@sublang/playbook 7.0.0 → 9.0.0

package/src/xstate-playbook-runtime.ts

@@ -66,13 +66,13 @@ export interface PlaybookPendingBossQuestionContext {
   questionId: string;
   resumeStateId: string;
   sourceItem: string;
-  player: string;
+  asker: { kind: 'captain' } | { kind: 'role'; roleId: string };
   question: string;
 }
 
 export interface PlaybookPlayerInput {
   stateId: string;
-  player: string;
+  role: string;
   sourceItem: string;
   prompt: string;
   result: Readonly<Record<string, string>>;
@@ -113,7 +113,7 @@ export type JudgePurpose =
 export interface RuntimeBoundaryCalls {
   callPlayer(
     input: PlaybookPlayerInput,
-    playerId: string,
+    roleId: string,
     prompt: string,
     signal: AbortSignal,
   ): Promise<PlayerResult>;
@@ -151,11 +151,14 @@ export interface ScheduledStatus {
 }
 
 /** Boss-facing identity for one FSM state whose invoked actor is `player`. */
-export interface XStatePlayerStateStatus {
-  player: string;
+export interface XStateRoleStateStatus {
+  role: string;
   label: string;
 }
 
+/** Invocation-scoped lookup exposed only while composing a player prompt. */
+export type XStatePromptIdentity = (roleId: string) => string;
+
 export interface XStateBossEventFieldSpec {
   /** The judge supplies routing data; the runtime supplies exact Boss text. */
   source: 'judge' | 'text';
@@ -247,7 +250,7 @@ export const RUNTIME_ABI = 1;
 
 /** The linked-artifact schema versions this engine accepts (DR-022). */
 export const SUPPORTED_ARTIFACT_SCHEMAS: readonly number[] = Object.freeze([
-  1,
+  2,
 ]);
 
 /** A linked artifact's declared link-time compatibility values (DR-022). */
@@ -259,14 +262,17 @@ export interface XStatePlaybookRuntimeCompat {
 }
 
 // PBRT-50: validate a declaration against the loaded engine, schema first,
-// so one clear diagnostic covers a fully skewed artifact. Absent means a
-// legacy artifact emitted before the DR-022 contract; those must keep
-// loading unchanged (DR-019 §4), so there is nothing to check.
+// so one clear diagnostic covers a fully skewed artifact. Declaration-free
+// artifacts are schema 1 and cannot be interpreted as local-role artifacts.
 function assertRuntimeCompat(
   compat: XStatePlaybookRuntimeCompat | undefined,
   label: string,
 ): void {
-  if (compat === undefined) return;
+  if (compat === undefined) {
+    throw new TypeError(
+      `${label} spec.compat is required for local-role artifacts`,
+    );
+  }
   if (compat === null || typeof compat !== 'object') {
     throw new TypeError(`${label} spec.compat must be an object`);
   }
@@ -355,8 +361,8 @@ export interface XStatePlaybookRuntimeSpec<TOptions> {
   label?: string;
   /**
    * Link-time compatibility declaration checked at construction against the
-   * loaded engine's self-report (DR-022). Absent: a legacy artifact emitted
-   * before the contract — constructed with no compatibility check.
+   * loaded engine's self-report (DR-022). Absent declarations reject because
+   * their overloaded player metadata has no safe local-role interpretation.
    */
   compat?: XStatePlaybookRuntimeCompat;
   /** Validate and JSON-snapshot the caller's per-run options. */
@@ -369,7 +375,19 @@ export interface XStatePlaybookRuntimeSpec<TOptions> {
    * ordinary textual entry event, send it without a judge call, carrying the
    * exact Boss text in `textField`. Absent: every non-empty turn classifies.
    */
-  entryEvent?: { type: string; textField: string };
+  entryEvent?: {
+    type: string;
+    textField: string;
+    /**
+     * DR-034: the FSM context member this machine's entry action copies the
+     * exact Boss text into. Where it is named, the failure-state retry
+     * builds its payload from that member of the live snapshot instead of
+     * from the process-local recorded event, so the action derives the same
+     * before and after `restore`. Absent: the recorded event stays the
+     * source and the action lives only as long as the process.
+     */
+    contextField?: string;
+  };
   /**
    * Exact flat Boss-event contracts whose non-text fields the judge may
    * select. `entryEvent` and scalar `BOSS_REPLY` contracts are supplied by
@@ -397,14 +415,15 @@ export interface XStatePlaybookRuntimeSpec<TOptions> {
    * recoverable FSM-result failures instead.
    */
   captainStrategy?: XStateCaptainStrategy<TOptions>;
-  /** Status line emitted after classification; canonical metadata defaults to the event type, legacy artifacts to none. */
+  /** Status line emitted after classification; metadata defaults to the event type. */
   classificationStatus?: (event: EventObject) => string | undefined;
-  /** Complete FSM-derived Boss-facing metadata for every `player` state; its presence selects the canonical status profile. */
-  playerStates?: Readonly<Record<string, XStatePlayerStateStatus>>;
-  /** Map a player-invoking state's input to the host player id. Default: lowercased player name. */
-  resolvePlayerId?: (input: PlaybookPlayerInput, options: TOptions) => string;
+  /** Complete FSM-derived Boss-facing metadata for every `player` state. */
+  roleStates?: Readonly<Record<string, XStateRoleStateStatus>>;
   /** Compose the player prompt. Default: continuation blocks + `<field>` placeholder substitution. */
-  composePlayerPrompt?: (input: PlaybookPlayerInput) => string;
+  composePlayerPrompt?: (
+    input: PlaybookPlayerInput,
+    promptIdentity: XStatePromptIdentity,
+  ) => string;
   /** Compose the direct-Captain prompt. Default: continuation blocks + placeholder substitution with deterministic JSON rendering. */
   composeCaptainPrompt?: (input: PlaybookCaptainInput) => string;
   /** Linker-known exceptions to the default kebab-token → camel-field mapping. */
@@ -568,11 +587,54 @@ export function normalizeErrorFull(
   return normalizeError(err);
 }
 
+// slc/link.md §Abort: cancellation is causal identity with the applicable
+// signal's reason — never an `AbortError` name, never bare signal state. A
+// distinct failure observed while the signal is aborted stays a non-abort
+// control error and takes precedence (mirrors DECIDE's bespoke reference).
 function isAbortFailure(error: unknown, signal: AbortSignal): boolean {
-  return (
-    signal.aborted &&
-    (error === signal.reason || normalizeError(error).name === 'AbortError')
+  return signal.aborted && Object.is(error, signal.reason);
+}
+
+interface AbortReasonClassifier {
+  isAbortReason(error: unknown): boolean;
+}
+
+function abortReasonClassifier(
+  ...sources: readonly (AbortSignal | AbortReasonClassifier | undefined)[]
+): AbortReasonClassifier {
+  const captured = sources.filter(
+    (source): source is AbortSignal | AbortReasonClassifier =>
+      source !== undefined,
   );
+  return Object.freeze({
+    isAbortReason: (error: unknown): boolean =>
+      captured.some((source) =>
+        source instanceof AbortSignal
+          ? isAbortFailure(error, source)
+          : source.isAbortReason(error),
+      ),
+  });
+}
+
+/**
+ * gears2fsm's canonical Boss-reply wait state. On the runtime's Boss-facing
+ * surfaces — state telemetry, status lines, the exported snapshot, and the
+ * control view — a context question counts as *pending* only while the
+ * machine sits in this state awaiting the reply. Later states retain the
+ * answered question in context (the resumed player prompt is composed from
+ * it), so an unconditional projection would resurrect it: a failure the
+ * resumed player reached would export a question nobody is waiting on,
+ * disagreeing with the gated telemetry a mirroring host's ledger follows
+ * and failing the shell's snapshot-equality settlement check.
+ */
+const BOSS_REPLY_WAIT_STATE_ID = 'awaitBossReply';
+
+function pendingBossQuestionForState(
+  state: PlaybookState,
+  context: Record<string, unknown>,
+): PlaybookPendingBossQuestionContext | undefined {
+  if (state.stateId !== BOSS_REPLY_WAIT_STATE_ID) return undefined;
+  return pendingBossQuestionFromContext(context);
 }
 
 /** Read the FSM context's single pending Boss question, when well-formed. */
@@ -594,16 +656,34 @@ export function pendingBossQuestionFromContext(
     typeof candidate.questionId !== 'string' ||
     typeof candidate.resumeStateId !== 'string' ||
     typeof candidate.sourceItem !== 'string' ||
-    typeof candidate.player !== 'string' ||
+    !isPlainObject(candidate.asker) ||
     typeof candidate.question !== 'string'
   ) {
     return undefined;
   }
+  let asker: PlaybookPendingBossQuestionContext['asker'];
+  if (candidate.asker.kind === 'captain') {
+    if (Object.keys(candidate.asker).some((key) => key !== 'kind')) {
+      return undefined;
+    }
+    asker = { kind: 'captain' };
+  } else if (
+    candidate.asker.kind === 'role' &&
+    typeof candidate.asker.roleId === 'string' &&
+    candidate.asker.roleId.trim().length > 0 &&
+    Object.keys(candidate.asker).every(
+      (key) => key === 'kind' || key === 'roleId',
+    )
+  ) {
+    asker = { kind: 'role', roleId: candidate.asker.roleId };
+  } else {
+    return undefined;
+  }
   return {
     questionId: candidate.questionId,
     resumeStateId: candidate.resumeStateId,
     sourceItem: candidate.sourceItem,
-    player: candidate.player,
+    asker,
     question: candidate.question,
   };
 }
@@ -707,11 +787,6 @@ export function defaultComposeCaptainPrompt(
   return blocks.join('\n\n');
 }
 
-/** Default player binding: each player to its lowercased name. */
-export function defaultResolvePlayerId(input: PlaybookPlayerInput): string {
-  return input.player.toLowerCase();
-}
-
 /**
  * Default required-field extraction (slc/link.md §Captain adjudication).
  * Limited to the description's `Output shall include` / `输出应包含` clause;
@@ -748,7 +823,7 @@ export function defaultBuildJudgePrompt(
       'and outcome descriptions. Reply with exactly one JSON object and no prose.',
   );
   lines.push('');
-  lines.push(`The ${input.player} just produced this output:`);
+  lines.push(`The ${input.role} role just produced this output:`);
   lines.push('');
   lines.push('```');
   lines.push(finalText);
@@ -856,7 +931,8 @@ function validateBossReplyOutput(
 
 // ---------------------------------------------------------------------------
 // Delegated-player actor bridge. One PromiseActorLogic the machine invokes
-// from every player-invoking state: resolve the playerId, compose the prompt,
+// from every player-invoking state: retain the role, resolve any bound player
+// identity privately, compose the prompt through the ephemeral identity lookup,
 // await callPlayer, adjudicate the finalText. An `ok` result with a missing,
 // empty, or whitespace-only finalText earns exactly one corrective re-ask of
 // the same composed call (DR-028); a non-`ok` result, or a second such empty
@@ -867,8 +943,8 @@ function validateBossReplyOutput(
 // which only fires on actor.stop(), not on Boss abort.
 // ---------------------------------------------------------------------------
 
-export interface PlayerBridgeSpec {
-  resolvePlayerId: (input: PlaybookPlayerInput) => string;
+interface PlayerBridgeSpec {
+  resolveRoleId: (input: PlaybookPlayerInput) => string;
   composePlayerPrompt: (input: PlaybookPlayerInput) => string;
   adjudication: PlayerAdjudicationSpec;
   resumableStateIds: ReadonlySet<string>;
@@ -884,12 +960,26 @@ export function createPlayerBridge(
   return fromPromise<PlaybookActorOutput, PlaybookPlayerInput>(
     async ({ input, signal }) => {
       const activeSignal = combineAbortSignals(signal, getActiveSignal?.());
-      const playerId = spec.resolvePlayerId(input);
-      const prompt = spec.composePlayerPrompt(input);
+      let roleId: string;
+      let prompt: string;
+      try {
+        roleId = spec.resolveRoleId(input);
+        prompt = spec.composePlayerPrompt(input);
+      } catch (error) {
+        if (!isAbortFailure(error, activeSignal)) {
+          onControlPlaneError?.(error);
+        }
+        throw error;
+      }
       const callPlayer = (resume: string | false) =>
         boundary
-          ? boundary.callPlayer(input, playerId, prompt, activeSignal)
-          : ports.callPlayer(playerId, prompt, activeSignal, { resume });
+          ? boundary.callPlayer(
+              input,
+              roleId,
+              prompt,
+              activeSignal,
+            )
+          : ports.callPlayer(roleId, prompt, activeSignal, { resume });
       let result = await callPlayer(false);
       if (result.status === 'ok' && isEmptyFinalText(result.finalText)) {
         // An abort that lands between the empty first result and the
@@ -936,7 +1026,9 @@ export function createPlayerBridge(
         validateBossReplyOutput(input, output, spec.resumableStateIds);
         return output;
       } catch (error) {
-        onControlPlaneError?.(error);
+        if (!isAbortFailure(error, activeSignal)) {
+          onControlPlaneError?.(error);
+        }
         throw error;
       }
     },
@@ -1063,10 +1155,10 @@ function collectInvokeSources(machine: AnyStateMachine): ReadonlySet<string> {
   return sources;
 }
 
-function collectPlayerStatePlayers(
+function collectPlayerStateRoles(
   machine: AnyStateMachine,
 ): ReadonlyMap<string, string> {
-  const players = new Map<string, string>();
+  const roles = new Map<string, string>();
   const visit = (stateDef: unknown, stateKey: string): void => {
     if (!isPlainObject(stateDef)) return;
     const invoke = stateDef.invoke;
@@ -1092,15 +1184,15 @@ function collectPlayerStatePlayers(
           'player state metadata must use a non-empty state id',
         );
       }
-      const player = isPlainObject(playbookMeta)
-        ? playbookMeta.player
+      const role = isPlainObject(playbookMeta)
+        ? playbookMeta.role
         : undefined;
-      if (typeof player !== 'string' || player.trim().length === 0) {
+      if (typeof role !== 'string' || role.trim().length === 0) {
         throw new TypeError(
-          `player state ${stateId} meta.playbook.player must be a non-empty string`,
+          `player state ${stateId} meta.playbook.role must be a non-empty string`,
         );
       }
-      players.set(stateId, player);
+      roles.set(stateId, role);
     }
     if (isPlainObject(stateDef.states)) {
       for (const [childKey, child] of Object.entries(stateDef.states)) {
@@ -1114,7 +1206,7 @@ function collectPlayerStatePlayers(
       visit(stateDef, stateKey);
     }
   }
-  return players;
+  return roles;
 }
 
 function transitionTargets(transition: unknown): string[] {
@@ -1138,7 +1230,7 @@ export function resumableStateIdsFromMachine(
   if (!isPlainObject(config) || !isPlainObject(config.states)) {
     return new Set();
   }
-  const awaitState = config.states.awaitBossReply;
+  const awaitState = config.states[BOSS_REPLY_WAIT_STATE_ID];
   if (!isPlainObject(awaitState) || !isPlainObject(awaitState.on)) {
     return new Set();
   }
@@ -1245,6 +1337,43 @@ function deepFreeze<T>(value: T): T {
 
 const SUPPRESSED_ENTRY_STATES: ReadonlySet<string> = new Set(['ready', 'done']);
 
+// Bounded escalation for aborted script process groups: SIGTERM first, then
+// SIGKILL after this grace, so settlement (gated on the shell's own exit)
+// stays bounded even for TERM-immune commands.
+const SCRIPT_ABORT_KILL_GRACE_MS = 2000;
+
+class ScriptProcessGroupTeardownError extends Error {
+  constructor(
+    pid: number,
+    message: string,
+    cause?: unknown,
+  ) {
+    super(
+      `script process group ${pid} teardown could not be confirmed: ${message}`,
+      cause === undefined ? undefined : { cause },
+    );
+    this.name = 'ScriptProcessGroupTeardownError';
+  }
+}
+
+function isNoSuchProcess(error: unknown): boolean {
+  return (
+    typeof error === 'object' &&
+    error !== null &&
+    'code' in error &&
+    (error as { code?: unknown }).code === 'ESRCH'
+  );
+}
+
+function isProcessPermissionDenied(error: unknown): boolean {
+  return (
+    typeof error === 'object' &&
+    error !== null &&
+    'code' in error &&
+    (error as { code?: unknown }).code === 'EPERM'
+  );
+}
+
 function makeDefaultNormalizeTransitionEvent(
   transitionEventFields: readonly string[],
 ): (event: unknown) => JsonValue {
@@ -1268,55 +1397,68 @@ function makeDefaultNormalizeTransitionEvent(
   };
 }
 
-function snapshotPlayerStateStatuses(
-  value: Readonly<Record<string, XStatePlayerStateStatus>> | undefined,
+function snapshotRoleStateStatuses(
+  value: unknown,
   label: string,
   machine: AnyStateMachine,
   stateDescriptions: ReadonlyMap<string, string>,
-): ReadonlyMap<string, XStatePlayerStateStatus> {
-  if (value === undefined) return new Map();
-  if (!isPlainObject(value)) {
-    throw new TypeError(`${label} playerStates must be an object`);
+): ReadonlyMap<string, XStateRoleStateStatus> {
+  if (value === undefined) {
+    throw new TypeError(`${label} roleStates must be supplied for schema 2`);
+  }
+  const captured = snapshotJsonValue(value, `${label} roleStates`);
+  if (!isPlainObject(captured)) {
+    throw new TypeError(`${label} roleStates must be an object`);
   }
-  const declared = collectPlayerStatePlayers(machine);
-  const statuses = new Map<string, XStatePlayerStateStatus>();
-  for (const [stateId, candidate] of Object.entries(value)) {
+  const declared = collectPlayerStateRoles(machine);
+  const statuses = new Map<string, XStateRoleStateStatus>();
+  for (const [stateId, candidate] of Object.entries(captured)) {
     if (!declared.has(stateId)) {
       throw new TypeError(
-        `${label} playerStates.${stateId} does not name a player state`,
+        `${label} roleStates.${stateId} does not name a player state`,
       );
     }
+    if (isPlainObject(candidate)) {
+      const extra = Object.keys(candidate).find(
+        (key) => key !== 'role' && key !== 'label',
+      );
+      if (extra !== undefined) {
+        throw new TypeError(
+          `${label} roleStates.${stateId}.${extra} is not allowed`,
+        );
+      }
+    }
     if (
       !isPlainObject(candidate) ||
-      typeof candidate.player !== 'string' ||
-      candidate.player.trim().length === 0 ||
+      typeof candidate.role !== 'string' ||
+      candidate.role.trim().length === 0 ||
       typeof candidate.label !== 'string' ||
       candidate.label.trim().length === 0
     ) {
       throw new TypeError(
-        `${label} playerStates.${stateId} must carry non-empty player and label strings`,
+        `${label} roleStates.${stateId} must carry non-empty role and label strings`,
       );
     }
     const expectedLabel = stateDescriptions.get(stateId);
     if (candidate.label !== expectedLabel) {
       throw new TypeError(
-        `${label} playerStates.${stateId}.label must equal its FSM description`,
+        `${label} roleStates.${stateId}.label must equal its FSM description`,
       );
     }
-    if (candidate.player !== declared.get(stateId)) {
+    if (candidate.role !== declared.get(stateId)) {
       throw new TypeError(
-        `${label} playerStates.${stateId}.player must equal its FSM player`,
+        `${label} roleStates.${stateId}.role must equal its FSM role`,
       );
     }
     statuses.set(stateId, {
-      player: candidate.player,
+      role: candidate.role,
       label: candidate.label,
     });
   }
   for (const stateId of declared.keys()) {
     if (!statuses.has(stateId)) {
       throw new TypeError(
-        `${label} playerStates must declare player state ${stateId}`,
+        `${label} roleStates must declare player state ${stateId}`,
       );
     }
   }
@@ -1331,39 +1473,14 @@ function settlingGuard(event: unknown): string | undefined {
     : undefined;
 }
 
-function legacyStatusesForState(
-  state: PlaybookState,
-  context: Record<string, unknown>,
-): ScheduledStatus[] {
-  const stateId = state.stateId;
-  if (stateId === undefined || SUPPRESSED_ENTRY_STATES.has(stateId)) return [];
-  if (stateId === 'awaitBossReply') {
-    const pending = pendingBossQuestionFromContext(context);
-    return [
-      {
-        message:
-          pending === undefined
-            ? 'Awaiting Boss reply.'
-            : `${pending.player} asks: ${pending.question}`,
-      },
-    ];
-  }
-  if (stateId === 'failed') {
-    const lastError = normalizeErrorFull(context.lastError);
-    return [
-      {
-        message: 'Workflow failed; awaiting Boss recovery.',
-        ...(lastError === undefined
-          ? {}
-          : { data: snapshotJsonValue({ lastError }, 'failed status data') }),
-      },
-    ];
-  }
-  return [{ message: `Entered ${stateId}.` }];
+function askerLabel(
+  asker: PlaybookPendingBossQuestionContext['asker'],
+): string {
+  return asker.kind === 'captain' ? 'Captain' : asker.roleId;
 }
 
 function makeDefaultStatusesForState(
-  playerStates: ReadonlyMap<string, XStatePlayerStateStatus>,
+  roleStates: ReadonlyMap<string, XStateRoleStateStatus>,
 ): NonNullable<XStatePlaybookRuntimeSpec<unknown>['statusesForState']> {
   return (state, context, event): ScheduledStatus[] => {
     const statuses: ScheduledStatus[] = [];
@@ -1374,18 +1491,18 @@ function makeDefaultStatusesForState(
     if (stateId === undefined || SUPPRESSED_ENTRY_STATES.has(stateId)) {
       return statuses;
     }
-    if (stateId === 'awaitBossReply') {
+    if (stateId === BOSS_REPLY_WAIT_STATE_ID) {
       const pending = pendingBossQuestionFromContext(context);
       if (pending === undefined) {
         return [...statuses, { message: 'Awaiting Boss reply.' }];
       }
       return [
         ...statuses,
-        { message: `${pending.player} asks: ${pending.question}` },
+        { message: `${askerLabel(pending.asker)} asks: ${pending.question}` },
         {
           message:
             `◆ awaiting Boss reply · ${pending.resumeStateId} · ` +
-            `${pending.player} · ${pending.sourceItem}`,
+            `${askerLabel(pending.asker)} · ${pending.sourceItem}`,
         },
       ];
     }
@@ -1406,10 +1523,10 @@ function makeDefaultStatusesForState(
         },
       ];
     }
-    const playerState = playerStates.get(stateId);
-    if (playerState !== undefined) {
+    const roleState = roleStates.get(stateId);
+    if (roleState !== undefined) {
       statuses.push({
-        message: `⤷ ${playerState.player}: ${playerState.label}`,
+        message: `⤷ ${roleState.role}: ${roleState.label}`,
       });
     }
     return statuses;
@@ -1654,7 +1771,15 @@ function makeDefaultClassifyBossText(
     const state = classifierState(snapshotOrState);
     const stateId = typeof state.value === 'string' ? state.value : undefined;
     const currentState = stateId ?? JSON.stringify(state.value ?? null);
-    const pending = pendingBossQuestionFromContext(state.context);
+    // The classifier shares the reply-wait pendingness of every other
+    // surface: outside the wait, a context question a later state retains
+    // is answered history, so the prompt must not present it as pending —
+    // a judge told a question awaits at the failure state is steered toward
+    // a reply it cannot select or toward no action at all.
+    const pending =
+      stateId === BOSS_REPLY_WAIT_STATE_ID
+        ? pendingBossQuestionFromContext(state.context)
+        : undefined;
     const configuredTypes = configuredEventTypesForState(machine, stateId);
     const applicable = [...contracts.values()].filter(
       (contract) =>
@@ -1672,7 +1797,7 @@ function makeDefaultClassifyBossText(
     if (pending !== undefined) {
       lines.push(
         `Pending question id: ${pending.questionId}`,
-        `Pending asking player: ${pending.player}`,
+        `Pending asker: ${askerLabel(pending.asker)}`,
         `Pending Boss question: ${pending.question}`,
       );
     }
@@ -1827,6 +1952,74 @@ function machineDeclaresParallelState(machine: AnyStateMachine): boolean {
   return visit((machine as unknown as { config?: unknown }).config);
 }
 
+// PBRT-52: the factory's domain is FLAT single-region machines — every
+// state a direct child of the root, so each snapshot exposes exactly one
+// playbook state id and every state-keyed lookup (deterministic entries,
+// retry, reply-wait pendingness, configured events, descriptions) indexes
+// one unambiguous identity. A compound child would be accepted and then
+// silently misbehave on all of those gates, so it is rejected up front
+// exactly like a parallel region.
+function machineDeclaresNestedState(machine: AnyStateMachine): boolean {
+  const config = (machine as unknown as { config?: unknown }).config;
+  if (!isPlainObject(config) || !isPlainObject(config.states)) return false;
+  return Object.values(config.states).some(
+    (stateDef) =>
+      isPlainObject(stateDef) &&
+      isPlainObject(stateDef.states) &&
+      Object.keys(stateDef.states).length > 0,
+  );
+}
+
+// PBRT-52: the factory's lookups index states by their root key, and the
+// published playbook identity is `meta.playbook.stateId` — the two must
+// coincide or a machine can advertise a pending question or retry under an
+// identity no lookup resolves. A state with no string stateId is just as
+// dead: every snapshot identity derives from that member, so the first
+// entry would fail the exactly-one-state-id inspection at runtime.
+// gears2fsm keeps identity and key equal by construction; a hand-authored
+// artifact that splits or omits them fails here instead of at a silently
+// dead gate.
+function assertFlatStateIdentity(
+  machine: AnyStateMachine,
+  label: string,
+): void {
+  const config = (machine as unknown as { config?: unknown }).config;
+  const states =
+    isPlainObject(config) && isPlainObject(config.states)
+      ? config.states
+      : undefined;
+  // A machine with no root states has no playbook identity to expose; its
+  // first snapshot would fail the exactly-one-state-id inspection, so it
+  // fails construction with the defect named instead.
+  if (states === undefined || Object.keys(states).length === 0) {
+    throw new Error(
+      `${label} declares no root states; the shared runtime requires at ` +
+        'least one flat playbook state',
+    );
+  }
+  for (const [key, stateDef] of Object.entries(states)) {
+    if (!isPlainObject(stateDef)) continue;
+    const meta = isPlainObject(stateDef.meta) ? stateDef.meta : undefined;
+    const playbook =
+      meta !== undefined && isPlainObject(meta.playbook)
+        ? meta.playbook
+        : undefined;
+    const stateId = playbook?.stateId;
+    if (typeof stateId !== 'string') {
+      throw new Error(
+        `${label} state ${key} declares no string meta.playbook.stateId; ` +
+          'the shared runtime derives every playbook state identity from it',
+      );
+    }
+    if (stateId !== key) {
+      throw new Error(
+        `${label} state ${key} declares meta.playbook.stateId ${stateId}; ` +
+          'the shared runtime requires the playbook state id to equal the state key',
+      );
+    }
+  }
+}
+
 /**
  * Build a `PlaybookRuntimeFactory` that interprets the given FSM artifact
  * under the slc/link.md contract. The factory provides every actor kind the
@@ -1834,9 +2027,10 @@ function machineDeclaresParallelState(machine: AnyStateMachine): boolean {
  * (literal and dynamic) — and implements the full runtime lifecycle including
  * the optional parked-session snapshot capability (DR-014).
  *
- * Scope: machines that declare no parallel state (each snapshot exposes
- * exactly one playbook state id). Parallel-region FSMs keep their own linked
- * runtimes.
+ * Scope: flat single-region machines — no parallel state, no compound
+ * child states, and every root state's `meta.playbook.stateId` equal to its
+ * state key — so each snapshot exposes exactly one playbook state id.
+ * Parallel-region FSMs keep their own linked runtimes.
  */
 export function createXStatePlaybookRuntime<TOptions>(
   machine: AnyStateMachine,
@@ -1846,24 +2040,50 @@ export function createXStatePlaybookRuntime<TOptions>(
   // DR-022 / PBRT-50: reject an incompatible artifact declaration before any
   // machine interpretation, against this loaded engine's own self-report.
   assertRuntimeCompat(spec.compat, label);
+  const specDescriptors = Object.getOwnPropertyDescriptors(spec);
+  if (Object.prototype.hasOwnProperty.call(specDescriptors, 'playerStates')) {
+    throw new TypeError(
+      `${label} schema-2 artifacts must supply roleStates, not playerStates`,
+    );
+  }
+  if (Object.prototype.hasOwnProperty.call(specDescriptors, 'resolvePlayerId')) {
+    throw new TypeError(
+      `${label} schema-2 artifacts must not derive concrete player bindings`,
+    );
+  }
   if (machineDeclaresParallelState(machine)) {
     throw new Error(
       `${label} uses a parallel state; the shared runtime supports only single-region FSMs`,
     );
   }
+  if (machineDeclaresNestedState(machine)) {
+    throw new Error(
+      `${label} declares a compound state; the shared runtime supports only flat single-region FSMs`,
+    );
+  }
+  assertFlatStateIdentity(machine, label);
   const declaredActors = collectInvokeSources(machine);
   const resumableStateIds =
     spec.resumableStateIds ?? resumableStateIdsFromMachine(machine);
   // DR-029: source state descriptions label the control actions the
   // runtime advertises through `describe()`.
   const stateDescriptions = stateDescriptionsFromMachine(machine);
-  const hasCanonicalStatusProfile = spec.playerStates !== undefined;
-  const playerStates = snapshotPlayerStateStatuses(
-    spec.playerStates,
+  const roleStatesDescriptor = specDescriptors.roleStates;
+  if (
+    roleStatesDescriptor !== undefined &&
+    !Object.prototype.hasOwnProperty.call(roleStatesDescriptor, 'value')
+  ) {
+    throw new TypeError(`${label} roleStates must be an own data property`);
+  }
+  const roleStates = snapshotRoleStateStatuses(
+    roleStatesDescriptor?.value,
     label,
     machine,
     stateDescriptions,
   );
+  const declaredRoleIds = Object.freeze([
+    ...new Set([...roleStates.values()].map(({ role }) => role)),
+  ]);
   // PBRT-52: the artifact's own ControlView context projection. Nothing is
   // exported by default, so an FSM context member — including one added
   // after this artifact was linked — is private until named here. The two
@@ -1880,7 +2100,6 @@ export function createXStatePlaybookRuntime<TOptions>(
       );
     }
   }
-  const resolvePlayerIdSpec = spec.resolvePlayerId;
   const composePlayerPrompt =
     spec.composePlayerPrompt ??
     ((input: PlaybookPlayerInput) =>
@@ -1919,14 +2138,10 @@ export function createXStatePlaybookRuntime<TOptions>(
     makeDefaultNormalizeTransitionEvent(spec.transitionEventFields ?? []);
   const statusesForState =
     spec.statusesForState ??
-    (hasCanonicalStatusProfile
-      ? makeDefaultStatusesForState(playerStates)
-      : legacyStatusesForState);
+    makeDefaultStatusesForState(roleStates);
   const classificationStatus =
     spec.classificationStatus ??
-    (hasCanonicalStatusProfile
-      ? (event: EventObject) => event.type
-      : () => undefined);
+    ((event: EventObject) => event.type);
   const machineInput =
     spec.machineInput ?? ((options: TOptions) => options as unknown);
   const scriptCwd =
@@ -1951,6 +2166,20 @@ export function createXStatePlaybookRuntime<TOptions>(
     // ports.callPlayer / callCaptain / callJudge see the right cancellation
     // source. undefined between turns; set by the public boundaries.
     let activeSignal: AbortSignal | undefined;
+    // Immutable cancellation provenance for the active public boundary. A
+    // nested resume widens it to include both invocation and resume signals;
+    // mutable `activeSignal` alone cannot classify a late invocation reason.
+    let activeAborts: AbortReasonClassifier | undefined;
+    // The bridge binds the provenance of a child result immediately before
+    // its promise actor settles. The next root snapshot/error consumes this
+    // one-shot so background settlement emissions retain their owner.
+    let actorSettlementAborts: AbortReasonClassifier | undefined;
+    let actorSettlementErrorAborts: AbortReasonClassifier | undefined;
+    // Exact cancellation observed by an emission owned by the active
+    // boundary. Ordinary runs settle from their signal/state; apply also
+    // needs this phase-local evidence to fold a pre-publication failure into
+    // its accepted receipt.
+    let activeAbortEmission: unknown;
     let activeTurnId: number | undefined;
     let controlPlaneError: unknown;
     // Previous root-machine state for the inspect-driven telemetry /
@@ -1977,8 +2206,8 @@ export function createXStatePlaybookRuntime<TOptions>(
     // acceptance records nothing, so a later call with that key may still
     // execute.
     const appliedReceipts = new Map<string, PlaybookControlReceipt>();
-    const playerResumeTokens = new Map<string, string>();
-    const activePlayerIds = new Set<string>();
+    const privateResumeTokens = new Map<string, string>();
+    const activePlayerKeys = new Set<string>();
     const playbookCallTurnIds = new Map<string, number | undefined>();
     // Captain and judge work share one serialized lane (slc/link.md
     // §Session lifecycle).
@@ -1989,87 +2218,229 @@ export function createXStatePlaybookRuntime<TOptions>(
     // All trace, state-telemetry, and status work shares this one queue.
     // Inspection callbacks enqueue a complete ordered batch synchronously;
     // imperative boundaries await their queued work directly.
-    let emissionFailure: unknown;
+    let emissionFailure: { readonly error: unknown } | undefined;
+
+    function bindSession(nextSession: PlaybookSession): PlaybookSession {
+      const bound = snapshotPlaybookSession(nextSession);
+      if (bound.roleBindings === undefined) return bound;
+      const actual = Object.keys(bound.roleBindings).sort();
+      const expected = [...declaredRoleIds].sort();
+      const missing = expected.filter((roleId) => !actual.includes(roleId));
+      const extra = actual.filter((roleId) => !expected.includes(roleId));
+      if (missing.length > 0 || extra.length > 0) {
+        throw new TypeError(
+          `${label} session roleBindings must cover exactly [${expected.join(', ')}]` +
+            `${missing.length === 0 ? '' : `; missing [${missing.join(', ')}]`}` +
+            `${extra.length === 0 ? '' : `; extra [${extra.join(', ')}]`}`,
+        );
+      }
+      return bound;
+    }
+
+    function requireRoleId(input: PlaybookPlayerInput): string {
+      const roleId = input.role;
+      if (
+        typeof roleId !== 'string' ||
+        roleId.trim().length === 0 ||
+        !declaredRoleIds.includes(roleId)
+      ) {
+        throw new TypeError(
+          `${label} player input role must name a declared local role`,
+        );
+      }
+      return roleId;
+    }
+
+    function resolvedPlayerId(roleId: string): string | undefined {
+      return session?.roleBindings?.[roleId]?.playerId;
+    }
+
+    function promptIdentity(roleId: string): string {
+      if (!declaredRoleIds.includes(roleId)) {
+        throw new TypeError(
+          `${label} prompt identity lookup rejected undeclared role ${roleId}`,
+        );
+      }
+      return session?.roleBindings?.[roleId]?.promptIdentity ?? roleId;
+    }
+
+    function composeBoundPlayerPrompt(input: PlaybookPlayerInput): string {
+      let active = true;
+      const lookup: XStatePromptIdentity = (roleId) => {
+        if (!active) {
+          throw new Error(
+            `${label} prompt identity lookup is no longer active`,
+          );
+        }
+        return promptIdentity(roleId);
+      };
+      try {
+        return composePlayerPrompt(input, lookup);
+      } finally {
+        active = false;
+      }
+    }
 
-    function selectPlayerResume(playerId: string): string | false {
+    function continuationKey(
+      roleId: string,
+      playerId: string | undefined,
+    ): string {
+      return playerId ?? roleId;
+    }
+
+    function roleTokensByContinuationKey(
+      tokens: Readonly<Record<string, string>>,
+    ): Map<string, string> {
+      const byKey = new Map<string, string>();
+      for (const [roleId, token] of Object.entries(tokens)) {
+        if (!declaredRoleIds.includes(roleId)) {
+          throw new TypeError(
+            `runtime role tokens contain unknown role ${roleId}`,
+          );
+        }
+        const key = continuationKey(roleId, resolvedPlayerId(roleId));
+        const existing = byKey.get(key);
+        if (existing !== undefined && existing !== token) {
+          throw new TypeError(
+            `runtime snapshot assigns conflicting tokens to roles bound to player ${key}`,
+          );
+        }
+        byKey.set(key, token);
+      }
+      const rolesByKey = new Map<string, string[]>();
+      for (const roleId of declaredRoleIds) {
+        const key = continuationKey(roleId, resolvedPlayerId(roleId));
+        rolesByKey.set(key, [...(rolesByKey.get(key) ?? []), roleId]);
+      }
+      for (const [key, roles] of rolesByKey) {
+        if (roles.length < 2) continue;
+        const present = roles.filter((roleId) => tokens[roleId] !== undefined);
+        if (present.length !== 0 && present.length !== roles.length) {
+          throw new TypeError(
+            `runtime role tokens must project player ${key} through every aliased role [${roles.join(', ')}]`,
+          );
+        }
+      }
+      return byKey;
+    }
+
+    function selectPlayerResume(
+      roleId: string,
+      playerId: string | undefined,
+    ): string | false {
+      const key = continuationKey(roleId, playerId);
       const selected = session?.playerSessions
-        ? session.playerSessions.select(playerId)
-        : playerResumeTokens.get(playerId) ?? false;
+        ? session.playerSessions.select(roleId)
+        : privateResumeTokens.get(key) ?? false;
       if (
         selected !== false &&
         (typeof selected !== 'string' || selected.trim().length === 0)
       ) {
         throw new TypeError(
-          `player session store returned an invalid resume token for ${playerId}`,
+          `player session store returned an invalid resume token for role ${roleId}`,
         );
       }
       return selected;
     }
 
     function updatePlayerResume(
-      playerId: string,
-      resumeToken: string | undefined,
+      roleId: string,
+      playerId: string | undefined,
+      result: PlayerResult,
     ): void {
+      const resumeToken = result.resumeToken;
+      if (resumeToken === undefined && result.status !== 'ok') return;
+      const key = continuationKey(roleId, playerId);
       if (session?.playerSessions) {
-        session.playerSessions.update(playerId, resumeToken);
-      } else if (resumeToken !== undefined && resumeToken.trim().length > 0) {
-        playerResumeTokens.set(playerId, resumeToken);
+        session.playerSessions.update(roleId, resumeToken);
+      } else if (resumeToken !== undefined) {
+        privateResumeTokens.set(key, resumeToken);
       } else {
-        playerResumeTokens.delete(playerId);
+        privateResumeTokens.delete(key);
       }
     }
 
-    function snapshotPlayerResumeTokens(): Record<string, string> {
-      const raw = session?.playerSessions
-        ? session.playerSessions.snapshot()
-        : Object.fromEntries(playerResumeTokens);
+    function snapshotRoleResumeTokens(): Record<string, string> {
+      const raw = snapshotJsonValue(
+        session?.playerSessions
+          ? session.playerSessions.snapshot()
+          : Object.fromEntries(
+              declaredRoleIds.flatMap((roleId) => {
+                const token = privateResumeTokens.get(
+                  continuationKey(roleId, resolvedPlayerId(roleId)),
+                );
+                return token === undefined ? [] : [[roleId, token]];
+              }),
+            ),
+        'player session store snapshot',
+      );
       if (!isPlainObject(raw)) {
         throw new TypeError('player session store snapshot must be an object');
       }
       const detached: Record<string, string> = {};
-      for (const [playerId, token] of Object.entries(raw)) {
-        if (playerId.trim().length === 0) {
+      for (const [roleId, token] of Object.entries(raw)) {
+        if (!declaredRoleIds.includes(roleId)) {
           throw new TypeError(
-            'player session store snapshot player ids must be non-empty',
+            `player session store snapshot contains unknown role ${roleId}`,
           );
         }
         if (typeof token !== 'string' || token.trim().length === 0) {
           throw new TypeError(
-            `player session store snapshot token for ${playerId} must be a non-empty string`,
+            `player session store snapshot token for ${roleId} must be a non-empty string`,
           );
         }
-        detached[playerId] = token;
+        detached[roleId] = token;
       }
+      roleTokensByContinuationKey(detached);
       return detached;
     }
 
-    function restorePlayerResumeTokens(
+    function restoreRoleResumeTokens(
       tokens: Readonly<Record<string, string>>,
     ): void {
+      const byKey = roleTokensByContinuationKey(tokens);
       if (session?.playerSessions) {
         session.playerSessions.restore(tokens);
         return;
       }
-      playerResumeTokens.clear();
-      for (const [playerId, token] of Object.entries(tokens)) {
-        playerResumeTokens.set(playerId, token);
-      }
+      privateResumeTokens.clear();
+      for (const [key, token] of byKey) privateResumeTokens.set(key, token);
     }
 
-    function enqueueEmission(fn: () => Promise<void>): Promise<void> {
+    function enqueueEmission(
+      fn: () => Promise<void>,
+      aborts: AbortReasonClassifier | undefined = activeAborts,
+    ): Promise<void> {
+      // The emission belongs to the boundary enqueueing it: a rejection
+      // causally identical to that boundary's abort reason is the
+      // cancellation's own evidence — never latched, so it cannot poison a
+      // later unrelated boundary (DR-036).
+      const enqueueAborts = aborts;
       const queued = emissionQueue.add(fn).then(() => undefined);
       activeEmissionCalls.add(queued);
       void queued.then(
         () => activeEmissionCalls.delete(queued),
         (error: unknown) => {
           activeEmissionCalls.delete(queued);
-          emissionFailure ??= error;
+          if (enqueueAborts?.isAbortReason(error)) {
+            // Record evidence only when it also belongs to the public
+            // boundary that is still active. A background A cancellation
+            // racing an unrelated B boundary is forgiven under A and must
+            // not change B's settlement.
+            if (activeAborts?.isAbortReason(error)) {
+              activeAbortEmission ??= error;
+            }
+            return;
+          }
+          emissionFailure ??= { error };
         },
       );
       return queued;
     }
 
-    async function drainEmissions(): Promise<void> {
+    async function drainEmissions(
+      _aborts: AbortReasonClassifier | undefined = activeAborts,
+    ): Promise<void> {
       while (true) {
         const active = [...activeEmissionCalls];
         if (active.length > 0) await Promise.allSettled(active);
@@ -2083,8 +2454,13 @@ export function createXStatePlaybookRuntime<TOptions>(
         }
       }
       if (emissionFailure !== undefined) {
-        const error = emissionFailure;
+        const { error } = emissionFailure;
         emissionFailure = undefined;
+        // The failure was classified as distinct by its enqueue owner. If a
+        // later public boundary drains it, retain that classification in the
+        // boundary latch before throwing; its signal must not reinterpret
+        // the same object as cancellation (DR-036 decision 2).
+        if (activeSignal !== undefined) controlPlaneError ??= error;
         throw error;
       }
     }
@@ -2111,7 +2487,7 @@ export function createXStatePlaybookRuntime<TOptions>(
       const currentSession = requireSession();
       const safePayload = snapshotJsonValue(payload, `trace ${type} payload`);
       return {
-        schemaVersion: 2,
+        schemaVersion: 3,
         sessionId: currentSession.sessionId,
         playbookId: currentSession.playbookId,
         rootSessionId: currentSession.rootSessionId,
@@ -2135,14 +2511,17 @@ export function createXStatePlaybookRuntime<TOptions>(
       type: PlaybookTraceType,
       payload: unknown,
       position: TracePosition = {},
+      aborts?: AbortReasonClassifier,
     ): Promise<void> {
       const currentSession = requireSession();
       const event = createTraceEvent(type, payload, position);
-      return enqueueEmission(() =>
-        currentSession.ports.emitTelemetry({
-          topic: 'playbook.trace',
-          payload: event,
-        }),
+      return enqueueEmission(
+        () =>
+          currentSession.ports.emitTelemetry({
+            topic: 'playbook.trace',
+            payload: event,
+          }),
+        aborts,
       );
     }
 
@@ -2230,6 +2609,11 @@ export function createXStatePlaybookRuntime<TOptions>(
         | 'apply.finished',
       identity: Record<string, unknown>,
       position: TracePosition,
+      // The applicable combined signal: a start-sink rejection causally
+      // identical to its reason is the cancellation itself, not a control
+      // error — the pair finishes `aborted` and nothing latches
+      // (slc/link.md §Abort).
+      signal: AbortSignal,
       // Base payload of the best-effort finish emitted when the start sink
       // rejects; it defaults to the payload the start carried, which the
       // player, judge, and captain pairs take as-is. The apply pair cannot:
@@ -2241,13 +2625,13 @@ export function createXStatePlaybookRuntime<TOptions>(
       try {
         await emitTrace(startedType, identity, position);
       } catch (error) {
-        controlPlaneError ??= error;
+        if (!isAbortFailure(error, signal)) controlPlaneError ??= error;
         try {
           await emitTrace(
             finishedType,
             {
               ...finishIdentity,
-              status: 'error',
+              status: isAbortFailure(error, signal) ? 'aborted' : 'error',
               error: normalizeError(error),
             },
             position,
@@ -2260,25 +2644,31 @@ export function createXStatePlaybookRuntime<TOptions>(
     }
 
     const boundary: RuntimeBoundaryCalls = {
-      async callPlayer(input, playerId, prompt, signal): Promise<PlayerResult> {
+      async callPlayer(
+        input,
+        roleId,
+        prompt,
+        signal,
+      ): Promise<PlayerResult> {
         // State-entry telemetry/status must precede the call they describe.
         await drainEmissions();
         const turnId = activeTurnId;
         const stateId = input.stateId;
+        const playerId = resolvedPlayerId(roleId);
         let resume: string | false;
         try {
           signal.throwIfAborted();
-          resume = selectPlayerResume(playerId);
+          resume = selectPlayerResume(roleId, playerId);
         } catch (error) {
-          if (!signal.aborted) controlPlaneError ??= error;
+          if (!isAbortFailure(error, signal)) controlPlaneError ??= error;
           throw error;
         }
         const callId = `player-${++playerCallSequence}`;
         const identity = {
-          purpose: 'captain' as const,
           ...stateIdentity(stateId),
           sourceItem: input.sourceItem,
-          playerId,
+          roleId,
+          ...(playerId === undefined ? {} : { playerId }),
           resume,
         };
         const position: TracePosition = {
@@ -2286,15 +2676,17 @@ export function createXStatePlaybookRuntime<TOptions>(
           callId,
         };
 
-        if (activePlayerIds.has(playerId)) {
+        const playerKey = continuationKey(roleId, playerId);
+        if (activePlayerKeys.has(playerKey)) {
           const error = new Error(
-            `simultaneous calls to resolved player ${playerId} are not allowed`,
+            `simultaneous calls to player key ${playerKey} are not allowed`,
           );
           await emitCallStarted(
             'player.call.started',
             'player.call.finished',
             { ...identity, prompt },
             position,
+            signal,
           );
           await emitTrace(
             'player.call.finished',
@@ -2303,13 +2695,15 @@ export function createXStatePlaybookRuntime<TOptions>(
           );
           throw error;
         }
-        activePlayerIds.add(playerId);
+        activePlayerKeys.add(playerKey);
 
         try {
-          await emitTrace(
+          await emitCallStarted(
             'player.call.started',
+            'player.call.finished',
             { ...identity, prompt },
             position,
+            signal,
           );
 
           let rawResult: unknown;
@@ -2320,7 +2714,7 @@ export function createXStatePlaybookRuntime<TOptions>(
             // as `aborted` through the catch below.
             signal.throwIfAborted();
             rawResult = await requireHostPorts().callPlayer(
-              playerId,
+              roleId,
               prompt,
               signal,
               { resume },
@@ -2329,13 +2723,13 @@ export function createXStatePlaybookRuntime<TOptions>(
             // a late result mutate continuity or publish a successful finish.
             signal.throwIfAborted();
           } catch (error) {
-            if (!signal.aborted) controlPlaneError ??= error;
+            if (!isAbortFailure(error, signal)) controlPlaneError ??= error;
             try {
               await emitTrace(
                 'player.call.finished',
                 {
                   ...identity,
-                  status: signal.aborted ? 'aborted' : 'error',
+                  status: isAbortFailure(error, signal) ? 'aborted' : 'error',
                   error: normalizeError(error),
                 },
                 position,
@@ -2352,7 +2746,7 @@ export function createXStatePlaybookRuntime<TOptions>(
           try {
             result = validatePlayerResult(rawResult);
           } catch (error) {
-            if (!signal.aborted) controlPlaneError ??= error;
+            if (!isAbortFailure(error, signal)) controlPlaneError ??= error;
             try {
               await emitTrace(
                 'player.call.finished',
@@ -2366,15 +2760,9 @@ export function createXStatePlaybookRuntime<TOptions>(
           }
 
           try {
-            updatePlayerResume(
-              playerId,
-              typeof result.resumeToken === 'string' &&
-                result.resumeToken.trim().length > 0
-                ? result.resumeToken
-                : undefined,
-            );
+            updatePlayerResume(roleId, playerId, result);
           } catch (error) {
-            if (!signal.aborted) controlPlaneError ??= error;
+            if (!isAbortFailure(error, signal)) controlPlaneError ??= error;
             try {
               await emitTrace(
                 'player.call.finished',
@@ -2406,7 +2794,7 @@ export function createXStatePlaybookRuntime<TOptions>(
           );
           return result;
         } finally {
-          activePlayerIds.delete(playerId);
+          activePlayerKeys.delete(playerKey);
         }
       },
 
@@ -2430,6 +2818,7 @@ export function createXStatePlaybookRuntime<TOptions>(
             'judge.call.finished',
             { ...identity, prompt },
             position,
+            signal,
           );
           let reply: unknown;
           try {
@@ -2448,7 +2837,7 @@ export function createXStatePlaybookRuntime<TOptions>(
               'judge.call.finished',
               {
                 ...identity,
-                status: signal.aborted ? 'aborted' : 'error',
+                status: isAbortFailure(error, signal) ? 'aborted' : 'error',
                 error: normalizeError(error),
               },
               position,
@@ -2512,6 +2901,7 @@ export function createXStatePlaybookRuntime<TOptions>(
             'captain.call.finished',
             { ...identity, prompt },
             position,
+            signal,
           );
           let rawResult: unknown;
           try {
@@ -2534,7 +2924,7 @@ export function createXStatePlaybookRuntime<TOptions>(
               'captain.call.finished',
               {
                 ...identity,
-                status: signal.aborted ? 'aborted' : 'error',
+                status: isAbortFailure(error, signal) ? 'aborted' : 'error',
                 error: normalizeError(error),
               },
               position,
@@ -2611,19 +3001,13 @@ export function createXStatePlaybookRuntime<TOptions>(
       },
     };
 
-    function resolvePlayerId(input: PlaybookPlayerInput): string {
-      return resolvePlayerIdSpec
-        ? resolvePlayerIdSpec(input, boundOptions)
-        : defaultResolvePlayerId(input);
-    }
-
     function playerActor(
       ports: PlaybookPorts,
     ): PromiseActorLogic<PlaybookActorOutput, PlaybookPlayerInput> {
       return createPlayerBridge(
         {
-          resolvePlayerId,
-          composePlayerPrompt,
+          resolveRoleId: requireRoleId,
+          composePlayerPrompt: composeBoundPlayerPrompt,
           adjudication,
           resumableStateIds,
         },
@@ -2631,7 +3015,9 @@ export function createXStatePlaybookRuntime<TOptions>(
         () => activeSignal,
         boundary,
         (error) => {
-          if (!activeSignal?.aborted) controlPlaneError ??= error;
+          if (activeSignal === undefined || !isAbortFailure(error, activeSignal)) {
+            controlPlaneError ??= error;
+          }
         },
       );
     }
@@ -2717,7 +3103,7 @@ export function createXStatePlaybookRuntime<TOptions>(
             // failure state (PBRT-47); everything else here — a drained
             // emission failure, prompt composition, the port itself,
             // adjudication — is control plane.
-            if (!active.aborted && !isFsmResultFailure(error)) {
+            if (!isAbortFailure(error, active) && !isFsmResultFailure(error)) {
               controlPlaneError ??= error;
             }
             throw error;
@@ -2744,53 +3130,187 @@ export function createXStatePlaybookRuntime<TOptions>(
           const failedGuard = guards[1] ?? guards[0];
           const cwd = boundScriptCwd ?? process.cwd();
           const ports = runtimePorts ?? requireHostPorts();
-
-          const exitStatus = await new Promise<number>((resolve, reject) => {
-            let child: ReturnType<typeof spawn>;
-            try {
-              child = spawn('sh', ['-c', input.command], {
-                cwd,
-                stdio: 'ignore',
-              });
-            } catch (error) {
-              reject(error);
-              return;
-            }
-            const onAbort = (): void => {
-              child.kill('SIGTERM');
-              reject(active.reason ?? new Error('script aborted'));
-            };
-            if (active.aborted) {
-              onAbort();
-              return;
+          // slc/link.md §Script execution: an already-aborted turn spawns
+          // nothing, and the thrown signal reason keeps the rejection
+          // causally classified as the abort it is.
+          active.throwIfAborted();
+
+          // Abort ownership — the listener that terminates the group and
+          // the escalation timer — spans the whole invocation body, not
+          // just the spawn-to-close window: an abort landing during the
+          // post-exit emission tail must still kill surviving group
+          // members before the actor settles (slc/link.md §Script
+          // execution). One finally releases both.
+          let child: ReturnType<typeof spawn> | undefined;
+          let killTimer: ReturnType<typeof setTimeout> | undefined;
+          const signalGroup = (sig: NodeJS.Signals): void => {
+            if (child?.pid !== undefined) {
+              try {
+                process.kill(-child.pid, sig);
+              } catch {
+                // Confirmation belongs to the bounded liveness probe below:
+                // a failed signal can mean ESRCH, EPERM, or another fault.
+              }
             }
-            active.addEventListener('abort', onAbort, { once: true });
-            child.on('error', (error) => {
-              active.removeEventListener('abort', onAbort);
-              reject(error);
-            });
-            child.on('close', (code) => {
-              active.removeEventListener('abort', onAbort);
-              resolve(typeof code === 'number' ? code : 1);
-            });
-          });
+          };
+          // After a SIGKILL is posted, settlement waits for the group to
+          // stop being signalable — bounded by the same grace so an
+          // unreapable member outside the runtime's control cannot stall
+          // the turn forever. Observed teardown is milliseconds.
+          let groupGonePromise: Promise<void> | undefined;
+          const awaitGroupGone = (): Promise<void> => {
+            const pid = child?.pid;
+            if (pid === undefined) return Promise.resolve();
+            groupGonePromise ??= (async () => {
+              const teardownFailure = (
+                message: string,
+                cause?: unknown,
+              ): ScriptProcessGroupTeardownError => {
+                const failure = new ScriptProcessGroupTeardownError(
+                  pid,
+                  message,
+                  cause,
+                );
+                // A teardown failure is not an authored script result.
+                // Surface it at the active public boundary even though
+                // XState also routes the rejected actor through onError.
+                controlPlaneError ??= failure;
+                return failure;
+              };
+              const deadline = Date.now() + SCRIPT_ABORT_KILL_GRACE_MS;
+              let lastProbeError: unknown;
+              for (;;) {
+                try {
+                  process.kill(-pid, 0);
+                } catch (error) {
+                  if (isNoSuchProcess(error)) return;
+                  // EPERM confirms that at least one process in the group
+                  // still exists but is not signalable by this process. Keep
+                  // waiting for ESRCH within the bound; every other probe
+                  // error makes confirmation itself unreliable immediately.
+                  if (!isProcessPermissionDenied(error)) {
+                    throw teardownFailure(
+                      'the liveness probe failed',
+                      error,
+                    );
+                  }
+                  lastProbeError = error;
+                }
+                if (Date.now() >= deadline) {
+                  throw teardownFailure(
+                    `the group remained signalable after ${SCRIPT_ABORT_KILL_GRACE_MS}ms`,
+                    lastProbeError,
+                  );
+                }
+                await new Promise((tick) => setTimeout(tick, 5));
+              }
+            })();
+            return groupGonePromise;
+          };
+          const onAbort = (): void => {
+            signalGroup('SIGTERM');
+            killTimer = setTimeout(
+              () => signalGroup('SIGKILL'),
+              SCRIPT_ABORT_KILL_GRACE_MS,
+            );
+          };
+          // An abort observed once the shell has already exited rejects
+          // with the signal's reason before guard resolution and before
+          // starting any further script emission — after killing whatever
+          // group members outlived the shell. The shell's own exit ended
+          // the TERM grace's purpose, so escalation is immediate here.
+          const settleIfAborted = async (): Promise<void> => {
+            if (!active.aborted) return;
+            signalGroup('SIGKILL');
+            await awaitGroupGone();
+            active.throwIfAborted();
+          };
+          let invocationFailed = false;
+          try {
+            const exitStatus = await new Promise<number>(
+              (resolve, reject) => {
+                try {
+                  // detached: the shell leads its own POSIX process group,
+                  // so an abort can terminate the command's whole group — a
+                  // lone SIGTERM to the wrapper never reaches backgrounded
+                  // members.
+                  child = spawn('sh', ['-c', input.command], {
+                    cwd,
+                    stdio: 'ignore',
+                    detached: true,
+                  });
+                } catch (error) {
+                  reject(error);
+                  return;
+                }
+                // On abort, terminate the group and escalate — but settle
+                // only from 'close', after the shell itself has exited, so
+                // the turn never reports quiescence while the script still
+                // runs (slc/link.md §Abort). SIGKILL is untrappable, so
+                // 'close' is bounded by the grace.
+                active.addEventListener('abort', onAbort, { once: true });
+                child.on('error', (error) => {
+                  reject(error);
+                });
+                child.on('close', (code) => {
+                  if (active.aborted) {
+                    // The shell may exit cooperatively on the group SIGTERM
+                    // while a TERM-immune same-group descendant survives;
+                    // the group stays addressable while any member lives,
+                    // so kill it and await its disappearance before
+                    // settling (slc/link.md §Script execution).
+                    signalGroup('SIGKILL');
+                    void awaitGroupGone().then(
+                      () =>
+                        reject(active.reason),
+                      reject,
+                    );
+                    return;
+                  }
+                  resolve(typeof code === 'number' ? code : 1);
+                });
+              },
+            );
 
-          await ports.emitStatus(
-            `Executed script for ${input.stateId} (exit ${exitStatus}).`,
-          );
-          await ports.emitTelemetry({
-            topic: 'playbook.script',
-            payload: {
-              stateId: input.stateId,
-              sourceItem: input.sourceItem,
-              exitStatus,
-            },
-          });
+            await settleIfAborted();
+
+            await ports.emitStatus(
+              `Executed script for ${input.stateId} (exit ${exitStatus}).`,
+            );
+            await settleIfAborted();
+            await ports.emitTelemetry({
+              topic: 'playbook.script',
+              payload: {
+                stateId: input.stateId,
+                sourceItem: input.sourceItem,
+                exitStatus,
+              },
+            });
+            await settleIfAborted();
 
-          if (exitStatus === 0) {
-            return { guard: okGuard, exitStatus: 0 };
+            if (exitStatus === 0) {
+              return { guard: okGuard, exitStatus: 0 };
+            }
+            return { guard: failedGuard, exitStatus };
+          } catch (error) {
+            // Preserve the invocation's authoritative exact cancellation or
+            // distinct sink failure after teardown succeeds. The finally
+            // block may replace it only with a distinct teardown failure
+            // when the process group cannot be confirmed gone.
+            invocationFailed = true;
+            throw error;
+          } finally {
+            try {
+              if (active.aborted) {
+                signalGroup('SIGKILL');
+                await awaitGroupGone();
+                if (!invocationFailed) active.throwIfAborted();
+              }
+            } finally {
+              active.removeEventListener('abort', onAbort);
+              if (killTimer !== undefined) clearTimeout(killTimer);
+            }
           }
-          return { guard: failedGuard, exitStatus };
         },
       );
     }
@@ -2800,7 +3320,7 @@ export function createXStatePlaybookRuntime<TOptions>(
       getBoundarySignal: () => activeSignal,
       callPlaybook: (request, signal) =>
         requireHostPorts().callPlaybook(request, signal),
-      emitStarted: async (event) => {
+      emitStarted: async (event, aborts) => {
         playbookCallTurnIds.set(event.callId, activeTurnId);
         await emitTrace(
           'playbook.call.started',
@@ -2813,9 +3333,10 @@ export function createXStatePlaybookRuntime<TOptions>(
             ...(activeTurnId !== undefined ? { turnId: activeTurnId } : {}),
             callId: event.callId,
           },
+          aborts,
         );
       },
-      emitFinished: async (event) => {
+      emitFinished: async (event, aborts) => {
         const turnId = playbookCallTurnIds.get(event.callId);
         try {
           await emitTrace(
@@ -2830,20 +3351,35 @@ export function createXStatePlaybookRuntime<TOptions>(
               ...(turnId !== undefined ? { turnId } : {}),
               callId: event.callId,
             },
+            aborts,
           );
         } finally {
           playbookCallTurnIds.delete(event.callId);
         }
       },
       drain: drainEmissions,
-      bindResumeSignal: (signal) => {
+      bindResumeSignal: (signal, aborts) => {
         activeSignal = signal;
+        activeAborts = aborts ?? abortReasonClassifier(signal);
+      },
+      bindActorSettlement: (aborts) => {
+        actorSettlementAborts = aborts;
       },
-      onControlPlaneError: (error) => {
-        if (!activeSignal?.aborted) controlPlaneError ??= error;
+      onControlPlaneError: (error, aborts) => {
+        // The shared bridge classifies before reporting against its own
+        // invocation-and-resume signals; classify once more here against
+        // the boundary signal so a report that is the active boundary's
+        // exact abort reason can never masquerade as a control error
+        // (slc/link.md §Abort).
+        if (
+          !aborts?.isAbortReason(error) &&
+          !activeAborts?.isAbortReason(error)
+        ) {
+          controlPlaneError ??= error;
+        }
       },
-      onBackgroundError: (error) => {
-        emissionFailure ??= error;
+      onBackgroundError: (error, aborts) => {
+        if (!aborts?.isAbortReason(error)) emissionFailure ??= { error };
       },
     });
 
@@ -2864,11 +3400,9 @@ export function createXStatePlaybookRuntime<TOptions>(
         previousState: previousState ?? null,
         state,
       };
-      if (state.stateId === 'awaitBossReply') {
-        const pendingBossQuestion = pendingBossQuestionFromContext(context);
-        if (pendingBossQuestion !== undefined) {
-          payload.pendingBossQuestion = pendingBossQuestion;
-        }
+      const pendingBossQuestion = pendingBossQuestionForState(state, context);
+      if (pendingBossQuestion !== undefined) {
+        payload.pendingBossQuestion = pendingBossQuestion;
       }
       if (state.stateId === 'failed') {
         const lastError = normalizeErrorFull(context.lastError);
@@ -2882,6 +3416,7 @@ export function createXStatePlaybookRuntime<TOptions>(
       state: PlaybookState,
       statuses: readonly ScheduledStatus[],
       position: TracePosition,
+      aborts?: AbortReasonClassifier,
     ): void {
       const currentSession = requireSession();
       const transitionTrace = createTraceEvent(
@@ -2903,28 +3438,61 @@ export function createXStatePlaybookRuntime<TOptions>(
           position,
         ),
       }));
-      void enqueueEmission(async () => {
-        await currentSession.ports.emitTelemetry({
-          topic: 'playbook.trace',
-          payload: transitionTrace,
-        });
-        await currentSession.ports.emitTelemetry({
-          topic: 'playbook.fsm.state',
-          payload,
-        });
-        for (const status of statusEmissions) {
+      void enqueueEmission(
+        async () => {
           await currentSession.ports.emitTelemetry({
             topic: 'playbook.trace',
-            payload: status.trace,
+            payload: transitionTrace,
           });
-          await currentSession.ports.emitStatus(status.message, status.data);
-        }
-      }).catch(() => undefined);
+          await currentSession.ports.emitTelemetry({
+            topic: 'playbook.fsm.state',
+            payload,
+          });
+          for (const status of statusEmissions) {
+            await currentSession.ports.emitTelemetry({
+              topic: 'playbook.trace',
+              payload: status.trace,
+            });
+            await currentSession.ports.emitStatus(status.message, status.data);
+          }
+        },
+        aborts,
+      ).catch(() => undefined);
+    }
+
+    // One classifying latch for every runtime-observed error — inspection
+    // failures and root-actor errors alike. Outside a boundary the error
+    // rides the emission channel, which the next boundary's (or init's)
+    // drain throws; inside a boundary it is a control-plane error unless it
+    // is the boundary signal's own abort reason (slc/link.md §Abort).
+    function latchRuntimeError(
+      error: unknown,
+      aborts: AbortReasonClassifier | undefined = activeAborts,
+    ): void {
+      if (aborts?.isAbortReason(error)) return;
+      if (activeSignal === undefined) emissionFailure ??= { error };
+      else controlPlaneError ??= error;
     }
 
-    function latchInspectionError(error: unknown): void {
-      if (activeSignal !== undefined) controlPlaneError ??= error;
-      else emissionFailure ??= error;
+    function consumeActorSettlementAborts(
+      forSnapshot = false,
+    ): AbortReasonClassifier | undefined {
+      const aborts = actorSettlementAborts ?? actorSettlementErrorAborts;
+      actorSettlementAborts = undefined;
+      actorSettlementErrorAborts = undefined;
+      if (forSnapshot && aborts !== undefined) {
+        // XState can report an errored root through both its inspection
+        // snapshot and subscriber. Keep the same provenance through that
+        // synchronous notification only; an ordinary transition must not
+        // lend it to a later unrelated actor error.
+        actorSettlementErrorAborts = aborts;
+        queueMicrotask(() => {
+          if (actorSettlementErrorAborts === aborts) {
+            actorSettlementErrorAborts = undefined;
+          }
+        });
+      }
+      return aborts;
     }
 
     // PBRT-6: the single seam that stops this runtime's actor. Stopping a
@@ -2968,6 +3536,7 @@ export function createXStatePlaybookRuntime<TOptions>(
           if (inspectionEvent.type !== '@xstate.snapshot') return;
           if (inspectionEvent.actorRef !== builtActor) return;
           if (suppressInspectionEmissions) return;
+          const settlementAborts = consumeActorSettlementAborts(true);
           try {
             const snap = inspectionEvent.snapshot;
             const state = normalizePlaybookSnapshot(snap);
@@ -2995,13 +3564,25 @@ export function createXStatePlaybookRuntime<TOptions>(
               state,
               statuses,
               tracePositionForActiveTurn(),
+              settlementAborts,
             );
             priorState = state;
           } catch (error) {
-            latchInspectionError(error);
+            latchRuntimeError(error, settlementAborts);
           }
         },
       });
+      // A synchronously-errored actor is already quiescent, so the turn's
+      // quiescence wait never subscribes and XState would report the error
+      // as unhandled after the boundary returns. Observe it through the
+      // classifying latch: mid-boundary it is the control-plane error
+      // unless it is the abort reason itself; at startup it rides the
+      // emission channel so `init`'s own drain rejects with it and the
+      // failed-start cleanup runs (slc/link.md §Session lifecycle).
+      builtActor.subscribe({
+        error: (error) =>
+          latchRuntimeError(error, consumeActorSettlementAborts()),
+      });
       return builtActor;
     }
 
@@ -3024,14 +3605,20 @@ export function createXStatePlaybookRuntime<TOptions>(
         const output = (
           actor?.getSnapshot() as { output?: unknown } | undefined
         )?.output;
-        if (output !== undefined) {
-          return {
-            outcome,
-            state,
-            output: snapshotJsonValue(output, 'terminal playbook output'),
-          };
-        }
-        return { outcome, state };
+        const stateDescription = stateDescriptionFor(state);
+        return {
+          outcome,
+          state,
+          ...(stateDescription === undefined ? {} : { stateDescription }),
+          ...(output === undefined
+            ? {}
+            : {
+                output: snapshotJsonValue(
+                  output,
+                  'terminal playbook output',
+                ),
+              }),
+        };
       }
       const failure =
         error ??
@@ -3050,15 +3637,23 @@ export function createXStatePlaybookRuntime<TOptions>(
 
     function settledOutcome(signal: AbortSignal): BossSettlementOutcome {
       if (nestedBridge.getPendingCall()) return 'suspended';
-      if (signal.aborted) return 'aborted';
       const state = currentState();
       if (state.status === 'error') {
+        // An errored actor outranks a coincident abort unless the actor's
+        // error is the abort reason itself (slc/link.md §Abort).
         const actorError = (
           actor?.getSnapshot() as { error?: unknown } | undefined
         )?.error;
+        if (actorError !== undefined && isAbortFailure(actorError, signal)) {
+          return 'aborted';
+        }
         throw actorError ?? new Error(`${label} actor entered error status`);
       }
+      // Terminal completion outranks a coincident abort: the work finished,
+      // and reporting `aborted` would hide a terminal machine behind a
+      // settlement a later turn silently restarts (slc/link.md §Abort).
       if (state.status === 'done') return 'terminal';
+      if (signal.aborted) return 'aborted';
       if (state.stateId === 'failed') return 'failed';
       return 'quiescent';
     }
@@ -3123,8 +3718,8 @@ export function createXStatePlaybookRuntime<TOptions>(
           // The session-start error remains authoritative.
         }
       }
-      playerResumeTokens.clear();
-      activePlayerIds.clear();
+      privateResumeTokens.clear();
+      activePlayerKeys.clear();
       playbookCallTurnIds.clear();
       activeEmissionCalls.clear();
       emissionQueue.clear();
@@ -3135,6 +3730,10 @@ export function createXStatePlaybookRuntime<TOptions>(
       savedPorts = undefined;
       runtimePorts = undefined;
       activeSignal = undefined;
+      activeAborts = undefined;
+      actorSettlementAborts = undefined;
+      actorSettlementErrorAborts = undefined;
+      activeAbortEmission = undefined;
       activeTurnId = undefined;
       controlPlaneError = undefined;
       emissionFailure = undefined;
@@ -3170,32 +3769,57 @@ export function createXStatePlaybookRuntime<TOptions>(
       );
     }
 
+    // DR-034: where the artifact names the FSM context member its entry
+    // action copies the exact Boss text into, that member of the live
+    // snapshot is the retry payload's source. The persisted machine snapshot
+    // carries it, so the candidate derives identically in the process that
+    // exported the snapshot and in one that restored it, and a failure
+    // reached after a Boss reply — whose recorded event the failure state
+    // refuses — is recoverable too. Naming the member is the artifact's
+    // statement that it holds the entry text: a same-named member is never
+    // assumed, since inferring one would turn any matching context member
+    // into a replay payload without its author saying so.
+    // Declared and absent or empty excludes the candidate rather than
+    // falling back to the record, which would make the action depend on the
+    // process again — the very thing this source exists to end.
+    function retryEventFrom(snapshot: unknown): EventObject | undefined {
+      const entryEvent = spec.entryEvent;
+      if (entryEvent?.contextField === undefined) return lastBossEvent;
+      const context = (snapshot as { context?: unknown } | null)?.context;
+      const text = isPlainObject(context)
+        ? context[entryEvent.contextField]
+        : undefined;
+      if (typeof text !== 'string' || text.trim() === '') return undefined;
+      return { type: entryEvent.type, [entryEvent.textField]: text };
+    }
+
     // The failure-state retry entry replays the recorded last classified
-    // event with its recorded payload. A candidate whose event the live
-    // snapshot does not accept — or whose payload the runtime never
-    // recorded — is excluded rather than completed with invented text.
+    // event with its recorded payload, or the entry event the declared
+    // context member above sources. A candidate whose event the live
+    // snapshot does not accept — or whose payload the runtime can source
+    // from neither — is excluded rather than completed with invented text.
     function retryActionFor(
       snapshot: unknown,
       stateId: string | undefined,
     ): DerivedControlAction | undefined {
-      if (stateId !== 'failed' || lastBossEvent === undefined) {
-        return undefined;
-      }
-      if (!snapshotCan(snapshot, lastBossEvent)) return undefined;
+      if (stateId !== 'failed') return undefined;
+      const retryEvent = retryEventFrom(snapshot);
+      if (retryEvent === undefined) return undefined;
+      if (!snapshotCan(snapshot, retryEvent)) return undefined;
       // A recorded explicit-state-jump event names the exact state its
       // replay re-enters: the root BOSS_INTERRUPT shape is a guarded
       // multi-arm list keyed on `targetId`, so the first configured arm
       // may label a different state than the one the recorded event
       // actually resumes.
       const recordedTargetId =
-        lastBossEvent.type === JUMP_EVENT_TYPE
-          ? (lastBossEvent as { targetId?: unknown }).targetId
+        retryEvent.type === JUMP_EVENT_TYPE
+          ? (retryEvent as { targetId?: unknown }).targetId
           : undefined;
       const target =
         typeof recordedTargetId === 'string' &&
         recordedTargetId.trim().length > 0
           ? recordedTargetId
-          : firstTransitionTarget(machine, stateId, lastBossEvent.type);
+          : firstTransitionTarget(machine, stateId, retryEvent.type);
       // PBRT-52: a label is written from a source state description, never
       // from an identifier. Falling back to the target id — or, with no
       // resolvable target, to the FSM event type — makes the label *be* the
@@ -3209,10 +3833,10 @@ export function createXStatePlaybookRuntime<TOptions>(
       if (description === undefined) return undefined;
       return {
         action: {
-          id: `retry:${lastBossEvent.type}`,
+          id: `retry:${retryEvent.type}`,
           label: `Retry: ${description}`,
         },
-        event: lastBossEvent,
+        event: retryEvent,
       };
     }
 
@@ -3332,7 +3956,7 @@ export function createXStatePlaybookRuntime<TOptions>(
         if (initialized || disposed || disposalPromise !== undefined) {
           throw new Error('createPlaybookRuntime.init: already initialized');
         }
-        const boundSession = snapshotPlaybookSession(nextSession);
+        const boundSession = bindSession(nextSession);
         initialized = true;
         let finishInitialization!: () => void;
         const initialization = new Promise<void>((resolve) => {
@@ -3406,12 +4030,12 @@ export function createXStatePlaybookRuntime<TOptions>(
         );
         const context = (actor.getSnapshot() as { context?: unknown })
           .context as Record<string, unknown>;
-        const pending = pendingBossQuestionFromContext(context ?? {});
+        const pending = pendingBossQuestionForState(state, context ?? {});
         return {
-          schemaVersion: 2,
+          schemaVersion: 3,
           playbookId: session.playbookId,
           machine: machineSnapshot,
-          playerResumeTokens: snapshotPlayerResumeTokens(),
+          roleResumeTokens: snapshotRoleResumeTokens(),
           sequences: {
             trace: traceSequence,
             turn: turnSequence,
@@ -3429,7 +4053,7 @@ export function createXStatePlaybookRuntime<TOptions>(
               : [
                   {
                     questionId: pending.questionId,
-                    player: pending.player,
+                    asker: pending.asker,
                     question: pending.question,
                     sourceItem: pending.sourceItem,
                   },
@@ -3450,16 +4074,21 @@ export function createXStatePlaybookRuntime<TOptions>(
         if (initialized || disposed || disposalPromise !== undefined) {
           throw new Error('createPlaybookRuntime.restore: already initialized');
         }
-        const boundSession = snapshotPlaybookSession(nextSession);
+        const boundSession = bindSession(nextSession);
         const boundSnapshot = assertPlaybookRuntimeSnapshot(
           snapshot,
           boundSession.playbookId,
           { allowSuspendedCall: true },
         );
-        const suspendedCall =
-          boundSnapshot.schemaVersion === 2
-            ? boundSnapshot.suspendedCall
-            : undefined;
+        if (
+          declaredActors.has('captain') &&
+          boundSnapshot.sequences.captainCall === undefined
+        ) {
+          throw new TypeError(
+            'runtime snapshot sequences.captainCall is required for a direct-Captain artifact',
+          );
+        }
+        const suspendedCall = boundSnapshot.suspendedCall;
         let priorExternalPlayerTokens:
           | Readonly<Record<string, string>>
           | undefined;
@@ -3479,22 +4108,17 @@ export function createXStatePlaybookRuntime<TOptions>(
           judgeCallSequence = boundSnapshot.sequences.judgeCall;
           playerCallSequence = boundSnapshot.sequences.playerCall;
           playbookCallSequence = boundSnapshot.sequences.playbookCall;
-          captainCallSequence =
-            boundSnapshot.sequences.captainCall ??
-            // Legacy schema-v1 snapshots predate this dedicated counter.
-            // Every Captain call already consumed at least one trace number,
-            // so the global trace counter is a collision-safe id floor.
-            boundSnapshot.sequences.trace;
+          captainCallSequence = boundSnapshot.sequences.captainCall ?? 0;
           // The runtime snapshot carries no apply counter (PBRT-50); every
           // apply boundary consumed trace numbers, so the persisted trace
           // counter is a collision-safe id floor here too, keeping
           // `apply-<n>` call ids unique across restore.
           applyCallSequence = boundSnapshot.sequences.trace;
           if (boundSession.playerSessions) {
-            priorExternalPlayerTokens = snapshotPlayerResumeTokens();
+            priorExternalPlayerTokens = snapshotRoleResumeTokens();
             externalStoreRestoreAttempted = true;
           }
-          restorePlayerResumeTokens(boundSnapshot.playerResumeTokens);
+          restoreRoleResumeTokens(boundSnapshot.roleResumeTokens);
           nestedBridge.prepareRestore(suspendedCall);
           if (suspendedCall !== undefined) {
             playbookCallTurnIds.set(
@@ -3505,7 +4129,26 @@ export function createXStatePlaybookRuntime<TOptions>(
           suppressInspectionEmissions = true;
           actor = buildActor(runtimePorts, boundSnapshot.machine);
           actor.start();
-          if (controlPlaneError !== undefined) throw controlPlaneError;
+          // A start-time actor error rides the startup emission channel
+          // (latchRuntimeError); consume both latches here so the original
+          // error outranks the derived status check below.
+          {
+            const startupFailure = emissionFailure;
+            if (
+              controlPlaneError !== undefined ||
+              startupFailure !== undefined
+            ) {
+              const startupError =
+                controlPlaneError !== undefined
+                  ? controlPlaneError
+                  : startupFailure!.error;
+              controlPlaneError = undefined;
+              if (emissionFailure === startupFailure) {
+                emissionFailure = undefined;
+              }
+              throw startupError;
+            }
+          }
           const restoredState = normalizePlaybookSnapshot(
             actor.getSnapshot(),
             suspendedCall === undefined
@@ -3588,7 +4231,7 @@ export function createXStatePlaybookRuntime<TOptions>(
         const state = currentState();
         const context = ((snapshot as { context?: unknown }).context ??
           {}) as Record<string, unknown>;
-        const pending = pendingBossQuestionFromContext(context);
+        const pending = pendingBossQuestionForState(state, context);
         const lastError = normalizeErrorFull(context.lastError);
         const projectedContext = projectControlContext(context);
         const stateDescription = stateDescriptionFor(state);
@@ -3604,7 +4247,7 @@ export function createXStatePlaybookRuntime<TOptions>(
               : [
                   {
                     questionId: pending.questionId,
-                    player: pending.player,
+                    asker: pending.asker,
                     question: pending.question,
                     sourceItem: pending.sourceItem,
                   },
@@ -3676,6 +4319,8 @@ export function createXStatePlaybookRuntime<TOptions>(
         const position: TracePosition = { turnId, callId };
         activeTurnId = turnId;
         activeSignal = signal;
+        activeAborts = abortReasonClassifier(signal);
+        activeAbortEmission = undefined;
         controlPlaneError = undefined;
         // Every receipt variant is normalized and frozen where it is built,
         // inside the guarded region, so the recording step below cannot
@@ -3727,9 +4372,13 @@ export function createXStatePlaybookRuntime<TOptions>(
         // final for their key. Past publication such a failure is therefore
         // re-latched onto the emission channel, surfacing from the next
         // public boundary's drain, and `apply` still does not throw past
-        // acceptance (PBRT-52).
+        // acceptance (PBRT-52). A delivery rejection causally identical to
+        // this call's own abort reason evidences the cancellation and is
+        // dropped — never carried to a later unrelated boundary
+        // (slc/link.md §Abort).
         const latchDeliveryFailure = (error: unknown): void => {
-          emissionFailure ??= error;
+          if (isAbortFailure(error, signal)) return;
+          emissionFailure ??= { error };
         };
         try {
           try {
@@ -3756,6 +4405,7 @@ export function createXStatePlaybookRuntime<TOptions>(
               'apply.finished',
               identity,
               position,
+              signal,
               preAcceptanceFinish('apply.started trace sink rejected'),
             );
             // An abort may land while the awaited started emission drains
@@ -3846,6 +4496,10 @@ export function createXStatePlaybookRuntime<TOptions>(
           } catch (error) {
             settlementError = error;
           }
+          // Exact cancellation is not a control-plane latch, but after apply
+          // acceptance and before publication it is still settlement evidence
+          // and therefore folds into the owed failed receipt (DR-036 §4).
+          settlementError ??= activeAbortEmission;
           // Fold before the finish emission, the last point at which the
           // traced disposition and the returned one can still be made the
           // same value.
@@ -3884,6 +4538,8 @@ export function createXStatePlaybookRuntime<TOptions>(
           // wedge every later public boundary behind "another runtime turn
           // is active".
           activeSignal = undefined;
+          activeAborts = undefined;
+          activeAbortEmission = undefined;
           activeTurnId = undefined;
           controlPlaneError = undefined;
         }
@@ -3932,136 +4588,171 @@ export function createXStatePlaybookRuntime<TOptions>(
         const turnId = ++turnSequence;
         activeTurnId = turnId;
         activeSignal = signal;
+        activeAborts = abortReasonClassifier(signal);
+        activeAbortEmission = undefined;
         controlPlaneError = undefined;
         let result: PlaybookRunResult | undefined;
         let operationError: unknown;
+        // The boundary sentinel releases on every exit: a settlement defect
+        // past the drain — a snapshot normalization throw inside
+        // `runResultFor` included — must never wedge every later public
+        // boundary and `dispose` itself behind "another runtime turn is
+        // active". Mirrors the apply boundary's finally.
         try {
-          await emitTrace('boss.input.received', { text }, { turnId });
-          // 1. Map the Boss text to an FSM event: deterministic exact entry
-          //    where applicable (slc/link.md §Boss-event mapping), judge
-          //    classification otherwise.
-          let event: EventObject | undefined;
-          const trimmed = text.trim();
-          if (trimmed !== '') {
-            const snapshot = actor.getSnapshot();
-            const terminal = snapshot.status === 'done';
-            const stateId = normalizePlaybookSnapshot(snapshot).stateId;
-            if (
-              spec.entryEvent !== undefined &&
-              (stateId === 'ready' || terminal)
-            ) {
-              event = {
-                type: spec.entryEvent.type,
-                [spec.entryEvent.textField]: text,
-              };
-            } else {
-              event = await classifyBossText(
-                text,
-                runtimePorts!,
-                signal,
-                snapshot,
-                boundary,
-                boundOptions,
-              );
-            }
-            signal.throwIfAborted();
-          }
-          // Empty input, no-action classifier output, or invalid classifier
-          // output — nothing to send.
-          if (event === undefined) {
-            result = runResultFor('no-action');
-          } else {
-            // 2. Optional Captain-pane classification line: the bare FSM
-            //    event type, emitted before the FSM advances.
-            const statusLine = classificationStatus(event);
-            if (statusLine !== undefined) {
-              await runtimePorts!.emitStatus(statusLine);
-            }
+          try {
+            await emitTrace('boss.input.received', { text }, { turnId });
+            // Record the attempted input, then refuse a boundary that entered
+            // aborted before deterministic mapping or the classifier can
+            // perform host-visible work (DR-036 §5).
             signal.throwIfAborted();
-            // 3. A final actor cannot accept new events; reconstruct only
-            //    after classification produced a real event.
-            if (actor.getSnapshot().status === 'done') {
-              stopActor();
-              actor = buildActor(runtimePorts!);
-              // The replacement actor's snapshots are real state entries.
-              suppressInspectionEmissions = false;
-              actor.start();
+            // 1. Map the Boss text to an FSM event: deterministic exact entry
+            //    where applicable (slc/link.md §Boss-event mapping), judge
+            //    classification otherwise.
+            let event: EventObject | undefined;
+            const trimmed = text.trim();
+            if (trimmed !== '') {
+              const snapshot = actor.getSnapshot();
+              const terminal = snapshot.status === 'done';
+              const stateId = normalizePlaybookSnapshot(snapshot).stateId;
+              // PBRT-1 / slc/link.md §Boss-event mapping: the idle entry, the
+              // recoverable failure state, and the reconstructed terminal all
+              // accept exactly one ordinary textual entry event, so delivered
+              // text enters deterministically — no judge call to spend and no
+              // classifier whim to settle a restart as no action. Every other
+              // parked state — a reply wait or an authored mid-workflow
+              // checkpoint — classifies under its own Boss-event contracts.
+              if (
+                spec.entryEvent !== undefined &&
+                (stateId === 'ready' || stateId === 'failed' || terminal)
+              ) {
+                event = {
+                  type: spec.entryEvent.type,
+                  [spec.entryEvent.textField]: text,
+                };
+              } else {
+                event = await classifyBossText(
+                  text,
+                  runtimePorts!,
+                  signal,
+                  snapshot,
+                  boundary,
+                  boundOptions,
+                );
+              }
+              signal.throwIfAborted();
             }
-            // DR-029: keep the classified event with its recorded payload
-            // as the retry-replay source. Recording is sanitizing, not
-            // load-bearing: an override classifier's non-JSON-safe event is
-            // simply not recorded, and the turn proceeds unchanged.
-            try {
-              lastBossEvent = snapshotJsonValue(
-                event,
-                'recorded Boss event',
-              ) as unknown as EventObject;
-            } catch {
-              lastBossEvent = undefined;
+            // Empty input, no-action classifier output, or invalid classifier
+            // output — nothing to send.
+            if (event === undefined) {
+              result = runResultFor('no-action');
+            } else {
+              // 2. Optional Captain-pane classification line: the bare FSM
+              //    event type, emitted before the FSM advances.
+              const statusLine = classificationStatus(event);
+              if (statusLine !== undefined) {
+                await runtimePorts!.emitStatus(statusLine);
+              }
+              signal.throwIfAborted();
+              // 3. A final actor cannot accept new events; reconstruct only
+              //    after classification produced a real event.
+              if (actor.getSnapshot().status === 'done') {
+                stopActor();
+                actor = buildActor(runtimePorts!);
+                // The replacement actor's snapshots are real state entries.
+                suppressInspectionEmissions = false;
+                actor.start();
+              }
+              // DR-029: keep the classified event with its recorded payload
+              // as the retry-replay source. Recording is sanitizing, not
+              // load-bearing: an override classifier's non-JSON-safe event is
+              // simply not recorded, and the turn proceeds unchanged.
+              try {
+                lastBossEvent = snapshotJsonValue(
+                  event,
+                  'recorded Boss event',
+                ) as unknown as EventObject;
+              } catch {
+                lastBossEvent = undefined;
+              }
+              actor.send(event);
+              await waitForPlaybookQuiescence(actor, {
+                pendingCalls: nestedBridge,
+              });
+              if (controlPlaneError !== undefined) throw controlPlaneError;
+              result = runResultFor(settledOutcome(signal));
             }
-            actor.send(event);
-            await waitForPlaybookQuiescence(actor, {
-              pendingCalls: nestedBridge,
-            });
-            if (controlPlaneError !== undefined) throw controlPlaneError;
-            result = runResultFor(settledOutcome(signal));
+          } catch (error) {
+            operationError = error;
           }
-        } catch (error) {
-          operationError = error;
-        }
 
-        let drainError: unknown;
-        try {
-          await drainEmissions();
-        } catch (error) {
-          drainError = error;
-        }
-        const latchedControlError = controlPlaneError;
-        const primaryError =
-          latchedControlError ?? drainError ?? operationError;
-        const abortError =
-          latchedControlError === undefined &&
-          drainError === undefined &&
-          operationError !== undefined &&
-          isAbortFailure(operationError, signal);
-        const settlementResult =
-          primaryError === undefined
-            ? (result ?? runResultFor('no-action'))
-            : runResultFor(abortError ? 'aborted' : 'failed', primaryError);
-
-        let settlementEmissionError: unknown;
-        try {
-          await emitTrace(
-            'boss.input.settled',
-            settlementTracePayload(settlementResult),
-            { turnId },
-          );
-        } catch (error) {
-          settlementEmissionError = error;
-        }
-        try {
-          await drainEmissions();
-        } catch (error) {
-          settlementEmissionError ??= error;
-        }
-        const failure =
-          controlPlaneError ??
-          latchedControlError ??
-          drainError ??
-          (abortError
-            ? (settlementEmissionError ?? operationError)
-            : (operationError ?? settlementEmissionError));
-        activeSignal = undefined;
-        activeTurnId = undefined;
-        controlPlaneError = undefined;
+          let drainError: unknown;
+          try {
+            await drainEmissions();
+          } catch (error) {
+            drainError = error;
+          }
+          const latchedControlError = controlPlaneError;
+          // A drain rejection that is the exact abort reason evidences the
+          // cancellation, not a control-plane failure (slc/link.md §Abort).
+          const drainAbort =
+            drainError !== undefined && isAbortFailure(drainError, signal);
+          const effectiveDrainError = drainAbort ? undefined : drainError;
+          const primaryError =
+            latchedControlError ?? effectiveDrainError ?? operationError;
+          const abortError =
+            latchedControlError === undefined &&
+            effectiveDrainError === undefined &&
+            ((operationError !== undefined &&
+              isAbortFailure(operationError, signal)) ||
+              (drainAbort && operationError === undefined));
+          const settlementResult =
+            primaryError === undefined
+              ? (result ?? runResultFor('no-action'))
+              : runResultFor(abortError ? 'aborted' : 'failed', primaryError);
+
+          let settlementEmissionError: unknown;
+          try {
+            await emitTrace(
+              'boss.input.settled',
+              settlementTracePayload(settlementResult),
+              { turnId },
+            );
+          } catch (error) {
+            settlementEmissionError = error;
+          }
+          try {
+            await drainEmissions();
+          } catch (error) {
+            settlementEmissionError ??= error;
+          }
+          if (
+            settlementEmissionError !== undefined &&
+            isAbortFailure(settlementEmissionError, signal)
+          ) {
+            settlementEmissionError = undefined;
+          }
+          const failure =
+            controlPlaneError ??
+            latchedControlError ??
+            effectiveDrainError ??
+            (abortError
+              ? (settlementEmissionError ?? operationError)
+              : (operationError ?? settlementEmissionError));
 
-        if (
-          failure !== undefined &&
-          !(abortError && settlementEmissionError === undefined)
-        ) {
-          throw failure;
+          if (
+            failure !== undefined &&
+            !(abortError && settlementEmissionError === undefined)
+          ) {
+            throw failure;
+          }
+          return settlementResult;
+        } finally {
+          activeSignal = undefined;
+          activeAborts = undefined;
+          activeAbortEmission = undefined;
+          activeTurnId = undefined;
+          controlPlaneError = undefined;
         }
-        return settlementResult;
       },
 
       async resumePlaybookCall(input: {
@@ -4086,37 +4777,88 @@ export function createXStatePlaybookRuntime<TOptions>(
         }
         activeTurnId = playbookCallTurnIds.get(input.callId);
         activeSignal = input.signal;
+        activeAborts = abortReasonClassifier(input.signal);
+        activeAbortEmission = undefined;
         controlPlaneError = undefined;
-        let result: PlaybookRunResult | undefined;
-        let operationError: unknown;
-        try {
-          await nestedBridge.resume(input);
-        } catch (error) {
-          operationError = error;
-        }
+        // The boundary sentinel releases on every exit, mirroring
+        // `handleBossInput` and the apply boundary.
         try {
-          await waitForPlaybookQuiescence(actor, {
-            pendingCalls: nestedBridge,
-          });
-          result = runResultFor(settledOutcome(input.signal));
-        } catch (error) {
-          operationError ??= error;
-        }
-        let drainError: unknown;
-        try {
-          await drainEmissions();
-        } catch (error) {
-          drainError = error;
-        }
-        const failure = controlPlaneError ?? drainError ?? operationError;
-        activeSignal = undefined;
-        activeTurnId = undefined;
-        controlPlaneError = undefined;
-        if (failure !== undefined) throw failure;
-        if (result === undefined) {
-          throw new Error('playbook resume produced no runtime result');
+          let result: PlaybookRunResult | undefined;
+          let operationError: unknown;
+          try {
+            await nestedBridge.resume(input);
+          } catch (error) {
+            operationError = error;
+          }
+          try {
+            await waitForPlaybookQuiescence(actor, {
+              pendingCalls: nestedBridge,
+            });
+            result = runResultFor(settledOutcome(input.signal));
+          } catch (error) {
+            operationError ??= error;
+          }
+          // A resume refused because its signal was already aborted
+          // delivers nothing: the pending call survives for a later
+          // resume, and the boundary settles `aborted` rather than
+          // advertising `suspended` (slc/link.md §Nested playbook bridge).
+          if (
+            operationError !== undefined &&
+            isAbortFailure(operationError, input.signal) &&
+            nestedBridge.getPendingCall()?.callId === input.callId
+          ) {
+            result = {
+              outcome: 'aborted',
+              state: currentState(),
+              error: normalizeError(input.signal.reason),
+            };
+          }
+          let drainError: unknown;
+          try {
+            await drainEmissions();
+          } catch (error) {
+            drainError = error;
+          }
+          const aborts = activeAborts ?? abortReasonClassifier(input.signal);
+          // A control-plane latch has already classified its failure as
+          // distinct under the owning operation. Never reinterpret it
+          // against this later resume signal (DR-036 decision 2).
+          const controlFailure = controlPlaneError;
+          const drainAbort =
+            controlFailure === undefined &&
+            drainError !== undefined &&
+            aborts.isAbortReason(drainError);
+          const operationAbort =
+            controlFailure === undefined &&
+            operationError !== undefined &&
+            aborts.isAbortReason(operationError);
+          const abortEvidence =
+            activeAbortEmission ??
+            (drainAbort ? drainError : undefined) ??
+            (operationAbort ? operationError : undefined);
+          const failure =
+            controlFailure ??
+            (drainAbort ? undefined : drainError) ??
+            (operationAbort ? undefined : operationError);
+          if (failure !== undefined) throw failure;
+          if (
+            abortEvidence !== undefined &&
+            result?.outcome !== 'terminal' &&
+            result?.outcome !== 'suspended'
+          ) {
+            result = runResultFor('aborted', abortEvidence);
+          }
+          if (result === undefined) {
+            throw new Error('playbook resume produced no runtime result');
+          }
+          return result;
+        } finally {
+          activeSignal = undefined;
+          activeAborts = undefined;
+          activeAbortEmission = undefined;
+          activeTurnId = undefined;
+          controlPlaneError = undefined;
         }
-        return result;
       },
 
       dispose(): Promise<void> {
@@ -4176,9 +4918,9 @@ export function createXStatePlaybookRuntime<TOptions>(
             // engagement tree. Child disposal must not erase a token its
             // caller will resume. The private fallback remains runtime-owned.
             if (session?.playerSessions === undefined) {
-              playerResumeTokens.clear();
+              privateResumeTokens.clear();
             }
-            activePlayerIds.clear();
+            activePlayerKeys.clear();
             playbookCallTurnIds.clear();
             activeEmissionCalls.clear();
             emissionQueue.clear();
@@ -4186,6 +4928,10 @@ export function createXStatePlaybookRuntime<TOptions>(
             appliedReceipts.clear();
             actor = undefined;
             activeSignal = undefined;
+            activeAborts = undefined;
+            actorSettlementAborts = undefined;
+            actorSettlementErrorAborts = undefined;
+            activeAbortEmission = undefined;
             activeTurnId = undefined;
             controlPlaneError = undefined;
             emissionFailure = undefined;