@polyengine/runtime 0.3.1-pre.g4fe5f4b → 0.3.1

package/esm/exec/executor.js

@@ -82,8 +82,26 @@ class Executor {
      * another.
      */
     store = new Store();
-    /** Memoized `unsafe-intrinsic` core functions, by symbol. */
+    /**
+     * Memoized `unsafe-intrinsic` core functions, by DECLARING COMPONENT
+     * INSTANCE and symbol.
+     *
+     * The instance is part of the key because `context.{get,set}` resolve their
+     * thread against it (`currentThreadForInstance`, task/scheduler.ts): the
+     * declaring instance is the one whose core frame is executing when the
+     * intrinsic is called, which is what keeps a JSPI continuation chunk's
+     * `context.set` out of a sibling task's slots. `null` keys the shared
+     * adapter/instance-less flavour (the plan records `instance: null` for FACT
+     * adapter modules).
+     */
     unsafeIntrinsics = new Map();
+    /**
+     * The component instance of the core module currently being instantiated
+     * (`instantiate-module`'s `instance` field; null for a FACT adapter). Read
+     * by `unsafeIntrinsic` while its import list is being resolved — the one
+     * place a core instance's owning component instance is stated by the plan.
+     */
+    #declaringInstance = null;
     /** The single in-flight FACT `prepare-call` state (intrinsics/fact_calls.ts). */
     preparedCall = { current: null };
     /**
@@ -353,6 +371,13 @@ class Executor {
                     // suspension point; every function it exports is therefore
                     // potentially-blocking, and everything else is not.
                     this.sawBlockingImport = false;
+                    // Which component instance this core module belongs to — the plan
+                    // states it here and nowhere else (`instance: null` = FACT adapter,
+                    // contracts/plan-format.md). `unsafeIntrinsic` reads it while the
+                    // import list below is resolved.
+                    this.#declaringInstance = init.instance === null
+                        ? null
+                        : this.componentInstance(init.instance);
                     // ISSUE #88: core wasm permits two imports with the same
                     // (module, field) pair (trusted wasmtime-environ 47.0.3 info.rs
                     // :438-445 gives one flat positional CoreDef per import slot, but
@@ -390,6 +415,10 @@ class Executor {
                             {})[imp.name] =
                             value;
                     });
+                    // Scoped strictly to the import list above: a CoreDef resolved by
+                    // any other initializer (extract-*, resource dtors) names no core
+                    // module, so it must not inherit this one's instance.
+                    this.#declaringInstance = null;
                     let instance;
                     try {
                         instance = await WebAssembly.instantiate(module, importObject);
@@ -670,10 +699,12 @@ class Executor {
         return m;
     }
     unsafeIntrinsic(symbol) {
-        let fn = this.unsafeIntrinsics.get(symbol);
+        const inst = this.#declaringInstance;
+        const key = `${inst === null ? "-" : inst.index}\0${symbol}`;
+        let fn = this.unsafeIntrinsics.get(key);
         if (fn === undefined) {
-            fn = createUnsafeIntrinsic(symbol);
-            this.unsafeIntrinsics.set(symbol, fn);
+            fn = createUnsafeIntrinsic(symbol, inst);
+            this.unsafeIntrinsics.set(key, fn);
         }
         return fn;
     }

package/esm/intrinsics/context.js

@@ -10,7 +10,7 @@
 // memory access for wasmtime's own internals; they have no portable meaning
 // in a JS host and are refused at instantiate time.
 import { assert_, trapIf } from "../cabi/trap.js";
-import { currentThread } from "../task/mod.js";
+import { currentThreadForInstance } from "../task/mod.js";
 import { ambientDebug, dbgId } from "../task/scheduler.js";
 import { UnsupportedFeatureError } from "./errors.js";
 /**
@@ -28,8 +28,8 @@ export const NUM_CONTEXT_SLOTS = 2;
  * in slot 0, which is why this intrinsic is the entry blocker for async
  * guests.
  */
-export function canonContextGet(i) {
-    const thread = currentThread();
+export function canonContextGet(i, inst) {
+    const thread = currentThreadForInstance(inst);
     assert_(i < NUM_CONTEXT_SLOTS, `context.get slot ${i} out of range`);
     const result = thread.storage[i];
     assert_(result < 2 ** 32, "context.get value out of i32 range");
@@ -56,8 +56,8 @@ function trace(msg, thread) {
     console.error(`[ctx] ${ctxThreadId(thread)} ${msg} storage=${JSON.stringify(thread.storage)} | stack=[${a.stack.map(ctxThreadId).join(",")}] claims=[${a.claims.map(ctxThreadId).join(",")}]`);
 }
 /** definitions.py `canon_context_set` (line 2358). */
-export function canonContextSet(i, v) {
-    const thread = currentThread();
+export function canonContextSet(i, v, inst) {
+    const thread = currentThreadForInstance(inst);
     assert_(i < NUM_CONTEXT_SLOTS, `context.set slot ${i} out of range`);
     if (CTX_TRACE)
         trace(`set[${i}] = ${v >>> 0}`, thread);
@@ -70,7 +70,17 @@ export function canonContextSet(i, v) {
  * unimplementable symbol fails instantiation rather than the first call
  * (contracts/plan-format.md "Executor obligations").
  */
-export function createUnsafeIntrinsic(symbol) {
+export function createUnsafeIntrinsic(symbol, 
+/**
+ * The component instance whose core module declares this import — the
+ * instance whose frame is, by construction, the one executing when it is
+ * called. `undefined`/`null` (a FACT adapter module, which the plan records
+ * with `instance: null`) falls back to the unscoped ambient. See
+ * `currentThreadForInstance` (task/scheduler.ts) for why this discriminator
+ * is what makes a JSPI continuation chunk's `context.set` land in its own
+ * thread's slots.
+ */
+inst) {
     const match = /^context-(get|set)-i32-(\d+)$/.exec(symbol);
     if (match === null) {
         throw new UnsupportedFeatureError("M2", `component imports the unsafe intrinsic '${symbol}', which has no ` +
@@ -83,8 +93,8 @@ export function createUnsafeIntrinsic(symbol) {
     trapIf(slot >= NUM_CONTEXT_SLOTS, `unsafe intrinsic '${symbol}' addresses context slot ${slot}, but a ` +
         `thread has ${NUM_CONTEXT_SLOTS}`);
     if (match[1] === "get")
-        return () => canonContextGet(slot);
+        return () => canonContextGet(slot, inst);
     return (v) => {
-        canonContextSet(slot, (v ?? 0) >>> 0);
+        canonContextSet(slot, (v ?? 0) >>> 0, inst);
     };
 }

package/esm/task/scheduler.js

@@ -567,6 +567,76 @@ export function currentThread() {
 export function maybeCurrentThread() {
     return resolveAmbient();
 }
+/**
+ * THE ambient, NARROWED BY THE INSTANCE WHOSE CORE FRAME IS EXECUTING.
+ *
+ * For a built-in whose declaration names a component instance, "who is
+ * running" is not an open question about the whole store: the call arrived
+ * from a core frame OF THAT INSTANCE, so the running activation is one of
+ * that instance's. This narrows `resolveAmbient` accordingly — same tiers,
+ * same order, candidates filtered — and falls back to the unscoped answer
+ * when the instance has no candidate at all (the instantiation-time shape,
+ * and any built-in reached before its instance has a task).
+ *
+ * WHY IT IS NEEDED (polyengine#24's residue; polyvisor#49 trap 1,
+ * `runtime/tests/context_attribution_test.ts`). A JSPI continuation chunk —
+ * the tail of a suspended activation, e.g. wit-bindgen's callback epilogue
+ * restoring its task pointer with `context.set` (rt/async_support.rs:592) —
+ * runs with an EMPTY `threadStack` and, unlike a hop, has no re-anchoring
+ * edge of its own. Tier 2 then answers the newest claim, which is whichever
+ * SIBLING activation suspended most recently. The attribution sentinels
+ * (jspi/bridge.ts) plant that claim one microtask ahead of the chunk, which
+ * is exact when the engine queues the resumption while the settle reaction
+ * returns (measured so in Deno's V8) — and NOT exact in Chromium, where a
+ * wider gap lets a sibling's sentinel land in between. Measured there 3/3:
+ * one task's epilogue wrote its state pointer into another task's slots, and
+ * the starved task's next callback entry hit `assert!(!state.is_null())`
+ * (async_support.rs:578) -> unreachable.
+ *
+ * Ordering discipline cannot fix that class — engine chunk boundaries are not
+ * observable, so every microtask-ordering scheme is a hope. Instance identity
+ * is not a hope: it is static (the declaration), and it is decisive because
+ * ONE INSTANCE CAN ONLY HAVE ONE ACTIVATION MID-FRAME AT A TIME — a callback
+ * invocation holds `inst.exclusiveThread` for its whole extent, suspensions
+ * included (definitions.py line 2187 / `runCallbackLoop`), and a sync or
+ * stackful-async lift holds the entry gate. Two activations that can race for
+ * an unbracketed read are therefore necessarily of different instances, which
+ * is exactly what this discriminates.
+ *
+ * SPEC BASIS. `canon_context_get`/`canon_context_set` (definitions.py 2348 /
+ * 2358) read `current_thread().storage`, and in the reference a built-in is
+ * only ever reached from inside the activation that called it — the identity
+ * is exact by construction, never inferred. This runtime has to reconstruct
+ * it; narrowing the reconstruction to the declaring instance moves it TOWARD
+ * the reference (it can only ever remove candidates the reference would never
+ * have named), never away.
+ */
+// deno-lint-ignore no-explicit-any
+export function currentThreadForInstance(inst) {
+    const t = resolveAmbientForInstance(inst);
+    if (t !== undefined)
+        return t;
+    // No candidate of this instance: the unscoped ladder, including its
+    // `PendingCapability` for the instantiation-time shape.
+    return currentThread();
+}
+function resolveAmbientForInstance(inst) {
+    if (inst === null || inst === undefined)
+        return resolveAmbient();
+    const top = threadStack[threadStack.length - 1];
+    if (top !== undefined && instOf(top) === inst)
+        return top;
+    for (let i = activationClaims.length - 1; i >= 0; i--) {
+        const c = activationClaims[i];
+        if (instOf(c) === inst)
+            return c;
+    }
+    return undefined;
+}
+// deno-lint-ignore no-explicit-any
+function instOf(t) {
+    return t?.task?.inst;
+}
 /** definitions.py `current_task()` (line 309). */
 // deno-lint-ignore no-explicit-any
 export function currentTask() {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@polyengine/runtime",
-  "version": "0.3.1-pre.g4fe5f4b",
+  "version": "0.3.1",
   "description": "A WebAssembly Component Model host for JavaScript engines: plan executor, canonical ABI, 0.3 task scheduler, JSPI bridge, and embedder API.",
   "homepage": "https://github.com/polymorph-components/polyengine#readme",
   "repository": {

package/types/intrinsics/context.d.ts

@@ -14,10 +14,10 @@ export declare const NUM_CONTEXT_SLOTS = 2;
  * in slot 0, which is why this intrinsic is the entry blocker for async
  * guests.
  */
-export declare function canonContextGet(i: number): number;
+export declare function canonContextGet(i: number, inst?: unknown): number;
 export declare function ctxThreadId(t: unknown): string;
 /** definitions.py `canon_context_set` (line 2358). */
-export declare function canonContextSet(i: number, v: number): void;
+export declare function canonContextSet(i: number, v: number, inst?: unknown): void;
 /**
  * Materialize one `unsafe-intrinsic` CoreDef as a core function.
  *
@@ -25,4 +25,14 @@ export declare function canonContextSet(i: number, v: number): void;
  * unimplementable symbol fails instantiation rather than the first call
  * (contracts/plan-format.md "Executor obligations").
  */
-export declare function createUnsafeIntrinsic(symbol: string): CoreFn;
+export declare function createUnsafeIntrinsic(symbol: string, 
+/**
+ * The component instance whose core module declares this import — the
+ * instance whose frame is, by construction, the one executing when it is
+ * called. `undefined`/`null` (a FACT adapter module, which the plan records
+ * with `instance: null`) falls back to the unscoped ambient. See
+ * `currentThreadForInstance` (task/scheduler.ts) for why this discriminator
+ * is what makes a JSPI continuation chunk's `context.set` land in its own
+ * thread's slots.
+ */
+inst?: unknown): CoreFn;

package/types/task/scheduler.d.ts

@@ -170,6 +170,51 @@ export declare function ambientResidue(): {
 };
 export declare function currentThread<T = CurrentThreadLike>(): T;
 export declare function maybeCurrentThread(): CurrentThreadLike | undefined;
+/**
+ * THE ambient, NARROWED BY THE INSTANCE WHOSE CORE FRAME IS EXECUTING.
+ *
+ * For a built-in whose declaration names a component instance, "who is
+ * running" is not an open question about the whole store: the call arrived
+ * from a core frame OF THAT INSTANCE, so the running activation is one of
+ * that instance's. This narrows `resolveAmbient` accordingly — same tiers,
+ * same order, candidates filtered — and falls back to the unscoped answer
+ * when the instance has no candidate at all (the instantiation-time shape,
+ * and any built-in reached before its instance has a task).
+ *
+ * WHY IT IS NEEDED (polyengine#24's residue; polyvisor#49 trap 1,
+ * `runtime/tests/context_attribution_test.ts`). A JSPI continuation chunk —
+ * the tail of a suspended activation, e.g. wit-bindgen's callback epilogue
+ * restoring its task pointer with `context.set` (rt/async_support.rs:592) —
+ * runs with an EMPTY `threadStack` and, unlike a hop, has no re-anchoring
+ * edge of its own. Tier 2 then answers the newest claim, which is whichever
+ * SIBLING activation suspended most recently. The attribution sentinels
+ * (jspi/bridge.ts) plant that claim one microtask ahead of the chunk, which
+ * is exact when the engine queues the resumption while the settle reaction
+ * returns (measured so in Deno's V8) — and NOT exact in Chromium, where a
+ * wider gap lets a sibling's sentinel land in between. Measured there 3/3:
+ * one task's epilogue wrote its state pointer into another task's slots, and
+ * the starved task's next callback entry hit `assert!(!state.is_null())`
+ * (async_support.rs:578) -> unreachable.
+ *
+ * Ordering discipline cannot fix that class — engine chunk boundaries are not
+ * observable, so every microtask-ordering scheme is a hope. Instance identity
+ * is not a hope: it is static (the declaration), and it is decisive because
+ * ONE INSTANCE CAN ONLY HAVE ONE ACTIVATION MID-FRAME AT A TIME — a callback
+ * invocation holds `inst.exclusiveThread` for its whole extent, suspensions
+ * included (definitions.py line 2187 / `runCallbackLoop`), and a sync or
+ * stackful-async lift holds the entry gate. Two activations that can race for
+ * an unbracketed read are therefore necessarily of different instances, which
+ * is exactly what this discriminates.
+ *
+ * SPEC BASIS. `canon_context_get`/`canon_context_set` (definitions.py 2348 /
+ * 2358) read `current_thread().storage`, and in the reference a built-in is
+ * only ever reached from inside the activation that called it — the identity
+ * is exact by construction, never inferred. This runtime has to reconstruct
+ * it; narrowing the reconstruction to the declaring instance moves it TOWARD
+ * the reference (it can only ever remove candidates the reference would never
+ * have named), never away.
+ */
+export declare function currentThreadForInstance<T = CurrentThreadLike>(inst: unknown): T;
 /** definitions.py `current_task()` (line 309). */
 export declare function currentTask(): any;
 /**