@sublang/playbook 7.0.0 → 8.0.0

package/reference/sdlc/code.playbook/playbook-captain.js

@@ -3,7 +3,8 @@
 import { randomUUID } from 'node:crypto';
 import { isDeepStrictEqual } from 'node:util';
 import PQueue from 'p-queue';
-import { assertPlaybookRuntimeSnapshot, hiddenControlEnvelope, registerPlaybookAbortCleanup, snapshotJsonValue, } from '../../../src/xstate-runtime.js';
+import { isAgentCallSettingsError, } from '@sublang/cligent/tmux-play';
+import { assertPlaybookRuntimeSnapshot, hiddenControlEnvelope, registerPlaybookAbortCleanup, snapshotJsonValue, validatePlayerResult, } from '../../../src/xstate-runtime.js';
 import createDefaultCaptainRuntime from '../captain.playbook/captain.playbook.js';
 class VisibilityControlError extends Error {
     constructor(cause) {
@@ -11,10 +12,33 @@ class VisibilityControlError extends Error {
         this.name = 'VisibilityControlError';
     }
 }
+class AgentSettingsPreflightError extends Error {
+    rejection;
+    constructor(rejection) {
+        super('agent rejected supplied complete call settings', {
+            cause: rejection,
+        });
+        this.rejection = rejection;
+        this.name = 'AgentSettingsPreflightError';
+    }
+}
+async function classifySettingsCall(call) {
+    try {
+        return await call();
+    }
+    catch (error) {
+        if (isAgentCallSettingsError(error)) {
+            throw new AgentSettingsPreflightError(error);
+        }
+        throw error;
+    }
+}
 const SUB_RUNTIME_FSM_TOPIC = 'playbook.fsm.state';
 const SHELL_FSM_TOPIC = 'playbook.captain.fsm.state';
 const INTERNAL_CAPTAIN_ID = 'captain';
 const UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+const PLAYER_ID_PATTERN = /^[a-z][a-z0-9_-]*(?:\.[a-z][a-z0-9_-]*)*$/;
+const ROLE_ID_PATTERN = /^[a-z][a-z0-9_-]*$/;
 function parseRegisteredCommand(prompt) {
     const match = /^\/([A-Za-z][A-Za-z0-9_-]*)(?:\s+([\s\S]*))?$/.exec(prompt.trim());
     if (!match)
@@ -127,7 +151,14 @@ function pendingQuestionLines(pending) {
                 : typeof record.id === 'string'
                     ? record.id
                     : undefined;
-            const player = typeof record.player === 'string' ? record.player : undefined;
+            const asker = typeof record.asker === 'object' && record.asker !== null
+                ? record.asker
+                : undefined;
+            const askerLabel = asker?.kind === 'captain'
+                ? 'Captain'
+                : asker?.kind === 'role' && typeof asker.roleId === 'string'
+                    ? asker.roleId
+                    : undefined;
             const text = typeof record.question === 'string'
                 ? record.question
                 : typeof record.text === 'string'
@@ -137,9 +168,9 @@ function pendingQuestionLines(pending) {
             // fragment is never handed back to the tag as a value: bounding it a
             // second time would cut the line at the seam's limit and drop whatever
             // the shell had already written after the long part.
-            const asked = player === undefined
+            const asked = askerLabel === undefined
                 ? digestLine `${quoteEvidence(text)}`
-                : digestLine `${quoteEvidence(player)} asks: ${quoteEvidence(text)}`;
+                : digestLine `${quoteEvidence(askerLabel)} asks: ${quoteEvidence(text)}`;
             const marker = id === undefined ? '' : digestLine `(${quoteEvidence(id)}) `;
             lines.push(`- ${marker}${asked}`);
         }
@@ -179,14 +210,20 @@ function renderJournalPayload(payload) {
     const raw = typeof payload === 'string' ? payload : JSON.stringify(payload);
     return raw ?? 'null';
 }
-function renderReseedDigest(records) {
+function renderJournalDigest(records, heading) {
     const lines = records.map((record) => `${record.seq}. turn ${record.turnId} ${record.kind}: ${renderJournalPayload(record.payload)}`);
     return [
-        'This conversation was replaced after a host-side continuity failure. The recap below is the deterministic session record kept by the host.',
+        heading,
         'The labeled ControlView and catalog digest blocks outrank conversation memory.',
         ...(lines.length === 0 ? ['(no earlier turns)'] : lines),
     ].join('\n');
 }
+function renderReseedDigest(records) {
+    return renderJournalDigest(records, 'This conversation was replaced after a host-side continuity failure. The recap below is the deterministic session record kept by the host.');
+}
+function renderCatchUpDigest(records) {
+    return renderJournalDigest(records, 'This retained conversation missed the host journal records below. Treat this deterministic journal suffix as authoritative.');
+}
 // DR-028 / CAPTAIN-9: validated captain speech carries no control JSON and no
 // internal control vocabulary.
 const CONTROL_VOCABULARY = [
@@ -299,22 +336,31 @@ function proseRejection(prose, liveSessionIds = [], liveStateIds = [], suppliedI
     return undefined;
 }
 // DR-013 A1: adapters with no provider-enforced tool-restriction surface.
-// Cligent's Codex adapter rejects any `allowedTools` value — including the
-// empty list that expresses tool-free — because the supported Codex SDK
-// cannot enforce one, so requesting it fails every control call before the
-// model is reached. Omitting the option is the only way such an adapter can
-// run a control call at all; its isolation then rests on the authored
-// hidden-judge envelope below rather than on provider enforcement.
-const ADAPTERS_WITHOUT_TOOL_ENFORCEMENT = new Set([
-    'codex',
-]);
+// Cligent's Codex, Kimi, and OpenCode adapters reject any `allowedTools`
+// value — including the empty list that expresses tool-free — because their
+// supported provider surfaces cannot enforce one, so requesting it fails
+// every control call before the model is reached. Omitting the option is the
+// only way such an adapter can run a control call at all; its isolation then
+// rests on the authored hidden-judge envelope below rather than on provider
+// enforcement.
+const CAPTAIN_TOOL_ISOLATION_BY_ADAPTER = {
+    claude: 'provider-enforced',
+    codex: 'prompt-only',
+    gemini: 'provider-enforced',
+    kimi: 'prompt-only',
+    opencode: 'prompt-only',
+};
+function requiresPromptOnlyToolIsolation(captainAdapter) {
+    return (Object.hasOwn(CAPTAIN_TOOL_ISOLATION_BY_ADAPTER, captainAdapter) &&
+        CAPTAIN_TOOL_ISOLATION_BY_ADAPTER[captainAdapter] === 'prompt-only');
+}
 // The tool half of a control call's options. An empty allowlist means "no
 // tools available" and is distinct from omission, which grants the adapter's
 // full native tool surface — so omit only where the empty list would be
 // refused, and keep requesting enforcement whenever the adapter is unknown.
 function controlCallToolOptions(captainAdapter) {
     if (captainAdapter !== undefined &&
-        ADAPTERS_WITHOUT_TOOL_ENFORCEMENT.has(captainAdapter)) {
+        requiresPromptOnlyToolIsolation(captainAdapter)) {
         return {};
     }
     return { allowedTools: [] };
@@ -330,14 +376,6 @@ function forwardedToolOptions(requested, captainAdapter) {
         return controlCallToolOptions(captainAdapter);
     return { allowedTools: requested };
 }
-function readCaptainAdapter(options) {
-    if (typeof options !== 'object' || options === null)
-        return undefined;
-    const adapter = options.captainAdapter;
-    return typeof adapter === 'string' && adapter.length > 0
-        ? adapter
-        : undefined;
-}
 const hiddenJudgeEnvelope = hiddenControlEnvelope;
 // CAPTAIN-20: the result-phase block the shell supplies inside the closing
 // reply call's envelope — the settlement's outcome-report facts verbatim, the
@@ -408,10 +446,28 @@ function isValidRegistryEntry(value) {
     if (typeof value !== 'object' || value === null)
         return false;
     const e = value;
+    if (!Array.isArray(e.requiredRoleIds) ||
+        e.requiredRoleIds.some((role) => typeof role !== 'string' ||
+            !ROLE_ID_PATTERN.test(role) ||
+            role === INTERNAL_CAPTAIN_ID) ||
+        new Set(e.requiredRoleIds).size !== e.requiredRoleIds.length ||
+        !Array.isArray(e.concurrentRoleSets)) {
+        return false;
+    }
+    const roles = new Set(e.requiredRoleIds);
+    const concurrency = e.concurrentRoleSets;
+    if (concurrency.some((set) => !Array.isArray(set) ||
+        set.length < 2 ||
+        set.some((role) => typeof role !== 'string' || !roles.has(role)) ||
+        new Set(set).size !== set.length) ||
+        new Set(concurrency.map((set) => JSON.stringify(set))).size !==
+            concurrency.length) {
+        return false;
+    }
     return (typeof e.id === 'string' &&
         typeof e.command === 'string' &&
         typeof e.intent === 'string' &&
-        Array.isArray(e.requiredRoleIds) &&
+        e.artifactSchema === 2 &&
         typeof e.validateOptions === 'function' &&
         typeof e.createRuntime === 'function');
 }
@@ -468,14 +524,165 @@ function snapshotUuid(value, path) {
     }
     return id;
 }
+function snapshotPermissions(value, path) {
+    if (value === undefined)
+        return undefined;
+    const record = snapshotRecord(value, path);
+    rejectSnapshotKeys(record, ['mode', 'fileWrite', 'shellExecute', 'networkAccess', 'writablePaths'], path);
+    const normalized = {};
+    if (record.mode !== undefined) {
+        if (record.mode !== 'auto' && record.mode !== 'bypass') {
+            throw new TypeError(`${path}.mode must be "auto" or "bypass"`);
+        }
+        normalized.mode = record.mode;
+    }
+    for (const key of [
+        'fileWrite',
+        'shellExecute',
+        'networkAccess',
+    ]) {
+        const level = record[key];
+        if (level === undefined)
+            continue;
+        if (level !== 'allow' && level !== 'ask' && level !== 'deny') {
+            throw new TypeError(`${path}.${key} must be "allow", "ask", or "deny"`);
+        }
+        normalized[key] = level;
+    }
+    if (record.writablePaths !== undefined) {
+        if (!Array.isArray(record.writablePaths) ||
+            record.writablePaths.some((entry) => typeof entry !== 'string' || entry.length === 0)) {
+            throw new TypeError(`${path}.writablePaths must be an array of non-empty strings`);
+        }
+        normalized.writablePaths = [...record.writablePaths];
+    }
+    return normalized;
+}
+function livePermissions(value) {
+    if (value === undefined)
+        return undefined;
+    return {
+        ...(value.mode === undefined ? {} : { mode: value.mode }),
+        ...(value.fileWrite === undefined ? {} : { fileWrite: value.fileWrite }),
+        ...(value.shellExecute === undefined
+            ? {}
+            : { shellExecute: value.shellExecute }),
+        ...(value.networkAccess === undefined
+            ? {}
+            : { networkAccess: value.networkAccess }),
+        ...(value.writablePaths === undefined
+            ? {}
+            : { writablePaths: [...value.writablePaths] }),
+    };
+}
+function snapshotFixedAgent(value, path) {
+    const record = snapshotRecord(value, path);
+    rejectSnapshotKeys(record, ['adapter', 'instruction', 'permissions'], path);
+    const adapter = snapshotString(record.adapter, `${path}.adapter`);
+    const instruction = record.instruction === undefined
+        ? undefined
+        : snapshotString(record.instruction, `${path}.instruction`, true);
+    const permissions = snapshotPermissions(record.permissions, `${path}.permissions`);
+    return {
+        adapter,
+        ...(instruction === undefined ? {} : { instruction }),
+        ...(permissions === undefined ? {} : { permissions }),
+    };
+}
+function snapshotPlayerSessions(value, path) {
+    const sessions = snapshotRecord(value, path);
+    return Object.fromEntries(Object.entries(sessions).map(([playerId, raw]) => {
+        if (!PLAYER_ID_PATTERN.test(playerId) || playerId === INTERNAL_CAPTAIN_ID) {
+            throw new TypeError(`${path} has invalid player id ${JSON.stringify(playerId)}`);
+        }
+        const record = snapshotRecord(raw, `${path}.${playerId}`);
+        rejectSnapshotKeys(record, ['adapter', 'instruction', 'permissions', 'resumeToken'], `${path}.${playerId}`);
+        const fixed = snapshotFixedAgent(Object.fromEntries(Object.entries(record).filter(([key]) => key !== 'resumeToken')), `${path}.${playerId}`);
+        const resumeToken = record.resumeToken === undefined
+            ? undefined
+            : snapshotString(record.resumeToken, `${path}.${playerId}.resumeToken`);
+        return [
+            playerId,
+            { ...fixed, ...(resumeToken === undefined ? {} : { resumeToken }) },
+        ];
+    }));
+}
+function snapshotFrameRoleBindings(value, path) {
+    const bindings = snapshotRecord(value, path);
+    return Object.fromEntries(Object.entries(bindings).map(([roleId, raw]) => {
+        if (!ROLE_ID_PATTERN.test(roleId) || roleId === INTERNAL_CAPTAIN_ID) {
+            throw new TypeError(`${path} has invalid role id ${JSON.stringify(roleId)}`);
+        }
+        const playerId = snapshotString(raw, `${path}.${roleId}`);
+        if (!PLAYER_ID_PATTERN.test(playerId) || playerId === INTERNAL_CAPTAIN_ID) {
+            throw new TypeError(`${path}.${roleId} has invalid player id`);
+        }
+        return [roleId, playerId];
+    }));
+}
+function normalizeHostPlayerResult(value, expectedPlayerId) {
+    const path = 'tmux-play delegated-player result';
+    if (typeof value !== 'object' || value === null || Array.isArray(value)) {
+        throw new TypeError(`${path} must be an object`);
+    }
+    const prototype = Object.getPrototypeOf(value);
+    if (prototype !== Object.prototype && prototype !== null) {
+        throw new TypeError(`${path} must be a plain JSON object`);
+    }
+    const descriptors = Object.getOwnPropertyDescriptors(value);
+    const allowedKeys = new Set([
+        'status',
+        'playerId',
+        'turnId',
+        'resumeToken',
+        'finalText',
+        'error',
+    ]);
+    const normalized = {};
+    for (const key of Reflect.ownKeys(descriptors)) {
+        if (typeof key === 'symbol') {
+            throw new TypeError(`${path} must not contain symbol-keyed properties`);
+        }
+        const descriptor = descriptors[key];
+        if (!allowedKeys.has(key)) {
+            throw new TypeError(`${path} has unknown field ${JSON.stringify(key)}`);
+        }
+        if (!descriptor?.enumerable || !Object.hasOwn(descriptor, 'value')) {
+            throw new TypeError(`${path}.${key} must be an enumerable data property`);
+        }
+        // Cligent deliberately exposes optional result members as own
+        // `undefined` data properties. Omit only those members before taking the
+        // immutable JSON snapshot; every other value still passes the strict
+        // JSON validator below.
+        if (descriptor.value !== undefined)
+            normalized[key] = descriptor.value;
+    }
+    const record = snapshotRecord(snapshotJsonValue(normalized, path), path);
+    rejectSnapshotKeys(record, ['status', 'playerId', 'turnId', 'resumeToken', 'finalText', 'error'], path);
+    if (record.playerId !== expectedPlayerId) {
+        throw new TypeError(`${path}.playerId does not match the requested player`);
+    }
+    snapshotInteger(record.turnId, `${path}.turnId`, 1);
+    return validatePlayerResult({
+        status: record.status,
+        ...(record.resumeToken === undefined
+            ? {}
+            : { resumeToken: record.resumeToken }),
+        ...(record.finalText === undefined
+            ? {}
+            : { finalText: record.finalText }),
+        ...(record.error === undefined ? {} : { error: record.error }),
+    }, path);
+}
 /** Validate, detach, and freeze one untrusted shell snapshot. */
-function assertPlaybookCaptainShellSnapshot(value) {
+export function assertPlaybookCaptainShellSnapshot(value) {
     const detached = snapshotJsonValue(value, 'Captain shell snapshot');
     const snapshot = snapshotRecord(detached, 'Captain shell snapshot');
     const mode = snapshot.mode;
     const commonKeys = [
         'schemaVersion',
         'captain',
+        'playerSessions',
         'issuedSessionIds',
         'sequences',
         'journal',
@@ -490,7 +697,6 @@ function assertPlaybookCaptainShellSnapshot(value) {
         rejectSnapshotKeys(snapshot, [
             ...commonKeys,
             'frames',
-            'rootPlayerResumeTokens',
             'pendingBossQuestions',
             'lastError',
         ], 'Captain shell snapshot');
@@ -498,20 +704,31 @@ function assertPlaybookCaptainShellSnapshot(value) {
     else {
         throw new TypeError('Captain shell snapshot.mode must be "chat" or "engaged.parked"');
     }
-    if (snapshot.schemaVersion !== 1) {
-        throw new TypeError(`Captain shell snapshot.schemaVersion ${String(snapshot.schemaVersion)} is not supported (expected 1)`);
+    if (snapshot.schemaVersion !== 3) {
+        throw new TypeError(`Captain shell snapshot.schemaVersion ${String(snapshot.schemaVersion)} is not supported (expected 3)`);
     }
     const captain = snapshotRecord(snapshot.captain, 'Captain shell snapshot.captain');
-    rejectSnapshotKeys(captain, ['sessionId', 'runtime', 'conversation'], 'Captain shell snapshot.captain');
+    rejectSnapshotKeys(captain, ['sessionId', 'runtime', 'agent', 'conversation'], 'Captain shell snapshot.captain');
     const captainSessionId = snapshotUuid(captain.sessionId, 'Captain shell snapshot.captain.sessionId');
     const captainRuntime = assertPlaybookRuntimeSnapshot(captain.runtime, INTERNAL_CAPTAIN_ID);
+    const captainAgent = snapshotFixedAgent(captain.agent, 'Captain shell snapshot.captain.agent');
     const conversation = snapshotRecord(captain.conversation, 'Captain shell snapshot.captain.conversation');
     let normalizedConversation;
     if (conversation.kind === 'pinned') {
         rejectSnapshotKeys(conversation, ['kind', 'token'], 'Captain shell snapshot.captain.conversation');
         normalizedConversation = {
             kind: 'pinned',
-            token: snapshotString(conversation.token, 'Captain shell snapshot.captain.conversation.token', true),
+            token: snapshotString(conversation.token, 'Captain shell snapshot.captain.conversation.token'),
+        };
+    }
+    else if (conversation.kind === 'needsCatchUp') {
+        rejectSnapshotKeys(conversation, ['kind', 'resume', 'afterJournalSeq'], 'Captain shell snapshot.captain.conversation');
+        normalizedConversation = {
+            kind: 'needsCatchUp',
+            resume: conversation.resume === false
+                ? false
+                : snapshotString(conversation.resume, 'Captain shell snapshot.captain.conversation.resume'),
+            afterJournalSeq: snapshotInteger(conversation.afterJournalSeq, 'Captain shell snapshot.captain.conversation.afterJournalSeq'),
         };
     }
     else if (conversation.kind === 'unopened' ||
@@ -579,6 +796,19 @@ function assertPlaybookCaptainShellSnapshot(value) {
         bossRecords !== turnSequence) {
         throw new TypeError('Captain shell snapshot sequences do not match the complete journal');
     }
+    const emptyHistory = turnSequence === 0 && normalizedJournal.length === 0;
+    if ((normalizedConversation.kind === 'unopened') !== emptyHistory) {
+        throw new TypeError('Captain shell snapshot history is empty exactly when its conversation is unopened');
+    }
+    if (normalizedConversation.kind === 'needsCatchUp' &&
+        normalizedConversation.afterJournalSeq >= journalSequence) {
+        throw new TypeError('Captain shell snapshot catch-up watermark must precede the current journal sequence');
+    }
+    if (normalizedConversation.kind === 'needsCatchUp' &&
+        ((normalizedConversation.resume === false) !==
+            (normalizedConversation.afterJournalSeq === 0))) {
+        throw new TypeError('Captain shell snapshot catch-up resume is fresh exactly at journal watermark zero');
+    }
     let lastAction;
     if (snapshot.lastAction !== undefined) {
         if (typeof snapshot.lastAction !== 'string' ||
@@ -595,13 +825,16 @@ function assertPlaybookCaptainShellSnapshot(value) {
         }
         lastSettlementStatus = snapshot.lastSettlementStatus;
     }
+    const playerSessions = snapshotPlayerSessions(snapshot.playerSessions, 'Captain shell snapshot.playerSessions');
     const common = {
-        schemaVersion: 1,
+        schemaVersion: 3,
         captain: {
             sessionId: captainSessionId,
             runtime: captainRuntime,
+            agent: captainAgent,
             conversation: normalizedConversation,
         },
+        playerSessions,
         issuedSessionIds: issued,
         sequences: { turn: turnSequence, journal: journalSequence },
         journal: normalizedJournal,
@@ -610,6 +843,17 @@ function assertPlaybookCaptainShellSnapshot(value) {
             ? {}
             : { lastSettlementStatus }),
     };
+    if (captainRuntime.state.status !== 'active' ||
+        !captainRuntime.state.quiescent ||
+        !captainRuntime.state.tags.includes('playbook.parked') ||
+        captainRuntime.suspendedCall !== undefined ||
+        Object.keys(captainRuntime.roleResumeTokens).length > 0 ||
+        captainRuntime.pendingBossQuestions.length > 0) {
+        throw new TypeError('Captain shell snapshot Captain runtime must be active, quiescent, playerless, and unsuspended');
+    }
+    if (captainRuntime.sequences.turn !== turnSequence) {
+        throw new TypeError('Captain shell snapshot Captain and shell turn sequences must match');
+    }
     if (mode === 'chat') {
         return snapshotJsonValue({ ...common, mode }, 'Captain shell snapshot');
     }
@@ -626,6 +870,8 @@ function assertPlaybookCaptainShellSnapshot(value) {
             'depth',
             'parentSessionId',
             'parentCallId',
+            'options',
+            'roleBindings',
             'runtime',
         ], `Captain shell snapshot.frames[${index}]`);
         const playbookId = snapshotString(frame.playbookId, `Captain shell snapshot.frames[${index}].playbookId`);
@@ -639,6 +885,8 @@ function assertPlaybookCaptainShellSnapshot(value) {
             ? undefined
             : snapshotString(frame.parentCallId, `Captain shell snapshot.frames[${index}].parentCallId`);
         const runtime = assertPlaybookRuntimeSnapshot(frame.runtime, playbookId, { allowSuspendedCall: true });
+        const options = frame.options;
+        const roleBindings = snapshotFrameRoleBindings(frame.roleBindings, `Captain shell snapshot.frames[${index}].roleBindings`);
         normalizedFrames.push({
             playbookId,
             sessionId,
@@ -646,14 +894,11 @@ function assertPlaybookCaptainShellSnapshot(value) {
             depth,
             ...(parentSessionId === undefined ? {} : { parentSessionId }),
             ...(parentCallId === undefined ? {} : { parentCallId }),
+            options,
+            roleBindings,
             runtime,
         });
     }
-    const rootTokens = snapshotRecord(snapshot.rootPlayerResumeTokens, 'Captain shell snapshot.rootPlayerResumeTokens');
-    const normalizedRootTokens = Object.fromEntries(Object.entries(rootTokens).map(([playerId, token]) => [
-        playerId,
-        snapshotString(token, `Captain shell snapshot.rootPlayerResumeTokens.${playerId}`),
-    ]));
     let normalizedLastError;
     if (snapshot.lastError !== undefined) {
         const error = snapshotRecord(snapshot.lastError, 'Captain shell snapshot.lastError');
@@ -663,11 +908,80 @@ function assertPlaybookCaptainShellSnapshot(value) {
             message: snapshotString(error.message, 'Captain shell snapshot.lastError.message', true),
         };
     }
+    const activePlaybooks = new Set();
+    const activeSessionIds = new Set([captainSessionId]);
+    const issuedIds = new Set(issued);
+    const rootSessionId = normalizedFrames[0].sessionId;
+    for (const [index, frame] of normalizedFrames.entries()) {
+        if (activePlaybooks.has(frame.playbookId)) {
+            throw new TypeError('Captain shell snapshot engagement path must not contain a playbook cycle');
+        }
+        activePlaybooks.add(frame.playbookId);
+        if (activeSessionIds.has(frame.sessionId)) {
+            throw new TypeError('Captain shell snapshot frame session ids must be unique');
+        }
+        activeSessionIds.add(frame.sessionId);
+        if (!issuedIds.has(frame.sessionId)) {
+            throw new TypeError('Captain shell snapshot frame session id was not historically issued');
+        }
+        if (frame.depth !== index ||
+            frame.rootSessionId !== rootSessionId ||
+            frame.runtime.state.status !== 'active' ||
+            !frame.runtime.state.quiescent) {
+            throw new TypeError('Captain shell snapshot frame depth, root, or parked runtime state is inconsistent');
+        }
+        if (index === 0) {
+            if (frame.sessionId !== frame.rootSessionId ||
+                frame.parentSessionId !== undefined ||
+                frame.parentCallId !== undefined) {
+                throw new TypeError('Captain shell snapshot root frame has child-only identity fields');
+            }
+        }
+        else {
+            const parent = normalizedFrames[index - 1];
+            const pending = parent.runtime.suspendedCall;
+            if (frame.parentSessionId !== parent.sessionId ||
+                frame.parentCallId === undefined) {
+                throw new TypeError('Captain shell snapshot child frame does not identify its immediate parent');
+            }
+            if (!pending ||
+                pending.callId !== frame.parentCallId ||
+                pending.playbookId !== frame.playbookId ||
+                pending.childSessionId !== frame.sessionId) {
+                throw new TypeError('Captain shell snapshot parent suspended call does not match its child edge');
+            }
+        }
+        for (const playerId of Object.values(frame.roleBindings)) {
+            if (playerSessions[playerId] === undefined) {
+                throw new TypeError(`Captain shell snapshot frame ${JSON.stringify(frame.playbookId)} binds an absent session player`);
+            }
+        }
+        for (const question of frame.runtime.pendingBossQuestions) {
+            if (question.asker.kind === 'role' &&
+                frame.roleBindings[question.asker.roleId] === undefined) {
+                throw new TypeError(`Captain shell snapshot frame ${JSON.stringify(frame.playbookId)} has a pending question from an unbound role`);
+            }
+        }
+        const projectedTokens = Object.fromEntries(Object.entries(frame.roleBindings).flatMap(([role, playerId]) => {
+            const token = playerSessions[playerId]?.resumeToken;
+            return token === undefined ? [] : [[role, token]];
+        }));
+        if (!isDeepStrictEqual(projectedTokens, frame.runtime.roleResumeTokens)) {
+            throw new TypeError(`Captain shell snapshot frame ${JSON.stringify(frame.playbookId)} player tokens do not match session continuation`);
+        }
+    }
+    const leafRuntime = normalizedFrames.at(-1).runtime;
+    if (leafRuntime.suspendedCall !== undefined ||
+        !leafRuntime.state.tags.includes('playbook.parked')) {
+        throw new TypeError('Captain shell snapshot leaf runtime must be parked without a dangling suspended child call');
+    }
+    if (!isDeepStrictEqual(snapshot.pendingBossQuestions ?? [], leafRuntime.pendingBossQuestions)) {
+        throw new TypeError('Captain shell snapshot pending Boss questions must equal the leaf runtime projection');
+    }
     return snapshotJsonValue({
         ...common,
         mode,
         frames: normalizedFrames,
-        rootPlayerResumeTokens: normalizedRootTokens,
         ...(snapshot.pendingBossQuestions === undefined
             ? {}
             : { pendingBossQuestions: snapshot.pendingBossQuestions }),
@@ -676,27 +990,109 @@ function assertPlaybookCaptainShellSnapshot(value) {
             : { lastError: normalizedLastError }),
     }, 'Captain shell snapshot');
 }
-function readPlaybooksConfig(options) {
-    if (typeof options !== 'object' || options === null)
-        return undefined;
-    const pb = options.playbooks;
-    if (typeof pb !== 'object' || pb === null || Array.isArray(pb)) {
-        return undefined;
+function snapshotTuningSelection(value, path) {
+    const selection = snapshotRecord(value, path);
+    if (selection.kind === 'provider-default') {
+        rejectSnapshotKeys(selection, ['kind'], path);
+        return { kind: 'provider-default' };
     }
-    return pb;
+    if (selection.kind === 'value') {
+        rejectSnapshotKeys(selection, ['kind', 'value'], path);
+        return {
+            kind: 'value',
+            value: snapshotString(selection.value, `${path}.value`),
+        };
+    }
+    throw new TypeError(`${path}.kind must be "value" or "provider-default"`);
+}
+const EFFORT_VALUES = new Set([
+    'on',
+    'minimal',
+    'low',
+    'medium',
+    'high',
+    'xhigh',
+    'max',
+    'ultra',
+    'ultracode',
+    'off',
+]);
+function snapshotEffortSelection(value, path) {
+    const selection = snapshotTuningSelection(value, path);
+    if (selection.kind === 'value' && !EFFORT_VALUES.has(selection.value)) {
+        throw new TypeError(`${path}.value is not a supported effort selection`);
+    }
+    return selection;
+}
+function snapshotSessionAgent(value, path) {
+    const agent = snapshotRecord(value, path);
+    rejectSnapshotKeys(agent, ['adapter', 'model', 'effort', 'instruction', 'permissions'], path);
+    const fixed = snapshotFixedAgent(Object.fromEntries(Object.entries(agent).filter(([key]) => key !== 'model' && key !== 'effort')), path);
+    return {
+        adapter: fixed.adapter,
+        ...(fixed.instruction === undefined
+            ? {}
+            : { instruction: fixed.instruction }),
+        ...(fixed.permissions === undefined
+            ? {}
+            : { permissions: livePermissions(fixed.permissions) }),
+        model: snapshotTuningSelection(agent.model, `${path}.model`),
+        effort: snapshotEffortSelection(agent.effort, `${path}.effort`),
+    };
+}
+function fixedAgent(agent) {
+    return {
+        adapter: agent.adapter,
+        ...(agent.instruction === undefined ? {} : { instruction: agent.instruction }),
+        ...(agent.permissions === undefined ? {} : { permissions: agent.permissions }),
+    };
+}
+function callSettings(agent, tuning = agent) {
+    return {
+        model: tuning.model,
+        effort: tuning.effort,
+        ...(agent.instruction === undefined ? {} : { instruction: agent.instruction }),
+        ...(agent.permissions === undefined ? {} : { permissions: agent.permissions }),
+    };
+}
+function promptIdentity(binding) {
+    return binding.model.kind === 'value'
+        ? binding.model.value
+        : binding.agent.adapter;
 }
-// Resolve the active registry at init from `captain.options.playbooks`
-// (CAPTAIN-16): each enabled playbook is loaded from its explicit `from`
-// module and bound to namespaced `<id>-<role>` host players.
-async function buildEnablements(options, players, loadModule) {
+// Resolve the active registry at init from exact normalized role and session
+// agent projections (CAPTAIN-16). No role, ancestor, or generated-name fallback
+// exists at this boundary.
+async function buildEnablements(options, loadModule) {
     const entries = [];
     const byCommand = new Map();
     const byId = new Map();
     const enablementById = new Map();
-    const config = readPlaybooksConfig(options);
-    if (config === undefined) {
+    const detached = snapshotJsonValue(options, 'captain.options');
+    const top = snapshotRecord(detached, 'captain.options');
+    rejectSnapshotKeys(top, ['playbooks', 'sessionAgents', 'captainAdapter'], 'captain.options');
+    const configValue = top.playbooks;
+    if (typeof configValue !== 'object' ||
+        configValue === null ||
+        Array.isArray(configValue)) {
         throw new Error('captain.options.playbooks is required');
     }
+    const config = configValue;
+    const sessionAgents = snapshotRecord(top.sessionAgents, 'captain.options.sessionAgents');
+    rejectSnapshotKeys(sessionAgents, ['captain', 'players'], 'captain.options.sessionAgents');
+    const captainAgent = snapshotSessionAgent(sessionAgents.captain, 'captain.options.sessionAgents.captain');
+    if (top.captainAdapter !== undefined &&
+        top.captainAdapter !== captainAgent.adapter) {
+        throw new Error('captain.options.captainAdapter must equal sessionAgents.captain.adapter');
+    }
+    const playerAgentRecord = snapshotRecord(sessionAgents.players, 'captain.options.sessionAgents.players');
+    const playerAgents = new Map();
+    for (const [playerId, agent] of Object.entries(playerAgentRecord)) {
+        if (!PLAYER_ID_PATTERN.test(playerId) || playerId === INTERNAL_CAPTAIN_ID) {
+            throw new Error(`captain.options.sessionAgents.players has invalid player id ${JSON.stringify(playerId)}`);
+        }
+        playerAgents.set(playerId, snapshotSessionAgent(agent, `captain.options.sessionAgents.players.${playerId}`));
+    }
     const ids = Object.keys(config);
     if (ids.length === 0) {
         throw new Error('captain.options.playbooks must enable at least one playbook');
@@ -710,6 +1106,7 @@ async function buildEnablements(options, players, loadModule) {
             throw new Error(`captain.options.playbooks.${id} must be an object`);
         }
         const record = block;
+        rejectSnapshotKeys(record, ['from', 'command', 'roles', 'options'], `captain.options.playbooks.${id}`);
         const from = record.from;
         if (typeof from !== 'string' || from.length === 0) {
             throw new Error(`captain.options.playbooks.${id}.from must be a module specifier`);
@@ -740,35 +1137,74 @@ async function buildEnablements(options, players, loadModule) {
         if (byCommand.has(command)) {
             throw new Error(`captain.options.playbooks has a duplicate effective command "${command}"`);
         }
-        const boundPlayers = entry.requiredRoleIds.map((role) => {
-            const host = players.find((p) => p.id === `${entry.id}-${role}`);
-            return {
-                id: role,
-                ...(host?.adapter !== undefined ? { adapter: host.adapter } : {}),
-                ...(host?.model !== undefined ? { model: host.model } : {}),
-            };
-        });
+        const roleRecord = snapshotRecord(record.roles, `captain.options.playbooks.${id}.roles`);
+        const required = new Set(entry.requiredRoleIds);
+        const configuredRoles = Object.keys(roleRecord);
+        const missing = entry.requiredRoleIds.filter((role) => !Object.hasOwn(roleRecord, role));
+        const extra = configuredRoles.filter((role) => !required.has(role));
+        if (missing.length > 0 || extra.length > 0) {
+            throw new Error(`captain.options.playbooks.${id}.roles must exactly cover requiredRoleIds`);
+        }
+        const roleBindings = new Map();
+        for (const role of entry.requiredRoleIds) {
+            const path = `captain.options.playbooks.${id}.roles.${role}`;
+            const rawBinding = snapshotRecord(roleRecord[role], path);
+            rejectSnapshotKeys(rawBinding, ['playerId', 'model', 'effort'], path);
+            const playerId = snapshotString(rawBinding.playerId, `${path}.playerId`);
+            if (!PLAYER_ID_PATTERN.test(playerId) || playerId === INTERNAL_CAPTAIN_ID) {
+                throw new Error(`${path}.playerId is not a canonical player id`);
+            }
+            const agent = playerAgents.get(playerId);
+            if (!agent) {
+                throw new Error(`${path}.playerId names absent session player ${JSON.stringify(playerId)}`);
+            }
+            roleBindings.set(role, {
+                playerId,
+                model: snapshotTuningSelection(rawBinding.model, `${path}.model`),
+                effort: snapshotEffortSelection(rawBinding.effort, `${path}.effort`),
+                agent,
+            });
+        }
+        for (const concurrentRoles of entry.concurrentRoleSets) {
+            const playerIds = concurrentRoles.map((role) => roleBindings.get(role).playerId);
+            if (new Set(playerIds).size !== playerIds.length) {
+                throw new Error(`captain.options.playbooks.${id}.roles aliases concurrent roles ${JSON.stringify(concurrentRoles)}`);
+            }
+        }
+        const validatedOptions = snapshotJsonValue(entry.validateOptions(record.options), `captain.options.playbooks.${id}.options`);
         entries.push(entry);
         byId.set(entry.id, entry);
         byCommand.set(command, entry);
         enablementById.set(entry.id, {
             entry,
             command,
-            optionInput: record.options,
-            boundPlayers,
-            hostPlayerId: (localRole) => `${entry.id}-${localRole}`,
+            options: validatedOptions,
+            roleBindings,
         });
     }
-    return { entries, byCommand, byId, enablementById };
+    const referenced = new Set([...enablementById.values()].flatMap((enablement) => [...enablement.roleBindings.values()].map((binding) => binding.playerId)));
+    const unreferenced = [...playerAgents.keys()].find((id) => !referenced.has(id));
+    if (unreferenced !== undefined) {
+        throw new Error(`captain.options.sessionAgents.players has unreferenced player ${JSON.stringify(unreferenced)}`);
+    }
+    return {
+        entries,
+        byCommand,
+        byId,
+        enablementById,
+        captainAgent,
+        playerAgents,
+    };
 }
 export function createPlaybookCaptainShell(options, deps = {}) {
     const loadModule = deps.loadModule ?? ((specifier) => import(specifier));
     const createSessionId = deps.createSessionId ?? randomUUID;
     const createCaptainRuntime = deps.createCaptainRuntime ?? createDefaultCaptainRuntime;
-    // DR-013 A1: the launcher passes the resolved captain adapter through
-    // `captain.options`; a raw `--config` launch leaves it undefined, which
-    // keeps the enforced empty allowlist and its fail-closed behavior.
-    const captainAdapter = readCaptainAdapter(options);
+    let captainAgent;
+    let captainAdapter;
+    let playerAgents = new Map();
+    const playerLedger = new Map();
+    const playerTransactions = new Map();
     let entries = [];
     let byCommand = new Map();
     let byId = new Map();
@@ -778,7 +1214,6 @@ export function createPlaybookCaptainShell(options, deps = {}) {
     let closedGateAttempted = false;
     let lifecycle = 'fresh';
     let terminallyDisposed = false;
-    let players = [];
     let activeContext;
     const frames = [];
     let mode = 'chat';
@@ -828,15 +1263,19 @@ export function createPlaybookCaptainShell(options, deps = {}) {
     // --- session Captain, durable conversation, and journal (CAPTAIN-16/31/35)
     let captainRuntime;
     let captainSessionId;
-    // CAPTAIN-35: the conversation is exactly one of unopened, pinned, or
-    // owed-a-reseed. There is no fourth state in which a non-first call starts a
-    // bare conversation.
+    // CAPTAIN-35: a preflight settings rejection retains proven continuity but
+    // records the exact journal suffix still owed; other continuity failures
+    // require a fresh, full reseed.
     let conversation = { kind: 'unopened' };
     let shuttingDown = false;
     const journal = [];
     let journalSeq = 0;
     let turnSequence = 0;
     let activeTurn;
+    // `PlayerSessionStore.restore` is authoritative only while the shell is
+    // awaiting the exact owning runtime's restore during a closed-gate shell
+    // restoration. A runtime cannot use the store as a general ledger writer.
+    let restoringPlayerSessionFrame;
     // The durable call the runtime is about to make, taken from the paired
     // `captain.call.started` boundary the engine emits before the port call
     // (CAPTAIN-9): the shell never infers a call's kind from its prose.
@@ -904,7 +1343,9 @@ export function createPlaybookCaptainShell(options, deps = {}) {
         // (CAPTAIN-5/CAPTAIN-6).
         ...(captainRuntime
             ? {
-                durableConversation: conversation.kind === 'pinned',
+                durableConversation: conversation.kind === 'pinned' ||
+                    (conversation.kind === 'needsCatchUp' &&
+                        conversation.resume !== false),
                 sessionJournal: true,
             }
             : {}),
@@ -1060,39 +1501,130 @@ export function createPlaybookCaptainShell(options, deps = {}) {
     };
     let callNestedPlaybook;
     const createPorts = (frame) => ({
-        callPlayer: async (playerId, prompt, signal, options) => {
+        callPlayer: async (roleId, prompt, signal, options) => {
             admitHostBoundary();
-            if (!activeContext) {
+            if (!activeContext || !activeTurn || !frame.playerCallScope) {
                 throw new Error('callPlayer invoked outside a Boss turn');
             }
             const context = activeContext;
+            const admittedTurn = activeTurn;
+            const scope = frame.playerCallScope;
             signal.throwIfAborted();
-            const hostPlayerId = bindingFor(frame, playerId).hostPlayerId;
-            const result = await trackHostCall(frame, context.callPlayer(hostPlayerId, prompt, {
-                resume: options.resume,
-            }));
-            // CaptainContext is turn-scoped and cannot accept a narrower XState
-            // invocation signal. Recheck after the host call so a sibling
-            // cancellation is still reported as aborted and cannot rotate a
-            // stopped branch's player token in the linked runtime.
-            signal.throwIfAborted();
-            // CAPTAIN-20: only a player call that actually produced work is an
-            // interruption the Boss was spared. A call that errored or aborted
-            // saved nothing, so it never feeds the saved-counts gate.
-            const summary = activeTurnSummary;
-            if (summary && summaryIncludes(frame) && result.status === 'ok') {
-                summary.counts.interruptions++;
+            const binding = bindingFor(frame, roleId);
+            const ledger = playerLedger.get(binding.playerId);
+            if (!ledger) {
+                throw new Error(`${frameLabel(frame)} resolved absent session player ${JSON.stringify(binding.playerId)}`);
             }
-            return {
-                status: result.status,
-                ...(result.resumeToken !== undefined
-                    ? { resumeToken: result.resumeToken }
-                    : {}),
-                ...(result.finalText !== undefined
-                    ? { finalText: result.finalText }
-                    : {}),
-                ...(result.error !== undefined ? { error: result.error } : {}),
+            const expectedResume = ledger.resumeToken ?? false;
+            if (options.resume !== expectedResume) {
+                throw new Error(`${frameLabel(frame)} player continuation changed before dispatch`);
+            }
+            if (playerTransactions.has(binding.playerId)) {
+                throw new Error(`session player ${JSON.stringify(binding.playerId)} already has a call in flight`);
+            }
+            const settings = callSettings(binding.agent, binding);
+            const calling = {
+                phase: 'calling',
+                frame,
+                roleId,
+                turnId: admittedTurn.id,
+                signal,
+                scope,
+                abandoned: false,
             };
+            playerTransactions.set(binding.playerId, calling);
+            let result;
+            let hostResolved = false;
+            try {
+                let rawResult;
+                try {
+                    rawResult = await trackHostCall(frame, classifySettingsCall(() => context.callPlayer(binding.playerId, prompt, {
+                        resume: options.resume,
+                        settings,
+                    })));
+                    hostResolved = true;
+                }
+                catch (error) {
+                    if (error instanceof AgentSettingsPreflightError) {
+                        if (playerTransactions.get(binding.playerId) !== calling ||
+                            calling.abandoned ||
+                            signal.aborted ||
+                            activeTurn !== admittedTurn ||
+                            frame.playerCallScope !== scope ||
+                            !frames.includes(frame)) {
+                            if (playerTransactions.get(binding.playerId) === calling) {
+                                playerTransactions.delete(binding.playerId);
+                            }
+                            signal.throwIfAborted();
+                            throw new Error(`${frameLabel(frame)} player settings rejection arrived after its runtime operation ended`);
+                        }
+                        throw rememberSettingsPreflight(error.rejection);
+                    }
+                    throw error;
+                }
+                result = normalizeHostPlayerResult(rawResult, binding.playerId);
+                const transitionRequired = result.resumeToken !== undefined || result.status === 'ok';
+                if (playerTransactions.get(binding.playerId) !== calling ||
+                    calling.abandoned ||
+                    signal.aborted ||
+                    activeTurn !== admittedTurn ||
+                    frame.playerCallScope !== scope ||
+                    !frames.includes(frame)) {
+                    if (playerTransactions.get(binding.playerId) === calling) {
+                        if (transitionRequired) {
+                            playerTransactions.set(binding.playerId, {
+                                phase: 'quarantined',
+                                frame,
+                                roleId,
+                                turnId: admittedTurn.id,
+                                signal,
+                                scope,
+                                reason: 'a transition-worthy result arrived after its runtime operation ended',
+                            });
+                        }
+                        else {
+                            playerTransactions.delete(binding.playerId);
+                        }
+                    }
+                    signal.throwIfAborted();
+                    throw new Error(`${frameLabel(frame)} player result arrived after its runtime operation ended`);
+                }
+                if (transitionRequired) {
+                    playerTransactions.set(binding.playerId, {
+                        phase: 'awaitingCommit',
+                        frame,
+                        roleId,
+                        turnId: admittedTurn.id,
+                        signal,
+                        scope,
+                        status: result.status,
+                        expectedToken: result.resumeToken,
+                    });
+                }
+                else {
+                    playerTransactions.delete(binding.playerId);
+                }
+            }
+            catch (error) {
+                if (playerTransactions.get(binding.playerId) === calling) {
+                    if (hostResolved) {
+                        playerTransactions.set(binding.playerId, {
+                            phase: 'quarantined',
+                            frame,
+                            roleId,
+                            turnId: admittedTurn.id,
+                            signal,
+                            scope,
+                            reason: 'a late player result could not be validated',
+                        });
+                    }
+                    else {
+                        playerTransactions.delete(binding.playerId);
+                    }
+                }
+                throw error;
+            }
+            return result;
         },
         callCaptain: async (prompt, signal, options) => {
             admitHostBoundary();
@@ -1173,12 +1705,14 @@ export function createPlaybookCaptainShell(options, deps = {}) {
         },
     });
     // CAPTAIN-22: before dispatching to a playbook, request tmux-play
-    // visibility for that playbook's generated host players. A pane
+    // visibility for that playbook's explicitly bound session players. A pane
     // reconciliation failure is display-only in tmux-play and does not
     // reject; the legacy path carries no generated set and skips this.
     const requestVisibility = async (frame) => {
-        const ids = [...new Set([...frame.playerBindings.values()].map(({ hostPlayerId }) => hostPlayerId))];
-        if (!ids || ids.length === 0 || !activeContext)
+        const ids = [...new Set([...frame.playerBindings.values()].map(({ playerId }) => playerId))];
+        // A roleless frame does not ask a non-empty host roster to show `[]`:
+        // tmux-play reserves that value for a genuinely empty configured roster.
+        if (ids.length === 0 || !activeContext)
             return;
         try {
             await activeContext.setVisiblePlayers(ids);
@@ -1210,39 +1744,14 @@ export function createPlaybookCaptainShell(options, deps = {}) {
                 : undefined;
         return typeof stack === 'string' ? { ...compact, stack } : compact;
     };
-    const makePlayerBindings = (enablement, parent) => {
-        const entry = enablement.entry;
-        const playerBindings = new Map();
-        for (const role of entry.requiredRoleIds) {
-            let inherited;
-            for (let ancestor = parent?.frame; ancestor && inherited === undefined; ancestor = ancestor.parent?.frame) {
-                inherited = ancestor.playerBindings.get(role);
-            }
-            if (inherited) {
-                playerBindings.set(role, inherited);
-                continue;
-            }
-            const configured = enablement.boundPlayers.find((player) => player.id === role) ?? { id: role };
-            playerBindings.set(role, {
-                hostPlayerId: enablement.hostPlayerId(role),
-                player: configured,
-            });
-        }
-        return playerBindings;
+    const makePlayerBindings = (enablement) => {
+        return new Map(enablement.roleBindings);
     };
     const makeFrame = (enablement, parent) => {
         const entry = enablement.entry;
         const sessionId = allocateSessionId();
-        const playerBindings = makePlayerBindings(enablement, parent);
-        const playerResumeTokens = parent?.frame.playerResumeTokens ?? new Map();
-        const runtime = entry.createRuntime({
-            captainOptions: enablement.optionInput,
-            players: [...playerBindings].map(([role, { player }]) => ({
-                id: role,
-                ...(player.adapter === undefined ? {} : { adapter: player.adapter }),
-                ...(player.model === undefined ? {} : { model: player.model }),
-            })),
-        });
+        const playerBindings = makePlayerBindings(enablement);
+        const runtime = entry.createRuntime(enablement.options);
         return {
             entry,
             enablement,
@@ -1251,22 +1760,14 @@ export function createPlaybookCaptainShell(options, deps = {}) {
             rootSessionId: parent?.frame.rootSessionId ?? sessionId,
             depth: parent ? parent.frame.depth + 1 : 0,
             playerBindings,
-            playerResumeTokens,
             ...(parent ? { parent } : {}),
             inFlightHostCalls: new Set(),
         };
     };
-    const makeRestoredFrame = (enablement, snapshot, rootPlayerResumeTokens, parent) => {
+    const makeRestoredFrame = (enablement, snapshot, parent) => {
         const entry = enablement.entry;
-        const playerBindings = makePlayerBindings(enablement, parent);
-        const runtime = entry.createRuntime({
-            captainOptions: enablement.optionInput,
-            players: [...playerBindings].map(([role, { player }]) => ({
-                id: role,
-                ...(player.adapter === undefined ? {} : { adapter: player.adapter }),
-                ...(player.model === undefined ? {} : { model: player.model }),
-            })),
-        });
+        const playerBindings = makePlayerBindings(enablement);
+        const runtime = entry.createRuntime(enablement.options);
         return {
             entry,
             enablement,
@@ -1275,7 +1776,6 @@ export function createPlaybookCaptainShell(options, deps = {}) {
             rootSessionId: snapshot.rootSessionId,
             depth: snapshot.depth,
             playerBindings,
-            playerResumeTokens: rootPlayerResumeTokens,
             ...(parent ? { parent } : {}),
             state: snapshot.runtime.state,
             inFlightHostCalls: new Set(),
@@ -1284,36 +1784,141 @@ export function createPlaybookCaptainShell(options, deps = {}) {
     const playerSessionStore = (frame) => ({
         select(playerId) {
             const binding = bindingFor(frame, playerId);
-            return frame.playerResumeTokens.get(binding.hostPlayerId) ?? false;
+            return playerLedger.get(binding.playerId)?.resumeToken ?? false;
         },
         update(playerId, resumeToken) {
             const binding = bindingFor(frame, playerId);
-            if (resumeToken === undefined) {
-                frame.playerResumeTokens.delete(binding.hostPlayerId);
+            const ledger = playerLedger.get(binding.playerId);
+            if (!ledger) {
+                throw new Error(`${frameLabel(frame)} resolved absent session player ${JSON.stringify(binding.playerId)}`);
             }
-            else {
-                frame.playerResumeTokens.set(binding.hostPlayerId, resumeToken);
+            const pending = playerTransactions.get(binding.playerId);
+            if (pending?.phase !== 'awaitingCommit' ||
+                pending.frame !== frame ||
+                pending.roleId !== playerId ||
+                pending.scope !== frame.playerCallScope ||
+                pending.expectedToken !== resumeToken) {
+                throw new Error(`${frameLabel(frame)} player update does not acknowledge a validated host result`);
+            }
+            if (pending.signal.aborted || activeTurn?.id !== pending.turnId) {
+                playerTransactions.set(binding.playerId, {
+                    phase: 'quarantined',
+                    frame: pending.frame,
+                    roleId: pending.roleId,
+                    turnId: pending.turnId,
+                    signal: pending.signal,
+                    scope: pending.scope,
+                    reason: 'the runtime aborted before committing a validated result',
+                });
+                throw new Error(`${frameLabel(frame)} rejected a late or aborted player continuation update`);
+            }
+            try {
+                if (resumeToken === undefined)
+                    delete ledger.resumeToken;
+                else
+                    ledger.resumeToken = resumeToken;
+                // CAPTAIN-20: a result counts only after the runtime validated it and
+                // atomically published its authorized continuation transition.
+                const summary = activeTurnSummary;
+                if (pending.status === 'ok' &&
+                    summary &&
+                    summaryIncludes(frame)) {
+                    summary.counts.interruptions++;
+                }
+            }
+            finally {
+                playerTransactions.delete(binding.playerId);
             }
         },
         snapshot() {
             const tokens = {};
             for (const [playerId, binding] of frame.playerBindings) {
-                const token = frame.playerResumeTokens.get(binding.hostPlayerId);
+                const token = playerLedger.get(binding.playerId)?.resumeToken;
                 if (token !== undefined)
                     tokens[playerId] = token;
             }
             return tokens;
         },
         restore(tokens) {
-            for (const binding of frame.playerBindings.values()) {
-                frame.playerResumeTokens.delete(binding.hostPlayerId);
+            if (lifecycle !== 'restoring' ||
+                restoringPlayerSessionFrame !== frame) {
+                throw new Error(`${frameLabel(frame)} player-session restore is only available during shell restoration`);
             }
+            const byPlayer = new Map();
             for (const [playerId, token] of Object.entries(tokens)) {
                 const binding = bindingFor(frame, playerId);
-                frame.playerResumeTokens.set(binding.hostPlayerId, token);
+                const previous = byPlayer.get(binding.playerId);
+                if (previous !== undefined && previous !== token) {
+                    throw new Error(`${frameLabel(frame)} restored conflicting tokens for shared player ${JSON.stringify(binding.playerId)}`);
+                }
+                byPlayer.set(binding.playerId, token);
+            }
+            for (const binding of frame.playerBindings.values()) {
+                if (!byPlayer.has(binding.playerId))
+                    byPlayer.set(binding.playerId, undefined);
+            }
+            for (const [playerId, token] of byPlayer) {
+                const ledger = playerLedger.get(playerId);
+                if (!ledger) {
+                    throw new Error(`${frameLabel(frame)} restored absent session player ${JSON.stringify(playerId)}`);
+                }
+                if (token === undefined)
+                    delete ledger.resumeToken;
+                else
+                    ledger.resumeToken = token;
             }
         },
     });
+    const closePlayerCallScope = (frame, scope) => {
+        if (frame.playerCallScope === scope)
+            frame.playerCallScope = undefined;
+        const missing = [];
+        for (const [playerId, transaction] of playerTransactions) {
+            if (transaction.frame !== frame || transaction.scope !== scope)
+                continue;
+            if (transaction.phase === 'calling') {
+                transaction.abandoned = true;
+            }
+            else {
+                playerTransactions.set(playerId, {
+                    phase: 'quarantined',
+                    frame: transaction.frame,
+                    roleId: transaction.roleId,
+                    turnId: transaction.turnId,
+                    signal: transaction.signal,
+                    scope: transaction.scope,
+                    reason: transaction.phase === 'awaitingCommit'
+                        ? 'the runtime returned without committing a validated result'
+                        : transaction.reason,
+                });
+            }
+            if (!transaction.signal.aborted)
+                missing.push(playerId);
+        }
+        return missing.length === 0
+            ? undefined
+            : new Error(`${frameLabel(frame)} runtime returned without committing validated player result for ${missing.map((id) => JSON.stringify(id)).join(', ')}`);
+    };
+    const runFrameOperation = async (frame, operation) => {
+        if (frame.playerCallScope !== undefined) {
+            throw new Error(`${frameLabel(frame)} runtime operations must not overlap`);
+        }
+        const scope = {};
+        frame.playerCallScope = scope;
+        let outcome;
+        try {
+            outcome = { ok: true, value: await operation() };
+        }
+        catch (error) {
+            outcome = { ok: false, error };
+        }
+        const cleanupError = closePlayerCallScope(frame, scope);
+        if (!outcome.ok)
+            throw outcome.error;
+        if (cleanupError !== undefined)
+            throw cleanupError;
+        return outcome.value;
+    };
     const frameSession = (frame) => ({
         sessionId: frame.sessionId,
         playbookId: frame.entry.id,
@@ -1325,6 +1930,13 @@ export function createPlaybookCaptainShell(options, deps = {}) {
             }
             : {}),
         depth: frame.depth,
+        roleBindings: Object.fromEntries([...frame.playerBindings].map(([roleId, binding]) => [
+            roleId,
+            {
+                playerId: binding.playerId,
+                promptIdentity: promptIdentity(binding),
+            },
+        ])),
         playerSessions: playerSessionStore(frame),
         ports: createPorts(frame),
     });
@@ -1609,7 +2221,7 @@ export function createPlaybookCaptainShell(options, deps = {}) {
         // exception filed against an effect that never ran.
         await requestVisibility(frame);
         await setMode('engaged.driving', 'submit');
-        const result = await runEffect(() => frame.runtime.handleBossInput({ text, signal }));
+        const result = await runFrameOperation(frame, () => runEffect(() => frame.runtime.handleBossInput({ text, signal })));
         frame.state = result.state;
         return result;
     };
@@ -1655,11 +2267,11 @@ export function createPlaybookCaptainShell(options, deps = {}) {
         }
         let result;
         try {
-            result = await runEffect(() => parent.runtime.resumePlaybookCall({
+            result = await runFrameOperation(parent, () => runEffect(() => parent.runtime.resumePlaybookCall({
                 callId: parentLink.callId,
                 result: effectiveResult,
                 signal: context.signal,
-            }));
+            })));
         }
         catch (error) {
             if (disposing || invocationSignal?.aborted)
@@ -2015,7 +2627,9 @@ export function createPlaybookCaptainShell(options, deps = {}) {
             stateDigestLine(view.state, view.stateDescription),
         ].join(': '));
         lines.push(...leafContextLines(view.context));
-        const pending = view.pendingQuestions.map((question) => digestLine `- (${quoteEvidence(question.questionId)}) ${quoteEvidence(question.player)} asks: ${quoteEvidence(question.question)}`);
+        const pending = view.pendingQuestions.map((question) => digestLine `- (${quoteEvidence(question.questionId)}) ${quoteEvidence(question.asker.kind === 'captain'
+            ? 'Captain'
+            : question.asker.roleId)} asks: ${quoteEvidence(question.question)}`);
         lines.push(pending.length === 0
             ? 'Pending Boss questions: none.'
             : ['Pending Boss questions:', ...pending].join('\n'));
@@ -2111,6 +2725,7 @@ export function createPlaybookCaptainShell(options, deps = {}) {
             await trackTurnCall(settlement.context.emitReply(settlement.text));
         }
         catch (error) {
+            conversation = { kind: 'needsSeeding' };
             const normalized = normalizeErrorCompact(error) ?? {
                 name: 'Error',
                 message: String(error),
@@ -2207,8 +2822,8 @@ export function createPlaybookCaptainShell(options, deps = {}) {
      * text, replies, handoffs, playbook ids, facts, labels, and reasons are prose
      * the Captain may need to repeat.
      */
-    const reseedDigest = () => {
-        for (const record of journal) {
+    const conversationDigest = (records, render) => {
+        for (const record of records) {
             if (record.kind === 'action' &&
                 typeof record.payload === 'object' &&
                 record.payload !== null &&
@@ -2218,13 +2833,34 @@ export function createPlaybookCaptainShell(options, deps = {}) {
                     recordSuppliedIdentifier(actionId);
             }
         }
-        return renderReseedDigest(journal);
+        return render(records);
     };
+    const reseedDigest = () => conversationDigest(journal, renderReseedDigest);
+    const catchUpDigest = (afterJournalSeq) => conversationDigest(journal.filter((record) => record.seq > afterJournalSeq), renderCatchUpDigest);
     const markControlFailure = (error) => {
-        if (activeTurn)
-            activeTurn.controlFailure = true;
+        activeTurn?.controlFailures.add(error);
         return error;
     };
+    const markSettingsRejection = (error) => markControlFailure(error);
+    const rememberSettingsPreflight = (error) => {
+        activeTurn?.settingsPreflightFailures.add(error);
+        return markSettingsRejection(error);
+    };
+    const markConversationCatchUp = () => {
+        if (conversation.kind === 'needsSeeding' || conversation.kind === 'needsCatchUp') {
+            return;
+        }
+        conversation = {
+            kind: 'needsCatchUp',
+            resume: conversation.kind === 'pinned' ? conversation.token : false,
+            afterJournalSeq: activeTurn?.captainSyncedJournalSeq ?? 0,
+        };
+    };
+    const markConversationUnsynchronized = () => {
+        if (conversation.kind !== 'needsCatchUp') {
+            conversation = { kind: 'needsSeeding' };
+        }
+    };
     /**
      * CAPTAIN-35: the one wrapper an effect runs through — a runtime driven, an
      * engagement constructed, a stack disposed, an advertised action applied.
@@ -2270,14 +2906,16 @@ export function createPlaybookCaptainShell(options, deps = {}) {
             this.name = 'CaptainProseError';
         }
     }
-    const rawDurableCall = async (context, prompt, resume) => {
+    const rawDurableCall = async (context, prompt, resume, attempt) => {
         const queued = captainQueue.add(async () => {
             context.signal.throwIfAborted();
-            const result = await context.callCaptain(prompt, {
+            attempt.providerBoundaryEntered = true;
+            const result = await classifySettingsCall(() => context.callCaptain(prompt, {
                 visibility: 'hidden',
                 resume,
                 ...controlCallToolOptions(captainAdapter),
-            });
+                settings: callSettings(captainAgent),
+            }));
             context.signal.throwIfAborted();
             return result;
         });
@@ -2289,17 +2927,47 @@ export function createPlaybookCaptainShell(options, deps = {}) {
     // conversation that is owed a reseed carries the digest on its very next
     // call, so the turn after a failed reseed starts seeded rather than blank.
     const durableCall = async (context, compose) => {
-        const resume = conversation.kind === 'pinned' ? conversation.token : false;
+        const startingConversation = conversation;
+        const resume = startingConversation.kind === 'pinned'
+            ? startingConversation.token
+            : startingConversation.kind === 'needsCatchUp'
+                ? startingConversation.resume
+                : false;
         const seedFirstCall = conversation.kind === 'needsSeeding';
+        const catchUpFirstCall = conversation.kind === 'needsCatchUp';
+        const representedJournalSeq = journalSeq;
+        const firstAttempt = { providerBoundaryEntered: false };
         let result;
         let failure;
         try {
-            result = await rawDurableCall(context, compose(seedFirstCall ? { reseedDigest: reseedDigest() } : {}), resume);
+            result = await rawDurableCall(context, compose(seedFirstCall
+                ? { reseedDigest: reseedDigest() }
+                : startingConversation.kind === 'needsCatchUp'
+                    ? {
+                        reseedDigest: catchUpDigest(startingConversation.afterJournalSeq),
+                    }
+                    : {}), resume, firstAttempt);
         }
         catch (error) {
             if (context.signal.aborted) {
-                conversation = { kind: 'needsSeeding' };
-                throw error;
+                if (firstAttempt.providerBoundaryEntered) {
+                    conversation = { kind: 'needsSeeding' };
+                }
+                else {
+                    markConversationUnsynchronized();
+                }
+                throw context.signal.reason ?? error;
+            }
+            if (error instanceof AgentSettingsPreflightError) {
+                if (conversation.kind !== 'needsCatchUp' &&
+                    conversation.kind !== 'needsSeeding') {
+                    conversation = {
+                        kind: 'needsCatchUp',
+                        resume: conversation.kind === 'pinned' ? conversation.token : false,
+                        afterJournalSeq: activeTurn?.captainSyncedJournalSeq ?? 0,
+                    };
+                }
+                throw rememberSettingsPreflight(error.rejection);
             }
             failure = error;
         }
@@ -2309,11 +2977,14 @@ export function createPlaybookCaptainShell(options, deps = {}) {
             result.resumeToken === undefined;
         if (!unsynchronized) {
             conversation = { kind: 'pinned', token: result.resumeToken };
+            if (activeTurn) {
+                activeTurn.captainSyncedJournalSeq = representedJournalSeq;
+            }
             return {
                 ...(result.finalText !== undefined
                     ? { finalText: result.finalText }
                     : {}),
-                correctiveSpent: seedFirstCall,
+                correctiveSpent: seedFirstCall || catchUpFirstCall,
             };
         }
         // Only the model-side conversation is replaced: the stack, player
@@ -2323,13 +2994,17 @@ export function createPlaybookCaptainShell(options, deps = {}) {
         conversation = { kind: 'needsSeeding' };
         const recap = reseedDigest();
         let reissued;
+        const reissueAttempt = { providerBoundaryEntered: false };
         try {
-            reissued = await rawDurableCall(context, compose({ reseedDigest: recap }), false);
+            reissued = await rawDurableCall(context, compose({ reseedDigest: recap }), false, reissueAttempt);
         }
         catch (error) {
             if (context.signal.aborted) {
                 conversation = { kind: 'needsSeeding' };
-                throw error;
+                throw context.signal.reason ?? error;
+            }
+            if (error instanceof AgentSettingsPreflightError) {
+                throw rememberSettingsPreflight(error.rejection);
             }
             throw markControlFailure(new CaptainContinuityError(error));
         }
@@ -2338,6 +3013,8 @@ export function createPlaybookCaptainShell(options, deps = {}) {
                 `callCaptain status "${reissued.status}" without a resume token`));
         }
         conversation = { kind: 'pinned', token: reissued.resumeToken };
+        if (activeTurn)
+            activeTurn.captainSyncedJournalSeq = journalSeq;
         return {
             ...(reissued.finalText !== undefined
                 ? { finalText: reissued.finalText }
@@ -2681,7 +3358,7 @@ export function createPlaybookCaptainShell(options, deps = {}) {
                 message: String(error),
             };
             if (aborted) {
-                conversation = { kind: 'needsSeeding' };
+                markConversationUnsynchronized();
                 if (turn?.outcomePending) {
                     turn.settlementFacts.push(`The ${selection.action} action was aborted before its outcome could be confirmed; it was not repeated automatically.`);
                     journalOutcome(journalOutcomeEvidence(turn.settlementFacts, 'failed', turn.report));
@@ -3011,7 +3688,7 @@ export function createPlaybookCaptainShell(options, deps = {}) {
         // guard against re-execution — a repeated selection returns the recorded
         // receipt rather than acting twice.
         const key = `turn-${turn.id}-apply-${actionId}`;
-        const outcome = await withCounting(leaf, async () => runEffect(() => leaf.runtime.apply({ actionId, key, signal })));
+        const outcome = await withCounting(leaf, async () => runFrameOperation(leaf, () => runEffect(() => leaf.runtime.apply({ actionId, key, signal }))));
         if (outcome.error !== undefined)
             throw outcome.error;
         const receipt = outcome.result;
@@ -3159,7 +3836,12 @@ export function createPlaybookCaptainShell(options, deps = {}) {
         // The durable Captain conversation did not receive the shell-authored
         // fallback. Force its next call through the journal so it cannot interpret
         // the Boss's follow-up without the reply the Boss was given this turn.
-        conversation = { kind: 'needsSeeding' };
+        if (activeTurn?.settingsPreflightFailures.has(error)) {
+            markConversationCatchUp();
+        }
+        else {
+            markConversationUnsynchronized();
+        }
         // A rejected presentation may already have emitted bytes. It is therefore
         // final for this turn even though the Promise did not prove it was shown.
         if (activeTurn?.presentationAttempted === true)
@@ -3182,112 +3864,68 @@ export function createPlaybookCaptainShell(options, deps = {}) {
         playbookId: INTERNAL_CAPTAIN_ID,
         rootSessionId: id,
         depth: 0,
+        roleBindings: {},
         ports: captainPorts(),
     });
-    const tokenRecord = (tokens) => Object.fromEntries(tokens);
+    const playerLedgerRecord = () => Object.fromEntries([...playerLedger].map(([playerId, entry]) => [
+        playerId,
+        {
+            adapter: entry.adapter,
+            ...(entry.instruction === undefined
+                ? {}
+                : { instruction: entry.instruction }),
+            ...(entry.permissions === undefined
+                ? {}
+                : { permissions: entry.permissions }),
+            ...(entry.resumeToken === undefined
+                ? {}
+                : { resumeToken: entry.resumeToken }),
+        },
+    ]));
     const assertSnapshotMatchesEnablements = (snapshot, enabled) => {
-        const captain = snapshot.captain.runtime;
-        if (captain.schemaVersion !== 2 ||
-            captain.state.status !== 'active' ||
-            !captain.state.quiescent ||
-            !captain.state.tags.includes('playbook.parked') ||
-            captain.suspendedCall !== undefined ||
-            Object.keys(captain.playerResumeTokens).length > 0 ||
-            captain.pendingBossQuestions.length > 0) {
-            throw new TypeError('Captain shell snapshot Captain runtime must be active, quiescent, playerless, and unsuspended');
-        }
-        if (captain.sequences.turn !== snapshot.sequences.turn) {
-            throw new TypeError('Captain shell snapshot Captain and shell turn sequences must match');
-        }
-        const emptyHistory = snapshot.sequences.turn === 0 && snapshot.journal.length === 0;
-        if ((snapshot.captain.conversation.kind === 'unopened') !== emptyHistory) {
-            throw new TypeError('Captain shell snapshot unopened conversation must exactly match an empty session history');
+        if (captainAgent === undefined ||
+            !isDeepStrictEqual(snapshot.captain.agent, fixedAgent(captainAgent))) {
+            throw new TypeError('Captain shell snapshot Captain agent is incompatible with current config');
+        }
+        const configuredPlayerIds = [...playerAgents.keys()].sort();
+        const savedPlayerIds = Object.keys(snapshot.playerSessions).sort();
+        if (!isDeepStrictEqual(savedPlayerIds, configuredPlayerIds)) {
+            throw new TypeError('Captain shell snapshot player ledger does not match current referenced players');
+        }
+        for (const playerId of configuredPlayerIds) {
+            const saved = snapshot.playerSessions[playerId];
+            const configured = playerAgents.get(playerId);
+            const savedFixed = {
+                adapter: saved.adapter,
+                ...(saved.instruction === undefined
+                    ? {}
+                    : { instruction: saved.instruction }),
+                ...(saved.permissions === undefined
+                    ? {}
+                    : { permissions: saved.permissions }),
+            };
+            if (!isDeepStrictEqual(savedFixed, fixedAgent(configured))) {
+                throw new TypeError(`Captain shell snapshot player ${JSON.stringify(playerId)} is incompatible with current config`);
+            }
         }
         if (snapshot.mode === 'chat')
             return;
-        const activePlaybooks = new Set();
-        const activeSessionIds = new Set([snapshot.captain.sessionId]);
-        const issuedIds = new Set(snapshot.issuedSessionIds);
-        const allowedHostPlayerIds = new Set();
-        for (const enablement of enabled.values()) {
-            for (const role of enablement.entry.requiredRoleIds) {
-                allowedHostPlayerIds.add(enablement.hostPlayerId(role));
-            }
-        }
-        for (const playerId of Object.keys(snapshot.rootPlayerResumeTokens)) {
-            if (!allowedHostPlayerIds.has(playerId)) {
-                throw new TypeError(`Captain shell snapshot root token names unknown host player ${JSON.stringify(playerId)}`);
-            }
-        }
-        const bindingMaps = [];
-        const rootSessionId = snapshot.frames[0].sessionId;
-        for (const [index, frame] of snapshot.frames.entries()) {
+        for (const frame of snapshot.frames) {
             const enablement = enabled.get(frame.playbookId);
             if (!enablement) {
                 throw new TypeError(`Captain shell snapshot frame names disabled playbook ${JSON.stringify(frame.playbookId)}`);
             }
-            if (activePlaybooks.has(frame.playbookId)) {
-                throw new TypeError('Captain shell snapshot engagement path must not contain a playbook cycle');
-            }
-            activePlaybooks.add(frame.playbookId);
-            if (activeSessionIds.has(frame.sessionId)) {
-                throw new TypeError('Captain shell snapshot frame session ids must be unique');
-            }
-            activeSessionIds.add(frame.sessionId);
-            if (!issuedIds.has(frame.sessionId)) {
-                throw new TypeError('Captain shell snapshot frame session id was not historically issued');
-            }
-            if (frame.depth !== index ||
-                frame.rootSessionId !== rootSessionId ||
-                frame.runtime.state.status !== 'active' ||
-                !frame.runtime.state.quiescent) {
-                throw new TypeError('Captain shell snapshot frame depth, root, or parked runtime state is inconsistent');
-            }
-            if (index === 0) {
-                if (frame.sessionId !== frame.rootSessionId ||
-                    frame.parentSessionId !== undefined ||
-                    frame.parentCallId !== undefined) {
-                    throw new TypeError('Captain shell snapshot root frame has child-only identity fields');
-                }
-            }
-            else {
-                const parent = snapshot.frames[index - 1];
-                if (frame.parentSessionId !== parent.sessionId ||
-                    frame.parentCallId === undefined) {
-                    throw new TypeError('Captain shell snapshot child frame does not identify its immediate parent');
-                }
-                const pending = parent.runtime.suspendedCall;
-                if (!pending ||
-                    pending.callId !== frame.parentCallId ||
-                    pending.playbookId !== frame.playbookId ||
-                    pending.childSessionId !== frame.sessionId) {
-                    throw new TypeError('Captain shell snapshot parent suspended call does not match its child edge');
-                }
-            }
-            const roleBindings = new Map();
-            for (const role of enablement.entry.requiredRoleIds) {
-                let inherited;
-                for (let ancestor = index - 1; ancestor >= 0; ancestor--) {
-                    inherited = bindingMaps[ancestor]?.get(role);
-                    if (inherited !== undefined)
-                        break;
-                }
-                roleBindings.set(role, inherited ?? enablement.hostPlayerId(role));
+            const configuredBindings = Object.fromEntries([...enablement.roleBindings].map(([role, binding]) => [
+                role,
+                binding.playerId,
+            ]));
+            if (!isDeepStrictEqual(frame.options, enablement.options)) {
+                throw new TypeError(`Captain shell snapshot frame ${JSON.stringify(frame.playbookId)} options changed`);
             }
-            bindingMaps.push(roleBindings);
-            const projectedTokens = Object.fromEntries([...roleBindings].flatMap(([role, hostPlayerId]) => {
-                const token = snapshot.rootPlayerResumeTokens[hostPlayerId];
-                return token === undefined ? [] : [[role, token]];
-            }));
-            if (!isDeepStrictEqual(projectedTokens, frame.runtime.playerResumeTokens)) {
-                throw new TypeError(`Captain shell snapshot frame ${JSON.stringify(frame.playbookId)} player tokens do not match root-owned continuation`);
+            if (!isDeepStrictEqual(frame.roleBindings, configuredBindings)) {
+                throw new TypeError(`Captain shell snapshot frame ${JSON.stringify(frame.playbookId)} role bindings changed`);
             }
         }
-        const leafRuntime = snapshot.frames.at(-1).runtime;
-        if (leafRuntime.suspendedCall !== undefined ||
-            !leafRuntime.state.tags.includes('playbook.parked')) {
-            throw new TypeError('Captain shell snapshot leaf runtime must be parked without a dangling suspended child call');
-        }
     };
     const safeCapturePoint = () => {
         if (lifecycle !== 'ready' ||
@@ -3305,6 +3943,7 @@ export function createPlaybookCaptainShell(options, deps = {}) {
             runFailureFacts !== undefined ||
             servingCall !== undefined ||
             decisionCall !== undefined ||
+            playerTransactions.size !== 0 ||
             captainQueue.pending !== 0 ||
             captainQueue.size !== 0 ||
             (mode !== 'chat' && mode !== 'engaged.parked')) {
@@ -3341,7 +3980,10 @@ export function createPlaybookCaptainShell(options, deps = {}) {
         });
     };
     const exportShellSnapshot = () => {
-        if (!safeCapturePoint() || !captainRuntime || !captainSessionId) {
+        if (!safeCapturePoint() ||
+            !captainRuntime ||
+            !captainSessionId ||
+            !captainAgent) {
             return undefined;
         }
         try {
@@ -3374,16 +4016,23 @@ export function createPlaybookCaptainShell(options, deps = {}) {
                             parentCallId: frame.parent.callId,
                         }
                         : {}),
+                    options: frame.enablement.options,
+                    roleBindings: Object.fromEntries([...frame.playerBindings].map(([role, binding]) => [
+                        role,
+                        binding.playerId,
+                    ])),
                     runtime,
                 });
             }
             const common = {
-                schemaVersion: 1,
+                schemaVersion: 3,
                 captain: {
                     sessionId: captainSessionId,
                     runtime: captainSnapshot,
+                    agent: fixedAgent(captainAgent),
                     conversation,
                 },
+                playerSessions: playerLedgerRecord(),
                 issuedSessionIds: [...issuedSessionIds],
                 sequences: { turn: turnSequence, journal: journalSeq },
                 journal,
@@ -3398,7 +4047,6 @@ export function createPlaybookCaptainShell(options, deps = {}) {
                     ...common,
                     mode: 'engaged.parked',
                     frames: frameSnapshots,
-                    rootPlayerResumeTokens: tokenRecord(rootFrame().playerResumeTokens),
                     ...(pendingBossQuestions === undefined
                         ? {}
                         : { pendingBossQuestions: pendingBossQuestions }),
@@ -3420,7 +4068,7 @@ export function createPlaybookCaptainShell(options, deps = {}) {
         const normalized = assertPlaybookRuntimeSnapshot(actual, playbookId, allowSuspendedCall ? { allowSuspendedCall: true } : {});
         for (const key of [
             'state',
-            'playerResumeTokens',
+            'roleResumeTokens',
             'sequences',
             'pendingBossQuestions',
             'suspendedCall',
@@ -3458,7 +4106,11 @@ export function createPlaybookCaptainShell(options, deps = {}) {
         byCommand = new Map();
         byId = new Map();
         enablementById = new Map();
-        players = [];
+        captainAgent = undefined;
+        captainAdapter = undefined;
+        playerAgents = new Map();
+        playerLedger.clear();
+        playerTransactions.clear();
         session = undefined;
         sessionEmissionsOpen = false;
         closedGateAttempted = false;
@@ -3492,17 +4144,30 @@ export function createPlaybookCaptainShell(options, deps = {}) {
         lifecycle = 'restoring';
         try {
             const snapshot = assertPlaybookCaptainShellSnapshot(untrusted);
-            const built = await buildEnablements(options, initSession.players, loadModule);
-            for (const enablement of built.enablementById.values()) {
-                enablement.entry.validateOptions(enablement.optionInput);
-            }
+            const built = await buildEnablements(options, loadModule);
+            captainAgent = built.captainAgent;
+            captainAdapter = captainAgent.adapter;
+            playerAgents = built.playerAgents;
             assertSnapshotMatchesEnablements(snapshot, built.enablementById);
             installSession(initSession, false);
-            players = initSession.players;
             entries = built.entries;
             byCommand = built.byCommand;
             byId = built.byId;
             enablementById = built.enablementById;
+            for (const [playerId, saved] of Object.entries(snapshot.playerSessions)) {
+                playerLedger.set(playerId, {
+                    adapter: saved.adapter,
+                    ...(saved.instruction === undefined
+                        ? {}
+                        : { instruction: saved.instruction }),
+                    ...(saved.permissions === undefined
+                        ? {}
+                        : { permissions: livePermissions(saved.permissions) }),
+                    ...(saved.resumeToken === undefined
+                        ? {}
+                        : { resumeToken: saved.resumeToken }),
+                });
+            }
             captainRuntime = createCaptainRuntime({
                 enabledPlaybooks: enabledCatalog(),
                 controller,
@@ -3511,10 +4176,9 @@ export function createPlaybookCaptainShell(options, deps = {}) {
                 throw new Error('session Captain runtime does not support restore');
             }
             if (snapshot.mode === 'engaged.parked') {
-                const rootTokens = new Map(Object.entries(snapshot.rootPlayerResumeTokens));
                 for (const [index, frameSnapshot] of snapshot.frames.entries()) {
                     const parentFrame = frames.at(-1);
-                    const frame = makeRestoredFrame(enablementById.get(frameSnapshot.playbookId), frameSnapshot, rootTokens, index === 0
+                    const frame = makeRestoredFrame(enablementById.get(frameSnapshot.playbookId), frameSnapshot, index === 0
                         ? undefined
                         : {
                             frame: parentFrame,
@@ -3531,7 +4195,13 @@ export function createPlaybookCaptainShell(options, deps = {}) {
             await captainRuntime.restore(captainPlaybookSession(snapshot.captain.sessionId), snapshot.captain.runtime);
             if (snapshot.mode === 'engaged.parked') {
                 for (const [index, frame] of frames.entries()) {
-                    await frame.runtime.restore(frameSession(frame), snapshot.frames[index].runtime);
+                    restoringPlayerSessionFrame = frame;
+                    try {
+                        await frame.runtime.restore(frameSession(frame), snapshot.frames[index].runtime);
+                    }
+                    finally {
+                        restoringPlayerSessionFrame = undefined;
+                    }
                 }
             }
             if (closedGateAttempted) {
@@ -3542,8 +4212,8 @@ export function createPlaybookCaptainShell(options, deps = {}) {
                 for (const [index, frame] of frames.entries()) {
                     verifyRestoredRuntime(frame.runtime, snapshot.frames[index].runtime, frame.entry.id, true);
                 }
-                if (!isDeepStrictEqual(tokenRecord(rootFrame().playerResumeTokens), snapshot.rootPlayerResumeTokens)) {
-                    throw new Error('restored root-owned player continuation changed during restore');
+                if (!isDeepStrictEqual(playerLedgerRecord(), snapshot.playerSessions)) {
+                    throw new Error('restored Captain-session player continuation changed during restore');
                 }
             }
             if (closedGateAttempted) {
@@ -3589,14 +4259,16 @@ export function createPlaybookCaptainShell(options, deps = {}) {
             lifecycle = 'initializing';
             try {
                 installSession(initSession, true);
-                players = initSession.players;
-                const built = await buildEnablements(options, players, loadModule);
+                const built = await buildEnablements(options, loadModule);
                 entries = built.entries;
                 byCommand = built.byCommand;
                 byId = built.byId;
                 enablementById = built.enablementById;
-                for (const enablement of enablementById.values()) {
-                    enablement.entry.validateOptions(enablement.optionInput);
+                captainAgent = built.captainAgent;
+                captainAdapter = captainAgent.adapter;
+                playerAgents = built.playerAgents;
+                for (const [playerId, agent] of playerAgents) {
+                    playerLedger.set(playerId, fixedAgent(agent));
                 }
                 await setMode('chat', 'init');
                 // CAPTAIN-16: the session Captain exists from `init`, outside the
@@ -3638,6 +4310,7 @@ export function createPlaybookCaptainShell(options, deps = {}) {
             const parsed = resolveCommandTurn(turn.prompt);
             activeTurn = {
                 id: ++turnSequence,
+                captainSyncedJournalSeq: journalSeq,
                 bossText: turn.prompt,
                 authoritativeText: parsed?.authoritativeText ?? turn.prompt,
                 ...(parsed ? { resolution: parsed.resolution } : {}),
@@ -3645,6 +4318,8 @@ export function createPlaybookCaptainShell(options, deps = {}) {
                 presentationAttempted: false,
                 settlementFacts: [],
                 effectThrows: new Set(),
+                controlFailures: new Set(),
+                settingsPreflightFailures: new Set(),
                 suppliedIdentifiers: new Set(),
                 outcomeRecorded: false,
             };
@@ -3663,11 +4338,14 @@ export function createPlaybookCaptainShell(options, deps = {}) {
                         new Error('the session Captain turn failed at its boundary'));
                 }
                 else if (result.outcome === 'aborted') {
-                    conversation = { kind: 'needsSeeding' };
+                    markConversationUnsynchronized();
                     if (activeTurn && !activeTurn.outcomeRecorded) {
                         activeTurn.settlementFacts.push('The Boss turn was aborted before it settled; no action was repeated automatically.');
                         journalOutcome([...activeTurn.settlementFacts]);
                     }
+                    if (context.signal.aborted) {
+                        throw context.signal.reason;
+                    }
                 }
                 else if (result.outcome !== 'suspended' &&
                     !context.signal.aborted &&
@@ -3681,10 +4359,10 @@ export function createPlaybookCaptainShell(options, deps = {}) {
             }
             catch (error) {
                 if (context.signal.aborted) {
-                    conversation = { kind: 'needsSeeding' };
+                    markConversationUnsynchronized();
                     throw error;
                 }
-                const controlFailure = activeTurn?.controlFailure === true;
+                const controlFailure = activeTurn?.controlFailures.has(error) === true;
                 await settleTurnFailure(context, error);
                 if (activeTurn?.presentationError !== undefined) {
                     throw activeTurn.presentationError;
@@ -3696,7 +4374,7 @@ export function createPlaybookCaptainShell(options, deps = {}) {
             }
             finally {
                 if (context.signal.aborted) {
-                    conversation = { kind: 'needsSeeding' };
+                    markConversationUnsynchronized();
                     if (activeTurn && !activeTurn.outcomeRecorded) {
                         activeTurn.settlementFacts.push('The Boss turn was aborted before it settled; no action was repeated automatically.');
                         journalOutcome([...activeTurn.settlementFacts]);
@@ -3750,6 +4428,9 @@ export function createPlaybookCaptainShell(options, deps = {}) {
                 failure ??= error;
             }
         }
+        // Quarantine is session-wide by design. Only terminal teardown may drop
+        // its ownership after every frame host call and the Captain are drained.
+        playerTransactions.clear();
         lifecycle = 'closed';
         if (failure !== undefined)
             throw failure;