@sublang/playbook 15.1.0 → 17.0.0

package/src/xstate-playbook-runtime.ts

@@ -66,6 +66,8 @@ import type {
   PlaybookEffectLogicalOperation,
   PlaybookFailureCause,
   PlaybookPendingBossQuestion,
+  PlaybookPendingCall,
+  PlaybookStepRecord,
   PlaybookPorts,
   PlaybookRepositoryReceipt,
   PlaybookRunResult,
@@ -158,7 +160,7 @@ export interface RuntimeBoundaryCalls {
    * with the cause the boundary decided at the call itself, where the role,
    * the resolved player, and the reported error are known.
    */
-  markPlayerResultFailure?(error: Error): Error;
+  markPlayerResultFailure?(error: Error, result?: PlayerResult): Error;
   callJudge(
     purpose: JudgePurpose,
     stateId: string | undefined,
@@ -339,8 +341,8 @@ export function playerFailureCause(input: {
 /**
  * DR-063 §1: the cause of an unresolved governed settlement. A reconciled
  * mismatch supplies its own receipt-read cause; the reasons a runtime owns map
- * to adjudication, abort, and runtime-defect codes. Shared with DECIDE's
- * bespoke runtime, which decides the same reasons.
+ * to adjudication, abort, and runtime-defect codes. Exported so linked
+ * machinery of an artifact's own decides the same reasons.
  */
 export function governedSettlementCause(
   reason: string,
@@ -365,11 +367,12 @@ export function governedSettlementCause(
 
 /**
  * DR-063 §2: the causes decided for thrown values that cannot carry the
- * marker — a string, a frozen error — kept by identity for as long as the
- * failure stands, so every surface that reads the FSM's own `lastError`
- * publishes the cause decided for exactly that value, whatever turn reads it.
- * A value that carries the marker answers from it; the map is bounded, since
- * only values that refuse the marker need an entry.
+ * marker — a string, a frozen error — and for the record a machine keeps in
+ * place of the thrown value, kept by identity for as long as the failure
+ * stands, so every surface that reads the FSM's own `lastError` publishes the
+ * cause decided for exactly that failure, whatever turn reads it. A value
+ * that carries the marker answers from it; the map is bounded, since only
+ * values that lack the marker need an entry.
  */
 export interface PlaybookFailureCauseRetention {
   retain(error: unknown, cause: PlaybookFailureCause): void;
@@ -396,6 +399,23 @@ export function createFailureCauseRetention(): PlaybookFailureCauseRetention {
   };
 }
 
+/**
+ * DR-063 §2: the value an invoked actor's rejection carried into the machine,
+ * read from the XState error event that delivered it, or `undefined` for any
+ * other event.
+ */
+function actorErrorOf(event: unknown): unknown {
+  if (typeof event !== 'object' || event === null) return undefined;
+  try {
+    const { type, error } = event as { type?: unknown; error?: unknown };
+    return typeof type === 'string' && type.startsWith('xstate.error.actor.')
+      ? error
+      : undefined;
+  } catch {
+    return undefined;
+  }
+}
+
 
 // ---------------------------------------------------------------------------
 // DR-028: both call boundaries treat an `ok` result whose `finalText` is
@@ -508,7 +528,29 @@ type XStateEffectBoundarySeed = Omit<
   'playbookId' | 'canonicalWorktree' | 'baseline' | 'cohortId'
 >;
 
+/** One member's completion inside a repository cohort (DR-067 §1). */
+type XStateRepositoryCohortCompletion<T> =
+  XStateRepositoryExclusiveCompletion<T> & { readonly roleId: string };
+
+interface XStateRepositoryCohortResult<T> {
+  readonly baseline: PlaybookRepositoryReceipt['baseline'];
+  readonly invocationId: string;
+  readonly operations: Readonly<
+    Record<
+      string,
+      XStateRepositoryOperationSettlement<T> | XStateRepositoryOperationRejection
+    >
+  >;
+  readonly receipts: Readonly<Record<string, PlaybookRepositoryReceipt>>;
+  readonly effectLedger: PlaybookEffectLedger;
+}
+
 export interface XStateRepositoryCapability {
+  observe?(): Promise<PlaybookRepositoryReceipt['baseline']>;
+  acquire?(options: { readonly signal: AbortSignal }): Promise<{
+    assertOwner(): Promise<void>;
+    release(): Promise<void>;
+  }>;
   runExclusive<T>(options: {
     readonly signal: AbortSignal;
     readonly effectBoundary: XStateEffectBoundarySeed;
@@ -542,6 +584,34 @@ export interface XStateRepositoryCapability {
     readonly signal: AbortSignal;
     readonly operationId: string;
   }): Promise<XStateRepositoryDeferredParked | XStateRepositoryDeferredRestoreResult>;
+  /**
+   * DR-067 §1 / PBRT-73: one repository claim over the working leaves of a
+   * parallel state entered together — every member an `unchanged` boundary
+   * of one cohort, the operations run concurrently under that claim, and
+   * one completion callback per member. Required for an artifact that
+   * declares a parallel state.
+   */
+  runCohort?<T>(options: {
+    readonly signal: AbortSignal;
+    readonly invocationId: string;
+    readonly roleIds: readonly string[];
+    readonly dispositionsByRole: Readonly<Record<string, readonly ['unchanged']>>;
+    readonly effectBoundaries: Readonly<Record<string, XStateEffectBoundarySeed>>;
+    readonly operations: Readonly<
+      Record<
+        string,
+        (context: {
+          readonly baseline: PlaybookRepositoryReceipt['baseline'];
+          readonly identity: unknown;
+          readonly invocationId: string;
+          readonly roleId: string;
+        }) => Promise<T>
+      >
+    >;
+    readonly completeEffectBoundary: (
+      completion: XStateRepositoryCohortCompletion<T>,
+    ) => XStateRepositoryCompletionEvidence | Promise<XStateRepositoryCompletionEvidence>;
+  }): Promise<XStateRepositoryCohortResult<T>>;
 }
 
 function assertNoConfiguredHostCapabilities(value: unknown, label: string): void {
@@ -643,6 +713,7 @@ function configuredOptionsFromFactoryInput(
 function repositoryCapabilityFromHostCapabilities(
   hostCapabilities: object | undefined,
   label: string,
+  requireCohort = false,
 ): XStateRepositoryCapability {
   const descriptor =
     hostCapabilities === undefined
@@ -659,10 +730,15 @@ function repositoryCapabilityFromHostCapabilities(
     Array.isArray(repository) ||
     typeof (repository as { runExclusive?: unknown }).runExclusive !==
       'function' ||
-    typeof (repository as { runDeferred?: unknown }).runDeferred !== 'function'
+    typeof (repository as { runDeferred?: unknown }).runDeferred !==
+      'function' ||
+    (requireCohort &&
+      typeof (repository as { runCohort?: unknown }).runCohort !== 'function')
   ) {
     throw new TypeError(
-      `${label} schema-3 factory input hostCapabilities.repository must be an own data property exposing runExclusive and runDeferred`,
+      requireCohort
+        ? `${label} schema-3 factory input hostCapabilities.repository must be an own data property exposing runExclusive, runCohort, and runDeferred`
+        : `${label} schema-3 factory input hostCapabilities.repository must be an own data property exposing runExclusive and runDeferred`,
     );
   }
   return repository as XStateRepositoryCapability;
@@ -881,14 +957,7 @@ interface XStatePlaybookRuntimeSpecBase<TOptions> {
   entryEvent?: {
     type: string;
     textField: string;
-    /**
-     * DR-034: the FSM context member this machine's entry action copies the
-     * exact Boss text into. Where it is named, the failure-state retry
-     * builds its payload from that member of the live snapshot instead of
-     * from the process-local recorded event, so the action derives the same
-     * before and after `restore`. Absent: the recorded event stays the
-     * source and the action lives only as long as the process.
-     */
+    /** @deprecated Step checkpoints now carry the accepted input directly. */
     contextField?: string;
   };
   /**
@@ -1118,7 +1187,7 @@ export function normalizeErrorFull(
 // slc/link.md §Abort: cancellation is causal identity with the applicable
 // signal's reason — never an `AbortError` name, never bare signal state. A
 // distinct failure observed while the signal is aborted stays a non-abort
-// control error and takes precedence (mirrors DECIDE's bespoke reference).
+// control error and takes precedence.
 function isAbortFailure(error: unknown, signal: AbortSignal): boolean {
   return signal.aborted && Object.is(error, signal.reason);
 }
@@ -1169,7 +1238,38 @@ function pendingBossQuestionForState(
 export function pendingBossQuestionFromContext(
   context: Record<string, unknown>,
 ): PlaybookPendingBossQuestionContext | undefined {
-  const pending = context.pendingBossQuestion;
+  return pendingBossQuestionRecord(context.pendingBossQuestion);
+}
+
+/**
+ * DR-067 §1: the keyed form of gears2fsm's Boss-reply suspension. Each
+ * well-formed `context.pendingBossQuestions[stateId]` record whose own
+ * `questionId` equals its key counts only while a wait state that resumes
+ * its `resumeStateId` is active, so an answered question the context
+ * retains for the resumed prompt never reads as pending. Ordered by
+ * question id.
+ */
+function keyedPendingBossQuestions(
+  context: Record<string, unknown>,
+  resumesFromActiveWait: (resumeStateId: string) => boolean,
+): PlaybookPendingBossQuestionContext[] {
+  const keyed = context.pendingBossQuestions;
+  if (!isPlainObject(keyed)) return [];
+  const pending: PlaybookPendingBossQuestionContext[] = [];
+  for (const [key, value] of Object.entries(keyed)) {
+    const record = pendingBossQuestionRecord(value);
+    if (record === undefined || record.questionId !== key) continue;
+    if (!resumesFromActiveWait(record.resumeStateId)) continue;
+    pending.push(record);
+  }
+  return pending.sort((left, right) =>
+    left.questionId.localeCompare(right.questionId),
+  );
+}
+
+function pendingBossQuestionRecord(
+  pending: unknown,
+): PlaybookPendingBossQuestionContext | undefined {
   if (
     pending === undefined ||
     pending === null ||
@@ -1647,8 +1747,8 @@ export function defaultBuildJudgePrompt(
  * so the judge omits it. Rendering the clause verbatim asked the judge for
  * `question`, `planningResult`, or `evaluatedRevision`, which the reconciler
  * rejects as a structural error, spending the single correction on a
- * self-inflicted defect. Exported so a bespoke linked runtime (DECIDE's
- * parallel machinery) renders the identical contract instead of restating it.
+ * self-inflicted defect. Exported so linked machinery of an artifact's own
+ * renders the identical contract instead of restating it.
  */
 export function renderGovernedOutcomeContract(
   guard: string,
@@ -1731,6 +1831,7 @@ function buildGovernedJudgePrompt(
     '```',
     '',
     'Pick exactly one declared `guard` and reply with exactly that outcome\'s reply shape below: `guard` plus its semantic-owned fields and nothing else.',
+    'If no declared outcome matches the player output, instead reply exactly {"blocked":"explain the missing outcome or contradictory requirements"}. Never force a match or invent a guard. A blocked reply pauses the playbook for Boss; it is not completion.',
     'A field listed as runtime-supplied is owned by presentation, effect, or runtime evidence; the runtime fills it itself, and a reply that includes one is structurally invalid.',
     '',
   ];
@@ -1879,6 +1980,7 @@ interface PlayerBridgeSpec {
   adjudication: PlayerAdjudicationSpec;
   resumableStateIds: ReadonlySet<string>;
   allowsCorrectiveReplay?: (result: PlayerResult) => boolean;
+  run?: (input: PlaybookPlayerInput, signal: AbortSignal, execute: () => Promise<PlaybookActorOutput>) => Promise<PlaybookActorOutput>;
 }
 
 export function createPlayerBridge(
@@ -1888,8 +1990,7 @@ export function createPlayerBridge(
   boundary?: RuntimeBoundaryCalls,
   onControlPlaneError?: (error: unknown) => void,
 ): PromiseActorLogic<PlaybookActorOutput, PlaybookPlayerInput> {
-  return fromPromise<PlaybookActorOutput, PlaybookPlayerInput>(
-    async ({ input, signal }) => {
+  const execute = async ({ input, signal }: { input: PlaybookPlayerInput; signal: AbortSignal }): Promise<PlaybookActorOutput> => {
       const activeSignal = combineAbortSignals(signal, getActiveSignal?.());
       let roleId: string;
       let prompt: string;
@@ -1943,7 +2044,7 @@ export function createPlayerBridge(
         const failure = new Error(
           result.error ?? `captainBridge: callPlayer status "${result.status}"`,
         );
-        throw boundary?.markPlayerResultFailure?.(failure) ?? failure;
+        throw boundary?.markPlayerResultFailure?.(failure, result) ?? failure;
       }
       const finalText = result.finalText ?? '';
       if (isEmptyFinalText(finalText)) {
@@ -1979,8 +2080,9 @@ export function createPlayerBridge(
         }
         throw error;
       }
-    },
-  );
+    };
+  return fromPromise<PlaybookActorOutput, PlaybookPlayerInput>((args) => spec.run
+    ? spec.run(args.input, args.signal, () => execute(args)) : execute(args));
 }
 
 // ---------------------------------------------------------------------------
@@ -2170,7 +2272,81 @@ function transitionTargets(transition: unknown): string[] {
   return targets;
 }
 
-/** Targets of the FSM's `awaitBossReply` BOSS_REPLY transitions. */
+function transitionArmTargets(transition: unknown): string[] {
+  const arms = Array.isArray(transition) ? transition : [transition];
+  const targets: string[] = [];
+  for (const arm of arms) {
+    if (typeof arm === 'string') {
+      targets.push(arm);
+    } else if (isPlainObject(arm) && typeof arm.target === 'string') {
+      targets.push(arm.target);
+    }
+  }
+  return targets;
+}
+
+function playbookStateIdOf(stateDef: unknown): string | undefined {
+  if (!isPlainObject(stateDef) || !isPlainObject(stateDef.meta)) {
+    return undefined;
+  }
+  const playbook = stateDef.meta.playbook;
+  return isPlainObject(playbook) && typeof playbook.stateId === 'string'
+    ? playbook.stateId
+    : undefined;
+}
+
+function stateTagsOf(stateDef: Record<string, unknown>): readonly string[] {
+  const tags = stateDef.tags;
+  if (typeof tags === 'string') return [tags];
+  return Array.isArray(tags)
+    ? tags.filter((tag): tag is string => typeof tag === 'string')
+    : [];
+}
+
+/** Every explicit node `id` in the config, mapped to its playbook state id. */
+function playbookStateIdsByNodeId(config: unknown): ReadonlyMap<string, string> {
+  const byNodeId = new Map<string, string>();
+  const visit = (stateDef: unknown): void => {
+    if (!isPlainObject(stateDef)) return;
+    const stateId = playbookStateIdOf(stateDef);
+    if (typeof stateDef.id === 'string' && stateId !== undefined) {
+      byNodeId.set(stateDef.id, stateId);
+    }
+    if (isPlainObject(stateDef.states)) {
+      for (const child of Object.values(stateDef.states)) visit(child);
+    }
+  };
+  if (isPlainObject(config) && isPlainObject(config.states)) {
+    for (const child of Object.values(config.states)) visit(child);
+  }
+  return byNodeId;
+}
+
+/**
+ * One transition target written inside a parallel region, resolved to the
+ * playbook state id it names: an `#id` reference through the node ids, and a
+ * bare sibling key through the region's own leaves.
+ */
+function resolveRegionTarget(
+  target: string,
+  regionStates: Record<string, unknown>,
+  byNodeId: ReadonlyMap<string, string>,
+): string {
+  if (target.startsWith('#')) {
+    const nodeId = target.slice(1);
+    return byNodeId.get(nodeId) ?? nodeId;
+  }
+  if (Object.prototype.hasOwnProperty.call(regionStates, target)) {
+    return playbookStateIdOf(regionStates[target]) ?? target;
+  }
+  return target;
+}
+
+/**
+ * Targets of the FSM's `awaitBossReply` BOSS_REPLY transitions, plus — for
+ * the parallel shape gears2fsm compiles (DR-067) — the targets of each
+ * region wait leaf's branch-local BOSS_REPLY arms, resolved to state ids.
+ */
 export function resumableStateIdsFromMachine(
   machine: AnyStateMachine,
 ): ReadonlySet<string> {
@@ -2178,13 +2354,321 @@ export function resumableStateIdsFromMachine(
   if (!isPlainObject(config) || !isPlainObject(config.states)) {
     return new Set();
   }
+  const resumable = new Set<string>();
   const awaitState = config.states[BOSS_REPLY_WAIT_STATE_ID];
-  if (!isPlainObject(awaitState) || !isPlainObject(awaitState.on)) {
-    return new Set();
+  if (isPlainObject(awaitState) && isPlainObject(awaitState.on)) {
+    const bossReply = awaitState.on.BOSS_REPLY;
+    if (bossReply !== undefined) {
+      for (const target of transitionTargets(bossReply)) resumable.add(target);
+    }
+  }
+  const byNodeId = playbookStateIdsByNodeId(config);
+  for (const stateDef of Object.values(config.states)) {
+    if (
+      !isPlainObject(stateDef) ||
+      stateDef.type !== 'parallel' ||
+      !isPlainObject(stateDef.states)
+    ) {
+      continue;
+    }
+    for (const region of Object.values(stateDef.states)) {
+      if (!isPlainObject(region) || !isPlainObject(region.states)) continue;
+      const regionStates = region.states;
+      for (const leaf of Object.values(regionStates)) {
+        if (!isPlainObject(leaf) || !isPlainObject(leaf.on)) continue;
+        const bossReply = leaf.on.BOSS_REPLY;
+        if (bossReply === undefined) continue;
+        for (const target of transitionArmTargets(bossReply)) {
+          resumable.add(resolveRegionTarget(target, regionStates, byNodeId));
+        }
+      }
+    }
+  }
+  return resumable;
+}
+
+/** One region of a compiled parallel state (DR-067 §1). */
+interface XStateParallelRegion {
+  readonly key: string;
+  readonly roleId: string;
+  readonly workingStateId: string;
+  readonly waitStateId: string;
+  readonly finalStateId: string;
+}
+
+/** One root `type: 'parallel'` state of the compiled shape. */
+interface XStateParallelState {
+  readonly stateId: string;
+  readonly regions: readonly XStateParallelRegion[];
+}
+
+/**
+ * The parallel profile derived from a machine that declares a parallel
+ * state (DR-067 §1): its parallel states, each wait state's resume targets
+ * — region waits and the root reply wait alike — and, per state id, the
+ * config nodes whose `on` maps an active state contributes.
+ */
+interface XStateParallelProfile {
+  readonly states: readonly XStateParallelState[];
+  readonly parallelStateByWorkingStateId: ReadonlyMap<
+    string,
+    XStateParallelState
+  >;
+  readonly waitResumeTargets: ReadonlyMap<string, ReadonlySet<string>>;
+  readonly transitionNodesByStateId: ReadonlyMap<
+    string,
+    readonly Record<string, unknown>[]
+  >;
+}
+
+/** One registered cohort member awaiting its cohort's settlement. */
+interface XStateCohortMember {
+  readonly region: XStateParallelRegion;
+  readonly input: PlaybookPlayerInput;
+  readonly roleId: string;
+  readonly playerId: string | undefined;
+  readonly playerKey: string;
+  readonly signal: AbortSignal;
+  readonly effectBoundary: XStateEffectBoundarySeed;
+  readonly run: (
+    callSignal: AbortSignal,
+    cohortCancellation: AbortSignal,
+    preExistingBlock: string | undefined,
+  ) => Promise<PlayerResult>;
+  readonly reportCollision: (callSignal: AbortSignal) => Promise<never>;
+  readonly settled: DeferredValue<PlayerResult>;
+}
+
+/** The cohort of one parallel state within one public boundary. */
+interface PendingCohort {
+  readonly boundarySequence: number;
+  readonly members: Map<string, XStateCohortMember>;
+  started: boolean;
+}
+
+function malformedParallelState(
+  label: string,
+  key: string,
+  reason: string,
+): Error {
+  return new Error(
+    `${label} parallel state ${key} is not the compiled parallel shape: ${reason}`,
+  );
+}
+
+/**
+ * DR-067 §1 / PBRT-52: the factory's domain is flat root states plus root
+ * `type: 'parallel'` states of the one shape gears2fsm compiles — each
+ * region a compound state with exactly one player-invoking `playbook.busy`
+ * working leaf, exactly one `playbook.parked` wait leaf whose BOSS_REPLY
+ * arms resume that working leaf, and exactly one final leaf, every leaf
+ * carrying a stable `meta.playbook.stateId` distinct from every other
+ * state's, and the parent's `onDone` the join. Any other compound state
+ * keeps the flat-domain rejection. Returns `undefined` for a flat machine.
+ */
+function parallelProfileFromMachine(
+  machine: AnyStateMachine,
+  label: string,
+): XStateParallelProfile | undefined {
+  const config = (machine as unknown as { config?: unknown }).config;
+  if (!isPlainObject(config) || !isPlainObject(config.states)) {
+    return undefined;
+  }
+  const rootStates = config.states;
+  const parallelKeys = Object.entries(rootStates)
+    .filter(
+      ([, stateDef]) => isPlainObject(stateDef) && stateDef.type === 'parallel',
+    )
+    .map(([key]) => key);
+  for (const stateDef of Object.values(rootStates)) {
+    if (
+      isPlainObject(stateDef) &&
+      stateDef.type !== 'parallel' &&
+      isPlainObject(stateDef.states) &&
+      Object.keys(stateDef.states).length > 0
+    ) {
+      throw new Error(
+        `${label} declares a compound state; the shared runtime supports only flat single-region FSMs`,
+      );
+    }
+  }
+  if (parallelKeys.length === 0) return undefined;
+
+  const byNodeId = playbookStateIdsByNodeId(config);
+  const seenStateIds = new Set<string>();
+  for (const stateDef of Object.values(rootStates)) {
+    const stateId = playbookStateIdOf(stateDef);
+    if (stateId !== undefined) seenStateIds.add(stateId);
+  }
+  const states: XStateParallelState[] = [];
+  const parallelStateByWorkingStateId = new Map<string, XStateParallelState>();
+  const waitResumeTargets = new Map<string, ReadonlySet<string>>();
+  const transitionNodesByStateId = new Map<
+    string,
+    readonly Record<string, unknown>[]
+  >();
+  for (const key of parallelKeys) {
+    const parent = rootStates[key] as Record<string, unknown>;
+    if (parent.onDone === undefined) {
+      throw malformedParallelState(label, key, 'it declares no onDone join');
+    }
+    if (!isPlainObject(parent.states) || Object.keys(parent.states).length < 2) {
+      throw malformedParallelState(
+        label,
+        key,
+        'it must declare at least two regions',
+      );
+    }
+    const regions: XStateParallelRegion[] = [];
+    const roleIds = new Set<string>();
+    for (const [regionKey, region] of Object.entries(parent.states)) {
+      const regionReason = (reason: string) =>
+        malformedParallelState(label, key, `region ${regionKey} ${reason}`);
+      if (
+        !isPlainObject(region) ||
+        region.type === 'parallel' ||
+        region.type === 'final' ||
+        region.type === 'history' ||
+        !isPlainObject(region.states)
+      ) {
+        throw regionReason('must be a compound state of leaves');
+      }
+      const regionStates = region.states;
+      let working: [string, Record<string, unknown>] | undefined;
+      let wait: [string, Record<string, unknown>] | undefined;
+      let final: [string, Record<string, unknown>] | undefined;
+      for (const [leafKey, leaf] of Object.entries(regionStates)) {
+        if (!isPlainObject(leaf)) {
+          throw regionReason(`leaf ${leafKey} must be a state object`);
+        }
+        if (
+          (isPlainObject(leaf.states) && Object.keys(leaf.states).length > 0) ||
+          leaf.type === 'parallel' ||
+          leaf.type === 'history'
+        ) {
+          throw regionReason(`leaf ${leafKey} must be an atomic state`);
+        }
+        const leafStateId = playbookStateIdOf(leaf);
+        if (leafStateId === undefined || leafStateId.trim().length === 0) {
+          throw regionReason(
+            `leaf ${leafKey} must carry a string meta.playbook.stateId`,
+          );
+        }
+        if (seenStateIds.has(leafStateId)) {
+          throw regionReason(
+            `leaf ${leafKey} reuses playbook state id ${leafStateId}`,
+          );
+        }
+        seenStateIds.add(leafStateId);
+        const invoke = leaf.invoke;
+        const invokes = Array.isArray(invoke) ? invoke : invoke ? [invoke] : [];
+        const tags = stateTagsOf(leaf);
+        if (leaf.type === 'final') {
+          if (final !== undefined) throw regionReason('declares two final leaves');
+          final = [leafKey, leaf];
+        } else if (
+          invokes.length === 1 &&
+          isPlainObject(invokes[0]) &&
+          invokes[0].src === 'player' &&
+          tags.includes('playbook.busy')
+        ) {
+          if (working !== undefined) {
+            throw regionReason('declares two working leaves');
+          }
+          working = [leafKey, leaf];
+        } else if (
+          invokes.length === 0 &&
+          tags.includes('playbook.parked') &&
+          isPlainObject(leaf.on) &&
+          leaf.on.BOSS_REPLY !== undefined
+        ) {
+          if (wait !== undefined) throw regionReason('declares two wait leaves');
+          wait = [leafKey, leaf];
+        } else {
+          throw regionReason(
+            `leaf ${leafKey} is neither its player-invoking playbook.busy working leaf, its playbook.parked BOSS_REPLY wait leaf, nor its final leaf`,
+          );
+        }
+      }
+      if (working === undefined || wait === undefined || final === undefined) {
+        throw regionReason(
+          'must hold exactly one working leaf, one wait leaf, and one final leaf',
+        );
+      }
+      if (region.initial !== working[0]) {
+        throw regionReason('must start in its working leaf');
+      }
+      const workingStateId = playbookStateIdOf(working[1])!;
+      const waitStateId = playbookStateIdOf(wait[1])!;
+      const finalStateId = playbookStateIdOf(final[1])!;
+      const replyTargets = transitionArmTargets(
+        (wait[1].on as Record<string, unknown>).BOSS_REPLY,
+      ).map((target) => resolveRegionTarget(target, regionStates, byNodeId));
+      const regionStateIds = new Set([waitStateId, finalStateId]);
+      if (
+        !replyTargets.includes(workingStateId) ||
+        replyTargets.some((target) => regionStateIds.has(target))
+      ) {
+        throw regionReason(
+          'wait leaf BOSS_REPLY arms must resume its working leaf',
+        );
+      }
+      const workingMeta = (working[1].meta as Record<string, unknown>)
+        .playbook as Record<string, unknown>;
+      const roleId = workingMeta.role;
+      if (typeof roleId !== 'string' || roleId.trim().length === 0) {
+        throw regionReason('working leaf must declare meta.playbook.role');
+      }
+      if (roleIds.has(roleId)) {
+        throw malformedParallelState(
+          label,
+          key,
+          `role ${roleId} works in more than one region`,
+        );
+      }
+      roleIds.add(roleId);
+      regions.push({
+        key: regionKey,
+        roleId,
+        workingStateId,
+        waitStateId,
+        finalStateId,
+      });
+      waitResumeTargets.set(waitStateId, new Set([workingStateId]));
+      for (const [, leaf] of [working, wait, final]) {
+        transitionNodesByStateId.set(playbookStateIdOf(leaf)!, [region, leaf]);
+      }
+    }
+    const parallelState: XStateParallelState = {
+      stateId: key,
+      regions: Object.freeze(regions),
+    };
+    states.push(parallelState);
+    for (const region of regions) {
+      parallelStateByWorkingStateId.set(region.workingStateId, parallelState);
+    }
+    transitionNodesByStateId.set(key, [parent]);
+  }
+  for (const [key, stateDef] of Object.entries(rootStates)) {
+    if (!isPlainObject(stateDef) || parallelKeys.includes(key)) continue;
+    transitionNodesByStateId.set(key, [stateDef]);
+  }
+  const rootWait = rootStates[BOSS_REPLY_WAIT_STATE_ID];
+  if (isPlainObject(rootWait) && isPlainObject(rootWait.on)) {
+    const bossReply = rootWait.on.BOSS_REPLY;
+    if (bossReply !== undefined) {
+      waitResumeTargets.set(
+        BOSS_REPLY_WAIT_STATE_ID,
+        new Set(transitionTargets(bossReply)),
+      );
+    }
   }
-  const bossReply = awaitState.on.BOSS_REPLY;
-  if (bossReply === undefined) return new Set();
-  return new Set(transitionTargets(bossReply));
+  return Object.freeze({
+    states: Object.freeze(states),
+    parallelStateByWorkingStateId,
+    waitResumeTargets,
+    transitionNodesByStateId,
+  });
 }
 
 // ---------------------------------------------------------------------------
@@ -2742,11 +3226,12 @@ function makeDefaultStatusesForState(
       }
       return [
         ...statuses,
-        { message: `${askerLabel(pending.asker)} asks: ${pending.question}` },
+        { message: `${askerLabel(pending.asker)} asks: ${pending.question}`, data: { kind: 'boss-question' } },
         {
           message:
             `◆ awaiting Boss reply · ${pending.resumeStateId} · ` +
             `${askerLabel(pending.asker)} · ${pending.sourceItem}`,
+          data: { kind: 'boss-question' },
         },
       ];
     }
@@ -2997,10 +3482,63 @@ function eventContractPrompt(contract: XStateBossEventSpec): string {
   }`;
 }
 
+/**
+ * DR-067 §1: the questions pending in a parallel-declaring machine — the
+ * keyed records whose resume state an active wait state (a region wait leaf
+ * or the root reply wait) resumes.
+ */
+function parallelPendingBossQuestions(
+  profile: XStateParallelProfile,
+  activeStateIds: readonly string[],
+  context: Record<string, unknown>,
+): PlaybookPendingBossQuestionContext[] {
+  return keyedPendingBossQuestions(context, (resumeStateId) =>
+    activeStateIds.some(
+      (stateId) =>
+        profile.waitResumeTargets.get(stateId)?.has(resumeStateId) === true,
+    ),
+  );
+}
+
+/** Event types the root and every active state node of a parallel machine configure. */
+function parallelConfiguredEventTypes(
+  machine: AnyStateMachine,
+  profile: XStateParallelProfile,
+  activeStateIds: readonly string[],
+): ReadonlySet<string> {
+  const configured = new Set<string>();
+  const config = (machine as unknown as { config?: unknown }).config;
+  if (!isPlainObject(config)) return configured;
+  if (isPlainObject(config.on)) {
+    for (const type of Object.keys(config.on)) configured.add(type);
+  }
+  for (const stateId of activeStateIds) {
+    for (const node of profile.transitionNodesByStateId.get(stateId) ?? []) {
+      if (!isPlainObject(node.on)) continue;
+      for (const type of Object.keys(node.on)) configured.add(type);
+    }
+  }
+  return configured;
+}
+
+function activeStateIdsOf(snapshotOrState: unknown): readonly string[] {
+  const listed = (snapshotOrState as { activeStateIds?: unknown } | null)
+    ?.activeStateIds;
+  if (Array.isArray(listed)) {
+    return listed.filter((stateId): stateId is string => typeof stateId === 'string');
+  }
+  try {
+    return normalizePlaybookSnapshot(snapshotOrState).activeStateIds;
+  } catch {
+    return [];
+  }
+}
+
 function makeDefaultClassifyBossText(
   machine: AnyStateMachine,
   entryEvent: { type: string; textField: string } | undefined,
   bossEvents: readonly XStateBossEventSpec[],
+  parallelProfile?: XStateParallelProfile,
 ): (
   text: string,
   ports: PlaybookPorts,
@@ -3020,16 +3558,54 @@ function makeDefaultClassifyBossText(
     // is answered history, so the prompt must not present it as pending —
     // a judge told a question awaits at the failure state is steered toward
     // a reply it cannot select or toward no action at all.
-    const pending =
-      stateId === BOSS_REPLY_WAIT_STATE_ID
-        ? pendingBossQuestionFromContext(state.context)
-        : undefined;
-    const configuredTypes = configuredEventTypesForState(machine, stateId);
-    const applicable = [...contracts.values()].filter(
-      (contract) =>
-        configuredTypes.has(contract.type) &&
-        (contract.type !== 'BOSS_REPLY' || pending !== undefined),
-    );
+    let pendingQuestions: readonly PlaybookPendingBossQuestionContext[];
+    let configuredTypes: ReadonlySet<string>;
+    if (parallelProfile === undefined) {
+      const pending =
+        stateId === BOSS_REPLY_WAIT_STATE_ID
+          ? pendingBossQuestionFromContext(state.context)
+          : undefined;
+      pendingQuestions = pending === undefined ? [] : [pending];
+      configuredTypes = configuredEventTypesForState(machine, stateId);
+    } else {
+      // DR-067 §1: every question pending in any active wait is offered, and
+      // the events of every active state node apply.
+      const activeStateIds = activeStateIdsOf(snapshotOrState);
+      pendingQuestions = parallelPendingBossQuestions(
+        parallelProfile,
+        activeStateIds,
+        state.context,
+      );
+      configuredTypes = parallelConfiguredEventTypes(
+        machine,
+        parallelProfile,
+        activeStateIds,
+      );
+    }
+    // Several pending questions: a reply must name the one it answers, and
+    // the classifier never guesses among them (gears2fsm §Parallel groups).
+    const severalPending = pendingQuestions.length > 1;
+    const applicable = [...contracts.values()]
+      .filter(
+        (contract) =>
+          configuredTypes.has(contract.type) &&
+          (contract.type !== 'BOSS_REPLY' || pendingQuestions.length > 0),
+      )
+      .map((contract): XStateBossEventSpec =>
+        contract.type === 'BOSS_REPLY' && severalPending
+          ? {
+              type: 'BOSS_REPLY',
+              fields: {
+                questionId: {
+                  source: 'judge',
+                  required: true,
+                  values: pendingQuestions.map(({ questionId }) => questionId),
+                },
+                answer: { source: 'text', required: true },
+              },
+            }
+          : contract,
+      );
 
     const lines = [
       'Classify the following Boss message into exactly one event.',
@@ -3038,13 +3614,18 @@ function makeDefaultClassifyBossText(
       '',
       `Current state: ${currentState}`,
     ];
-    if (pending !== undefined) {
+    for (const pending of pendingQuestions) {
       lines.push(
         `Pending question id: ${pending.questionId}`,
         `Pending asker: ${askerLabel(pending.asker)}`,
         `Pending Boss question: ${pending.question}`,
       );
     }
+    if (severalPending) {
+      lines.push(
+        'Several Boss questions are pending: a BOSS_REPLY must name the questionId of the one question it answers.',
+      );
+    }
     lines.push('', 'Allowed JSON objects:', '- { "type": "NO_ACTION" }');
     for (const contract of applicable) {
       lines.push(`- ${eventContractPrompt(contract)}`);
@@ -3137,20 +3718,23 @@ function makeDefaultClassifyBossText(
     }
 
     if (eventType === 'BOSS_REPLY') {
-      if (pending === undefined) {
+      if (pendingQuestions.length === 0) {
         await ports.emitStatus(
           'Classifier returned BOSS_REPLY without a pending question',
         );
         return undefined;
       }
-      const questionId = event.questionId;
-      if (questionId !== undefined && questionId !== pending.questionId) {
-        await ports.emitStatus(
-          `Classifier supplied unknown questionId for BOSS_REPLY: ${String(questionId)}`,
-        );
-        return undefined;
+      if (!severalPending) {
+        const pending = pendingQuestions[0]!;
+        const questionId = event.questionId;
+        if (questionId !== undefined && questionId !== pending.questionId) {
+          await ports.emitStatus(
+            `Classifier supplied unknown questionId for BOSS_REPLY: ${String(questionId)}`,
+          );
+          return undefined;
+        }
+        event.questionId = pending.questionId;
       }
-      event.questionId = pending.questionId;
     }
     const can = (snapshotOrState as { can?: unknown } | null)?.can;
     if (
@@ -3187,34 +3771,6 @@ interface TracePosition {
   callId?: string;
 }
 
-function machineDeclaresParallelState(machine: AnyStateMachine): boolean {
-  const visit = (stateDef: unknown): boolean => {
-    if (!isPlainObject(stateDef)) return false;
-    if (stateDef.type === 'parallel') return true;
-    if (!isPlainObject(stateDef.states)) return false;
-    return Object.values(stateDef.states).some(visit);
-  };
-  return visit((machine as unknown as { config?: unknown }).config);
-}
-
-// PBRT-52: the factory's domain is FLAT single-region machines — every
-// state a direct child of the root, so each snapshot exposes exactly one
-// playbook state id and every state-keyed lookup (deterministic entries,
-// retry, reply-wait pendingness, configured events, descriptions) indexes
-// one unambiguous identity. A compound child would be accepted and then
-// silently misbehave on all of those gates, so it is rejected up front
-// exactly like a parallel region.
-function machineDeclaresNestedState(machine: AnyStateMachine): boolean {
-  const config = (machine as unknown as { config?: unknown }).config;
-  if (!isPlainObject(config) || !isPlainObject(config.states)) return false;
-  return Object.values(config.states).some(
-    (stateDef) =>
-      isPlainObject(stateDef) &&
-      isPlainObject(stateDef.states) &&
-      Object.keys(stateDef.states).length > 0,
-  );
-}
-
 // PBRT-52: the factory's lookups index states by their root key, and the
 // published playbook identity is `meta.playbook.stateId` — the two must
 // coincide or a machine can advertise a pending question or retry under an
@@ -3309,10 +3865,12 @@ function assertUnfinishedFinalStateIds(
  * the optional parked-session snapshot capability (DR-014) and the retained-
  * snapshot adoption capability (DR-038).
  *
- * Scope: flat single-region machines — no parallel state, no compound
- * child states, and every root state's `meta.playbook.stateId` equal to its
- * state key — so each snapshot exposes exactly one playbook state id.
- * Parallel-region FSMs keep their own linked runtimes.
+ * Scope: flat single-region machines — every root state's
+ * `meta.playbook.stateId` equal to its state key, so each snapshot exposes
+ * exactly one playbook state id — plus the parallel profile of DR-067: root
+ * `type: 'parallel'` states of the shape gears2fsm compiles, whose regions
+ * run as one all-`unchanged` repository cohort with keyed pending questions.
+ * A machine declaring a parallel state omits `adopt`.
  */
 export function createXStatePlaybookRuntime<
   TOptions,
@@ -3348,16 +3906,9 @@ export function createXStatePlaybookRuntime<
       `${label} artifacts must not derive concrete player bindings`,
     );
   }
-  if (machineDeclaresParallelState(machine)) {
-    throw new Error(
-      `${label} uses a parallel state; the shared runtime supports only single-region FSMs`,
-    );
-  }
-  if (machineDeclaresNestedState(machine)) {
-    throw new Error(
-      `${label} declares a compound state; the shared runtime supports only flat single-region FSMs`,
-    );
-  }
+  // DR-067 §1: a flat machine, or one whose only compound states are root
+  // parallel states of the compiled shape; everything else is rejected.
+  const parallelProfile = parallelProfileFromMachine(machine, label);
   assertFlatStateIdentity(machine, label);
   assertUnfinishedFinalStateIds(
     spec.unfinishedFinalStateIds,
@@ -3398,6 +3949,18 @@ export function createXStatePlaybookRuntime<
   const declaredRoleIds = Object.freeze([
     ...new Set([...roleStates.values()].map(({ role }) => role)),
   ]);
+  // DR-067 §1: the Boss-relevant states of a parallel-declaring machine —
+  // each player state, each wait state, and the failure state. A status is
+  // scheduled for each one newly entered, and a status trace names a
+  // `stateId` only while exactly one is active.
+  const bossRelevantStateIds: ReadonlySet<string> | undefined =
+    parallelProfile === undefined
+      ? undefined
+      : new Set([
+          ...roleStates.keys(),
+          ...parallelProfile.waitResumeTargets.keys(),
+          'failed',
+        ]);
   // PBRT-52: the artifact's own ControlView context projection. Nothing is
   // exported by default, so an FSM context member — including one added
   // after this artifact was linked — is private until named here. The two
@@ -3462,6 +4025,7 @@ export function createXStatePlaybookRuntime<
     machine,
     spec.entryEvent,
     spec.bossEvents ?? [],
+    parallelProfile,
   );
   const classifyBossText: NonNullable<
     XStatePlaybookRuntimeSpec<TOptions>['classifyBossText']
@@ -3485,20 +4049,140 @@ export function createXStatePlaybookRuntime<
       return typeof cwd === 'string' ? cwd : undefined;
     });
 
-  const createPlaybookRuntime = function createPlaybookRuntime(
-    factoryOptions: unknown,
-  ): PlaybookRuntime {
-    const construction = configuredOptionsFromFactoryInput(
-      factoryOptions,
-      label,
+  // DR-067 §1: the questions pending in a state — the singular reply-wait
+  // question of a flat machine, or a parallel machine's keyed questions
+  // whose own wait state is active.
+  const pendingBossQuestionsFor = (
+    state: PlaybookState,
+    context: Record<string, unknown>,
+  ): readonly PlaybookPendingBossQuestionContext[] => {
+    if (parallelProfile === undefined) {
+      const pending = pendingBossQuestionForState(state, context);
+      return pending === undefined ? [] : [pending];
+    }
+    return parallelPendingBossQuestions(
+      parallelProfile,
+      state.activeStateIds,
+      context,
     );
-    const configuredOptions = construction.configuredOptions as TOptions;
-    const effectLedgerCapability = construction.effectLedger;
-    const hasGovernedPlayerStates =
-      Object.keys(outcomeAuthority.governedPlayerStates).length > 0;
-    const acceptedOutcomeConsumer = createAcceptedOutcomeConsumer(
-      (source, acceptedOutcome) => {
-        const governedPlayerStates = outcomeAuthority.governedPlayerStates;
+  };
+  const singlePendingBossQuestion = (
+    state: PlaybookState,
+    context: Record<string, unknown>,
+  ): PlaybookPendingBossQuestionContext | undefined => {
+    const pending = pendingBossQuestionsFor(state, context);
+    return pending.length === 1 ? pending[0] : undefined;
+  };
+  // DR-067 §1: a status trace names a `stateId` only while exactly one
+  // Boss-relevant state is active; a flat machine's is its one state.
+  const statusTraceStateId = (state: PlaybookState): string | undefined => {
+    if (bossRelevantStateIds === undefined) return state.stateId;
+    const relevant = state.activeStateIds.filter((stateId) =>
+      bossRelevantStateIds.has(stateId),
+    );
+    return relevant.length === 1 ? relevant[0] : undefined;
+  };
+  // DR-067 §1: a parallel machine schedules statuses for each newly entered
+  // Boss-relevant state — a player state's role line, a wait state's
+  // question lines, and the failure line — diffed against the previous
+  // snapshot's active state ids, so a sibling still running is not
+  // announced again.
+  const parallelStatusesFor = (
+    previousState: PlaybookState | undefined,
+    state: PlaybookState,
+    context: Record<string, unknown>,
+  ): ScheduledStatus[] => {
+    const prior = new Set(previousState?.activeStateIds ?? []);
+    const statuses: ScheduledStatus[] = [];
+    for (const stateId of state.activeStateIds) {
+      if (prior.has(stateId) || !bossRelevantStateIds!.has(stateId)) continue;
+      const resumeTargets = parallelProfile!.waitResumeTargets.get(stateId);
+      if (resumeTargets !== undefined) {
+        const questions = keyedPendingBossQuestions(context, (resumeStateId) =>
+          resumeTargets.has(resumeStateId),
+        );
+        if (questions.length === 0) {
+          statuses.push({ message: 'Awaiting Boss reply.' });
+          continue;
+        }
+        for (const pending of questions) {
+          statuses.push(
+            {
+              message: `${askerLabel(pending.asker)} asks: ${pending.question}`,
+              data: { kind: 'boss-question' },
+            },
+            {
+              message:
+                `◆ awaiting Boss reply · ${pending.resumeStateId} · ` +
+                `${askerLabel(pending.asker)} · ${pending.sourceItem}`,
+              data: { kind: 'boss-question' },
+            },
+          );
+        }
+        continue;
+      }
+      if (stateId === 'failed') {
+        const lastError = normalizeErrorCompact(context.lastError);
+        statuses.push({
+          message: '◆ workflow failed; awaiting Boss recovery.',
+          ...(lastError === undefined
+            ? {}
+            : {
+                data: snapshotJsonValue({ lastError }, 'failed status data'),
+              }),
+        });
+        continue;
+      }
+      const roleState = roleStates.get(stateId);
+      if (roleState !== undefined) {
+        statuses.push({ message: `⤷ ${roleState.role}: ${roleState.label}` });
+      }
+    }
+    return statuses;
+  };
+  // DR-067 §1: each parallel state's region roles, in region order, are one
+  // concurrent role set the FSM exports; a host that forwards those sets in
+  // its schema-3 authority is held to them before any agent call.
+  const assertDeclaredCohorts = (hostCapabilities: object): void => {
+    const authority = Object.getOwnPropertyDescriptor(
+      hostCapabilities,
+      'authority',
+    )?.value;
+    if (!isPlainObject(authority) || !Array.isArray(authority.concurrentRoleSets)) {
+      return;
+    }
+    const declared = authority.concurrentRoleSets as readonly unknown[];
+    for (const parallelState of parallelProfile!.states) {
+      const roles = parallelState.regions.map(({ roleId }) => roleId);
+      if (
+        !declared.some(
+          (candidate) =>
+            Array.isArray(candidate) &&
+            candidate.length === roles.length &&
+            candidate.every((roleId, index) => roleId === roles[index]),
+        )
+      ) {
+        throw new TypeError(
+          `${label} parallel state ${parallelState.stateId} roles [${roles.join(', ')}] are not a declared concurrent role set`,
+        );
+      }
+    }
+  };
+
+  const createPlaybookRuntime = function createPlaybookRuntime(
+    factoryOptions: unknown,
+  ): PlaybookRuntime {
+    const construction = configuredOptionsFromFactoryInput(
+      factoryOptions,
+      label,
+    );
+    const configuredOptions = construction.configuredOptions as TOptions;
+    const effectLedgerCapability = construction.effectLedger;
+    const hasGovernedPlayerStates =
+      Object.keys(outcomeAuthority.governedPlayerStates).length > 0;
+    const acceptedOutcomeConsumer = createAcceptedOutcomeConsumer(
+      (source, acceptedOutcome) => {
+        const governedPlayerStates = outcomeAuthority.governedPlayerStates;
         if (
           !Object.prototype.hasOwnProperty.call(governedPlayerStates, source)
         ) {
@@ -3519,14 +4203,19 @@ export function createXStatePlaybookRuntime<
         ? repositoryCapabilityFromHostCapabilities(
             construction.hostCapabilities,
             label,
+            parallelProfile !== undefined,
           )
         : undefined;
+    if (parallelProfile !== undefined) {
+      assertDeclaredCohorts(construction.hostCapabilities);
+    }
     const currentEffectLedger = (): PlaybookEffectLedger =>
       assertPlaybookEffectLedger(
         effectLedgerCapability.snapshot(),
         `${label} current host effect ledger`,
       );
     let effectLedgerMirror = currentEffectLedger();
+    let recoveryCheckpoint: PlaybookRuntimeSnapshot['recoveryCheckpoint'];
     let retainedEffectSourceSessionId: string | undefined;
     let retainedEffectReconciliation:
       | PlaybookRuntimeSnapshot['retainedEffectReconciliation']
@@ -3591,9 +4280,11 @@ export function createXStatePlaybookRuntime<
     // mutable `activeSignal` alone cannot classify a late invocation reason.
     let activeAborts: AbortReasonClassifier | undefined;
     // The bridge binds the provenance of a child result immediately before
-    // its promise actor settles. The next root snapshot/error consumes this
-    // one-shot so background settlement emissions retain their owner.
-    let actorSettlementAborts: AbortReasonClassifier | undefined;
+    // its promise actor settles. The next root snapshot/error consumes it so
+    // background settlement emissions retain their owner. A flat machine has
+    // one settling actor at a time, so a later binding replaces an unconsumed
+    // one; a parallel machine's settlements queue in order (DR-067 §1).
+    const actorSettlementAborts: (AbortReasonClassifier | undefined)[] = [];
     let actorSettlementErrorAborts: AbortReasonClassifier | undefined;
     // Exact cancellation observed by an emission owned by the active
     // boundary. Ordinary runs settle from their signal/state; apply also
@@ -3643,11 +4334,29 @@ export function createXStatePlaybookRuntime<
     // each successful result, so it is never stale.
     let pendingResultFailureCause: PlaybookFailureCause | undefined;
     // DR-063 §2: the causes decided for thrown values that cannot carry the
-    // marker — a string, a frozen error — kept by identity for as long as the
+    // marker — a string, a frozen error — and for the record a machine keeps
+    // in place of the thrown value, kept by identity for as long as the
     // failure stands, so every surface that reads the FSM's own `lastError`
-    // publishes the cause decided for exactly that value, whatever turn reads
-    // it.
+    // publishes the cause decided for exactly that failure, whatever turn
+    // reads it.
     const failureCauses = createFailureCauseRetention();
+    // DR-063 §2 / DR-067 §1: the cause decided for each non-`ok` player
+    // result, keyed by the result itself, so concurrent region calls never
+    // lend one another the single slot above.
+    const resultFailureCauses = new WeakMap<object, PlaybookFailureCause>();
+    // DR-067 §1: the parallel profile's cohort bookkeeping. Every public
+    // boundary advances the sequence; a parallel state's working leaves run
+    // as one cohort at most once per boundary, and each cohort's semantic
+    // completions — which the host settles concurrently — reconcile one at a
+    // time so their durable correction-budget writes cannot race.
+    let publicBoundarySequence = 0;
+    const consumedCohortBoundaries = new Map<string, number>();
+    const pendingCohorts = new Map<string, PendingCohort>();
+    const cohortCompletionQueue = new PQueue({ concurrency: 1 });
+    // DR-067 §1: every player, judge, and nested call a parallel machine
+    // starts, so a boundary's drain waits for a cancelled sibling whose port
+    // ignores its signal before it settles.
+    const activeBoundaryCalls = new Set<Promise<unknown>>();
     // Previous root-machine state for the inspect-driven telemetry /
     // status emitter. undefined before the first inspect firing.
     let priorState: PlaybookState | undefined;
@@ -3660,12 +4369,6 @@ export function createXStatePlaybookRuntime<
     let playbookCallSequence = 0;
     let captainCallSequence = 0;
     let applyCallSequence = 0;
-    // DR-029: the last event a public Boss boundary sent into the
-    // machine — classified, deterministic entry, or Boss reply — kept with
-    // its recorded payload so a failure-state retry action can replay the
-    // event that drove the run into `failed`. Process-local: the durable
-    // runtime snapshot does not persist it (PBRT-50).
-    let lastBossEvent: EventObject | undefined;
     // DR-029: process-local at-most-once `apply` execution — the accepted receipt
     // recorded for each idempotency key, returned verbatim on a repeated
     // key. A key whose call settled `rejected` or threw before reaching
@@ -3902,7 +4605,7 @@ export function createXStatePlaybookRuntime<
     function boundaryExcludesEffect(boundary: PlaybookEffectBoundary): boolean {
       return (
         boundary.logicalOperationId === undefined &&
-        boundary.physicalReceipt?.classification === 'unchanged'
+        (boundary.physicalReceipt?.classification === 'unchanged' || boundary.restored !== undefined)
       );
     }
 
@@ -3974,7 +4677,7 @@ export function createXStatePlaybookRuntime<
               ({ sequence }) =>
                 sequence > reconstructedGovernedPrefixSequence!,
             );
-      if (candidate === undefined || candidate.sourceStateId !== state.stateId) {
+      if (candidate === undefined || candidate.restored !== undefined || candidate.sourceStateId !== state.stateId) {
         return;
       }
       const persisted = persistedBoundaryReconciliation(candidate, ledger);
@@ -4716,7 +5419,7 @@ export function createXStatePlaybookRuntime<
               ...(descriptor !== undefined
                 ? {
                     state: descriptor,
-                    ...stateIdentity(descriptor.stateId),
+                    ...stateIdentity(statusTraceStateId(descriptor)),
                   }
                 : {}),
             },
@@ -4767,9 +5470,12 @@ export function createXStatePlaybookRuntime<
       // start-only fields, so it passes its own canonical pre-acceptance
       // base (slc/link.md §Playbook trace).
       finishIdentity: Record<string, unknown> = identity,
+      // DR-067 §1: the per-call abort classification a parallel machine's
+      // player pairs enqueue under; absent, the active boundary's.
+      aborts?: AbortReasonClassifier,
     ): Promise<void> {
       try {
-        await emitTrace(startedType, identity, position);
+        await emitTrace(startedType, identity, position, aborts);
       } catch (error) {
         if (!isAbortFailure(error, signal)) controlPlaneError ??= error;
         try {
@@ -4781,6 +5487,7 @@ export function createXStatePlaybookRuntime<
               error: normalizeError(error),
             },
             position,
+            aborts,
           );
         } catch {
           // Preserve the start failure after one best-effort finish attempt.
@@ -5010,12 +5717,46 @@ export function createXStatePlaybookRuntime<
         ...(semanticCandidate === undefined ? {} : { semanticCandidate }),
         correctionBudget: { limit: 1, spent: true },
       };
+      // DR-067 §1 / PBRT-69: a cohort's shared receipt becomes visible for
+      // every member in one ledger revision — publishing only this member's
+      // spend would leave the invalid half-complete cohort the ledger admits
+      // nowhere.
+      const cohortMembers =
+        current.cohortId === undefined
+          ? [current]
+          : currentLedger.boundaries.filter(
+              ({ cohortId }) => cohortId === current.cohortId,
+            );
+      const replacements = cohortMembers.map((member) => {
+        if (member.boundaryId === current.boundaryId) {
+          return { expected: current, next };
+        }
+        if (
+          member.physicalReceipt !== undefined &&
+          !isDeepStrictEqual(member.physicalReceipt, receipt)
+        ) {
+          throw new TypeError(
+            `${label} correction budget cohort conflicts with its shared repository receipt`,
+          );
+        }
+        return {
+          expected: member,
+          next: {
+            ...member,
+            ...(receipt.after === undefined ? {} : { after: receipt.after }),
+            physicalReceipt: receipt,
+          },
+        };
+      }) as [
+        { readonly expected: PlaybookEffectBoundary; readonly next: PlaybookEffectBoundary },
+        ...{
+          readonly expected: PlaybookEffectBoundary;
+          readonly next: PlaybookEffectBoundary;
+        }[],
+      ];
       const acknowledged = assertPlaybookEffectLedger(
         await effectLedgerCapability.writeAhead([
-          {
-            kind: 'replace-boundaries',
-            replacements: [{ expected: current, next }],
-          },
+          { kind: 'replace-boundaries', replacements },
         ]),
         `${label} semantic correction budget acknowledgement`,
       );
@@ -5401,7 +6142,7 @@ export function createXStatePlaybookRuntime<
     function acknowledgeGovernedPlayerResult(
       value: unknown,
       boundaryId: string,
-      source: 'runExclusive' | 'runDeferred' = 'runExclusive',
+      source: 'runExclusive' | 'runDeferred' | 'runCohort' = 'runExclusive',
     ): PlayerResult {
       if (!isPlainObject(value) || !isPlainObject(value.operation)) {
         throw new TypeError(
@@ -5512,7 +6253,7 @@ export function createXStatePlaybookRuntime<
           );
           governedOutput = undefined;
         }
-      } else if (source === 'runExclusive' && value.deferredStatus !== undefined) {
+      } else if (source !== 'runDeferred' && value.deferredStatus !== undefined) {
         throw new TypeError(
           `${label} non-deferred settlement returned a deferred binding status`,
         );
@@ -5600,6 +6341,401 @@ export function createXStatePlaybookRuntime<
       );
     }
 
+    let acceptedStepResult: PlaybookRuntimeSnapshot['recoveryCheckpoint'];
+    let requiredRecoveryBaseline: PlaybookRepositoryReceipt['baseline'] | undefined;
+
+    function captureRecoveryCheckpoint(stateId: string, prompt: string, boundaryPrefix?: number): void {
+      if (requiredRecoveryBaseline !== undefined) return;
+      // Capture after the entry emissions drain: the invocation is now a
+      // real active child in XState's persisted snapshot, before host work.
+      const id = recoveryCheckpoint?.stateId === stateId ? recoveryCheckpoint.id : undefined;
+      recoveryCheckpoint = undefined;
+      if (!actor || currentState().stateId !== stateId) return;
+      try {
+        const current = currentEffectLedger();
+        recoveryCheckpoint = deepFreeze({
+          stateId,
+          prompt,
+          ...(id === undefined ? {} : { id }),
+          machine: detachPersistedMachineSnapshot(actor.getPersistedSnapshot()),
+          boundaryPrefix: boundaryPrefix ?? current.boundaries.length,
+        });
+      } catch {
+        // An in-memory-only context is still executable; it simply cannot
+        // promise a durable step retry. Keep the legacy control behavior.
+      }
+    }
+
+    function stepReplayIsSafe(): boolean {
+      if (!recoveryCheckpoint || hasUnresolvedReconciliation()) return false;
+      const current = currentEffectLedger();
+      return current.boundaries
+        .slice(recoveryCheckpoint.boundaryPrefix)
+        .every(
+          (boundary) =>
+            runtimeBoundaryIsOwned(boundary) &&
+            boundary.logicalOperationId === undefined &&
+            (boundary.physicalReceipt?.classification === 'unchanged' || boundary.restored !== undefined),
+        );
+    }
+
+    function repairableReadOnlyBoundary(): PlaybookEffectBoundary | undefined {
+      if (!recoveryCheckpoint || !repositoryCapability?.observe || !repositoryCapability.acquire ||
+          retainedEffectReconciliationRequired || deferredReconciliationOperationId !== undefined) return undefined;
+      const suffix = currentEffectLedger().boundaries.slice(recoveryCheckpoint.boundaryPrefix);
+      if (suffix.length !== 1) return undefined;
+      const saved = suffix[0]!;
+      if (!runtimeBoundaryIsOwned(saved) || saved.restored !== undefined ||
+          saved.sourceStateId !== recoveryCheckpoint.stateId || saved.cohortId !== undefined ||
+          saved.logicalOperationId !== undefined || saved.dispositions.some((item) => item !== 'unchanged') ||
+          saved.physicalReceipt === undefined || saved.after?.head !== saved.baseline.head ||
+          saved.physicalReceipt.classification === 'unchanged' ||
+          [...unresolvedSemanticBoundaryIds].some((id) => id !== saved.boundaryId)) return undefined;
+      return saved;
+    }
+
+    async function confirmReadOnlyRestoration(saved: PlaybookEffectBoundary, signal: AbortSignal): Promise<void> {
+      const claim = await repositoryCapability!.acquire!({ signal });
+      try {
+        await claim.assertOwner();
+        const restored = snapshotJsonValue(await repositoryCapability!.observe!()) as unknown as PlaybookRepositoryReceipt['baseline'];
+        if (!isDeepStrictEqual(restored, saved.baseline)) {
+          throw new Error(`${label} preparation has not restored the stopped step's repository; it remains paused`);
+        }
+        signal.throwIfAborted();
+        effectLedgerMirror = assertPlaybookEffectLedger(await effectLedgerCapability!.writeAhead([
+          { kind: 'replace-boundaries', replacements: [{ expected: saved, next: { ...saved, restored } }] },
+        ]));
+        if (!isDeepStrictEqual(effectLedgerMirror.boundaries.find(({ boundaryId }) => boundaryId === saved.boundaryId)?.restored, restored)) {
+          throw new Error(`${label} repository restoration was not durably acknowledged`);
+        }
+        refreshUnresolvedSemanticReconciliation(effectLedgerMirror);
+      } finally { await claim.release(); }
+    }
+
+    // A completed commit with saved presentation needs only the missing
+    // tool-free judgment. Never repeat the player to recover that evidence.
+    function recoverableJudgment(): PlaybookEffectBoundary | undefined {
+      if (
+        !recoveryCheckpoint || recoveryCheckpoint.result !== undefined || recoveryCheckpoint.delivered ||
+        retainedEffectReconciliationRequired ||
+        deferredReconciliationOperationId !== undefined
+      )
+        return undefined;
+      const suffix = currentEffectLedger().boundaries.slice(
+        recoveryCheckpoint.boundaryPrefix,
+      );
+      if (suffix.length !== 1) return undefined;
+      const saved = suffix[0]!;
+      if (
+        !runtimeBoundaryIsOwned(saved) ||
+        saved.sourceStateId !== recoveryCheckpoint.stateId ||
+        saved.logicalOperationId !== undefined ||
+        saved.correctionBudget.spent ||
+        saved.physicalReceipt?.classification !== 'one-descendant-commit' ||
+        !saved.finalText?.trim() ||
+        governedOutcomesForBoundary(saved) === undefined ||
+        (saved.semanticCandidate !== undefined &&
+          persistedBoundaryReconciliation(saved, currentEffectLedger())
+            ?.reconciliation.status !== 'resolved') ||
+        [...unresolvedSemanticBoundaryIds].some((id) => id !== saved.boundaryId)
+      )
+        return undefined;
+      return saved;
+    }
+
+    async function recoverJudgment(
+      saved: PlaybookEffectBoundary,
+      signal: AbortSignal,
+    ): Promise<void> {
+      const checkpoint = recoveryCheckpoint!;
+      const persisted = checkpoint.machine as unknown as {
+        children: Record<string, { snapshot: { input: PlaybookPlayerInput } }>;
+      };
+      const input = Object.values(persisted.children)[0]!;
+      const actorInput = input.snapshot.input;
+      const outcomes = governedOutcomesForBoundary(saved)!;
+      const candidate =
+        saved.semanticCandidate ??
+        parseGovernedSemanticCandidate(
+          await boundary.callJudge(
+            'player-output-adjudication',
+            saved.sourceStateId,
+            buildGovernedJudgePrompt(actorInput, saved.finalText!, outcomes),
+            signal,
+          ),
+        );
+      const result = reconcilePlaybookSemanticEvidence({
+        outcomes,
+        semanticCandidate: candidate,
+        finalText: saved.finalText,
+        receipt: saved.physicalReceipt,
+      });
+      signal.throwIfAborted();
+      const next = {
+        ...saved,
+        semanticCandidate: snapshotJsonValue(result.evidence.semanticCandidate),
+      };
+      const acknowledged = assertPlaybookEffectLedger(
+        await effectLedgerCapability!.writeAhead([
+          {
+            kind: 'replace-boundaries',
+            replacements: [{ expected: saved, next }],
+          },
+        ]),
+      );
+      if (
+        !isDeepStrictEqual(
+          acknowledged.boundaries.find((b) => b.boundaryId === saved.boundaryId),
+          next,
+        )
+      ) {
+        throw new Error(
+          `${label} recovered judgment was not acknowledged exactly`,
+        );
+      }
+      effectLedgerMirror = acknowledged;
+      refreshUnresolvedSemanticReconciliation(acknowledged);
+      if (result.status !== 'resolved') {
+        const error = attachPlaybookFailureCause(new Error(
+          result.status === 'unresolved' && 'reason' in result.cause.evidence && result.cause.evidence.reason
+            ? String(result.cause.evidence.reason)
+            : `${label} saved result could not be reconciled; the playbook remains parked`,
+        ), result.status === 'unresolved' ? result.cause : runtimeDefectCause('Saved result still needs a Boss answer'));
+        const paused = detachPersistedMachineSnapshot(actor!.getPersistedSnapshot()) as Record<string, JsonValue>;
+        stopActor();
+        actor = buildActor(runtimePorts!, {
+          ...paused, context: { ...(paused.context as Record<string, JsonValue>), lastError: snapshotJsonValue(normalizeErrorFull(error)) },
+        });
+        suppressInspectionEmissions = false;
+        actor.start();
+        throw error;
+      }
+      await resumeCheckpoint({ ...checkpoint, result: snapshotJsonValue(result.output) });
+    }
+
+    async function resumeCheckpoint(checkpoint: NonNullable<PlaybookRuntimeSnapshot['recoveryCheckpoint']>): Promise<void> {
+      acceptedStepResult = checkpoint;
+      try {
+        stopActor();
+        actor = buildActor(runtimePorts!, checkpoint.machine);
+        suppressInspectionEmissions = false;
+        actor.start();
+        await waitForPlaybookQuiescence(actor, { pendingCalls: nestedBridge });
+      } finally { acceptedStepResult = undefined; }
+    }
+
+    function exportRuntimeSnapshot(checkpoint?: { interrupted?: true; child?: PlaybookPendingCall }): PlaybookRuntimeSnapshot | undefined {
+        if (!actor || !session || disposed || disposalPromise !== undefined) {
+          return undefined;
+        }
+        if (activeSignal !== undefined && checkpoint === undefined) return undefined;
+        if (deferredSettlementClosure !== undefined) return undefined;
+        const pendingCall = checkpoint?.child ?? nestedBridge.getPendingCall();
+        const bridgeSuspendedCall = checkpoint?.child ? nestedBridge.checkpointCall(checkpoint.child) : nestedBridge.getSuspendedCall();
+        if ((pendingCall === undefined) !== (bridgeSuspendedCall === undefined)) {
+          return undefined;
+        }
+        let suspendedCall: typeof bridgeSuspendedCall;
+        if (bridgeSuspendedCall !== undefined) {
+          if (
+            pendingCall?.callId !== bridgeSuspendedCall.callId ||
+            pendingCall?.playbookId !== bridgeSuspendedCall.playbookId ||
+            pendingCall?.childSessionId !== bridgeSuspendedCall.childSessionId
+          ) {
+            return undefined;
+          }
+          if (!playbookCallTurnIds.has(bridgeSuspendedCall.callId)) {
+            return undefined;
+          }
+          const turnId = playbookCallTurnIds.get(bridgeSuspendedCall.callId);
+          if (
+            bridgeSuspendedCall.turnId !== undefined &&
+            bridgeSuspendedCall.turnId !== turnId
+          ) {
+            return undefined;
+          }
+          suspendedCall = {
+            ...bridgeSuspendedCall,
+            ...(turnId === undefined ? {} : { turnId }),
+            ...(hasGovernedPlayerStates
+              ? {
+                  effectBoundaryPrefixSequence:
+                    playbookCallEffectPrefixes.get(
+                      bridgeSuspendedCall.callId,
+                    ) ?? null,
+                }
+              : {}),
+          };
+        }
+        const interrupted = checkpoint?.interrupted && recoveryCheckpoint && machine.root.states.failed;
+        const state = interrupted
+          ? normalizePlaybookSnapshot(machine.resolveState({ value: 'failed', context: {} }))
+          : checkpoint?.child ? normalizePlaybookSnapshot(actor.getSnapshot(), { pendingCall }) : currentState();
+        if (state.status !== 'active' || !state.quiescent) return undefined;
+        const context = (actor.getSnapshot() as { context?: unknown })
+          .context as Record<string, unknown>;
+        // DR-063 §2: the failed state's `lastError` is persisted as every live
+        // surface publishes it, completed from the runtime's own cause slot, so
+        // a thrown value that refused the cause still explains itself after a
+        // restart.
+        const machineSnapshot = detachPersistedMachineSnapshot(
+          interrupted ? { ...recoveryCheckpoint!.machine as object, value: 'failed', children: {} } : actor.getPersistedSnapshot(),
+          state.stateId === 'failed'
+            ? { lastError: interrupted ? { name: 'InterruptedStep', message: 'The process stopped during this step. Review the recorded work before choosing how to continue.', cause: runtimeDefectCause('The process stopped during this step. Review the recorded work before choosing how to continue.') } : failedStateError(context ?? {}) }
+            : {},
+        );
+        effectLedgerMirror = currentEffectLedger();
+        refreshRetainedEffectReconciliation(effectLedgerMirror);
+        syncDeferredReconciliationOverlay();
+        refreshUnresolvedSemanticReconciliation(effectLedgerMirror);
+        const pendingQuestions = !hasUnresolvedReconciliation()
+          ? pendingBossQuestionsFor(state, context ?? {})
+          : [];
+        const interruptedPrefix = interrupted ? activeEffectLedgerPrefixSequence : undefined;
+        const interruptedAttempts = new Set(effectLedgerMirror.boundaries.filter(({ sequence }) => interruptedPrefix !== undefined && sequence > interruptedPrefix).map(({ attemptId }) => attemptId));
+        const failedEffectAttempt = interrupted && interruptedPrefix !== undefined && interruptedAttempts.size <= 1
+          ? { boundaryPrefix: interruptedPrefix, attemptId: interruptedAttempts.values().next().value ?? null }
+          :
+          hasGovernedPlayerStates &&
+          !interrupted && state.stateId === 'failed' &&
+          failedAttemptMatchesCurrentLedger(effectLedgerMirror)
+            ? {
+                boundaryPrefix: failedEffectBoundaryPrefix!,
+                attemptId: failedGovernedAttemptId ?? null,
+              }
+            : undefined;
+        return {
+          schemaVersion: 4,
+          playbookId: session.playbookId,
+          machine: machineSnapshot,
+          roleResumeTokens: snapshotRoleResumeTokens(),
+          sequences: {
+            trace: traceSequence,
+            turn: turnSequence,
+            judgeCall: judgeCallSequence,
+            playerCall: playerCallSequence,
+            playbookCall: playbookCallSequence,
+            ...(declaredActors.has('captain')
+              ? { captainCall: captainCallSequence }
+              : {}),
+          },
+          state,
+          pendingBossQuestions: pendingQuestions.map((pending) => ({
+            questionId: pending.questionId,
+            asker: pending.asker,
+            question: pending.question,
+            sourceItem: pending.sourceItem,
+          })),
+          effectLedger: effectLedgerMirror,
+          ...(retainedEffectSourceSessionId === undefined
+            ? {}
+            : { retainedEffectSourceSessionId }),
+          ...(retainedEffectReconciliation === undefined
+            ? {}
+            : { retainedEffectReconciliation }),
+          ...(failedEffectAttempt === undefined
+            ? {}
+            : { failedEffectAttempt }),
+          ...((state.stateId === 'failed' || pendingQuestions.length > 0) && recoveryCheckpoint !== undefined
+            ? { recoveryCheckpoint } : {}),
+          ...(suspendedCall === undefined ? {} : { suspendedCall }),
+        };
+    }
+
+    async function runJournalledStep(
+      kind: PlaybookStepRecord['kind'],
+      input: PlaybookPlayerInput | PlaybookCaptainInput | PlaybookScriptInput,
+      signal: AbortSignal,
+      execute: () => Promise<PlaybookActorOutput>,
+    ): Promise<PlaybookActorOutput> {
+      const saved = acceptedStepResult;
+      let output: PlaybookActorOutput;
+      if (saved?.stateId === input.stateId && saved.result !== undefined) {
+        acceptedStepResult = undefined;
+        recoveryCheckpoint = saved;
+        output = snapshotJsonValue(saved.result) as PlaybookActorOutput;
+      } else {
+        const record = savedPorts?.recordStep;
+        await drainEmissions();
+        signal.throwIfAborted();
+        try {
+          captureRecoveryCheckpoint(input.stateId, 'command' in input ? input.command : 'role' in input ? composeBoundPlayerPrompt(input) : composeCaptainPrompt(input));
+        } catch (error) {
+          if (!isAbortFailure(error, signal)) controlPlaneError ??= error;
+          throw error;
+        }
+        if (record) {
+          const id = randomUUID();
+          if (recoveryCheckpoint) recoveryCheckpoint = { ...recoveryCheckpoint, id };
+          const step = { id, kind, stateId: input.stateId };
+          await record(step, exportRuntimeSnapshot({ interrupted: true }));
+          signal.throwIfAborted();
+          const result = snapshotJsonValue(await execute());
+          // Keep the known output if its save loses acknowledgement. A drained
+          // failure can then preserve it without treating the call as unexecuted.
+          if (recoveryCheckpoint?.id === id) recoveryCheckpoint = { ...recoveryCheckpoint, result };
+          await record({ ...step, result });
+          output = result as PlaybookActorOutput;
+        } else {
+          output = await execute();
+        }
+      }
+      if (recoveryCheckpoint?.stateId === input.stateId) {
+        const { result: _result, ...start } = recoveryCheckpoint;
+        recoveryCheckpoint = { ...start, delivered: true };
+      }
+      return output;
+    }
+
+    function validateRecoveryCheckpoint(
+      checkpoint: PlaybookRuntimeSnapshot['recoveryCheckpoint'],
+    ): void {
+      if (!checkpoint) return;
+      const node = machine.root.states[checkpoint.stateId];
+      const persisted = checkpoint.machine as Record<string, JsonValue>;
+      const children = persisted.children;
+      if (
+        !node ||
+        node.invoke.length !== 1 ||
+        !['player', 'captain', 'script'].includes(String(node.invoke[0]!.src)) ||
+        !isPlainObject(children) ||
+        Object.keys(children).length !== 1
+      ) {
+        throw new TypeError(
+          `${label} recovery checkpoint does not name one current invocation`,
+        );
+      }
+      const child = children[node.invoke[0]!.id] as
+        Record<string, JsonValue> | undefined;
+      if (
+        !child ||
+        child.src !== node.invoke[0]!.src ||
+        !isPlainObject(child.snapshot) ||
+        child.snapshot.status !== 'active' ||
+        !isPlainObject(child.snapshot.input) ||
+        child.snapshot.input.stateId !== checkpoint.stateId
+      ) {
+        throw new TypeError(
+          `${label} recovery checkpoint invocation is incompatible`,
+        );
+      }
+      if (checkpoint.result !== undefined) {
+        const output = checkpoint.result;
+        const input = child.snapshot.input;
+        if (!isPlainObject(output) || typeof output.guard !== 'string' ||
+            !isPlainObject(input.result) || !Object.hasOwn(input.result, output.guard) ||
+            (node.invoke[0]!.src === 'script' &&
+              (!Number.isInteger(output.exitStatus) || Object.keys(output).sort().join(',') !== 'exitStatus,guard' ||
+                output.guard !== Object.keys(input.result)[output.exitStatus === 0 ? 0 : Math.min(1, Object.keys(input.result).length - 1)]))) {
+          throw new TypeError(`${label} saved step result is incompatible with its invocation`);
+        }
+        for (const field of extractFields(String(input.result[output.guard]))) {
+          if (output[field] === undefined || output[field] === null) throw new TypeError(`${label} saved step result is missing ${field}`);
+        }
+      }
+    }
+
     function captureEffectLedgerPrefixSequence(): number | undefined {
       if (!hasGovernedPlayerStates) return undefined;
       try {
@@ -5672,6 +6808,371 @@ export function createXStatePlaybookRuntime<
       failedGovernedAttemptId = attemptIds.values().next().value;
     }
 
+    // -----------------------------------------------------------------
+    // DR-067 §1: the parallel profile's repository cohort. The working
+    // leaves of one parallel state entered together run under one
+    // `runCohort` claim, each member an `unchanged` boundary: a member's
+    // result is adjudicated through the one reconciler in serial, a spent
+    // correction rewrites every member's boundary in one acknowledged batch,
+    // members are acknowledged and released in completion order, and a
+    // member's failure cancels its siblings and fails the cohort with the
+    // cause decided first.
+    // -----------------------------------------------------------------
+
+    function trackBoundaryCall<T>(call: Promise<T>): Promise<T> {
+      if (parallelProfile === undefined) return call;
+      activeBoundaryCalls.add(call);
+      const forget = (): void => {
+        activeBoundaryCalls.delete(call);
+      };
+      void call.then(forget, forget);
+      return call;
+    }
+
+    async function drainBoundaryCalls(): Promise<void> {
+      while (activeBoundaryCalls.size > 0) {
+        await Promise.allSettled([...activeBoundaryCalls]);
+      }
+    }
+
+    function cohortParallelStateFor(
+      stateId: string,
+    ): XStateParallelState | undefined {
+      const parallelState =
+        parallelProfile?.parallelStateByWorkingStateId.get(stateId);
+      if (parallelState === undefined) return undefined;
+      if (
+        consumedCohortBoundaries.get(parallelState.stateId) ===
+        publicBoundarySequence
+      ) {
+        return undefined;
+      }
+      const pending = pendingCohorts.get(parallelState.stateId);
+      if (
+        pending !== undefined &&
+        pending.boundarySequence === publicBoundarySequence &&
+        !pending.started
+      ) {
+        return parallelState;
+      }
+      const active = currentState().activeStateIds;
+      return parallelState.regions.every(({ workingStateId }) =>
+        active.includes(workingStateId),
+      )
+        ? parallelState
+        : undefined;
+    }
+
+    function startCohort(
+      parallelState: XStateParallelState,
+      cohort: PendingCohort,
+    ): void {
+      cohort.started = true;
+      consumedCohortBoundaries.set(
+        parallelState.stateId,
+        cohort.boundarySequence,
+      );
+      if (pendingCohorts.get(parallelState.stateId) === cohort) {
+        pendingCohorts.delete(parallelState.stateId);
+      }
+    }
+
+    async function joinCohort(
+      parallelState: XStateParallelState,
+      member: XStateCohortMember,
+    ): Promise<PlayerResult> {
+      let cohort = pendingCohorts.get(parallelState.stateId);
+      if (
+        cohort === undefined ||
+        cohort.boundarySequence !== publicBoundarySequence ||
+        cohort.started
+      ) {
+        cohort = {
+          boundarySequence: publicBoundarySequence,
+          members: new Map(),
+          started: false,
+        };
+        pendingCohorts.set(parallelState.stateId, cohort);
+      }
+      const registered = cohort;
+      if (registered.members.has(member.region.key)) {
+        throw new Error(
+          `${label} parallel state ${parallelState.stateId} registered region ${member.region.key} twice`,
+        );
+      }
+      registered.members.set(member.region.key, member);
+      // A member whose invocation stops before every sibling registered —
+      // its region exited, or the boundary aborted — leaves no cohort to
+      // run: each registered member settles with its own cancellation and
+      // the boundary's cohort is spent.
+      const withdraw = (): void => {
+        if (registered.started) return;
+        startCohort(parallelState, registered);
+        for (const candidate of registered.members.values()) {
+          candidate.settled.reject(
+            candidate.signal.aborted
+              ? candidate.signal.reason
+              : member.signal.reason,
+          );
+        }
+      };
+      if (member.signal.aborted) {
+        withdraw();
+      } else {
+        member.signal.addEventListener('abort', withdraw, { once: true });
+      }
+      if (
+        !registered.started &&
+        registered.members.size === parallelState.regions.length
+      ) {
+        startCohort(parallelState, registered);
+        void settleCohort(parallelState, registered);
+      }
+      return await member.settled.promise;
+    }
+
+    async function settleCohort(
+      parallelState: XStateParallelState,
+      cohort: PendingCohort,
+    ): Promise<void> {
+      const members = parallelState.regions.map(
+        ({ key }) => cohort.members.get(key)!,
+      );
+      const cancellation = new AbortController();
+      const completionOrder: XStateCohortMember[] = [];
+      const decided = new Map<
+        XStateCohortMember,
+        {
+          readonly error: unknown;
+          readonly cause: PlaybookFailureCause | undefined;
+          readonly sequence: number;
+        }
+      >();
+      let decisionSequence = 0;
+      // DR-063 §2: each member failure is one decision, ordered as it was
+      // decided, with the cause decided for exactly that value at that
+      // moment — so a value a sibling later rethrows cannot rename it.
+      const decide = (
+        member: XStateCohortMember,
+        error: unknown,
+        cause: PlaybookFailureCause | undefined = failureCauses.causeOf(error),
+      ): void => {
+        if (decided.has(member)) return;
+        decided.set(member, { error, cause, sequence: ++decisionSequence });
+      };
+      const isCancellation = (error: unknown): boolean =>
+        cancellation.signal.aborted &&
+        Object.is(error, cancellation.signal.reason) &&
+        !activeAborts?.isAbortReason(error);
+      const operationFor =
+        (member: XStateCohortMember) =>
+        async (
+          context:
+            | { readonly baseline?: PlaybookRepositoryReceipt['baseline'] }
+            | undefined,
+        ): Promise<PlayerResult> => {
+          const callSignal = combineAbortSignals(
+            member.signal,
+            cancellation.signal,
+          );
+          try {
+            if (activePlayerKeys.has(member.playerKey)) {
+              await member.reportCollision(callSignal);
+            }
+            activePlayerKeys.add(member.playerKey);
+            try {
+              const result = await member.run(
+                callSignal,
+                cancellation.signal,
+                effectAuthorizedPreExistingBlock(
+                  member.effectBoundary,
+                  context?.baseline,
+                ),
+              );
+              if (result.status !== 'ok' && !cancellation.signal.aborted) {
+                // DR-063 §2: the failure built for a non-`ok` member result
+                // carries the cause decided for exactly that result, and its
+                // siblings are cancelled with it.
+                const cause =
+                  resultFailureCauses.get(result) ??
+                  runtimeDefectCause(
+                    `callPlayer status ${JSON.stringify(result.status)}`,
+                  );
+                const failure = attachPlaybookFailureCause(
+                  markFsmResultFailure(
+                    new Error(
+                      result.error ??
+                        `captainBridge: callPlayer status "${result.status}"`,
+                    ),
+                  ),
+                  cause,
+                );
+                failureCauses.retain(failure, cause);
+                decide(member, failure, cause);
+                cancellation.abort(failure);
+              }
+              return result;
+            } finally {
+              activePlayerKeys.delete(member.playerKey);
+            }
+          } catch (error) {
+            if (!isCancellation(error)) decide(member, error);
+            if (!cancellation.signal.aborted) cancellation.abort(error);
+            throw error;
+          } finally {
+            completionOrder.push(member);
+          }
+        };
+      const completeEffectBoundary = (
+        completion: XStateRepositoryCohortCompletion<PlayerResult>,
+      ): Promise<XStateRepositoryCompletionEvidence> =>
+        cohortCompletionQueue.add(async () => {
+          const member = members.find(
+            ({ roleId }) => roleId === completion.roleId,
+          );
+          if (
+            member === undefined ||
+            completion.boundary.boundaryId !== member.effectBoundary.boundaryId
+          ) {
+            throw new TypeError(
+              `${label} repository cohort completed an undeclared member`,
+            );
+          }
+          const evidence = await completionEvidenceFor(
+            member.input,
+            member.roleId,
+            member.playerId,
+            member.signal,
+            undefined,
+          )(completion);
+          const settlement = governedSettlementsByBoundaryId.get(
+            member.effectBoundary.boundaryId,
+          );
+          if (settlement?.status === 'unresolved') {
+            decide(member, settlement.error);
+          }
+          return evidence;
+        }) as Promise<XStateRepositoryCompletionEvidence>;
+      const runSignal = activeSignal ?? members[0]!.signal;
+      const invocationId = randomUUID();
+      let settled: XStateRepositoryCohortResult<PlayerResult>;
+      try {
+        for (const member of members) member.signal.throwIfAborted();
+        settled = await repositoryCapability!.runCohort!<PlayerResult>({
+          signal: runSignal,
+          invocationId,
+          roleIds: members.map(({ roleId }) => roleId),
+          dispositionsByRole: Object.fromEntries(
+            members.map(({ roleId }) => [roleId, ['unchanged'] as const]),
+          ),
+          effectBoundaries: Object.fromEntries(
+            members.map(({ roleId, effectBoundary }) => [
+              roleId,
+              effectBoundary,
+            ]),
+          ),
+          operations: Object.fromEntries(
+            members.map((member) => [member.roleId, operationFor(member)]),
+          ),
+          completeEffectBoundary,
+        });
+        if (!isPlainObject(settled) || settled.invocationId !== invocationId) {
+          throw new TypeError(
+            `${label} repository cohort changed its invocation identity`,
+          );
+        }
+      } catch (error) {
+        for (const member of members) {
+          governedSettlementsByBoundaryId.delete(
+            member.effectBoundary.boundaryId,
+          );
+          governedCompletionEvidenceByBoundaryId.delete(
+            member.effectBoundary.boundaryId,
+          );
+          refreshGovernedBoundaryStart(member.effectBoundary.boundaryId);
+        }
+        if (!isAbortFailure(error, runSignal)) controlPlaneError ??= error;
+        for (const member of members) member.settled.reject(error);
+        return;
+      }
+      const releaseOrder = [
+        ...completionOrder,
+        ...members.filter((member) => !completionOrder.includes(member)),
+      ];
+      const acknowledged = new Map<XStateCohortMember, PlayerResult>();
+      const failures = new Map<XStateCohortMember, unknown>();
+      for (const member of releaseOrder) {
+        const operation = isPlainObject(settled.operations)
+          ? settled.operations[member.roleId]
+          : undefined;
+        try {
+          const result = acknowledgeGovernedPlayerResult(
+            {
+              operation,
+              receipt: isPlainObject(settled.receipts)
+                ? settled.receipts[member.roleId]
+                : undefined,
+              effectLedger: settled.effectLedger,
+            },
+            member.effectBoundary.boundaryId,
+            'runCohort',
+          );
+          acknowledged.set(member, result);
+          const settlement = governedPlayerSettlements.get(result);
+          if (settlement?.status === 'unresolved') {
+            failures.set(member, settlement.error);
+          } else if (result.status !== 'ok') {
+            failures.set(member, decided.get(member)?.error);
+          }
+        } catch (error) {
+          failures.set(member, error);
+          const operationReason =
+            isPlainObject(operation) &&
+            operation.status === 'rejected' &&
+            Object.is(operation.reason, error);
+          if (!operationReason) {
+            // An acknowledgement the host could not prove is a control-plane
+            // defect, exactly as on the exclusive path.
+            if (!isAbortFailure(error, runSignal)) controlPlaneError ??= error;
+            decide(member, error);
+          }
+        } finally {
+          governedSettlementsByBoundaryId.delete(
+            member.effectBoundary.boundaryId,
+          );
+          governedCompletionEvidenceByBoundaryId.delete(
+            member.effectBoundary.boundaryId,
+          );
+        }
+      }
+      if (failures.size === 0) {
+        for (const member of releaseOrder) {
+          member.settled.resolve(acknowledged.get(member)!);
+        }
+        return;
+      }
+      for (const result of acknowledged.values()) {
+        governedPlayerSettlements.delete(result);
+      }
+      const first = [...decided.values()].sort(
+        (left, right) => left.sequence - right.sequence,
+      )[0];
+      const failure =
+        first?.error ??
+        failures.get(releaseOrder.find((member) => failures.has(member))!) ??
+        markFsmResultFailure(
+          new Error(
+            `${label} parallel state ${parallelState.stateId} cohort failed`,
+          ),
+        );
+      const cause = first?.cause ?? failureCauses.causeOf(failure);
+      if (cause !== undefined) {
+        failureCauses.retain(failure, cause);
+        attachPlaybookFailureCause(failure, cause);
+      }
+      for (const member of members) member.settled.reject(failure);
+    }
+
     const boundary: RuntimeBoundaryCalls = {
       async callPlayer(
         input,
@@ -5729,16 +7230,192 @@ export function createXStatePlaybookRuntime<
         };
 
         const playerKey = continuationKey(roleId, playerId);
-        if (activePlayerKeys.has(playerKey)) {
+        const runTracedPlayerCall = async (
+          resume: string | false = selectedResume,
+          // DR-062 §4: composed from this call's own baseline observation,
+          // so the prompt the trace records is the prompt the player is sent.
+          preExistingBlock?: string,
+          // DR-067 §1: a cohort member's call signal also carries its
+          // cohort's sibling cancellation.
+          callSignal: AbortSignal = signal,
+          cohortCancellation?: AbortSignal,
+        ): Promise<PlayerResult> => {
+          const identity = callIdentity(resume);
+          // DR-067 §1: a parallel machine classifies aborts per call, so a
+          // trace sink rejecting with a sibling's cancellation is forgiven
+          // for that call alone.
+          const traceAborts =
+            parallelProfile === undefined
+              ? undefined
+              : abortReasonClassifier(callSignal, activeAborts);
+          const withPreExisting = (text: string): string =>
+            preExistingBlock === undefined
+              ? text
+              : `${text}\n\n${preExistingBlock}`;
+          const callPrompt = withPreExisting(
+            resume === false ? freshPrompt : prompt,
+          );
+          const callFreshPrompt = withPreExisting(freshPrompt);
+          await emitCallStarted(
+            'player.call.started',
+            'player.call.finished',
+            { ...identity, prompt: callPrompt },
+            position,
+            callSignal,
+            undefined,
+            traceAborts,
+          );
+
+          let rawResult: unknown;
+          try {
+            // An abort may land while the awaited started emission drains
+            // (e.g. fired from the trace sink itself); the host call must
+            // never start after abort, so settle the already-started pair
+            // as `aborted` through the catch below.
+            callSignal.throwIfAborted();
+            rawResult = await requireHostPorts().callPlayer(
+              roleId,
+              callPrompt,
+              callSignal,
+              {
+                resume,
+                ...(callPrompt === callFreshPrompt
+                  ? {}
+                  : { freshPrompt: callFreshPrompt }),
+              },
+            );
+            // A host promise is not required to honor cancellation. Do not
+            // let a late result mutate continuity or publish a successful
+            // finish.
+            callSignal.throwIfAborted();
+          } catch (error) {
+            if (!isAbortFailure(error, callSignal)) controlPlaneError ??= error;
+            try {
+              await emitTrace(
+                'player.call.finished',
+                {
+                  ...identity,
+                  status: isAbortFailure(error, callSignal)
+                    ? 'aborted'
+                    : 'error',
+                  error: normalizeError(error),
+                },
+                position,
+                traceAborts,
+              );
+            } catch {
+              // The original non-abort port rejection remains authoritative.
+            }
+            // A thrown port call carries no authoritative result, so the
+            // prior token remains available for a later explicit resume.
+            throw decidePlayerCallFailure(
+              error,
+              roleId,
+              playerId,
+              callSignal,
+              cohortCancellation,
+            );
+          }
+
+          let result: PlayerResult;
+          try {
+            result = validatePlayerResult(rawResult);
+          } catch (error) {
+            if (!isAbortFailure(error, callSignal)) controlPlaneError ??= error;
+            try {
+              await emitTrace(
+                'player.call.finished',
+                { ...identity, status: 'error', error: normalizeError(error) },
+                position,
+                traceAborts,
+              );
+            } catch {
+              // The malformed host result remains authoritative.
+            }
+            throw decidePlayerCallFailure(
+              error,
+              roleId,
+              playerId,
+              callSignal,
+              cohortCancellation,
+            );
+          }
+
+          try {
+            updatePlayerResume(roleId, playerId, result);
+          } catch (error) {
+            if (!isAbortFailure(error, callSignal)) controlPlaneError ??= error;
+            try {
+              await emitTrace(
+                'player.call.finished',
+                { ...identity, status: 'error', error: normalizeError(error) },
+                position,
+                traceAborts,
+              );
+            } catch {
+              // The continuation-store failure remains authoritative.
+            }
+            throw error;
+          }
+
+          await emitTrace(
+            'player.call.finished',
+            {
+              ...identity,
+              status: result.status,
+              ...(result.finalText !== undefined
+                ? { finalText: result.finalText }
+                : {}),
+              ...(result.error !== undefined
+                ? { error: normalizeError(result.error) }
+                : {}),
+              ...(result.resumeToken !== undefined
+                ? { resumeToken: result.resumeToken }
+                : {}),
+            },
+            position,
+            traceAborts,
+          );
+          // DR-063 §2: the player bridge builds the failure Error for a
+          // non-`ok` result, so the cause is decided here, where the role,
+          // the player, and the reported error are known, and a successful
+          // result clears it so no later failure inherits it.
+          if (result.status === 'ok') {
+            pendingResultFailureCause = undefined;
+          } else if (result.status === 'aborted') {
+            pendingResultFailureCause = ABORTED_FAILURE_CAUSE;
+          } else {
+            pendingResultFailureCause = playerFailureCause({
+              roleId,
+              ...(playerId === undefined ? {} : { playerId }),
+              error:
+                result.error ??
+                `callPlayer status ${JSON.stringify(result.status)}`,
+            });
+          }
+          if (pendingResultFailureCause !== undefined) {
+            resultFailureCauses.set(result, pendingResultFailureCause);
+          }
+          return result;
+        };
+        const reportPlayerKeyCollision = async (
+          callSignal: AbortSignal,
+        ): Promise<never> => {
           const error = new Error(
             `simultaneous calls to player key ${playerKey} are not allowed`,
           );
+          const traceAborts =
+            parallelProfile === undefined
+              ? undefined
+              : abortReasonClassifier(callSignal, activeAborts);
           await emitCallStarted(
             'player.call.started',
             'player.call.finished',
             { ...callIdentity(selectedResume), prompt },
             position,
-            signal,
+            callSignal,
+            undefined,
+            traceAborts,
           );
           await emitTrace(
             'player.call.finished',
@@ -5748,147 +7425,63 @@ export function createXStatePlaybookRuntime<
               error: normalizeError(error),
             },
             position,
+            traceAborts,
           );
           throw error;
-        }
-        activePlayerKeys.add(playerKey);
+        };
 
-        try {
-          const runTracedPlayerCall = async (
-            resume: string | false = selectedResume,
-            // DR-062 §4: composed from this call's own baseline observation,
-            // so the prompt the trace records is the prompt the player is sent.
-            preExistingBlock?: string,
-          ): Promise<PlayerResult> => {
-            const identity = callIdentity(resume);
-            const withPreExisting = (text: string): string =>
-              preExistingBlock === undefined
-                ? text
-                : `${text}\n\n${preExistingBlock}`;
-            const callPrompt = withPreExisting(
-              resume === false ? freshPrompt : prompt,
-            );
-            const callFreshPrompt = withPreExisting(freshPrompt);
-            await emitCallStarted(
-              'player.call.started',
-              'player.call.finished',
-              { ...identity, prompt: callPrompt },
-              position,
-              signal,
+        // DR-067 §1: the working leaves of one parallel state entered
+        // together run as one all-`unchanged` repository cohort, at most once
+        // per public boundary; a corrective re-ask and a single region
+        // resuming after its Boss reply take the exclusive path below.
+        const cohortState =
+          deferredContinuation === undefined
+            ? cohortParallelStateFor(input.stateId)
+            : undefined;
+        if (cohortState !== undefined) {
+          const effectBoundary = governedBoundarySeed(
+            input,
+            roleId,
+            callId,
+            turnId,
+          );
+          if (
+            effectBoundary === undefined ||
+            repositoryCapability?.runCohort === undefined
+          ) {
+            throw new Error(
+              `${label} parallel state ${cohortState.stateId} requires governed player states and repository.runCohort`,
             );
+          }
+          activeGovernedBoundarySeen = true;
+          return await joinCohort(cohortState, {
+            region: cohortState.regions.find(
+              ({ workingStateId }) => workingStateId === input.stateId,
+            )!,
+            input,
+            roleId,
+            playerId,
+            playerKey,
+            signal,
+            effectBoundary,
+            run: (callSignal, cohortCancellation, preExistingBlock) =>
+              runTracedPlayerCall(
+                selectedResume,
+                preExistingBlock,
+                callSignal,
+                cohortCancellation,
+              ),
+            reportCollision: reportPlayerKeyCollision,
+            settled: deferredValue<PlayerResult>(),
+          });
+        }
 
-            let rawResult: unknown;
-            try {
-              // An abort may land while the awaited started emission drains
-              // (e.g. fired from the trace sink itself); the host call must
-              // never start after abort, so settle the already-started pair
-              // as `aborted` through the catch below.
-              signal.throwIfAborted();
-              rawResult = await requireHostPorts().callPlayer(
-                roleId,
-                callPrompt,
-                signal,
-                {
-                  resume,
-                  ...(callPrompt === callFreshPrompt
-                    ? {}
-                    : { freshPrompt: callFreshPrompt }),
-                },
-              );
-              // A host promise is not required to honor cancellation. Do not
-              // let a late result mutate continuity or publish a successful
-              // finish.
-              signal.throwIfAborted();
-            } catch (error) {
-              if (!isAbortFailure(error, signal)) controlPlaneError ??= error;
-              try {
-                await emitTrace(
-                  'player.call.finished',
-                  {
-                    ...identity,
-                    status: isAbortFailure(error, signal) ? 'aborted' : 'error',
-                    error: normalizeError(error),
-                  },
-                  position,
-                );
-              } catch {
-                // The original non-abort port rejection remains authoritative.
-              }
-              // A thrown port call carries no authoritative result, so the
-              // prior token remains available for a later explicit resume.
-              throw decidePlayerCallFailure(error, roleId, playerId, signal);
-            }
-
-            let result: PlayerResult;
-            try {
-              result = validatePlayerResult(rawResult);
-            } catch (error) {
-              if (!isAbortFailure(error, signal)) controlPlaneError ??= error;
-              try {
-                await emitTrace(
-                  'player.call.finished',
-                  { ...identity, status: 'error', error: normalizeError(error) },
-                  position,
-                );
-              } catch {
-                // The malformed host result remains authoritative.
-              }
-              throw decidePlayerCallFailure(error, roleId, playerId, signal);
-            }
-
-            try {
-              updatePlayerResume(roleId, playerId, result);
-            } catch (error) {
-              if (!isAbortFailure(error, signal)) controlPlaneError ??= error;
-              try {
-                await emitTrace(
-                  'player.call.finished',
-                  { ...identity, status: 'error', error: normalizeError(error) },
-                  position,
-                );
-              } catch {
-                // The continuation-store failure remains authoritative.
-              }
-              throw error;
-            }
-
-            await emitTrace(
-              'player.call.finished',
-              {
-                ...identity,
-                status: result.status,
-                ...(result.finalText !== undefined
-                  ? { finalText: result.finalText }
-                  : {}),
-                ...(result.error !== undefined
-                  ? { error: normalizeError(result.error) }
-                  : {}),
-                ...(result.resumeToken !== undefined
-                  ? { resumeToken: result.resumeToken }
-                  : {}),
-              },
-              position,
-            );
-            // DR-063 §2: the player bridge builds the failure Error for a
-            // non-`ok` result, so the cause is decided here, where the role,
-            // the player, and the reported error are known, and a successful
-            // result clears it so no later failure inherits it.
-            if (result.status === 'ok') {
-              pendingResultFailureCause = undefined;
-            } else if (result.status === 'aborted') {
-              pendingResultFailureCause = ABORTED_FAILURE_CAUSE;
-            } else {
-              pendingResultFailureCause = playerFailureCause({
-                roleId,
-                ...(playerId === undefined ? {} : { playerId }),
-                error:
-                  result.error ??
-                  `callPlayer status ${JSON.stringify(result.status)}`,
-              });
-            }
-            return result;
-          };
+        if (activePlayerKeys.has(playerKey)) {
+          await reportPlayerKeyCollision(signal);
+        }
+        activePlayerKeys.add(playerKey);
 
+        try {
           const effectBoundary = governedBoundarySeed(
             input,
             roleId,
@@ -5955,14 +7548,23 @@ export function createXStatePlaybookRuntime<
               // captured it under this exclusive claim. A host that supplies
               // none states no pre-existing change, exactly as an empty
               // baseline projection does.
-              operation: (context) =>
-                runTracedPlayerCall(
+              operation: async (context) => {
+                if (requiredRecoveryBaseline !== undefined) {
+                  if (!isDeepStrictEqual(snapshotJsonValue(context.baseline), requiredRecoveryBaseline)) {
+                    throw new Error(`${label} repository changed after preparation; the stopped step remains paused`);
+                  }
+                  requiredRecoveryBaseline = undefined;
+                  captureRecoveryCheckpoint(input.stateId, freshPrompt,
+                    currentEffectLedger().boundaries.findIndex(({ boundaryId }) => boundaryId === effectBoundary.boundaryId));
+                }
+                return runTracedPlayerCall(
                   selectedResume,
                   effectAuthorizedPreExistingBlock(
                     effectBoundary,
                     context?.baseline,
                   ),
-                ),
+                );
+              },
               completeEffectBoundary: completionEvidenceFor(
                 input,
                 roleId,
@@ -5993,10 +7595,13 @@ export function createXStatePlaybookRuntime<
         }
       },
 
-      markPlayerResultFailure(error): Error {
-        if (pendingResultFailureCause === undefined) return error;
-        failureCauses.retain(error, pendingResultFailureCause);
-        return attachPlaybookFailureCause(error, pendingResultFailureCause);
+      markPlayerResultFailure(error, result): Error {
+        const cause =
+          (result === undefined ? undefined : resultFailureCauses.get(result)) ??
+          pendingResultFailureCause;
+        if (cause === undefined) return error;
+        failureCauses.retain(error, cause);
+        return attachPlaybookFailureCause(error, cause);
       },
 
       takeGovernedPlayerOutput(result): GovernedPlayerSettlement | undefined {
@@ -6237,12 +7842,23 @@ export function createXStatePlaybookRuntime<
         }) as Promise<CaptainResult>;
       },
     };
+    if (parallelProfile !== undefined) {
+      // DR-067 §1: a parallel machine's boundary drain waits for every player
+      // and judge call it started.
+      const untrackedCallPlayer = boundary.callPlayer;
+      const untrackedCallJudge = boundary.callJudge;
+      boundary.callPlayer = (input, roleId, freshPrompt, signal) =>
+        trackBoundaryCall(untrackedCallPlayer(input, roleId, freshPrompt, signal));
+      boundary.callJudge = (purpose, stateId, prompt, signal) =>
+        trackBoundaryCall(untrackedCallJudge(purpose, stateId, prompt, signal));
+    }
 
     function playerActor(
       ports: PlaybookPorts,
     ): PromiseActorLogic<PlaybookActorOutput, PlaybookPlayerInput> {
       return createPlayerBridge(
         {
+          run: (input, signal, execute) => runJournalledStep('player', input, signal, execute),
           resolveRoleId: requireRoleId,
           validateInput: (input) =>
             assertGovernedPlayerInput(
@@ -6276,7 +7892,7 @@ export function createXStatePlaybookRuntime<
       PlaybookCaptainInput
     > {
       return fromPromise<PlaybookActorOutput, PlaybookCaptainInput>(
-        async ({ input, signal }) => {
+        ({ input, signal }) => runJournalledStep('captain', input, signal, async () => {
           const active = combineAbortSignals(signal, activeSignal);
           try {
             await drainEmissions();
@@ -6353,7 +7969,7 @@ export function createXStatePlaybookRuntime<
             }
             throw error;
           }
-        },
+        }),
       );
     }
 
@@ -6367,7 +7983,7 @@ export function createXStatePlaybookRuntime<
       PlaybookScriptInput
     > {
       return fromPromise<PlaybookActorOutput, PlaybookScriptInput>(
-        async ({ input, signal }) => {
+        ({ input, signal }) => runJournalledStep('script', input, signal, async () => {
           await drainEmissions();
           const active = combineAbortSignals(signal, activeSignal);
           const guards = Object.keys(input.result);
@@ -6556,15 +8172,19 @@ export function createXStatePlaybookRuntime<
               if (killTimer !== undefined) clearTimeout(killTimer);
             }
           }
-        },
+        }),
       );
     }
 
     const nestedBridge = createNestedPlaybookBridge({
       nextCallId: () => `playbook-${++playbookCallSequence}`,
       getBoundarySignal: () => activeSignal,
-      callPlaybook: (request, signal) =>
-        requireHostPorts().callPlaybook(request, signal),
+      callPlaybook: (request, signal) => {
+        const call = requireHostPorts().callPlaybook(request, signal);
+        return parallelProfile === undefined
+          ? call
+          : trackBoundaryCall(Promise.resolve(call));
+      },
       emitStarted: async (event, aborts) => {
         playbookCallTurnIds.set(event.callId, activeTurnId);
         if (hasGovernedPlayerStates) {
@@ -6615,7 +8235,8 @@ export function createXStatePlaybookRuntime<
         activeAborts = aborts ?? abortReasonClassifier(signal);
       },
       bindActorSettlement: (aborts) => {
-        actorSettlementAborts = aborts;
+        if (parallelProfile === undefined) actorSettlementAborts.length = 0;
+        actorSettlementAborts.push(aborts);
       },
       onControlPlaneError: (error, aborts) => {
         // The shared bridge classifies before reporting against its own
@@ -6662,14 +8283,44 @@ export function createXStatePlaybookRuntime<
       };
     }
 
+    // DR-063 §2: the failure that parks the machine is the error its parking
+    // transition carried, but a compiled machine keeps a JSON-safe record of
+    // it as `lastError` (gears2fsm requires JSON-safe context), so neither
+    // that value's identity nor its marker reaches the failed state. The cause
+    // decided for the carried error is retained under the value the machine
+    // kept, so every surface of this turn and of each later one publishes the
+    // runtime's own decision for as long as that failure stands. A kept value
+    // that already answers keeps its cause.
+    function bindParkedFailureCause(
+      context: Record<string, unknown>,
+      event: unknown,
+    ): void {
+      const kept = context.lastError;
+      if (kept === undefined || kept === null) return;
+      if (failureCauses.causeOf(kept) !== undefined) return;
+      const decided = failureCauses.causeOf(actorErrorOf(event));
+      if (decided !== undefined) failureCauses.retain(kept, decided);
+    }
+
     // DR-063 §2: a rejected player port or a result the runtime cannot read is
-    // a `player-failed` failure named by role; an abort is `aborted`.
+    // a `player-failed` failure named by role; an abort is `aborted`. A
+    // cancellation the runtime itself issued to a cohort member because its
+    // sibling failed is not this player's failure and decides nothing, so the
+    // originator's cause stands (DR-067 §1, playbook-55).
     function decidePlayerCallFailure(
       error: unknown,
       roleId: string,
       playerId: string | undefined,
       signal: AbortSignal,
+      cohortCancellation?: AbortSignal,
     ): unknown {
+      if (
+        cohortCancellation?.aborted === true &&
+        Object.is(error, cohortCancellation.reason) &&
+        !activeAborts?.isAbortReason(error)
+      ) {
+        return error;
+      }
       const cause = isAbortFailure(error, signal)
         ? ABORTED_FAILURE_CAUSE
         : playerFailureCause({
@@ -6728,12 +8379,21 @@ export function createXStatePlaybookRuntime<
         previousState: previousState ?? null,
         state,
       };
-      const pendingBossQuestion = pendingBossQuestionForState(state, context);
-      if (
-        pendingBossQuestion !== undefined &&
-        !hasUnresolvedReconciliation()
-      ) {
-        payload.pendingBossQuestion = pendingBossQuestion;
+      if (parallelProfile === undefined) {
+        const pendingBossQuestion = pendingBossQuestionForState(state, context);
+        if (
+          pendingBossQuestion !== undefined &&
+          !hasUnresolvedReconciliation()
+        ) {
+          payload.pendingBossQuestion = pendingBossQuestion;
+        }
+      } else if (!hasUnresolvedReconciliation()) {
+        // DR-067 §1: a parallel machine's telemetry carries every question
+        // pending in an active wait, in the plural.
+        const pendingBossQuestions = pendingBossQuestionsFor(state, context);
+        if (pendingBossQuestions.length > 0) {
+          payload.pendingBossQuestions = pendingBossQuestions;
+        }
       }
       if (state.stateId === 'failed') {
         const lastError = failedStateError(context);
@@ -6768,7 +8428,7 @@ export function createXStatePlaybookRuntime<
             message,
             ...(data === undefined ? {} : { data }),
             state,
-            ...stateIdentity(state.stateId),
+            ...stateIdentity(statusTraceStateId(state)),
           },
           position,
         ),
@@ -6818,8 +8478,7 @@ export function createXStatePlaybookRuntime<
     function consumeActorSettlementAborts(
       forSnapshot = false,
     ): AbortReasonClassifier | undefined {
-      const aborts = actorSettlementAborts ?? actorSettlementErrorAborts;
-      actorSettlementAborts = undefined;
+      const aborts = actorSettlementAborts.shift() ?? actorSettlementErrorAborts;
       actorSettlementErrorAborts = undefined;
       if (forSnapshot && aborts !== undefined) {
         // XState can report an errored root through both its inspection
@@ -6891,7 +8550,14 @@ export function createXStatePlaybookRuntime<
           try {
             const snap = inspectionEvent.snapshot;
             const state = normalizePlaybookSnapshot(snap);
-            if (state.stateId === undefined) {
+            if (
+              state.stateId === undefined &&
+              !(
+                parallelProfile?.states.some(({ stateId }) =>
+                  state.activeStateIds.includes(stateId),
+                ) ?? false
+              )
+            ) {
               throw new Error(
                 `${label} root snapshot must expose exactly one playbook state id`,
               );
@@ -6908,6 +8574,10 @@ export function createXStatePlaybookRuntime<
               latchRuntimeError(error);
             }
             if (state.stateId === 'failed') {
+              if (previousState?.stateId !== 'failed' &&
+                  previousState?.stateId !== recoveryCheckpoint?.stateId) {
+                recoveryCheckpoint = undefined;
+              }
               if (
                 previousState?.stateId !== 'failed' ||
                 activeGovernedBoundarySeen
@@ -6921,6 +8591,9 @@ export function createXStatePlaybookRuntime<
             }
             const context = ((snap as { context?: unknown }).context ??
               {}) as Record<string, unknown>;
+            if (state.stateId === 'failed') {
+              bindParkedFailureCause(context, inspectionEvent.event);
+            }
             if (
               state.stateId === BOSS_REPLY_WAIT_STATE_ID &&
               deferredReconciliationOperationId !== undefined
@@ -6942,7 +8615,9 @@ export function createXStatePlaybookRuntime<
               context,
             );
             const stateStatuses = completeFailedStatuses(
-              statusesForState(state, context, inspectionEvent.event),
+              bossRelevantStateIds !== undefined && usesDefaultStatuses
+                ? parallelStatusesFor(previousState, state, context)
+                : statusesForState(state, context, inspectionEvent.event),
               state,
               context,
             );
@@ -7149,13 +8824,17 @@ export function createXStatePlaybookRuntime<
       emissionQueue.clear();
       judgeQueue.clear();
       appliedReceipts.clear();
+      pendingCohorts.clear();
+      consumedCohortBoundaries.clear();
+      activeBoundaryCalls.clear();
+      cohortCompletionQueue.clear();
       actor = undefined;
       session = undefined;
       savedPorts = undefined;
       runtimePorts = undefined;
       activeSignal = undefined;
       activeAborts = undefined;
-      actorSettlementAborts = undefined;
+      actorSettlementAborts.length = 0;
       actorSettlementErrorAborts = undefined;
       activeAbortEmission = undefined;
       activeTurnId = undefined;
@@ -7183,7 +8862,7 @@ export function createXStatePlaybookRuntime<
       activeDeferredContinuation = undefined;
       deferInspectionEmissions = false;
       deferredInspectionEmissions = [];
-      lastBossEvent = undefined;
+      recoveryCheckpoint = undefined;
       suppressInspectionEmissions = false;
       initialized = false;
       traceSequence = 0;
@@ -7205,6 +8884,9 @@ export function createXStatePlaybookRuntime<
       event?: EventObject;
       deferredRestoreOperationId?: string;
       unresolvedEffectAction?: 'reconcile' | 'abandon';
+      retryStep?: true;
+      retryJudgment?: PlaybookEffectBoundary;
+      restoreReadOnly?: PlaybookEffectBoundary;
     }
 
     function snapshotCan(snapshot: unknown, event: EventObject): boolean {
@@ -7216,78 +8898,24 @@ export function createXStatePlaybookRuntime<
       );
     }
 
-    // DR-034: where the artifact names the FSM context member its entry
-    // action copies the exact Boss text into, that member of the live
-    // snapshot is the retry payload's source. The persisted machine snapshot
-    // carries it, so the candidate derives identically in the process that
-    // exported the snapshot and in one that restored it, and a failure
-    // reached after a Boss reply — whose recorded event the failure state
-    // refuses — is recoverable too. Naming the member is the artifact's
-    // statement that it holds the entry text: a same-named member is never
-    // assumed, since inferring one would turn any matching context member
-    // into a replay payload without its author saying so.
-    // Declared and absent or empty excludes the candidate rather than
-    // falling back to the record, which would make the action depend on the
-    // process again — the very thing this source exists to end.
-    function retryEventFrom(snapshot: unknown): EventObject | undefined {
-      const entryEvent = spec.entryEvent;
-      if (entryEvent?.contextField === undefined) return lastBossEvent;
-      const context = (snapshot as { context?: unknown } | null)?.context;
-      const text = isPlainObject(context)
-        ? context[entryEvent.contextField]
-        : undefined;
-      if (typeof text !== 'string' || text.trim() === '') return undefined;
-      return { type: entryEvent.type, [entryEvent.textField]: text };
-    }
-
-    // The failure-state retry entry replays the recorded last classified
-    // event with its recorded payload, or the entry event the declared
-    // context member above sources. A candidate whose event the live
-    // snapshot does not accept — or whose payload the runtime can source
-    // from neither — is excluded rather than completed with invented text.
-    function retryActionFor(
-      snapshot: unknown,
-      stateId: string | undefined,
-    ): DerivedControlAction | undefined {
-      if (stateId !== 'failed') return undefined;
-      if (!failedAttemptAllowsReplay()) return undefined;
-      const retryEvent = retryEventFrom(snapshot);
-      if (retryEvent === undefined) return undefined;
-      if (!snapshotCan(snapshot, retryEvent)) return undefined;
-      // A recorded explicit-state-jump event names the exact state its
-      // replay re-enters: the root BOSS_INTERRUPT shape is a guarded
-      // multi-arm list keyed on `targetId`, so the first configured arm
-      // may label a different state than the one the recorded event
-      // actually resumes.
-      const recordedTargetId =
-        retryEvent.type === JUMP_EVENT_TYPE
-          ? (retryEvent as { targetId?: unknown }).targetId
-          : undefined;
-      const target =
-        typeof recordedTargetId === 'string' &&
-        recordedTargetId.trim().length > 0
-          ? recordedTargetId
-          : firstTransitionTarget(machine, stateId, retryEvent.type);
-      // PBRT-52: a label is written from a source state description, never
-      // from an identifier. Falling back to the target id — or, with no
-      // resolvable target, to the FSM event type — makes the label *be* the
-      // internal name, which defeats the substitution the label exists for
-      // and puts a machine identifier into Boss-facing text
-      // (CAPPLAY-5). A candidate whose label can only be an id is excluded
-      // exactly like one whose payload cannot be sourced.
-      const description =
-        (target === undefined ? undefined : stateDescriptions.get(target)) ??
-        stateDescriptions.get(stateId);
-      if (description === undefined) return undefined;
+    function retryActionFor(stateId: string | undefined): DerivedControlAction | undefined {
+      if (stateId !== 'failed' || !recoveryCheckpoint) return undefined;
+      const description = stateDescriptions.get(recoveryCheckpoint.stateId);
+      const savedResult = recoveryCheckpoint.result !== undefined;
+      const safe = savedResult
+        ? !hasUnresolvedReconciliation() && currentEffectLedger().boundaries.slice(recoveryCheckpoint.boundaryPrefix)
+          .every((boundary) => runtimeBoundaryIsOwned(boundary) && boundary.sourceStateId === recoveryCheckpoint!.stateId)
+        : stepReplayIsSafe();
+      if (description === undefined || !safe) return undefined;
+      const entry = spec.entryEvent;
+      const target = entry && firstTransitionTarget(machine, stateId, entry.type);
       return {
         action: {
-          id: `retry:${retryEvent.type}`,
-          label: `Retry: ${description}`,
-          // DR-063 §3: retrying a failed call is `ready` — the runtime cannot
-          // see whether the Boss changed the outside world since it failed.
+          id: target === recoveryCheckpoint.stateId ? `retry:${entry!.type}` : 'retry:step',
+          label: `${savedResult ? 'Continue from saved result' : 'Retry'}: ${description}`,
           standing: 'ready',
         },
-        event: retryEvent,
+        retryStep: true,
       };
     }
 
@@ -7344,6 +8972,18 @@ export function createXStatePlaybookRuntime<
         return [];
       }
       const derived: DerivedControlAction[] = [];
+      const repairable = state.stateId === 'failed' ? repairableReadOnlyBoundary() : undefined;
+      if (repairable !== undefined) derived.push({
+        action: { id: 'retry:restored-step', label: 'Restore the repository and retry the read-only step', standing: 'ready' },
+        retryStep: true,
+        restoreReadOnly: repairable,
+      });
+      const judgment = state.stateId === 'failed' ? recoverableJudgment() : undefined;
+        if (judgment !== undefined) derived.push({
+          action: { id: 'retry:adjudication', label: 'Retry assessment of the saved result', standing: 'ready' },
+          retryJudgment: judgment,
+        });
+      if (judgment !== undefined && !hasUnresolvedReconciliation()) return derived;
       if (hasUnresolvedReconciliation()) {
         const operation =
           deferredReconciliationOperationId === undefined
@@ -7380,8 +9020,13 @@ export function createXStatePlaybookRuntime<
         );
         return derived;
       }
-      const retry = retryActionFor(snapshot, state.stateId);
+      const retry = retryActionFor(state.stateId);
       if (retry !== undefined) derived.push(retry);
+      // A jump can repeat earlier work, unlike checkpoint retry. Its whole
+      // failed attempt must therefore still pass the replay fence.
+      if (state.stateId === 'failed' && !failedAttemptAllowsReplay()) {
+        return derived;
+      }
       // Jump entries: resumable targets whose explicit-state-jump event the
       // live snapshot accepts (state guards included), sent with the
       // advertised target id and optional textual fields omitted.
@@ -7447,9 +9092,12 @@ export function createXStatePlaybookRuntime<
     // state whose source declares no description publishes none: an id is
     // never promoted into a description by default.
     function stateDescriptionFor(state: PlaybookState): string | undefined {
+      // DR-067 §1: inside a parallel state, the meaning published is the
+      // root state's — the parallel parent's own description.
       const keys = [
         ...(state.stateId === undefined ? [] : [state.stateId]),
         ...(typeof state.value === 'string' ? [state.value] : []),
+        ...(isPlainObject(state.value) ? Object.keys(state.value) : []),
         ...state.activeStateIds,
       ];
       for (const key of keys) {
@@ -7510,6 +9158,7 @@ export function createXStatePlaybookRuntime<
         boundSession.playbookId,
         { allowSuspendedCall: true },
       );
+      validateRecoveryCheckpoint(boundSnapshot.recoveryCheckpoint);
       if (
         kind === 'adopt' &&
         effectLedgerCapability !== undefined &&
@@ -7617,6 +9266,7 @@ export function createXStatePlaybookRuntime<
       initInFlight = initialization;
       const initTask = (async () => {
         session = boundSession;
+        recoveryCheckpoint = boundSnapshot.recoveryCheckpoint;
         syncDeferredReconciliationOverlay();
         refreshUnresolvedSemanticReconciliation(effectLedgerMirror);
         prepareReconstructedGovernedDelivery(
@@ -7820,7 +9470,7 @@ export function createXStatePlaybookRuntime<
         ?.context ?? {}) as Record<string, unknown>;
       const actual =
         state?.stateId === BOSS_REPLY_WAIT_STATE_ID
-          ? pendingBossQuestionFromContext(context)
+          ? singlePendingBossQuestion(state, context)
           : undefined;
       if (!isDeepStrictEqual(actual, expected)) {
         throw new Error(
@@ -7851,6 +9501,7 @@ export function createXStatePlaybookRuntime<
       signal: AbortSignal,
       turnId: number,
       classificationLine?: string,
+      onAccepted?: () => void,
     ): Promise<'continued' | 'unresolved'> {
       if (repositoryCapability === undefined) {
         throw new Error(
@@ -7901,6 +9552,7 @@ export function createXStatePlaybookRuntime<
               effectBoundary.roleId, boundPlayerId,
             );
             continuationStarted = true;
+            onAccepted?.();
             actor!.send(event);
             // The host has durably started this boundary and the FSM has
             // moved: publish the buffered classification line and the
@@ -8177,7 +9829,7 @@ export function createXStatePlaybookRuntime<
         const state = normalizePlaybookSnapshot(snapshot);
         const context = ((snapshot as { context?: unknown }).context ??
           {}) as Record<string, unknown>;
-        const pending = pendingBossQuestionForState(state, context);
+        const pending = singlePendingBossQuestion(state, context);
         if (
           pending === undefined ||
           currentBoundDeferredOperation(pending)?.operationId !== operationId
@@ -8237,120 +9889,7 @@ export function createXStatePlaybookRuntime<
       // Defined only at a safe capture point — initialized, not disposing
       // or disposed, no active public boundary, and the actor quiescent with
       // status `active`.
-      exportSnapshot(): PlaybookRuntimeSnapshot | undefined {
-        if (!actor || !session || disposed || disposalPromise !== undefined) {
-          return undefined;
-        }
-        if (activeSignal !== undefined) return undefined;
-        if (deferredSettlementClosure !== undefined) return undefined;
-        const pendingCall = nestedBridge.getPendingCall();
-        const bridgeSuspendedCall = nestedBridge.getSuspendedCall();
-        if ((pendingCall === undefined) !== (bridgeSuspendedCall === undefined)) {
-          return undefined;
-        }
-        let suspendedCall: typeof bridgeSuspendedCall;
-        if (bridgeSuspendedCall !== undefined) {
-          if (
-            pendingCall?.callId !== bridgeSuspendedCall.callId ||
-            pendingCall?.playbookId !== bridgeSuspendedCall.playbookId ||
-            pendingCall?.childSessionId !== bridgeSuspendedCall.childSessionId
-          ) {
-            return undefined;
-          }
-          if (!playbookCallTurnIds.has(bridgeSuspendedCall.callId)) {
-            return undefined;
-          }
-          const turnId = playbookCallTurnIds.get(bridgeSuspendedCall.callId);
-          if (
-            bridgeSuspendedCall.turnId !== undefined &&
-            bridgeSuspendedCall.turnId !== turnId
-          ) {
-            return undefined;
-          }
-          suspendedCall = {
-            ...bridgeSuspendedCall,
-            ...(turnId === undefined ? {} : { turnId }),
-            ...(hasGovernedPlayerStates
-              ? {
-                  effectBoundaryPrefixSequence:
-                    playbookCallEffectPrefixes.get(
-                      bridgeSuspendedCall.callId,
-                    ) ?? null,
-                }
-              : {}),
-          };
-        }
-        const state = currentState();
-        if (state.status !== 'active' || !state.quiescent) return undefined;
-        const context = (actor.getSnapshot() as { context?: unknown })
-          .context as Record<string, unknown>;
-        // DR-063 §2: the failed state's `lastError` is persisted as every live
-        // surface publishes it, completed from the runtime's own cause slot, so
-        // a thrown value that refused the cause still explains itself after a
-        // restart.
-        const machineSnapshot = detachPersistedMachineSnapshot(
-          actor.getPersistedSnapshot(),
-          state.stateId === 'failed'
-            ? { lastError: failedStateError(context ?? {}) }
-            : {},
-        );
-        effectLedgerMirror = currentEffectLedger();
-        refreshRetainedEffectReconciliation(effectLedgerMirror);
-        syncDeferredReconciliationOverlay();
-        refreshUnresolvedSemanticReconciliation(effectLedgerMirror);
-        const pending =
-          !hasUnresolvedReconciliation()
-            ? pendingBossQuestionForState(state, context ?? {})
-            : undefined;
-        const failedEffectAttempt =
-          hasGovernedPlayerStates &&
-          state.stateId === 'failed' &&
-          failedAttemptMatchesCurrentLedger(effectLedgerMirror)
-            ? {
-                boundaryPrefix: failedEffectBoundaryPrefix!,
-                attemptId: failedGovernedAttemptId ?? null,
-              }
-            : undefined;
-        return {
-          schemaVersion: 4,
-          playbookId: session.playbookId,
-          machine: machineSnapshot,
-          roleResumeTokens: snapshotRoleResumeTokens(),
-          sequences: {
-            trace: traceSequence,
-            turn: turnSequence,
-            judgeCall: judgeCallSequence,
-            playerCall: playerCallSequence,
-            playbookCall: playbookCallSequence,
-            ...(declaredActors.has('captain')
-              ? { captainCall: captainCallSequence }
-              : {}),
-          },
-          state,
-          pendingBossQuestions:
-            pending === undefined
-              ? []
-              : [
-                  {
-                    questionId: pending.questionId,
-                    asker: pending.asker,
-                    question: pending.question,
-                    sourceItem: pending.sourceItem,
-                  },
-                ],
-          effectLedger: effectLedgerMirror,
-          ...(retainedEffectSourceSessionId === undefined
-            ? {}
-            : { retainedEffectSourceSessionId }),
-          ...(retainedEffectReconciliation === undefined
-            ? {}
-            : { retainedEffectReconciliation }),
-          ...(failedEffectAttempt === undefined
-            ? {}
-            : { failedEffectAttempt }),
-          ...(suspendedCall === undefined ? {} : { suspendedCall }),
-        };
-      },
+      exportSnapshot: (checkpoint?: { child?: PlaybookPendingCall }) => exportRuntimeSnapshot(checkpoint?.child ? { child: checkpoint.child } : undefined),
 
       // DR-014 §1 / PBRT-45: alternative to `init` that rehydrates an
       // exported snapshot under the same immutable session identity.
@@ -8365,17 +9904,23 @@ export function createXStatePlaybookRuntime<
       },
 
       // DR-038 §§1,5 / PBRT-61/PBRT-65: adoption is restore under a fresh
-      // engagement identity and counter lineage, exposed separately so
-      // capability-less bespoke runtimes can omit it. Runtime-visible
-      // preflight mismatches reject before effects; after preflight the new
+      // engagement identity and counter lineage, exposed separately so a
+      // capability-less runtime can omit it. Runtime-visible preflight
+      // mismatches reject before effects; after preflight the new
       // session.started boundary owns failed-start cleanup just like init.
-      async adopt(
-        nextSession: PlaybookSession,
-        snapshot: PlaybookRuntimeSnapshot,
-        context: PlaybookAdoptionContext,
-      ): Promise<void> {
-        await rehydrateSnapshot('adopt', nextSession, snapshot, context);
-      },
+      // DR-067 §2: retained-snapshot adoption stays in the flat domain, so a
+      // machine that declares a parallel state omits the member.
+      ...(parallelProfile === undefined
+        ? {
+            async adopt(
+              nextSession: PlaybookSession,
+              snapshot: PlaybookRuntimeSnapshot,
+              context: PlaybookAdoptionContext,
+            ): Promise<void> {
+              await rehydrateSnapshot('adopt', nextSession, snapshot, context);
+            },
+          }
+        : {}),
 
       // DR-029 / PBRT-52: side-effect-free control view over the live
       // snapshot, valid at parked quiescence outside an active boundary.
@@ -8403,10 +9948,9 @@ export function createXStatePlaybookRuntime<
         const state = currentState();
         const context = ((snapshot as { context?: unknown }).context ??
           {}) as Record<string, unknown>;
-        const pending =
-          !hasUnresolvedReconciliation()
-            ? pendingBossQuestionForState(state, context)
-            : undefined;
+        const pendingQuestions = !hasUnresolvedReconciliation()
+          ? pendingBossQuestionsFor(state, context)
+          : [];
         const lastError =
           state.stateId === 'failed'
             ? failedStateError(context)
@@ -8416,25 +9960,46 @@ export function createXStatePlaybookRuntime<
           !hasUnresolvedReconciliation()
             ? stateDescriptionFor(state)
             : undefined;
+        const actions = deriveControlActions(snapshot).map(({ action }) => action);
+        const retry = actions.find(({ id, standing }) =>
+          id.startsWith('retry:') &&
+          (standing ?? 'ready') === 'ready');
+        const stoppedBoundary = recoveryCheckpoint === undefined ? undefined :
+          currentEffectLedger().boundaries.slice(recoveryCheckpoint.boundaryPrefix)
+            .filter((boundary) => runtimeBoundaryIsOwned(boundary) && boundary.sourceStateId === recoveryCheckpoint!.stateId).at(-1);
+        const recovery = recoveryCheckpoint === undefined ||
+          (pendingQuestions.length === 0 && retry === undefined) ? undefined : {
+            prompt: recoveryCheckpoint.prompt,
+            ...(stoppedBoundary === undefined ? {} : { evidence: snapshotJsonValue({
+              declaredResults: stoppedBoundary.sourceOutcomeSchema,
+              ...(stoppedBoundary.finalText === undefined ? {} : { savedPlayerText: stoppedBoundary.finalText }),
+              ...(stoppedBoundary.semanticCandidate === undefined ? {} : { selectedResult: stoppedBoundary.semanticCandidate }),
+              ...(stoppedBoundary.physicalReceipt === undefined ? {} : { repositoryReceipt: stoppedBoundary.physicalReceipt }),
+            }) }),
+            ...(repairableReadOnlyBoundary() === undefined ? {} : {
+              preparation: `This read-only step changed the repository. Restore its exact original HEAD and visible files before retrying; do not accept its saved result. Preserve user work. You may put generated outputs aside and prevent their return using local environment or ignore settings. Original observation: ${JSON.stringify(repairableReadOnlyBoundary()!.baseline)}. Observed after the failed step: ${JSON.stringify(repairableReadOnlyBoundary()!.after)}.`,
+            }),
+            ...(stateDescriptions.get(recoveryCheckpoint.stateId) === undefined ? {} :
+              { description: stateDescriptions.get(recoveryCheckpoint.stateId)! }),
+            continuation: pendingQuestions.length === 0
+              ? { kind: 'runtime' as const, actionId: retry!.id }
+              : { kind: 'reply' as const },
+          };
         return deepFreeze({
           state,
           ...(stateDescription === undefined ? {} : { stateDescription }),
           ...(projectedContext !== undefined
             ? { context: projectedContext }
             : {}),
-          pendingQuestions:
-            pending === undefined
-              ? []
-              : [
-                  {
-                    questionId: pending.questionId,
-                    asker: pending.asker,
-                    question: pending.question,
-                    sourceItem: pending.sourceItem,
-                  },
-                ],
+          pendingQuestions: pendingQuestions.map((pending) => ({
+            questionId: pending.questionId,
+            asker: pending.asker,
+            question: pending.question,
+            sourceItem: pending.sourceItem,
+          })),
           ...(lastError !== undefined ? { lastError } : {}),
-          actions: deriveControlActions(snapshot).map(({ action }) => action),
+          actions,
+          ...(recovery === undefined ? {} : { recovery }),
         });
       },
 
@@ -8501,6 +10066,7 @@ export function createXStatePlaybookRuntime<
         const callId = `apply-${++applyCallSequence}`;
         const position: TracePosition = { turnId, callId };
         activeTurnId = turnId;
+        publicBoundarySequence += 1;
         beginAutomaticReplayBoundary();
         activeSignal = signal;
         activeAborts = abortReasonClassifier(signal);
@@ -8634,7 +10200,10 @@ export function createXStatePlaybookRuntime<
               accepted = true;
               try {
                 let run: PlaybookRunResult;
-                if (candidate.unresolvedEffectAction === 'abandon') {
+                if (candidate.retryJudgment !== undefined) {
+                  await recoverJudgment(candidate.retryJudgment, signal);
+                  run = runResultFor(settledOutcome(signal));
+                } else if (candidate.unresolvedEffectAction === 'abandon') {
                   signal.throwIfAborted();
                   run = runResultFor('unresolved-effect');
                 } else if (
@@ -8657,6 +10226,19 @@ export function createXStatePlaybookRuntime<
                       ? 'no-action'
                       : 'quiescent',
                   );
+                } else if (candidate.retryStep) {
+                  if (candidate.restoreReadOnly !== undefined) {
+                    await confirmReadOnlyRestoration(candidate.restoreReadOnly, signal);
+                  }
+                  const checkpoint = recoveryCheckpoint!;
+                  requiredRecoveryBaseline = currentEffectLedger().boundaries
+                    .slice(checkpoint.boundaryPrefix).find(({ restored }) => restored !== undefined)?.restored;
+                  try {
+                    await resumeCheckpoint(checkpoint);
+                  } finally {
+                    requiredRecoveryBaseline = undefined;
+                  }
+                  run = runResultFor(settledOutcome(signal));
                 } else {
                   actor.send(candidate.event!);
                   await waitForPlaybookQuiescence(actor, {
@@ -8669,6 +10251,7 @@ export function createXStatePlaybookRuntime<
                   run.outcome === 'failed' || run.outcome === 'aborted'
                     ? {
                         disposition: 'failed',
+                        run,
                         error:
                           ('error' in run ? run.error : undefined) ??
                           normalizeError(
@@ -8701,6 +10284,7 @@ export function createXStatePlaybookRuntime<
           if (receipt !== undefined && receipt.disposition !== 'rejected') {
             appliedReceipts.set(key, receipt);
           }
+          if (parallelProfile !== undefined) await drainBoundaryCalls();
           try {
             await drainEmissions();
           } catch (error) {
@@ -8781,9 +10365,11 @@ export function createXStatePlaybookRuntime<
       async handleBossInput({
         text,
         signal,
+        onAccepted,
       }: {
         text: string;
         signal: AbortSignal;
+        onAccepted?: () => void;
       }): Promise<PlaybookRunResult> {
         if (!actor || !savedPorts) {
           throw new Error(
@@ -8804,6 +10390,7 @@ export function createXStatePlaybookRuntime<
         refreshRetainedEffectFenceFromHost();
         const turnId = ++turnSequence;
         activeTurnId = turnId;
+        publicBoundarySequence += 1;
         beginAutomaticReplayBoundary();
         activeSignal = signal;
         activeAborts = abortReasonClassifier(signal);
@@ -8845,7 +10432,7 @@ export function createXStatePlaybookRuntime<
               const stateId = normalizePlaybookSnapshot(snapshot).stateId;
               const snapshotContext = ((snapshot as { context?: unknown })
                 .context ?? {}) as Record<string, unknown>;
-              deferredPending = pendingBossQuestionForState(
+              deferredPending = singlePendingBossQuestion(
                 normalizePlaybookSnapshot(snapshot),
                 snapshotContext,
               );
@@ -8928,16 +10515,9 @@ export function createXStatePlaybookRuntime<
                   signal,
                   turnId,
                   statusLine,
+                  onAccepted,
                 );
                 if (continuation === 'continued') {
-                  try {
-                    lastBossEvent = snapshotJsonValue(
-                      event,
-                      'recorded Boss event',
-                    ) as unknown as EventObject;
-                  } catch {
-                    lastBossEvent = undefined;
-                  }
                   if (controlPlaneError !== undefined) {
                     throw controlPlaneError;
                   }
@@ -8947,7 +10527,6 @@ export function createXStatePlaybookRuntime<
                       : 'no-action',
                   );
                 } else {
-                  lastBossEvent = undefined;
                   result = runResultFor('no-action');
                 }
                 handledDeferred = true;
@@ -8960,7 +10539,6 @@ export function createXStatePlaybookRuntime<
                   deferredOperation.operationId,
                   signal,
                 );
-                lastBossEvent = undefined;
                 result = runResultFor('no-action');
                 handledDeferred = true;
               }
@@ -8989,18 +10567,7 @@ export function createXStatePlaybookRuntime<
                 suppressInspectionEmissions = false;
                 actor.start();
               }
-              // DR-029: keep the classified event with its recorded payload
-              // as the retry-replay source. Recording is sanitizing, not
-              // load-bearing: an override classifier's non-JSON-safe event is
-              // simply not recorded, and the turn proceeds unchanged.
-              try {
-                lastBossEvent = snapshotJsonValue(
-                  event,
-                  'recorded Boss event',
-                ) as unknown as EventObject;
-              } catch {
-                lastBossEvent = undefined;
-              }
+              onAccepted?.();
               actor.send(event);
               await waitForPlaybookQuiescence(actor, {
                 pendingCalls: nestedBridge,
@@ -9012,6 +10579,7 @@ export function createXStatePlaybookRuntime<
             operationError = error;
           }
 
+          if (parallelProfile !== undefined) await drainBoundaryCalls();
           let drainError: unknown;
           try {
             await drainEmissions();
@@ -9125,6 +10693,7 @@ export function createXStatePlaybookRuntime<
           return runResultFor('no-action');
         }
         activeTurnId = playbookCallTurnIds.get(input.callId);
+        publicBoundarySequence += 1;
         bindAutomaticReplayBoundary(
           playbookCallEffectPrefixes.has(input.callId)
             ? playbookCallEffectPrefixes.get(input.callId)
@@ -9169,6 +10738,7 @@ export function createXStatePlaybookRuntime<
               error: normalizeError(input.signal.reason),
             };
           }
+          if (parallelProfile !== undefined) await drainBoundaryCalls();
           let drainError: unknown;
           try {
             await drainEmissions();
@@ -9286,10 +10856,14 @@ export function createXStatePlaybookRuntime<
             emissionQueue.clear();
             judgeQueue.clear();
             appliedReceipts.clear();
+            pendingCohorts.clear();
+            consumedCohortBoundaries.clear();
+            activeBoundaryCalls.clear();
+            cohortCompletionQueue.clear();
             actor = undefined;
             activeSignal = undefined;
             activeAborts = undefined;
-            actorSettlementAborts = undefined;
+            actorSettlementAborts.length = 0;
             actorSettlementErrorAborts = undefined;
             activeAbortEmission = undefined;
             activeTurnId = undefined;
@@ -9301,7 +10875,6 @@ export function createXStatePlaybookRuntime<
             failedGovernedAttemptId = undefined;
             controlPlaneError = undefined;
             emissionFailure = undefined;
-            lastBossEvent = undefined;
             retainedEffectSourceSessionId = undefined;
             retainedEffectReconciliation = undefined;
             retainedEffectReconciliationRequired = false;