dsh-ptc-plus 0.4.8 → 0.5.0

package/internal/session-runtime.js

@@ -10,12 +10,14 @@ import {
   reduceStateOperations,
 } from './session-journal.js'
 import {
+  foldSessionTimeline,
   pathToHead,
   recoveryBoundaryForHistory,
   recoverJournal,
   visibleExecutableCallSeqs,
 } from './session-journal-recovery.js'
 import { valueLimitsFromConfig } from './value-wire-schema.js'
+import { encodeValueAtBoundary, valueWiresEqual } from './value-wire.js'
 import { normalizeBindingDescriptors } from './binding-descriptors.js'
 import { resolveConfig } from './runtime-config.js'
 import { WorkerClient } from './worker-client.js'
@@ -26,6 +28,7 @@ import { executionPolicies } from './binding-update-policy.js'
 import {
   createReplMemorySnapshot,
   normalizeReplMemorySnapshot,
+  REPL_MEMORY_META_KEY,
   unavailableReplMemorySnapshot,
 } from './repl-memory-projection.js'
 
@@ -34,8 +37,12 @@ const UNAVAILABLE_SURFACE_GENERATION = Symbol('unavailableSurfaceGeneration')
 
 function surfaceGeneration(session, provenanceRequired = true) {
   try {
-    return session?.surface?.replaceGeneration
-      ?? (provenanceRequired ? UNAVAILABLE_SURFACE_GENERATION : undefined)
+    const surface = session?.surface
+    const generation = surface?.replaceGeneration
+    if (generation === undefined) return provenanceRequired ? UNAVAILABLE_SURFACE_GENERATION : undefined
+    return surface.contentGeneration === undefined
+      ? generation
+      : `${generation}:${surface.contentGeneration}`
   } catch {
     return provenanceRequired ? UNAVAILABLE_SURFACE_GENERATION : undefined
   }
@@ -96,6 +103,7 @@ class SessionKernel {
     this.recoveryNotice = history.volatileSuffix.length === 0
       ? undefined
       : recoveryDiagnostic(history.volatileSuffix.length)
+    this.recoveryNoticeShown = false
     this.active = undefined
     this.sequence = 0
     this.tail = Promise.resolve()
@@ -144,17 +152,25 @@ class SessionKernel {
     } catch (error) {
       record.failed = true
       record.reason = error
-      return
+      return Promise.resolve(record)
     }
     const attempt = Promise.resolve(reset).then(
-      () => { this.reclamationRecords.delete(sequence) },
+      () => { this.reclamationRecords.delete(sequence); return record },
       error => {
         record.failed = true
         record.reason = error
+        return record
       },
     )
     this.reclamationAttempts.add(attempt)
     attempt.then(() => { this.reclamationAttempts.delete(attempt) })
+    return attempt
+  }
+
+  async prepareWorker() {
+    await Promise.all([...this.reclamationAttempts])
+    const failures = [...this.reclamationRecords.values()].filter(record => record.failed).map(record => record.reason)
+    if (failures.length) throw new AggregateError(failures, 'previous computation helper reclamation failed; dispose the session before continuing')
   }
 
   valueLimits(config = this.config) {
@@ -244,6 +260,7 @@ class SessionKernel {
   }
 
   async execute(request, config) {
+    const observedSession = request.sessionLog ?? this.session
     const recoveryBoundaries = this.initialRecoveryBoundary === undefined
       ? []
       : [this.initialRecoveryBoundary]
@@ -256,7 +273,7 @@ class SessionKernel {
     if (this.surfaceProvenanceRequired
       && (currentGeneration !== this.surfaceGeneration || hasLiveState)) {
       this.surfaceGeneration = currentGeneration
-      const visibleCallSeqs = visibleExecutableCallSeqs(this.session)
+      const visibleCallSeqs = visibleExecutableCallSeqs(observedSession)
       const contractsLiveState = [...this.liveCallSeqs].some(callSeq => (
         !(visibleCallSeqs instanceof Set) || !visibleCallSeqs.has(callSeq)
       ))
@@ -267,7 +284,7 @@ class SessionKernel {
         if (config.durableReplay) {
           this.recoveryNotice = undefined
           try {
-            this.history = recoverJournal(this.session, request.callSeq, {
+            this.history = recoverJournal(observedSession, request.callSeq, {
               visibleCallSeqs,
             })
           } catch (error) {
@@ -309,9 +326,9 @@ class SessionKernel {
             if (!(error instanceof ReplayFailure)) throw error
             const previousPathLength = pathToHead(this.history).length
             const boundary = recoveryBoundaryForHistory(this.history, error.node)
-            const recovered = recoverJournal(this.session, request.callSeq, {
+            const recovered = recoverJournal(observedSession, request.callSeq, {
               extraBoundaries: [boundary],
-              visibleCallSeqs: visibleExecutableCallSeqs(this.session),
+              visibleCallSeqs: visibleExecutableCallSeqs(observedSession),
             })
             const nextPathLength = pathToHead(recovered).length
             if (nextPathLength >= previousPathLength) throw new Error('recovery did not contract the historical frontier')
@@ -332,14 +349,12 @@ class SessionKernel {
       }
       if (skipped > 0) this.recoveryNotice = recoveryDiagnostic(skipped)
     }
-    const leadingDiagnostics = this.recoveryNotice === undefined ? [] : [this.recoveryNotice]
+    const leadingDiagnostics = this.recoveryNotice === undefined || this.recoveryNoticeShown
+      ? [] : [this.recoveryNotice]
+    this.recoveryNoticeShown = this.recoveryNotice !== undefined
     this.recoveryNotice = undefined
     if (request.journal !== undefined) request.journal.diagnostics.push(...leadingDiagnostics)
     const result = await this.cellExecutor.executeCell(request, undefined, config)
-    if (leadingDiagnostics.length > 0) {
-      const rendered = leadingDiagnostics.map(item => renderDiagnostic(item, request.program))
-      result.logs = [...rendered, ...result.logs]
-    }
     if (result.error === undefined) {
       this.failures.reset()
     } else {
@@ -350,17 +365,29 @@ class SessionKernel {
         if (request.journal !== undefined) request.journal.diagnostics.push(hint)
       }
     }
+    if (leadingDiagnostics.length > 0) {
+      const rendered = leadingDiagnostics.map(item => renderDiagnostic(item, request.program))
+      if (result.error === undefined) result.logs = [...rendered, ...result.logs]
+      else result.error = { ...result.error, message: [result.error.message, ...rendered].join('\n') }
+    }
     return finishResult(result)
   }
 
   async replayHistory(request, config) {
     this.bindingCatalog = new BindingCatalog()
+    const limits = this.valueLimits(config)
+    const emptyArgsWire = encodeValueAtBoundary({}, limits, 'parameter')
     const path = pathToHead(this.history)
     for (const node of path) {
+      const bindings = replayBindingNamespaces(request.bindings, node.journal, limits, emptyArgsWire)
+      const bindingDescriptors = bindings === request.bindings
+        ? request.bindingDescriptors : normalizeBindingDescriptors(bindings)
       try {
         const result = await this.cellExecutor.executeCell(
           {
             ...request,
+            bindings: bindingDescriptors.namespaces,
+            bindingDescriptors,
             program: node.code,
             journal: undefined,
             ...(node.userBindings === undefined ? { userBindings: undefined } : { userBindings: node.userBindings }),
@@ -475,7 +502,17 @@ class SessionKernel {
       this.workerObservation = undefined
       // A refused reclamation stays recorded on this kernel instead of becoming
       // an unhandled rejection; the kernel keeps the worker until dispose.
-      this.resetWorker(worker)
+      void this.resetWorker(worker).then(record => {
+        if (record.failed) {
+          result = { ...result, error: { ...result.error,
+            message: `${result.error?.message ?? 'cell terminated'}; helper reclamation failed: ${String(record.reason?.message ?? record.reason)}` } }
+          if (journal !== undefined && replay === undefined) {
+            this.completeJournal(journal, 'discarded', result, journal.volatileReason, active.diagnostics)
+          }
+        }
+        active.finish(result)
+      })
+      return
     }
     if (!terminate && active.observing && replay === undefined) {
       // Computation and journal settlement are complete. Observation cannot change either.
@@ -620,17 +657,55 @@ function sessionOf(sessionContext) {
     session,
     callId: sessionContext.callId,
     persistedCallSeq: sessionContext.persistedCallSeq,
+    sourceCallSeq: sessionContext.sourceCallSeq,
     cwd: typeof session?.header?.cwd === 'string' ? session.header.cwd : undefined,
     surfaceProvenanceRequired: true,
   }
 }
 
+/**
+ * Recorded-value replay settles a host call from its journal entry without
+ * dispatching it. A member the Host no longer supplies must therefore stay
+ * visible to the replayed cell as a replay-only stub; otherwise a routine
+ * capability removal would make an otherwise provable cell unreconstructable
+ * and contract the durable frontier. Zero-argument calls keep their recorded
+ * empty-object form so the args wire still matches the journal.
+ */
+function replayBindingNamespaces(namespaces, journal, limits, emptyArgsWire) {
+  const calls = journal?.calls ?? []
+  let changed = false
+  const next = namespaces.map(namespace => {
+    const recorded = calls.filter(call => call.global === namespace.global)
+    const missing = [...new Set(recorded.map(call => call.member))]
+      .filter(member => !namespace.members.includes(member))
+    if (missing.length === 0) return namespace
+    changed = true
+    const functions = { ...namespace.functions }
+    const emptyObjectMembers = [...(namespace.emptyObjectMembers ?? [])]
+    for (const member of missing) {
+      // The replay executor settles or rejects every host-binding call from the
+      // recorded journal, so the placeholder keeps the member visible without
+      // ever running; the throw only guards a dispatch path that would bypass
+      // recorded-value interception.
+      /* c8 ignore next -- replay interception precedes invocation */
+      functions[member] = () => { throw new Error(`replay-only member ${namespace.global}.${member}`) }
+      if (recorded.some(call => call.member === member && valueWiresEqual(call.args, emptyArgsWire, limits))) {
+        emptyObjectMembers.push(member)
+      }
+    }
+    return { ...namespace, functions, emptyObjectMembers }
+  })
+  return changed ? next : namespaces
+}
+
 export class SessionRuntime {
   constructor(config = {}, options = {}) {
     this.config = resolvedRuntimeConfig(config)
     this.kernels = new Map()
     this.pendingNoops = new Map()
     this.settlements = new WeakSet()
+    this.preparingCells = new Set()
+    this.submissions = new WeakSet()
     this.disposed = false
     this.userBindingsCwd = options.userBindingsCwd ?? process.cwd()
     if (typeof this.userBindingsCwd !== 'string' || !isAbsolute(this.userBindingsCwd)) {
@@ -638,6 +713,8 @@ export class SessionRuntime {
     }
     this.withInitiator = typeof options.withInitiator === 'function' ? options.withInitiator : undefined
     this.observeSession = options.observeSession ?? (() => false)
+    this.readSessionLog = options.readSessionLog ?? (async session => session)
+    this.sessionForId = options.sessionForId
     this.disposal = undefined
   }
 
@@ -647,8 +724,31 @@ export class SessionRuntime {
     return execution.result
   }
 
+  beginSubmission(sessionContext, signal) {
+    const admission = { sessionId: sessionOf(sessionContext).id, config: this.config,
+      signal, cancelled: this.disposed }
+    this.submissions.add(admission)
+    if (!this.disposed) this.preparingCells.add(admission)
+    return admission
+  }
+
+  releaseSubmission(admission) {
+    this.preparingCells.delete(admission)
+    this.submissions.delete(admission)
+  }
+
+  assertSubmission(admission) {
+    if (this.disposed) throw new Error('PTC runtime disposed')
+    if (admission.cancelled || !this.submissions.has(admission)) throw new Error('PTC session disposed')
+  }
+
   reconfigure(config) {
     const resolved = resolvedRuntimeConfig(config)
+    for (const admission of this.preparingCells) {
+      if (!admission.signal?.aborted && resolved.maxOldGenerationSizeMb !== admission.config.maxOldGenerationSizeMb) {
+        throw new Error('ptc-plus: maxOldGenerationSizeMb cannot change while a session worker is active; retry after the session is disposed')
+      }
+    }
     const kernels = [...this.kernels.values()]
     for (const kernel of kernels) kernel.assertReconfigurationAllowed(resolved)
     for (const kernel of kernels) kernel.reconfigure(resolved)
@@ -659,13 +759,34 @@ export class SessionRuntime {
     if (this.disposed || !this.config.replViewEnabled) return undefined
     const { observation: _observation, ...expected } = normalizeReplMemorySnapshot(memory)
     if (!expected.available || expected.entries.length === 0) return undefined
-    return this.kernels.get(sessionId)?.observe(expected, signal)
+    const kernel = this.kernels.get(sessionId)
+    const session = kernel?.session ?? this.sessionForId?.(sessionId)
+    if (session !== undefined && kernel?.surfaceProvenanceRequired !== false) {
+      const observed = await this.readSessionLog(session, signal)
+      signal?.throwIfAborted()
+      const visible = visibleExecutableCallSeqs(observed)
+      if (kernel !== undefined) {
+        if ([...kernel.liveCallSeqs].some(seq => !visible.has(seq))) return unavailableReplMemorySnapshot()
+        kernel.surfaceGeneration = surfaceGeneration(session)
+      } else {
+        const timeline = foldSessionTimeline(observed.events)
+        const history = recoverJournal(observed, undefined, { visibleCallSeqs: visible })
+        const head = history.nodes[history.head]
+        if (head === undefined) return unavailableReplMemorySnapshot()
+        // A cold inventory can describe a proved recorded frontier without
+        // instantiating a worker. It cannot describe a discarded suffix.
+        const resultSeq = timeline.results.get(head.callSeq)?.eventSeq
+        const result = observed.events.find(event => event.type === 'tool/result' && event.seq === resultSeq)
+        const recorded = result?.data?.meta?.[REPL_MEMORY_META_KEY]?.memory
+        if (!isDeepStrictEqual(recorded, memory)) return unavailableReplMemorySnapshot()
+      }
+    }
+    return kernel?.observe(expected, signal)
   }
 
-  async runTentative(sessionContext, request) {
+  async runTentative(sessionContext, request, { programCompletion = false } = {}) {
     const completed = result => Object.freeze({ result, settlement: undefined })
     if (this.disposed) return completed({ logs: [], error: { kind: 'abort', message: 'PTC runtime disposed' } })
-    const cellConfig = this.config
     let bindingDescriptors
     try {
       bindingDescriptors = normalizeBindingDescriptors(request?.bindings)
@@ -673,44 +794,67 @@ export class SessionRuntime {
       return completed({ logs: [], error: { kind: 'exception', message: messageOf(error) } })
     }
     request = { ...request, bindings: bindingDescriptors.namespaces, bindingDescriptors }
+    if (request.cwd !== undefined && (typeof request.cwd !== 'string' || !isAbsolute(request.cwd))) {
+      return completed({ logs: [], error: { kind: 'exception', message: 'PTC execution cwd must be an absolute path' } })
+    }
     const {
       id: sessionId,
       session,
       callId,
       persistedCallSeq,
+      sourceCallSeq: provedSourceCallSeq,
       cwd,
       surfaceProvenanceRequired,
     } = sessionOf(sessionContext)
     let callSeq
     let sourceCallSeq
+    let sessionLog
+    const admission = sessionContext?.submission ?? this.beginSubmission(sessionContext, request.signal)
+    if (!this.submissions.has(admission) || admission.sessionId !== sessionId) {
+      return completed({ logs: [], error: { kind: 'exception', message: 'PTC submission does not belong to this session runtime' } })
+    }
+    const cellConfig = admission.config
+    const aborted = () => this.disposed || admission.cancelled
+    const abortResult = () => completed({ logs: [], error: { kind: 'abort',
+      message: request.signal?.aborted ? String(request.signal.reason)
+        : this.disposed ? 'PTC runtime disposed' : 'PTC session disposed' } })
     try {
+      sessionLog = sessionContext?.sessionLog ?? await this.readSessionLog(session, request.signal)
+      if (aborted()) return abortResult()
       if (persistedCallSeq !== undefined
         && !isCanonicalSequence(persistedCallSeq)) {
         throw new Error('persisted tool call sequence must be a non-negative safe integer')
       }
+      if (provedSourceCallSeq !== undefined
+        && !isCanonicalSequence(provedSourceCallSeq)) {
+        throw new Error('source tool call sequence must be a non-negative safe integer')
+      }
       if (cellConfig.durableReplay) {
-        sourceCallSeq = liveToolCallSeq(session, callId, 'run_code')
+        sourceCallSeq = provedSourceCallSeq ?? liveToolCallSeq(sessionLog, callId, 'run_code')
         callSeq = persistedCallSeq ?? sourceCallSeq
       } else {
-        sourceCallSeq = persistedCallSeq
+        sourceCallSeq = provedSourceCallSeq ?? persistedCallSeq
         if (sourceCallSeq === undefined) {
           try {
-            sourceCallSeq = liveToolCallSeq(session, callId, 'run_code')
+            sourceCallSeq = liveToolCallSeq(sessionLog, callId, 'run_code')
           } catch {
             sourceCallSeq = undefined
           }
         }
       }
     } catch (error) {
+      if (aborted() || request.signal?.aborted) return abortResult()
       return completed({ logs: [], error: { kind: 'recovery', message: `cannot identify current run_code call in session log: ${messageOf(error)}` } })
+    } finally {
+      this.releaseSubmission(admission)
     }
     let kernel = this.kernels.get(sessionId)
     if (kernel === undefined) {
       let history
       try {
         history = cellConfig.durableReplay
-          ? recoverJournal(session, callSeq, {
-            visibleCallSeqs: visibleExecutableCallSeqs(session),
+          ? recoverJournal(sessionLog, callSeq, {
+            visibleCallSeqs: visibleExecutableCallSeqs(sessionLog),
           })
           : emptyHistory()
       } catch (error) {
@@ -738,11 +882,12 @@ export class SessionRuntime {
       policies.rewritesEnabled,
       policies.languageSemantics,
       policies.moduleTransform,
+      request.cwd ?? cwd ?? null,
     )
     const workerReservation = kernel.reserveWorkerConfiguration(cellConfig)
     let result
     try {
-      result = await kernel.run({ ...request, journal, callSeq, sourceCallSeq }, cellConfig)
+      result = await kernel.run({ ...request, journal, callSeq, sourceCallSeq, sessionLog, programCompletion }, cellConfig)
     } finally {
       kernel.releaseWorkerConfiguration(workerReservation)
     }
@@ -793,6 +938,12 @@ export class SessionRuntime {
 
   async disposeSession(sessionId) {
     const id = String(sessionId)
+    for (const admission of this.preparingCells) {
+      if (admission.sessionId === id) {
+        admission.cancelled = true
+        this.preparingCells.delete(admission)
+      }
+    }
     const kernel = this.kernels.get(id)
     this.pendingNoops.delete(id)
     if (kernel === undefined) return
@@ -815,6 +966,7 @@ export class SessionRuntime {
 
   async #dispose() {
     this.disposed = true
+    this.preparingCells.clear()
     const entries = [...this.kernels]
     const results = await Promise.allSettled(entries.map(async ([id, kernel]) => {
       await kernel.dispose()

package/internal/settings-compat.js

@@ -36,12 +36,16 @@ export function hostOwnsSettingsDocument(settingsModule) {
  * @returns the Cordis schema field for that definition.
  */
 export function configFieldSchema({ Schema, field, settingsModule }) {
-  const base = field.type === 'boolean'
-    ? Schema.boolean().default(field.default)
+  const schema = field.type === 'boolean'
+    ? Schema.boolean()
+    : field.type === 'string'
+      ? Schema.string()
     : field.type === 'enum'
-      // Keep omission visible until resolveConfig migrates legacy policies.
       ? Schema.union(field.options.map(option => Schema.const(option)))
-      : Schema.number().step(1).min(field.min).max(field.max).default(field.default)
+      : Schema.number().step(1).min(field.min).max(field.max)
+  // Migration must distinguish omitted legacy inputs from explicit new choices.
+  // Runtime defaults belong to resolveConfig; the Host must preserve omission.
+  const base = field.preserveOmission || field.type === 'enum' ? schema : schema.default(field.default)
   const described = base.description(field.description)
   if (!hostOwnsSettingsDocument(settingsModule)) return described
   if (typeof described.volatile !== 'function') {
@@ -63,7 +67,17 @@ export function installSettingsSectionCompat({
 }) {
   ctx.inject(['settings'], settingsContext => {
     const provider = settingsContext.settings
-    onProvider(provider)
+    const sectionInstalled = typeof provider?.installSection === 'function'
+      || typeof settingsModule?.installSettingsSection === 'function'
+    const writeNamespace = sectionInstalled ? namespace : (ownerFiber ?? ctx.fiber)?.entry?.options?.id
+    const writer = typeof provider?.update === 'function'
+      && typeof writeNamespace === 'string' && writeNamespace.length > 0
+      ? Object.freeze({
+        update: (patch, expectedRevision) => provider.update(writeNamespace, patch, expectedRevision),
+        read: () => provider.describe?.().find(descriptor => descriptor.ns === writeNamespace),
+      }) : undefined
+    const unbind = onProvider(provider, writer)
+    if (typeof unbind === 'function') settingsContext.effect(() => unbind, 'ptc-plus settings writer')
     if (typeof provider?.installSection === 'function') {
       provider.installSection(ctx, namespace, schema, entry, hooks)
       return
@@ -79,7 +93,10 @@ export function installSettingsSectionCompat({
         // fiber, so the owner is the plugin's entry context rather than the
         // scope this installation happens to run in.
         const dispose = provider.configure({ auto: false }, ownerFiber ?? ctx.fiber)
-        ctx.effect?.(() => dispose, 'ptc-plus settings page policy')
+        // The policy belongs to the settings surface that accepted it, so its
+        // disposer is released when that surface goes away instead of
+        // accumulating on the plugin scope across settings reloads.
+        settingsContext.effect?.(() => dispose, 'ptc-plus settings page policy')
       }
       return
     }

package/internal/stateful-module-compiler.js

@@ -96,9 +96,9 @@ export function createUserModuleCompilationHooks({ transformForParent = () => un
       }
     }
   }
-  const recordResolution = (parentUrl, specifier, importAttributes, result) => {
+  const recordResolution = (parentUrl, specifier, importAttributes, result,
+    transform = mapGet(modules, parentUrl) ?? transformForParent(parentUrl)) => {
     recordStatefulModuleResolution(parentUrl, specifier, importAttributes, result.url)
-    const transform = mapGet(modules, parentUrl) ?? transformForParent(parentUrl)
     // Runtime links are outside the user compilation graph. Skipping only
     // their load would still propagate user transforms to their dependencies.
     if (transform !== undefined && !startsWith(result.url, 'node:')
@@ -106,6 +106,7 @@ export function createUserModuleCompilationHooks({ transformForParent = () => un
   }
   return {
     mark,
+    recordResolution,
     resolve(specifier, context, nextResolve) {
       const evidence = commonJsEvidence.resolve(specifier, context, recordResolution)
       if (evidence !== undefined) return evidence

package/internal/stateful-module-runtime.js

@@ -198,7 +198,7 @@ const nativeModuleRealm = {
   importModule: (source, options) => import(source, options),
 }
 
-export function managedModuleImport(parentUrl, specifier, options, realm = nativeModuleRealm) {
+export function managedModuleImport(parentUrl, specifier, options, realm = nativeModuleRealm, recordResolution) {
   return new realm.Promise((resolve, reject) => {
     // Template conversion follows native import's ToString (including Symbols).
     const source = realm.stringify(specifier)
@@ -216,6 +216,7 @@ export function managedModuleImport(parentUrl, specifier, options, realm = nativ
       if (request !== url) return nextResolve(request, context)
       const resolution = nextResolve(source, { ...context, parentURL: parentUrl })
       const attributes = resolution.importAttributes ?? context.importAttributes
+      recordResolution?.(parentUrl, source, attributes, resolution)
       return { url: resolveManagedModuleAdapter(resolution, attributes), format: 'module',
         importAttributes: attributes, shortCircuit: true }
     })
@@ -259,13 +260,16 @@ export function loadManagedModuleAdapter(url) {
 }
 
 /** Only PTC-provided require paths decode formally compiled ESM returns. */
-export function managedRequire(parentUrl, nativeRequire) {
+export function managedRequire(parentUrl, nativeRequire, recordResolution) {
   const acquire = (target, receiver, args) => {
     let url
     let value
     const dispose = registerModuleResolutionHook((source, context, nextResolve) => {
       const result = nextResolve(source, context)
-      if (source === args[0] && url === undefined) url = result.url
+      if (source === args[0] && url === undefined) {
+        url = result.url
+        recordResolution?.(parentUrl, source, context.importAttributes, result)
+      }
       return result
     })
     try {

package/internal/stateful-root-runtime.js

@@ -13,7 +13,7 @@ export function createStatefulRootRuntime({ readAmbient, typeofAmbient, writeAmb
   const entries = new Map()
   const intrinsics = captureCompilerIntrinsics(dynamicIntrinsics?.realmFunction)
   errors ??= intrinsics
-  const dynamicRuntime = createDynamicEnvironmentRuntime({ ...dynamicIntrinsics, importModule })
+  const defaultDynamicRuntime = createDynamicEnvironmentRuntime({ ...dynamicIntrinsics, importModule })
   const moduleRuntime = dynamicIntrinsics === undefined ? undefined : createDynamicEnvironmentRuntime()
   let commit
   const read = name => {
@@ -59,7 +59,11 @@ export function createStatefulRootRuntime({ readAmbient, typeofAmbient, writeAmb
     return value
   }
   const begin = ({ declared = [], known = [], readOnly = [], legacyImports = [], legacyWritable = [], legacyLexicals = [], legacyObjects = [],
-    declarationKinds = [], declaredKinds = [], callableSources = [], languageSemantics = 'stateful-v1', committed }) => {
+    declarationKinds = [], declaredKinds = [], callableSources = [], languageSemantics = 'stateful-v1', committed,
+    importModule: cellImportModule = importModule }) => {
+    // Each cell owns dynamic-source resolution; shared logical roots remain live.
+    const dynamicRuntime = createDynamicEnvironmentRuntime({ ...dynamicIntrinsics,
+      importModule: cellImportModule }).installIntrinsics()
     dynamicRuntime.registerSources(callableSources)
     commit = committed
     const kinds = new Map()
@@ -127,7 +131,7 @@ export function createStatefulRootRuntime({ readAmbient, typeofAmbient, writeAmb
     const result = {
       values,
       intrinsics,
-      importModule,
+      importModule: cellImportModule,
       dynamic({ realm = false } = {}) {
         const pendingKinds = new Map()
         for (let index = 0; index < declaredKinds.length; index++) mapSet(pendingKinds, declaredKinds[index][0], declaredKinds[index][1])
@@ -155,6 +159,7 @@ export function createStatefulRootRuntime({ readAmbient, typeofAmbient, writeAmb
         const varFrame = { has: name => variableKind(kindFor(name)), get: name => varFrame.has(name) ? descriptor(name, 'var') : undefined,
           set() {} }
         return dynamicRuntime.environment({
+          importModule: cellImportModule,
           varFrame, frames: [{ kind: 'lexical', bindings: lexicalFrame }],
           declareVars: realm ? (names, functionNames) => {
             const globals = []
@@ -288,7 +293,7 @@ export function createStatefulRootRuntime({ readAmbient, typeofAmbient, writeAmb
     // Only new-generation environments select intrinsic interfaces. Native
     // global/prototype properties and saved legacy identities remain intact.
     if (dynamicIntrinsics !== undefined) {
-      dynamicRuntime.installIntrinsics()
+      defaultDynamicRuntime.installIntrinsics()
       moduleRuntime.installIntrinsics()
     }
     return result

package/internal/user-binding-authoring.js

@@ -37,14 +37,9 @@ export const BINDING_SUBMISSION = deepFreeze({
 })
 
 export const BINDING_AUTHORING_SDK = `
-During /binding, submit a draft for user review from run_code using the supplied requestId. Submission does not save, enable or execute it.
+/binding only: copy its requestId; submission does not save, enable or run the draft.
 \`\`\`ts
-declare namespace code {
-  function submitBindingDraft(args: {
-    requestId: string;
-    entry: { id: string; name: string; scope: "namespace" | "top-level"; symbols?: string[]; purpose: string; source: string; modelContext?: { includeDeclaration?: boolean; instructions?: string } };
-  }): Promise<{ accepted: true; id: string; requestId: string }>;
-}
+declare namespace code { function submitBindingDraft(args: { requestId: string; entry: { id: string; name: string; scope: "namespace" | "top-level"; symbols?: string[]; purpose: string; source: string; modelContext?: { includeDeclaration?: boolean; instructions?: string } } }): Promise<{ accepted: true; id: string; requestId: string }> }
 \`\`\``
 
 export function bindingAuthoringInstructions(requestId, cwd) {