dsh-ptc-plus 0.5.0 → 0.5.2

package/internal/cell-error.js

@@ -5,3 +5,16 @@ export class ModuleRewriteError extends SyntaxError {
     if (cellPosition !== undefined) this.cellPosition = cellPosition
   }
 }
+
+/**
+ * The kernel refuses to admit a cell because a previous helper was not reclaimed.
+ *
+ * This is a fact about the kernel's own lifecycle, not about the recorded history
+ * or the submitted source, so consumers must not contract a frontier or blame a
+ * cell for it.
+ */
+export class CellAdmissionBlocked extends AggregateError {
+  constructor(failures) {
+    super(failures, 'previous computation helper reclamation failed; dispose the session before continuing')
+  }
+}

package/internal/config-spec.js

@@ -1,4 +1,5 @@
 import { CAPABILITY_POLICY_DEFAULT } from './capability-policy.js'
+import { PROMPT_TEXT_DEFAULT } from './prompt-text.js'
 
 /** Configuration fields shared by the Host schema and settings card. */
 export const MAX_TIMER_DELAY_MS = 2_147_483_647
@@ -215,6 +216,77 @@ export const CONFIG_FIELDS = Object.freeze([
     description: 'worker 重启后从 session journal 重建可恢复的 REPL 状态。',
     descriptionEn: 'Rebuilds recoverable REPL state from the session journal after a worker restart.',
   },
+  {
+    key: 'retentionPayloadRuns',
+    type: 'integer',
+    default: 8,
+    min: 8,
+    max: 512,
+    label: '保留最近单元格数',
+    labelEn: 'Retained recent cells',
+    description: '检查点保留最近多少个单元格的参数原文。调大能直接编辑更久以前的计算，但检查点更大；更早的单元格需要从会话日志重新折叠才能编辑或重新发布。',
+    descriptionEn: 'How many recent cells keep their argument text in the checkpoint. A larger window keeps more history editable without a log read but grows the checkpoint; older cells must be refolded from the session log to be edited or republished.',
+  },
+  {
+    key: 'retentionPayloadBytes',
+    type: 'integer',
+    default: 8388608,
+    min: 1048576,
+    max: 16777216,
+    label: '保留载荷预算 (UTF-8 bytes)',
+    labelEn: 'Retained payload budget (UTF-8 bytes)',
+    description: '保留单元格参数原文的累计上限。达到上限后最旧的原文被移除，检查点体积因此与会话写入总量无关；单个超过预算的单元格也会被移除并从日志重折。检查点体积约为本预算的两倍，上限 16 MiB 对应约 32 MB 的最坏情况。',
+    descriptionEn: 'Cumulative budget for the retained argument text. Past it the oldest payload is removed, which keeps the checkpoint independent of how much the session wrote; a single cell larger than the budget is removed as well and refolded from the log. A checkpoint is roughly twice this budget, so the 16 MiB maximum bounds the worst case near 32 MB.',
+  },
+  {
+    key: 'retentionClusters',
+    type: 'integer',
+    default: 8,
+    min: 0,
+    max: 50000,
+    label: '保留单元格簇上限',
+    labelEn: 'Retained cluster limit',
+    description: '检查点保留多少个单元格簇的身份与观测，超过后最旧的簇折进区间摘要（其后续操作需要从日志重折）。默认与"保留最近单元格数"一致，所以检查点不会随会话长度线性增长；调大能保留更多无需重折的恢复证据，但检查点更大。填 0 表示不限制：不做按数量的折叠，只由载荷预算约束体积。',
+    descriptionEn: 'How many cell clusters keep their identity and observations in the checkpoint; older ones fold into an interval summary and need a log refold afterwards. It defaults to the retained-cells window, which is what keeps a long session from growing linearly; a larger value keeps more recovery evidence without a refold at the cost of a bigger checkpoint. 0 means unlimited: no count-based folding, with the payload budget as the only bound.',
+  },
+  {
+    key: 'capabilityPromptTextEnabled',
+    type: 'boolean',
+    default: true,
+    label: '提示文本',
+    labelEn: 'Prompt text',
+    description: '把「提示文本」页签里改写的固定句子应用到模型的请求、工具说明、能力方案与提示；关闭后这些渠道一律回到内置文本，已保存的改写保留但暂停生效。',
+    descriptionEn: 'Applies the sentences edited in the Prompt text tab to model requests, tool descriptions, the capability plan and tips. When off, those channels use the built-in text; saved edits are kept but paused.',
+  },
+  {
+    key: 'promptText',
+    type: 'string',
+    default: PROMPT_TEXT_DEFAULT,
+    label: '提示文本覆盖',
+    labelEn: 'Prompt text overrides',
+    description: '按槽位 id 覆盖插件写给模型的固定提示文本；空对象表示使用内置文本。诊断、信封与由配置派生的策略句始终只读。',
+    descriptionEn: 'Override the fixed prompt text the plugin writes for the model, keyed by slot id; an empty document keeps the built-in text. Diagnostics, message envelopes and configuration-derived policy sentences stay read-only.',
+  },
+  {
+    key: 'unmeasuredCellLimit',
+    type: 'integer',
+    default: 2,
+    min: 1,
+    max: Number.MAX_SAFE_INTEGER,
+    label: '连续未测量 cell 丢弃阈值',
+    labelEn: 'Consecutive unmeasured cells before the worker is dropped',
+    description: '连续第几个未测量 cell 触发丢弃 live worker（默认 2：第一个保留，第二个丢弃）；已证明的 frontier 保留给下一 cell 重放。',
+    descriptionEn: 'The consecutive unmeasured cell that drops the live worker (default 2: the first is kept, the second drops it). The proved frontier stays replayable for the next cell.',
+  },
+  {
+    key: 'officialReplPriority',
+    type: 'boolean',
+    default: false,
+    label: '官方 REPL 模式优先',
+    labelEn: 'Prioritize the official REPL mode',
+    description: '检测到官方持久 REPL 模式时由官方运行时接管 PTC 会话执行；PTC Plus 让出 run_code 及其进程内会话状态语义，关闭时始终由 PTC Plus 接管。',
+    descriptionEn: 'Lets the official runtime own PTC session execution when the official persistent REPL mode is active; PTC Plus then leaves run_code and its in-process session-state semantics to DSH. Disabled keeps PTC Plus in charge.',
+  },
   {
     key: 'tipsEnabled',
     type: 'boolean',
@@ -279,6 +351,50 @@ export const CONFIG_FIELDS = Object.freeze([
     description: '限制单个 cell 的日志和返回结果的合计大小。',
     descriptionEn: 'Limits the combined size of one cell\'s logs and returned result.',
   },
+  {
+    key: 'sampleBoundMs',
+    type: 'integer',
+    default: 1_000,
+    min: 1,
+    max: MAX_TIMER_DELAY_MS,
+    label: '计算基线采样等待上限 (ms)',
+    labelEn: 'Compute-baseline sample wait limit (ms)',
+    description: '等待 worker 回答计算基线采样的上限；宿主忙碌时先读空 helper 通道再判断缺失，未观察到的采样按未测量 no-op 结算，是否保留 worker 由 unmeasuredCellLimit 决定；transport 报告退出、断连或无法发送时仍走 worker-exit 重置。',
+    descriptionEn: 'Bounds the wait for the worker compute-baseline answer. A busy host reads the helper channel out before concluding an answer is missing; an unobserved sample settles as an unmeasured no-op and unmeasuredCellLimit decides whether the worker stays; a transport-reported exit, disconnect or unsendable request keeps the worker-exit reset route.',
+  },
+  {
+    key: 'workerReclaimMs',
+    type: 'integer',
+    default: 5_000,
+    min: 1_000,
+    max: MAX_TIMER_DELAY_MS,
+    label: 'worker 回收确认上限 (ms)',
+    labelEn: 'Worker reclamation confirmation limit (ms)',
+    description: '停止 helper 的关闭阶段上限（至少 1000ms）；exit 确认与其后的输出关闭各自以此为上界，release grace 会被压缩以给 kill 预留至少 1000ms 的确认窗口。worker 创建与关闭时读取当前配置。cell 触发的 session kernel exit 超时会保留 helper 并在会话释放前阻止后续 cell；startup、idle 或输出关闭路径的失败，以及 binding console 与 candidate helper，只保留实例并在释放时报告。',
+    descriptionEn: 'Bounds one close stage of a stopped helper (at least 1000 ms): exit confirmation and the following output close are each bounded by it, with the release grace capped so the kill keeps at least a 1000 ms confirmation window. Read from the current configuration when a worker is created or closed. A cell-driven session-kernel exit miss retains the helper and blocks later cells until the session is released; a startup, idle or output-close miss, and the binding console and candidate helpers, only retain the instance and report it at release.',
+  },
+  {
+    key: 'startupProbeMs',
+    type: 'integer',
+    default: 5_000,
+    min: 1,
+    max: MAX_TIMER_DELAY_MS,
+    label: 'REPL 启动探针上限 (ms)',
+    labelEn: 'REPL startup probe limit (ms)',
+    description: 'worker 启动时校验 REPL 契约的等待上限；超时按启动失败结算，不执行任何 cell。worker 创建时读取当前配置。',
+    descriptionEn: 'Bounds the worker startup check of the REPL contract. A timeout settles as a startup failure and no cell executes. Read from the current configuration when a worker is created.',
+  },
+  {
+    key: 'executionSeamTimeoutMs',
+    type: 'integer',
+    default: 30_000,
+    min: 1,
+    max: MAX_TIMER_DELAY_MS,
+    label: '等待宿主执行入口上限 (ms)',
+    labelEn: 'Host execution-seam wait limit (ms)',
+    description: '激活时等待宿主注册执行入口的上限；超时把当前部署报告为不支持。只在插件激活或重载时读取，运行中的修改在下次激活生效。',
+    descriptionEn: 'Bounds the activation wait for the host to register its execution seam. A timeout reports the deployment as unsupported. Read only when the plugin activates or reloads; a live change applies at the next activation.',
+  },
   {
     key: 'maxValueNodes',
     type: 'integer',
@@ -367,7 +483,7 @@ export const CONFIG_GROUPS = Object.freeze([
     key: 'recovery',
     label: '状态与恢复',
     labelEn: 'State and recovery',
-    fields: Object.freeze(['durableReplay', 'tipsEnabled', 'tipCooldownMessages', 'tipEscalationFailures']),
+    fields: Object.freeze(['durableReplay', 'unmeasuredCellLimit', 'officialReplPriority', 'tipsEnabled', 'tipCooldownMessages', 'tipEscalationFailures']),
   },
   {
     key: 'extensions',
@@ -397,6 +513,10 @@ export const CONFIG_GROUPS = Object.freeze([
       'maxOldGenerationSizeMb',
       'maxNestedRunCodeDepth',
       'maxOutputBytes',
+      'sampleBoundMs',
+      'workerReclaimMs',
+      'startupProbeMs',
+      'executionSeamTimeoutMs',
       'maxValueNodes',
       'maxValueEdges',
       'maxValueArrayLength',
@@ -405,7 +525,7 @@ export const CONFIG_GROUPS = Object.freeze([
   },
   { key: 'capabilities', label: '能力与上下文', labelEn: 'Capabilities and context',
     fields: Object.freeze(['capabilityContextEnabled', 'capabilityManagementEnabled', 'capabilityBaseline', 'capabilityOverrides',
-      'capabilityStatistics', 'capabilityPolicy', 'capabilityRecoveryEnabled', 'modelPreviewEnabled', 'capabilityProfiles', 'capabilityBudgetBytes', 'capabilityDirectoryBytes', 'capabilityRecoveryBytes', 'modelPreviewTokens']) },
+      'capabilityStatistics', 'capabilityPolicy', 'capabilityRecoveryEnabled', 'modelPreviewEnabled', 'capabilityProfiles', 'capabilityBudgetBytes', 'capabilityDirectoryBytes', 'capabilityRecoveryBytes', 'modelPreviewTokens', 'retentionPayloadRuns', 'retentionPayloadBytes', 'retentionClusters', 'capabilityPromptTextEnabled', 'promptText']) },
 ])
 
 /** Functional modules share the same section order across every settings entry. */

package/internal/direct-surface-owner.js

@@ -16,10 +16,8 @@ import {
 import { userBindingsConfiguredContext } from './user-bindings.js'
 import { BINDING_AUTHORING_SDK } from './user-binding-authoring.js'
 import { executionPolicies } from './binding-update-policy.js'
+import { PROMPT_SLOT_IDS, promptAssetText, resolvePromptTextConfig } from './prompt-text.js'
 
-const RUN_CODE_TOOL_DESCRIPTION = 'Evaluate the next TypeScript cell in this session-bound persistent REPL, reusing earlier top-level bindings. Use `code` for the cell and `description` for its short UI summary. Successful image-bearing subtool results are attached after the cell.'
-const RUN_CODE_CODE_DESCRIPTION = 'Code for the next PTC TypeScript cell, following the selected language conventions.'
-const RUN_CODE_DESCRIPTION_DESCRIPTION = 'Short active-voice summary of what this cell does, 5-10 words (shown in the UI).'
 const CODE_TRANSPORT_INSTRUCTION = '`run_code` is the only tool callable directly. Call `tools.edit_run_code` and other SDK tools from inside a program. An accepted edit runs after the current cell finishes.'
 const PTC_COLLAPSE_SECTION_NAMES = Object.freeze(['tools:ptc-only', 'tools:code-only'])
 const INVALID_TOOL_JSON_FAILURE = Object.freeze({
@@ -29,7 +27,7 @@ const INVALID_TOOL_JSON_FAILURE = Object.freeze({
 const MALFORMED_TOOL_REJECTION_ID = 'dsh-ptc-plus-malformed-tool-json'
 const MALFORMED_TOOL_REJECTION_ARGUMENTS = '{"dsh_ptc_plus_malformed_tool_json":'
 
-function adaptRunCodeSchema(tool) {
+function adaptRunCodeSchema(tool, promptText) {
   const parameters = tool.parameters
   const properties = isRecord(parameters) ? parameters.properties : undefined
   const code = isRecord(properties) ? properties.code : undefined
@@ -41,13 +39,13 @@ function adaptRunCodeSchema(tool) {
   }
   return {
     ...tool,
-    description: RUN_CODE_TOOL_DESCRIPTION,
+    description: promptAssetText(promptText, PROMPT_SLOT_IDS.runCodeDescription),
     parameters: {
       ...parameters,
       properties: {
         ...properties,
-        code: { ...code, description: RUN_CODE_CODE_DESCRIPTION },
-        description: { ...description, description: RUN_CODE_DESCRIPTION_DESCRIPTION },
+        code: { ...code, description: promptAssetText(promptText, PROMPT_SLOT_IDS.runCodeCodeArg) },
+        description: { ...description, description: promptAssetText(promptText, PROMPT_SLOT_IDS.runCodeDescriptionArg) },
       },
     },
   }
@@ -472,11 +470,13 @@ export function createDirectSurfaceOwner({
   let disposed = false
   let currentCanonicalizeToolCalls = canonicalizeToolCalls
   let currentAutoDescribeRunCode = runtimeConfig.autoDescribeRunCode
+  let currentPromptText = resolvePromptTextConfig(runtimeConfig)
   let currentLanguageSemantics = executionPolicies(runtimeConfig).languageSemantics
   const tipConfig = {
     enabled: runtimeConfig.tipsEnabled,
     cooldownMessages: runtimeConfig.tipCooldownMessages,
     escalationFailures: runtimeConfig.tipEscalationFailures,
+    get prompt() { return currentPromptText },
   }
 
   const sessionOwner = (id) => {
@@ -561,6 +561,7 @@ export function createDirectSurfaceOwner({
       currentLanguageSemantics = executionPolicies(nextConfig).languageSemantics
       currentCanonicalizeToolCalls = nextConfig.canonicalizeToolCalls
       currentAutoDescribeRunCode = nextConfig.autoDescribeRunCode
+      currentPromptText = resolvePromptTextConfig(nextConfig)
       cordisRecovery.reconfigure(nextConfig.cordisToolsEnabled)
       tipConfig.enabled = nextConfig.tipsEnabled
       tipConfig.cooldownMessages = nextConfig.tipCooldownMessages
@@ -628,10 +629,11 @@ export function createDirectSurfaceOwner({
       const userBindings = sessionPtc ? await userBindingsForAgent(agent) : undefined
       if (!isCurrent()) return assembly
       const runCode = tools.find(tool => tool?.name === RUN_CODE)
+      const promptText = currentPromptText
       let directTools = sessionPtc ? capabilityEnvironment?.visibleSchemas(agent, tools) ?? tools : tools
       if (sessionPtcProjection) {
         editTransport.ensureInstalled(agent)
-        directTools = [adaptRunCodeSchema(runCode)]
+        directTools = [adaptRunCodeSchema(runCode, promptText)]
       }
       const runtimeContexts = sessionPtc
         ? sessionRuntimeContexts(agent, tipConfig, {
@@ -641,7 +643,9 @@ export function createDirectSurfaceOwner({
           },
         })
         : { contexts: [] }
-      const bindingDefaults = userBindings === undefined ? undefined : userBindingsConfiguredContext(userBindings)
+      const bindingDefaults = userBindings === undefined ? undefined : userBindingsConfiguredContext(userBindings, {
+        entryLabel: promptAssetText(promptText, PROMPT_SLOT_IDS.userBindingsEntryLabel),
+      })
       const contexts = [
         ...runtimeContexts.contexts,
         ...(bindingDefaults === undefined ? [] : [bindingDefaults]),
@@ -684,7 +688,7 @@ export function createDirectSurfaceOwner({
         tools: sessionPtcProjection
           ? directTools
           : directTools.map(tool => tool?.name === RUN_CODE
-            ? adaptRunCodeSchema(tool)
+            ? adaptRunCodeSchema(tool, promptText)
             : tool),
         sections,
       }

package/internal/edit-transport-owner.js

@@ -7,10 +7,12 @@ import {
   REWRITES_KEY,
   isCanonicalSequence,
   liveToolCallSeq,
+  normalizeDeferredEditSettlement,
   normalizeJournal,
   normalizeRecoveryBoundaries,
   normalizeRewrites,
   validatedRewrites,
+  withDiagnosticWording,
 } from './session-journal.js'
 import {
   EXPECTED_TARGET_CALL_SEQ,
@@ -18,6 +20,11 @@ import {
   editRunCodeSchema,
 } from './rejected-cell-editor.js'
 import { projectSessionLog } from './session-log-view.js'
+import { refoldEditableSettlement } from './session-journal-recovery.js'
+import {
+  PRUNED_EDIT, PRUNED_EDIT_EN, PRUNED_SUMMARY_MISMATCH, PRUNED_SUMMARY_MISMATCH_EN,
+} from './projection-retention.js'
+import { PROMPT_SLOT_IDS, promptAssetText } from './prompt-text.js'
 import { sessionEvents } from './session-events.js'
 import { deepEqualJson, snapshotJsonValue } from '@deepseek-ai/dsh-util-values'
 import { scopeTarget } from '@deepseek-ai/dsh-scope'
@@ -39,6 +46,15 @@ import {
 
 export const EDIT_RUN_CODE = 'edit_run_code'
 
+const TARGET_FIRST_LINE_LIMIT = 120
+
+/** Bounded identity of the cell an edit actually captured, for model-facing reasons. */
+function targetSummary(target) {
+  const line = typeof target?.source === 'string' ? target.source.split(/\r?\n/, 1)[0].trim() : ''
+  const firstLine = line.length > TARGET_FIRST_LINE_LIMIT ? `${line.slice(0, TARGET_FIRST_LINE_LIMIT)}…` : line
+  return `run_code call ${target?.callSeq}${firstLine === '' ? '' : `, first line: ${firstLine}`}`
+}
+
 function nestedEditStart(sessionLog, exec) {
   const events = sessionEvents(sessionLog)
   if (!Array.isArray(events) || typeof exec?.callId !== 'string'
@@ -63,8 +79,35 @@ function nestedEditStart(sessionLog, exec) {
     || event.data.rootCallId !== exec.rootCallId
     || event.data.parentCallId !== exec.rootCallId
     || !deepEqualJson(event.data.arguments, exec.arguments)) return undefined
-  const target = projectSessionLog({ session: { events: events.slice(0, index + 1) } }).editableRun
-  return { startSeq: event.seq, rootCallSeq, target }
+  const slice = { session: { events: events.slice(0, index + 1) } }
+  const view = projectSessionLog(slice)
+  let target = view.editableRun
+  // A dropped cluster is not gone for good: the log still holds the events, so the
+  // edit path refolds that slice with pruning disabled and reads the cell from
+  // there. Only when the log itself cannot supply it does the edit report that the
+  // retention window cut it.
+  if (target === undefined && view.retentionSummary !== undefined) {
+    const refolded = refoldEditableSettlement(events.slice(0, index + 1), view.retentionSummary)
+    target = refolded.run
+    // The summary is the checkpoint's only record of a dropped cluster; the log is
+    // the authority. When the two disagree the edit must not proceed on either.
+    //
+    // This call site cannot produce that disagreement: the summary and the refold
+    // come from the same fold of the same event slice, and the run the refold reads
+    // is the one the pruned fold pins, so `refoldEditableSettlement` never finds a
+    // summary record for it. The comparison stays for the exported contract, which
+    // covers both outcomes in test/projection-retention.test.js.
+    /* c8 ignore start -- same-fold determinism: the call site cannot disagree with itself (see above) */
+    if (refolded.mismatch) {
+      return { startSeq: event.seq, rootCallSeq, target: undefined, retentionSummary: view.retentionSummary,
+        summaryMismatch: true }
+    }
+    /* c8 ignore stop */
+  }
+  // The summary travels with the target so an unavailable edit can say why it is
+  // unavailable: the cell fell outside the retention window instead of never
+  // existing.
+  return { startSeq: event.seq, rootCallSeq, target, retentionSummary: view.retentionSummary }
 }
 
 function unavailableDerivedResult(inner) {
@@ -109,6 +152,7 @@ export function createEditTransportOwner(ctx, {
   sessionId,
   toolSchemasForAgent,
   readSessionLog,
+  promptText,
 }) {
   const editClaims = new Map()
   const pendingAcceptances = new Map()
@@ -128,7 +172,7 @@ export function createEditTransportOwner(ctx, {
     }
   }
 
-  const definition = editRunCodeSchema()
+  const definition = editRunCodeSchema(promptAssetText(promptText, PROMPT_SLOT_IDS.editRunCodeDescription))
   const derivedMetadata = (derived) => {
     const meta = {
       [JOURNAL_KEY]: normalizeJournal(derived.journal),
@@ -155,9 +199,12 @@ export function createEditTransportOwner(ctx, {
           derived.draftCapability,
           presentationGeneration,
         )
+    // The derived settlement records its own diagnostic wording, so a replay reads
+    // the same pairing the root path publishes.
+    const withWording = withDiagnosticWording(withDraft, withDraft[JOURNAL_KEY])
     return derived.replMemory === undefined
-      ? withDraft
-      : withReplMemorySnapshot(withDraft, derived.replMemory, presentationGeneration)
+      ? withWording
+      : withReplMemorySnapshot(withWording, derived.replMemory, presentationGeneration)
   }
   definition.output = {
     schema: {
@@ -184,17 +231,29 @@ export function createEditTransportOwner(ctx, {
       throw new Error('ptc-plus: edit_run_code requires a unique persisted PTC sub-call start')
     }
     const target = start.target
+    /* c8 ignore start -- reachable only through `nestedEditStart`'s mismatch, which cannot disagree with itself (see there) */
+    if (start.summaryMismatch === true) {
+      return { accepted: false, scheduled: false,
+        reason: `${PRUNED_SUMMARY_MISMATCH} / ${PRUNED_SUMMARY_MISMATCH_EN}` }
+    }
+    /* c8 ignore stop */
     if (target?.source === undefined || target.callSeq === undefined) {
-      return { accepted: false, scheduled: false, reason: 'no run_code cell is currently eligible for safe editing' }
+      return { accepted: false, scheduled: false,
+        reason: start.retentionSummary === undefined
+          ? 'no run_code cell is currently eligible for safe editing'
+          : `${PRUNED_EDIT} / ${PRUNED_EDIT_EN}` }
     }
     const edited = editRejectedCell(args, target.source)
-    if (!edited.edited) return { accepted: false, scheduled: false, reason: edited.reason }
+    if (!edited.edited) {
+      return { accepted: false, scheduled: false, reason: `${edited.reason} (edit target: ${targetSummary(target)})` }
+    }
     const expectedTargetCallSeq = args[EXPECTED_TARGET_CALL_SEQ]
     if (expectedTargetCallSeq !== undefined && expectedTargetCallSeq !== target.callSeq) {
       return {
         accepted: false,
         scheduled: false,
-        reason: `validated repair targets run_code call ${expectedTargetCallSeq}, but this edit captured call ${target.callSeq}`,
+        reason: `validated repair targets run_code call ${expectedTargetCallSeq}, but this edit captured ${targetSummary(target)}.`
+          + ' Only the most recent settled cell stays editable; if the intended cell is no longer editable, re-submit its corrected source with run_code instead.',
       }
     }
     if (typeof ctx.tools.execute !== 'function') {
@@ -207,7 +266,8 @@ export function createEditTransportOwner(ctx, {
       editClaims.set(id, claims)
     }
     if (claims.has(target.callSeq)) {
-      return { accepted: false, scheduled: false, reason: 'the current edit target already has a derived execution' }
+      return { accepted: false, scheduled: false,
+        reason: `the current edit target already has a derived execution (edit target: ${targetSummary(target)})` }
     }
     claims.set(target.callSeq, 'scheduled')
     const receipt = { accepted: true, scheduled: true, target_call_seq: target.callSeq }
@@ -219,6 +279,7 @@ export function createEditTransportOwner(ctx, {
       rootCallSeq: start.rootCallSeq,
       subCallId: exec.callId,
       targetCallSeq: target.callSeq,
+      targetDescription: targetSummary(target),
       finalized: false,
       finalizeTentative: undefined,
       finish(confirmed) {
@@ -278,7 +339,7 @@ export function createEditTransportOwner(ctx, {
         const journalValue = isRecord(metadata) && Object.hasOwn(metadata, JOURNAL_KEY)
           ? metadata[JOURNAL_KEY] : undefined
         const journal = journalValue === undefined ? undefined : normalizeJournal(journalValue)
-        if (journal === undefined || journal.status === 'noop'
+        if (journal === undefined
           || inner.isError !== (journal.completion?.kind === 'throw' || journal.status === 'discarded')) {
           this.finish(false)
           return { outcome: unavailableDerivedResult(inner), presentation: derivedPresentation(inner) }
@@ -296,16 +357,34 @@ export function createEditTransportOwner(ctx, {
           code: edited.code,
           description: edited.description,
         }
+        const metaValue = derivedMetadata(derived)
+        let settlement
+        try {
+          settlement = normalizeDeferredEditSettlement(metaValue, target.callSeq)
+        } catch {
+          // Metadata this relation cannot prove must not reach the root result.
+          this.finish(false)
+          return { outcome: unavailableDerivedResult(inner), presentation: derivedPresentation(inner) }
+        }
+        const provenance = {
+          startSeq: start.startSeq,
+          executionStartSeq: executionStart.seq,
+          rootCallSeq: start.rootCallSeq,
+          subCallId: exec.callId,
+          meta: metaValue,
+        }
+        if (settlement.unexecuted === true) {
+          // The accepted edit is proved by a settlement that never ran. Publishing
+          // the relation keeps the root cell provable, while the outcome and the
+          // unexecuted journal keep the revision from executing, from publishing a
+          // binding and from becoming the next edit target.
+          this.finish(false)
+          return { outcome: unavailableDerivedResult(inner), presentation: derivedPresentation(inner), provenance }
+        }
         return {
           outcome: derivedEditResult(inner),
           presentation: derivedPresentation(inner),
-          provenance: {
-            startSeq: start.startSeq,
-            executionStartSeq: executionStart.seq,
-            rootCallSeq: start.rootCallSeq,
-            subCallId: exec.callId,
-            meta: derivedMetadata(derived),
-          },
+          provenance,
         }
       },
     }

package/internal/execution-provider-owner.js

@@ -64,12 +64,32 @@ export function apply(ctx, config = {}) {
   }
   const publish = () => {
     const resolutions = new WeakMap()
+    const ownerOriginals = new WeakMap()
+    const isOwner = owner => owner !== null && (typeof owner === 'object' || typeof owner === 'function')
     const delegate = {
       get language() { return readOriginal().language },
       get isolation() { return readOriginal().isolation },
+      get programFormat() { return readOriginal().programFormat ?? 'function-body' },
       get executionInstructions() { return readOriginal().executionInstructions },
       get sandboxMode() { return readOriginal().sandboxMode },
       get timeout() { return readOriginal().timeout },
+      release(owner) {
+        const originals = isOwner(owner) ? ownerOriginals.get(owner) : undefined
+        if (originals !== undefined) {
+          return Promise.all([...originals].map(original => Promise.resolve()
+            .then(() => original.release(owner))
+            .then(() => originals.delete(original)))).then(() => undefined)
+        }
+        let original
+        try {
+          original = readOriginal()
+        } catch {
+          // No retained dispatch belongs to this owner and execution is unavailable.
+          return Promise.resolve()
+        }
+        if (typeof original.release !== 'function') return Promise.resolve()
+        return Promise.resolve(original.release.call(original, owner))
+      },
       resolve(request) {
         const original = readOriginal()
         const spec = serviceName === EXECUTION_SEAM_SERVICE ? original.resolve(request) : request
@@ -82,6 +102,11 @@ export function apply(ctx, config = {}) {
         const resolved = resolutions.get(spec)
         if (resolved?.generation?.active === false) throw new Error('ptc-plus: resolved spec belongs to an unavailable original generation')
         const original = resolved?.original ?? readOriginal()
+        if (isOwner(spec?.stateOwner) && typeof original.release === 'function') {
+          let originals = ownerOriginals.get(spec.stateOwner)
+          if (originals === undefined) ownerOriginals.set(spec.stateOwner, originals = new Set())
+          originals.add(original)
+        }
         return original.run(spec)
       },
     }

package/internal/execution-seam-compat.js

@@ -60,6 +60,10 @@ export function createExecutionSeam(service, serviceName) {
   const provider = Object.freeze({
     get language() { requireCompatible(); return service.language },
     get isolation() { requireCompatible(); return installed === undefined ? service.isolation : 'worker-thread' },
+    // Source evaluation form belongs to the provider that actually receives
+    // the program. Program-format consumers delegate to the original provider,
+    // so this descriptor always follows the original generation.
+    get programFormat() { requireCompatible(); return service.programFormat ?? 'function-body' },
     get executionInstructions() { requireCompatible(); return installed === undefined ? service.executionInstructions ?? '' : '' },
     get sandboxMode() { requireCompatible(); return installed === undefined ? service.sandboxMode : undefined },
     get timeout() { requireCompatible(); return installed === undefined ? service.timeout : undefined },
@@ -71,6 +75,20 @@ export function createExecutionSeam(service, serviceName) {
       requireCompatible()
       return installed === undefined ? upstreamRun.call(service, input) : installed.execute(input)
     },
+    /**
+     * Release one owner's retained environment. The resources live in the
+     * original generation (the session kernel releases its state through its
+     * own lifecycle). Adapter retirement only closes execution; the original
+     * still owns cleanup for references retained by its consumers.
+     */
+    release(owner) {
+      if (typeof service.release !== 'function') return Promise.resolve()
+      try {
+        return Promise.resolve(service.release.call(service, owner))
+      } catch (error) {
+        return Promise.reject(error)
+      }
+    },
     [PLUGIN_EXECUTION_SEAM]() { return seam },
   })
   const seam = Object.freeze({