@sublang/playbook 7.0.0 → 9.0.0

package/src/xstate-playbook-runtime.js

@@ -78,15 +78,15 @@ function isEmptyOkRetryFailure(error) {
 export const RUNTIME_ABI = 1;
 /** The linked-artifact schema versions this engine accepts (DR-022). */
 export const SUPPORTED_ARTIFACT_SCHEMAS = Object.freeze([
-    1,
+    2,
 ]);
 // PBRT-50: validate a declaration against the loaded engine, schema first,
-// so one clear diagnostic covers a fully skewed artifact. Absent means a
-// legacy artifact emitted before the DR-022 contract; those must keep
-// loading unchanged (DR-019 §4), so there is nothing to check.
+// so one clear diagnostic covers a fully skewed artifact. Declaration-free
+// artifacts are schema 1 and cannot be interpreted as local-role artifacts.
 function assertRuntimeCompat(compat, label) {
-    if (compat === undefined)
-        return;
+    if (compat === undefined) {
+        throw new TypeError(`${label} spec.compat is required for local-role artifacts`);
+    }
     if (compat === null || typeof compat !== 'object') {
         throw new TypeError(`${label} spec.compat must be an object`);
     }
@@ -233,9 +233,37 @@ export function normalizeErrorFull(err) {
         return undefined;
     return normalizeError(err);
 }
+// slc/link.md §Abort: cancellation is causal identity with the applicable
+// signal's reason — never an `AbortError` name, never bare signal state. A
+// distinct failure observed while the signal is aborted stays a non-abort
+// control error and takes precedence (mirrors DECIDE's bespoke reference).
 function isAbortFailure(error, signal) {
-    return (signal.aborted &&
-        (error === signal.reason || normalizeError(error).name === 'AbortError'));
+    return signal.aborted && Object.is(error, signal.reason);
+}
+function abortReasonClassifier(...sources) {
+    const captured = sources.filter((source) => source !== undefined);
+    return Object.freeze({
+        isAbortReason: (error) => captured.some((source) => source instanceof AbortSignal
+            ? isAbortFailure(error, source)
+            : source.isAbortReason(error)),
+    });
+}
+/**
+ * gears2fsm's canonical Boss-reply wait state. On the runtime's Boss-facing
+ * surfaces — state telemetry, status lines, the exported snapshot, and the
+ * control view — a context question counts as *pending* only while the
+ * machine sits in this state awaiting the reply. Later states retain the
+ * answered question in context (the resumed player prompt is composed from
+ * it), so an unconditional projection would resurrect it: a failure the
+ * resumed player reached would export a question nobody is waiting on,
+ * disagreeing with the gated telemetry a mirroring host's ledger follows
+ * and failing the shell's snapshot-equality settlement check.
+ */
+const BOSS_REPLY_WAIT_STATE_ID = 'awaitBossReply';
+function pendingBossQuestionForState(state, context) {
+    if (state.stateId !== BOSS_REPLY_WAIT_STATE_ID)
+        return undefined;
+    return pendingBossQuestionFromContext(context);
 }
 /** Read the FSM context's single pending Boss question, when well-formed. */
 export function pendingBossQuestionFromContext(context) {
@@ -249,15 +277,31 @@ export function pendingBossQuestionFromContext(context) {
     if (typeof candidate.questionId !== 'string' ||
         typeof candidate.resumeStateId !== 'string' ||
         typeof candidate.sourceItem !== 'string' ||
-        typeof candidate.player !== 'string' ||
+        !isPlainObject(candidate.asker) ||
         typeof candidate.question !== 'string') {
         return undefined;
     }
+    let asker;
+    if (candidate.asker.kind === 'captain') {
+        if (Object.keys(candidate.asker).some((key) => key !== 'kind')) {
+            return undefined;
+        }
+        asker = { kind: 'captain' };
+    }
+    else if (candidate.asker.kind === 'role' &&
+        typeof candidate.asker.roleId === 'string' &&
+        candidate.asker.roleId.trim().length > 0 &&
+        Object.keys(candidate.asker).every((key) => key === 'kind' || key === 'roleId')) {
+        asker = { kind: 'role', roleId: candidate.asker.roleId };
+    }
+    else {
+        return undefined;
+    }
     return {
         questionId: candidate.questionId,
         resumeStateId: candidate.resumeStateId,
         sourceItem: candidate.sourceItem,
-        player: candidate.player,
+        asker,
         question: candidate.question,
     };
 }
@@ -339,10 +383,6 @@ export function defaultComposeCaptainPrompt(input, placeholderFields = {}) {
     blocks.push(body);
     return blocks.join('\n\n');
 }
-/** Default player binding: each player to its lowercased name. */
-export function defaultResolvePlayerId(input) {
-    return input.player.toLowerCase();
-}
 /**
  * Default required-field extraction (slc/link.md §Captain adjudication).
  * Limited to the description's `Output shall include` / `输出应包含` clause;
@@ -375,7 +415,7 @@ export function defaultBuildJudgePrompt(input, finalText) {
         'seek external evidence. Decide only from the supplied player output ' +
         'and outcome descriptions. Reply with exactly one JSON object and no prose.');
     lines.push('');
-    lines.push(`The ${input.player} just produced this output:`);
+    lines.push(`The ${input.role} role just produced this output:`);
     lines.push('');
     lines.push('```');
     lines.push(finalText);
@@ -447,11 +487,21 @@ function validateBossReplyOutput(input, output, resumableStateIds) {
 export function createPlayerBridge(spec, ports, getActiveSignal, boundary, onControlPlaneError) {
     return fromPromise(async ({ input, signal }) => {
         const activeSignal = combineAbortSignals(signal, getActiveSignal?.());
-        const playerId = spec.resolvePlayerId(input);
-        const prompt = spec.composePlayerPrompt(input);
+        let roleId;
+        let prompt;
+        try {
+            roleId = spec.resolveRoleId(input);
+            prompt = spec.composePlayerPrompt(input);
+        }
+        catch (error) {
+            if (!isAbortFailure(error, activeSignal)) {
+                onControlPlaneError?.(error);
+            }
+            throw error;
+        }
         const callPlayer = (resume) => boundary
-            ? boundary.callPlayer(input, playerId, prompt, activeSignal)
-            : ports.callPlayer(playerId, prompt, activeSignal, { resume });
+            ? boundary.callPlayer(input, roleId, prompt, activeSignal)
+            : ports.callPlayer(roleId, prompt, activeSignal, { resume });
         let result = await callPlayer(false);
         if (result.status === 'ok' && isEmptyFinalText(result.finalText)) {
             // An abort that lands between the empty first result and the
@@ -486,7 +536,9 @@ export function createPlayerBridge(spec, ports, getActiveSignal, boundary, onCon
             return output;
         }
         catch (error) {
-            onControlPlaneError?.(error);
+            if (!isAbortFailure(error, activeSignal)) {
+                onControlPlaneError?.(error);
+            }
             throw error;
         }
     });
@@ -589,8 +641,8 @@ function collectInvokeSources(machine) {
     visit(machine.config);
     return sources;
 }
-function collectPlayerStatePlayers(machine) {
-    const players = new Map();
+function collectPlayerStateRoles(machine) {
+    const roles = new Map();
     const visit = (stateDef, stateKey) => {
         if (!isPlainObject(stateDef))
             return;
@@ -609,13 +661,13 @@ function collectPlayerStatePlayers(machine) {
             if (stateId.trim().length === 0) {
                 throw new TypeError('player state metadata must use a non-empty state id');
             }
-            const player = isPlainObject(playbookMeta)
-                ? playbookMeta.player
+            const role = isPlainObject(playbookMeta)
+                ? playbookMeta.role
                 : undefined;
-            if (typeof player !== 'string' || player.trim().length === 0) {
-                throw new TypeError(`player state ${stateId} meta.playbook.player must be a non-empty string`);
+            if (typeof role !== 'string' || role.trim().length === 0) {
+                throw new TypeError(`player state ${stateId} meta.playbook.role must be a non-empty string`);
             }
-            players.set(stateId, player);
+            roles.set(stateId, role);
         }
         if (isPlainObject(stateDef.states)) {
             for (const [childKey, child] of Object.entries(stateDef.states)) {
@@ -629,7 +681,7 @@ function collectPlayerStatePlayers(machine) {
             visit(stateDef, stateKey);
         }
     }
-    return players;
+    return roles;
 }
 function transitionTargets(transition) {
     const arms = Array.isArray(transition) ? transition : [transition];
@@ -650,7 +702,7 @@ export function resumableStateIdsFromMachine(machine) {
     if (!isPlainObject(config) || !isPlainObject(config.states)) {
         return new Set();
     }
-    const awaitState = config.states.awaitBossReply;
+    const awaitState = config.states[BOSS_REPLY_WAIT_STATE_ID];
     if (!isPlainObject(awaitState) || !isPlainObject(awaitState.on)) {
         return new Set();
     }
@@ -752,6 +804,28 @@ function deepFreeze(value) {
 // Default transition/status derivation.
 // ---------------------------------------------------------------------------
 const SUPPRESSED_ENTRY_STATES = new Set(['ready', 'done']);
+// Bounded escalation for aborted script process groups: SIGTERM first, then
+// SIGKILL after this grace, so settlement (gated on the shell's own exit)
+// stays bounded even for TERM-immune commands.
+const SCRIPT_ABORT_KILL_GRACE_MS = 2000;
+class ScriptProcessGroupTeardownError extends Error {
+    constructor(pid, message, cause) {
+        super(`script process group ${pid} teardown could not be confirmed: ${message}`, cause === undefined ? undefined : { cause });
+        this.name = 'ScriptProcessGroupTeardownError';
+    }
+}
+function isNoSuchProcess(error) {
+    return (typeof error === 'object' &&
+        error !== null &&
+        'code' in error &&
+        error.code === 'ESRCH');
+}
+function isProcessPermissionDenied(error) {
+    return (typeof error === 'object' &&
+        error !== null &&
+        'code' in error &&
+        error.code === 'EPERM');
+}
 function makeDefaultNormalizeTransitionEvent(transitionEventFields) {
     return (event) => {
         if (event === null || typeof event !== 'object') {
@@ -774,40 +848,48 @@ function makeDefaultNormalizeTransitionEvent(transitionEventFields) {
         return snapshotJsonValue(out, 'FSM event');
     };
 }
-function snapshotPlayerStateStatuses(value, label, machine, stateDescriptions) {
-    if (value === undefined)
-        return new Map();
-    if (!isPlainObject(value)) {
-        throw new TypeError(`${label} playerStates must be an object`);
+function snapshotRoleStateStatuses(value, label, machine, stateDescriptions) {
+    if (value === undefined) {
+        throw new TypeError(`${label} roleStates must be supplied for schema 2`);
     }
-    const declared = collectPlayerStatePlayers(machine);
+    const captured = snapshotJsonValue(value, `${label} roleStates`);
+    if (!isPlainObject(captured)) {
+        throw new TypeError(`${label} roleStates must be an object`);
+    }
+    const declared = collectPlayerStateRoles(machine);
     const statuses = new Map();
-    for (const [stateId, candidate] of Object.entries(value)) {
+    for (const [stateId, candidate] of Object.entries(captured)) {
         if (!declared.has(stateId)) {
-            throw new TypeError(`${label} playerStates.${stateId} does not name a player state`);
+            throw new TypeError(`${label} roleStates.${stateId} does not name a player state`);
+        }
+        if (isPlainObject(candidate)) {
+            const extra = Object.keys(candidate).find((key) => key !== 'role' && key !== 'label');
+            if (extra !== undefined) {
+                throw new TypeError(`${label} roleStates.${stateId}.${extra} is not allowed`);
+            }
         }
         if (!isPlainObject(candidate) ||
-            typeof candidate.player !== 'string' ||
-            candidate.player.trim().length === 0 ||
+            typeof candidate.role !== 'string' ||
+            candidate.role.trim().length === 0 ||
             typeof candidate.label !== 'string' ||
             candidate.label.trim().length === 0) {
-            throw new TypeError(`${label} playerStates.${stateId} must carry non-empty player and label strings`);
+            throw new TypeError(`${label} roleStates.${stateId} must carry non-empty role and label strings`);
         }
         const expectedLabel = stateDescriptions.get(stateId);
         if (candidate.label !== expectedLabel) {
-            throw new TypeError(`${label} playerStates.${stateId}.label must equal its FSM description`);
+            throw new TypeError(`${label} roleStates.${stateId}.label must equal its FSM description`);
         }
-        if (candidate.player !== declared.get(stateId)) {
-            throw new TypeError(`${label} playerStates.${stateId}.player must equal its FSM player`);
+        if (candidate.role !== declared.get(stateId)) {
+            throw new TypeError(`${label} roleStates.${stateId}.role must equal its FSM role`);
         }
         statuses.set(stateId, {
-            player: candidate.player,
+            role: candidate.role,
             label: candidate.label,
         });
     }
     for (const stateId of declared.keys()) {
         if (!statuses.has(stateId)) {
-            throw new TypeError(`${label} playerStates must declare player state ${stateId}`);
+            throw new TypeError(`${label} roleStates must declare player state ${stateId}`);
         }
     }
     return statuses;
@@ -820,34 +902,10 @@ function settlingGuard(event) {
         ? guard
         : undefined;
 }
-function legacyStatusesForState(state, context) {
-    const stateId = state.stateId;
-    if (stateId === undefined || SUPPRESSED_ENTRY_STATES.has(stateId))
-        return [];
-    if (stateId === 'awaitBossReply') {
-        const pending = pendingBossQuestionFromContext(context);
-        return [
-            {
-                message: pending === undefined
-                    ? 'Awaiting Boss reply.'
-                    : `${pending.player} asks: ${pending.question}`,
-            },
-        ];
-    }
-    if (stateId === 'failed') {
-        const lastError = normalizeErrorFull(context.lastError);
-        return [
-            {
-                message: 'Workflow failed; awaiting Boss recovery.',
-                ...(lastError === undefined
-                    ? {}
-                    : { data: snapshotJsonValue({ lastError }, 'failed status data') }),
-            },
-        ];
-    }
-    return [{ message: `Entered ${stateId}.` }];
+function askerLabel(asker) {
+    return asker.kind === 'captain' ? 'Captain' : asker.roleId;
 }
-function makeDefaultStatusesForState(playerStates) {
+function makeDefaultStatusesForState(roleStates) {
     return (state, context, event) => {
         const statuses = [];
         const guard = settlingGuard(event);
@@ -857,17 +915,17 @@ function makeDefaultStatusesForState(playerStates) {
         if (stateId === undefined || SUPPRESSED_ENTRY_STATES.has(stateId)) {
             return statuses;
         }
-        if (stateId === 'awaitBossReply') {
+        if (stateId === BOSS_REPLY_WAIT_STATE_ID) {
             const pending = pendingBossQuestionFromContext(context);
             if (pending === undefined) {
                 return [...statuses, { message: 'Awaiting Boss reply.' }];
             }
             return [
                 ...statuses,
-                { message: `${pending.player} asks: ${pending.question}` },
+                { message: `${askerLabel(pending.asker)} asks: ${pending.question}` },
                 {
                     message: `◆ awaiting Boss reply · ${pending.resumeStateId} · ` +
-                        `${pending.player} · ${pending.sourceItem}`,
+                        `${askerLabel(pending.asker)} · ${pending.sourceItem}`,
                 },
             ];
         }
@@ -885,10 +943,10 @@ function makeDefaultStatusesForState(playerStates) {
                 },
             ];
         }
-        const playerState = playerStates.get(stateId);
-        if (playerState !== undefined) {
+        const roleState = roleStates.get(stateId);
+        if (roleState !== undefined) {
             statuses.push({
-                message: `⤷ ${playerState.player}: ${playerState.label}`,
+                message: `⤷ ${roleState.role}: ${roleState.label}`,
             });
         }
         return statuses;
@@ -1059,7 +1117,14 @@ function makeDefaultClassifyBossText(machine, entryEvent, bossEvents) {
         const state = classifierState(snapshotOrState);
         const stateId = typeof state.value === 'string' ? state.value : undefined;
         const currentState = stateId ?? JSON.stringify(state.value ?? null);
-        const pending = pendingBossQuestionFromContext(state.context);
+        // The classifier shares the reply-wait pendingness of every other
+        // surface: outside the wait, a context question a later state retains
+        // is answered history, so the prompt must not present it as pending —
+        // a judge told a question awaits at the failure state is steered toward
+        // a reply it cannot select or toward no action at all.
+        const pending = stateId === BOSS_REPLY_WAIT_STATE_ID
+            ? pendingBossQuestionFromContext(state.context)
+            : undefined;
         const configuredTypes = configuredEventTypesForState(machine, stateId);
         const applicable = [...contracts.values()].filter((contract) => configuredTypes.has(contract.type) &&
             (contract.type !== 'BOSS_REPLY' || pending !== undefined));
@@ -1071,7 +1136,7 @@ function makeDefaultClassifyBossText(machine, entryEvent, bossEvents) {
             `Current state: ${currentState}`,
         ];
         if (pending !== undefined) {
-            lines.push(`Pending question id: ${pending.questionId}`, `Pending asking player: ${pending.player}`, `Pending Boss question: ${pending.question}`);
+            lines.push(`Pending question id: ${pending.questionId}`, `Pending asker: ${askerLabel(pending.asker)}`, `Pending Boss question: ${pending.question}`);
         }
         lines.push('', 'Allowed JSON objects:', '- { "type": "NO_ACTION" }');
         for (const contract of applicable) {
@@ -1175,6 +1240,60 @@ function machineDeclaresParallelState(machine) {
     };
     return visit(machine.config);
 }
+// PBRT-52: the factory's domain is FLAT single-region machines — every
+// state a direct child of the root, so each snapshot exposes exactly one
+// playbook state id and every state-keyed lookup (deterministic entries,
+// retry, reply-wait pendingness, configured events, descriptions) indexes
+// one unambiguous identity. A compound child would be accepted and then
+// silently misbehave on all of those gates, so it is rejected up front
+// exactly like a parallel region.
+function machineDeclaresNestedState(machine) {
+    const config = machine.config;
+    if (!isPlainObject(config) || !isPlainObject(config.states))
+        return false;
+    return Object.values(config.states).some((stateDef) => isPlainObject(stateDef) &&
+        isPlainObject(stateDef.states) &&
+        Object.keys(stateDef.states).length > 0);
+}
+// PBRT-52: the factory's lookups index states by their root key, and the
+// published playbook identity is `meta.playbook.stateId` — the two must
+// coincide or a machine can advertise a pending question or retry under an
+// identity no lookup resolves. A state with no string stateId is just as
+// dead: every snapshot identity derives from that member, so the first
+// entry would fail the exactly-one-state-id inspection at runtime.
+// gears2fsm keeps identity and key equal by construction; a hand-authored
+// artifact that splits or omits them fails here instead of at a silently
+// dead gate.
+function assertFlatStateIdentity(machine, label) {
+    const config = machine.config;
+    const states = isPlainObject(config) && isPlainObject(config.states)
+        ? config.states
+        : undefined;
+    // A machine with no root states has no playbook identity to expose; its
+    // first snapshot would fail the exactly-one-state-id inspection, so it
+    // fails construction with the defect named instead.
+    if (states === undefined || Object.keys(states).length === 0) {
+        throw new Error(`${label} declares no root states; the shared runtime requires at ` +
+            'least one flat playbook state');
+    }
+    for (const [key, stateDef] of Object.entries(states)) {
+        if (!isPlainObject(stateDef))
+            continue;
+        const meta = isPlainObject(stateDef.meta) ? stateDef.meta : undefined;
+        const playbook = meta !== undefined && isPlainObject(meta.playbook)
+            ? meta.playbook
+            : undefined;
+        const stateId = playbook?.stateId;
+        if (typeof stateId !== 'string') {
+            throw new Error(`${label} state ${key} declares no string meta.playbook.stateId; ` +
+                'the shared runtime derives every playbook state identity from it');
+        }
+        if (stateId !== key) {
+            throw new Error(`${label} state ${key} declares meta.playbook.stateId ${stateId}; ` +
+                'the shared runtime requires the playbook state id to equal the state key');
+        }
+    }
+}
 /**
  * Build a `PlaybookRuntimeFactory` that interprets the given FSM artifact
  * under the slc/link.md contract. The factory provides every actor kind the
@@ -1182,25 +1301,44 @@ function machineDeclaresParallelState(machine) {
  * (literal and dynamic) — and implements the full runtime lifecycle including
  * the optional parked-session snapshot capability (DR-014).
  *
- * Scope: machines that declare no parallel state (each snapshot exposes
- * exactly one playbook state id). Parallel-region FSMs keep their own linked
- * runtimes.
+ * Scope: flat single-region machines — no parallel state, no compound
+ * child states, and every root state's `meta.playbook.stateId` equal to its
+ * state key — so each snapshot exposes exactly one playbook state id.
+ * Parallel-region FSMs keep their own linked runtimes.
  */
 export function createXStatePlaybookRuntime(machine, spec) {
     const label = spec.label ?? 'playbook';
     // DR-022 / PBRT-50: reject an incompatible artifact declaration before any
     // machine interpretation, against this loaded engine's own self-report.
     assertRuntimeCompat(spec.compat, label);
+    const specDescriptors = Object.getOwnPropertyDescriptors(spec);
+    if (Object.prototype.hasOwnProperty.call(specDescriptors, 'playerStates')) {
+        throw new TypeError(`${label} schema-2 artifacts must supply roleStates, not playerStates`);
+    }
+    if (Object.prototype.hasOwnProperty.call(specDescriptors, 'resolvePlayerId')) {
+        throw new TypeError(`${label} schema-2 artifacts must not derive concrete player bindings`);
+    }
     if (machineDeclaresParallelState(machine)) {
         throw new Error(`${label} uses a parallel state; the shared runtime supports only single-region FSMs`);
     }
+    if (machineDeclaresNestedState(machine)) {
+        throw new Error(`${label} declares a compound state; the shared runtime supports only flat single-region FSMs`);
+    }
+    assertFlatStateIdentity(machine, label);
     const declaredActors = collectInvokeSources(machine);
     const resumableStateIds = spec.resumableStateIds ?? resumableStateIdsFromMachine(machine);
     // DR-029: source state descriptions label the control actions the
     // runtime advertises through `describe()`.
     const stateDescriptions = stateDescriptionsFromMachine(machine);
-    const hasCanonicalStatusProfile = spec.playerStates !== undefined;
-    const playerStates = snapshotPlayerStateStatuses(spec.playerStates, label, machine, stateDescriptions);
+    const roleStatesDescriptor = specDescriptors.roleStates;
+    if (roleStatesDescriptor !== undefined &&
+        !Object.prototype.hasOwnProperty.call(roleStatesDescriptor, 'value')) {
+        throw new TypeError(`${label} roleStates must be an own data property`);
+    }
+    const roleStates = snapshotRoleStateStatuses(roleStatesDescriptor?.value, label, machine, stateDescriptions);
+    const declaredRoleIds = Object.freeze([
+        ...new Set([...roleStates.values()].map(({ role }) => role)),
+    ]);
     // PBRT-52: the artifact's own ControlView context projection. Nothing is
     // exported by default, so an FSM context member — including one added
     // after this artifact was linked — is private until named here. The two
@@ -1215,7 +1353,6 @@ export function createXStatePlaybookRuntime(machine, spec) {
             throw new Error(`${label} controlContextFields must not name ${field}: the control view surfaces it first-class`);
         }
     }
-    const resolvePlayerIdSpec = spec.resolvePlayerId;
     const composePlayerPrompt = spec.composePlayerPrompt ??
         ((input) => defaultComposePlayerPrompt(input, spec.placeholderFields));
     const composeCaptainPrompt = spec.composeCaptainPrompt ??
@@ -1241,13 +1378,9 @@ export function createXStatePlaybookRuntime(machine, spec) {
     const normalizeTransitionEvent = spec.normalizeTransitionEvent ??
         makeDefaultNormalizeTransitionEvent(spec.transitionEventFields ?? []);
     const statusesForState = spec.statusesForState ??
-        (hasCanonicalStatusProfile
-            ? makeDefaultStatusesForState(playerStates)
-            : legacyStatusesForState);
+        makeDefaultStatusesForState(roleStates);
     const classificationStatus = spec.classificationStatus ??
-        (hasCanonicalStatusProfile
-            ? (event) => event.type
-            : () => undefined);
+        ((event) => event.type);
     const machineInput = spec.machineInput ?? ((options) => options);
     const scriptCwd = spec.scriptCwd ??
         ((options) => {
@@ -1269,6 +1402,20 @@ export function createXStatePlaybookRuntime(machine, spec) {
         // ports.callPlayer / callCaptain / callJudge see the right cancellation
         // source. undefined between turns; set by the public boundaries.
         let activeSignal;
+        // Immutable cancellation provenance for the active public boundary. A
+        // nested resume widens it to include both invocation and resume signals;
+        // mutable `activeSignal` alone cannot classify a late invocation reason.
+        let activeAborts;
+        // The bridge binds the provenance of a child result immediately before
+        // its promise actor settles. The next root snapshot/error consumes this
+        // one-shot so background settlement emissions retain their owner.
+        let actorSettlementAborts;
+        let actorSettlementErrorAborts;
+        // Exact cancellation observed by an emission owned by the active
+        // boundary. Ordinary runs settle from their signal/state; apply also
+        // needs this phase-local evidence to fold a pre-publication failure into
+        // its accepted receipt.
+        let activeAbortEmission;
         let activeTurnId;
         let controlPlaneError;
         // Previous root-machine state for the inspect-driven telemetry /
@@ -1294,8 +1441,8 @@ export function createXStatePlaybookRuntime(machine, spec) {
         // acceptance records nothing, so a later call with that key may still
         // execute.
         const appliedReceipts = new Map();
-        const playerResumeTokens = new Map();
-        const activePlayerIds = new Set();
+        const privateResumeTokens = new Map();
+        const activePlayerKeys = new Set();
         const playbookCallTurnIds = new Map();
         // Captain and judge work share one serialized lane (slc/link.md
         // §Session lifecycle).
@@ -1306,66 +1453,169 @@ export function createXStatePlaybookRuntime(machine, spec) {
         // Inspection callbacks enqueue a complete ordered batch synchronously;
         // imperative boundaries await their queued work directly.
         let emissionFailure;
-        function selectPlayerResume(playerId) {
+        function bindSession(nextSession) {
+            const bound = snapshotPlaybookSession(nextSession);
+            if (bound.roleBindings === undefined)
+                return bound;
+            const actual = Object.keys(bound.roleBindings).sort();
+            const expected = [...declaredRoleIds].sort();
+            const missing = expected.filter((roleId) => !actual.includes(roleId));
+            const extra = actual.filter((roleId) => !expected.includes(roleId));
+            if (missing.length > 0 || extra.length > 0) {
+                throw new TypeError(`${label} session roleBindings must cover exactly [${expected.join(', ')}]` +
+                    `${missing.length === 0 ? '' : `; missing [${missing.join(', ')}]`}` +
+                    `${extra.length === 0 ? '' : `; extra [${extra.join(', ')}]`}`);
+            }
+            return bound;
+        }
+        function requireRoleId(input) {
+            const roleId = input.role;
+            if (typeof roleId !== 'string' ||
+                roleId.trim().length === 0 ||
+                !declaredRoleIds.includes(roleId)) {
+                throw new TypeError(`${label} player input role must name a declared local role`);
+            }
+            return roleId;
+        }
+        function resolvedPlayerId(roleId) {
+            return session?.roleBindings?.[roleId]?.playerId;
+        }
+        function promptIdentity(roleId) {
+            if (!declaredRoleIds.includes(roleId)) {
+                throw new TypeError(`${label} prompt identity lookup rejected undeclared role ${roleId}`);
+            }
+            return session?.roleBindings?.[roleId]?.promptIdentity ?? roleId;
+        }
+        function composeBoundPlayerPrompt(input) {
+            let active = true;
+            const lookup = (roleId) => {
+                if (!active) {
+                    throw new Error(`${label} prompt identity lookup is no longer active`);
+                }
+                return promptIdentity(roleId);
+            };
+            try {
+                return composePlayerPrompt(input, lookup);
+            }
+            finally {
+                active = false;
+            }
+        }
+        function continuationKey(roleId, playerId) {
+            return playerId ?? roleId;
+        }
+        function roleTokensByContinuationKey(tokens) {
+            const byKey = new Map();
+            for (const [roleId, token] of Object.entries(tokens)) {
+                if (!declaredRoleIds.includes(roleId)) {
+                    throw new TypeError(`runtime role tokens contain unknown role ${roleId}`);
+                }
+                const key = continuationKey(roleId, resolvedPlayerId(roleId));
+                const existing = byKey.get(key);
+                if (existing !== undefined && existing !== token) {
+                    throw new TypeError(`runtime snapshot assigns conflicting tokens to roles bound to player ${key}`);
+                }
+                byKey.set(key, token);
+            }
+            const rolesByKey = new Map();
+            for (const roleId of declaredRoleIds) {
+                const key = continuationKey(roleId, resolvedPlayerId(roleId));
+                rolesByKey.set(key, [...(rolesByKey.get(key) ?? []), roleId]);
+            }
+            for (const [key, roles] of rolesByKey) {
+                if (roles.length < 2)
+                    continue;
+                const present = roles.filter((roleId) => tokens[roleId] !== undefined);
+                if (present.length !== 0 && present.length !== roles.length) {
+                    throw new TypeError(`runtime role tokens must project player ${key} through every aliased role [${roles.join(', ')}]`);
+                }
+            }
+            return byKey;
+        }
+        function selectPlayerResume(roleId, playerId) {
+            const key = continuationKey(roleId, playerId);
             const selected = session?.playerSessions
-                ? session.playerSessions.select(playerId)
-                : playerResumeTokens.get(playerId) ?? false;
+                ? session.playerSessions.select(roleId)
+                : privateResumeTokens.get(key) ?? false;
             if (selected !== false &&
                 (typeof selected !== 'string' || selected.trim().length === 0)) {
-                throw new TypeError(`player session store returned an invalid resume token for ${playerId}`);
+                throw new TypeError(`player session store returned an invalid resume token for role ${roleId}`);
             }
             return selected;
         }
-        function updatePlayerResume(playerId, resumeToken) {
+        function updatePlayerResume(roleId, playerId, result) {
+            const resumeToken = result.resumeToken;
+            if (resumeToken === undefined && result.status !== 'ok')
+                return;
+            const key = continuationKey(roleId, playerId);
             if (session?.playerSessions) {
-                session.playerSessions.update(playerId, resumeToken);
+                session.playerSessions.update(roleId, resumeToken);
             }
-            else if (resumeToken !== undefined && resumeToken.trim().length > 0) {
-                playerResumeTokens.set(playerId, resumeToken);
+            else if (resumeToken !== undefined) {
+                privateResumeTokens.set(key, resumeToken);
             }
             else {
-                playerResumeTokens.delete(playerId);
+                privateResumeTokens.delete(key);
             }
         }
-        function snapshotPlayerResumeTokens() {
-            const raw = session?.playerSessions
+        function snapshotRoleResumeTokens() {
+            const raw = snapshotJsonValue(session?.playerSessions
                 ? session.playerSessions.snapshot()
-                : Object.fromEntries(playerResumeTokens);
+                : Object.fromEntries(declaredRoleIds.flatMap((roleId) => {
+                    const token = privateResumeTokens.get(continuationKey(roleId, resolvedPlayerId(roleId)));
+                    return token === undefined ? [] : [[roleId, token]];
+                })), 'player session store snapshot');
             if (!isPlainObject(raw)) {
                 throw new TypeError('player session store snapshot must be an object');
             }
             const detached = {};
-            for (const [playerId, token] of Object.entries(raw)) {
-                if (playerId.trim().length === 0) {
-                    throw new TypeError('player session store snapshot player ids must be non-empty');
+            for (const [roleId, token] of Object.entries(raw)) {
+                if (!declaredRoleIds.includes(roleId)) {
+                    throw new TypeError(`player session store snapshot contains unknown role ${roleId}`);
                 }
                 if (typeof token !== 'string' || token.trim().length === 0) {
-                    throw new TypeError(`player session store snapshot token for ${playerId} must be a non-empty string`);
+                    throw new TypeError(`player session store snapshot token for ${roleId} must be a non-empty string`);
                 }
-                detached[playerId] = token;
+                detached[roleId] = token;
             }
+            roleTokensByContinuationKey(detached);
             return detached;
         }
-        function restorePlayerResumeTokens(tokens) {
+        function restoreRoleResumeTokens(tokens) {
+            const byKey = roleTokensByContinuationKey(tokens);
             if (session?.playerSessions) {
                 session.playerSessions.restore(tokens);
                 return;
             }
-            playerResumeTokens.clear();
-            for (const [playerId, token] of Object.entries(tokens)) {
-                playerResumeTokens.set(playerId, token);
-            }
-        }
-        function enqueueEmission(fn) {
+            privateResumeTokens.clear();
+            for (const [key, token] of byKey)
+                privateResumeTokens.set(key, token);
+        }
+        function enqueueEmission(fn, aborts = activeAborts) {
+            // The emission belongs to the boundary enqueueing it: a rejection
+            // causally identical to that boundary's abort reason is the
+            // cancellation's own evidence — never latched, so it cannot poison a
+            // later unrelated boundary (DR-036).
+            const enqueueAborts = aborts;
             const queued = emissionQueue.add(fn).then(() => undefined);
             activeEmissionCalls.add(queued);
             void queued.then(() => activeEmissionCalls.delete(queued), (error) => {
                 activeEmissionCalls.delete(queued);
-                emissionFailure ??= error;
+                if (enqueueAborts?.isAbortReason(error)) {
+                    // Record evidence only when it also belongs to the public
+                    // boundary that is still active. A background A cancellation
+                    // racing an unrelated B boundary is forgiven under A and must
+                    // not change B's settlement.
+                    if (activeAborts?.isAbortReason(error)) {
+                        activeAbortEmission ??= error;
+                    }
+                    return;
+                }
+                emissionFailure ??= { error };
             });
             return queued;
         }
-        async function drainEmissions() {
+        async function drainEmissions(_aborts = activeAborts) {
             while (true) {
                 const active = [...activeEmissionCalls];
                 if (active.length > 0)
@@ -1378,8 +1628,14 @@ export function createXStatePlaybookRuntime(machine, spec) {
                 }
             }
             if (emissionFailure !== undefined) {
-                const error = emissionFailure;
+                const { error } = emissionFailure;
                 emissionFailure = undefined;
+                // The failure was classified as distinct by its enqueue owner. If a
+                // later public boundary drains it, retain that classification in the
+                // boundary latch before throwing; its signal must not reinterpret
+                // the same object as cancellation (DR-036 decision 2).
+                if (activeSignal !== undefined)
+                    controlPlaneError ??= error;
                 throw error;
             }
         }
@@ -1399,7 +1655,7 @@ export function createXStatePlaybookRuntime(machine, spec) {
             const currentSession = requireSession();
             const safePayload = snapshotJsonValue(payload, `trace ${type} payload`);
             return {
-                schemaVersion: 2,
+                schemaVersion: 3,
                 sessionId: currentSession.sessionId,
                 playbookId: currentSession.playbookId,
                 rootSessionId: currentSession.rootSessionId,
@@ -1418,13 +1674,13 @@ export function createXStatePlaybookRuntime(machine, spec) {
                 payload: safePayload,
             };
         }
-        function emitTrace(type, payload, position = {}) {
+        function emitTrace(type, payload, position = {}, aborts) {
             const currentSession = requireSession();
             const event = createTraceEvent(type, payload, position);
             return enqueueEmission(() => currentSession.ports.emitTelemetry({
                 topic: 'playbook.trace',
                 payload: event,
-            }));
+            }), aborts);
         }
         function stateIdentity(stateId) {
             return stateId === undefined ? {} : { stateId };
@@ -1482,6 +1738,11 @@ export function createXStatePlaybookRuntime(machine, spec) {
             };
         }
         async function emitCallStarted(startedType, finishedType, identity, position, 
+        // The applicable combined signal: a start-sink rejection causally
+        // identical to its reason is the cancellation itself, not a control
+        // error — the pair finishes `aborted` and nothing latches
+        // (slc/link.md §Abort).
+        signal, 
         // Base payload of the best-effort finish emitted when the start sink
         // rejects; it defaults to the payload the start carried, which the
         // player, judge, and captain pairs take as-is. The apply pair cannot:
@@ -1493,11 +1754,12 @@ export function createXStatePlaybookRuntime(machine, spec) {
                 await emitTrace(startedType, identity, position);
             }
             catch (error) {
-                controlPlaneError ??= error;
+                if (!isAbortFailure(error, signal))
+                    controlPlaneError ??= error;
                 try {
                     await emitTrace(finishedType, {
                         ...finishIdentity,
-                        status: 'error',
+                        status: isAbortFailure(error, signal) ? 'aborted' : 'error',
                         error: normalizeError(error),
                     }, position);
                 }
@@ -1508,42 +1770,44 @@ export function createXStatePlaybookRuntime(machine, spec) {
             }
         }
         const boundary = {
-            async callPlayer(input, playerId, prompt, signal) {
+            async callPlayer(input, roleId, prompt, signal) {
                 // State-entry telemetry/status must precede the call they describe.
                 await drainEmissions();
                 const turnId = activeTurnId;
                 const stateId = input.stateId;
+                const playerId = resolvedPlayerId(roleId);
                 let resume;
                 try {
                     signal.throwIfAborted();
-                    resume = selectPlayerResume(playerId);
+                    resume = selectPlayerResume(roleId, playerId);
                 }
                 catch (error) {
-                    if (!signal.aborted)
+                    if (!isAbortFailure(error, signal))
                         controlPlaneError ??= error;
                     throw error;
                 }
                 const callId = `player-${++playerCallSequence}`;
                 const identity = {
-                    purpose: 'captain',
                     ...stateIdentity(stateId),
                     sourceItem: input.sourceItem,
-                    playerId,
+                    roleId,
+                    ...(playerId === undefined ? {} : { playerId }),
                     resume,
                 };
                 const position = {
                     ...(turnId !== undefined ? { turnId } : {}),
                     callId,
                 };
-                if (activePlayerIds.has(playerId)) {
-                    const error = new Error(`simultaneous calls to resolved player ${playerId} are not allowed`);
-                    await emitCallStarted('player.call.started', 'player.call.finished', { ...identity, prompt }, position);
+                const playerKey = continuationKey(roleId, playerId);
+                if (activePlayerKeys.has(playerKey)) {
+                    const error = new Error(`simultaneous calls to player key ${playerKey} are not allowed`);
+                    await emitCallStarted('player.call.started', 'player.call.finished', { ...identity, prompt }, position, signal);
                     await emitTrace('player.call.finished', { ...identity, status: 'error', error: normalizeError(error) }, position);
                     throw error;
                 }
-                activePlayerIds.add(playerId);
+                activePlayerKeys.add(playerKey);
                 try {
-                    await emitTrace('player.call.started', { ...identity, prompt }, position);
+                    await emitCallStarted('player.call.started', 'player.call.finished', { ...identity, prompt }, position, signal);
                     let rawResult;
                     try {
                         // An abort may land while the awaited started emission drains
@@ -1551,18 +1815,18 @@ export function createXStatePlaybookRuntime(machine, spec) {
                         // never start after abort, so settle the already-started pair
                         // as `aborted` through the catch below.
                         signal.throwIfAborted();
-                        rawResult = await requireHostPorts().callPlayer(playerId, prompt, signal, { resume });
+                        rawResult = await requireHostPorts().callPlayer(roleId, prompt, signal, { resume });
                         // A host promise is not required to honor cancellation. Do not let
                         // a late result mutate continuity or publish a successful finish.
                         signal.throwIfAborted();
                     }
                     catch (error) {
-                        if (!signal.aborted)
+                        if (!isAbortFailure(error, signal))
                             controlPlaneError ??= error;
                         try {
                             await emitTrace('player.call.finished', {
                                 ...identity,
-                                status: signal.aborted ? 'aborted' : 'error',
+                                status: isAbortFailure(error, signal) ? 'aborted' : 'error',
                                 error: normalizeError(error),
                             }, position);
                         }
@@ -1578,7 +1842,7 @@ export function createXStatePlaybookRuntime(machine, spec) {
                         result = validatePlayerResult(rawResult);
                     }
                     catch (error) {
-                        if (!signal.aborted)
+                        if (!isAbortFailure(error, signal))
                             controlPlaneError ??= error;
                         try {
                             await emitTrace('player.call.finished', { ...identity, status: 'error', error: normalizeError(error) }, position);
@@ -1589,13 +1853,10 @@ export function createXStatePlaybookRuntime(machine, spec) {
                         throw error;
                     }
                     try {
-                        updatePlayerResume(playerId, typeof result.resumeToken === 'string' &&
-                            result.resumeToken.trim().length > 0
-                            ? result.resumeToken
-                            : undefined);
+                        updatePlayerResume(roleId, playerId, result);
                     }
                     catch (error) {
-                        if (!signal.aborted)
+                        if (!isAbortFailure(error, signal))
                             controlPlaneError ??= error;
                         try {
                             await emitTrace('player.call.finished', { ...identity, status: 'error', error: normalizeError(error) }, position);
@@ -1621,7 +1882,7 @@ export function createXStatePlaybookRuntime(machine, spec) {
                     return result;
                 }
                 finally {
-                    activePlayerIds.delete(playerId);
+                    activePlayerKeys.delete(playerKey);
                 }
             },
             async callJudge(purpose, stateId, prompt, signal) {
@@ -1638,7 +1899,7 @@ export function createXStatePlaybookRuntime(machine, spec) {
                         ...(turnId !== undefined ? { turnId } : {}),
                         callId,
                     };
-                    await emitCallStarted('judge.call.started', 'judge.call.finished', { ...identity, prompt }, position);
+                    await emitCallStarted('judge.call.started', 'judge.call.finished', { ...identity, prompt }, position, signal);
                     let reply;
                     try {
                         // An abort may land while the awaited started emission drains
@@ -1655,7 +1916,7 @@ export function createXStatePlaybookRuntime(machine, spec) {
                         }
                         await emitTrace('judge.call.finished', {
                             ...identity,
-                            status: signal.aborted ? 'aborted' : 'error',
+                            status: isAbortFailure(error, signal) ? 'aborted' : 'error',
                             error: normalizeError(error),
                         }, position);
                         throw error;
@@ -1702,7 +1963,7 @@ export function createXStatePlaybookRuntime(machine, spec) {
                         ...(turnId !== undefined ? { turnId } : {}),
                         callId,
                     };
-                    await emitCallStarted('captain.call.started', 'captain.call.finished', { ...identity, prompt }, position);
+                    await emitCallStarted('captain.call.started', 'captain.call.finished', { ...identity, prompt }, position, signal);
                     let rawResult;
                     try {
                         // An abort may land while the awaited started emission drains
@@ -1724,7 +1985,7 @@ export function createXStatePlaybookRuntime(machine, spec) {
                             controlPlaneError ??= error;
                         await emitTrace('captain.call.finished', {
                             ...identity,
-                            status: signal.aborted ? 'aborted' : 'error',
+                            status: isAbortFailure(error, signal) ? 'aborted' : 'error',
                             error: normalizeError(error),
                         }, position);
                         throw error;
@@ -1786,20 +2047,16 @@ export function createXStatePlaybookRuntime(machine, spec) {
                 });
             },
         };
-        function resolvePlayerId(input) {
-            return resolvePlayerIdSpec
-                ? resolvePlayerIdSpec(input, boundOptions)
-                : defaultResolvePlayerId(input);
-        }
         function playerActor(ports) {
             return createPlayerBridge({
-                resolvePlayerId,
-                composePlayerPrompt,
+                resolveRoleId: requireRoleId,
+                composePlayerPrompt: composeBoundPlayerPrompt,
                 adjudication,
                 resumableStateIds,
             }, ports, () => activeSignal, boundary, (error) => {
-                if (!activeSignal?.aborted)
+                if (activeSignal === undefined || !isAbortFailure(error, activeSignal)) {
                     controlPlaneError ??= error;
+                }
             });
         }
         // Direct-Captain actor (slc/link.md §Captain prompt composition,
@@ -1866,7 +2123,7 @@ export function createXStatePlaybookRuntime(machine, spec) {
                     // failure state (PBRT-47); everything else here — a drained
                     // emission failure, prompt composition, the port itself,
                     // adjudication — is control plane.
-                    if (!active.aborted && !isFsmResultFailure(error)) {
+                    if (!isAbortFailure(error, active) && !isFsmResultFailure(error)) {
                         controlPlaneError ??= error;
                     }
                     throw error;
@@ -1887,56 +2144,177 @@ export function createXStatePlaybookRuntime(machine, spec) {
                 const failedGuard = guards[1] ?? guards[0];
                 const cwd = boundScriptCwd ?? process.cwd();
                 const ports = runtimePorts ?? requireHostPorts();
-                const exitStatus = await new Promise((resolve, reject) => {
-                    let child;
-                    try {
-                        child = spawn('sh', ['-c', input.command], {
-                            cwd,
-                            stdio: 'ignore',
-                        });
+                // slc/link.md §Script execution: an already-aborted turn spawns
+                // nothing, and the thrown signal reason keeps the rejection
+                // causally classified as the abort it is.
+                active.throwIfAborted();
+                // Abort ownership — the listener that terminates the group and
+                // the escalation timer — spans the whole invocation body, not
+                // just the spawn-to-close window: an abort landing during the
+                // post-exit emission tail must still kill surviving group
+                // members before the actor settles (slc/link.md §Script
+                // execution). One finally releases both.
+                let child;
+                let killTimer;
+                const signalGroup = (sig) => {
+                    if (child?.pid !== undefined) {
+                        try {
+                            process.kill(-child.pid, sig);
+                        }
+                        catch {
+                            // Confirmation belongs to the bounded liveness probe below:
+                            // a failed signal can mean ESRCH, EPERM, or another fault.
+                        }
                     }
-                    catch (error) {
-                        reject(error);
+                };
+                // After a SIGKILL is posted, settlement waits for the group to
+                // stop being signalable — bounded by the same grace so an
+                // unreapable member outside the runtime's control cannot stall
+                // the turn forever. Observed teardown is milliseconds.
+                let groupGonePromise;
+                const awaitGroupGone = () => {
+                    const pid = child?.pid;
+                    if (pid === undefined)
+                        return Promise.resolve();
+                    groupGonePromise ??= (async () => {
+                        const teardownFailure = (message, cause) => {
+                            const failure = new ScriptProcessGroupTeardownError(pid, message, cause);
+                            // A teardown failure is not an authored script result.
+                            // Surface it at the active public boundary even though
+                            // XState also routes the rejected actor through onError.
+                            controlPlaneError ??= failure;
+                            return failure;
+                        };
+                        const deadline = Date.now() + SCRIPT_ABORT_KILL_GRACE_MS;
+                        let lastProbeError;
+                        for (;;) {
+                            try {
+                                process.kill(-pid, 0);
+                            }
+                            catch (error) {
+                                if (isNoSuchProcess(error))
+                                    return;
+                                // EPERM confirms that at least one process in the group
+                                // still exists but is not signalable by this process. Keep
+                                // waiting for ESRCH within the bound; every other probe
+                                // error makes confirmation itself unreliable immediately.
+                                if (!isProcessPermissionDenied(error)) {
+                                    throw teardownFailure('the liveness probe failed', error);
+                                }
+                                lastProbeError = error;
+                            }
+                            if (Date.now() >= deadline) {
+                                throw teardownFailure(`the group remained signalable after ${SCRIPT_ABORT_KILL_GRACE_MS}ms`, lastProbeError);
+                            }
+                            await new Promise((tick) => setTimeout(tick, 5));
+                        }
+                    })();
+                    return groupGonePromise;
+                };
+                const onAbort = () => {
+                    signalGroup('SIGTERM');
+                    killTimer = setTimeout(() => signalGroup('SIGKILL'), SCRIPT_ABORT_KILL_GRACE_MS);
+                };
+                // An abort observed once the shell has already exited rejects
+                // with the signal's reason before guard resolution and before
+                // starting any further script emission — after killing whatever
+                // group members outlived the shell. The shell's own exit ended
+                // the TERM grace's purpose, so escalation is immediate here.
+                const settleIfAborted = async () => {
+                    if (!active.aborted)
                         return;
+                    signalGroup('SIGKILL');
+                    await awaitGroupGone();
+                    active.throwIfAborted();
+                };
+                let invocationFailed = false;
+                try {
+                    const exitStatus = await new Promise((resolve, reject) => {
+                        try {
+                            // detached: the shell leads its own POSIX process group,
+                            // so an abort can terminate the command's whole group — a
+                            // lone SIGTERM to the wrapper never reaches backgrounded
+                            // members.
+                            child = spawn('sh', ['-c', input.command], {
+                                cwd,
+                                stdio: 'ignore',
+                                detached: true,
+                            });
+                        }
+                        catch (error) {
+                            reject(error);
+                            return;
+                        }
+                        // On abort, terminate the group and escalate — but settle
+                        // only from 'close', after the shell itself has exited, so
+                        // the turn never reports quiescence while the script still
+                        // runs (slc/link.md §Abort). SIGKILL is untrappable, so
+                        // 'close' is bounded by the grace.
+                        active.addEventListener('abort', onAbort, { once: true });
+                        child.on('error', (error) => {
+                            reject(error);
+                        });
+                        child.on('close', (code) => {
+                            if (active.aborted) {
+                                // The shell may exit cooperatively on the group SIGTERM
+                                // while a TERM-immune same-group descendant survives;
+                                // the group stays addressable while any member lives,
+                                // so kill it and await its disappearance before
+                                // settling (slc/link.md §Script execution).
+                                signalGroup('SIGKILL');
+                                void awaitGroupGone().then(() => reject(active.reason), reject);
+                                return;
+                            }
+                            resolve(typeof code === 'number' ? code : 1);
+                        });
+                    });
+                    await settleIfAborted();
+                    await ports.emitStatus(`Executed script for ${input.stateId} (exit ${exitStatus}).`);
+                    await settleIfAborted();
+                    await ports.emitTelemetry({
+                        topic: 'playbook.script',
+                        payload: {
+                            stateId: input.stateId,
+                            sourceItem: input.sourceItem,
+                            exitStatus,
+                        },
+                    });
+                    await settleIfAborted();
+                    if (exitStatus === 0) {
+                        return { guard: okGuard, exitStatus: 0 };
                     }
-                    const onAbort = () => {
-                        child.kill('SIGTERM');
-                        reject(active.reason ?? new Error('script aborted'));
-                    };
-                    if (active.aborted) {
-                        onAbort();
-                        return;
+                    return { guard: failedGuard, exitStatus };
+                }
+                catch (error) {
+                    // Preserve the invocation's authoritative exact cancellation or
+                    // distinct sink failure after teardown succeeds. The finally
+                    // block may replace it only with a distinct teardown failure
+                    // when the process group cannot be confirmed gone.
+                    invocationFailed = true;
+                    throw error;
+                }
+                finally {
+                    try {
+                        if (active.aborted) {
+                            signalGroup('SIGKILL');
+                            await awaitGroupGone();
+                            if (!invocationFailed)
+                                active.throwIfAborted();
+                        }
                     }
-                    active.addEventListener('abort', onAbort, { once: true });
-                    child.on('error', (error) => {
-                        active.removeEventListener('abort', onAbort);
-                        reject(error);
-                    });
-                    child.on('close', (code) => {
+                    finally {
                         active.removeEventListener('abort', onAbort);
-                        resolve(typeof code === 'number' ? code : 1);
-                    });
-                });
-                await ports.emitStatus(`Executed script for ${input.stateId} (exit ${exitStatus}).`);
-                await ports.emitTelemetry({
-                    topic: 'playbook.script',
-                    payload: {
-                        stateId: input.stateId,
-                        sourceItem: input.sourceItem,
-                        exitStatus,
-                    },
-                });
-                if (exitStatus === 0) {
-                    return { guard: okGuard, exitStatus: 0 };
+                        if (killTimer !== undefined)
+                            clearTimeout(killTimer);
+                    }
                 }
-                return { guard: failedGuard, exitStatus };
             });
         }
         const nestedBridge = createNestedPlaybookBridge({
             nextCallId: () => `playbook-${++playbookCallSequence}`,
             getBoundarySignal: () => activeSignal,
             callPlaybook: (request, signal) => requireHostPorts().callPlaybook(request, signal),
-            emitStarted: async (event) => {
+            emitStarted: async (event, aborts) => {
                 playbookCallTurnIds.set(event.callId, activeTurnId);
                 await emitTrace('playbook.call.started', {
                     stateId: event.stateId,
@@ -1945,9 +2323,9 @@ export function createXStatePlaybookRuntime(machine, spec) {
                 }, {
                     ...(activeTurnId !== undefined ? { turnId: activeTurnId } : {}),
                     callId: event.callId,
-                });
+                }, aborts);
             },
-            emitFinished: async (event) => {
+            emitFinished: async (event, aborts) => {
                 const turnId = playbookCallTurnIds.get(event.callId);
                 try {
                     await emitTrace('playbook.call.finished', {
@@ -1958,22 +2336,34 @@ export function createXStatePlaybookRuntime(machine, spec) {
                     }, {
                         ...(turnId !== undefined ? { turnId } : {}),
                         callId: event.callId,
-                    });
+                    }, aborts);
                 }
                 finally {
                     playbookCallTurnIds.delete(event.callId);
                 }
             },
             drain: drainEmissions,
-            bindResumeSignal: (signal) => {
+            bindResumeSignal: (signal, aborts) => {
                 activeSignal = signal;
+                activeAborts = aborts ?? abortReasonClassifier(signal);
             },
-            onControlPlaneError: (error) => {
-                if (!activeSignal?.aborted)
+            bindActorSettlement: (aborts) => {
+                actorSettlementAborts = aborts;
+            },
+            onControlPlaneError: (error, aborts) => {
+                // The shared bridge classifies before reporting against its own
+                // invocation-and-resume signals; classify once more here against
+                // the boundary signal so a report that is the active boundary's
+                // exact abort reason can never masquerade as a control error
+                // (slc/link.md §Abort).
+                if (!aborts?.isAbortReason(error) &&
+                    !activeAborts?.isAbortReason(error)) {
                     controlPlaneError ??= error;
+                }
             },
-            onBackgroundError: (error) => {
-                emissionFailure ??= error;
+            onBackgroundError: (error, aborts) => {
+                if (!aborts?.isAbortReason(error))
+                    emissionFailure ??= { error };
             },
         });
         function tracePositionForActiveTurn() {
@@ -1987,11 +2377,9 @@ export function createXStatePlaybookRuntime(machine, spec) {
                 previousState: previousState ?? null,
                 state,
             };
-            if (state.stateId === 'awaitBossReply') {
-                const pendingBossQuestion = pendingBossQuestionFromContext(context);
-                if (pendingBossQuestion !== undefined) {
-                    payload.pendingBossQuestion = pendingBossQuestion;
-                }
+            const pendingBossQuestion = pendingBossQuestionForState(state, context);
+            if (pendingBossQuestion !== undefined) {
+                payload.pendingBossQuestion = pendingBossQuestion;
             }
             if (state.stateId === 'failed') {
                 const lastError = normalizeErrorFull(context.lastError);
@@ -2000,7 +2388,7 @@ export function createXStatePlaybookRuntime(machine, spec) {
             }
             return snapshotJsonValue(payload, 'FSM telemetry payload');
         }
-        function enqueueTransitionEmission(payload, state, statuses, position) {
+        function enqueueTransitionEmission(payload, state, statuses, position, aborts) {
             const currentSession = requireSession();
             const transitionTrace = createTraceEvent('fsm.transition', payload, position);
             const statusEmissions = statuses.map(({ message, data }) => ({
@@ -2029,13 +2417,38 @@ export function createXStatePlaybookRuntime(machine, spec) {
                     });
                     await currentSession.ports.emitStatus(status.message, status.data);
                 }
-            }).catch(() => undefined);
+            }, aborts).catch(() => undefined);
         }
-        function latchInspectionError(error) {
-            if (activeSignal !== undefined)
-                controlPlaneError ??= error;
+        // One classifying latch for every runtime-observed error — inspection
+        // failures and root-actor errors alike. Outside a boundary the error
+        // rides the emission channel, which the next boundary's (or init's)
+        // drain throws; inside a boundary it is a control-plane error unless it
+        // is the boundary signal's own abort reason (slc/link.md §Abort).
+        function latchRuntimeError(error, aborts = activeAborts) {
+            if (aborts?.isAbortReason(error))
+                return;
+            if (activeSignal === undefined)
+                emissionFailure ??= { error };
             else
-                emissionFailure ??= error;
+                controlPlaneError ??= error;
+        }
+        function consumeActorSettlementAborts(forSnapshot = false) {
+            const aborts = actorSettlementAborts ?? actorSettlementErrorAborts;
+            actorSettlementAborts = undefined;
+            actorSettlementErrorAborts = undefined;
+            if (forSnapshot && aborts !== undefined) {
+                // XState can report an errored root through both its inspection
+                // snapshot and subscriber. Keep the same provenance through that
+                // synchronous notification only; an ordinary transition must not
+                // lend it to a later unrelated actor error.
+                actorSettlementErrorAborts = aborts;
+                queueMicrotask(() => {
+                    if (actorSettlementErrorAborts === aborts) {
+                        actorSettlementErrorAborts = undefined;
+                    }
+                });
+            }
+            return aborts;
         }
         // PBRT-6: the single seam that stops this runtime's actor. Stopping a
         // still-running actor fires one more `@xstate.snapshot` for the
@@ -2081,6 +2494,7 @@ export function createXStatePlaybookRuntime(machine, spec) {
                         return;
                     if (suppressInspectionEmissions)
                         return;
+                    const settlementAborts = consumeActorSettlementAborts(true);
                     try {
                         const snap = inspectionEvent.snapshot;
                         const state = normalizePlaybookSnapshot(snap);
@@ -2092,14 +2506,24 @@ export function createXStatePlaybookRuntime(machine, spec) {
                             {});
                         const payload = structuredStateTelemetryPayload(previousState, state, inspectionEvent.event, context);
                         const statuses = statusesForState(state, context, inspectionEvent.event);
-                        enqueueTransitionEmission(payload, state, statuses, tracePositionForActiveTurn());
+                        enqueueTransitionEmission(payload, state, statuses, tracePositionForActiveTurn(), settlementAborts);
                         priorState = state;
                     }
                     catch (error) {
-                        latchInspectionError(error);
+                        latchRuntimeError(error, settlementAborts);
                     }
                 },
             });
+            // A synchronously-errored actor is already quiescent, so the turn's
+            // quiescence wait never subscribes and XState would report the error
+            // as unhandled after the boundary returns. Observe it through the
+            // classifying latch: mid-boundary it is the control-plane error
+            // unless it is the abort reason itself; at startup it rides the
+            // emission channel so `init`'s own drain rejects with it and the
+            // failed-start cleanup runs (slc/link.md §Session lifecycle).
+            builtActor.subscribe({
+                error: (error) => latchRuntimeError(error, consumeActorSettlementAborts()),
+            });
             return builtActor;
         }
         function runResultFor(outcome, error) {
@@ -2116,14 +2540,17 @@ export function createXStatePlaybookRuntime(machine, spec) {
             }
             if (outcome === 'terminal') {
                 const output = actor?.getSnapshot()?.output;
-                if (output !== undefined) {
-                    return {
-                        outcome,
-                        state,
-                        output: snapshotJsonValue(output, 'terminal playbook output'),
-                    };
-                }
-                return { outcome, state };
+                const stateDescription = stateDescriptionFor(state);
+                return {
+                    outcome,
+                    state,
+                    ...(stateDescription === undefined ? {} : { stateDescription }),
+                    ...(output === undefined
+                        ? {}
+                        : {
+                            output: snapshotJsonValue(output, 'terminal playbook output'),
+                        }),
+                };
             }
             const failure = error ??
                 (outcome === 'failed'
@@ -2141,15 +2568,23 @@ export function createXStatePlaybookRuntime(machine, spec) {
         function settledOutcome(signal) {
             if (nestedBridge.getPendingCall())
                 return 'suspended';
-            if (signal.aborted)
-                return 'aborted';
             const state = currentState();
             if (state.status === 'error') {
+                // An errored actor outranks a coincident abort unless the actor's
+                // error is the abort reason itself (slc/link.md §Abort).
                 const actorError = actor?.getSnapshot()?.error;
+                if (actorError !== undefined && isAbortFailure(actorError, signal)) {
+                    return 'aborted';
+                }
                 throw actorError ?? new Error(`${label} actor entered error status`);
             }
+            // Terminal completion outranks a coincident abort: the work finished,
+            // and reporting `aborted` would hide a terminal machine behind a
+            // settlement a later turn silently restarts (slc/link.md §Abort).
             if (state.status === 'done')
                 return 'terminal';
+            if (signal.aborted)
+                return 'aborted';
             if (state.stateId === 'failed')
                 return 'failed';
             return 'quiescent';
@@ -2210,8 +2645,8 @@ export function createXStatePlaybookRuntime(machine, spec) {
                     // The session-start error remains authoritative.
                 }
             }
-            playerResumeTokens.clear();
-            activePlayerIds.clear();
+            privateResumeTokens.clear();
+            activePlayerKeys.clear();
             playbookCallTurnIds.clear();
             activeEmissionCalls.clear();
             emissionQueue.clear();
@@ -2222,6 +2657,10 @@ export function createXStatePlaybookRuntime(machine, spec) {
             savedPorts = undefined;
             runtimePorts = undefined;
             activeSignal = undefined;
+            activeAborts = undefined;
+            actorSettlementAborts = undefined;
+            actorSettlementErrorAborts = undefined;
+            activeAbortEmission = undefined;
             activeTurnId = undefined;
             controlPlaneError = undefined;
             emissionFailure = undefined;
@@ -2243,28 +2682,56 @@ export function createXStatePlaybookRuntime(machine, spec) {
                 can.call(snapshot, event) ===
                     true);
         }
+        // DR-034: where the artifact names the FSM context member its entry
+        // action copies the exact Boss text into, that member of the live
+        // snapshot is the retry payload's source. The persisted machine snapshot
+        // carries it, so the candidate derives identically in the process that
+        // exported the snapshot and in one that restored it, and a failure
+        // reached after a Boss reply — whose recorded event the failure state
+        // refuses — is recoverable too. Naming the member is the artifact's
+        // statement that it holds the entry text: a same-named member is never
+        // assumed, since inferring one would turn any matching context member
+        // into a replay payload without its author saying so.
+        // Declared and absent or empty excludes the candidate rather than
+        // falling back to the record, which would make the action depend on the
+        // process again — the very thing this source exists to end.
+        function retryEventFrom(snapshot) {
+            const entryEvent = spec.entryEvent;
+            if (entryEvent?.contextField === undefined)
+                return lastBossEvent;
+            const context = snapshot?.context;
+            const text = isPlainObject(context)
+                ? context[entryEvent.contextField]
+                : undefined;
+            if (typeof text !== 'string' || text.trim() === '')
+                return undefined;
+            return { type: entryEvent.type, [entryEvent.textField]: text };
+        }
         // The failure-state retry entry replays the recorded last classified
-        // event with its recorded payload. A candidate whose event the live
-        // snapshot does not accept — or whose payload the runtime never
-        // recorded — is excluded rather than completed with invented text.
+        // event with its recorded payload, or the entry event the declared
+        // context member above sources. A candidate whose event the live
+        // snapshot does not accept — or whose payload the runtime can source
+        // from neither — is excluded rather than completed with invented text.
         function retryActionFor(snapshot, stateId) {
-            if (stateId !== 'failed' || lastBossEvent === undefined) {
+            if (stateId !== 'failed')
                 return undefined;
-            }
-            if (!snapshotCan(snapshot, lastBossEvent))
+            const retryEvent = retryEventFrom(snapshot);
+            if (retryEvent === undefined)
+                return undefined;
+            if (!snapshotCan(snapshot, retryEvent))
                 return undefined;
             // A recorded explicit-state-jump event names the exact state its
             // replay re-enters: the root BOSS_INTERRUPT shape is a guarded
             // multi-arm list keyed on `targetId`, so the first configured arm
             // may label a different state than the one the recorded event
             // actually resumes.
-            const recordedTargetId = lastBossEvent.type === JUMP_EVENT_TYPE
-                ? lastBossEvent.targetId
+            const recordedTargetId = retryEvent.type === JUMP_EVENT_TYPE
+                ? retryEvent.targetId
                 : undefined;
             const target = typeof recordedTargetId === 'string' &&
                 recordedTargetId.trim().length > 0
                 ? recordedTargetId
-                : firstTransitionTarget(machine, stateId, lastBossEvent.type);
+                : firstTransitionTarget(machine, stateId, retryEvent.type);
             // PBRT-52: a label is written from a source state description, never
             // from an identifier. Falling back to the target id — or, with no
             // resolvable target, to the FSM event type — makes the label *be* the
@@ -2278,10 +2745,10 @@ export function createXStatePlaybookRuntime(machine, spec) {
                 return undefined;
             return {
                 action: {
-                    id: `retry:${lastBossEvent.type}`,
+                    id: `retry:${retryEvent.type}`,
                     label: `Retry: ${description}`,
                 },
-                event: lastBossEvent,
+                event: retryEvent,
             };
         }
         function deriveControlActions(snapshot) {
@@ -2394,7 +2861,7 @@ export function createXStatePlaybookRuntime(machine, spec) {
                 if (initialized || disposed || disposalPromise !== undefined) {
                     throw new Error('createPlaybookRuntime.init: already initialized');
                 }
-                const boundSession = snapshotPlaybookSession(nextSession);
+                const boundSession = bindSession(nextSession);
                 initialized = true;
                 let finishInitialization;
                 const initialization = new Promise((resolve) => {
@@ -2466,12 +2933,12 @@ export function createXStatePlaybookRuntime(machine, spec) {
                 const machineSnapshot = detachPersistedMachineSnapshot(actor.getPersistedSnapshot());
                 const context = actor.getSnapshot()
                     .context;
-                const pending = pendingBossQuestionFromContext(context ?? {});
+                const pending = pendingBossQuestionForState(state, context ?? {});
                 return {
-                    schemaVersion: 2,
+                    schemaVersion: 3,
                     playbookId: session.playbookId,
                     machine: machineSnapshot,
-                    playerResumeTokens: snapshotPlayerResumeTokens(),
+                    roleResumeTokens: snapshotRoleResumeTokens(),
                     sequences: {
                         trace: traceSequence,
                         turn: turnSequence,
@@ -2488,7 +2955,7 @@ export function createXStatePlaybookRuntime(machine, spec) {
                         : [
                             {
                                 questionId: pending.questionId,
-                                player: pending.player,
+                                asker: pending.asker,
                                 question: pending.question,
                                 sourceItem: pending.sourceItem,
                             },
@@ -2505,11 +2972,13 @@ export function createXStatePlaybookRuntime(machine, spec) {
                 if (initialized || disposed || disposalPromise !== undefined) {
                     throw new Error('createPlaybookRuntime.restore: already initialized');
                 }
-                const boundSession = snapshotPlaybookSession(nextSession);
+                const boundSession = bindSession(nextSession);
                 const boundSnapshot = assertPlaybookRuntimeSnapshot(snapshot, boundSession.playbookId, { allowSuspendedCall: true });
-                const suspendedCall = boundSnapshot.schemaVersion === 2
-                    ? boundSnapshot.suspendedCall
-                    : undefined;
+                if (declaredActors.has('captain') &&
+                    boundSnapshot.sequences.captainCall === undefined) {
+                    throw new TypeError('runtime snapshot sequences.captainCall is required for a direct-Captain artifact');
+                }
+                const suspendedCall = boundSnapshot.suspendedCall;
                 let priorExternalPlayerTokens;
                 let externalStoreRestoreAttempted = false;
                 initialized = true;
@@ -2527,22 +2996,17 @@ export function createXStatePlaybookRuntime(machine, spec) {
                     judgeCallSequence = boundSnapshot.sequences.judgeCall;
                     playerCallSequence = boundSnapshot.sequences.playerCall;
                     playbookCallSequence = boundSnapshot.sequences.playbookCall;
-                    captainCallSequence =
-                        boundSnapshot.sequences.captainCall ??
-                            // Legacy schema-v1 snapshots predate this dedicated counter.
-                            // Every Captain call already consumed at least one trace number,
-                            // so the global trace counter is a collision-safe id floor.
-                            boundSnapshot.sequences.trace;
+                    captainCallSequence = boundSnapshot.sequences.captainCall ?? 0;
                     // The runtime snapshot carries no apply counter (PBRT-50); every
                     // apply boundary consumed trace numbers, so the persisted trace
                     // counter is a collision-safe id floor here too, keeping
                     // `apply-<n>` call ids unique across restore.
                     applyCallSequence = boundSnapshot.sequences.trace;
                     if (boundSession.playerSessions) {
-                        priorExternalPlayerTokens = snapshotPlayerResumeTokens();
+                        priorExternalPlayerTokens = snapshotRoleResumeTokens();
                         externalStoreRestoreAttempted = true;
                     }
-                    restorePlayerResumeTokens(boundSnapshot.playerResumeTokens);
+                    restoreRoleResumeTokens(boundSnapshot.roleResumeTokens);
                     nestedBridge.prepareRestore(suspendedCall);
                     if (suspendedCall !== undefined) {
                         playbookCallTurnIds.set(suspendedCall.callId, suspendedCall.turnId);
@@ -2550,8 +3014,23 @@ export function createXStatePlaybookRuntime(machine, spec) {
                     suppressInspectionEmissions = true;
                     actor = buildActor(runtimePorts, boundSnapshot.machine);
                     actor.start();
-                    if (controlPlaneError !== undefined)
-                        throw controlPlaneError;
+                    // A start-time actor error rides the startup emission channel
+                    // (latchRuntimeError); consume both latches here so the original
+                    // error outranks the derived status check below.
+                    {
+                        const startupFailure = emissionFailure;
+                        if (controlPlaneError !== undefined ||
+                            startupFailure !== undefined) {
+                            const startupError = controlPlaneError !== undefined
+                                ? controlPlaneError
+                                : startupFailure.error;
+                            controlPlaneError = undefined;
+                            if (emissionFailure === startupFailure) {
+                                emissionFailure = undefined;
+                            }
+                            throw startupError;
+                        }
+                    }
                     const restoredState = normalizePlaybookSnapshot(actor.getSnapshot(), suspendedCall === undefined
                         ? {}
                         : {
@@ -2617,7 +3096,7 @@ export function createXStatePlaybookRuntime(machine, spec) {
                 const state = currentState();
                 const context = (snapshot.context ??
                     {});
-                const pending = pendingBossQuestionFromContext(context);
+                const pending = pendingBossQuestionForState(state, context);
                 const lastError = normalizeErrorFull(context.lastError);
                 const projectedContext = projectControlContext(context);
                 const stateDescription = stateDescriptionFor(state);
@@ -2632,7 +3111,7 @@ export function createXStatePlaybookRuntime(machine, spec) {
                         : [
                             {
                                 questionId: pending.questionId,
-                                player: pending.player,
+                                asker: pending.asker,
                                 question: pending.question,
                                 sourceItem: pending.sourceItem,
                             },
@@ -2685,6 +3164,8 @@ export function createXStatePlaybookRuntime(machine, spec) {
                 const position = { turnId, callId };
                 activeTurnId = turnId;
                 activeSignal = signal;
+                activeAborts = abortReasonClassifier(signal);
+                activeAbortEmission = undefined;
                 controlPlaneError = undefined;
                 // Every receipt variant is normalized and frozen where it is built,
                 // inside the guarded region, so the recording step below cannot
@@ -2730,9 +3211,14 @@ export function createXStatePlaybookRuntime(machine, spec) {
                 // final for their key. Past publication such a failure is therefore
                 // re-latched onto the emission channel, surfacing from the next
                 // public boundary's drain, and `apply` still does not throw past
-                // acceptance (PBRT-52).
+                // acceptance (PBRT-52). A delivery rejection causally identical to
+                // this call's own abort reason evidences the cancellation and is
+                // dropped — never carried to a later unrelated boundary
+                // (slc/link.md §Abort).
                 const latchDeliveryFailure = (error) => {
-                    emissionFailure ??= error;
+                    if (isAbortFailure(error, signal))
+                        return;
+                    emissionFailure ??= { error };
                 };
                 try {
                     try {
@@ -2752,7 +3238,7 @@ export function createXStatePlaybookRuntime(machine, spec) {
                             key,
                             ...receiptTracePayload({ disposition: 'rejected', reason }),
                         });
-                        await emitCallStarted('apply.started', 'apply.finished', identity, position, preAcceptanceFinish('apply.started trace sink rejected'));
+                        await emitCallStarted('apply.started', 'apply.finished', identity, position, signal, preAcceptanceFinish('apply.started trace sink rejected'));
                         // An abort may land while the awaited started emission drains
                         // (e.g. fired from the trace sink itself); the action must
                         // never execute after abort. Settle the already-started pair
@@ -2831,6 +3317,10 @@ export function createXStatePlaybookRuntime(machine, spec) {
                     catch (error) {
                         settlementError = error;
                     }
+                    // Exact cancellation is not a control-plane latch, but after apply
+                    // acceptance and before publication it is still settlement evidence
+                    // and therefore folds into the owed failed receipt (DR-036 §4).
+                    settlementError ??= activeAbortEmission;
                     // Fold before the finish emission, the last point at which the
                     // traced disposition and the returned one can still be made the
                     // same value.
@@ -2872,6 +3362,8 @@ export function createXStatePlaybookRuntime(machine, spec) {
                     // wedge every later public boundary behind "another runtime turn
                     // is active".
                     activeSignal = undefined;
+                    activeAborts = undefined;
+                    activeAbortEmission = undefined;
                     activeTurnId = undefined;
                     controlPlaneError = undefined;
                 }
@@ -2907,119 +3399,152 @@ export function createXStatePlaybookRuntime(machine, spec) {
                 const turnId = ++turnSequence;
                 activeTurnId = turnId;
                 activeSignal = signal;
+                activeAborts = abortReasonClassifier(signal);
+                activeAbortEmission = undefined;
                 controlPlaneError = undefined;
                 let result;
                 let operationError;
+                // The boundary sentinel releases on every exit: a settlement defect
+                // past the drain — a snapshot normalization throw inside
+                // `runResultFor` included — must never wedge every later public
+                // boundary and `dispose` itself behind "another runtime turn is
+                // active". Mirrors the apply boundary's finally.
                 try {
-                    await emitTrace('boss.input.received', { text }, { turnId });
-                    // 1. Map the Boss text to an FSM event: deterministic exact entry
-                    //    where applicable (slc/link.md §Boss-event mapping), judge
-                    //    classification otherwise.
-                    let event;
-                    const trimmed = text.trim();
-                    if (trimmed !== '') {
-                        const snapshot = actor.getSnapshot();
-                        const terminal = snapshot.status === 'done';
-                        const stateId = normalizePlaybookSnapshot(snapshot).stateId;
-                        if (spec.entryEvent !== undefined &&
-                            (stateId === 'ready' || terminal)) {
-                            event = {
-                                type: spec.entryEvent.type,
-                                [spec.entryEvent.textField]: text,
-                            };
-                        }
-                        else {
-                            event = await classifyBossText(text, runtimePorts, signal, snapshot, boundary, boundOptions);
-                        }
-                        signal.throwIfAborted();
-                    }
-                    // Empty input, no-action classifier output, or invalid classifier
-                    // output — nothing to send.
-                    if (event === undefined) {
-                        result = runResultFor('no-action');
-                    }
-                    else {
-                        // 2. Optional Captain-pane classification line: the bare FSM
-                        //    event type, emitted before the FSM advances.
-                        const statusLine = classificationStatus(event);
-                        if (statusLine !== undefined) {
-                            await runtimePorts.emitStatus(statusLine);
-                        }
+                    try {
+                        await emitTrace('boss.input.received', { text }, { turnId });
+                        // Record the attempted input, then refuse a boundary that entered
+                        // aborted before deterministic mapping or the classifier can
+                        // perform host-visible work (DR-036 §5).
                         signal.throwIfAborted();
-                        // 3. A final actor cannot accept new events; reconstruct only
-                        //    after classification produced a real event.
-                        if (actor.getSnapshot().status === 'done') {
-                            stopActor();
-                            actor = buildActor(runtimePorts);
-                            // The replacement actor's snapshots are real state entries.
-                            suppressInspectionEmissions = false;
-                            actor.start();
+                        // 1. Map the Boss text to an FSM event: deterministic exact entry
+                        //    where applicable (slc/link.md §Boss-event mapping), judge
+                        //    classification otherwise.
+                        let event;
+                        const trimmed = text.trim();
+                        if (trimmed !== '') {
+                            const snapshot = actor.getSnapshot();
+                            const terminal = snapshot.status === 'done';
+                            const stateId = normalizePlaybookSnapshot(snapshot).stateId;
+                            // PBRT-1 / slc/link.md §Boss-event mapping: the idle entry, the
+                            // recoverable failure state, and the reconstructed terminal all
+                            // accept exactly one ordinary textual entry event, so delivered
+                            // text enters deterministically — no judge call to spend and no
+                            // classifier whim to settle a restart as no action. Every other
+                            // parked state — a reply wait or an authored mid-workflow
+                            // checkpoint — classifies under its own Boss-event contracts.
+                            if (spec.entryEvent !== undefined &&
+                                (stateId === 'ready' || stateId === 'failed' || terminal)) {
+                                event = {
+                                    type: spec.entryEvent.type,
+                                    [spec.entryEvent.textField]: text,
+                                };
+                            }
+                            else {
+                                event = await classifyBossText(text, runtimePorts, signal, snapshot, boundary, boundOptions);
+                            }
+                            signal.throwIfAborted();
                         }
-                        // DR-029: keep the classified event with its recorded payload
-                        // as the retry-replay source. Recording is sanitizing, not
-                        // load-bearing: an override classifier's non-JSON-safe event is
-                        // simply not recorded, and the turn proceeds unchanged.
-                        try {
-                            lastBossEvent = snapshotJsonValue(event, 'recorded Boss event');
+                        // Empty input, no-action classifier output, or invalid classifier
+                        // output — nothing to send.
+                        if (event === undefined) {
+                            result = runResultFor('no-action');
                         }
-                        catch {
-                            lastBossEvent = undefined;
+                        else {
+                            // 2. Optional Captain-pane classification line: the bare FSM
+                            //    event type, emitted before the FSM advances.
+                            const statusLine = classificationStatus(event);
+                            if (statusLine !== undefined) {
+                                await runtimePorts.emitStatus(statusLine);
+                            }
+                            signal.throwIfAborted();
+                            // 3. A final actor cannot accept new events; reconstruct only
+                            //    after classification produced a real event.
+                            if (actor.getSnapshot().status === 'done') {
+                                stopActor();
+                                actor = buildActor(runtimePorts);
+                                // The replacement actor's snapshots are real state entries.
+                                suppressInspectionEmissions = false;
+                                actor.start();
+                            }
+                            // DR-029: keep the classified event with its recorded payload
+                            // as the retry-replay source. Recording is sanitizing, not
+                            // load-bearing: an override classifier's non-JSON-safe event is
+                            // simply not recorded, and the turn proceeds unchanged.
+                            try {
+                                lastBossEvent = snapshotJsonValue(event, 'recorded Boss event');
+                            }
+                            catch {
+                                lastBossEvent = undefined;
+                            }
+                            actor.send(event);
+                            await waitForPlaybookQuiescence(actor, {
+                                pendingCalls: nestedBridge,
+                            });
+                            if (controlPlaneError !== undefined)
+                                throw controlPlaneError;
+                            result = runResultFor(settledOutcome(signal));
                         }
-                        actor.send(event);
-                        await waitForPlaybookQuiescence(actor, {
-                            pendingCalls: nestedBridge,
-                        });
-                        if (controlPlaneError !== undefined)
-                            throw controlPlaneError;
-                        result = runResultFor(settledOutcome(signal));
                     }
+                    catch (error) {
+                        operationError = error;
+                    }
+                    let drainError;
+                    try {
+                        await drainEmissions();
+                    }
+                    catch (error) {
+                        drainError = error;
+                    }
+                    const latchedControlError = controlPlaneError;
+                    // A drain rejection that is the exact abort reason evidences the
+                    // cancellation, not a control-plane failure (slc/link.md §Abort).
+                    const drainAbort = drainError !== undefined && isAbortFailure(drainError, signal);
+                    const effectiveDrainError = drainAbort ? undefined : drainError;
+                    const primaryError = latchedControlError ?? effectiveDrainError ?? operationError;
+                    const abortError = latchedControlError === undefined &&
+                        effectiveDrainError === undefined &&
+                        ((operationError !== undefined &&
+                            isAbortFailure(operationError, signal)) ||
+                            (drainAbort && operationError === undefined));
+                    const settlementResult = primaryError === undefined
+                        ? (result ?? runResultFor('no-action'))
+                        : runResultFor(abortError ? 'aborted' : 'failed', primaryError);
+                    let settlementEmissionError;
+                    try {
+                        await emitTrace('boss.input.settled', settlementTracePayload(settlementResult), { turnId });
+                    }
+                    catch (error) {
+                        settlementEmissionError = error;
+                    }
+                    try {
+                        await drainEmissions();
+                    }
+                    catch (error) {
+                        settlementEmissionError ??= error;
+                    }
+                    if (settlementEmissionError !== undefined &&
+                        isAbortFailure(settlementEmissionError, signal)) {
+                        settlementEmissionError = undefined;
+                    }
+                    const failure = controlPlaneError ??
+                        latchedControlError ??
+                        effectiveDrainError ??
+                        (abortError
+                            ? (settlementEmissionError ?? operationError)
+                            : (operationError ?? settlementEmissionError));
+                    if (failure !== undefined &&
+                        !(abortError && settlementEmissionError === undefined)) {
+                        throw failure;
+                    }
+                    return settlementResult;
                 }
-                catch (error) {
-                    operationError = error;
-                }
-                let drainError;
-                try {
-                    await drainEmissions();
-                }
-                catch (error) {
-                    drainError = error;
-                }
-                const latchedControlError = controlPlaneError;
-                const primaryError = latchedControlError ?? drainError ?? operationError;
-                const abortError = latchedControlError === undefined &&
-                    drainError === undefined &&
-                    operationError !== undefined &&
-                    isAbortFailure(operationError, signal);
-                const settlementResult = primaryError === undefined
-                    ? (result ?? runResultFor('no-action'))
-                    : runResultFor(abortError ? 'aborted' : 'failed', primaryError);
-                let settlementEmissionError;
-                try {
-                    await emitTrace('boss.input.settled', settlementTracePayload(settlementResult), { turnId });
-                }
-                catch (error) {
-                    settlementEmissionError = error;
-                }
-                try {
-                    await drainEmissions();
-                }
-                catch (error) {
-                    settlementEmissionError ??= error;
-                }
-                const failure = controlPlaneError ??
-                    latchedControlError ??
-                    drainError ??
-                    (abortError
-                        ? (settlementEmissionError ?? operationError)
-                        : (operationError ?? settlementEmissionError));
-                activeSignal = undefined;
-                activeTurnId = undefined;
-                controlPlaneError = undefined;
-                if (failure !== undefined &&
-                    !(abortError && settlementEmissionError === undefined)) {
-                    throw failure;
+                finally {
+                    activeSignal = undefined;
+                    activeAborts = undefined;
+                    activeAbortEmission = undefined;
+                    activeTurnId = undefined;
+                    controlPlaneError = undefined;
                 }
-                return settlementResult;
             },
             async resumePlaybookCall(input) {
                 if (!actor || !savedPorts) {
@@ -3033,41 +3558,85 @@ export function createXStatePlaybookRuntime(machine, spec) {
                 }
                 activeTurnId = playbookCallTurnIds.get(input.callId);
                 activeSignal = input.signal;
+                activeAborts = abortReasonClassifier(input.signal);
+                activeAbortEmission = undefined;
                 controlPlaneError = undefined;
-                let result;
-                let operationError;
+                // The boundary sentinel releases on every exit, mirroring
+                // `handleBossInput` and the apply boundary.
                 try {
-                    await nestedBridge.resume(input);
-                }
-                catch (error) {
-                    operationError = error;
-                }
-                try {
-                    await waitForPlaybookQuiescence(actor, {
-                        pendingCalls: nestedBridge,
-                    });
-                    result = runResultFor(settledOutcome(input.signal));
-                }
-                catch (error) {
-                    operationError ??= error;
-                }
-                let drainError;
-                try {
-                    await drainEmissions();
-                }
-                catch (error) {
-                    drainError = error;
+                    let result;
+                    let operationError;
+                    try {
+                        await nestedBridge.resume(input);
+                    }
+                    catch (error) {
+                        operationError = error;
+                    }
+                    try {
+                        await waitForPlaybookQuiescence(actor, {
+                            pendingCalls: nestedBridge,
+                        });
+                        result = runResultFor(settledOutcome(input.signal));
+                    }
+                    catch (error) {
+                        operationError ??= error;
+                    }
+                    // A resume refused because its signal was already aborted
+                    // delivers nothing: the pending call survives for a later
+                    // resume, and the boundary settles `aborted` rather than
+                    // advertising `suspended` (slc/link.md §Nested playbook bridge).
+                    if (operationError !== undefined &&
+                        isAbortFailure(operationError, input.signal) &&
+                        nestedBridge.getPendingCall()?.callId === input.callId) {
+                        result = {
+                            outcome: 'aborted',
+                            state: currentState(),
+                            error: normalizeError(input.signal.reason),
+                        };
+                    }
+                    let drainError;
+                    try {
+                        await drainEmissions();
+                    }
+                    catch (error) {
+                        drainError = error;
+                    }
+                    const aborts = activeAborts ?? abortReasonClassifier(input.signal);
+                    // A control-plane latch has already classified its failure as
+                    // distinct under the owning operation. Never reinterpret it
+                    // against this later resume signal (DR-036 decision 2).
+                    const controlFailure = controlPlaneError;
+                    const drainAbort = controlFailure === undefined &&
+                        drainError !== undefined &&
+                        aborts.isAbortReason(drainError);
+                    const operationAbort = controlFailure === undefined &&
+                        operationError !== undefined &&
+                        aborts.isAbortReason(operationError);
+                    const abortEvidence = activeAbortEmission ??
+                        (drainAbort ? drainError : undefined) ??
+                        (operationAbort ? operationError : undefined);
+                    const failure = controlFailure ??
+                        (drainAbort ? undefined : drainError) ??
+                        (operationAbort ? undefined : operationError);
+                    if (failure !== undefined)
+                        throw failure;
+                    if (abortEvidence !== undefined &&
+                        result?.outcome !== 'terminal' &&
+                        result?.outcome !== 'suspended') {
+                        result = runResultFor('aborted', abortEvidence);
+                    }
+                    if (result === undefined) {
+                        throw new Error('playbook resume produced no runtime result');
+                    }
+                    return result;
                 }
-                const failure = controlPlaneError ?? drainError ?? operationError;
-                activeSignal = undefined;
-                activeTurnId = undefined;
-                controlPlaneError = undefined;
-                if (failure !== undefined)
-                    throw failure;
-                if (result === undefined) {
-                    throw new Error('playbook resume produced no runtime result');
+                finally {
+                    activeSignal = undefined;
+                    activeAborts = undefined;
+                    activeAbortEmission = undefined;
+                    activeTurnId = undefined;
+                    controlPlaneError = undefined;
                 }
-                return result;
             },
             dispose() {
                 if (disposalPromise !== undefined)
@@ -3126,9 +3695,9 @@ export function createXStatePlaybookRuntime(machine, spec) {
                         // engagement tree. Child disposal must not erase a token its
                         // caller will resume. The private fallback remains runtime-owned.
                         if (session?.playerSessions === undefined) {
-                            playerResumeTokens.clear();
+                            privateResumeTokens.clear();
                         }
-                        activePlayerIds.clear();
+                        activePlayerKeys.clear();
                         playbookCallTurnIds.clear();
                         activeEmissionCalls.clear();
                         emissionQueue.clear();
@@ -3136,6 +3705,10 @@ export function createXStatePlaybookRuntime(machine, spec) {
                         appliedReceipts.clear();
                         actor = undefined;
                         activeSignal = undefined;
+                        activeAborts = undefined;
+                        actorSettlementAborts = undefined;
+                        actorSettlementErrorAborts = undefined;
+                        activeAbortEmission = undefined;
                         activeTurnId = undefined;
                         controlPlaneError = undefined;
                         emissionFailure = undefined;