better-dsh 0.3.0 → 0.3.1-a

package/lib/index.js

@@ -1,17 +1,16 @@
 import { t as Schema } from "./lib-C8_jXvwA.js";
 import { a as RESERVED_ERROR_MEMBERS, i as RESERVED_BINDING_GLOBALS, n as DUNDER_MEMBER, o as ReplRuntime, r as PORTABLE_RESERVED_WORDS, t as isFlatBindableName } from "./py-sdk-D7klhpWb.js";
-import { s as resolveKernelEnv } from "./kernel-env-D8UOWeji.js";
+import { n as resolveKernelEnv } from "./kernel-env-x_WkG6Fr.js";
 import { t as captureAllTools } from "./native-capture-BEByDXYM.js";
 import { createRequire } from "node:module";
-import { randomBytes, randomUUID } from "node:crypto";
-import { spawn } from "node:child_process";
-import { join } from "node:path";
-import { fileURLToPath } from "node:url";
 import { Context } from "@deepseek-ai/cordis";
-import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
-import { tmpdir } from "node:os";
-import { setTimeout as setTimeout$1 } from "node:timers/promises";
+import { createHash, randomBytes, randomUUID } from "node:crypto";
+import { existsSync, mkdirSync, readFileSync, rmSync } from "node:fs";
+import { join } from "node:path";
+import { spawn } from "node:child_process";
+import { createServer } from "node:http";
 import { createInterface } from "node:readline";
+import { fileURLToPath } from "node:url";
 import { TOOL_RUNTIME_SCHEDULER, defineTool } from "@deepseek-ai/dsh-tools";
 import * as dshLlm from "@deepseek-ai/dsh-llm";
 import { BlockAssembler, HarnessError, createUserMessage } from "@deepseek-ai/dsh-llm";
@@ -175,870 +174,32 @@ function snapshotJsonValue(value) {
 	return walkJsonValue(value, true);
 }
 
-//#endregion
-//#region src/kernel-transport.ts
-/** The bridge script shipped beside the built entry (`lib/kernel-bridge.py`). */
-const BRIDGE_SCRIPT = fileURLToPath(new URL("./kernel-bridge.py", import.meta.url));
-/**
-* One bridge subprocess speaking JSON lines. Lifecycle is owned by the caller
-* (the kernel bridge registers it as an `ctx.effect`); this type installs no
-* process-level signal handlers.
-*/
-var KernelTransport = class {
-	child;
-	reader;
-	startup = false;
-	closed = false;
-	readySettled = false;
-	readyResolve;
-	readyReject;
-	bridgeStderr = "";
-	handlers = /* @__PURE__ */ new Set();
-	waiters = /* @__PURE__ */ new Set();
-	constructor(options) {
-		this.options = options;
-	}
-	/** Spawn the bridge and resolve once it reports the channels are up. */
-	async start() {
-		if (this.reader !== void 0) return;
-		if (this.closed) throw new Error("kernel transport is closed");
-		const child = spawn(this.options.python, [BRIDGE_SCRIPT, this.options.connectionFile], {
-			...this.options.cwd === void 0 ? {} : { cwd: this.options.cwd },
-			env: {
-				PATH: process.env.PATH ?? "/usr/local/bin:/usr/bin:/bin",
-				LANG: "C.UTF-8",
-				HOME: process.env.HOME ?? tmpdir(),
-				PYTHONUNBUFFERED: "1"
-			},
-			stdio: [
-				"pipe",
-				"pipe",
-				"pipe"
-			]
-		});
-		this.child = child;
-		this.startup = true;
-		const ready = new Promise((resolve$1, reject) => {
-			this.readyResolve = resolve$1;
-			this.readyReject = reject;
-		});
-		const timer = setTimeout(() => {
-			this.failReady(/* @__PURE__ */ new Error(`kernel bridge did not report ready within ${this.options.readyTimeoutMs}ms; stderr tail:\n${this.stderrTail()}`));
-		}, this.options.readyTimeoutMs);
-		timer.unref?.();
-		child.stderr?.on("data", (buffer) => {
-			this.bridgeStderr += buffer.toString();
-		});
-		child.stdin?.on("error", (error) => {
-			this.bridgeStderr += `stdin error: ${error.code ?? error.message}\n`;
-			this.closed = true;
-			this.failWaiters();
-		});
-		child.stdout?.on("error", (error) => {
-			this.bridgeStderr += `stdout error: ${error.code ?? error.message}\n`;
-		});
-		child.on("error", (error) => {
-			this.bridgeStderr += `spawn error: ${error.message}\n`;
-			this.failReady(/* @__PURE__ */ new Error(`kernel bridge failed to spawn: ${error.message}`));
-			this.failWaiters();
-			this.failExit();
-		});
-		child.on("exit", (code, signal) => {
-			const detail = `kernel bridge exited (code=${String(code)} signal=${String(signal)})`;
-			this.bridgeStderr += `${detail}\n`;
-			this.closed = true;
-			this.failReady(/* @__PURE__ */ new Error(`${detail}; stderr tail:\n${this.stderrTail()}`));
-			this.failWaiters();
-			this.failExit();
-		});
-		if (child.stdout) {
-			this.reader = createInterface({ input: child.stdout });
-			this.reader.on("line", (line) => {
-				this.accept(line);
-			});
-		}
-		try {
-			await ready;
-		} finally {
-			clearTimeout(timer);
-			this.startup = false;
-		}
-	}
-	/** Whether the bridge process is still live. */
-	get alive() {
-		return this.child !== void 0 && this.child.exitCode === null && !this.closed;
-	}
-	/** The bridge's stderr tail, for startup and crash diagnostics. */
-	stderrTail() {
-		return this.bridgeStderr.slice(-1024) || "(empty)";
-	}
-	/** Register a message handler; the returned function removes it. */
-	onMessage(handler) {
-		this.handlers.add(handler);
-		return () => {
-			this.handlers.delete(handler);
-		};
-	}
-	/**
-	* Register a bridge-exit handler; the returned function removes it. A bridge
-	* that dies mid-cell must settle the active execution at once rather than at
-	* the cell budget.
-	*/
-	onExit(handler) {
-		this.exitHandlers.add(handler);
-		return () => {
-			this.exitHandlers.delete(handler);
-		};
-	}
-	exitHandlers = /* @__PURE__ */ new Set();
-	/** Notify exit handlers once per bridge process end. */
-	failExit() {
-		const handlers = [...this.exitHandlers];
-		this.exitHandlers.clear();
-		for (const handler of handlers) handler();
-	}
-	/** Send one message on the shell or control channel. */
-	send(channel, message) {
-		this.writeLine({
-			op: "send",
-			channel,
-			header: message.header,
-			content: message.content
-		});
-	}
-	/** Ask the kernel to interrupt the running cell (control channel). */
-	interrupt() {
-		this.writeLine({ op: "interrupt" });
-	}
-	/** Write one protocol line, refusing instead of throwing when the pipe is gone. */
-	writeLine(payload) {
-		const stdin = this.child?.stdin;
-		if (stdin === null || stdin === void 0 || this.closed || !stdin.writable) throw new Error("kernel bridge is not connected");
-		stdin.write(`${JSON.stringify(payload)}\n`);
-	}
-	/**
-	* Wait for the next message on `channel` matching `match`.
-	* @returns The message, or null when the budget expires or the bridge dies.
-	*/
-	waitFor(channel, match, timeoutMs) {
-		if (this.closed) return Promise.resolve(null);
-		return new Promise((resolve$1) => {
-			const waiter = {
-				channel,
-				match,
-				settle: (message) => {
-					clearTimeout(waiter.timer);
-					this.waiters.delete(waiter);
-					resolve$1(message);
-				},
-				timer: setTimeout(() => {
-					this.waiters.delete(waiter);
-					resolve$1(null);
-				}, timeoutMs)
-			};
-			waiter.timer.unref?.();
-			this.waiters.add(waiter);
-		});
-	}
-	/** Stop the bridge (graceful shutdown note, then kill). */
-	async dispose() {
-		const child = this.child;
-		this.closed = true;
-		this.failWaiters();
-		this.reader?.close();
-		this.reader = void 0;
-		if (child === void 0) return;
-		try {
-			if (child.stdin?.writable === true) child.stdin.write(`${JSON.stringify({ op: "shutdown" })}\n`);
-		} catch {}
-		try {
-			child.stdin?.end();
-		} catch {}
-		if (child.exitCode !== null) return;
-		await new Promise((resolve$1) => {
-			const timer = setTimeout(() => {
-				try {
-					child.kill("SIGKILL");
-				} catch {}
-				resolve$1();
-			}, 500);
-			timer.unref?.();
-			child.once("exit", () => {
-				clearTimeout(timer);
-				resolve$1();
-			});
-		});
-	}
-	failReady(error) {
-		if (this.readySettled) return;
-		this.readySettled = true;
-		this.readyReject?.(error);
-	}
-	failWaiters() {
-		for (const waiter of [...this.waiters]) waiter.settle(null);
-	}
-	/** Route one decoded line; unknown events are ignored. */
-	accept(line) {
-		let event;
-		try {
-			event = JSON.parse(line);
-		} catch {
-			return;
-		}
-		if (event.ev === "ready") {
-			if (!this.readySettled) {
-				this.readySettled = true;
-				this.readyResolve?.();
-			}
-			return;
-		}
-		if (event.ev === "msg") {
-			const channel = event.channel;
-			const raw = event.msg;
-			if (typeof channel !== "string" || raw === void 0 || typeof raw.header !== "object" || raw.header === null) return;
-			const message = {
-				header: raw.header,
-				parent_header: raw.parent_header ?? {},
-				content: raw.content ?? {}
-			};
-			for (const waiter of [...this.waiters]) if (waiter.channel === channel && waiter.match(message)) waiter.settle(message);
-			for (const handler of this.handlers) handler(channel, message);
-			return;
-		}
-		if (event.ev === "fatal") this.bridgeStderr += `fatal: ${String(event.message ?? "unknown")}\n`;
-	}
-};
-
 //#endregion
 //#region src/bootstrap.ts
-/**
-* Python-side bootstrap executed once as an internal cell right after kernel
-* startup. Seeds the user namespace with the host-request comm bridge
-* (`dashr.host` target, the PA `host_request()` pattern), the binding-proxy
-* factories, the typed rejection classes, and the lossless-JSON completion
-* encoder. Names are `_dashr`/`__dashr` prefixed (any case) so they are
-* excluded from namespace snapshots and never leak into user state.
-* @module dashr/bootstrap
-*/
-/** Comm target the kernel-side shim opens for typed host requests. */
-const HOST_COMM_TARGET = "dashr.host";
-/**
-* The bootstrap source. Kept dependency-free apart from `ast`, `asyncio`,
-* `json`, and `comm` (present by construction — it IS the kernel).
-*/
-const KERNEL_BOOTSTRAP = `
-import ast as _dashr_ast
-import json as _dashr_json
-
-
-def _dashr_install_control_comm_handlers():
-    # Host replies arrive as comm_msg on the CONTROL channel while the shell
-    # channel is busy executing our cell; teach the kernel to route them.
-    try:
-        from IPython import get_ipython
-    except Exception:
-        return
-    shell = get_ipython()
-    kernel = getattr(shell, 'kernel', None)
-    comm_manager = getattr(kernel, 'comm_manager', None)
-    control_handlers = getattr(kernel, 'control_handlers', None)
-    if comm_manager is None or not isinstance(control_handlers, dict):
-        return
-    control_handlers.setdefault('comm_msg', comm_manager.comm_msg)
-    control_handlers.setdefault('comm_close', comm_manager.comm_close)
-
-
-def _dashr_install_interrupt():
-    # ipykernel's async-cell SIGINT handling only schedules a callback on the
-    # kernel event loop, and a non-yielding cell ('while True: pass') blocks
-    # that very loop, so the control-channel interrupt can never break it.
-    # SIGALRM is untouched by ipykernel: raising KeyboardInterrupt from its
-    # handler breaks any cell, and the host sends it (after a confirm window,
-    # see the bridge) on timeout/abort. Best effort — where SIGALRM is
-    # unavailable the control-channel interrupt is all there is.
-    #
-    # The busy guard is load-bearing (M3-A, blueprint §5 "SIGALRM-at-idle 双重
-    # 窗口"): a KeyboardInterrupt raised OUTSIDE cell execution — while the
-    # kernel boots, idles between cells, or unwinds a finished one — escapes
-    # the shell's containment and terminates the process cleanly, which used
-    # to kill the kernel deterministically (10/10 same-tick aborts, 40/40
-    # during cold boot; dev/m2a-report.md §5.1). The handler therefore only
-    # raises while a dashr cell is actually executing, tracked by the
-    # module-level _dashr_state dict below and set/cleared by the run/snapshot
-    # cell scaffolds around their whole body. A stray SIGALRM outside that
-    # window is swallowed — the host's force-settle already resolves the run,
-    # and the kernel lives. The dict (not a bare flag) is captured by the
-    # handler closure, so user code rebinding the NAME cannot disarm the
-    # guard; mutating the dict itself stays possible and accepted — this shim
-    # is a capability seam, not a security boundary.
-    try:
-        import signal as _dashr_signal
-
-        def _dashr_on_sigalrm(_signum, _frame):
-            if not _dashr_state['executing']:
-                return
-            raise KeyboardInterrupt
-
-        _dashr_signal.signal(_dashr_signal.SIGALRM, _dashr_on_sigalrm)
-    except (ImportError, AttributeError, OSError, ValueError):
-        pass
-
-
-# The dashr busy-guard flag (see _dashr_install_interrupt): True for the whole
-# duration of a run or snapshot cell — the only window in which a SIGALRM may
-# raise KeyboardInterrupt. Lives at module (user-namespace) level so the cell
-# scaffolds can flip it; excluded from snapshots by the _dashr prefix rule.
-_dashr_state = {'executing': False}
-
-
-_dashr_install_interrupt()
-
-
-class _DashrRejected(Exception):
-    def __init__(self, message):
-        Exception.__init__(self, message)
-
-
-def _dashr_host_request(payload):
-    from comm import create_comm
-    import asyncio
-    _dashr_install_control_comm_handlers()
-    loop = asyncio.get_running_loop()
-    future = loop.create_future()
-    # primary=True publishes comm_open so the host learns this comm_id; the
-    # request itself travels as the first comm_msg.
-    comm = create_comm(target_name=${JSON.stringify(HOST_COMM_TARGET)})
-
-    def _resolve(action):
-        def _apply():
-            if future.done():
-                return
-            action()
-            comm.close()
-        # Replies arrive on the kernel's control channel, which may run off
-        # the event-loop thread; only call_soon_threadsafe may touch the
-        # future from there.
-        loop.call_soon_threadsafe(_apply)
-
-    def _on_msg(msg):
-        content = msg.get('content', {})
-        reply = content.get('data', {}) if isinstance(content, dict) else {}
-        if not isinstance(reply, dict) or future.done():
-            return
-        status = reply.get('status')
-        if status == 'ok':
-            _resolve(lambda: future.set_result(reply.get('result')))
-        elif status == 'error':
-            _resolve(lambda: future.set_exception(_DashrRejected(reply.get('error') or 'host request failed')))
-
-    comm.on_msg(_on_msg)
-    comm.send(dict(payload))
-    return future
-
-
-def _dashr_make_error_class(name, member_property):
-    def _init(self, message, member=None):
-        Exception.__init__(self, message)
-        if member is not None:
-            setattr(self, member_property, member)
-    return type(name, (Exception,), {'__init__': _init})
-
-
-def _dashr_make_proxy(global_name, function_name, error_class_name, member_property):
-    async def _dashr_proxy(*args, **kwargs):
-        if kwargs:
-            raise TypeError('dashr binding calls do not accept keyword arguments')
-        if len(args) == 1:
-            call_args = args[0]
-        elif len(args) == 0:
-            call_args = None
-        else:
-            call_args = list(args)
-        payload = {
-            'type': 'binding.call',
-            'global': global_name,
-            'name': function_name,
-            'args': call_args,
-        }
-        try:
-            return await _dashr_host_request(payload)
-        except _DashrRejected as rejected:
-            cls = globals().get(error_class_name) if error_class_name else None
-            if cls is None:
-                raise
-            raise cls(str(rejected), function_name) from None
-    return _dashr_proxy
-
-
-def _dashr_make_holder(global_name, error_class_name, member_property, members):
-    # Attribute misses travel to the host instead of raising AttributeError
-    # here: the host owns the namespace, so IT rejects an unknown member as an
-    # unknown binding rather than the kernel inventing a local error class.
-    class _DashrBindingHolder:
-        def __dir__(self):
-            # F9 (v0.2.0-a): introspection tells the truth — dir(tool) lists
-            # exactly the bound names. A custom __dir__ fully replaces the
-            # default object.__dir__, so no dunder noise leaks in.
-            return list(members)
-
-        def __getattr__(self, function_name):
-            return _dashr_make_proxy(
-                global_name,
-                function_name,
-                error_class_name,
-                member_property,
-            )
-
-    return _DashrBindingHolder()
-
-
-def _dashr_make_callable(global_name, function_name, error_class_name, member_property):
-    # A BARE callable global (the flat per-tool bindings AND the bridge
-    # tools: 'callable: true' on the namespace) instead of an object
-    # holder. The one-object form is the single convention: every callable
-    # takes exactly one positional arguments object (e.g.
-    # agent_message({'receiver': 'child', ...})), and keyword / multi-positional forms are
-    # rejected HERE, at the Python call boundary, so the introspectable
-    # signature tells the truth and a TypeError names the binding global
-    # (read(...) got an unexpected keyword argument ...). The wire envelope
-    # keeps the historical {'args': [...], 'kwargs': {}} shape so the host's
-    # parseReplCall / flatToolArgs / flatBridgeToolArgs validation layers stay
-    # authoritative and unchanged. The single functions-entry name is
-    # transport-only: the program never sees it, and a typed rejection
-    # carries the GLOBAL name as its member (for a flat tool binding the
-    # global IS the tool name the program knows). __name__/__qualname__ are
-    # pinned to the global name so introspection shows the binding's name,
-    # not the factory-local _dashr_callable.
-    async def _dashr_callable(args=None, /):
-        payload = {
-            'type': 'binding.call',
-            'global': global_name,
-            'name': function_name,
-            'args': {'args': [] if args is None else [args], 'kwargs': {}},
-        }
-        try:
-            return await _dashr_host_request(payload)
-        except _DashrRejected as rejected:
-            cls = globals().get(error_class_name) if error_class_name else None
-            if cls is None:
-                raise
-            raise cls(str(rejected), global_name) from None
-
-    _dashr_callable.__name__ = global_name
-    _dashr_callable.__qualname__ = global_name
-    return _dashr_callable
-
-
-class _DashrNoValue:
-    # Marks 'no completion value': a cell whose last statement is not an
-    # expression, or whose last expression evaluates to None — the REPL
-    # displayhook suppresses None (IPython behavior), so no value crosses.
-    __slots__ = ()
-
-
-_DASHR_NO_VALUE = _DashrNoValue()
-
-
-class _DashrTopLevelReturnChecker(_dashr_ast.NodeVisitor):
-    # A cell runs at module scope, like any native IPython cell: a top-level
-    # 'return'/'yield' is a SyntaxError decided by the kernel itself, exactly
-    # as in a real REPL. Nested scopes (functions, lambdas, classes) keep
-    # their own return semantics.
-    def visit_FunctionDef(self, node):
-        return
-
-    def visit_AsyncFunctionDef(self, node):
-        return
-
-    def visit_ClassDef(self, node):
-        return
-
-    def visit_Lambda(self, node):
-        return
-
-    def visit_Return(self, node):
-        raise SyntaxError("'return' outside function")
-
-    def visit_Yield(self, node):
-        raise SyntaxError("'yield' outside function")
-
-
-async def _dashr_run_program(source):
-    # Run one cell with the user namespace as BOTH globals and locals —
-    # module-scope REPL semantics: state persists across cells, top-level
-    # 'await' is legal (PyCF_ALLOW_TOP_LEVEL_AWAIT, the same mechanism IPython
-    # uses), a top-level 'return'/'yield' is a SyntaxError decided here by the
-    # kernel — exactly as in a native IPython cell — and the last expression's
-    # value is the cell's result (the REPL displayhook handoff).
-    import inspect as _dashr_inspect
-    user_ns = globals()
-    if not source.strip():
-        source = 'pass'
-    parsed = _dashr_ast.parse(source, '<dashr program>', 'exec')
-    _DashrTopLevelReturnChecker().visit(parsed)
-    body = parsed.body
-    if body and isinstance(body[-1], _dashr_ast.Expr):
-        # Capture the last expression the way a REPL's displayhook shows it:
-        # its value feeds the completion envelope instead of being discarded.
-        # The name is distinct from the scaffold's __dashr_completion__ (the
-        # envelope holder) so a statement-ending cell can never pop a stale
-        # envelope left by an earlier run.
-        last = body[-1]
-        body[-1] = _dashr_ast.Assign(
-            targets=[_dashr_ast.Name(id='__dashr_cell_value__', ctx=_dashr_ast.Store())],
-            value=last.value,
-        )
-        _dashr_ast.fix_missing_locations(body[-1])
-    code = compile(
-        parsed,
-        '<dashr program>',
-        'exec',
-        flags=_dashr_ast.PyCF_ALLOW_TOP_LEVEL_AWAIT,
-    )
-    # IPython's own run_code pattern: with PyCF_ALLOW_TOP_LEVEL_AWAIT, plain
-    # exec() DISCARDS the module coroutine silently; eval() under await
-    # returns it and runs the code (IPython InteractiveShell.run_code does
-    # exactly 'await eval(code_obj, user_global_ns, user_ns)').
-    result = eval(code, user_ns, user_ns)
-    if _dashr_inspect.iscoroutine(result):
-        await result
-    value = user_ns.pop('__dashr_cell_value__', _DASHR_NO_VALUE)
-    if value is None:
-        return _DASHR_NO_VALUE
-    return value
-
-
-def _dashr_install_bindings(spec_json):
-    spec = _dashr_json.loads(spec_json)
-    user_ns = globals()
-    injected = user_ns.get('__dashr_injected__', {})
-    for old_name, old_spec in list(injected.items()):
-        if old_name not in spec:
-            user_ns.pop(old_name, None)
-            if old_spec.get('errorClass'):
-                user_ns.pop(old_spec['errorClass']['name'], None)
-    fresh = {}
-    # The flat per-tool shape declares the SAME error class on many
-    # namespaces: materialize each DISTINCT name once, so every proxy's
-    # raise-time globals() lookup finds ONE class and a single
-    # 'except ToolCallError' catches failures from every binding.
-    error_classes = {}
-    for global_name, namespace in spec.items():
-        error_class = namespace.get('errorClass')
-        if namespace.get('callable'):
-            # Exactly one function entry was validated by the host; its key is
-            # the transport name, the bare global itself is the callable.
-            function_name = next(iter(namespace['functions']))
-            user_ns[global_name] = _dashr_make_callable(
-                global_name,
-                function_name,
-                error_class['name'] if error_class else None,
-                error_class['memberNameProperty'] if error_class else None,
-            )
-        else:
-            user_ns[global_name] = _dashr_make_holder(
-                global_name,
-                error_class['name'] if error_class else None,
-                error_class['memberNameProperty'] if error_class else None,
-                sorted(namespace['functions']),
-            )
-        if error_class and error_class['name'] not in error_classes:
-            cls = _dashr_make_error_class(
-                error_class['name'],
-                error_class['memberNameProperty'],
-            )
-            error_classes[error_class['name']] = cls
-            user_ns[error_class['name']] = cls
-        fresh[global_name] = namespace
-    user_ns['__dashr_injected__'] = fresh
-
-
-def _dashr_encode(value):
-    if value is _DASHR_NO_VALUE:
-        return {'ok': True}
-    try:
-        return {'ok': True, 'json': _dashr_json.dumps(value, allow_nan=False)}
-    except (TypeError, ValueError, OverflowError):
-        # Not lossless JSON: pass its repr TEXT through instead of failing
-        # the cell. The upstream renders the tool result as text either way,
-        # so a non-JSON value costs the model nothing; the host keeps a
-        # plain string it forwards untouched. The envelope itself never
-        # fails, so the completion never gate-rejects a return value.
-        return {'ok': True, 'json': _dashr_json.dumps(repr(value))}
-`;
+/** Module-qualified initialization survives OMP %reset without leaking imports. */
+const KERNEL_BOOTSTRAP = `__import__('better_support').initialize(globals())`;
 
 //#endregion
 //#region src/python.ts
-/**
-* Build the single cell for one run.
-* @param program - the model's cell program, executed at module scope.
-* @param specJson - the JSON-encoded {@link NamespaceSpecs} map.
-* @param sentinel - per-run nonce prefix; the envelope line starts with it.
-* @returns the complete cell source.
-*/
 function buildRunCell(program, specJson, sentinel) {
-	return [
-		`_dashr_state['executing'] = True`,
-		`try:`,
-		`    _dashr_install_bindings(${JSON.stringify(specJson)})`,
-		`    __dashr_completion__ = _dashr_encode(await _dashr_run_program(${JSON.stringify(program)}))`,
-		`    print(${JSON.stringify(sentinel)} + _dashr_json.dumps(__dashr_completion__))`,
-		`finally:`,
-		`    _dashr_state['executing'] = False`
-	].join("\n");
-}
-/**
-* Build the internal cell that dumps the user namespace to a dill snapshot and
-* writes a JSON manifest next to it. Only USER state is captured: IPython's
-* own session plumbing (`exit`, `quit`, `get_ipython`, … tracked in the
-* shell's `user_ns_hidden` and still bound to the object IPython installed)
-* reaches unpicklable kernel machinery — e.g. the history manager's
-* sqlite3.Connection — and is never restored as program state anyway. Shim
-* names (any `_dashr`/`__dashr` spelling) are excluded by prefix.
-*
-* Size-cap policy (M3-B, blueprint §8.3): dill cannot report a serialized
-* size before dumping, and a GB-sized `DataFrame` dumped EVERY turn is the IO
-* storm the cap exists to stop. The cell therefore gates in two tiers:
-* first a bounded-depth namespace walk estimates the footprint (counting
-* container lengths and reading `nbytes` / `memory_usage(deep=True)` for
-* numpy/pandas objects — the stated pathological case — so the dump is
-* skipped BEFORE any dill IO), then the actual dump goes to a sibling
-* `.part` file whose true byte size is measured before it replaces the
-* previous good snapshot. Skipped snapshots leave the previous
-* `state.dill` + manifest untouched, so a revive restores the last good turn.
-* @param payloadPath - absolute path for the dill payload.
-* @param manifestPath - absolute path for the JSON manifest.
-* @param spec - turn counter, skills list, and the size cap.
-* @param sentinel - per-cell nonce prefix for the outcome envelope.
-* @returns the complete cell source.
-*/
-function buildSnapshotCell(payloadPath, manifestPath, spec, sentinel) {
-	return [
-		`_dashr_state['executing'] = True`,
-		`try:`,
-		`    import dill as _dashr_dill, json as _dashr_json, platform as _dashr_platform`,
-		`    import os as _dashr_os, sys as _dashr_sys, datetime as _dashr_dt`,
-		`    _dashr_shell = globals().get('get_ipython', lambda: None)()`,
-		`    _dashr_hidden = getattr(_dashr_shell, 'user_ns_hidden', None) or {}`,
-		`    _dashr_user_ns = {`,
-		`        name: value`,
-		`        for name, value in globals().items()`,
-		`        if not name.lower().startswith(('_dashr', '__dashr'))`,
-		`        and (name not in _dashr_hidden or _dashr_hidden[name] is not value)`,
-		`    }`,
-		`    _dashr_cap = ${JSON.stringify(spec.sizeCapBytes)}`,
-		`    def _dashr_estimate(value, depth):`,
-		`        if value is None or isinstance(value, (bool, int, float, complex)):`,
-		`            return 32`,
-		`        if isinstance(value, (str, bytes, bytearray)):`,
-		`            return len(value) + 64`,
-		`        if isinstance(value, (list, tuple, set, frozenset)):`,
-		`            if depth <= 0:`,
-		`                return 4096`,
-		`            return 64 + sum(_dashr_estimate(item, depth - 1) for item in value)`,
-		`        if isinstance(value, dict):`,
-		`            if depth <= 0:`,
-		`                return 4096`,
-		`            total = 64`,
-		`            for key, item in value.items():`,
-		`                total += _dashr_estimate(key, depth - 1)`,
-		`                total += _dashr_estimate(item, depth - 1)`,
-		`                if total > _dashr_cap:`,
-		`                    return total`,
-		`            return total`,
-		`        _dashr_nbytes = getattr(value, 'nbytes', None)`,
-		`        if isinstance(_dashr_nbytes, int) and _dashr_nbytes > 0:`,
-		`            return _dashr_nbytes + 128`,
-		`        _dashr_mem = getattr(value, 'memory_usage', None)`,
-		`        if callable(_dashr_mem):`,
-		`            try:`,
-		`                _dashr_usage = _dashr_mem(deep=True)`,
-		`                _dashr_sum = getattr(_dashr_usage, 'sum', None)`,
-		`                if callable(_dashr_sum):`,
-		`                    # pandas returns a numpy scalar (np.int64), which is`,
-		`                    # not a Python int subclass; coerce, don't isinstance.`,
-		`                    _dashr_n = int(_dashr_sum())`,
-		`                    if _dashr_n > 0:`,
-		`                        return _dashr_n + 128`,
-		`            except Exception:`,
-		`                pass`,
-		`        return 4096`,
-		`    _dashr_estimate_bytes = sum(_dashr_estimate(value, 4) for value in _dashr_user_ns.values())`,
-		`    if _dashr_estimate_bytes > _dashr_cap:`,
-		`        print(${JSON.stringify(sentinel)} + _dashr_json.dumps({`,
-		`            'ok': False, 'skipped': True, 'reason': 'estimate',`,
-		`            'estimateBytes': _dashr_estimate_bytes, 'capBytes': _dashr_cap,`,
-		`        }))`,
-		`    else:`,
-		`        _dashr_part = ${JSON.stringify(payloadPath)} + '.part'`,
-		`        try:`,
-		`            with open(_dashr_part, 'wb') as _dashr_f:`,
-		`                _dashr_dill.dump(_dashr_user_ns, _dashr_f)`,
-		`            _dashr_size = _dashr_os.path.getsize(_dashr_part)`,
-		`            if _dashr_size > _dashr_cap:`,
-		`                print(${JSON.stringify(sentinel)} + _dashr_json.dumps({`,
-		`                    'ok': False, 'skipped': True, 'reason': 'actual',`,
-		`                    'sizeBytes': _dashr_size, 'capBytes': _dashr_cap,`,
-		`                }))`,
-		`            else:`,
-		`                _dashr_os.replace(_dashr_part, ${JSON.stringify(payloadPath)})`,
-		`                _dashr_manifest = {`,
-		`                    'snapshotFormat': 1,`,
-		`                    'turn': ${JSON.stringify(spec.turn)},`,
-		`                    'pythonVersion': _dashr_platform.python_version(),`,
-		`                    'venvPath': _dashr_sys.executable,`,
-		`                    'skills': ${JSON.stringify(spec.skills)},`,
-		`                    'names': sorted(_dashr_user_ns),`,
-		`                    'sizeBytes': _dashr_size,`,
-		`                    'skipped': False,`,
-		`                    'createdAt': _dashr_dt.datetime.now(_dashr_dt.timezone.utc).isoformat(),`,
-		`                }`,
-		`                with open(${JSON.stringify(manifestPath)}, 'w', encoding='utf-8') as _dashr_f:`,
-		`                    _dashr_json.dump(_dashr_manifest, _dashr_f)`,
-		`                print(${JSON.stringify(sentinel)} + _dashr_json.dumps({`,
-		`                    'ok': True, 'sizeBytes': _dashr_size, 'names': len(_dashr_user_ns),`,
-		`                }))`,
-		`        finally:`,
-		`            if _dashr_os.path.exists(_dashr_part):`,
-		`                try:`,
-		`                    _dashr_os.unlink(_dashr_part)`,
-		`                except OSError:`,
-		`                    pass`,
-		`finally:`,
-		`    _dashr_state['executing'] = False`
-	].join("\n");
-}
-/**
-* Build the internal cell that restores a dill snapshot into the user
-* namespace. The kernel validates the manifest ITSELF (it is the only party
-* that knows its own python version and `sys.executable`): a python-version
-* mismatch, a different interpreter (`venvPath`), a non-empty skills list, or
-* an unreadable/corrupt payload degrades to an empty namespace WITHOUT
-* touching globals, and reports the reason through the envelope so the host
-* can tell the model "snapshot not replayable, started from empty". Shim and
-* IPython-hidden names are re-filtered on the way in — the same exclusion the
-* snapshot applied on the way out, applied again defensively.
-* @param payloadPath - absolute path of the dill payload.
-* @param manifestPath - absolute path of the JSON manifest.
-* @param sentinel - per-cell nonce prefix for the outcome envelope.
-* @returns the complete cell source.
-*/
-function buildRestoreCell(payloadPath, manifestPath, sentinel) {
-	return [
-		`_dashr_state['executing'] = True`,
-		`try:`,
-		`    import dill as _dashr_dill, json as _dashr_json, platform as _dashr_platform`,
-		`    import os as _dashr_os, sys as _dashr_sys`,
-		`    _dashr_manifest = None`,
-		`    _dashr_reason = 'snapshot manifest could not be read'`,
-		`    try:`,
-		`        with open(${JSON.stringify(manifestPath)}, 'r', encoding='utf-8') as _dashr_f:`,
-		`            _dashr_manifest = _dashr_json.load(_dashr_f)`,
-		`    except Exception as _dashr_err:`,
-		`        _dashr_reason = 'snapshot manifest could not be read: ' + repr(_dashr_err)`,
-		`    if _dashr_manifest is None:`,
-		`        print(${JSON.stringify(sentinel)} + _dashr_json.dumps({'ok': False, 'reason': _dashr_reason}))`,
-		`    elif _dashr_manifest.get('snapshotFormat') != 1:`,
-		`        print(${JSON.stringify(sentinel)} + _dashr_json.dumps({'ok': False, 'reason': 'snapshot format is not replayable'}))`,
-		`    elif _dashr_manifest.get('skipped'):`,
-		`        print(${JSON.stringify(sentinel)} + _dashr_json.dumps({'ok': False, 'reason': 'snapshot was skipped (namespace exceeded the size cap)'}))`,
-		`    elif _dashr_manifest.get('pythonVersion') != _dashr_platform.python_version():`,
-		`        print(${JSON.stringify(sentinel)} + _dashr_json.dumps({'ok': False, 'reason': 'python version mismatch: snapshot ' + str(_dashr_manifest.get('pythonVersion')) + ' vs kernel ' + _dashr_platform.python_version()}))`,
-		`    elif _dashr_os.path.realpath(_dashr_manifest.get('venvPath') or '') != _dashr_os.path.realpath(_dashr_sys.executable):`,
-		`        print(${JSON.stringify(sentinel)} + _dashr_json.dumps({'ok': False, 'reason': 'kernel interpreter differs from the snapshot venv'}))`,
-		`    elif _dashr_manifest.get('skills'):`,
-		`        print(${JSON.stringify(sentinel)} + _dashr_json.dumps({'ok': False, 'reason': 'snapshot skills are not replayable in this provider'}))`,
-		`    else:`,
-		`        try:`,
-		`            with open(${JSON.stringify(payloadPath)}, 'rb') as _dashr_f:`,
-		`                _dashr_restored = _dashr_dill.load(_dashr_f)`,
-		`        except Exception as _dashr_err:`,
-		`            _dashr_restored = None`,
-		`            _dashr_reason = 'snapshot payload could not be loaded: ' + repr(_dashr_err)`,
-		`        if not isinstance(_dashr_restored, dict):`,
-		`            print(${JSON.stringify(sentinel)} + _dashr_json.dumps({'ok': False, 'reason': _dashr_reason if _dashr_restored is None else 'snapshot payload is not a namespace dict'}))`,
-		`        else:`,
-		`            _dashr_shell = globals().get('get_ipython', lambda: None)()`,
-		`            _dashr_hidden = getattr(_dashr_shell, 'user_ns_hidden', None) or {}`,
-		`            _dashr_user_ns = globals()`,
-		`            _dashr_restored_count = 0`,
-		`            for _dashr_name, _dashr_value in _dashr_restored.items():`,
-		`                if not isinstance(_dashr_name, str):`,
-		`                    continue`,
-		`                if _dashr_name.lower().startswith(('_dashr', '__dashr')):`,
-		`                    continue`,
-		`                if _dashr_name in _dashr_hidden and _dashr_hidden[_dashr_name] is _dashr_value:`,
-		`                    continue`,
-		`                _dashr_user_ns[_dashr_name] = _dashr_value`,
-		`                _dashr_restored_count += 1`,
-		`            print(${JSON.stringify(sentinel)} + _dashr_json.dumps({'ok': True, 'restored': _dashr_restored_count}))`,
-		`finally:`,
-		`    _dashr_state['executing'] = False`
-	].join("\n");
+	return `await __import__('better_support').run(globals(), ${JSON.stringify(program)}, ${JSON.stringify(specJson)}, ${JSON.stringify(sentinel)})`;
 }
-/**
-* Build the internal cell that reads ONE user-namespace variable by name, or
-* — when `name` is `null` — lists the namespace's user-variable names. The
-* same exclusion the snapshot applies on the way out (any `_dashr`/`__dashr`
-* spelling plus IPython's `user_ns_hidden`) defines what "user variable"
-* means here, so `ctx://` sees exactly the namespace a revive would restore.
-*
-* Serialization boundary (design.md D4): a value that survives
-* `json.dumps(…, allow_nan=False)` crosses as `kind: 'json'` text; anything
-* else falls back to `repr` text (`kind: 'repr'`) so a non-JSON variable
-* (the reason the snapshot uses dill at all) is still readable as text. The
-* host keeps the `kind` so the presentation can annotate a repr as "this is
-* repr text, not a JSON value".
-* @param name - the exact variable name, or `null` to list namespace names.
-* @param sentinel - per-cell nonce prefix for the outcome envelope.
-* @returns the complete cell source.
-*/
 function buildQueryVarCell(name$1, sentinel) {
-	const lines = [
-		`_dashr_state['executing'] = True`,
-		`try:`,
-		`    import json as _dashr_json`,
-		`    _dashr_shell = globals().get('get_ipython', lambda: None)()`,
-		`    _dashr_hidden = getattr(_dashr_shell, 'user_ns_hidden', None) or {}`,
-		`    _dashr_user_ns = {`,
-		`        _name: _value`,
-		`        for _name, _value in globals().items()`,
-		`        if not _name.lower().startswith(('_dashr', '__dashr'))`,
-		`        and (_name not in _dashr_hidden or _dashr_hidden[_name] is not _value)`,
-		`    }`
-	];
-	if (name$1 === null) lines.push(`    print(${JSON.stringify(sentinel)} + _dashr_json.dumps({'ok': True, 'kind': 'names', 'names': sorted(_dashr_user_ns)}))`);
-	else lines.push(`    _dashr_name = ${JSON.stringify(name$1)}`, `    if _dashr_name not in _dashr_user_ns:`, `        print(${JSON.stringify(sentinel)} + _dashr_json.dumps({'ok': True, 'kind': 'missing'}))`, `    else:`, `        _dashr_value = _dashr_user_ns[_dashr_name]`, `        try:`, `            _dashr_text = _dashr_json.dumps(_dashr_value, allow_nan=False)`, `            print(${JSON.stringify(sentinel)} + _dashr_json.dumps({'ok': True, 'kind': 'json', 'text': _dashr_text}))`, `        except (TypeError, ValueError, OverflowError):`, `            print(${JSON.stringify(sentinel)} + _dashr_json.dumps({'ok': True, 'kind': 'repr', 'text': repr(_dashr_value)}))`);
-	lines.push(`finally:`, `    _dashr_state['executing'] = False`);
-	return lines.join("\n");
+	return `__import__('better_support').query(globals(), ${JSON.stringify(JSON.stringify(name$1))}, ${JSON.stringify(sentinel)})`;
 }
-/**
-* Build the internal cell that assigns one JSON value into the user
-* namespace under `name`. The value is carried as pre-serialized JSON text
-* (the host validated it as lossless JSON and the name as a usable
-* identifier), so the cell only decodes and binds — no arbitrary object can
-* cross the wire. Bracketed by the same SIGALRM busy guard as a run cell.
-* @param name - the validated identifier to assign under.
-* @param valueJson - the lossless-JSON text to decode and bind.
-* @param sentinel - per-cell nonce prefix for the outcome envelope.
-* @returns the complete cell source.
-*/
 function buildSetVarCell(name$1, valueJson, sentinel) {
-	return [
-		`_dashr_state['executing'] = True`,
-		`try:`,
-		`    import json as _dashr_json`,
-		`    _dashr_value = _dashr_json.loads(${JSON.stringify(valueJson)})`,
-		`    globals()[${JSON.stringify(name$1)}] = _dashr_value`,
-		`    print(${JSON.stringify(sentinel)} + _dashr_json.dumps({'ok': True}))`,
-		`finally:`,
-		`    _dashr_state['executing'] = False`
-	].join("\n");
+	return `__import__('better_support').set_var(globals(), ${JSON.stringify(name$1)}, ${JSON.stringify(valueJson)}, ${JSON.stringify(sentinel)})`;
+}
+function buildSnapshotCell(payloadPath, manifestPath, spec, sentinel) {
+	return `__import__('better_snapshot').save(globals(), ${JSON.stringify(payloadPath)}, ${JSON.stringify(manifestPath)}, ${JSON.stringify(JSON.stringify(spec))}, ${JSON.stringify(sentinel)})`;
+}
+function buildRestoreCell(payloadPath, manifestPath, sentinel, bindings = []) {
+	return `__import__('better_snapshot').restore(globals(), ${JSON.stringify(payloadPath)}, ${JSON.stringify(manifestPath)}, ${JSON.stringify(sentinel)}, ${JSON.stringify(JSON.stringify(bindings))})`;
 }
 
 //#endregion
 //#region src/output.ts
-/** ANSI color escapes, which ipykernel embeds in published tracebacks. */
+/** ANSI color escapes, which Python may embed in tracebacks. */
 const ANSI_ESCAPE = /\x1b\[[0-9;]*[A-Za-z]/g;
 /** Smallest cap that can represent an empty logs array plus a quoted message. */
 const MIN_OUTPUT_BYTES = 4;
@@ -1067,7 +228,7 @@ function extractStream(streamText, sentinel) {
 		envelope: envelope === "" ? void 0 : envelope
 	};
 }
-/** Strip ANSI escapes from an ipykernel traceback for a model-facing message. */
+/** Strip ANSI escapes from a Python traceback for a model-facing message. */
 function plainTraceback(ename, evalue, traceback) {
 	const body = traceback.map((line) => line.replace(ANSI_ESCAPE, "")).join("\n");
 	return body.length > 0 ? `${ename}: ${evalue}\n${body}` : `${ename}: ${evalue}`;
@@ -1122,775 +283,437 @@ function finalizeOutput(logs, value, error, maxBytes) {
 
 //#endregion
 //#region src/kernel.ts
-const PROTOCOL_VERSION = "5.3";
-/** Loopback PUB/SUB subscription propagation guard before the first execute. */
-const IOPUB_SUBSCRIBE_DELAY_MS = 50;
-const CONNECT_POLL_MS = 25;
-const SHUTDOWN_DRAIN_MS = 200;
-function isRecord(value) {
-	return typeof value === "object" && value !== null && !Array.isArray(value);
+function record(value) {
+	return value !== null && typeof value === "object" && !Array.isArray(value);
 }
-function buildMessage(msgType, content, session, username) {
-	return {
-		header: {
-			msg_id: randomUUID(),
-			session,
-			username,
-			date: (/* @__PURE__ */ new Date()).toISOString(),
-			msg_type: msgType,
-			version: PROTOCOL_VERSION
-		},
-		parent_header: {},
-		content
-	};
-}
-function makeConnection() {
-	const info = {
-		ip: "127.0.0.1",
-		transport: "tcp",
-		shell_port: 0,
-		iopub_port: 0,
-		stdin_port: 0,
-		control_port: 0,
-		hb_port: 0,
-		signature_scheme: "hmac-sha256",
-		key: randomBytes(16).toString("hex"),
-		kernel_name: "python3"
-	};
-	const tempDir = mkdtempSync(join(tmpdir(), "dashr-kernel-"));
-	const path$1 = join(tempDir, "connection.json");
-	writeFileSync(path$1, JSON.stringify(info, null, 2), { mode: 384 });
-	return {
-		path: path$1,
-		tempDir
-	};
-}
-function readResolvedConnection(path$1) {
-	try {
-		const parsed = JSON.parse(readFileSync(path$1, "utf8"));
-		if (!isRecord(parsed) || parsed.ip !== "127.0.0.1" || parsed.transport !== "tcp" || parsed.signature_scheme !== "hmac-sha256" || typeof parsed.key !== "string") return null;
-		for (const port of [
-			"shell_port",
-			"iopub_port",
-			"stdin_port",
-			"control_port",
-			"hb_port"
-		]) {
-			const value = parsed[port];
-			if (typeof value !== "number" || !Number.isInteger(value) || value <= 0) return null;
-		}
-		return parsed;
-	} catch {
-		return null;
-	}
-}
-/**
-* One persistent IPython kernel subprocess with its ZeroMQ channels. Cell
-* execution is serialized on an internal queue (the Jupyter shell channel is
-* request/reply).
-*/
+/** Historical class name retained for the runtime's private integration seam. */
 var IpyKernelBridge = class {
-	session = randomUUID();
 	state = "idle";
+	child;
 	startPromise;
-	kernel;
-	transport;
-	connection;
-	tempDir;
-	kernelStderr = "";
-	executionQueue = Promise.resolve();
-	activeExec;
-	commTargets = /* @__PURE__ */ new Map();
-	servedComms = /* @__PURE__ */ new Set();
+	disposePromise;
+	queue = Promise.resolve();
+	active;
+	stderr = "";
+	deathFailure;
+	callbackServer;
+	closePromise;
+	ownedReaders = [];
 	constructor(options) {
 		this.options = options;
 	}
-	/** The kernel subprocess pid, for lifecycle assertions; absent before spawn. */
 	get pid() {
-		return this.kernel?.pid;
+		return this.child?.pid;
 	}
 	get isRunning() {
 		return this.state === "running";
 	}
-	/**
-	* Whether the subprocess is gone (crashed or disposed). A dead bridge is
-	* never resurrected — the owning provider replaces it with a fresh one
-	* (respawn, M3-A), because kernel state is unrecoverable in-process.
-	*/
 	get isDead() {
 		return this.state === "shutdown";
 	}
-	/**
-	* Start the kernel (idempotent; concurrent callers share one startup).
-	* @throws when the subprocess cannot spawn, ports never resolve, the
-	*   kernel_info probe times out, or the bootstrap cell fails.
-	*/
-	async start() {
-		if (!this.startPromise) this.startPromise = this.doStart().catch((error) => {
-			this.startPromise = void 0;
-			throw error;
-		});
+	start() {
+		this.startPromise ??= this.doStart();
 		return this.startPromise;
 	}
-	stderrTail() {
-		return this.kernelStderr.slice(-1024) || "(empty)";
+	async windowsCallbacks() {
+		const token = randomBytes(32).toString("hex");
+		const server = createServer((req, response) => {
+			if (req.method !== "POST" || req.url !== "/callback" || req.headers.authorization !== `Bearer ${token}`) {
+				response.writeHead(403).end();
+				return;
+			}
+			let body = "";
+			req.setEncoding("utf8");
+			req.on("data", (data) => {
+				body += data;
+			});
+			req.on("end", () => {
+				let parsed;
+				try {
+					parsed = JSON.parse(body);
+				} catch {
+					response.writeHead(400).end();
+					return;
+				}
+				this.callback(parsed).then((reply) => {
+					if (!response.destroyed) response.writeHead(200, { "content-type": "application/json" }).end(JSON.stringify(reply));
+				});
+			});
+		});
+		this.callbackServer = server;
+		await new Promise((resolve$1, reject) => {
+			server.once("error", reject);
+			server.listen(0, "127.0.0.1", () => {
+				server.off("error", reject);
+				resolve$1();
+			});
+		});
+		const address = server.address();
+		if (!address || typeof address === "string") throw new Error("callback endpoint unavailable");
+		return {
+			BETTER_CALLBACK_URL: `http://127.0.0.1:${address.port}/callback`,
+			BETTER_CALLBACK_TOKEN: token
+		};
 	}
 	async doStart() {
-		if (this.state !== "idle") return;
+		if (this.state !== "idle") throw new Error("Python bridge cannot restart after shutdown");
 		this.state = "starting";
-		const { path: path$1, tempDir } = makeConnection();
-		this.tempDir = tempDir;
-		const kernel = spawn(this.options.python, [
-			"-m",
-			"ipykernel_launcher",
-			"-f",
-			path$1
-		], {
-			cwd: this.options.cwd,
-			env: {
-				PATH: process.env.PATH ?? "/usr/local/bin:/usr/bin:/bin",
-				LANG: "C.UTF-8",
-				HOME: process.env.HOME ?? tmpdir()
-			},
-			stdio: [
-				"ignore",
-				"pipe",
-				"pipe"
-			]
-		});
-		this.kernel = kernel;
-		kernel.stderr?.on("data", (buf) => {
-			this.kernelStderr += buf.toString();
-		});
-		kernel.on("error", (error) => {
-			this.kernelStderr += `spawn error: ${error.message}\n`;
-			this.onKernelDeath();
-		});
-		kernel.on("exit", (code, signal) => {
-			if (this.state !== "shutdown") this.kernelStderr += `unexpected exit code=${code} signal=${signal}\n`;
-			this.onKernelDeath();
-		});
-		let conn;
 		try {
-			conn = await this.waitForConnection(path$1);
-			this.connection = conn;
-		} catch (error) {
-			this.cleanupResources();
-			this.state = "idle";
-			throw error;
-		}
-		const transport = new KernelTransport({
-			python: this.options.python,
-			connectionFile: path$1,
-			...this.options.cwd === void 0 ? {} : { cwd: this.options.cwd },
-			readyTimeoutMs: this.options.startupTimeoutMs
-		});
-		this.transport = transport;
-		transport.onMessage((channel, message) => {
-			this.handleTransportMessage(channel, message);
-		});
-		transport.onExit(() => {
-			if (this.state !== "shutdown") this.forceSettleActive({
-				kind: "worker-exit",
-				message: `kernel bridge died. stderr tail:\n${transport.stderrTail()}`
+			const resources = fileURLToPath(new URL("./omp-python/", import.meta.url));
+			const callbackEnv = process.platform === "win32" ? await this.windowsCallbacks() : {};
+			if (this.isDead) throw new Error("Python startup cancelled by disposal");
+			const child = spawn(this.options.python, ["-u", fileURLToPath(new URL("./omp-python/runner.py", import.meta.url))], {
+				...this.options.cwd ? { cwd: this.options.cwd } : {},
+				detached: process.platform !== "win32",
+				stdio: process.platform === "win32" ? [
+					"pipe",
+					"pipe",
+					"pipe"
+				] : [
+					"pipe",
+					"pipe",
+					"pipe",
+					"pipe",
+					"pipe"
+				],
+				env: {
+					...process.env,
+					...this.options.env,
+					PYTHONUNBUFFERED: "1",
+					PYTHONIOENCODING: "utf-8",
+					PYTHONDONTWRITEBYTECODE: "1",
+					PYTHONPATH: [resources, process.env.PYTHONPATH].filter(Boolean).join(process.platform === "win32" ? ";" : ":"),
+					...callbackEnv
+				}
 			});
-		});
-		try {
-			await transport.start();
-		} catch (error) {
-			this.cleanupResources();
-			this.state = "idle";
-			throw error;
-		}
-		await setTimeout$1(IOPUB_SUBSCRIBE_DELAY_MS);
-		try {
-			await this.probeReady();
+			this.child = child;
+			this.closePromise = new Promise((resolve$1) => child.once("close", () => resolve$1()));
+			child.on("error", (error) => this.died(`Python process error: ${error.message}`));
+			child.on("exit", (code, signal) => this.died(`Python process exited (${signal ?? code}); stderr: ${this.stderr.slice(-2048)}`));
+			child.stdin?.on("error", (error) => this.died(`Python input pipe failed: ${error.message}`));
+			child.stderr?.setEncoding("utf8").on("data", (data) => {
+				this.stderr = (this.stderr + data).slice(-8192);
+			});
+			const frames = createInterface({ input: child.stdout });
+			this.ownedReaders.push(frames);
+			frames.on("line", (line) => {
+				try {
+					this.frame(JSON.parse(line));
+				} catch {
+					this.died("Python emitted invalid NDJSON protocol");
+				}
+			});
+			if (process.platform !== "win32") {
+				const requests = createInterface({ input: child.stdio[3] });
+				this.ownedReaders.push(requests);
+				const replies = child.stdio[4];
+				replies.on("error", () => {});
+				requests.on("line", (line) => {
+					let data;
+					try {
+						data = JSON.parse(line);
+					} catch {
+						return;
+					}
+					this.callback(data).then((reply) => {
+						if (!replies.destroyed && !replies.writableEnded) replies.write(JSON.stringify(reply) + "\n");
+					});
+				});
+			}
+			const result = await this.perform(KERNEL_BOOTSTRAP + `\n__import__('better_snapshot').configure(${JSON.stringify(this.options.snapshotDirectory ?? "")}, ${this.options.snapshotSizeCapBytes ?? 268435456}, ${this.options.snapshotTimeoutMs})`, {
+				timeoutMs: this.options.startupTimeoutMs,
+				interruptGraceMs: 1e3,
+				interruptConfirmMs: this.options.interruptConfirmMs
+			});
+			if (result.outcome !== "completed" || result.status !== "ok") throw new Error(`OMP Python initialization failed: ${JSON.stringify(result)}`);
+			if (this.isDead) throw new Error("Python exited during initialization");
+			this.state = "running";
 		} catch (error) {
-			this.cleanupResources();
-			this.state = "idle";
+			await this.dispose();
 			throw error;
 		}
-		const bootstrap = await this.executeCell(KERNEL_BOOTSTRAP, {
-			timeoutMs: this.options.startupTimeoutMs,
-			interruptGraceMs: 1e3,
-			interruptConfirmMs: Math.min(this.options.interruptConfirmMs, 500)
-		});
-		if (bootstrap.outcome !== "completed" || bootstrap.status !== "ok") {
-			const detail = bootstrap.outcome === "completed" && bootstrap.cellError ? `${bootstrap.cellError.ename}: ${bootstrap.cellError.evalue}` : "bootstrap cell failed";
-			this.cleanupResources();
-			this.state = "idle";
-			throw new Error(`dashr kernel bootstrap failed: ${detail}`);
-		}
-		this.state = "running";
-	}
-	async waitForConnection(path$1) {
-		const deadline = Date.now() + this.options.startupTimeoutMs;
-		while (Date.now() < deadline) {
-			if (this.state === "shutdown") throw new Error(`kernel exited before resolving ports. stderr:\n${this.stderrTail()}`);
-			const info = readResolvedConnection(path$1);
-			if (info) return info;
-			await setTimeout$1(CONNECT_POLL_MS);
-		}
-		throw new Error(`kernel did not resolve connection ports within ${this.options.startupTimeoutMs}ms. stderr tail:\n${this.stderrTail()}`);
 	}
-	async probeReady() {
-		const transport = this.transport;
-		if (!transport) throw new Error("kernel channels are not connected");
-		const msg = buildMessage("kernel_info_request", {}, this.session, this.options.username);
-		const requestMsgId = msg.header.msg_id;
-		transport.send("shell", msg);
-		if (await transport.waitFor("shell", (incoming) => incoming.header.msg_type === "kernel_info_reply" && incoming.parent_header.msg_id === requestMsgId, this.options.startupTimeoutMs)) return;
-		const bridgeTail = transport.stderrTail();
-		if (this.state === "shutdown") throw new Error(`kernel exited during startup. kernel stderr:\n${this.stderrTail()}\nbridge stderr:\n${bridgeTail}`);
-		throw new Error(`kernel did not answer kernel_info_request within ${this.options.startupTimeoutMs}ms. kernel stderr:\n${this.stderrTail()}\nbridge stderr:\n${bridgeTail}`);
+	async callback(data) {
+		const identity = record(data) ? {
+			id: data.id,
+			run: data.run
+		} : {};
+		const active = this.active;
+		if (!record(data) || !active || active.id !== data.run || active.pendingForce || !active.opts.hostRequestHandler) return {
+			...identity,
+			ok: false,
+			message: "host callback rejected: its cell is no longer active"
+		};
+		const revoked = {
+			...identity,
+			ok: false,
+			message: "host callback cancelled: its cell ended"
+		};
+		return new Promise((resolve$1) => {
+			let settled = false;
+			const finish = (reply) => {
+				if (settled) return;
+				settled = true;
+				active.rejectCallbacks.delete(reject);
+				resolve$1(reply);
+			};
+			const reject = () => finish(revoked);
+			active.rejectCallbacks.add(reject);
+			active.opts.hostRequestHandler(data).then((reply) => {
+				finish(this.active === active && !active.pendingForce ? {
+					...identity,
+					...reply
+				} : revoked);
+			}, (error) => finish({
+				...identity,
+				ok: false,
+				message: String(error)
+			}));
+		});
 	}
-	/**
-	* Execute one cell on the persistent kernel, serialized against all other
-	* executions. Resolves with the cell's outcome — never rejects for
-	* cell-level failures (program errors, timeouts, aborts, kernel death).
-	* @param code - complete cell source.
-	* @param opts - budgets, abort signal, and the host-request dispatcher.
-	*/
-	async executeCell(code, opts) {
-		const prev = this.executionQueue;
-		let releaseQueue;
-		this.executionQueue = new Promise((resolve$1) => {
-			releaseQueue = resolve$1;
+	frame(frame) {
+		if (!record(frame) || frame.id !== this.active?.id) return;
+		const active = this.active;
+		if (frame.type === "started") {
+			active.started = true;
+			if (active.pendingForce) this.signal("SIGINT");
+		} else if (frame.type === "stdout" || frame.type === "stderr") {
+			if (typeof frame.data === "string") active.streamText += frame.data;
+		} else if (frame.type === "display" || frame.type === "result") {
+			if (record(frame.bundle)) {
+				const text = frame.bundle["text/plain"] ?? frame.bundle["text/markdown"] ?? frame.bundle["text/html"];
+				if (typeof text === "string") active.streamText += `${text}\n`;
+				else if (frame.bundle["application/json"] !== void 0) active.streamText += `${JSON.stringify(frame.bundle["application/json"])}\n`;
+				else active.streamText += `[Python display: ${Object.keys(frame.bundle).join(", ")}]\n`;
+			}
+		} else if (frame.type === "error") active.error = {
+			ename: String(frame.ename),
+			evalue: String(frame.evalue),
+			traceback: Array.isArray(frame.traceback) ? frame.traceback.map(String) : []
+		};
+		else if (frame.type === "done") this.settle(active.pendingForce ? {
+			outcome: "forced",
+			failure: active.pendingForce,
+			streamText: active.streamText
+		} : {
+			outcome: "completed",
+			status: frame.status === "ok" ? "ok" : "error",
+			streamText: active.streamText,
+			...active.error ? { cellError: active.error } : {}
 		});
-		await prev;
-		try {
-			if (this.state === "shutdown" || this.state === "idle") return {
+	}
+	executeCell(code, opts) {
+		const task = this.queue.then(() => {
+			if (!this.isRunning) return {
 				outcome: "forced",
 				failure: {
 					kind: "worker-exit",
-					message: "kernel has been shut down"
+					message: "Python is not running"
 				},
 				streamText: ""
 			};
-			return await this.executeInner(code, opts);
-		} finally {
-			releaseQueue();
-		}
+			return this.perform(code, opts);
+		});
+		this.queue = task.catch(() => void 0);
+		return task;
 	}
-	executeInner(code, opts) {
-		const transport = this.transport;
-		if (!transport) return Promise.resolve({
+	perform(code, opts) {
+		if (opts.signal?.aborted) return Promise.resolve({
 			outcome: "forced",
 			failure: {
-				kind: "worker-exit",
-				message: "kernel channels are not connected"
+				kind: "abort",
+				message: String(opts.signal.reason)
 			},
 			streamText: ""
 		});
-		const msg = buildMessage("execute_request", {
-			code,
-			silent: false,
-			store_history: false,
-			user_expressions: {},
-			allow_stdin: false,
-			stop_on_error: true
-		}, this.session, this.options.username);
 		return new Promise((resolve$1) => {
-			const execution = {
-				requestMsgId: msg.header.msg_id,
+			const active = {
+				id: randomUUID(),
 				opts,
 				streamText: "",
-				status: "ok",
-				settled: false,
-				resolve: resolve$1
+				started: false,
+				resolve: resolve$1,
+				rejectCallbacks: /* @__PURE__ */ new Set()
 			};
-			this.activeExec = execution;
-			const settle = (outcome) => {
-				if (execution.settled) return;
-				execution.settled = true;
-				if (execution.forceTimer) clearTimeout(execution.forceTimer);
-				if (execution.timeoutTimer) clearTimeout(execution.timeoutTimer);
-				if (execution.alarmTimer) clearTimeout(execution.alarmTimer);
-				execution.detachSignal?.();
-				if (this.activeExec === execution) this.activeExec = void 0;
-				resolve$1(outcome);
-			};
-			const interruptAndForce = (failure) => {
-				if (this.activeExec !== execution) return;
-				if (execution.pendingForce === void 0) execution.pendingForce = failure;
-				this.sendInterrupt(execution);
-				execution.forceTimer = setTimeout(() => {
-					settle({
-						outcome: "forced",
-						failure,
-						streamText: execution.streamText
-					});
-				}, opts.interruptGraceMs);
-				execution.forceTimer.unref?.();
-			};
-			const onAbort = () => {
-				interruptAndForce({
+			this.active = active;
+			active.timeout = setTimeout(() => this.interrupt(active, {
+				kind: "timeout",
+				message: `Python cell exceeded ${opts.timeoutMs}ms`
+			}), opts.timeoutMs);
+			if (opts.signal) {
+				const signal = opts.signal;
+				const abort = () => this.interrupt(active, {
 					kind: "abort",
-					message: String(opts.signal?.reason)
-				});
-			};
-			execution.timeoutTimer = setTimeout(() => {
-				interruptAndForce({
-					kind: "timeout",
-					message: `cell exceeded ${opts.timeoutMs}ms wall budget`
-				});
-			}, opts.timeoutMs);
-			execution.timeoutTimer.unref?.();
-			opts.signal?.addEventListener("abort", onAbort, { once: true });
-			execution.detachSignal = () => opts.signal?.removeEventListener("abort", onAbort);
-			if (opts.signal?.aborted) onAbort();
-			try {
-				transport.send("shell", msg);
-			} catch {
-				settle({
-					outcome: "forced",
-					failure: {
-						kind: "worker-exit",
-						message: "shell channel send failed"
-					},
-					streamText: execution.streamText
+					message: String(signal.reason)
 				});
+				signal.addEventListener("abort", abort, { once: true });
+				active.detach = () => signal.removeEventListener("abort", abort);
 			}
+			this.child?.stdin?.write(JSON.stringify({
+				id: active.id,
+				code,
+				...this.options.cwd ? { cwd: this.options.cwd } : {}
+			}) + "\n");
 		});
 	}
-	/**
-	* Route one relayed message. Only iopub drives executions and comms; shell
-	* replies serve the startup probe (via `waitFor`), and control is inbound
-	* for host replies.
-	*/
-	handleTransportMessage(channel, incoming) {
-		if (channel !== "iopub") return;
-		const msgType = incoming.header.msg_type;
-		if (msgType === "comm_open" || msgType === "comm_msg" || msgType === "comm_close") {
-			this.handleCommMessage(incoming);
-			return;
-		}
-		this.handleExecutionMessage(incoming);
-	}
-	forceSettleActive(failure) {
-		const execution = this.activeExec;
-		if (!execution || execution.settled) return;
-		execution.settled = true;
-		if (execution.forceTimer) clearTimeout(execution.forceTimer);
-		if (execution.timeoutTimer) clearTimeout(execution.timeoutTimer);
-		if (execution.alarmTimer) clearTimeout(execution.alarmTimer);
-		execution.detachSignal?.();
-		this.activeExec = void 0;
-		execution.resolve({
-			outcome: "forced",
-			failure,
-			streamText: execution.streamText
-		});
-	}
-	handleExecutionMessage(incoming) {
-		const execution = this.activeExec;
-		if (!execution || execution.settled) return;
-		if (incoming.parent_header.msg_id !== execution.requestMsgId) return;
-		const msgType = incoming.header.msg_type;
-		if (msgType === "stream") {
-			const content = incoming.content;
-			if (typeof content.text === "string") execution.streamText += content.text;
-		} else if (msgType === "error") {
-			const content = incoming.content;
-			execution.cellError = {
-				ename: typeof content.ename === "string" ? content.ename : "Error",
-				evalue: typeof content.evalue === "string" ? content.evalue : "",
-				traceback: Array.isArray(content.traceback) ? content.traceback : []
-			};
-			execution.status = "error";
-		} else if (msgType === "status") {
-			if (incoming.content.execution_state === "idle") this.settleCompleted(execution);
-		}
-	}
-	settleCompleted(execution) {
-		if (execution.settled) return;
-		execution.settled = true;
-		if (execution.forceTimer) clearTimeout(execution.forceTimer);
-		if (execution.timeoutTimer) clearTimeout(execution.timeoutTimer);
-		if (execution.alarmTimer) clearTimeout(execution.alarmTimer);
-		execution.detachSignal?.();
-		if (this.activeExec === execution) this.activeExec = void 0;
-		if (execution.pendingForce !== void 0) {
-			execution.resolve({
-				outcome: "forced",
-				failure: execution.pendingForce,
-				streamText: execution.streamText
-			});
-			return;
-		}
-		execution.resolve({
-			outcome: "completed",
-			status: execution.status,
-			streamText: execution.streamText,
-			...execution.cellError ? { cellError: execution.cellError } : {}
-		});
-	}
-	handleCommMessage(incoming) {
-		const content = incoming.content;
-		const commId = content.comm_id;
-		if (typeof commId !== "string") return;
-		const msgType = incoming.header.msg_type;
-		if (msgType === "comm_close") {
-			this.commTargets.delete(commId);
-			this.servedComms.delete(commId);
-			return;
-		}
-		if (msgType === "comm_open") {
-			const targetName = content.target_name;
-			if (typeof targetName === "string") this.commTargets.set(commId, targetName);
-			return;
-		}
-		if (msgType === "comm_msg" && this.commTargets.get(commId) === HOST_COMM_TARGET) this.serveHostRequest(commId, content.data);
-	}
-	serveHostRequest(commId, data) {
-		if (this.servedComms.has(commId)) return;
-		this.servedComms.add(commId);
-		const handler = this.activeExec?.opts.hostRequestHandler;
-		if (!handler) {
-			this.replyComm(commId, {
-				status: "error",
-				error: "no host request handler is active"
-			}).catch(() => void 0);
-			return;
-		}
-		if (!isRecord(data)) {
-			this.replyComm(commId, {
-				status: "error",
-				error: "host request payload must be an object"
-			}).catch(() => void 0);
-			return;
-		}
-		(async () => {
-			try {
-				const outcome = await handler(data);
-				if (outcome.ok) await this.replyComm(commId, {
-					status: "ok",
-					result: outcome.result
-				});
-				else await this.replyComm(commId, {
-					status: "error",
-					error: outcome.message
-				});
-			} catch (error) {
-				const message = error instanceof Error ? error.message : String(error);
-				await this.replyComm(commId, {
-					status: "error",
-					error: message
-				}).catch(() => void 0);
-			}
-		})().catch(() => void 0);
-	}
-	async replyComm(commId, data) {
-		const transport = this.transport;
-		if (!transport) throw new Error("kernel channels are not connected");
-		transport.send("control", buildMessage("comm_msg", {
-			comm_id: commId,
-			data
-		}, this.session, this.options.username));
-	}
-	/**
-	* Phase one NOW, phase two on a timer: send the control-channel interrupt,
-	* then — after the confirm window, and only if the execution has still not
-	* settled — escalate to SIGALRM. The zmq interrupt only lands when the cell
-	* yields to the kernel event loop; a busy sync cell ('while True: pass')
-	* never does, which is why the escalation exists at all. Sending both
-	* channels in the same tick (the M1 design) made SIGALRM the FIRST signal
-	* an idle-or-booting kernel saw on timeout/abort: its handler raised
-	* KeyboardInterrupt at the top level and the process exited cleanly — a
-	* deterministic kill (10/10 same-tick aborts, 8/10 at +1-2ms, 40/40 during
-	* cold boot; dev/m2a-report.md §5.1). Two-phase escalation plus the
-	* kernel-side busy guard closes that window while keeping the hard-abort
-	* contract: a busy loop still breaks, one confirm window later.
-	*/
-	async sendInterrupt(execution) {
-		const transport = this.transport;
-		if (!transport) return;
+	interrupt(active, failure) {
+		if (this.active !== active || active.pendingForce) return;
+		active.pendingForce = failure;
+		for (const revoke of [...active.rejectCallbacks]) revoke();
+		if (active.started) this.signal("SIGINT");
+		active.confirm = setTimeout(() => {
+			if (this.active === active && active.started && active.pendingForce) this.signal("SIGINT");
+		}, active.opts.interruptConfirmMs);
+		active.force = setTimeout(() => {
+			this.dispose();
+		}, active.opts.interruptGraceMs);
+	}
+	settle(outcome) {
+		const active = this.active;
+		if (!active) return;
+		this.active = void 0;
+		clearTimeout(active.timeout);
+		clearTimeout(active.force);
+		clearTimeout(active.confirm);
+		active.detach?.();
+		for (const revoke of [...active.rejectCallbacks]) revoke();
+		active.resolve(outcome);
+	}
+	signal(signal) {
 		try {
-			transport.interrupt();
+			this.child?.kill(signal);
 		} catch {}
-		execution.alarmTimer = setTimeout(() => {
-			if (execution.settled) return;
-			if (this.kernel?.exitCode === null) try {
-				this.kernel.kill("SIGALRM");
-			} catch {}
-		}, execution.opts.interruptConfirmMs);
-		execution.alarmTimer.unref?.();
 	}
-	/**
-	* Snapshot the user namespace via an internal dill cell. Requires `dill` in
-	* the kernel environment. The cell reports its outcome through a nonce
-	* envelope (skipped-for-size vs written); a failed/skipped dump NEVER
-	* replaces a previous good snapshot on disk.
-	* @param payloadPath - dill payload destination.
-	* @param manifestPath - JSON manifest destination (turn, names, python
-	*   version, venv path, skills, size).
-	* @param spec - turn counter, skills list, and the size cap.
-	*/
-	async snapshotState(payloadPath, manifestPath, spec) {
-		if (!this.isRunning) return {
-			kind: "failed",
-			reason: "kernel is not running"
-		};
-		const sentinel = `__dashr_snapshot_${randomBytes(9).toString("hex")}__`;
-		const outcome = await this.executeCell(buildSnapshotCell(payloadPath, manifestPath, spec, sentinel), {
-			timeoutMs: this.options.snapshotTimeoutMs,
-			interruptGraceMs: 1e3,
-			interruptConfirmMs: Math.min(this.options.interruptConfirmMs, 500)
-		});
-		if (outcome.outcome !== "completed" || outcome.status !== "ok") return {
-			kind: "failed",
-			reason: "snapshot cell failed"
-		};
-		return this.parseSnapshotEnvelope(outcome.streamText, sentinel);
-	}
-	/** Parse one snapshot cell's nonce envelope into its outcome. */
-	parseSnapshotEnvelope(streamText, sentinel) {
-		const capture = extractStream(streamText, sentinel);
-		if (capture.envelope === void 0) return {
-			kind: "failed",
-			reason: "snapshot cell produced no envelope"
-		};
-		let envelope;
+	killGroup() {
+		const pid = this.child?.pid;
+		if (pid === void 0) return;
 		try {
-			envelope = JSON.parse(capture.envelope);
-		} catch {
-			return {
-				kind: "failed",
-				reason: "snapshot envelope was not valid JSON"
-			};
-		}
-		if (typeof envelope !== "object" || envelope === null) return {
-			kind: "failed",
-			reason: "snapshot envelope was not an object"
-		};
-		const record = envelope;
-		if (record.ok === true) return {
-			kind: "ok",
-			sizeBytes: typeof record.sizeBytes === "number" ? record.sizeBytes : 0,
-			names: typeof record.names === "number" ? record.names : 0
-		};
-		if (record.skipped === true) return {
-			kind: "skipped",
-			reason: typeof record.reason === "string" ? record.reason : "size cap",
-			...typeof record.estimateBytes === "number" ? { estimateBytes: record.estimateBytes } : {},
-			...typeof record.sizeBytes === "number" ? { sizeBytes: record.sizeBytes } : {},
-			capBytes: typeof record.capBytes === "number" ? record.capBytes : 0
-		};
-		return {
-			kind: "failed",
-			reason: typeof record.reason === "string" ? record.reason : "snapshot failed"
-		};
+			if (process.platform !== "win32") process.kill(-pid, "SIGKILL");
+			else this.child?.kill("SIGKILL");
+		} catch {}
 	}
-	/**
-	* Restore a dill snapshot into the user namespace via an internal cell. The
-	* kernel validates the manifest (python version, interpreter identity,
-	* skills) and reports restored vs degraded through a nonce envelope; a
-	* degraded restore leaves the namespace empty.
-	* @param payloadPath - dill payload source.
-	* @param manifestPath - JSON manifest source.
-	*/
-	async restoreState(payloadPath, manifestPath) {
-		if (!this.isRunning) return {
-			kind: "degraded",
-			reason: "kernel is not running"
+	died(message) {
+		this.state = "shutdown";
+		this.deathFailure ??= {
+			kind: "worker-exit",
+			message
 		};
-		const sentinel = `__dashr_restore_${randomBytes(9).toString("hex")}__`;
-		const outcome = await this.executeCell(buildRestoreCell(payloadPath, manifestPath, sentinel), {
+		this.killGroup();
+		this.dispose();
+	}
+	async internal(code, sentinel) {
+		const result = await this.executeCell(code, {
 			timeoutMs: this.options.snapshotTimeoutMs,
 			interruptGraceMs: 1e3,
-			interruptConfirmMs: Math.min(this.options.interruptConfirmMs, 500)
+			interruptConfirmMs: this.options.interruptConfirmMs
 		});
-		if (outcome.outcome !== "completed" || outcome.status !== "ok") return {
-			kind: "degraded",
-			reason: "restore cell failed"
-		};
-		const capture = extractStream(outcome.streamText, sentinel);
-		if (capture.envelope === void 0) return {
-			kind: "degraded",
-			reason: "restore cell produced no envelope"
-		};
-		let envelope;
+		if (result.outcome !== "completed" || result.status !== "ok") return void 0;
 		try {
-			envelope = JSON.parse(capture.envelope);
+			const envelope = JSON.parse(extractStream(result.streamText, sentinel).envelope ?? "");
+			return record(envelope) ? envelope : void 0;
 		} catch {
-			return {
-				kind: "degraded",
-				reason: "restore envelope was not valid JSON"
-			};
+			return;
 		}
-		if (typeof envelope !== "object" || envelope === null) return {
-			kind: "degraded",
-			reason: "restore envelope was not an object"
-		};
-		const record = envelope;
-		if (record.ok === true) return {
-			kind: "restored",
-			count: typeof record.restored === "number" ? record.restored : 0
-		};
-		return {
-			kind: "degraded",
-			reason: typeof record.reason === "string" ? record.reason : "snapshot not replayable"
-		};
 	}
-	/**
-	* Read one user-namespace variable by name (or list the namespace's user
-	* names when `name` is `null`) via an internal cell. JSON-serializable
-	* values cross as `kind: 'json'` text; anything else falls back to `repr`
-	* text (`kind: 'repr'`) so a non-JSON variable is still readable. A missing
-	* name reports `kind: 'missing'` rather than failing the cell.
-	* @param name - the exact variable name, or `null` to list namespace names.
-	*/
 	async queryVar(name$1) {
-		if (!this.isRunning) return {
-			kind: "failed",
-			reason: "kernel is not running"
-		};
-		const sentinel = `__dashr_query_${randomBytes(9).toString("hex")}__`;
-		const outcome = await this.executeCell(buildQueryVarCell(name$1, sentinel), {
-			timeoutMs: this.options.snapshotTimeoutMs,
-			interruptGraceMs: 1e3,
-			interruptConfirmMs: Math.min(this.options.interruptConfirmMs, 500)
-		});
-		if (outcome.outcome !== "completed" || outcome.status !== "ok") return {
-			kind: "failed",
-			reason: "query cell failed"
-		};
-		const capture = extractStream(outcome.streamText, sentinel);
-		if (capture.envelope === void 0) return {
-			kind: "failed",
-			reason: "query cell produced no envelope"
-		};
-		let envelope;
-		try {
-			envelope = JSON.parse(capture.envelope);
-		} catch {
-			return {
-				kind: "failed",
-				reason: "query envelope was not valid JSON"
-			};
-		}
-		if (!isRecord(envelope)) return {
-			kind: "failed",
-			reason: "query envelope was not an object"
-		};
-		if (envelope.ok !== true) return {
-			kind: "failed",
-			reason: typeof envelope.reason === "string" ? envelope.reason : "query failed"
-		};
-		const kind = envelope.kind;
-		if (kind === "names") return {
+		const sentinel = `__better_query_${randomBytes(12).toString("hex")}__`;
+		const reply = await this.internal(buildQueryVarCell(name$1, sentinel), sentinel);
+		if (reply?.kind === "names" && Array.isArray(reply.names)) return {
 			kind: "names",
-			names: Array.isArray(envelope.names) ? envelope.names.filter((name$2) => typeof name$2 === "string") : []
+			names: reply.names.filter((name$2) => typeof name$2 === "string")
 		};
-		if (kind === "missing") return { kind: "missing" };
-		if (kind === "json" || kind === "repr") return typeof envelope.text === "string" ? {
-			kind,
-			text: envelope.text
-		} : {
-			kind: "failed",
-			reason: "query envelope carried no text"
+		if (reply?.kind === "missing") return { kind: "missing" };
+		if ((reply?.kind === "json" || reply?.kind === "repr") && typeof reply.text === "string") return {
+			kind: reply.kind,
+			text: reply.text
 		};
 		return {
 			kind: "failed",
-			reason: `unknown query kind ${JSON.stringify(kind)}`
+			reason: "Python variable query failed"
 		};
 	}
-	/**
-	* Assign one pre-serialized JSON value into the user namespace under
-	* `name` via an internal cell. The host already validated the name and the
-	* value; the cell only decodes and binds. Uses the same busy guard and
-	* internal-cell budget as the snapshot cells.
-	* @param name - the validated identifier to assign under.
-	* @param valueJson - the lossless-JSON text to decode and bind.
-	*/
 	async setVar(name$1, valueJson) {
-		if (!this.isRunning) return {
+		const sentinel = `__better_set_${randomBytes(12).toString("hex")}__`;
+		return (await this.internal(buildSetVarCell(name$1, valueJson, sentinel), sentinel))?.ok === true ? { kind: "ok" } : {
 			kind: "failed",
-			reason: "kernel is not running"
+			reason: "Python variable assignment failed"
 		};
-		const sentinel = `__dashr_set_${randomBytes(9).toString("hex")}__`;
-		const outcome = await this.executeCell(buildSetVarCell(name$1, valueJson, sentinel), {
-			timeoutMs: this.options.snapshotTimeoutMs,
-			interruptGraceMs: 1e3,
-			interruptConfirmMs: Math.min(this.options.interruptConfirmMs, 500)
-		});
-		if (outcome.outcome !== "completed" || outcome.status !== "ok") return {
-			kind: "failed",
-			reason: "set cell failed"
+	}
+	async snapshotState(payloadPath, manifestPath, spec) {
+		const sentinel = `__better_save_${randomBytes(12).toString("hex")}__`;
+		const reply = await this.internal(buildSnapshotCell(payloadPath, manifestPath, spec, sentinel), sentinel);
+		if (reply?.kind === "ok" && Array.isArray(reply.names) && typeof reply.sizeBytes === "number" && typeof reply.turn === "number" && record(reply.omitted)) return {
+			kind: "ok",
+			sizeBytes: reply.sizeBytes,
+			names: reply.names,
+			omitted: reply.omitted,
+			turn: reply.turn,
+			...typeof reply.warning === "string" ? { warning: reply.warning } : {}
 		};
-		const capture = extractStream(outcome.streamText, sentinel);
-		if (capture.envelope === void 0) return {
-			kind: "failed",
-			reason: "set cell produced no envelope"
+		if (reply?.kind === "skipped") return {
+			kind: "skipped",
+			reason: String(reply.reason),
+			capBytes: spec.sizeCapBytes
 		};
-		let envelope;
-		try {
-			envelope = JSON.parse(capture.envelope);
-		} catch {
-			return {
-				kind: "failed",
-				reason: "set envelope was not valid JSON"
-			};
-		}
-		if (!isRecord(envelope) || envelope.ok !== true) return {
+		return {
 			kind: "failed",
-			reason: isRecord(envelope) && typeof envelope.reason === "string" ? envelope.reason : "set failed"
+			reason: typeof reply?.reason === "string" ? reply.reason : "checkpoint helper timed out, failed, or exited; commit status could not be confirmed"
 		};
-		return { kind: "ok" };
 	}
-	onKernelDeath() {
-		this.state = "shutdown";
-		this.forceSettleActive({
-			kind: "worker-exit",
-			message: `kernel process died. stderr tail:\n${this.stderrTail()}`
-		});
-		this.cleanupResources();
+	async restoreState(payloadPath, manifestPath, bindings = []) {
+		const sentinel = `__better_restore_${randomBytes(12).toString("hex")}__`;
+		const reply = await this.internal(buildRestoreCell(payloadPath, manifestPath, sentinel, bindings), sentinel);
+		if (reply?.kind === "restored" && typeof reply.count === "number" && typeof reply.turn === "number" && record(reply.omitted)) return {
+			kind: "restored",
+			count: reply.count,
+			turn: reply.turn,
+			omitted: reply.omitted
+		};
+		return {
+			kind: "degraded",
+			reason: typeof reply?.reason === "string" ? reply.reason : "checkpoint restore helper failed or timed out"
+		};
 	}
-	cleanupResources() {
-		this.transport?.dispose();
-		this.transport = void 0;
-		this.connection = void 0;
-		try {
-			this.kernel?.kill("SIGKILL");
-		} catch {}
-		this.kernel = void 0;
-		if (this.tempDir) try {
-			rmSync(this.tempDir, {
-				recursive: true,
-				force: true
-			});
-		} catch {}
-		this.tempDir = void 0;
+	dispose() {
+		this.disposePromise ??= this.doDispose();
+		return this.disposePromise;
 	}
-	/** Graceful teardown: shutdown_request, then SIGKILL after the dispose budget. */
-	async dispose() {
-		if (this.state === "shutdown") {
-			this.cleanupResources();
+	async doDispose() {
+		this.state = "shutdown";
+		const child = this.child;
+		if (!child) {
+			this.callbackServer?.closeAllConnections();
+			this.callbackServer?.close();
 			return;
 		}
-		this.state = "shutdown";
-		try {
-			if (this.transport) {
-				this.transport.send("control", buildMessage("shutdown_request", { restart: false }, this.session, this.options.username));
-				await setTimeout$1(SHUTDOWN_DRAIN_MS);
-			}
-		} catch {}
-		const kernel = this.kernel;
-		this.cleanupResources();
-		if (kernel && kernel.exitCode === null && kernel.signalCode === null) await new Promise((resolve$1) => {
-			const timer = setTimeout(() => {
-				kernel.removeListener("exit", onExit);
-				try {
-					kernel.kill("SIGKILL");
-				} catch {}
-				resolve$1();
-			}, this.options.disposeTimeoutMs);
-			timer.unref?.();
-			const onExit = () => {
+		if (!this.active && child.exitCode === null && child.signalCode === null) {
+			child.stdin?.end(JSON.stringify({ type: "exit" }) + "\n");
+			await this.waitClose(Math.min(200, this.options.disposeTimeoutMs));
+		}
+		this.killGroup();
+		await this.waitClose(this.options.disposeTimeoutMs);
+		if (this.active) this.settle({
+			outcome: "forced",
+			failure: this.active.pendingForce ?? this.deathFailure ?? {
+				kind: "worker-exit",
+				message: "Python disposed during cell execution"
+			},
+			streamText: this.active.streamText
+		});
+		for (const reader of this.ownedReaders) reader.close();
+		for (const stream of child.stdio) stream?.destroy();
+		this.callbackServer?.closeAllConnections();
+		this.callbackServer?.close();
+		this.child = void 0;
+	}
+	async waitClose(ms) {
+		if (!this.closePromise) return;
+		await new Promise((resolve$1) => {
+			const timer = setTimeout(resolve$1, ms);
+			this.closePromise.then(() => {
 				clearTimeout(timer);
 				resolve$1();
-			};
-			kernel.once("exit", onExit);
+			});
 		});
 	}
 };
@@ -1898,15 +721,8 @@ var IpyKernelBridge = class {
 //#endregion
 //#region src/runtime.ts
 const IDENTIFIER = /^[A-Za-z_][A-Za-z0-9_]*$/;
-/**
-* Names the kernel-side shim owns (`_dashr`/`__dashr` prefixed, any case —
-* bootstrap helpers plus the per-run `__dashr_completion__` and
-* `__dashr_injected__`), refused as binding globals on top of the seam's
-* shared set.
-*/
-const KERNEL_OWNED_NAME = /^_+dashr/i;
-/** Manifest format version; a snapshot written under a different version is not replayable. */
-const SNAPSHOT_FORMAT = 1;
+/** Runner internals and legacy reserved shim prefix are never injectable variables. */
+const KERNEL_OWNED_NAME = /^(?:_+dashr|__omp_)/i;
 function messageOf(error) {
 	return error instanceof Error ? error.message : String(error);
 }
@@ -1931,7 +747,7 @@ function keyDirectoryName(principal) {
 */
 var DashrRuntime = class extends ReplRuntime {
 	static Config = Schema.object({
-		python: Schema.string().default("python3"),
+		python: Schema.string(),
 		startupTimeoutMs: Schema.number().default(3e4),
 		runTimeoutMs: Schema.number().default(12e4),
 		interruptGraceMs: Schema.number().default(2e3),
@@ -1941,9 +757,6 @@ var DashrRuntime = class extends ReplRuntime {
 		maxOutputBytes: Schema.number().default(67108864),
 		snapshotDir: Schema.string(),
 		snapshotSizeCapBytes: Schema.number().default(268435456),
-		kernelEnvDir: Schema.string(),
-		kernelPythonVersion: Schema.string(),
-		kernelAutoInstall: Schema.boolean().default(true),
 		username: Schema.string().default("dashr")
 	});
 	language = "python";
@@ -1953,11 +766,14 @@ var DashrRuntime = class extends ReplRuntime {
 	/** One entry per session principal that has run code (lazy — never pre-seeded). */
 	kernels = /* @__PURE__ */ new Map();
 	disposed = false;
-	/** Lazily-resolved (and, when managed, provisioned) kernel interpreter. */
-	kernelEnvPromise;
+	transactions = /* @__PURE__ */ new Map();
 	constructor(ctx, config) {
 		super(ctx);
-		this.config = config;
+		const profile = ctx.get("profileContext");
+		this.config = {
+			...config,
+			snapshotDir: config.snapshotDir ?? (profile ? join(profile.home, "better-dsh", "python-repl", createHash("sha256").update(profile.dir).digest("hex")) : void 0)
+		};
 		for (const key of [
 			"startupTimeoutMs",
 			"runTimeoutMs",
@@ -1997,9 +813,21 @@ var DashrRuntime = class extends ReplRuntime {
 	* @param request - the program, its bindings, and the abort signal.
 	* @returns the run's outcome per the seam contract.
 	*/
-	async run(request) {
+	transaction(key, operation) {
+		const result = (this.transactions.get(key) ?? Promise.resolve()).catch(() => void 0).then(operation);
+		this.transactions.set(key, result);
+		result.finally(() => {
+			if (this.transactions.get(key) === result) this.transactions.delete(key);
+		}).catch(() => void 0);
+		return result;
+	}
+	run(request) {
+		return this.transaction(request.principal || AGENTLESS_KEY, () => this.runTransaction(request));
+	}
+	async runTransaction(request) {
 		if (this.disposed) throw new Error("dashr-repl: run() after disposal");
 		const bindings = this.validateBindings(request);
+		const bindingNames = request.bindings.flatMap((binding) => [binding.global, ...binding.errorClass ? [binding.errorClass.name] : []]);
 		if (request.signal?.aborted) return {
 			logs: [],
 			error: {
@@ -2012,7 +840,7 @@ var DashrRuntime = class extends ReplRuntime {
 		const dead = this.kernels.get(key);
 		if (dead?.bridge.isDead) {
 			this.kernels.delete(key);
-			if (dead.ranCells) return await this.reviveAfterDeath(key, dead);
+			if (dead.ranCells) return await this.reviveAfterDeath(key, dead, false, bindingNames);
 		}
 		let entry;
 		try {
@@ -2025,8 +853,8 @@ var DashrRuntime = class extends ReplRuntime {
 		}
 		if (!entry.restoreAttempted) {
 			entry.restoreAttempted = true;
-			const restore = await this.restoreEntry(entry);
-			if (restore.kind === "restored") entry.pendingNotice = `namespace restored from the turn-${restore.turn} snapshot`;
+			const restore = await this.restoreEntry(entry, bindingNames);
+			if (restore.kind === "restored") entry.pendingNotice = `namespace restored from the turn-${restore.turn} snapshot${this.omissionNotice(restore.omitted)}`;
 			else if (restore.kind === "degraded") entry.pendingNotice = `snapshot not replayable (${restore.reason}); started from an EMPTY namespace — re-create any state you need`;
 		}
 		const kernel = entry.bridge;
@@ -2049,17 +877,13 @@ var DashrRuntime = class extends ReplRuntime {
 			entry.turn += 1;
 		} else if (outcome.outcome === "forced" && outcome.failure.kind === "worker-exit" && kernel.isDead && !this.disposed) {
 			if (this.kernels.get(key) === entry) this.kernels.delete(key);
-			if (entry.ranCells) return await this.reviveAfterDeath(key, entry);
+			const revived = await this.reviveAfterDeath(key, entry, true, bindingNames);
+			return finalizeOutput(extractStream(outcome.streamText, sentinel).logs, revived.value, revived.error, this.config.maxOutputBytes);
 		}
 		let result = this.assembleResult(outcome, sentinel);
 		if (outcome.outcome === "completed") {
 			const snapshot = await this.snapshotTurnEnd(entry);
-			const notices = [];
-			if (snapshot.skipped && !entry.warnedSnapshotSkip) {
-				entry.warnedSnapshotSkip = true;
-				const detail = snapshot.estimateBytes !== void 0 ? `estimated ${snapshot.estimateBytes} bytes` : `${snapshot.sizeBytes ?? "unknown"} bytes serialized`;
-				notices.push(`[dashr] namespace snapshot skipped: ${detail} exceeds snapshotSizeCapBytes (${this.config.snapshotSizeCapBytes}) — later turn-end snapshots are skipped while the namespace stays this large`);
-			}
+			const notices = snapshot ? [snapshot] : [];
 			if (entry.pendingNotice) {
 				notices.push(`[dashr] ${entry.pendingNotice}`);
 				entry.pendingNotice = void 0;
@@ -2079,7 +903,10 @@ var DashrRuntime = class extends ReplRuntime {
 	* @param name - the variable name, or empty to list namespace names.
 	* @param principal - the session key (absent → the shared default).
 	*/
-	async queryVar(name$1, principal) {
+	queryVar(name$1, principal) {
+		return this.transaction(principal || AGENTLESS_KEY, () => this.queryTransaction(name$1, principal));
+	}
+	async queryTransaction(name$1, principal) {
 		if (this.disposed) throw new Error("dashr-repl: queryVar() after disposal");
 		const key = principal && principal.length > 0 ? principal : AGENTLESS_KEY;
 		const bridge = this.kernels.get(key)?.bridge;
@@ -2115,12 +942,15 @@ var DashrRuntime = class extends ReplRuntime {
 	* @param value - the lossless-JSON value to bind.
 	* @param principal - the session key (absent → the shared default).
 	*/
-	async setVar(name$1, value, principal) {
+	setVar(name$1, value, principal) {
+		return this.transaction(principal || AGENTLESS_KEY, () => this.setTransaction(name$1, value, principal));
+	}
+	async setTransaction(name$1, value, principal) {
 		if (this.disposed) throw new Error("dashr-repl: setVar() after disposal");
 		const trimmed = name$1.trim();
 		if (trimmed.length === 0) throw new Error("dashr-repl: setVar() requires a non-empty variable name");
 		if (!IDENTIFIER.test(trimmed)) throw new Error(`dashr-repl: setVar() name ${JSON.stringify(trimmed)} is not a usable identifier`);
-		if (KERNEL_OWNED_NAME.test(trimmed)) throw new Error(`dashr-repl: setVar() name ${JSON.stringify(trimmed)} is reserved by the kernel`);
+		if (KERNEL_OWNED_NAME.test(trimmed) || RESERVED_BINDING_GLOBALS.has(trimmed) || trimmed === "__doc__") throw new Error(`dashr-repl: setVar() name ${JSON.stringify(trimmed)} is reserved by the kernel`);
 		const jsonValue = snapshotJsonValue(value);
 		if (jsonValue === void 0) throw new Error("dashr-repl: setVar() value must be lossless JSON");
 		const key = principal && principal.length > 0 ? principal : AGENTLESS_KEY;
@@ -2128,6 +958,9 @@ var DashrRuntime = class extends ReplRuntime {
 		if (!bridge || !bridge.isRunning) throw new Error("dashr-repl: setVar() requires a live kernel for this session — run a cell first");
 		const outcome = await bridge.setVar(trimmed, JSON.stringify(jsonValue));
 		if (outcome.kind === "failed") throw new Error(`dashr-repl: setVar(${JSON.stringify(trimmed)}) failed: ${outcome.reason}`);
+		const entry = this.kernels.get(key);
+		const notice = await this.snapshotTurnEnd(entry);
+		if (notice) entry.pendingNotice = [entry.pendingNotice, notice].filter(Boolean).join("; ");
 	}
 	/** Map one cell outcome onto the seam's result shape under the output ledger. */
 	assembleResult(outcome, sentinel) {
@@ -2193,8 +1026,8 @@ var DashrRuntime = class extends ReplRuntime {
 			ok: false,
 			message: "host request must be a binding.call with global and name"
 		};
-		const record = bindings.get(data.global)?.functions;
-		const fn = record && Object.hasOwn(record, data.name) ? record[data.name] : void 0;
+		const record$1 = bindings.get(data.global)?.functions;
+		const fn = record$1 && Object.hasOwn(record$1, data.name) ? record$1[data.name] : void 0;
 		if (typeof fn !== "function") return {
 			ok: false,
 			message: `unknown binding ${JSON.stringify(`${data.global}.${data.name}`)}`
@@ -2223,23 +1056,6 @@ var DashrRuntime = class extends ReplRuntime {
 			result: value
 		};
 	}
-	/** Resolve (and provision, when managed) the kernel interpreter once per runtime. */
-	resolveKernelPython() {
-		this.kernelEnvPromise ??= resolveKernelEnv({
-			python: this.config.python,
-			venvDir: this.config.kernelEnvDir,
-			pythonVersion: this.config.kernelPythonVersion,
-			autoInstall: this.config.kernelAutoInstall,
-			log: (level, message) => {
-				if (level === "warn") this.logger.warn(message);
-				else this.logger.info(message);
-			}
-		}).catch((error) => {
-			this.kernelEnvPromise = void 0;
-			throw error;
-		});
-		return this.kernelEnvPromise;
-	}
 	/**
 	* Spawn-or-reuse the kernel for one key. The lazy map guarantees one
 	* entry is created here and nowhere else, so a key that never runs never
@@ -2251,150 +1067,129 @@ var DashrRuntime = class extends ReplRuntime {
 		let entry = this.kernels.get(key);
 		if (!entry) {
 			const kernelCwd = cwd && existsSync(cwd) ? cwd : void 0;
+			const environment = await resolveKernelEnv({
+				python: this.config.python,
+				cwd: kernelCwd
+			});
 			entry = {
 				key,
 				cwd: kernelCwd,
 				bridge: new IpyKernelBridge({
-					python: (await this.resolveKernelPython()).python,
+					python: environment.python,
+					env: environment.env,
 					...kernelCwd ? { cwd: kernelCwd } : {},
 					startupTimeoutMs: this.config.startupTimeoutMs,
 					disposeTimeoutMs: this.config.disposeTimeoutMs,
 					interruptConfirmMs: this.config.interruptConfirmMs,
 					snapshotTimeoutMs: this.config.snapshotTimeoutMs,
-					username: this.config.username
+					username: this.config.username,
+					snapshotDirectory: this.config.snapshotDir ? join(this.config.snapshotDir, keyDirectoryName(key)) : void 0,
+					snapshotSizeCapBytes: this.config.snapshotSizeCapBytes
 				}),
 				ranCells: false,
 				turn: 0
 			};
 			this.kernels.set(key, entry);
 		}
+		if (this.disposed) {
+			await entry.bridge.dispose();
+			throw new Error("runtime disposed during startup");
+		}
 		await entry.bridge.start();
 		return entry;
 	}
-	/**
-	* Restore a key's on-disk snapshot into a freshly booted kernel, when one
-	* exists and its manifest is plausible. Called once per entry boot. The
-	* kernel-side restore cell performs the authoritative environment checks
-	* (python version, interpreter identity, skills); this method only gates on
-	* the manifest the host can read cheaply, then records the turn so the
-	* first-run notice and the revive chain can name it.
-	*/
-	async restoreEntry(entry) {
+	/** Restore once before user admission; any degraded load retires that child. */
+	async restoreEntry(entry, bindingNames) {
 		if (!this.config.snapshotDir) return { kind: "none" };
 		const dir = join(this.config.snapshotDir, keyDirectoryName(entry.key));
-		const payloadPath = join(dir, "state.dill");
 		const manifestPath = join(dir, "manifest.json");
-		const manifest = this.readSnapshotManifest(entry.key);
-		if (manifest === void 0) return { kind: "none" };
-		if (manifest.snapshotFormat !== SNAPSHOT_FORMAT) return {
-			kind: "degraded",
-			reason: `snapshot format ${String(manifest.snapshotFormat)} is not replayable`
-		};
-		if (manifest.skipped === true) return { kind: "none" };
-		if (!existsSync(payloadPath)) return {
-			kind: "degraded",
-			reason: "snapshot payload is missing"
-		};
-		const restored = await entry.bridge.restoreState(payloadPath, manifestPath);
+		if (!existsSync(manifestPath)) return { kind: "none" };
+		const restored = await entry.bridge.restoreState(join(dir, "state.dill"), manifestPath, bindingNames);
 		if (restored.kind === "restored") {
-			entry.turn = typeof manifest.turn === "number" && Number.isSafeInteger(manifest.turn) && manifest.turn >= 0 ? manifest.turn : 0;
-			entry.lastSnapshotTurn = entry.turn;
+			entry.turn = restored.turn;
+			entry.lastSnapshotTurn = restored.turn;
 			entry.ranCells = true;
 			return {
 				kind: "restored",
-				turn: entry.turn
+				turn: restored.turn,
+				omitted: restored.omitted
 			};
 		}
+		await entry.bridge.dispose();
+		this.kernels.delete(entry.key);
+		entry.bridge = (await this.ensureKernel(entry.key, entry.cwd)).bridge;
+		this.kernels.set(entry.key, entry);
 		return {
 			kind: "degraded",
 			reason: restored.reason
 		};
 	}
-	/** Read the per-key manifest's host-relevant fields; absent when unreadable/missing. */
-	readSnapshotManifest(key) {
-		if (!this.config.snapshotDir) return void 0;
-		try {
-			return JSON.parse(readFileSync(join(this.config.snapshotDir, keyDirectoryName(key), "manifest.json"), "utf8"));
-		} catch {
-			return;
-		}
+	omissionNotice(omitted) {
+		const entries = Object.entries(omitted);
+		return entries.length ? `; partial coverage, omitted ${entries.map(([name$1, reason]) => `${name$1} (${reason})`).join(", ")}` : "";
 	}
-	/**
-	* Revive one session's kernel after death: respawn a fresh kernel, restore
-	* the nearest replayable snapshot onto it (the normal restore path), and
-	* return the death-observing run's explicit error naming the turn. When no
-	* replayable snapshot exists the message falls back to M3-A's fresh-empty
-	* contract. The run itself does NOT execute — an error that lies about a
-	* NameError costs the model more than one dropped cell (blueprint §8.3).
-	* @param key - the run principal.
-	* @param dead - the entry that died (its `turn` is the last completed turn).
-	*/
-	async reviveAfterDeath(key, dead) {
+	/** Restore a fresh child and report whether the observing call had started. */
+	async reviveAfterDeath(key, dead, started, bindingNames) {
+		const execution = started ? "This cell may have executed partially, including external side effects; inspect their state before choosing any retry. No user code was replayed." : "This observing call did not execute. No user code was replayed.";
 		let entry;
 		try {
 			entry = await this.ensureKernel(key, dead.cwd);
 		} catch (error) {
 			return finalizeOutput([], void 0, {
 				kind: "worker-exit",
-				message: `kernel died and respawn failed (${messageOf(error)}); the next run will retry a fresh kernel`
+				message: `kernel died and respawn failed (${messageOf(error)}); the next run will retry a fresh kernel. ${execution}`
 			}, this.config.maxOutputBytes);
 		}
 		entry.restoreAttempted = true;
-		const restore = await this.restoreEntry(entry);
-		const observingTurn = dead.turn + 1;
-		if (restore.kind === "restored") {
-			const lost = observingTurn - restore.turn;
-			const rounds = lost === 1 ? "round" : "rounds";
-			return finalizeOutput([], void 0, {
-				kind: "worker-exit",
-				message: `the kernel for this session died; its namespace was restored from the turn-${restore.turn} snapshot — the last ${lost} ${rounds} of variable operations must be replayed. This run did not execute.`
-			}, this.config.maxOutputBytes);
-		}
+		const restore = await this.restoreEntry(entry, bindingNames);
+		entry.turn = Math.max(entry.turn, dead.turn);
+		if (restore.kind === "restored") return finalizeOutput([], void 0, {
+			kind: "worker-exit",
+			message: `the kernel for this session died; its namespace was restored from the turn-${restore.turn} snapshot${this.omissionNotice(restore.omitted)}. Changes after that checkpoint may be lost. ${execution}`
+		}, this.config.maxOutputBytes);
 		return finalizeOutput([], void 0, {
 			kind: "worker-exit",
-			message: `the kernel for this session died and no replayable snapshot was available${restore.kind === "degraded" ? ` (${restore.reason})` : ""}; the next run starts a fresh kernel with an EMPTY namespace — re-create any state you still need. This run did not execute.`
+			message: `the kernel for this session died and no usable snapshot was available${restore.kind === "degraded" ? ` (${restore.reason})` : ""}; the next run uses an EMPTY namespace. ${execution}`
 		}, this.config.maxOutputBytes);
 	}
-	/**
-	* Write one key's turn-end snapshot, when a snapshot directory is
-	* configured. A size-cap skip is reported (so the run can warn the model
-	* once); other failures log without disturbing the run.
-	*/
+	/** Save completed mutations and expose partial/failed coverage within output limits. */
 	async snapshotTurnEnd(entry) {
-		if (!this.config.snapshotDir) return { skipped: false };
-		const kernel = entry.bridge;
-		if (!kernel.isRunning) return { skipped: false };
+		if (!this.config.snapshotDir || !entry.bridge.isRunning || this.disposed) return;
 		const dir = join(this.config.snapshotDir, keyDirectoryName(entry.key));
-		mkdirSync(dir, { recursive: true });
 		const spec = {
 			turn: entry.turn,
 			skills: [],
 			sizeCapBytes: this.config.snapshotSizeCapBytes
 		};
-		const outcome = await kernel.snapshotState(join(dir, "state.dill"), join(dir, "manifest.json"), spec);
+		let outcome;
+		try {
+			mkdirSync(dir, {
+				recursive: true,
+				mode: 448
+			});
+			outcome = await entry.bridge.snapshotState(join(dir, "state.dill"), join(dir, "manifest.json"), spec);
+		} catch (error) {
+			outcome = {
+				kind: "failed",
+				reason: messageOf(error)
+			};
+		}
 		if (outcome.kind === "ok") {
-			entry.lastSnapshotTurn = entry.turn;
-			return { skipped: false };
+			entry.lastSnapshotTurn = outcome.turn;
+			const omission = this.omissionNotice(outcome.omitted);
+			const warning = outcome.warning ? `; ${outcome.warning}` : "";
+			return omission || warning ? `[dashr] turn-${outcome.turn} checkpoint saved${omission}${warning}` : void 0;
 		}
-		if (outcome.kind === "skipped") return {
-			skipped: true,
-			...outcome.estimateBytes !== void 0 ? { estimateBytes: outcome.estimateBytes } : {},
-			...outcome.sizeBytes !== void 0 ? { sizeBytes: outcome.sizeBytes } : {}
-		};
-		this.logger.warn(`turn-end snapshot for ${JSON.stringify(entry.key)} failed: ${outcome.reason}`);
-		return { skipped: false };
+		const latest = entry.lastSnapshotTurn === void 0 ? "no successful checkpoint available" : `latest successful checkpoint is turn-${entry.lastSnapshotTurn}`;
+		return `[dashr] namespace snapshot ${outcome.kind === "skipped" ? "skipped" : "failed"}: ${outcome.reason}; ${latest}`;
 	}
-	/**
-	* Dispose to quiescence: snapshot every live key's namespace when a
-	* snapshot directory is configured (each under its own per-key
-	* subdirectory), then shut the subprocesses down. Registered as the
-	* plugin's `ctx.effect` disposer.
-	*/
+	/** Cancel active work, drain admitted transactions, and reap every owned child. */
 	async teardown() {
 		this.disposed = true;
-		const entries = [...this.kernels.values()];
+		await Promise.all([...this.kernels.values()].map((entry) => entry.bridge.dispose()));
+		await Promise.allSettled([...this.transactions.values()]);
+		await Promise.all([...this.kernels.values()].map((entry) => entry.bridge.dispose()));
 		this.kernels.clear();
-		await Promise.all(entries.map((entry) => this.teardownKernel(entry)));
 	}
 	/**
 	* Tear one session's kernel down (session end via the `agent/disposed`
@@ -2402,15 +1197,17 @@ var DashrRuntime = class extends ReplRuntime {
 	* which is what makes hearing every agent's disposal safe.
 	*/
 	async destroyKey(key) {
-		const entry = this.kernels.get(key);
-		if (!entry) return;
-		this.kernels.delete(key);
-		await this.teardownKernel(entry);
+		await this.kernels.get(key)?.bridge.dispose();
+		await this.transaction(key, async () => {
+			const entry = this.kernels.get(key);
+			this.kernels.delete(key);
+			await entry?.bridge.dispose();
+		});
 	}
 	/**
 	* Reset one session's kernel to a fresh, empty namespace: dispose the live
 	* subprocess WITHOUT a turn-end snapshot and clear its on-disk snapshot, so
-	* the next ensureKernel spawns empty (restore finds nothing to replay).
+	* the next ensureKernel spawns empty (restore finds no checkpoint).
 	*/
 	async resetKey(key) {
 		const entry = this.kernels.get(key);
@@ -2423,24 +1220,6 @@ var DashrRuntime = class extends ReplRuntime {
 			force: true
 		});
 	}
-	/** Snapshot (when configured) then dispose one key's kernel; failures log, never throw into a listener. */
-	async teardownKernel(entry) {
-		const kernel = entry.bridge;
-		if (this.config.snapshotDir && kernel.isRunning) try {
-			const dir = join(this.config.snapshotDir, keyDirectoryName(entry.key));
-			mkdirSync(dir, { recursive: true });
-			const spec = {
-				turn: entry.turn,
-				skills: [],
-				sizeCapBytes: this.config.snapshotSizeCapBytes
-			};
-			const saved = await kernel.snapshotState(join(dir, "state.dill"), join(dir, "manifest.json"), spec);
-			if (saved.kind !== "ok" && saved.kind !== "skipped") this.logger.warn(`kernel namespace snapshot for ${JSON.stringify(entry.key)} failed: ${saved.reason}`);
-		} catch (error) {
-			this.logger.warn(`kernel namespace snapshot for ${JSON.stringify(entry.key)} failed: ${messageOf(error)}`);
-		}
-		await kernel.dispose();
-	}
 };
 
 //#endregion
@@ -3389,7 +2168,7 @@ function createRunCellTool(registry, options) {
 			},
 			reset: {
 				type: "boolean",
-				description: "Optional: reset the persistent pad namespace to EMPTY before running — variables, imports, and definitions from earlier cells are discarded and the pad restarts fresh. Omit to keep the namespace."
+				description: "Optional: reset the persistent pad namespace to EMPTY before running and delete its saved checkpoints — variables, imports, and definitions from earlier cells are discarded and the pad restarts fresh. Omit to keep the namespace."
 			}
 		},
 		output: {
@@ -3701,10 +2480,7 @@ const RUNTIME_CONFIG_KEYS = [
 	"maxOutputBytes",
 	"snapshotDir",
 	"snapshotSizeCapBytes",
-	"username",
-	"kernelEnvDir",
-	"kernelPythonVersion",
-	"kernelAutoInstall"
+	"username"
 ];
 /** The runtime slice of the merged config — the keys `DashrRuntime` owns. */
 function pickRuntimeConfig(config) {
@@ -3716,20 +2492,6 @@ function apply(ctx, config) {
 	ctx.plugin(DashrRuntime, pickRuntimeConfig(config));
 	const logger = ctx.logger("dashr-repl");
 	const maxParallel = resolveMaxParallelSubCalls(config.maxParallelSubCalls);
-	{
-		const kernelConfig = pickRuntimeConfig(config);
-		resolveKernelEnv({
-			python: kernelConfig.python,
-			venvDir: kernelConfig.kernelEnvDir,
-			pythonVersion: kernelConfig.kernelPythonVersion,
-			autoInstall: kernelConfig.kernelAutoInstall ?? true,
-			log: (level, message) => {
-				logger[level](message);
-			}
-		}).catch((error) => {
-			logger.error(`dashr-repl: spin-up kernel check failed (non-blocking): ${error instanceof Error ? error.message : String(error)}`);
-		});
-	}
 	ctx.inject(["replRuntime"], (runtimeCtx) => {
 		const requireRuntime = () => {
 			const runtime = runtimeCtx.get("replRuntime");