@sublang/playbook 6.0.0 → 8.0.0

package/reference/sdlc/code.playbook/playbook-captain.js

@@ -1,8 +1,10 @@
 // SPDX-License-Identifier: Apache-2.0
 // SPDX-FileCopyrightText: 2026 SubLang International <https://sublang.ai>
 import { randomUUID } from 'node:crypto';
+import { isDeepStrictEqual } from 'node:util';
 import PQueue from 'p-queue';
-import { hiddenControlEnvelope, registerPlaybookAbortCleanup, } from '../../../src/xstate-runtime.js';
+import { isAgentCallSettingsError, } from '@sublang/cligent/tmux-play';
+import { assertPlaybookRuntimeSnapshot, hiddenControlEnvelope, registerPlaybookAbortCleanup, snapshotJsonValue, validatePlayerResult, } from '../../../src/xstate-runtime.js';
 import createDefaultCaptainRuntime from '../captain.playbook/captain.playbook.js';
 class VisibilityControlError extends Error {
     constructor(cause) {
@@ -10,10 +12,33 @@ class VisibilityControlError extends Error {
         this.name = 'VisibilityControlError';
     }
 }
+class AgentSettingsPreflightError extends Error {
+    rejection;
+    constructor(rejection) {
+        super('agent rejected supplied complete call settings', {
+            cause: rejection,
+        });
+        this.rejection = rejection;
+        this.name = 'AgentSettingsPreflightError';
+    }
+}
+async function classifySettingsCall(call) {
+    try {
+        return await call();
+    }
+    catch (error) {
+        if (isAgentCallSettingsError(error)) {
+            throw new AgentSettingsPreflightError(error);
+        }
+        throw error;
+    }
+}
 const SUB_RUNTIME_FSM_TOPIC = 'playbook.fsm.state';
 const SHELL_FSM_TOPIC = 'playbook.captain.fsm.state';
 const INTERNAL_CAPTAIN_ID = 'captain';
 const UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+const PLAYER_ID_PATTERN = /^[a-z][a-z0-9_-]*(?:\.[a-z][a-z0-9_-]*)*$/;
+const ROLE_ID_PATTERN = /^[a-z][a-z0-9_-]*$/;
 function parseRegisteredCommand(prompt) {
     const match = /^\/([A-Za-z][A-Za-z0-9_-]*)(?:\s+([\s\S]*))?$/.exec(prompt.trim());
     if (!match)
@@ -126,7 +151,14 @@ function pendingQuestionLines(pending) {
                 : typeof record.id === 'string'
                     ? record.id
                     : undefined;
-            const player = typeof record.player === 'string' ? record.player : undefined;
+            const asker = typeof record.asker === 'object' && record.asker !== null
+                ? record.asker
+                : undefined;
+            const askerLabel = asker?.kind === 'captain'
+                ? 'Captain'
+                : asker?.kind === 'role' && typeof asker.roleId === 'string'
+                    ? asker.roleId
+                    : undefined;
             const text = typeof record.question === 'string'
                 ? record.question
                 : typeof record.text === 'string'
@@ -136,9 +168,9 @@ function pendingQuestionLines(pending) {
             // fragment is never handed back to the tag as a value: bounding it a
             // second time would cut the line at the seam's limit and drop whatever
             // the shell had already written after the long part.
-            const asked = player === undefined
+            const asked = askerLabel === undefined
                 ? digestLine `${quoteEvidence(text)}`
-                : digestLine `${quoteEvidence(player)} asks: ${quoteEvidence(text)}`;
+                : digestLine `${quoteEvidence(askerLabel)} asks: ${quoteEvidence(text)}`;
             const marker = id === undefined ? '' : digestLine `(${quoteEvidence(id)}) `;
             lines.push(`- ${marker}${asked}`);
         }
@@ -178,14 +210,20 @@ function renderJournalPayload(payload) {
     const raw = typeof payload === 'string' ? payload : JSON.stringify(payload);
     return raw ?? 'null';
 }
-function renderReseedDigest(records) {
+function renderJournalDigest(records, heading) {
     const lines = records.map((record) => `${record.seq}. turn ${record.turnId} ${record.kind}: ${renderJournalPayload(record.payload)}`);
     return [
-        'This conversation was replaced after a host-side continuity failure. The recap below is the deterministic session record kept by the host.',
+        heading,
         'The labeled ControlView and catalog digest blocks outrank conversation memory.',
         ...(lines.length === 0 ? ['(no earlier turns)'] : lines),
     ].join('\n');
 }
+function renderReseedDigest(records) {
+    return renderJournalDigest(records, 'This conversation was replaced after a host-side continuity failure. The recap below is the deterministic session record kept by the host.');
+}
+function renderCatchUpDigest(records) {
+    return renderJournalDigest(records, 'This retained conversation missed the host journal records below. Treat this deterministic journal suffix as authoritative.');
+}
 // DR-028 / CAPTAIN-9: validated captain speech carries no control JSON and no
 // internal control vocabulary.
 const CONTROL_VOCABULARY = [
@@ -298,22 +336,31 @@ function proseRejection(prose, liveSessionIds = [], liveStateIds = [], suppliedI
     return undefined;
 }
 // DR-013 A1: adapters with no provider-enforced tool-restriction surface.
-// Cligent's Codex adapter rejects any `allowedTools` value — including the
-// empty list that expresses tool-free — because the supported Codex SDK
-// cannot enforce one, so requesting it fails every control call before the
-// model is reached. Omitting the option is the only way such an adapter can
-// run a control call at all; its isolation then rests on the authored
-// hidden-judge envelope below rather than on provider enforcement.
-const ADAPTERS_WITHOUT_TOOL_ENFORCEMENT = new Set([
-    'codex',
-]);
+// Cligent's Codex, Kimi, and OpenCode adapters reject any `allowedTools`
+// value — including the empty list that expresses tool-free — because their
+// supported provider surfaces cannot enforce one, so requesting it fails
+// every control call before the model is reached. Omitting the option is the
+// only way such an adapter can run a control call at all; its isolation then
+// rests on the authored hidden-judge envelope below rather than on provider
+// enforcement.
+const CAPTAIN_TOOL_ISOLATION_BY_ADAPTER = {
+    claude: 'provider-enforced',
+    codex: 'prompt-only',
+    gemini: 'provider-enforced',
+    kimi: 'prompt-only',
+    opencode: 'prompt-only',
+};
+function requiresPromptOnlyToolIsolation(captainAdapter) {
+    return (Object.hasOwn(CAPTAIN_TOOL_ISOLATION_BY_ADAPTER, captainAdapter) &&
+        CAPTAIN_TOOL_ISOLATION_BY_ADAPTER[captainAdapter] === 'prompt-only');
+}
 // The tool half of a control call's options. An empty allowlist means "no
 // tools available" and is distinct from omission, which grants the adapter's
 // full native tool surface — so omit only where the empty list would be
 // refused, and keep requesting enforcement whenever the adapter is unknown.
 function controlCallToolOptions(captainAdapter) {
     if (captainAdapter !== undefined &&
-        ADAPTERS_WITHOUT_TOOL_ENFORCEMENT.has(captainAdapter)) {
+        requiresPromptOnlyToolIsolation(captainAdapter)) {
         return {};
     }
     return { allowedTools: [] };
@@ -329,14 +376,6 @@ function forwardedToolOptions(requested, captainAdapter) {
         return controlCallToolOptions(captainAdapter);
     return { allowedTools: requested };
 }
-function readCaptainAdapter(options) {
-    if (typeof options !== 'object' || options === null)
-        return undefined;
-    const adapter = options.captainAdapter;
-    return typeof adapter === 'string' && adapter.length > 0
-        ? adapter
-        : undefined;
-}
 const hiddenJudgeEnvelope = hiddenControlEnvelope;
 // CAPTAIN-20: the result-phase block the shell supplies inside the closing
 // reply call's envelope — the settlement's outcome-report facts verbatim, the
@@ -407,34 +446,653 @@ function isValidRegistryEntry(value) {
     if (typeof value !== 'object' || value === null)
         return false;
     const e = value;
+    if (!Array.isArray(e.requiredRoleIds) ||
+        e.requiredRoleIds.some((role) => typeof role !== 'string' ||
+            !ROLE_ID_PATTERN.test(role) ||
+            role === INTERNAL_CAPTAIN_ID) ||
+        new Set(e.requiredRoleIds).size !== e.requiredRoleIds.length ||
+        !Array.isArray(e.concurrentRoleSets)) {
+        return false;
+    }
+    const roles = new Set(e.requiredRoleIds);
+    const concurrency = e.concurrentRoleSets;
+    if (concurrency.some((set) => !Array.isArray(set) ||
+        set.length < 2 ||
+        set.some((role) => typeof role !== 'string' || !roles.has(role)) ||
+        new Set(set).size !== set.length) ||
+        new Set(concurrency.map((set) => JSON.stringify(set))).size !==
+            concurrency.length) {
+        return false;
+    }
     return (typeof e.id === 'string' &&
         typeof e.command === 'string' &&
         typeof e.intent === 'string' &&
-        Array.isArray(e.requiredRoleIds) &&
+        e.artifactSchema === 2 &&
         typeof e.validateOptions === 'function' &&
         typeof e.createRuntime === 'function');
 }
-function readPlaybooksConfig(options) {
-    if (typeof options !== 'object' || options === null)
+const SNAPSHOT_ACTIONS = new Set([
+    'respond',
+    'start',
+    'switch',
+    'dismiss',
+    'deliver',
+    'runtime',
+]);
+const SNAPSHOT_SETTLEMENT_STATUSES = new Set([
+    'ok',
+    'rejected',
+    'failed',
+]);
+const SNAPSHOT_JOURNAL_KINDS = new Set([
+    'boss',
+    'reply',
+    'handoff',
+    'action',
+    'outcome',
+]);
+function snapshotRecord(value, path) {
+    if (typeof value !== 'object' || value === null || Array.isArray(value)) {
+        throw new TypeError(`${path} must be an object`);
+    }
+    return value;
+}
+function rejectSnapshotKeys(value, allowed, path) {
+    const allowedKeys = new Set(allowed);
+    const unknown = Object.keys(value).filter((key) => !allowedKeys.has(key));
+    if (unknown.length > 0) {
+        throw new TypeError(`${path} has unknown field ${JSON.stringify(unknown[0])}`);
+    }
+}
+function snapshotString(value, path, allowEmpty = false) {
+    if (typeof value !== 'string' ||
+        (!allowEmpty && value.trim().length === 0)) {
+        throw new TypeError(`${path} must be a ${allowEmpty ? '' : 'non-empty '}string`);
+    }
+    return value;
+}
+function snapshotInteger(value, path, minimum = 0) {
+    if (!Number.isSafeInteger(value) || value < minimum) {
+        throw new TypeError(`${path} must be an integer >= ${minimum}`);
+    }
+    return value;
+}
+function snapshotUuid(value, path) {
+    const id = snapshotString(value, path);
+    if (!UUID_PATTERN.test(id)) {
+        throw new TypeError(`${path} must be a UUID`);
+    }
+    return id;
+}
+function snapshotPermissions(value, path) {
+    if (value === undefined)
         return undefined;
-    const pb = options.playbooks;
-    if (typeof pb !== 'object' || pb === null || Array.isArray(pb)) {
+    const record = snapshotRecord(value, path);
+    rejectSnapshotKeys(record, ['mode', 'fileWrite', 'shellExecute', 'networkAccess', 'writablePaths'], path);
+    const normalized = {};
+    if (record.mode !== undefined) {
+        if (record.mode !== 'auto' && record.mode !== 'bypass') {
+            throw new TypeError(`${path}.mode must be "auto" or "bypass"`);
+        }
+        normalized.mode = record.mode;
+    }
+    for (const key of [
+        'fileWrite',
+        'shellExecute',
+        'networkAccess',
+    ]) {
+        const level = record[key];
+        if (level === undefined)
+            continue;
+        if (level !== 'allow' && level !== 'ask' && level !== 'deny') {
+            throw new TypeError(`${path}.${key} must be "allow", "ask", or "deny"`);
+        }
+        normalized[key] = level;
+    }
+    if (record.writablePaths !== undefined) {
+        if (!Array.isArray(record.writablePaths) ||
+            record.writablePaths.some((entry) => typeof entry !== 'string' || entry.length === 0)) {
+            throw new TypeError(`${path}.writablePaths must be an array of non-empty strings`);
+        }
+        normalized.writablePaths = [...record.writablePaths];
+    }
+    return normalized;
+}
+function livePermissions(value) {
+    if (value === undefined)
         return undefined;
+    return {
+        ...(value.mode === undefined ? {} : { mode: value.mode }),
+        ...(value.fileWrite === undefined ? {} : { fileWrite: value.fileWrite }),
+        ...(value.shellExecute === undefined
+            ? {}
+            : { shellExecute: value.shellExecute }),
+        ...(value.networkAccess === undefined
+            ? {}
+            : { networkAccess: value.networkAccess }),
+        ...(value.writablePaths === undefined
+            ? {}
+            : { writablePaths: [...value.writablePaths] }),
+    };
+}
+function snapshotFixedAgent(value, path) {
+    const record = snapshotRecord(value, path);
+    rejectSnapshotKeys(record, ['adapter', 'instruction', 'permissions'], path);
+    const adapter = snapshotString(record.adapter, `${path}.adapter`);
+    const instruction = record.instruction === undefined
+        ? undefined
+        : snapshotString(record.instruction, `${path}.instruction`, true);
+    const permissions = snapshotPermissions(record.permissions, `${path}.permissions`);
+    return {
+        adapter,
+        ...(instruction === undefined ? {} : { instruction }),
+        ...(permissions === undefined ? {} : { permissions }),
+    };
+}
+function snapshotPlayerSessions(value, path) {
+    const sessions = snapshotRecord(value, path);
+    return Object.fromEntries(Object.entries(sessions).map(([playerId, raw]) => {
+        if (!PLAYER_ID_PATTERN.test(playerId) || playerId === INTERNAL_CAPTAIN_ID) {
+            throw new TypeError(`${path} has invalid player id ${JSON.stringify(playerId)}`);
+        }
+        const record = snapshotRecord(raw, `${path}.${playerId}`);
+        rejectSnapshotKeys(record, ['adapter', 'instruction', 'permissions', 'resumeToken'], `${path}.${playerId}`);
+        const fixed = snapshotFixedAgent(Object.fromEntries(Object.entries(record).filter(([key]) => key !== 'resumeToken')), `${path}.${playerId}`);
+        const resumeToken = record.resumeToken === undefined
+            ? undefined
+            : snapshotString(record.resumeToken, `${path}.${playerId}.resumeToken`);
+        return [
+            playerId,
+            { ...fixed, ...(resumeToken === undefined ? {} : { resumeToken }) },
+        ];
+    }));
+}
+function snapshotFrameRoleBindings(value, path) {
+    const bindings = snapshotRecord(value, path);
+    return Object.fromEntries(Object.entries(bindings).map(([roleId, raw]) => {
+        if (!ROLE_ID_PATTERN.test(roleId) || roleId === INTERNAL_CAPTAIN_ID) {
+            throw new TypeError(`${path} has invalid role id ${JSON.stringify(roleId)}`);
+        }
+        const playerId = snapshotString(raw, `${path}.${roleId}`);
+        if (!PLAYER_ID_PATTERN.test(playerId) || playerId === INTERNAL_CAPTAIN_ID) {
+            throw new TypeError(`${path}.${roleId} has invalid player id`);
+        }
+        return [roleId, playerId];
+    }));
+}
+function normalizeHostPlayerResult(value, expectedPlayerId) {
+    const path = 'tmux-play delegated-player result';
+    if (typeof value !== 'object' || value === null || Array.isArray(value)) {
+        throw new TypeError(`${path} must be an object`);
+    }
+    const prototype = Object.getPrototypeOf(value);
+    if (prototype !== Object.prototype && prototype !== null) {
+        throw new TypeError(`${path} must be a plain JSON object`);
+    }
+    const descriptors = Object.getOwnPropertyDescriptors(value);
+    const allowedKeys = new Set([
+        'status',
+        'playerId',
+        'turnId',
+        'resumeToken',
+        'finalText',
+        'error',
+    ]);
+    const normalized = {};
+    for (const key of Reflect.ownKeys(descriptors)) {
+        if (typeof key === 'symbol') {
+            throw new TypeError(`${path} must not contain symbol-keyed properties`);
+        }
+        const descriptor = descriptors[key];
+        if (!allowedKeys.has(key)) {
+            throw new TypeError(`${path} has unknown field ${JSON.stringify(key)}`);
+        }
+        if (!descriptor?.enumerable || !Object.hasOwn(descriptor, 'value')) {
+            throw new TypeError(`${path}.${key} must be an enumerable data property`);
+        }
+        // Cligent deliberately exposes optional result members as own
+        // `undefined` data properties. Omit only those members before taking the
+        // immutable JSON snapshot; every other value still passes the strict
+        // JSON validator below.
+        if (descriptor.value !== undefined)
+            normalized[key] = descriptor.value;
+    }
+    const record = snapshotRecord(snapshotJsonValue(normalized, path), path);
+    rejectSnapshotKeys(record, ['status', 'playerId', 'turnId', 'resumeToken', 'finalText', 'error'], path);
+    if (record.playerId !== expectedPlayerId) {
+        throw new TypeError(`${path}.playerId does not match the requested player`);
+    }
+    snapshotInteger(record.turnId, `${path}.turnId`, 1);
+    return validatePlayerResult({
+        status: record.status,
+        ...(record.resumeToken === undefined
+            ? {}
+            : { resumeToken: record.resumeToken }),
+        ...(record.finalText === undefined
+            ? {}
+            : { finalText: record.finalText }),
+        ...(record.error === undefined ? {} : { error: record.error }),
+    }, path);
+}
+/** Validate, detach, and freeze one untrusted shell snapshot. */
+export function assertPlaybookCaptainShellSnapshot(value) {
+    const detached = snapshotJsonValue(value, 'Captain shell snapshot');
+    const snapshot = snapshotRecord(detached, 'Captain shell snapshot');
+    const mode = snapshot.mode;
+    const commonKeys = [
+        'schemaVersion',
+        'captain',
+        'playerSessions',
+        'issuedSessionIds',
+        'sequences',
+        'journal',
+        'lastAction',
+        'lastSettlementStatus',
+        'mode',
+    ];
+    if (mode === 'chat') {
+        rejectSnapshotKeys(snapshot, commonKeys, 'Captain shell snapshot');
+    }
+    else if (mode === 'engaged.parked') {
+        rejectSnapshotKeys(snapshot, [
+            ...commonKeys,
+            'frames',
+            'pendingBossQuestions',
+            'lastError',
+        ], 'Captain shell snapshot');
+    }
+    else {
+        throw new TypeError('Captain shell snapshot.mode must be "chat" or "engaged.parked"');
+    }
+    if (snapshot.schemaVersion !== 3) {
+        throw new TypeError(`Captain shell snapshot.schemaVersion ${String(snapshot.schemaVersion)} is not supported (expected 3)`);
+    }
+    const captain = snapshotRecord(snapshot.captain, 'Captain shell snapshot.captain');
+    rejectSnapshotKeys(captain, ['sessionId', 'runtime', 'agent', 'conversation'], 'Captain shell snapshot.captain');
+    const captainSessionId = snapshotUuid(captain.sessionId, 'Captain shell snapshot.captain.sessionId');
+    const captainRuntime = assertPlaybookRuntimeSnapshot(captain.runtime, INTERNAL_CAPTAIN_ID);
+    const captainAgent = snapshotFixedAgent(captain.agent, 'Captain shell snapshot.captain.agent');
+    const conversation = snapshotRecord(captain.conversation, 'Captain shell snapshot.captain.conversation');
+    let normalizedConversation;
+    if (conversation.kind === 'pinned') {
+        rejectSnapshotKeys(conversation, ['kind', 'token'], 'Captain shell snapshot.captain.conversation');
+        normalizedConversation = {
+            kind: 'pinned',
+            token: snapshotString(conversation.token, 'Captain shell snapshot.captain.conversation.token'),
+        };
+    }
+    else if (conversation.kind === 'needsCatchUp') {
+        rejectSnapshotKeys(conversation, ['kind', 'resume', 'afterJournalSeq'], 'Captain shell snapshot.captain.conversation');
+        normalizedConversation = {
+            kind: 'needsCatchUp',
+            resume: conversation.resume === false
+                ? false
+                : snapshotString(conversation.resume, 'Captain shell snapshot.captain.conversation.resume'),
+            afterJournalSeq: snapshotInteger(conversation.afterJournalSeq, 'Captain shell snapshot.captain.conversation.afterJournalSeq'),
+        };
+    }
+    else if (conversation.kind === 'unopened' ||
+        conversation.kind === 'needsSeeding') {
+        rejectSnapshotKeys(conversation, ['kind'], 'Captain shell snapshot.captain.conversation');
+        normalizedConversation = { kind: conversation.kind };
+    }
+    else {
+        throw new TypeError('Captain shell snapshot.captain.conversation.kind is not supported');
+    }
+    if (!Array.isArray(snapshot.issuedSessionIds)) {
+        throw new TypeError('Captain shell snapshot.issuedSessionIds must be an array');
+    }
+    const issued = snapshot.issuedSessionIds.map((id, index) => snapshotUuid(id, `Captain shell snapshot.issuedSessionIds[${index}]`));
+    if (new Set(issued).size !== issued.length) {
+        throw new TypeError('Captain shell snapshot.issuedSessionIds must not contain duplicates');
+    }
+    if (issued[0] !== captainSessionId) {
+        throw new TypeError('Captain shell snapshot Captain session id must be the first issued id');
+    }
+    const sequences = snapshotRecord(snapshot.sequences, 'Captain shell snapshot.sequences');
+    rejectSnapshotKeys(sequences, ['turn', 'journal'], 'Captain shell snapshot.sequences');
+    const turnSequence = snapshotInteger(sequences.turn, 'Captain shell snapshot.sequences.turn');
+    const journalSequence = snapshotInteger(sequences.journal, 'Captain shell snapshot.sequences.journal');
+    if (!Array.isArray(snapshot.journal)) {
+        throw new TypeError('Captain shell snapshot.journal must be an array');
+    }
+    const normalizedJournal = [];
+    let previousTurn = 0;
+    let bossRecords = 0;
+    for (const [index, value] of snapshot.journal.entries()) {
+        const record = snapshotRecord(value, `Captain shell snapshot.journal[${index}]`);
+        rejectSnapshotKeys(record, ['seq', 'turnId', 'kind', 'payload'], `Captain shell snapshot.journal[${index}]`);
+        const seq = snapshotInteger(record.seq, `Captain shell snapshot.journal[${index}].seq`, 1);
+        if (seq !== index + 1) {
+            throw new TypeError('Captain shell snapshot journal sequence must be contiguous from one');
+        }
+        const turnId = snapshotInteger(record.turnId, `Captain shell snapshot.journal[${index}].turnId`, 1);
+        if (turnId < previousTurn || turnId > turnSequence) {
+            throw new TypeError('Captain shell snapshot journal turn ids must be ordered and in range');
+        }
+        const kind = record.kind;
+        if (typeof kind !== 'string' ||
+            !SNAPSHOT_JOURNAL_KINDS.has(kind)) {
+            throw new TypeError(`Captain shell snapshot.journal[${index}].kind is not supported`);
+        }
+        if (turnId !== previousTurn) {
+            if (turnId !== previousTurn + 1 || kind !== 'boss') {
+                throw new TypeError('Captain shell snapshot journal must begin every turn with one boss record');
+            }
+            bossRecords++;
+            previousTurn = turnId;
+        }
+        else if (kind === 'boss') {
+            throw new TypeError('Captain shell snapshot journal must contain one boss record per turn');
+        }
+        normalizedJournal.push({
+            seq,
+            turnId,
+            kind: kind,
+            payload: record.payload,
+        });
+    }
+    if (journalSequence !== normalizedJournal.length ||
+        bossRecords !== turnSequence) {
+        throw new TypeError('Captain shell snapshot sequences do not match the complete journal');
+    }
+    const emptyHistory = turnSequence === 0 && normalizedJournal.length === 0;
+    if ((normalizedConversation.kind === 'unopened') !== emptyHistory) {
+        throw new TypeError('Captain shell snapshot history is empty exactly when its conversation is unopened');
+    }
+    if (normalizedConversation.kind === 'needsCatchUp' &&
+        normalizedConversation.afterJournalSeq >= journalSequence) {
+        throw new TypeError('Captain shell snapshot catch-up watermark must precede the current journal sequence');
+    }
+    if (normalizedConversation.kind === 'needsCatchUp' &&
+        ((normalizedConversation.resume === false) !==
+            (normalizedConversation.afterJournalSeq === 0))) {
+        throw new TypeError('Captain shell snapshot catch-up resume is fresh exactly at journal watermark zero');
+    }
+    let lastAction;
+    if (snapshot.lastAction !== undefined) {
+        if (typeof snapshot.lastAction !== 'string' ||
+            !SNAPSHOT_ACTIONS.has(snapshot.lastAction)) {
+            throw new TypeError('Captain shell snapshot.lastAction is not supported');
+        }
+        lastAction = snapshot.lastAction;
+    }
+    let lastSettlementStatus;
+    if (snapshot.lastSettlementStatus !== undefined) {
+        if (typeof snapshot.lastSettlementStatus !== 'string' ||
+            !SNAPSHOT_SETTLEMENT_STATUSES.has(snapshot.lastSettlementStatus)) {
+            throw new TypeError('Captain shell snapshot.lastSettlementStatus is not supported');
+        }
+        lastSettlementStatus = snapshot.lastSettlementStatus;
+    }
+    const playerSessions = snapshotPlayerSessions(snapshot.playerSessions, 'Captain shell snapshot.playerSessions');
+    const common = {
+        schemaVersion: 3,
+        captain: {
+            sessionId: captainSessionId,
+            runtime: captainRuntime,
+            agent: captainAgent,
+            conversation: normalizedConversation,
+        },
+        playerSessions,
+        issuedSessionIds: issued,
+        sequences: { turn: turnSequence, journal: journalSequence },
+        journal: normalizedJournal,
+        ...(lastAction === undefined ? {} : { lastAction }),
+        ...(lastSettlementStatus === undefined
+            ? {}
+            : { lastSettlementStatus }),
+    };
+    if (captainRuntime.state.status !== 'active' ||
+        !captainRuntime.state.quiescent ||
+        !captainRuntime.state.tags.includes('playbook.parked') ||
+        captainRuntime.suspendedCall !== undefined ||
+        Object.keys(captainRuntime.roleResumeTokens).length > 0 ||
+        captainRuntime.pendingBossQuestions.length > 0) {
+        throw new TypeError('Captain shell snapshot Captain runtime must be active, quiescent, playerless, and unsuspended');
+    }
+    if (captainRuntime.sequences.turn !== turnSequence) {
+        throw new TypeError('Captain shell snapshot Captain and shell turn sequences must match');
+    }
+    if (mode === 'chat') {
+        return snapshotJsonValue({ ...common, mode }, 'Captain shell snapshot');
+    }
+    if (!Array.isArray(snapshot.frames) || snapshot.frames.length === 0) {
+        throw new TypeError('Captain shell snapshot.frames must be a non-empty array');
+    }
+    const normalizedFrames = [];
+    for (const [index, value] of snapshot.frames.entries()) {
+        const frame = snapshotRecord(value, `Captain shell snapshot.frames[${index}]`);
+        rejectSnapshotKeys(frame, [
+            'playbookId',
+            'sessionId',
+            'rootSessionId',
+            'depth',
+            'parentSessionId',
+            'parentCallId',
+            'options',
+            'roleBindings',
+            'runtime',
+        ], `Captain shell snapshot.frames[${index}]`);
+        const playbookId = snapshotString(frame.playbookId, `Captain shell snapshot.frames[${index}].playbookId`);
+        const sessionId = snapshotUuid(frame.sessionId, `Captain shell snapshot.frames[${index}].sessionId`);
+        const rootSessionId = snapshotUuid(frame.rootSessionId, `Captain shell snapshot.frames[${index}].rootSessionId`);
+        const depth = snapshotInteger(frame.depth, `Captain shell snapshot.frames[${index}].depth`);
+        const parentSessionId = frame.parentSessionId === undefined
+            ? undefined
+            : snapshotUuid(frame.parentSessionId, `Captain shell snapshot.frames[${index}].parentSessionId`);
+        const parentCallId = frame.parentCallId === undefined
+            ? undefined
+            : snapshotString(frame.parentCallId, `Captain shell snapshot.frames[${index}].parentCallId`);
+        const runtime = assertPlaybookRuntimeSnapshot(frame.runtime, playbookId, { allowSuspendedCall: true });
+        const options = frame.options;
+        const roleBindings = snapshotFrameRoleBindings(frame.roleBindings, `Captain shell snapshot.frames[${index}].roleBindings`);
+        normalizedFrames.push({
+            playbookId,
+            sessionId,
+            rootSessionId,
+            depth,
+            ...(parentSessionId === undefined ? {} : { parentSessionId }),
+            ...(parentCallId === undefined ? {} : { parentCallId }),
+            options,
+            roleBindings,
+            runtime,
+        });
+    }
+    let normalizedLastError;
+    if (snapshot.lastError !== undefined) {
+        const error = snapshotRecord(snapshot.lastError, 'Captain shell snapshot.lastError');
+        rejectSnapshotKeys(error, ['name', 'message'], 'Captain shell snapshot.lastError');
+        normalizedLastError = {
+            name: snapshotString(error.name, 'Captain shell snapshot.lastError.name', true),
+            message: snapshotString(error.message, 'Captain shell snapshot.lastError.message', true),
+        };
+    }
+    const activePlaybooks = new Set();
+    const activeSessionIds = new Set([captainSessionId]);
+    const issuedIds = new Set(issued);
+    const rootSessionId = normalizedFrames[0].sessionId;
+    for (const [index, frame] of normalizedFrames.entries()) {
+        if (activePlaybooks.has(frame.playbookId)) {
+            throw new TypeError('Captain shell snapshot engagement path must not contain a playbook cycle');
+        }
+        activePlaybooks.add(frame.playbookId);
+        if (activeSessionIds.has(frame.sessionId)) {
+            throw new TypeError('Captain shell snapshot frame session ids must be unique');
+        }
+        activeSessionIds.add(frame.sessionId);
+        if (!issuedIds.has(frame.sessionId)) {
+            throw new TypeError('Captain shell snapshot frame session id was not historically issued');
+        }
+        if (frame.depth !== index ||
+            frame.rootSessionId !== rootSessionId ||
+            frame.runtime.state.status !== 'active' ||
+            !frame.runtime.state.quiescent) {
+            throw new TypeError('Captain shell snapshot frame depth, root, or parked runtime state is inconsistent');
+        }
+        if (index === 0) {
+            if (frame.sessionId !== frame.rootSessionId ||
+                frame.parentSessionId !== undefined ||
+                frame.parentCallId !== undefined) {
+                throw new TypeError('Captain shell snapshot root frame has child-only identity fields');
+            }
+        }
+        else {
+            const parent = normalizedFrames[index - 1];
+            const pending = parent.runtime.suspendedCall;
+            if (frame.parentSessionId !== parent.sessionId ||
+                frame.parentCallId === undefined) {
+                throw new TypeError('Captain shell snapshot child frame does not identify its immediate parent');
+            }
+            if (!pending ||
+                pending.callId !== frame.parentCallId ||
+                pending.playbookId !== frame.playbookId ||
+                pending.childSessionId !== frame.sessionId) {
+                throw new TypeError('Captain shell snapshot parent suspended call does not match its child edge');
+            }
+        }
+        for (const playerId of Object.values(frame.roleBindings)) {
+            if (playerSessions[playerId] === undefined) {
+                throw new TypeError(`Captain shell snapshot frame ${JSON.stringify(frame.playbookId)} binds an absent session player`);
+            }
+        }
+        for (const question of frame.runtime.pendingBossQuestions) {
+            if (question.asker.kind === 'role' &&
+                frame.roleBindings[question.asker.roleId] === undefined) {
+                throw new TypeError(`Captain shell snapshot frame ${JSON.stringify(frame.playbookId)} has a pending question from an unbound role`);
+            }
+        }
+        const projectedTokens = Object.fromEntries(Object.entries(frame.roleBindings).flatMap(([role, playerId]) => {
+            const token = playerSessions[playerId]?.resumeToken;
+            return token === undefined ? [] : [[role, token]];
+        }));
+        if (!isDeepStrictEqual(projectedTokens, frame.runtime.roleResumeTokens)) {
+            throw new TypeError(`Captain shell snapshot frame ${JSON.stringify(frame.playbookId)} player tokens do not match session continuation`);
+        }
     }
-    return pb;
+    const leafRuntime = normalizedFrames.at(-1).runtime;
+    if (leafRuntime.suspendedCall !== undefined ||
+        !leafRuntime.state.tags.includes('playbook.parked')) {
+        throw new TypeError('Captain shell snapshot leaf runtime must be parked without a dangling suspended child call');
+    }
+    if (!isDeepStrictEqual(snapshot.pendingBossQuestions ?? [], leafRuntime.pendingBossQuestions)) {
+        throw new TypeError('Captain shell snapshot pending Boss questions must equal the leaf runtime projection');
+    }
+    return snapshotJsonValue({
+        ...common,
+        mode,
+        frames: normalizedFrames,
+        ...(snapshot.pendingBossQuestions === undefined
+            ? {}
+            : { pendingBossQuestions: snapshot.pendingBossQuestions }),
+        ...(normalizedLastError === undefined
+            ? {}
+            : { lastError: normalizedLastError }),
+    }, 'Captain shell snapshot');
+}
+function snapshotTuningSelection(value, path) {
+    const selection = snapshotRecord(value, path);
+    if (selection.kind === 'provider-default') {
+        rejectSnapshotKeys(selection, ['kind'], path);
+        return { kind: 'provider-default' };
+    }
+    if (selection.kind === 'value') {
+        rejectSnapshotKeys(selection, ['kind', 'value'], path);
+        return {
+            kind: 'value',
+            value: snapshotString(selection.value, `${path}.value`),
+        };
+    }
+    throw new TypeError(`${path}.kind must be "value" or "provider-default"`);
+}
+const EFFORT_VALUES = new Set([
+    'on',
+    'minimal',
+    'low',
+    'medium',
+    'high',
+    'xhigh',
+    'max',
+    'ultra',
+    'ultracode',
+    'off',
+]);
+function snapshotEffortSelection(value, path) {
+    const selection = snapshotTuningSelection(value, path);
+    if (selection.kind === 'value' && !EFFORT_VALUES.has(selection.value)) {
+        throw new TypeError(`${path}.value is not a supported effort selection`);
+    }
+    return selection;
+}
+function snapshotSessionAgent(value, path) {
+    const agent = snapshotRecord(value, path);
+    rejectSnapshotKeys(agent, ['adapter', 'model', 'effort', 'instruction', 'permissions'], path);
+    const fixed = snapshotFixedAgent(Object.fromEntries(Object.entries(agent).filter(([key]) => key !== 'model' && key !== 'effort')), path);
+    return {
+        adapter: fixed.adapter,
+        ...(fixed.instruction === undefined
+            ? {}
+            : { instruction: fixed.instruction }),
+        ...(fixed.permissions === undefined
+            ? {}
+            : { permissions: livePermissions(fixed.permissions) }),
+        model: snapshotTuningSelection(agent.model, `${path}.model`),
+        effort: snapshotEffortSelection(agent.effort, `${path}.effort`),
+    };
+}
+function fixedAgent(agent) {
+    return {
+        adapter: agent.adapter,
+        ...(agent.instruction === undefined ? {} : { instruction: agent.instruction }),
+        ...(agent.permissions === undefined ? {} : { permissions: agent.permissions }),
+    };
 }
-// Resolve the active registry at init from `captain.options.playbooks`
-// (CAPTAIN-16): each enabled playbook is loaded from its explicit `from`
-// module and bound to namespaced `<id>-<role>` host players.
-async function buildEnablements(options, players, loadModule) {
+function callSettings(agent, tuning = agent) {
+    return {
+        model: tuning.model,
+        effort: tuning.effort,
+        ...(agent.instruction === undefined ? {} : { instruction: agent.instruction }),
+        ...(agent.permissions === undefined ? {} : { permissions: agent.permissions }),
+    };
+}
+function promptIdentity(binding) {
+    return binding.model.kind === 'value'
+        ? binding.model.value
+        : binding.agent.adapter;
+}
+// Resolve the active registry at init from exact normalized role and session
+// agent projections (CAPTAIN-16). No role, ancestor, or generated-name fallback
+// exists at this boundary.
+async function buildEnablements(options, loadModule) {
     const entries = [];
     const byCommand = new Map();
     const byId = new Map();
     const enablementById = new Map();
-    const config = readPlaybooksConfig(options);
-    if (config === undefined) {
+    const detached = snapshotJsonValue(options, 'captain.options');
+    const top = snapshotRecord(detached, 'captain.options');
+    rejectSnapshotKeys(top, ['playbooks', 'sessionAgents', 'captainAdapter'], 'captain.options');
+    const configValue = top.playbooks;
+    if (typeof configValue !== 'object' ||
+        configValue === null ||
+        Array.isArray(configValue)) {
         throw new Error('captain.options.playbooks is required');
     }
+    const config = configValue;
+    const sessionAgents = snapshotRecord(top.sessionAgents, 'captain.options.sessionAgents');
+    rejectSnapshotKeys(sessionAgents, ['captain', 'players'], 'captain.options.sessionAgents');
+    const captainAgent = snapshotSessionAgent(sessionAgents.captain, 'captain.options.sessionAgents.captain');
+    if (top.captainAdapter !== undefined &&
+        top.captainAdapter !== captainAgent.adapter) {
+        throw new Error('captain.options.captainAdapter must equal sessionAgents.captain.adapter');
+    }
+    const playerAgentRecord = snapshotRecord(sessionAgents.players, 'captain.options.sessionAgents.players');
+    const playerAgents = new Map();
+    for (const [playerId, agent] of Object.entries(playerAgentRecord)) {
+        if (!PLAYER_ID_PATTERN.test(playerId) || playerId === INTERNAL_CAPTAIN_ID) {
+            throw new Error(`captain.options.sessionAgents.players has invalid player id ${JSON.stringify(playerId)}`);
+        }
+        playerAgents.set(playerId, snapshotSessionAgent(agent, `captain.options.sessionAgents.players.${playerId}`));
+    }
     const ids = Object.keys(config);
     if (ids.length === 0) {
         throw new Error('captain.options.playbooks must enable at least one playbook');
@@ -448,6 +1106,7 @@ async function buildEnablements(options, players, loadModule) {
             throw new Error(`captain.options.playbooks.${id} must be an object`);
         }
         const record = block;
+        rejectSnapshotKeys(record, ['from', 'command', 'roles', 'options'], `captain.options.playbooks.${id}`);
         const from = record.from;
         if (typeof from !== 'string' || from.length === 0) {
             throw new Error(`captain.options.playbooks.${id}.from must be a module specifier`);
@@ -478,41 +1137,83 @@ async function buildEnablements(options, players, loadModule) {
         if (byCommand.has(command)) {
             throw new Error(`captain.options.playbooks has a duplicate effective command "${command}"`);
         }
-        const boundPlayers = entry.requiredRoleIds.map((role) => {
-            const host = players.find((p) => p.id === `${entry.id}-${role}`);
-            return {
-                id: role,
-                ...(host?.adapter !== undefined ? { adapter: host.adapter } : {}),
-                ...(host?.model !== undefined ? { model: host.model } : {}),
-            };
-        });
+        const roleRecord = snapshotRecord(record.roles, `captain.options.playbooks.${id}.roles`);
+        const required = new Set(entry.requiredRoleIds);
+        const configuredRoles = Object.keys(roleRecord);
+        const missing = entry.requiredRoleIds.filter((role) => !Object.hasOwn(roleRecord, role));
+        const extra = configuredRoles.filter((role) => !required.has(role));
+        if (missing.length > 0 || extra.length > 0) {
+            throw new Error(`captain.options.playbooks.${id}.roles must exactly cover requiredRoleIds`);
+        }
+        const roleBindings = new Map();
+        for (const role of entry.requiredRoleIds) {
+            const path = `captain.options.playbooks.${id}.roles.${role}`;
+            const rawBinding = snapshotRecord(roleRecord[role], path);
+            rejectSnapshotKeys(rawBinding, ['playerId', 'model', 'effort'], path);
+            const playerId = snapshotString(rawBinding.playerId, `${path}.playerId`);
+            if (!PLAYER_ID_PATTERN.test(playerId) || playerId === INTERNAL_CAPTAIN_ID) {
+                throw new Error(`${path}.playerId is not a canonical player id`);
+            }
+            const agent = playerAgents.get(playerId);
+            if (!agent) {
+                throw new Error(`${path}.playerId names absent session player ${JSON.stringify(playerId)}`);
+            }
+            roleBindings.set(role, {
+                playerId,
+                model: snapshotTuningSelection(rawBinding.model, `${path}.model`),
+                effort: snapshotEffortSelection(rawBinding.effort, `${path}.effort`),
+                agent,
+            });
+        }
+        for (const concurrentRoles of entry.concurrentRoleSets) {
+            const playerIds = concurrentRoles.map((role) => roleBindings.get(role).playerId);
+            if (new Set(playerIds).size !== playerIds.length) {
+                throw new Error(`captain.options.playbooks.${id}.roles aliases concurrent roles ${JSON.stringify(concurrentRoles)}`);
+            }
+        }
+        const validatedOptions = snapshotJsonValue(entry.validateOptions(record.options), `captain.options.playbooks.${id}.options`);
         entries.push(entry);
         byId.set(entry.id, entry);
         byCommand.set(command, entry);
         enablementById.set(entry.id, {
             entry,
             command,
-            optionInput: record.options,
-            boundPlayers,
-            hostPlayerId: (localRole) => `${entry.id}-${localRole}`,
+            options: validatedOptions,
+            roleBindings,
         });
     }
-    return { entries, byCommand, byId, enablementById };
+    const referenced = new Set([...enablementById.values()].flatMap((enablement) => [...enablement.roleBindings.values()].map((binding) => binding.playerId)));
+    const unreferenced = [...playerAgents.keys()].find((id) => !referenced.has(id));
+    if (unreferenced !== undefined) {
+        throw new Error(`captain.options.sessionAgents.players has unreferenced player ${JSON.stringify(unreferenced)}`);
+    }
+    return {
+        entries,
+        byCommand,
+        byId,
+        enablementById,
+        captainAgent,
+        playerAgents,
+    };
 }
 export function createPlaybookCaptainShell(options, deps = {}) {
     const loadModule = deps.loadModule ?? ((specifier) => import(specifier));
     const createSessionId = deps.createSessionId ?? randomUUID;
     const createCaptainRuntime = deps.createCaptainRuntime ?? createDefaultCaptainRuntime;
-    // DR-013 A1: the launcher passes the resolved captain adapter through
-    // `captain.options`; a raw `--config` launch leaves it undefined, which
-    // keeps the enforced empty allowlist and its fail-closed behavior.
-    const captainAdapter = readCaptainAdapter(options);
+    let captainAgent;
+    let captainAdapter;
+    let playerAgents = new Map();
+    const playerLedger = new Map();
+    const playerTransactions = new Map();
     let entries = [];
     let byCommand = new Map();
     let byId = new Map();
     let enablementById = new Map();
     let session;
-    let players = [];
+    let sessionEmissionsOpen = false;
+    let closedGateAttempted = false;
+    let lifecycle = 'fresh';
+    let terminallyDisposed = false;
     let activeContext;
     const frames = [];
     let mode = 'chat';
@@ -524,18 +1225,57 @@ export function createPlaybookCaptainShell(options, deps = {}) {
     const pendingChildParents = new Set();
     const captainQueue = new PQueue({ concurrency: 1 });
     let disposing = false;
+    const admitHostBoundary = () => {
+        if (sessionEmissionsOpen)
+            return;
+        closedGateAttempted = true;
+        throw new Error('Captain shell host boundaries are closed during restore');
+    };
+    const admitHostEmission = () => {
+        if (sessionEmissionsOpen)
+            return true;
+        closedGateAttempted = true;
+        return false;
+    };
+    const installSession = (initSession, emissionsOpen) => {
+        sessionEmissionsOpen = emissionsOpen;
+        closedGateAttempted = false;
+        session = {
+            signal: initSession.signal,
+            players: initSession.players,
+            emitStatus: async (message, data) => {
+                if (!admitHostEmission())
+                    return;
+                await initSession.emitStatus(message, data);
+            },
+            emitTelemetry: async (event) => {
+                if (!admitHostEmission())
+                    return;
+                await initSession.emitTelemetry(event);
+            },
+            setVisiblePlayers: async (playerIds) => {
+                if (!admitHostEmission())
+                    return;
+                await initSession.setVisiblePlayers(playerIds);
+            },
+        };
+    };
     // --- session Captain, durable conversation, and journal (CAPTAIN-16/31/35)
     let captainRuntime;
     let captainSessionId;
-    // CAPTAIN-35: the conversation is exactly one of unopened, pinned, or
-    // owed-a-reseed. There is no fourth state in which a non-first call starts a
-    // bare conversation.
+    // CAPTAIN-35: a preflight settings rejection retains proven continuity but
+    // records the exact journal suffix still owed; other continuity failures
+    // require a fresh, full reseed.
     let conversation = { kind: 'unopened' };
     let shuttingDown = false;
     const journal = [];
     let journalSeq = 0;
     let turnSequence = 0;
     let activeTurn;
+    // `PlayerSessionStore.restore` is authoritative only while the shell is
+    // awaiting the exact owning runtime's restore during a closed-gate shell
+    // restoration. A runtime cannot use the store as a general ledger writer.
+    let restoringPlayerSessionFrame;
     // The durable call the runtime is about to make, taken from the paired
     // `captain.call.started` boundary the engine emits before the port call
     // (CAPTAIN-9): the shell never infers a call's kind from its prose.
@@ -603,7 +1343,9 @@ export function createPlaybookCaptainShell(options, deps = {}) {
         // (CAPTAIN-5/CAPTAIN-6).
         ...(captainRuntime
             ? {
-                durableConversation: conversation.kind === 'pinned',
+                durableConversation: conversation.kind === 'pinned' ||
+                    (conversation.kind === 'needsCatchUp' &&
+                        conversation.resume !== false),
                 sessionJournal: true,
             }
             : {}),
@@ -759,40 +1501,133 @@ export function createPlaybookCaptainShell(options, deps = {}) {
     };
     let callNestedPlaybook;
     const createPorts = (frame) => ({
-        callPlayer: async (playerId, prompt, signal, options) => {
-            if (!activeContext) {
+        callPlayer: async (roleId, prompt, signal, options) => {
+            admitHostBoundary();
+            if (!activeContext || !activeTurn || !frame.playerCallScope) {
                 throw new Error('callPlayer invoked outside a Boss turn');
             }
             const context = activeContext;
+            const admittedTurn = activeTurn;
+            const scope = frame.playerCallScope;
             signal.throwIfAborted();
-            const hostPlayerId = bindingFor(frame, playerId).hostPlayerId;
-            const result = await trackHostCall(frame, context.callPlayer(hostPlayerId, prompt, {
-                resume: options.resume,
-            }));
-            // CaptainContext is turn-scoped and cannot accept a narrower XState
-            // invocation signal. Recheck after the host call so a sibling
-            // cancellation is still reported as aborted and cannot rotate a
-            // stopped branch's player token in the linked runtime.
-            signal.throwIfAborted();
-            // CAPTAIN-20: only a player call that actually produced work is an
-            // interruption the Boss was spared. A call that errored or aborted
-            // saved nothing, so it never feeds the saved-counts gate.
-            const summary = activeTurnSummary;
-            if (summary && summaryIncludes(frame) && result.status === 'ok') {
-                summary.counts.interruptions++;
+            const binding = bindingFor(frame, roleId);
+            const ledger = playerLedger.get(binding.playerId);
+            if (!ledger) {
+                throw new Error(`${frameLabel(frame)} resolved absent session player ${JSON.stringify(binding.playerId)}`);
             }
-            return {
-                status: result.status,
-                ...(result.resumeToken !== undefined
-                    ? { resumeToken: result.resumeToken }
-                    : {}),
-                ...(result.finalText !== undefined
-                    ? { finalText: result.finalText }
-                    : {}),
-                ...(result.error !== undefined ? { error: result.error } : {}),
+            const expectedResume = ledger.resumeToken ?? false;
+            if (options.resume !== expectedResume) {
+                throw new Error(`${frameLabel(frame)} player continuation changed before dispatch`);
+            }
+            if (playerTransactions.has(binding.playerId)) {
+                throw new Error(`session player ${JSON.stringify(binding.playerId)} already has a call in flight`);
+            }
+            const settings = callSettings(binding.agent, binding);
+            const calling = {
+                phase: 'calling',
+                frame,
+                roleId,
+                turnId: admittedTurn.id,
+                signal,
+                scope,
+                abandoned: false,
             };
+            playerTransactions.set(binding.playerId, calling);
+            let result;
+            let hostResolved = false;
+            try {
+                let rawResult;
+                try {
+                    rawResult = await trackHostCall(frame, classifySettingsCall(() => context.callPlayer(binding.playerId, prompt, {
+                        resume: options.resume,
+                        settings,
+                    })));
+                    hostResolved = true;
+                }
+                catch (error) {
+                    if (error instanceof AgentSettingsPreflightError) {
+                        if (playerTransactions.get(binding.playerId) !== calling ||
+                            calling.abandoned ||
+                            signal.aborted ||
+                            activeTurn !== admittedTurn ||
+                            frame.playerCallScope !== scope ||
+                            !frames.includes(frame)) {
+                            if (playerTransactions.get(binding.playerId) === calling) {
+                                playerTransactions.delete(binding.playerId);
+                            }
+                            signal.throwIfAborted();
+                            throw new Error(`${frameLabel(frame)} player settings rejection arrived after its runtime operation ended`);
+                        }
+                        throw rememberSettingsPreflight(error.rejection);
+                    }
+                    throw error;
+                }
+                result = normalizeHostPlayerResult(rawResult, binding.playerId);
+                const transitionRequired = result.resumeToken !== undefined || result.status === 'ok';
+                if (playerTransactions.get(binding.playerId) !== calling ||
+                    calling.abandoned ||
+                    signal.aborted ||
+                    activeTurn !== admittedTurn ||
+                    frame.playerCallScope !== scope ||
+                    !frames.includes(frame)) {
+                    if (playerTransactions.get(binding.playerId) === calling) {
+                        if (transitionRequired) {
+                            playerTransactions.set(binding.playerId, {
+                                phase: 'quarantined',
+                                frame,
+                                roleId,
+                                turnId: admittedTurn.id,
+                                signal,
+                                scope,
+                                reason: 'a transition-worthy result arrived after its runtime operation ended',
+                            });
+                        }
+                        else {
+                            playerTransactions.delete(binding.playerId);
+                        }
+                    }
+                    signal.throwIfAborted();
+                    throw new Error(`${frameLabel(frame)} player result arrived after its runtime operation ended`);
+                }
+                if (transitionRequired) {
+                    playerTransactions.set(binding.playerId, {
+                        phase: 'awaitingCommit',
+                        frame,
+                        roleId,
+                        turnId: admittedTurn.id,
+                        signal,
+                        scope,
+                        status: result.status,
+                        expectedToken: result.resumeToken,
+                    });
+                }
+                else {
+                    playerTransactions.delete(binding.playerId);
+                }
+            }
+            catch (error) {
+                if (playerTransactions.get(binding.playerId) === calling) {
+                    if (hostResolved) {
+                        playerTransactions.set(binding.playerId, {
+                            phase: 'quarantined',
+                            frame,
+                            roleId,
+                            turnId: admittedTurn.id,
+                            signal,
+                            scope,
+                            reason: 'a late player result could not be validated',
+                        });
+                    }
+                    else {
+                        playerTransactions.delete(binding.playerId);
+                    }
+                }
+                throw error;
+            }
+            return result;
         },
         callCaptain: async (prompt, signal, options) => {
+            admitHostBoundary();
             if (!activeContext) {
                 throw new Error('callCaptain invoked outside a Boss turn');
             }
@@ -810,6 +1645,7 @@ export function createPlaybookCaptainShell(options, deps = {}) {
             };
         },
         callJudge: async (prompt, signal) => {
+            admitHostBoundary();
             if (!activeContext) {
                 throw new Error('callJudge invoked outside a Boss turn');
             }
@@ -835,6 +1671,7 @@ export function createPlaybookCaptainShell(options, deps = {}) {
             return result.finalText;
         },
         callPlaybook: (request, signal) => {
+            admitHostBoundary();
             const opening = callNestedPlaybook(frame, request, signal);
             let exposed;
             const registerOpeningCleanup = () => {
@@ -848,23 +1685,34 @@ export function createPlaybookCaptainShell(options, deps = {}) {
                 registerOpeningCleanup();
             return exposed;
         },
-        emitStatus: async (message, data) => {
-            await requireSession().emitStatus(message, data);
+        emitStatus: (message, data) => {
+            if (!admitHostEmission())
+                return Promise.resolve();
+            return trackHostCall(frame, (async () => {
+                await requireSession().emitStatus(message, data);
+            })());
         },
-        emitTelemetry: async (event) => {
-            if (event.topic === SUB_RUNTIME_FSM_TOPIC) {
-                await mirrorSubRuntimeTelemetry(frame, event.payload);
-            }
-            await requireSession().emitTelemetry(event);
+        emitTelemetry: (event) => {
+            if (!admitHostEmission())
+                return Promise.resolve();
+            const emission = (async () => {
+                if (event.topic === SUB_RUNTIME_FSM_TOPIC) {
+                    await mirrorSubRuntimeTelemetry(frame, event.payload);
+                }
+                await requireSession().emitTelemetry(event);
+            })();
+            return trackHostCall(frame, emission);
         },
     });
     // CAPTAIN-22: before dispatching to a playbook, request tmux-play
-    // visibility for that playbook's generated host players. A pane
+    // visibility for that playbook's explicitly bound session players. A pane
     // reconciliation failure is display-only in tmux-play and does not
     // reject; the legacy path carries no generated set and skips this.
     const requestVisibility = async (frame) => {
-        const ids = [...new Set([...frame.playerBindings.values()].map(({ hostPlayerId }) => hostPlayerId))];
-        if (!ids || ids.length === 0 || !activeContext)
+        const ids = [...new Set([...frame.playerBindings.values()].map(({ playerId }) => playerId))];
+        // A roleless frame does not ask a non-empty host roster to show `[]`:
+        // tmux-play reserves that value for a genuinely empty configured roster.
+        if (ids.length === 0 || !activeContext)
             return;
         try {
             await activeContext.setVisiblePlayers(ids);
@@ -896,34 +1744,14 @@ export function createPlaybookCaptainShell(options, deps = {}) {
                 : undefined;
         return typeof stack === 'string' ? { ...compact, stack } : compact;
     };
+    const makePlayerBindings = (enablement) => {
+        return new Map(enablement.roleBindings);
+    };
     const makeFrame = (enablement, parent) => {
         const entry = enablement.entry;
         const sessionId = allocateSessionId();
-        const playerBindings = new Map();
-        for (const role of entry.requiredRoleIds) {
-            let inherited;
-            for (let ancestor = parent?.frame; ancestor && inherited === undefined; ancestor = ancestor.parent?.frame) {
-                inherited = ancestor.playerBindings.get(role);
-            }
-            if (inherited) {
-                playerBindings.set(role, inherited);
-                continue;
-            }
-            const configured = enablement.boundPlayers.find((player) => player.id === role) ?? { id: role };
-            playerBindings.set(role, {
-                hostPlayerId: enablement.hostPlayerId(role),
-                player: configured,
-            });
-        }
-        const playerResumeTokens = parent?.frame.playerResumeTokens ?? new Map();
-        const runtime = entry.createRuntime({
-            captainOptions: enablement.optionInput,
-            players: [...playerBindings].map(([role, { player }]) => ({
-                id: role,
-                ...(player.adapter === undefined ? {} : { adapter: player.adapter }),
-                ...(player.model === undefined ? {} : { model: player.model }),
-            })),
-        });
+        const playerBindings = makePlayerBindings(enablement);
+        const runtime = entry.createRuntime(enablement.options);
         return {
             entry,
             enablement,
@@ -932,59 +1760,188 @@ export function createPlaybookCaptainShell(options, deps = {}) {
             rootSessionId: parent?.frame.rootSessionId ?? sessionId,
             depth: parent ? parent.frame.depth + 1 : 0,
             playerBindings,
-            playerResumeTokens,
             ...(parent ? { parent } : {}),
             inFlightHostCalls: new Set(),
         };
     };
+    const makeRestoredFrame = (enablement, snapshot, parent) => {
+        const entry = enablement.entry;
+        const playerBindings = makePlayerBindings(enablement);
+        const runtime = entry.createRuntime(enablement.options);
+        return {
+            entry,
+            enablement,
+            runtime,
+            sessionId: snapshot.sessionId,
+            rootSessionId: snapshot.rootSessionId,
+            depth: snapshot.depth,
+            playerBindings,
+            ...(parent ? { parent } : {}),
+            state: snapshot.runtime.state,
+            inFlightHostCalls: new Set(),
+        };
+    };
     const playerSessionStore = (frame) => ({
         select(playerId) {
             const binding = bindingFor(frame, playerId);
-            return frame.playerResumeTokens.get(binding.hostPlayerId) ?? false;
+            return playerLedger.get(binding.playerId)?.resumeToken ?? false;
         },
         update(playerId, resumeToken) {
             const binding = bindingFor(frame, playerId);
-            if (resumeToken === undefined) {
-                frame.playerResumeTokens.delete(binding.hostPlayerId);
+            const ledger = playerLedger.get(binding.playerId);
+            if (!ledger) {
+                throw new Error(`${frameLabel(frame)} resolved absent session player ${JSON.stringify(binding.playerId)}`);
             }
-            else {
-                frame.playerResumeTokens.set(binding.hostPlayerId, resumeToken);
+            const pending = playerTransactions.get(binding.playerId);
+            if (pending?.phase !== 'awaitingCommit' ||
+                pending.frame !== frame ||
+                pending.roleId !== playerId ||
+                pending.scope !== frame.playerCallScope ||
+                pending.expectedToken !== resumeToken) {
+                throw new Error(`${frameLabel(frame)} player update does not acknowledge a validated host result`);
+            }
+            if (pending.signal.aborted || activeTurn?.id !== pending.turnId) {
+                playerTransactions.set(binding.playerId, {
+                    phase: 'quarantined',
+                    frame: pending.frame,
+                    roleId: pending.roleId,
+                    turnId: pending.turnId,
+                    signal: pending.signal,
+                    scope: pending.scope,
+                    reason: 'the runtime aborted before committing a validated result',
+                });
+                throw new Error(`${frameLabel(frame)} rejected a late or aborted player continuation update`);
+            }
+            try {
+                if (resumeToken === undefined)
+                    delete ledger.resumeToken;
+                else
+                    ledger.resumeToken = resumeToken;
+                // CAPTAIN-20: a result counts only after the runtime validated it and
+                // atomically published its authorized continuation transition.
+                const summary = activeTurnSummary;
+                if (pending.status === 'ok' &&
+                    summary &&
+                    summaryIncludes(frame)) {
+                    summary.counts.interruptions++;
+                }
+            }
+            finally {
+                playerTransactions.delete(binding.playerId);
             }
         },
         snapshot() {
             const tokens = {};
             for (const [playerId, binding] of frame.playerBindings) {
-                const token = frame.playerResumeTokens.get(binding.hostPlayerId);
+                const token = playerLedger.get(binding.playerId)?.resumeToken;
                 if (token !== undefined)
                     tokens[playerId] = token;
             }
             return tokens;
         },
         restore(tokens) {
-            for (const binding of frame.playerBindings.values()) {
-                frame.playerResumeTokens.delete(binding.hostPlayerId);
+            if (lifecycle !== 'restoring' ||
+                restoringPlayerSessionFrame !== frame) {
+                throw new Error(`${frameLabel(frame)} player-session restore is only available during shell restoration`);
             }
+            const byPlayer = new Map();
             for (const [playerId, token] of Object.entries(tokens)) {
                 const binding = bindingFor(frame, playerId);
-                frame.playerResumeTokens.set(binding.hostPlayerId, token);
+                const previous = byPlayer.get(binding.playerId);
+                if (previous !== undefined && previous !== token) {
+                    throw new Error(`${frameLabel(frame)} restored conflicting tokens for shared player ${JSON.stringify(binding.playerId)}`);
+                }
+                byPlayer.set(binding.playerId, token);
+            }
+            for (const binding of frame.playerBindings.values()) {
+                if (!byPlayer.has(binding.playerId))
+                    byPlayer.set(binding.playerId, undefined);
+            }
+            for (const [playerId, token] of byPlayer) {
+                const ledger = playerLedger.get(playerId);
+                if (!ledger) {
+                    throw new Error(`${frameLabel(frame)} restored absent session player ${JSON.stringify(playerId)}`);
+                }
+                if (token === undefined)
+                    delete ledger.resumeToken;
+                else
+                    ledger.resumeToken = token;
             }
         },
     });
+    const closePlayerCallScope = (frame, scope) => {
+        if (frame.playerCallScope === scope)
+            frame.playerCallScope = undefined;
+        const missing = [];
+        for (const [playerId, transaction] of playerTransactions) {
+            if (transaction.frame !== frame || transaction.scope !== scope)
+                continue;
+            if (transaction.phase === 'calling') {
+                transaction.abandoned = true;
+            }
+            else {
+                playerTransactions.set(playerId, {
+                    phase: 'quarantined',
+                    frame: transaction.frame,
+                    roleId: transaction.roleId,
+                    turnId: transaction.turnId,
+                    signal: transaction.signal,
+                    scope: transaction.scope,
+                    reason: transaction.phase === 'awaitingCommit'
+                        ? 'the runtime returned without committing a validated result'
+                        : transaction.reason,
+                });
+            }
+            if (!transaction.signal.aborted)
+                missing.push(playerId);
+        }
+        return missing.length === 0
+            ? undefined
+            : new Error(`${frameLabel(frame)} runtime returned without committing validated player result for ${missing.map((id) => JSON.stringify(id)).join(', ')}`);
+    };
+    const runFrameOperation = async (frame, operation) => {
+        if (frame.playerCallScope !== undefined) {
+            throw new Error(`${frameLabel(frame)} runtime operations must not overlap`);
+        }
+        const scope = {};
+        frame.playerCallScope = scope;
+        let outcome;
+        try {
+            outcome = { ok: true, value: await operation() };
+        }
+        catch (error) {
+            outcome = { ok: false, error };
+        }
+        const cleanupError = closePlayerCallScope(frame, scope);
+        if (!outcome.ok)
+            throw outcome.error;
+        if (cleanupError !== undefined)
+            throw cleanupError;
+        return outcome.value;
+    };
+    const frameSession = (frame) => ({
+        sessionId: frame.sessionId,
+        playbookId: frame.entry.id,
+        rootSessionId: frame.rootSessionId,
+        ...(frame.parent
+            ? {
+                parentSessionId: frame.parent.frame.sessionId,
+                parentCallId: frame.parent.callId,
+            }
+            : {}),
+        depth: frame.depth,
+        roleBindings: Object.fromEntries([...frame.playerBindings].map(([roleId, binding]) => [
+            roleId,
+            {
+                playerId: binding.playerId,
+                promptIdentity: promptIdentity(binding),
+            },
+        ])),
+        playerSessions: playerSessionStore(frame),
+        ports: createPorts(frame),
+    });
     const initFrame = async (frame) => {
-        await frame.runtime.init({
-            sessionId: frame.sessionId,
-            playbookId: frame.entry.id,
-            rootSessionId: frame.rootSessionId,
-            ...(frame.parent
-                ? {
-                    parentSessionId: frame.parent.frame.sessionId,
-                    parentCallId: frame.parent.callId,
-                }
-                : {}),
-            depth: frame.depth,
-            playerSessions: playerSessionStore(frame),
-            ports: createPorts(frame),
-        });
+        await frame.runtime.init(frameSession(frame));
     };
     const clearLeafLedger = () => {
         pendingBossQuestions = undefined;
@@ -1264,7 +2221,7 @@ export function createPlaybookCaptainShell(options, deps = {}) {
         // exception filed against an effect that never ran.
         await requestVisibility(frame);
         await setMode('engaged.driving', 'submit');
-        const result = await runEffect(() => frame.runtime.handleBossInput({ text, signal }));
+        const result = await runFrameOperation(frame, () => runEffect(() => frame.runtime.handleBossInput({ text, signal })));
         frame.state = result.state;
         return result;
     };
@@ -1310,11 +2267,11 @@ export function createPlaybookCaptainShell(options, deps = {}) {
         }
         let result;
         try {
-            result = await runEffect(() => parent.runtime.resumePlaybookCall({
+            result = await runFrameOperation(parent, () => runEffect(() => parent.runtime.resumePlaybookCall({
                 callId: parentLink.callId,
                 result: effectiveResult,
                 signal: context.signal,
-            }));
+            })));
         }
         catch (error) {
             if (disposing || invocationSignal?.aborted)
@@ -1346,6 +2303,12 @@ export function createPlaybookCaptainShell(options, deps = {}) {
                 await resumeParent(frame, callResultFor(frame, result), context);
             }
             else {
+                // CAPTAIN-20: the root is still alive here, so this is the one
+                // authoritative boundary that can retain the Boss-facing meaning its
+                // runtime publishes before disposal removes the frame. The opaque run
+                // output remains runtime-to-runtime data and never becomes Captain
+                // evidence (CAPPLAY-10).
+                activeTurn?.settlementFacts.push(rootCompletionFact(frame));
                 await runEffect(() => disposeStack('final'));
             }
             return;
@@ -1664,7 +2627,9 @@ export function createPlaybookCaptainShell(options, deps = {}) {
             stateDigestLine(view.state, view.stateDescription),
         ].join(': '));
         lines.push(...leafContextLines(view.context));
-        const pending = view.pendingQuestions.map((question) => digestLine `- (${quoteEvidence(question.questionId)}) ${quoteEvidence(question.player)} asks: ${quoteEvidence(question.question)}`);
+        const pending = view.pendingQuestions.map((question) => digestLine `- (${quoteEvidence(question.questionId)}) ${quoteEvidence(question.asker.kind === 'captain'
+            ? 'Captain'
+            : question.asker.roleId)} asks: ${quoteEvidence(question.question)}`);
         lines.push(pending.length === 0
             ? 'Pending Boss questions: none.'
             : ['Pending Boss questions:', ...pending].join('\n'));
@@ -1760,6 +2725,7 @@ export function createPlaybookCaptainShell(options, deps = {}) {
             await trackTurnCall(settlement.context.emitReply(settlement.text));
         }
         catch (error) {
+            conversation = { kind: 'needsSeeding' };
             const normalized = normalizeErrorCompact(error) ?? {
                 name: 'Error',
                 message: String(error),
@@ -1856,8 +2822,8 @@ export function createPlaybookCaptainShell(options, deps = {}) {
      * text, replies, handoffs, playbook ids, facts, labels, and reasons are prose
      * the Captain may need to repeat.
      */
-    const reseedDigest = () => {
-        for (const record of journal) {
+    const conversationDigest = (records, render) => {
+        for (const record of records) {
             if (record.kind === 'action' &&
                 typeof record.payload === 'object' &&
                 record.payload !== null &&
@@ -1867,13 +2833,34 @@ export function createPlaybookCaptainShell(options, deps = {}) {
                     recordSuppliedIdentifier(actionId);
             }
         }
-        return renderReseedDigest(journal);
+        return render(records);
     };
+    const reseedDigest = () => conversationDigest(journal, renderReseedDigest);
+    const catchUpDigest = (afterJournalSeq) => conversationDigest(journal.filter((record) => record.seq > afterJournalSeq), renderCatchUpDigest);
     const markControlFailure = (error) => {
-        if (activeTurn)
-            activeTurn.controlFailure = true;
+        activeTurn?.controlFailures.add(error);
         return error;
     };
+    const markSettingsRejection = (error) => markControlFailure(error);
+    const rememberSettingsPreflight = (error) => {
+        activeTurn?.settingsPreflightFailures.add(error);
+        return markSettingsRejection(error);
+    };
+    const markConversationCatchUp = () => {
+        if (conversation.kind === 'needsSeeding' || conversation.kind === 'needsCatchUp') {
+            return;
+        }
+        conversation = {
+            kind: 'needsCatchUp',
+            resume: conversation.kind === 'pinned' ? conversation.token : false,
+            afterJournalSeq: activeTurn?.captainSyncedJournalSeq ?? 0,
+        };
+    };
+    const markConversationUnsynchronized = () => {
+        if (conversation.kind !== 'needsCatchUp') {
+            conversation = { kind: 'needsSeeding' };
+        }
+    };
     /**
      * CAPTAIN-35: the one wrapper an effect runs through — a runtime driven, an
      * engagement constructed, a stack disposed, an advertised action applied.
@@ -1919,14 +2906,16 @@ export function createPlaybookCaptainShell(options, deps = {}) {
             this.name = 'CaptainProseError';
         }
     }
-    const rawDurableCall = async (context, prompt, resume) => {
+    const rawDurableCall = async (context, prompt, resume, attempt) => {
         const queued = captainQueue.add(async () => {
             context.signal.throwIfAborted();
-            const result = await context.callCaptain(prompt, {
+            attempt.providerBoundaryEntered = true;
+            const result = await classifySettingsCall(() => context.callCaptain(prompt, {
                 visibility: 'hidden',
                 resume,
                 ...controlCallToolOptions(captainAdapter),
-            });
+                settings: callSettings(captainAgent),
+            }));
             context.signal.throwIfAborted();
             return result;
         });
@@ -1938,17 +2927,47 @@ export function createPlaybookCaptainShell(options, deps = {}) {
     // conversation that is owed a reseed carries the digest on its very next
     // call, so the turn after a failed reseed starts seeded rather than blank.
     const durableCall = async (context, compose) => {
-        const resume = conversation.kind === 'pinned' ? conversation.token : false;
+        const startingConversation = conversation;
+        const resume = startingConversation.kind === 'pinned'
+            ? startingConversation.token
+            : startingConversation.kind === 'needsCatchUp'
+                ? startingConversation.resume
+                : false;
         const seedFirstCall = conversation.kind === 'needsSeeding';
+        const catchUpFirstCall = conversation.kind === 'needsCatchUp';
+        const representedJournalSeq = journalSeq;
+        const firstAttempt = { providerBoundaryEntered: false };
         let result;
         let failure;
         try {
-            result = await rawDurableCall(context, compose(seedFirstCall ? { reseedDigest: reseedDigest() } : {}), resume);
+            result = await rawDurableCall(context, compose(seedFirstCall
+                ? { reseedDigest: reseedDigest() }
+                : startingConversation.kind === 'needsCatchUp'
+                    ? {
+                        reseedDigest: catchUpDigest(startingConversation.afterJournalSeq),
+                    }
+                    : {}), resume, firstAttempt);
         }
         catch (error) {
             if (context.signal.aborted) {
-                conversation = { kind: 'needsSeeding' };
-                throw error;
+                if (firstAttempt.providerBoundaryEntered) {
+                    conversation = { kind: 'needsSeeding' };
+                }
+                else {
+                    markConversationUnsynchronized();
+                }
+                throw context.signal.reason ?? error;
+            }
+            if (error instanceof AgentSettingsPreflightError) {
+                if (conversation.kind !== 'needsCatchUp' &&
+                    conversation.kind !== 'needsSeeding') {
+                    conversation = {
+                        kind: 'needsCatchUp',
+                        resume: conversation.kind === 'pinned' ? conversation.token : false,
+                        afterJournalSeq: activeTurn?.captainSyncedJournalSeq ?? 0,
+                    };
+                }
+                throw rememberSettingsPreflight(error.rejection);
             }
             failure = error;
         }
@@ -1958,11 +2977,14 @@ export function createPlaybookCaptainShell(options, deps = {}) {
             result.resumeToken === undefined;
         if (!unsynchronized) {
             conversation = { kind: 'pinned', token: result.resumeToken };
+            if (activeTurn) {
+                activeTurn.captainSyncedJournalSeq = representedJournalSeq;
+            }
             return {
                 ...(result.finalText !== undefined
                     ? { finalText: result.finalText }
                     : {}),
-                correctiveSpent: seedFirstCall,
+                correctiveSpent: seedFirstCall || catchUpFirstCall,
             };
         }
         // Only the model-side conversation is replaced: the stack, player
@@ -1972,13 +2994,17 @@ export function createPlaybookCaptainShell(options, deps = {}) {
         conversation = { kind: 'needsSeeding' };
         const recap = reseedDigest();
         let reissued;
+        const reissueAttempt = { providerBoundaryEntered: false };
         try {
-            reissued = await rawDurableCall(context, compose({ reseedDigest: recap }), false);
+            reissued = await rawDurableCall(context, compose({ reseedDigest: recap }), false, reissueAttempt);
         }
         catch (error) {
             if (context.signal.aborted) {
                 conversation = { kind: 'needsSeeding' };
-                throw error;
+                throw context.signal.reason ?? error;
+            }
+            if (error instanceof AgentSettingsPreflightError) {
+                throw rememberSettingsPreflight(error.rejection);
             }
             throw markControlFailure(new CaptainContinuityError(error));
         }
@@ -1987,6 +3013,8 @@ export function createPlaybookCaptainShell(options, deps = {}) {
                 `callCaptain status "${reissued.status}" without a resume token`));
         }
         conversation = { kind: 'pinned', token: reissued.resumeToken };
+        if (activeTurn)
+            activeTurn.captainSyncedJournalSeq = journalSeq;
         return {
             ...(reissued.finalText !== undefined
                 ? { finalText: reissued.finalText }
@@ -2025,9 +3053,11 @@ export function createPlaybookCaptainShell(options, deps = {}) {
     // -------------------------------------------------------------------------
     const captainPorts = () => ({
         callPlayer: async () => {
+            admitHostBoundary();
             throw new Error('the session Captain has no players');
         },
         callCaptain: async (prompt, signal) => {
+            admitHostBoundary();
             if (!activeContext) {
                 throw new Error('the session Captain called out of a Boss turn');
             }
@@ -2085,29 +3115,38 @@ export function createPlaybookCaptainShell(options, deps = {}) {
             return { status: 'ok', finalText: 'ok' };
         },
         callJudge: async () => {
+            admitHostBoundary();
             throw new Error('the session Captain makes no judge call');
         },
         callPlaybook: async () => {
+            admitHostBoundary();
             throw new Error('the session Captain never calls a playbook');
         },
         // CAPTAIN-9: the session Captain's human status stream is suppressed while
         // its structured telemetry is forwarded.
-        emitStatus: async () => { },
-        emitTelemetry: async (event) => {
-            if (event.topic === 'playbook.trace') {
-                const payload = payloadRecord(event.payload);
-                if (payload?.type === 'captain.call.started') {
-                    const identity = payloadRecord(payload.payload);
-                    const stateId = identity?.stateId;
-                    servingCall =
-                        stateId === 'reporting'
-                            ? 'closingReply'
-                            : stateId === 'answeringCommand'
-                                ? 'commandReply'
-                                : 'decision';
+        emitStatus: async () => {
+            admitHostEmission();
+        },
+        emitTelemetry: (event) => {
+            if (!admitHostEmission())
+                return Promise.resolve();
+            const emission = (async () => {
+                if (event.topic === 'playbook.trace') {
+                    const payload = payloadRecord(event.payload);
+                    if (payload?.type === 'captain.call.started') {
+                        const identity = payloadRecord(payload.payload);
+                        const stateId = identity?.stateId;
+                        servingCall =
+                            stateId === 'reporting'
+                                ? 'closingReply'
+                                : stateId === 'answeringCommand'
+                                    ? 'commandReply'
+                                    : 'decision';
+                    }
                 }
-            }
-            await requireSession().emitTelemetry(event);
+                await requireSession().emitTelemetry(event);
+            })();
+            return trackTurnCall(emission);
         },
     });
     const resolveCommandTurn = (text) => {
@@ -2175,6 +3214,13 @@ export function createPlaybookCaptainShell(options, deps = {}) {
             return undefined;
         }
     };
+    const rootCompletionFact = (frame) => {
+        const published = leafStateDescription(frame);
+        const description = published === undefined ? '' : compactEvidence(published);
+        return description === ''
+            ? `${frameLabel(frame)} completed; its runtime published no result description.`
+            : `${frameLabel(frame)} completed; its runtime-published result meaning was ${quoteEvidence(description)}.`;
+    };
     const leafStateSummary = () => {
         const leaf = leafFrame();
         if (!leaf)
@@ -2312,7 +3358,7 @@ export function createPlaybookCaptainShell(options, deps = {}) {
                 message: String(error),
             };
             if (aborted) {
-                conversation = { kind: 'needsSeeding' };
+                markConversationUnsynchronized();
                 if (turn?.outcomePending) {
                     turn.settlementFacts.push(`The ${selection.action} action was aborted before its outcome could be confirmed; it was not repeated automatically.`);
                     journalOutcome(journalOutcomeEvidence(turn.settlementFacts, 'failed', turn.report));
@@ -2573,9 +3619,6 @@ export function createPlaybookCaptainShell(options, deps = {}) {
                 };
                 throw outcome.error;
             }
-            if (!frames.includes(leaf)) {
-                facts.push(`${frameLabel(leaf)} finished and was disposed.`);
-            }
             const runFailed = drainRunFailureFacts(facts);
             const summary = leafStateSummary();
             turn.report = {
@@ -2645,7 +3688,7 @@ export function createPlaybookCaptainShell(options, deps = {}) {
         // guard against re-execution — a repeated selection returns the recorded
         // receipt rather than acting twice.
         const key = `turn-${turn.id}-apply-${actionId}`;
-        const outcome = await withCounting(leaf, async () => runEffect(() => leaf.runtime.apply({ actionId, key, signal })));
+        const outcome = await withCounting(leaf, async () => runFrameOperation(leaf, () => runEffect(() => leaf.runtime.apply({ actionId, key, signal }))));
         if (outcome.error !== undefined)
             throw outcome.error;
         const receipt = outcome.result;
@@ -2730,8 +3773,14 @@ export function createPlaybookCaptainShell(options, deps = {}) {
         };
     };
     const controller = {
-        submit: (selection, signal) => settleSelection(selection, signal),
-        resolveParsedTurn: () => shuttingDown ? { kind: 'shutdown' } : activeTurn?.resolution,
+        submit: (selection, signal) => {
+            admitHostBoundary();
+            return settleSelection(selection, signal);
+        },
+        resolveParsedTurn: () => {
+            admitHostBoundary();
+            return shuttingDown ? { kind: 'shutdown' } : activeTurn?.resolution;
+        },
     };
     // -------------------------------------------------------------------------
     // Failure surface (CAPTAIN-34): a Boss-appropriate reply naming a concrete
@@ -2787,7 +3836,12 @@ export function createPlaybookCaptainShell(options, deps = {}) {
         // The durable Captain conversation did not receive the shell-authored
         // fallback. Force its next call through the journal so it cannot interpret
         // the Boss's follow-up without the reply the Boss was given this turn.
-        conversation = { kind: 'needsSeeding' };
+        if (activeTurn?.settingsPreflightFailures.has(error)) {
+            markConversationCatchUp();
+        }
+        else {
+            markConversationUnsynchronized();
+        }
         // A rejected presentation may already have emitted bytes. It is therefore
         // final for this turn even though the Promise did not prove it was shown.
         if (activeTurn?.presentationAttempted === true)
@@ -2800,40 +3854,445 @@ export function createPlaybookCaptainShell(options, deps = {}) {
             text: failureReplyText(),
         });
     };
-    return {
-        async init(initSession) {
-            session = initSession;
-            players = initSession.players;
-            const built = await buildEnablements(options, players, loadModule);
+    const enabledCatalog = () => Object.freeze(entries.map((entry) => Object.freeze({
+        id: entry.id,
+        command: enablementById.get(entry.id).command,
+        intent: entry.intent,
+    })));
+    const captainPlaybookSession = (id) => ({
+        sessionId: id,
+        playbookId: INTERNAL_CAPTAIN_ID,
+        rootSessionId: id,
+        depth: 0,
+        roleBindings: {},
+        ports: captainPorts(),
+    });
+    const playerLedgerRecord = () => Object.fromEntries([...playerLedger].map(([playerId, entry]) => [
+        playerId,
+        {
+            adapter: entry.adapter,
+            ...(entry.instruction === undefined
+                ? {}
+                : { instruction: entry.instruction }),
+            ...(entry.permissions === undefined
+                ? {}
+                : { permissions: entry.permissions }),
+            ...(entry.resumeToken === undefined
+                ? {}
+                : { resumeToken: entry.resumeToken }),
+        },
+    ]));
+    const assertSnapshotMatchesEnablements = (snapshot, enabled) => {
+        if (captainAgent === undefined ||
+            !isDeepStrictEqual(snapshot.captain.agent, fixedAgent(captainAgent))) {
+            throw new TypeError('Captain shell snapshot Captain agent is incompatible with current config');
+        }
+        const configuredPlayerIds = [...playerAgents.keys()].sort();
+        const savedPlayerIds = Object.keys(snapshot.playerSessions).sort();
+        if (!isDeepStrictEqual(savedPlayerIds, configuredPlayerIds)) {
+            throw new TypeError('Captain shell snapshot player ledger does not match current referenced players');
+        }
+        for (const playerId of configuredPlayerIds) {
+            const saved = snapshot.playerSessions[playerId];
+            const configured = playerAgents.get(playerId);
+            const savedFixed = {
+                adapter: saved.adapter,
+                ...(saved.instruction === undefined
+                    ? {}
+                    : { instruction: saved.instruction }),
+                ...(saved.permissions === undefined
+                    ? {}
+                    : { permissions: saved.permissions }),
+            };
+            if (!isDeepStrictEqual(savedFixed, fixedAgent(configured))) {
+                throw new TypeError(`Captain shell snapshot player ${JSON.stringify(playerId)} is incompatible with current config`);
+            }
+        }
+        if (snapshot.mode === 'chat')
+            return;
+        for (const frame of snapshot.frames) {
+            const enablement = enabled.get(frame.playbookId);
+            if (!enablement) {
+                throw new TypeError(`Captain shell snapshot frame names disabled playbook ${JSON.stringify(frame.playbookId)}`);
+            }
+            const configuredBindings = Object.fromEntries([...enablement.roleBindings].map(([role, binding]) => [
+                role,
+                binding.playerId,
+            ]));
+            if (!isDeepStrictEqual(frame.options, enablement.options)) {
+                throw new TypeError(`Captain shell snapshot frame ${JSON.stringify(frame.playbookId)} options changed`);
+            }
+            if (!isDeepStrictEqual(frame.roleBindings, configuredBindings)) {
+                throw new TypeError(`Captain shell snapshot frame ${JSON.stringify(frame.playbookId)} role bindings changed`);
+            }
+        }
+    };
+    const safeCapturePoint = () => {
+        if (lifecycle !== 'ready' ||
+            terminallyDisposed ||
+            !sessionEmissionsOpen ||
+            !session ||
+            session.signal.aborted ||
+            !captainRuntime ||
+            disposing ||
+            shuttingDown ||
+            activeContext !== undefined ||
+            activeTurn !== undefined ||
+            activeTurnHostCalls !== undefined ||
+            activeTurnSummary !== undefined ||
+            runFailureFacts !== undefined ||
+            servingCall !== undefined ||
+            decisionCall !== undefined ||
+            playerTransactions.size !== 0 ||
+            captainQueue.pending !== 0 ||
+            captainQueue.size !== 0 ||
+            (mode !== 'chat' && mode !== 'engaged.parked')) {
+            return false;
+        }
+        if ((mode === 'chat' &&
+            (frames.length !== 0 ||
+                pendingChildParents.size !== 0 ||
+                pendingBossQuestions !== undefined ||
+                lastError !== undefined)) ||
+            (mode === 'engaged.parked' && frames.length === 0)) {
+            return false;
+        }
+        const expectedParents = new Set(frames.slice(0, -1));
+        if (pendingChildParents.size !== expectedParents.size ||
+            [...pendingChildParents].some((frame) => !expectedParents.has(frame))) {
+            return false;
+        }
+        return frames.every((frame, index) => {
+            const liveInvocation = frame.invocationSignal !== undefined || frame.abortListener !== undefined;
+            return (frame.state !== undefined &&
+                frame.state.status === 'active' &&
+                frame.state.quiescent &&
+                !frame.disposing &&
+                frame.disposePromise === undefined &&
+                frame.removal === undefined &&
+                frame.inFlightHostCalls.size === 0 &&
+                (index === 0
+                    ? !liveInvocation
+                    : !liveInvocation ||
+                        (frame.invocationSignal !== undefined &&
+                            !frame.invocationSignal.aborted &&
+                            frame.abortListener !== undefined)));
+        });
+    };
+    const exportShellSnapshot = () => {
+        if (!safeCapturePoint() ||
+            !captainRuntime ||
+            !captainSessionId ||
+            !captainAgent) {
+            return undefined;
+        }
+        try {
+            if (typeof captainRuntime.exportSnapshot !== 'function' ||
+                typeof captainRuntime.restore !== 'function') {
+                return undefined;
+            }
+            const captainSnapshot = captainRuntime.exportSnapshot();
+            if (captainSnapshot === undefined)
+                return undefined;
+            const frameSnapshots = [];
+            for (const frame of frames) {
+                if (typeof frame.runtime.exportSnapshot !== 'function' ||
+                    typeof frame.runtime.restore !== 'function') {
+                    return undefined;
+                }
+                const runtime = frame.runtime.exportSnapshot();
+                if (runtime === undefined ||
+                    !isDeepStrictEqual(frame.state, runtime.state)) {
+                    return undefined;
+                }
+                frameSnapshots.push({
+                    playbookId: frame.entry.id,
+                    sessionId: frame.sessionId,
+                    rootSessionId: frame.rootSessionId,
+                    depth: frame.depth,
+                    ...(frame.parent
+                        ? {
+                            parentSessionId: frame.parent.frame.sessionId,
+                            parentCallId: frame.parent.callId,
+                        }
+                        : {}),
+                    options: frame.enablement.options,
+                    roleBindings: Object.fromEntries([...frame.playerBindings].map(([role, binding]) => [
+                        role,
+                        binding.playerId,
+                    ])),
+                    runtime,
+                });
+            }
+            const common = {
+                schemaVersion: 3,
+                captain: {
+                    sessionId: captainSessionId,
+                    runtime: captainSnapshot,
+                    agent: fixedAgent(captainAgent),
+                    conversation,
+                },
+                playerSessions: playerLedgerRecord(),
+                issuedSessionIds: [...issuedSessionIds],
+                sequences: { turn: turnSequence, journal: journalSeq },
+                journal,
+                ...(lastAction === undefined ? {} : { lastAction }),
+                ...(lastSettlementStatus === undefined
+                    ? {}
+                    : { lastSettlementStatus }),
+            };
+            const candidate = mode === 'chat'
+                ? { ...common, mode }
+                : {
+                    ...common,
+                    mode: 'engaged.parked',
+                    frames: frameSnapshots,
+                    ...(pendingBossQuestions === undefined
+                        ? {}
+                        : { pendingBossQuestions: pendingBossQuestions }),
+                    ...(lastError === undefined ? {} : { lastError }),
+                };
+            const normalized = assertPlaybookCaptainShellSnapshot(candidate);
+            assertSnapshotMatchesEnablements(normalized, enablementById);
+            return normalized;
+        }
+        catch {
+            return undefined;
+        }
+    };
+    const verifyRestoredRuntime = (runtime, expected, playbookId, allowSuspendedCall) => {
+        const actual = runtime.exportSnapshot?.();
+        if (actual === undefined) {
+            throw new Error(`restored ${playbookId} runtime did not reach a safe snapshot boundary`);
+        }
+        const normalized = assertPlaybookRuntimeSnapshot(actual, playbookId, allowSuspendedCall ? { allowSuspendedCall: true } : {});
+        for (const key of [
+            'state',
+            'roleResumeTokens',
+            'sequences',
+            'pendingBossQuestions',
+            'suspendedCall',
+        ]) {
+            if (!isDeepStrictEqual(normalized[key], expected[key])) {
+                throw new Error(`restored ${playbookId} runtime changed snapshot field ${key}`);
+            }
+        }
+    };
+    const resetFailedRestore = async () => {
+        const cleanupFailures = [];
+        for (const frame of [...frames].reverse()) {
+            frame.disposing = true;
+            try {
+                await frame.runtime.dispose();
+            }
+            catch (error) {
+                cleanupFailures.push(error);
+            }
+        }
+        if (captainRuntime) {
+            shuttingDown = true;
+            try {
+                await captainRuntime.dispose();
+            }
+            catch (error) {
+                cleanupFailures.push(error);
+            }
+        }
+        frames.splice(0);
+        pendingChildParents.clear();
+        issuedSessionIds.clear();
+        journal.splice(0);
+        entries = [];
+        byCommand = new Map();
+        byId = new Map();
+        enablementById = new Map();
+        captainAgent = undefined;
+        captainAdapter = undefined;
+        playerAgents = new Map();
+        playerLedger.clear();
+        playerTransactions.clear();
+        session = undefined;
+        sessionEmissionsOpen = false;
+        closedGateAttempted = false;
+        captainRuntime = undefined;
+        captainSessionId = undefined;
+        conversation = { kind: 'unopened' };
+        mode = 'chat';
+        pendingBossQuestions = undefined;
+        lastError = undefined;
+        journalSeq = 0;
+        turnSequence = 0;
+        lastAction = undefined;
+        lastSettlementStatus = undefined;
+        shuttingDown = false;
+        if (cleanupFailures.length > 0) {
+            terminallyDisposed = true;
+            lifecycle = 'closed';
+        }
+        else {
+            lifecycle = 'fresh';
+        }
+        return cleanupFailures;
+    };
+    const restoreShellSnapshot = async (initSession, untrusted) => {
+        if (lifecycle !== 'fresh' || terminallyDisposed) {
+            throw new Error('Captain shell restore requires a fresh shell');
+        }
+        if (initSession.signal.aborted) {
+            throw new Error('cannot restore an aborted Captain session');
+        }
+        lifecycle = 'restoring';
+        try {
+            const snapshot = assertPlaybookCaptainShellSnapshot(untrusted);
+            const built = await buildEnablements(options, loadModule);
+            captainAgent = built.captainAgent;
+            captainAdapter = captainAgent.adapter;
+            playerAgents = built.playerAgents;
+            assertSnapshotMatchesEnablements(snapshot, built.enablementById);
+            installSession(initSession, false);
             entries = built.entries;
             byCommand = built.byCommand;
             byId = built.byId;
             enablementById = built.enablementById;
-            for (const enablement of enablementById.values()) {
-                enablement.entry.validateOptions(enablement.optionInput);
-            }
-            await setMode('chat', 'init');
-            // CAPTAIN-16: the session Captain exists from `init`, outside the
-            // engagement stack, with its own playbook session id.
-            const catalog = Object.freeze(entries.map((entry) => Object.freeze({
-                id: entry.id,
-                command: enablementById.get(entry.id).command,
-                intent: entry.intent,
-            })));
-            captainSessionId = allocateSessionId();
+            for (const [playerId, saved] of Object.entries(snapshot.playerSessions)) {
+                playerLedger.set(playerId, {
+                    adapter: saved.adapter,
+                    ...(saved.instruction === undefined
+                        ? {}
+                        : { instruction: saved.instruction }),
+                    ...(saved.permissions === undefined
+                        ? {}
+                        : { permissions: livePermissions(saved.permissions) }),
+                    ...(saved.resumeToken === undefined
+                        ? {}
+                        : { resumeToken: saved.resumeToken }),
+                });
+            }
             captainRuntime = createCaptainRuntime({
-                enabledPlaybooks: catalog,
+                enabledPlaybooks: enabledCatalog(),
                 controller,
             });
-            await captainRuntime.init({
-                sessionId: captainSessionId,
-                playbookId: INTERNAL_CAPTAIN_ID,
-                rootSessionId: captainSessionId,
-                depth: 0,
-                ports: captainPorts(),
-            });
+            if (typeof captainRuntime.restore !== 'function') {
+                throw new Error('session Captain runtime does not support restore');
+            }
+            if (snapshot.mode === 'engaged.parked') {
+                for (const [index, frameSnapshot] of snapshot.frames.entries()) {
+                    const parentFrame = frames.at(-1);
+                    const frame = makeRestoredFrame(enablementById.get(frameSnapshot.playbookId), frameSnapshot, index === 0
+                        ? undefined
+                        : {
+                            frame: parentFrame,
+                            callId: frameSnapshot.parentCallId,
+                        });
+                    if (typeof frame.runtime.restore !== 'function') {
+                        throw new Error(`playbook ${frame.entry.id} runtime does not support restore`);
+                    }
+                    frames.push(frame);
+                    if (parentFrame)
+                        pendingChildParents.add(parentFrame);
+                }
+            }
+            await captainRuntime.restore(captainPlaybookSession(snapshot.captain.sessionId), snapshot.captain.runtime);
+            if (snapshot.mode === 'engaged.parked') {
+                for (const [index, frame] of frames.entries()) {
+                    restoringPlayerSessionFrame = frame;
+                    try {
+                        await frame.runtime.restore(frameSession(frame), snapshot.frames[index].runtime);
+                    }
+                    finally {
+                        restoringPlayerSessionFrame = undefined;
+                    }
+                }
+            }
+            if (closedGateAttempted) {
+                throw new Error('a runtime attempted a host emission during restore');
+            }
+            verifyRestoredRuntime(captainRuntime, snapshot.captain.runtime, INTERNAL_CAPTAIN_ID, false);
+            if (snapshot.mode === 'engaged.parked') {
+                for (const [index, frame] of frames.entries()) {
+                    verifyRestoredRuntime(frame.runtime, snapshot.frames[index].runtime, frame.entry.id, true);
+                }
+                if (!isDeepStrictEqual(playerLedgerRecord(), snapshot.playerSessions)) {
+                    throw new Error('restored Captain-session player continuation changed during restore');
+                }
+            }
+            if (closedGateAttempted) {
+                throw new Error('a runtime attempted a host emission during restore');
+            }
+            if (requireSession().signal.aborted) {
+                throw new Error('Captain session aborted during restore');
+            }
+            for (const id of snapshot.issuedSessionIds)
+                issuedSessionIds.add(id);
+            journal.push(...snapshot.journal);
+            journalSeq = snapshot.sequences.journal;
+            turnSequence = snapshot.sequences.turn;
+            conversation = snapshot.captain.conversation;
+            captainSessionId = snapshot.captain.sessionId;
+            lastAction = snapshot.lastAction;
+            lastSettlementStatus = snapshot.lastSettlementStatus;
+            mode = snapshot.mode;
+            if (snapshot.mode === 'engaged.parked') {
+                pendingBossQuestions = snapshot.pendingBossQuestions;
+                lastError = snapshot.lastError;
+            }
+            lifecycle = 'ready';
+            // The final commit is deliberately one non-throwing assignment.
+            sessionEmissionsOpen = true;
+        }
+        catch (error) {
+            const cleanupFailures = await resetFailedRestore();
+            if (cleanupFailures.length > 0) {
+                throw new AggregateError([error, ...cleanupFailures], 'Captain shell restore and cleanup failed');
+            }
+            throw error;
+        }
+    };
+    return {
+        async init(initSession) {
+            if (lifecycle !== 'fresh' || terminallyDisposed) {
+                throw new Error('Captain shell requires a fresh instance for init');
+            }
+            if (initSession.signal.aborted) {
+                throw new Error('cannot initialize an aborted Captain session');
+            }
+            lifecycle = 'initializing';
+            try {
+                installSession(initSession, true);
+                const built = await buildEnablements(options, loadModule);
+                entries = built.entries;
+                byCommand = built.byCommand;
+                byId = built.byId;
+                enablementById = built.enablementById;
+                captainAgent = built.captainAgent;
+                captainAdapter = captainAgent.adapter;
+                playerAgents = built.playerAgents;
+                for (const [playerId, agent] of playerAgents) {
+                    playerLedger.set(playerId, fixedAgent(agent));
+                }
+                await setMode('chat', 'init');
+                // CAPTAIN-16: the session Captain exists from `init`, outside the
+                // engagement stack, with its own playbook session id.
+                captainSessionId = allocateSessionId();
+                captainRuntime = createCaptainRuntime({
+                    enabledPlaybooks: enabledCatalog(),
+                    controller,
+                });
+                await captainRuntime.init(captainPlaybookSession(captainSessionId));
+                lifecycle = 'ready';
+            }
+            catch (error) {
+                terminallyDisposed = true;
+                lifecycle = 'closed';
+                throw error;
+            }
         },
+        exportSnapshot: exportShellSnapshot,
+        restore: restoreShellSnapshot,
         async handleBossTurn(turn, context) {
+            if (lifecycle !== 'ready' || terminallyDisposed) {
+                throw new Error('init must be called first, or restore must complete before handling a Boss turn');
+            }
             requireSession();
             if (!captainRuntime) {
                 throw new Error('init must be called first');
@@ -2851,6 +4310,7 @@ export function createPlaybookCaptainShell(options, deps = {}) {
             const parsed = resolveCommandTurn(turn.prompt);
             activeTurn = {
                 id: ++turnSequence,
+                captainSyncedJournalSeq: journalSeq,
                 bossText: turn.prompt,
                 authoritativeText: parsed?.authoritativeText ?? turn.prompt,
                 ...(parsed ? { resolution: parsed.resolution } : {}),
@@ -2858,6 +4318,8 @@ export function createPlaybookCaptainShell(options, deps = {}) {
                 presentationAttempted: false,
                 settlementFacts: [],
                 effectThrows: new Set(),
+                controlFailures: new Set(),
+                settingsPreflightFailures: new Set(),
                 suppliedIdentifiers: new Set(),
                 outcomeRecorded: false,
             };
@@ -2876,11 +4338,14 @@ export function createPlaybookCaptainShell(options, deps = {}) {
                         new Error('the session Captain turn failed at its boundary'));
                 }
                 else if (result.outcome === 'aborted') {
-                    conversation = { kind: 'needsSeeding' };
+                    markConversationUnsynchronized();
                     if (activeTurn && !activeTurn.outcomeRecorded) {
                         activeTurn.settlementFacts.push('The Boss turn was aborted before it settled; no action was repeated automatically.');
                         journalOutcome([...activeTurn.settlementFacts]);
                     }
+                    if (context.signal.aborted) {
+                        throw context.signal.reason;
+                    }
                 }
                 else if (result.outcome !== 'suspended' &&
                     !context.signal.aborted &&
@@ -2894,10 +4359,10 @@ export function createPlaybookCaptainShell(options, deps = {}) {
             }
             catch (error) {
                 if (context.signal.aborted) {
-                    conversation = { kind: 'needsSeeding' };
+                    markConversationUnsynchronized();
                     throw error;
                 }
-                const controlFailure = activeTurn?.controlFailure === true;
+                const controlFailure = activeTurn?.controlFailures.has(error) === true;
                 await settleTurnFailure(context, error);
                 if (activeTurn?.presentationError !== undefined) {
                     throw activeTurn.presentationError;
@@ -2909,7 +4374,7 @@ export function createPlaybookCaptainShell(options, deps = {}) {
             }
             finally {
                 if (context.signal.aborted) {
-                    conversation = { kind: 'needsSeeding' };
+                    markConversationUnsynchronized();
                     if (activeTurn && !activeTurn.outcomeRecorded) {
                         activeTurn.settlementFacts.push('The Boss turn was aborted before it settled; no action was repeated automatically.');
                         journalOutcome([...activeTurn.settlementFacts]);
@@ -2926,10 +4391,16 @@ export function createPlaybookCaptainShell(options, deps = {}) {
             }
         },
         async prepareDispose() {
+            if (lifecycle === 'initializing' || lifecycle === 'restoring') {
+                throw new Error('cannot dispose while Captain shell setup is in progress');
+            }
             activeContext = undefined;
             await teardown();
         },
         async dispose() {
+            if (lifecycle === 'initializing' || lifecycle === 'restoring') {
+                throw new Error('cannot dispose while Captain shell setup is in progress');
+            }
             activeContext = undefined;
             await teardown();
         },
@@ -2937,6 +4408,8 @@ export function createPlaybookCaptainShell(options, deps = {}) {
     // CAPTAIN-16: dispose every active frame from leaf to root, then the
     // session Captain last.
     async function teardown() {
+        terminallyDisposed = true;
+        lifecycle = 'disposing';
         let failure;
         try {
             await disposeStack('dispose');
@@ -2955,6 +4428,10 @@ export function createPlaybookCaptainShell(options, deps = {}) {
                 failure ??= error;
             }
         }
+        // Quarantine is session-wide by design. Only terminal teardown may drop
+        // its ownership after every frame host call and the Captain are drained.
+        playerTransactions.clear();
+        lifecycle = 'closed';
         if (failure !== undefined)
             throw failure;
     }