@sublang/playbook 8.0.0 → 10.0.0

package/src/xstate-playbook-runtime.js

@@ -5,7 +5,8 @@
 // machinery that slc/link.md previously regenerated inside every linked
 // `<name>.playbook.ts` artifact — actor wiring, boundary tracing, judge
 // classification/adjudication, script execution, nested-playbook bridging,
-// Boss-reply suspension, snapshot/restore, and disposal — lives here once.
+// Boss-reply suspension, snapshot restore/adoption, and disposal — lives here
+// once.
 // A linked artifact supplies only its per-workflow `spec` (options
 // validation and any strategy overrides) and its own FSM; the factory
 // interprets the FSM data the artifact already carries.
@@ -15,9 +16,12 @@
 // its behavior tests are the equivalence proof. Do not change observable
 // behavior here without consulting those suites.
 import { spawn } from 'node:child_process';
+import { randomUUID } from 'node:crypto';
+import { isDeepStrictEqual } from 'node:util';
 import PQueue from 'p-queue';
 import { createActor, fromPromise } from 'xstate';
-import { assertPlaybookRuntimeSnapshot, combineAbortSignals, createNestedPlaybookBridge, detachPersistedMachineSnapshot, normalizeError, normalizePlaybookSnapshot, snapshotJsonValue, snapshotPlaybookSession, validateCaptainResult, validatePlayerResult, waitForPlaybookQuiescence, } from './xstate-runtime.js';
+import { createAcceptedOutcomeConsumer, } from './accepted-outcome.js';
+import { assertPlaybookRuntimeSnapshot, assertPlaybookEffectLedger, combineAbortSignals, createNestedPlaybookBridge, detachPersistedMachineSnapshot, normalizeError, normalizePlaybookSnapshot, snapshotJsonValue, snapshotPlaybookSession, isPlaybookEffectLedgerMonotonicExtension, PlaybookSemanticCandidateStructureError, reconcilePlaybookSemanticEvidence, validateCaptainResult, validatePlayerResult, waitForPlaybookQuiescence, } from './xstate-runtime.js';
 export const BOSS_REPLY_ERRORS = {
     missingQuestion: "needsBossReply outcome missing 'question' field",
     unregisteredState: (stateId) => `state ${stateId} declared needsBossReply but is not registered as resumable`,
@@ -56,6 +60,95 @@ function isEmptyFinalText(finalText) {
     return finalText === undefined || finalText.trim().length === 0;
 }
 const emptyOkRetryFailures = new WeakSet();
+const HOST_CAPABILITIES_OPTION_KEY = 'hostCapabilities';
+const UNRESOLVED_EFFECT_RECONCILIATION_ACTION_ID = 'reconcile:unresolved-effect';
+const UNRESOLVED_EFFECT_ABANDONMENT_ACTION_ID = 'abandon:unresolved-effect';
+function deferredValue() {
+    let resolve;
+    let reject;
+    const promise = new Promise((resolvePromise, rejectPromise) => {
+        resolve = resolvePromise;
+        reject = rejectPromise;
+    });
+    return { promise, resolve, reject };
+}
+function assertNoConfiguredHostCapabilities(value, label) {
+    if (value !== null &&
+        typeof value === 'object' &&
+        Object.prototype.hasOwnProperty.call(value, HOST_CAPABILITIES_OPTION_KEY)) {
+        throw new TypeError(`${label} configured options must not contain hostCapabilities`);
+    }
+}
+function configuredOptionsFromFactoryInput(value, label) {
+    if (value === null ||
+        typeof value !== 'object' ||
+        Array.isArray(value) ||
+        (Object.getPrototypeOf(value) !== Object.prototype &&
+            Object.getPrototypeOf(value) !== null)) {
+        throw new TypeError(`${label} schema-3 factory input must be a plain object`);
+    }
+    const descriptors = Object.getOwnPropertyDescriptors(value);
+    const keys = Reflect.ownKeys(value);
+    if (keys.length !== 2 ||
+        !keys.includes('configuredOptions') ||
+        !keys.includes(HOST_CAPABILITIES_OPTION_KEY) ||
+        keys.some((key) => {
+            const descriptor = descriptors[key];
+            return (descriptor?.get !== undefined ||
+                descriptor?.set !== undefined ||
+                descriptor?.enumerable !== true ||
+                !Object.prototype.hasOwnProperty.call(descriptor, 'value'));
+        })) {
+        throw new TypeError(`${label} schema-3 factory input must contain exactly configuredOptions and hostCapabilities data properties`);
+    }
+    const hostCapabilities = descriptors.hostCapabilities.value;
+    if (hostCapabilities === null ||
+        typeof hostCapabilities !== 'object' ||
+        Array.isArray(hostCapabilities)) {
+        throw new TypeError(`${label} schema-3 factory input hostCapabilities must be a live object`);
+    }
+    const configuredOptions = descriptors.configuredOptions.value;
+    assertNoConfiguredHostCapabilities(configuredOptions, label);
+    const ledgerDescriptor = Object.getOwnPropertyDescriptor(hostCapabilities, 'effectLedger');
+    if (ledgerDescriptor === undefined ||
+        !Object.prototype.hasOwnProperty.call(ledgerDescriptor, 'value') ||
+        ledgerDescriptor.get !== undefined ||
+        ledgerDescriptor.set !== undefined) {
+        throw new TypeError(`${label} schema-3 factory input hostCapabilities.effectLedger must be an own data property`);
+    }
+    const effectLedger = ledgerDescriptor.value;
+    if (effectLedger === null ||
+        typeof effectLedger !== 'object' ||
+        Array.isArray(effectLedger) ||
+        typeof effectLedger.snapshot !== 'function' ||
+        typeof effectLedger.writeAhead !== 'function') {
+        throw new TypeError(`${label} schema-3 factory input hostCapabilities.effectLedger must expose snapshot and writeAhead functions`);
+    }
+    return {
+        configuredOptions,
+        hostCapabilities,
+        effectLedger: effectLedger,
+    };
+}
+function repositoryCapabilityFromHostCapabilities(hostCapabilities, label) {
+    const descriptor = hostCapabilities === undefined
+        ? undefined
+        : Object.getOwnPropertyDescriptor(hostCapabilities, 'repository');
+    const repository = descriptor?.value;
+    if (descriptor === undefined ||
+        !Object.prototype.hasOwnProperty.call(descriptor, 'value') ||
+        descriptor.get !== undefined ||
+        descriptor.set !== undefined ||
+        repository === null ||
+        typeof repository !== 'object' ||
+        Array.isArray(repository) ||
+        typeof repository.runExclusive !==
+            'function' ||
+        typeof repository.runDeferred !== 'function') {
+        throw new TypeError(`${label} schema-3 factory input hostCapabilities.repository must be an own data property exposing runExclusive and runDeferred`);
+    }
+    return repository;
+}
 function markEmptyOkRetryFailure(error) {
     emptyOkRetryFailures.add(error);
     return error;
@@ -78,7 +171,7 @@ function isEmptyOkRetryFailure(error) {
 export const RUNTIME_ABI = 1;
 /** The linked-artifact schema versions this engine accepts (DR-022). */
 export const SUPPORTED_ARTIFACT_SCHEMAS = Object.freeze([
-    2,
+    3,
 ]);
 // PBRT-50: validate a declaration against the loaded engine, schema first,
 // so one clear diagnostic covers a fully skewed artifact. Declaration-free
@@ -106,6 +199,7 @@ function assertRuntimeCompat(compat, label) {
         throw new TypeError(`${label} artifact declares runtime ABI ${runtimeAbi}, but this ` +
             `@sublang/playbook/xstate-runtime engine implements ${RUNTIME_ABI}`);
     }
+    return artifactSchema;
 }
 // ---------------------------------------------------------------------------
 // Tolerant judge-JSON recovery (slc/link.md §Boss-event mapping).
@@ -233,9 +327,37 @@ export function normalizeErrorFull(err) {
         return undefined;
     return normalizeError(err);
 }
+// slc/link.md §Abort: cancellation is causal identity with the applicable
+// signal's reason — never an `AbortError` name, never bare signal state. A
+// distinct failure observed while the signal is aborted stays a non-abort
+// control error and takes precedence (mirrors DECIDE's bespoke reference).
 function isAbortFailure(error, signal) {
-    return (signal.aborted &&
-        (error === signal.reason || normalizeError(error).name === 'AbortError'));
+    return signal.aborted && Object.is(error, signal.reason);
+}
+function abortReasonClassifier(...sources) {
+    const captured = sources.filter((source) => source !== undefined);
+    return Object.freeze({
+        isAbortReason: (error) => captured.some((source) => source instanceof AbortSignal
+            ? isAbortFailure(error, source)
+            : source.isAbortReason(error)),
+    });
+}
+/**
+ * gears2fsm's canonical Boss-reply wait state. On the runtime's Boss-facing
+ * surfaces — state telemetry, status lines, the exported snapshot, and the
+ * control view — a context question counts as *pending* only while the
+ * machine sits in this state awaiting the reply. Later states retain the
+ * answered question in context (the resumed player prompt is composed from
+ * it), so an unconditional projection would resurrect it: a failure the
+ * resumed player reached would export a question nobody is waiting on,
+ * disagreeing with the gated telemetry a mirroring host's ledger follows
+ * and failing the shell's snapshot-equality settlement check.
+ */
+const BOSS_REPLY_WAIT_STATE_ID = 'awaitBossReply';
+function pendingBossQuestionForState(state, context) {
+    if (state.stateId !== BOSS_REPLY_WAIT_STATE_ID)
+        return undefined;
+    return pendingBossQuestionFromContext(context);
 }
 /** Read the FSM context's single pending Boss question, when well-formed. */
 export function pendingBossQuestionFromContext(context) {
@@ -333,6 +455,97 @@ function sortJson(value) {
 function stableJson(value, path) {
     return JSON.stringify(sortJson(snapshotJsonValue(value, path)));
 }
+// DR-040 task 8: a retained checkpoint authorizes adoption without a replay
+// fence only when the authoritative ledger preserves the checkpoint exactly,
+// has made no deferred-operation progress, and every later physical boundary
+// is complete and proves `unchanged`. This is intentionally the same
+// fail-closed shape as uncertain whole-turn replay.
+function retainedAdoptionCheckpointIsSafe(checkpoint, current) {
+    if (checkpoint.boundaries.some(({ physicalReceipt }) => physicalReceipt === undefined)) {
+        return false;
+    }
+    if (!isPlaybookEffectLedgerMonotonicExtension(checkpoint, current)) {
+        return false;
+    }
+    if (!isDeepStrictEqual(current.boundaries.slice(0, checkpoint.boundaries.length), checkpoint.boundaries) ||
+        !isDeepStrictEqual(current.logicalOperations, checkpoint.logicalOperations)) {
+        return false;
+    }
+    return current.boundaries
+        .slice(checkpoint.boundaries.length)
+        .every(({ physicalReceipt }) => physicalReceipt?.classification === 'unchanged');
+}
+const RETAINED_EFFECT_SESSION_ID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;
+function requireAdoptionIdentity(value, path) {
+    if (typeof value !== 'string' || value.trim().length === 0) {
+        throw new TypeError(`${path} must be a non-empty string`);
+    }
+    return value;
+}
+// DR-038 §5: capture the host-owned source lineage before adoption binds
+// anything. The retained stack already carries both identities: a frame's
+// sessionId names its source runtime, while the common rootSessionId names the
+// retained generation. A suspended parent also needs the host's freshly
+// allocated target child id so its bridge can be re-keyed without leaking a
+// source-session id into the new engagement.
+function snapshotAdoptionContext(value, targetSession, sourceSnapshot) {
+    const captured = snapshotJsonValue(value, 'playbook adoption context');
+    if (captured === null ||
+        Array.isArray(captured) ||
+        typeof captured !== 'object') {
+        throw new TypeError('playbook adoption context must be an object');
+    }
+    const fields = captured;
+    const hasSuspendedCall = sourceSnapshot.suspendedCall !== undefined;
+    const expectedKeys = [
+        'sourceGenerationId',
+        'sourceSessionId',
+        ...(hasSuspendedCall ? ['targetChildSessionId'] : []),
+    ].sort();
+    const actualKeys = Object.keys(fields).sort();
+    if (actualKeys.length !== expectedKeys.length ||
+        actualKeys.some((key, index) => key !== expectedKeys[index])) {
+        throw new TypeError(`playbook adoption context must contain exactly ${expectedKeys.join(', ')}`);
+    }
+    const sourceSessionId = requireAdoptionIdentity(fields.sourceSessionId, 'playbook adoption context sourceSessionId');
+    const sourceGenerationId = requireAdoptionIdentity(fields.sourceGenerationId, 'playbook adoption context sourceGenerationId');
+    const sourceIsRoot = sourceSessionId === sourceGenerationId;
+    if ((targetSession.depth === 0) !== sourceIsRoot) {
+        throw new TypeError('playbook adoption context source identities do not match the target frame depth');
+    }
+    const targetChildSessionId = hasSuspendedCall
+        ? requireAdoptionIdentity(fields.targetChildSessionId, 'playbook adoption context targetChildSessionId')
+        : undefined;
+    const sourceIds = new Set([
+        sourceSessionId,
+        sourceGenerationId,
+        ...(sourceSnapshot.suspendedCall === undefined
+            ? []
+            : [sourceSnapshot.suspendedCall.childSessionId]),
+    ]);
+    const targetIds = [
+        targetSession.sessionId,
+        targetSession.rootSessionId,
+        ...(targetSession.parentSessionId === undefined
+            ? []
+            : [targetSession.parentSessionId]),
+        ...(targetChildSessionId === undefined ? [] : [targetChildSessionId]),
+    ];
+    if (targetIds.some((identity) => sourceIds.has(identity))) {
+        throw new TypeError('playbook adoption target identities must be fresh from the source generation');
+    }
+    if (targetChildSessionId !== undefined &&
+        (targetChildSessionId === targetSession.sessionId ||
+            targetChildSessionId === targetSession.rootSessionId ||
+            targetChildSessionId === targetSession.parentSessionId)) {
+        throw new TypeError('playbook adoption targetChildSessionId must name a fresh child frame');
+    }
+    return Object.freeze({
+        sourceSessionId,
+        sourceGenerationId,
+        ...(targetChildSessionId === undefined ? {} : { targetChildSessionId }),
+    });
+}
 /**
  * Default direct-Captain prompt composer (slc/link.md §Captain prompt
  * composition). Placeholder substitution is presence-based: string fields
@@ -402,6 +615,43 @@ export function defaultBuildJudgePrompt(input, finalText) {
     }
     return lines.join('\n');
 }
+function buildGovernedJudgePrompt(input, finalText, outcomes, correction) {
+    const lines = [
+        'This is hidden control work. Do not call tools, inspect files, or seek external evidence.',
+        'Decide only from the supplied player output and declared outcomes.',
+        'Reply with exactly one JSON object and no prose.',
+        '',
+        `The ${input.role} role just produced this output:`,
+        '',
+        '```',
+        finalText,
+        '```',
+        '',
+        'Pick exactly one declared `guard`. Include every semantic-owned field for that guard and no other field.',
+        'Do not include presentation-, effect-, or runtime-owned fields; the runtime supplies those from their authoritative evidence.',
+        '',
+    ];
+    for (const [guard, description] of Object.entries(input.result)) {
+        const semanticFields = Object.entries(outcomes[guard]?.fields ?? {})
+            .filter(([, authority]) => authority === 'semantic')
+            .map(([field]) => field);
+        lines.push(`- \`${guard}\` — semantic fields: ${semanticFields.length === 0
+            ? '(none)'
+            : semanticFields.map((field) => `\`${field}\``).join(', ')}; ${description}`);
+    }
+    if (correction !== undefined) {
+        lines.push('', 'Your first reply was structurally invalid:', '', '```', correction.reply, '```', '', `Validation error: ${correction.error}`, 'Correct only that structure using the same player output and outcome schema.');
+    }
+    return lines.join('\n');
+}
+function parseGovernedSemanticCandidate(raw) {
+    try {
+        return parseJudgeJson(raw);
+    }
+    catch (error) {
+        throw new PlaybookSemanticCandidateStructureError(error instanceof Error ? error.message : 'reply is not valid JSON');
+    }
+}
 const NO_VERBATIM_FIELDS = new Set();
 /**
  * LLM-judge adjudicator for delegated players. Coerces the player's
@@ -434,7 +684,12 @@ export async function adjudicatePlayerOutput(spec, input, finalText, ports, sign
     const verbatim = finalText.trim();
     for (const field of extractFields(input.result[guard])) {
         if (verbatimFields.has(field)) {
-            obj[field] = verbatim;
+            Object.defineProperty(obj, field, {
+                value: verbatim,
+                enumerable: true,
+                configurable: true,
+                writable: true,
+            });
             continue;
         }
         if (typeof obj[field] !== 'string') {
@@ -462,18 +717,23 @@ export function createPlayerBridge(spec, ports, getActiveSignal, boundary, onCon
         let roleId;
         let prompt;
         try {
+            spec.validateInput?.(input);
             roleId = spec.resolveRoleId(input);
             prompt = spec.composePlayerPrompt(input);
         }
         catch (error) {
-            onControlPlaneError?.(error);
+            if (!isAbortFailure(error, activeSignal)) {
+                onControlPlaneError?.(error);
+            }
             throw error;
         }
         const callPlayer = (resume) => boundary
             ? boundary.callPlayer(input, roleId, prompt, activeSignal)
             : ports.callPlayer(roleId, prompt, activeSignal, { resume });
         let result = await callPlayer(false);
-        if (result.status === 'ok' && isEmptyFinalText(result.finalText)) {
+        if (result.status === 'ok' &&
+            isEmptyFinalText(result.finalText) &&
+            (spec.allowsCorrectiveReplay?.(result) ?? true)) {
             // An abort that lands between the empty first result and the
             // corrective call ends the turn as ordinary abort settlement with
             // no second host call — aborts are never retried (DR-028 via
@@ -501,12 +761,22 @@ export function createPlayerBridge(spec, ports, getActiveSignal, boundary, onCon
             throw new Error('captainBridge: callPlayer returned status=ok with no finalText');
         }
         try {
-            const output = await adjudicatePlayerOutput(spec.adjudication, input, finalText, ports, activeSignal, boundary);
+            const governed = boundary?.takeGovernedPlayerOutput?.(result);
+            if (governed?.status === 'unresolved') {
+                throw governed.error;
+            }
+            const output = governed?.status === 'resolved'
+                ? governed.output
+                : await adjudicatePlayerOutput(spec.adjudication, input, finalText, ports, activeSignal, boundary);
+            boundary?.recordGovernedPlayerOutput?.(result, output);
             validateBossReplyOutput(input, output, spec.resumableStateIds);
             return output;
         }
         catch (error) {
-            onControlPlaneError?.(error);
+            if (!isAbortFailure(error, activeSignal) &&
+                !isFsmResultFailure(error)) {
+                onControlPlaneError?.(error);
+            }
             throw error;
         }
     });
@@ -670,7 +940,7 @@ export function resumableStateIdsFromMachine(machine) {
     if (!isPlainObject(config) || !isPlainObject(config.states)) {
         return new Set();
     }
-    const awaitState = config.states.awaitBossReply;
+    const awaitState = config.states[BOSS_REPLY_WAIT_STATE_ID];
     if (!isPlainObject(awaitState) || !isPlainObject(awaitState.on)) {
         return new Set();
     }
@@ -772,6 +1042,28 @@ function deepFreeze(value) {
 // Default transition/status derivation.
 // ---------------------------------------------------------------------------
 const SUPPRESSED_ENTRY_STATES = new Set(['ready', 'done']);
+// Bounded escalation for aborted script process groups: SIGTERM first, then
+// SIGKILL after this grace, so settlement (gated on the shell's own exit)
+// stays bounded even for TERM-immune commands.
+const SCRIPT_ABORT_KILL_GRACE_MS = 2000;
+class ScriptProcessGroupTeardownError extends Error {
+    constructor(pid, message, cause) {
+        super(`script process group ${pid} teardown could not be confirmed: ${message}`, cause === undefined ? undefined : { cause });
+        this.name = 'ScriptProcessGroupTeardownError';
+    }
+}
+function isNoSuchProcess(error) {
+    return (typeof error === 'object' &&
+        error !== null &&
+        'code' in error &&
+        error.code === 'ESRCH');
+}
+function isProcessPermissionDenied(error) {
+    return (typeof error === 'object' &&
+        error !== null &&
+        'code' in error &&
+        error.code === 'EPERM');
+}
 function makeDefaultNormalizeTransitionEvent(transitionEventFields) {
     return (event) => {
         if (event === null || typeof event !== 'object') {
@@ -796,7 +1088,7 @@ function makeDefaultNormalizeTransitionEvent(transitionEventFields) {
 }
 function snapshotRoleStateStatuses(value, label, machine, stateDescriptions) {
     if (value === undefined) {
-        throw new TypeError(`${label} roleStates must be supplied for schema 2`);
+        throw new TypeError(`${label} roleStates must be supplied for schema 3`);
     }
     const captured = snapshotJsonValue(value, `${label} roleStates`);
     if (!isPlainObject(captured)) {
@@ -840,28 +1132,194 @@ function snapshotRoleStateStatuses(value, label, machine, stateDescriptions) {
     }
     return statuses;
 }
-function settlingGuard(event) {
-    if (!isPlainObject(event) || !isPlainObject(event.output))
-        return undefined;
-    const guard = event.output.guard;
-    return typeof guard === 'string' && guard.trim().length > 0
-        ? guard
-        : undefined;
+const OUTCOME_FIELD_AUTHORITIES = new Set([
+    'presentation',
+    'semantic',
+    'effect',
+    'runtime',
+]);
+const REPOSITORY_DISPOSITIONS = new Set([
+    'unchanged',
+    'one-descendant-commit',
+    'deferred',
+]);
+const OUTCOME_FIELD_KEY_PATTERN = /^[A-Za-z_$][A-Za-z0-9_$]*$/;
+const SEMANTIC_PAYLOAD_FIELDS = new Set([
+    'irNumber',
+    'irTask',
+]);
+function requireExactObjectKeys(value, expected, path) {
+    const actual = Object.keys(value);
+    const missing = expected.filter((key) => !actual.includes(key));
+    const extra = actual.filter((key) => !expected.includes(key));
+    if (missing.length === 0 && extra.length === 0)
+        return;
+    throw new TypeError(`${path} must contain exactly ${expected.join(', ')}` +
+        (missing.length === 0 ? '' : `; missing ${missing.join(', ')}`) +
+        (extra.length === 0 ? '' : `; unknown ${extra.join(', ')}`));
+}
+function requireAuthorityIdentifier(value, path) {
+    if (!OUTCOME_FIELD_KEY_PATTERN.test(value)) {
+        throw new TypeError(`${path} must be an identifier`);
+    }
+}
+function snapshotOutcomeAuthority(descriptor, label, playerStates, verbatimPayloadFields) {
+    const path = `${label} outcomeAuthority`;
+    if (descriptor === undefined ||
+        !Object.prototype.hasOwnProperty.call(descriptor, 'value') ||
+        descriptor.enumerable !== true) {
+        throw new TypeError(`${path} must be an own enumerable data property for schema 3`);
+    }
+    const captured = snapshotJsonValue(descriptor.value, path);
+    if (!isPlainObject(captured)) {
+        throw new TypeError(`${path} must be an object`);
+    }
+    requireExactObjectKeys(captured, ['governedPlayerStates'], path);
+    const governed = captured.governedPlayerStates;
+    if (!isPlainObject(governed)) {
+        throw new TypeError(`${path}.governedPlayerStates must be an object`);
+    }
+    for (const stateId of playerStates.keys()) {
+        if (!Object.prototype.hasOwnProperty.call(governed, stateId)) {
+            throw new TypeError(`${path}.governedPlayerStates must declare player state ${stateId}`);
+        }
+    }
+    for (const stateId of Object.keys(governed)) {
+        if (!playerStates.has(stateId)) {
+            throw new TypeError(`${path}.governedPlayerStates.${stateId} does not name a player state`);
+        }
+    }
+    const usedVerbatimFields = new Set();
+    const normalizedStates = Object.create(null);
+    for (const [stateId, rawOutcomes] of Object.entries(governed)) {
+        const statePath = `${path}.governedPlayerStates.${stateId}`;
+        if (!isPlainObject(rawOutcomes) || Object.keys(rawOutcomes).length === 0) {
+            throw new TypeError(`${statePath} must declare at least one outcome`);
+        }
+        const outcomes = Object.create(null);
+        for (const [outcome, rawSpec] of Object.entries(rawOutcomes)) {
+            requireAuthorityIdentifier(outcome, `${statePath} outcome key`);
+            const outcomePath = `${statePath}.${outcome}`;
+            if (!isPlainObject(rawSpec)) {
+                throw new TypeError(`${outcomePath} must be an object`);
+            }
+            requireExactObjectKeys(rawSpec, ['fields', 'repositoryDisposition'], outcomePath);
+            if (!isPlainObject(rawSpec.fields)) {
+                throw new TypeError(`${outcomePath}.fields must be an object`);
+            }
+            const fields = Object.create(null);
+            for (const [field, authority] of Object.entries(rawSpec.fields)) {
+                requireAuthorityIdentifier(field, `${outcomePath}.fields key`);
+                if (field === 'guard') {
+                    throw new TypeError(`${outcomePath}.fields.guard is not allowed; the outcome key owns the semantic discriminator`);
+                }
+                if (typeof authority !== 'string' ||
+                    !OUTCOME_FIELD_AUTHORITIES.has(authority)) {
+                    throw new TypeError(`${outcomePath}.fields.${field} must name presentation, semantic, effect, or runtime authority`);
+                }
+                const requiredAuthorities = new Set();
+                if (field === 'latestCommit')
+                    requiredAuthorities.add('effect');
+                if (SEMANTIC_PAYLOAD_FIELDS.has(field)) {
+                    requiredAuthorities.add('semantic');
+                }
+                if (field === 'question' || verbatimPayloadFields.has(field)) {
+                    requiredAuthorities.add('presentation');
+                }
+                if (requiredAuthorities.size > 1) {
+                    throw new TypeError(`${outcomePath}.fields.${field} has conflicting linker authority requirements`);
+                }
+                const requiredAuthority = [...requiredAuthorities][0];
+                if (requiredAuthority !== undefined && authority !== requiredAuthority) {
+                    throw new TypeError(`${outcomePath}.fields.${field} must use ${requiredAuthority} authority`);
+                }
+                if (verbatimPayloadFields.has(field))
+                    usedVerbatimFields.add(field);
+                fields[field] = authority;
+            }
+            const disposition = rawSpec.repositoryDisposition;
+            if (typeof disposition !== 'string' ||
+                !REPOSITORY_DISPOSITIONS.has(disposition)) {
+                throw new TypeError(`${outcomePath}.repositoryDisposition must be unchanged, one-descendant-commit, or deferred`);
+            }
+            if (disposition !== 'one-descendant-commit' &&
+                Object.values(fields).includes('effect')) {
+                throw new TypeError(`${outcomePath} may declare effect-owned fields only for one-descendant-commit`);
+            }
+            outcomes[outcome] = Object.freeze({
+                fields: Object.freeze(fields),
+                repositoryDisposition: disposition,
+            });
+        }
+        for (const [outcome, outcomeSpec] of Object.entries(outcomes)) {
+            if (outcomeSpec.repositoryDisposition !== 'deferred')
+                continue;
+            if (outcome !== 'needsBossReply') {
+                throw new TypeError(`${statePath}.${outcome} may use deferred only for needsBossReply`);
+            }
+            if (outcomeSpec.fields.question !== 'presentation') {
+                throw new TypeError(`${statePath}.needsBossReply deferred outcome must declare presentation-owned question`);
+            }
+            if (!Object.entries(outcomes).some(([other, candidate]) => other !== outcome &&
+                candidate.repositoryDisposition === 'one-descendant-commit')) {
+                throw new TypeError(`${statePath}.needsBossReply deferred outcome requires another one-descendant-commit outcome`);
+            }
+        }
+        normalizedStates[stateId] = Object.freeze(outcomes);
+    }
+    for (const field of verbatimPayloadFields) {
+        requireAuthorityIdentifier(field, `${path} verbatimPayloadFields entry`);
+        if (!usedVerbatimFields.has(field)) {
+            throw new TypeError(`${path} verbatimPayloadFields entry ${field} is absent from governed payload fields`);
+        }
+    }
+    return Object.freeze({
+        governedPlayerStates: Object.freeze(normalizedStates),
+    });
+}
+function sameStringSet(left, right) {
+    if (left.length !== right.length)
+        return false;
+    const expected = new Set(right);
+    return left.every((value) => expected.has(value));
+}
+function assertGovernedPlayerInput(authority, input, extractFields, label) {
+    if (authority === undefined)
+        return;
+    const state = authority.governedPlayerStates[input.stateId];
+    if (state === undefined) {
+        throw new TypeError(`${label} outcomeAuthority has no governed player state ${input.stateId}`);
+    }
+    const actualOutcomes = Object.keys(input.result);
+    const governedOutcomes = Object.keys(state);
+    if (!sameStringSet(actualOutcomes, governedOutcomes)) {
+        throw new TypeError(`${label} outcomeAuthority for ${input.stateId} must exactly match outcomes ` +
+            governedOutcomes.join(', '));
+    }
+    for (const outcome of governedOutcomes) {
+        const description = input.result[outcome];
+        if (typeof description !== 'string') {
+            throw new TypeError(`${label} player outcome ${input.stateId}.${outcome} must have a string description`);
+        }
+        const describedFields = [...new Set(extractFields(description))];
+        const candidateFields = Object.keys(state[outcome].fields);
+        if (!sameStringSet(describedFields, candidateFields)) {
+            throw new TypeError(`${label} outcomeAuthority fields for ${input.stateId}.${outcome} ` +
+                'must exactly match its described output fields');
+        }
+    }
 }
 function askerLabel(asker) {
     return asker.kind === 'captain' ? 'Captain' : asker.roleId;
 }
 function makeDefaultStatusesForState(roleStates) {
-    return (state, context, event) => {
+    return (state, context) => {
         const statuses = [];
-        const guard = settlingGuard(event);
-        if (guard !== undefined)
-            statuses.push({ message: `→ ${guard}` });
         const stateId = state.stateId;
         if (stateId === undefined || SUPPRESSED_ENTRY_STATES.has(stateId)) {
             return statuses;
         }
-        if (stateId === 'awaitBossReply') {
+        if (stateId === BOSS_REPLY_WAIT_STATE_ID) {
             const pending = pendingBossQuestionFromContext(context);
             if (pending === undefined) {
                 return [...statuses, { message: 'Awaiting Boss reply.' }];
@@ -1063,7 +1521,14 @@ function makeDefaultClassifyBossText(machine, entryEvent, bossEvents) {
         const state = classifierState(snapshotOrState);
         const stateId = typeof state.value === 'string' ? state.value : undefined;
         const currentState = stateId ?? JSON.stringify(state.value ?? null);
-        const pending = pendingBossQuestionFromContext(state.context);
+        // The classifier shares the reply-wait pendingness of every other
+        // surface: outside the wait, a context question a later state retains
+        // is answered history, so the prompt must not present it as pending —
+        // a judge told a question awaits at the failure state is steered toward
+        // a reply it cannot select or toward no action at all.
+        const pending = stateId === BOSS_REPLY_WAIT_STATE_ID
+            ? pendingBossQuestionFromContext(state.context)
+            : undefined;
         const configuredTypes = configuredEventTypesForState(machine, stateId);
         const applicable = [...contracts.values()].filter((contract) => configuredTypes.has(contract.type) &&
             (contract.type !== 'BOSS_REPLY' || pending !== undefined));
@@ -1179,32 +1644,114 @@ function machineDeclaresParallelState(machine) {
     };
     return visit(machine.config);
 }
-/**
- * Build a `PlaybookRuntimeFactory` that interprets the given FSM artifact
- * under the slc/link.md contract. The factory provides every actor kind the
- * machine declares — `player`, `script`, `captain`, and nested `playbook`
- * (literal and dynamic) — and implements the full runtime lifecycle including
- * the optional parked-session snapshot capability (DR-014).
- *
- * Scope: machines that declare no parallel state (each snapshot exposes
- * exactly one playbook state id). Parallel-region FSMs keep their own linked
- * runtimes.
- */
+// PBRT-52: the factory's domain is FLAT single-region machines — every
+// state a direct child of the root, so each snapshot exposes exactly one
+// playbook state id and every state-keyed lookup (deterministic entries,
+// retry, reply-wait pendingness, configured events, descriptions) indexes
+// one unambiguous identity. A compound child would be accepted and then
+// silently misbehave on all of those gates, so it is rejected up front
+// exactly like a parallel region.
+function machineDeclaresNestedState(machine) {
+    const config = machine.config;
+    if (!isPlainObject(config) || !isPlainObject(config.states))
+        return false;
+    return Object.values(config.states).some((stateDef) => isPlainObject(stateDef) &&
+        isPlainObject(stateDef.states) &&
+        Object.keys(stateDef.states).length > 0);
+}
+// PBRT-52: the factory's lookups index states by their root key, and the
+// published playbook identity is `meta.playbook.stateId` — the two must
+// coincide or a machine can advertise a pending question or retry under an
+// identity no lookup resolves. A state with no string stateId is just as
+// dead: every snapshot identity derives from that member, so the first
+// entry would fail the exactly-one-state-id inspection at runtime.
+// gears2fsm keeps identity and key equal by construction; a hand-authored
+// artifact that splits or omits them fails here instead of at a silently
+// dead gate.
+function assertFlatStateIdentity(machine, label) {
+    const config = machine.config;
+    const states = isPlainObject(config) && isPlainObject(config.states)
+        ? config.states
+        : undefined;
+    // A machine with no root states has no playbook identity to expose; its
+    // first snapshot would fail the exactly-one-state-id inspection, so it
+    // fails construction with the defect named instead.
+    if (states === undefined || Object.keys(states).length === 0) {
+        throw new Error(`${label} declares no root states; the shared runtime requires at ` +
+            'least one flat playbook state');
+    }
+    for (const [key, stateDef] of Object.entries(states)) {
+        if (!isPlainObject(stateDef))
+            continue;
+        const meta = isPlainObject(stateDef.meta) ? stateDef.meta : undefined;
+        const playbook = meta !== undefined && isPlainObject(meta.playbook)
+            ? meta.playbook
+            : undefined;
+        const stateId = playbook?.stateId;
+        if (typeof stateId !== 'string') {
+            throw new Error(`${label} state ${key} declares no string meta.playbook.stateId; ` +
+                'the shared runtime derives every playbook state identity from it');
+        }
+        if (stateId !== key) {
+            throw new Error(`${label} state ${key} declares meta.playbook.stateId ${stateId}; ` +
+                'the shared runtime requires the playbook state id to equal the state key');
+        }
+    }
+}
+function rootFinalStateIdsFromMachine(machine) {
+    const config = machine.config;
+    if (!isPlainObject(config) || !isPlainObject(config.states)) {
+        return new Set();
+    }
+    const stateIds = new Set();
+    for (const [stateId, stateDef] of Object.entries(config.states)) {
+        if (isPlainObject(stateDef) && stateDef.type === 'final') {
+            stateIds.add(stateId);
+        }
+    }
+    return stateIds;
+}
+// PBRT-52: whether a final outcome leaves the procedure unfinished remains
+// authored link metadata. The machine can still prove the mechanical half:
+// every declared stable id must resolve to one of its root final states.
+function assertUnfinishedFinalStateIds(value, machine, label) {
+    if (value === undefined)
+        return;
+    const rootFinalStateIds = rootFinalStateIdsFromMachine(machine);
+    for (const stateId of value) {
+        if (typeof stateId !== 'string' || !rootFinalStateIds.has(stateId)) {
+            throw new TypeError(`${label} unfinishedFinalStateIds entry ${JSON.stringify(stateId)} ` +
+                'does not name a root final state');
+        }
+    }
+}
 export function createXStatePlaybookRuntime(machine, spec) {
     const label = spec.label ?? 'playbook';
     // DR-022 / PBRT-50: reject an incompatible artifact declaration before any
     // machine interpretation, against this loaded engine's own self-report.
-    assertRuntimeCompat(spec.compat, label);
+    const artifactSchema = assertRuntimeCompat(spec.compat, label);
     const specDescriptors = Object.getOwnPropertyDescriptors(spec);
     if (Object.prototype.hasOwnProperty.call(specDescriptors, 'playerStates')) {
-        throw new TypeError(`${label} schema-2 artifacts must supply roleStates, not playerStates`);
+        throw new TypeError(`${label} artifacts must supply roleStates, not playerStates`);
     }
     if (Object.prototype.hasOwnProperty.call(specDescriptors, 'resolvePlayerId')) {
-        throw new TypeError(`${label} schema-2 artifacts must not derive concrete player bindings`);
+        throw new TypeError(`${label} artifacts must not derive concrete player bindings`);
     }
     if (machineDeclaresParallelState(machine)) {
         throw new Error(`${label} uses a parallel state; the shared runtime supports only single-region FSMs`);
     }
+    if (machineDeclaresNestedState(machine)) {
+        throw new Error(`${label} declares a compound state; the shared runtime supports only flat single-region FSMs`);
+    }
+    assertFlatStateIdentity(machine, label);
+    assertUnfinishedFinalStateIds(spec.unfinishedFinalStateIds, machine, label);
+    const retainedGenerationMetadata = spec.unfinishedFinalStateIds === undefined
+        ? undefined
+        : Object.freeze({
+            unfinishedFinalStateIds: Object.freeze([
+                ...spec.unfinishedFinalStateIds,
+            ]),
+        });
     const declaredActors = collectInvokeSources(machine);
     const resumableStateIds = spec.resumableStateIds ?? resumableStateIdsFromMachine(machine);
     // DR-029: source state descriptions label the control actions the
@@ -1237,18 +1784,22 @@ export function createXStatePlaybookRuntime(machine, spec) {
         ((input) => defaultComposePlayerPrompt(input, spec.placeholderFields));
     const composeCaptainPrompt = spec.composeCaptainPrompt ??
         ((input) => defaultComposeCaptainPrompt(input, spec.placeholderFields));
+    const extractFields = spec.extractRequiredFields ?? defaultExtractRequiredFields;
+    const verbatimPayloadFields = new Set(spec.verbatimPayloadFields ?? NO_VERBATIM_FIELDS);
     const adjudication = {
         ...(spec.buildJudgePrompt !== undefined
             ? { buildJudgePrompt: spec.buildJudgePrompt }
             : {}),
-        ...(spec.extractRequiredFields !== undefined
-            ? { extractRequiredFields: spec.extractRequiredFields }
-            : {}),
-        ...(spec.verbatimPayloadFields !== undefined
-            ? { verbatimPayloadFields: spec.verbatimPayloadFields }
-            : {}),
+        extractRequiredFields: extractFields,
+        verbatimPayloadFields,
     };
-    const extractFields = spec.extractRequiredFields ?? defaultExtractRequiredFields;
+    const outcomeAuthority = snapshotOutcomeAuthority(specDescriptors.outcomeAuthority, label, roleStates, verbatimPayloadFields);
+    for (const [stateId, outcomes] of Object.entries(outcomeAuthority.governedPlayerStates)) {
+        if (Object.values(outcomes).some(({ repositoryDisposition }) => repositoryDisposition === 'deferred') &&
+            !resumableStateIds.has(stateId)) {
+            throw new TypeError(`${label} outcomeAuthority deferred state ${stateId} must be registered in resumableStateIds`);
+        }
+    }
     // Build the derived classifier unconditionally: it is the sole validator of
     // supplied `bossEvents`, and DR-019 §2 requires a conflicting duplicate to
     // fail factory construction whether or not this spec overrides the
@@ -1259,6 +1810,7 @@ export function createXStatePlaybookRuntime(machine, spec) {
         makeDefaultNormalizeTransitionEvent(spec.transitionEventFields ?? []);
     const statusesForState = spec.statusesForState ??
         makeDefaultStatusesForState(roleStates);
+    const usesDefaultStatuses = spec.statusesForState === undefined;
     const classificationStatus = spec.classificationStatus ??
         ((event) => event.type);
     const machineInput = spec.machineInput ?? ((options) => options);
@@ -1267,8 +1819,39 @@ export function createXStatePlaybookRuntime(machine, spec) {
             const cwd = options?.cwd;
             return typeof cwd === 'string' ? cwd : undefined;
         });
-    return function createPlaybookRuntime(options) {
-        const boundOptions = spec.snapshotOptions(options);
+    const createPlaybookRuntime = function createPlaybookRuntime(factoryOptions) {
+        const construction = configuredOptionsFromFactoryInput(factoryOptions, label);
+        const configuredOptions = construction.configuredOptions;
+        const effectLedgerCapability = construction.effectLedger;
+        const hasGovernedPlayerStates = Object.keys(outcomeAuthority.governedPlayerStates).length > 0;
+        const acceptedOutcomeConsumer = createAcceptedOutcomeConsumer((source, acceptedOutcome) => {
+            const governedPlayerStates = outcomeAuthority.governedPlayerStates;
+            if (!Object.prototype.hasOwnProperty.call(governedPlayerStates, source)) {
+                return false;
+            }
+            const declarations = governedPlayerStates[source];
+            return (declarations !== undefined &&
+                Object.prototype.hasOwnProperty.call(declarations, acceptedOutcome));
+        });
+        const repositoryCapability = hasGovernedPlayerStates
+            ? repositoryCapabilityFromHostCapabilities(construction.hostCapabilities, label)
+            : undefined;
+        const currentEffectLedger = () => assertPlaybookEffectLedger(effectLedgerCapability.snapshot(), `${label} current host effect ledger`);
+        let effectLedgerMirror = currentEffectLedger();
+        let retainedEffectSourceSessionId;
+        let retainedEffectReconciliation;
+        let retainedEffectReconciliationRequired = false;
+        const playerBoundaryReceipts = new WeakMap();
+        const governedPlayerSettlements = new WeakMap();
+        const governedSettlementsByBoundaryId = new Map();
+        const governedCompletionEvidenceByBoundaryId = new Map();
+        const unresolvedSemanticBoundaryIds = new Set();
+        let reconstructedGovernedDelivery;
+        let reconstructedGovernedPrefixSequence;
+        const reconstructedGovernedResults = new WeakMap();
+        let reconstructedAcceptancePending;
+        const boundOptions = spec.snapshotOptions(configuredOptions);
+        assertNoConfiguredHostCapabilities(boundOptions, label);
         const boundScriptCwd = scriptCwd(boundOptions);
         let actor;
         let session;
@@ -1282,7 +1865,37 @@ export function createXStatePlaybookRuntime(machine, spec) {
         // ports.callPlayer / callCaptain / callJudge see the right cancellation
         // source. undefined between turns; set by the public boundaries.
         let activeSignal;
+        // Immutable cancellation provenance for the active public boundary. A
+        // nested resume widens it to include both invocation and resume signals;
+        // mutable `activeSignal` alone cannot classify a late invocation reason.
+        let activeAborts;
+        // The bridge binds the provenance of a child result immediately before
+        // its promise actor settles. The next root snapshot/error consumes this
+        // one-shot so background settlement emissions retain their owner.
+        let actorSettlementAborts;
+        let actorSettlementErrorAborts;
+        // Exact cancellation observed by an emission owned by the active
+        // boundary. Ordinary runs settle from their signal/state; apply also
+        // needs this phase-local evidence to fold a pre-publication failure into
+        // its accepted receipt.
+        let activeAbortEmission;
         let activeTurnId;
+        // The durable host attempt observed by governed calls in the active
+        // public boundary. The failed-state latch survives later no-action turns;
+        // clearing it at every boundary start must not make unsafe replay appear
+        // newly eligible.
+        let activeGovernedBoundarySeen = false;
+        let activeGovernedAttemptId;
+        let activeEffectLedgerPrefixSequence;
+        let failedGovernedAttemptUnknown = false;
+        let failedEffectBoundaryPrefix;
+        let failedGovernedAttemptId;
+        let deferredReconciliationOperationId;
+        let deferredSettlementClosure;
+        let expectedBoundPendingQuestion;
+        let activeDeferredContinuation;
+        let deferInspectionEmissions = false;
+        let deferredInspectionEmissions = [];
         let controlPlaneError;
         // Previous root-machine state for the inspect-driven telemetry /
         // status emitter. undefined before the first inspect firing.
@@ -1310,6 +1923,7 @@ export function createXStatePlaybookRuntime(machine, spec) {
         const privateResumeTokens = new Map();
         const activePlayerKeys = new Set();
         const playbookCallTurnIds = new Map();
+        const playbookCallEffectPrefixes = new Map();
         // Captain and judge work share one serialized lane (slc/link.md
         // §Session lifecycle).
         const judgeQueue = new PQueue({ concurrency: 1 });
@@ -1319,99 +1933,520 @@ export function createXStatePlaybookRuntime(machine, spec) {
         // Inspection callbacks enqueue a complete ordered batch synchronously;
         // imperative boundaries await their queued work directly.
         let emissionFailure;
-        function bindSession(nextSession) {
-            const bound = snapshotPlaybookSession(nextSession);
-            if (bound.roleBindings === undefined)
-                return bound;
-            const actual = Object.keys(bound.roleBindings).sort();
-            const expected = [...declaredRoleIds].sort();
-            const missing = expected.filter((roleId) => !actual.includes(roleId));
-            const extra = actual.filter((roleId) => !expected.includes(roleId));
-            if (missing.length > 0 || extra.length > 0) {
-                throw new TypeError(`${label} session roleBindings must cover exactly [${expected.join(', ')}]` +
-                    `${missing.length === 0 ? '' : `; missing [${missing.join(', ')}]`}` +
-                    `${extra.length === 0 ? '' : `; extra [${extra.join(', ')}]`}`);
+        function runtimeLogicalOperations(ledger = effectLedgerMirror) {
+            if (session === undefined)
+                return [];
+            const runtimeSessionIds = new Set([
+                session.sessionId,
+                ...(retainedEffectSourceSessionId === undefined
+                    ? []
+                    : [retainedEffectSourceSessionId]),
+            ]);
+            return ledger.logicalOperations.filter((operation) => operation.playbookId === session.playbookId &&
+                runtimeSessionIds.has(operation.runtimeSessionId));
+        }
+        function refreshRetainedEffectReconciliation(current = effectLedgerMirror) {
+            const retained = retainedEffectReconciliation;
+            if (retained === undefined) {
+                retainedEffectReconciliationRequired = false;
+                return;
+            }
+            const safe = retainedAdoptionCheckpointIsSafe(retained.checkpoint, current);
+            retainedEffectReconciliationRequired = !safe;
+            if (safe) {
+                retainedEffectReconciliation = undefined;
+                reconstructedGovernedPrefixSequence = undefined;
             }
-            return bound;
         }
-        function requireRoleId(input) {
-            const roleId = input.role;
-            if (typeof roleId !== 'string' ||
-                roleId.trim().length === 0 ||
-                !declaredRoleIds.includes(roleId)) {
-                throw new TypeError(`${label} player input role must name a declared local role`);
+        function bindRetainedEffectReconciliation(retained, current) {
+            retainedEffectReconciliation = retained;
+            refreshRetainedEffectReconciliation(current);
+            reconstructedGovernedPrefixSequence =
+                retainedEffectReconciliation === undefined
+                    ? undefined
+                    : (retainedEffectReconciliation.checkpoint.boundaries.at(-1)
+                        ?.sequence ?? 0);
+        }
+        function refreshRetainedEffectFenceFromHost() {
+            if (retainedEffectReconciliation === undefined)
+                return;
+            const retainedBeforeRefresh = retainedEffectReconciliation;
+            try {
+                effectLedgerMirror = currentEffectLedger();
+                refreshRetainedEffectReconciliation(effectLedgerMirror);
+                syncDeferredReconciliationOverlay();
+                refreshUnresolvedSemanticReconciliation(effectLedgerMirror);
+            }
+            catch {
+                // A fence can open only from validated authoritative evidence. If the
+                // live mirror or its source-owned deferred-operation view cannot be
+                // read exactly, keep every ordinary entry point closed.
+                retainedEffectReconciliation ??= retainedBeforeRefresh;
+                deferredReconciliationOperationId = undefined;
+                retainedEffectReconciliationRequired = true;
             }
-            return roleId;
         }
-        function resolvedPlayerId(roleId) {
-            return session?.roleBindings?.[roleId]?.playerId;
+        function syncDeferredReconciliationOverlay() {
+            const unresolved = runtimeLogicalOperations().filter((operation) => operation.logicalReceipt === undefined &&
+                (operation.checkpointRestorationEligible ||
+                    operation.pendingQuestion === undefined));
+            if (unresolved.length > 1) {
+                throw new Error(`${label} effect ledger contains multiple unresolved deferred operations`);
+            }
+            deferredReconciliationOperationId = unresolved[0]?.operationId;
         }
-        function promptIdentity(roleId) {
-            if (!declaredRoleIds.includes(roleId)) {
-                throw new TypeError(`${label} prompt identity lookup rejected undeclared role ${roleId}`);
+        function runtimeBoundaryIsOwned(boundary) {
+            if (session === undefined || boundary.playbookId !== session.playbookId) {
+                return false;
             }
-            return session?.roleBindings?.[roleId]?.promptIdentity ?? roleId;
+            return (boundary.runtimeSessionId === session.sessionId ||
+                boundary.runtimeSessionId === retainedEffectSourceSessionId);
         }
-        function composeBoundPlayerPrompt(input) {
-            let active = true;
-            const lookup = (roleId) => {
-                if (!active) {
-                    throw new Error(`${label} prompt identity lookup is no longer active`);
+        function governedOutcomesForBoundary(candidate) {
+            const outcomes = outcomeAuthority?.governedPlayerStates[candidate.sourceStateId];
+            if (outcomes === undefined)
+                return undefined;
+            if (!isPlainObject(candidate.sourceOutcomeSchema) ||
+                !sameStringSet(Object.keys(candidate.sourceOutcomeSchema), Object.keys(outcomes))) {
+                return undefined;
+            }
+            for (const [guard, description] of Object.entries(candidate.sourceOutcomeSchema)) {
+                if (typeof description !== 'string')
+                    return undefined;
+                const describedFields = [...new Set(extractFields(description))];
+                if (!sameStringSet(describedFields, Object.keys(outcomes[guard].fields))) {
+                    return undefined;
                 }
-                return promptIdentity(roleId);
-            };
-            try {
-                return composePlayerPrompt(input, lookup);
             }
-            finally {
-                active = false;
+            const expectedDispositions = [
+                ...new Set(Object.values(outcomes).map(({ repositoryDisposition }) => repositoryDisposition)),
+            ];
+            if (!sameStringSet(candidate.dispositions, expectedDispositions)) {
+                return undefined;
             }
+            return outcomes;
         }
-        function continuationKey(roleId, playerId) {
-            return playerId ?? roleId;
-        }
-        function roleTokensByContinuationKey(tokens) {
-            const byKey = new Map();
-            for (const [roleId, token] of Object.entries(tokens)) {
-                if (!declaredRoleIds.includes(roleId)) {
-                    throw new TypeError(`runtime role tokens contain unknown role ${roleId}`);
+        function persistedBoundaryReconciliation(candidate, ledger) {
+            const outcomes = governedOutcomesForBoundary(candidate);
+            if (outcomes === undefined || candidate.semanticCandidate === undefined) {
+                return undefined;
+            }
+            let receipt = candidate.physicalReceipt;
+            let historicalDeferred = false;
+            let awaitingLogicalReceipt = false;
+            if (candidate.logicalOperationId !== undefined) {
+                const operation = ledger.logicalOperations.find(({ operationId }) => operationId === candidate.logicalOperationId);
+                if (operation === undefined)
+                    return undefined;
+                const latestBoundaryId = operation.boundaryIds.at(-1);
+                if (latestBoundaryId !== candidate.boundaryId) {
+                    // Earlier questions remain independently validated historical
+                    // evidence. Their physical same-HEAD receipt, candidate, and
+                    // reciprocal operation link must still prove a deferred arm.
+                    historicalDeferred = true;
                 }
-                const key = continuationKey(roleId, resolvedPlayerId(roleId));
-                const existing = byKey.get(key);
-                if (existing !== undefined && existing !== token) {
-                    throw new TypeError(`runtime snapshot assigns conflicting tokens to roles bound to player ${key}`);
+                else if (operation.logicalReceipt !== undefined) {
+                    receipt = operation.logicalReceipt;
+                }
+                else if (operation.pendingQuestion === undefined ||
+                    operation.checkpoint === undefined ||
+                    !Object.prototype.hasOwnProperty.call(operation, 'playerContinuation')) {
+                    return undefined;
+                }
+                else {
+                    awaitingLogicalReceipt = true;
                 }
-                byKey.set(key, token);
-            }
-            const rolesByKey = new Map();
-            for (const roleId of declaredRoleIds) {
-                const key = continuationKey(roleId, resolvedPlayerId(roleId));
-                rolesByKey.set(key, [...(rolesByKey.get(key) ?? []), roleId]);
             }
-            for (const [key, roles] of rolesByKey) {
-                if (roles.length < 2)
-                    continue;
-                const present = roles.filter((roleId) => tokens[roleId] !== undefined);
-                if (present.length !== 0 && present.length !== roles.length) {
-                    throw new TypeError(`runtime role tokens must project player ${key} through every aliased role [${roles.join(', ')}]`);
+            try {
+                const reconciliation = reconcilePlaybookSemanticEvidence({
+                    outcomes,
+                    semanticCandidate: candidate.semanticCandidate,
+                    finalText: candidate.finalText,
+                    receipt,
+                });
+                if (awaitingLogicalReceipt &&
+                    reconciliation.status !== 'deferred') {
+                    return undefined;
                 }
+                return {
+                    reconciliation,
+                    historicalDeferred,
+                };
+            }
+            catch {
+                return undefined;
             }
-            return byKey;
         }
-        function selectPlayerResume(roleId, playerId) {
-            const key = continuationKey(roleId, playerId);
-            const selected = session?.playerSessions
-                ? session.playerSessions.select(roleId)
-                : privateResumeTokens.get(key) ?? false;
-            if (selected !== false &&
-                (typeof selected !== 'string' || selected.trim().length === 0)) {
-                throw new TypeError(`player session store returned an invalid resume token for role ${roleId}`);
+        function boundaryNeedsSemanticReconciliation(candidate, ledger) {
+            if (!runtimeBoundaryIsOwned(candidate))
+                return false;
+            if (governedOutcomesForBoundary(candidate) === undefined)
+                return true;
+            const persisted = persistedBoundaryReconciliation(candidate, ledger);
+            if (persisted !== undefined) {
+                if (persisted.reconciliation.status === 'unresolved')
+                    return true;
+                if (persisted.historicalDeferred) {
+                    return persisted.reconciliation.status !== 'deferred';
+                }
+                if (persisted.reconciliation.status === 'deferred' &&
+                    candidate.logicalOperationId === undefined) {
+                    return true;
+                }
+                return false;
             }
-            return selected;
+            if (candidate.physicalReceipt === undefined) {
+                // An unsafe retained suffix is already owned by the task-8 adoption
+                // fence, which may still expose its exact deferred-restoration
+                // action. A same-generation incomplete boundary has no such fence
+                // and remains semantic/effect unresolved until host reconstruction.
+                return retainedEffectReconciliation === undefined;
+            }
+            if (typeof candidate.finalText === 'string' &&
+                candidate.finalText.trim().length > 0) {
+                return true;
+            }
+            return candidate.physicalReceipt.classification !== 'unchanged';
         }
-        function updatePlayerResume(roleId, playerId, result) {
-            const resumeToken = result.resumeToken;
-            if (resumeToken === undefined && result.status !== 'ok')
+        function refreshUnresolvedSemanticReconciliation(current = effectLedgerMirror) {
+            unresolvedSemanticBoundaryIds.clear();
+            if (outcomeAuthority === undefined || session === undefined)
+                return;
+            for (const candidate of current.boundaries) {
+                if (boundaryNeedsSemanticReconciliation(candidate, current)) {
+                    unresolvedSemanticBoundaryIds.add(candidate.boundaryId);
+                }
+            }
+        }
+        function prepareReconstructedGovernedDelivery(state, ledger = effectLedgerMirror) {
+            reconstructedGovernedDelivery = undefined;
+            if (state.stateId === undefined ||
+                state.activeStateIds.length !== 1) {
+                return;
+            }
+            const owned = ledger.boundaries.filter(runtimeBoundaryIsOwned);
+            const candidate = reconstructedGovernedPrefixSequence === undefined
+                ? owned.at(-1)
+                : owned.find(({ sequence }) => sequence > reconstructedGovernedPrefixSequence);
+            if (candidate === undefined || candidate.sourceStateId !== state.stateId) {
+                return;
+            }
+            const persisted = persistedBoundaryReconciliation(candidate, ledger);
+            if (persisted === undefined ||
+                persisted.historicalDeferred ||
+                persisted.reconciliation.status !== 'resolved' ||
+                typeof candidate.finalText !== 'string') {
+                return;
+            }
+            reconstructedGovernedDelivery = {
+                boundary: candidate,
+                finalText: candidate.finalText,
+                settlement: {
+                    status: 'resolved',
+                    output: persisted.reconciliation.output,
+                },
+            };
+        }
+        function takeReconstructedGovernedPlayerResult(input, roleId) {
+            const reconstructed = reconstructedGovernedDelivery;
+            if (reconstructed === undefined)
+                return undefined;
+            // A reconstructed envelope is consumable once even when a hostile host
+            // changes its mirror between restore validation and actor startup.
+            reconstructedGovernedDelivery = undefined;
+            const current = currentEffectLedger();
+            effectLedgerMirror = current;
+            syncDeferredReconciliationOverlay();
+            refreshUnresolvedSemanticReconciliation(current);
+            const completed = current.boundaries.find(({ boundaryId }) => boundaryId === reconstructed.boundary.boundaryId);
+            const expected = reconstructedGovernedPrefixSequence === undefined
+                ? current.boundaries.filter(runtimeBoundaryIsOwned).at(-1)
+                : current.boundaries
+                    .filter(runtimeBoundaryIsOwned)
+                    .find(({ sequence }) => sequence > reconstructedGovernedPrefixSequence);
+            const persisted = completed === undefined
+                ? undefined
+                : persistedBoundaryReconciliation(completed, current);
+            if (completed === undefined ||
+                expected?.boundaryId !== completed.boundaryId ||
+                !isDeepStrictEqual(completed, reconstructed.boundary) ||
+                completed.sourceStateId !== input.stateId ||
+                completed.roleId !== roleId ||
+                !isDeepStrictEqual(completed.sourceOutcomeSchema, input.result) ||
+                persisted === undefined ||
+                persisted.historicalDeferred ||
+                persisted.reconciliation.status !== 'resolved' ||
+                completed.finalText !== reconstructed.finalText ||
+                !isDeepStrictEqual(persisted.reconciliation.output, reconstructed.settlement.output)) {
+                unresolvedSemanticBoundaryIds.add(reconstructed.boundary.boundaryId);
+                throw markFsmResultFailure(new Error(`${label} retained governed semantic envelope is no longer exact`));
+            }
+            validateBossReplyOutput(input, reconstructed.settlement.output, resumableStateIds);
+            const result = validatePlayerResult({
+                status: 'ok',
+                finalText: reconstructed.finalText,
+            });
+            playerBoundaryReceipts.set(result, {
+                boundaryId: completed.boundaryId,
+                attemptId: completed.attemptId,
+            });
+            governedPlayerSettlements.set(result, reconstructed.settlement);
+            reconstructedGovernedResults.set(result, completed);
+            return result;
+        }
+        function acceptReconstructedGovernedDelivery(state) {
+            const accepted = reconstructedAcceptancePending;
+            if (accepted === undefined ||
+                state.stateId === accepted.sourceStateId) {
+                return;
+            }
+            reconstructedAcceptancePending = undefined;
+            let current;
+            try {
+                current = currentEffectLedger();
+                effectLedgerMirror = current;
+                syncDeferredReconciliationOverlay();
+                refreshUnresolvedSemanticReconciliation(current);
+            }
+            catch {
+                unresolvedSemanticBoundaryIds.add(accepted.boundaryId);
+                return;
+            }
+            const acknowledged = current.boundaries.find(({ boundaryId }) => boundaryId === accepted.boundaryId);
+            if (acknowledged === undefined ||
+                !isDeepStrictEqual(acknowledged, accepted)) {
+                unresolvedSemanticBoundaryIds.add(accepted.boundaryId);
+                return;
+            }
+            if (reconstructedGovernedPrefixSequence !== undefined) {
+                reconstructedGovernedPrefixSequence = accepted.sequence;
+                prepareReconstructedGovernedDelivery(state, current);
+                if (current.boundaries
+                    .filter(runtimeBoundaryIsOwned)
+                    .some(({ sequence }) => sequence > reconstructedGovernedPrefixSequence)) {
+                    return;
+                }
+            }
+            if (unresolvedSemanticBoundaryIds.size > 0 ||
+                deferredReconciliationOperationId !== undefined) {
+                return;
+            }
+            // Task 9 has now projected the retained, host-acknowledged envelope
+            // into the FSM. Only after that acceptance may the task-8 adoption
+            // marker retire; an unresolved sibling boundary leaves it intact.
+            retainedEffectReconciliation = undefined;
+            retainedEffectReconciliationRequired = false;
+            reconstructedGovernedPrefixSequence = undefined;
+        }
+        function hasUnresolvedReconciliation() {
+            return (deferredReconciliationOperationId !== undefined ||
+                retainedEffectReconciliationRequired ||
+                unresolvedSemanticBoundaryIds.size > 0);
+        }
+        function unresolvedEffectEnvelopeIdentities() {
+            if (session === undefined)
+                return [];
+            const current = currentEffectLedger();
+            effectLedgerMirror = current;
+            refreshRetainedEffectReconciliation(current);
+            syncDeferredReconciliationOverlay();
+            refreshUnresolvedSemanticReconciliation(current);
+            if (!hasUnresolvedReconciliation())
+                return [];
+            const boundaryIds = new Set(unresolvedSemanticBoundaryIds);
+            const operationIds = new Set();
+            if (deferredReconciliationOperationId !== undefined) {
+                operationIds.add(deferredReconciliationOperationId);
+            }
+            if (retainedEffectReconciliationRequired) {
+                const checkpointLength = retainedEffectReconciliation?.checkpoint
+                    .boundaries.length ?? 0;
+                for (const boundary of current.boundaries.slice(checkpointLength)) {
+                    if (boundary.physicalReceipt?.classification === 'unchanged') {
+                        continue;
+                    }
+                    boundaryIds.add(boundary.boundaryId);
+                }
+            }
+            for (const boundaryId of [...boundaryIds]) {
+                const boundary = current.boundaries.find((candidate) => candidate.boundaryId === boundaryId);
+                if (boundary?.logicalOperationId !== undefined &&
+                    current.logicalOperations.some(({ operationId }) => operationId === boundary.logicalOperationId)) {
+                    operationIds.add(boundary.logicalOperationId);
+                    for (const memberId of current.logicalOperations.find(({ operationId }) => operationId === boundary.logicalOperationId).boundaryIds) {
+                        boundaryIds.delete(memberId);
+                    }
+                }
+            }
+            const ordered = [
+                ...[...boundaryIds].map((boundaryId) => ({
+                    order: current.boundaries.find((candidate) => candidate.boundaryId === boundaryId)?.sequence ?? Number.MAX_SAFE_INTEGER,
+                    value: { kind: 'boundary', boundaryId },
+                })),
+                ...[...operationIds].map((operationId) => {
+                    const operation = current.logicalOperations.find((candidate) => candidate.operationId === operationId);
+                    const firstBoundaryId = operation?.boundaryIds[0];
+                    return {
+                        order: current.boundaries.find(({ boundaryId }) => boundaryId === firstBoundaryId)?.sequence ?? Number.MAX_SAFE_INTEGER,
+                        value: { kind: 'logical-operation', operationId },
+                    };
+                }),
+            ].sort((left, right) => left.order - right.order);
+            return deepFreeze(snapshotJsonValue(ordered.map(({ value }) => value), `${label} unresolved effect envelope identities`));
+        }
+        function closeAfterIndeterminateDeferredSettlement(operationId, cause) {
+            try {
+                effectLedgerMirror = currentEffectLedger();
+                refreshRetainedEffectReconciliation(effectLedgerMirror);
+                syncDeferredReconciliationOverlay();
+                refreshUnresolvedSemanticReconciliation(effectLedgerMirror);
+            }
+            catch {
+                // The current host mirror is itself unavailable. The closure below
+                // keeps every public state surface shut until a fresh host recovers
+                // the write-ahead record and constructs a replacement runtime.
+            }
+            expectedBoundPendingQuestion = undefined;
+            deferredSettlementClosure ??= new Error(`${label} deferred settlement is indeterminate; recover the host effect ledger before continuing`, { cause });
+            if (operationId !== undefined &&
+                deferredReconciliationOperationId === undefined) {
+                deferredReconciliationOperationId = operationId;
+            }
+        }
+        function assertDeferredSettlementOpen(method) {
+            if (deferredSettlementClosure !== undefined) {
+                throw new Error(`createPlaybookRuntime.${method}: deferred settlement recovery is required`, { cause: deferredSettlementClosure });
+            }
+        }
+        function currentBoundDeferredOperation(pending) {
+            const projected = {
+                questionId: pending.questionId,
+                asker: pending.asker,
+                question: pending.question,
+                sourceItem: pending.sourceItem,
+            };
+            const matches = runtimeLogicalOperations().filter((operation) => operation.logicalReceipt === undefined &&
+                operation.checkpoint !== undefined &&
+                operation.pendingQuestion !== undefined &&
+                operation.playerContinuation !== undefined &&
+                !operation.checkpointRestorationEligible &&
+                isDeepStrictEqual(operation.pendingQuestion, projected));
+            if (matches.length > 1) {
+                throw new Error(`${label} effect ledger contains multiple operations for one pending question`);
+            }
+            return matches[0];
+        }
+        function continuationBoundarySeed(operation, turnId) {
+            const latestBoundaryId = operation.boundaryIds.at(-1);
+            const latestBoundary = effectLedgerMirror.boundaries.find(({ boundaryId }) => boundaryId === latestBoundaryId);
+            if (latestBoundary === undefined) {
+                throw new Error(`${label} deferred logical operation has no latest physical boundary`);
+            }
+            return {
+                boundaryId: randomUUID(),
+                runtimeSessionId: latestBoundary.runtimeSessionId,
+                turnId,
+                callId: `player-${++playerCallSequence}`,
+                roleId: latestBoundary.roleId,
+                sourceStateId: latestBoundary.sourceStateId,
+                sourceOutcomeSchema: latestBoundary.sourceOutcomeSchema,
+                dispositions: latestBoundary.dispositions,
+                correctionBudget: { limit: 1, spent: false },
+            };
+        }
+        function bindSession(nextSession) {
+            const bound = snapshotPlaybookSession(nextSession);
+            if (bound.roleBindings === undefined)
+                return bound;
+            const actual = Object.keys(bound.roleBindings).sort();
+            const expected = [...declaredRoleIds].sort();
+            const missing = expected.filter((roleId) => !actual.includes(roleId));
+            const extra = actual.filter((roleId) => !expected.includes(roleId));
+            if (missing.length > 0 || extra.length > 0) {
+                throw new TypeError(`${label} session roleBindings must cover exactly [${expected.join(', ')}]` +
+                    `${missing.length === 0 ? '' : `; missing [${missing.join(', ')}]`}` +
+                    `${extra.length === 0 ? '' : `; extra [${extra.join(', ')}]`}`);
+            }
+            return bound;
+        }
+        function requireRoleId(input) {
+            const roleId = input.role;
+            if (typeof roleId !== 'string' ||
+                roleId.trim().length === 0 ||
+                !declaredRoleIds.includes(roleId)) {
+                throw new TypeError(`${label} player input role must name a declared local role`);
+            }
+            return roleId;
+        }
+        function resolvedPlayerId(roleId) {
+            return session?.roleBindings?.[roleId]?.playerId;
+        }
+        function promptIdentity(roleId) {
+            if (!declaredRoleIds.includes(roleId)) {
+                throw new TypeError(`${label} prompt identity lookup rejected undeclared role ${roleId}`);
+            }
+            return session?.roleBindings?.[roleId]?.promptIdentity ?? roleId;
+        }
+        function composeBoundPlayerPrompt(input) {
+            let active = true;
+            const lookup = (roleId) => {
+                if (!active) {
+                    throw new Error(`${label} prompt identity lookup is no longer active`);
+                }
+                return promptIdentity(roleId);
+            };
+            try {
+                return composePlayerPrompt(input, lookup);
+            }
+            finally {
+                active = false;
+            }
+        }
+        function continuationKey(roleId, playerId) {
+            return playerId ?? roleId;
+        }
+        function roleTokensByContinuationKey(tokens) {
+            const byKey = new Map();
+            for (const [roleId, token] of Object.entries(tokens)) {
+                if (!declaredRoleIds.includes(roleId)) {
+                    throw new TypeError(`runtime role tokens contain unknown role ${roleId}`);
+                }
+                const key = continuationKey(roleId, resolvedPlayerId(roleId));
+                const existing = byKey.get(key);
+                if (existing !== undefined && existing !== token) {
+                    throw new TypeError(`runtime snapshot assigns conflicting tokens to roles bound to player ${key}`);
+                }
+                byKey.set(key, token);
+            }
+            const rolesByKey = new Map();
+            for (const roleId of declaredRoleIds) {
+                const key = continuationKey(roleId, resolvedPlayerId(roleId));
+                rolesByKey.set(key, [...(rolesByKey.get(key) ?? []), roleId]);
+            }
+            for (const [key, roles] of rolesByKey) {
+                if (roles.length < 2)
+                    continue;
+                const present = roles.filter((roleId) => tokens[roleId] !== undefined);
+                if (present.length !== 0 && present.length !== roles.length) {
+                    throw new TypeError(`runtime role tokens must project player ${key} through every aliased role [${roles.join(', ')}]`);
+                }
+            }
+            return byKey;
+        }
+        function selectPlayerResume(roleId, playerId) {
+            const key = continuationKey(roleId, playerId);
+            const selected = session?.playerSessions
+                ? session.playerSessions.select(roleId)
+                : privateResumeTokens.get(key) ?? false;
+            if (selected !== false &&
+                (typeof selected !== 'string' || selected.trim().length === 0)) {
+                throw new TypeError(`player session store returned an invalid resume token for role ${roleId}`);
+            }
+            return selected;
+        }
+        function updatePlayerResume(roleId, playerId, result) {
+            const resumeToken = result.resumeToken;
+            if (resumeToken === undefined && result.status !== 'ok')
                 return;
             const key = continuationKey(roleId, playerId);
             if (session?.playerSessions) {
@@ -1457,16 +2492,31 @@ export function createXStatePlaybookRuntime(machine, spec) {
             for (const [key, token] of byKey)
                 privateResumeTokens.set(key, token);
         }
-        function enqueueEmission(fn) {
+        function enqueueEmission(fn, aborts = activeAborts) {
+            // The emission belongs to the boundary enqueueing it: a rejection
+            // causally identical to that boundary's abort reason is the
+            // cancellation's own evidence — never latched, so it cannot poison a
+            // later unrelated boundary (DR-036).
+            const enqueueAborts = aborts;
             const queued = emissionQueue.add(fn).then(() => undefined);
             activeEmissionCalls.add(queued);
             void queued.then(() => activeEmissionCalls.delete(queued), (error) => {
                 activeEmissionCalls.delete(queued);
-                emissionFailure ??= error;
+                if (enqueueAborts?.isAbortReason(error)) {
+                    // Record evidence only when it also belongs to the public
+                    // boundary that is still active. A background A cancellation
+                    // racing an unrelated B boundary is forgiven under A and must
+                    // not change B's settlement.
+                    if (activeAborts?.isAbortReason(error)) {
+                        activeAbortEmission ??= error;
+                    }
+                    return;
+                }
+                emissionFailure ??= { error };
             });
             return queued;
         }
-        async function drainEmissions() {
+        async function drainEmissions(_aborts = activeAborts) {
             while (true) {
                 const active = [...activeEmissionCalls];
                 if (active.length > 0)
@@ -1479,8 +2529,14 @@ export function createXStatePlaybookRuntime(machine, spec) {
                 }
             }
             if (emissionFailure !== undefined) {
-                const error = emissionFailure;
+                const { error } = emissionFailure;
                 emissionFailure = undefined;
+                // The failure was classified as distinct by its enqueue owner. If a
+                // later public boundary drains it, retain that classification in the
+                // boundary latch before throwing; its signal must not reinterpret
+                // the same object as cancellation (DR-036 decision 2).
+                if (activeSignal !== undefined)
+                    controlPlaneError ??= error;
                 throw error;
             }
         }
@@ -1500,7 +2556,7 @@ export function createXStatePlaybookRuntime(machine, spec) {
             const currentSession = requireSession();
             const safePayload = snapshotJsonValue(payload, `trace ${type} payload`);
             return {
-                schemaVersion: 3,
+                schemaVersion: 4,
                 sessionId: currentSession.sessionId,
                 playbookId: currentSession.playbookId,
                 rootSessionId: currentSession.rootSessionId,
@@ -1519,13 +2575,13 @@ export function createXStatePlaybookRuntime(machine, spec) {
                 payload: safePayload,
             };
         }
-        function emitTrace(type, payload, position = {}) {
+        function emitTrace(type, payload, position = {}, aborts) {
             const currentSession = requireSession();
             const event = createTraceEvent(type, payload, position);
             return enqueueEmission(() => currentSession.ports.emitTelemetry({
                 topic: 'playbook.trace',
                 payload: event,
-            }));
+            }), aborts);
         }
         function stateIdentity(stateId) {
             return stateId === undefined ? {} : { stateId };
@@ -1583,6 +2639,11 @@ export function createXStatePlaybookRuntime(machine, spec) {
             };
         }
         async function emitCallStarted(startedType, finishedType, identity, position, 
+        // The applicable combined signal: a start-sink rejection causally
+        // identical to its reason is the cancellation itself, not a control
+        // error — the pair finishes `aborted` and nothing latches
+        // (slc/link.md §Abort).
+        signal, 
         // Base payload of the best-effort finish emitted when the start sink
         // rejects; it defaults to the payload the start carried, which the
         // player, judge, and captain pairs take as-is. The apply pair cannot:
@@ -1594,11 +2655,12 @@ export function createXStatePlaybookRuntime(machine, spec) {
                 await emitTrace(startedType, identity, position);
             }
             catch (error) {
-                controlPlaneError ??= error;
+                if (!isAbortFailure(error, signal))
+                    controlPlaneError ??= error;
                 try {
                     await emitTrace(finishedType, {
                         ...finishIdentity,
-                        status: 'error',
+                        status: isAbortFailure(error, signal) ? 'aborted' : 'error',
                         error: normalizeError(error),
                     }, position);
                 }
@@ -1608,31 +2670,605 @@ export function createXStatePlaybookRuntime(machine, spec) {
                 throw error;
             }
         }
+        function governedBoundarySeed(input, roleId, callId, turnId) {
+            const governed = outcomeAuthority?.governedPlayerStates[input.stateId];
+            if (governed === undefined)
+                return undefined;
+            if (!Number.isSafeInteger(turnId) || turnId === undefined || turnId <= 0) {
+                throw new Error(`${label} governed player call requires an active positive turn id`);
+            }
+            const dispositions = [
+                ...new Set(Object.values(governed).map(({ repositoryDisposition }) => repositoryDisposition)),
+            ];
+            if (dispositions.length === 0) {
+                throw new Error(`${label} governed player call has no repository disposition`);
+            }
+            return {
+                boundaryId: randomUUID(),
+                // An adopted runtime keeps one durable effect-owner identity across
+                // every later target generation. New boundaries must join that same
+                // lineage; otherwise a boundary started by an intermediate target is
+                // no longer discoverable after the next adoption.
+                runtimeSessionId: retainedEffectSourceSessionId ?? requireSession().sessionId,
+                turnId,
+                callId,
+                roleId,
+                sourceStateId: input.stateId,
+                sourceOutcomeSchema: snapshotJsonValue(input.result, `${label} governed player source outcome schema`),
+                dispositions,
+                correctionBudget: { limit: 1, spent: false },
+            };
+        }
+        function boundPendingQuestion(input, roleId, output) {
+            if (output.guard !== 'needsBossReply' || typeof output.question !== 'string') {
+                throw new TypeError(`${label} deferred outcome must carry one exact Boss question`);
+            }
+            return {
+                questionId: input.stateId,
+                resumeStateId: input.stateId,
+                sourceItem: input.sourceItem,
+                asker: { kind: 'role', roleId },
+                question: output.question,
+            };
+        }
+        function detachedPlayerContinuation(roleId, playerId) {
+            return snapshotJsonValue(selectPlayerResume(roleId, playerId), `${label} deferred player continuation`);
+        }
+        function completionEvidenceFor(input, roleId, playerId, signal, operationId) {
+            return async (completion) => {
+                const { operation } = completion;
+                let evidence;
+                if (operation.status !== 'fulfilled' ||
+                    operation.value.status !== 'ok' ||
+                    isEmptyFinalText(operation.value.finalText)) {
+                    evidence = operation.status === 'fulfilled' &&
+                        operation.value.status === 'ok' &&
+                        operation.value.finalText !== undefined
+                        ? { finalText: operation.value.finalText }
+                        : {};
+                }
+                else {
+                    const finalText = operation.value.finalText;
+                    evidence = await reconcileGovernedCompletion(input, roleId, playerId, finalText, signal, operationId, completion);
+                }
+                rememberGovernedCompletionEvidence(completion.boundary.boundaryId, evidence);
+                return evidence;
+            };
+        }
+        function rememberGovernedCompletionEvidence(boundaryId, evidence) {
+            const previous = governedCompletionEvidenceByBoundaryId.get(boundaryId);
+            governedCompletionEvidenceByBoundaryId.set(boundaryId, {
+                ...previous,
+                boundaryEvidence: {
+                    ...(Object.prototype.hasOwnProperty.call(evidence, 'finalText')
+                        ? { finalText: evidence.finalText }
+                        : {}),
+                    ...(Object.prototype.hasOwnProperty.call(evidence, 'semanticCandidate')
+                        ? { semanticCandidate: evidence.semanticCandidate }
+                        : {}),
+                },
+            });
+        }
+        function unresolvedGovernedSettlement(reason, error, signal = activeSignal) {
+            if (error !== undefined && signal?.aborted && Object.is(error, signal.reason)) {
+                return { status: 'unresolved', error };
+            }
+            const failure = error instanceof Error
+                ? error
+                : new Error(`${label} governed outcome remains unresolved: ${reason}`);
+            return {
+                status: 'unresolved',
+                error: markFsmResultFailure(failure),
+            };
+        }
+        async function spendSemanticCorrectionBudget(completedBoundary, receipt, finalText, semanticCandidate) {
+            if (effectLedgerCapability === undefined)
+                return undefined;
+            const currentLedger = currentEffectLedger();
+            const current = currentLedger.boundaries.find(({ boundaryId }) => boundaryId === completedBoundary.boundaryId);
+            if (current === undefined ||
+                current.correctionBudget.limit !== 1 ||
+                current.correctionBudget.spent) {
+                return undefined;
+            }
+            if (current.finalText !== undefined &&
+                current.finalText !== finalText) {
+                throw new TypeError(`${label} correction budget boundary conflicts with retained finalText`);
+            }
+            if (current.physicalReceipt !== undefined &&
+                !isDeepStrictEqual(current.physicalReceipt, receipt)) {
+                throw new TypeError(`${label} correction budget boundary conflicts with its repository receipt`);
+            }
+            if (semanticCandidate !== undefined &&
+                current.semanticCandidate !== undefined &&
+                !isDeepStrictEqual(current.semanticCandidate, semanticCandidate)) {
+                throw new TypeError(`${label} correction budget boundary conflicts with its retained semantic candidate`);
+            }
+            const next = {
+                ...current,
+                ...(receipt.after === undefined ? {} : { after: receipt.after }),
+                physicalReceipt: receipt,
+                finalText,
+                ...(semanticCandidate === undefined ? {} : { semanticCandidate }),
+                correctionBudget: { limit: 1, spent: true },
+            };
+            const acknowledged = assertPlaybookEffectLedger(await effectLedgerCapability.writeAhead([
+                {
+                    kind: 'replace-boundaries',
+                    replacements: [{ expected: current, next }],
+                },
+            ]), `${label} semantic correction budget acknowledgement`);
+            effectLedgerMirror = acknowledged;
+            refreshRetainedEffectReconciliation(acknowledged);
+            syncDeferredReconciliationOverlay();
+            refreshUnresolvedSemanticReconciliation(acknowledged);
+            const spent = acknowledged.boundaries.find(({ boundaryId }) => boundaryId === completedBoundary.boundaryId);
+            if (spent === undefined ||
+                !isDeepStrictEqual(spent, next)) {
+                throw new TypeError(`${label} semantic correction budget spend was not acknowledged exactly`);
+            }
+            return spent;
+        }
+        async function reconcileGovernedCompletion(input, roleId, playerId, finalText, signal, operationId, completion) {
+            const outcomes = outcomeAuthority?.governedPlayerStates[input.stateId];
+            if (outcomes === undefined) {
+                throw new TypeError(`${label} governed semantic reconciliation has no authority for ${input.stateId}`);
+            }
+            if (completion.boundary.sourceStateId !== input.stateId ||
+                !isDeepStrictEqual(completion.boundary.sourceOutcomeSchema, input.result)) {
+                throw new TypeError(`${label} governed semantic reconciliation source schema changed`);
+            }
+            let raw;
+            try {
+                raw = await boundary.callJudge('player-output-adjudication', input.stateId, buildGovernedJudgePrompt(input, finalText, outcomes), signal);
+            }
+            catch (error) {
+                governedSettlementsByBoundaryId.set(completion.boundary.boundaryId, unresolvedGovernedSettlement('judge transport failed', error, signal));
+                return { finalText, unresolved: true };
+            }
+            let candidate;
+            let retainedSemanticCandidate;
+            const retainSemanticCandidate = (value) => {
+                try {
+                    retainedSemanticCandidate = snapshotJsonValue(value, `${label} recoverable governed semantic candidate`);
+                }
+                catch {
+                    // A malformed or non-detachable reply supplies no durable
+                    // candidate; presentation and receipt evidence still survive.
+                }
+            };
+            const unresolvedEvidence = () => ({
+                finalText,
+                ...(retainedSemanticCandidate === undefined
+                    ? {}
+                    : { semanticCandidate: retainedSemanticCandidate }),
+                unresolved: true,
+            });
+            let reconciliation;
+            let structuralError;
+            try {
+                candidate = parseGovernedSemanticCandidate(raw);
+                retainSemanticCandidate(candidate);
+                reconciliation = reconcilePlaybookSemanticEvidence({
+                    outcomes,
+                    semanticCandidate: candidate,
+                    finalText,
+                    receipt: completion.outcomeReceipt,
+                });
+            }
+            catch (error) {
+                if (!(error instanceof PlaybookSemanticCandidateStructureError)) {
+                    throw error;
+                }
+                structuralError = error;
+            }
+            if (structuralError !== undefined) {
+                let spent;
+                try {
+                    spent = await spendSemanticCorrectionBudget(completion.boundary, completion.receipt, finalText, retainedSemanticCandidate);
+                }
+                catch (error) {
+                    // A failed or indeterminate spend cannot authorize another judge.
+                    // Let the repository coordinator quarantine its still-owned claim;
+                    // an acknowledged write remains durable and one-way on recovery.
+                    throw error;
+                }
+                if (spent === undefined) {
+                    governedSettlementsByBoundaryId.set(completion.boundary.boundaryId, unresolvedGovernedSettlement('semantic correction budget is unavailable'));
+                    return unresolvedEvidence();
+                }
+                if (signal.aborted) {
+                    governedSettlementsByBoundaryId.set(completion.boundary.boundaryId, unresolvedGovernedSettlement('semantic correction was aborted before its judge call', signal.reason, signal));
+                    return unresolvedEvidence();
+                }
+                let correctiveRaw;
+                try {
+                    correctiveRaw = await boundary.callJudge('player-output-adjudication', input.stateId, buildGovernedJudgePrompt(input, finalText, outcomes, {
+                        reply: raw,
+                        error: structuralError.message,
+                    }), signal);
+                }
+                catch (error) {
+                    governedSettlementsByBoundaryId.set(completion.boundary.boundaryId, unresolvedGovernedSettlement('corrective judge failed', error, signal));
+                    return unresolvedEvidence();
+                }
+                try {
+                    candidate = parseGovernedSemanticCandidate(correctiveRaw);
+                    retainSemanticCandidate(candidate);
+                    reconciliation = reconcilePlaybookSemanticEvidence({
+                        outcomes,
+                        semanticCandidate: candidate,
+                        finalText,
+                        receipt: completion.outcomeReceipt,
+                    });
+                }
+                catch (error) {
+                    if (!(error instanceof PlaybookSemanticCandidateStructureError)) {
+                        throw error;
+                    }
+                    governedSettlementsByBoundaryId.set(completion.boundary.boundaryId, unresolvedGovernedSettlement('corrective semantic candidate is invalid'));
+                    return unresolvedEvidence();
+                }
+            }
+            if (reconciliation === undefined) {
+                throw new Error(`${label} semantic reconciliation produced no decision`);
+            }
+            const semanticCandidate = snapshotJsonValue(reconciliation.evidence.semanticCandidate, `${label} governed semantic candidate`);
+            if (reconciliation.status === 'unresolved') {
+                governedSettlementsByBoundaryId.set(completion.boundary.boundaryId, unresolvedGovernedSettlement(reconciliation.reason));
+                return { finalText, semanticCandidate, unresolved: true };
+            }
+            const output = reconciliation.output;
+            validateBossReplyOutput(input, output, resumableStateIds);
+            governedSettlementsByBoundaryId.set(completion.boundary.boundaryId, {
+                status: 'resolved',
+                output,
+            });
+            governedCompletionEvidenceByBoundaryId.set(completion.boundary.boundaryId, {
+                boundaryEvidence: {},
+                reconciliationStatus: reconciliation.status,
+                output,
+            });
+            if (reconciliation.status !== 'deferred') {
+                return { finalText, semanticCandidate };
+            }
+            const pending = boundPendingQuestion(input, roleId, output);
+            const bindingId = operationId ?? randomUUID();
+            expectedBoundPendingQuestion = pending;
+            return {
+                finalText,
+                semanticCandidate,
+                deferred: {
+                    operationId: bindingId,
+                    pendingQuestion: {
+                        questionId: pending.questionId,
+                        asker: pending.asker,
+                        question: pending.question,
+                        sourceItem: pending.sourceItem,
+                    },
+                    playerContinuation: detachedPlayerContinuation(roleId, playerId),
+                },
+            };
+        }
+        async function deferredContinuationCompletionEvidence(completion) {
+            const remember = (evidence) => {
+                rememberGovernedCompletionEvidence(completion.boundary.boundaryId, evidence);
+                return evidence;
+            };
+            const continuation = activeDeferredContinuation;
+            if (continuation === undefined) {
+                throw new Error(`${label} deferred continuation completed without active runtime context`);
+            }
+            const result = continuation.result;
+            if (completion.operation.status !== 'fulfilled' ||
+                completion.operation.value !== null ||
+                result === undefined ||
+                result.status !== 'ok' ||
+                isEmptyFinalText(result.finalText)) {
+                if (completion.outcomeReceipt.classification === 'unchanged' &&
+                    (continuation.callError !== undefined ||
+                        (result !== undefined && result.status !== 'ok'))) {
+                    return remember({});
+                }
+                governedSettlementsByBoundaryId.set(completion.boundary.boundaryId, unresolvedGovernedSettlement('deferred player result has no semantic evidence', continuation.callError));
+                return remember({
+                    ...(result?.status !== 'ok' || result.finalText === undefined
+                        ? {}
+                        : { finalText: result.finalText }),
+                    unresolved: true,
+                });
+            }
+            const input = continuation.input;
+            const roleId = continuation.roleId;
+            const signal = continuation.signal;
+            if (input === undefined || roleId === undefined || signal === undefined) {
+                throw new Error(`${label} deferred continuation lost its bound player identity or signal`);
+            }
+            return remember(await reconcileGovernedCompletion(input, roleId, continuation.playerId, result.finalText, signal, continuation.operationId, completion));
+        }
+        function assertAcknowledgedGovernedEvidence(completed, settlement, ledger) {
+            const expected = governedCompletionEvidenceByBoundaryId.get(completed.boundaryId);
+            if (expected === undefined ||
+                (Object.prototype.hasOwnProperty.call(expected.boundaryEvidence, 'finalText')
+                    ? completed.finalText !== expected.boundaryEvidence.finalText
+                    : completed.finalText !== undefined) ||
+                (Object.prototype.hasOwnProperty.call(expected.boundaryEvidence, 'semanticCandidate')
+                    ? !isDeepStrictEqual(completed.semanticCandidate, expected.boundaryEvidence.semanticCandidate)
+                    : completed.semanticCandidate !== undefined)) {
+                throw new TypeError(`${label} repository did not acknowledge the exact governed semantic evidence`);
+            }
+            if (settlement?.status !== 'resolved')
+                return;
+            const persisted = persistedBoundaryReconciliation(completed, ledger);
+            if (persisted === undefined ||
+                persisted.historicalDeferred ||
+                persisted.reconciliation.status !== expected.reconciliationStatus ||
+                !isDeepStrictEqual(persisted.reconciliation.output, expected.output) ||
+                !isDeepStrictEqual(expected.output, settlement.output)) {
+                throw new TypeError(`${label} repository did not acknowledge the exact governed semantic evidence`);
+            }
+        }
+        function recordActiveGovernedAttempt(boundary) {
+            if (activeGovernedAttemptId !== undefined &&
+                activeGovernedAttemptId !== boundary.attemptId) {
+                throw new Error(`${label} governed calls in one runtime boundary used different host attempt ids`);
+            }
+            activeGovernedAttemptId = boundary.attemptId;
+        }
+        function refreshGovernedBoundaryStart(boundaryId) {
+            try {
+                const current = currentEffectLedger();
+                const boundary = current.boundaries.find((candidate) => candidate.boundaryId === boundaryId);
+                if (boundary === undefined)
+                    return;
+                effectLedgerMirror = current;
+                refreshRetainedEffectReconciliation(current);
+                recordActiveGovernedAttempt(boundary);
+            }
+            catch {
+                // Preserve the repository failure. A mirror that cannot be read or
+                // validated supplies no evidence authorizing replay.
+            }
+        }
+        function acknowledgeGovernedPlayerResult(value, boundaryId, source = 'runExclusive') {
+            if (!isPlainObject(value) || !isPlainObject(value.operation)) {
+                throw new TypeError(`${label} repository ${source} returned an invalid settlement`);
+            }
+            const ledger = assertPlaybookEffectLedger(value.effectLedger, `${label} repository ${source} effect ledger`);
+            const completed = ledger.boundaries.find((candidate) => candidate.boundaryId === boundaryId);
+            if (completed === undefined ||
+                completed.physicalReceipt === undefined ||
+                !isDeepStrictEqual(completed.physicalReceipt, value.receipt)) {
+                throw new TypeError(`${label} repository ${source} did not acknowledge its completed boundary`);
+            }
+            effectLedgerMirror = ledger;
+            refreshRetainedEffectReconciliation(ledger);
+            syncDeferredReconciliationOverlay();
+            refreshUnresolvedSemanticReconciliation(ledger);
+            recordActiveGovernedAttempt(completed);
+            if (value.operation.status === 'rejected') {
+                if (!Object.prototype.hasOwnProperty.call(value.operation, 'reason')) {
+                    throw new TypeError(`${label} repository ${source} rejection omitted its reason`);
+                }
+                throw value.operation.reason;
+            }
+            if (value.operation.status !== 'fulfilled' ||
+                !Object.prototype.hasOwnProperty.call(value.operation, 'value')) {
+                throw new TypeError(`${label} repository ${source} returned an invalid operation settlement`);
+            }
+            const result = validatePlayerResult(value.operation.value);
+            playerBoundaryReceipts.set(result, {
+                boundaryId: completed.boundaryId,
+                attemptId: completed.attemptId,
+            });
+            let governedSettlement = governedSettlementsByBoundaryId.get(boundaryId);
+            if (governedSettlement === undefined &&
+                result.status === 'ok' &&
+                !isEmptyFinalText(result.finalText)) {
+                governedSettlement = unresolvedGovernedSettlement('host omitted governed semantic settlement');
+            }
+            assertAcknowledgedGovernedEvidence(completed, governedSettlement, ledger);
+            governedCompletionEvidenceByBoundaryId.delete(boundaryId);
+            let governedOutput = governedSettlement?.status === 'resolved'
+                ? governedSettlement.output
+                : undefined;
+            const governedDisposition = governedOutput === undefined
+                ? undefined
+                : governedOutcomesForBoundary(completed)?.[governedOutput.guard]
+                    ?.repositoryDisposition;
+            if (source === 'runExclusive' && governedDisposition === 'deferred') {
+                if (value.deferredStatus !== 'bound' &&
+                    value.deferredStatus !== 'unresolved') {
+                    throw new TypeError(`${label} deferred settlement omitted its durable binding status`);
+                }
+                const operationId = completed.logicalOperationId;
+                if (operationId === undefined) {
+                    throw new TypeError(`${label} deferred settlement omitted its logical operation`);
+                }
+                if (value.deferredStatus === 'bound') {
+                    if (expectedBoundPendingQuestion === undefined ||
+                        currentBoundDeferredOperation(expectedBoundPendingQuestion)
+                            ?.operationId !== operationId) {
+                        throw new TypeError(`${label} deferred settlement did not acknowledge its exact bound question`);
+                    }
+                }
+                else {
+                    if (deferredReconciliationOperationId !== operationId) {
+                        throw new TypeError(`${label} unresolved deferred settlement is not structurally unresolved`);
+                    }
+                    expectedBoundPendingQuestion = undefined;
+                    governedSettlement = unresolvedGovernedSettlement('deferred question did not receive an eligible durable binding');
+                    governedOutput = undefined;
+                }
+            }
+            else if (source === 'runExclusive' && value.deferredStatus !== undefined) {
+                throw new TypeError(`${label} non-deferred settlement returned a deferred binding status`);
+            }
+            if (governedSettlement !== undefined) {
+                governedSettlementsByBoundaryId.delete(boundaryId);
+                governedPlayerSettlements.set(result, governedSettlement);
+                if (governedSettlement.status === 'unresolved') {
+                    unresolvedSemanticBoundaryIds.add(boundaryId);
+                }
+                else {
+                    unresolvedSemanticBoundaryIds.delete(boundaryId);
+                }
+            }
+            return result;
+        }
+        function acknowledgedBoundaryIsUnchanged(result) {
+            if (outcomeAuthority === undefined)
+                return true;
+            const identity = playerBoundaryReceipts.get(result);
+            if (identity === undefined)
+                return false;
+            const boundary = effectLedgerMirror.boundaries.find((candidate) => candidate.boundaryId === identity.boundaryId);
+            return (boundary?.attemptId === identity.attemptId &&
+                boundary.physicalReceipt?.classification === 'unchanged');
+        }
+        function failedAttemptMatchesCurrentLedger(current) {
+            const boundaryPrefix = failedEffectBoundaryPrefix;
+            if (failedGovernedAttemptUnknown ||
+                boundaryPrefix === undefined) {
+                return false;
+            }
+            const causalBoundaries = current.boundaries.filter(({ sequence }) => sequence > boundaryPrefix);
+            const matches = failedGovernedAttemptId === undefined
+                ? causalBoundaries.length === 0
+                : causalBoundaries.length > 0 &&
+                    causalBoundaries.every(({ attemptId }) => attemptId === failedGovernedAttemptId);
+            if (!matches)
+                failedGovernedAttemptUnknown = true;
+            return matches;
+        }
+        function failedAttemptAllowsReplay() {
+            if (!hasGovernedPlayerStates)
+                return true;
+            if (unresolvedSemanticBoundaryIds.size > 0)
+                return false;
+            let current;
+            try {
+                current = currentEffectLedger();
+                effectLedgerMirror = current;
+                refreshRetainedEffectReconciliation(current);
+                refreshUnresolvedSemanticReconciliation(current);
+            }
+            catch {
+                failedGovernedAttemptUnknown = true;
+                return false;
+            }
+            if (unresolvedSemanticBoundaryIds.size > 0)
+                return false;
+            if (!failedAttemptMatchesCurrentLedger(current))
+                return false;
+            if (failedGovernedAttemptId === undefined)
+                return true;
+            const boundaries = current.boundaries.filter(({ attemptId }) => attemptId === failedGovernedAttemptId);
+            return (boundaries.length > 0 &&
+                boundaries.every(({ physicalReceipt }) => physicalReceipt?.classification === 'unchanged'));
+        }
+        function captureEffectLedgerPrefixSequence() {
+            if (!hasGovernedPlayerStates)
+                return undefined;
+            try {
+                const current = currentEffectLedger();
+                effectLedgerMirror = current;
+                refreshRetainedEffectReconciliation(current);
+                return current.boundaries.at(-1)?.sequence ?? 0;
+            }
+            catch {
+                return undefined;
+            }
+        }
+        function bindAutomaticReplayBoundary(prefixSequence) {
+            activeGovernedBoundarySeen = false;
+            activeGovernedAttemptId = undefined;
+            activeEffectLedgerPrefixSequence = prefixSequence;
+        }
+        function beginAutomaticReplayBoundary() {
+            bindAutomaticReplayBoundary(captureEffectLedgerPrefixSequence());
+        }
+        function latchFailedGovernedAttempt() {
+            if (!hasGovernedPlayerStates) {
+                failedGovernedAttemptUnknown = false;
+                failedEffectBoundaryPrefix = undefined;
+                failedGovernedAttemptId = undefined;
+                return;
+            }
+            if (activeEffectLedgerPrefixSequence === undefined) {
+                failedGovernedAttemptUnknown = true;
+                failedEffectBoundaryPrefix = undefined;
+                failedGovernedAttemptId = undefined;
+                return;
+            }
+            let current;
+            try {
+                current = currentEffectLedger();
+                effectLedgerMirror = current;
+                refreshRetainedEffectReconciliation(current);
+            }
+            catch {
+                failedGovernedAttemptUnknown = true;
+                failedEffectBoundaryPrefix = undefined;
+                failedGovernedAttemptId = undefined;
+                return;
+            }
+            const attemptIds = new Set(current.boundaries
+                .filter(({ sequence }) => sequence > activeEffectLedgerPrefixSequence)
+                .map(({ attemptId }) => attemptId));
+            if (activeGovernedAttemptId !== undefined) {
+                attemptIds.add(activeGovernedAttemptId);
+            }
+            if (attemptIds.size > 1) {
+                failedGovernedAttemptUnknown = true;
+                failedEffectBoundaryPrefix = undefined;
+                failedGovernedAttemptId = undefined;
+                return;
+            }
+            failedGovernedAttemptUnknown =
+                attemptIds.size === 0 && activeGovernedBoundarySeen;
+            failedEffectBoundaryPrefix = failedGovernedAttemptUnknown
+                ? undefined
+                : activeEffectLedgerPrefixSequence;
+            failedGovernedAttemptId = attemptIds.values().next().value;
+        }
         const boundary = {
             async callPlayer(input, roleId, prompt, signal) {
                 // State-entry telemetry/status must precede the call they describe.
                 await drainEmissions();
+                signal.throwIfAborted();
+                const deferredContinuation = activeDeferredContinuation;
+                const reconstructed = takeReconstructedGovernedPlayerResult(input, roleId);
+                if (reconstructed !== undefined)
+                    return reconstructed;
+                if (deferredContinuation === undefined &&
+                    hasUnresolvedReconciliation()) {
+                    throw markFsmResultFailure(new Error(`${label} governed semantic reconciliation remains unresolved`));
+                }
                 const turnId = activeTurnId;
                 const stateId = input.stateId;
                 const playerId = resolvedPlayerId(roleId);
-                let resume;
+                let selectedResume;
                 try {
                     signal.throwIfAborted();
-                    resume = selectPlayerResume(roleId, playerId);
+                    selectedResume =
+                        deferredContinuation?.playerContinuation ??
+                            selectPlayerResume(roleId, playerId);
                 }
                 catch (error) {
-                    if (!signal.aborted)
+                    if (!isAbortFailure(error, signal))
                         controlPlaneError ??= error;
                     throw error;
                 }
-                const callId = `player-${++playerCallSequence}`;
-                const identity = {
+                const callId = deferredContinuation?.effectBoundary.callId ??
+                    `player-${++playerCallSequence}`;
+                const callIdentity = (resume) => ({
                     ...stateIdentity(stateId),
                     sourceItem: input.sourceItem,
                     roleId,
                     ...(playerId === undefined ? {} : { playerId }),
                     resume,
-                };
+                });
                 const position = {
                     ...(turnId !== undefined ? { turnId } : {}),
                     callId,
@@ -1640,92 +3276,182 @@ export function createXStatePlaybookRuntime(machine, spec) {
                 const playerKey = continuationKey(roleId, playerId);
                 if (activePlayerKeys.has(playerKey)) {
                     const error = new Error(`simultaneous calls to player key ${playerKey} are not allowed`);
-                    await emitCallStarted('player.call.started', 'player.call.finished', { ...identity, prompt }, position);
-                    await emitTrace('player.call.finished', { ...identity, status: 'error', error: normalizeError(error) }, position);
+                    await emitCallStarted('player.call.started', 'player.call.finished', { ...callIdentity(selectedResume), prompt }, position, signal);
+                    await emitTrace('player.call.finished', {
+                        ...callIdentity(selectedResume),
+                        status: 'error',
+                        error: normalizeError(error),
+                    }, position);
                     throw error;
                 }
                 activePlayerKeys.add(playerKey);
                 try {
-                    await emitTrace('player.call.started', { ...identity, prompt }, position);
-                    let rawResult;
-                    try {
-                        // An abort may land while the awaited started emission drains
-                        // (e.g. fired from the trace sink itself); the host call must
-                        // never start after abort, so settle the already-started pair
-                        // as `aborted` through the catch below.
-                        signal.throwIfAborted();
-                        rawResult = await requireHostPorts().callPlayer(roleId, prompt, signal, { resume });
-                        // A host promise is not required to honor cancellation. Do not let
-                        // a late result mutate continuity or publish a successful finish.
-                        signal.throwIfAborted();
-                    }
-                    catch (error) {
-                        if (!signal.aborted)
-                            controlPlaneError ??= error;
+                    const runTracedPlayerCall = async (resume = selectedResume) => {
+                        const identity = callIdentity(resume);
+                        await emitCallStarted('player.call.started', 'player.call.finished', { ...identity, prompt }, position, signal);
+                        let rawResult;
                         try {
-                            await emitTrace('player.call.finished', {
-                                ...identity,
-                                status: signal.aborted ? 'aborted' : 'error',
-                                error: normalizeError(error),
-                            }, position);
+                            // An abort may land while the awaited started emission drains
+                            // (e.g. fired from the trace sink itself); the host call must
+                            // never start after abort, so settle the already-started pair
+                            // as `aborted` through the catch below.
+                            signal.throwIfAborted();
+                            rawResult = await requireHostPorts().callPlayer(roleId, prompt, signal, { resume });
+                            // A host promise is not required to honor cancellation. Do not
+                            // let a late result mutate continuity or publish a successful
+                            // finish.
+                            signal.throwIfAborted();
                         }
-                        catch {
-                            // The original non-abort port rejection remains authoritative.
+                        catch (error) {
+                            if (!isAbortFailure(error, signal))
+                                controlPlaneError ??= error;
+                            try {
+                                await emitTrace('player.call.finished', {
+                                    ...identity,
+                                    status: isAbortFailure(error, signal) ? 'aborted' : 'error',
+                                    error: normalizeError(error),
+                                }, position);
+                            }
+                            catch {
+                                // The original non-abort port rejection remains authoritative.
+                            }
+                            // A thrown port call carries no authoritative result, so the
+                            // prior token remains available for a later explicit resume.
+                            throw error;
                         }
-                        // A thrown port call carries no authoritative result, so the
-                        // prior token remains available for a later explicit resume.
-                        throw error;
-                    }
-                    let result;
-                    try {
-                        result = validatePlayerResult(rawResult);
-                    }
-                    catch (error) {
-                        if (!signal.aborted)
-                            controlPlaneError ??= error;
+                        let result;
                         try {
-                            await emitTrace('player.call.finished', { ...identity, status: 'error', error: normalizeError(error) }, position);
+                            result = validatePlayerResult(rawResult);
                         }
-                        catch {
-                            // The malformed host result remains authoritative.
+                        catch (error) {
+                            if (!isAbortFailure(error, signal))
+                                controlPlaneError ??= error;
+                            try {
+                                await emitTrace('player.call.finished', { ...identity, status: 'error', error: normalizeError(error) }, position);
+                            }
+                            catch {
+                                // The malformed host result remains authoritative.
+                            }
+                            throw error;
                         }
-                        throw error;
-                    }
-                    try {
-                        updatePlayerResume(roleId, playerId, result);
-                    }
-                    catch (error) {
-                        if (!signal.aborted)
-                            controlPlaneError ??= error;
                         try {
-                            await emitTrace('player.call.finished', { ...identity, status: 'error', error: normalizeError(error) }, position);
+                            updatePlayerResume(roleId, playerId, result);
                         }
-                        catch {
-                            // The continuation-store failure remains authoritative.
+                        catch (error) {
+                            if (!isAbortFailure(error, signal))
+                                controlPlaneError ??= error;
+                            try {
+                                await emitTrace('player.call.finished', { ...identity, status: 'error', error: normalizeError(error) }, position);
+                            }
+                            catch {
+                                // The continuation-store failure remains authoritative.
+                            }
+                            throw error;
+                        }
+                        await emitTrace('player.call.finished', {
+                            ...identity,
+                            status: result.status,
+                            ...(result.finalText !== undefined
+                                ? { finalText: result.finalText }
+                                : {}),
+                            ...(result.error !== undefined
+                                ? { error: normalizeError(result.error) }
+                                : {}),
+                            ...(result.resumeToken !== undefined
+                                ? { resumeToken: result.resumeToken }
+                                : {}),
+                        }, position);
+                        return result;
+                    };
+                    const effectBoundary = governedBoundarySeed(input, roleId, callId, turnId);
+                    if (deferredContinuation !== undefined) {
+                        if (effectBoundary === undefined ||
+                            effectBoundary.runtimeSessionId !==
+                                deferredContinuation.effectBoundary.runtimeSessionId ||
+                            effectBoundary.turnId !== deferredContinuation.effectBoundary.turnId ||
+                            effectBoundary.callId !== deferredContinuation.effectBoundary.callId ||
+                            effectBoundary.roleId !== deferredContinuation.effectBoundary.roleId ||
+                            effectBoundary.sourceStateId !==
+                                deferredContinuation.effectBoundary.sourceStateId ||
+                            !isDeepStrictEqual(effectBoundary.sourceOutcomeSchema, deferredContinuation.effectBoundary.sourceOutcomeSchema) ||
+                            !isDeepStrictEqual(effectBoundary.dispositions, deferredContinuation.effectBoundary.dispositions)) {
+                            throw new TypeError(`${label} deferred continuation did not invoke its bound player boundary`);
+                        }
+                        activeGovernedBoundarySeen = true;
+                        deferredContinuation.input = input;
+                        deferredContinuation.roleId = roleId;
+                        deferredContinuation.playerId = playerId;
+                        deferredContinuation.signal = signal;
+                        try {
+                            deferredContinuation.result = await runTracedPlayerCall(selectedResume);
+                        }
+                        catch (error) {
+                            deferredContinuation.callError = error;
+                        }
+                        finally {
+                            deferredContinuation.rawPlayerSettled.resolve();
+                        }
+                        return await deferredContinuation.delivery.promise;
+                    }
+                    // Await inside this try so its finally retains the player-key
+                    // exclusion until the host operation actually settles.
+                    if (effectBoundary === undefined)
+                        return await runTracedPlayerCall();
+                    if (repositoryCapability === undefined) {
+                        throw new Error(`${label} governed player call requires repository.runExclusive`);
+                    }
+                    activeGovernedBoundarySeen = true;
+                    try {
+                        const exclusive = await repositoryCapability.runExclusive({
+                            signal,
+                            effectBoundary,
+                            operation: () => runTracedPlayerCall(),
+                            completeEffectBoundary: completionEvidenceFor(input, roleId, playerId, signal, undefined),
+                        });
+                        return acknowledgeGovernedPlayerResult(exclusive, effectBoundary.boundaryId);
+                    }
+                    catch (error) {
+                        if (expectedBoundPendingQuestion !== undefined) {
+                            closeAfterIndeterminateDeferredSettlement(undefined, error);
                         }
+                        expectedBoundPendingQuestion = undefined;
+                        governedSettlementsByBoundaryId.delete(effectBoundary.boundaryId);
+                        governedCompletionEvidenceByBoundaryId.delete(effectBoundary.boundaryId);
+                        refreshGovernedBoundaryStart(effectBoundary.boundaryId);
+                        if (!isAbortFailure(error, signal))
+                            controlPlaneError ??= error;
                         throw error;
                     }
-                    await emitTrace('player.call.finished', {
-                        ...identity,
-                        status: result.status,
-                        ...(result.finalText !== undefined
-                            ? { finalText: result.finalText }
-                            : {}),
-                        ...(result.error !== undefined
-                            ? { error: normalizeError(result.error) }
-                            : {}),
-                        ...(result.resumeToken !== undefined
-                            ? { resumeToken: result.resumeToken }
-                            : {}),
-                    }, position);
-                    return result;
                 }
                 finally {
                     activePlayerKeys.delete(playerKey);
                 }
             },
+            takeGovernedPlayerOutput(result) {
+                const settlement = governedPlayerSettlements.get(result);
+                if (settlement !== undefined)
+                    governedPlayerSettlements.delete(result);
+                return settlement;
+            },
+            recordGovernedPlayerOutput(result, output) {
+                const reconstructed = reconstructedGovernedResults.get(result);
+                if (reconstructed === undefined)
+                    return;
+                reconstructedGovernedResults.delete(result);
+                const persisted = persistedBoundaryReconciliation(reconstructed, effectLedgerMirror);
+                if (persisted === undefined ||
+                    persisted.reconciliation.status !== 'resolved' ||
+                    !isDeepStrictEqual(persisted.reconciliation.output, output)) {
+                    unresolvedSemanticBoundaryIds.add(reconstructed.boundaryId);
+                    throw markFsmResultFailure(new Error(`${label} reconstructed governed output changed before FSM acceptance`));
+                }
+                reconstructedAcceptancePending = reconstructed;
+            },
             async callJudge(purpose, stateId, prompt, signal) {
                 return judgeQueue.add(async () => {
+                    const governedSemanticJudge = purpose === 'player-output-adjudication' &&
+                        stateId !== undefined &&
+                        outcomeAuthority.governedPlayerStates[stateId] !== undefined;
                     signal.throwIfAborted();
                     // A transition/status queued synchronously by XState must reach
                     // the host before the judge call that follows it.
@@ -1738,7 +3464,7 @@ export function createXStatePlaybookRuntime(machine, spec) {
                         ...(turnId !== undefined ? { turnId } : {}),
                         callId,
                     };
-                    await emitCallStarted('judge.call.started', 'judge.call.finished', { ...identity, prompt }, position);
+                    await emitCallStarted('judge.call.started', 'judge.call.finished', { ...identity, prompt }, position, signal);
                     let reply;
                     try {
                         // An abort may land while the awaited started emission drains
@@ -1750,19 +3476,20 @@ export function createXStatePlaybookRuntime(machine, spec) {
                         signal.throwIfAborted();
                     }
                     catch (error) {
-                        if (!isAbortFailure(error, signal)) {
+                        if (!isAbortFailure(error, signal) && !governedSemanticJudge) {
                             controlPlaneError ??= error;
                         }
                         await emitTrace('judge.call.finished', {
                             ...identity,
-                            status: signal.aborted ? 'aborted' : 'error',
+                            status: isAbortFailure(error, signal) ? 'aborted' : 'error',
                             error: normalizeError(error),
                         }, position);
                         throw error;
                     }
                     if (typeof reply !== 'string') {
                         const error = new TypeError('judge reply must be a string');
-                        controlPlaneError ??= error;
+                        if (!governedSemanticJudge)
+                            controlPlaneError ??= error;
                         await emitTrace('judge.call.finished', { ...identity, status: 'error', error: normalizeError(error) }, position);
                         throw error;
                     }
@@ -1802,7 +3529,7 @@ export function createXStatePlaybookRuntime(machine, spec) {
                         ...(turnId !== undefined ? { turnId } : {}),
                         callId,
                     };
-                    await emitCallStarted('captain.call.started', 'captain.call.finished', { ...identity, prompt }, position);
+                    await emitCallStarted('captain.call.started', 'captain.call.finished', { ...identity, prompt }, position, signal);
                     let rawResult;
                     try {
                         // An abort may land while the awaited started emission drains
@@ -1824,7 +3551,7 @@ export function createXStatePlaybookRuntime(machine, spec) {
                             controlPlaneError ??= error;
                         await emitTrace('captain.call.finished', {
                             ...identity,
-                            status: signal.aborted ? 'aborted' : 'error',
+                            status: isAbortFailure(error, signal) ? 'aborted' : 'error',
                             error: normalizeError(error),
                         }, position);
                         throw error;
@@ -1889,12 +3616,15 @@ export function createXStatePlaybookRuntime(machine, spec) {
         function playerActor(ports) {
             return createPlayerBridge({
                 resolveRoleId: requireRoleId,
+                validateInput: (input) => assertGovernedPlayerInput(outcomeAuthority, input, extractFields, label),
                 composePlayerPrompt: composeBoundPlayerPrompt,
                 adjudication,
                 resumableStateIds,
+                allowsCorrectiveReplay: acknowledgedBoundaryIsUnchanged,
             }, ports, () => activeSignal, boundary, (error) => {
-                if (!activeSignal?.aborted)
+                if (activeSignal === undefined || !isAbortFailure(error, activeSignal)) {
                     controlPlaneError ??= error;
+                }
             });
         }
         // Direct-Captain actor (slc/link.md §Captain prompt composition,
@@ -1961,7 +3691,7 @@ export function createXStatePlaybookRuntime(machine, spec) {
                     // failure state (PBRT-47); everything else here — a drained
                     // emission failure, prompt composition, the port itself,
                     // adjudication — is control plane.
-                    if (!active.aborted && !isFsmResultFailure(error)) {
+                    if (!isAbortFailure(error, active) && !isFsmResultFailure(error)) {
                         controlPlaneError ??= error;
                     }
                     throw error;
@@ -1982,57 +3712,181 @@ export function createXStatePlaybookRuntime(machine, spec) {
                 const failedGuard = guards[1] ?? guards[0];
                 const cwd = boundScriptCwd ?? process.cwd();
                 const ports = runtimePorts ?? requireHostPorts();
-                const exitStatus = await new Promise((resolve, reject) => {
-                    let child;
-                    try {
-                        child = spawn('sh', ['-c', input.command], {
-                            cwd,
-                            stdio: 'ignore',
-                        });
+                // slc/link.md §Script execution: an already-aborted turn spawns
+                // nothing, and the thrown signal reason keeps the rejection
+                // causally classified as the abort it is.
+                active.throwIfAborted();
+                // Abort ownership — the listener that terminates the group and
+                // the escalation timer — spans the whole invocation body, not
+                // just the spawn-to-close window: an abort landing during the
+                // post-exit emission tail must still kill surviving group
+                // members before the actor settles (slc/link.md §Script
+                // execution). One finally releases both.
+                let child;
+                let killTimer;
+                const signalGroup = (sig) => {
+                    if (child?.pid !== undefined) {
+                        try {
+                            process.kill(-child.pid, sig);
+                        }
+                        catch {
+                            // Confirmation belongs to the bounded liveness probe below:
+                            // a failed signal can mean ESRCH, EPERM, or another fault.
+                        }
                     }
-                    catch (error) {
-                        reject(error);
+                };
+                // After a SIGKILL is posted, settlement waits for the group to
+                // stop being signalable — bounded by the same grace so an
+                // unreapable member outside the runtime's control cannot stall
+                // the turn forever. Observed teardown is milliseconds.
+                let groupGonePromise;
+                const awaitGroupGone = () => {
+                    const pid = child?.pid;
+                    if (pid === undefined)
+                        return Promise.resolve();
+                    groupGonePromise ??= (async () => {
+                        const teardownFailure = (message, cause) => {
+                            const failure = new ScriptProcessGroupTeardownError(pid, message, cause);
+                            // A teardown failure is not an authored script result.
+                            // Surface it at the active public boundary even though
+                            // XState also routes the rejected actor through onError.
+                            controlPlaneError ??= failure;
+                            return failure;
+                        };
+                        const deadline = Date.now() + SCRIPT_ABORT_KILL_GRACE_MS;
+                        let lastProbeError;
+                        for (;;) {
+                            try {
+                                process.kill(-pid, 0);
+                            }
+                            catch (error) {
+                                if (isNoSuchProcess(error))
+                                    return;
+                                // EPERM confirms that at least one process in the group
+                                // still exists but is not signalable by this process. Keep
+                                // waiting for ESRCH within the bound; every other probe
+                                // error makes confirmation itself unreliable immediately.
+                                if (!isProcessPermissionDenied(error)) {
+                                    throw teardownFailure('the liveness probe failed', error);
+                                }
+                                lastProbeError = error;
+                            }
+                            if (Date.now() >= deadline) {
+                                throw teardownFailure(`the group remained signalable after ${SCRIPT_ABORT_KILL_GRACE_MS}ms`, lastProbeError);
+                            }
+                            await new Promise((tick) => setTimeout(tick, 5));
+                        }
+                    })();
+                    return groupGonePromise;
+                };
+                const onAbort = () => {
+                    signalGroup('SIGTERM');
+                    killTimer = setTimeout(() => signalGroup('SIGKILL'), SCRIPT_ABORT_KILL_GRACE_MS);
+                };
+                // An abort observed once the shell has already exited rejects
+                // with the signal's reason before guard resolution and before
+                // starting any further script emission — after killing whatever
+                // group members outlived the shell. The shell's own exit ended
+                // the TERM grace's purpose, so escalation is immediate here.
+                const settleIfAborted = async () => {
+                    if (!active.aborted)
                         return;
+                    signalGroup('SIGKILL');
+                    await awaitGroupGone();
+                    active.throwIfAborted();
+                };
+                let invocationFailed = false;
+                try {
+                    const exitStatus = await new Promise((resolve, reject) => {
+                        try {
+                            // detached: the shell leads its own POSIX process group,
+                            // so an abort can terminate the command's whole group — a
+                            // lone SIGTERM to the wrapper never reaches backgrounded
+                            // members.
+                            child = spawn('sh', ['-c', input.command], {
+                                cwd,
+                                stdio: 'ignore',
+                                detached: true,
+                            });
+                        }
+                        catch (error) {
+                            reject(error);
+                            return;
+                        }
+                        // On abort, terminate the group and escalate — but settle
+                        // only from 'close', after the shell itself has exited, so
+                        // the turn never reports quiescence while the script still
+                        // runs (slc/link.md §Abort). SIGKILL is untrappable, so
+                        // 'close' is bounded by the grace.
+                        active.addEventListener('abort', onAbort, { once: true });
+                        child.on('error', (error) => {
+                            reject(error);
+                        });
+                        child.on('close', (code) => {
+                            if (active.aborted) {
+                                // The shell may exit cooperatively on the group SIGTERM
+                                // while a TERM-immune same-group descendant survives;
+                                // the group stays addressable while any member lives,
+                                // so kill it and await its disappearance before
+                                // settling (slc/link.md §Script execution).
+                                signalGroup('SIGKILL');
+                                void awaitGroupGone().then(() => reject(active.reason), reject);
+                                return;
+                            }
+                            resolve(typeof code === 'number' ? code : 1);
+                        });
+                    });
+                    await settleIfAborted();
+                    await ports.emitStatus(`Executed script for ${input.stateId} (exit ${exitStatus}).`);
+                    await settleIfAborted();
+                    await ports.emitTelemetry({
+                        topic: 'playbook.script',
+                        payload: {
+                            stateId: input.stateId,
+                            sourceItem: input.sourceItem,
+                            exitStatus,
+                        },
+                    });
+                    await settleIfAborted();
+                    if (exitStatus === 0) {
+                        return { guard: okGuard, exitStatus: 0 };
                     }
-                    const onAbort = () => {
-                        child.kill('SIGTERM');
-                        reject(active.reason ?? new Error('script aborted'));
-                    };
-                    if (active.aborted) {
-                        onAbort();
-                        return;
+                    return { guard: failedGuard, exitStatus };
+                }
+                catch (error) {
+                    // Preserve the invocation's authoritative exact cancellation or
+                    // distinct sink failure after teardown succeeds. The finally
+                    // block may replace it only with a distinct teardown failure
+                    // when the process group cannot be confirmed gone.
+                    invocationFailed = true;
+                    throw error;
+                }
+                finally {
+                    try {
+                        if (active.aborted) {
+                            signalGroup('SIGKILL');
+                            await awaitGroupGone();
+                            if (!invocationFailed)
+                                active.throwIfAborted();
+                        }
                     }
-                    active.addEventListener('abort', onAbort, { once: true });
-                    child.on('error', (error) => {
-                        active.removeEventListener('abort', onAbort);
-                        reject(error);
-                    });
-                    child.on('close', (code) => {
+                    finally {
                         active.removeEventListener('abort', onAbort);
-                        resolve(typeof code === 'number' ? code : 1);
-                    });
-                });
-                await ports.emitStatus(`Executed script for ${input.stateId} (exit ${exitStatus}).`);
-                await ports.emitTelemetry({
-                    topic: 'playbook.script',
-                    payload: {
-                        stateId: input.stateId,
-                        sourceItem: input.sourceItem,
-                        exitStatus,
-                    },
-                });
-                if (exitStatus === 0) {
-                    return { guard: okGuard, exitStatus: 0 };
+                        if (killTimer !== undefined)
+                            clearTimeout(killTimer);
+                    }
                 }
-                return { guard: failedGuard, exitStatus };
             });
         }
         const nestedBridge = createNestedPlaybookBridge({
             nextCallId: () => `playbook-${++playbookCallSequence}`,
             getBoundarySignal: () => activeSignal,
             callPlaybook: (request, signal) => requireHostPorts().callPlaybook(request, signal),
-            emitStarted: async (event) => {
+            emitStarted: async (event, aborts) => {
                 playbookCallTurnIds.set(event.callId, activeTurnId);
+                if (hasGovernedPlayerStates) {
+                    playbookCallEffectPrefixes.set(event.callId, activeEffectLedgerPrefixSequence);
+                }
                 await emitTrace('playbook.call.started', {
                     stateId: event.stateId,
                     playbookId: event.playbookId,
@@ -2040,9 +3894,9 @@ export function createXStatePlaybookRuntime(machine, spec) {
                 }, {
                     ...(activeTurnId !== undefined ? { turnId: activeTurnId } : {}),
                     callId: event.callId,
-                });
+                }, aborts);
             },
-            emitFinished: async (event) => {
+            emitFinished: async (event, aborts) => {
                 const turnId = playbookCallTurnIds.get(event.callId);
                 try {
                     await emitTrace('playbook.call.finished', {
@@ -2053,22 +3907,35 @@ export function createXStatePlaybookRuntime(machine, spec) {
                     }, {
                         ...(turnId !== undefined ? { turnId } : {}),
                         callId: event.callId,
-                    });
+                    }, aborts);
                 }
                 finally {
                     playbookCallTurnIds.delete(event.callId);
+                    playbookCallEffectPrefixes.delete(event.callId);
                 }
             },
             drain: drainEmissions,
-            bindResumeSignal: (signal) => {
+            bindResumeSignal: (signal, aborts) => {
                 activeSignal = signal;
+                activeAborts = aborts ?? abortReasonClassifier(signal);
+            },
+            bindActorSettlement: (aborts) => {
+                actorSettlementAborts = aborts;
             },
-            onControlPlaneError: (error) => {
-                if (!activeSignal?.aborted)
+            onControlPlaneError: (error, aborts) => {
+                // The shared bridge classifies before reporting against its own
+                // invocation-and-resume signals; classify once more here against
+                // the boundary signal so a report that is the active boundary's
+                // exact abort reason can never masquerade as a control error
+                // (slc/link.md §Abort).
+                if (!aborts?.isAbortReason(error) &&
+                    !activeAborts?.isAbortReason(error)) {
                     controlPlaneError ??= error;
+                }
             },
-            onBackgroundError: (error) => {
-                emissionFailure ??= error;
+            onBackgroundError: (error, aborts) => {
+                if (!aborts?.isAbortReason(error))
+                    emissionFailure ??= { error };
             },
         });
         function tracePositionForActiveTurn() {
@@ -2082,11 +3949,10 @@ export function createXStatePlaybookRuntime(machine, spec) {
                 previousState: previousState ?? null,
                 state,
             };
-            if (state.stateId === 'awaitBossReply') {
-                const pendingBossQuestion = pendingBossQuestionFromContext(context);
-                if (pendingBossQuestion !== undefined) {
-                    payload.pendingBossQuestion = pendingBossQuestion;
-                }
+            const pendingBossQuestion = pendingBossQuestionForState(state, context);
+            if (pendingBossQuestion !== undefined &&
+                !hasUnresolvedReconciliation()) {
+                payload.pendingBossQuestion = pendingBossQuestion;
             }
             if (state.stateId === 'failed') {
                 const lastError = normalizeErrorFull(context.lastError);
@@ -2095,9 +3961,10 @@ export function createXStatePlaybookRuntime(machine, spec) {
             }
             return snapshotJsonValue(payload, 'FSM telemetry payload');
         }
-        function enqueueTransitionEmission(payload, state, statuses, position) {
+        function enqueueTransitionEmission(payload, state, acceptedOutcomes, statuses, position, aborts) {
             const currentSession = requireSession();
             const transitionTrace = createTraceEvent('fsm.transition', payload, position);
+            const acceptedOutcomeTraces = acceptedOutcomes.map((acceptedOutcome) => createTraceEvent('outcome.accepted', acceptedOutcome, position));
             const statusEmissions = statuses.map(({ message, data }) => ({
                 message,
                 data,
@@ -2117,6 +3984,12 @@ export function createXStatePlaybookRuntime(machine, spec) {
                     topic: 'playbook.fsm.state',
                     payload,
                 });
+                for (const acceptedOutcome of acceptedOutcomeTraces) {
+                    await currentSession.ports.emitTelemetry({
+                        topic: 'playbook.trace',
+                        payload: acceptedOutcome,
+                    });
+                }
                 for (const status of statusEmissions) {
                     await currentSession.ports.emitTelemetry({
                         topic: 'playbook.trace',
@@ -2124,13 +3997,38 @@ export function createXStatePlaybookRuntime(machine, spec) {
                     });
                     await currentSession.ports.emitStatus(status.message, status.data);
                 }
-            }).catch(() => undefined);
+            }, aborts).catch(() => undefined);
         }
-        function latchInspectionError(error) {
-            if (activeSignal !== undefined)
-                controlPlaneError ??= error;
+        // One classifying latch for every runtime-observed error — inspection
+        // failures and root-actor errors alike. Outside a boundary the error
+        // rides the emission channel, which the next boundary's (or init's)
+        // drain throws; inside a boundary it is a control-plane error unless it
+        // is the boundary signal's own abort reason (slc/link.md §Abort).
+        function latchRuntimeError(error, aborts = activeAborts) {
+            if (aborts?.isAbortReason(error))
+                return;
+            if (activeSignal === undefined)
+                emissionFailure ??= { error };
             else
-                emissionFailure ??= error;
+                controlPlaneError ??= error;
+        }
+        function consumeActorSettlementAborts(forSnapshot = false) {
+            const aborts = actorSettlementAborts ?? actorSettlementErrorAborts;
+            actorSettlementAborts = undefined;
+            actorSettlementErrorAborts = undefined;
+            if (forSnapshot && aborts !== undefined) {
+                // XState can report an errored root through both its inspection
+                // snapshot and subscriber. Keep the same provenance through that
+                // synchronous notification only; an ordinary transition must not
+                // lend it to a later unrelated actor error.
+                actorSettlementErrorAborts = aborts;
+                queueMicrotask(() => {
+                    if (actorSettlementErrorAborts === aborts) {
+                        actorSettlementErrorAborts = undefined;
+                    }
+                });
+            }
+            return aborts;
         }
         // PBRT-6: the single seam that stops this runtime's actor. Stopping a
         // still-running actor fires one more `@xstate.snapshot` for the
@@ -2144,10 +4042,12 @@ export function createXStatePlaybookRuntime(machine, spec) {
             if (!actor)
                 return;
             suppressInspectionEmissions = true;
+            acceptedOutcomeConsumer.reset();
             actor.stop();
         }
         function buildActor(ports, machineSnapshot) {
             priorState = undefined;
+            acceptedOutcomeConsumer.reset();
             const actors = {};
             if (declaredActors.has('player'))
                 actors.player = playerActor(ports);
@@ -2170,12 +4070,22 @@ export function createXStatePlaybookRuntime(machine, spec) {
                     ? {}
                     : { snapshot: machineSnapshot }),
                 inspect: (inspectionEvent) => {
-                    if (inspectionEvent.type !== '@xstate.snapshot')
-                        return;
                     if (inspectionEvent.actorRef !== builtActor)
                         return;
                     if (suppressInspectionEmissions)
                         return;
+                    if (inspectionEvent.type === '@xstate.action') {
+                        try {
+                            acceptedOutcomeConsumer.capture(inspectionEvent.action);
+                        }
+                        catch (error) {
+                            latchRuntimeError(error);
+                        }
+                        return;
+                    }
+                    if (inspectionEvent.type !== '@xstate.snapshot')
+                        return;
+                    const settlementAborts = consumeActorSettlementAborts(true);
                     try {
                         const snap = inspectionEvent.snapshot;
                         const state = normalizePlaybookSnapshot(snap);
@@ -2183,18 +4093,70 @@ export function createXStatePlaybookRuntime(machine, spec) {
                             throw new Error(`${label} root snapshot must expose exactly one playbook state id`);
                         }
                         const previousState = priorState;
+                        acceptReconstructedGovernedDelivery(state);
+                        let acceptedOutcomes = [];
+                        try {
+                            acceptedOutcomes = acceptedOutcomeConsumer.confirm(previousState, state);
+                        }
+                        catch (error) {
+                            latchRuntimeError(error);
+                        }
+                        if (state.stateId === 'failed') {
+                            if (previousState?.stateId !== 'failed' ||
+                                activeGovernedBoundarySeen) {
+                                latchFailedGovernedAttempt();
+                            }
+                        }
+                        else if (previousState?.stateId === 'failed') {
+                            failedEffectBoundaryPrefix = undefined;
+                            failedGovernedAttemptId = undefined;
+                            failedGovernedAttemptUnknown = false;
+                        }
                         const context = (snap.context ??
                             {});
+                        if (state.stateId === BOSS_REPLY_WAIT_STATE_ID &&
+                            deferredReconciliationOperationId !== undefined) {
+                            priorState = state;
+                            return;
+                        }
+                        if (state.stateId === BOSS_REPLY_WAIT_STATE_ID &&
+                            expectedBoundPendingQuestion !== undefined &&
+                            !deferInspectionEmissions) {
+                            validateBoundQuestionProjection();
+                        }
                         const payload = structuredStateTelemetryPayload(previousState, state, inspectionEvent.event, context);
-                        const statuses = statusesForState(state, context, inspectionEvent.event);
-                        enqueueTransitionEmission(payload, state, statuses, tracePositionForActiveTurn());
+                        const stateStatuses = statusesForState(state, context, inspectionEvent.event);
+                        const outcomeStatuses = usesDefaultStatuses
+                            ? acceptedOutcomes.map(({ acceptedOutcome }) => ({
+                                message: `→ ${acceptedOutcome}`,
+                            }))
+                            : [];
+                        const statuses = [...outcomeStatuses, ...stateStatuses];
+                        const publish = () => enqueueTransitionEmission(payload, state, acceptedOutcomes, statuses, tracePositionForActiveTurn(), settlementAborts);
+                        if (deferInspectionEmissions) {
+                            deferredInspectionEmissions.push(publish);
+                        }
+                        else {
+                            publish();
+                        }
                         priorState = state;
                     }
                     catch (error) {
-                        latchInspectionError(error);
+                        acceptedOutcomeConsumer.reset();
+                        latchRuntimeError(error, settlementAborts);
                     }
                 },
             });
+            // A synchronously-errored actor is already quiescent, so the turn's
+            // quiescence wait never subscribes and XState would report the error
+            // as unhandled after the boundary returns. Observe it through the
+            // classifying latch: mid-boundary it is the control-plane error
+            // unless it is the abort reason itself; at startup it rides the
+            // emission channel so `init`'s own drain rejects with it and the
+            // failed-start cleanup runs (slc/link.md §Session lifecycle).
+            builtActor.subscribe({
+                error: (error) => latchRuntimeError(error, consumeActorSettlementAborts()),
+            });
             return builtActor;
         }
         function runResultFor(outcome, error) {
@@ -2202,6 +4164,9 @@ export function createXStatePlaybookRuntime(machine, spec) {
             if (outcome === 'quiescent' || outcome === 'no-action') {
                 return { outcome, state };
             }
+            if (outcome === 'unresolved-effect') {
+                return { outcome, state };
+            }
             if (outcome === 'suspended') {
                 const pendingCall = nestedBridge.getPendingCall();
                 if (!pendingCall) {
@@ -2211,14 +4176,19 @@ export function createXStatePlaybookRuntime(machine, spec) {
             }
             if (outcome === 'terminal') {
                 const output = actor?.getSnapshot()?.output;
-                if (output !== undefined) {
-                    return {
-                        outcome,
-                        state,
-                        output: snapshotJsonValue(output, 'terminal playbook output'),
-                    };
-                }
-                return { outcome, state };
+                const stateDescription = !hasUnresolvedReconciliation()
+                    ? stateDescriptionFor(state)
+                    : undefined;
+                return {
+                    outcome,
+                    state,
+                    ...(stateDescription === undefined ? {} : { stateDescription }),
+                    ...(output === undefined
+                        ? {}
+                        : {
+                            output: snapshotJsonValue(output, 'terminal playbook output'),
+                        }),
+                };
             }
             const failure = error ??
                 (outcome === 'failed'
@@ -2236,15 +4206,23 @@ export function createXStatePlaybookRuntime(machine, spec) {
         function settledOutcome(signal) {
             if (nestedBridge.getPendingCall())
                 return 'suspended';
-            if (signal.aborted)
-                return 'aborted';
             const state = currentState();
             if (state.status === 'error') {
+                // An errored actor outranks a coincident abort unless the actor's
+                // error is the abort reason itself (slc/link.md §Abort).
                 const actorError = actor?.getSnapshot()?.error;
+                if (actorError !== undefined && isAbortFailure(actorError, signal)) {
+                    return 'aborted';
+                }
                 throw actorError ?? new Error(`${label} actor entered error status`);
             }
+            // Terminal completion outranks a coincident abort: the work finished,
+            // and reporting `aborted` would hide a terminal machine behind a
+            // settlement a later turn silently restarts (slc/link.md §Abort).
             if (state.status === 'done')
                 return 'terminal';
+            if (signal.aborted)
+                return 'aborted';
             if (state.stateId === 'failed')
                 return 'failed';
             return 'quiescent';
@@ -2255,12 +4233,12 @@ export function createXStatePlaybookRuntime(machine, spec) {
                 ...stateIdentity(result.state.stateId),
             };
         }
-        // Shared failed-start cleanup for init and restore: stop the actor,
-        // abort/drain nested and host work, optionally emit one best-effort
+        // Shared failed-start cleanup for init, restore, and adoption: stop the
+        // actor, abort/drain nested and host work, optionally emit one best-effort
         // session.disposed boundary, and unbind every closure field so dispose
-        // stays callable. The caller rethrows its original failure. A restore
-        // failure skips the disposal trace — the parked session was never
-        // re-bound in this process, so its persisted snapshot stays
+        // stays callable. The caller rethrows its original failure. A snapshot
+        // start failure skips the disposal trace — the parked generation was
+        // never re-bound in this process, so its persisted snapshot stays
         // authoritative (DR-014 §2).
         async function cleanupFailedStart(cause, options) {
             let finalState;
@@ -2308,6 +4286,7 @@ export function createXStatePlaybookRuntime(machine, spec) {
             privateResumeTokens.clear();
             activePlayerKeys.clear();
             playbookCallTurnIds.clear();
+            playbookCallEffectPrefixes.clear();
             activeEmissionCalls.clear();
             emissionQueue.clear();
             judgeQueue.clear();
@@ -2317,10 +4296,35 @@ export function createXStatePlaybookRuntime(machine, spec) {
             savedPorts = undefined;
             runtimePorts = undefined;
             activeSignal = undefined;
+            activeAborts = undefined;
+            actorSettlementAborts = undefined;
+            actorSettlementErrorAborts = undefined;
+            activeAbortEmission = undefined;
             activeTurnId = undefined;
+            activeGovernedBoundarySeen = false;
+            activeGovernedAttemptId = undefined;
+            activeEffectLedgerPrefixSequence = undefined;
+            failedGovernedAttemptUnknown = false;
+            failedEffectBoundaryPrefix = undefined;
+            failedGovernedAttemptId = undefined;
             controlPlaneError = undefined;
             emissionFailure = undefined;
             priorState = undefined;
+            retainedEffectSourceSessionId = undefined;
+            retainedEffectReconciliation = undefined;
+            retainedEffectReconciliationRequired = false;
+            reconstructedGovernedDelivery = undefined;
+            reconstructedGovernedPrefixSequence = undefined;
+            reconstructedAcceptancePending = undefined;
+            governedSettlementsByBoundaryId.clear();
+            governedCompletionEvidenceByBoundaryId.clear();
+            unresolvedSemanticBoundaryIds.clear();
+            deferredReconciliationOperationId = undefined;
+            deferredSettlementClosure = undefined;
+            expectedBoundPendingQuestion = undefined;
+            activeDeferredContinuation = undefined;
+            deferInspectionEmissions = false;
+            deferredInspectionEmissions = [];
             lastBossEvent = undefined;
             suppressInspectionEmissions = false;
             initialized = false;
@@ -2338,28 +4342,58 @@ export function createXStatePlaybookRuntime(machine, spec) {
                 can.call(snapshot, event) ===
                     true);
         }
+        // DR-034: where the artifact names the FSM context member its entry
+        // action copies the exact Boss text into, that member of the live
+        // snapshot is the retry payload's source. The persisted machine snapshot
+        // carries it, so the candidate derives identically in the process that
+        // exported the snapshot and in one that restored it, and a failure
+        // reached after a Boss reply — whose recorded event the failure state
+        // refuses — is recoverable too. Naming the member is the artifact's
+        // statement that it holds the entry text: a same-named member is never
+        // assumed, since inferring one would turn any matching context member
+        // into a replay payload without its author saying so.
+        // Declared and absent or empty excludes the candidate rather than
+        // falling back to the record, which would make the action depend on the
+        // process again — the very thing this source exists to end.
+        function retryEventFrom(snapshot) {
+            const entryEvent = spec.entryEvent;
+            if (entryEvent?.contextField === undefined)
+                return lastBossEvent;
+            const context = snapshot?.context;
+            const text = isPlainObject(context)
+                ? context[entryEvent.contextField]
+                : undefined;
+            if (typeof text !== 'string' || text.trim() === '')
+                return undefined;
+            return { type: entryEvent.type, [entryEvent.textField]: text };
+        }
         // The failure-state retry entry replays the recorded last classified
-        // event with its recorded payload. A candidate whose event the live
-        // snapshot does not accept — or whose payload the runtime never
-        // recorded — is excluded rather than completed with invented text.
+        // event with its recorded payload, or the entry event the declared
+        // context member above sources. A candidate whose event the live
+        // snapshot does not accept — or whose payload the runtime can source
+        // from neither — is excluded rather than completed with invented text.
         function retryActionFor(snapshot, stateId) {
-            if (stateId !== 'failed' || lastBossEvent === undefined) {
+            if (stateId !== 'failed')
                 return undefined;
-            }
-            if (!snapshotCan(snapshot, lastBossEvent))
+            if (!failedAttemptAllowsReplay())
+                return undefined;
+            const retryEvent = retryEventFrom(snapshot);
+            if (retryEvent === undefined)
+                return undefined;
+            if (!snapshotCan(snapshot, retryEvent))
                 return undefined;
             // A recorded explicit-state-jump event names the exact state its
             // replay re-enters: the root BOSS_INTERRUPT shape is a guarded
             // multi-arm list keyed on `targetId`, so the first configured arm
             // may label a different state than the one the recorded event
             // actually resumes.
-            const recordedTargetId = lastBossEvent.type === JUMP_EVENT_TYPE
-                ? lastBossEvent.targetId
+            const recordedTargetId = retryEvent.type === JUMP_EVENT_TYPE
+                ? retryEvent.targetId
                 : undefined;
             const target = typeof recordedTargetId === 'string' &&
                 recordedTargetId.trim().length > 0
                 ? recordedTargetId
-                : firstTransitionTarget(machine, stateId, lastBossEvent.type);
+                : firstTransitionTarget(machine, stateId, retryEvent.type);
             // PBRT-52: a label is written from a source state description, never
             // from an identifier. Falling back to the target id — or, with no
             // resolvable target, to the FSM event type — makes the label *be* the
@@ -2373,10 +4407,10 @@ export function createXStatePlaybookRuntime(machine, spec) {
                 return undefined;
             return {
                 action: {
-                    id: `retry:${lastBossEvent.type}`,
+                    id: `retry:${retryEvent.type}`,
                     label: `Retry: ${description}`,
                 },
-                event: lastBossEvent,
+                event: retryEvent,
             };
         }
         function deriveControlActions(snapshot) {
@@ -2399,6 +4433,31 @@ export function createXStatePlaybookRuntime(machine, spec) {
                 return [];
             }
             const derived = [];
+            if (hasUnresolvedReconciliation()) {
+                const operation = deferredReconciliationOperationId === undefined
+                    ? undefined
+                    : effectLedgerMirror.logicalOperations.find(({ operationId }) => operationId === deferredReconciliationOperationId);
+                const deferredRestoreOperationId = operation?.checkpointRestorationEligible === true
+                    ? operation.operationId
+                    : undefined;
+                derived.push({
+                    action: {
+                        id: UNRESOLVED_EFFECT_RECONCILIATION_ACTION_ID,
+                        label: 'Retry unresolved effect reconciliation',
+                    },
+                    unresolvedEffectAction: 'reconcile',
+                    ...(deferredRestoreOperationId === undefined
+                        ? {}
+                        : { deferredRestoreOperationId }),
+                }, {
+                    action: {
+                        id: UNRESOLVED_EFFECT_ABANDONMENT_ACTION_ID,
+                        label: 'Abandon unresolved workflow attempt',
+                    },
+                    unresolvedEffectAction: 'abandon',
+                });
+                return derived;
+            }
             const retry = retryActionFor(snapshot, state.stateId);
             if (retry !== undefined)
                 derived.push(retry);
@@ -2446,45 +4505,555 @@ export function createXStatePlaybookRuntime(machine, spec) {
                 try {
                     projected[key] = snapshotJsonValue(value instanceof Error ? normalizeError(value) : value, `control context ${key}`);
                 }
-                catch {
-                    // Declared but not JSON-safe — dropped.
+                catch {
+                    // Declared but not JSON-safe — dropped.
+                }
+            }
+            return Object.keys(projected).length === 0 ? undefined : projected;
+        }
+        // PBRT-52: the view's Boss-facing state description — the meaning of the
+        // state the runtime is in, written by the artifact's own source, from the
+        // same descriptions its action labels are written from. A control view is
+        // the only grounding a controller host has for a status answer, and an
+        // internal state id is not Boss-appropriate text
+        // (CAPPLAY-5), so the runtime publishes the meaning
+        // rather than leaving the host to substitute the identifier for it. A
+        // state whose source declares no description publishes none: an id is
+        // never promoted into a description by default.
+        function stateDescriptionFor(state) {
+            const keys = [
+                ...(state.stateId === undefined ? [] : [state.stateId]),
+                ...(typeof state.value === 'string' ? [state.value] : []),
+                ...state.activeStateIds,
+            ];
+            for (const key of keys) {
+                const description = stateDescriptions.get(key);
+                if (description !== undefined)
+                    return description;
+            }
+            return undefined;
+        }
+        function receiptTracePayload(receipt) {
+            return {
+                disposition: receipt.disposition,
+                ...(receipt.disposition === 'rejected'
+                    ? { reason: receipt.reason }
+                    : {}),
+                ...(receipt.disposition === 'failed' ? { error: receipt.error } : {}),
+                ...(receipt.disposition === 'executed' ? { run: receipt.run } : {}),
+            };
+        }
+        // DR-014 / DR-038: restore and adoption share one transactional snapshot
+        // start. Adoption deliberately differs at the public boundary so a host
+        // can feature-detect permission to bind a retained generation to a fresh
+        // engagement identity; the runtime-visible schema, playbook, and actor
+        // state remain exact, while adoption deliberately re-keys a suspended
+        // bridge into the fresh target counter and session lineage.
+        async function rehydrateSnapshot(kind, nextSession, snapshot, context) {
+            if (initialized || disposed || disposalPromise !== undefined) {
+                throw new Error(`createPlaybookRuntime.${kind}: already initialized`);
+            }
+            const boundSession = bindSession(nextSession);
+            const boundSnapshot = assertPlaybookRuntimeSnapshot(snapshot, boundSession.playbookId, { allowSuspendedCall: true });
+            if (kind === 'adopt' &&
+                effectLedgerCapability !== undefined &&
+                (boundSnapshot.retainedEffectReconciliation?.checkpoint ??
+                    boundSnapshot.effectLedger).boundaries.some(({ physicalReceipt }) => physicalReceipt === undefined)) {
+                throw new TypeError('retained runtime checkpoint contains an incomplete physical boundary');
+            }
+            const hostEffectLedger = currentEffectLedger();
+            if (kind === 'restore' &&
+                !isDeepStrictEqual(boundSnapshot.effectLedger, hostEffectLedger)) {
+                throw new TypeError('runtime snapshot effectLedger does not equal the current host mirror');
+            }
+            if (kind === 'adopt' &&
+                !isPlaybookEffectLedgerMonotonicExtension(boundSnapshot.effectLedger, hostEffectLedger)) {
+                throw new TypeError('retained runtime snapshot effectLedger is not a monotonic prefix of the current host mirror');
+            }
+            effectLedgerMirror = hostEffectLedger;
+            if (declaredActors.has('captain') &&
+                boundSnapshot.sequences.captainCall === undefined) {
+                throw new TypeError('runtime snapshot sequences.captainCall is required for a direct-Captain artifact');
+            }
+            const adoptionContext = kind === 'adopt'
+                ? snapshotAdoptionContext(context, boundSession, boundSnapshot)
+                : undefined;
+            if (adoptionContext !== undefined &&
+                effectLedgerCapability !== undefined &&
+                !RETAINED_EFFECT_SESSION_ID_PATTERN.test(adoptionContext.sourceSessionId)) {
+                throw new TypeError('schema-3 retained adoption sourceSessionId must be a canonical UUID');
+            }
+            const retainedReconciliation = boundSnapshot.retainedEffectReconciliation ??
+                (adoptionContext !== undefined &&
+                    effectLedgerCapability !== undefined &&
+                    !retainedAdoptionCheckpointIsSafe(boundSnapshot.effectLedger, hostEffectLedger)
+                    ? Object.freeze({
+                        sourceSessionId: boundSnapshot.retainedEffectSourceSessionId ??
+                            adoptionContext.sourceSessionId,
+                        checkpoint: boundSnapshot.effectLedger,
+                    })
+                    : undefined);
+            retainedEffectSourceSessionId =
+                boundSnapshot.retainedEffectSourceSessionId ??
+                    boundSnapshot.retainedEffectReconciliation?.sourceSessionId ??
+                    (adoptionContext !== undefined && effectLedgerCapability !== undefined
+                        ? adoptionContext.sourceSessionId
+                        : undefined);
+            bindRetainedEffectReconciliation(retainedReconciliation, hostEffectLedger);
+            const sourceSuspendedCall = boundSnapshot.suspendedCall;
+            const suspendedCall = adoptionContext !== undefined && sourceSuspendedCall !== undefined
+                ? Object.freeze({
+                    callId: 'playbook-1',
+                    stateId: sourceSuspendedCall.stateId,
+                    playbookId: sourceSuspendedCall.playbookId,
+                    text: sourceSuspendedCall.text,
+                    childSessionId: adoptionContext.targetChildSessionId,
+                })
+                : sourceSuspendedCall;
+            let priorExternalPlayerTokens;
+            let externalStoreRestoreAttempted = false;
+            let adoptionStartAttempted = false;
+            initialized = true;
+            let finishInitialization;
+            const initialization = new Promise((resolve) => {
+                finishInitialization = resolve;
+            });
+            initInFlight = initialization;
+            const initTask = (async () => {
+                session = boundSession;
+                syncDeferredReconciliationOverlay();
+                refreshUnresolvedSemanticReconciliation(effectLedgerMirror);
+                prepareReconstructedGovernedDelivery(boundSnapshot.state, effectLedgerMirror);
+                savedPorts = boundSession.ports;
+                runtimePorts = createRuntimePorts(boundSession.ports);
+                if (adoptionContext === undefined) {
+                    traceSequence = boundSnapshot.sequences.trace;
+                    turnSequence = boundSnapshot.sequences.turn;
+                    judgeCallSequence = boundSnapshot.sequences.judgeCall;
+                    playerCallSequence = boundSnapshot.sequences.playerCall;
+                    playbookCallSequence = boundSnapshot.sequences.playbookCall;
+                    captainCallSequence = boundSnapshot.sequences.captainCall ?? 0;
+                    // The runtime snapshot carries no apply counter (PBRT-50); every
+                    // apply boundary consumed trace numbers, so the persisted trace
+                    // counter is a collision-safe id floor here too, keeping
+                    // `apply-<n>` call ids unique across a snapshot start.
+                    applyCallSequence = boundSnapshot.sequences.trace;
+                }
+                else {
+                    // DR-038 §5: a new engagement owns a new counter space. A
+                    // rebased live child consumes the first target-local playbook id;
+                    // all other counters begin before their first target boundary.
+                    traceSequence = 0;
+                    turnSequence = 0;
+                    judgeCallSequence = 0;
+                    playerCallSequence = 0;
+                    playbookCallSequence = suspendedCall === undefined ? 0 : 1;
+                    captainCallSequence = 0;
+                    applyCallSequence = 0;
+                }
+                // Same-engagement restore owns the snapshot's token projection.
+                // Adoption leaves it inert: the fresh engagement's player ledger (or
+                // the absence of one) is authoritative, and its binding rules land
+                // independently under DR-038 §4.
+                if (kind === 'restore') {
+                    if (boundSession.playerSessions) {
+                        priorExternalPlayerTokens = snapshotRoleResumeTokens();
+                        externalStoreRestoreAttempted = true;
+                    }
+                    restoreRoleResumeTokens(boundSnapshot.roleResumeTokens);
+                }
+                nestedBridge.prepareRestore(suspendedCall);
+                if (suspendedCall !== undefined) {
+                    playbookCallTurnIds.set(suspendedCall.callId, suspendedCall.turnId);
+                    if (hasGovernedPlayerStates) {
+                        const savedPrefix = kind === 'restore'
+                            ? suspendedCall.effectBoundaryPrefixSequence
+                            : undefined;
+                        // Pre-task-5 snapshots and retained-generation adoption have no
+                        // target-local causal prefix. Zero is conservative; an explicit
+                        // null preserves an observation failure as unknown/fail-closed.
+                        playbookCallEffectPrefixes.set(suspendedCall.callId, savedPrefix === null ? undefined : (savedPrefix ?? 0));
+                    }
+                }
+                suppressInspectionEmissions = true;
+                actor = buildActor(runtimePorts, boundSnapshot.machine);
+                if (adoptionContext !== undefined) {
+                    adoptionStartAttempted = true;
+                    await emitTrace('session.started', {
+                        state: boundSnapshot.state,
+                        ...stateIdentity(boundSnapshot.state.stateId),
+                        adoption: {
+                            sourceSessionId: adoptionContext.sourceSessionId,
+                            sourceGenerationId: adoptionContext.sourceGenerationId,
+                            ...(sourceSuspendedCall === undefined ||
+                                suspendedCall === undefined
+                                ? {}
+                                : {
+                                    sourceCallId: sourceSuspendedCall.callId,
+                                    sourceChildSessionId: sourceSuspendedCall.childSessionId,
+                                    targetCallId: suspendedCall.callId,
+                                    targetChildSessionId: suspendedCall.childSessionId,
+                                }),
+                        },
+                    }, suspendedCall === undefined
+                        ? {}
+                        : { callId: suspendedCall.callId });
+                }
+                actor.start();
+                // A start-time actor error rides the startup emission channel
+                // (latchRuntimeError); consume both latches here so the original
+                // error outranks the derived status check below.
+                {
+                    const startupFailure = emissionFailure;
+                    if (controlPlaneError !== undefined ||
+                        startupFailure !== undefined) {
+                        const startupError = controlPlaneError !== undefined
+                            ? controlPlaneError
+                            : startupFailure.error;
+                        controlPlaneError = undefined;
+                        if (emissionFailure === startupFailure) {
+                            emissionFailure = undefined;
+                        }
+                        throw startupError;
+                    }
+                }
+                const restoredState = normalizePlaybookSnapshot(actor.getSnapshot(), suspendedCall === undefined
+                    ? {}
+                    : {
+                        pendingCall: {
+                            callId: suspendedCall.callId,
+                            playbookId: suspendedCall.playbookId,
+                            childSessionId: suspendedCall.childSessionId,
+                        },
+                    });
+                if (restoredState.status !== 'active') {
+                    throw new Error(`createPlaybookRuntime.${kind}: restored actor status is ${restoredState.status}, expected active`);
+                }
+                if (stableJson(restoredState, 'restored runtime state') !==
+                    stableJson(boundSnapshot.state, 'runtime snapshot state')) {
+                    throw new Error(`createPlaybookRuntime.${kind}: restored actor state does not match snapshot state`);
+                }
+                const restoredFailedEffectAttempt = restoredState.stateId === 'failed' && kind === 'restore'
+                    ? boundSnapshot.failedEffectAttempt
+                    : undefined;
+                failedEffectBoundaryPrefix =
+                    restoredFailedEffectAttempt?.boundaryPrefix;
+                failedGovernedAttemptId =
+                    typeof restoredFailedEffectAttempt?.attemptId === 'string'
+                        ? restoredFailedEffectAttempt.attemptId
+                        : undefined;
+                activeGovernedBoundarySeen = false;
+                activeGovernedAttemptId = undefined;
+                activeEffectLedgerPrefixSequence = undefined;
+                failedGovernedAttemptUnknown =
+                    restoredState.stateId === 'failed' &&
+                        kind === 'restore' &&
+                        hasGovernedPlayerStates &&
+                        restoredFailedEffectAttempt === undefined;
+                priorState = restoredState;
+                await drainEmissions();
+                suppressInspectionEmissions = false;
+                acceptReconstructedGovernedDelivery(currentState());
+                // Final fallible step: after this publication the authoritative
+                // child has rejoined ordinary resume/abort ownership, so no later
+                // snapshot-start validation may trigger failed-start rollback.
+                nestedBridge.confirmRestore();
+            })();
+            try {
+                await initTask;
+            }
+            catch (error) {
+                let failure = error;
+                if (externalStoreRestoreAttempted &&
+                    priorExternalPlayerTokens !== undefined) {
+                    try {
+                        boundSession.playerSessions.restore(priorExternalPlayerTokens);
+                    }
+                    catch (rollbackError) {
+                        failure = new AggregateError([error, rollbackError], `createPlaybookRuntime.${kind} and player continuation rollback failed`);
+                    }
+                }
+                await cleanupFailedStart(failure, {
+                    emitDisposal: adoptionStartAttempted,
+                });
+                throw failure;
+            }
+            finally {
+                finishInitialization();
+                if (initInFlight === initialization)
+                    initInFlight = undefined;
+            }
+        }
+        function validateBoundQuestionProjection() {
+            const expected = expectedBoundPendingQuestion;
+            if (expected === undefined)
+                return;
+            const snapshot = actor?.getSnapshot();
+            const state = snapshot === undefined
+                ? undefined
+                : normalizePlaybookSnapshot(snapshot);
+            const context = (snapshot
+                ?.context ?? {});
+            const actual = state?.stateId === BOSS_REPLY_WAIT_STATE_ID
+                ? pendingBossQuestionFromContext(context)
+                : undefined;
+            if (!isDeepStrictEqual(actual, expected)) {
+                throw new Error(`${label} deferred FSM question does not equal its durable binding`);
+            }
+            const operation = currentBoundDeferredOperation(expected);
+            if (operation === undefined) {
+                throw new Error(`${label} deferred FSM question has no exact durable operation`);
+            }
+            expectedBoundPendingQuestion = undefined;
+        }
+        function settleDeferredInspectionBuffer(publish) {
+            const buffered = deferredInspectionEmissions;
+            deferredInspectionEmissions = [];
+            deferInspectionEmissions = false;
+            if (publish) {
+                for (const emission of buffered)
+                    emission();
+            }
+        }
+        async function continueBoundDeferredOperation(operation, event, signal, turnId, classificationLine) {
+            if (repositoryCapability === undefined) {
+                throw new Error(`${label} deferred continuation requires repository.runDeferred`);
+            }
+            const effectBoundary = continuationBoundarySeed(operation, turnId);
+            const continuation = {
+                operationId: operation.operationId,
+                effectBoundary,
+                rawPlayerSettled: deferredValue(),
+                delivery: deferredValue(),
+            };
+            activeDeferredContinuation = continuation;
+            deferInspectionEmissions = true;
+            let continuationStarted = false;
+            let deliverySettled = false;
+            deferredInspectionEmissions =
+                classificationLine === undefined
+                    ? []
+                    : [() => void runtimePorts.emitStatus(classificationLine)];
+            try {
+                const result = await repositoryCapability.runDeferred({
+                    mode: 'continue',
+                    signal,
+                    operationId: operation.operationId,
+                    effectBoundary,
+                    operation: async ({ playerContinuation }) => {
+                        const selectedContinuation = retainedEffectSourceSessionId === undefined
+                            ? playerContinuation
+                            : selectPlayerResume(effectBoundary.roleId, resolvedPlayerId(effectBoundary.roleId));
+                        if (selectedContinuation !== false &&
+                            (typeof selectedContinuation !== 'string' ||
+                                selectedContinuation.trim().length === 0)) {
+                            throw new TypeError(`${label} bound deferred player continuation is invalid`);
+                        }
+                        // Retained adoption owns a fresh Captain-session player ledger;
+                        // no source token becomes target ownership. Same-engagement
+                        // continuation still uses the exact durable binding.
+                        continuation.playerContinuation = selectedContinuation;
+                        continuationStarted = true;
+                        actor.send(event);
+                        // The invoked player remains gated inside boundary.callPlayer.
+                        // Return to the host only after the raw player call settles so it
+                        // can capture and persist the receipt before any actor output or
+                        // error reaches XState.
+                        await continuation.rawPlayerSettled.promise;
+                        return null;
+                    },
+                    completeEffectBoundary: deferredContinuationCompletionEvidence,
+                });
+                effectLedgerMirror = assertPlaybookEffectLedger(result.effectLedger, `${label} deferred continuation effect ledger`);
+                refreshRetainedEffectReconciliation(effectLedgerMirror);
+                syncDeferredReconciliationOverlay();
+                refreshUnresolvedSemanticReconciliation(effectLedgerMirror);
+                if (result.status !== 'continued') {
+                    if (continuationStarted) {
+                        deliverySettled = true;
+                        continuation.delivery.reject(markFsmResultFailure(new Error(`${label} deferred continuation remains unresolved`)));
+                        await waitForPlaybookQuiescence(actor, {
+                            pendingCalls: nestedBridge,
+                        });
+                        if (controlPlaneError !== undefined)
+                            throw controlPlaneError;
+                    }
+                    expectedBoundPendingQuestion = undefined;
+                    settleDeferredInspectionBuffer(false);
+                    return 'unresolved';
+                }
+                const completed = effectLedgerMirror.boundaries.find(({ boundaryId }) => boundaryId === effectBoundary.boundaryId);
+                if (completed?.physicalReceipt === undefined ||
+                    !isDeepStrictEqual(completed.physicalReceipt, result.receipt)) {
+                    throw new TypeError(`${label} deferred continuation did not acknowledge its physical boundary`);
+                }
+                recordActiveGovernedAttempt(completed);
+                let settlement = governedSettlementsByBoundaryId.get(effectBoundary.boundaryId);
+                if (settlement === undefined &&
+                    continuation.result?.status === 'ok' &&
+                    !isEmptyFinalText(continuation.result.finalText)) {
+                    settlement = unresolvedGovernedSettlement('host omitted governed semantic settlement');
+                }
+                assertAcknowledgedGovernedEvidence(completed, settlement, effectLedgerMirror);
+                governedSettlementsByBoundaryId.delete(effectBoundary.boundaryId);
+                governedCompletionEvidenceByBoundaryId.delete(effectBoundary.boundaryId);
+                if (settlement?.status === 'resolved' &&
+                    settlement.output.guard === 'needsBossReply' &&
+                    result.deferredStatus !== 'bound') {
+                    settlement = unresolvedGovernedSettlement('deferred question did not receive an eligible durable binding');
+                }
+                if (settlement?.status === 'unresolved') {
+                    unresolvedSemanticBoundaryIds.add(effectBoundary.boundaryId);
+                }
+                else if (settlement?.status === 'resolved') {
+                    unresolvedSemanticBoundaryIds.delete(effectBoundary.boundaryId);
+                }
+                if (result.logicalReceipt !== undefined) {
+                    const completedOperation = effectLedgerMirror.logicalOperations.find(({ operationId }) => operationId === operation.operationId);
+                    if (completedOperation?.logicalReceipt === undefined ||
+                        !isDeepStrictEqual(completedOperation.logicalReceipt, result.logicalReceipt)) {
+                        throw new TypeError(`${label} deferred continuation did not acknowledge its cumulative receipt`);
+                    }
+                }
+                if (settlement?.status === 'resolved' &&
+                    settlement.output.guard === 'needsBossReply') {
+                    if (result.deferredStatus !== 'bound' &&
+                        result.deferredStatus !== 'unresolved') {
+                        throw new TypeError(`${label} repeated deferred settlement omitted its durable binding status`);
+                    }
+                }
+                else if (settlement?.status === 'resolved' &&
+                    result.logicalReceipt === undefined) {
+                    throw new TypeError(`${label} final deferred settlement omitted its cumulative receipt`);
+                }
+                if (continuation.callError !== undefined) {
+                    deliverySettled = true;
+                    continuation.delivery.reject(continuation.callError);
+                }
+                else if (continuation.result === undefined) {
+                    deliverySettled = true;
+                    continuation.delivery.reject(markFsmResultFailure(new Error(`${label} deferred player returned no result`)));
+                }
+                else {
+                    if (settlement !== undefined) {
+                        governedPlayerSettlements.set(continuation.result, settlement);
+                    }
+                    // The bound answer authorizes exactly this one player call. Clear
+                    // its live delivery scope before XState can advance through a
+                    // nested call and invoke a later governed player in the same turn.
+                    activeDeferredContinuation = undefined;
+                    deliverySettled = true;
+                    continuation.delivery.resolve(continuation.result);
+                }
+                await waitForPlaybookQuiescence(actor, {
+                    pendingCalls: nestedBridge,
+                });
+                if (controlPlaneError !== undefined)
+                    throw controlPlaneError;
+                if (!hasUnresolvedReconciliation()) {
+                    validateBoundQuestionProjection();
+                    settleDeferredInspectionBuffer(true);
+                }
+                else {
+                    expectedBoundPendingQuestion = undefined;
+                    settleDeferredInspectionBuffer(false);
                 }
+                return 'continued';
+            }
+            catch (error) {
+                let failure = error;
+                governedSettlementsByBoundaryId.delete(effectBoundary.boundaryId);
+                governedCompletionEvidenceByBoundaryId.delete(effectBoundary.boundaryId);
+                if (continuationStarted && !deliverySettled) {
+                    deliverySettled = true;
+                    continuation.delivery.reject(error);
+                    try {
+                        await waitForPlaybookQuiescence(actor, {
+                            pendingCalls: nestedBridge,
+                        });
+                    }
+                    catch (drainError) {
+                        failure = new AggregateError([error, drainError], `${label} deferred continuation rejection and actor drain both failed`);
+                    }
+                }
+                if (continuationStarted) {
+                    closeAfterIndeterminateDeferredSettlement(operation.operationId, failure);
+                }
+                settleDeferredInspectionBuffer(false);
+                throw failure;
+            }
+            finally {
+                activeDeferredContinuation = undefined;
             }
-            return Object.keys(projected).length === 0 ? undefined : projected;
         }
-        // PBRT-52: the view's Boss-facing state description — the meaning of the
-        // state the runtime is in, written by the artifact's own source, from the
-        // same descriptions its action labels are written from. A control view is
-        // the only grounding a controller host has for a status answer, and an
-        // internal state id is not Boss-appropriate text
-        // (CAPPLAY-5), so the runtime publishes the meaning
-        // rather than leaving the host to substitute the identifier for it. A
-        // state whose source declares no description publishes none: an id is
-        // never promoted into a description by default.
-        function stateDescriptionFor(state) {
-            const keys = [
-                ...(state.stateId === undefined ? [] : [state.stateId]),
-                ...(typeof state.value === 'string' ? [state.value] : []),
-                ...state.activeStateIds,
-            ];
-            for (const key of keys) {
-                const description = stateDescriptions.get(key);
-                if (description !== undefined)
-                    return description;
+        function isExactDeferredBossReply(snapshot, event, pending) {
+            const candidate = event;
+            return (candidate.type === 'BOSS_REPLY' &&
+                (candidate.questionId === undefined ||
+                    candidate.questionId === pending.questionId) &&
+                typeof candidate.answer === 'string' &&
+                candidate.answer.trim().length > 0 &&
+                snapshotCan(snapshot, event));
+        }
+        async function parkBoundDeferredOperation(operationId, signal) {
+            if (repositoryCapability === undefined) {
+                throw new Error(`${label} deferred parking requires repository.runDeferred`);
+            }
+            const parked = await repositoryCapability.runDeferred({
+                mode: 'park',
+                signal,
+                operationId,
+            });
+            if (parked.status !== 'parked') {
+                throw new TypeError(`${label} repository refused to park its deferred operation`);
+            }
+            effectLedgerMirror = assertPlaybookEffectLedger(parked.effectLedger, `${label} parked deferred effect ledger`);
+            refreshRetainedEffectReconciliation(effectLedgerMirror);
+            syncDeferredReconciliationOverlay();
+            refreshUnresolvedSemanticReconciliation(effectLedgerMirror);
+            if (deferredReconciliationOperationId !== operationId) {
+                throw new TypeError(`${label} parked deferred operation is not structurally unresolved`);
             }
-            return undefined;
         }
-        function receiptTracePayload(receipt) {
-            return {
-                disposition: receipt.disposition,
-                ...(receipt.disposition === 'rejected'
-                    ? { reason: receipt.reason }
-                    : {}),
-                ...(receipt.disposition === 'failed' ? { error: receipt.error } : {}),
-                ...(receipt.disposition === 'executed' ? { run: receipt.run } : {}),
-            };
+        async function restoreBoundDeferredOperation(operationId, signal) {
+            if (repositoryCapability === undefined) {
+                throw new Error(`${label} deferred restoration requires repository.runDeferred`);
+            }
+            const restored = await repositoryCapability.runDeferred({
+                mode: 'restore',
+                signal,
+                operationId,
+            });
+            if (restored.status === 'parked') {
+                throw new TypeError(`${label} repository returned a park result for deferred restoration`);
+            }
+            effectLedgerMirror = assertPlaybookEffectLedger(restored.effectLedger, `${label} restored deferred effect ledger`);
+            refreshRetainedEffectReconciliation(effectLedgerMirror);
+            syncDeferredReconciliationOverlay();
+            refreshUnresolvedSemanticReconciliation(effectLedgerMirror);
+            if (restored.status === 'restored') {
+                if (deferredReconciliationOperationId !== undefined) {
+                    throw new TypeError(`${label} restored deferred operation remained unresolved`);
+                }
+                const snapshot = actor.getSnapshot();
+                const state = normalizePlaybookSnapshot(snapshot);
+                const context = (snapshot.context ??
+                    {});
+                const pending = pendingBossQuestionForState(state, context);
+                if (pending === undefined ||
+                    currentBoundDeferredOperation(pending)?.operationId !== operationId) {
+                    throw new TypeError(`${label} restored deferred wait does not equal its FSM question`);
+                }
+            }
+            else if (deferredReconciliationOperationId !== operationId) {
+                throw new TypeError(`${label} unresolved deferred restoration lost its operation identity`);
+            }
+            return restored.status;
         }
         const runtime = {
+            ...(retainedGenerationMetadata === undefined
+                ? {}
+                : { retainedGenerationMetadata }),
             async init(nextSession) {
                 if (initialized || disposed || disposalPromise !== undefined) {
                     throw new Error('createPlaybookRuntime.init: already initialized');
@@ -2498,6 +5067,8 @@ export function createXStatePlaybookRuntime(machine, spec) {
                 initInFlight = initialization;
                 const initTask = (async () => {
                     session = boundSession;
+                    syncDeferredReconciliationOverlay();
+                    refreshUnresolvedSemanticReconciliation(effectLedgerMirror);
                     savedPorts = boundSession.ports;
                     runtimePorts = createRuntimePorts(boundSession.ports);
                     suppressInspectionEmissions = false;
@@ -2530,6 +5101,8 @@ export function createXStatePlaybookRuntime(machine, spec) {
                 }
                 if (activeSignal !== undefined)
                     return undefined;
+                if (deferredSettlementClosure !== undefined)
+                    return undefined;
                 const pendingCall = nestedBridge.getPendingCall();
                 const bridgeSuspendedCall = nestedBridge.getSuspendedCall();
                 if ((pendingCall === undefined) !== (bridgeSuspendedCall === undefined)) {
@@ -2553,6 +5126,11 @@ export function createXStatePlaybookRuntime(machine, spec) {
                     suspendedCall = {
                         ...bridgeSuspendedCall,
                         ...(turnId === undefined ? {} : { turnId }),
+                        ...(hasGovernedPlayerStates
+                            ? {
+                                effectBoundaryPrefixSequence: playbookCallEffectPrefixes.get(bridgeSuspendedCall.callId) ?? null,
+                            }
+                            : {}),
                     };
                 }
                 const state = currentState();
@@ -2561,9 +5139,23 @@ export function createXStatePlaybookRuntime(machine, spec) {
                 const machineSnapshot = detachPersistedMachineSnapshot(actor.getPersistedSnapshot());
                 const context = actor.getSnapshot()
                     .context;
-                const pending = pendingBossQuestionFromContext(context ?? {});
+                effectLedgerMirror = currentEffectLedger();
+                refreshRetainedEffectReconciliation(effectLedgerMirror);
+                syncDeferredReconciliationOverlay();
+                refreshUnresolvedSemanticReconciliation(effectLedgerMirror);
+                const pending = !hasUnresolvedReconciliation()
+                    ? pendingBossQuestionForState(state, context ?? {})
+                    : undefined;
+                const failedEffectAttempt = hasGovernedPlayerStates &&
+                    state.stateId === 'failed' &&
+                    failedAttemptMatchesCurrentLedger(effectLedgerMirror)
+                    ? {
+                        boundaryPrefix: failedEffectBoundaryPrefix,
+                        attemptId: failedGovernedAttemptId ?? null,
+                    }
+                    : undefined;
                 return {
-                    schemaVersion: 3,
+                    schemaVersion: 4,
                     playbookId: session.playbookId,
                     machine: machineSnapshot,
                     roleResumeTokens: snapshotRoleResumeTokens(),
@@ -2588,6 +5180,16 @@ export function createXStatePlaybookRuntime(machine, spec) {
                                 sourceItem: pending.sourceItem,
                             },
                         ],
+                    effectLedger: effectLedgerMirror,
+                    ...(retainedEffectSourceSessionId === undefined
+                        ? {}
+                        : { retainedEffectSourceSessionId }),
+                    ...(retainedEffectReconciliation === undefined
+                        ? {}
+                        : { retainedEffectReconciliation }),
+                    ...(failedEffectAttempt === undefined
+                        ? {}
+                        : { failedEffectAttempt }),
                     ...(suspendedCall === undefined ? {} : { suspendedCall }),
                 };
             },
@@ -2597,99 +5199,15 @@ export function createXStatePlaybookRuntime(machine, spec) {
             // the session already started; the next public boundary continues
             // the contiguous trace sequence.
             async restore(nextSession, snapshot) {
-                if (initialized || disposed || disposalPromise !== undefined) {
-                    throw new Error('createPlaybookRuntime.restore: already initialized');
-                }
-                const boundSession = bindSession(nextSession);
-                const boundSnapshot = assertPlaybookRuntimeSnapshot(snapshot, boundSession.playbookId, { allowSuspendedCall: true });
-                if (declaredActors.has('captain') &&
-                    boundSnapshot.sequences.captainCall === undefined) {
-                    throw new TypeError('runtime snapshot sequences.captainCall is required for a direct-Captain artifact');
-                }
-                const suspendedCall = boundSnapshot.suspendedCall;
-                let priorExternalPlayerTokens;
-                let externalStoreRestoreAttempted = false;
-                initialized = true;
-                let finishInitialization;
-                const initialization = new Promise((resolve) => {
-                    finishInitialization = resolve;
-                });
-                initInFlight = initialization;
-                const initTask = (async () => {
-                    session = boundSession;
-                    savedPorts = boundSession.ports;
-                    runtimePorts = createRuntimePorts(boundSession.ports);
-                    traceSequence = boundSnapshot.sequences.trace;
-                    turnSequence = boundSnapshot.sequences.turn;
-                    judgeCallSequence = boundSnapshot.sequences.judgeCall;
-                    playerCallSequence = boundSnapshot.sequences.playerCall;
-                    playbookCallSequence = boundSnapshot.sequences.playbookCall;
-                    captainCallSequence = boundSnapshot.sequences.captainCall ?? 0;
-                    // The runtime snapshot carries no apply counter (PBRT-50); every
-                    // apply boundary consumed trace numbers, so the persisted trace
-                    // counter is a collision-safe id floor here too, keeping
-                    // `apply-<n>` call ids unique across restore.
-                    applyCallSequence = boundSnapshot.sequences.trace;
-                    if (boundSession.playerSessions) {
-                        priorExternalPlayerTokens = snapshotRoleResumeTokens();
-                        externalStoreRestoreAttempted = true;
-                    }
-                    restoreRoleResumeTokens(boundSnapshot.roleResumeTokens);
-                    nestedBridge.prepareRestore(suspendedCall);
-                    if (suspendedCall !== undefined) {
-                        playbookCallTurnIds.set(suspendedCall.callId, suspendedCall.turnId);
-                    }
-                    suppressInspectionEmissions = true;
-                    actor = buildActor(runtimePorts, boundSnapshot.machine);
-                    actor.start();
-                    if (controlPlaneError !== undefined)
-                        throw controlPlaneError;
-                    const restoredState = normalizePlaybookSnapshot(actor.getSnapshot(), suspendedCall === undefined
-                        ? {}
-                        : {
-                            pendingCall: {
-                                callId: suspendedCall.callId,
-                                playbookId: suspendedCall.playbookId,
-                                childSessionId: suspendedCall.childSessionId,
-                            },
-                        });
-                    if (restoredState.status !== 'active') {
-                        throw new Error(`createPlaybookRuntime.restore: restored actor status is ${restoredState.status}, expected active`);
-                    }
-                    if (stableJson(restoredState, 'restored runtime state') !==
-                        stableJson(boundSnapshot.state, 'runtime snapshot state')) {
-                        throw new Error('createPlaybookRuntime.restore: restored actor state does not match snapshot state');
-                    }
-                    priorState = restoredState;
-                    await drainEmissions();
-                    suppressInspectionEmissions = false;
-                    // Final fallible step: after this publication the authoritative
-                    // child has rejoined ordinary resume/abort ownership, so no later
-                    // restore validation may trigger failed-start rollback.
-                    nestedBridge.confirmRestore();
-                })();
-                try {
-                    await initTask;
-                }
-                catch (error) {
-                    let failure = error;
-                    if (externalStoreRestoreAttempted &&
-                        priorExternalPlayerTokens !== undefined) {
-                        try {
-                            boundSession.playerSessions.restore(priorExternalPlayerTokens);
-                        }
-                        catch (rollbackError) {
-                            failure = new AggregateError([error, rollbackError], 'createPlaybookRuntime.restore and player continuation rollback failed');
-                        }
-                    }
-                    await cleanupFailedStart(failure, { emitDisposal: false });
-                    throw failure;
-                }
-                finally {
-                    finishInitialization();
-                    if (initInFlight === initialization)
-                        initInFlight = undefined;
-                }
+                await rehydrateSnapshot('restore', nextSession, snapshot);
+            },
+            // DR-038 §§1,5 / PBRT-61/PBRT-65: adoption is restore under a fresh
+            // engagement identity and counter lineage, exposed separately so
+            // capability-less bespoke runtimes can omit it. Runtime-visible
+            // preflight mismatches reject before effects; after preflight the new
+            // session.started boundary owns failed-start cleanup just like init.
+            async adopt(nextSession, snapshot, context) {
+                await rehydrateSnapshot('adopt', nextSession, snapshot, context);
             },
             // DR-029 / PBRT-52: side-effect-free control view over the live
             // snapshot, valid at parked quiescence outside an active boundary.
@@ -2705,14 +5223,20 @@ export function createXStatePlaybookRuntime(machine, spec) {
                 if (activeSignal !== undefined) {
                     throw new Error('createPlaybookRuntime.describe: another runtime turn is active');
                 }
+                assertDeferredSettlementOpen('describe');
+                refreshRetainedEffectFenceFromHost();
                 const snapshot = actor.getSnapshot();
                 const state = currentState();
                 const context = (snapshot.context ??
                     {});
-                const pending = pendingBossQuestionFromContext(context);
+                const pending = !hasUnresolvedReconciliation()
+                    ? pendingBossQuestionForState(state, context)
+                    : undefined;
                 const lastError = normalizeErrorFull(context.lastError);
                 const projectedContext = projectControlContext(context);
-                const stateDescription = stateDescriptionFor(state);
+                const stateDescription = !hasUnresolvedReconciliation()
+                    ? stateDescriptionFor(state)
+                    : undefined;
                 return deepFreeze({
                     state,
                     ...(stateDescription === undefined ? {} : { stateDescription }),
@@ -2745,6 +5269,7 @@ export function createXStatePlaybookRuntime(machine, spec) {
                 if (input === null || typeof input !== 'object') {
                     throw new TypeError('createPlaybookRuntime.apply: input must be an object');
                 }
+                assertDeferredSettlementOpen('apply');
                 const { actionId, key, signal } = input;
                 if (typeof actionId !== 'string' || actionId.length === 0) {
                     throw new TypeError('createPlaybookRuntime.apply: actionId must be a non-empty string');
@@ -2772,11 +5297,15 @@ export function createXStatePlaybookRuntime(machine, spec) {
                 // An abort before acceptance ends the call with no receipt
                 // recorded, like every other pre-acceptance failure.
                 signal.throwIfAborted();
+                refreshRetainedEffectFenceFromHost();
                 const turnId = ++turnSequence;
                 const callId = `apply-${++applyCallSequence}`;
                 const position = { turnId, callId };
                 activeTurnId = turnId;
+                beginAutomaticReplayBoundary();
                 activeSignal = signal;
+                activeAborts = abortReasonClassifier(signal);
+                activeAbortEmission = undefined;
                 controlPlaneError = undefined;
                 // Every receipt variant is normalized and frozen where it is built,
                 // inside the guarded region, so the recording step below cannot
@@ -2822,9 +5351,14 @@ export function createXStatePlaybookRuntime(machine, spec) {
                 // final for their key. Past publication such a failure is therefore
                 // re-latched onto the emission channel, surfacing from the next
                 // public boundary's drain, and `apply` still does not throw past
-                // acceptance (PBRT-52).
+                // acceptance (PBRT-52). A delivery rejection causally identical to
+                // this call's own abort reason evidences the cancellation and is
+                // dropped — never carried to a later unrelated boundary
+                // (slc/link.md §Abort).
                 const latchDeliveryFailure = (error) => {
-                    emissionFailure ??= error;
+                    if (isAbortFailure(error, signal))
+                        return;
+                    emissionFailure ??= { error };
                 };
                 try {
                     try {
@@ -2844,7 +5378,7 @@ export function createXStatePlaybookRuntime(machine, spec) {
                             key,
                             ...receiptTracePayload({ disposition: 'rejected', reason }),
                         });
-                        await emitCallStarted('apply.started', 'apply.finished', identity, position, preAcceptanceFinish('apply.started trace sink rejected'));
+                        await emitCallStarted('apply.started', 'apply.finished', identity, position, signal, preAcceptanceFinish('apply.started trace sink rejected'));
                         // An abort may land while the awaited started emission drains
                         // (e.g. fired from the trace sink itself); the action must
                         // never execute after abort. Settle the already-started pair
@@ -2880,13 +5414,35 @@ export function createXStatePlaybookRuntime(machine, spec) {
                             // the key, so the action can never execute twice.
                             accepted = true;
                             try {
-                                actor.send(candidate.event);
-                                await waitForPlaybookQuiescence(actor, {
-                                    pendingCalls: nestedBridge,
-                                });
+                                let run;
+                                if (candidate.unresolvedEffectAction === 'abandon') {
+                                    signal.throwIfAborted();
+                                    run = runResultFor('unresolved-effect');
+                                }
+                                else if (candidate.unresolvedEffectAction === 'reconcile') {
+                                    if (candidate.deferredRestoreOperationId !== undefined) {
+                                        await restoreBoundDeferredOperation(candidate.deferredRestoreOperationId, signal);
+                                    }
+                                    else {
+                                        // Receipt reconstruction itself belongs to the host. The
+                                        // runtime may only re-read that authoritative mirror; it
+                                        // never replays a player to manufacture missing evidence.
+                                        refreshRetainedEffectFenceFromHost();
+                                    }
+                                    signal.throwIfAborted();
+                                    run = runResultFor(hasUnresolvedReconciliation()
+                                        ? 'no-action'
+                                        : 'quiescent');
+                                }
+                                else {
+                                    actor.send(candidate.event);
+                                    await waitForPlaybookQuiescence(actor, {
+                                        pendingCalls: nestedBridge,
+                                    });
+                                    run = runResultFor(settledOutcome(signal));
+                                }
                                 if (controlPlaneError !== undefined)
                                     throw controlPlaneError;
-                                const run = runResultFor(settledOutcome(signal));
                                 receipt = settledReceipt(run.outcome === 'failed' || run.outcome === 'aborted'
                                     ? {
                                         disposition: 'failed',
@@ -2923,6 +5479,10 @@ export function createXStatePlaybookRuntime(machine, spec) {
                     catch (error) {
                         settlementError = error;
                     }
+                    // Exact cancellation is not a control-plane latch, but after apply
+                    // acceptance and before publication it is still settlement evidence
+                    // and therefore folds into the owed failed receipt (DR-036 §4).
+                    settlementError ??= activeAbortEmission;
                     // Fold before the finish emission, the last point at which the
                     // traced disposition and the returned one can still be made the
                     // same value.
@@ -2964,7 +5524,12 @@ export function createXStatePlaybookRuntime(machine, spec) {
                     // wedge every later public boundary behind "another runtime turn
                     // is active".
                     activeSignal = undefined;
+                    activeAborts = undefined;
+                    activeAbortEmission = undefined;
                     activeTurnId = undefined;
+                    activeGovernedBoundarySeen = false;
+                    activeGovernedAttemptId = undefined;
+                    activeEffectLedgerPrefixSequence = undefined;
                     controlPlaneError = undefined;
                 }
                 // Past acceptance every settlement failure has been folded into the
@@ -2986,6 +5551,7 @@ export function createXStatePlaybookRuntime(machine, spec) {
                 }
                 return receipt;
             },
+            unresolvedEffectEnvelopes: unresolvedEffectEnvelopeIdentities,
             async handleBossInput({ text, signal, }) {
                 if (!actor || !savedPorts) {
                     throw new Error('createPlaybookRuntime.handleBossInput: init must be called first');
@@ -2996,122 +5562,247 @@ export function createXStatePlaybookRuntime(machine, spec) {
                 if (activeSignal !== undefined) {
                     throw new Error('createPlaybookRuntime.handleBossInput: another runtime turn is active');
                 }
+                assertDeferredSettlementOpen('handleBossInput');
+                refreshRetainedEffectFenceFromHost();
                 const turnId = ++turnSequence;
                 activeTurnId = turnId;
+                beginAutomaticReplayBoundary();
                 activeSignal = signal;
+                activeAborts = abortReasonClassifier(signal);
+                activeAbortEmission = undefined;
                 controlPlaneError = undefined;
                 let result;
                 let operationError;
+                // The boundary sentinel releases on every exit: a settlement defect
+                // past the drain — a snapshot normalization throw inside
+                // `runResultFor` included — must never wedge every later public
+                // boundary and `dispose` itself behind "another runtime turn is
+                // active". Mirrors the apply boundary's finally.
                 try {
-                    await emitTrace('boss.input.received', { text }, { turnId });
-                    // 1. Map the Boss text to an FSM event: deterministic exact entry
-                    //    where applicable (slc/link.md §Boss-event mapping), judge
-                    //    classification otherwise.
-                    let event;
-                    const trimmed = text.trim();
-                    if (trimmed !== '') {
-                        const snapshot = actor.getSnapshot();
-                        const terminal = snapshot.status === 'done';
-                        const stateId = normalizePlaybookSnapshot(snapshot).stateId;
-                        if (spec.entryEvent !== undefined &&
-                            (stateId === 'ready' || terminal)) {
-                            event = {
-                                type: spec.entryEvent.type,
-                                [spec.entryEvent.textField]: text,
-                            };
+                    try {
+                        await emitTrace('boss.input.received', { text }, { turnId });
+                        // Record the attempted input, then refuse a boundary that entered
+                        // aborted before deterministic mapping or the classifier can
+                        // perform host-visible work (DR-036 §5).
+                        signal.throwIfAborted();
+                        // 1. Map the Boss text to an FSM event: deterministic exact entry
+                        //    where applicable (slc/link.md §Boss-event mapping), judge
+                        //    classification otherwise.
+                        let event;
+                        let classifiedSnapshot;
+                        let deferredPending;
+                        let deferredOperation;
+                        let pendingRequiresDeferredBinding = false;
+                        const trimmed = text.trim();
+                        if (trimmed !== '') {
+                            const snapshot = actor.getSnapshot();
+                            classifiedSnapshot = snapshot;
+                            const terminal = snapshot.status === 'done';
+                            const stateId = normalizePlaybookSnapshot(snapshot).stateId;
+                            const snapshotContext = (snapshot
+                                .context ?? {});
+                            deferredPending = pendingBossQuestionForState(normalizePlaybookSnapshot(snapshot), snapshotContext);
+                            pendingRequiresDeferredBinding =
+                                deferredPending !== undefined &&
+                                    outcomeAuthority?.governedPlayerStates[deferredPending.resumeStateId]?.needsBossReply?.repositoryDisposition === 'deferred';
+                            deferredOperation =
+                                !pendingRequiresDeferredBinding
+                                    ? undefined
+                                    : currentBoundDeferredOperation(deferredPending);
+                            // PBRT-1 / slc/link.md §Boss-event mapping: the idle entry, the
+                            // recoverable failure state, and the reconstructed terminal all
+                            // accept exactly one ordinary textual entry event, so delivered
+                            // text enters deterministically — no judge call to spend and no
+                            // classifier whim to settle a restart as no action. Every other
+                            // parked state — a reply wait or an authored mid-workflow
+                            // checkpoint — classifies under its own Boss-event contracts.
+                            if (hasUnresolvedReconciliation()) {
+                                event = undefined;
+                            }
+                            else if (stateId === 'failed' &&
+                                !failedAttemptAllowsReplay()) {
+                                event = undefined;
+                            }
+                            else if (spec.entryEvent !== undefined &&
+                                (stateId === 'ready' || stateId === 'failed' || terminal)) {
+                                event = {
+                                    type: spec.entryEvent.type,
+                                    [spec.entryEvent.textField]: text,
+                                };
+                            }
+                            else {
+                                event = await classifyBossText(text, runtimePorts, signal, snapshot, boundary, boundOptions);
+                            }
+                            signal.throwIfAborted();
                         }
-                        else {
-                            event = await classifyBossText(text, runtimePorts, signal, snapshot, boundary, boundOptions);
+                        if (event !== undefined &&
+                            deferredPending !== undefined &&
+                            pendingRequiresDeferredBinding &&
+                            deferredOperation === undefined &&
+                            hasGovernedPlayerStates &&
+                            deferredReconciliationOperationId === undefined) {
+                            throw new Error(`${label} pending governed Boss question has no durable logical operation`);
                         }
-                        signal.throwIfAborted();
-                    }
-                    // Empty input, no-action classifier output, or invalid classifier
-                    // output — nothing to send.
-                    if (event === undefined) {
-                        result = runResultFor('no-action');
-                    }
-                    else {
-                        // 2. Optional Captain-pane classification line: the bare FSM
-                        //    event type, emitted before the FSM advances.
-                        const statusLine = classificationStatus(event);
-                        if (statusLine !== undefined) {
-                            await runtimePorts.emitStatus(statusLine);
+                        let handledDeferred = false;
+                        if (event !== undefined &&
+                            classifiedSnapshot !== undefined &&
+                            deferredPending !== undefined &&
+                            deferredOperation !== undefined) {
+                            if (isExactDeferredBossReply(classifiedSnapshot, event, deferredPending)) {
+                                const statusLine = classificationStatus(event);
+                                const continuation = await continueBoundDeferredOperation(deferredOperation, event, signal, turnId, statusLine);
+                                if (continuation === 'continued') {
+                                    try {
+                                        lastBossEvent = snapshotJsonValue(event, 'recorded Boss event');
+                                    }
+                                    catch {
+                                        lastBossEvent = undefined;
+                                    }
+                                    if (controlPlaneError !== undefined) {
+                                        throw controlPlaneError;
+                                    }
+                                    result = runResultFor(!hasUnresolvedReconciliation()
+                                        ? settledOutcome(signal)
+                                        : 'no-action');
+                                }
+                                else {
+                                    lastBossEvent = undefined;
+                                    result = runResultFor('no-action');
+                                }
+                                handledDeferred = true;
+                            }
+                            else if (event.type === 'BOSS_REPLY') {
+                                // A malformed, empty, or mismatched answer does not consume
+                                // the durable wait and starts no repository or player work.
+                                event = undefined;
+                            }
+                            else {
+                                await parkBoundDeferredOperation(deferredOperation.operationId, signal);
+                                lastBossEvent = undefined;
+                                result = runResultFor('no-action');
+                                handledDeferred = true;
+                            }
                         }
-                        signal.throwIfAborted();
-                        // 3. A final actor cannot accept new events; reconstruct only
-                        //    after classification produced a real event.
-                        if (actor.getSnapshot().status === 'done') {
-                            stopActor();
-                            actor = buildActor(runtimePorts);
-                            // The replacement actor's snapshots are real state entries.
-                            suppressInspectionEmissions = false;
-                            actor.start();
+                        // Empty input, no-action classifier output, or invalid classifier
+                        // output — nothing to send.
+                        if (handledDeferred) {
+                            // The deferred host transaction already decided whether the
+                            // authored continuation ran; never send its event a second time.
+                        }
+                        else if (event === undefined) {
+                            result = runResultFor('no-action');
+                        }
+                        else {
+                            // 2. Optional Captain-pane classification line: the bare FSM
+                            //    event type, emitted before the FSM advances.
+                            const statusLine = classificationStatus(event);
+                            if (statusLine !== undefined) {
+                                await runtimePorts.emitStatus(statusLine);
+                            }
+                            signal.throwIfAborted();
+                            // 3. A final actor cannot accept new events; reconstruct only
+                            //    after classification produced a real event.
+                            if (actor.getSnapshot().status === 'done') {
+                                stopActor();
+                                actor = buildActor(runtimePorts);
+                                // The replacement actor's snapshots are real state entries.
+                                suppressInspectionEmissions = false;
+                                actor.start();
+                            }
+                            // DR-029: keep the classified event with its recorded payload
+                            // as the retry-replay source. Recording is sanitizing, not
+                            // load-bearing: an override classifier's non-JSON-safe event is
+                            // simply not recorded, and the turn proceeds unchanged.
+                            try {
+                                lastBossEvent = snapshotJsonValue(event, 'recorded Boss event');
+                            }
+                            catch {
+                                lastBossEvent = undefined;
+                            }
+                            actor.send(event);
+                            await waitForPlaybookQuiescence(actor, {
+                                pendingCalls: nestedBridge,
+                            });
+                            if (controlPlaneError !== undefined)
+                                throw controlPlaneError;
+                            result = runResultFor(settledOutcome(signal));
                         }
-                        // DR-029: keep the classified event with its recorded payload
-                        // as the retry-replay source. Recording is sanitizing, not
-                        // load-bearing: an override classifier's non-JSON-safe event is
-                        // simply not recorded, and the turn proceeds unchanged.
+                    }
+                    catch (error) {
+                        operationError = error;
+                    }
+                    let drainError;
+                    try {
+                        await drainEmissions();
+                    }
+                    catch (error) {
+                        drainError = error;
+                    }
+                    const latchedControlError = controlPlaneError;
+                    // A drain rejection that is the exact abort reason evidences the
+                    // cancellation, not a control-plane failure (slc/link.md §Abort).
+                    const drainAbort = drainError !== undefined && isAbortFailure(drainError, signal);
+                    const effectiveDrainError = drainAbort ? undefined : drainError;
+                    const primaryError = latchedControlError ?? effectiveDrainError ?? operationError;
+                    const abortError = latchedControlError === undefined &&
+                        effectiveDrainError === undefined &&
+                        ((operationError !== undefined &&
+                            isAbortFailure(operationError, signal)) ||
+                            (drainAbort && operationError === undefined));
+                    // A deferred continuation whose actor advanced before the host's
+                    // completion write became authoritative has no safe public FSM
+                    // settlement. The durable uncertain record is the only recovery
+                    // source, so do not project the actor's advanced snapshot into a
+                    // `boss.input.settled` event.
+                    const settlementResult = deferredSettlementClosure !== undefined
+                        ? undefined
+                        : primaryError === undefined
+                            ? (result ?? runResultFor('no-action'))
+                            : runResultFor(abortError ? 'aborted' : 'failed', primaryError);
+                    let settlementEmissionError;
+                    if (settlementResult !== undefined) {
                         try {
-                            lastBossEvent = snapshotJsonValue(event, 'recorded Boss event');
+                            await emitTrace('boss.input.settled', settlementTracePayload(settlementResult), { turnId });
                         }
-                        catch {
-                            lastBossEvent = undefined;
+                        catch (error) {
+                            settlementEmissionError = error;
                         }
-                        actor.send(event);
-                        await waitForPlaybookQuiescence(actor, {
-                            pendingCalls: nestedBridge,
-                        });
-                        if (controlPlaneError !== undefined)
-                            throw controlPlaneError;
-                        result = runResultFor(settledOutcome(signal));
                     }
+                    try {
+                        await drainEmissions();
+                    }
+                    catch (error) {
+                        settlementEmissionError ??= error;
+                    }
+                    if (settlementEmissionError !== undefined &&
+                        isAbortFailure(settlementEmissionError, signal)) {
+                        settlementEmissionError = undefined;
+                    }
+                    const failure = controlPlaneError ??
+                        latchedControlError ??
+                        effectiveDrainError ??
+                        (abortError
+                            ? (settlementEmissionError ?? operationError)
+                            : (operationError ?? settlementEmissionError));
+                    if (failure !== undefined &&
+                        !(abortError && settlementEmissionError === undefined)) {
+                        throw failure;
+                    }
+                    if (settlementResult === undefined) {
+                        throw deferredSettlementClosure;
+                    }
+                    return settlementResult;
                 }
-                catch (error) {
-                    operationError = error;
-                }
-                let drainError;
-                try {
-                    await drainEmissions();
-                }
-                catch (error) {
-                    drainError = error;
-                }
-                const latchedControlError = controlPlaneError;
-                const primaryError = latchedControlError ?? drainError ?? operationError;
-                const abortError = latchedControlError === undefined &&
-                    drainError === undefined &&
-                    operationError !== undefined &&
-                    isAbortFailure(operationError, signal);
-                const settlementResult = primaryError === undefined
-                    ? (result ?? runResultFor('no-action'))
-                    : runResultFor(abortError ? 'aborted' : 'failed', primaryError);
-                let settlementEmissionError;
-                try {
-                    await emitTrace('boss.input.settled', settlementTracePayload(settlementResult), { turnId });
-                }
-                catch (error) {
-                    settlementEmissionError = error;
-                }
-                try {
-                    await drainEmissions();
-                }
-                catch (error) {
-                    settlementEmissionError ??= error;
-                }
-                const failure = controlPlaneError ??
-                    latchedControlError ??
-                    drainError ??
-                    (abortError
-                        ? (settlementEmissionError ?? operationError)
-                        : (operationError ?? settlementEmissionError));
-                activeSignal = undefined;
-                activeTurnId = undefined;
-                controlPlaneError = undefined;
-                if (failure !== undefined &&
-                    !(abortError && settlementEmissionError === undefined)) {
-                    throw failure;
+                finally {
+                    activeSignal = undefined;
+                    activeAborts = undefined;
+                    activeAbortEmission = undefined;
+                    activeTurnId = undefined;
+                    activeGovernedBoundarySeen = false;
+                    activeGovernedAttemptId = undefined;
+                    activeEffectLedgerPrefixSequence = undefined;
+                    controlPlaneError = undefined;
                 }
-                return settlementResult;
             },
             async resumePlaybookCall(input) {
                 if (!actor || !savedPorts) {
@@ -3123,43 +5814,99 @@ export function createXStatePlaybookRuntime(machine, spec) {
                 if (activeSignal !== undefined) {
                     throw new Error('createPlaybookRuntime.resumePlaybookCall: another runtime turn is active');
                 }
+                refreshRetainedEffectFenceFromHost();
+                if (hasUnresolvedReconciliation()) {
+                    return runResultFor('no-action');
+                }
                 activeTurnId = playbookCallTurnIds.get(input.callId);
+                bindAutomaticReplayBoundary(playbookCallEffectPrefixes.has(input.callId)
+                    ? playbookCallEffectPrefixes.get(input.callId)
+                    : hasGovernedPlayerStates
+                        ? 0
+                        : undefined);
                 activeSignal = input.signal;
+                activeAborts = abortReasonClassifier(input.signal);
+                activeAbortEmission = undefined;
                 controlPlaneError = undefined;
-                let result;
-                let operationError;
-                try {
-                    await nestedBridge.resume(input);
-                }
-                catch (error) {
-                    operationError = error;
-                }
-                try {
-                    await waitForPlaybookQuiescence(actor, {
-                        pendingCalls: nestedBridge,
-                    });
-                    result = runResultFor(settledOutcome(input.signal));
-                }
-                catch (error) {
-                    operationError ??= error;
-                }
-                let drainError;
+                // The boundary sentinel releases on every exit, mirroring
+                // `handleBossInput` and the apply boundary.
                 try {
-                    await drainEmissions();
-                }
-                catch (error) {
-                    drainError = error;
+                    let result;
+                    let operationError;
+                    try {
+                        await nestedBridge.resume(input);
+                    }
+                    catch (error) {
+                        operationError = error;
+                    }
+                    try {
+                        await waitForPlaybookQuiescence(actor, {
+                            pendingCalls: nestedBridge,
+                        });
+                        result = runResultFor(settledOutcome(input.signal));
+                    }
+                    catch (error) {
+                        operationError ??= error;
+                    }
+                    // A resume refused because its signal was already aborted
+                    // delivers nothing: the pending call survives for a later
+                    // resume, and the boundary settles `aborted` rather than
+                    // advertising `suspended` (slc/link.md §Nested playbook bridge).
+                    if (operationError !== undefined &&
+                        isAbortFailure(operationError, input.signal) &&
+                        nestedBridge.getPendingCall()?.callId === input.callId) {
+                        result = {
+                            outcome: 'aborted',
+                            state: currentState(),
+                            error: normalizeError(input.signal.reason),
+                        };
+                    }
+                    let drainError;
+                    try {
+                        await drainEmissions();
+                    }
+                    catch (error) {
+                        drainError = error;
+                    }
+                    const aborts = activeAborts ?? abortReasonClassifier(input.signal);
+                    // A control-plane latch has already classified its failure as
+                    // distinct under the owning operation. Never reinterpret it
+                    // against this later resume signal (DR-036 decision 2).
+                    const controlFailure = controlPlaneError;
+                    const drainAbort = controlFailure === undefined &&
+                        drainError !== undefined &&
+                        aborts.isAbortReason(drainError);
+                    const operationAbort = controlFailure === undefined &&
+                        operationError !== undefined &&
+                        aborts.isAbortReason(operationError);
+                    const abortEvidence = activeAbortEmission ??
+                        (drainAbort ? drainError : undefined) ??
+                        (operationAbort ? operationError : undefined);
+                    const failure = controlFailure ??
+                        (drainAbort ? undefined : drainError) ??
+                        (operationAbort ? undefined : operationError);
+                    if (failure !== undefined)
+                        throw failure;
+                    if (abortEvidence !== undefined &&
+                        result?.outcome !== 'terminal' &&
+                        result?.outcome !== 'suspended') {
+                        result = runResultFor('aborted', abortEvidence);
+                    }
+                    if (result === undefined) {
+                        throw new Error('playbook resume produced no runtime result');
+                    }
+                    return result;
                 }
-                const failure = controlPlaneError ?? drainError ?? operationError;
-                activeSignal = undefined;
-                activeTurnId = undefined;
-                controlPlaneError = undefined;
-                if (failure !== undefined)
-                    throw failure;
-                if (result === undefined) {
-                    throw new Error('playbook resume produced no runtime result');
+                finally {
+                    activeSignal = undefined;
+                    activeAborts = undefined;
+                    activeAbortEmission = undefined;
+                    activeTurnId = undefined;
+                    activeGovernedBoundarySeen = false;
+                    activeGovernedAttemptId = undefined;
+                    activeEffectLedgerPrefixSequence = undefined;
+                    controlPlaneError = undefined;
                 }
-                return result;
             },
             dispose() {
                 if (disposalPromise !== undefined)
@@ -3222,16 +5969,42 @@ export function createXStatePlaybookRuntime(machine, spec) {
                         }
                         activePlayerKeys.clear();
                         playbookCallTurnIds.clear();
+                        playbookCallEffectPrefixes.clear();
                         activeEmissionCalls.clear();
                         emissionQueue.clear();
                         judgeQueue.clear();
                         appliedReceipts.clear();
                         actor = undefined;
                         activeSignal = undefined;
+                        activeAborts = undefined;
+                        actorSettlementAborts = undefined;
+                        actorSettlementErrorAborts = undefined;
+                        activeAbortEmission = undefined;
                         activeTurnId = undefined;
+                        activeGovernedBoundarySeen = false;
+                        activeGovernedAttemptId = undefined;
+                        activeEffectLedgerPrefixSequence = undefined;
+                        failedGovernedAttemptUnknown = false;
+                        failedEffectBoundaryPrefix = undefined;
+                        failedGovernedAttemptId = undefined;
                         controlPlaneError = undefined;
                         emissionFailure = undefined;
                         lastBossEvent = undefined;
+                        retainedEffectSourceSessionId = undefined;
+                        retainedEffectReconciliation = undefined;
+                        retainedEffectReconciliationRequired = false;
+                        reconstructedGovernedDelivery = undefined;
+                        reconstructedGovernedPrefixSequence = undefined;
+                        reconstructedAcceptancePending = undefined;
+                        governedSettlementsByBoundaryId.clear();
+                        governedCompletionEvidenceByBoundaryId.clear();
+                        unresolvedSemanticBoundaryIds.clear();
+                        deferredReconciliationOperationId = undefined;
+                        deferredSettlementClosure = undefined;
+                        expectedBoundPendingQuestion = undefined;
+                        activeDeferredContinuation = undefined;
+                        deferInspectionEmissions = false;
+                        deferredInspectionEmissions = [];
                         savedPorts = undefined;
                         runtimePorts = undefined;
                         session = undefined;
@@ -3261,4 +6034,11 @@ export function createXStatePlaybookRuntime(machine, spec) {
         };
         return runtime;
     };
+    Object.defineProperty(createPlaybookRuntime, 'compat', {
+        value: Object.freeze({ artifactSchema, runtimeAbi: RUNTIME_ABI }),
+        enumerable: true,
+        writable: false,
+        configurable: false,
+    });
+    return createPlaybookRuntime;
 }