ctx.rng() is seeded from the call's timestamp (documented in crates/bindings/src/rng.rs), so it's predictable.
Modules that mint OAuth state/PKCE verifiers, invite codes, session tokens or webhook secrets have nowhere to get
unpredictable bytes, and today have to derive them from a secret passed in through env. A host-provided entropy call
(e.g. ctx.random_bytes(n) or a ctx.csprng(), outside the deterministic replay path) would close that gap.