@sublang/slc 0.8.0 → 0.10.0

package/dist/verify-coverage.js

@@ -19,12 +19,77 @@
  * The checker needs only the artifact and `xstate`; the emitted per-artifact
  * test runs it beside the artifacts. See specs/packages/verification.md.
  */
+import { AsyncLocalStorage } from 'node:async_hooks';
 import { mkdir, readFile, writeFile } from 'node:fs/promises';
 import { join } from 'node:path';
+import { setTimeout as delay } from 'node:timers/promises';
 import { createActor, fromPromise } from 'xstate';
-import { AWAIT_BOSS_REPLY_STATE, BOSS_REPLY_EVENT, CONTROLLER_ACTION_GUARDS, INTERRUPT_EVENT, NEEDS_BOSS_REPLY, VERIFY_MODULE, controllerDecisionNearMiss, enumerateCaptainStates, enumerateScriptStates, isControllerDecisionResult, isControllerMachine, loadFsmModule, normalizeArms, } from './verify.js';
+import { AWAIT_BOSS_REPLY_STATE, BOSS_REPLY_EVENT, CONTROLLER_ACTION_GUARDS, INTERRUPT_EVENT, NEEDS_BOSS_REPLY, VERIFY_MODULE, controllerDecisionNearMiss, enumerateCaptainStates, enumerateScriptStates, initialStateTarget, isControllerDecisionResult, isControllerMachine, loadFsmModule, normalizeArms, } from './verify.js';
 /** The `gears2fsm`-mandated captain actor name a machine declares. */
 export const CAPTAIN_ACTOR = 'captain';
+// Each check owns its resources, including concurrent checks and async actor
+// callbacks. No current-run variable is shared between invocations.
+const coverageRuns = new AsyncLocalStorage();
+/** Incomplete coverage is not an unsatisfiable transition or Source question. */
+export class FsmCoverageDeadlineError extends Error {
+    constructor() {
+        super('FSM transition coverage incomplete: cooperative deadline exceeded');
+        this.name = 'FsmCoverageDeadlineError';
+    }
+}
+function coverageCheckpoint() {
+    const run = coverageRuns.getStore();
+    run?.signal?.throwIfAborted();
+    if (run !== undefined && performance.now() >= run.deadline)
+        throw new FsmCoverageDeadlineError();
+}
+/** Deliver pending cancellation between bounded blocks of synchronous work. */
+async function coverageYield(force = false) {
+    coverageCheckpoint();
+    const run = coverageRuns.getStore();
+    if (run !== undefined && (force || performance.now() - run.lastYield >= 8)) {
+        try {
+            await delay(0, undefined, { signal: run.signal });
+        }
+        finally {
+            coverageCheckpoint();
+        }
+        run.lastYield = performance.now();
+    }
+}
+function trackCoverageActor(actor) {
+    const run = coverageRuns.getStore();
+    if (run !== undefined) {
+        run.actors.add(actor);
+        const stop = actor.stop.bind(actor);
+        actor.stop = () => {
+            try {
+                return stop();
+            }
+            finally {
+                run.actors.delete(actor);
+            }
+        };
+    }
+    return actor;
+}
+/** Release every actor without replacing an already propagating failure. */
+function stopCoverageActors(actors, preserveFailure) {
+    let failed = false;
+    let firstError;
+    for (const actor of actors) {
+        try {
+            actor.stop();
+        }
+        catch (error) {
+            if (!failed)
+                firstError = error;
+            failed = true;
+        }
+    }
+    if (failed && !preserveFailure)
+        throw firstError;
+}
 function stateRefKey(ref) {
     return ref.path.join('\u0000');
 }
@@ -49,6 +114,15 @@ function interruptTargetForRef(ref, fallback) {
 function captainInterruptTarget(captain) {
     return interruptTargetForRef(captain.ref, captainPublicStateId(captain));
 }
+function invokeGuard(guard, args, ...params) {
+    coverageCheckpoint();
+    try {
+        return guard(args, ...params);
+    }
+    finally {
+        coverageCheckpoint();
+    }
+}
 /** Scalar values carried by a parameterized XState guard descriptor. */
 function descriptorValues(value, seen = new Set()) {
     if (typeof value === 'string' ||
@@ -66,7 +140,7 @@ function resolveGuard(machine, guard) {
     if (typeof guard === 'function') {
         const implementation = guard;
         return {
-            run: (args) => implementation(args),
+            run: (args) => invokeGuard(implementation, args),
             probeValues: minedLiterals(implementation),
         };
     }
@@ -83,7 +157,7 @@ function resolveGuard(machine, guard) {
     const implementation = candidate;
     const params = descriptor.params;
     return {
-        run: (args) => implementation(args, typeof params === 'function'
+        run: (args) => invokeGuard(implementation, args, typeof params === 'function'
             ? params(args)
             : params),
         probeValues: [
@@ -100,6 +174,7 @@ function guardLabel(guard) {
         return JSON.stringify(guard) ?? String(guard);
     }
     catch {
+        coverageCheckpoint();
         return String(guard);
     }
 }
@@ -135,6 +210,8 @@ const SETTLE_MS = 1_000;
 const PARALLEL_SETTLE_MS = 250;
 const PARALLEL_QUESTION_SETTLE_MS = 500;
 const MAX_PARALLEL_COMBINATIONS = 64;
+const MAX_COVERAGE_PATH_STEPS = 8;
+const MAX_COVERAGE_PATH_ATTEMPTS = 64;
 /** Stable values shared by machine input, result output, and guard probing. */
 const COVERAGE_PLAYBOOK_ID = 'coverage-child-playbook';
 const COVERAGE_PLAYBOOK_INPUT = 'coverage: complete the child request';
@@ -185,15 +262,20 @@ function coverageGuardContext(dynamic) {
 }
 /** Context produced by the machine's real initializer for the coverage input. */
 function initializedMachineContext(machine) {
+    let actor;
+    let failed = false;
     try {
-        const actor = createActor(machine, { input: COVERAGE_MACHINE_INPUT });
-        const context = actor.getSnapshot().context;
-        actor.stop();
-        return context;
+        actor = trackCoverageActor(createActor(machine, { input: COVERAGE_MACHINE_INPUT }));
+        return actor.getSnapshot().context;
     }
     catch {
+        failed = true;
+        coverageCheckpoint();
         return {};
     }
+    finally {
+        stopCoverageActors(actor === undefined ? [] : [actor], failed);
+    }
 }
 /** Real initialized fields plus deterministic values needed by guard probes. */
 function initializedCoverageContext(machine, dynamic) {
@@ -243,12 +325,28 @@ function synthesizedFieldValue(field) {
 }
 /** Synthesizes a captain output that selects `key` under the state's contract. */
 function synthOutput(state, key) {
+    if (state.actor === 'script') {
+        return {
+            guard: key,
+            exitStatus: Object.keys(state.result)[0] === key ? 0 : 1,
+        };
+    }
     const output = { guard: key };
     for (const field of requiredFields(state.result[key] ?? '')) {
         output[field] = synthesizedFieldValue(field);
     }
     return output;
 }
+/** One bounded runtime-valid candidate set for acceptance and arm auditing. */
+function resultOutputCandidates(state, key, candidates) {
+    const output = synthOutput(state, key);
+    if (state.actor !== 'script' || output.exitStatus === 0)
+        return [output];
+    return [...new Set([1, ...candidates])]
+        .filter((value) => typeof value === 'number' && Number.isInteger(value) && value > 0)
+        .slice(0, MAX_SCRIPT_EXIT_STATUSES)
+        .map((exitStatus) => ({ guard: key, exitStatus }));
+}
 function invocations(state) {
     if (Array.isArray(state.invoke))
         return state.invoke;
@@ -291,21 +389,33 @@ function stateRefs(config) {
     visit((config.states ?? {}));
     return out;
 }
-/** The root initial state followed through every compound initial child. */
-function initialActiveRefs(config, refs) {
+/** States entered by default, including every active parallel region. */
+function enteredStateRefs(state, refs, parent) {
     const active = [];
-    let path = [];
-    let initial = config.initial;
-    while (typeof initial === 'string') {
-        path = [...path, initial];
+    const initial = initialStateTarget(state.initial);
+    const keys = state.type === 'parallel'
+        ? Object.keys(state.states ?? {})
+        : initial !== undefined
+            ? [initial]
+            : [];
+    for (const key of keys) {
+        const path = [...(parent?.path ?? []), key];
         const ref = refs.find((candidate) => candidate.path.join('\u0000') === path.join('\u0000'));
         if (ref === undefined)
-            break;
-        active.push(ref);
-        initial = ref.state.initial;
+            continue;
+        active.push(ref, ...enteredStateRefs(ref.state, refs, ref));
     }
     return active;
 }
+function initialActiveRefs(config, refs) {
+    return enteredStateRefs(config, refs);
+}
+/** A target enters itself and only its default active descendants. */
+function targetEntersRef(refs, target, invocation) {
+    return (target !== undefined &&
+        (sameStateRef(target, invocation) ||
+            enteredStateRefs(target.state, refs, target).some((ref) => sameStateRef(ref, invocation))));
+}
 /** Captain bindings paired with the nested state node that owns the invoke. */
 function captainRefs(config) {
     const out = [];
@@ -361,6 +471,7 @@ function captainRefs(config) {
                 return matchingActor;
             }
             catch {
+                coverageCheckpoint();
                 return matchingActor && binding.sourceItem === '';
             }
         });
@@ -396,21 +507,10 @@ function coverageErrorMessage(error) {
         return error instanceof Error ? error.message : String(error);
     }
     catch {
+        coverageCheckpoint();
         return 'unknown error';
     }
 }
-/** Replays a nested input against the context observed after a failed start. */
-function playbookInputFailure(playbook, context) {
-    if (typeof playbook.invocation.input !== 'function')
-        return undefined;
-    try {
-        playbook.invocation.input({ context });
-        return undefined;
-    }
-    catch (error) {
-        return coverageErrorMessage(error);
-    }
-}
 /** Dynamic target/text context names declared by a nested playbook input. */
 function dynamicPlaybookFields(playbook) {
     if (typeof playbook.invocation.input !== 'function')
@@ -420,6 +520,7 @@ function dynamicPlaybookFields(playbook) {
         input = playbook.invocation.input({ context: coverageGuardContext() });
     }
     catch {
+        coverageCheckpoint();
         return undefined;
     }
     if (typeof input !== 'object' || input === null || Array.isArray(input)) {
@@ -470,22 +571,26 @@ function resolvedStateNode(machine, ref) {
     return node;
 }
 function persistedSnapshotWithContext(provided, context) {
-    const seed = createActor(provided, { input: COVERAGE_MACHINE_INPUT });
+    const seed = trackCoverageActor(createActor(provided, { input: COVERAGE_MACHINE_INPUT }));
+    let completed = false;
     try {
-        return {
+        const snapshot = {
             ...seed.getPersistedSnapshot(),
             context: { ...context },
             children: {},
         };
+        completed = true;
+        return snapshot;
     }
     finally {
-        seed.stop();
+        stopCoverageActors([seed], !completed);
     }
 }
 function makeActor(machine, script, playbookScript = () => null, restoredContext, observeTransition) {
+    coverageCheckpoint();
     const coverageErrors = [];
-    const workActor = fromPromise(async ({ input }) => {
-        const output = script(input ?? {});
+    const workActor = fromPromise(async ({ input, self, }) => {
+        const output = await script(input ?? {}, self.id);
         if (output === null)
             return new Promise(() => { });
         if (output instanceof Error)
@@ -500,7 +605,7 @@ function makeActor(machine, script, playbookScript = () => null, restoredContext
             // A child script is opt-in. All unrelated child invocations hang until
             // the driven actor is stopped, preserving Captain and parallel probes.
             playbook: fromPromise(async ({ input, self, }) => {
-                const output = playbookScript(input ?? {}, self.id);
+                const output = await playbookScript(input ?? {}, self.id);
                 if (output === null)
                     return new Promise(() => { });
                 if (output instanceof Error)
@@ -512,17 +617,18 @@ function makeActor(machine, script, playbookScript = () => null, restoredContext
     const restoredSnapshot = restoredContext === undefined
         ? undefined
         : persistedSnapshotWithContext(provided, restoredContext);
-    const actor = createActor(provided, {
+    const actor = trackCoverageActor(createActor(provided, {
         input: COVERAGE_MACHINE_INPUT,
-        ...(restoredSnapshot === undefined ? {} : { snapshot: restoredSnapshot }),
+        ...(restoredSnapshot === undefined
+            ? {}
+            : { snapshot: restoredSnapshot }),
         inspect: (inspection) => {
             if (typeof inspection !== 'object' ||
                 inspection === null ||
                 !('event' in inspection)) {
                 return;
             }
-            const inspectedTransitions = inspection
-                ._transitions;
+            const inspectedTransitions = inspection._transitions;
             if (inspection.type === '@xstate.microstep' &&
                 Array.isArray(inspectedTransitions)) {
                 for (const transition of inspectedTransitions) {
@@ -559,12 +665,13 @@ function makeActor(machine, script, playbookScript = () => null, restoredContext
                 });
             }
         },
-    });
+    }));
     Object.defineProperty(actor, 'coverageErrors', {
         value: coverageErrors,
     });
     actor.subscribe({ error: () => { } });
     actor.start();
+    coverageCheckpoint();
     return actor;
 }
 /** A script that rejects the captain invocation for the given source item. */
@@ -587,14 +694,30 @@ function onceScript(sourceItem, output, gate) {
 }
 /** Waits until the actor's snapshot satisfies `predicate`, or times out. */
 function settle(actor, predicate, ms = SETTLE_MS) {
-    return new Promise((resolveSettled) => {
+    coverageCheckpoint();
+    const run = coverageRuns.getStore();
+    return new Promise((resolveSettled, reject) => {
         let subscription = undefined;
+        let settled = false;
         const finish = (outcome) => {
+            if (settled)
+                return;
+            settled = true;
             clearTimeout(timer);
             subscription?.unsubscribe();
-            resolveSettled(outcome);
+            run?.signal?.removeEventListener('abort', aborted);
+            try {
+                coverageCheckpoint();
+                resolveSettled(outcome);
+            }
+            catch (error) {
+                reject(error);
+            }
         };
-        const timer = setTimeout(() => finish(predicate(actor.getSnapshot())), ms);
+        const aborted = () => finish(false);
+        const remaining = run === undefined ? ms : Math.max(0, run.deadline - performance.now());
+        const timer = setTimeout(() => finish(predicate(actor.getSnapshot())), Math.min(ms, Math.ceil(remaining)));
+        run?.signal?.addEventListener('abort', aborted, { once: true });
         subscription = actor.subscribe({
             next: (snapshot) => {
                 if (predicate(snapshot))
@@ -605,13 +728,26 @@ function settle(actor, predicate, ms = SETTLE_MS) {
             // owning probe records the actionable coverage finding.
             error: () => finish(false),
         });
+        if (settled)
+            subscription.unsubscribe();
         if (predicate(actor.getSnapshot()))
             finish(true);
+        if (run?.signal?.aborted)
+            aborted();
     });
 }
 /** Lets XState process an event whose correct outcome is no transition. */
 async function settleNoTransition() {
-    await new Promise((resolveSettled) => setTimeout(resolveSettled, 10));
+    coverageCheckpoint();
+    const run = coverageRuns.getStore();
+    try {
+        await delay(Math.min(10, run === undefined
+            ? 10
+            : Math.max(0, Math.ceil(run.deadline - performance.now()))), undefined, { signal: run?.signal });
+    }
+    finally {
+        coverageCheckpoint();
+    }
 }
 function activeStateIds(snapshot) {
     const ids = new Set();
@@ -641,6 +777,7 @@ function activeStateIds(snapshot) {
             return;
         }
         for (const [key, nested] of Object.entries(value)) {
+            ids.add([...prefix, key].join('.'));
             walkValue(nested, [...prefix, key]);
         }
     };
@@ -701,8 +838,12 @@ function directlySelectedEventArm(machine, arms, event, context = coverageGuardC
                 return index;
         }
         catch {
+            coverageCheckpoint();
             return undefined;
         }
+        finally {
+            coverageCheckpoint();
+        }
     }
     return undefined;
 }
@@ -742,7 +883,6 @@ function orderedArmPredicate(machine, arms, selected) {
 }
 /** A bounded satisfying context/event pair for one authored interrupt arm. */
 function interruptDriveForRef(machine, refs, target, targetId, extraValues = [], selectedArmIndex) {
-    const base = { type: INTERRUPT_EVENT, targetId };
     const arms = transitionArms((machine.config.on ?? {})[INTERRUPT_EVENT]);
     const armIndex = selectedArmIndex ??
         arms.findIndex((arm) => {
@@ -750,9 +890,17 @@ function interruptDriveForRef(machine, refs, target, targetId, extraValues = [],
             if (rawTarget === undefined)
                 return false;
             const resolvedTarget = stateRefForTarget(refs, rawTarget);
-            return (sameStateRef(resolvedTarget, target) ||
+            return (targetEntersRef(refs, resolvedTarget, target) ||
                 resolvedTarget?.stableId === targetId);
         });
+    const rawTarget = rawArmTarget(arms[armIndex]);
+    const entryTarget = rawTarget === undefined ? undefined : stateRefForTarget(refs, rawTarget);
+    const base = {
+        type: INTERRUPT_EVENT,
+        targetId: entryTarget !== undefined && !sameStateRef(entryTarget, target)
+            ? entryTarget.stableId
+            : targetId,
+    };
     const targetPlaybook = playbookRefs(machine.config).find((playbook) => sameStateRef(playbook.ref, target));
     const initialContext = initializedCoverageContext(machine, targetPlaybook === undefined
         ? undefined
@@ -802,7 +950,7 @@ function entryDriveForRef(machine, refs, target, extraValues = [], initialContex
             for (const [armIndex, arm] of arms.entries()) {
                 const rawTarget = rawArmTarget(arm);
                 if (rawTarget === undefined ||
-                    !sameStateRef(stateRefForTarget(refs, rawTarget, source), target)) {
+                    !targetEntersRef(refs, stateRefForTarget(refs, rawTarget, source), target)) {
                     continue;
                 }
                 const guard = orderedArmPredicate(machine, arms, armIndex);
@@ -867,15 +1015,18 @@ const GENERIC_VALUES = [
     COVERAGE_ENABLED_PLAYBOOKS,
 ];
 const MAX_PROBES = 30_000;
+const MAX_SCRIPT_EXIT_STATUSES = 8;
 const PROBES_PER_TIMEOUT_MILLISECOND = 50;
 const COVERAGE_TIMEOUT_MARGIN_MS = 5_000;
 const MIN_COVERAGE_TEST_TIMEOUT_MS = 10_000;
+const MAX_COVERAGE_TEST_TIMEOUT_MS = 300_000;
 function minedLiterals(fn) {
     let source;
     try {
         source = String(fn);
     }
     catch {
+        coverageCheckpoint();
         return [];
     }
     const literals = source.match(/'(?:[^'\\]|\\.)*'|"(?:[^"\\]|\\.)*"/g) ?? [];
@@ -923,6 +1074,22 @@ export function guardSatisfiable(guard, baseOutput, extraValues = []) {
 }
 function probeGuardAssignment(guard, fixedEvent, payloads, extraValues, options = {}) {
     const baseContext = { ...(options.initialContext ?? {}) };
+    // Guards are predicates over fixed seed objects. Snapshot their descriptors
+    // once within this probe, while keeping every candidate independently mutable
+    // and retaining accessors, prototypes and non-enumerable Error properties.
+    const bases = new WeakMap();
+    const overlay = (base, assigned) => {
+        let shape = bases.get(base);
+        if (shape === undefined) {
+            shape = {
+                prototype: Object.getPrototypeOf(base),
+                descriptors: Object.getOwnPropertyDescriptors(base),
+            };
+            bases.set(base, shape);
+        }
+        const copy = Object.create(shape.prototype, shape.descriptors);
+        return Object.assign(copy, assigned);
+    };
     // Guard-source literals first: the likeliest matches are tried earliest.
     const values = [
         ...new Set([...minedLiterals(guard), ...extraValues, ...GENERIC_VALUES]),
@@ -932,27 +1099,33 @@ function probeGuardAssignment(guard, fixedEvent, payloads, extraValues, options
         let event = { ...fixedEvent };
         for (const payload of payloads) {
             if (payload.eventField === undefined) {
-                event = overlaidObject(event, assignment.payloads[payload.tag] ?? {});
+                event = overlay(overlay(payload.base, event), assignment.payloads[payload.tag] ?? {});
             }
             else {
-                event[payload.eventField] = overlaidObject(payload.base, assignment.payloads[payload.tag] ?? {});
+                event[payload.eventField] = overlay(payload.base, assignment.payloads[payload.tag] ?? {});
             }
         }
         return event;
     };
     const passes = (assignment) => {
+        coverageCheckpoint();
         probes++;
         try {
             return Boolean(guard({ context: assignment.context, event: eventFor(assignment) }));
         }
         catch {
+            coverageCheckpoint();
             return false;
         }
+        finally {
+            coverageCheckpoint();
+        }
     };
     // Records the unassigned fields the guard reads under the given assignment.
     const readsUnder = (assignment) => {
+        coverageCheckpoint();
         const reads = new Set();
-        const recording = (base, assigned, tag, varyExisting = false) => new Proxy(overlaidObject(base, assigned), {
+        const recording = (base, assigned, tag, varyExisting = false) => new Proxy(overlay(base, assigned), {
             get(target, prop) {
                 if (typeof prop !== 'string')
                     return undefined;
@@ -978,7 +1151,7 @@ function probeGuardAssignment(guard, fixedEvent, payloads, extraValues, options
             let event = { ...fixedEvent };
             for (const payload of payloads) {
                 if (payload.eventField === undefined) {
-                    event = recording(event, assignment.payloads[payload.tag] ?? {}, payload.tag);
+                    event = recording(overlay(payload.base, event), assignment.payloads[payload.tag] ?? {}, payload.tag);
                 }
                 else {
                     event[payload.eventField] = recording(payload.base, assignment.payloads[payload.tag] ?? {}, payload.tag);
@@ -990,11 +1163,16 @@ function probeGuardAssignment(guard, fixedEvent, payloads, extraValues, options
             });
         }
         catch {
+            coverageCheckpoint();
             // Reads observed before the throw still guide the search.
         }
+        finally {
+            coverageCheckpoint();
+        }
         return [...reads];
     };
     const search = (assignment, depth) => {
+        coverageCheckpoint();
         if (probes > MAX_PROBES)
             return undefined;
         if (passes(assignment))
@@ -1020,6 +1198,7 @@ function probeGuardAssignment(guard, fixedEvent, payloads, extraValues, options
                 ...values.filter((value) => !hasBaseline || value !== baseline),
             ];
             for (const value of candidates) {
+                coverageCheckpoint();
                 if (probes > MAX_PROBES)
                     return undefined;
                 const nextDepth = depth + (hasBaseline && value === baseline ? 0 : 1);
@@ -1066,8 +1245,8 @@ function overlaidObject(base, assigned) {
  * named nested payloads are assignable; event-level fields such as `type` and
  * `actorId` remain the values XState actually supplies.
  */
-function doneGuardSatisfiable(guard, event, output, extraValues) {
-    return probeGuardSatisfiable(guard.run, event, [{ eventField: 'output', tag: 'o:', base: output }], [...guard.probeValues, ...extraValues]);
+function doneGuardSatisfiable(guard, event, output, extraValues, fixedOutput = false) {
+    return probeGuardSatisfiable(guard.run, fixedOutput ? { ...event, output } : event, fixedOutput ? [] : [{ eventField: 'output', tag: 'o:', base: output }], [...guard.probeValues, ...extraValues]);
 }
 /** A concrete initialized-context/output assignment selecting one done arm. */
 function controllerDoneGuardAssignment(guard, event, output, extraValues, initialContext) {
@@ -1085,11 +1264,7 @@ function parallelBranchCaptains(parallel, refs, captains) {
     const regions = refs.filter((ref) => ref.parent === parallel);
     const selected = [];
     for (const region of regions) {
-        const candidates = captains.filter((captain) => isDescendantOf(captain.ref, region));
-        const initial = region.state.initial;
-        const captain = (initial === undefined
-            ? undefined
-            : candidates.find((candidate) => candidate.ref.path[region.path.length] === initial)) ?? candidates[0];
+        const captain = captains.find((candidate) => targetEntersRef(refs, region, candidate.ref));
         if (captain !== undefined)
             selected.push(captain);
     }
@@ -1153,21 +1328,300 @@ function callCount(calls, captain) {
         calls.get(captain.binding.sourceItem) ??
         0);
 }
-function playbookCoverageInput(machine, playbook, dynamic) {
-    if (typeof playbook.invocation.input !== 'function')
-        return undefined;
-    try {
-        const input = playbook.invocation.input({
-            context: initializedCoverageContext(machine, dynamic),
+/** One public drive or the actual initialized state, never a private jump. */
+function childCoverageDrive(machine, refs, ref, targetId, candidates) {
+    const interrupt = interruptDriveForRef(machine, refs, ref, targetId, candidates);
+    if (interrupt.satisfiable)
+        return { drive: interrupt };
+    const entry = entryDriveForRef(machine, refs, ref, candidates);
+    if (entry !== undefined)
+        return { drive: entry };
+    return initialActiveRefs(machine.config, refs).some((active) => sameStateRef(active, ref))
+        ? {}
+        : undefined;
+}
+function coverageNodeKey(node) {
+    return `${stateRefKey(node.value.ref)}:${node.value.invocationIndex}`;
+}
+function coverageNodes(captains, playbooks) {
+    return [
+        ...captains.map((value) => ({ kind: 'acting', value })),
+        ...playbooks.map((value) => ({ kind: 'child', value })),
+    ];
+}
+/** The exact ordered output candidates used both for entry and target arms. */
+function coverageArmResults(machine, node, outcome, armIndex, context, input, candidates, dynamicTarget, requiredResult, includeBare = false, firstOnly = false) {
+    const arms = transitionArms(node.value.invocation[outcome]);
+    const guard = orderedArmPredicate(machine, arms, armIndex);
+    if (guard === undefined)
+        return [];
+    const actorId = invocationActorId(machine, node.value);
+    const event = {
+        type: `xstate.${outcome === 'onDone' ? 'done' : 'error'}.actor.${actorId}`,
+        actorId,
+    };
+    const bases = outcome === 'onError'
+        ? node.kind === 'child'
+            ? [
+                nestedFailure(typeof input.playbookId === 'string'
+                    ? input.playbookId
+                    : COVERAGE_PLAYBOOK_ID),
+                nestedFailureTerminal(typeof input.playbookId === 'string'
+                    ? input.playbookId
+                    : COVERAGE_PLAYBOOK_ID),
+                new Error('coverage: generic nested playbook failure'),
+            ]
+            : [new Error('coverage: forced captain failure')]
+        : node.kind === 'child'
+            ? [{}, nestedSuccessOutput(), { invalidCoverageOutput: undefined }]
+            : (requiredResult === undefined
+                ? Object.keys(node.value.binding.result)
+                : [requiredResult]).flatMap((key) => resultOutputCandidates(node.value.binding, key, [
+                ...guard.probeValues,
+                ...candidates,
+            ]).map((output) => ({
+                ...output,
+                ...(dynamicTarget === undefined
+                    ? {}
+                    : {
+                        [dynamicTarget.playbookIdContext]: COVERAGE_PLAYBOOK_ID,
+                        [dynamicTarget.textContext]: COVERAGE_PLAYBOOK_INPUT,
+                    }),
+            })));
+    if (includeBare &&
+        node.kind === 'acting' &&
+        node.value.binding.actor !== 'script' &&
+        outcome === 'onDone') {
+        bases.push(...Object.keys(node.value.binding.result).map((guard) => ({ guard })));
+    }
+    const results = [];
+    for (const base of bases) {
+        coverageCheckpoint();
+        if (node.kind === 'acting' &&
+            node.value.binding.actor === 'script' &&
+            outcome === 'onDone') {
+            if (directlySelectedEventArm(machine, arms, { ...event, output: base }, context) === armIndex) {
+                results.push(base);
+                if (firstOnly)
+                    return results;
+            }
+            continue;
+        }
+        const assignment = probeGuardAssignment(guard.run, event, [
+            {
+                eventField: outcome === 'onDone' ? 'output' : 'error',
+                tag: outcome === 'onDone' ? 'o:' : 'r:',
+                base,
+                ...(outcome === 'onError' ? { varyExisting: true } : {}),
+            },
+        ], [...guard.probeValues, ...GENERIC_VALUES, ...candidates], { initialContext: context, assignContext: false });
+        if (assignment !== undefined) {
+            results.push(assignedPayload(base, assignment, outcome === 'onDone' ? 'o:' : 'r:'));
+            if (firstOnly)
+                return results;
+        }
+    }
+    return results;
+}
+/** Replay every prefix transition; no persisted private-state restoration. */
+async function replayCoveragePath(machine, nodes, path) {
+    const gate = { armed: path.drive === undefined };
+    let expected = path.root;
+    let pending;
+    const script = (input, actorId) => {
+        const node = nodes.find((candidate) => invocationActorId(machine, candidate.value) === actorId);
+        if (!gate.armed ||
+            node === undefined ||
+            coverageNodeKey(node) !== coverageNodeKey(expected))
+            return null;
+        const stateId = node.kind === 'acting'
+            ? captainPublicStateId(node.value)
+            : node.value.ref.stableId;
+        if (input.stateId !== stateId)
+            return null;
+        return new Promise((complete) => {
+            pending = { node, input, complete };
         });
-        return typeof input === 'object' && input !== null && !Array.isArray(input)
-            ? input
-            : undefined;
+    };
+    const actor = makeActor(machine, script, script, path.drive?.context);
+    gate.armed = true;
+    if (path.drive !== undefined)
+        actor.send(path.drive.event);
+    const wait = () => settle(actor, (snapshot) => (pending !== undefined && atState(expected.value.ref)(snapshot)) ||
+        snapshot.status === 'done' ||
+        snapshot.status === 'error', PARALLEL_SETTLE_MS);
+    let completedPrefix = true;
+    for (const step of path.steps) {
+        await coverageYield();
+        await wait();
+        const current = pending;
+        if (current === undefined ||
+            coverageNodeKey(current.node) !== coverageNodeKey(step.node)) {
+            completedPrefix = false;
+            break;
+        }
+        pending = undefined;
+        expected = step.next;
+        current.complete(step.result);
+        if (step.questionWait !== undefined) {
+            if (!(await settle(actor, atState(step.questionWait), PARALLEL_SETTLE_MS))) {
+                completedPrefix = false;
+                break;
+            }
+            actor.send({
+                type: BOSS_REPLY_EVENT,
+                questionId: captainPublicStateId(step.node.value),
+                answer: 'Proceed as planned.',
+            });
+        }
     }
-    catch {
-        return undefined;
+    await wait();
+    const snapshot = actor.getSnapshot();
+    const failure = actor.coverageErrors.find(({ eventType }) => eventType ===
+        `xstate.error.actor.${invocationActorId(machine, expected.value)}`);
+    return {
+        actor,
+        ...(!completedPrefix ||
+            pending === undefined ||
+            !atState(expected.value.ref)(snapshot)
+            ? {}
+            : { pending }),
+        ...(failure !== undefined
+            ? { inputFailure: coverageErrorMessage(failure.error) }
+            : snapshot.status === 'error'
+                ? { inputFailure: coverageErrorMessage(snapshot.error) }
+                : {}),
+    };
+}
+/** Finite path replay, with one canonical question/reply revisit at most. */
+async function searchCoverageEntry(machine, target, refs, captains, playbooks, candidates, check) {
+    const nodes = coverageNodes(captains, playbooks);
+    const nodesForTarget = (raw, source) => {
+        const targetName = rawArmTarget(raw);
+        const targetRef = targetName === undefined
+            ? undefined
+            : stateRefForTarget(refs, targetName, source);
+        return nodes.filter((node) => targetEntersRef(refs, targetRef, node.value.ref));
+    };
+    const reachable = new Set([coverageNodeKey(target)]);
+    for (let pass = 0; pass < nodes.length; pass++) {
+        for (const node of nodes) {
+            if (['onDone', 'onError'].some((outcome) => transitionArms(node.value.invocation[outcome]).some((arm) => {
+                return nodesForTarget(arm, node.value.ref).some((next) => reachable.has(coverageNodeKey(next)));
+            })))
+                reachable.add(coverageNodeKey(node));
+        }
     }
+    const queue = [];
+    for (const node of [
+        target,
+        ...nodes.filter((node) => coverageNodeKey(node) !== coverageNodeKey(target)),
+    ]) {
+        if (!reachable.has(coverageNodeKey(node)))
+            continue;
+        const entry = childCoverageDrive(machine, refs, node.value.ref, node.kind === 'acting'
+            ? captainInterruptTarget(node.value)
+            : interruptTargetForRef(node.value.ref, node.value.ref.stableId), candidates);
+        if (entry !== undefined)
+            queue.push({ root: node, ...entry, steps: [] });
+    }
+    let attempts = 0;
+    let entered = false;
+    let limitation;
+    let inputFailure;
+    while (queue.length > 0 && attempts < MAX_COVERAGE_PATH_ATTEMPTS) {
+        await coverageYield();
+        const path = queue.shift();
+        attempts++;
+        let replay = await replayCoveragePath(machine, nodes, path);
+        try {
+            if (replay.inputFailure !== undefined)
+                inputFailure = replay.inputFailure;
+            if (replay.pending !== undefined &&
+                coverageNodeKey(replay.pending.node) === coverageNodeKey(target)) {
+                entered = true;
+                if (await check(replay.actor, replay.pending))
+                    return { covered: true, entered };
+                // A target check may have completed its actor. Re-enter the same
+                // authored prefix before considering successors, charging that replay
+                // against the same attempt limit.
+                replay.actor.stop();
+                if (attempts >= MAX_COVERAGE_PATH_ATTEMPTS) {
+                    limitation = `exhausted ${MAX_COVERAGE_PATH_ATTEMPTS}-attempt path budget`;
+                    break;
+                }
+                attempts++;
+                replay = await replayCoveragePath(machine, nodes, path);
+            }
+            const pending = replay.pending;
+            if (pending === undefined)
+                continue;
+            const node = pending.node;
+            const context = replay.actor.getSnapshot().context;
+            const nextSteps = [];
+            for (const outcome of ['onDone', 'onError']) {
+                for (const [index, arm] of transitionArms(node.value.invocation[outcome]).entries()) {
+                    for (const next of nodesForTarget(arm, node.value.ref)) {
+                        if (!reachable.has(coverageNodeKey(next)))
+                            continue;
+                        const dynamic = next.kind === 'child'
+                            ? dynamicPlaybookFields(next.value)
+                            : undefined;
+                        for (const result of coverageArmResults(machine, node, outcome, index, context, pending.input, candidates, dynamic)) {
+                            nextSteps.push({ node, result, next });
+                        }
+                    }
+                }
+            }
+            if (node.kind === 'acting' &&
+                Object.hasOwn(node.value.binding.result, NEEDS_BOSS_REPLY) &&
+                !path.steps.some((step) => step.questionWait !== undefined)) {
+                for (const [index, arm] of transitionArms(node.value.invocation.onDone).entries()) {
+                    const rawTarget = rawArmTarget(arm);
+                    const waitRef = rawTarget === undefined
+                        ? undefined
+                        : stateRefForTarget(refs, rawTarget, node.value.ref);
+                    if (waitRef === undefined ||
+                        (waitRef.stableId !== AWAIT_BOSS_REPLY_STATE &&
+                            !tagsOf(waitRef.state).includes('playbook.parked')))
+                        continue;
+                    for (const result of coverageArmResults(machine, node, 'onDone', index, context, pending.input, candidates, undefined, NEEDS_BOSS_REPLY)) {
+                        nextSteps.push({ node, result, next: node, questionWait: waitRef });
+                    }
+                }
+            }
+            for (const step of nextSteps) {
+                if (path.steps.length + 1 >= MAX_COVERAGE_PATH_STEPS) {
+                    limitation = `exhausted ${MAX_COVERAGE_PATH_STEPS}-invocation path depth`;
+                    continue;
+                }
+                const visited = [path.root, ...path.steps.map((step) => step.next)].map(coverageNodeKey);
+                if (step.questionWait === undefined &&
+                    visited.includes(coverageNodeKey(step.next))) {
+                    limitation ??= 'unsupported repeated-invocation path';
+                    continue;
+                }
+                queue.push({ ...path, steps: [...path.steps, step] });
+            }
+        }
+        finally {
+            replay.actor.stop();
+        }
+    }
+    if (queue.length > 0)
+        limitation = `exhausted ${MAX_COVERAGE_PATH_ATTEMPTS}-attempt path budget`;
+    return {
+        covered: false,
+        entered,
+        ...(limitation === undefined ? {} : { limitation }),
+        ...(inputFailure === undefined ? {} : { inputFailure }),
+    };
 }
+/**
+ * The value the bridge resolves a completed child with: a child that reached
+ * a success terminal, or an older child that published no terminal kind,
+ * resolves with its own output and reaches `onDone`.
+ */
 function nestedSuccessOutput() {
     return {
         outcome: 'terminal',
@@ -1193,6 +1647,33 @@ function nestedFailure(playbookId) {
     });
     return error;
 }
+/**
+ * A child that completed at its own authored failure terminal. The bridge
+ * rejects the call with that exact `ok` result, so a recovering first
+ * `onError` arm written for it is satisfiable under probing.
+ */
+function nestedFailureTerminal(playbookId) {
+    const terminal = {
+        stateId: 'coverageFailureTerminal',
+        kind: 'failure',
+        description: 'coverage: the child reported its own failure terminal',
+    };
+    const error = new Error(`Child playbook ${playbookId} reached failure terminal ${terminal.stateId}`);
+    error.name = 'NestedPlaybookCallError';
+    Object.defineProperty(error, 'result', {
+        configurable: true,
+        enumerable: true,
+        writable: true,
+        value: {
+            status: 'ok',
+            playbookId,
+            childSessionId: 'coverage-child-session',
+            output: { response: 'coverage: nested playbook failure terminal' },
+            terminal,
+        },
+    });
+    return error;
+}
 function assignedPayload(base, assignment, tag) {
     return overlaidObject(base, assignment.payloads[tag] ?? {});
 }
@@ -1208,7 +1689,7 @@ function playbookEntryPlan(machine, playbook, refs, captains, dynamic) {
         for (const [armIndex, arm] of arms.entries()) {
             const rawTarget = rawArmTarget(arm);
             if (rawTarget === undefined ||
-                !sameStateRef(stateRefForTarget(refs, rawTarget, captain.ref), playbook.ref)) {
+                !targetEntersRef(refs, stateRefForTarget(refs, rawTarget, captain.ref), playbook.ref)) {
                 continue;
             }
             for (const key of Object.keys(captain.binding.result)) {
@@ -1256,7 +1737,7 @@ function captainPredecessorPlan(machine, target, playbooks, refs, captains) {
         for (const [armIndex, arm] of arms.entries()) {
             const rawTarget = rawArmTarget(arm);
             if (rawTarget === undefined ||
-                !sameStateRef(stateRefForTarget(refs, rawTarget, playbook.ref), target.ref)) {
+                !targetEntersRef(refs, stateRefForTarget(refs, rawTarget, playbook.ref), target.ref)) {
                 continue;
             }
             const guard = orderedArmPredicate(machine, arms, armIndex);
@@ -1310,7 +1791,7 @@ function controllerCaptainEntryPlan(machine, target, refs, captains, candidates,
         for (const resultKey of Object.keys(current.captain.binding.result)) {
             const output = synthOutput(current.captain.binding, resultKey);
             const nextRef = directTargetRef(machine, refs, current.captain, output, initialContext);
-            const nextCaptain = captains.find((candidate) => nextRef !== undefined && sameStateRef(candidate.ref, nextRef));
+            const nextCaptain = captains.find((candidate) => targetEntersRef(refs, nextRef, candidate.ref));
             if (nextCaptain !== undefined &&
                 !visited.has(stateRefKey(nextCaptain.ref))) {
                 queue.push({
@@ -1333,7 +1814,7 @@ function controllerCaptainExitPlan(machine, captain, output, refs, captains, hub
     if (sameStateRef(firstTarget, hub) || firstTarget.state.type === 'final') {
         return { following: [], outcome: 'planned' };
     }
-    const firstCaptain = captains.find((candidate) => sameStateRef(candidate.ref, firstTarget));
+    const firstCaptain = captains.find((candidate) => targetEntersRef(refs, firstTarget, candidate.ref));
     if (firstCaptain === undefined) {
         return { following: [], outcome: 'runtime' };
     }
@@ -1359,7 +1840,7 @@ function controllerCaptainExitPlan(machine, captain, output, refs, captains, hub
             if (sameStateRef(nextRef, hub) || nextRef.state.type === 'final') {
                 return { following, outcome: 'planned' };
             }
-            const nextCaptain = captains.find((candidate) => sameStateRef(candidate.ref, nextRef));
+            const nextCaptain = captains.find((candidate) => targetEntersRef(refs, nextRef, candidate.ref));
             if (nextCaptain !== undefined &&
                 !visited.has(stateRefKey(nextCaptain.ref))) {
                 queue.push({ captain: nextCaptain, following });
@@ -1508,80 +1989,24 @@ async function probePlaybookOutcome(machine, playbook, refs, captains, outcome,
             `state ${playbook.ref.stableId} declares no nested playbook ${outcome} transition`,
         ];
     }
-    const actorId = invocationActorId(machine, playbook);
-    const dynamic = dynamicPlaybookFields(playbook);
-    const entry = dynamic === undefined
-        ? undefined
-        : playbookEntryPlan(machine, playbook, refs, captains, dynamic);
-    if (dynamic !== undefined && entry === undefined) {
-        return [
-            `state ${playbook.ref.stableId}: dynamic nested playbook has no reachable Captain entry transition`,
-        ];
-    }
-    const entryRef = entry?.captain.ref ?? playbook.ref;
-    const entryId = entry === undefined
-        ? interruptTargetForRef(playbook.ref, playbook.ref.stableId)
-        : captainInterruptTarget(entry.captain);
-    const drive = interruptDriveForRef(machine, refs, entryRef, entryId, interruptValues);
-    const input = playbookCoverageInput(machine, playbook, dynamic);
-    const expectedPlaybookId = typeof input?.playbookId === 'string'
-        ? input.playbookId
-        : COVERAGE_PLAYBOOK_ID;
-    const fixedEvent = {
-        type: `xstate.${outcome === 'onDone' ? 'done' : 'error'}.actor.${actorId}`,
-        actorId,
-    };
-    const context = initializedCoverageContext(machine, dynamic);
-    const candidateValues = refs.flatMap((ref) => [
-        ref.key,
-        ref.stableId,
-        ...(ref.configId === undefined ? [] : [ref.configId]),
-    ]);
+    const node = { kind: 'child', value: playbook };
+    const candidateValues = [
+        ...interruptValues,
+        ...refs.flatMap((ref) => [
+            ref.key,
+            ref.stableId,
+            ...(ref.configId === undefined ? [] : [ref.configId]),
+        ]),
+    ];
     const findings = [];
     for (const [armIndex, arm] of rawArms.entries()) {
+        await coverageYield();
         const rawGuard = armGuard(arm);
         if (rawGuard !== undefined &&
             resolveGuard(machine, rawGuard) === undefined) {
             findings.push(`state ${playbook.ref.stableId}: nested playbook ${outcome} arm ${armIndex} names an unresolvable guard "${guardLabel(rawGuard)}"`);
             continue;
         }
-        const guard = orderedArmPredicate(machine, rawArms, armIndex);
-        if (guard === undefined)
-            continue;
-        let scriptedResult;
-        if (outcome === 'onDone') {
-            const outputs = [
-                nestedSuccessOutput(),
-                // A resolved promise may still return a value rejected by the linked
-                // runtime's output validator; fallback arms must be independently
-                // selectable and driven as well.
-                { invalidCoverageOutput: undefined },
-            ];
-            for (const base of outputs) {
-                const assignment = probeGuardAssignment(guard.run, fixedEvent, [{ eventField: 'output', tag: 'o:', base }], [...guard.probeValues, ...candidateValues], { initialContext: context, assignContext: false });
-                if (assignment !== undefined) {
-                    scriptedResult = assignedPayload(base, assignment, 'o:');
-                    break;
-                }
-            }
-        }
-        else {
-            const errors = [
-                nestedFailure(expectedPlaybookId),
-                new Error('coverage: generic nested playbook failure'),
-            ];
-            for (const base of errors) {
-                const assignment = probeGuardAssignment(guard.run, fixedEvent, [{ eventField: 'error', tag: 'r:', base, varyExisting: true }], [...guard.probeValues, ...candidateValues], { initialContext: context, assignContext: false });
-                if (assignment !== undefined) {
-                    scriptedResult = assignedPayload(base, assignment, 'r:');
-                    break;
-                }
-            }
-        }
-        if (scriptedResult === undefined) {
-            findings.push(`state ${playbook.ref.stableId}: nested playbook ${outcome} arm ${armIndex} is unsatisfiable under probing`);
-            continue;
-        }
         const rawTarget = rawArmTarget(arm);
         const target = rawTarget === undefined
             ? undefined
@@ -1594,49 +2019,129 @@ async function probePlaybookOutcome(machine, playbook, refs, captains, outcome,
             findings.push(`state ${playbook.ref.stableId}: nested playbook ${outcome} arm ${armIndex} does not leave the call state`);
             continue;
         }
-        const gate = { armed: false };
-        let calls = 0;
-        const actor = makeActor(machine, entry === undefined
-            ? () => null
-            : onceScript(entry.captain.binding.sourceItem, entry.output, gate), (actorInput, invokedActorId) => {
-            if (!gate.armed ||
-                calls > 0 ||
-                invokedActorId !== actorId ||
-                actorInput.stateId !== playbook.ref.stableId ||
-                (dynamic !== undefined &&
-                    (actorInput.playbookId !== COVERAGE_PLAYBOOK_ID ||
-                        actorInput.text !== COVERAGE_PLAYBOOK_INPUT))) {
-                return null;
-            }
-            calls++;
-            return scriptedResult;
-        }, drive.context);
-        gate.armed = true;
-        actor.send(drive.event);
-        let enteredCall = false;
-        const settled = await settle(actor, (snapshot) => {
-            if (atState(playbook.ref)(snapshot))
-                enteredCall = true;
-            return ((calls === 1 && atState(target)(snapshot)) ||
-                (calls === 0 && actor.coverageErrors.length > 0) ||
-                (enteredCall && calls === 0 && leftState(playbook.ref)(snapshot)));
+        let satisfiable = false;
+        const result = await searchCoverageEntry(machine, node, refs, captains, playbookRefs(machine.config), candidateValues, async (actor, pending) => {
+            const outputs = coverageArmResults(machine, node, outcome, armIndex, actor.getSnapshot().context, pending.input, candidateValues, undefined, undefined, false, true);
+            if (outputs.length === 0)
+                return false;
+            satisfiable = true;
+            pending.complete(outputs[0]);
+            return await settle(actor, atState(target), PARALLEL_SETTLE_MS);
         });
-        const finalSnapshot = actor.getSnapshot();
-        const observedStartFailure = actor.coverageErrors.find(({ eventType }) => eventType === `xstate.error.actor.${actorId}` || calls === 0);
-        const inputFailure = calls === 0
-            ? observedStartFailure === undefined
-                ? finalSnapshot.status === 'error'
-                    ? coverageErrorMessage(finalSnapshot.error)
-                    : playbookInputFailure(playbook, finalSnapshot.context)
-                : coverageErrorMessage(observedStartFailure.error)
-            : undefined;
-        actor.stop();
-        if (inputFailure !== undefined) {
-            findings.push(`state ${playbook.ref.stableId}: nested playbook actor failed to start during ${outcome} coverage: ${inputFailure}`);
+        if (result.covered)
             continue;
+        const label = `state ${playbook.ref.stableId}: nested playbook ${outcome} arm ${armIndex}`;
+        if (result.limitation !== undefined)
+            findings.push(`${label}: ${result.limitation}`);
+        else if (result.inputFailure !== undefined && !result.entered)
+            findings.push(`state ${playbook.ref.stableId}: nested playbook actor failed to start during ${outcome} coverage: ${result.inputFailure}`);
+        else if (!result.entered)
+            findings.push(`${label} has no reachable entry under probing (dead or unsupported entry path)`);
+        else if (!satisfiable)
+            findings.push(`${label} is unsatisfiable under probing`);
+        else
+            findings.push(`${label} did not reach ${target.stableId}`);
+    }
+    return findings;
+}
+/** No preemption is needed to audit ordinary acting outcomes and one reply. */
+async function probeNonPreemptiveActor(machine, captain, refs, captains, playbooks, candidates) {
+    const node = { kind: 'acting', value: captain };
+    const findings = [];
+    const stateId = captainPublicStateId(captain);
+    const label = `state ${stateId}`;
+    const search = (check) => searchCoverageEntry(machine, node, refs, captains, playbooks, candidates, check);
+    const detail = (result) => result.limitation ??
+        (result.inputFailure !== undefined
+            ? `actor failed to start: ${result.inputFailure}`
+            : result.entered
+                ? 'no candidate completed at the declared target under reached-context probing'
+                : 'no reachable entry under probing (dead or unsupported entry path)');
+    for (const key of Object.keys(captain.binding.result)) {
+        await coverageYield();
+        const check = (blankReply) => search(async (actor, pending) => {
+            for (const [index, arm] of transitionArms(captain.invocation.onDone).entries()) {
+                const outputs = coverageArmResults(machine, node, 'onDone', index, actor.getSnapshot().context, pending.input, candidates, undefined, key, false, true);
+                if (outputs.length === 0)
+                    continue;
+                const targetName = rawArmTarget(arm);
+                const target = targetName === undefined
+                    ? undefined
+                    : stateRefForTarget(refs, targetName, captain.ref);
+                if (target === undefined || sameStateRef(target, captain.ref))
+                    return false;
+                pending.complete(outputs[0]);
+                if (!(await settle(actor, atState(target), PARALLEL_SETTLE_MS)))
+                    return false;
+                if (key !== NEEDS_BOSS_REPLY)
+                    return true;
+                if (target.stableId !== AWAIT_BOSS_REPLY_STATE &&
+                    !tagsOf(target.state).includes('playbook.parked'))
+                    return false;
+                if (!blankReply && target.stableId !== AWAIT_BOSS_REPLY_STATE) {
+                    actor.send({
+                        type: BOSS_REPLY_EVENT,
+                        questionId: 'coverage-unknown-question',
+                        answer: 'This answer belongs to no pending branch.',
+                    });
+                    await settleNoTransition();
+                    if (!atState(target)(actor.getSnapshot()))
+                        return false;
+                }
+                actor.send({
+                    type: BOSS_REPLY_EVENT,
+                    questionId: stateId,
+                    answer: blankReply ? '   ' : 'Proceed as planned.',
+                });
+                if (blankReply) {
+                    await settleNoTransition();
+                    return !atState(captain.ref)(actor.getSnapshot());
+                }
+                return await settle(actor, atState(captain.ref), PARALLEL_SETTLE_MS);
+            }
+            return false;
+        });
+        const result = await check(false);
+        if (!result.covered)
+            findings.push(`${label}: result "${key}" remains unproved: ${detail(result)}`);
+        if (key === NEEDS_BOSS_REPLY && result.covered) {
+            const blank = await check(true);
+            if (!blank.covered)
+                findings.push(`${label}: a blank ${BOSS_REPLY_EVENT} answer must not resume the state (${detail(blank)})`);
         }
-        if (!settled || calls !== 1 || !atState(target)(finalSnapshot)) {
-            findings.push(`state ${playbook.ref.stableId}: nested playbook ${outcome} arm ${armIndex} did not reach ${target.stableId}`);
+    }
+    for (const outcome of ['onDone', 'onError']) {
+        await coverageYield();
+        const arms = transitionArms(captain.invocation[outcome]);
+        if (outcome === 'onError' && arms.length === 0)
+            findings.push(`${label} declares no onError transition`);
+        for (const [index, arm] of arms.entries()) {
+            await coverageYield();
+            const rawGuard = armGuard(arm);
+            if (outcome === 'onDone' && rawGuard === undefined)
+                continue;
+            if (rawGuard !== undefined &&
+                resolveGuard(machine, rawGuard) === undefined) {
+                findings.push(`${label}: ${outcome} arm ${index} names an unresolvable guard "${guardLabel(rawGuard)}"`);
+                continue;
+            }
+            const targetName = rawArmTarget(arm);
+            const target = targetName === undefined
+                ? undefined
+                : stateRefForTarget(refs, targetName, captain.ref);
+            if (target === undefined || sameStateRef(target, captain.ref)) {
+                findings.push(`${label}: ${outcome} arm ${index} has no distinct observable target`);
+                continue;
+            }
+            const result = await search(async (actor, pending) => {
+                const outputs = coverageArmResults(machine, node, outcome, index, actor.getSnapshot().context, pending.input, candidates, undefined, undefined, true, true);
+                if (outputs.length === 0)
+                    return false;
+                pending.complete(outputs[0]);
+                return await settle(actor, atState(target), PARALLEL_SETTLE_MS);
+            });
+            if (!result.covered)
+                findings.push(`${label}: ${outcome} arm ${index} remains unproved: ${detail(result)}`);
         }
     }
     return findings;
@@ -1726,6 +2231,7 @@ async function probeParallelJoins(machine, parallel, refs, captains, interruptVa
     const normalizedTargets = arms.map((arm) => rawArmTarget(arm) ?? null);
     const findings = [];
     for (const [armIndex, rawTarget] of normalizedTargets.entries()) {
+        await coverageYield();
         if (rawTarget === null) {
             findings.push(`parallel state ${parallel.stableId}: onDone join arm ${armIndex} coverage is unsupported for a target-less arm`);
             continue;
@@ -1738,6 +2244,7 @@ async function probeParallelJoins(machine, parallel, refs, captains, interruptVa
         }
         let exercised = false;
         for (const combination of outputs) {
+            await coverageYield();
             const entries = branches.map((captain, index) => ({
                 captain,
                 output: combination[index],
@@ -1769,7 +2276,6 @@ async function probeParallelJoins(machine, parallel, refs, captains, interruptVa
 export function fsmCoverageTestTimeout(fsmModule) {
     const machine = findMachine(fsmModule);
     const config = machine.config;
-    const states = (config.states ?? {});
     const refs = stateRefs(config);
     const captains = captainRefs(config);
     const playbooks = playbookRefs(config);
@@ -1777,54 +2283,96 @@ export function fsmCoverageTestTimeout(fsmModule) {
     const controller = isControllerMachine(config);
     const rootInterruptProbes = transitionArms((config.on ?? {})[INTERRUPT_EVENT]).length;
     const rootSettles = rootInterruptProbes * SETTLE_MS;
-    const initial = typeof config.initial === 'string' ? config.initial : undefined;
     const entryEvents = new Set([
-        ...Object.keys(initial === undefined ? {} : (states[initial]?.on ?? {})),
+        ...initialActiveRefs(config, refs).flatMap((ref) => Object.keys(ref.state.on ?? {})),
         ...Object.keys(config.on ?? {}),
     ]);
     entryEvents.delete(INTERRUPT_EVENT);
     const entrySettles = entryEvents.size * SETTLE_MS;
     let captainSettles = 0;
     let guardProbeCalls = rootInterruptProbes;
+    let pathSearches = controller
+        ? 0
+        : playbooks.reduce((total, playbook) => total +
+            transitionArms(playbook.invocation.onDone).length +
+            transitionArms(playbook.invocation.onError).length, 0);
     for (const captain of captains) {
         const resultKeys = Object.keys(captain.binding.result);
+        const guardedDoneArms = transitionArms(captain.invocation.onDone).filter((arm) => armGuard(arm) !== undefined).length;
+        const errorArms = transitionArms(captain.invocation.onError).length;
+        if (!controller && rootInterruptProbes === 0) {
+            pathSearches +=
+                resultKeys.length +
+                    (resultKeys.includes(NEEDS_BOSS_REPLY) ? 1 : 0) +
+                    guardedDoneArms +
+                    errorArms;
+            continue;
+        }
         captainSettles +=
             resultKeys.reduce((total, key) => total + (key === NEEDS_BOSS_REPLY ? 4 : controller ? 2 : 1), 0) * SETTLE_MS;
         // One directly selectable onError arm is driven.
         captainSettles += SETTLE_MS;
-        const guardedDoneArms = transitionArms(captain.invocation.onDone).filter((arm) => armGuard(arm) !== undefined).length;
-        const errorArms = transitionArms(captain.invocation.onError).length;
-        // Result acceptance probes each guarded arm once, then the arm audit probes
-        // every result's structured and bare output forms.
-        guardProbeCalls += resultKeys.length * guardedDoneArms * 3 + errorArms;
+        // Acceptance includes ordered fallbacks. Script arm probes have one zero
+        // status and a capped set of nonzero statuses; ordinary actors also probe
+        // malformed bare outputs for defensive arms.
+        const resultCandidates = captain.binding.actor === 'script'
+            ? 1 + MAX_SCRIPT_EXIT_STATUSES
+            : resultKeys.length;
+        guardProbeCalls +=
+            resultCandidates * transitionArms(captain.invocation.onDone).length +
+                guardedDoneArms *
+                    (captain.binding.actor === 'script'
+                        ? resultCandidates
+                        : resultKeys.length * 2) +
+                errorArms;
         // Every result, the blank Boss-reply check, and onError enter through an
         // independently context-probed interrupt plan.
         guardProbeCalls +=
             resultKeys.length + (resultKeys.includes(NEEDS_BOSS_REPLY) ? 1 : 0) + 1;
     }
-    guardProbeCalls += playbooks.reduce((total, playbook) => total +
-        transitionArms(playbook.invocation.onDone).length +
-        transitionArms(playbook.invocation.onError).length, 0);
-    // Nested success/error and parallel question/join helpers each reuse one
-    // context-probed entry plan per state and outcome.
-    guardProbeCalls += 2 * playbooks.length + 2 * parallels.length;
-    const playbookSettles = playbooks.reduce((total, playbook) => total +
-        (transitionArms(playbook.invocation.onDone).length +
-            transitionArms(playbook.invocation.onError).length) *
-            SETTLE_MS, 0);
+    const nodes = coverageNodes(captains, playbooks);
+    const entryArmCount = [
+        config.on ?? {},
+        ...initialActiveRefs(config, refs).map((ref) => ref.state.on ?? {}),
+    ].reduce((total, events) => total +
+        Object.values(events).reduce((count, arms) => count + transitionArms(arms).length, 0), 0);
+    const maxNodeCandidates = Math.max(0, ...nodes.map((node) => {
+        const done = transitionArms(node.value.invocation.onDone).length;
+        const error = transitionArms(node.value.invocation.onError).length;
+        if (node.kind === 'child')
+            return 3 * (done + error);
+        const keys = Object.keys(node.value.binding.result);
+        const candidates = node.value.binding.actor === 'script'
+            ? keys.length * MAX_SCRIPT_EXIT_STATUSES
+            : 2 * keys.length;
+        // Target malformed-output probes and predecessor question revisits both
+        // fit this allowance; real searches stop early on a satisfying target.
+        return (done * (candidates + (keys.includes(NEEDS_BOSS_REPLY) ? 1 : 0)) + error);
+    }));
+    guardProbeCalls +=
+        pathSearches *
+            (nodes.length * (1 + entryArmCount) +
+                MAX_COVERAGE_PATH_ATTEMPTS * 2 * maxNodeCandidates);
+    // Parallel question/join helpers retain their independent entry probes.
+    guardProbeCalls += 2 * parallels.length;
+    // Each charged replay contains at most eight invocation waits, one parked
+    // question wait and two target/reply settles, plus no-transition checks.
+    const pathSettles = pathSearches *
+        MAX_COVERAGE_PATH_ATTEMPTS *
+        ((MAX_COVERAGE_PATH_STEPS + 3) * PARALLEL_SETTLE_MS + 2 * 10);
     const parallelSettles = parallels.reduce((total, parallel) => total +
         2 * PARALLEL_QUESTION_SETTLE_MS +
         transitionArms(parallel.state.onDone).length *
             MAX_PARALLEL_COMBINATIONS *
             PARALLEL_SETTLE_MS, 0);
     const guardAllowance = guardProbeCalls * Math.ceil(MAX_PROBES / PROBES_PER_TIMEOUT_MILLISECOND);
-    return Math.max(MIN_COVERAGE_TEST_TIMEOUT_MS, rootSettles +
+    return Math.min(MAX_COVERAGE_TEST_TIMEOUT_MS, Math.max(MIN_COVERAGE_TEST_TIMEOUT_MS, rootSettles +
         entrySettles +
         captainSettles +
-        playbookSettles +
+        pathSettles +
         parallelSettles +
         guardAllowance +
-        COVERAGE_TIMEOUT_MARGIN_MS);
+        COVERAGE_TIMEOUT_MARGIN_MS));
 }
 /**
  * Checks transition coverage over a compiled `playbook` artifact's machine
@@ -1834,6 +2382,34 @@ export function fsmCoverageTestTimeout(fsmModule) {
  * surface entirely, in which case interrupt coverage is skipped.
  */
 export async function checkFsmCoverage(fsmModule, opts = {}) {
+    opts.signal?.throwIfAborted();
+    if (opts.timeoutMs !== undefined &&
+        (!Number.isFinite(opts.timeoutMs) || opts.timeoutMs <= 0))
+        throw new RangeError('FSM coverage timeout must be a positive finite number');
+    const started = performance.now();
+    const run = {
+        signal: opts.signal,
+        deadline: started +
+            Math.min(opts.timeoutMs ?? Infinity, MAX_COVERAGE_TEST_TIMEOUT_MS),
+        lastYield: started,
+        actors: new Set(),
+    };
+    return coverageRuns.run(run, async () => {
+        let completed = false;
+        try {
+            run.deadline = Math.min(run.deadline, started + fsmCoverageTestTimeout(fsmModule));
+            await coverageYield(true);
+            const findings = await runFsmCoverage(fsmModule, opts.sourceText ?? '');
+            await coverageYield(true);
+            completed = true;
+            return findings;
+        }
+        finally {
+            stopCoverageActors(run.actors, !completed);
+        }
+    });
+}
+async function runFsmCoverage(fsmModule, sourceText) {
     const findings = [];
     const machine = findMachine(fsmModule);
     const config = machine.config;
@@ -1843,8 +2419,8 @@ export async function checkFsmCoverage(fsmModule, opts = {}) {
     const playbooks = playbookRefs(config);
     const captainByRef = new Map(captains.map((captain) => [stateRefKey(captain.ref), captain]));
     const sourceCandidates = [
-        ...identifierLiterals(opts.sourceText ?? ''),
-        ...numericLiterals(opts.sourceText ?? ''),
+        ...identifierLiterals(sourceText),
+        ...numericLiterals(sourceText),
     ];
     const isController = isControllerMachine(config);
     const controllerNearMisses = captains.flatMap((captain) => {
@@ -1861,12 +2437,14 @@ export async function checkFsmCoverage(fsmModule, opts = {}) {
     const parallelRefs = refs.filter((ref) => ref.state.type === 'parallel');
     findings.push(...repeatedParallelRoleFindings(refs, captains));
     for (const { captain, nearMiss } of controllerNearMisses) {
+        await coverageYield();
         const detail = nearMiss.missing.length > 0
             ? `missing ${JSON.stringify(nearMiss.missing[0])}`
             : `extra ${JSON.stringify(nearMiss.extra[0])}`;
         findings.push(`state ${captain.binding.stateId}: controller decision contract near-miss (${detail}); the controller domain requires exactly ${CONTROLLER_ACTION_GUARDS.join(', ')}`);
     }
     for (const ref of parallelRefs) {
+        await coverageYield();
         if (!normalizeArms(ref.state.onDone).some((arm) => arm.target !== null)) {
             findings.push(`parallel state ${ref.stableId} declares no onDone join`);
         }
@@ -1907,11 +2485,13 @@ export async function checkFsmCoverage(fsmModule, opts = {}) {
     if (!canJump && handlesInterruptSomewhere && !controllerContractCandidate) {
         findings.push(`machine declares no root ${INTERRUPT_EVENT} event`);
     }
-    if (canJump && !isController) {
+    if (!isController) {
         for (const playbook of playbooks) {
+            await coverageYield();
             findings.push(...(await probePlaybookInvocation(machine, playbook, refs, captains, sourceCandidates)));
         }
-        for (const parallel of parallelRefs) {
+        for (const parallel of canJump ? parallelRefs : []) {
+            await coverageYield();
             findings.push(...(await probeParallelQuestions(machine, parallel, refs, captains, sourceCandidates)), ...(await probeParallelJoins(machine, parallel, refs, captains, sourceCandidates)));
         }
     }
@@ -1928,6 +2508,7 @@ export async function checkFsmCoverage(fsmModule, opts = {}) {
     // captain state parks in it).
     if (canJump) {
         for (const [armIndex, arm] of rootArms.entries()) {
+            await coverageYield();
             if (arm.target === null)
                 continue;
             const target = stateRefForTarget(refs, arm.target);
@@ -1962,6 +2543,7 @@ export async function checkFsmCoverage(fsmModule, opts = {}) {
     const initialRef = initialPath.at(-1);
     const entryArms = Object.assign({}, config.on ?? {}, ...initialPath.map((ref) => ref.state.on ?? {}));
     for (const [event, raw] of Object.entries(entryArms)) {
+        await coverageYield();
         if (event === INTERRUPT_EVENT)
             continue;
         const arms = normalizeArms(raw);
@@ -1991,8 +2573,11 @@ export async function checkFsmCoverage(fsmModule, opts = {}) {
     if (unsupportedController)
         return findings;
     for (const captain of captains) {
-        if (!canJump && !isController)
-            break;
+        await coverageYield();
+        if (!canJump && !isController) {
+            findings.push(...(await probeNonPreemptiveActor(machine, captain, refs, captains, playbooks, [...stateCandidates, ...sourceCandidates])));
+            continue;
+        }
         const state = captain.binding;
         const stateKey = state.stateId;
         const stateId = captainPublicStateId(captain);
@@ -2002,23 +2587,21 @@ export async function checkFsmCoverage(fsmModule, opts = {}) {
         const rawDoneArms = transitionArms(captain.invocation.onDone);
         const onDoneArms = normalizeArms(captain.invocation.onDone);
         const controllerResultByArm = new Map();
-        // Every declared result needs an arm that explicitly accepts its complete
-        // valid output. A sole unguarded arm accepts the whole local result
-        // contract; an array's unguarded arm is a fallback and cannot make an
-        // otherwise orphaned key look covered.
+        // Every declared result needs an ordered arm accepting its valid output.
+        // A fallback is reachable exactly when all preceding guards reject it.
+        // Result names alone cannot distinguish authored failure from an orphan.
         for (const key of Object.keys(state.result)) {
+            await coverageYield();
             const output = synthOutput(state, key);
             const accepting = new Map();
+            const acceptedOutputs = new Map();
             for (const [index, arm] of rawDoneArms.entries()) {
+                await coverageYield();
                 const target = onDoneArms[index]?.target ?? null;
                 const rawGuard = armGuard(arm);
-                if (rawGuard === undefined) {
-                    if (rawDoneArms.length === 1 && target !== null) {
-                        accepting.set(index, undefined);
-                    }
-                    continue;
-                }
-                if (target === null || resolveGuard(machine, rawGuard) === undefined) {
+                if (target === null ||
+                    (rawGuard !== undefined &&
+                        resolveGuard(machine, rawGuard) === undefined)) {
                     continue;
                 }
                 const guard = orderedArmPredicate(machine, rawDoneArms, index);
@@ -2029,8 +2612,18 @@ export async function checkFsmCoverage(fsmModule, opts = {}) {
                     if (assignment !== undefined)
                         accepting.set(index, assignment);
                 }
-                else if (doneGuardSatisfiable(guard, doneEvent, output, candidates)) {
-                    accepting.set(index, undefined);
+                else {
+                    const outputs = resultOutputCandidates(state, key, [
+                        ...(resolveGuard(machine, rawGuard)?.probeValues ?? []),
+                        ...candidates,
+                    ]);
+                    for (const candidate of outputs) {
+                        await coverageYield();
+                        if (doneGuardSatisfiable(guard, doneEvent, candidate, candidates, state.actor === 'script')) {
+                            accepting.set(index, undefined);
+                            acceptedOutputs.set(JSON.stringify(candidate), candidate);
+                        }
+                    }
                 }
             }
             if (accepting.size === 0) {
@@ -2058,37 +2651,15 @@ export async function checkFsmCoverage(fsmModule, opts = {}) {
                 // initial context is a known accepting arm. Encountering an unresolved
                 // guard first makes driving unsafe: XState reports that error
                 // asynchronously, so the arm audit below owns the finding (c887fc4).
-                let safeToDrive = true;
-                for (const [index, arm] of rawDoneArms.entries()) {
-                    const rawGuard = armGuard(arm);
-                    if (rawGuard === undefined) {
-                        directArm = index;
-                        break;
-                    }
-                    const guard = resolveGuard(machine, rawGuard);
-                    if (guard === undefined) {
-                        safeToDrive = false;
-                        break;
-                    }
-                    try {
-                        if (guard.run({
-                            context: initialCoverageContext,
-                            event: { ...doneEvent, output },
-                        })) {
-                            directArm = index;
-                            break;
-                        }
-                    }
-                    catch {
-                        safeToDrive = false;
+                for (const candidate of acceptedOutputs.values()) {
+                    await coverageYield();
+                    const selected = directlySelectedArm(machine, captain, candidate, initialCoverageContext);
+                    if (selected !== undefined && accepting.has(selected)) {
+                        directArm = selected;
+                        drivenOutput = candidate;
                         break;
                     }
                 }
-                if (!safeToDrive ||
-                    directArm === undefined ||
-                    !accepting.has(directArm)) {
-                    continue;
-                }
             }
             if (directArm === undefined) {
                 continue;
@@ -2216,9 +2787,11 @@ export async function checkFsmCoverage(fsmModule, opts = {}) {
             actor.stop();
         }
         // Every onDone arm is satisfiable under the actual done-event identity.
-        // Try each key's full output and bare malformed form; neither probe may
-        // invent a different event type or actor id.
+        // Ordinary actors also probe bare malformed forms for authored defensive
+        // arms. Scripts resolve only their exact runtime guard/exit-status pair;
+        // invented payload fields or impossible statuses cannot cover an arm.
         for (const [index, arm] of rawDoneArms.entries()) {
+            await coverageYield();
             const rawGuard = armGuard(arm);
             if (rawGuard === undefined)
                 continue;
@@ -2232,8 +2805,15 @@ export async function checkFsmCoverage(fsmModule, opts = {}) {
             // ordered reachability of later arms unsafe to evaluate.
             if (guard === undefined)
                 continue;
-            const anyOutput = Object.keys(state.result).some((key) => doneGuardSatisfiable(guard, doneEvent, synthOutput(state, key), candidates) ||
-                doneGuardSatisfiable(guard, doneEvent, { guard: key }, candidates));
+            const anyOutput = Object.keys(state.result).some((key) => {
+                const outputs = resultOutputCandidates(state, key, [
+                    ...declaredGuard.probeValues,
+                    ...candidates,
+                ]);
+                return (outputs.some((candidate) => doneGuardSatisfiable(guard, doneEvent, candidate, candidates, state.actor === 'script')) ||
+                    (state.actor !== 'script' &&
+                        doneGuardSatisfiable(guard, doneEvent, { guard: key }, candidates)));
+            });
             if (!anyOutput) {
                 findings.push(`state ${stateKey}: onDone arm ${index} (target ${onDoneArms[index]?.target ?? 'none'}) is unsatisfiable under probing`);
             }
@@ -2250,6 +2830,7 @@ export async function checkFsmCoverage(fsmModule, opts = {}) {
         const forcedError = new Error('coverage: forced captain failure');
         let hasUnresolvableErrorGuard = false;
         for (const [index, arm] of rawErrorArms.entries()) {
+            await coverageYield();
             const rawGuard = armGuard(arm);
             if (rawGuard !== undefined) {
                 const declaredGuard = resolveGuard(machine, rawGuard);
@@ -2271,6 +2852,7 @@ export async function checkFsmCoverage(fsmModule, opts = {}) {
         let directErrorArm;
         let errorDriveSafe = true;
         for (const [index, arm] of rawErrorArms.entries()) {
+            await coverageYield();
             const rawGuard = armGuard(arm);
             if (rawGuard === undefined) {
                 directErrorArm = index;
@@ -2291,9 +2873,13 @@ export async function checkFsmCoverage(fsmModule, opts = {}) {
                 }
             }
             catch {
+                coverageCheckpoint();
                 errorDriveSafe = false;
                 break;
             }
+            finally {
+                coverageCheckpoint();
+            }
         }
         if (!errorDriveSafe || directErrorArm === undefined)
             continue;