dsh-ptc-plus 0.5.2 → 0.5.4

package/internal/runtime-bridge-owner.js

@@ -24,6 +24,8 @@ import {
   toolCapabilityMetadata,
 } from './program-bindings.js'
 import { deepFreeze } from './record-utils.js'
+import { adaptRunCodeSchema } from './direct-surface-owner.js'
+import { hostTransportDefinition, isBatchSubmission } from './host-tool-sdk.js'
 import { REPL_MEMORY_META_KEY, withReplMemorySnapshot } from './repl-memory-projection.js'
 import { withUserBindingDraftCapability } from './user-binding-draft-projection.js'
 import { POST_EDIT_KEY } from './session-journal-schema.js'
@@ -160,6 +162,7 @@ export function createRuntimeBridgeOwner({
   userBindingDraftForAgent,
   bindingSubmissionForAgent,
   capabilityEnvironment,
+  readPromptText = () => undefined,
 }) {
   const scope = new AsyncLocalStorage()
   const childScope = new AsyncLocalStorage()
@@ -185,6 +188,8 @@ export function createRuntimeBridgeOwner({
   })
   let currentConfig = sessions.config
   const patchedDefinitions = new Map()
+  /** The host descriptors this attachment replaced on each definition's slots. */
+  const slotPatches = new Map()
   const pending = new WeakMap()
   const nativeRunCodeHandoffs = new Set()
   let active = true
@@ -342,7 +347,11 @@ export function createRuntimeBridgeOwner({
     )))
     const metadata = Object.freeze([
       ...(capabilityEnvironment?.toolMetadata(executionToken?.agent, toolCapabilityMetadata(schemas, annotations), schemas) ?? toolCapabilityMetadata(schemas, annotations)),
-      ...(capabilityEnvironment?.metadata(executionToken?.agent) ?? []),
+      // The same set, as the third argument's own evidence: a derived row (`skills.*`,
+      // `mcp.*`) states the invocation path it still has, and the operations it can name
+      // are the members this program was handed — not the ones the composition froze when
+      // the session was last composed, which a step that delivers less does not rewrite.
+      ...(capabilityEnvironment?.metadata(executionToken?.agent, schemas) ?? []),
       ...PROGRAM_CAPABILITY_METADATA.map(entry => entry.namespace === 'code'
         && cellConfig.userBindingsEnabled === true
         ? { ...entry, members: [...entry.members, BINDING_SUBMISSION] }
@@ -393,14 +402,94 @@ export function createRuntimeBridgeOwner({
     return { request: { ...request, bindings: projected }, release }
   }
 
+/**
+ * Write one editable run_code slot onto the host's definition.
+ *
+ * A host may publish the slot as writable data or as a getter-only accessor over
+ * its own text, and strict-mode assignment throws on the latter. An owned property
+ * definition reaches both shapes, so the plugin never fails silently to deliver the
+ * text it was asked to deliver.
+ * @param {object} definition - the host's live run_code definition.
+ * @param {string} key - the definition field being replaced.
+ * @param {unknown} value - the text the plugin owns.
+ * @returns {boolean} whether the field now holds that value.
+ */
+function writeSlot(definition, key, value) {
+  const own = Object.getOwnPropertyDescriptor(definition, key)
+  try {
+    Object.defineProperty(definition, key, {
+      configurable: own?.configurable ?? true,
+      enumerable: own?.enumerable ?? true,
+      writable: true,
+      value,
+    })
+    return true
+  } catch {
+    return false
+  }
+}
+
+/** Put one slot back to the descriptor the host published before this plugin. */
+function restoreSlot(definition, key, descriptor) {
+  try {
+    if (descriptor === undefined) delete definition[key]
+    else Object.defineProperty(definition, key, descriptor)
+  } catch {
+    // A host that made the slot non-configurable after the plugin replaced it keeps
+    // the last written text; the restore cannot be forced, and the caller that
+    // rewrote it owns the consequence.
+  }
+}
+
+/**
+ * The editable run_code slots have to reach whichever definition the host lets this
+ * plugin own. Two writes, one decision: if the host's parameter texts cannot be
+ * replaced, the definition keeps all of its own text rather than half of ours. The
+ * descriptors the write replaced are recorded once, so re-applying the current
+ * prompt document on every request can never mistake the plugin's own text for the
+ * host's, and disposal can restore what the host still publishes.
+ */
+function applyEditableSlots(definition, promptText, slotPatches) {
+  if (promptText === undefined) return
+  let adapted
+  try {
+    adapted = adaptRunCodeSchema(definition, promptText)
+  } catch {
+    return
+  }
+  const recorded = slotPatches.get(definition)
+  if (recorded !== undefined) {
+    // Re-applied on every request: the descriptors recorded by the first write are
+    // the ones disposal restores, so a later application can never mistake the
+    // plugin's own text for the host's. A slot the host has since made unreplaceable
+    // keeps the text this attachment already delivered.
+    writeSlot(definition, 'parameters', adapted.parameters)
+    writeSlot(definition, 'description', adapted.description)
+    return
+  }
+  const ownParameters = Object.getOwnPropertyDescriptor(definition, 'parameters')
+  const ownDescription = Object.getOwnPropertyDescriptor(definition, 'description')
+  if (!writeSlot(definition, 'parameters', adapted.parameters)) return
+  if (!writeSlot(definition, 'description', adapted.description)) {
+    restoreSlot(definition, 'parameters', ownParameters)
+    return
+  }
+  slotPatches.set(definition, new Map([['parameters', ownParameters], ['description', ownDescription]]))
+}
+
   const patchRunCodeDefinition = (agent) => {
-    const definition = ctx.tools.get(RUN_CODE, agent)
+    const definition = hostTransportDefinition(ctx.tools, agent, RUN_CODE)
     if (definition === undefined) {
       throw new Error('ptc-plus: run_code definition is unavailable for the owning session')
     }
     if (definition.output === undefined) {
       throw new Error('ptc-plus: run_code definition has no output projection')
     }
+    // A host that declares its own model-facing tools never hands this plugin a
+    // tools array to adapt, so the editable prompt slots reach the model only on
+    // the definition the executor projects. Re-applied on every request, because
+    // the prompt document can change while the definition stays the same object.
+    applyEditableSlots(definition, readPromptText(), slotPatches)
     if (patchedDefinitions.has(definition)) return
     const output = definition.output
     const ownPresentationMeta = Object.getOwnPropertyDescriptor(output, 'presentationMeta')
@@ -463,10 +552,10 @@ export function createRuntimeBridgeOwner({
       // nested success. Capture its canonical value before policy; the private
       // relation is admitted only if policy retains that same frozen value.
       if (current?.deferredSettlement?.current === current && derived !== undefined
-        && current.exec === exec && exec.token !== undefined && exec.parent !== undefined
+        && current.exec === exec && exec.token !== undefined
         && current.id === sessionId(exec.agent) && derived.agent === exec.agent
-        && derived.callId === exec.callId && derived.rootCallId === exec.rootCallId
-        && derived.parent === exec.parent && deepEqualJson(derived.arguments, exec.arguments)
+        && isDerivedExecution(derived, exec)
+        && deepEqualJson(derived.arguments, exec.arguments)
         && current.presentationMetaCalls === undefined && result.isError === false
         && result.value !== null && typeof result.value === 'object'
         && Object.isFrozen(result.value) && result.meta?.[JOURNAL_KEY] === undefined
@@ -610,13 +699,30 @@ export function createRuntimeBridgeOwner({
 
   const releaseSeam = seam.installExecute(patchedRun)
 
+  /**
+   * Whether this execution is the derived execution the edit transport submitted.
+   *
+   * A registry host runs the very object the plugin built, so the call id, the root
+   * call and the parent token it carries all prove the relation. The batch contract
+   * assigns its own identity instead: the parent token is the host's own and the
+   * root call is whichever call that host treats as direct. What survives there is
+   * the call id this plugin chose, which the host matched the batch result back to,
+   * together with the dispatch record; the derived source is compared beside it.
+   */
+  const isDerivedExecution = (derived, exec) => {
+    if (derived === null || typeof derived !== 'object' || exec === null || typeof exec !== 'object') return false
+    if (derived.callId !== exec.callId) return false
+    if (isBatchSubmission(derived)) return true
+    return exec.parent !== undefined
+      && derived.rootCallId === exec.rootCallId && derived.parent === exec.parent
+  }
+
   const ownedDerivedScope = (exec, executionArguments = exec.arguments) => {
     const inherited = scope.getStore()
     const derived = inherited?.derivedExecution
     if (inherited?.deferredSettlement === undefined
       || inherited.id !== sessionId(exec.agent) || derived?.agent !== exec.agent
-      || derived.callId !== exec.callId || derived.rootCallId !== exec.rootCallId
-      || derived.parent !== exec.parent || exec.name !== RUN_CODE
+      || !isDerivedExecution(derived, exec) || exec.name !== RUN_CODE
       || !deepEqualJson(derived.arguments, executionArguments)) return undefined
     return inherited
   }
@@ -800,8 +906,7 @@ export function createRuntimeBridgeOwner({
       const derived = current.derivedExecution
       const privateMetadata = projection !== undefined && projection.exec === exec
         && deferred.current === current && current.exec === exec && current.id === id
-        && derived?.agent === exec.agent && derived.callId === exec.callId
-        && derived.rootCallId === exec.rootCallId && derived.parent === exec.parent
+        && derived?.agent === exec.agent && isDerivedExecution(derived, exec)
         && deepEqualJson(derived.arguments, exec.arguments)
         && projection.token === exec.token && projection.value === result?.value
         && result.isError === false && deepEqualJson(projection.meta, result.meta)
@@ -868,6 +973,10 @@ export function createRuntimeBridgeOwner({
         }
       }
       patchedDefinitions.clear()
+      for (const [definition, recorded] of slotPatches) {
+        for (const [key, descriptor] of recorded) restoreSlot(definition, key, descriptor)
+      }
+      slotPatches.clear()
       try {
         await sessions.dispose()
       } catch (error) {

package/internal/runtime-config.js

@@ -130,6 +130,16 @@ export function resolveConfig(config = {}) {
     }
   }
   resolved.capabilityPolicy = JSON.stringify(capabilityPolicyForConfig(provided.has('capabilityPolicy') ? resolved : { ...resolved, capabilityPolicy: undefined }))
+  // Whether the record holds this policy is a fact about the input document, not about this
+  // resolution's output: a configuration this function already resolved carries the answer,
+  // and resolving that answer's own product again must not re-infer it from the policy this
+  // function just wrote. Callers that reconcile by resolving a source that may itself be
+  // resolved (the plugin resolves its raw document and then re-resolves the result) would
+  // otherwise report every policy as saved, which is what makes a synthesized bottom layer
+  // decide the saved column. The marker only means something beside a policy the document
+  // itself holds, so a document that writes the marker without one states no provenance.
+  resolved.capabilityPolicySaved = provided.has('capabilityPolicy')
+    && (typeof config.capabilityPolicySaved === 'boolean' ? config.capabilityPolicySaved : true)
   if (!provided.has('capabilityPolicy') && resolved.capabilityManagementEnabled) {
     if (!provided.has('capabilityRecoveryEnabled')) resolved.capabilityRecoveryEnabled = true
     if (!provided.has('modelPreviewEnabled')) resolved.modelPreviewEnabled = true

package/internal/runtime-messages.js

@@ -5,6 +5,7 @@ import {
 } from './prompt-text.js'
 
 import { isPtcMessageSource, PTC_MESSAGE_SOURCE_KIND } from './message-sources.js'
+import { BINDING_ADOPTION_FORM, readBindingAdoption } from './binding-adoption.js'
 
 export const PTC_DELIVERY_CONTEXT = 'tools:ptc-plus-message-delivery'
 export const PTC_BINDING_CATALOG = 'tools:ptc-plus-user-binding-defaults'
@@ -116,6 +117,10 @@ export function readRuntimeMessage(message) {
   const text = message.content[0].text
   const availability = readRuntimeAvailability(message)
   if (availability !== undefined) return { form: 'runtime-availability', state: availability }
+  // A session's binding adoption is recorded as one of its own messages, so the
+  // log is its only owner and replay reconstructs it without process memory.
+  const adoption = readBindingAdoption(message)
+  if (adoption !== undefined) return { form: BINDING_ADOPTION_FORM, declined: [...adoption.declined] }
   if (source.form === 'snapshot') {
     const sections = stateSections(source.sections)
     if (sections !== undefined && [STATE_PREFIX, PREVIOUS_STATE_PREFIX, LEGACY_STATE_PREFIX]

package/internal/session-journal-recovery.js

@@ -9,6 +9,9 @@ import {
   RECOVERY_BOUNDARY_EVENT,
   DIAGNOSTIC_WORDING_KEY,
   DIAGNOSTIC_WORDING_FIELDS,
+  SETTLEMENT_PROOF_KEY,
+  SETTLEMENT_PROOF_FIELDS,
+  SETTLEMENT_PROOF_VERSION,
   LEGACY_JOURNAL_VERSION,
   REPL_TOOL_NAMES,
   REWRITES_KEY,
@@ -23,6 +26,7 @@ import {
   normalizeJournal,
   normalizeRecoveryBoundaries,
   reduceStateOperations,
+  settlementProofDigest,
   userBindingsForJournal,
   validatedRewrites,
 } from './session-journal.js'
@@ -104,14 +108,13 @@ function reachableFrom(nodes, head) {
 }
 
 /**
- * Binding names a node recorded.
+ * Binding names a settlement journal recorded.
  *
  * The recorded values are the only evidence that names a durable binding today;
  * `unrecordedBindings` names the ones the codec could not transfer, and a
  * `kind: "binding"` save names one explicitly. A checkpoint save never counts.
  */
-function recordedBindingNames(node) {
-  const journal = node?.journal
+function journalBindingNames(journal) {
   if (journal === undefined) return []
   return [...new Set([
     ...(journal.values ?? []).map(value => value.name),
@@ -120,6 +123,11 @@ function recordedBindingNames(node) {
   ].filter(name => typeof name === 'string'))]
 }
 
+/** Binding names an installed node recorded. */
+function recordedBindingNames(node) {
+  return journalBindingNames(node?.journal)
+}
+
 function applyOperations(state, operations, nodeIndex) {
   const previousHead = state.head
   const transition = reduceStateOperations(state, operations, nodeIndex)
@@ -145,6 +153,117 @@ function applyOperations(state, operations, nodeIndex) {
   }
 }
 
+/**
+ * Adopt the relation a record states about the cell it revised.
+ *
+ * The relation belongs to the fold, because only the fold knows the path that
+ * builds the environment. An accepted edit claims the revision *replaces* the cell
+ * it edited, so the revision takes that cell's place in the recorded order: it
+ * continues from the target's parent and every cell that followed the target
+ * continues from the revision. Appending the revision after those cells instead
+ * leaves them replaying an environment the edit already rewrote, with the
+ * declarations they read gone and the revision not yet in place.
+ *
+ * `installed` says whether this settlement puts a cell on the path. A contracted
+ * revision installs nothing, so the cells that followed the target bridge to the
+ * target's parent, and only a head that was the target itself has to move.
+ *
+ * The returned record of what changed is what lets a rejected settlement put the
+ * path back: nothing this adoption did survives a settlement the fold refuses.
+ */
+function adoptSupersession(state, record, { installed }) {
+  const superseded = state.editRewritesHistory && record.supersedes !== undefined
+    ? state.nodes.findIndex(node => node.callSeq === record.supersedes) : -1
+  const adoption = {
+    superseded,
+    previousHead: state.head,
+    supersededBindings: new Set(state.supersededBindings),
+    supersessions: state.supersessions.length,
+    children: [],
+    parent: state.head,
+    head: undefined,
+  }
+  if (superseded < 0) {
+    // No relation: the settlement appends to the head, as it always has.
+    adoption.head = installed ? undefined : state.head
+    return adoption
+  }
+  const parent = state.nodes[superseded].parent
+  adoption.parent = parent
+  for (let child = 0; child < state.nodes.length; child += 1) {
+    if (state.nodes[child].parent === superseded) adoption.children.push(child)
+  }
+  // The head is the last recorded cell. It keeps its place when the target is on
+  // its path behind other cells, because those cells now reach the same head
+  // through the revision; otherwise the revision is the newest cell and the head.
+  const targetOnPath = reachableFrom(state.nodes, state.head).has(superseded)
+  if (installed) adoption.head = targetOnPath && state.head !== superseded ? state.head : undefined
+  else adoption.head = state.head === superseded ? parent : state.head
+  return adoption
+}
+
+/**
+ * Record the relation as the fact the model is owed.
+ *
+ * Only names the record proves count. A durable declaration that the replay
+ * re-establishes is not evidence about the superseded cell, and claiming it
+ * would report a binding this fold cannot see. What the revision supplies is the
+ * caller's answer, because a settlement the fold refused to install supplies
+ * nothing; a cell the fold installs supplies the names its journal recorded.
+ */
+function recordSupersession(state, record, adoption, suppliedNames) {
+  if (adoption.superseded < 0) return
+  const supplied = new Set(suppliedNames)
+  for (const name of recordedBindingNames(state.nodes[adoption.superseded])) {
+    if (!supplied.has(name)) state.supersededBindings.add(name)
+  }
+  state.supersessions.push(Object.freeze({
+    supersededCallSeq: record.supersedes,
+    supersedingCallSeq: record.call.seq,
+  }))
+}
+
+/**
+ * Fold one accepted record as a settlement of the recorded path.
+ *
+ * `installed` is false for a settlement the fold contracts: it puts no cell on the
+ * path and supplies no name, while the relation it states is still the log's fact.
+ * Either way the relation is adopted first and the state operations are applied
+ * last, so a settlement that throws leaves the path, the children it re-parented
+ * and the relation it recorded exactly as it found them.
+ */
+function applyAdoptedRecord(state, record, { journal, installed = true, restoredFromRecord = false }) {
+  const adoption = adoptSupersession(state, record, { installed })
+  const index = installed
+    ? state.nodes.push(Object.freeze({
+      code: record.code,
+      journal,
+      callSeq: record.call.seq,
+      parent: adoption.parent,
+      ...(restoredFromRecord ? { restoredFromRecord: true } : {}),
+      ...(record.result.userBindings === undefined ? {} : { userBindings: record.result.userBindings }),
+    })) - 1
+    : undefined
+  const inherited = installed ? index : adoption.parent
+  for (const child of adoption.children) {
+    state.nodes[child] = Object.freeze({ ...state.nodes[child], parent: inherited })
+  }
+  state.head = adoption.head === undefined ? index : adoption.head
+  try {
+    recordSupersession(state, record, adoption, installed ? journalBindingNames(journal) : [])
+    applyOperations(state, journal.operations, index)
+  } catch (error) {
+    if (index !== undefined) state.nodes.pop()
+    state.head = adoption.previousHead
+    for (const child of adoption.children) {
+      state.nodes[child] = Object.freeze({ ...state.nodes[child], parent: adoption.superseded })
+    }
+    state.supersededBindings = adoption.supersededBindings
+    state.supersessions.length = adoption.supersessions
+    throw error
+  }
+}
+
 /**
  * Binding names a recorded journal operation list saves.
  *
@@ -212,17 +331,10 @@ function applyRecord(state, record, invalidCallSeqs) {
     // the owner that read `Date.now()` or `process.pid` is gone, and the next
     // environment inherits the durable computation, not the live cache.
     if (!state.liveOnlyLost && journal.values !== undefined && journal.values.length > 0) {
-      const node = Object.freeze({
-        code,
-        journal,
-        callSeq: call.seq,
-        parent: state.head,
-        restoredFromRecord: true,
-        ...(result.userBindings === undefined ? {} : { userBindings: result.userBindings }),
-      })
-      const index = state.nodes.push(node) - 1
-      state.head = index
-      applyOperations(state, journal.operations, index)
+      // The relation is adopted for this settlement too: an accepted revision that
+      // settled volatile is still the revision the record names, so it replaces its
+      // target on the path and installs its own recorded values.
+      applyAdoptedRecord(state, record, { journal, restoredFromRecord: true })
       return
     }
     // A released live environment is reported as a contracted cell: the model
@@ -236,29 +348,22 @@ function applyRecord(state, record, invalidCallSeqs) {
         : journal.volatileReason ?? 'volatile cell',
       ...(volatileBindings.length === 0 || state.liveOnlyLost === true ? {} : { bindings: volatileBindings }),
     })
-    applyOperations(state, journal.operations, undefined)
+    // A contracted revision still replaces the cell it edited. Leaving the target
+    // on the path would keep building an environment the accepted edit already
+    // ended, and the relation is what tells the model those names are withdrawn
+    // rather than lost. The settlement installs nothing, so it supplies no name:
+    // every name the target recorded is withdrawn by this record.
+    applyAdoptedRecord(state, record, { journal, installed: false })
     return
   }
   if (!state.trusted && !state.surfaceContracted) {
     state.trusted = true
     state.volatileSuffix.length = 0
   }
-  const node = Object.freeze({
-    code,
-    journal,
-    callSeq: call.seq,
-    parent: state.head,
-    ...(result.userBindings === undefined ? {} : { userBindings: result.userBindings }),
-  })
-  const index = state.nodes.push(node) - 1
-  state.head = index
-  try {
-    applyOperations(state, journal.operations, index)
-  } catch (error) {
-    state.nodes.pop()
-    state.head = node.parent
-    throw error
-  }
+  // A record may declare that it is the revision of an earlier cell. Adoption of
+  // that relation, its re-parented children and the node this record puts on the
+  // path are one settlement: a record the fold refuses leaves none of them behind.
+  applyAdoptedRecord(state, record, { journal })
 }
 
 function recordEventSeq(record) {
@@ -277,9 +382,15 @@ function foldRecords(records, invalidCallSeqs, options = {}) {
     volatileSuffix: [],
     provenBindings: new Set(),
     deletedBindings: new Set(),
+    // One recorded revision replaced the cell it edited. The relation, not a
+    // deletion, is what the log proves: the superseded cell stays in the record
+    // and off the path to the head.
+    supersessions: [],
+    supersededBindings: new Set(),
     trusted: true,
     surfaceContracted: options.surfaceContracted === true,
     liveOnlyLost: options.liveOnlyLost === true,
+    editRewritesHistory: options.editRewritesHistory === true,
   }
   for (const record of records) {
     applyRecord(state, record, invalidCallSeqs)
@@ -1459,6 +1570,12 @@ function normalizePostEditFact(facts, call, resultEvent, result, replayPostEdit,
   let derived
   try {
     derived = normalizeDeferredEditSettlement(post.meta, target?.callSeq)
+    // The derived metadata is a published settlement of its own, so it carries the
+    // same proof the root journal does. Comparing the two recorded journal copies
+    // proves only that they agree with each other; an edit that changed both and
+    // left this proof behind no longer reproduces the settlement it published, and
+    // its journal is then not evidence for the bindings the revision declares.
+    requireRecordedSettlementProof(post.meta, derived.journal)
   } catch (error) {
     return fail(error.message)
   }
@@ -1517,6 +1634,40 @@ function requireRecordedDiagnosticWording(meta, journal) {
   }
 }
 
+/**
+ * A published settlement proves its own facts, and the Host's copy of its outcome
+ * must still agree with them.
+ *
+ * Recovery reads a record as evidence for the bindings its cell declared, and the
+ * record is the only account of its cell: editing the status, the completion or a
+ * diagnostic leaves the record self-consistent, because the completion is rendered
+ * from the same diagnostic that was edited. The proof recorded at publication is
+ * one digest over exactly those facts, so an edited record no longer reproduces it.
+ * A record that carries no proof predates it and keeps the older evidence.
+ *
+ * The retained `isError` is the Host's copy of the same outcome and not a fact this
+ * plugin can recompute, so an edit that also rewrites the proof still has to agree
+ * with it. That relation is the one a deferred edit already proves before it is
+ * published.
+ */
+function requireRecordedSettlementProof(meta, journal, isError = undefined) {
+  if (isError !== undefined && isError !== (journal.status === 'discarded'
+    || journal.completion?.kind === 'throw')) {
+    throw new Error('journal settlement does not agree with the tool result it settled')
+  }
+  if (!isRecord(meta) || !Object.hasOwn(meta, SETTLEMENT_PROOF_KEY)) return
+  const recorded = meta[SETTLEMENT_PROOF_KEY]
+  if (!isRecord(recorded) || Reflect.ownKeys(recorded).length !== SETTLEMENT_PROOF_FIELDS.size
+    || Reflect.ownKeys(recorded).some(key => !SETTLEMENT_PROOF_FIELDS.has(key))
+    || recorded.version !== SETTLEMENT_PROOF_VERSION
+    || typeof recorded.recordedMessage !== 'string') {
+    throw new Error('invalid recorded settlement proof')
+  }
+  if (recorded.recordedMessage !== settlementProofDigest(journal)) {
+    throw new Error('journal facts do not match their recorded settlement proof')
+  }
+}
+
 function advanceTimelineEvent(previous, inputEvent, eventIndex, replayFact, retainedCalls) {
   const nested = inputEvent?.type === 'tool/ptc-dispatch-start'
     || inputEvent?.type === 'tool/ptc-dispatch'
@@ -1767,6 +1918,7 @@ function advanceTimelineEvent(previous, inputEvent, eventIndex, replayFact, reta
               ...(derived.userBindings === undefined ? {} : { userBindings: derived.userBindings }),
             }
             requireRecordedDiagnosticWording(meta, derived.journal)
+            requireRecordedSettlementProof(meta, derived.journal)
           } else if (call.data.name === 'run_code') {
             const rawJournal = meta[JOURNAL_KEY]
             const resolveLegacyConfirm = rawJournal?.version === LEGACY_JOURNAL_VERSION
@@ -1800,6 +1952,15 @@ function advanceTimelineEvent(previous, inputEvent, eventIndex, replayFact, reta
               ...(userBindings === undefined ? {} : { userBindings }),
             }
             requireRecordedDiagnosticWording(meta, journal)
+            // The Host states the outcome of the cell it settled; a record whose
+            // completion or status contradicts it was edited after publication. The
+            // Host records that outcome on the result message it appends, so the
+            // message is read first; a log that carries it on the event instead is
+            // read the same way.
+            const hostIsError = typeof event.data?.message?.isError === 'boolean'
+              ? event.data.message.isError
+              : typeof event.data?.isError === 'boolean' ? event.data.isError : undefined
+            requireRecordedSettlementProof(meta, journal, hostIsError)
             let postEdit
             try {
               postEdit = normalizePostEditFact(state.eventFacts, call, event, normalized, undefined, state.executableCalls)
@@ -2299,7 +2460,8 @@ export function recoverJournal(session, currentCallSeq, options = {}) {
   // A live environment that was released cannot lend its recorded live-only
   // values to the environment that replaces it. The flag belongs to the fold, so
   // every re-fold below carries it.
-  const foldOptions = { liveOnlyLost: options?.liveOnlyLost === true }
+  const foldOptions = { liveOnlyLost: options?.liveOnlyLost === true,
+    editRewritesHistory: options?.editRewritesHistory === true }
   let state = foldRecords(records, invalidCallSeqs, foldOptions)
   let boundaryIndex = 0
   const carrierCallSeqForBoundary = boundary => boundary.carrierCallSeq
@@ -2415,6 +2577,9 @@ export function recoverJournal(session, currentCallSeq, options = {}) {
           code: postEdit.derived.code,
           result: { eventSeq: result.eventSeq, journal: postEdit.derived.journal,
             derived: postEdit.derived, userBindings: postEdit.derived.userBindings },
+          // The revision names the cell it edits. Whether that relation replaces
+          // the target or appends to it is the fold's decision, not the log's.
+          supersedes: postEdit.targetCallSeq,
           hidden: visibleCalls instanceof Set && (!visibleCalls.has(call.seq)
             || !visibleCalls.has(postEdit.targetCallSeq)),
         })
@@ -2482,6 +2647,19 @@ export function recoverJournal(session, currentCallSeq, options = {}) {
     enumerable: false,
     configurable: true,
   })
+  // The supersession relation is recovery evidence of the same kind: which cell
+  // each revision replaced, and which proved names the path no longer supplies
+  // because of it. Both stay off the enumerable shape for the same reason.
+  Object.defineProperty(history, 'supersessions', {
+    value: [...state.supersessions],
+    enumerable: false,
+    configurable: true,
+  })
+  Object.defineProperty(history, 'supersededBindings', {
+    value: [...state.supersededBindings],
+    enumerable: false,
+    configurable: true,
+  })
   return history
 }
 

package/internal/session-journal-schema.js

@@ -12,6 +12,7 @@ export const POST_EDIT_KEY = 'dshPtcPlusPostEdit'
 export const REWRITES_KEY = 'dshPtcPlusRewrites'
 export const RECOVERY_BOUNDARY_KEY = 'dshPtcPlusRecoveryBoundaries'
 export const DIAGNOSTIC_WORDING_KEY = 'dshPtcPlusDiagnosticWording'
+export const SETTLEMENT_PROOF_KEY = 'dshPtcPlusSettlementProof'
 export const IMPORT_BOUNDARY_JOURNAL_VERSION = 7
 export const PER_NAME_USER_BINDINGS_JOURNAL_VERSION = 8
 export const LANGUAGE_SEMANTICS_JOURNAL_VERSION = 9
@@ -62,6 +63,8 @@ export const ERROR_FIELDS = new Set(['kind', 'message'])
 export const EDIT_TARGET_FIELDS = new Set(['targetCallSeq'])
 export const DERIVED_RUN_FIELDS = new Set(['code', 'codeDigest', 'codeBytes', 'description'])
 export const DIAGNOSTIC_WORDING_FIELDS = new Set(['digest'])
+export const SETTLEMENT_PROOF_VERSION = 1
+export const SETTLEMENT_PROOF_FIELDS = new Set(['version', 'recordedMessage'])
 
 export const JOURNAL_VERSIONS = new Set([LEGACY_JOURNAL_VERSION, INTERMEDIATE_JOURNAL_VERSION, PREVIOUS_JOURNAL_VERSION, USER_BINDING_RELATIONLESS_JOURNAL_VERSION, FINGERPRINT_REUSE_JOURNAL_VERSION, VERSIONED_BINDING_REUSE_JOURNAL_VERSION, IMPORT_BOUNDARY_JOURNAL_VERSION, PER_NAME_USER_BINDINGS_JOURNAL_VERSION, LANGUAGE_SEMANTICS_JOURNAL_VERSION, MODULE_TRANSFORM_JOURNAL_VERSION, JOURNAL_VERSION])
 export const USER_BINDINGS_REUSE_POLICIES = new Set([LEGACY_USER_BINDINGS_REUSE_POLICY, LIVE_USER_BINDINGS_REUSE_POLICY])