@sublang/playbook 15.1.0 → 17.0.0

package/src/xstate-playbook-runtime.js

@@ -117,8 +117,8 @@ export function playerFailureCause(input) {
 /**
  * DR-063 §1: the cause of an unresolved governed settlement. A reconciled
  * mismatch supplies its own receipt-read cause; the reasons a runtime owns map
- * to adjudication, abort, and runtime-defect codes. Shared with DECIDE's
- * bespoke runtime, which decides the same reasons.
+ * to adjudication, abort, and runtime-defect codes. Exported so linked
+ * machinery of an artifact's own decides the same reasons.
  */
 export function governedSettlementCause(reason, error, aborted, supplied) {
     if (supplied !== undefined)
@@ -157,6 +157,24 @@ export function createFailureCauseRetention() {
         },
     };
 }
+/**
+ * DR-063 §2: the value an invoked actor's rejection carried into the machine,
+ * read from the XState error event that delivered it, or `undefined` for any
+ * other event.
+ */
+function actorErrorOf(event) {
+    if (typeof event !== 'object' || event === null)
+        return undefined;
+    try {
+        const { type, error } = event;
+        return typeof type === 'string' && type.startsWith('xstate.error.actor.')
+            ? error
+            : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
 // ---------------------------------------------------------------------------
 // DR-028: both call boundaries treat an `ok` result whose `finalText` is
 // missing, empty, or whitespace-only under one empty predicate, and that
@@ -242,7 +260,7 @@ function configuredOptionsFromFactoryInput(value, label) {
         effectLedger: effectLedger,
     };
 }
-function repositoryCapabilityFromHostCapabilities(hostCapabilities, label) {
+function repositoryCapabilityFromHostCapabilities(hostCapabilities, label, requireCohort = false) {
     const descriptor = hostCapabilities === undefined
         ? undefined
         : Object.getOwnPropertyDescriptor(hostCapabilities, 'repository');
@@ -256,8 +274,13 @@ function repositoryCapabilityFromHostCapabilities(hostCapabilities, label) {
         Array.isArray(repository) ||
         typeof repository.runExclusive !==
             'function' ||
-        typeof repository.runDeferred !== 'function') {
-        throw new TypeError(`${label} schema-3 factory input hostCapabilities.repository must be an own data property exposing runExclusive and runDeferred`);
+        typeof repository.runDeferred !==
+            'function' ||
+        (requireCohort &&
+            typeof repository.runCohort !== 'function')) {
+        throw new TypeError(requireCohort
+            ? `${label} schema-3 factory input hostCapabilities.repository must be an own data property exposing runExclusive, runCohort, and runDeferred`
+            : `${label} schema-3 factory input hostCapabilities.repository must be an own data property exposing runExclusive and runDeferred`);
     }
     return repository;
 }
@@ -448,7 +471,7 @@ export function normalizeErrorFull(err) {
 // slc/link.md §Abort: cancellation is causal identity with the applicable
 // signal's reason — never an `AbortError` name, never bare signal state. A
 // distinct failure observed while the signal is aborted stays a non-abort
-// control error and takes precedence (mirrors DECIDE's bespoke reference).
+// control error and takes precedence.
 function isAbortFailure(error, signal) {
     return signal.aborted && Object.is(error, signal.reason);
 }
@@ -479,7 +502,32 @@ function pendingBossQuestionForState(state, context) {
 }
 /** Read the FSM context's single pending Boss question, when well-formed. */
 export function pendingBossQuestionFromContext(context) {
-    const pending = context.pendingBossQuestion;
+    return pendingBossQuestionRecord(context.pendingBossQuestion);
+}
+/**
+ * DR-067 §1: the keyed form of gears2fsm's Boss-reply suspension. Each
+ * well-formed `context.pendingBossQuestions[stateId]` record whose own
+ * `questionId` equals its key counts only while a wait state that resumes
+ * its `resumeStateId` is active, so an answered question the context
+ * retains for the resumed prompt never reads as pending. Ordered by
+ * question id.
+ */
+function keyedPendingBossQuestions(context, resumesFromActiveWait) {
+    const keyed = context.pendingBossQuestions;
+    if (!isPlainObject(keyed))
+        return [];
+    const pending = [];
+    for (const [key, value] of Object.entries(keyed)) {
+        const record = pendingBossQuestionRecord(value);
+        if (record === undefined || record.questionId !== key)
+            continue;
+        if (!resumesFromActiveWait(record.resumeStateId))
+            continue;
+        pending.push(record);
+    }
+    return pending.sort((left, right) => left.questionId.localeCompare(right.questionId));
+}
+function pendingBossQuestionRecord(pending) {
     if (pending === undefined ||
         pending === null ||
         typeof pending !== 'object') {
@@ -851,8 +899,8 @@ export function defaultBuildJudgePrompt(input, finalText) {
  * so the judge omits it. Rendering the clause verbatim asked the judge for
  * `question`, `planningResult`, or `evaluatedRevision`, which the reconciler
  * rejects as a structural error, spending the single correction on a
- * self-inflicted defect. Exported so a bespoke linked runtime (DECIDE's
- * parallel machinery) renders the identical contract instead of restating it.
+ * self-inflicted defect. Exported so linked machinery of an artifact's own
+ * renders the identical contract instead of restating it.
  */
 export function renderGovernedOutcomeContract(guard, description, outcome) {
     const { meaning, clause } = splitOutputClause(description);
@@ -918,6 +966,7 @@ function buildGovernedJudgePrompt(input, finalText, outcomes, correction) {
         '```',
         '',
         'Pick exactly one declared `guard` and reply with exactly that outcome\'s reply shape below: `guard` plus its semantic-owned fields and nothing else.',
+        'If no declared outcome matches the player output, instead reply exactly {"blocked":"explain the missing outcome or contradictory requirements"}. Never force a match or invent a guard. A blocked reply pauses the playbook for Boss; it is not completion.',
         'A field listed as runtime-supplied is owned by presentation, effect, or runtime evidence; the runtime fills it itself, and a reply that includes one is structurally invalid.',
         '',
     ];
@@ -997,7 +1046,7 @@ function validateBossReplyOutput(input, output, resumableStateIds) {
     }
 }
 export function createPlayerBridge(spec, ports, getActiveSignal, boundary, onControlPlaneError) {
-    return fromPromise(async ({ input, signal }) => {
+    const execute = async ({ input, signal }) => {
         const activeSignal = combineAbortSignals(signal, getActiveSignal?.());
         let roleId;
         let prompt;
@@ -1040,7 +1089,7 @@ export function createPlayerBridge(spec, ports, getActiveSignal, boundary, onCon
         }
         if (result.status !== 'ok') {
             const failure = new Error(result.error ?? `captainBridge: callPlayer status "${result.status}"`);
-            throw boundary?.markPlayerResultFailure?.(failure) ?? failure;
+            throw boundary?.markPlayerResultFailure?.(failure, result) ?? failure;
         }
         const finalText = result.finalText ?? '';
         if (isEmptyFinalText(finalText)) {
@@ -1065,7 +1114,9 @@ export function createPlayerBridge(spec, ports, getActiveSignal, boundary, onCon
             }
             throw error;
         }
-    });
+    };
+    return fromPromise((args) => spec.run
+        ? spec.run(args.input, args.signal, () => execute(args)) : execute(args));
 }
 // ---------------------------------------------------------------------------
 // Direct-Captain adjudication (slc/link.md §Captain adjudication). The judge
@@ -1220,20 +1271,293 @@ function transitionTargets(transition) {
     }
     return targets;
 }
-/** Targets of the FSM's `awaitBossReply` BOSS_REPLY transitions. */
+function transitionArmTargets(transition) {
+    const arms = Array.isArray(transition) ? transition : [transition];
+    const targets = [];
+    for (const arm of arms) {
+        if (typeof arm === 'string') {
+            targets.push(arm);
+        }
+        else if (isPlainObject(arm) && typeof arm.target === 'string') {
+            targets.push(arm.target);
+        }
+    }
+    return targets;
+}
+function playbookStateIdOf(stateDef) {
+    if (!isPlainObject(stateDef) || !isPlainObject(stateDef.meta)) {
+        return undefined;
+    }
+    const playbook = stateDef.meta.playbook;
+    return isPlainObject(playbook) && typeof playbook.stateId === 'string'
+        ? playbook.stateId
+        : undefined;
+}
+function stateTagsOf(stateDef) {
+    const tags = stateDef.tags;
+    if (typeof tags === 'string')
+        return [tags];
+    return Array.isArray(tags)
+        ? tags.filter((tag) => typeof tag === 'string')
+        : [];
+}
+/** Every explicit node `id` in the config, mapped to its playbook state id. */
+function playbookStateIdsByNodeId(config) {
+    const byNodeId = new Map();
+    const visit = (stateDef) => {
+        if (!isPlainObject(stateDef))
+            return;
+        const stateId = playbookStateIdOf(stateDef);
+        if (typeof stateDef.id === 'string' && stateId !== undefined) {
+            byNodeId.set(stateDef.id, stateId);
+        }
+        if (isPlainObject(stateDef.states)) {
+            for (const child of Object.values(stateDef.states))
+                visit(child);
+        }
+    };
+    if (isPlainObject(config) && isPlainObject(config.states)) {
+        for (const child of Object.values(config.states))
+            visit(child);
+    }
+    return byNodeId;
+}
+/**
+ * One transition target written inside a parallel region, resolved to the
+ * playbook state id it names: an `#id` reference through the node ids, and a
+ * bare sibling key through the region's own leaves.
+ */
+function resolveRegionTarget(target, regionStates, byNodeId) {
+    if (target.startsWith('#')) {
+        const nodeId = target.slice(1);
+        return byNodeId.get(nodeId) ?? nodeId;
+    }
+    if (Object.prototype.hasOwnProperty.call(regionStates, target)) {
+        return playbookStateIdOf(regionStates[target]) ?? target;
+    }
+    return target;
+}
+/**
+ * Targets of the FSM's `awaitBossReply` BOSS_REPLY transitions, plus — for
+ * the parallel shape gears2fsm compiles (DR-067) — the targets of each
+ * region wait leaf's branch-local BOSS_REPLY arms, resolved to state ids.
+ */
 export function resumableStateIdsFromMachine(machine) {
     const config = machine.config;
     if (!isPlainObject(config) || !isPlainObject(config.states)) {
         return new Set();
     }
+    const resumable = new Set();
     const awaitState = config.states[BOSS_REPLY_WAIT_STATE_ID];
-    if (!isPlainObject(awaitState) || !isPlainObject(awaitState.on)) {
-        return new Set();
+    if (isPlainObject(awaitState) && isPlainObject(awaitState.on)) {
+        const bossReply = awaitState.on.BOSS_REPLY;
+        if (bossReply !== undefined) {
+            for (const target of transitionTargets(bossReply))
+                resumable.add(target);
+        }
     }
-    const bossReply = awaitState.on.BOSS_REPLY;
-    if (bossReply === undefined)
-        return new Set();
-    return new Set(transitionTargets(bossReply));
+    const byNodeId = playbookStateIdsByNodeId(config);
+    for (const stateDef of Object.values(config.states)) {
+        if (!isPlainObject(stateDef) ||
+            stateDef.type !== 'parallel' ||
+            !isPlainObject(stateDef.states)) {
+            continue;
+        }
+        for (const region of Object.values(stateDef.states)) {
+            if (!isPlainObject(region) || !isPlainObject(region.states))
+                continue;
+            const regionStates = region.states;
+            for (const leaf of Object.values(regionStates)) {
+                if (!isPlainObject(leaf) || !isPlainObject(leaf.on))
+                    continue;
+                const bossReply = leaf.on.BOSS_REPLY;
+                if (bossReply === undefined)
+                    continue;
+                for (const target of transitionArmTargets(bossReply)) {
+                    resumable.add(resolveRegionTarget(target, regionStates, byNodeId));
+                }
+            }
+        }
+    }
+    return resumable;
+}
+function malformedParallelState(label, key, reason) {
+    return new Error(`${label} parallel state ${key} is not the compiled parallel shape: ${reason}`);
+}
+/**
+ * DR-067 §1 / PBRT-52: the factory's domain is flat root states plus root
+ * `type: 'parallel'` states of the one shape gears2fsm compiles — each
+ * region a compound state with exactly one player-invoking `playbook.busy`
+ * working leaf, exactly one `playbook.parked` wait leaf whose BOSS_REPLY
+ * arms resume that working leaf, and exactly one final leaf, every leaf
+ * carrying a stable `meta.playbook.stateId` distinct from every other
+ * state's, and the parent's `onDone` the join. Any other compound state
+ * keeps the flat-domain rejection. Returns `undefined` for a flat machine.
+ */
+function parallelProfileFromMachine(machine, label) {
+    const config = machine.config;
+    if (!isPlainObject(config) || !isPlainObject(config.states)) {
+        return undefined;
+    }
+    const rootStates = config.states;
+    const parallelKeys = Object.entries(rootStates)
+        .filter(([, stateDef]) => isPlainObject(stateDef) && stateDef.type === 'parallel')
+        .map(([key]) => key);
+    for (const stateDef of Object.values(rootStates)) {
+        if (isPlainObject(stateDef) &&
+            stateDef.type !== 'parallel' &&
+            isPlainObject(stateDef.states) &&
+            Object.keys(stateDef.states).length > 0) {
+            throw new Error(`${label} declares a compound state; the shared runtime supports only flat single-region FSMs`);
+        }
+    }
+    if (parallelKeys.length === 0)
+        return undefined;
+    const byNodeId = playbookStateIdsByNodeId(config);
+    const seenStateIds = new Set();
+    for (const stateDef of Object.values(rootStates)) {
+        const stateId = playbookStateIdOf(stateDef);
+        if (stateId !== undefined)
+            seenStateIds.add(stateId);
+    }
+    const states = [];
+    const parallelStateByWorkingStateId = new Map();
+    const waitResumeTargets = new Map();
+    const transitionNodesByStateId = new Map();
+    for (const key of parallelKeys) {
+        const parent = rootStates[key];
+        if (parent.onDone === undefined) {
+            throw malformedParallelState(label, key, 'it declares no onDone join');
+        }
+        if (!isPlainObject(parent.states) || Object.keys(parent.states).length < 2) {
+            throw malformedParallelState(label, key, 'it must declare at least two regions');
+        }
+        const regions = [];
+        const roleIds = new Set();
+        for (const [regionKey, region] of Object.entries(parent.states)) {
+            const regionReason = (reason) => malformedParallelState(label, key, `region ${regionKey} ${reason}`);
+            if (!isPlainObject(region) ||
+                region.type === 'parallel' ||
+                region.type === 'final' ||
+                region.type === 'history' ||
+                !isPlainObject(region.states)) {
+                throw regionReason('must be a compound state of leaves');
+            }
+            const regionStates = region.states;
+            let working;
+            let wait;
+            let final;
+            for (const [leafKey, leaf] of Object.entries(regionStates)) {
+                if (!isPlainObject(leaf)) {
+                    throw regionReason(`leaf ${leafKey} must be a state object`);
+                }
+                if ((isPlainObject(leaf.states) && Object.keys(leaf.states).length > 0) ||
+                    leaf.type === 'parallel' ||
+                    leaf.type === 'history') {
+                    throw regionReason(`leaf ${leafKey} must be an atomic state`);
+                }
+                const leafStateId = playbookStateIdOf(leaf);
+                if (leafStateId === undefined || leafStateId.trim().length === 0) {
+                    throw regionReason(`leaf ${leafKey} must carry a string meta.playbook.stateId`);
+                }
+                if (seenStateIds.has(leafStateId)) {
+                    throw regionReason(`leaf ${leafKey} reuses playbook state id ${leafStateId}`);
+                }
+                seenStateIds.add(leafStateId);
+                const invoke = leaf.invoke;
+                const invokes = Array.isArray(invoke) ? invoke : invoke ? [invoke] : [];
+                const tags = stateTagsOf(leaf);
+                if (leaf.type === 'final') {
+                    if (final !== undefined)
+                        throw regionReason('declares two final leaves');
+                    final = [leafKey, leaf];
+                }
+                else if (invokes.length === 1 &&
+                    isPlainObject(invokes[0]) &&
+                    invokes[0].src === 'player' &&
+                    tags.includes('playbook.busy')) {
+                    if (working !== undefined) {
+                        throw regionReason('declares two working leaves');
+                    }
+                    working = [leafKey, leaf];
+                }
+                else if (invokes.length === 0 &&
+                    tags.includes('playbook.parked') &&
+                    isPlainObject(leaf.on) &&
+                    leaf.on.BOSS_REPLY !== undefined) {
+                    if (wait !== undefined)
+                        throw regionReason('declares two wait leaves');
+                    wait = [leafKey, leaf];
+                }
+                else {
+                    throw regionReason(`leaf ${leafKey} is neither its player-invoking playbook.busy working leaf, its playbook.parked BOSS_REPLY wait leaf, nor its final leaf`);
+                }
+            }
+            if (working === undefined || wait === undefined || final === undefined) {
+                throw regionReason('must hold exactly one working leaf, one wait leaf, and one final leaf');
+            }
+            if (region.initial !== working[0]) {
+                throw regionReason('must start in its working leaf');
+            }
+            const workingStateId = playbookStateIdOf(working[1]);
+            const waitStateId = playbookStateIdOf(wait[1]);
+            const finalStateId = playbookStateIdOf(final[1]);
+            const replyTargets = transitionArmTargets(wait[1].on.BOSS_REPLY).map((target) => resolveRegionTarget(target, regionStates, byNodeId));
+            const regionStateIds = new Set([waitStateId, finalStateId]);
+            if (!replyTargets.includes(workingStateId) ||
+                replyTargets.some((target) => regionStateIds.has(target))) {
+                throw regionReason('wait leaf BOSS_REPLY arms must resume its working leaf');
+            }
+            const workingMeta = working[1].meta
+                .playbook;
+            const roleId = workingMeta.role;
+            if (typeof roleId !== 'string' || roleId.trim().length === 0) {
+                throw regionReason('working leaf must declare meta.playbook.role');
+            }
+            if (roleIds.has(roleId)) {
+                throw malformedParallelState(label, key, `role ${roleId} works in more than one region`);
+            }
+            roleIds.add(roleId);
+            regions.push({
+                key: regionKey,
+                roleId,
+                workingStateId,
+                waitStateId,
+                finalStateId,
+            });
+            waitResumeTargets.set(waitStateId, new Set([workingStateId]));
+            for (const [, leaf] of [working, wait, final]) {
+                transitionNodesByStateId.set(playbookStateIdOf(leaf), [region, leaf]);
+            }
+        }
+        const parallelState = {
+            stateId: key,
+            regions: Object.freeze(regions),
+        };
+        states.push(parallelState);
+        for (const region of regions) {
+            parallelStateByWorkingStateId.set(region.workingStateId, parallelState);
+        }
+        transitionNodesByStateId.set(key, [parent]);
+    }
+    for (const [key, stateDef] of Object.entries(rootStates)) {
+        if (!isPlainObject(stateDef) || parallelKeys.includes(key))
+            continue;
+        transitionNodesByStateId.set(key, [stateDef]);
+    }
+    const rootWait = rootStates[BOSS_REPLY_WAIT_STATE_ID];
+    if (isPlainObject(rootWait) && isPlainObject(rootWait.on)) {
+        const bossReply = rootWait.on.BOSS_REPLY;
+        if (bossReply !== undefined) {
+            waitResumeTargets.set(BOSS_REPLY_WAIT_STATE_ID, new Set(transitionTargets(bossReply)));
+        }
+    }
+    return Object.freeze({
+        states: Object.freeze(states),
+        parallelStateByWorkingStateId,
+        waitResumeTargets,
+        transitionNodesByStateId,
+    });
 }
 // ---------------------------------------------------------------------------
 // DR-029 control surface: the FSM's explicit-state-jump event and the
@@ -1654,10 +1978,11 @@ function makeDefaultStatusesForState(roleStates) {
             }
             return [
                 ...statuses,
-                { message: `${askerLabel(pending.asker)} asks: ${pending.question}` },
+                { message: `${askerLabel(pending.asker)} asks: ${pending.question}`, data: { kind: 'boss-question' } },
                 {
                     message: `◆ awaiting Boss reply · ${pending.resumeStateId} · ` +
                         `${askerLabel(pending.asker)} · ${pending.sourceItem}`,
+                    data: { kind: 'boss-question' },
                 },
             ];
         }
@@ -1840,7 +2165,48 @@ function eventContractPrompt(contract) {
     ]);
     return `{ ${members.join(', ')} }${notes.length === 0 ? '' : ` (${notes.join('; ')})`}`;
 }
-function makeDefaultClassifyBossText(machine, entryEvent, bossEvents) {
+/**
+ * DR-067 §1: the questions pending in a parallel-declaring machine — the
+ * keyed records whose resume state an active wait state (a region wait leaf
+ * or the root reply wait) resumes.
+ */
+function parallelPendingBossQuestions(profile, activeStateIds, context) {
+    return keyedPendingBossQuestions(context, (resumeStateId) => activeStateIds.some((stateId) => profile.waitResumeTargets.get(stateId)?.has(resumeStateId) === true));
+}
+/** Event types the root and every active state node of a parallel machine configure. */
+function parallelConfiguredEventTypes(machine, profile, activeStateIds) {
+    const configured = new Set();
+    const config = machine.config;
+    if (!isPlainObject(config))
+        return configured;
+    if (isPlainObject(config.on)) {
+        for (const type of Object.keys(config.on))
+            configured.add(type);
+    }
+    for (const stateId of activeStateIds) {
+        for (const node of profile.transitionNodesByStateId.get(stateId) ?? []) {
+            if (!isPlainObject(node.on))
+                continue;
+            for (const type of Object.keys(node.on))
+                configured.add(type);
+        }
+    }
+    return configured;
+}
+function activeStateIdsOf(snapshotOrState) {
+    const listed = snapshotOrState
+        ?.activeStateIds;
+    if (Array.isArray(listed)) {
+        return listed.filter((stateId) => typeof stateId === 'string');
+    }
+    try {
+        return normalizePlaybookSnapshot(snapshotOrState).activeStateIds;
+    }
+    catch {
+        return [];
+    }
+}
+function makeDefaultClassifyBossText(machine, entryEvent, bossEvents, parallelProfile) {
     const contracts = defaultBossEventSpecs(machine, entryEvent, bossEvents);
     return async (text, ports, signal, snapshotOrState, boundary) => {
         const trimmed = text.trim();
@@ -1854,12 +2220,41 @@ function makeDefaultClassifyBossText(machine, entryEvent, bossEvents) {
         // is answered history, so the prompt must not present it as pending —
         // a judge told a question awaits at the failure state is steered toward
         // a reply it cannot select or toward no action at all.
-        const pending = stateId === BOSS_REPLY_WAIT_STATE_ID
-            ? pendingBossQuestionFromContext(state.context)
-            : undefined;
-        const configuredTypes = configuredEventTypesForState(machine, stateId);
-        const applicable = [...contracts.values()].filter((contract) => configuredTypes.has(contract.type) &&
-            (contract.type !== 'BOSS_REPLY' || pending !== undefined));
+        let pendingQuestions;
+        let configuredTypes;
+        if (parallelProfile === undefined) {
+            const pending = stateId === BOSS_REPLY_WAIT_STATE_ID
+                ? pendingBossQuestionFromContext(state.context)
+                : undefined;
+            pendingQuestions = pending === undefined ? [] : [pending];
+            configuredTypes = configuredEventTypesForState(machine, stateId);
+        }
+        else {
+            // DR-067 §1: every question pending in any active wait is offered, and
+            // the events of every active state node apply.
+            const activeStateIds = activeStateIdsOf(snapshotOrState);
+            pendingQuestions = parallelPendingBossQuestions(parallelProfile, activeStateIds, state.context);
+            configuredTypes = parallelConfiguredEventTypes(machine, parallelProfile, activeStateIds);
+        }
+        // Several pending questions: a reply must name the one it answers, and
+        // the classifier never guesses among them (gears2fsm §Parallel groups).
+        const severalPending = pendingQuestions.length > 1;
+        const applicable = [...contracts.values()]
+            .filter((contract) => configuredTypes.has(contract.type) &&
+            (contract.type !== 'BOSS_REPLY' || pendingQuestions.length > 0))
+            .map((contract) => contract.type === 'BOSS_REPLY' && severalPending
+            ? {
+                type: 'BOSS_REPLY',
+                fields: {
+                    questionId: {
+                        source: 'judge',
+                        required: true,
+                        values: pendingQuestions.map(({ questionId }) => questionId),
+                    },
+                    answer: { source: 'text', required: true },
+                },
+            }
+            : contract);
         const lines = [
             'Classify the following Boss message into exactly one event.',
             'Respond with one exact flat JSON object. Do not add fields that are not shown.',
@@ -1867,9 +2262,12 @@ function makeDefaultClassifyBossText(machine, entryEvent, bossEvents) {
             '',
             `Current state: ${currentState}`,
         ];
-        if (pending !== undefined) {
+        for (const pending of pendingQuestions) {
             lines.push(`Pending question id: ${pending.questionId}`, `Pending asker: ${askerLabel(pending.asker)}`, `Pending Boss question: ${pending.question}`);
         }
+        if (severalPending) {
+            lines.push('Several Boss questions are pending: a BOSS_REPLY must name the questionId of the one question it answers.');
+        }
         lines.push('', 'Allowed JSON objects:', '- { "type": "NO_ACTION" }');
         for (const contract of applicable) {
             lines.push(`- ${eventContractPrompt(contract)}`);
@@ -1940,16 +2338,19 @@ function makeDefaultClassifyBossText(machine, entryEvent, bossEvents) {
             event[field] = value;
         }
         if (eventType === 'BOSS_REPLY') {
-            if (pending === undefined) {
+            if (pendingQuestions.length === 0) {
                 await ports.emitStatus('Classifier returned BOSS_REPLY without a pending question');
                 return undefined;
             }
-            const questionId = event.questionId;
-            if (questionId !== undefined && questionId !== pending.questionId) {
-                await ports.emitStatus(`Classifier supplied unknown questionId for BOSS_REPLY: ${String(questionId)}`);
-                return undefined;
+            if (!severalPending) {
+                const pending = pendingQuestions[0];
+                const questionId = event.questionId;
+                if (questionId !== undefined && questionId !== pending.questionId) {
+                    await ports.emitStatus(`Classifier supplied unknown questionId for BOSS_REPLY: ${String(questionId)}`);
+                    return undefined;
+                }
+                event.questionId = pending.questionId;
             }
-            event.questionId = pending.questionId;
         }
         const can = snapshotOrState?.can;
         if (typeof can === 'function' &&
@@ -1960,33 +2361,6 @@ function makeDefaultClassifyBossText(machine, entryEvent, bossEvents) {
         return event;
     };
 }
-function machineDeclaresParallelState(machine) {
-    const visit = (stateDef) => {
-        if (!isPlainObject(stateDef))
-            return false;
-        if (stateDef.type === 'parallel')
-            return true;
-        if (!isPlainObject(stateDef.states))
-            return false;
-        return Object.values(stateDef.states).some(visit);
-    };
-    return visit(machine.config);
-}
-// PBRT-52: the factory's domain is FLAT single-region machines — every
-// state a direct child of the root, so each snapshot exposes exactly one
-// playbook state id and every state-keyed lookup (deterministic entries,
-// retry, reply-wait pendingness, configured events, descriptions) indexes
-// one unambiguous identity. A compound child would be accepted and then
-// silently misbehave on all of those gates, so it is rejected up front
-// exactly like a parallel region.
-function machineDeclaresNestedState(machine) {
-    const config = machine.config;
-    if (!isPlainObject(config) || !isPlainObject(config.states))
-        return false;
-    return Object.values(config.states).some((stateDef) => isPlainObject(stateDef) &&
-        isPlainObject(stateDef.states) &&
-        Object.keys(stateDef.states).length > 0);
-}
 // PBRT-52: the factory's lookups index states by their root key, and the
 // published playbook identity is `meta.playbook.stateId` — the two must
 // coincide or a machine can advertise a pending question or retry under an
@@ -2065,12 +2439,9 @@ export function createXStatePlaybookRuntime(machine, spec) {
     if (Object.prototype.hasOwnProperty.call(specDescriptors, 'resolvePlayerId')) {
         throw new TypeError(`${label} artifacts must not derive concrete player bindings`);
     }
-    if (machineDeclaresParallelState(machine)) {
-        throw new Error(`${label} uses a parallel state; the shared runtime supports only single-region FSMs`);
-    }
-    if (machineDeclaresNestedState(machine)) {
-        throw new Error(`${label} declares a compound state; the shared runtime supports only flat single-region FSMs`);
-    }
+    // DR-067 §1: a flat machine, or one whose only compound states are root
+    // parallel states of the compiled shape; everything else is rejected.
+    const parallelProfile = parallelProfileFromMachine(machine, label);
     assertFlatStateIdentity(machine, label);
     assertUnfinishedFinalStateIds(spec.unfinishedFinalStateIds, machine, label);
     const retainedGenerationMetadata = spec.unfinishedFinalStateIds === undefined
@@ -2098,6 +2469,17 @@ export function createXStatePlaybookRuntime(machine, spec) {
     const declaredRoleIds = Object.freeze([
         ...new Set([...roleStates.values()].map(({ role }) => role)),
     ]);
+    // DR-067 §1: the Boss-relevant states of a parallel-declaring machine —
+    // each player state, each wait state, and the failure state. A status is
+    // scheduled for each one newly entered, and a status trace names a
+    // `stateId` only while exactly one is active.
+    const bossRelevantStateIds = parallelProfile === undefined
+        ? undefined
+        : new Set([
+            ...roleStates.keys(),
+            ...parallelProfile.waitResumeTargets.keys(),
+            'failed',
+        ]);
     // PBRT-52: the artifact's own ControlView context projection. Nothing is
     // exported by default, so an FSM context member — including one added
     // after this artifact was linked — is private until named here. The two
@@ -2136,7 +2518,7 @@ export function createXStatePlaybookRuntime(machine, spec) {
     // supplied `bossEvents`, and DR-019 §2 requires a conflicting duplicate to
     // fail factory construction whether or not this spec overrides the
     // classifier that would have consumed the contracts.
-    const derivedClassifyBossText = makeDefaultClassifyBossText(machine, spec.entryEvent, spec.bossEvents ?? []);
+    const derivedClassifyBossText = makeDefaultClassifyBossText(machine, spec.entryEvent, spec.bossEvents ?? [], parallelProfile);
     const classifyBossText = spec.classifyBossText ?? derivedClassifyBossText;
     const normalizeTransitionEvent = spec.normalizeTransitionEvent ??
         makeDefaultNormalizeTransitionEvent(spec.transitionEventFields ?? []);
@@ -2151,6 +2533,95 @@ export function createXStatePlaybookRuntime(machine, spec) {
             const cwd = options?.cwd;
             return typeof cwd === 'string' ? cwd : undefined;
         });
+    // DR-067 §1: the questions pending in a state — the singular reply-wait
+    // question of a flat machine, or a parallel machine's keyed questions
+    // whose own wait state is active.
+    const pendingBossQuestionsFor = (state, context) => {
+        if (parallelProfile === undefined) {
+            const pending = pendingBossQuestionForState(state, context);
+            return pending === undefined ? [] : [pending];
+        }
+        return parallelPendingBossQuestions(parallelProfile, state.activeStateIds, context);
+    };
+    const singlePendingBossQuestion = (state, context) => {
+        const pending = pendingBossQuestionsFor(state, context);
+        return pending.length === 1 ? pending[0] : undefined;
+    };
+    // DR-067 §1: a status trace names a `stateId` only while exactly one
+    // Boss-relevant state is active; a flat machine's is its one state.
+    const statusTraceStateId = (state) => {
+        if (bossRelevantStateIds === undefined)
+            return state.stateId;
+        const relevant = state.activeStateIds.filter((stateId) => bossRelevantStateIds.has(stateId));
+        return relevant.length === 1 ? relevant[0] : undefined;
+    };
+    // DR-067 §1: a parallel machine schedules statuses for each newly entered
+    // Boss-relevant state — a player state's role line, a wait state's
+    // question lines, and the failure line — diffed against the previous
+    // snapshot's active state ids, so a sibling still running is not
+    // announced again.
+    const parallelStatusesFor = (previousState, state, context) => {
+        const prior = new Set(previousState?.activeStateIds ?? []);
+        const statuses = [];
+        for (const stateId of state.activeStateIds) {
+            if (prior.has(stateId) || !bossRelevantStateIds.has(stateId))
+                continue;
+            const resumeTargets = parallelProfile.waitResumeTargets.get(stateId);
+            if (resumeTargets !== undefined) {
+                const questions = keyedPendingBossQuestions(context, (resumeStateId) => resumeTargets.has(resumeStateId));
+                if (questions.length === 0) {
+                    statuses.push({ message: 'Awaiting Boss reply.' });
+                    continue;
+                }
+                for (const pending of questions) {
+                    statuses.push({
+                        message: `${askerLabel(pending.asker)} asks: ${pending.question}`,
+                        data: { kind: 'boss-question' },
+                    }, {
+                        message: `◆ awaiting Boss reply · ${pending.resumeStateId} · ` +
+                            `${askerLabel(pending.asker)} · ${pending.sourceItem}`,
+                        data: { kind: 'boss-question' },
+                    });
+                }
+                continue;
+            }
+            if (stateId === 'failed') {
+                const lastError = normalizeErrorCompact(context.lastError);
+                statuses.push({
+                    message: '◆ workflow failed; awaiting Boss recovery.',
+                    ...(lastError === undefined
+                        ? {}
+                        : {
+                            data: snapshotJsonValue({ lastError }, 'failed status data'),
+                        }),
+                });
+                continue;
+            }
+            const roleState = roleStates.get(stateId);
+            if (roleState !== undefined) {
+                statuses.push({ message: `⤷ ${roleState.role}: ${roleState.label}` });
+            }
+        }
+        return statuses;
+    };
+    // DR-067 §1: each parallel state's region roles, in region order, are one
+    // concurrent role set the FSM exports; a host that forwards those sets in
+    // its schema-3 authority is held to them before any agent call.
+    const assertDeclaredCohorts = (hostCapabilities) => {
+        const authority = Object.getOwnPropertyDescriptor(hostCapabilities, 'authority')?.value;
+        if (!isPlainObject(authority) || !Array.isArray(authority.concurrentRoleSets)) {
+            return;
+        }
+        const declared = authority.concurrentRoleSets;
+        for (const parallelState of parallelProfile.states) {
+            const roles = parallelState.regions.map(({ roleId }) => roleId);
+            if (!declared.some((candidate) => Array.isArray(candidate) &&
+                candidate.length === roles.length &&
+                candidate.every((roleId, index) => roleId === roles[index]))) {
+                throw new TypeError(`${label} parallel state ${parallelState.stateId} roles [${roles.join(', ')}] are not a declared concurrent role set`);
+            }
+        }
+    };
     const createPlaybookRuntime = function createPlaybookRuntime(factoryOptions) {
         const construction = configuredOptionsFromFactoryInput(factoryOptions, label);
         const configuredOptions = construction.configuredOptions;
@@ -2166,10 +2637,14 @@ export function createXStatePlaybookRuntime(machine, spec) {
                 Object.prototype.hasOwnProperty.call(declarations, acceptedOutcome));
         });
         const repositoryCapability = hasGovernedPlayerStates
-            ? repositoryCapabilityFromHostCapabilities(construction.hostCapabilities, label)
+            ? repositoryCapabilityFromHostCapabilities(construction.hostCapabilities, label, parallelProfile !== undefined)
             : undefined;
+        if (parallelProfile !== undefined) {
+            assertDeclaredCohorts(construction.hostCapabilities);
+        }
         const currentEffectLedger = () => assertPlaybookEffectLedger(effectLedgerCapability.snapshot(), `${label} current host effect ledger`);
         let effectLedgerMirror = currentEffectLedger();
+        let recoveryCheckpoint;
         let retainedEffectSourceSessionId;
         let retainedEffectReconciliation;
         let retainedEffectReconciliationRequired = false;
@@ -2202,9 +2677,11 @@ export function createXStatePlaybookRuntime(machine, spec) {
         // mutable `activeSignal` alone cannot classify a late invocation reason.
         let activeAborts;
         // The bridge binds the provenance of a child result immediately before
-        // its promise actor settles. The next root snapshot/error consumes this
-        // one-shot so background settlement emissions retain their owner.
-        let actorSettlementAborts;
+        // its promise actor settles. The next root snapshot/error consumes it so
+        // background settlement emissions retain their owner. A flat machine has
+        // one settling actor at a time, so a later binding replaces an unconsumed
+        // one; a parallel machine's settlements queue in order (DR-067 §1).
+        const actorSettlementAborts = [];
         let actorSettlementErrorAborts;
         // Exact cancellation observed by an emission owned by the active
         // boundary. Ordinary runs settle from their signal/state; apply also
@@ -2235,11 +2712,29 @@ export function createXStatePlaybookRuntime(machine, spec) {
         // each successful result, so it is never stale.
         let pendingResultFailureCause;
         // DR-063 §2: the causes decided for thrown values that cannot carry the
-        // marker — a string, a frozen error — kept by identity for as long as the
+        // marker — a string, a frozen error — and for the record a machine keeps
+        // in place of the thrown value, kept by identity for as long as the
         // failure stands, so every surface that reads the FSM's own `lastError`
-        // publishes the cause decided for exactly that value, whatever turn reads
-        // it.
+        // publishes the cause decided for exactly that failure, whatever turn
+        // reads it.
         const failureCauses = createFailureCauseRetention();
+        // DR-063 §2 / DR-067 §1: the cause decided for each non-`ok` player
+        // result, keyed by the result itself, so concurrent region calls never
+        // lend one another the single slot above.
+        const resultFailureCauses = new WeakMap();
+        // DR-067 §1: the parallel profile's cohort bookkeeping. Every public
+        // boundary advances the sequence; a parallel state's working leaves run
+        // as one cohort at most once per boundary, and each cohort's semantic
+        // completions — which the host settles concurrently — reconcile one at a
+        // time so their durable correction-budget writes cannot race.
+        let publicBoundarySequence = 0;
+        const consumedCohortBoundaries = new Map();
+        const pendingCohorts = new Map();
+        const cohortCompletionQueue = new PQueue({ concurrency: 1 });
+        // DR-067 §1: every player, judge, and nested call a parallel machine
+        // starts, so a boundary's drain waits for a cancelled sibling whose port
+        // ignores its signal before it settles.
+        const activeBoundaryCalls = new Set();
         // Previous root-machine state for the inspect-driven telemetry /
         // status emitter. undefined before the first inspect firing.
         let priorState;
@@ -2251,12 +2746,6 @@ export function createXStatePlaybookRuntime(machine, spec) {
         let playbookCallSequence = 0;
         let captainCallSequence = 0;
         let applyCallSequence = 0;
-        // DR-029: the last event a public Boss boundary sent into the
-        // machine — classified, deterministic entry, or Boss reply — kept with
-        // its recorded payload so a failure-state retry action can replay the
-        // event that drove the run into `failed`. Process-local: the durable
-        // runtime snapshot does not persist it (PBRT-50).
-        let lastBossEvent;
         // DR-029: process-local at-most-once `apply` execution — the accepted receipt
         // recorded for each idempotency key, returned verbatim on a repeated
         // key. A key whose call settled `rejected` or threw before reaching
@@ -2431,7 +2920,7 @@ export function createXStatePlaybookRuntime(machine, spec) {
         // cumulative receipt from its original baseline, not by its own step.
         function boundaryExcludesEffect(boundary) {
             return (boundary.logicalOperationId === undefined &&
-                boundary.physicalReceipt?.classification === 'unchanged');
+                (boundary.physicalReceipt?.classification === 'unchanged' || boundary.restored !== undefined));
         }
         function boundaryNeedsSemanticReconciliation(candidate, ledger) {
             if (!runtimeBoundaryIsOwned(candidate))
@@ -2486,7 +2975,7 @@ export function createXStatePlaybookRuntime(machine, spec) {
             const candidate = reconstructedGovernedPrefixSequence === undefined
                 ? owned.at(-1)
                 : owned.find(({ sequence }) => sequence > reconstructedGovernedPrefixSequence);
-            if (candidate === undefined || candidate.sourceStateId !== state.stateId) {
+            if (candidate === undefined || candidate.restored !== undefined || candidate.sourceStateId !== state.stateId) {
                 return;
             }
             const persisted = persistedBoundaryReconciliation(candidate, ledger);
@@ -3015,7 +3504,7 @@ export function createXStatePlaybookRuntime(machine, spec) {
                         ...(descriptor !== undefined
                             ? {
                                 state: descriptor,
-                                ...stateIdentity(descriptor.stateId),
+                                ...stateIdentity(statusTraceStateId(descriptor)),
                             }
                             : {}),
                     }, activeTurnId !== undefined ? { turnId: activeTurnId } : {});
@@ -3048,9 +3537,12 @@ export function createXStatePlaybookRuntime(machine, spec) {
         // its finish carries the receipt disposition and none of the
         // start-only fields, so it passes its own canonical pre-acceptance
         // base (slc/link.md §Playbook trace).
-        finishIdentity = identity) {
+        finishIdentity = identity, 
+        // DR-067 §1: the per-call abort classification a parallel machine's
+        // player pairs enqueue under; absent, the active boundary's.
+        aborts) {
             try {
-                await emitTrace(startedType, identity, position);
+                await emitTrace(startedType, identity, position, aborts);
             }
             catch (error) {
                 if (!isAbortFailure(error, signal))
@@ -3060,7 +3552,7 @@ export function createXStatePlaybookRuntime(machine, spec) {
                         ...finishIdentity,
                         status: isAbortFailure(error, signal) ? 'aborted' : 'error',
                         error: normalizeError(error),
-                    }, position);
+                    }, position, aborts);
                 }
                 catch {
                     // Preserve the start failure after one best-effort finish attempt.
@@ -3199,11 +3691,32 @@ export function createXStatePlaybookRuntime(machine, spec) {
                 ...(semanticCandidate === undefined ? {} : { semanticCandidate }),
                 correctionBudget: { limit: 1, spent: true },
             };
+            // DR-067 §1 / PBRT-69: a cohort's shared receipt becomes visible for
+            // every member in one ledger revision — publishing only this member's
+            // spend would leave the invalid half-complete cohort the ledger admits
+            // nowhere.
+            const cohortMembers = current.cohortId === undefined
+                ? [current]
+                : currentLedger.boundaries.filter(({ cohortId }) => cohortId === current.cohortId);
+            const replacements = cohortMembers.map((member) => {
+                if (member.boundaryId === current.boundaryId) {
+                    return { expected: current, next };
+                }
+                if (member.physicalReceipt !== undefined &&
+                    !isDeepStrictEqual(member.physicalReceipt, receipt)) {
+                    throw new TypeError(`${label} correction budget cohort conflicts with its shared repository receipt`);
+                }
+                return {
+                    expected: member,
+                    next: {
+                        ...member,
+                        ...(receipt.after === undefined ? {} : { after: receipt.after }),
+                        physicalReceipt: receipt,
+                    },
+                };
+            });
             const acknowledged = assertPlaybookEffectLedger(await effectLedgerCapability.writeAhead([
-                {
-                    kind: 'replace-boundaries',
-                    replacements: [{ expected: current, next }],
-                },
+                { kind: 'replace-boundaries', replacements },
             ]), `${label} semantic correction budget acknowledgement`);
             effectLedgerMirror = acknowledged;
             refreshRetainedEffectReconciliation(acknowledged);
@@ -3508,7 +4021,7 @@ export function createXStatePlaybookRuntime(machine, spec) {
                     governedOutput = undefined;
                 }
             }
-            else if (source === 'runExclusive' && value.deferredStatus !== undefined) {
+            else if (source !== 'runDeferred' && value.deferredStatus !== undefined) {
                 throw new TypeError(`${label} non-deferred settlement returned a deferred binding status`);
             }
             if (governedSettlement !== undefined) {
@@ -3578,47 +4091,397 @@ export function createXStatePlaybookRuntime(machine, spec) {
             return (boundaries.length > 0 &&
                 boundaries.every(({ physicalReceipt }) => physicalReceipt?.classification === 'unchanged'));
         }
-        function captureEffectLedgerPrefixSequence() {
-            if (!hasGovernedPlayerStates)
-                return undefined;
+        let acceptedStepResult;
+        let requiredRecoveryBaseline;
+        function captureRecoveryCheckpoint(stateId, prompt, boundaryPrefix) {
+            if (requiredRecoveryBaseline !== undefined)
+                return;
+            // Capture after the entry emissions drain: the invocation is now a
+            // real active child in XState's persisted snapshot, before host work.
+            const id = recoveryCheckpoint?.stateId === stateId ? recoveryCheckpoint.id : undefined;
+            recoveryCheckpoint = undefined;
+            if (!actor || currentState().stateId !== stateId)
+                return;
             try {
                 const current = currentEffectLedger();
-                effectLedgerMirror = current;
-                refreshRetainedEffectReconciliation(current);
-                return current.boundaries.at(-1)?.sequence ?? 0;
+                recoveryCheckpoint = deepFreeze({
+                    stateId,
+                    prompt,
+                    ...(id === undefined ? {} : { id }),
+                    machine: detachPersistedMachineSnapshot(actor.getPersistedSnapshot()),
+                    boundaryPrefix: boundaryPrefix ?? current.boundaries.length,
+                });
             }
             catch {
-                return undefined;
+                // An in-memory-only context is still executable; it simply cannot
+                // promise a durable step retry. Keep the legacy control behavior.
             }
         }
-        function bindAutomaticReplayBoundary(prefixSequence) {
-            activeGovernedBoundarySeen = false;
-            activeGovernedAttemptId = undefined;
-            activeEffectLedgerPrefixSequence = prefixSequence;
+        function stepReplayIsSafe() {
+            if (!recoveryCheckpoint || hasUnresolvedReconciliation())
+                return false;
+            const current = currentEffectLedger();
+            return current.boundaries
+                .slice(recoveryCheckpoint.boundaryPrefix)
+                .every((boundary) => runtimeBoundaryIsOwned(boundary) &&
+                boundary.logicalOperationId === undefined &&
+                (boundary.physicalReceipt?.classification === 'unchanged' || boundary.restored !== undefined));
+        }
+        function repairableReadOnlyBoundary() {
+            if (!recoveryCheckpoint || !repositoryCapability?.observe || !repositoryCapability.acquire ||
+                retainedEffectReconciliationRequired || deferredReconciliationOperationId !== undefined)
+                return undefined;
+            const suffix = currentEffectLedger().boundaries.slice(recoveryCheckpoint.boundaryPrefix);
+            if (suffix.length !== 1)
+                return undefined;
+            const saved = suffix[0];
+            if (!runtimeBoundaryIsOwned(saved) || saved.restored !== undefined ||
+                saved.sourceStateId !== recoveryCheckpoint.stateId || saved.cohortId !== undefined ||
+                saved.logicalOperationId !== undefined || saved.dispositions.some((item) => item !== 'unchanged') ||
+                saved.physicalReceipt === undefined || saved.after?.head !== saved.baseline.head ||
+                saved.physicalReceipt.classification === 'unchanged' ||
+                [...unresolvedSemanticBoundaryIds].some((id) => id !== saved.boundaryId))
+                return undefined;
+            return saved;
         }
-        function beginAutomaticReplayBoundary() {
-            bindAutomaticReplayBoundary(captureEffectLedgerPrefixSequence());
+        async function confirmReadOnlyRestoration(saved, signal) {
+            const claim = await repositoryCapability.acquire({ signal });
+            try {
+                await claim.assertOwner();
+                const restored = snapshotJsonValue(await repositoryCapability.observe());
+                if (!isDeepStrictEqual(restored, saved.baseline)) {
+                    throw new Error(`${label} preparation has not restored the stopped step's repository; it remains paused`);
+                }
+                signal.throwIfAborted();
+                effectLedgerMirror = assertPlaybookEffectLedger(await effectLedgerCapability.writeAhead([
+                    { kind: 'replace-boundaries', replacements: [{ expected: saved, next: { ...saved, restored } }] },
+                ]));
+                if (!isDeepStrictEqual(effectLedgerMirror.boundaries.find(({ boundaryId }) => boundaryId === saved.boundaryId)?.restored, restored)) {
+                    throw new Error(`${label} repository restoration was not durably acknowledged`);
+                }
+                refreshUnresolvedSemanticReconciliation(effectLedgerMirror);
+            }
+            finally {
+                await claim.release();
+            }
         }
-        function latchFailedGovernedAttempt() {
-            if (!hasGovernedPlayerStates) {
-                failedGovernedAttemptUnknown = false;
-                failedEffectBoundaryPrefix = undefined;
-                failedGovernedAttemptId = undefined;
-                return;
+        // A completed commit with saved presentation needs only the missing
+        // tool-free judgment. Never repeat the player to recover that evidence.
+        function recoverableJudgment() {
+            if (!recoveryCheckpoint || recoveryCheckpoint.result !== undefined || recoveryCheckpoint.delivered ||
+                retainedEffectReconciliationRequired ||
+                deferredReconciliationOperationId !== undefined)
+                return undefined;
+            const suffix = currentEffectLedger().boundaries.slice(recoveryCheckpoint.boundaryPrefix);
+            if (suffix.length !== 1)
+                return undefined;
+            const saved = suffix[0];
+            if (!runtimeBoundaryIsOwned(saved) ||
+                saved.sourceStateId !== recoveryCheckpoint.stateId ||
+                saved.logicalOperationId !== undefined ||
+                saved.correctionBudget.spent ||
+                saved.physicalReceipt?.classification !== 'one-descendant-commit' ||
+                !saved.finalText?.trim() ||
+                governedOutcomesForBoundary(saved) === undefined ||
+                (saved.semanticCandidate !== undefined &&
+                    persistedBoundaryReconciliation(saved, currentEffectLedger())
+                        ?.reconciliation.status !== 'resolved') ||
+                [...unresolvedSemanticBoundaryIds].some((id) => id !== saved.boundaryId))
+                return undefined;
+            return saved;
+        }
+        async function recoverJudgment(saved, signal) {
+            const checkpoint = recoveryCheckpoint;
+            const persisted = checkpoint.machine;
+            const input = Object.values(persisted.children)[0];
+            const actorInput = input.snapshot.input;
+            const outcomes = governedOutcomesForBoundary(saved);
+            const candidate = saved.semanticCandidate ??
+                parseGovernedSemanticCandidate(await boundary.callJudge('player-output-adjudication', saved.sourceStateId, buildGovernedJudgePrompt(actorInput, saved.finalText, outcomes), signal));
+            const result = reconcilePlaybookSemanticEvidence({
+                outcomes,
+                semanticCandidate: candidate,
+                finalText: saved.finalText,
+                receipt: saved.physicalReceipt,
+            });
+            signal.throwIfAborted();
+            const next = {
+                ...saved,
+                semanticCandidate: snapshotJsonValue(result.evidence.semanticCandidate),
+            };
+            const acknowledged = assertPlaybookEffectLedger(await effectLedgerCapability.writeAhead([
+                {
+                    kind: 'replace-boundaries',
+                    replacements: [{ expected: saved, next }],
+                },
+            ]));
+            if (!isDeepStrictEqual(acknowledged.boundaries.find((b) => b.boundaryId === saved.boundaryId), next)) {
+                throw new Error(`${label} recovered judgment was not acknowledged exactly`);
             }
-            if (activeEffectLedgerPrefixSequence === undefined) {
-                failedGovernedAttemptUnknown = true;
-                failedEffectBoundaryPrefix = undefined;
-                failedGovernedAttemptId = undefined;
-                return;
+            effectLedgerMirror = acknowledged;
+            refreshUnresolvedSemanticReconciliation(acknowledged);
+            if (result.status !== 'resolved') {
+                const error = attachPlaybookFailureCause(new Error(result.status === 'unresolved' && 'reason' in result.cause.evidence && result.cause.evidence.reason
+                    ? String(result.cause.evidence.reason)
+                    : `${label} saved result could not be reconciled; the playbook remains parked`), result.status === 'unresolved' ? result.cause : runtimeDefectCause('Saved result still needs a Boss answer'));
+                const paused = detachPersistedMachineSnapshot(actor.getPersistedSnapshot());
+                stopActor();
+                actor = buildActor(runtimePorts, {
+                    ...paused, context: { ...paused.context, lastError: snapshotJsonValue(normalizeErrorFull(error)) },
+                });
+                suppressInspectionEmissions = false;
+                actor.start();
+                throw error;
             }
-            let current;
+            await resumeCheckpoint({ ...checkpoint, result: snapshotJsonValue(result.output) });
+        }
+        async function resumeCheckpoint(checkpoint) {
+            acceptedStepResult = checkpoint;
             try {
-                current = currentEffectLedger();
-                effectLedgerMirror = current;
-                refreshRetainedEffectReconciliation(current);
-            }
-            catch {
+                stopActor();
+                actor = buildActor(runtimePorts, checkpoint.machine);
+                suppressInspectionEmissions = false;
+                actor.start();
+                await waitForPlaybookQuiescence(actor, { pendingCalls: nestedBridge });
+            }
+            finally {
+                acceptedStepResult = undefined;
+            }
+        }
+        function exportRuntimeSnapshot(checkpoint) {
+            if (!actor || !session || disposed || disposalPromise !== undefined) {
+                return undefined;
+            }
+            if (activeSignal !== undefined && checkpoint === undefined)
+                return undefined;
+            if (deferredSettlementClosure !== undefined)
+                return undefined;
+            const pendingCall = checkpoint?.child ?? nestedBridge.getPendingCall();
+            const bridgeSuspendedCall = checkpoint?.child ? nestedBridge.checkpointCall(checkpoint.child) : nestedBridge.getSuspendedCall();
+            if ((pendingCall === undefined) !== (bridgeSuspendedCall === undefined)) {
+                return undefined;
+            }
+            let suspendedCall;
+            if (bridgeSuspendedCall !== undefined) {
+                if (pendingCall?.callId !== bridgeSuspendedCall.callId ||
+                    pendingCall?.playbookId !== bridgeSuspendedCall.playbookId ||
+                    pendingCall?.childSessionId !== bridgeSuspendedCall.childSessionId) {
+                    return undefined;
+                }
+                if (!playbookCallTurnIds.has(bridgeSuspendedCall.callId)) {
+                    return undefined;
+                }
+                const turnId = playbookCallTurnIds.get(bridgeSuspendedCall.callId);
+                if (bridgeSuspendedCall.turnId !== undefined &&
+                    bridgeSuspendedCall.turnId !== turnId) {
+                    return undefined;
+                }
+                suspendedCall = {
+                    ...bridgeSuspendedCall,
+                    ...(turnId === undefined ? {} : { turnId }),
+                    ...(hasGovernedPlayerStates
+                        ? {
+                            effectBoundaryPrefixSequence: playbookCallEffectPrefixes.get(bridgeSuspendedCall.callId) ?? null,
+                        }
+                        : {}),
+                };
+            }
+            const interrupted = checkpoint?.interrupted && recoveryCheckpoint && machine.root.states.failed;
+            const state = interrupted
+                ? normalizePlaybookSnapshot(machine.resolveState({ value: 'failed', context: {} }))
+                : checkpoint?.child ? normalizePlaybookSnapshot(actor.getSnapshot(), { pendingCall }) : currentState();
+            if (state.status !== 'active' || !state.quiescent)
+                return undefined;
+            const context = actor.getSnapshot()
+                .context;
+            // DR-063 §2: the failed state's `lastError` is persisted as every live
+            // surface publishes it, completed from the runtime's own cause slot, so
+            // a thrown value that refused the cause still explains itself after a
+            // restart.
+            const machineSnapshot = detachPersistedMachineSnapshot(interrupted ? { ...recoveryCheckpoint.machine, value: 'failed', children: {} } : actor.getPersistedSnapshot(), state.stateId === 'failed'
+                ? { lastError: interrupted ? { name: 'InterruptedStep', message: 'The process stopped during this step. Review the recorded work before choosing how to continue.', cause: runtimeDefectCause('The process stopped during this step. Review the recorded work before choosing how to continue.') } : failedStateError(context ?? {}) }
+                : {});
+            effectLedgerMirror = currentEffectLedger();
+            refreshRetainedEffectReconciliation(effectLedgerMirror);
+            syncDeferredReconciliationOverlay();
+            refreshUnresolvedSemanticReconciliation(effectLedgerMirror);
+            const pendingQuestions = !hasUnresolvedReconciliation()
+                ? pendingBossQuestionsFor(state, context ?? {})
+                : [];
+            const interruptedPrefix = interrupted ? activeEffectLedgerPrefixSequence : undefined;
+            const interruptedAttempts = new Set(effectLedgerMirror.boundaries.filter(({ sequence }) => interruptedPrefix !== undefined && sequence > interruptedPrefix).map(({ attemptId }) => attemptId));
+            const failedEffectAttempt = interrupted && interruptedPrefix !== undefined && interruptedAttempts.size <= 1
+                ? { boundaryPrefix: interruptedPrefix, attemptId: interruptedAttempts.values().next().value ?? null }
+                :
+                    hasGovernedPlayerStates &&
+                        !interrupted && state.stateId === 'failed' &&
+                        failedAttemptMatchesCurrentLedger(effectLedgerMirror)
+                        ? {
+                            boundaryPrefix: failedEffectBoundaryPrefix,
+                            attemptId: failedGovernedAttemptId ?? null,
+                        }
+                        : undefined;
+            return {
+                schemaVersion: 4,
+                playbookId: session.playbookId,
+                machine: machineSnapshot,
+                roleResumeTokens: snapshotRoleResumeTokens(),
+                sequences: {
+                    trace: traceSequence,
+                    turn: turnSequence,
+                    judgeCall: judgeCallSequence,
+                    playerCall: playerCallSequence,
+                    playbookCall: playbookCallSequence,
+                    ...(declaredActors.has('captain')
+                        ? { captainCall: captainCallSequence }
+                        : {}),
+                },
+                state,
+                pendingBossQuestions: pendingQuestions.map((pending) => ({
+                    questionId: pending.questionId,
+                    asker: pending.asker,
+                    question: pending.question,
+                    sourceItem: pending.sourceItem,
+                })),
+                effectLedger: effectLedgerMirror,
+                ...(retainedEffectSourceSessionId === undefined
+                    ? {}
+                    : { retainedEffectSourceSessionId }),
+                ...(retainedEffectReconciliation === undefined
+                    ? {}
+                    : { retainedEffectReconciliation }),
+                ...(failedEffectAttempt === undefined
+                    ? {}
+                    : { failedEffectAttempt }),
+                ...((state.stateId === 'failed' || pendingQuestions.length > 0) && recoveryCheckpoint !== undefined
+                    ? { recoveryCheckpoint } : {}),
+                ...(suspendedCall === undefined ? {} : { suspendedCall }),
+            };
+        }
+        async function runJournalledStep(kind, input, signal, execute) {
+            const saved = acceptedStepResult;
+            let output;
+            if (saved?.stateId === input.stateId && saved.result !== undefined) {
+                acceptedStepResult = undefined;
+                recoveryCheckpoint = saved;
+                output = snapshotJsonValue(saved.result);
+            }
+            else {
+                const record = savedPorts?.recordStep;
+                await drainEmissions();
+                signal.throwIfAborted();
+                try {
+                    captureRecoveryCheckpoint(input.stateId, 'command' in input ? input.command : 'role' in input ? composeBoundPlayerPrompt(input) : composeCaptainPrompt(input));
+                }
+                catch (error) {
+                    if (!isAbortFailure(error, signal))
+                        controlPlaneError ??= error;
+                    throw error;
+                }
+                if (record) {
+                    const id = randomUUID();
+                    if (recoveryCheckpoint)
+                        recoveryCheckpoint = { ...recoveryCheckpoint, id };
+                    const step = { id, kind, stateId: input.stateId };
+                    await record(step, exportRuntimeSnapshot({ interrupted: true }));
+                    signal.throwIfAborted();
+                    const result = snapshotJsonValue(await execute());
+                    // Keep the known output if its save loses acknowledgement. A drained
+                    // failure can then preserve it without treating the call as unexecuted.
+                    if (recoveryCheckpoint?.id === id)
+                        recoveryCheckpoint = { ...recoveryCheckpoint, result };
+                    await record({ ...step, result });
+                    output = result;
+                }
+                else {
+                    output = await execute();
+                }
+            }
+            if (recoveryCheckpoint?.stateId === input.stateId) {
+                const { result: _result, ...start } = recoveryCheckpoint;
+                recoveryCheckpoint = { ...start, delivered: true };
+            }
+            return output;
+        }
+        function validateRecoveryCheckpoint(checkpoint) {
+            if (!checkpoint)
+                return;
+            const node = machine.root.states[checkpoint.stateId];
+            const persisted = checkpoint.machine;
+            const children = persisted.children;
+            if (!node ||
+                node.invoke.length !== 1 ||
+                !['player', 'captain', 'script'].includes(String(node.invoke[0].src)) ||
+                !isPlainObject(children) ||
+                Object.keys(children).length !== 1) {
+                throw new TypeError(`${label} recovery checkpoint does not name one current invocation`);
+            }
+            const child = children[node.invoke[0].id];
+            if (!child ||
+                child.src !== node.invoke[0].src ||
+                !isPlainObject(child.snapshot) ||
+                child.snapshot.status !== 'active' ||
+                !isPlainObject(child.snapshot.input) ||
+                child.snapshot.input.stateId !== checkpoint.stateId) {
+                throw new TypeError(`${label} recovery checkpoint invocation is incompatible`);
+            }
+            if (checkpoint.result !== undefined) {
+                const output = checkpoint.result;
+                const input = child.snapshot.input;
+                if (!isPlainObject(output) || typeof output.guard !== 'string' ||
+                    !isPlainObject(input.result) || !Object.hasOwn(input.result, output.guard) ||
+                    (node.invoke[0].src === 'script' &&
+                        (!Number.isInteger(output.exitStatus) || Object.keys(output).sort().join(',') !== 'exitStatus,guard' ||
+                            output.guard !== Object.keys(input.result)[output.exitStatus === 0 ? 0 : Math.min(1, Object.keys(input.result).length - 1)]))) {
+                    throw new TypeError(`${label} saved step result is incompatible with its invocation`);
+                }
+                for (const field of extractFields(String(input.result[output.guard]))) {
+                    if (output[field] === undefined || output[field] === null)
+                        throw new TypeError(`${label} saved step result is missing ${field}`);
+                }
+            }
+        }
+        function captureEffectLedgerPrefixSequence() {
+            if (!hasGovernedPlayerStates)
+                return undefined;
+            try {
+                const current = currentEffectLedger();
+                effectLedgerMirror = current;
+                refreshRetainedEffectReconciliation(current);
+                return current.boundaries.at(-1)?.sequence ?? 0;
+            }
+            catch {
+                return undefined;
+            }
+        }
+        function bindAutomaticReplayBoundary(prefixSequence) {
+            activeGovernedBoundarySeen = false;
+            activeGovernedAttemptId = undefined;
+            activeEffectLedgerPrefixSequence = prefixSequence;
+        }
+        function beginAutomaticReplayBoundary() {
+            bindAutomaticReplayBoundary(captureEffectLedgerPrefixSequence());
+        }
+        function latchFailedGovernedAttempt() {
+            if (!hasGovernedPlayerStates) {
+                failedGovernedAttemptUnknown = false;
+                failedEffectBoundaryPrefix = undefined;
+                failedGovernedAttemptId = undefined;
+                return;
+            }
+            if (activeEffectLedgerPrefixSequence === undefined) {
+                failedGovernedAttemptUnknown = true;
+                failedEffectBoundaryPrefix = undefined;
+                failedGovernedAttemptId = undefined;
+                return;
+            }
+            let current;
+            try {
+                current = currentEffectLedger();
+                effectLedgerMirror = current;
+                refreshRetainedEffectReconciliation(current);
+            }
+            catch {
                 failedGovernedAttemptUnknown = true;
                 failedEffectBoundaryPrefix = undefined;
                 failedGovernedAttemptId = undefined;
@@ -3643,6 +4506,269 @@ export function createXStatePlaybookRuntime(machine, spec) {
                 : activeEffectLedgerPrefixSequence;
             failedGovernedAttemptId = attemptIds.values().next().value;
         }
+        // -----------------------------------------------------------------
+        // DR-067 §1: the parallel profile's repository cohort. The working
+        // leaves of one parallel state entered together run under one
+        // `runCohort` claim, each member an `unchanged` boundary: a member's
+        // result is adjudicated through the one reconciler in serial, a spent
+        // correction rewrites every member's boundary in one acknowledged batch,
+        // members are acknowledged and released in completion order, and a
+        // member's failure cancels its siblings and fails the cohort with the
+        // cause decided first.
+        // -----------------------------------------------------------------
+        function trackBoundaryCall(call) {
+            if (parallelProfile === undefined)
+                return call;
+            activeBoundaryCalls.add(call);
+            const forget = () => {
+                activeBoundaryCalls.delete(call);
+            };
+            void call.then(forget, forget);
+            return call;
+        }
+        async function drainBoundaryCalls() {
+            while (activeBoundaryCalls.size > 0) {
+                await Promise.allSettled([...activeBoundaryCalls]);
+            }
+        }
+        function cohortParallelStateFor(stateId) {
+            const parallelState = parallelProfile?.parallelStateByWorkingStateId.get(stateId);
+            if (parallelState === undefined)
+                return undefined;
+            if (consumedCohortBoundaries.get(parallelState.stateId) ===
+                publicBoundarySequence) {
+                return undefined;
+            }
+            const pending = pendingCohorts.get(parallelState.stateId);
+            if (pending !== undefined &&
+                pending.boundarySequence === publicBoundarySequence &&
+                !pending.started) {
+                return parallelState;
+            }
+            const active = currentState().activeStateIds;
+            return parallelState.regions.every(({ workingStateId }) => active.includes(workingStateId))
+                ? parallelState
+                : undefined;
+        }
+        function startCohort(parallelState, cohort) {
+            cohort.started = true;
+            consumedCohortBoundaries.set(parallelState.stateId, cohort.boundarySequence);
+            if (pendingCohorts.get(parallelState.stateId) === cohort) {
+                pendingCohorts.delete(parallelState.stateId);
+            }
+        }
+        async function joinCohort(parallelState, member) {
+            let cohort = pendingCohorts.get(parallelState.stateId);
+            if (cohort === undefined ||
+                cohort.boundarySequence !== publicBoundarySequence ||
+                cohort.started) {
+                cohort = {
+                    boundarySequence: publicBoundarySequence,
+                    members: new Map(),
+                    started: false,
+                };
+                pendingCohorts.set(parallelState.stateId, cohort);
+            }
+            const registered = cohort;
+            if (registered.members.has(member.region.key)) {
+                throw new Error(`${label} parallel state ${parallelState.stateId} registered region ${member.region.key} twice`);
+            }
+            registered.members.set(member.region.key, member);
+            // A member whose invocation stops before every sibling registered —
+            // its region exited, or the boundary aborted — leaves no cohort to
+            // run: each registered member settles with its own cancellation and
+            // the boundary's cohort is spent.
+            const withdraw = () => {
+                if (registered.started)
+                    return;
+                startCohort(parallelState, registered);
+                for (const candidate of registered.members.values()) {
+                    candidate.settled.reject(candidate.signal.aborted
+                        ? candidate.signal.reason
+                        : member.signal.reason);
+                }
+            };
+            if (member.signal.aborted) {
+                withdraw();
+            }
+            else {
+                member.signal.addEventListener('abort', withdraw, { once: true });
+            }
+            if (!registered.started &&
+                registered.members.size === parallelState.regions.length) {
+                startCohort(parallelState, registered);
+                void settleCohort(parallelState, registered);
+            }
+            return await member.settled.promise;
+        }
+        async function settleCohort(parallelState, cohort) {
+            const members = parallelState.regions.map(({ key }) => cohort.members.get(key));
+            const cancellation = new AbortController();
+            const completionOrder = [];
+            const decided = new Map();
+            let decisionSequence = 0;
+            // DR-063 §2: each member failure is one decision, ordered as it was
+            // decided, with the cause decided for exactly that value at that
+            // moment — so a value a sibling later rethrows cannot rename it.
+            const decide = (member, error, cause = failureCauses.causeOf(error)) => {
+                if (decided.has(member))
+                    return;
+                decided.set(member, { error, cause, sequence: ++decisionSequence });
+            };
+            const isCancellation = (error) => cancellation.signal.aborted &&
+                Object.is(error, cancellation.signal.reason) &&
+                !activeAborts?.isAbortReason(error);
+            const operationFor = (member) => async (context) => {
+                const callSignal = combineAbortSignals(member.signal, cancellation.signal);
+                try {
+                    if (activePlayerKeys.has(member.playerKey)) {
+                        await member.reportCollision(callSignal);
+                    }
+                    activePlayerKeys.add(member.playerKey);
+                    try {
+                        const result = await member.run(callSignal, cancellation.signal, effectAuthorizedPreExistingBlock(member.effectBoundary, context?.baseline));
+                        if (result.status !== 'ok' && !cancellation.signal.aborted) {
+                            // DR-063 §2: the failure built for a non-`ok` member result
+                            // carries the cause decided for exactly that result, and its
+                            // siblings are cancelled with it.
+                            const cause = resultFailureCauses.get(result) ??
+                                runtimeDefectCause(`callPlayer status ${JSON.stringify(result.status)}`);
+                            const failure = attachPlaybookFailureCause(markFsmResultFailure(new Error(result.error ??
+                                `captainBridge: callPlayer status "${result.status}"`)), cause);
+                            failureCauses.retain(failure, cause);
+                            decide(member, failure, cause);
+                            cancellation.abort(failure);
+                        }
+                        return result;
+                    }
+                    finally {
+                        activePlayerKeys.delete(member.playerKey);
+                    }
+                }
+                catch (error) {
+                    if (!isCancellation(error))
+                        decide(member, error);
+                    if (!cancellation.signal.aborted)
+                        cancellation.abort(error);
+                    throw error;
+                }
+                finally {
+                    completionOrder.push(member);
+                }
+            };
+            const completeEffectBoundary = (completion) => cohortCompletionQueue.add(async () => {
+                const member = members.find(({ roleId }) => roleId === completion.roleId);
+                if (member === undefined ||
+                    completion.boundary.boundaryId !== member.effectBoundary.boundaryId) {
+                    throw new TypeError(`${label} repository cohort completed an undeclared member`);
+                }
+                const evidence = await completionEvidenceFor(member.input, member.roleId, member.playerId, member.signal, undefined)(completion);
+                const settlement = governedSettlementsByBoundaryId.get(member.effectBoundary.boundaryId);
+                if (settlement?.status === 'unresolved') {
+                    decide(member, settlement.error);
+                }
+                return evidence;
+            });
+            const runSignal = activeSignal ?? members[0].signal;
+            const invocationId = randomUUID();
+            let settled;
+            try {
+                for (const member of members)
+                    member.signal.throwIfAborted();
+                settled = await repositoryCapability.runCohort({
+                    signal: runSignal,
+                    invocationId,
+                    roleIds: members.map(({ roleId }) => roleId),
+                    dispositionsByRole: Object.fromEntries(members.map(({ roleId }) => [roleId, ['unchanged']])),
+                    effectBoundaries: Object.fromEntries(members.map(({ roleId, effectBoundary }) => [
+                        roleId,
+                        effectBoundary,
+                    ])),
+                    operations: Object.fromEntries(members.map((member) => [member.roleId, operationFor(member)])),
+                    completeEffectBoundary,
+                });
+                if (!isPlainObject(settled) || settled.invocationId !== invocationId) {
+                    throw new TypeError(`${label} repository cohort changed its invocation identity`);
+                }
+            }
+            catch (error) {
+                for (const member of members) {
+                    governedSettlementsByBoundaryId.delete(member.effectBoundary.boundaryId);
+                    governedCompletionEvidenceByBoundaryId.delete(member.effectBoundary.boundaryId);
+                    refreshGovernedBoundaryStart(member.effectBoundary.boundaryId);
+                }
+                if (!isAbortFailure(error, runSignal))
+                    controlPlaneError ??= error;
+                for (const member of members)
+                    member.settled.reject(error);
+                return;
+            }
+            const releaseOrder = [
+                ...completionOrder,
+                ...members.filter((member) => !completionOrder.includes(member)),
+            ];
+            const acknowledged = new Map();
+            const failures = new Map();
+            for (const member of releaseOrder) {
+                const operation = isPlainObject(settled.operations)
+                    ? settled.operations[member.roleId]
+                    : undefined;
+                try {
+                    const result = acknowledgeGovernedPlayerResult({
+                        operation,
+                        receipt: isPlainObject(settled.receipts)
+                            ? settled.receipts[member.roleId]
+                            : undefined,
+                        effectLedger: settled.effectLedger,
+                    }, member.effectBoundary.boundaryId, 'runCohort');
+                    acknowledged.set(member, result);
+                    const settlement = governedPlayerSettlements.get(result);
+                    if (settlement?.status === 'unresolved') {
+                        failures.set(member, settlement.error);
+                    }
+                    else if (result.status !== 'ok') {
+                        failures.set(member, decided.get(member)?.error);
+                    }
+                }
+                catch (error) {
+                    failures.set(member, error);
+                    const operationReason = isPlainObject(operation) &&
+                        operation.status === 'rejected' &&
+                        Object.is(operation.reason, error);
+                    if (!operationReason) {
+                        // An acknowledgement the host could not prove is a control-plane
+                        // defect, exactly as on the exclusive path.
+                        if (!isAbortFailure(error, runSignal))
+                            controlPlaneError ??= error;
+                        decide(member, error);
+                    }
+                }
+                finally {
+                    governedSettlementsByBoundaryId.delete(member.effectBoundary.boundaryId);
+                    governedCompletionEvidenceByBoundaryId.delete(member.effectBoundary.boundaryId);
+                }
+            }
+            if (failures.size === 0) {
+                for (const member of releaseOrder) {
+                    member.settled.resolve(acknowledged.get(member));
+                }
+                return;
+            }
+            for (const result of acknowledged.values()) {
+                governedPlayerSettlements.delete(result);
+            }
+            const first = [...decided.values()].sort((left, right) => left.sequence - right.sequence)[0];
+            const failure = first?.error ??
+                failures.get(releaseOrder.find((member) => failures.has(member))) ??
+                markFsmResultFailure(new Error(`${label} parallel state ${parallelState.stateId} cohort failed`));
+            const cause = first?.cause ?? failureCauses.causeOf(failure);
+            if (cause !== undefined) {
+                failureCauses.retain(failure, cause);
+                attachPlaybookFailureCause(failure, cause);
+            }
+            for (const member of members)
+                member.settled.reject(failure);
+        }
         const boundary = {
             async callPlayer(input, roleId, freshPrompt, signal) {
                 // State-entry telemetry/status must precede the call they describe.
@@ -3687,126 +4813,173 @@ export function createXStatePlaybookRuntime(machine, spec) {
                     callId,
                 };
                 const playerKey = continuationKey(roleId, playerId);
-                if (activePlayerKeys.has(playerKey)) {
-                    const error = new Error(`simultaneous calls to player key ${playerKey} are not allowed`);
-                    await emitCallStarted('player.call.started', 'player.call.finished', { ...callIdentity(selectedResume), prompt }, position, signal);
-                    await emitTrace('player.call.finished', {
-                        ...callIdentity(selectedResume),
-                        status: 'error',
-                        error: normalizeError(error),
-                    }, position);
-                    throw error;
-                }
-                activePlayerKeys.add(playerKey);
-                try {
-                    const runTracedPlayerCall = async (resume = selectedResume, 
-                    // DR-062 §4: composed from this call's own baseline observation,
-                    // so the prompt the trace records is the prompt the player is sent.
-                    preExistingBlock) => {
-                        const identity = callIdentity(resume);
-                        const withPreExisting = (text) => preExistingBlock === undefined
-                            ? text
-                            : `${text}\n\n${preExistingBlock}`;
-                        const callPrompt = withPreExisting(resume === false ? freshPrompt : prompt);
-                        const callFreshPrompt = withPreExisting(freshPrompt);
-                        await emitCallStarted('player.call.started', 'player.call.finished', { ...identity, prompt: callPrompt }, position, signal);
-                        let rawResult;
+                const runTracedPlayerCall = async (resume = selectedResume, 
+                // DR-062 §4: composed from this call's own baseline observation,
+                // so the prompt the trace records is the prompt the player is sent.
+                preExistingBlock, 
+                // DR-067 §1: a cohort member's call signal also carries its
+                // cohort's sibling cancellation.
+                callSignal = signal, cohortCancellation) => {
+                    const identity = callIdentity(resume);
+                    // DR-067 §1: a parallel machine classifies aborts per call, so a
+                    // trace sink rejecting with a sibling's cancellation is forgiven
+                    // for that call alone.
+                    const traceAborts = parallelProfile === undefined
+                        ? undefined
+                        : abortReasonClassifier(callSignal, activeAborts);
+                    const withPreExisting = (text) => preExistingBlock === undefined
+                        ? text
+                        : `${text}\n\n${preExistingBlock}`;
+                    const callPrompt = withPreExisting(resume === false ? freshPrompt : prompt);
+                    const callFreshPrompt = withPreExisting(freshPrompt);
+                    await emitCallStarted('player.call.started', 'player.call.finished', { ...identity, prompt: callPrompt }, position, callSignal, undefined, traceAborts);
+                    let rawResult;
+                    try {
+                        // An abort may land while the awaited started emission drains
+                        // (e.g. fired from the trace sink itself); the host call must
+                        // never start after abort, so settle the already-started pair
+                        // as `aborted` through the catch below.
+                        callSignal.throwIfAborted();
+                        rawResult = await requireHostPorts().callPlayer(roleId, callPrompt, callSignal, {
+                            resume,
+                            ...(callPrompt === callFreshPrompt
+                                ? {}
+                                : { freshPrompt: callFreshPrompt }),
+                        });
+                        // A host promise is not required to honor cancellation. Do not
+                        // let a late result mutate continuity or publish a successful
+                        // finish.
+                        callSignal.throwIfAborted();
+                    }
+                    catch (error) {
+                        if (!isAbortFailure(error, callSignal))
+                            controlPlaneError ??= error;
                         try {
-                            // An abort may land while the awaited started emission drains
-                            // (e.g. fired from the trace sink itself); the host call must
-                            // never start after abort, so settle the already-started pair
-                            // as `aborted` through the catch below.
-                            signal.throwIfAborted();
-                            rawResult = await requireHostPorts().callPlayer(roleId, callPrompt, signal, {
-                                resume,
-                                ...(callPrompt === callFreshPrompt
-                                    ? {}
-                                    : { freshPrompt: callFreshPrompt }),
-                            });
-                            // A host promise is not required to honor cancellation. Do not
-                            // let a late result mutate continuity or publish a successful
-                            // finish.
-                            signal.throwIfAborted();
+                            await emitTrace('player.call.finished', {
+                                ...identity,
+                                status: isAbortFailure(error, callSignal)
+                                    ? 'aborted'
+                                    : 'error',
+                                error: normalizeError(error),
+                            }, position, traceAborts);
                         }
-                        catch (error) {
-                            if (!isAbortFailure(error, signal))
-                                controlPlaneError ??= error;
-                            try {
-                                await emitTrace('player.call.finished', {
-                                    ...identity,
-                                    status: isAbortFailure(error, signal) ? 'aborted' : 'error',
-                                    error: normalizeError(error),
-                                }, position);
-                            }
-                            catch {
-                                // The original non-abort port rejection remains authoritative.
-                            }
-                            // A thrown port call carries no authoritative result, so the
-                            // prior token remains available for a later explicit resume.
-                            throw decidePlayerCallFailure(error, roleId, playerId, signal);
+                        catch {
+                            // The original non-abort port rejection remains authoritative.
                         }
-                        let result;
+                        // A thrown port call carries no authoritative result, so the
+                        // prior token remains available for a later explicit resume.
+                        throw decidePlayerCallFailure(error, roleId, playerId, callSignal, cohortCancellation);
+                    }
+                    let result;
+                    try {
+                        result = validatePlayerResult(rawResult);
+                    }
+                    catch (error) {
+                        if (!isAbortFailure(error, callSignal))
+                            controlPlaneError ??= error;
                         try {
-                            result = validatePlayerResult(rawResult);
+                            await emitTrace('player.call.finished', { ...identity, status: 'error', error: normalizeError(error) }, position, traceAborts);
                         }
-                        catch (error) {
-                            if (!isAbortFailure(error, signal))
-                                controlPlaneError ??= error;
-                            try {
-                                await emitTrace('player.call.finished', { ...identity, status: 'error', error: normalizeError(error) }, position);
-                            }
-                            catch {
-                                // The malformed host result remains authoritative.
-                            }
-                            throw decidePlayerCallFailure(error, roleId, playerId, signal);
+                        catch {
+                            // The malformed host result remains authoritative.
                         }
+                        throw decidePlayerCallFailure(error, roleId, playerId, callSignal, cohortCancellation);
+                    }
+                    try {
+                        updatePlayerResume(roleId, playerId, result);
+                    }
+                    catch (error) {
+                        if (!isAbortFailure(error, callSignal))
+                            controlPlaneError ??= error;
                         try {
-                            updatePlayerResume(roleId, playerId, result);
-                        }
-                        catch (error) {
-                            if (!isAbortFailure(error, signal))
-                                controlPlaneError ??= error;
-                            try {
-                                await emitTrace('player.call.finished', { ...identity, status: 'error', error: normalizeError(error) }, position);
-                            }
-                            catch {
-                                // The continuation-store failure remains authoritative.
-                            }
-                            throw error;
-                        }
-                        await emitTrace('player.call.finished', {
-                            ...identity,
-                            status: result.status,
-                            ...(result.finalText !== undefined
-                                ? { finalText: result.finalText }
-                                : {}),
-                            ...(result.error !== undefined
-                                ? { error: normalizeError(result.error) }
-                                : {}),
-                            ...(result.resumeToken !== undefined
-                                ? { resumeToken: result.resumeToken }
-                                : {}),
-                        }, position);
-                        // DR-063 §2: the player bridge builds the failure Error for a
-                        // non-`ok` result, so the cause is decided here, where the role,
-                        // the player, and the reported error are known, and a successful
-                        // result clears it so no later failure inherits it.
-                        if (result.status === 'ok') {
-                            pendingResultFailureCause = undefined;
+                            await emitTrace('player.call.finished', { ...identity, status: 'error', error: normalizeError(error) }, position, traceAborts);
                         }
-                        else if (result.status === 'aborted') {
-                            pendingResultFailureCause = ABORTED_FAILURE_CAUSE;
-                        }
-                        else {
-                            pendingResultFailureCause = playerFailureCause({
-                                roleId,
-                                ...(playerId === undefined ? {} : { playerId }),
-                                error: result.error ??
-                                    `callPlayer status ${JSON.stringify(result.status)}`,
-                            });
+                        catch {
+                            // The continuation-store failure remains authoritative.
                         }
-                        return result;
-                    };
+                        throw error;
+                    }
+                    await emitTrace('player.call.finished', {
+                        ...identity,
+                        status: result.status,
+                        ...(result.finalText !== undefined
+                            ? { finalText: result.finalText }
+                            : {}),
+                        ...(result.error !== undefined
+                            ? { error: normalizeError(result.error) }
+                            : {}),
+                        ...(result.resumeToken !== undefined
+                            ? { resumeToken: result.resumeToken }
+                            : {}),
+                    }, position, traceAborts);
+                    // DR-063 §2: the player bridge builds the failure Error for a
+                    // non-`ok` result, so the cause is decided here, where the role,
+                    // the player, and the reported error are known, and a successful
+                    // result clears it so no later failure inherits it.
+                    if (result.status === 'ok') {
+                        pendingResultFailureCause = undefined;
+                    }
+                    else if (result.status === 'aborted') {
+                        pendingResultFailureCause = ABORTED_FAILURE_CAUSE;
+                    }
+                    else {
+                        pendingResultFailureCause = playerFailureCause({
+                            roleId,
+                            ...(playerId === undefined ? {} : { playerId }),
+                            error: result.error ??
+                                `callPlayer status ${JSON.stringify(result.status)}`,
+                        });
+                    }
+                    if (pendingResultFailureCause !== undefined) {
+                        resultFailureCauses.set(result, pendingResultFailureCause);
+                    }
+                    return result;
+                };
+                const reportPlayerKeyCollision = async (callSignal) => {
+                    const error = new Error(`simultaneous calls to player key ${playerKey} are not allowed`);
+                    const traceAborts = parallelProfile === undefined
+                        ? undefined
+                        : abortReasonClassifier(callSignal, activeAborts);
+                    await emitCallStarted('player.call.started', 'player.call.finished', { ...callIdentity(selectedResume), prompt }, position, callSignal, undefined, traceAborts);
+                    await emitTrace('player.call.finished', {
+                        ...callIdentity(selectedResume),
+                        status: 'error',
+                        error: normalizeError(error),
+                    }, position, traceAborts);
+                    throw error;
+                };
+                // DR-067 §1: the working leaves of one parallel state entered
+                // together run as one all-`unchanged` repository cohort, at most once
+                // per public boundary; a corrective re-ask and a single region
+                // resuming after its Boss reply take the exclusive path below.
+                const cohortState = deferredContinuation === undefined
+                    ? cohortParallelStateFor(input.stateId)
+                    : undefined;
+                if (cohortState !== undefined) {
+                    const effectBoundary = governedBoundarySeed(input, roleId, callId, turnId);
+                    if (effectBoundary === undefined ||
+                        repositoryCapability?.runCohort === undefined) {
+                        throw new Error(`${label} parallel state ${cohortState.stateId} requires governed player states and repository.runCohort`);
+                    }
+                    activeGovernedBoundarySeen = true;
+                    return await joinCohort(cohortState, {
+                        region: cohortState.regions.find(({ workingStateId }) => workingStateId === input.stateId),
+                        input,
+                        roleId,
+                        playerId,
+                        playerKey,
+                        signal,
+                        effectBoundary,
+                        run: (callSignal, cohortCancellation, preExistingBlock) => runTracedPlayerCall(selectedResume, preExistingBlock, callSignal, cohortCancellation),
+                        reportCollision: reportPlayerKeyCollision,
+                        settled: deferredValue(),
+                    });
+                }
+                if (activePlayerKeys.has(playerKey)) {
+                    await reportPlayerKeyCollision(signal);
+                }
+                activePlayerKeys.add(playerKey);
+                try {
                     const effectBoundary = governedBoundarySeed(input, roleId, callId, turnId);
                     if (deferredContinuation !== undefined) {
                         if (effectBoundary === undefined ||
@@ -3853,7 +5026,16 @@ export function createXStatePlaybookRuntime(machine, spec) {
                             // captured it under this exclusive claim. A host that supplies
                             // none states no pre-existing change, exactly as an empty
                             // baseline projection does.
-                            operation: (context) => runTracedPlayerCall(selectedResume, effectAuthorizedPreExistingBlock(effectBoundary, context?.baseline)),
+                            operation: async (context) => {
+                                if (requiredRecoveryBaseline !== undefined) {
+                                    if (!isDeepStrictEqual(snapshotJsonValue(context.baseline), requiredRecoveryBaseline)) {
+                                        throw new Error(`${label} repository changed after preparation; the stopped step remains paused`);
+                                    }
+                                    requiredRecoveryBaseline = undefined;
+                                    captureRecoveryCheckpoint(input.stateId, freshPrompt, currentEffectLedger().boundaries.findIndex(({ boundaryId }) => boundaryId === effectBoundary.boundaryId));
+                                }
+                                return runTracedPlayerCall(selectedResume, effectAuthorizedPreExistingBlock(effectBoundary, context?.baseline));
+                            },
                             completeEffectBoundary: completionEvidenceFor(input, roleId, playerId, signal, undefined),
                         });
                         return acknowledgeGovernedPlayerResult(exclusive, effectBoundary.boundaryId);
@@ -3875,11 +5057,13 @@ export function createXStatePlaybookRuntime(machine, spec) {
                     activePlayerKeys.delete(playerKey);
                 }
             },
-            markPlayerResultFailure(error) {
-                if (pendingResultFailureCause === undefined)
+            markPlayerResultFailure(error, result) {
+                const cause = (result === undefined ? undefined : resultFailureCauses.get(result)) ??
+                    pendingResultFailureCause;
+                if (cause === undefined)
                     return error;
-                failureCauses.retain(error, pendingResultFailureCause);
-                return attachPlaybookFailureCause(error, pendingResultFailureCause);
+                failureCauses.retain(error, cause);
+                return attachPlaybookFailureCause(error, cause);
             },
             takeGovernedPlayerOutput(result) {
                 const settlement = governedPlayerSettlements.get(result);
@@ -4067,8 +5251,17 @@ export function createXStatePlaybookRuntime(machine, spec) {
                 });
             },
         };
+        if (parallelProfile !== undefined) {
+            // DR-067 §1: a parallel machine's boundary drain waits for every player
+            // and judge call it started.
+            const untrackedCallPlayer = boundary.callPlayer;
+            const untrackedCallJudge = boundary.callJudge;
+            boundary.callPlayer = (input, roleId, freshPrompt, signal) => trackBoundaryCall(untrackedCallPlayer(input, roleId, freshPrompt, signal));
+            boundary.callJudge = (purpose, stateId, prompt, signal) => trackBoundaryCall(untrackedCallJudge(purpose, stateId, prompt, signal));
+        }
         function playerActor(ports) {
             return createPlayerBridge({
+                run: (input, signal, execute) => runJournalledStep('player', input, signal, execute),
                 resolveRoleId: requireRoleId,
                 validateInput: (input) => assertGovernedPlayerInput(outcomeAuthority, input, extractFields, label),
                 composePlayerPrompt: composeBoundPlayerPrompt,
@@ -4086,7 +5279,7 @@ export function createXStatePlaybookRuntime(machine, spec) {
         // adjudication that injects the exact visible finalText as the selected
         // output's question/response.
         function captainActor() {
-            return fromPromise(async ({ input, signal }) => {
+            return fromPromise(({ input, signal }) => runJournalledStep('captain', input, signal, async () => {
                 const active = combineAbortSignals(signal, activeSignal);
                 try {
                     await drainEmissions();
@@ -4150,7 +5343,7 @@ export function createXStatePlaybookRuntime(machine, spec) {
                     }
                     throw error;
                 }
-            });
+            }));
         }
         // Deterministic script actor (slc/link.md §Script execution). Runs
         // `input.command` through `sh -c`, resolves the declared guard
@@ -4158,7 +5351,7 @@ export function createXStatePlaybookRuntime(machine, spec) {
         // `playbook.script` telemetry event. No agent call, no adjudication,
         // no `*.call.*` trace.
         function scriptActor() {
-            return fromPromise(async ({ input, signal }) => {
+            return fromPromise(({ input, signal }) => runJournalledStep('script', input, signal, async () => {
                 await drainEmissions();
                 const active = combineAbortSignals(signal, activeSignal);
                 const guards = Object.keys(input.result);
@@ -4330,12 +5523,17 @@ export function createXStatePlaybookRuntime(machine, spec) {
                             clearTimeout(killTimer);
                     }
                 }
-            });
+            }));
         }
         const nestedBridge = createNestedPlaybookBridge({
             nextCallId: () => `playbook-${++playbookCallSequence}`,
             getBoundarySignal: () => activeSignal,
-            callPlaybook: (request, signal) => requireHostPorts().callPlaybook(request, signal),
+            callPlaybook: (request, signal) => {
+                const call = requireHostPorts().callPlaybook(request, signal);
+                return parallelProfile === undefined
+                    ? call
+                    : trackBoundaryCall(Promise.resolve(call));
+            },
             emitStarted: async (event, aborts) => {
                 playbookCallTurnIds.set(event.callId, activeTurnId);
                 if (hasGovernedPlayerStates) {
@@ -4374,7 +5572,9 @@ export function createXStatePlaybookRuntime(machine, spec) {
                 activeAborts = aborts ?? abortReasonClassifier(signal);
             },
             bindActorSettlement: (aborts) => {
-                actorSettlementAborts = aborts;
+                if (parallelProfile === undefined)
+                    actorSettlementAborts.length = 0;
+                actorSettlementAborts.push(aborts);
             },
             onControlPlaneError: (error, aborts) => {
                 // The shared bridge classifies before reporting against its own
@@ -4412,9 +5612,35 @@ export function createXStatePlaybookRuntime(machine, spec) {
                     runtimeDefectCause(normalized.message),
             };
         }
+        // DR-063 §2: the failure that parks the machine is the error its parking
+        // transition carried, but a compiled machine keeps a JSON-safe record of
+        // it as `lastError` (gears2fsm requires JSON-safe context), so neither
+        // that value's identity nor its marker reaches the failed state. The cause
+        // decided for the carried error is retained under the value the machine
+        // kept, so every surface of this turn and of each later one publishes the
+        // runtime's own decision for as long as that failure stands. A kept value
+        // that already answers keeps its cause.
+        function bindParkedFailureCause(context, event) {
+            const kept = context.lastError;
+            if (kept === undefined || kept === null)
+                return;
+            if (failureCauses.causeOf(kept) !== undefined)
+                return;
+            const decided = failureCauses.causeOf(actorErrorOf(event));
+            if (decided !== undefined)
+                failureCauses.retain(kept, decided);
+        }
         // DR-063 §2: a rejected player port or a result the runtime cannot read is
-        // a `player-failed` failure named by role; an abort is `aborted`.
-        function decidePlayerCallFailure(error, roleId, playerId, signal) {
+        // a `player-failed` failure named by role; an abort is `aborted`. A
+        // cancellation the runtime itself issued to a cohort member because its
+        // sibling failed is not this player's failure and decides nothing, so the
+        // originator's cause stands (DR-067 §1, playbook-55).
+        function decidePlayerCallFailure(error, roleId, playerId, signal, cohortCancellation) {
+            if (cohortCancellation?.aborted === true &&
+                Object.is(error, cohortCancellation.reason) &&
+                !activeAborts?.isAbortReason(error)) {
+                return error;
+            }
             const cause = isAbortFailure(error, signal)
                 ? ABORTED_FAILURE_CAUSE
                 : playerFailureCause({
@@ -4459,10 +5685,20 @@ export function createXStatePlaybookRuntime(machine, spec) {
                 previousState: previousState ?? null,
                 state,
             };
-            const pendingBossQuestion = pendingBossQuestionForState(state, context);
-            if (pendingBossQuestion !== undefined &&
-                !hasUnresolvedReconciliation()) {
-                payload.pendingBossQuestion = pendingBossQuestion;
+            if (parallelProfile === undefined) {
+                const pendingBossQuestion = pendingBossQuestionForState(state, context);
+                if (pendingBossQuestion !== undefined &&
+                    !hasUnresolvedReconciliation()) {
+                    payload.pendingBossQuestion = pendingBossQuestion;
+                }
+            }
+            else if (!hasUnresolvedReconciliation()) {
+                // DR-067 §1: a parallel machine's telemetry carries every question
+                // pending in an active wait, in the plural.
+                const pendingBossQuestions = pendingBossQuestionsFor(state, context);
+                if (pendingBossQuestions.length > 0) {
+                    payload.pendingBossQuestions = pendingBossQuestions;
+                }
             }
             if (state.stateId === 'failed') {
                 const lastError = failedStateError(context);
@@ -4482,7 +5718,7 @@ export function createXStatePlaybookRuntime(machine, spec) {
                     message,
                     ...(data === undefined ? {} : { data }),
                     state,
-                    ...stateIdentity(state.stateId),
+                    ...stateIdentity(statusTraceStateId(state)),
                 }, position),
             }));
             void enqueueEmission(async () => {
@@ -4523,8 +5759,7 @@ export function createXStatePlaybookRuntime(machine, spec) {
                 controlPlaneError ??= error;
         }
         function consumeActorSettlementAborts(forSnapshot = false) {
-            const aborts = actorSettlementAborts ?? actorSettlementErrorAborts;
-            actorSettlementAborts = undefined;
+            const aborts = actorSettlementAborts.shift() ?? actorSettlementErrorAborts;
             actorSettlementErrorAborts = undefined;
             if (forSnapshot && aborts !== undefined) {
                 // XState can report an errored root through both its inspection
@@ -4599,7 +5834,8 @@ export function createXStatePlaybookRuntime(machine, spec) {
                     try {
                         const snap = inspectionEvent.snapshot;
                         const state = normalizePlaybookSnapshot(snap);
-                        if (state.stateId === undefined) {
+                        if (state.stateId === undefined &&
+                            !(parallelProfile?.states.some(({ stateId }) => state.activeStateIds.includes(stateId)) ?? false)) {
                             throw new Error(`${label} root snapshot must expose exactly one playbook state id`);
                         }
                         const previousState = priorState;
@@ -4612,6 +5848,10 @@ export function createXStatePlaybookRuntime(machine, spec) {
                             latchRuntimeError(error);
                         }
                         if (state.stateId === 'failed') {
+                            if (previousState?.stateId !== 'failed' &&
+                                previousState?.stateId !== recoveryCheckpoint?.stateId) {
+                                recoveryCheckpoint = undefined;
+                            }
                             if (previousState?.stateId !== 'failed' ||
                                 activeGovernedBoundarySeen) {
                                 latchFailedGovernedAttempt();
@@ -4624,6 +5864,9 @@ export function createXStatePlaybookRuntime(machine, spec) {
                         }
                         const context = (snap.context ??
                             {});
+                        if (state.stateId === 'failed') {
+                            bindParkedFailureCause(context, inspectionEvent.event);
+                        }
                         if (state.stateId === BOSS_REPLY_WAIT_STATE_ID &&
                             deferredReconciliationOperationId !== undefined) {
                             priorState = state;
@@ -4635,7 +5878,9 @@ export function createXStatePlaybookRuntime(machine, spec) {
                             validateBoundQuestionProjection();
                         }
                         const payload = structuredStateTelemetryPayload(previousState, state, inspectionEvent.event, context);
-                        const stateStatuses = completeFailedStatuses(statusesForState(state, context, inspectionEvent.event), state, context);
+                        const stateStatuses = completeFailedStatuses(bossRelevantStateIds !== undefined && usesDefaultStatuses
+                            ? parallelStatusesFor(previousState, state, context)
+                            : statusesForState(state, context, inspectionEvent.event), state, context);
                         const outcomeStatuses = usesDefaultStatuses
                             ? acceptedOutcomes.map(({ acceptedOutcome }) => ({
                                 message: `→ ${acceptedOutcome}`,
@@ -4816,13 +6061,17 @@ export function createXStatePlaybookRuntime(machine, spec) {
             emissionQueue.clear();
             judgeQueue.clear();
             appliedReceipts.clear();
+            pendingCohorts.clear();
+            consumedCohortBoundaries.clear();
+            activeBoundaryCalls.clear();
+            cohortCompletionQueue.clear();
             actor = undefined;
             session = undefined;
             savedPorts = undefined;
             runtimePorts = undefined;
             activeSignal = undefined;
             activeAborts = undefined;
-            actorSettlementAborts = undefined;
+            actorSettlementAborts.length = 0;
             actorSettlementErrorAborts = undefined;
             activeAbortEmission = undefined;
             activeTurnId = undefined;
@@ -4850,7 +6099,7 @@ export function createXStatePlaybookRuntime(machine, spec) {
             activeDeferredContinuation = undefined;
             deferInspectionEmissions = false;
             deferredInspectionEmissions = [];
-            lastBossEvent = undefined;
+            recoveryCheckpoint = undefined;
             suppressInspectionEmissions = false;
             initialized = false;
             traceSequence = 0;
@@ -4867,78 +6116,26 @@ export function createXStatePlaybookRuntime(machine, spec) {
                 can.call(snapshot, event) ===
                     true);
         }
-        // DR-034: where the artifact names the FSM context member its entry
-        // action copies the exact Boss text into, that member of the live
-        // snapshot is the retry payload's source. The persisted machine snapshot
-        // carries it, so the candidate derives identically in the process that
-        // exported the snapshot and in one that restored it, and a failure
-        // reached after a Boss reply — whose recorded event the failure state
-        // refuses — is recoverable too. Naming the member is the artifact's
-        // statement that it holds the entry text: a same-named member is never
-        // assumed, since inferring one would turn any matching context member
-        // into a replay payload without its author saying so.
-        // Declared and absent or empty excludes the candidate rather than
-        // falling back to the record, which would make the action depend on the
-        // process again — the very thing this source exists to end.
-        function retryEventFrom(snapshot) {
-            const entryEvent = spec.entryEvent;
-            if (entryEvent?.contextField === undefined)
-                return lastBossEvent;
-            const context = snapshot?.context;
-            const text = isPlainObject(context)
-                ? context[entryEvent.contextField]
-                : undefined;
-            if (typeof text !== 'string' || text.trim() === '')
-                return undefined;
-            return { type: entryEvent.type, [entryEvent.textField]: text };
-        }
-        // The failure-state retry entry replays the recorded last classified
-        // event with its recorded payload, or the entry event the declared
-        // context member above sources. A candidate whose event the live
-        // snapshot does not accept — or whose payload the runtime can source
-        // from neither — is excluded rather than completed with invented text.
-        function retryActionFor(snapshot, stateId) {
-            if (stateId !== 'failed')
-                return undefined;
-            if (!failedAttemptAllowsReplay())
-                return undefined;
-            const retryEvent = retryEventFrom(snapshot);
-            if (retryEvent === undefined)
+        function retryActionFor(stateId) {
+            if (stateId !== 'failed' || !recoveryCheckpoint)
                 return undefined;
-            if (!snapshotCan(snapshot, retryEvent))
-                return undefined;
-            // A recorded explicit-state-jump event names the exact state its
-            // replay re-enters: the root BOSS_INTERRUPT shape is a guarded
-            // multi-arm list keyed on `targetId`, so the first configured arm
-            // may label a different state than the one the recorded event
-            // actually resumes.
-            const recordedTargetId = retryEvent.type === JUMP_EVENT_TYPE
-                ? retryEvent.targetId
-                : undefined;
-            const target = typeof recordedTargetId === 'string' &&
-                recordedTargetId.trim().length > 0
-                ? recordedTargetId
-                : firstTransitionTarget(machine, stateId, retryEvent.type);
-            // PBRT-52: a label is written from a source state description, never
-            // from an identifier. Falling back to the target id — or, with no
-            // resolvable target, to the FSM event type — makes the label *be* the
-            // internal name, which defeats the substitution the label exists for
-            // and puts a machine identifier into Boss-facing text
-            // (CAPPLAY-5). A candidate whose label can only be an id is excluded
-            // exactly like one whose payload cannot be sourced.
-            const description = (target === undefined ? undefined : stateDescriptions.get(target)) ??
-                stateDescriptions.get(stateId);
-            if (description === undefined)
+            const description = stateDescriptions.get(recoveryCheckpoint.stateId);
+            const savedResult = recoveryCheckpoint.result !== undefined;
+            const safe = savedResult
+                ? !hasUnresolvedReconciliation() && currentEffectLedger().boundaries.slice(recoveryCheckpoint.boundaryPrefix)
+                    .every((boundary) => runtimeBoundaryIsOwned(boundary) && boundary.sourceStateId === recoveryCheckpoint.stateId)
+                : stepReplayIsSafe();
+            if (description === undefined || !safe)
                 return undefined;
+            const entry = spec.entryEvent;
+            const target = entry && firstTransitionTarget(machine, stateId, entry.type);
             return {
                 action: {
-                    id: `retry:${retryEvent.type}`,
-                    label: `Retry: ${description}`,
-                    // DR-063 §3: retrying a failed call is `ready` — the runtime cannot
-                    // see whether the Boss changed the outside world since it failed.
+                    id: target === recoveryCheckpoint.stateId ? `retry:${entry.type}` : 'retry:step',
+                    label: `${savedResult ? 'Continue from saved result' : 'Retry'}: ${description}`,
                     standing: 'ready',
                 },
-                event: retryEvent,
+                retryStep: true,
             };
         }
         /**
@@ -4984,6 +6181,21 @@ export function createXStatePlaybookRuntime(machine, spec) {
                 return [];
             }
             const derived = [];
+            const repairable = state.stateId === 'failed' ? repairableReadOnlyBoundary() : undefined;
+            if (repairable !== undefined)
+                derived.push({
+                    action: { id: 'retry:restored-step', label: 'Restore the repository and retry the read-only step', standing: 'ready' },
+                    retryStep: true,
+                    restoreReadOnly: repairable,
+                });
+            const judgment = state.stateId === 'failed' ? recoverableJudgment() : undefined;
+            if (judgment !== undefined)
+                derived.push({
+                    action: { id: 'retry:adjudication', label: 'Retry assessment of the saved result', standing: 'ready' },
+                    retryJudgment: judgment,
+                });
+            if (judgment !== undefined && !hasUnresolvedReconciliation())
+                return derived;
             if (hasUnresolvedReconciliation()) {
                 const operation = deferredReconciliationOperationId === undefined
                     ? undefined
@@ -5012,9 +6224,14 @@ export function createXStatePlaybookRuntime(machine, spec) {
                 });
                 return derived;
             }
-            const retry = retryActionFor(snapshot, state.stateId);
+            const retry = retryActionFor(state.stateId);
             if (retry !== undefined)
                 derived.push(retry);
+            // A jump can repeat earlier work, unlike checkpoint retry. Its whole
+            // failed attempt must therefore still pass the replay fence.
+            if (state.stateId === 'failed' && !failedAttemptAllowsReplay()) {
+                return derived;
+            }
             // Jump entries: resumable targets whose explicit-state-jump event the
             // live snapshot accepts (state guards included), sent with the
             // advertised target id and optional textual fields omitted.
@@ -5077,9 +6294,12 @@ export function createXStatePlaybookRuntime(machine, spec) {
         // state whose source declares no description publishes none: an id is
         // never promoted into a description by default.
         function stateDescriptionFor(state) {
+            // DR-067 §1: inside a parallel state, the meaning published is the
+            // root state's — the parallel parent's own description.
             const keys = [
                 ...(state.stateId === undefined ? [] : [state.stateId]),
                 ...(typeof state.value === 'string' ? [state.value] : []),
+                ...(isPlainObject(state.value) ? Object.keys(state.value) : []),
                 ...state.activeStateIds,
             ];
             for (const key of keys) {
@@ -5123,6 +6343,7 @@ export function createXStatePlaybookRuntime(machine, spec) {
             }
             const boundSession = bindSession(nextSession);
             const boundSnapshot = assertPlaybookRuntimeSnapshot(snapshot, boundSession.playbookId, { allowSuspendedCall: true });
+            validateRecoveryCheckpoint(boundSnapshot.recoveryCheckpoint);
             if (kind === 'adopt' &&
                 effectLedgerCapability !== undefined &&
                 (boundSnapshot.retainedEffectReconciliation?.checkpoint ??
@@ -5189,6 +6410,7 @@ export function createXStatePlaybookRuntime(machine, spec) {
             initInFlight = initialization;
             const initTask = (async () => {
                 session = boundSession;
+                recoveryCheckpoint = boundSnapshot.recoveryCheckpoint;
                 syncDeferredReconciliationOverlay();
                 refreshUnresolvedSemanticReconciliation(effectLedgerMirror);
                 prepareReconstructedGovernedDelivery(boundSnapshot.state, effectLedgerMirror);
@@ -5363,7 +6585,7 @@ export function createXStatePlaybookRuntime(machine, spec) {
             const context = (snapshot
                 ?.context ?? {});
             const actual = state?.stateId === BOSS_REPLY_WAIT_STATE_ID
-                ? pendingBossQuestionFromContext(context)
+                ? singlePendingBossQuestion(state, context)
                 : undefined;
             if (!isDeepStrictEqual(actual, expected)) {
                 throw new Error(`${label} deferred FSM question does not equal its durable binding`);
@@ -5383,7 +6605,7 @@ export function createXStatePlaybookRuntime(machine, spec) {
                     emission();
             }
         }
-        async function continueBoundDeferredOperation(operation, event, signal, turnId, classificationLine) {
+        async function continueBoundDeferredOperation(operation, event, signal, turnId, classificationLine, onAccepted) {
             if (repositoryCapability === undefined) {
                 throw new Error(`${label} deferred continuation requires repository.runDeferred`);
             }
@@ -5429,6 +6651,7 @@ export function createXStatePlaybookRuntime(machine, spec) {
                         continuation.baseline = context?.baseline;
                         continuation.playerContinuation = selectPlayerResume(effectBoundary.roleId, boundPlayerId);
                         continuationStarted = true;
+                        onAccepted?.();
                         actor.send(event);
                         // The host has durably started this boundary and the FSM has
                         // moved: publish the buffered classification line and the
@@ -5622,7 +6845,7 @@ export function createXStatePlaybookRuntime(machine, spec) {
                 const state = normalizePlaybookSnapshot(snapshot);
                 const context = (snapshot.context ??
                     {});
-                const pending = pendingBossQuestionForState(state, context);
+                const pending = singlePendingBossQuestion(state, context);
                 if (pending === undefined ||
                     currentBoundDeferredOperation(pending)?.operationId !== operationId) {
                     throw new TypeError(`${label} restored deferred wait does not equal its FSM question`);
@@ -5678,110 +6901,7 @@ export function createXStatePlaybookRuntime(machine, spec) {
             // Defined only at a safe capture point — initialized, not disposing
             // or disposed, no active public boundary, and the actor quiescent with
             // status `active`.
-            exportSnapshot() {
-                if (!actor || !session || disposed || disposalPromise !== undefined) {
-                    return undefined;
-                }
-                if (activeSignal !== undefined)
-                    return undefined;
-                if (deferredSettlementClosure !== undefined)
-                    return undefined;
-                const pendingCall = nestedBridge.getPendingCall();
-                const bridgeSuspendedCall = nestedBridge.getSuspendedCall();
-                if ((pendingCall === undefined) !== (bridgeSuspendedCall === undefined)) {
-                    return undefined;
-                }
-                let suspendedCall;
-                if (bridgeSuspendedCall !== undefined) {
-                    if (pendingCall?.callId !== bridgeSuspendedCall.callId ||
-                        pendingCall?.playbookId !== bridgeSuspendedCall.playbookId ||
-                        pendingCall?.childSessionId !== bridgeSuspendedCall.childSessionId) {
-                        return undefined;
-                    }
-                    if (!playbookCallTurnIds.has(bridgeSuspendedCall.callId)) {
-                        return undefined;
-                    }
-                    const turnId = playbookCallTurnIds.get(bridgeSuspendedCall.callId);
-                    if (bridgeSuspendedCall.turnId !== undefined &&
-                        bridgeSuspendedCall.turnId !== turnId) {
-                        return undefined;
-                    }
-                    suspendedCall = {
-                        ...bridgeSuspendedCall,
-                        ...(turnId === undefined ? {} : { turnId }),
-                        ...(hasGovernedPlayerStates
-                            ? {
-                                effectBoundaryPrefixSequence: playbookCallEffectPrefixes.get(bridgeSuspendedCall.callId) ?? null,
-                            }
-                            : {}),
-                    };
-                }
-                const state = currentState();
-                if (state.status !== 'active' || !state.quiescent)
-                    return undefined;
-                const context = actor.getSnapshot()
-                    .context;
-                // DR-063 §2: the failed state's `lastError` is persisted as every live
-                // surface publishes it, completed from the runtime's own cause slot, so
-                // a thrown value that refused the cause still explains itself after a
-                // restart.
-                const machineSnapshot = detachPersistedMachineSnapshot(actor.getPersistedSnapshot(), state.stateId === 'failed'
-                    ? { lastError: failedStateError(context ?? {}) }
-                    : {});
-                effectLedgerMirror = currentEffectLedger();
-                refreshRetainedEffectReconciliation(effectLedgerMirror);
-                syncDeferredReconciliationOverlay();
-                refreshUnresolvedSemanticReconciliation(effectLedgerMirror);
-                const pending = !hasUnresolvedReconciliation()
-                    ? pendingBossQuestionForState(state, context ?? {})
-                    : undefined;
-                const failedEffectAttempt = hasGovernedPlayerStates &&
-                    state.stateId === 'failed' &&
-                    failedAttemptMatchesCurrentLedger(effectLedgerMirror)
-                    ? {
-                        boundaryPrefix: failedEffectBoundaryPrefix,
-                        attemptId: failedGovernedAttemptId ?? null,
-                    }
-                    : undefined;
-                return {
-                    schemaVersion: 4,
-                    playbookId: session.playbookId,
-                    machine: machineSnapshot,
-                    roleResumeTokens: snapshotRoleResumeTokens(),
-                    sequences: {
-                        trace: traceSequence,
-                        turn: turnSequence,
-                        judgeCall: judgeCallSequence,
-                        playerCall: playerCallSequence,
-                        playbookCall: playbookCallSequence,
-                        ...(declaredActors.has('captain')
-                            ? { captainCall: captainCallSequence }
-                            : {}),
-                    },
-                    state,
-                    pendingBossQuestions: pending === undefined
-                        ? []
-                        : [
-                            {
-                                questionId: pending.questionId,
-                                asker: pending.asker,
-                                question: pending.question,
-                                sourceItem: pending.sourceItem,
-                            },
-                        ],
-                    effectLedger: effectLedgerMirror,
-                    ...(retainedEffectSourceSessionId === undefined
-                        ? {}
-                        : { retainedEffectSourceSessionId }),
-                    ...(retainedEffectReconciliation === undefined
-                        ? {}
-                        : { retainedEffectReconciliation }),
-                    ...(failedEffectAttempt === undefined
-                        ? {}
-                        : { failedEffectAttempt }),
-                    ...(suspendedCall === undefined ? {} : { suspendedCall }),
-                };
-            },
+            exportSnapshot: (checkpoint) => exportRuntimeSnapshot(checkpoint?.child ? { child: checkpoint.child } : undefined),
             // DR-014 §1 / PBRT-45: alternative to `init` that rehydrates an
             // exported snapshot under the same immutable session identity.
             // Emits no `session.started`, transition trace, or human status —
@@ -5791,13 +6911,19 @@ export function createXStatePlaybookRuntime(machine, spec) {
                 await rehydrateSnapshot('restore', nextSession, snapshot);
             },
             // DR-038 §§1,5 / PBRT-61/PBRT-65: adoption is restore under a fresh
-            // engagement identity and counter lineage, exposed separately so
-            // capability-less bespoke runtimes can omit it. Runtime-visible
-            // preflight mismatches reject before effects; after preflight the new
+            // engagement identity and counter lineage, exposed separately so a
+            // capability-less runtime can omit it. Runtime-visible preflight
+            // mismatches reject before effects; after preflight the new
             // session.started boundary owns failed-start cleanup just like init.
-            async adopt(nextSession, snapshot, context) {
-                await rehydrateSnapshot('adopt', nextSession, snapshot, context);
-            },
+            // DR-067 §2: retained-snapshot adoption stays in the flat domain, so a
+            // machine that declares a parallel state omits the member.
+            ...(parallelProfile === undefined
+                ? {
+                    async adopt(nextSession, snapshot, context) {
+                        await rehydrateSnapshot('adopt', nextSession, snapshot, context);
+                    },
+                }
+                : {}),
             // DR-029 / PBRT-52: side-effect-free control view over the live
             // snapshot, valid at parked quiescence outside an active boundary.
             // The view is detached and frozen; producing it emits nothing and
@@ -5818,9 +6944,9 @@ export function createXStatePlaybookRuntime(machine, spec) {
                 const state = currentState();
                 const context = (snapshot.context ??
                     {});
-                const pending = !hasUnresolvedReconciliation()
-                    ? pendingBossQuestionForState(state, context)
-                    : undefined;
+                const pendingQuestions = !hasUnresolvedReconciliation()
+                    ? pendingBossQuestionsFor(state, context)
+                    : [];
                 const lastError = state.stateId === 'failed'
                     ? failedStateError(context)
                     : normalizeErrorFull(context.lastError);
@@ -5828,24 +6954,45 @@ export function createXStatePlaybookRuntime(machine, spec) {
                 const stateDescription = !hasUnresolvedReconciliation()
                     ? stateDescriptionFor(state)
                     : undefined;
+                const actions = deriveControlActions(snapshot).map(({ action }) => action);
+                const retry = actions.find(({ id, standing }) => id.startsWith('retry:') &&
+                    (standing ?? 'ready') === 'ready');
+                const stoppedBoundary = recoveryCheckpoint === undefined ? undefined :
+                    currentEffectLedger().boundaries.slice(recoveryCheckpoint.boundaryPrefix)
+                        .filter((boundary) => runtimeBoundaryIsOwned(boundary) && boundary.sourceStateId === recoveryCheckpoint.stateId).at(-1);
+                const recovery = recoveryCheckpoint === undefined ||
+                    (pendingQuestions.length === 0 && retry === undefined) ? undefined : {
+                    prompt: recoveryCheckpoint.prompt,
+                    ...(stoppedBoundary === undefined ? {} : { evidence: snapshotJsonValue({
+                            declaredResults: stoppedBoundary.sourceOutcomeSchema,
+                            ...(stoppedBoundary.finalText === undefined ? {} : { savedPlayerText: stoppedBoundary.finalText }),
+                            ...(stoppedBoundary.semanticCandidate === undefined ? {} : { selectedResult: stoppedBoundary.semanticCandidate }),
+                            ...(stoppedBoundary.physicalReceipt === undefined ? {} : { repositoryReceipt: stoppedBoundary.physicalReceipt }),
+                        }) }),
+                    ...(repairableReadOnlyBoundary() === undefined ? {} : {
+                        preparation: `This read-only step changed the repository. Restore its exact original HEAD and visible files before retrying; do not accept its saved result. Preserve user work. You may put generated outputs aside and prevent their return using local environment or ignore settings. Original observation: ${JSON.stringify(repairableReadOnlyBoundary().baseline)}. Observed after the failed step: ${JSON.stringify(repairableReadOnlyBoundary().after)}.`,
+                    }),
+                    ...(stateDescriptions.get(recoveryCheckpoint.stateId) === undefined ? {} :
+                        { description: stateDescriptions.get(recoveryCheckpoint.stateId) }),
+                    continuation: pendingQuestions.length === 0
+                        ? { kind: 'runtime', actionId: retry.id }
+                        : { kind: 'reply' },
+                };
                 return deepFreeze({
                     state,
                     ...(stateDescription === undefined ? {} : { stateDescription }),
                     ...(projectedContext !== undefined
                         ? { context: projectedContext }
                         : {}),
-                    pendingQuestions: pending === undefined
-                        ? []
-                        : [
-                            {
-                                questionId: pending.questionId,
-                                asker: pending.asker,
-                                question: pending.question,
-                                sourceItem: pending.sourceItem,
-                            },
-                        ],
+                    pendingQuestions: pendingQuestions.map((pending) => ({
+                        questionId: pending.questionId,
+                        asker: pending.asker,
+                        question: pending.question,
+                        sourceItem: pending.sourceItem,
+                    })),
                     ...(lastError !== undefined ? { lastError } : {}),
-                    actions: deriveControlActions(snapshot).map(({ action }) => action),
+                    actions,
+                    ...(recovery === undefined ? {} : { recovery }),
                 });
             },
             // DR-029 / PBRT-52: revalidate the named action against the live
@@ -5893,6 +7040,7 @@ export function createXStatePlaybookRuntime(machine, spec) {
                 const callId = `apply-${++applyCallSequence}`;
                 const position = { turnId, callId };
                 activeTurnId = turnId;
+                publicBoundarySequence += 1;
                 beginAutomaticReplayBoundary();
                 activeSignal = signal;
                 activeAborts = abortReasonClassifier(signal);
@@ -6006,7 +7154,11 @@ export function createXStatePlaybookRuntime(machine, spec) {
                             accepted = true;
                             try {
                                 let run;
-                                if (candidate.unresolvedEffectAction === 'abandon') {
+                                if (candidate.retryJudgment !== undefined) {
+                                    await recoverJudgment(candidate.retryJudgment, signal);
+                                    run = runResultFor(settledOutcome(signal));
+                                }
+                                else if (candidate.unresolvedEffectAction === 'abandon') {
                                     signal.throwIfAborted();
                                     run = runResultFor('unresolved-effect');
                                 }
@@ -6025,6 +7177,21 @@ export function createXStatePlaybookRuntime(machine, spec) {
                                         ? 'no-action'
                                         : 'quiescent');
                                 }
+                                else if (candidate.retryStep) {
+                                    if (candidate.restoreReadOnly !== undefined) {
+                                        await confirmReadOnlyRestoration(candidate.restoreReadOnly, signal);
+                                    }
+                                    const checkpoint = recoveryCheckpoint;
+                                    requiredRecoveryBaseline = currentEffectLedger().boundaries
+                                        .slice(checkpoint.boundaryPrefix).find(({ restored }) => restored !== undefined)?.restored;
+                                    try {
+                                        await resumeCheckpoint(checkpoint);
+                                    }
+                                    finally {
+                                        requiredRecoveryBaseline = undefined;
+                                    }
+                                    run = runResultFor(settledOutcome(signal));
+                                }
                                 else {
                                     actor.send(candidate.event);
                                     await waitForPlaybookQuiescence(actor, {
@@ -6037,6 +7204,7 @@ export function createXStatePlaybookRuntime(machine, spec) {
                                 receipt = settledReceipt(run.outcome === 'failed' || run.outcome === 'aborted'
                                     ? {
                                         disposition: 'failed',
+                                        run,
                                         error: ('error' in run ? run.error : undefined) ??
                                             normalizeError(new Error(`apply settled with outcome ${run.outcome}`)),
                                     }
@@ -6064,6 +7232,8 @@ export function createXStatePlaybookRuntime(machine, spec) {
                     if (receipt !== undefined && receipt.disposition !== 'rejected') {
                         appliedReceipts.set(key, receipt);
                     }
+                    if (parallelProfile !== undefined)
+                        await drainBoundaryCalls();
                     try {
                         await drainEmissions();
                     }
@@ -6143,7 +7313,7 @@ export function createXStatePlaybookRuntime(machine, spec) {
                 return receipt;
             },
             unresolvedEffectEnvelopes: unresolvedEffectEnvelopeIdentities,
-            async handleBossInput({ text, signal, }) {
+            async handleBossInput({ text, signal, onAccepted, }) {
                 if (!actor || !savedPorts) {
                     throw new Error('createPlaybookRuntime.handleBossInput: init must be called first');
                 }
@@ -6157,6 +7327,7 @@ export function createXStatePlaybookRuntime(machine, spec) {
                 refreshRetainedEffectFenceFromHost();
                 const turnId = ++turnSequence;
                 activeTurnId = turnId;
+                publicBoundarySequence += 1;
                 beginAutomaticReplayBoundary();
                 activeSignal = signal;
                 activeAborts = abortReasonClassifier(signal);
@@ -6196,7 +7367,7 @@ export function createXStatePlaybookRuntime(machine, spec) {
                             const stateId = normalizePlaybookSnapshot(snapshot).stateId;
                             const snapshotContext = (snapshot
                                 .context ?? {});
-                            deferredPending = pendingBossQuestionForState(normalizePlaybookSnapshot(snapshot), snapshotContext);
+                            deferredPending = singlePendingBossQuestion(normalizePlaybookSnapshot(snapshot), snapshotContext);
                             pendingRequiresDeferredBinding =
                                 deferredPending !== undefined &&
                                     outcomeAuthority?.governedPlayerStates[deferredPending.resumeStateId]?.needsBossReply?.repositoryDisposition === 'deferred' &&
@@ -6246,14 +7417,8 @@ export function createXStatePlaybookRuntime(machine, spec) {
                             deferredOperation !== undefined) {
                             if (isExactDeferredBossReply(classifiedSnapshot, event, deferredPending)) {
                                 const statusLine = classificationStatus(event);
-                                const continuation = await continueBoundDeferredOperation(deferredOperation, event, signal, turnId, statusLine);
+                                const continuation = await continueBoundDeferredOperation(deferredOperation, event, signal, turnId, statusLine, onAccepted);
                                 if (continuation === 'continued') {
-                                    try {
-                                        lastBossEvent = snapshotJsonValue(event, 'recorded Boss event');
-                                    }
-                                    catch {
-                                        lastBossEvent = undefined;
-                                    }
                                     if (controlPlaneError !== undefined) {
                                         throw controlPlaneError;
                                     }
@@ -6262,7 +7427,6 @@ export function createXStatePlaybookRuntime(machine, spec) {
                                         : 'no-action');
                                 }
                                 else {
-                                    lastBossEvent = undefined;
                                     result = runResultFor('no-action');
                                 }
                                 handledDeferred = true;
@@ -6274,7 +7438,6 @@ export function createXStatePlaybookRuntime(machine, spec) {
                             }
                             else {
                                 await parkBoundDeferredOperation(deferredOperation.operationId, signal);
-                                lastBossEvent = undefined;
                                 result = runResultFor('no-action');
                                 handledDeferred = true;
                             }
@@ -6305,16 +7468,7 @@ export function createXStatePlaybookRuntime(machine, spec) {
                                 suppressInspectionEmissions = false;
                                 actor.start();
                             }
-                            // DR-029: keep the classified event with its recorded payload
-                            // as the retry-replay source. Recording is sanitizing, not
-                            // load-bearing: an override classifier's non-JSON-safe event is
-                            // simply not recorded, and the turn proceeds unchanged.
-                            try {
-                                lastBossEvent = snapshotJsonValue(event, 'recorded Boss event');
-                            }
-                            catch {
-                                lastBossEvent = undefined;
-                            }
+                            onAccepted?.();
                             actor.send(event);
                             await waitForPlaybookQuiescence(actor, {
                                 pendingCalls: nestedBridge,
@@ -6327,6 +7481,8 @@ export function createXStatePlaybookRuntime(machine, spec) {
                     catch (error) {
                         operationError = error;
                     }
+                    if (parallelProfile !== undefined)
+                        await drainBoundaryCalls();
                     let drainError;
                     try {
                         await drainEmissions();
@@ -6415,6 +7571,7 @@ export function createXStatePlaybookRuntime(machine, spec) {
                     return runResultFor('no-action');
                 }
                 activeTurnId = playbookCallTurnIds.get(input.callId);
+                publicBoundarySequence += 1;
                 bindAutomaticReplayBoundary(playbookCallEffectPrefixes.has(input.callId)
                     ? playbookCallEffectPrefixes.get(input.callId)
                     : hasGovernedPlayerStates
@@ -6457,6 +7614,8 @@ export function createXStatePlaybookRuntime(machine, spec) {
                             error: normalizeError(input.signal.reason),
                         };
                     }
+                    if (parallelProfile !== undefined)
+                        await drainBoundaryCalls();
                     let drainError;
                     try {
                         await drainEmissions();
@@ -6570,10 +7729,14 @@ export function createXStatePlaybookRuntime(machine, spec) {
                         emissionQueue.clear();
                         judgeQueue.clear();
                         appliedReceipts.clear();
+                        pendingCohorts.clear();
+                        consumedCohortBoundaries.clear();
+                        activeBoundaryCalls.clear();
+                        cohortCompletionQueue.clear();
                         actor = undefined;
                         activeSignal = undefined;
                         activeAborts = undefined;
-                        actorSettlementAborts = undefined;
+                        actorSettlementAborts.length = 0;
                         actorSettlementErrorAborts = undefined;
                         activeAbortEmission = undefined;
                         activeTurnId = undefined;
@@ -6585,7 +7748,6 @@ export function createXStatePlaybookRuntime(machine, spec) {
                         failedGovernedAttemptId = undefined;
                         controlPlaneError = undefined;
                         emissionFailure = undefined;
-                        lastBossEvent = undefined;
                         retainedEffectSourceSessionId = undefined;
                         retainedEffectReconciliation = undefined;
                         retainedEffectReconciliationRequired = false;