dsh-ptc-plus 0.5.6 → 0.5.7

package/internal/cordis-tools-owner.js

@@ -8,7 +8,7 @@ import { RUN_CODE } from './runtime-bridge-owner.js'
 import { sessionExecutionAvailable } from './host-tool-sdk.js'
 
 const CORDIS_PRESET_ID = 'cordis'
-const CORDIS_SKILL_NAME = 'cordis-plugin-development'
+const COMPANION_SKILL_NAMES = Object.freeze(['dsh-doc', 'cordis-plugin-development'])
 const CORDIS_SKILL_PROVIDER = 'ptc-plus-cordis'
 const COMPANION_SKILL_TOOL = 'skill'
 const COMPANION_PACKAGE_LAYOUTS = Object.freeze([
@@ -22,19 +22,19 @@ const COMPANION_PACKAGE_LAYOUTS = Object.freeze([
   }),
 ])
 
-function exactCompanionCandidates(observation) {
+function exactCompanionCandidates(observation, skillName) {
   if (Array.isArray(observation)) {
-    return observation.filter(candidate => candidate?.name === CORDIS_SKILL_NAME)
+    return observation.filter(candidate => candidate?.name === skillName)
   }
   if (observation === null || typeof observation !== 'object'
     || !Array.isArray(observation.candidates)) return observation
   return {
     ...observation,
-    candidates: observation.candidates.filter(candidate => candidate?.name === CORDIS_SKILL_NAME),
+    candidates: observation.candidates.filter(candidate => candidate?.name === skillName),
   }
 }
 
-function exactCompanionProvider(provider) {
+function exactCompanionProvider(provider, skillName) {
   if (provider === null || typeof provider !== 'object'
     || typeof provider.name !== 'string'
     || typeof provider.list !== 'function'
@@ -44,17 +44,17 @@ function exactCompanionProvider(provider) {
   return {
     ...provider,
     async list(options) {
-      return exactCompanionCandidates(await Reflect.apply(provider.list, provider, [options]))
+      return exactCompanionCandidates(await Reflect.apply(provider.list, provider, [options]), skillName)
     },
     async get(candidate, options) {
-      if (candidate?.name !== CORDIS_SKILL_NAME) return undefined
+      if (candidate?.name !== skillName) return undefined
       const skill = await Reflect.apply(provider.get, provider, [candidate, options])
-      return skill?.name === CORDIS_SKILL_NAME ? skill : undefined
+      return skill?.name === skillName ? skill : undefined
     },
   }
 }
 
-function exactCompanionSkillPlugin(skillFilesystemPlugin) {
+function exactCompanionSkillPlugin(skillFilesystemPlugin, skillName) {
   return {
     ...skillFilesystemPlugin,
     apply(pluginCtx, config) {
@@ -68,7 +68,7 @@ function exactCompanionSkillPlugin(skillFilesystemPlugin) {
       const facade = new Proxy(skills, {
         get(target, property) {
           if (property === 'registerProvider') {
-            return create => target.registerProvider(control => exactCompanionProvider(create(control)))
+            return create => target.registerProvider(control => exactCompanionProvider(create(control), skillName))
           }
           const value = Reflect.get(target, property, target)
           return typeof value === 'function' ? value.bind(target) : value
@@ -144,12 +144,13 @@ function requireCompanionServices(agent) {
   return { agentPresets, skills }
 }
 
-function containsCompanionSkill(directory, fileExists) {
-  return fileExists(join(directory, CORDIS_SKILL_NAME, 'SKILL.md'))
+function companionSkill(directory, fileExists) {
+  const skillName = COMPANION_SKILL_NAMES.find(name => fileExists(join(directory, name, 'SKILL.md')))
+  return skillName === undefined ? undefined : { skillRoot: directory, skillName }
 }
 
 /** Resolve the official Cordis companion Skill across DSH preset generations. */
-export async function resolveCompanionSkillDirectory(agentPresets, options = {}) {
+export async function resolveCompanionSkillResource(agentPresets, options = {}) {
   const preset = await agentPresets.resolve(CORDIS_PRESET_ID)
   const resolution = typeof options === 'function' ? options() : options
   const fileExists = resolution.fileExists ?? existsSync
@@ -161,10 +162,11 @@ export async function resolveCompanionSkillDirectory(agentPresets, options = {})
       throw new Error('ptc-plus: DSH cordis preset did not expose an absolute composition path')
     }
     const directory = join(dirname(preset.path), 'skills')
-    if (!containsCompanionSkill(directory, fileExists)) {
-      throw new Error(`ptc-plus: DSH cordis preset does not contain ${CORDIS_SKILL_NAME}/SKILL.md beside its composition`)
+    const resource = companionSkill(directory, fileExists)
+    if (resource === undefined) {
+      throw new Error(`ptc-plus: DSH cordis preset does not contain a supported companion SKILL.md beside its composition`)
     }
-    return directory
+    return resource
   }
 
   for (const layout of COMPANION_PACKAGE_LAYOUTS) {
@@ -174,7 +176,8 @@ export async function resolveCompanionSkillDirectory(agentPresets, options = {})
       throw new Error(`ptc-plus: DSH pluginPackages returned an invalid ${layout.name} package resource`)
     }
     const directory = layout.skillRoot(pkg.dir)
-    if (containsCompanionSkill(directory, fileExists)) return directory
+    const resource = companionSkill(directory, fileExists)
+    if (resource !== undefined) return resource
   }
 
   if (resolution.packageOf === undefined && resolution.resolveLegacyPackageManifest !== undefined) {
@@ -186,29 +189,30 @@ export async function resolveCompanionSkillDirectory(agentPresets, options = {})
     }
     if (manifest !== undefined) {
       const directory = join(dirname(manifest), 'presets', CORDIS_PRESET_ID, 'skills')
-      if (containsCompanionSkill(directory, fileExists)) return directory
+      const resource = companionSkill(directory, fileExists)
+      if (resource !== undefined) return resource
     }
   }
-  throw new Error(`ptc-plus: the active DSH installation does not publish a loadable ${CORDIS_SKILL_NAME} companion Skill through its package-resolution surface`)
+  throw new Error(`ptc-plus: the active DSH installation does not publish a loadable official companion Skill through its package-resolution surface`)
 }
 
-async function requireCompanionSkill(agent, skills) {
+async function requireCompanionSkill(agent, skills, skillName) {
   const lookup = {
     cwd: agent.session?.header?.cwd,
     scope: agent,
   }
   const owned = (await skills.list(lookup)).filter(skill => skill?.provider === CORDIS_SKILL_PROVIDER)
   const summary = owned[0]
-  if (owned.length !== 1 || summary?.name !== CORDIS_SKILL_NAME
+  if (owned.length !== 1 || summary?.name !== skillName
     || summary.invocation?.modelInvocable !== true) {
-    throw new Error(`ptc-plus: official Cordis Skill provider must publish exactly ${JSON.stringify(CORDIS_SKILL_NAME)} as model-invocable`)
+    throw new Error(`ptc-plus: official Cordis Skill provider must publish exactly ${JSON.stringify(skillName)} as model-invocable`)
   }
-  const skill = await skills.get(CORDIS_SKILL_NAME, lookup)
+  const skill = await skills.get(skillName, lookup)
   if (skill?.provider !== CORDIS_SKILL_PROVIDER
     || skill.invocation?.modelInvocable !== true
     || typeof skill.content !== 'string'
     || skill.content.length === 0) {
-    throw new Error(`ptc-plus: official Cordis companion Skill ${JSON.stringify(CORDIS_SKILL_NAME)} is not loadable`)
+    throw new Error(`ptc-plus: official Cordis companion Skill ${JSON.stringify(skillName)} is not loadable`)
   }
 }
 
@@ -321,7 +325,6 @@ export function createCordisToolsOwner(
   const withdrawn = new Map()
   const cordisInspectLeases = createCordisInspectLeases(ctx)
   const scopedCordisPlugin = cordisInspectLeases.plugin(cordisPlugin)
-  const scopedSkillPlugin = exactCompanionSkillPlugin(skillFilesystemPlugin)
   const packageBaseUrl = ctx.baseUrl
   const skillResolution = companionResolution ?? (() => {
     const pluginPackages = ctx.get?.('pluginPackages')
@@ -423,13 +426,14 @@ export function createCordisToolsOwner(
     mounts.set(agent, mount)
     mount.activation = Promise.resolve().then(async () => {
       const { agentPresets, skills } = requireCompanionServices(agent)
-      const skillDirectory = await resolveCompanionSkillDirectory(agentPresets, skillResolution)
+      const { skillRoot, skillName } = await resolveCompanionSkillResource(agentPresets, skillResolution)
+      const scopedSkillPlugin = exactCompanionSkillPlugin(skillFilesystemPlugin, skillName)
       if (mount.disposed) return
 
       const skillFiber = agent.ctx.plugin(scopedSkillPlugin, {
         providerName: CORDIS_SKILL_PROVIDER,
         includeDefaultRoots: false,
-        bundledSkillDir: skillDirectory,
+        bundledSkillDir: skillRoot,
         watch: false,
       })
       if (typeof skillFiber?.dispose !== 'function') {
@@ -449,7 +453,7 @@ export function createCordisToolsOwner(
       await Promise.resolve(cordisFiber)
       if (mount.disposed) return
 
-      await requireCompanionSkill(agent, skills)
+      await requireCompanionSkill(agent, skills, skillName)
       if (mount.disposed) return
       mount.activated = true
     }).catch(async error => {

package/internal/execution-seam-compat.js

@@ -94,19 +94,16 @@ export function createExecutionSeam(service, serviceName) {
       requireCompatible()
       return installed === undefined ? upstreamRun.call(service, input) : installed.execute(input)
     },
-    /**
-     * Release one owner's retained environment. The resources live in the
-     * original generation (the session kernel releases its state through its
-     * own lifecycle). Adapter retirement only closes execution; the original
-     * still owns cleanup for references retained by its consumers.
-     */
-    release(owner) {
-      if (typeof service.release !== 'function') return Promise.resolve()
-      try {
-        return Promise.resolve(service.release.call(service, owner))
-      } catch (error) {
-        return Promise.reject(error)
-      }
+    /** Release both the installed environment and any original-provider state. */
+    async release(owner) {
+      const entry = installed
+      const results = await Promise.allSettled([
+        Promise.resolve().then(() => entry?.release?.(owner)),
+        Promise.resolve().then(() => service.release?.call(service, owner)),
+      ])
+      const failures = results.filter(result => result.status === 'rejected').map(result => result.reason)
+      if (failures.length === 1) throw failures[0]
+      if (failures.length > 1) throw new AggregateError(failures, 'ptc-plus: execution environment release failed')
     },
     [PLUGIN_EXECUTION_SEAM]() { return seam },
   })
@@ -143,11 +140,12 @@ export function createExecutionSeam(service, serviceName) {
       requireCompatible()
       return upstreamRun.call(service, spec)
     },
-    installExecute(execute) {
+    installExecute(execute, release) {
       requireAvailable()
       if (typeof execute !== 'function') throw new TypeError('ptc-plus: execution entry must be a function')
       if (installed !== undefined) throw new Error('ptc-plus: execution seam already installed')
-      const entry = { execute, language: service.language }
+      if (release !== undefined && typeof release !== 'function') throw new TypeError('ptc-plus: release entry must be a function')
+      const entry = { execute, release, language: service.language }
       installed = entry
       const restore = () => {
         if (installed !== entry) return

package/internal/runtime-bridge-owner.js

@@ -697,7 +697,13 @@ function applyEditableSlots(definition, promptText, slotPatches) {
       .finally(projected.release)
   }
 
-  const releaseSeam = seam.installExecute(patchedRun)
+  const releaseSeam = seam.installExecute(patchedRun, owner => {
+    if (owner?.session === undefined || sessionId(owner) === undefined) return
+    // Host uses release for explicit reset and for its retained-environment effect.
+    // Cordis clears the public Agent scope uid before invoking disposal effects.
+    if (owner.ctx?.fiber?.uid === null) return sessions.disposeAgent(sessionId(owner))
+    return sessions.resetEnvironment(owner.session)
+  })
 
   /**
    * Whether this execution is the derived execution the edit transport submitted.

package/internal/runtime-messages.js

@@ -1,3 +1,4 @@
+import { ENVIRONMENT_RESET_VERSION } from './session-journal-schema.js'
 import { createUserMessage } from '@deepseek-ai/dsh-llm'
 import {
   CATALOG_PREFIX, EMPTY_CATALOG, LEGACY_STATE_PREFIX, PREVIOUS_EMPTY_CATALOG, PREVIOUS_STATE_PREFIX,
@@ -185,3 +186,10 @@ export function runtimeNoticeMessage(tip) {
   if (readRuntimeMessage(message) === undefined) throw new Error('invalid PTC recovery notice')
   return message
 }
+
+/** A persisted computation boundary; the Host separately owns its reset receipt. */
+export function environmentResetMessage() {
+  return createUserMessage({ source: { kind: PTC_MESSAGE_SOURCE_KIND, form: 'environment-reset', version: ENVIRONMENT_RESET_VERSION },
+    content: [{ type: 'text', text: 'PTC Plus computation reset: earlier session bindings, named checkpoints and edit targets are retired. New computation starts empty with the configured global bindings. Completed external effects remain.' }],
+  })
+}

package/internal/session-journal-recovery.js

@@ -7,6 +7,8 @@ import {
   JOURNAL_KEY,
   RECOVERY_BOUNDARY_KEY,
   RECOVERY_BOUNDARY_EVENT,
+  ENVIRONMENT_RESET_VERSION,
+  isEnvironmentResetEvent,
   DIAGNOSTIC_WORDING_KEY,
   DIAGNOSTIC_WORDING_FIELDS,
   SETTLEMENT_PROOF_KEY,
@@ -40,7 +42,7 @@ import {
 
 const RECOVERY_BOUNDARY_EVIDENCE = Symbol('recoveryBoundaryEvidence')
 const RUN_SELECTION_CLEAR_REASONS = new Set([
-  'turn/start', 'turn/end', 'duplicate-call-sequence', 'invalid-source-relation',
+  'turn/start', 'turn/end', 'environment-reset', 'duplicate-call-sequence', 'invalid-source-relation',
   'ambiguous-call-id', 'ambiguous-call-sequence', 'duplicate-result', 'result-identity-mismatch',
 ])
 const MODEL_VISIBLE_SURFACE_EVENTS = new Set([
@@ -80,8 +82,12 @@ function sourceForRunCall(call, executableCalls) {
 /** Select the boundary of a failed replay node or an unavailable recovered suffix. */
 export function recoveryBoundaryForHistory(history, failedNode, { reset = false } = {}) {
   if (reset) failedNode = history.nodes[0]
+  const unavailable = history.available === false ? history.volatileSuffix[0] : undefined
+  if (failedNode === undefined && unavailable?.kind === 'environment-reset') {
+    return { failedResetSeq: unavailable.seq, frontierCallSeq: null }
+  }
   const failedCallSeq = failedNode === undefined
-    ? history.available === false ? history.volatileSuffix[0]?.seq : undefined
+    ? unavailable?.seq
     : failedNode.callSeq
   if (failedCallSeq === undefined) return undefined
   const frontier = reset ? undefined : failedNode === undefined ? history.head : failedNode.parent
@@ -735,6 +741,7 @@ function correlationEvent(event) {
       ...(typeof event.data?.message?.source?.callId === 'string'
         ? { callId: event.data.message.source.callId } : {}),
     } } } } : {}),
+    ...(isEnvironmentResetEvent(event) ? { data: { source: event.data.source } } : {}),
     ...(event.type === 'compaction/prune' ? { data: {
       ...(event.data?.shadowedSeqs === undefined ? {} : { shadowedSeqs: event.data.shadowedSeqs }),
       ...(event.data?.shadowedRange === undefined ? {} : { shadowedRange: event.data.shadowedRange }),
@@ -1158,7 +1165,7 @@ export function validateSessionTimelineState(value, logFacts, options = {}) {
     'ordinaryResultSeqs', 'settledResultsByEventSeq', 'scope', 'latestRun', 'editableRun', 'lastSuccessfulRunIndex',
     'unavailableResultSeq', 'unavailableResultReason', 'pruneReplacementWindow', 'runSelectionFrontier',
     'runSelectionHistory', 'lastEventIndex', 'eventFacts', 'retainedBytes', 'retentionSummary', 'compacted',
-    'hotCellDropped']) && typeof value.openTurn === 'boolean'
+    'hotCellDropped', 'environmentReset']) && typeof value.openTurn === 'boolean'
     && typeof value.found === 'boolean' && isCanonicalSequence(value.scope)
     && typeof value.retainedBytes === 'number' && value.retainedBytes >= 0
     && (value.retentionSummary === undefined || value.retentionSummary === null || isRecord(value.retentionSummary))
@@ -1328,9 +1335,10 @@ export function validateSessionTimelineState(value, logFacts, options = {}) {
       && isCanonicalSequence(observation.eventIndex) && observation.eventIndex > correlationIndex
       && value.lastEventIndex !== null && observation.eventIndex <= value.lastEventIndex
       && isRecord(observation.event) && isCanonicalSequence(observation.event.seq)
-      && ['turn/start', 'turn/end', RECOVERY_BOUNDARY_EVENT, 'compaction/prune', 'tool/call', 'tool/result',
+      && ['turn/start', 'turn/end', 'user/message', RECOVERY_BOUNDARY_EVENT, 'compaction/prune', 'tool/call', 'tool/result',
         'tool/ptc-dispatch-start', 'tool/ptc-dispatch']
         .includes(observation.event.type)
+      && (observation.event.type !== 'user/message' || isEnvironmentResetEvent(observation.event))
       && deepEqualJson(correlationEvent(observation.event), observation.event)
       && (observation.event.type === 'tool/ptc-dispatch-start'
         && observation.event.data?.name === 'edit_run_code'
@@ -1363,6 +1371,9 @@ export function validateSessionTimelineState(value, logFacts, options = {}) {
     }
     reconstructed = replaySessionTimelineFact(reconstructed, observation, executable)
   }
+  const resetFact = value.eventFacts.findLast(fact => isEnvironmentResetEvent(fact.event))
+  requireFact(deepEqualJson(value.environmentReset ?? null, resetFact === undefined ? null
+    : { seq: resetFact.event.seq, index: resetFact.eventIndex }))
   const summary = retentionSummaryOf(value)
   // A compacted state that lost its summary must be rejected: dropping the summary
   // would erase the only trace of the clusters the window removed.
@@ -1428,7 +1439,8 @@ export function validateSessionTimelineState(value, logFacts, options = {}) {
     if (item.frontier !== undefined) {
       dispatchFrontier = item.frontier
       dispatchRun = undefined
-      if (item.frontier.reason === 'turn/start' || item.frontier.reason === 'turn/end') {
+      if (item.frontier.reason === 'turn/start' || item.frontier.reason === 'turn/end'
+        || item.frontier.reason === 'environment-reset') {
         dispatchScope = item.frontier.scope
         dispatchClaims.clear()
         dispatchEdits.clear()
@@ -1669,13 +1681,14 @@ function requireRecordedSettlementProof(meta, journal, isError = undefined) {
 }
 
 function advanceTimelineEvent(previous, inputEvent, eventIndex, replayFact, retainedCalls) {
+  if (inputEvent?.type === 'user/message' && !isEnvironmentResetEvent(inputEvent)) return previous
   const nested = inputEvent?.type === 'tool/ptc-dispatch-start'
     || inputEvent?.type === 'tool/ptc-dispatch'
   if (nested && inputEvent.data?.name !== 'edit_run_code'
     && inputEvent.data?.name !== 'run_code'
     && !previous.eventFacts.some(fact => fact.event.type === 'tool/ptc-dispatch-start'
       && fact.event.data?.subCallId === inputEvent.data?.subCallId)) return previous
-  if (!['turn/start', 'turn/end', RECOVERY_BOUNDARY_EVENT, 'compaction/prune', 'tool/call', 'tool/result',
+  if (!['turn/start', 'turn/end', 'user/message', RECOVERY_BOUNDARY_EVENT, 'compaction/prune', 'tool/call', 'tool/result',
     'tool/ptc-dispatch-start', 'tool/ptc-dispatch'].includes(inputEvent?.type)) {
     return previous
   }
@@ -1746,6 +1759,21 @@ function advanceTimelineEvent(previous, inputEvent, eventIndex, replayFact, reta
       resetTurn(false)
       continue
     }
+    if (isEnvironmentResetEvent(event)) {
+      state.environmentReset = { seq: event.seq, index: eventIndex }
+      pendingByCallId.clear()
+      seenCallIds.clear()
+      claimedEditTargets.clear()
+      editClaims.clear()
+      delete state.unavailableResultSeq
+      delete state.unavailableResultReason
+      clearRunSelection('environment-reset')
+      if (event.data.source.version !== ENVIRONMENT_RESET_VERSION) {
+        state.unavailableResultSeq = isCanonicalSequence(event.seq) ? event.seq : eventIndex
+        state.unavailableResultReason = { seq: state.unavailableResultSeq, reason: 'invalid PTC environment reset boundary' }
+      }
+      continue
+    }
     if (event?.type === RECOVERY_BOUNDARY_EVENT) {
       state.unavailableResultSeq ??= isCanonicalSequence(event.seq) ? event.seq : eventIndex
       continue
@@ -1824,6 +1852,7 @@ function advanceTimelineEvent(previous, inputEvent, eventIndex, replayFact, reta
       settledResultsByEventSeq.set(event.seq, republishedSettlement)
       continue
     }
+    if (entry?.event?.seq <= (state.environmentReset?.seq ?? -1)) continue
     if (hasSourceRelation && !canonicalSourceRelation) {
       const callSeq = invalidSourceCallSeq(event, state.executableCalls, pendingByCallId)
       if (callSeq !== undefined) {
@@ -2387,29 +2416,33 @@ export function recoverJournal(session, currentCallSeq, options = {}) {
   const needsPayload = [...folded.executableCalls.values()]
     .some(entry => typeof entry?.event?.data?.arguments !== 'string')
   const timeline = needsPayload ? withFullRetention(() => foldSessionTimeline(events)) : folded
-  const calls = timelineCalls(timeline).filter(call => call.seq !== currentCallSeq)
-  const { executableCalls, results, found } = timeline
+  const resetSeq = timeline.environmentReset?.seq ?? -1
+  const calls = timelineCalls(timeline).filter(call => call.seq !== currentCallSeq && call.seq > resetSeq)
+  const executableCalls = new Map([...timeline.executableCalls].filter(([seq]) => seq > resetSeq))
+  const results = new Map([...timeline.results].filter(([seq]) => seq > resetSeq))
+  const found = timeline.found || resetSeq >= 0
   const visibleCalls = options?.visibleCallSeqs
   const appliedBoundaries = options?.[RECOVERY_BOUNDARY_EVIDENCE]
   const invalidCallSeqs = new Set()
   let unavailableBoundary
-  const registerUnavailable = ({ seq, reason, code }, recoveryState) => {
+  const registerUnavailable = ({ seq, reason, code, kind }, recoveryState) => {
     if (unavailableBoundary === undefined || seq <= unavailableBoundary.seq) {
-      unavailableBoundary = { seq, reason }
+      unavailableBoundary = { seq, reason, ...(kind === undefined ? {} : { kind }) }
     }
     if (recoveryState === undefined) return
     invalidCallSeqs.add(seq)
     recoveryState.trusted = false
     if (!recoveryState.volatileSuffix.some(item => item.seq === seq)) {
-      const item = { seq, code, reason }
+      const item = { seq, code, reason, ...(kind === undefined ? {} : { kind }) }
       const index = recoveryState.volatileSuffix.findIndex(existing => existing.seq > seq)
       if (index < 0) recoveryState.volatileSuffix.push(item)
       else recoveryState.volatileSuffix.splice(index, 0, item)
     }
   }
-  if (timeline.unavailableResultSeq !== undefined) {
+  if (timeline.unavailableResultSeq !== undefined && timeline.unavailableResultSeq >= resetSeq) {
     registerUnavailable({
       seq: timeline.unavailableResultSeq,
+      ...(timeline.unavailableResultSeq === resetSeq ? { kind: 'environment-reset' } : {}),
       reason: timeline.unavailableResultReason?.seq === timeline.unavailableResultSeq
         ? timeline.unavailableResultReason.reason
         : 'unavailable or malformed dsh-ptc-plus journal result',
@@ -2428,7 +2461,7 @@ export function recoverJournal(session, currentCallSeq, options = {}) {
     normalizedExtraBoundaries = []
   }
   const boundaries = [
-    ...timeline.boundaries,
+    ...recoveryBoundariesAfterReset(timeline),
     ...normalizedExtraBoundaries.map(boundary => ({
       ...boundary,
       eventSeq: Number.POSITIVE_INFINITY,
@@ -2442,7 +2475,7 @@ export function recoverJournal(session, currentCallSeq, options = {}) {
   for (const [resultSeq, { journal, eventIndex }] of results.entries()) {
     const candidateConfirms = []
     for (const callSeq of journal?.confirms ?? []) {
-      if (!isConfirmableNoop(timeline, callSeq, eventIndex)) {
+      if (callSeq <= resetSeq || !isConfirmableNoop(timeline, callSeq, eventIndex)) {
         const reason = `confirmed no-op does not identify an earlier unjournaled run_code call seq ${callSeq}`
         invalidResultReasons.set(resultSeq, reason)
         registerUnavailable({ seq: resultSeq, reason })
@@ -2470,9 +2503,10 @@ export function recoverJournal(session, currentCallSeq, options = {}) {
   ))
   const rejectBoundary = (boundary, reason) => {
     const carrierCallSeq = carrierCallSeqForBoundary(boundary)
+    const failedSeq = boundary.failedResetSeq ?? boundary.failedCallSeq
     const contractionSeq = carrierCallSeq === undefined
-      ? boundary.failedCallSeq
-      : Math.min(boundary.failedCallSeq, carrierCallSeq)
+      ? failedSeq
+      : Math.min(failedSeq, carrierCallSeq)
     // A rejected boundary still establishes a conservative contraction point:
     // the same window an accepted boundary would contract stays unproved, so
     // settlements folded after this rejection cannot re-enter the frontier.
@@ -2486,12 +2520,13 @@ export function recoverJournal(session, currentCallSeq, options = {}) {
       ...foldOptions,
       surfaceContracted: state.surfaceContracted,
     })
-    registerUnavailable({ seq: carrierCallSeq ?? boundary.failedCallSeq, reason }, state)
+    registerUnavailable({ seq: carrierCallSeq ?? failedSeq, reason }, state)
   }
   const applyBoundariesBefore = (seq) => {
     while (boundaryIndex < boundaries.length && boundaries[boundaryIndex].eventSeq <= seq) {
       const boundary = boundaries[boundaryIndex++]
       const carrierCallSeq = carrierCallSeqForBoundary(boundary)
+      const failedSeq = boundary.failedResetSeq ?? boundary.failedCallSeq
       const failedCall = executableCalls.get(boundary.failedCallSeq)
       // Derived records exist only after the shared timeline has proved both
       // dispatch pairs and the final root publication. A raw nested start does
@@ -2503,14 +2538,17 @@ export function recoverJournal(session, currentCallSeq, options = {}) {
       )) : []
       const failedExecution = failedCall === undefined && derivedRecords.length === 1
         ? derivedRecords[0] : undefined
+      const failedReset = boundary.failedResetSeq === resetSeq
+        && unavailableBoundary?.seq === resetSeq && unavailableBoundary.kind === 'environment-reset'
+        && resetSeq < boundary.eventSeq
       const isEarlierExecution = failedCall === undefined
         ? failedExecution !== undefined && recordEventSeq(failedExecution) < boundary.eventSeq
         : failedCall.event.seq < boundary.eventSeq
-      if (!isEarlierExecution) {
+      if (boundary.failedResetSeq !== undefined ? !failedReset : !isEarlierExecution) {
         rejectBoundary(boundary, 'recovery boundary does not identify an earlier executable call')
         continue
       }
-      const failedIndex = state.nodes.findIndex(node => node.callSeq === boundary.failedCallSeq)
+      const failedIndex = state.nodes.findIndex(node => node.callSeq === failedSeq)
       const expectedFrontier = failedIndex < 0 ? state.head : state.nodes[failedIndex].parent
       const frontierIndex = boundary.frontierCallSeq === null
         ? undefined
@@ -2519,25 +2557,25 @@ export function recoverJournal(session, currentCallSeq, options = {}) {
         rejectBoundary(boundary, 'recovery boundary frontier does not match the failed call parent')
         continue
       }
-      const resolvesUnavailable = unavailableBoundary?.seq === boundary.failedCallSeq
+      const resolvesUnavailable = unavailableBoundary?.seq === failedSeq
       const resolvesConfirmedNoop = confirmedNoops.has(boundary.failedCallSeq)
       if (failedIndex < 0 && !resolvesUnavailable && !resolvesConfirmedNoop) {
         rejectBoundary(boundary, 'recovery boundary failed call is outside the verified frontier')
         continue
       }
-      if (carrierCallSeq !== undefined && carrierCallSeq <= boundary.failedCallSeq) {
+      if (carrierCallSeq !== undefined && carrierCallSeq <= failedSeq) {
         rejectBoundary(boundary, 'recovery boundary carrier does not follow the failed call')
         continue
       }
       if (Array.isArray(appliedBoundaries)) appliedBoundaries.push(boundary)
       if (carrierCallSeq !== undefined) {
-        contractedCallRanges.push({ start: boundary.failedCallSeq, end: carrierCallSeq })
+        contractedCallRanges.push({ start: failedSeq, end: carrierCallSeq })
       }
       for (let index = 0; index < state.nodes.length; index += 1) {
         if (dependsOn(state.nodes, index, failedIndex)) invalidCallSeqs.add(state.nodes[index].callSeq)
       }
       for (const record of records) {
-        if ((failedIndex < 0 && record.call.seq >= boundary.failedCallSeq)
+        if ((failedIndex < 0 && record.call.seq >= failedSeq)
           || isContractedCallSeq(record.call.seq)) {
           invalidCallSeqs.add(record.call.seq)
         }
@@ -2663,7 +2701,12 @@ export function recoverJournal(session, currentCallSeq, options = {}) {
   return history
 }
 
-/** Prove that recovery consumes every persisted boundary at its declared frontier. */
+function recoveryBoundariesAfterReset(timeline) {
+  const resetSeq = timeline.environmentReset?.seq ?? -1
+  return timeline.boundaries.filter(boundary => boundary.carrierCallSeq > resetSeq)
+}
+
+/** Prove every persisted boundary eligible after the latest reset at its declared frontier. */
 export function validateRecoveryBoundaryApplication(events) {
   const applied = []
   const recovered = recoverJournal(
@@ -2671,7 +2714,7 @@ export function validateRecoveryBoundaryApplication(events) {
     undefined,
     { [RECOVERY_BOUNDARY_EVIDENCE]: applied },
   )
-  const declared = foldSessionTimeline(events).boundaries.length
+  const declared = recoveryBoundariesAfterReset(foldSessionTimeline(events)).length
   if (!recovered.available || applied.length !== declared) {
     throw new Error('migrated PTC recovery boundary does not prove its declared frontier')
   }

package/internal/session-journal-schema.js

@@ -1,3 +1,4 @@
+import { isPtcMessageSource } from './message-sources.js'
 import {
   LEGACY_DEFAULT_EXPORT_BINDING,
   LIVE_DEFAULT_EXPORT_BINDING,
@@ -29,6 +30,14 @@ export const PREVIOUS_JOURNAL_VERSION = 3
 export const USER_BINDING_RELATIONLESS_JOURNAL_VERSION = 4
 export const FINGERPRINT_REUSE_JOURNAL_VERSION = 5
 export const VERSIONED_BINDING_REUSE_JOURNAL_VERSION = 6
+export const ENVIRONMENT_RESET_VERSION = 1
+
+/** Structured producer identity proves a reset independently of notice wording. */
+export function isEnvironmentResetEvent(event) {
+  const source = event?.data?.source
+  return event?.type === 'user/message' && isPtcMessageSource(source)
+    && source.form === 'environment-reset'
+}
 export const RECOVERY_BOUNDARY_EVENT = 'ptc-plus/recovery-boundary'
 
 export const STATUSES = new Set(['durable', 'volatile', 'discarded', 'noop'])
@@ -121,6 +130,7 @@ export function normalizeJournalUserBindingNames(journal) {
   return normalizeUserBindingNames(journal.userBindingNames)
 }
 export const RECOVERY_BOUNDARY_FIELDS = new Set(['failedCallSeq', 'frontierCallSeq'])
+export const RESET_RECOVERY_BOUNDARY_FIELDS = new Set(['failedResetSeq', 'frontierCallSeq'])
 export const REPL_TOOL_NAMES = new Set(['run_code', 'edit_run_code'])
 export const REWRITE_FIELDS = new Set(['kind', 'description', 'source'])
 export const REWRITE_KINDS = new Set(['import', 'redeclaration', 'export'])

package/internal/session-journal.js

@@ -63,6 +63,8 @@ import {
   JOURNAL_VERSIONS,
   USER_BINDINGS_REUSE_POLICIES,
   RECOVERY_BOUNDARY_FIELDS,
+  RESET_RECOVERY_BOUNDARY_FIELDS,
+  isEnvironmentResetEvent,
   DIAGNOSTIC_WORDING_KEY,
   SETTLEMENT_PROOF_KEY,
   SETTLEMENT_PROOF_FIELDS,
@@ -722,18 +724,19 @@ export function recoveryBoundariesEqual(left, right) {
 }
 
 function normalizeRecoveryBoundaryValue(value, eventSeq = undefined) {
+  const reset = isRecord(value) && Object.hasOwn(value, 'failedResetSeq')
   if (!isRecord(value)
-    || !isCanonicalSequence(value.failedCallSeq)
-    || (value.frontierCallSeq !== null
-      && !isCanonicalSequence(value.frontierCallSeq))) {
+    || !isCanonicalSequence(reset ? value.failedResetSeq : value.failedCallSeq)
+    || (reset ? value.frontierCallSeq !== null
+      : value.frontierCallSeq !== null && !isCanonicalSequence(value.frontierCallSeq))) {
     throw new Error('invalid dsh-ptc-plus recovery boundary')
   }
-  assertOwnFields(value, RECOVERY_BOUNDARY_FIELDS, 'recovery boundary')
+  assertOwnFields(value, reset ? RESET_RECOVERY_BOUNDARY_FIELDS : RECOVERY_BOUNDARY_FIELDS, 'recovery boundary')
   if (eventSeq !== undefined && !isCanonicalSequence(eventSeq)) {
     throw new Error('invalid dsh-ptc-plus recovery boundary event sequence')
   }
   return {
-    failedCallSeq: value.failedCallSeq,
+    ...(reset ? { failedResetSeq: value.failedResetSeq } : { failedCallSeq: value.failedCallSeq }),
     frontierCallSeq: value.frontierCallSeq,
     ...(eventSeq === undefined ? {} : { eventSeq }),
   }
@@ -1111,15 +1114,24 @@ export function migrateRecoveryBoundaryEvents(events) {
     }
     return target.retainedSeq
   }
-  const mapBoundary = (boundary, resultSeq) => ({
-    failedCallSeq: mapCall(boundary.failedCallSeq, resultSeq, 'recovery-boundary failure'),
-    frontierCallSeq: boundary.frontierCallSeq === null ? null : (() => {
-      if (boundary.frontierCallSeq >= boundary.failedCallSeq) {
-        throw new Error('recovery-boundary frontier must precede its failed call')
+  const mapBoundary = (boundary, resultSeq) => {
+    if (boundary.failedResetSeq !== undefined) {
+      const target = sequenceMap.get(boundary.failedResetSeq)
+      if (!isEnvironmentResetEvent(target?.event) || boundary.failedResetSeq >= resultSeq) {
+        throw new Error('unproved recovery-boundary reset event reference')
       }
-      return mapCall(boundary.frontierCallSeq, resultSeq, 'recovery-boundary frontier')
-    })(),
-  })
+      return { failedResetSeq: mapEvent(boundary.failedResetSeq, 'recovery-boundary reset'), frontierCallSeq: null }
+    }
+    return {
+      failedCallSeq: mapCall(boundary.failedCallSeq, resultSeq, 'recovery-boundary failure'),
+      frontierCallSeq: boundary.frontierCallSeq === null ? null : (() => {
+        if (boundary.frontierCallSeq >= boundary.failedCallSeq) {
+          throw new Error('recovery-boundary frontier must precede its failed call')
+        }
+        return mapCall(boundary.frontierCallSeq, resultSeq, 'recovery-boundary frontier')
+      })(),
+    }
+  }
   const migrated = []
   const pending = []
   const boundaryOrigins = new Map()