@sublang/playbook 8.0.0 → 9.0.0

package/src/xstate-playbook-runtime.ts

@@ -375,7 +375,19 @@ export interface XStatePlaybookRuntimeSpec<TOptions> {
    * ordinary textual entry event, send it without a judge call, carrying the
    * exact Boss text in `textField`. Absent: every non-empty turn classifies.
    */
-  entryEvent?: { type: string; textField: string };
+  entryEvent?: {
+    type: string;
+    textField: string;
+    /**
+     * DR-034: the FSM context member this machine's entry action copies the
+     * exact Boss text into. Where it is named, the failure-state retry
+     * builds its payload from that member of the live snapshot instead of
+     * from the process-local recorded event, so the action derives the same
+     * before and after `restore`. Absent: the recorded event stays the
+     * source and the action lives only as long as the process.
+     */
+    contextField?: string;
+  };
   /**
    * Exact flat Boss-event contracts whose non-text fields the judge may
    * select. `entryEvent` and scalar `BOSS_REPLY` contracts are supplied by
@@ -575,11 +587,54 @@ export function normalizeErrorFull(
   return normalizeError(err);
 }
 
+// slc/link.md §Abort: cancellation is causal identity with the applicable
+// signal's reason — never an `AbortError` name, never bare signal state. A
+// distinct failure observed while the signal is aborted stays a non-abort
+// control error and takes precedence (mirrors DECIDE's bespoke reference).
 function isAbortFailure(error: unknown, signal: AbortSignal): boolean {
-  return (
-    signal.aborted &&
-    (error === signal.reason || normalizeError(error).name === 'AbortError')
+  return signal.aborted && Object.is(error, signal.reason);
+}
+
+interface AbortReasonClassifier {
+  isAbortReason(error: unknown): boolean;
+}
+
+function abortReasonClassifier(
+  ...sources: readonly (AbortSignal | AbortReasonClassifier | undefined)[]
+): AbortReasonClassifier {
+  const captured = sources.filter(
+    (source): source is AbortSignal | AbortReasonClassifier =>
+      source !== undefined,
   );
+  return Object.freeze({
+    isAbortReason: (error: unknown): boolean =>
+      captured.some((source) =>
+        source instanceof AbortSignal
+          ? isAbortFailure(error, source)
+          : source.isAbortReason(error),
+      ),
+  });
+}
+
+/**
+ * gears2fsm's canonical Boss-reply wait state. On the runtime's Boss-facing
+ * surfaces — state telemetry, status lines, the exported snapshot, and the
+ * control view — a context question counts as *pending* only while the
+ * machine sits in this state awaiting the reply. Later states retain the
+ * answered question in context (the resumed player prompt is composed from
+ * it), so an unconditional projection would resurrect it: a failure the
+ * resumed player reached would export a question nobody is waiting on,
+ * disagreeing with the gated telemetry a mirroring host's ledger follows
+ * and failing the shell's snapshot-equality settlement check.
+ */
+const BOSS_REPLY_WAIT_STATE_ID = 'awaitBossReply';
+
+function pendingBossQuestionForState(
+  state: PlaybookState,
+  context: Record<string, unknown>,
+): PlaybookPendingBossQuestionContext | undefined {
+  if (state.stateId !== BOSS_REPLY_WAIT_STATE_ID) return undefined;
+  return pendingBossQuestionFromContext(context);
 }
 
 /** Read the FSM context's single pending Boss question, when well-formed. */
@@ -911,7 +966,9 @@ export function createPlayerBridge(
         roleId = spec.resolveRoleId(input);
         prompt = spec.composePlayerPrompt(input);
       } catch (error) {
-        onControlPlaneError?.(error);
+        if (!isAbortFailure(error, activeSignal)) {
+          onControlPlaneError?.(error);
+        }
         throw error;
       }
       const callPlayer = (resume: string | false) =>
@@ -969,7 +1026,9 @@ export function createPlayerBridge(
         validateBossReplyOutput(input, output, spec.resumableStateIds);
         return output;
       } catch (error) {
-        onControlPlaneError?.(error);
+        if (!isAbortFailure(error, activeSignal)) {
+          onControlPlaneError?.(error);
+        }
         throw error;
       }
     },
@@ -1171,7 +1230,7 @@ export function resumableStateIdsFromMachine(
   if (!isPlainObject(config) || !isPlainObject(config.states)) {
     return new Set();
   }
-  const awaitState = config.states.awaitBossReply;
+  const awaitState = config.states[BOSS_REPLY_WAIT_STATE_ID];
   if (!isPlainObject(awaitState) || !isPlainObject(awaitState.on)) {
     return new Set();
   }
@@ -1278,6 +1337,43 @@ function deepFreeze<T>(value: T): T {
 
 const SUPPRESSED_ENTRY_STATES: ReadonlySet<string> = new Set(['ready', 'done']);
 
+// Bounded escalation for aborted script process groups: SIGTERM first, then
+// SIGKILL after this grace, so settlement (gated on the shell's own exit)
+// stays bounded even for TERM-immune commands.
+const SCRIPT_ABORT_KILL_GRACE_MS = 2000;
+
+class ScriptProcessGroupTeardownError extends Error {
+  constructor(
+    pid: number,
+    message: string,
+    cause?: unknown,
+  ) {
+    super(
+      `script process group ${pid} teardown could not be confirmed: ${message}`,
+      cause === undefined ? undefined : { cause },
+    );
+    this.name = 'ScriptProcessGroupTeardownError';
+  }
+}
+
+function isNoSuchProcess(error: unknown): boolean {
+  return (
+    typeof error === 'object' &&
+    error !== null &&
+    'code' in error &&
+    (error as { code?: unknown }).code === 'ESRCH'
+  );
+}
+
+function isProcessPermissionDenied(error: unknown): boolean {
+  return (
+    typeof error === 'object' &&
+    error !== null &&
+    'code' in error &&
+    (error as { code?: unknown }).code === 'EPERM'
+  );
+}
+
 function makeDefaultNormalizeTransitionEvent(
   transitionEventFields: readonly string[],
 ): (event: unknown) => JsonValue {
@@ -1395,7 +1491,7 @@ function makeDefaultStatusesForState(
     if (stateId === undefined || SUPPRESSED_ENTRY_STATES.has(stateId)) {
       return statuses;
     }
-    if (stateId === 'awaitBossReply') {
+    if (stateId === BOSS_REPLY_WAIT_STATE_ID) {
       const pending = pendingBossQuestionFromContext(context);
       if (pending === undefined) {
         return [...statuses, { message: 'Awaiting Boss reply.' }];
@@ -1675,7 +1771,15 @@ function makeDefaultClassifyBossText(
     const state = classifierState(snapshotOrState);
     const stateId = typeof state.value === 'string' ? state.value : undefined;
     const currentState = stateId ?? JSON.stringify(state.value ?? null);
-    const pending = pendingBossQuestionFromContext(state.context);
+    // The classifier shares the reply-wait pendingness of every other
+    // surface: outside the wait, a context question a later state retains
+    // is answered history, so the prompt must not present it as pending —
+    // a judge told a question awaits at the failure state is steered toward
+    // a reply it cannot select or toward no action at all.
+    const pending =
+      stateId === BOSS_REPLY_WAIT_STATE_ID
+        ? pendingBossQuestionFromContext(state.context)
+        : undefined;
     const configuredTypes = configuredEventTypesForState(machine, stateId);
     const applicable = [...contracts.values()].filter(
       (contract) =>
@@ -1848,6 +1952,74 @@ function machineDeclaresParallelState(machine: AnyStateMachine): boolean {
   return visit((machine as unknown as { config?: unknown }).config);
 }
 
+// PBRT-52: the factory's domain is FLAT single-region machines — every
+// state a direct child of the root, so each snapshot exposes exactly one
+// playbook state id and every state-keyed lookup (deterministic entries,
+// retry, reply-wait pendingness, configured events, descriptions) indexes
+// one unambiguous identity. A compound child would be accepted and then
+// silently misbehave on all of those gates, so it is rejected up front
+// exactly like a parallel region.
+function machineDeclaresNestedState(machine: AnyStateMachine): boolean {
+  const config = (machine as unknown as { config?: unknown }).config;
+  if (!isPlainObject(config) || !isPlainObject(config.states)) return false;
+  return Object.values(config.states).some(
+    (stateDef) =>
+      isPlainObject(stateDef) &&
+      isPlainObject(stateDef.states) &&
+      Object.keys(stateDef.states).length > 0,
+  );
+}
+
+// PBRT-52: the factory's lookups index states by their root key, and the
+// published playbook identity is `meta.playbook.stateId` — the two must
+// coincide or a machine can advertise a pending question or retry under an
+// identity no lookup resolves. A state with no string stateId is just as
+// dead: every snapshot identity derives from that member, so the first
+// entry would fail the exactly-one-state-id inspection at runtime.
+// gears2fsm keeps identity and key equal by construction; a hand-authored
+// artifact that splits or omits them fails here instead of at a silently
+// dead gate.
+function assertFlatStateIdentity(
+  machine: AnyStateMachine,
+  label: string,
+): void {
+  const config = (machine as unknown as { config?: unknown }).config;
+  const states =
+    isPlainObject(config) && isPlainObject(config.states)
+      ? config.states
+      : undefined;
+  // A machine with no root states has no playbook identity to expose; its
+  // first snapshot would fail the exactly-one-state-id inspection, so it
+  // fails construction with the defect named instead.
+  if (states === undefined || Object.keys(states).length === 0) {
+    throw new Error(
+      `${label} declares no root states; the shared runtime requires at ` +
+        'least one flat playbook state',
+    );
+  }
+  for (const [key, stateDef] of Object.entries(states)) {
+    if (!isPlainObject(stateDef)) continue;
+    const meta = isPlainObject(stateDef.meta) ? stateDef.meta : undefined;
+    const playbook =
+      meta !== undefined && isPlainObject(meta.playbook)
+        ? meta.playbook
+        : undefined;
+    const stateId = playbook?.stateId;
+    if (typeof stateId !== 'string') {
+      throw new Error(
+        `${label} state ${key} declares no string meta.playbook.stateId; ` +
+          'the shared runtime derives every playbook state identity from it',
+      );
+    }
+    if (stateId !== key) {
+      throw new Error(
+        `${label} state ${key} declares meta.playbook.stateId ${stateId}; ` +
+          'the shared runtime requires the playbook state id to equal the state key',
+      );
+    }
+  }
+}
+
 /**
  * Build a `PlaybookRuntimeFactory` that interprets the given FSM artifact
  * under the slc/link.md contract. The factory provides every actor kind the
@@ -1855,9 +2027,10 @@ function machineDeclaresParallelState(machine: AnyStateMachine): boolean {
  * (literal and dynamic) — and implements the full runtime lifecycle including
  * the optional parked-session snapshot capability (DR-014).
  *
- * Scope: machines that declare no parallel state (each snapshot exposes
- * exactly one playbook state id). Parallel-region FSMs keep their own linked
- * runtimes.
+ * Scope: flat single-region machines — no parallel state, no compound
+ * child states, and every root state's `meta.playbook.stateId` equal to its
+ * state key — so each snapshot exposes exactly one playbook state id.
+ * Parallel-region FSMs keep their own linked runtimes.
  */
 export function createXStatePlaybookRuntime<TOptions>(
   machine: AnyStateMachine,
@@ -1883,6 +2056,12 @@ export function createXStatePlaybookRuntime<TOptions>(
       `${label} uses a parallel state; the shared runtime supports only single-region FSMs`,
     );
   }
+  if (machineDeclaresNestedState(machine)) {
+    throw new Error(
+      `${label} declares a compound state; the shared runtime supports only flat single-region FSMs`,
+    );
+  }
+  assertFlatStateIdentity(machine, label);
   const declaredActors = collectInvokeSources(machine);
   const resumableStateIds =
     spec.resumableStateIds ?? resumableStateIdsFromMachine(machine);
@@ -1987,6 +2166,20 @@ export function createXStatePlaybookRuntime<TOptions>(
     // ports.callPlayer / callCaptain / callJudge see the right cancellation
     // source. undefined between turns; set by the public boundaries.
     let activeSignal: AbortSignal | undefined;
+    // Immutable cancellation provenance for the active public boundary. A
+    // nested resume widens it to include both invocation and resume signals;
+    // mutable `activeSignal` alone cannot classify a late invocation reason.
+    let activeAborts: AbortReasonClassifier | undefined;
+    // The bridge binds the provenance of a child result immediately before
+    // its promise actor settles. The next root snapshot/error consumes this
+    // one-shot so background settlement emissions retain their owner.
+    let actorSettlementAborts: AbortReasonClassifier | undefined;
+    let actorSettlementErrorAborts: AbortReasonClassifier | undefined;
+    // Exact cancellation observed by an emission owned by the active
+    // boundary. Ordinary runs settle from their signal/state; apply also
+    // needs this phase-local evidence to fold a pre-publication failure into
+    // its accepted receipt.
+    let activeAbortEmission: unknown;
     let activeTurnId: number | undefined;
     let controlPlaneError: unknown;
     // Previous root-machine state for the inspect-driven telemetry /
@@ -2025,7 +2218,7 @@ export function createXStatePlaybookRuntime<TOptions>(
     // All trace, state-telemetry, and status work shares this one queue.
     // Inspection callbacks enqueue a complete ordered batch synchronously;
     // imperative boundaries await their queued work directly.
-    let emissionFailure: unknown;
+    let emissionFailure: { readonly error: unknown } | undefined;
 
     function bindSession(nextSession: PlaybookSession): PlaybookSession {
       const bound = snapshotPlaybookSession(nextSession);
@@ -2214,20 +2407,40 @@ export function createXStatePlaybookRuntime<TOptions>(
       for (const [key, token] of byKey) privateResumeTokens.set(key, token);
     }
 
-    function enqueueEmission(fn: () => Promise<void>): Promise<void> {
+    function enqueueEmission(
+      fn: () => Promise<void>,
+      aborts: AbortReasonClassifier | undefined = activeAborts,
+    ): Promise<void> {
+      // The emission belongs to the boundary enqueueing it: a rejection
+      // causally identical to that boundary's abort reason is the
+      // cancellation's own evidence — never latched, so it cannot poison a
+      // later unrelated boundary (DR-036).
+      const enqueueAborts = aborts;
       const queued = emissionQueue.add(fn).then(() => undefined);
       activeEmissionCalls.add(queued);
       void queued.then(
         () => activeEmissionCalls.delete(queued),
         (error: unknown) => {
           activeEmissionCalls.delete(queued);
-          emissionFailure ??= error;
+          if (enqueueAborts?.isAbortReason(error)) {
+            // Record evidence only when it also belongs to the public
+            // boundary that is still active. A background A cancellation
+            // racing an unrelated B boundary is forgiven under A and must
+            // not change B's settlement.
+            if (activeAborts?.isAbortReason(error)) {
+              activeAbortEmission ??= error;
+            }
+            return;
+          }
+          emissionFailure ??= { error };
         },
       );
       return queued;
     }
 
-    async function drainEmissions(): Promise<void> {
+    async function drainEmissions(
+      _aborts: AbortReasonClassifier | undefined = activeAborts,
+    ): Promise<void> {
       while (true) {
         const active = [...activeEmissionCalls];
         if (active.length > 0) await Promise.allSettled(active);
@@ -2241,8 +2454,13 @@ export function createXStatePlaybookRuntime<TOptions>(
         }
       }
       if (emissionFailure !== undefined) {
-        const error = emissionFailure;
+        const { error } = emissionFailure;
         emissionFailure = undefined;
+        // The failure was classified as distinct by its enqueue owner. If a
+        // later public boundary drains it, retain that classification in the
+        // boundary latch before throwing; its signal must not reinterpret
+        // the same object as cancellation (DR-036 decision 2).
+        if (activeSignal !== undefined) controlPlaneError ??= error;
         throw error;
       }
     }
@@ -2293,14 +2511,17 @@ export function createXStatePlaybookRuntime<TOptions>(
       type: PlaybookTraceType,
       payload: unknown,
       position: TracePosition = {},
+      aborts?: AbortReasonClassifier,
     ): Promise<void> {
       const currentSession = requireSession();
       const event = createTraceEvent(type, payload, position);
-      return enqueueEmission(() =>
-        currentSession.ports.emitTelemetry({
-          topic: 'playbook.trace',
-          payload: event,
-        }),
+      return enqueueEmission(
+        () =>
+          currentSession.ports.emitTelemetry({
+            topic: 'playbook.trace',
+            payload: event,
+          }),
+        aborts,
       );
     }
 
@@ -2388,6 +2609,11 @@ export function createXStatePlaybookRuntime<TOptions>(
         | 'apply.finished',
       identity: Record<string, unknown>,
       position: TracePosition,
+      // The applicable combined signal: a start-sink rejection causally
+      // identical to its reason is the cancellation itself, not a control
+      // error — the pair finishes `aborted` and nothing latches
+      // (slc/link.md §Abort).
+      signal: AbortSignal,
       // Base payload of the best-effort finish emitted when the start sink
       // rejects; it defaults to the payload the start carried, which the
       // player, judge, and captain pairs take as-is. The apply pair cannot:
@@ -2399,13 +2625,13 @@ export function createXStatePlaybookRuntime<TOptions>(
       try {
         await emitTrace(startedType, identity, position);
       } catch (error) {
-        controlPlaneError ??= error;
+        if (!isAbortFailure(error, signal)) controlPlaneError ??= error;
         try {
           await emitTrace(
             finishedType,
             {
               ...finishIdentity,
-              status: 'error',
+              status: isAbortFailure(error, signal) ? 'aborted' : 'error',
               error: normalizeError(error),
             },
             position,
@@ -2434,7 +2660,7 @@ export function createXStatePlaybookRuntime<TOptions>(
           signal.throwIfAborted();
           resume = selectPlayerResume(roleId, playerId);
         } catch (error) {
-          if (!signal.aborted) controlPlaneError ??= error;
+          if (!isAbortFailure(error, signal)) controlPlaneError ??= error;
           throw error;
         }
         const callId = `player-${++playerCallSequence}`;
@@ -2460,6 +2686,7 @@ export function createXStatePlaybookRuntime<TOptions>(
             'player.call.finished',
             { ...identity, prompt },
             position,
+            signal,
           );
           await emitTrace(
             'player.call.finished',
@@ -2471,10 +2698,12 @@ export function createXStatePlaybookRuntime<TOptions>(
         activePlayerKeys.add(playerKey);
 
         try {
-          await emitTrace(
+          await emitCallStarted(
             'player.call.started',
+            'player.call.finished',
             { ...identity, prompt },
             position,
+            signal,
           );
 
           let rawResult: unknown;
@@ -2494,13 +2723,13 @@ export function createXStatePlaybookRuntime<TOptions>(
             // a late result mutate continuity or publish a successful finish.
             signal.throwIfAborted();
           } catch (error) {
-            if (!signal.aborted) controlPlaneError ??= error;
+            if (!isAbortFailure(error, signal)) controlPlaneError ??= error;
             try {
               await emitTrace(
                 'player.call.finished',
                 {
                   ...identity,
-                  status: signal.aborted ? 'aborted' : 'error',
+                  status: isAbortFailure(error, signal) ? 'aborted' : 'error',
                   error: normalizeError(error),
                 },
                 position,
@@ -2517,7 +2746,7 @@ export function createXStatePlaybookRuntime<TOptions>(
           try {
             result = validatePlayerResult(rawResult);
           } catch (error) {
-            if (!signal.aborted) controlPlaneError ??= error;
+            if (!isAbortFailure(error, signal)) controlPlaneError ??= error;
             try {
               await emitTrace(
                 'player.call.finished',
@@ -2533,7 +2762,7 @@ export function createXStatePlaybookRuntime<TOptions>(
           try {
             updatePlayerResume(roleId, playerId, result);
           } catch (error) {
-            if (!signal.aborted) controlPlaneError ??= error;
+            if (!isAbortFailure(error, signal)) controlPlaneError ??= error;
             try {
               await emitTrace(
                 'player.call.finished',
@@ -2589,6 +2818,7 @@ export function createXStatePlaybookRuntime<TOptions>(
             'judge.call.finished',
             { ...identity, prompt },
             position,
+            signal,
           );
           let reply: unknown;
           try {
@@ -2607,7 +2837,7 @@ export function createXStatePlaybookRuntime<TOptions>(
               'judge.call.finished',
               {
                 ...identity,
-                status: signal.aborted ? 'aborted' : 'error',
+                status: isAbortFailure(error, signal) ? 'aborted' : 'error',
                 error: normalizeError(error),
               },
               position,
@@ -2671,6 +2901,7 @@ export function createXStatePlaybookRuntime<TOptions>(
             'captain.call.finished',
             { ...identity, prompt },
             position,
+            signal,
           );
           let rawResult: unknown;
           try {
@@ -2693,7 +2924,7 @@ export function createXStatePlaybookRuntime<TOptions>(
               'captain.call.finished',
               {
                 ...identity,
-                status: signal.aborted ? 'aborted' : 'error',
+                status: isAbortFailure(error, signal) ? 'aborted' : 'error',
                 error: normalizeError(error),
               },
               position,
@@ -2784,7 +3015,9 @@ export function createXStatePlaybookRuntime<TOptions>(
         () => activeSignal,
         boundary,
         (error) => {
-          if (!activeSignal?.aborted) controlPlaneError ??= error;
+          if (activeSignal === undefined || !isAbortFailure(error, activeSignal)) {
+            controlPlaneError ??= error;
+          }
         },
       );
     }
@@ -2870,7 +3103,7 @@ export function createXStatePlaybookRuntime<TOptions>(
             // failure state (PBRT-47); everything else here — a drained
             // emission failure, prompt composition, the port itself,
             // adjudication — is control plane.
-            if (!active.aborted && !isFsmResultFailure(error)) {
+            if (!isAbortFailure(error, active) && !isFsmResultFailure(error)) {
               controlPlaneError ??= error;
             }
             throw error;
@@ -2897,53 +3130,187 @@ export function createXStatePlaybookRuntime<TOptions>(
           const failedGuard = guards[1] ?? guards[0];
           const cwd = boundScriptCwd ?? process.cwd();
           const ports = runtimePorts ?? requireHostPorts();
-
-          const exitStatus = await new Promise<number>((resolve, reject) => {
-            let child: ReturnType<typeof spawn>;
-            try {
-              child = spawn('sh', ['-c', input.command], {
-                cwd,
-                stdio: 'ignore',
-              });
-            } catch (error) {
-              reject(error);
-              return;
-            }
-            const onAbort = (): void => {
-              child.kill('SIGTERM');
-              reject(active.reason ?? new Error('script aborted'));
-            };
-            if (active.aborted) {
-              onAbort();
-              return;
+          // slc/link.md §Script execution: an already-aborted turn spawns
+          // nothing, and the thrown signal reason keeps the rejection
+          // causally classified as the abort it is.
+          active.throwIfAborted();
+
+          // Abort ownership — the listener that terminates the group and
+          // the escalation timer — spans the whole invocation body, not
+          // just the spawn-to-close window: an abort landing during the
+          // post-exit emission tail must still kill surviving group
+          // members before the actor settles (slc/link.md §Script
+          // execution). One finally releases both.
+          let child: ReturnType<typeof spawn> | undefined;
+          let killTimer: ReturnType<typeof setTimeout> | undefined;
+          const signalGroup = (sig: NodeJS.Signals): void => {
+            if (child?.pid !== undefined) {
+              try {
+                process.kill(-child.pid, sig);
+              } catch {
+                // Confirmation belongs to the bounded liveness probe below:
+                // a failed signal can mean ESRCH, EPERM, or another fault.
+              }
             }
-            active.addEventListener('abort', onAbort, { once: true });
-            child.on('error', (error) => {
-              active.removeEventListener('abort', onAbort);
-              reject(error);
-            });
-            child.on('close', (code) => {
-              active.removeEventListener('abort', onAbort);
-              resolve(typeof code === 'number' ? code : 1);
-            });
-          });
+          };
+          // After a SIGKILL is posted, settlement waits for the group to
+          // stop being signalable — bounded by the same grace so an
+          // unreapable member outside the runtime's control cannot stall
+          // the turn forever. Observed teardown is milliseconds.
+          let groupGonePromise: Promise<void> | undefined;
+          const awaitGroupGone = (): Promise<void> => {
+            const pid = child?.pid;
+            if (pid === undefined) return Promise.resolve();
+            groupGonePromise ??= (async () => {
+              const teardownFailure = (
+                message: string,
+                cause?: unknown,
+              ): ScriptProcessGroupTeardownError => {
+                const failure = new ScriptProcessGroupTeardownError(
+                  pid,
+                  message,
+                  cause,
+                );
+                // A teardown failure is not an authored script result.
+                // Surface it at the active public boundary even though
+                // XState also routes the rejected actor through onError.
+                controlPlaneError ??= failure;
+                return failure;
+              };
+              const deadline = Date.now() + SCRIPT_ABORT_KILL_GRACE_MS;
+              let lastProbeError: unknown;
+              for (;;) {
+                try {
+                  process.kill(-pid, 0);
+                } catch (error) {
+                  if (isNoSuchProcess(error)) return;
+                  // EPERM confirms that at least one process in the group
+                  // still exists but is not signalable by this process. Keep
+                  // waiting for ESRCH within the bound; every other probe
+                  // error makes confirmation itself unreliable immediately.
+                  if (!isProcessPermissionDenied(error)) {
+                    throw teardownFailure(
+                      'the liveness probe failed',
+                      error,
+                    );
+                  }
+                  lastProbeError = error;
+                }
+                if (Date.now() >= deadline) {
+                  throw teardownFailure(
+                    `the group remained signalable after ${SCRIPT_ABORT_KILL_GRACE_MS}ms`,
+                    lastProbeError,
+                  );
+                }
+                await new Promise((tick) => setTimeout(tick, 5));
+              }
+            })();
+            return groupGonePromise;
+          };
+          const onAbort = (): void => {
+            signalGroup('SIGTERM');
+            killTimer = setTimeout(
+              () => signalGroup('SIGKILL'),
+              SCRIPT_ABORT_KILL_GRACE_MS,
+            );
+          };
+          // An abort observed once the shell has already exited rejects
+          // with the signal's reason before guard resolution and before
+          // starting any further script emission — after killing whatever
+          // group members outlived the shell. The shell's own exit ended
+          // the TERM grace's purpose, so escalation is immediate here.
+          const settleIfAborted = async (): Promise<void> => {
+            if (!active.aborted) return;
+            signalGroup('SIGKILL');
+            await awaitGroupGone();
+            active.throwIfAborted();
+          };
+          let invocationFailed = false;
+          try {
+            const exitStatus = await new Promise<number>(
+              (resolve, reject) => {
+                try {
+                  // detached: the shell leads its own POSIX process group,
+                  // so an abort can terminate the command's whole group — a
+                  // lone SIGTERM to the wrapper never reaches backgrounded
+                  // members.
+                  child = spawn('sh', ['-c', input.command], {
+                    cwd,
+                    stdio: 'ignore',
+                    detached: true,
+                  });
+                } catch (error) {
+                  reject(error);
+                  return;
+                }
+                // On abort, terminate the group and escalate — but settle
+                // only from 'close', after the shell itself has exited, so
+                // the turn never reports quiescence while the script still
+                // runs (slc/link.md §Abort). SIGKILL is untrappable, so
+                // 'close' is bounded by the grace.
+                active.addEventListener('abort', onAbort, { once: true });
+                child.on('error', (error) => {
+                  reject(error);
+                });
+                child.on('close', (code) => {
+                  if (active.aborted) {
+                    // The shell may exit cooperatively on the group SIGTERM
+                    // while a TERM-immune same-group descendant survives;
+                    // the group stays addressable while any member lives,
+                    // so kill it and await its disappearance before
+                    // settling (slc/link.md §Script execution).
+                    signalGroup('SIGKILL');
+                    void awaitGroupGone().then(
+                      () =>
+                        reject(active.reason),
+                      reject,
+                    );
+                    return;
+                  }
+                  resolve(typeof code === 'number' ? code : 1);
+                });
+              },
+            );
 
-          await ports.emitStatus(
-            `Executed script for ${input.stateId} (exit ${exitStatus}).`,
-          );
-          await ports.emitTelemetry({
-            topic: 'playbook.script',
-            payload: {
-              stateId: input.stateId,
-              sourceItem: input.sourceItem,
-              exitStatus,
-            },
-          });
+            await settleIfAborted();
+
+            await ports.emitStatus(
+              `Executed script for ${input.stateId} (exit ${exitStatus}).`,
+            );
+            await settleIfAborted();
+            await ports.emitTelemetry({
+              topic: 'playbook.script',
+              payload: {
+                stateId: input.stateId,
+                sourceItem: input.sourceItem,
+                exitStatus,
+              },
+            });
+            await settleIfAborted();
 
-          if (exitStatus === 0) {
-            return { guard: okGuard, exitStatus: 0 };
+            if (exitStatus === 0) {
+              return { guard: okGuard, exitStatus: 0 };
+            }
+            return { guard: failedGuard, exitStatus };
+          } catch (error) {
+            // Preserve the invocation's authoritative exact cancellation or
+            // distinct sink failure after teardown succeeds. The finally
+            // block may replace it only with a distinct teardown failure
+            // when the process group cannot be confirmed gone.
+            invocationFailed = true;
+            throw error;
+          } finally {
+            try {
+              if (active.aborted) {
+                signalGroup('SIGKILL');
+                await awaitGroupGone();
+                if (!invocationFailed) active.throwIfAborted();
+              }
+            } finally {
+              active.removeEventListener('abort', onAbort);
+              if (killTimer !== undefined) clearTimeout(killTimer);
+            }
           }
-          return { guard: failedGuard, exitStatus };
         },
       );
     }
@@ -2953,7 +3320,7 @@ export function createXStatePlaybookRuntime<TOptions>(
       getBoundarySignal: () => activeSignal,
       callPlaybook: (request, signal) =>
         requireHostPorts().callPlaybook(request, signal),
-      emitStarted: async (event) => {
+      emitStarted: async (event, aborts) => {
         playbookCallTurnIds.set(event.callId, activeTurnId);
         await emitTrace(
           'playbook.call.started',
@@ -2966,9 +3333,10 @@ export function createXStatePlaybookRuntime<TOptions>(
             ...(activeTurnId !== undefined ? { turnId: activeTurnId } : {}),
             callId: event.callId,
           },
+          aborts,
         );
       },
-      emitFinished: async (event) => {
+      emitFinished: async (event, aborts) => {
         const turnId = playbookCallTurnIds.get(event.callId);
         try {
           await emitTrace(
@@ -2983,20 +3351,35 @@ export function createXStatePlaybookRuntime<TOptions>(
               ...(turnId !== undefined ? { turnId } : {}),
               callId: event.callId,
             },
+            aborts,
           );
         } finally {
           playbookCallTurnIds.delete(event.callId);
         }
       },
       drain: drainEmissions,
-      bindResumeSignal: (signal) => {
+      bindResumeSignal: (signal, aborts) => {
         activeSignal = signal;
+        activeAborts = aborts ?? abortReasonClassifier(signal);
       },
-      onControlPlaneError: (error) => {
-        if (!activeSignal?.aborted) controlPlaneError ??= error;
+      bindActorSettlement: (aborts) => {
+        actorSettlementAborts = aborts;
+      },
+      onControlPlaneError: (error, aborts) => {
+        // The shared bridge classifies before reporting against its own
+        // invocation-and-resume signals; classify once more here against
+        // the boundary signal so a report that is the active boundary's
+        // exact abort reason can never masquerade as a control error
+        // (slc/link.md §Abort).
+        if (
+          !aborts?.isAbortReason(error) &&
+          !activeAborts?.isAbortReason(error)
+        ) {
+          controlPlaneError ??= error;
+        }
       },
-      onBackgroundError: (error) => {
-        emissionFailure ??= error;
+      onBackgroundError: (error, aborts) => {
+        if (!aborts?.isAbortReason(error)) emissionFailure ??= { error };
       },
     });
 
@@ -3017,11 +3400,9 @@ export function createXStatePlaybookRuntime<TOptions>(
         previousState: previousState ?? null,
         state,
       };
-      if (state.stateId === 'awaitBossReply') {
-        const pendingBossQuestion = pendingBossQuestionFromContext(context);
-        if (pendingBossQuestion !== undefined) {
-          payload.pendingBossQuestion = pendingBossQuestion;
-        }
+      const pendingBossQuestion = pendingBossQuestionForState(state, context);
+      if (pendingBossQuestion !== undefined) {
+        payload.pendingBossQuestion = pendingBossQuestion;
       }
       if (state.stateId === 'failed') {
         const lastError = normalizeErrorFull(context.lastError);
@@ -3035,6 +3416,7 @@ export function createXStatePlaybookRuntime<TOptions>(
       state: PlaybookState,
       statuses: readonly ScheduledStatus[],
       position: TracePosition,
+      aborts?: AbortReasonClassifier,
     ): void {
       const currentSession = requireSession();
       const transitionTrace = createTraceEvent(
@@ -3056,28 +3438,61 @@ export function createXStatePlaybookRuntime<TOptions>(
           position,
         ),
       }));
-      void enqueueEmission(async () => {
-        await currentSession.ports.emitTelemetry({
-          topic: 'playbook.trace',
-          payload: transitionTrace,
-        });
-        await currentSession.ports.emitTelemetry({
-          topic: 'playbook.fsm.state',
-          payload,
-        });
-        for (const status of statusEmissions) {
+      void enqueueEmission(
+        async () => {
           await currentSession.ports.emitTelemetry({
             topic: 'playbook.trace',
-            payload: status.trace,
+            payload: transitionTrace,
           });
-          await currentSession.ports.emitStatus(status.message, status.data);
-        }
-      }).catch(() => undefined);
+          await currentSession.ports.emitTelemetry({
+            topic: 'playbook.fsm.state',
+            payload,
+          });
+          for (const status of statusEmissions) {
+            await currentSession.ports.emitTelemetry({
+              topic: 'playbook.trace',
+              payload: status.trace,
+            });
+            await currentSession.ports.emitStatus(status.message, status.data);
+          }
+        },
+        aborts,
+      ).catch(() => undefined);
+    }
+
+    // One classifying latch for every runtime-observed error — inspection
+    // failures and root-actor errors alike. Outside a boundary the error
+    // rides the emission channel, which the next boundary's (or init's)
+    // drain throws; inside a boundary it is a control-plane error unless it
+    // is the boundary signal's own abort reason (slc/link.md §Abort).
+    function latchRuntimeError(
+      error: unknown,
+      aborts: AbortReasonClassifier | undefined = activeAborts,
+    ): void {
+      if (aborts?.isAbortReason(error)) return;
+      if (activeSignal === undefined) emissionFailure ??= { error };
+      else controlPlaneError ??= error;
     }
 
-    function latchInspectionError(error: unknown): void {
-      if (activeSignal !== undefined) controlPlaneError ??= error;
-      else emissionFailure ??= error;
+    function consumeActorSettlementAborts(
+      forSnapshot = false,
+    ): AbortReasonClassifier | undefined {
+      const aborts = actorSettlementAborts ?? actorSettlementErrorAborts;
+      actorSettlementAborts = undefined;
+      actorSettlementErrorAborts = undefined;
+      if (forSnapshot && aborts !== undefined) {
+        // XState can report an errored root through both its inspection
+        // snapshot and subscriber. Keep the same provenance through that
+        // synchronous notification only; an ordinary transition must not
+        // lend it to a later unrelated actor error.
+        actorSettlementErrorAborts = aborts;
+        queueMicrotask(() => {
+          if (actorSettlementErrorAborts === aborts) {
+            actorSettlementErrorAborts = undefined;
+          }
+        });
+      }
+      return aborts;
     }
 
     // PBRT-6: the single seam that stops this runtime's actor. Stopping a
@@ -3121,6 +3536,7 @@ export function createXStatePlaybookRuntime<TOptions>(
           if (inspectionEvent.type !== '@xstate.snapshot') return;
           if (inspectionEvent.actorRef !== builtActor) return;
           if (suppressInspectionEmissions) return;
+          const settlementAborts = consumeActorSettlementAborts(true);
           try {
             const snap = inspectionEvent.snapshot;
             const state = normalizePlaybookSnapshot(snap);
@@ -3148,13 +3564,25 @@ export function createXStatePlaybookRuntime<TOptions>(
               state,
               statuses,
               tracePositionForActiveTurn(),
+              settlementAborts,
             );
             priorState = state;
           } catch (error) {
-            latchInspectionError(error);
+            latchRuntimeError(error, settlementAborts);
           }
         },
       });
+      // A synchronously-errored actor is already quiescent, so the turn's
+      // quiescence wait never subscribes and XState would report the error
+      // as unhandled after the boundary returns. Observe it through the
+      // classifying latch: mid-boundary it is the control-plane error
+      // unless it is the abort reason itself; at startup it rides the
+      // emission channel so `init`'s own drain rejects with it and the
+      // failed-start cleanup runs (slc/link.md §Session lifecycle).
+      builtActor.subscribe({
+        error: (error) =>
+          latchRuntimeError(error, consumeActorSettlementAborts()),
+      });
       return builtActor;
     }
 
@@ -3177,14 +3605,20 @@ export function createXStatePlaybookRuntime<TOptions>(
         const output = (
           actor?.getSnapshot() as { output?: unknown } | undefined
         )?.output;
-        if (output !== undefined) {
-          return {
-            outcome,
-            state,
-            output: snapshotJsonValue(output, 'terminal playbook output'),
-          };
-        }
-        return { outcome, state };
+        const stateDescription = stateDescriptionFor(state);
+        return {
+          outcome,
+          state,
+          ...(stateDescription === undefined ? {} : { stateDescription }),
+          ...(output === undefined
+            ? {}
+            : {
+                output: snapshotJsonValue(
+                  output,
+                  'terminal playbook output',
+                ),
+              }),
+        };
       }
       const failure =
         error ??
@@ -3203,15 +3637,23 @@ export function createXStatePlaybookRuntime<TOptions>(
 
     function settledOutcome(signal: AbortSignal): BossSettlementOutcome {
       if (nestedBridge.getPendingCall()) return 'suspended';
-      if (signal.aborted) return 'aborted';
       const state = currentState();
       if (state.status === 'error') {
+        // An errored actor outranks a coincident abort unless the actor's
+        // error is the abort reason itself (slc/link.md §Abort).
         const actorError = (
           actor?.getSnapshot() as { error?: unknown } | undefined
         )?.error;
+        if (actorError !== undefined && isAbortFailure(actorError, signal)) {
+          return 'aborted';
+        }
         throw actorError ?? new Error(`${label} actor entered error status`);
       }
+      // Terminal completion outranks a coincident abort: the work finished,
+      // and reporting `aborted` would hide a terminal machine behind a
+      // settlement a later turn silently restarts (slc/link.md §Abort).
       if (state.status === 'done') return 'terminal';
+      if (signal.aborted) return 'aborted';
       if (state.stateId === 'failed') return 'failed';
       return 'quiescent';
     }
@@ -3288,6 +3730,10 @@ export function createXStatePlaybookRuntime<TOptions>(
       savedPorts = undefined;
       runtimePorts = undefined;
       activeSignal = undefined;
+      activeAborts = undefined;
+      actorSettlementAborts = undefined;
+      actorSettlementErrorAborts = undefined;
+      activeAbortEmission = undefined;
       activeTurnId = undefined;
       controlPlaneError = undefined;
       emissionFailure = undefined;
@@ -3323,32 +3769,57 @@ export function createXStatePlaybookRuntime<TOptions>(
       );
     }
 
+    // DR-034: where the artifact names the FSM context member its entry
+    // action copies the exact Boss text into, that member of the live
+    // snapshot is the retry payload's source. The persisted machine snapshot
+    // carries it, so the candidate derives identically in the process that
+    // exported the snapshot and in one that restored it, and a failure
+    // reached after a Boss reply — whose recorded event the failure state
+    // refuses — is recoverable too. Naming the member is the artifact's
+    // statement that it holds the entry text: a same-named member is never
+    // assumed, since inferring one would turn any matching context member
+    // into a replay payload without its author saying so.
+    // Declared and absent or empty excludes the candidate rather than
+    // falling back to the record, which would make the action depend on the
+    // process again — the very thing this source exists to end.
+    function retryEventFrom(snapshot: unknown): EventObject | undefined {
+      const entryEvent = spec.entryEvent;
+      if (entryEvent?.contextField === undefined) return lastBossEvent;
+      const context = (snapshot as { context?: unknown } | null)?.context;
+      const text = isPlainObject(context)
+        ? context[entryEvent.contextField]
+        : undefined;
+      if (typeof text !== 'string' || text.trim() === '') return undefined;
+      return { type: entryEvent.type, [entryEvent.textField]: text };
+    }
+
     // The failure-state retry entry replays the recorded last classified
-    // event with its recorded payload. A candidate whose event the live
-    // snapshot does not accept — or whose payload the runtime never
-    // recorded — is excluded rather than completed with invented text.
+    // event with its recorded payload, or the entry event the declared
+    // context member above sources. A candidate whose event the live
+    // snapshot does not accept — or whose payload the runtime can source
+    // from neither — is excluded rather than completed with invented text.
     function retryActionFor(
       snapshot: unknown,
       stateId: string | undefined,
     ): DerivedControlAction | undefined {
-      if (stateId !== 'failed' || lastBossEvent === undefined) {
-        return undefined;
-      }
-      if (!snapshotCan(snapshot, lastBossEvent)) return undefined;
+      if (stateId !== 'failed') return undefined;
+      const retryEvent = retryEventFrom(snapshot);
+      if (retryEvent === undefined) return undefined;
+      if (!snapshotCan(snapshot, retryEvent)) return undefined;
       // A recorded explicit-state-jump event names the exact state its
       // replay re-enters: the root BOSS_INTERRUPT shape is a guarded
       // multi-arm list keyed on `targetId`, so the first configured arm
       // may label a different state than the one the recorded event
       // actually resumes.
       const recordedTargetId =
-        lastBossEvent.type === JUMP_EVENT_TYPE
-          ? (lastBossEvent as { targetId?: unknown }).targetId
+        retryEvent.type === JUMP_EVENT_TYPE
+          ? (retryEvent as { targetId?: unknown }).targetId
           : undefined;
       const target =
         typeof recordedTargetId === 'string' &&
         recordedTargetId.trim().length > 0
           ? recordedTargetId
-          : firstTransitionTarget(machine, stateId, lastBossEvent.type);
+          : firstTransitionTarget(machine, stateId, retryEvent.type);
       // PBRT-52: a label is written from a source state description, never
       // from an identifier. Falling back to the target id — or, with no
       // resolvable target, to the FSM event type — makes the label *be* the
@@ -3362,10 +3833,10 @@ export function createXStatePlaybookRuntime<TOptions>(
       if (description === undefined) return undefined;
       return {
         action: {
-          id: `retry:${lastBossEvent.type}`,
+          id: `retry:${retryEvent.type}`,
           label: `Retry: ${description}`,
         },
-        event: lastBossEvent,
+        event: retryEvent,
       };
     }
 
@@ -3559,7 +4030,7 @@ export function createXStatePlaybookRuntime<TOptions>(
         );
         const context = (actor.getSnapshot() as { context?: unknown })
           .context as Record<string, unknown>;
-        const pending = pendingBossQuestionFromContext(context ?? {});
+        const pending = pendingBossQuestionForState(state, context ?? {});
         return {
           schemaVersion: 3,
           playbookId: session.playbookId,
@@ -3658,7 +4129,26 @@ export function createXStatePlaybookRuntime<TOptions>(
           suppressInspectionEmissions = true;
           actor = buildActor(runtimePorts, boundSnapshot.machine);
           actor.start();
-          if (controlPlaneError !== undefined) throw controlPlaneError;
+          // A start-time actor error rides the startup emission channel
+          // (latchRuntimeError); consume both latches here so the original
+          // error outranks the derived status check below.
+          {
+            const startupFailure = emissionFailure;
+            if (
+              controlPlaneError !== undefined ||
+              startupFailure !== undefined
+            ) {
+              const startupError =
+                controlPlaneError !== undefined
+                  ? controlPlaneError
+                  : startupFailure!.error;
+              controlPlaneError = undefined;
+              if (emissionFailure === startupFailure) {
+                emissionFailure = undefined;
+              }
+              throw startupError;
+            }
+          }
           const restoredState = normalizePlaybookSnapshot(
             actor.getSnapshot(),
             suspendedCall === undefined
@@ -3741,7 +4231,7 @@ export function createXStatePlaybookRuntime<TOptions>(
         const state = currentState();
         const context = ((snapshot as { context?: unknown }).context ??
           {}) as Record<string, unknown>;
-        const pending = pendingBossQuestionFromContext(context);
+        const pending = pendingBossQuestionForState(state, context);
         const lastError = normalizeErrorFull(context.lastError);
         const projectedContext = projectControlContext(context);
         const stateDescription = stateDescriptionFor(state);
@@ -3829,6 +4319,8 @@ export function createXStatePlaybookRuntime<TOptions>(
         const position: TracePosition = { turnId, callId };
         activeTurnId = turnId;
         activeSignal = signal;
+        activeAborts = abortReasonClassifier(signal);
+        activeAbortEmission = undefined;
         controlPlaneError = undefined;
         // Every receipt variant is normalized and frozen where it is built,
         // inside the guarded region, so the recording step below cannot
@@ -3880,9 +4372,13 @@ export function createXStatePlaybookRuntime<TOptions>(
         // final for their key. Past publication such a failure is therefore
         // re-latched onto the emission channel, surfacing from the next
         // public boundary's drain, and `apply` still does not throw past
-        // acceptance (PBRT-52).
+        // acceptance (PBRT-52). A delivery rejection causally identical to
+        // this call's own abort reason evidences the cancellation and is
+        // dropped — never carried to a later unrelated boundary
+        // (slc/link.md §Abort).
         const latchDeliveryFailure = (error: unknown): void => {
-          emissionFailure ??= error;
+          if (isAbortFailure(error, signal)) return;
+          emissionFailure ??= { error };
         };
         try {
           try {
@@ -3909,6 +4405,7 @@ export function createXStatePlaybookRuntime<TOptions>(
               'apply.finished',
               identity,
               position,
+              signal,
               preAcceptanceFinish('apply.started trace sink rejected'),
             );
             // An abort may land while the awaited started emission drains
@@ -3999,6 +4496,10 @@ export function createXStatePlaybookRuntime<TOptions>(
           } catch (error) {
             settlementError = error;
           }
+          // Exact cancellation is not a control-plane latch, but after apply
+          // acceptance and before publication it is still settlement evidence
+          // and therefore folds into the owed failed receipt (DR-036 §4).
+          settlementError ??= activeAbortEmission;
           // Fold before the finish emission, the last point at which the
           // traced disposition and the returned one can still be made the
           // same value.
@@ -4037,6 +4538,8 @@ export function createXStatePlaybookRuntime<TOptions>(
           // wedge every later public boundary behind "another runtime turn
           // is active".
           activeSignal = undefined;
+          activeAborts = undefined;
+          activeAbortEmission = undefined;
           activeTurnId = undefined;
           controlPlaneError = undefined;
         }
@@ -4085,136 +4588,171 @@ export function createXStatePlaybookRuntime<TOptions>(
         const turnId = ++turnSequence;
         activeTurnId = turnId;
         activeSignal = signal;
+        activeAborts = abortReasonClassifier(signal);
+        activeAbortEmission = undefined;
         controlPlaneError = undefined;
         let result: PlaybookRunResult | undefined;
         let operationError: unknown;
+        // The boundary sentinel releases on every exit: a settlement defect
+        // past the drain — a snapshot normalization throw inside
+        // `runResultFor` included — must never wedge every later public
+        // boundary and `dispose` itself behind "another runtime turn is
+        // active". Mirrors the apply boundary's finally.
         try {
-          await emitTrace('boss.input.received', { text }, { turnId });
-          // 1. Map the Boss text to an FSM event: deterministic exact entry
-          //    where applicable (slc/link.md §Boss-event mapping), judge
-          //    classification otherwise.
-          let event: EventObject | undefined;
-          const trimmed = text.trim();
-          if (trimmed !== '') {
-            const snapshot = actor.getSnapshot();
-            const terminal = snapshot.status === 'done';
-            const stateId = normalizePlaybookSnapshot(snapshot).stateId;
-            if (
-              spec.entryEvent !== undefined &&
-              (stateId === 'ready' || terminal)
-            ) {
-              event = {
-                type: spec.entryEvent.type,
-                [spec.entryEvent.textField]: text,
-              };
-            } else {
-              event = await classifyBossText(
-                text,
-                runtimePorts!,
-                signal,
-                snapshot,
-                boundary,
-                boundOptions,
-              );
-            }
-            signal.throwIfAborted();
-          }
-          // Empty input, no-action classifier output, or invalid classifier
-          // output — nothing to send.
-          if (event === undefined) {
-            result = runResultFor('no-action');
-          } else {
-            // 2. Optional Captain-pane classification line: the bare FSM
-            //    event type, emitted before the FSM advances.
-            const statusLine = classificationStatus(event);
-            if (statusLine !== undefined) {
-              await runtimePorts!.emitStatus(statusLine);
-            }
+          try {
+            await emitTrace('boss.input.received', { text }, { turnId });
+            // Record the attempted input, then refuse a boundary that entered
+            // aborted before deterministic mapping or the classifier can
+            // perform host-visible work (DR-036 §5).
             signal.throwIfAborted();
-            // 3. A final actor cannot accept new events; reconstruct only
-            //    after classification produced a real event.
-            if (actor.getSnapshot().status === 'done') {
-              stopActor();
-              actor = buildActor(runtimePorts!);
-              // The replacement actor's snapshots are real state entries.
-              suppressInspectionEmissions = false;
-              actor.start();
+            // 1. Map the Boss text to an FSM event: deterministic exact entry
+            //    where applicable (slc/link.md §Boss-event mapping), judge
+            //    classification otherwise.
+            let event: EventObject | undefined;
+            const trimmed = text.trim();
+            if (trimmed !== '') {
+              const snapshot = actor.getSnapshot();
+              const terminal = snapshot.status === 'done';
+              const stateId = normalizePlaybookSnapshot(snapshot).stateId;
+              // PBRT-1 / slc/link.md §Boss-event mapping: the idle entry, the
+              // recoverable failure state, and the reconstructed terminal all
+              // accept exactly one ordinary textual entry event, so delivered
+              // text enters deterministically — no judge call to spend and no
+              // classifier whim to settle a restart as no action. Every other
+              // parked state — a reply wait or an authored mid-workflow
+              // checkpoint — classifies under its own Boss-event contracts.
+              if (
+                spec.entryEvent !== undefined &&
+                (stateId === 'ready' || stateId === 'failed' || terminal)
+              ) {
+                event = {
+                  type: spec.entryEvent.type,
+                  [spec.entryEvent.textField]: text,
+                };
+              } else {
+                event = await classifyBossText(
+                  text,
+                  runtimePorts!,
+                  signal,
+                  snapshot,
+                  boundary,
+                  boundOptions,
+                );
+              }
+              signal.throwIfAborted();
             }
-            // DR-029: keep the classified event with its recorded payload
-            // as the retry-replay source. Recording is sanitizing, not
-            // load-bearing: an override classifier's non-JSON-safe event is
-            // simply not recorded, and the turn proceeds unchanged.
-            try {
-              lastBossEvent = snapshotJsonValue(
-                event,
-                'recorded Boss event',
-              ) as unknown as EventObject;
-            } catch {
-              lastBossEvent = undefined;
+            // Empty input, no-action classifier output, or invalid classifier
+            // output — nothing to send.
+            if (event === undefined) {
+              result = runResultFor('no-action');
+            } else {
+              // 2. Optional Captain-pane classification line: the bare FSM
+              //    event type, emitted before the FSM advances.
+              const statusLine = classificationStatus(event);
+              if (statusLine !== undefined) {
+                await runtimePorts!.emitStatus(statusLine);
+              }
+              signal.throwIfAborted();
+              // 3. A final actor cannot accept new events; reconstruct only
+              //    after classification produced a real event.
+              if (actor.getSnapshot().status === 'done') {
+                stopActor();
+                actor = buildActor(runtimePorts!);
+                // The replacement actor's snapshots are real state entries.
+                suppressInspectionEmissions = false;
+                actor.start();
+              }
+              // DR-029: keep the classified event with its recorded payload
+              // as the retry-replay source. Recording is sanitizing, not
+              // load-bearing: an override classifier's non-JSON-safe event is
+              // simply not recorded, and the turn proceeds unchanged.
+              try {
+                lastBossEvent = snapshotJsonValue(
+                  event,
+                  'recorded Boss event',
+                ) as unknown as EventObject;
+              } catch {
+                lastBossEvent = undefined;
+              }
+              actor.send(event);
+              await waitForPlaybookQuiescence(actor, {
+                pendingCalls: nestedBridge,
+              });
+              if (controlPlaneError !== undefined) throw controlPlaneError;
+              result = runResultFor(settledOutcome(signal));
             }
-            actor.send(event);
-            await waitForPlaybookQuiescence(actor, {
-              pendingCalls: nestedBridge,
-            });
-            if (controlPlaneError !== undefined) throw controlPlaneError;
-            result = runResultFor(settledOutcome(signal));
+          } catch (error) {
+            operationError = error;
           }
-        } catch (error) {
-          operationError = error;
-        }
 
-        let drainError: unknown;
-        try {
-          await drainEmissions();
-        } catch (error) {
-          drainError = error;
-        }
-        const latchedControlError = controlPlaneError;
-        const primaryError =
-          latchedControlError ?? drainError ?? operationError;
-        const abortError =
-          latchedControlError === undefined &&
-          drainError === undefined &&
-          operationError !== undefined &&
-          isAbortFailure(operationError, signal);
-        const settlementResult =
-          primaryError === undefined
-            ? (result ?? runResultFor('no-action'))
-            : runResultFor(abortError ? 'aborted' : 'failed', primaryError);
-
-        let settlementEmissionError: unknown;
-        try {
-          await emitTrace(
-            'boss.input.settled',
-            settlementTracePayload(settlementResult),
-            { turnId },
-          );
-        } catch (error) {
-          settlementEmissionError = error;
-        }
-        try {
-          await drainEmissions();
-        } catch (error) {
-          settlementEmissionError ??= error;
-        }
-        const failure =
-          controlPlaneError ??
-          latchedControlError ??
-          drainError ??
-          (abortError
-            ? (settlementEmissionError ?? operationError)
-            : (operationError ?? settlementEmissionError));
-        activeSignal = undefined;
-        activeTurnId = undefined;
-        controlPlaneError = undefined;
+          let drainError: unknown;
+          try {
+            await drainEmissions();
+          } catch (error) {
+            drainError = error;
+          }
+          const latchedControlError = controlPlaneError;
+          // A drain rejection that is the exact abort reason evidences the
+          // cancellation, not a control-plane failure (slc/link.md §Abort).
+          const drainAbort =
+            drainError !== undefined && isAbortFailure(drainError, signal);
+          const effectiveDrainError = drainAbort ? undefined : drainError;
+          const primaryError =
+            latchedControlError ?? effectiveDrainError ?? operationError;
+          const abortError =
+            latchedControlError === undefined &&
+            effectiveDrainError === undefined &&
+            ((operationError !== undefined &&
+              isAbortFailure(operationError, signal)) ||
+              (drainAbort && operationError === undefined));
+          const settlementResult =
+            primaryError === undefined
+              ? (result ?? runResultFor('no-action'))
+              : runResultFor(abortError ? 'aborted' : 'failed', primaryError);
+
+          let settlementEmissionError: unknown;
+          try {
+            await emitTrace(
+              'boss.input.settled',
+              settlementTracePayload(settlementResult),
+              { turnId },
+            );
+          } catch (error) {
+            settlementEmissionError = error;
+          }
+          try {
+            await drainEmissions();
+          } catch (error) {
+            settlementEmissionError ??= error;
+          }
+          if (
+            settlementEmissionError !== undefined &&
+            isAbortFailure(settlementEmissionError, signal)
+          ) {
+            settlementEmissionError = undefined;
+          }
+          const failure =
+            controlPlaneError ??
+            latchedControlError ??
+            effectiveDrainError ??
+            (abortError
+              ? (settlementEmissionError ?? operationError)
+              : (operationError ?? settlementEmissionError));
 
-        if (
-          failure !== undefined &&
-          !(abortError && settlementEmissionError === undefined)
-        ) {
-          throw failure;
+          if (
+            failure !== undefined &&
+            !(abortError && settlementEmissionError === undefined)
+          ) {
+            throw failure;
+          }
+          return settlementResult;
+        } finally {
+          activeSignal = undefined;
+          activeAborts = undefined;
+          activeAbortEmission = undefined;
+          activeTurnId = undefined;
+          controlPlaneError = undefined;
         }
-        return settlementResult;
       },
 
       async resumePlaybookCall(input: {
@@ -4239,37 +4777,88 @@ export function createXStatePlaybookRuntime<TOptions>(
         }
         activeTurnId = playbookCallTurnIds.get(input.callId);
         activeSignal = input.signal;
+        activeAborts = abortReasonClassifier(input.signal);
+        activeAbortEmission = undefined;
         controlPlaneError = undefined;
-        let result: PlaybookRunResult | undefined;
-        let operationError: unknown;
+        // The boundary sentinel releases on every exit, mirroring
+        // `handleBossInput` and the apply boundary.
         try {
-          await nestedBridge.resume(input);
-        } catch (error) {
-          operationError = error;
-        }
-        try {
-          await waitForPlaybookQuiescence(actor, {
-            pendingCalls: nestedBridge,
-          });
-          result = runResultFor(settledOutcome(input.signal));
-        } catch (error) {
-          operationError ??= error;
-        }
-        let drainError: unknown;
-        try {
-          await drainEmissions();
-        } catch (error) {
-          drainError = error;
-        }
-        const failure = controlPlaneError ?? drainError ?? operationError;
-        activeSignal = undefined;
-        activeTurnId = undefined;
-        controlPlaneError = undefined;
-        if (failure !== undefined) throw failure;
-        if (result === undefined) {
-          throw new Error('playbook resume produced no runtime result');
+          let result: PlaybookRunResult | undefined;
+          let operationError: unknown;
+          try {
+            await nestedBridge.resume(input);
+          } catch (error) {
+            operationError = error;
+          }
+          try {
+            await waitForPlaybookQuiescence(actor, {
+              pendingCalls: nestedBridge,
+            });
+            result = runResultFor(settledOutcome(input.signal));
+          } catch (error) {
+            operationError ??= error;
+          }
+          // A resume refused because its signal was already aborted
+          // delivers nothing: the pending call survives for a later
+          // resume, and the boundary settles `aborted` rather than
+          // advertising `suspended` (slc/link.md §Nested playbook bridge).
+          if (
+            operationError !== undefined &&
+            isAbortFailure(operationError, input.signal) &&
+            nestedBridge.getPendingCall()?.callId === input.callId
+          ) {
+            result = {
+              outcome: 'aborted',
+              state: currentState(),
+              error: normalizeError(input.signal.reason),
+            };
+          }
+          let drainError: unknown;
+          try {
+            await drainEmissions();
+          } catch (error) {
+            drainError = error;
+          }
+          const aborts = activeAborts ?? abortReasonClassifier(input.signal);
+          // A control-plane latch has already classified its failure as
+          // distinct under the owning operation. Never reinterpret it
+          // against this later resume signal (DR-036 decision 2).
+          const controlFailure = controlPlaneError;
+          const drainAbort =
+            controlFailure === undefined &&
+            drainError !== undefined &&
+            aborts.isAbortReason(drainError);
+          const operationAbort =
+            controlFailure === undefined &&
+            operationError !== undefined &&
+            aborts.isAbortReason(operationError);
+          const abortEvidence =
+            activeAbortEmission ??
+            (drainAbort ? drainError : undefined) ??
+            (operationAbort ? operationError : undefined);
+          const failure =
+            controlFailure ??
+            (drainAbort ? undefined : drainError) ??
+            (operationAbort ? undefined : operationError);
+          if (failure !== undefined) throw failure;
+          if (
+            abortEvidence !== undefined &&
+            result?.outcome !== 'terminal' &&
+            result?.outcome !== 'suspended'
+          ) {
+            result = runResultFor('aborted', abortEvidence);
+          }
+          if (result === undefined) {
+            throw new Error('playbook resume produced no runtime result');
+          }
+          return result;
+        } finally {
+          activeSignal = undefined;
+          activeAborts = undefined;
+          activeAbortEmission = undefined;
+          activeTurnId = undefined;
+          controlPlaneError = undefined;
         }
-        return result;
       },
 
       dispose(): Promise<void> {
@@ -4339,6 +4928,10 @@ export function createXStatePlaybookRuntime<TOptions>(
             appliedReceipts.clear();
             actor = undefined;
             activeSignal = undefined;
+            activeAborts = undefined;
+            actorSettlementAborts = undefined;
+            actorSettlementErrorAborts = undefined;
+            activeAbortEmission = undefined;
             activeTurnId = undefined;
             controlPlaneError = undefined;
             emissionFailure = undefined;