dsh-ptc-plus 0.3.2 → 0.4.1

package/internal/session-journal.js

@@ -2,42 +2,72 @@ import { decodeValue, encodeValue, normalizeValueWire } from './value-wire.js'
 import { normalizeDiagnostic } from './diagnostic.js'
 import { assertOwnFields, isRecord } from './record-utils.js'
 import { sessionEvents } from './session-events.js'
+import { LEGACY_LANGUAGE_SEMANTICS, normalizeLanguageSemantics } from './language-semantics.js'
 import {
   LEGACY_DEFAULT_EXPORT_BINDING,
-  LIVE_DEFAULT_EXPORT_BINDING,
+  LEGACY_IMPORT_EXPRESSION_BOUNDARY,
+  LIVE_MODULE_SEMANTICS,
 } from './repl-rewrite-contract.js'
-
-export const JOURNAL_KEY = 'dshPtcPlus'
-export const EDIT_TARGET_KEY = 'dshPtcPlusEdit'
-export const DERIVED_RUN_KEY = 'dshPtcPlusDerivedRun'
-export const REWRITES_KEY = 'dshPtcPlusRewrites'
-export const RECOVERY_BOUNDARY_KEY = 'dshPtcPlusRecoveryBoundaries'
-export const JOURNAL_VERSION = 4
-const LEGACY_JOURNAL_VERSION = 1
-const INTERMEDIATE_JOURNAL_VERSION = 2
-const PREVIOUS_JOURNAL_VERSION = 3
-export const RECOVERY_BOUNDARY_EVENT = 'ptc-plus/recovery-boundary'
-
-const STATUSES = new Set(['durable', 'volatile', 'discarded', 'noop'])
-const BINDING_MODES = new Set(['loose', 'strict'])
-const JOURNAL_FIELDS = new Set(['version', 'bindingPolicy', 'rewritePolicy', 'moduleSemantics', 'status', 'calls', 'operations', 'confirms', 'diagnostics', 'completion', 'volatileReason'])
-const PREDECESSOR_JOURNAL_FIELDS = new Set(['version', 'bindingMode', 'rewritePolicy', 'status', 'calls', 'operations', 'confirms', 'diagnostics', 'completion', 'volatileReason'])
-const LEGACY_JOURNAL_FIELDS = new Set([...PREDECESSOR_JOURNAL_FIELDS].filter(field => field !== 'rewritePolicy'))
-const BINDING_POLICY_FIELDS = new Set(['variableRedeclarations', 'functionClassRedeclarations'])
-const REWRITE_POLICY_FIELDS = new Set(['autoRewriteImports', 'autoStripExports', 'autoSplitRedeclarations'])
-const MODULE_SEMANTICS_FIELDS = new Set(['defaultExportBinding'])
-const DEFAULT_EXPORT_BINDINGS = new Set([
-  LEGACY_DEFAULT_EXPORT_BINDING,
-  LIVE_DEFAULT_EXPORT_BINDING,
-])
-const CALL_SUCCESS_FIELDS = new Set(['global', 'member', 'args', 'ok', 'value', 'settle'])
-const CALL_ERROR_FIELDS = new Set(['global', 'member', 'args', 'ok', 'error', 'settle'])
-const OPERATION_FIELDS = new Set(['action', 'name'])
-const RETURN_FIELDS = new Set(['kind', 'hasValue', 'value'])
-const THROW_FIELDS = new Set(['kind', 'error'])
-const ERROR_FIELDS = new Set(['kind', 'message'])
-const EDIT_TARGET_FIELDS = new Set(['targetCallSeq'])
-const DERIVED_RUN_FIELDS = new Set(['code', 'description'])
+import { userBindingsSnapshotFromMeta } from './user-bindings.js'
+import {
+  JOURNAL_KEY,
+  EDIT_TARGET_KEY,
+  DERIVED_RUN_KEY,
+  REWRITES_KEY,
+  RECOVERY_BOUNDARY_KEY,
+  JOURNAL_VERSION,
+  IMPORT_BOUNDARY_JOURNAL_VERSION,
+  PER_NAME_USER_BINDINGS_JOURNAL_VERSION,
+  PER_NAME_JOURNAL_FIELDS,
+  WHOLE_ENTRY_JOURNAL_FIELDS,
+  LIVE_USER_BINDINGS_SHADOW_POLICY,
+  LEGACY_USER_BINDINGS_SHADOW_POLICY,
+  normalizeJournalUserBindingNames,
+  LIVE_USER_BINDINGS_REUSE_POLICY,
+  LEGACY_USER_BINDINGS_REUSE_POLICY,
+  LEGACY_JOURNAL_VERSION,
+  USER_BINDING_RELATIONLESS_JOURNAL_VERSION,
+  FINGERPRINT_REUSE_JOURNAL_VERSION,
+  VERSIONED_BINDING_REUSE_JOURNAL_VERSION,
+  RECOVERY_BOUNDARY_EVENT,
+  STATUSES,
+  BINDING_MODES,
+  JOURNAL_FIELDS,
+  FINGERPRINT_REUSE_JOURNAL_FIELDS,
+  RELATIONLESS_JOURNAL_FIELDS,
+  PREDECESSOR_JOURNAL_FIELDS,
+  LEGACY_JOURNAL_FIELDS,
+  BINDING_POLICY_FIELDS,
+  REWRITE_POLICY_FIELDS,
+  MODULE_SEMANTICS_FIELDS,
+  LEGACY_MODULE_SEMANTICS_FIELDS,
+  IMPORT_EXPRESSION_BOUNDARIES,
+  DEFAULT_EXPORT_BINDINGS,
+  CALL_SUCCESS_FIELDS,
+  CALL_ERROR_FIELDS,
+  OPERATION_FIELDS,
+  RETURN_FIELDS,
+  THROW_FIELDS,
+  ERROR_FIELDS,
+  EDIT_TARGET_FIELDS,
+  DERIVED_RUN_FIELDS,
+  JOURNAL_VERSIONS,
+  USER_BINDINGS_REUSE_POLICIES,
+  RECOVERY_BOUNDARY_FIELDS,
+  REWRITE_FIELDS,
+  REWRITE_KINDS,
+} from './session-journal-schema.js'
+
+export {
+  JOURNAL_KEY,
+  EDIT_TARGET_KEY,
+  DERIVED_RUN_KEY,
+  REWRITES_KEY,
+  RECOVERY_BOUNDARY_KEY,
+  JOURNAL_VERSION,
+  LIVE_USER_BINDINGS_REUSE_POLICY,
+  RECOVERY_BOUNDARY_EVENT,
+} from './session-journal-schema.js'
 
 function cloneJson(value) {
   if (value === undefined) return undefined
@@ -197,11 +227,65 @@ function normalizeModuleSemantics(value) {
   if (!DEFAULT_EXPORT_BINDINGS.has(value.defaultExportBinding)) {
     throw new Error('invalid dsh-ptc-plus journal default export binding semantics')
   }
-  return Object.freeze({ defaultExportBinding: value.defaultExportBinding })
+  if (!IMPORT_EXPRESSION_BOUNDARIES.has(value.importExpressionBoundary)) {
+    throw new Error('invalid dsh-ptc-plus journal import expression boundary semantics')
+  }
+  return Object.freeze({
+    defaultExportBinding: value.defaultExportBinding,
+    importExpressionBoundary: value.importExpressionBoundary,
+  })
+}
+
+function migrateLegacyModuleSemantics(value) {
+  if (!isRecord(value)) throw new Error('invalid dsh-ptc-plus journal module semantics')
+  assertOwnFields(value, LEGACY_MODULE_SEMANTICS_FIELDS, 'journal module semantics')
+  return { ...value, importExpressionBoundary: LEGACY_IMPORT_EXPRESSION_BOUNDARY }
+}
+
+function normalizeUserBindingsFingerprint(value) {
+  if (value !== null && (typeof value !== 'string' || !/^[a-f0-9]{64}$/.test(value))) {
+    throw new Error('invalid dsh-ptc-plus journal user binding fingerprint')
+  }
+  return value
 }
 
 function migrateJournal(value, resolveLegacyConfirm) {
   if (value.version === JOURNAL_VERSION) return value
+  if (value.version === PER_NAME_USER_BINDINGS_JOURNAL_VERSION) {
+    assertOwnFields(value, PER_NAME_JOURNAL_FIELDS, 'dsh-ptc-plus journal')
+    return { ...value, version: JOURNAL_VERSION, languageSemantics: LEGACY_LANGUAGE_SEMANTICS }
+  }
+  const shadow = { userBindingsShadowPolicy: LEGACY_USER_BINDINGS_SHADOW_POLICY, userBindingNames: null,
+    languageSemantics: LEGACY_LANGUAGE_SEMANTICS }
+  if (value.version === IMPORT_BOUNDARY_JOURNAL_VERSION) {
+    assertOwnFields(value, WHOLE_ENTRY_JOURNAL_FIELDS, 'dsh-ptc-plus journal')
+    return { ...value, version: JOURNAL_VERSION, ...shadow }
+  }
+  if (value.version === VERSIONED_BINDING_REUSE_JOURNAL_VERSION) {
+    assertOwnFields(value, WHOLE_ENTRY_JOURNAL_FIELDS, 'dsh-ptc-plus journal')
+    return { ...value, version: JOURNAL_VERSION, ...shadow, moduleSemantics: migrateLegacyModuleSemantics(value.moduleSemantics) }
+  }
+  if (value.version === FINGERPRINT_REUSE_JOURNAL_VERSION) {
+    assertOwnFields(value, FINGERPRINT_REUSE_JOURNAL_FIELDS, 'dsh-ptc-plus journal')
+    return {
+      ...value,
+      version: JOURNAL_VERSION,
+      moduleSemantics: migrateLegacyModuleSemantics(value.moduleSemantics),
+      userBindingsReusePolicy: LEGACY_USER_BINDINGS_REUSE_POLICY,
+      ...shadow,
+    }
+  }
+  if (value.version === USER_BINDING_RELATIONLESS_JOURNAL_VERSION) {
+    assertOwnFields(value, RELATIONLESS_JOURNAL_FIELDS, 'dsh-ptc-plus journal')
+    return {
+      ...value,
+      version: JOURNAL_VERSION,
+      moduleSemantics: migrateLegacyModuleSemantics(value.moduleSemantics),
+      userBindingsFingerprint: null,
+      userBindingsReusePolicy: LEGACY_USER_BINDINGS_REUSE_POLICY,
+      ...shadow,
+    }
+  }
   const legacy = value.version === LEGACY_JOURNAL_VERSION
   assertOwnFields(
     value,
@@ -218,7 +302,13 @@ function migrateJournal(value, resolveLegacyConfirm) {
       functionClassRedeclarations: false,
     },
     rewritePolicy: legacy ? LEGACY_REWRITE_POLICY : value.rewritePolicy,
-    moduleSemantics: { defaultExportBinding: LEGACY_DEFAULT_EXPORT_BINDING },
+    moduleSemantics: {
+      defaultExportBinding: LEGACY_DEFAULT_EXPORT_BINDING,
+      importExpressionBoundary: LEGACY_IMPORT_EXPRESSION_BOUNDARY,
+    },
+    userBindingsFingerprint: null,
+    userBindingsReusePolicy: LEGACY_USER_BINDINGS_REUSE_POLICY,
+    ...shadow,
     confirms: legacy
       ? normalizeLegacyConfirms(value.confirms, resolveLegacyConfirm)
       : value.confirms,
@@ -228,15 +318,22 @@ function migrateJournal(value, resolveLegacyConfirm) {
 /** Validate and detach one journal emitted by the runtime. */
 export function normalizeJournal(value, options = {}) {
   if (!isRecord(value)) throw new Error('invalid dsh-ptc-plus journal')
-  if (![LEGACY_JOURNAL_VERSION, INTERMEDIATE_JOURNAL_VERSION, PREVIOUS_JOURNAL_VERSION, JOURNAL_VERSION].includes(value.version)
+  if (!JOURNAL_VERSIONS.has(value.version)
     || !STATUSES.has(value.status)) {
     throw new Error('invalid dsh-ptc-plus journal')
   }
   const migrated = migrateJournal(value, options.resolveLegacyConfirm)
   assertOwnFields(migrated, JOURNAL_FIELDS, 'dsh-ptc-plus journal')
+  const languageSemantics = normalizeLanguageSemantics(migrated.languageSemantics)
   const bindingPolicy = normalizeBindingPolicy(migrated.bindingPolicy)
   const rewritePolicy = normalizeRewritePolicy(migrated.rewritePolicy)
   const moduleSemantics = normalizeModuleSemantics(migrated.moduleSemantics)
+  const userBindingsFingerprint = normalizeUserBindingsFingerprint(migrated.userBindingsFingerprint)
+  const userBindingsReusePolicy = migrated.userBindingsReusePolicy
+  const userBindingNames = normalizeJournalUserBindingNames(migrated)
+  if (!USER_BINDINGS_REUSE_POLICIES.has(userBindingsReusePolicy)) {
+    throw new Error('invalid dsh-ptc-plus journal user binding reuse policy')
+  }
   const calls = normalizeCalls(migrated.calls)
   const operations = normalizeOperations(migrated.operations)
   const confirms = normalizeConfirms(migrated.confirms)
@@ -257,9 +354,14 @@ export function normalizeJournal(value, options = {}) {
   }
   return Object.freeze({
     version: JOURNAL_VERSION,
+    languageSemantics,
     bindingPolicy,
     rewritePolicy,
     moduleSemantics,
+    userBindingsFingerprint,
+    userBindingsReusePolicy,
+    userBindingsShadowPolicy: migrated.userBindingsShadowPolicy,
+    userBindingNames,
     status: migrated.status,
     calls: Object.freeze(calls),
     operations: Object.freeze(operations),
@@ -292,15 +394,53 @@ export function normalizeDerivedEditResult(meta, expectedTargetCallSeq) {
   const recoveryBoundaries = meta[RECOVERY_BOUNDARY_KEY] === undefined
     ? undefined
     : normalizeRecoveryBoundaries(meta[RECOVERY_BOUNDARY_KEY])
+  const userBindings = userBindingsForJournal(meta, journal)
   return Object.freeze({
     targetCallSeq: target.targetCallSeq,
     code: derived.code,
     description: derived.description,
     journal,
     ...(recoveryBoundaries === undefined ? {} : { recoveryBoundaries }),
+    ...(userBindings === undefined ? {} : { userBindings }),
   })
 }
 
+export function userBindingsForJournal(meta, journal) {
+  const userBindings = userBindingsSnapshotFromMeta(meta)
+  if (journal.userBindingsFingerprint === null) {
+    if (userBindings !== undefined) {
+      throw new Error('dsh-ptc-plus journal does not declare user binding metadata')
+    }
+    validateUserBindingNameProviders(journal, undefined)
+    return undefined
+  }
+  if (userBindings === undefined) {
+    throw new Error('dsh-ptc-plus journal requires user binding metadata')
+  }
+  if (userBindings.fingerprint !== journal.userBindingsFingerprint) {
+    throw new Error('dsh-ptc-plus journal user binding fingerprint does not match metadata')
+  }
+  validateUserBindingNameProviders(journal, userBindings)
+  return userBindings
+}
+
+function validateUserBindingNameProviders(journal, snapshot) {
+  const providers = new Map((snapshot?.entries ?? []).flatMap(entry => (
+    (entry.scope === 'namespace' ? [entry.name] : entry.symbols).map(name => [name, entry.id])
+  )))
+  for (const fact of journal.userBindingNames ?? []) {
+    if (fact.state === 'provider' && providers.get(fact.name) !== fact.entryId) {
+      throw new Error('journal user binding name evidence has no matching provider')
+    }
+  }
+  if (journal.userBindingNames !== null) {
+    const names = new Set(journal.userBindingNames.map(fact => fact.name))
+    if ([...providers.keys()].some(name => !names.has(name))) {
+      throw new Error('journal user binding name evidence is incomplete')
+    }
+  }
+}
+
 /** Compare only the required persisted relation for one derived edit. */
 export function derivedEditResultsEqual(leftMeta, rightMeta, expectedTargetCallSeq) {
   try {
@@ -341,7 +481,7 @@ function normalizeRecoveryBoundaryValue(value, eventSeq = undefined) {
       && (!Number.isSafeInteger(value.frontierCallSeq) || value.frontierCallSeq < 0))) {
     throw new Error('invalid dsh-ptc-plus recovery boundary')
   }
-  assertOwnFields(value, new Set(['failedCallSeq', 'frontierCallSeq']), 'recovery boundary')
+  assertOwnFields(value, RECOVERY_BOUNDARY_FIELDS, 'recovery boundary')
   if (eventSeq !== undefined && (!Number.isSafeInteger(eventSeq) || eventSeq < 0)) {
     throw new Error('invalid dsh-ptc-plus recovery boundary event sequence')
   }
@@ -443,7 +583,7 @@ export function liveToolCallSeq(session, callId, toolName) {
 }
 
 /** Start a mutable journal for one live cell. */
-export function createJournal(confirms = [], bindingPolicy, rewritePolicy) {
+export function createJournal(confirms = [], bindingPolicy, rewritePolicy, languageSemantics = LEGACY_LANGUAGE_SEMANTICS) {
   if (typeof bindingPolicy === 'string') {
     if (!BINDING_MODES.has(bindingPolicy)) throw new TypeError('invalid dsh-ptc-plus journal binding mode')
     bindingPolicy = {
@@ -453,11 +593,14 @@ export function createJournal(confirms = [], bindingPolicy, rewritePolicy) {
   }
   return {
     version: JOURNAL_VERSION,
+    languageSemantics: normalizeLanguageSemantics(languageSemantics),
     bindingPolicy: normalizeBindingPolicy(bindingPolicy),
     rewritePolicy: normalizeRewritePolicy(rewritePolicy),
-    moduleSemantics: normalizeModuleSemantics({
-      defaultExportBinding: LIVE_DEFAULT_EXPORT_BINDING,
-    }),
+    moduleSemantics: normalizeModuleSemantics(LIVE_MODULE_SEMANTICS),
+    userBindingsFingerprint: null,
+    userBindingsReusePolicy: LIVE_USER_BINDINGS_REUSE_POLICY,
+    userBindingsShadowPolicy: LIVE_USER_BINDINGS_SHADOW_POLICY,
+    userBindingNames: null,
     calls: [],
     operations: [],
     confirms: [...confirms],
@@ -465,15 +608,6 @@ export function createJournal(confirms = [], bindingPolicy, rewritePolicy) {
   }
 }
 
-function sourceForRunCall(call) {
-  try {
-    const args = JSON.parse(call.data.arguments)
-    return isRecord(args) && typeof args.code === 'string' ? args.code : undefined
-  } catch {
-    return undefined
-  }
-}
-
 /** Return an owned state transition; reject volatile saves and unknown named restores. */
 export function reduceStateOperations({ nodes, head, checkpoints }, operations, nodeIndex) {
   const nextCheckpoints = new Map(checkpoints)
@@ -501,607 +635,6 @@ export function reduceStateOperations({ nodes, head, checkpoints }, operations,
   return { head: nextHead, checkpoints: nextCheckpoints, restored }
 }
 
-function applyOperations(state, operations, nodeIndex) {
-  const transition = reduceStateOperations(state, operations, nodeIndex)
-  state.head = transition.head
-  state.checkpoints = transition.checkpoints
-  if (transition.restored) {
-    state.trusted = true
-    state.volatileSuffix.length = 0
-  }
-}
-
-function applyRecord(state, record, invalidCallSeqs) {
-  const { call, code, result } = record
-  if (invalidCallSeqs.has(call.seq)) return
-  const journal = result.journal
-  if (journal.status === 'noop') return
-  if (journal.status === 'discarded') {
-    if (journal.volatileReason !== undefined) {
-      state.trusted = false
-      state.volatileSuffix.push({ seq: call.seq, code, reason: journal.volatileReason })
-    }
-    return
-  }
-  if (journal.status === 'volatile') {
-    state.trusted = false
-    state.volatileSuffix.push({ seq: call.seq, code, reason: journal.volatileReason ?? 'volatile cell' })
-    applyOperations(state, journal.operations, undefined)
-    return
-  }
-  if (!state.trusted && !state.surfaceContracted) {
-    state.trusted = true
-    state.volatileSuffix.length = 0
-  }
-  const node = Object.freeze({
-    code,
-    journal,
-    callSeq: call.seq,
-    parent: state.head,
-  })
-  const index = state.nodes.push(node) - 1
-  state.head = index
-  try {
-    applyOperations(state, journal.operations, index)
-  } catch (error) {
-    state.nodes.pop()
-    state.head = node.parent
-    throw error
-  }
-}
-
-function recordEventSeq(record) {
-  return record.result?.eventSeq ?? record.call.seq
-}
-
-function foldRecords(records, invalidCallSeqs, options = {}) {
-  const state = {
-    nodes: [],
-    head: undefined,
-    checkpoints: new Map(),
-    volatileSuffix: [],
-    trusted: true,
-    surfaceContracted: options.surfaceContracted === true,
-  }
-  for (const record of records) {
-    applyRecord(state, record, invalidCallSeqs)
-  }
-  return state
-}
-
-function dependsOn(nodes, index, ancestor) {
-  for (let cursor = index; cursor !== undefined; cursor = nodes[cursor]?.parent) {
-    if (cursor === ancestor) return true
-  }
-  return false
-}
-
-/** Return executable call sequences whose provenance remains model-visible. */
-export function visibleExecutableCallSeqs(session) {
-  const events = sessionEvents(session)
-  let nodes
-  try {
-    nodes = session?.surface?.nodes
-  } catch {
-    return undefined
-  }
-  if (!Array.isArray(events) || !Array.isArray(nodes)) return undefined
-  const eventBySeq = new Map()
-  for (const event of events) eventBySeq.set(event?.seq, event)
-  for (const seq of nodes) {
-    if (!Number.isSafeInteger(seq) || seq < 0 || eventBySeq.get(seq) === undefined) return undefined
-  }
-  const visible = new Set(nodes)
-  const resultSources = new Set()
-  const visibleAssistantCallSeqs = new Set()
-  const pendingAssistantCalls = new Map()
-  let assistantCallEvidence = false
-  for (const event of events) {
-    if (event?.type === 'turn/start' || event?.type === 'turn/end') {
-      pendingAssistantCalls.clear()
-      continue
-    }
-    if (event?.type === 'assistant/message') {
-      pendingAssistantCalls.clear()
-      const content = event.data?.message?.content
-      if (Array.isArray(content)) {
-        for (const part of content) {
-          if (part?.type === 'tool-call' && typeof part.id === 'string') {
-            const isVisible = visible.has(event.seq)
-            if (isVisible) assistantCallEvidence = true
-            let occurrences = pendingAssistantCalls.get(part.id)
-            if (occurrences === undefined) {
-              occurrences = []
-              pendingAssistantCalls.set(part.id, occurrences)
-            }
-            occurrences.push(isVisible)
-          }
-        }
-      }
-      continue
-    }
-    if (event?.type === 'tool/call' && typeof event.data?.callId === 'string') {
-      const occurrences = pendingAssistantCalls.get(event.data.callId)
-      if (occurrences !== undefined && occurrences.length > 0) {
-        const isVisible = occurrences.shift()
-        if (occurrences.length === 0) pendingAssistantCalls.delete(event.data.callId)
-        if (isVisible && ['run_code', 'edit_run_code'].includes(event.data.name)) {
-          visibleAssistantCallSeqs.add(event.seq)
-        }
-      }
-    }
-    if (visible.has(event?.seq)
-      && event?.type === 'tool/result' && Array.isArray(event.sourceEventSeqs)) {
-      for (const sourceSeq of event.sourceEventSeqs) {
-        if (Number.isSafeInteger(sourceSeq) && sourceSeq >= 0) resultSources.add(sourceSeq)
-      }
-    }
-  }
-  const calls = new Set()
-  for (const event of events) {
-    if (event?.type !== 'tool/call' || !['run_code', 'edit_run_code'].includes(event.data?.name)) continue
-    if (assistantCallEvidence
-      ? visibleAssistantCallSeqs.has(event.seq)
-      : (visible.has(event.seq) || resultSources.has(event.seq))) calls.add(event.seq)
-  }
-  return calls
-}
-
-function timelineRun(call, result, eventIndex, journal) {
-  let args
-  try {
-    const parsed = JSON.parse(call.data.arguments)
-    if (isRecord(parsed)) args = Object.freeze(parsed)
-  } catch {
-    // Invalid persisted arguments cannot support derived source facts.
-  }
-  return Object.freeze({
-    index: eventIndex,
-    callSeq: Number.isSafeInteger(call.seq) ? call.seq : undefined,
-    args,
-    source: typeof args?.code === 'string' ? args.code : undefined,
-    journal,
-    rewrites: validatedRewrites(result.data?.meta),
-  })
-}
-
-function timelineDerivedRun(call, result, eventIndex, derived) {
-  return Object.freeze({
-    index: eventIndex,
-    callSeq: Number.isSafeInteger(call.seq) ? call.seq : undefined,
-    args: Object.freeze({ description: derived.description }),
-    source: derived.code,
-    journal: derived.journal,
-    rewrites: validatedRewrites(result.data?.meta),
-  })
-}
-
-function successfulTimelineRun(run) {
-  return run.journal?.completion?.kind === 'return' && run.journal.status !== 'noop'
-}
-
-/**
- * Fold persisted tool events once into the call/result and edit-target timeline
- * shared by prompt projection and cold journal recovery.
- */
-export function foldSessionTimeline(events) {
-  const empty = {
-    openTurn: false,
-    executableCalls: new Map(),
-    calls: [],
-    results: new Map(),
-    boundaries: [],
-    found: false,
-    unavailableResultSeq: undefined,
-    lastSuccessfulRunIndex: undefined,
-    latestRun: undefined,
-    editableRun: undefined,
-    editTargets: new Map(),
-  }
-  if (!Array.isArray(events)) return empty
-
-  const state = { ...empty }
-  const pendingByCallId = new Map()
-  const seenCallIds = new Set()
-  const claimedEditTargets = new Set()
-  const editClaims = new Map()
-  const journalResultSeqs = new Set()
-  let pruneReplacementWindow
-  let scope = 0
-
-  const resetTurn = (openTurn) => {
-    state.openTurn = openTurn
-    scope += 1
-    pendingByCallId.clear()
-    seenCallIds.clear()
-    claimedEditTargets.clear()
-    state.latestRun = undefined
-    state.editableRun = undefined
-  }
-
-  for (let eventIndex = 0; eventIndex < events.length; eventIndex += 1) {
-    const event = events[eventIndex]
-    if (pruneReplacementWindow !== undefined
-      && event?.type !== 'compaction/prune'
-      && eventIndex !== pruneReplacementWindow.lastEventIndex + 1) {
-      pruneReplacementWindow = undefined
-    }
-    if (event?.type === 'turn/start') {
-      resetTurn(true)
-      continue
-    }
-    if (event?.type === 'turn/end') {
-      resetTurn(false)
-      continue
-    }
-    if (event?.type === RECOVERY_BOUNDARY_EVENT) {
-      state.unavailableResultSeq ??= Number.isSafeInteger(event.seq) ? event.seq : eventIndex
-      continue
-    }
-    if (event?.type === 'compaction/prune' && Array.isArray(event.data?.shadowedSeqs)) {
-      const shadowedSeqs = event.data.shadowedSeqs
-      const seqs = new Set(shadowedSeqs)
-      const shadowedRange = event.data.shadowedRange
-      const rangeValid = shadowedRange === undefined
-        || (isRecord(shadowedRange)
-          && shadowedRange.start === shadowedSeqs[0]
-          && shadowedRange.end === shadowedSeqs[shadowedSeqs.length - 1])
-      const valid = shadowedSeqs.length > 0
-        && seqs.size === shadowedSeqs.length
-        && shadowedSeqs.every(seq => Number.isSafeInteger(seq) && seq >= 0)
-        && shadowedSeqs.every((seq, index) => index === 0 || seq > shadowedSeqs[index - 1])
-        && rangeValid
-      pruneReplacementWindow = { seqs: valid ? seqs : new Set(), lastEventIndex: eventIndex }
-      continue
-    }
-    if (event?.type === 'tool/call' && typeof event.data?.callId === 'string') {
-      const executable = event.data.name === 'run_code' || event.data.name === 'edit_run_code'
-      let entry = { event, eventIndex, scope }
-      if (executable) {
-        if (Number.isSafeInteger(event.seq) && event.seq >= 0 && state.executableCalls.has(event.seq)) {
-          throw new Error('session log contains a duplicate run_code call sequence')
-        }
-        if (event.data.name === 'edit_run_code') {
-          const targetCallSeq = state.editableRun?.callSeq
-          const target = targetCallSeq !== undefined && state.editableRun.source !== undefined
-            && !claimedEditTargets.has(targetCallSeq)
-            ? Object.freeze({ source: state.editableRun.source, callSeq: targetCallSeq })
-            : undefined
-          entry = { ...entry, editTarget: target }
-          state.editTargets.set(event.seq, target)
-          if (target !== undefined) {
-            claimedEditTargets.add(target.callSeq)
-            editClaims.set(event.seq, target.callSeq)
-          }
-        }
-        state.calls.push(event)
-        if (Number.isSafeInteger(event.seq) && event.seq >= 0) {
-          state.executableCalls.set(event.seq, entry)
-        }
-      }
-      if (seenCallIds.has(event.data.callId)) pendingByCallId.set(event.data.callId, null)
-      else {
-        seenCallIds.add(event.data.callId)
-        pendingByCallId.set(event.data.callId, entry)
-      }
-      continue
-    }
-    if (event?.type !== 'tool/result') continue
-
-    const sourceSeq = event.sourceEventSeqs?.[0]
-    const callId = event.data?.message?.source?.callId
-    let entry = Number.isSafeInteger(sourceSeq) ? state.executableCalls.get(sourceSeq) : undefined
-    let prunedReplacement = false
-    if (entry === undefined && Number.isSafeInteger(sourceSeq)
-      && pruneReplacementWindow?.seqs.has(sourceSeq)
-      && eventIndex === pruneReplacementWindow.lastEventIndex + 1
-      && Array.isArray(event.sourceEventSeqs) && event.sourceEventSeqs.length === 1
-      && typeof callId === 'string') {
-      const candidate = pendingByCallId.get(callId)
-      const candidateSeq = candidate?.event?.seq
-      const pruneSeq = events[pruneReplacementWindow.lastEventIndex]?.seq
-      const resultEventSeq = event.seq
-      const surfaceOp = event.surfaceOp
-      if (candidate !== undefined && candidate !== null
-        && (candidate.event.data.name === 'run_code' || candidate.event.data.name === 'edit_run_code')
-        && Number.isSafeInteger(candidateSeq) && candidateSeq >= 0
-        && sourceSeq > candidateSeq
-        && Number.isSafeInteger(pruneSeq) && pruneSeq >= 0
-        && Number.isSafeInteger(resultEventSeq) && resultEventSeq - pruneSeq === 1
-        && sourceSeq < pruneSeq
-        && (surfaceOp === undefined
-          || (surfaceOp?.op === 'replace' && surfaceOp.start === sourceSeq && surfaceOp.end === sourceSeq))) {
-        entry = candidate
-        prunedReplacement = true
-        pruneReplacementWindow.lastEventIndex = eventIndex
-      }
-    }
-    if (entry === undefined && !Number.isSafeInteger(sourceSeq) && typeof callId === 'string') {
-      entry = pendingByCallId.get(callId)
-    }
-    if (typeof callId === 'string') pendingByCallId.delete(callId)
-    if (entry === null) {
-      state.latestRun = undefined
-      state.editableRun = undefined
-      continue
-    }
-
-    const call = entry?.event
-    const callSeq = call?.seq
-    const meta = event.data?.meta
-    let normalized
-    if (isRecord(meta) && Object.hasOwn(meta, JOURNAL_KEY)) {
-      if (Number.isSafeInteger(sourceSeq) && journalResultSeqs.has(sourceSeq)) {
-        state.unavailableResultSeq ??= sourceSeq
-        state.results.set(sourceSeq, {
-          eventSeq: Number.isSafeInteger(event.seq) && event.seq >= 0 ? event.seq : sourceSeq,
-          eventIndex,
-          error: `session log contains duplicate PTC journal results for call seq ${sourceSeq}`,
-        })
-        state.found = true
-        continue
-      }
-      if (Number.isSafeInteger(sourceSeq)) journalResultSeqs.add(sourceSeq)
-      if (entry === undefined) {
-        if (Number.isSafeInteger(sourceSeq)) {
-          state.unavailableResultSeq ??= sourceSeq
-        }
-        continue
-      }
-      const resultSeq = prunedReplacement
-        ? callSeq
-        : Number.isSafeInteger(sourceSeq) ? sourceSeq : callSeq
-      const raw = {
-        meta,
-        eventSeq: Number.isSafeInteger(event.seq) && event.seq >= 0 ? event.seq : resultSeq,
-        eventIndex,
-      }
-      if (Object.hasOwn(meta, RECOVERY_BOUNDARY_KEY)) {
-        try {
-          state.boundaries.push(...normalizeRecoveryBoundaries(
-            meta[RECOVERY_BOUNDARY_KEY], raw.eventSeq,
-          ))
-        } catch {
-          state.unavailableResultSeq ??= callSeq
-        }
-      }
-      try {
-        if (call.data.name === 'edit_run_code') {
-          const derived = normalizeDerivedEditResult(meta, entry.editTarget?.callSeq)
-          normalized = { ...raw, journal: derived.journal, derived }
-        } else if (call.data.name === 'run_code') {
-          const rawJournal = meta[JOURNAL_KEY]
-          const resolveLegacyConfirm = rawJournal?.version === LEGACY_JOURNAL_VERSION
-            ? legacyCallId => {
-              const candidates = [...state.executableCalls.values()]
-                .filter(candidate => candidate.eventIndex < eventIndex
-                  && candidate.event.data?.name === 'run_code'
-                  && candidate.event.data.callId === legacyCallId
-                  && !state.results.has(candidate.event.seq))
-              return candidates.length === 1 ? candidates[0].event.seq : undefined
-            }
-            : undefined
-          normalized = { ...raw, journal: normalizeJournal(rawJournal, { resolveLegacyConfirm }) }
-        }
-      } catch (error) {
-        normalized = { ...raw, error: error.message }
-      }
-      if (Number.isSafeInteger(resultSeq)) state.results.set(resultSeq, normalized)
-      state.found = true
-    }
-
-    const claimedTarget = editClaims.get(callSeq)
-    if (claimedTarget !== undefined) {
-      editClaims.delete(callSeq)
-      if (normalized?.derived === undefined) claimedEditTargets.delete(claimedTarget)
-    }
-    if (entry === undefined || entry.scope !== scope) continue
-    if (call.data.name === 'edit_run_code') {
-      if (normalized?.derived !== undefined) {
-        const run = timelineDerivedRun(call, event, eventIndex, normalized.derived)
-        state.latestRun = run
-        state.editableRun = run
-        if (successfulTimelineRun(run)) state.lastSuccessfulRunIndex = eventIndex
-      }
-      continue
-    }
-    if (call.data.name !== 'run_code') {
-      // Unrelated native settlements do not change the current editable cell.
-      // The edit target is captured at dispatch time and remains valid until a
-      // new executable cell or turn boundary supersedes it.
-      continue
-    }
-    const run = timelineRun(call, event, eventIndex, normalized?.journal)
-    state.latestRun = run
-    state.editableRun = run
-    if (successfulTimelineRun(run)) state.lastSuccessfulRunIndex = eventIndex
-  }
-  return state
-}
-
-/** Fold the session log into the last exactly replayable frontier. */
-export function recoverJournal(session, currentCallSeq, options = {}) {
-  const events = sessionEvents(session)
-  if (!Array.isArray(events)) {
-    return { nodes: [], head: undefined, checkpoints: new Map(), volatileSuffix: [], available: true }
-  }
-  const timeline = foldSessionTimeline(events)
-  const calls = timeline.calls.filter(call => call.seq !== currentCallSeq)
-  const { executableCalls, results, found } = timeline
-  const visibleCalls = options?.visibleCallSeqs
-  let unavailableSeq = timeline.unavailableResultSeq
-  let unavailableReason = 'unavailable or malformed dsh-ptc-plus journal result'
-  for (const [resultSeq, result] of results.entries()) {
-    if (result?.error !== undefined && Number.isSafeInteger(resultSeq)) {
-      unavailableSeq ??= resultSeq
-      unavailableReason = result.error
-    }
-  }
-  const extraBoundaries = options?.extraBoundaries ?? []
-  let normalizedExtraBoundaries = []
-  try {
-    normalizedExtraBoundaries = normalizeRecoveryBoundaries(extraBoundaries, undefined)
-  } catch {
-    normalizedExtraBoundaries = []
-  }
-  const boundaries = [
-    ...timeline.boundaries,
-    ...normalizedExtraBoundaries.map(boundary => ({
-      ...boundary,
-      eventSeq: Number.POSITIVE_INFINITY,
-    })),
-  ].sort((left, right) => left.eventSeq - right.eventSeq)
-  // An unavailable historical result contracts the replay frontier. It must
-  // not prevent the current request from executing on the verified prefix.
-
-  const confirmedNoops = new Set()
-  const invalidResultReasons = new Map()
-  for (const [resultSeq, { journal, eventIndex }] of results.entries()) {
-    const candidateConfirms = []
-    for (const callSeq of journal?.confirms ?? []) {
-      const confirmed = executableCalls.get(callSeq)
-      if (confirmed === undefined || confirmed.eventIndex >= eventIndex || results.has(callSeq)) {
-        const reason = `confirmed no-op does not identify an earlier unjournaled run_code call seq ${callSeq}`
-        invalidResultReasons.set(resultSeq, reason)
-        unavailableSeq ??= resultSeq
-        unavailableReason = reason
-        break
-      }
-      candidateConfirms.push(callSeq)
-    }
-    if (!invalidResultReasons.has(resultSeq)) {
-      for (const callSeq of candidateConfirms) confirmedNoops.add(callSeq)
-    }
-  }
-  const records = []
-  const orderedRecords = []
-  const invalidCallSeqs = new Set()
-  let state = foldRecords(records, invalidCallSeqs)
-  let blockedUnavailableSeq = unavailableSeq
-  let boundaryIndex = 0
-  const applyBoundariesBefore = (seq) => {
-    while (boundaryIndex < boundaries.length && boundaries[boundaryIndex].eventSeq <= seq) {
-      const boundary = boundaries[boundaryIndex++]
-      const failedCall = executableCalls.get(boundary.failedCallSeq)
-      if (failedCall === undefined || failedCall.event.seq >= boundary.eventSeq) continue
-      const failedIndex = state.nodes.findIndex(node => node.callSeq === boundary.failedCallSeq)
-      const expectedFrontier = failedIndex < 0 ? state.head : state.nodes[failedIndex].parent
-      const frontierIndex = boundary.frontierCallSeq === null
-        ? undefined
-        : state.nodes.findIndex(node => node.callSeq === boundary.frontierCallSeq)
-      if (frontierIndex !== expectedFrontier) continue
-      const resolvesUnavailable = blockedUnavailableSeq === boundary.failedCallSeq
-      if (failedIndex < 0 && !resolvesUnavailable) continue
-      for (let index = 0; index < state.nodes.length; index += 1) {
-        if (dependsOn(state.nodes, index, failedIndex)) invalidCallSeqs.add(state.nodes[index].callSeq)
-      }
-      if (failedIndex < 0) {
-        for (const record of records) {
-          if (record.call.seq >= boundary.failedCallSeq) invalidCallSeqs.add(record.call.seq)
-        }
-      }
-      state = foldRecords(records, invalidCallSeqs, {
-        surfaceContracted: resolvesUnavailable ? false : state.surfaceContracted,
-      })
-      if (resolvesUnavailable) {
-        blockedUnavailableSeq = undefined
-        if (unavailableSeq === boundary.failedCallSeq) unavailableSeq = undefined
-      }
-    }
-  }
-  for (const call of calls) {
-    const result = results.get(call.seq)
-    const code = call.data?.name === 'edit_run_code' ? result?.derived?.code : sourceForRunCall(call)
-    const record = {
-      call,
-      code,
-      result: invalidResultReasons.has(call.seq)
-        ? { ...result, journal: undefined, error: invalidResultReasons.get(call.seq) }
-        : result,
-      hidden: visibleCalls instanceof Set && !visibleCalls.has(call.seq),
-    }
-    if (call.data?.name === 'edit_run_code' && record.code === undefined && result === undefined) continue
-    if (result?.journal === undefined && confirmedNoops.has(call.seq)) continue
-    orderedRecords.push(record)
-  }
-  orderedRecords.sort((left, right) => (
-    recordEventSeq(left) - recordEventSeq(right) || left.call.seq - right.call.seq
-  ))
-  for (const record of orderedRecords) {
-    applyBoundariesBefore(recordEventSeq(record))
-    records.push(record)
-    if (record.hidden) {
-      blockedUnavailableSeq ??= record.call.seq
-      unavailableSeq ??= record.call.seq
-      unavailableReason = 'model-visible provenance was shadowed'
-      invalidCallSeqs.add(record.call.seq)
-      state.surfaceContracted = true
-      state.trusted = false
-      state.volatileSuffix.push({ seq: record.call.seq, code: undefined, reason: unavailableReason })
-      continue
-    }
-    if (blockedUnavailableSeq !== undefined && record.call.seq >= blockedUnavailableSeq) {
-      invalidCallSeqs.add(record.call.seq)
-      if (!state.volatileSuffix.some(item => item.seq === record.call.seq)) {
-        state.trusted = false
-        state.volatileSuffix.push({
-          seq: record.call.seq,
-          code: record.code,
-          reason: unavailableReason,
-        })
-      }
-      continue
-    }
-    if (record.result?.journal === undefined) {
-      blockedUnavailableSeq ??= record.call.seq
-      unavailableSeq ??= record.call.seq
-      unavailableReason = record.result?.error ?? 'missing dsh-ptc-plus journal result'
-      invalidCallSeqs.add(record.call.seq)
-      state.trusted = false
-      state.volatileSuffix.push({ seq: record.call.seq, code: record.code, reason: unavailableReason })
-      continue
-    }
-    try {
-      applyRecord(state, record, invalidCallSeqs)
-    } catch (error) {
-      unavailableSeq ??= record.call.seq
-      blockedUnavailableSeq ??= record.call.seq
-      unavailableReason = error.message
-      invalidCallSeqs.add(record.call.seq)
-    }
-  }
-  applyBoundariesBefore(Number.POSITIVE_INFINITY)
-  if (unavailableSeq !== undefined
-    && !state.volatileSuffix.some(item => item.seq === unavailableSeq)) {
-    state.trusted = false
-    state.volatileSuffix.push({
-      seq: unavailableSeq,
-      code: undefined,
-      reason: unavailableReason,
-    })
-  }
-  return {
-    nodes: state.nodes,
-    head: state.head,
-    checkpoints: state.checkpoints,
-    volatileSuffix: state.volatileSuffix,
-    available: found && !state.surfaceContracted && blockedUnavailableSeq === undefined,
-  }
-}
-
-/** Return source nodes from the empty state to a selected durable head. */
-export function pathToHead(state) {
-  const path = []
-  for (let cursor = state.head; cursor !== undefined;) {
-    const node = state.nodes[cursor]
-    if (node === undefined) throw new Error('invalid dsh-ptc-plus journal head')
-    path.push(node)
-    cursor = node.parent
-  }
-  path.reverse()
-  return path
-}
-
 /** Merge the journal into the tool result's private metadata. */
 export function withJournal(meta, journal) {
   const base = isRecord(meta) ? { ...meta } : meta === undefined ? {} : { value: cloneJson(meta) }
@@ -1109,9 +642,6 @@ export function withJournal(meta, journal) {
   return base
 }
 
-const REWRITE_FIELDS = new Set(['kind', 'description', 'source'])
-const REWRITE_KINDS = new Set(['import', 'redeclaration', 'export'])
-
 /** Validate and detach one rewrite record emitted by the runtime. */
 export function normalizeRewrites(value) {
   if (!Array.isArray(value)) throw new Error('invalid dsh-ptc-plus rewrites')