@sublang/playbook 8.0.0 → 9.0.0

package/src/xstate-playbook-runtime.js

@@ -233,9 +233,37 @@ export function normalizeErrorFull(err) {
         return undefined;
     return normalizeError(err);
 }
+// slc/link.md §Abort: cancellation is causal identity with the applicable
+// signal's reason — never an `AbortError` name, never bare signal state. A
+// distinct failure observed while the signal is aborted stays a non-abort
+// control error and takes precedence (mirrors DECIDE's bespoke reference).
 function isAbortFailure(error, signal) {
-    return (signal.aborted &&
-        (error === signal.reason || normalizeError(error).name === 'AbortError'));
+    return signal.aborted && Object.is(error, signal.reason);
+}
+function abortReasonClassifier(...sources) {
+    const captured = sources.filter((source) => source !== undefined);
+    return Object.freeze({
+        isAbortReason: (error) => captured.some((source) => source instanceof AbortSignal
+            ? isAbortFailure(error, source)
+            : source.isAbortReason(error)),
+    });
+}
+/**
+ * gears2fsm's canonical Boss-reply wait state. On the runtime's Boss-facing
+ * surfaces — state telemetry, status lines, the exported snapshot, and the
+ * control view — a context question counts as *pending* only while the
+ * machine sits in this state awaiting the reply. Later states retain the
+ * answered question in context (the resumed player prompt is composed from
+ * it), so an unconditional projection would resurrect it: a failure the
+ * resumed player reached would export a question nobody is waiting on,
+ * disagreeing with the gated telemetry a mirroring host's ledger follows
+ * and failing the shell's snapshot-equality settlement check.
+ */
+const BOSS_REPLY_WAIT_STATE_ID = 'awaitBossReply';
+function pendingBossQuestionForState(state, context) {
+    if (state.stateId !== BOSS_REPLY_WAIT_STATE_ID)
+        return undefined;
+    return pendingBossQuestionFromContext(context);
 }
 /** Read the FSM context's single pending Boss question, when well-formed. */
 export function pendingBossQuestionFromContext(context) {
@@ -466,7 +494,9 @@ export function createPlayerBridge(spec, ports, getActiveSignal, boundary, onCon
             prompt = spec.composePlayerPrompt(input);
         }
         catch (error) {
-            onControlPlaneError?.(error);
+            if (!isAbortFailure(error, activeSignal)) {
+                onControlPlaneError?.(error);
+            }
             throw error;
         }
         const callPlayer = (resume) => boundary
@@ -506,7 +536,9 @@ export function createPlayerBridge(spec, ports, getActiveSignal, boundary, onCon
             return output;
         }
         catch (error) {
-            onControlPlaneError?.(error);
+            if (!isAbortFailure(error, activeSignal)) {
+                onControlPlaneError?.(error);
+            }
             throw error;
         }
     });
@@ -670,7 +702,7 @@ export function resumableStateIdsFromMachine(machine) {
     if (!isPlainObject(config) || !isPlainObject(config.states)) {
         return new Set();
     }
-    const awaitState = config.states.awaitBossReply;
+    const awaitState = config.states[BOSS_REPLY_WAIT_STATE_ID];
     if (!isPlainObject(awaitState) || !isPlainObject(awaitState.on)) {
         return new Set();
     }
@@ -772,6 +804,28 @@ function deepFreeze(value) {
 // Default transition/status derivation.
 // ---------------------------------------------------------------------------
 const SUPPRESSED_ENTRY_STATES = new Set(['ready', 'done']);
+// Bounded escalation for aborted script process groups: SIGTERM first, then
+// SIGKILL after this grace, so settlement (gated on the shell's own exit)
+// stays bounded even for TERM-immune commands.
+const SCRIPT_ABORT_KILL_GRACE_MS = 2000;
+class ScriptProcessGroupTeardownError extends Error {
+    constructor(pid, message, cause) {
+        super(`script process group ${pid} teardown could not be confirmed: ${message}`, cause === undefined ? undefined : { cause });
+        this.name = 'ScriptProcessGroupTeardownError';
+    }
+}
+function isNoSuchProcess(error) {
+    return (typeof error === 'object' &&
+        error !== null &&
+        'code' in error &&
+        error.code === 'ESRCH');
+}
+function isProcessPermissionDenied(error) {
+    return (typeof error === 'object' &&
+        error !== null &&
+        'code' in error &&
+        error.code === 'EPERM');
+}
 function makeDefaultNormalizeTransitionEvent(transitionEventFields) {
     return (event) => {
         if (event === null || typeof event !== 'object') {
@@ -861,7 +915,7 @@ function makeDefaultStatusesForState(roleStates) {
         if (stateId === undefined || SUPPRESSED_ENTRY_STATES.has(stateId)) {
             return statuses;
         }
-        if (stateId === 'awaitBossReply') {
+        if (stateId === BOSS_REPLY_WAIT_STATE_ID) {
             const pending = pendingBossQuestionFromContext(context);
             if (pending === undefined) {
                 return [...statuses, { message: 'Awaiting Boss reply.' }];
@@ -1063,7 +1117,14 @@ function makeDefaultClassifyBossText(machine, entryEvent, bossEvents) {
         const state = classifierState(snapshotOrState);
         const stateId = typeof state.value === 'string' ? state.value : undefined;
         const currentState = stateId ?? JSON.stringify(state.value ?? null);
-        const pending = pendingBossQuestionFromContext(state.context);
+        // The classifier shares the reply-wait pendingness of every other
+        // surface: outside the wait, a context question a later state retains
+        // is answered history, so the prompt must not present it as pending —
+        // a judge told a question awaits at the failure state is steered toward
+        // a reply it cannot select or toward no action at all.
+        const pending = stateId === BOSS_REPLY_WAIT_STATE_ID
+            ? pendingBossQuestionFromContext(state.context)
+            : undefined;
         const configuredTypes = configuredEventTypesForState(machine, stateId);
         const applicable = [...contracts.values()].filter((contract) => configuredTypes.has(contract.type) &&
             (contract.type !== 'BOSS_REPLY' || pending !== undefined));
@@ -1179,6 +1240,60 @@ function machineDeclaresParallelState(machine) {
     };
     return visit(machine.config);
 }
+// PBRT-52: the factory's domain is FLAT single-region machines — every
+// state a direct child of the root, so each snapshot exposes exactly one
+// playbook state id and every state-keyed lookup (deterministic entries,
+// retry, reply-wait pendingness, configured events, descriptions) indexes
+// one unambiguous identity. A compound child would be accepted and then
+// silently misbehave on all of those gates, so it is rejected up front
+// exactly like a parallel region.
+function machineDeclaresNestedState(machine) {
+    const config = machine.config;
+    if (!isPlainObject(config) || !isPlainObject(config.states))
+        return false;
+    return Object.values(config.states).some((stateDef) => isPlainObject(stateDef) &&
+        isPlainObject(stateDef.states) &&
+        Object.keys(stateDef.states).length > 0);
+}
+// PBRT-52: the factory's lookups index states by their root key, and the
+// published playbook identity is `meta.playbook.stateId` — the two must
+// coincide or a machine can advertise a pending question or retry under an
+// identity no lookup resolves. A state with no string stateId is just as
+// dead: every snapshot identity derives from that member, so the first
+// entry would fail the exactly-one-state-id inspection at runtime.
+// gears2fsm keeps identity and key equal by construction; a hand-authored
+// artifact that splits or omits them fails here instead of at a silently
+// dead gate.
+function assertFlatStateIdentity(machine, label) {
+    const config = machine.config;
+    const states = isPlainObject(config) && isPlainObject(config.states)
+        ? config.states
+        : undefined;
+    // A machine with no root states has no playbook identity to expose; its
+    // first snapshot would fail the exactly-one-state-id inspection, so it
+    // fails construction with the defect named instead.
+    if (states === undefined || Object.keys(states).length === 0) {
+        throw new Error(`${label} declares no root states; the shared runtime requires at ` +
+            'least one flat playbook state');
+    }
+    for (const [key, stateDef] of Object.entries(states)) {
+        if (!isPlainObject(stateDef))
+            continue;
+        const meta = isPlainObject(stateDef.meta) ? stateDef.meta : undefined;
+        const playbook = meta !== undefined && isPlainObject(meta.playbook)
+            ? meta.playbook
+            : undefined;
+        const stateId = playbook?.stateId;
+        if (typeof stateId !== 'string') {
+            throw new Error(`${label} state ${key} declares no string meta.playbook.stateId; ` +
+                'the shared runtime derives every playbook state identity from it');
+        }
+        if (stateId !== key) {
+            throw new Error(`${label} state ${key} declares meta.playbook.stateId ${stateId}; ` +
+                'the shared runtime requires the playbook state id to equal the state key');
+        }
+    }
+}
 /**
  * Build a `PlaybookRuntimeFactory` that interprets the given FSM artifact
  * under the slc/link.md contract. The factory provides every actor kind the
@@ -1186,9 +1301,10 @@ function machineDeclaresParallelState(machine) {
  * (literal and dynamic) — and implements the full runtime lifecycle including
  * the optional parked-session snapshot capability (DR-014).
  *
- * Scope: machines that declare no parallel state (each snapshot exposes
- * exactly one playbook state id). Parallel-region FSMs keep their own linked
- * runtimes.
+ * Scope: flat single-region machines — no parallel state, no compound
+ * child states, and every root state's `meta.playbook.stateId` equal to its
+ * state key — so each snapshot exposes exactly one playbook state id.
+ * Parallel-region FSMs keep their own linked runtimes.
  */
 export function createXStatePlaybookRuntime(machine, spec) {
     const label = spec.label ?? 'playbook';
@@ -1205,6 +1321,10 @@ export function createXStatePlaybookRuntime(machine, spec) {
     if (machineDeclaresParallelState(machine)) {
         throw new Error(`${label} uses a parallel state; the shared runtime supports only single-region FSMs`);
     }
+    if (machineDeclaresNestedState(machine)) {
+        throw new Error(`${label} declares a compound state; the shared runtime supports only flat single-region FSMs`);
+    }
+    assertFlatStateIdentity(machine, label);
     const declaredActors = collectInvokeSources(machine);
     const resumableStateIds = spec.resumableStateIds ?? resumableStateIdsFromMachine(machine);
     // DR-029: source state descriptions label the control actions the
@@ -1282,6 +1402,20 @@ export function createXStatePlaybookRuntime(machine, spec) {
         // ports.callPlayer / callCaptain / callJudge see the right cancellation
         // source. undefined between turns; set by the public boundaries.
         let activeSignal;
+        // Immutable cancellation provenance for the active public boundary. A
+        // nested resume widens it to include both invocation and resume signals;
+        // mutable `activeSignal` alone cannot classify a late invocation reason.
+        let activeAborts;
+        // The bridge binds the provenance of a child result immediately before
+        // its promise actor settles. The next root snapshot/error consumes this
+        // one-shot so background settlement emissions retain their owner.
+        let actorSettlementAborts;
+        let actorSettlementErrorAborts;
+        // Exact cancellation observed by an emission owned by the active
+        // boundary. Ordinary runs settle from their signal/state; apply also
+        // needs this phase-local evidence to fold a pre-publication failure into
+        // its accepted receipt.
+        let activeAbortEmission;
         let activeTurnId;
         let controlPlaneError;
         // Previous root-machine state for the inspect-driven telemetry /
@@ -1457,16 +1591,31 @@ export function createXStatePlaybookRuntime(machine, spec) {
             for (const [key, token] of byKey)
                 privateResumeTokens.set(key, token);
         }
-        function enqueueEmission(fn) {
+        function enqueueEmission(fn, aborts = activeAborts) {
+            // The emission belongs to the boundary enqueueing it: a rejection
+            // causally identical to that boundary's abort reason is the
+            // cancellation's own evidence — never latched, so it cannot poison a
+            // later unrelated boundary (DR-036).
+            const enqueueAborts = aborts;
             const queued = emissionQueue.add(fn).then(() => undefined);
             activeEmissionCalls.add(queued);
             void queued.then(() => activeEmissionCalls.delete(queued), (error) => {
                 activeEmissionCalls.delete(queued);
-                emissionFailure ??= error;
+                if (enqueueAborts?.isAbortReason(error)) {
+                    // Record evidence only when it also belongs to the public
+                    // boundary that is still active. A background A cancellation
+                    // racing an unrelated B boundary is forgiven under A and must
+                    // not change B's settlement.
+                    if (activeAborts?.isAbortReason(error)) {
+                        activeAbortEmission ??= error;
+                    }
+                    return;
+                }
+                emissionFailure ??= { error };
             });
             return queued;
         }
-        async function drainEmissions() {
+        async function drainEmissions(_aborts = activeAborts) {
             while (true) {
                 const active = [...activeEmissionCalls];
                 if (active.length > 0)
@@ -1479,8 +1628,14 @@ export function createXStatePlaybookRuntime(machine, spec) {
                 }
             }
             if (emissionFailure !== undefined) {
-                const error = emissionFailure;
+                const { error } = emissionFailure;
                 emissionFailure = undefined;
+                // The failure was classified as distinct by its enqueue owner. If a
+                // later public boundary drains it, retain that classification in the
+                // boundary latch before throwing; its signal must not reinterpret
+                // the same object as cancellation (DR-036 decision 2).
+                if (activeSignal !== undefined)
+                    controlPlaneError ??= error;
                 throw error;
             }
         }
@@ -1519,13 +1674,13 @@ export function createXStatePlaybookRuntime(machine, spec) {
                 payload: safePayload,
             };
         }
-        function emitTrace(type, payload, position = {}) {
+        function emitTrace(type, payload, position = {}, aborts) {
             const currentSession = requireSession();
             const event = createTraceEvent(type, payload, position);
             return enqueueEmission(() => currentSession.ports.emitTelemetry({
                 topic: 'playbook.trace',
                 payload: event,
-            }));
+            }), aborts);
         }
         function stateIdentity(stateId) {
             return stateId === undefined ? {} : { stateId };
@@ -1583,6 +1738,11 @@ export function createXStatePlaybookRuntime(machine, spec) {
             };
         }
         async function emitCallStarted(startedType, finishedType, identity, position, 
+        // The applicable combined signal: a start-sink rejection causally
+        // identical to its reason is the cancellation itself, not a control
+        // error — the pair finishes `aborted` and nothing latches
+        // (slc/link.md §Abort).
+        signal, 
         // Base payload of the best-effort finish emitted when the start sink
         // rejects; it defaults to the payload the start carried, which the
         // player, judge, and captain pairs take as-is. The apply pair cannot:
@@ -1594,11 +1754,12 @@ export function createXStatePlaybookRuntime(machine, spec) {
                 await emitTrace(startedType, identity, position);
             }
             catch (error) {
-                controlPlaneError ??= error;
+                if (!isAbortFailure(error, signal))
+                    controlPlaneError ??= error;
                 try {
                     await emitTrace(finishedType, {
                         ...finishIdentity,
-                        status: 'error',
+                        status: isAbortFailure(error, signal) ? 'aborted' : 'error',
                         error: normalizeError(error),
                     }, position);
                 }
@@ -1621,7 +1782,7 @@ export function createXStatePlaybookRuntime(machine, spec) {
                     resume = selectPlayerResume(roleId, playerId);
                 }
                 catch (error) {
-                    if (!signal.aborted)
+                    if (!isAbortFailure(error, signal))
                         controlPlaneError ??= error;
                     throw error;
                 }
@@ -1640,13 +1801,13 @@ export function createXStatePlaybookRuntime(machine, spec) {
                 const playerKey = continuationKey(roleId, playerId);
                 if (activePlayerKeys.has(playerKey)) {
                     const error = new Error(`simultaneous calls to player key ${playerKey} are not allowed`);
-                    await emitCallStarted('player.call.started', 'player.call.finished', { ...identity, prompt }, position);
+                    await emitCallStarted('player.call.started', 'player.call.finished', { ...identity, prompt }, position, signal);
                     await emitTrace('player.call.finished', { ...identity, status: 'error', error: normalizeError(error) }, position);
                     throw error;
                 }
                 activePlayerKeys.add(playerKey);
                 try {
-                    await emitTrace('player.call.started', { ...identity, prompt }, position);
+                    await emitCallStarted('player.call.started', 'player.call.finished', { ...identity, prompt }, position, signal);
                     let rawResult;
                     try {
                         // An abort may land while the awaited started emission drains
@@ -1660,12 +1821,12 @@ export function createXStatePlaybookRuntime(machine, spec) {
                         signal.throwIfAborted();
                     }
                     catch (error) {
-                        if (!signal.aborted)
+                        if (!isAbortFailure(error, signal))
                             controlPlaneError ??= error;
                         try {
                             await emitTrace('player.call.finished', {
                                 ...identity,
-                                status: signal.aborted ? 'aborted' : 'error',
+                                status: isAbortFailure(error, signal) ? 'aborted' : 'error',
                                 error: normalizeError(error),
                             }, position);
                         }
@@ -1681,7 +1842,7 @@ export function createXStatePlaybookRuntime(machine, spec) {
                         result = validatePlayerResult(rawResult);
                     }
                     catch (error) {
-                        if (!signal.aborted)
+                        if (!isAbortFailure(error, signal))
                             controlPlaneError ??= error;
                         try {
                             await emitTrace('player.call.finished', { ...identity, status: 'error', error: normalizeError(error) }, position);
@@ -1695,7 +1856,7 @@ export function createXStatePlaybookRuntime(machine, spec) {
                         updatePlayerResume(roleId, playerId, result);
                     }
                     catch (error) {
-                        if (!signal.aborted)
+                        if (!isAbortFailure(error, signal))
                             controlPlaneError ??= error;
                         try {
                             await emitTrace('player.call.finished', { ...identity, status: 'error', error: normalizeError(error) }, position);
@@ -1738,7 +1899,7 @@ export function createXStatePlaybookRuntime(machine, spec) {
                         ...(turnId !== undefined ? { turnId } : {}),
                         callId,
                     };
-                    await emitCallStarted('judge.call.started', 'judge.call.finished', { ...identity, prompt }, position);
+                    await emitCallStarted('judge.call.started', 'judge.call.finished', { ...identity, prompt }, position, signal);
                     let reply;
                     try {
                         // An abort may land while the awaited started emission drains
@@ -1755,7 +1916,7 @@ export function createXStatePlaybookRuntime(machine, spec) {
                         }
                         await emitTrace('judge.call.finished', {
                             ...identity,
-                            status: signal.aborted ? 'aborted' : 'error',
+                            status: isAbortFailure(error, signal) ? 'aborted' : 'error',
                             error: normalizeError(error),
                         }, position);
                         throw error;
@@ -1802,7 +1963,7 @@ export function createXStatePlaybookRuntime(machine, spec) {
                         ...(turnId !== undefined ? { turnId } : {}),
                         callId,
                     };
-                    await emitCallStarted('captain.call.started', 'captain.call.finished', { ...identity, prompt }, position);
+                    await emitCallStarted('captain.call.started', 'captain.call.finished', { ...identity, prompt }, position, signal);
                     let rawResult;
                     try {
                         // An abort may land while the awaited started emission drains
@@ -1824,7 +1985,7 @@ export function createXStatePlaybookRuntime(machine, spec) {
                             controlPlaneError ??= error;
                         await emitTrace('captain.call.finished', {
                             ...identity,
-                            status: signal.aborted ? 'aborted' : 'error',
+                            status: isAbortFailure(error, signal) ? 'aborted' : 'error',
                             error: normalizeError(error),
                         }, position);
                         throw error;
@@ -1893,8 +2054,9 @@ export function createXStatePlaybookRuntime(machine, spec) {
                 adjudication,
                 resumableStateIds,
             }, ports, () => activeSignal, boundary, (error) => {
-                if (!activeSignal?.aborted)
+                if (activeSignal === undefined || !isAbortFailure(error, activeSignal)) {
                     controlPlaneError ??= error;
+                }
             });
         }
         // Direct-Captain actor (slc/link.md §Captain prompt composition,
@@ -1961,7 +2123,7 @@ export function createXStatePlaybookRuntime(machine, spec) {
                     // failure state (PBRT-47); everything else here — a drained
                     // emission failure, prompt composition, the port itself,
                     // adjudication — is control plane.
-                    if (!active.aborted && !isFsmResultFailure(error)) {
+                    if (!isAbortFailure(error, active) && !isFsmResultFailure(error)) {
                         controlPlaneError ??= error;
                     }
                     throw error;
@@ -1982,56 +2144,177 @@ export function createXStatePlaybookRuntime(machine, spec) {
                 const failedGuard = guards[1] ?? guards[0];
                 const cwd = boundScriptCwd ?? process.cwd();
                 const ports = runtimePorts ?? requireHostPorts();
-                const exitStatus = await new Promise((resolve, reject) => {
-                    let child;
-                    try {
-                        child = spawn('sh', ['-c', input.command], {
-                            cwd,
-                            stdio: 'ignore',
-                        });
+                // slc/link.md §Script execution: an already-aborted turn spawns
+                // nothing, and the thrown signal reason keeps the rejection
+                // causally classified as the abort it is.
+                active.throwIfAborted();
+                // Abort ownership — the listener that terminates the group and
+                // the escalation timer — spans the whole invocation body, not
+                // just the spawn-to-close window: an abort landing during the
+                // post-exit emission tail must still kill surviving group
+                // members before the actor settles (slc/link.md §Script
+                // execution). One finally releases both.
+                let child;
+                let killTimer;
+                const signalGroup = (sig) => {
+                    if (child?.pid !== undefined) {
+                        try {
+                            process.kill(-child.pid, sig);
+                        }
+                        catch {
+                            // Confirmation belongs to the bounded liveness probe below:
+                            // a failed signal can mean ESRCH, EPERM, or another fault.
+                        }
                     }
-                    catch (error) {
-                        reject(error);
+                };
+                // After a SIGKILL is posted, settlement waits for the group to
+                // stop being signalable — bounded by the same grace so an
+                // unreapable member outside the runtime's control cannot stall
+                // the turn forever. Observed teardown is milliseconds.
+                let groupGonePromise;
+                const awaitGroupGone = () => {
+                    const pid = child?.pid;
+                    if (pid === undefined)
+                        return Promise.resolve();
+                    groupGonePromise ??= (async () => {
+                        const teardownFailure = (message, cause) => {
+                            const failure = new ScriptProcessGroupTeardownError(pid, message, cause);
+                            // A teardown failure is not an authored script result.
+                            // Surface it at the active public boundary even though
+                            // XState also routes the rejected actor through onError.
+                            controlPlaneError ??= failure;
+                            return failure;
+                        };
+                        const deadline = Date.now() + SCRIPT_ABORT_KILL_GRACE_MS;
+                        let lastProbeError;
+                        for (;;) {
+                            try {
+                                process.kill(-pid, 0);
+                            }
+                            catch (error) {
+                                if (isNoSuchProcess(error))
+                                    return;
+                                // EPERM confirms that at least one process in the group
+                                // still exists but is not signalable by this process. Keep
+                                // waiting for ESRCH within the bound; every other probe
+                                // error makes confirmation itself unreliable immediately.
+                                if (!isProcessPermissionDenied(error)) {
+                                    throw teardownFailure('the liveness probe failed', error);
+                                }
+                                lastProbeError = error;
+                            }
+                            if (Date.now() >= deadline) {
+                                throw teardownFailure(`the group remained signalable after ${SCRIPT_ABORT_KILL_GRACE_MS}ms`, lastProbeError);
+                            }
+                            await new Promise((tick) => setTimeout(tick, 5));
+                        }
+                    })();
+                    return groupGonePromise;
+                };
+                const onAbort = () => {
+                    signalGroup('SIGTERM');
+                    killTimer = setTimeout(() => signalGroup('SIGKILL'), SCRIPT_ABORT_KILL_GRACE_MS);
+                };
+                // An abort observed once the shell has already exited rejects
+                // with the signal's reason before guard resolution and before
+                // starting any further script emission — after killing whatever
+                // group members outlived the shell. The shell's own exit ended
+                // the TERM grace's purpose, so escalation is immediate here.
+                const settleIfAborted = async () => {
+                    if (!active.aborted)
                         return;
+                    signalGroup('SIGKILL');
+                    await awaitGroupGone();
+                    active.throwIfAborted();
+                };
+                let invocationFailed = false;
+                try {
+                    const exitStatus = await new Promise((resolve, reject) => {
+                        try {
+                            // detached: the shell leads its own POSIX process group,
+                            // so an abort can terminate the command's whole group — a
+                            // lone SIGTERM to the wrapper never reaches backgrounded
+                            // members.
+                            child = spawn('sh', ['-c', input.command], {
+                                cwd,
+                                stdio: 'ignore',
+                                detached: true,
+                            });
+                        }
+                        catch (error) {
+                            reject(error);
+                            return;
+                        }
+                        // On abort, terminate the group and escalate — but settle
+                        // only from 'close', after the shell itself has exited, so
+                        // the turn never reports quiescence while the script still
+                        // runs (slc/link.md §Abort). SIGKILL is untrappable, so
+                        // 'close' is bounded by the grace.
+                        active.addEventListener('abort', onAbort, { once: true });
+                        child.on('error', (error) => {
+                            reject(error);
+                        });
+                        child.on('close', (code) => {
+                            if (active.aborted) {
+                                // The shell may exit cooperatively on the group SIGTERM
+                                // while a TERM-immune same-group descendant survives;
+                                // the group stays addressable while any member lives,
+                                // so kill it and await its disappearance before
+                                // settling (slc/link.md §Script execution).
+                                signalGroup('SIGKILL');
+                                void awaitGroupGone().then(() => reject(active.reason), reject);
+                                return;
+                            }
+                            resolve(typeof code === 'number' ? code : 1);
+                        });
+                    });
+                    await settleIfAborted();
+                    await ports.emitStatus(`Executed script for ${input.stateId} (exit ${exitStatus}).`);
+                    await settleIfAborted();
+                    await ports.emitTelemetry({
+                        topic: 'playbook.script',
+                        payload: {
+                            stateId: input.stateId,
+                            sourceItem: input.sourceItem,
+                            exitStatus,
+                        },
+                    });
+                    await settleIfAborted();
+                    if (exitStatus === 0) {
+                        return { guard: okGuard, exitStatus: 0 };
                     }
-                    const onAbort = () => {
-                        child.kill('SIGTERM');
-                        reject(active.reason ?? new Error('script aborted'));
-                    };
-                    if (active.aborted) {
-                        onAbort();
-                        return;
+                    return { guard: failedGuard, exitStatus };
+                }
+                catch (error) {
+                    // Preserve the invocation's authoritative exact cancellation or
+                    // distinct sink failure after teardown succeeds. The finally
+                    // block may replace it only with a distinct teardown failure
+                    // when the process group cannot be confirmed gone.
+                    invocationFailed = true;
+                    throw error;
+                }
+                finally {
+                    try {
+                        if (active.aborted) {
+                            signalGroup('SIGKILL');
+                            await awaitGroupGone();
+                            if (!invocationFailed)
+                                active.throwIfAborted();
+                        }
                     }
-                    active.addEventListener('abort', onAbort, { once: true });
-                    child.on('error', (error) => {
-                        active.removeEventListener('abort', onAbort);
-                        reject(error);
-                    });
-                    child.on('close', (code) => {
+                    finally {
                         active.removeEventListener('abort', onAbort);
-                        resolve(typeof code === 'number' ? code : 1);
-                    });
-                });
-                await ports.emitStatus(`Executed script for ${input.stateId} (exit ${exitStatus}).`);
-                await ports.emitTelemetry({
-                    topic: 'playbook.script',
-                    payload: {
-                        stateId: input.stateId,
-                        sourceItem: input.sourceItem,
-                        exitStatus,
-                    },
-                });
-                if (exitStatus === 0) {
-                    return { guard: okGuard, exitStatus: 0 };
+                        if (killTimer !== undefined)
+                            clearTimeout(killTimer);
+                    }
                 }
-                return { guard: failedGuard, exitStatus };
             });
         }
         const nestedBridge = createNestedPlaybookBridge({
             nextCallId: () => `playbook-${++playbookCallSequence}`,
             getBoundarySignal: () => activeSignal,
             callPlaybook: (request, signal) => requireHostPorts().callPlaybook(request, signal),
-            emitStarted: async (event) => {
+            emitStarted: async (event, aborts) => {
                 playbookCallTurnIds.set(event.callId, activeTurnId);
                 await emitTrace('playbook.call.started', {
                     stateId: event.stateId,
@@ -2040,9 +2323,9 @@ export function createXStatePlaybookRuntime(machine, spec) {
                 }, {
                     ...(activeTurnId !== undefined ? { turnId: activeTurnId } : {}),
                     callId: event.callId,
-                });
+                }, aborts);
             },
-            emitFinished: async (event) => {
+            emitFinished: async (event, aborts) => {
                 const turnId = playbookCallTurnIds.get(event.callId);
                 try {
                     await emitTrace('playbook.call.finished', {
@@ -2053,22 +2336,34 @@ export function createXStatePlaybookRuntime(machine, spec) {
                     }, {
                         ...(turnId !== undefined ? { turnId } : {}),
                         callId: event.callId,
-                    });
+                    }, aborts);
                 }
                 finally {
                     playbookCallTurnIds.delete(event.callId);
                 }
             },
             drain: drainEmissions,
-            bindResumeSignal: (signal) => {
+            bindResumeSignal: (signal, aborts) => {
                 activeSignal = signal;
+                activeAborts = aborts ?? abortReasonClassifier(signal);
+            },
+            bindActorSettlement: (aborts) => {
+                actorSettlementAborts = aborts;
             },
-            onControlPlaneError: (error) => {
-                if (!activeSignal?.aborted)
+            onControlPlaneError: (error, aborts) => {
+                // The shared bridge classifies before reporting against its own
+                // invocation-and-resume signals; classify once more here against
+                // the boundary signal so a report that is the active boundary's
+                // exact abort reason can never masquerade as a control error
+                // (slc/link.md §Abort).
+                if (!aborts?.isAbortReason(error) &&
+                    !activeAborts?.isAbortReason(error)) {
                     controlPlaneError ??= error;
+                }
             },
-            onBackgroundError: (error) => {
-                emissionFailure ??= error;
+            onBackgroundError: (error, aborts) => {
+                if (!aborts?.isAbortReason(error))
+                    emissionFailure ??= { error };
             },
         });
         function tracePositionForActiveTurn() {
@@ -2082,11 +2377,9 @@ export function createXStatePlaybookRuntime(machine, spec) {
                 previousState: previousState ?? null,
                 state,
             };
-            if (state.stateId === 'awaitBossReply') {
-                const pendingBossQuestion = pendingBossQuestionFromContext(context);
-                if (pendingBossQuestion !== undefined) {
-                    payload.pendingBossQuestion = pendingBossQuestion;
-                }
+            const pendingBossQuestion = pendingBossQuestionForState(state, context);
+            if (pendingBossQuestion !== undefined) {
+                payload.pendingBossQuestion = pendingBossQuestion;
             }
             if (state.stateId === 'failed') {
                 const lastError = normalizeErrorFull(context.lastError);
@@ -2095,7 +2388,7 @@ export function createXStatePlaybookRuntime(machine, spec) {
             }
             return snapshotJsonValue(payload, 'FSM telemetry payload');
         }
-        function enqueueTransitionEmission(payload, state, statuses, position) {
+        function enqueueTransitionEmission(payload, state, statuses, position, aborts) {
             const currentSession = requireSession();
             const transitionTrace = createTraceEvent('fsm.transition', payload, position);
             const statusEmissions = statuses.map(({ message, data }) => ({
@@ -2124,13 +2417,38 @@ export function createXStatePlaybookRuntime(machine, spec) {
                     });
                     await currentSession.ports.emitStatus(status.message, status.data);
                 }
-            }).catch(() => undefined);
+            }, aborts).catch(() => undefined);
         }
-        function latchInspectionError(error) {
-            if (activeSignal !== undefined)
-                controlPlaneError ??= error;
+        // One classifying latch for every runtime-observed error — inspection
+        // failures and root-actor errors alike. Outside a boundary the error
+        // rides the emission channel, which the next boundary's (or init's)
+        // drain throws; inside a boundary it is a control-plane error unless it
+        // is the boundary signal's own abort reason (slc/link.md §Abort).
+        function latchRuntimeError(error, aborts = activeAborts) {
+            if (aborts?.isAbortReason(error))
+                return;
+            if (activeSignal === undefined)
+                emissionFailure ??= { error };
             else
-                emissionFailure ??= error;
+                controlPlaneError ??= error;
+        }
+        function consumeActorSettlementAborts(forSnapshot = false) {
+            const aborts = actorSettlementAborts ?? actorSettlementErrorAborts;
+            actorSettlementAborts = undefined;
+            actorSettlementErrorAborts = undefined;
+            if (forSnapshot && aborts !== undefined) {
+                // XState can report an errored root through both its inspection
+                // snapshot and subscriber. Keep the same provenance through that
+                // synchronous notification only; an ordinary transition must not
+                // lend it to a later unrelated actor error.
+                actorSettlementErrorAborts = aborts;
+                queueMicrotask(() => {
+                    if (actorSettlementErrorAborts === aborts) {
+                        actorSettlementErrorAborts = undefined;
+                    }
+                });
+            }
+            return aborts;
         }
         // PBRT-6: the single seam that stops this runtime's actor. Stopping a
         // still-running actor fires one more `@xstate.snapshot` for the
@@ -2176,6 +2494,7 @@ export function createXStatePlaybookRuntime(machine, spec) {
                         return;
                     if (suppressInspectionEmissions)
                         return;
+                    const settlementAborts = consumeActorSettlementAborts(true);
                     try {
                         const snap = inspectionEvent.snapshot;
                         const state = normalizePlaybookSnapshot(snap);
@@ -2187,14 +2506,24 @@ export function createXStatePlaybookRuntime(machine, spec) {
                             {});
                         const payload = structuredStateTelemetryPayload(previousState, state, inspectionEvent.event, context);
                         const statuses = statusesForState(state, context, inspectionEvent.event);
-                        enqueueTransitionEmission(payload, state, statuses, tracePositionForActiveTurn());
+                        enqueueTransitionEmission(payload, state, statuses, tracePositionForActiveTurn(), settlementAborts);
                         priorState = state;
                     }
                     catch (error) {
-                        latchInspectionError(error);
+                        latchRuntimeError(error, settlementAborts);
                     }
                 },
             });
+            // A synchronously-errored actor is already quiescent, so the turn's
+            // quiescence wait never subscribes and XState would report the error
+            // as unhandled after the boundary returns. Observe it through the
+            // classifying latch: mid-boundary it is the control-plane error
+            // unless it is the abort reason itself; at startup it rides the
+            // emission channel so `init`'s own drain rejects with it and the
+            // failed-start cleanup runs (slc/link.md §Session lifecycle).
+            builtActor.subscribe({
+                error: (error) => latchRuntimeError(error, consumeActorSettlementAborts()),
+            });
             return builtActor;
         }
         function runResultFor(outcome, error) {
@@ -2211,14 +2540,17 @@ export function createXStatePlaybookRuntime(machine, spec) {
             }
             if (outcome === 'terminal') {
                 const output = actor?.getSnapshot()?.output;
-                if (output !== undefined) {
-                    return {
-                        outcome,
-                        state,
-                        output: snapshotJsonValue(output, 'terminal playbook output'),
-                    };
-                }
-                return { outcome, state };
+                const stateDescription = stateDescriptionFor(state);
+                return {
+                    outcome,
+                    state,
+                    ...(stateDescription === undefined ? {} : { stateDescription }),
+                    ...(output === undefined
+                        ? {}
+                        : {
+                            output: snapshotJsonValue(output, 'terminal playbook output'),
+                        }),
+                };
             }
             const failure = error ??
                 (outcome === 'failed'
@@ -2236,15 +2568,23 @@ export function createXStatePlaybookRuntime(machine, spec) {
         function settledOutcome(signal) {
             if (nestedBridge.getPendingCall())
                 return 'suspended';
-            if (signal.aborted)
-                return 'aborted';
             const state = currentState();
             if (state.status === 'error') {
+                // An errored actor outranks a coincident abort unless the actor's
+                // error is the abort reason itself (slc/link.md §Abort).
                 const actorError = actor?.getSnapshot()?.error;
+                if (actorError !== undefined && isAbortFailure(actorError, signal)) {
+                    return 'aborted';
+                }
                 throw actorError ?? new Error(`${label} actor entered error status`);
             }
+            // Terminal completion outranks a coincident abort: the work finished,
+            // and reporting `aborted` would hide a terminal machine behind a
+            // settlement a later turn silently restarts (slc/link.md §Abort).
             if (state.status === 'done')
                 return 'terminal';
+            if (signal.aborted)
+                return 'aborted';
             if (state.stateId === 'failed')
                 return 'failed';
             return 'quiescent';
@@ -2317,6 +2657,10 @@ export function createXStatePlaybookRuntime(machine, spec) {
             savedPorts = undefined;
             runtimePorts = undefined;
             activeSignal = undefined;
+            activeAborts = undefined;
+            actorSettlementAborts = undefined;
+            actorSettlementErrorAborts = undefined;
+            activeAbortEmission = undefined;
             activeTurnId = undefined;
             controlPlaneError = undefined;
             emissionFailure = undefined;
@@ -2338,28 +2682,56 @@ export function createXStatePlaybookRuntime(machine, spec) {
                 can.call(snapshot, event) ===
                     true);
         }
+        // DR-034: where the artifact names the FSM context member its entry
+        // action copies the exact Boss text into, that member of the live
+        // snapshot is the retry payload's source. The persisted machine snapshot
+        // carries it, so the candidate derives identically in the process that
+        // exported the snapshot and in one that restored it, and a failure
+        // reached after a Boss reply — whose recorded event the failure state
+        // refuses — is recoverable too. Naming the member is the artifact's
+        // statement that it holds the entry text: a same-named member is never
+        // assumed, since inferring one would turn any matching context member
+        // into a replay payload without its author saying so.
+        // Declared and absent or empty excludes the candidate rather than
+        // falling back to the record, which would make the action depend on the
+        // process again — the very thing this source exists to end.
+        function retryEventFrom(snapshot) {
+            const entryEvent = spec.entryEvent;
+            if (entryEvent?.contextField === undefined)
+                return lastBossEvent;
+            const context = snapshot?.context;
+            const text = isPlainObject(context)
+                ? context[entryEvent.contextField]
+                : undefined;
+            if (typeof text !== 'string' || text.trim() === '')
+                return undefined;
+            return { type: entryEvent.type, [entryEvent.textField]: text };
+        }
         // The failure-state retry entry replays the recorded last classified
-        // event with its recorded payload. A candidate whose event the live
-        // snapshot does not accept — or whose payload the runtime never
-        // recorded — is excluded rather than completed with invented text.
+        // event with its recorded payload, or the entry event the declared
+        // context member above sources. A candidate whose event the live
+        // snapshot does not accept — or whose payload the runtime can source
+        // from neither — is excluded rather than completed with invented text.
         function retryActionFor(snapshot, stateId) {
-            if (stateId !== 'failed' || lastBossEvent === undefined) {
+            if (stateId !== 'failed')
                 return undefined;
-            }
-            if (!snapshotCan(snapshot, lastBossEvent))
+            const retryEvent = retryEventFrom(snapshot);
+            if (retryEvent === undefined)
+                return undefined;
+            if (!snapshotCan(snapshot, retryEvent))
                 return undefined;
             // A recorded explicit-state-jump event names the exact state its
             // replay re-enters: the root BOSS_INTERRUPT shape is a guarded
             // multi-arm list keyed on `targetId`, so the first configured arm
             // may label a different state than the one the recorded event
             // actually resumes.
-            const recordedTargetId = lastBossEvent.type === JUMP_EVENT_TYPE
-                ? lastBossEvent.targetId
+            const recordedTargetId = retryEvent.type === JUMP_EVENT_TYPE
+                ? retryEvent.targetId
                 : undefined;
             const target = typeof recordedTargetId === 'string' &&
                 recordedTargetId.trim().length > 0
                 ? recordedTargetId
-                : firstTransitionTarget(machine, stateId, lastBossEvent.type);
+                : firstTransitionTarget(machine, stateId, retryEvent.type);
             // PBRT-52: a label is written from a source state description, never
             // from an identifier. Falling back to the target id — or, with no
             // resolvable target, to the FSM event type — makes the label *be* the
@@ -2373,10 +2745,10 @@ export function createXStatePlaybookRuntime(machine, spec) {
                 return undefined;
             return {
                 action: {
-                    id: `retry:${lastBossEvent.type}`,
+                    id: `retry:${retryEvent.type}`,
                     label: `Retry: ${description}`,
                 },
-                event: lastBossEvent,
+                event: retryEvent,
             };
         }
         function deriveControlActions(snapshot) {
@@ -2561,7 +2933,7 @@ export function createXStatePlaybookRuntime(machine, spec) {
                 const machineSnapshot = detachPersistedMachineSnapshot(actor.getPersistedSnapshot());
                 const context = actor.getSnapshot()
                     .context;
-                const pending = pendingBossQuestionFromContext(context ?? {});
+                const pending = pendingBossQuestionForState(state, context ?? {});
                 return {
                     schemaVersion: 3,
                     playbookId: session.playbookId,
@@ -2642,8 +3014,23 @@ export function createXStatePlaybookRuntime(machine, spec) {
                     suppressInspectionEmissions = true;
                     actor = buildActor(runtimePorts, boundSnapshot.machine);
                     actor.start();
-                    if (controlPlaneError !== undefined)
-                        throw controlPlaneError;
+                    // A start-time actor error rides the startup emission channel
+                    // (latchRuntimeError); consume both latches here so the original
+                    // error outranks the derived status check below.
+                    {
+                        const startupFailure = emissionFailure;
+                        if (controlPlaneError !== undefined ||
+                            startupFailure !== undefined) {
+                            const startupError = controlPlaneError !== undefined
+                                ? controlPlaneError
+                                : startupFailure.error;
+                            controlPlaneError = undefined;
+                            if (emissionFailure === startupFailure) {
+                                emissionFailure = undefined;
+                            }
+                            throw startupError;
+                        }
+                    }
                     const restoredState = normalizePlaybookSnapshot(actor.getSnapshot(), suspendedCall === undefined
                         ? {}
                         : {
@@ -2709,7 +3096,7 @@ export function createXStatePlaybookRuntime(machine, spec) {
                 const state = currentState();
                 const context = (snapshot.context ??
                     {});
-                const pending = pendingBossQuestionFromContext(context);
+                const pending = pendingBossQuestionForState(state, context);
                 const lastError = normalizeErrorFull(context.lastError);
                 const projectedContext = projectControlContext(context);
                 const stateDescription = stateDescriptionFor(state);
@@ -2777,6 +3164,8 @@ export function createXStatePlaybookRuntime(machine, spec) {
                 const position = { turnId, callId };
                 activeTurnId = turnId;
                 activeSignal = signal;
+                activeAborts = abortReasonClassifier(signal);
+                activeAbortEmission = undefined;
                 controlPlaneError = undefined;
                 // Every receipt variant is normalized and frozen where it is built,
                 // inside the guarded region, so the recording step below cannot
@@ -2822,9 +3211,14 @@ export function createXStatePlaybookRuntime(machine, spec) {
                 // final for their key. Past publication such a failure is therefore
                 // re-latched onto the emission channel, surfacing from the next
                 // public boundary's drain, and `apply` still does not throw past
-                // acceptance (PBRT-52).
+                // acceptance (PBRT-52). A delivery rejection causally identical to
+                // this call's own abort reason evidences the cancellation and is
+                // dropped — never carried to a later unrelated boundary
+                // (slc/link.md §Abort).
                 const latchDeliveryFailure = (error) => {
-                    emissionFailure ??= error;
+                    if (isAbortFailure(error, signal))
+                        return;
+                    emissionFailure ??= { error };
                 };
                 try {
                     try {
@@ -2844,7 +3238,7 @@ export function createXStatePlaybookRuntime(machine, spec) {
                             key,
                             ...receiptTracePayload({ disposition: 'rejected', reason }),
                         });
-                        await emitCallStarted('apply.started', 'apply.finished', identity, position, preAcceptanceFinish('apply.started trace sink rejected'));
+                        await emitCallStarted('apply.started', 'apply.finished', identity, position, signal, preAcceptanceFinish('apply.started trace sink rejected'));
                         // An abort may land while the awaited started emission drains
                         // (e.g. fired from the trace sink itself); the action must
                         // never execute after abort. Settle the already-started pair
@@ -2923,6 +3317,10 @@ export function createXStatePlaybookRuntime(machine, spec) {
                     catch (error) {
                         settlementError = error;
                     }
+                    // Exact cancellation is not a control-plane latch, but after apply
+                    // acceptance and before publication it is still settlement evidence
+                    // and therefore folds into the owed failed receipt (DR-036 §4).
+                    settlementError ??= activeAbortEmission;
                     // Fold before the finish emission, the last point at which the
                     // traced disposition and the returned one can still be made the
                     // same value.
@@ -2964,6 +3362,8 @@ export function createXStatePlaybookRuntime(machine, spec) {
                     // wedge every later public boundary behind "another runtime turn
                     // is active".
                     activeSignal = undefined;
+                    activeAborts = undefined;
+                    activeAbortEmission = undefined;
                     activeTurnId = undefined;
                     controlPlaneError = undefined;
                 }
@@ -2999,119 +3399,152 @@ export function createXStatePlaybookRuntime(machine, spec) {
                 const turnId = ++turnSequence;
                 activeTurnId = turnId;
                 activeSignal = signal;
+                activeAborts = abortReasonClassifier(signal);
+                activeAbortEmission = undefined;
                 controlPlaneError = undefined;
                 let result;
                 let operationError;
+                // The boundary sentinel releases on every exit: a settlement defect
+                // past the drain — a snapshot normalization throw inside
+                // `runResultFor` included — must never wedge every later public
+                // boundary and `dispose` itself behind "another runtime turn is
+                // active". Mirrors the apply boundary's finally.
                 try {
-                    await emitTrace('boss.input.received', { text }, { turnId });
-                    // 1. Map the Boss text to an FSM event: deterministic exact entry
-                    //    where applicable (slc/link.md §Boss-event mapping), judge
-                    //    classification otherwise.
-                    let event;
-                    const trimmed = text.trim();
-                    if (trimmed !== '') {
-                        const snapshot = actor.getSnapshot();
-                        const terminal = snapshot.status === 'done';
-                        const stateId = normalizePlaybookSnapshot(snapshot).stateId;
-                        if (spec.entryEvent !== undefined &&
-                            (stateId === 'ready' || terminal)) {
-                            event = {
-                                type: spec.entryEvent.type,
-                                [spec.entryEvent.textField]: text,
-                            };
-                        }
-                        else {
-                            event = await classifyBossText(text, runtimePorts, signal, snapshot, boundary, boundOptions);
-                        }
-                        signal.throwIfAborted();
-                    }
-                    // Empty input, no-action classifier output, or invalid classifier
-                    // output — nothing to send.
-                    if (event === undefined) {
-                        result = runResultFor('no-action');
-                    }
-                    else {
-                        // 2. Optional Captain-pane classification line: the bare FSM
-                        //    event type, emitted before the FSM advances.
-                        const statusLine = classificationStatus(event);
-                        if (statusLine !== undefined) {
-                            await runtimePorts.emitStatus(statusLine);
-                        }
+                    try {
+                        await emitTrace('boss.input.received', { text }, { turnId });
+                        // Record the attempted input, then refuse a boundary that entered
+                        // aborted before deterministic mapping or the classifier can
+                        // perform host-visible work (DR-036 §5).
                         signal.throwIfAborted();
-                        // 3. A final actor cannot accept new events; reconstruct only
-                        //    after classification produced a real event.
-                        if (actor.getSnapshot().status === 'done') {
-                            stopActor();
-                            actor = buildActor(runtimePorts);
-                            // The replacement actor's snapshots are real state entries.
-                            suppressInspectionEmissions = false;
-                            actor.start();
+                        // 1. Map the Boss text to an FSM event: deterministic exact entry
+                        //    where applicable (slc/link.md §Boss-event mapping), judge
+                        //    classification otherwise.
+                        let event;
+                        const trimmed = text.trim();
+                        if (trimmed !== '') {
+                            const snapshot = actor.getSnapshot();
+                            const terminal = snapshot.status === 'done';
+                            const stateId = normalizePlaybookSnapshot(snapshot).stateId;
+                            // PBRT-1 / slc/link.md §Boss-event mapping: the idle entry, the
+                            // recoverable failure state, and the reconstructed terminal all
+                            // accept exactly one ordinary textual entry event, so delivered
+                            // text enters deterministically — no judge call to spend and no
+                            // classifier whim to settle a restart as no action. Every other
+                            // parked state — a reply wait or an authored mid-workflow
+                            // checkpoint — classifies under its own Boss-event contracts.
+                            if (spec.entryEvent !== undefined &&
+                                (stateId === 'ready' || stateId === 'failed' || terminal)) {
+                                event = {
+                                    type: spec.entryEvent.type,
+                                    [spec.entryEvent.textField]: text,
+                                };
+                            }
+                            else {
+                                event = await classifyBossText(text, runtimePorts, signal, snapshot, boundary, boundOptions);
+                            }
+                            signal.throwIfAborted();
                         }
-                        // DR-029: keep the classified event with its recorded payload
-                        // as the retry-replay source. Recording is sanitizing, not
-                        // load-bearing: an override classifier's non-JSON-safe event is
-                        // simply not recorded, and the turn proceeds unchanged.
-                        try {
-                            lastBossEvent = snapshotJsonValue(event, 'recorded Boss event');
+                        // Empty input, no-action classifier output, or invalid classifier
+                        // output — nothing to send.
+                        if (event === undefined) {
+                            result = runResultFor('no-action');
                         }
-                        catch {
-                            lastBossEvent = undefined;
+                        else {
+                            // 2. Optional Captain-pane classification line: the bare FSM
+                            //    event type, emitted before the FSM advances.
+                            const statusLine = classificationStatus(event);
+                            if (statusLine !== undefined) {
+                                await runtimePorts.emitStatus(statusLine);
+                            }
+                            signal.throwIfAborted();
+                            // 3. A final actor cannot accept new events; reconstruct only
+                            //    after classification produced a real event.
+                            if (actor.getSnapshot().status === 'done') {
+                                stopActor();
+                                actor = buildActor(runtimePorts);
+                                // The replacement actor's snapshots are real state entries.
+                                suppressInspectionEmissions = false;
+                                actor.start();
+                            }
+                            // DR-029: keep the classified event with its recorded payload
+                            // as the retry-replay source. Recording is sanitizing, not
+                            // load-bearing: an override classifier's non-JSON-safe event is
+                            // simply not recorded, and the turn proceeds unchanged.
+                            try {
+                                lastBossEvent = snapshotJsonValue(event, 'recorded Boss event');
+                            }
+                            catch {
+                                lastBossEvent = undefined;
+                            }
+                            actor.send(event);
+                            await waitForPlaybookQuiescence(actor, {
+                                pendingCalls: nestedBridge,
+                            });
+                            if (controlPlaneError !== undefined)
+                                throw controlPlaneError;
+                            result = runResultFor(settledOutcome(signal));
                         }
-                        actor.send(event);
-                        await waitForPlaybookQuiescence(actor, {
-                            pendingCalls: nestedBridge,
-                        });
-                        if (controlPlaneError !== undefined)
-                            throw controlPlaneError;
-                        result = runResultFor(settledOutcome(signal));
                     }
+                    catch (error) {
+                        operationError = error;
+                    }
+                    let drainError;
+                    try {
+                        await drainEmissions();
+                    }
+                    catch (error) {
+                        drainError = error;
+                    }
+                    const latchedControlError = controlPlaneError;
+                    // A drain rejection that is the exact abort reason evidences the
+                    // cancellation, not a control-plane failure (slc/link.md §Abort).
+                    const drainAbort = drainError !== undefined && isAbortFailure(drainError, signal);
+                    const effectiveDrainError = drainAbort ? undefined : drainError;
+                    const primaryError = latchedControlError ?? effectiveDrainError ?? operationError;
+                    const abortError = latchedControlError === undefined &&
+                        effectiveDrainError === undefined &&
+                        ((operationError !== undefined &&
+                            isAbortFailure(operationError, signal)) ||
+                            (drainAbort && operationError === undefined));
+                    const settlementResult = primaryError === undefined
+                        ? (result ?? runResultFor('no-action'))
+                        : runResultFor(abortError ? 'aborted' : 'failed', primaryError);
+                    let settlementEmissionError;
+                    try {
+                        await emitTrace('boss.input.settled', settlementTracePayload(settlementResult), { turnId });
+                    }
+                    catch (error) {
+                        settlementEmissionError = error;
+                    }
+                    try {
+                        await drainEmissions();
+                    }
+                    catch (error) {
+                        settlementEmissionError ??= error;
+                    }
+                    if (settlementEmissionError !== undefined &&
+                        isAbortFailure(settlementEmissionError, signal)) {
+                        settlementEmissionError = undefined;
+                    }
+                    const failure = controlPlaneError ??
+                        latchedControlError ??
+                        effectiveDrainError ??
+                        (abortError
+                            ? (settlementEmissionError ?? operationError)
+                            : (operationError ?? settlementEmissionError));
+                    if (failure !== undefined &&
+                        !(abortError && settlementEmissionError === undefined)) {
+                        throw failure;
+                    }
+                    return settlementResult;
                 }
-                catch (error) {
-                    operationError = error;
-                }
-                let drainError;
-                try {
-                    await drainEmissions();
-                }
-                catch (error) {
-                    drainError = error;
-                }
-                const latchedControlError = controlPlaneError;
-                const primaryError = latchedControlError ?? drainError ?? operationError;
-                const abortError = latchedControlError === undefined &&
-                    drainError === undefined &&
-                    operationError !== undefined &&
-                    isAbortFailure(operationError, signal);
-                const settlementResult = primaryError === undefined
-                    ? (result ?? runResultFor('no-action'))
-                    : runResultFor(abortError ? 'aborted' : 'failed', primaryError);
-                let settlementEmissionError;
-                try {
-                    await emitTrace('boss.input.settled', settlementTracePayload(settlementResult), { turnId });
-                }
-                catch (error) {
-                    settlementEmissionError = error;
-                }
-                try {
-                    await drainEmissions();
-                }
-                catch (error) {
-                    settlementEmissionError ??= error;
-                }
-                const failure = controlPlaneError ??
-                    latchedControlError ??
-                    drainError ??
-                    (abortError
-                        ? (settlementEmissionError ?? operationError)
-                        : (operationError ?? settlementEmissionError));
-                activeSignal = undefined;
-                activeTurnId = undefined;
-                controlPlaneError = undefined;
-                if (failure !== undefined &&
-                    !(abortError && settlementEmissionError === undefined)) {
-                    throw failure;
+                finally {
+                    activeSignal = undefined;
+                    activeAborts = undefined;
+                    activeAbortEmission = undefined;
+                    activeTurnId = undefined;
+                    controlPlaneError = undefined;
                 }
-                return settlementResult;
             },
             async resumePlaybookCall(input) {
                 if (!actor || !savedPorts) {
@@ -3125,41 +3558,85 @@ export function createXStatePlaybookRuntime(machine, spec) {
                 }
                 activeTurnId = playbookCallTurnIds.get(input.callId);
                 activeSignal = input.signal;
+                activeAborts = abortReasonClassifier(input.signal);
+                activeAbortEmission = undefined;
                 controlPlaneError = undefined;
-                let result;
-                let operationError;
-                try {
-                    await nestedBridge.resume(input);
-                }
-                catch (error) {
-                    operationError = error;
-                }
-                try {
-                    await waitForPlaybookQuiescence(actor, {
-                        pendingCalls: nestedBridge,
-                    });
-                    result = runResultFor(settledOutcome(input.signal));
-                }
-                catch (error) {
-                    operationError ??= error;
-                }
-                let drainError;
+                // The boundary sentinel releases on every exit, mirroring
+                // `handleBossInput` and the apply boundary.
                 try {
-                    await drainEmissions();
-                }
-                catch (error) {
-                    drainError = error;
+                    let result;
+                    let operationError;
+                    try {
+                        await nestedBridge.resume(input);
+                    }
+                    catch (error) {
+                        operationError = error;
+                    }
+                    try {
+                        await waitForPlaybookQuiescence(actor, {
+                            pendingCalls: nestedBridge,
+                        });
+                        result = runResultFor(settledOutcome(input.signal));
+                    }
+                    catch (error) {
+                        operationError ??= error;
+                    }
+                    // A resume refused because its signal was already aborted
+                    // delivers nothing: the pending call survives for a later
+                    // resume, and the boundary settles `aborted` rather than
+                    // advertising `suspended` (slc/link.md §Nested playbook bridge).
+                    if (operationError !== undefined &&
+                        isAbortFailure(operationError, input.signal) &&
+                        nestedBridge.getPendingCall()?.callId === input.callId) {
+                        result = {
+                            outcome: 'aborted',
+                            state: currentState(),
+                            error: normalizeError(input.signal.reason),
+                        };
+                    }
+                    let drainError;
+                    try {
+                        await drainEmissions();
+                    }
+                    catch (error) {
+                        drainError = error;
+                    }
+                    const aborts = activeAborts ?? abortReasonClassifier(input.signal);
+                    // A control-plane latch has already classified its failure as
+                    // distinct under the owning operation. Never reinterpret it
+                    // against this later resume signal (DR-036 decision 2).
+                    const controlFailure = controlPlaneError;
+                    const drainAbort = controlFailure === undefined &&
+                        drainError !== undefined &&
+                        aborts.isAbortReason(drainError);
+                    const operationAbort = controlFailure === undefined &&
+                        operationError !== undefined &&
+                        aborts.isAbortReason(operationError);
+                    const abortEvidence = activeAbortEmission ??
+                        (drainAbort ? drainError : undefined) ??
+                        (operationAbort ? operationError : undefined);
+                    const failure = controlFailure ??
+                        (drainAbort ? undefined : drainError) ??
+                        (operationAbort ? undefined : operationError);
+                    if (failure !== undefined)
+                        throw failure;
+                    if (abortEvidence !== undefined &&
+                        result?.outcome !== 'terminal' &&
+                        result?.outcome !== 'suspended') {
+                        result = runResultFor('aborted', abortEvidence);
+                    }
+                    if (result === undefined) {
+                        throw new Error('playbook resume produced no runtime result');
+                    }
+                    return result;
                 }
-                const failure = controlPlaneError ?? drainError ?? operationError;
-                activeSignal = undefined;
-                activeTurnId = undefined;
-                controlPlaneError = undefined;
-                if (failure !== undefined)
-                    throw failure;
-                if (result === undefined) {
-                    throw new Error('playbook resume produced no runtime result');
+                finally {
+                    activeSignal = undefined;
+                    activeAborts = undefined;
+                    activeAbortEmission = undefined;
+                    activeTurnId = undefined;
+                    controlPlaneError = undefined;
                 }
-                return result;
             },
             dispose() {
                 if (disposalPromise !== undefined)
@@ -3228,6 +3705,10 @@ export function createXStatePlaybookRuntime(machine, spec) {
                         appliedReceipts.clear();
                         actor = undefined;
                         activeSignal = undefined;
+                        activeAborts = undefined;
+                        actorSettlementAborts = undefined;
+                        actorSettlementErrorAborts = undefined;
+                        activeAbortEmission = undefined;
                         activeTurnId = undefined;
                         controlPlaneError = undefined;
                         emissionFailure = undefined;