The ECMAScript defines realm object as one that must be associated with JS code before evaluating. It holds references to the global object and global environment. Such specification entities as Module Record and Script Record have reference to its realm so their code would be running with this realm.
If we have a dependency graph of several modules (Module Records) must all of them store the same realm object? It should be so in due to these modules have to share a single global environment but I can't draw the specific rule on it from the specification.
There is the following instruction:
A global Environment Record is used to represent the outer most scope that is shared by all of the ECMAScript Script elements that are processed in a common realm.
albeit it restricts "a common realm" to Script elements (for reasons arcane for me).
So my final question is what's the conditions under which JS code from different sources must be executed with the same realm object (and then all this code shares the same global environment) and, oppositely, when JS code is eligible to create its own realm? (this answer tells one of the cases is <iframe>).