dsh-ptc-plus 0.5.2 → 0.5.4

package/internal/session-journal.js

@@ -64,6 +64,9 @@ import {
   USER_BINDINGS_REUSE_POLICIES,
   RECOVERY_BOUNDARY_FIELDS,
   DIAGNOSTIC_WORDING_KEY,
+  SETTLEMENT_PROOF_KEY,
+  SETTLEMENT_PROOF_FIELDS,
+  SETTLEMENT_PROOF_VERSION,
   REPL_TOOL_NAMES,
   REWRITE_FIELDS,
   REWRITE_KINDS,
@@ -78,6 +81,9 @@ export {
   RECOVERY_BOUNDARY_KEY,
   DIAGNOSTIC_WORDING_KEY,
   DIAGNOSTIC_WORDING_FIELDS,
+  SETTLEMENT_PROOF_KEY,
+  SETTLEMENT_PROOF_FIELDS,
+  SETTLEMENT_PROOF_VERSION,
   JOURNAL_VERSION,
   LIVE_USER_BINDINGS_REUSE_POLICY,
   RECOVERY_BOUNDARY_EVENT,
@@ -129,15 +135,46 @@ export function diagnosticWordingDigest(journal) {
   return digestOf(diagnostics.map(diagnosticWordingFacts))
 }
 
-/** Attach the recorded wording digest beside a journal, or drop a stale one. */
-export function withDiagnosticWording(meta, journal) {
-  const digest = diagnosticWordingDigest(journal)
-  if (digest === undefined) {
-    if (!Object.hasOwn(meta, DIAGNOSTIC_WORDING_KEY)) return meta
-    const { [DIAGNOSTIC_WORDING_KEY]: _omitted, ...rest } = meta
-    return rest
+/**
+ * Digest of the one settlement a journal states: the status of its cell, its
+ * completion, and the wording of its diagnostics.
+ *
+ * A published record is the only account of its own cell, so a record edited
+ * afterwards stays self-consistent: the completion is checkable against a
+ * diagnostic, and the diagnostic against the wording digest, but all three are
+ * the same settlement. The proof is taken at publication, from the facts the
+ * settlement was published with, and every fact is represented here exactly once,
+ * so a record whose status, completion or diagnostic wording changed no longer
+ * reproduces it.
+ */
+export function settlementProofDigest(journal) {
+  const completion = journal?.completion
+  const completionFacts = completion === undefined ? null
+    : completion.kind === 'return'
+      ? [completion.kind, completion.hasValue,
+        completion.hasValue ? digestOf(completion.value) : null]
+      : [completion.kind, completion.error.kind, completion.error.message]
+  return digestOf([
+    journal?.status ?? null,
+    completionFacts,
+    diagnosticWordingDigest(journal) ?? null,
+  ])
+}
+
+/**
+ * Attach the published settlement's proof beside a journal.
+ *
+ * Every settlement states a status, so every publication carries one; a record
+ * that carries none predates this proof and keeps the older evidence.
+ */
+export function withSettlementProof(meta, journal) {
+  return {
+    ...meta,
+    [SETTLEMENT_PROOF_KEY]: {
+      version: SETTLEMENT_PROOF_VERSION,
+      recordedMessage: settlementProofDigest(journal),
+    },
   }
-  return { ...meta, [DIAGNOSTIC_WORDING_KEY]: { digest } }
 }
 
 function cloneJson(value) {
@@ -1272,7 +1309,7 @@ export function withJournal(meta, journal) {
   const base = isRecord(meta) ? { ...meta } : meta === undefined ? {} : { value: cloneJson(meta) }
   const normalized = normalizeJournal(journal)
   base[JOURNAL_KEY] = normalized
-  return withDiagnosticWording(base, normalized)
+  return withSettlementProof(base, normalized)
 }
 
 /** Validate and detach one rewrite record emitted by the runtime. */

package/internal/session-log-view.js

@@ -9,9 +9,38 @@ import { deepEqualJson, isJsonValue } from '@deepseek-ai/dsh-util-values'
 import { deepFreeze, isRecord } from './record-utils.js'
 import { advanceRuntimeHistory, createRuntimeHistory } from './recovery-tips.js'
 
-import { isHostRuntimeContextSource } from './message-sources.js'
+import { isHostRuntimeContextSource, isPtcMessageSource } from './message-sources.js'
+import { BINDING_ADOPTION_FORM, readBindingAdoption } from './binding-adoption.js'
 const SYSTEM_PROMPT_CLEARED = 'Current runtime context: none. Earlier runtime-context snapshots no longer apply.'
 
+/**
+ * A PTC binding-adoption statement, readable or not.
+ *
+ * The fold has to recognize the statement even when this build cannot resolve its
+ * wording: the fact it keeps is what a restored checkpoint replays, so a fact that
+ * dropped the form could not reproduce the record the fold appended.
+ */
+function isBindingAdoptionStatement(message) {
+  const source = message?.source
+  return isPtcMessageSource(source) && source.form === BINDING_ADOPTION_FORM
+}
+
+/**
+ * An adoption statement this build cannot resolve, kept as the statement it is.
+ *
+ * Both the panel and the `/binding` command answer from this projection, and the
+ * answer has to be this session's *newest* statement. A projection that dropped a
+ * statement it could not resolve would let the record the session superseded answer
+ * instead, so the statement is retained with no declined list — the absence is what
+ * marks it unreadable. It never reaches the model-visible surface, which is built
+ * from resolvable runtime messages only.
+ */
+function unreadableBindingAdoption(message) {
+  if (!isBindingAdoptionStatement(message)) return undefined
+  if (readBindingAdoption(message) !== undefined) return undefined
+  return Object.freeze({ form: BINDING_ADOPTION_FORM })
+}
+
 /** DSH's empty aggregate uses an exact owner marker without a snapshot form. */
 export function systemPromptSnapshotSections(message) {
   const source = message?.source
@@ -72,7 +101,8 @@ export function runtimeMessageFacts(records, initial = {}) {
 
 function presentationEvent(event) {
   const recognized = event?.type === 'user/message'
-    && (systemPromptSnapshotSections(event.data) !== undefined || readRuntimeMessage(event.data) !== undefined)
+    && (systemPromptSnapshotSections(event.data) !== undefined || readRuntimeMessage(event.data) !== undefined
+      || isBindingAdoptionStatement(event.data))
   const data = recognized ? { source: event.data.source, content: event.data.content }
     : event?.type === 'user/message' && typeof event.data?.source?.kind === 'string'
       ? { source: { kind: event.data.source.kind } } : undefined
@@ -86,11 +116,14 @@ function applyLogEvent(state, event, index = event?.seq,
   timeline = advanceSessionTimeline(state.timeline, event, index)) {
   const sections = event?.type === 'user/message' ? systemPromptSnapshotSections(event.data) : undefined
   const ptc = event?.type === 'user/message' ? readRuntimeMessage(event.data) : undefined
+  // An adoption statement this build cannot resolve is still this session's statement,
+  // so it stays in the projection as the newest one rather than disappearing.
+  const unresolvedAdoption = ptc === undefined ? unreadableBindingAdoption(event?.data) : undefined
   const contextStep = state.contextStep + (isContextStep(event) ? 1 : 0)
   const surfaceNodes = advanceSessionSurface(state.surfaceNodes, event)
   let visibleRuntimeMessages = state.visibleRuntimeMessages
-  if (timeline === state.timeline && sections === undefined && ptc === undefined && contextStep === state.contextStep
-    && surfaceNodes === state.surfaceNodes) return state
+  if (timeline === state.timeline && sections === undefined && ptc === undefined && unresolvedAdoption === undefined
+    && contextStep === state.contextStep && surfaceNodes === state.surfaceNodes) return state
   const next = { ...state, timeline, contextStep,
     logFacts: [...state.logFacts, deepFreeze({ index, event: presentationEvent(event) })],
   }
@@ -110,6 +143,11 @@ function applyLogEvent(state, event, index = event?.seq,
     const record = Object.freeze({ ...ptc, index, contextStep: state.contextStep, producer: 'ptc-plus' })
     next.ptcMessages = [...state.ptcMessages, record]
     next.runtimeMessagesBySeq = { ...next.runtimeMessagesBySeq, [`k${event.seq}`]: record }
+  } else if (unresolvedAdoption !== undefined) {
+    // Listed as this session's newest statement, but not as a resolvable runtime
+    // message: the ordered surface below is built from `runtimeMessagesBySeq`.
+    next.ptcMessages = [...state.ptcMessages,
+      Object.freeze({ ...unresolvedAdoption, index, contextStep: state.contextStep, producer: 'ptc-plus' })]
   }
   if (event?.surfaceOp === 'append') {
     const record = next.runtimeMessagesBySeq[`k${event.seq}`]
@@ -133,7 +171,11 @@ export function createSessionLogProjection(options = {}) {
   const replayBudget = admissionReplayBudget(options.replayBudgetBytes)
   return Object.freeze({
     key: SESSION_LOG_PROJECTION_KEY,
-    stateVersion: 13,
+    // 14 records the binding-adoption statement this build cannot resolve: the fact it
+    // keeps now carries the form its own replay needs, and `ptcMessages` gained a record
+    // for it. A checkpoint written by an earlier fold answers a different question, so
+    // the version moves and stored checkpoints are refolded rather than admitted.
+    stateVersion: 14,
     stateSchema: Object.freeze({ parse(value) {
       if (!isJsonValue(value) || !isRecord(value) || !isRecord(value.timeline)
         || typeof value.timeline.openTurn !== 'boolean' || typeof value.timeline.found !== 'boolean'
@@ -249,6 +291,24 @@ export function createSessionLogProjection(options = {}) {
   })
 }
 
+/**
+ * The disposer a session projection registration handed back.
+ *
+ * Two registration contracts are published: an earlier host returns a disposer and a
+ * newer one returns a `ProjectionHandle` (`stateOf`/`readerFor`/`dispose`, possibly
+ * async). Every projection this plugin registers goes through this reader, because a
+ * registration that only understands the earlier shape drops the projection — and
+ * with it the fact that the host accepted it — on the newer contract.
+ * @param {unknown} registration - what `sessionProjections.register` returned.
+ * @returns {(() => unknown)|undefined} the release call, or undefined when the answer
+ *   names neither contract.
+ */
+export function projectionRegistrationDisposer(registration) {
+  if (typeof registration === 'function') return () => registration()
+  if (typeof registration?.dispose === 'function') return () => registration.dispose()
+  return undefined
+}
+
 export function createSessionLogOwner(ctx) {
   const projection = createSessionLogProjection()
   let registeredService
@@ -256,8 +316,10 @@ export function createSessionLogOwner(ctx) {
     try {
       scope.effect(() => {
         const registry = scope.sessionProjections
-        const unregister = registry.register(projection)
-        if (typeof unregister !== 'function') throw new Error('ptc-plus: sessionProjections.register did not return a disposer')
+        const unregister = projectionRegistrationDisposer(registry.register(projection))
+        if (unregister === undefined) {
+          throw new Error('ptc-plus: sessionProjections.register returned neither a disposer nor a handle')
+        }
         registeredService = registry
         return async () => {
           await unregister()

package/internal/session-runtime.js

@@ -180,6 +180,34 @@ export function vanishedBindingDiagnostic(names) {
   })
 }
 
+/**
+ * Notice for bindings a recorded revision superseded.
+ *
+ * A revision that rewrites its target puts the target off the recorded path, so
+ * the target's declarations stop building the environment. They are not missing:
+ * the log says which revision replaced them, and reporting that relation keeps
+ * the model from reading a later `x is not defined` as its own mistake.
+ */
+export function supersededDiagnostic(bindings, supersessions = []) {
+  const names = bindings.length === 0 ? '' : ` (${bindings.join(', ')})`
+  const relations = supersessions.map(item =>
+    `cell ${item.supersededCallSeq} by cell ${item.supersedingCallSeq}`).join('; ')
+  return diagnostic({
+    code: 'PTC-R007',
+    severity: 'warning',
+    phase: 'recover',
+    message: (bindings.length === 0
+      ? 'A recorded revision replaced the cell it edited'
+      : `Superseded ${bindings.length} binding(s)${names} because a recorded revision replaced the cell that declared them`)
+      + `${relations === '' ? '' : ` (${relations})`}. The replaced cell stays in the session log but no longer builds this environment.`,
+    stateEffect: 'rolled-back',
+    help: [
+      'this is not a recovery failure: an accepted edit rewrote the cell that declared these bindings, and the revision does not declare them',
+      'redeclare a superseded name in a new cell before using it again',
+    ],
+  })
+}
+
 function unverifiedCompletionDiagnostic(count) {
   return diagnostic({
     code: 'PTC-R003',
@@ -329,19 +357,21 @@ class SessionKernel {
     this.liveCallSeqs = new Set()
     this.unverifiedCompletions = []
     this.restoredFromRecord = []
-    this.recoveryNotice = disposedCells > 0
+    this.recoveryNotices = disposedCells > 0
       // A kernel whose owning agent or session was disposed must not resurrect
       // the disposed environment: the history is gone by contract, and a later
       // cell starts from an empty REPL with the loss reported once.
-      ? recoveryDiagnostic([], disposedCells)
+      ? [recoveryDiagnostic([], disposedCells)]
       : history.volatileSuffix.length === 0
-        ? undefined
-        : recoveryDiagnostic(droppedBindingNames(history), history.volatileSuffix.length)
-    this.recoveryNoticeShown = false
+        ? []
+        : [recoveryDiagnostic(droppedBindingNames(history), history.volatileSuffix.length)]
     // Bindings a recovery told the model were live, and the last help pair that
     // explained a recovery. Both exist to keep one event from being reported
     // twice and to notice a binding that stops existing afterwards.
     this.announcedLive = new Set()
+    // A recorded supersession is a durable fact; announcing it once per runtime
+    // keeps later folds from repeating a relation the model already read.
+    this.announcedSupersessions = new Set()
     this.recoveryHelpSignature = undefined
     this.recoveryEventCount = 0
     this.active = undefined
@@ -558,27 +588,29 @@ class SessionKernel {
         if (worker !== undefined) await this.resetWorker(worker)
         this.rollbackToDurable()
         if (config.durableReplay) {
-          this.recoveryNotice = undefined
+          this.recoveryNotices = []
           try {
             this.history = recoverJournal(observedSession, request.callSeq, {
               visibleCallSeqs,
+              editRewritesHistory: config.editRewritesHistory === true,
             })
           } catch (error) {
-            /* c8 ignore start -- a fold that throws is not reachable from any supported session; cover or prove it in 0.5.3 */
+            /* c8 ignore start -- the fold reports damaged history as data, so no supported session reaches this catch */
             const boundary = recoveryBoundaryForHistory(this.history, undefined, { reset: true })
             if (boundary !== undefined) recoveryBoundaries.push(boundary)
             this.history = emptyHistory()
-            this.recoveryNotice = recoveryDiagnostic([], 1)
+            this.recoveryNotices = [recoveryDiagnostic([], 1)]
             this.initialRecoveryBoundary = undefined
             /* c8 ignore stop */
           }
-          /* c8 ignore start -- volatile suffix on the first fold; cover in 0.5.3 */
+          /* c8 ignore start -- volatile suffix on the first fold; no case settles a volatile suffix before the first replay */
           if (this.history.volatileSuffix.length > 0) {
-            this.recoveryNotice = recoveryDiagnostic(droppedBindingNames(this.history), this.history.volatileSuffix.length)
+            this.recoveryNotices = [recoveryDiagnostic(
+              droppedBindingNames(this.history), this.history.volatileSuffix.length)]
           }
           /* c8 ignore stop */
           this.initialRecoveryBoundary = recoveryBoundaryForHistory(this.history)
-          /* c8 ignore start -- first-fold recovery boundary; cover in 0.5.3 */
+          /* c8 ignore start -- first-fold recovery boundary; no case makes the first replay record one */
           if (this.initialRecoveryBoundary !== undefined) {
             recoveryBoundaries.push(this.initialRecoveryBoundary)
             this.initialRecoveryBoundary = undefined
@@ -587,7 +619,7 @@ class SessionKernel {
         } else {
           this.history = emptyHistory()
           this.replayed = true
-          this.recoveryNotice = recoveryDiagnostic([], 1)
+          this.recoveryNotices = [recoveryDiagnostic([], 1)]
         }
       }
     }
@@ -680,6 +712,7 @@ class SessionKernel {
             const recovered = recoverJournal(observedSession, request.callSeq, {
               extraBoundaries: [boundary],
               visibleCallSeqs: visibleExecutableCallSeqs(observedSession),
+              editRewritesHistory: config.editRewritesHistory === true,
             })
             const nextPathLength = pathToHead(recovered).length
             if (nextPathLength >= previousPathLength) throw new Error('recovery did not contract the historical frontier')
@@ -698,10 +731,12 @@ class SessionKernel {
           this.durability = durabilityState()
         }
       }
-      // One recovery event produces one notice. The four facts below describe the
-      // same event, so they are composed once instead of overwriting each other:
-      // an earlier overwrite dropped the restored-name list whenever a later fact
-      // arrived, and a repeat entry re-emitted the same sentence.
+      // One recovery event produces one report. The facts below describe the same
+      // event, so each one that holds is collected instead of overwriting the ones
+      // already found: an earlier overwrite dropped the restored-name list whenever
+      // a later fact arrived, and a relation dropped that way was then cleared
+      // without ever reaching the model. The facts never name the same binding, so
+      // collecting them states the event once per fact rather than twice per name.
       const restoredCount = this.restoredFromRecord.length
       const allLive = [...new Set(this.restoredFromRecord.flatMap(item => item.bindings))]
       // Report only what this recovery added. A later recovery that installs
@@ -716,6 +751,8 @@ const failedNames = [...new Set(this.restoredFromRecord
   .filter(name => typeof name === 'string'))]
       const droppedNames = this.missingBindings === undefined ? [] : [...new Set(this.missingBindings)]
       const endedNames = this.rewindEndedBindings === undefined ? [] : [...new Set(this.rewindEndedBindings)]
+      const supersededNames = this.supersededEndedBindings === undefined
+        ? [] : [...new Set(this.supersededEndedBindings)]
       const alreadyReported = this.recoveryEventCount > 0
       // A complete restore is invisible to the model. Every recorded binding was
       // installed, nothing was dropped or ended, and the next cell behaves exactly
@@ -726,58 +763,78 @@ const failedNames = [...new Set(this.restoredFromRecord
       const completeRestore = failedNames.length === 0
         && droppedNames.length === 0
         && endedNames.length === 0
+        && supersededNames.length === 0
       if (restoredCount > 0 && completeRestore) {
         this.restoredFromRecord = []
-      /* c8 ignore start -- needs a rewind that ended an announced name; cover in 0.5.3 */
+      /* c8 ignore start -- needs a rewind that ended an announced name after a reported recovery; no case does */
       } else if (restoredCount > 0 && liveNames.length === 0 && failedNames.length === 0 && alreadyReported) {
         this.restoredFromRecord = []
       /* c8 ignore stop */
       } else if (restoredCount > 0) {
         this.recoveryEventCount += 1
-        this.recoveryNotice = restoredFromRecordDiagnostic(
+        this.recoveryNotices.push(restoredFromRecordDiagnostic(
           restoredCount,
           liveNames,
           failedNames,
           alreadyReported,
-        )
+        ))
       }
-      /* c8 ignore start -- needs a proven name the replay never visits; cover in 0.5.3 */
+      /* c8 ignore start -- needs a proven name the replay never visits; no case records one */
       if (droppedNames.length > 0) {
-        this.recoveryNotice = recoveryDiagnostic(droppedNames, droppedNames.length)
+        this.recoveryNotices.push(recoveryDiagnostic(droppedNames, droppedNames.length))
       /* c8 ignore stop */
       } else if (restoredCount === 0 && skipped > 0) {
-        this.recoveryNotice = recoveryDiagnostic([], skipped)
+        this.recoveryNotices.push(recoveryDiagnostic([], skipped))
       }
       // A rewind that ended a binding is recorded, not a loss: report it only when
       // the replay installed nothing under that name anywhere (path, off-path or
-      // catalog), so a correct value never carries a "dropped" notice.
-      if (this.recoveryNotice === undefined && endedNames.length > 0) {
-        this.recoveryNotice = rewindEndedDiagnostic(endedNames)
+      // catalog), so a correct value never carries a "dropped" notice. A revision
+      // that superseded a cell is the other recorded ending: the environment it
+      // built differs from the cells the log still lists, so the relation is
+      // reported once per runtime instead of on every later fold.
+      const freshSupersessions = (this.supersessions ?? [])
+        .filter(item => !this.announcedSupersessions.has(item.supersedingCallSeq))
+      // A restored cell and a superseded one are two facts about the same recovery,
+      // not alternatives: the names this relation withdrew are excluded from the
+      // missing and rewind lists, so a report that chose the restore notice over it
+      // left a withdrawn name reported nowhere.
+      if (freshSupersessions.length > 0 || supersededNames.length > 0) {
+        this.recoveryNotices.push(supersededDiagnostic(supersededNames, freshSupersessions))
+        for (const item of freshSupersessions) this.announcedSupersessions.add(item.supersedingCallSeq)
       }
-      if (this.recoveryNotice === undefined && this.unverifiedCompletions.length > 0) {
-        this.recoveryNotice = unverifiedCompletionDiagnostic(this.unverifiedCompletions.length)
+      if (endedNames.length > 0) {
+        this.recoveryNotices.push(rewindEndedDiagnostic(endedNames))
       }
       // A completion the replay could not certify is not a lost binding: the
       // replay established them, and only the recorded payload stays unproved.
-      if (this.recoveryNotice !== undefined) {
+      if (this.unverifiedCompletions.length > 0) {
+        this.recoveryNotices.push(unverifiedCompletionDiagnostic(this.unverifiedCompletions.length))
+      }
+      if (this.recoveryNotices.length > 0) {
         // Remember what was promised as live, so a binding that disappears later
         // is reported by name instead of surfacing as an unexplained ReferenceError.
         for (const name of liveNames) this.announcedLive.add(name)
         // The help pair explains the recovery once. Repeating it on every later
         // recovery in the same session is noise the model cannot act on twice.
-        const signature = this.recoveryNotice.message
-        if (this.recoveryHelpSignature === signature) this.recoveryNotice = { ...this.recoveryNotice, help: [] }
-        else this.recoveryHelpSignature = signature
+        const signature = this.recoveryNotices.map(item => item.message).join('\n')
+        if (this.recoveryHelpSignature === signature) {
+          this.recoveryNotices = this.recoveryNotices.map(item => ({ ...item, help: [] }))
+        } else {
+          this.recoveryHelpSignature = signature
+        }
       }
       this.restoredFromRecord = []
       this.missingBindings = undefined
       this.rewindEndedBindings = undefined
+      this.supersededEndedBindings = undefined
+      this.supersessions = undefined
     }
-    const leadingDiagnostics = [
-      ...(this.recoveryNotice === undefined || this.recoveryNoticeShown ? [] : [this.recoveryNotice]),
-    ]
-    this.recoveryNoticeShown = this.recoveryNotice !== undefined
-    this.recoveryNotice = undefined
+    // Every recovery reports the facts it established. Suppressing a later recovery's
+    // notice hid a relation the runtime had already marked as announced, so a name the
+    // revision withdrew was reported nowhere; what is deduplicated is the explanation
+    // (below) and each name or relation this runtime already stated.
+    const leadingDiagnostics = this.recoveryNotices
+    this.recoveryNotices = []
     if (request.journal !== undefined) request.journal.diagnostics.push(...leadingDiagnostics)
     let result
     try {
@@ -938,9 +995,17 @@ const failedNames = [...new Set(this.restoredFromRecord
     // correct.
     const installed = new Set(replayedNames)
     for (const name of this.bindingCatalog.inputs().knownBindings) installed.add(name)
-    this.rewindEndedBindings = [...endedBindings].filter(name => !installed.has(name))
+    // A superseded name is ended by the record that replaced its cell, so it is
+    // reported apart from a rewind and never as a binding recovery failed to
+    // install: the log says which revision replaced it.
+    const supersededEnded = new Set((this.history.supersededBindings ?? [])
+      .filter(name => !installed.has(name)))
+    this.rewindEndedBindings = [...endedBindings]
+      .filter(name => !installed.has(name) && !supersededEnded.has(name))
+    this.supersededEndedBindings = [...supersededEnded]
+    this.supersessions = this.history.supersessions ?? []
     this.missingBindings = (this.history.provenBindings ?? [])
-      .filter(name => !installed.has(name) && !endedBindings.has(name))
+      .filter(name => !installed.has(name) && !endedBindings.has(name) && !supersededEnded.has(name))
   }
 
   completeJournal(journal, status, result, volatileReason, diagnostics = [], completion = undefined, values = undefined) {
@@ -1372,7 +1437,8 @@ export class SessionRuntime {
         kernel.surfaceGeneration = surfaceGeneration(session)
       } else {
         const timeline = foldSessionTimeline(observed.events)
-        const history = recoverJournal(observed, undefined, { visibleCallSeqs: visible })
+        const history = recoverJournal(observed, undefined, { visibleCallSeqs: visible,
+          editRewritesHistory: this.config.editRewritesHistory === true })
         const head = history.nodes[history.head]
         if (head === undefined) return unavailableReplMemorySnapshot()
         // A cold inventory can describe a proved recorded frontier without
@@ -1468,6 +1534,7 @@ export class SessionRuntime {
           ? emptyHistory()
           : recoverJournal(sessionLog, callSeq, {
             visibleCallSeqs: visibleExecutableCallSeqs(sessionLog),
+            editRewritesHistory: cellConfig.editRewritesHistory === true,
             ...(liveOnlyLost ? { liveOnlyLost: true } : {}),
           })
       } catch (error) {

package/internal/settings-compat.js

@@ -74,6 +74,12 @@ export function installSettingsSectionCompat({
       && typeof writeNamespace === 'string' && writeNamespace.length > 0
       ? Object.freeze({
         update: (patch, expectedRevision) => provider.update(writeNamespace, patch, expectedRevision),
+        // The service applies field edits as `{ op: 'set' | 'unset', path }`; `update` can only
+        // restate values, so expose the primitive when it exists instead of narrowing the callers
+        // to a writer that cannot remove a field.
+        ...(typeof provider.mutate === 'function'
+          ? { mutate: (ops, expectedRevision) => provider.mutate(writeNamespace, ops, expectedRevision) }
+          : {}),
         read: () => provider.describe?.().find(descriptor => descriptor.ns === writeNamespace),
       }) : undefined
     const unbind = onProvider(provider, writer)