@polyengine/runtime 0.5.0 → 0.5.1

package/esm/embedder/copy.js

@@ -29,7 +29,7 @@ export const COPY_URL = import.meta.url;
  * @internal — copy-identity constant for the A9 multi-copy diagnostics; not
  * host-facing.
  */
-export const RUNTIME_VERSION = "0.5.0";
+export const RUNTIME_VERSION = "0.5.1";
 /**
  * Compose a cross-copy diagnostic: what was foreign, which copy is speaking,
  * the census of every copy in the graph, and the by-value remediation.

package/esm/embedder/instantiate.js

@@ -13,7 +13,7 @@ import { loadEnvelope, loadPlan, PlanError } from "../plan/loader.js";
 import { Trap } from "../cabi/trap.js";
 import { CONSTRUCTOR_SYNC_ENTRY, hostResourceType, instantiateComponent, } from "../exec/mod.js";
 import { camelCase, parseLeafName, pascalCase } from "./casing.js";
-import { isSuspending, suspending } from "../jspi/suspending.js";
+import { abortable, deferCancel, isAbortable, isDeferCancel, isSuspending, suspending, } from "../jspi/suspending.js";
 import { Translator } from "../shim/mod.js";
 import { copyCensus, isTrap, isComponentException } from "@polyengine/protocol";
 import { NameCollisionError, ComponentException } from "./errors.js";
@@ -23,6 +23,27 @@ import { buildGuestResourceClass, HostResourceRegistry, invalidateWrapper, lendW
 import { BorrowScope, describe, fromHost, toHost, } from "./values.js";
 import { ImportResolver } from "./version.js";
 import { Future, Stream } from "./streams.js";
+/**
+ * Relay the per-declaration host-import marks from the embedder's function
+ * onto the wrapper the executor will actually receive, and return the
+ * wrapper.
+ *
+ * Every `#dispatcher` arm re-wraps the embedder's function in a closure, so a
+ * brand left on the original is INVISIBLE to `buildLoweredImport` — for A1
+ * that surfaced as a `NeedsJspi`, for A23 (`deferCancel()`) it would be a
+ * silently discarded commit, which is precisely the failure the brand exists
+ * to prevent. Both marks are relayed by the same helper so a third one cannot
+ * be added to one arm and forgotten in the other three.
+ */
+function relayMarks(from, to) {
+    if (isSuspending(from))
+        suspending(to);
+    if (isDeferCancel(from))
+        deferCancel(to);
+    if (isAbortable(from))
+        abortable(to);
+    return to;
+}
 /** Per-element codec for a `future<T>` returned in function-result position. */
 function elementCodec(element, o) {
     return {
@@ -433,9 +454,10 @@ class Facade {
             }
             return impl(...raw);
         };
-        // A1 brand relay, layer 2 of 2 (see #dispatcher): the executor reads the
-        // brand off this wrapper, which is what lands in its hostImports record.
-        return isSuspending(dispatch) ? suspending(wrapper) : wrapper;
+        // A1/A23 brand relay, layer 2 of 2 (see #dispatcher): the executor reads
+        // the brands off this wrapper, which is what lands in its hostImports
+        // record.
+        return relayMarks(dispatch, wrapper);
     }
     /** A host-implemented resource type: register the class, own the mapping. */
     #wrapResourceType(leaf, importIndex, provider) {
@@ -471,8 +493,9 @@ class Facade {
                 throw new PlanError(`host import '${label(leaf)}' missing or not a function (got ` +
                     `${describe(fn)}); expected '${camelCase(m.name)}'`);
             }
-            // A1: the `suspending()` brand rides the dispatch closure so #wrapLeaf
-            // can relay it onto the value the executor actually receives.
+            // A1/A23: the `suspending()` and `deferCancel()` brands ride the
+            // dispatch closure so #wrapLeaf can relay them onto the value the
+            // executor actually receives.
             //
             // A2 receiver rule: an interface member is invoked with its containing
             // object as receiver (matching the static arm's `apply(cls)`), so a
@@ -485,7 +508,7 @@ class Facade {
             // liberal-acceptance failure the contract forbids.)
             const receiver = leaf.path.length === 0 ? undefined : provider;
             const dispatch = (args) => fn.apply(receiver, args);
-            return isSuspending(fn) ? suspending(dispatch) : dispatch;
+            return relayMarks(fn, dispatch);
         }
         const clsName = pascalCase(m.resource);
         // World-level member leaves resolved the class itself (`#provider`);
@@ -530,7 +553,7 @@ class Facade {
                     }
                     return fn.apply(self, rest);
                 };
-                return isSuspending(protoFn) ? suspending(dispatch) : dispatch;
+                return relayMarks(protoFn, dispatch);
             }
             case "static": {
                 const fn = cls[camelCase(m.member)];
@@ -542,7 +565,7 @@ class Facade {
                 // static-method decorator marks the function value), readable here
                 // at wrap time.
                 const dispatch = (args) => fn.apply(cls, args);
-                return isSuspending(fn) ? suspending(dispatch) : dispatch;
+                return relayMarks(fn, dispatch);
             }
         }
     }
@@ -615,6 +638,17 @@ class Facade {
         return (...raw) => {
             const scope = new BorrowScope();
             const args = ft.params.map((p, i) => toHost(raw[i], p, o, scope));
+            // CONTRACT (A24): anything the executor appended PAST the WIT-declared
+            // params is a runtime-minted extra, not a component value — today
+            // exactly the `abortable()` signal `createLoweredImport` adds for a
+            // marked import. It is forwarded verbatim (no `toHost` conversion: it
+            // has no `ValType` and must reach the host as the platform object it
+            // is). Without this the facade would silently drop the signal and a
+            // marked import's `signal` parameter would be forever `undefined` —
+            // the failure the mark exists to prevent. The slice is empty for every
+            // unmarked import, so no existing path changes shape.
+            for (let i = ft.params.length; i < raw.length; i++)
+                args.push(raw[i]);
             let out;
             try {
                 out = dispatch(args);

package/esm/exec/boundary.js

@@ -385,7 +385,9 @@ export async function driveStoreAsync(store, done, what) {
  * have always produced concurrent loops, and the host-stream pump's stand-down
  * below is cooperative, so a *bounded overlap window* remains by construction
  * (an export call can start while the pump is parked mid-`await`; the pump
- * only notices at its next `done()` evaluation). The invariant is:
+ * notices at its next `done()` evaluation, which the driver-arrival one-shot
+ * below now makes prompt — before issue #239 it was "whenever the host happens
+ * to answer", i.e. not bounded at all). The invariant is:
  *
  *   **no activation is resumed twice for one settlement, and no activation is
  *   resumed with a value from a settlement it has already consumed.**
@@ -455,6 +457,51 @@ export function whenStoreDriverIdle(store) {
     return w.p;
 }
 // ---------------------------------------------------------------------------
+// Driver arrival: closing the overlap window (issue #239)
+// ---------------------------------------------------------------------------
+//
+// The stand-down above ("the pumps are *fallback* drivers") is evaluated only
+// at a driver's next `done()`, so the doc's "bounded overlap window" is really
+// bounded by whatever the incumbent driver is parked on — and its longest park
+// is `Promise.race([...parked tags, ...pendingHostCalls])`, i.e. HOST-CONTROLLED
+// time. That is a stall in its own right, and it is fatal in combination with
+// the SPECULATIVE resume entry the race holds: `Store.pendingResumptions` is a
+// store-wide scheduling gate, so a second driver on the same store spins at
+// `driveAsync`'s top and dies at the 10,000-hop internal-bug assert in ~311ms
+// (issue #239 — the same-store half of the cross-store stall #210 fixed; see
+// `tests/cross_store_driver_test.ts`, whose header describes this gate being
+// "held for the entire duration of a guest's wait on a slow host import").
+//
+// So drivers announce themselves: every `driveAsync` that finds itself the
+// second (or later) loop on a store fires this one-shot, which every driver
+// races alongside its parked tags. The incumbent wakes within a microtask,
+// drops the speculative entry on its way out of the race, and re-evaluates
+// `done()` — which is exactly the stand-down the pumps were always supposed to
+// perform, now prompt instead of "whenever the host happens to answer".
+const driverArrivals = new WeakMap();
+/** A one-shot that resolves (to `null`, the race's "nothing settled" value)
+ * when another driver starts on `store`. */
+function armDriverArrival(store) {
+    let n = driverArrivals.get(store);
+    if (n === undefined) {
+        let r;
+        const p = new Promise((res) => (r = () => res(null)));
+        n = { p, r };
+        driverArrivals.set(store, n);
+    }
+    return n.p;
+}
+function fireDriverArrival(store) {
+    const n = driverArrivals.get(store);
+    if (n === undefined)
+        return;
+    // Deleted before resolving so the next `armDriverArrival` mints a fresh,
+    // unresolved one-shot: a driver that wakes on this and re-parks must not
+    // pick the settled promise back up and spin.
+    driverArrivals.delete(store);
+    n.r();
+}
+// ---------------------------------------------------------------------------
 // The settlement pump: liveness between export calls
 // ---------------------------------------------------------------------------
 //
@@ -599,7 +646,14 @@ async function settlementPumpLoop(store) {
     }
 }
 async function driveAsync(store, done, what) {
-    driverDepth.set(store, storeDriverDepth(store) + 1);
+    const depth = storeDriverDepth(store) + 1;
+    driverDepth.set(store, depth);
+    // An incumbent driver may be parked in the awaiting-race holding the
+    // speculative resume entry — a store-wide gate this loop would otherwise
+    // spin on until the 10,000-hop assert (issue #239). Announce ourselves so it
+    // stands down within a microtask.
+    if (depth > 1)
+        fireDriverArrival(store);
     try {
         let claimHops = 0;
         for (;;) {
@@ -831,9 +885,14 @@ async function driveAsync(store, done, what) {
                     // Every awaiting thread's settle is deferred on a non-enterable
                     // instance. The way out is the lock holder finishing, and the only
                     // await-spanning host-entry lock is the async-dtor bracket, which
-                    // registers in `pendingHostCalls` — so park on those.
+                    // registers in `pendingHostCalls` — so park on those, plus the
+                    // driver-arrival one-shot: every park in this loop races it, so the
+                    // stand-down below is prompt wherever we happen to be waiting.
                     if (store.pendingHostCalls.size > 0) {
-                        await Promise.race([...store.pendingHostCalls]).catch(() => { });
+                        await Promise.race([
+                            ...store.pendingHostCalls,
+                            armDriverArrival(store),
+                        ]).catch(() => { });
                         continue;
                     }
                     // Per the issue #156 analysis this is unreachable (a spanning lock
@@ -863,13 +922,49 @@ async function driveAsync(store, done, what) {
                 // await — which takes a fresh entry of its own — had that entry
                 // clobbered early, re-opening the window it exists to close. With a set
                 // we can name exactly what we added.
-                store.addPendingResumption(chosen);
+                //
+                // SOLE DRIVER ONLY, AND ONLY UNTIL ONE ARRIVES (issue #239). The entry
+                // is a claim over a window this loop cannot bound: the race settles when
+                // the HOST answers, which may be never. As a store-wide scheduling gate
+                // (`Store.tick` refuses; every driver yields at its top) that is a wedge
+                // the moment a second driver exists — it spins at the top of its own
+                // loop and dies at the 10,000-hop assert in ~311ms, an internal-bug
+                // detector firing on a perfectly ordinary suspended guest. Two concurrent
+                // export calls with one slow suspending import were enough; the reported
+                // shape was a detached guest task cancelling an in-flight import, which
+                // parks mid-frame with no export call outstanding and leaves the
+                // settlement pump holding this entry.
+                //
+                // What the entry protects — "the engine may run `chosen`'s wasm during
+                // this await" — it protects by refusing OTHER `Store.tick` callers, and
+                // this loop is not one of them while it awaits. The tick callers that
+                // can reach a store mid-race are another `driveAsync` loop and
+                // `HostActivity.pump`'s synchronous drain (exec/host_streams.ts) — the
+                // latter is not gated by driver depth, so scoping the entry to "sole
+                // driver" does hand it a window the entry used to close at depth >= 2.
+                // What holds regardless is the invariant the `driverDepth` note names:
+                // a genuine resumption is preceded by `SuspensionPoint.resume`'s OWN
+                // entry (jspi/bridge.ts, minted before the settle), and every
+                // resumption site here re-checks membership, promise identity and
+                // `dispatchableTail` synchronously — mechanisms (a) and (b), which is
+                // where that note already puts the weight.
+                const sole = storeDriverDepth(store) === 1;
+                if (sole)
+                    store.addPendingResumption(chosen);
                 let winner;
                 try {
-                    winner = await Promise.race([chosenTag, ...others]);
+                    // `armDriverArrival` rides the race for every driver, not just the one
+                    // holding the entry: waking on a new arrival is also how a fallback
+                    // pump reaches its next `done()` — i.e. its stand-down — promptly.
+                    winner = await Promise.race([
+                        chosenTag,
+                        ...others,
+                        armDriverArrival(store),
+                    ]);
                 }
                 finally {
-                    store.removePendingResumption(chosen);
+                    if (sole)
+                        store.removePendingResumption(chosen);
                 }
                 // Resume whichever thread actually settled -- not necessarily the one we
                 // claimed. Resuming only the claimed thread would spin: its promise may
@@ -906,7 +1001,18 @@ async function driveAsync(store, done, what) {
             // not ours — this is genuine, unavoidable nondeterminism at the boundary
             // (the reference has the same freedom in `Store.tick`). Everything
             // *inside* the component stays deterministic per scheduler.ts.
-            await Promise.race([...store.pendingHostCalls]).catch(() => { });
+            //
+            // The driver-arrival one-shot rides here too. This is the routine park of
+            // a quiet guest with a real host call outstanding — no speculative entry
+            // is held, so there is no wedge to break, but a fallback pump parked here
+            // would otherwise not reach its `done()` (i.e. its stand-down) until the
+            // HOST answered, leaving two loops interleaving `serviceSettled`/`tick`
+            // for that whole window. That interleaving is what the `driverDepth` note
+            // above calls out as bad for throughput and blame.
+            await Promise.race([
+                ...store.pendingHostCalls,
+                armDriverArrival(store),
+            ]).catch(() => { });
         }
     }
     finally {
@@ -1626,7 +1732,7 @@ function* liftBody(input) {
  *     (`thread.wait_until(subtask.resolved)`, line 2286), so: `needsJspi`.
  */
 export function createLoweredImport(input) {
-    const { name, ft, opts, hostFn, stats, mode, suspendable } = input;
+    const { name, ft, opts, hostFn, stats, mode, suspendable, deferCancel, abortable, } = input;
     const inst = opts.instance;
     const store = inst.store;
     const computed = flattenFunctype(cabiOptions(opts), ft, "lower");
@@ -1677,22 +1783,42 @@ export function createLoweredImport(input) {
         // definitions.py assigns the callee's `OnCancel` here:
         //   `subtask.on_cancel = callee(on_start, on_resolve, caller = ...)`
         //
-        // A host import is a plain JS function and offers no cancellation
-        // channel — there is nothing to forward a request to. The faithful model
-        // is therefore a handler that *accepts and ignores* the request, which is
-        // exactly what the reference permits: `canon_subtask_cancel` (line 2469)
-        // calls `on_cancel` and then re-checks `subtask.resolved()`; a callee that
-        // declines to cancel promptly leaves the subtask unresolved, and the async
-        // form returns BLOCKED while the sync form waits. The subtask still
-        // resolves normally when the promise settles — cancellation is a request,
-        // not a guarantee.
+        // The `OnCancel` is the CALLEE's to supply: `Store.invoke` takes it back
+        // from the callee it invoked (`on_cancel = f(on_start, on_resolve, caller
+        // = None)`, definitions.py line 572), i.e. the reference expects the
+        // embedding to hand back the cancellation behaviour of whatever it is
+        // hosting. A wasmtime host gets a real one for free — dropping a Rust
+        // future IS cancellation. A JS Promise has no such channel, so polyengine
+        // answers on the host's behalf; amendment A23 makes the DEFAULT answer the
+        // reference's prompt-cancel host (`on_cancel = () => on_resolve(None)`),
+        // installed by the async arm below.
+        //
+        // The no-op assigned HERE is only the placeholder for paths where
+        // `subtask.cancel` is unreachable, so no answer can ever be demanded of
+        // it: an eagerly-resolving callee never mints a subtask handle (the
+        // fast-path return below is a bare state), and a sync-typed import's A1
+        // park never mints one either. It is also the FINAL handler for a
+        // `deferCancel()`-branded import — accept and ignore, the pre-A23
+        // behaviour, now per-declaration.
         //
         // Leaving `on_cancel` null instead made a *legal* `subtask.cancel` crash
         // with an internal AssertionError, which is neither reference behaviour
         // nor a sanctioned incompleteness signal.
         subtask.onCancel = () => { };
+        // A24 (contracts/embedder-api.md §"Functions and async"): a marked import
+        // is handed a fresh `AbortSignal` after its WIT-declared parameters. The
+        // mark controls the SIGNATURE UNCONDITIONALLY — a marked function receives
+        // a signal on every call, including the paths where it can never fire
+        // (sync-typed, eager resolve, `deferCancel`) — so the host's arity is a
+        // property of its declaration, not of how a particular call happened to
+        // go. `new AbortController()` is evaluated only for marked imports, which
+        // keeps bare engine shells with no `AbortController` off this path for the
+        // whole unmarked corpus.
+        const controller = abortable ? new AbortController() : null;
         const args = onStart();
-        const raw = hostFn(...args);
+        const raw = controller === null
+            ? hostFn(...args)
+            : hostFn(...args, controller.signal);
         const toResults = (v) => ft.results.length === 0 ? [] : [v];
         if (isPromiseLike(raw)) {
             if (!opts.async) {
@@ -1817,6 +1943,16 @@ export function createLoweredImport(input) {
             }
             const promise = Promise.resolve(raw).then((v) => {
                 store.pendingHostCalls.delete(promise);
+                // A23: the subtask may already be resolved when the host promise
+                // settles — the discard `onCancel` below resolved it
+                // CANCELLED_BEFORE_RETURNED (the only pre-settle resolver on this
+                // arm). The value has no addressee, and `onResolve` would run
+                // straight into its `state === STARTED` assert ("on_resolve on a
+                // subtask that never started") and park that AssertionError on
+                // `store.hostFailure`, poisoning whatever unrelated embedder call
+                // came next.
+                if (subtask.resolved())
+                    return;
                 try {
                     onResolve(toResults(v));
                 }
@@ -1825,9 +1961,64 @@ export function createLoweredImport(input) {
                 }
             }, (e) => {
                 store.pendingHostCalls.delete(promise);
+                // Same guard, different reason: a rejection of a RENOUNCED call is
+                // not a host failure. The guest cancelled and was told so; surfacing
+                // the rejection would fail an unrelated later call with the error of
+                // an operation nobody is waiting for.
+                if (subtask.resolved())
+                    return;
                 store.hostFailure = e;
             });
             store.pendingHostCalls.add(promise);
+            if (!deferCancel) {
+                // A23 DISCARD (contracts/embedder-api.md §"Functions and async";
+                // polyengine#241) — the reference's prompt-cancel host,
+                // `on_cancel = () => on_resolve(None)` (definitions.py canon_lower's
+                // null branch, line ~2267).
+                //
+                // This runs synchronously inside `canon_subtask_cancel`, which already
+                // set `cancellationRequested` before calling us (the assert in
+                // `onResolve`'s null branch relies on that ordering). `onResolve(null)`
+                // arms the SUBTASK event — a delivery-time thunk — and resolves
+                // CANCELLED_BEFORE_RETURNED, so the built-in's `finish()` tail consumes
+                // the event, `deliverResolve` releases the lenders (the #106 class,
+                // discharged exactly as a RETURNED delivery would), and BOTH cancel
+                // forms return the state without blocking. The null path lowers
+                // nothing, so there is no realloc re-entry from inside a built-in.
+                //
+                // The renounced call can no longer wake the guest, so it must stop
+                // counting as externally-wakeable for the driver's deadlock probe:
+                // deregister it NOW. (The settle continuation above also deletes;
+                // `Set.delete` is idempotent.)
+                subtask.onCancel = () => {
+                    store.pendingHostCalls.delete(promise);
+                    onResolve(null);
+                    if (controller !== null) {
+                        // A24: tell the host its result was discarded, so it can stop the
+                        // underlying operation — clear a timer, abort a fetch, close a
+                        // dial. Reachable only from this arm by construction: a
+                        // `deferCancel()` import never discards, so its signal never
+                        // fires.
+                        //
+                        // Deferred one microtask. This closure runs SYNCHRONOUSLY inside
+                        // `canon_subtask_cancel`, i.e. inside a live guest activation, and
+                        // host abort listeners must not execute there — that is the
+                        // issue-#24 attribution class, plus arbitrary re-entrancy into a
+                        // guest mid-built-in. `Promise.resolve().then`, not
+                        // `queueMicrotask`: the latter does not exist in bare engine
+                        // shells (see jspi/bridge.ts's SENTINEL_TICK note).
+                        //
+                        // The resulting order is: the guest observes
+                        // CANCELLED_BEFORE_RETURNED first, the host observes the abort a
+                        // tick later. Any settlement the abort provokes (typically an
+                        // `AbortError` rejection) arrives at the settle continuation above
+                        // with the subtask already resolved, so it lands on the A23
+                        // resolved-subtask guards and is discarded like any other late
+                        // settlement — never a `store.hostFailure`.
+                        Promise.resolve().then(() => controller.abort());
+                    }
+                };
+            }
         }
         else {
             onResolve(toResults(raw));

package/esm/exec/executor.js

@@ -10,7 +10,7 @@
 //   - component hash verification against plan.component
 import { Trap } from "../cabi/trap.js";
 import { ComponentInstanceState, Store } from "../task/mod.js";
-import { anySuspendingImport, assertModeConsistent, chooseMode, isSuspending, planNeedsSuspension, suspendingImport, trampolineCanBlock, trampolineNeedsSuspension, } from "../jspi/mod.js";
+import { anySuspendingImport, assertModeConsistent, chooseMode, isAbortable, isDeferCancel, isSuspending, planNeedsSuspension, suspendingImport, trampolineCanBlock, trampolineNeedsSuspension, } from "../jspi/mod.js";
 import { loadPlan, PlanError, resourceIndexOfDefined, } from "../plan/loader.js";
 import { CONSTRUCTOR_SYNC_ENTRY, createDtorEntry, createLiftedFunction, createLoweredImport, LiveMemory, newStats, } from "./boundary.js";
 import { createTrampoline, createUnsafeIntrinsic, TranscodeMemory, } from "../intrinsics/mod.js";
@@ -931,6 +931,19 @@ class Executor {
         const ft = this.funcType(decl.type, `import '${label}'`);
         const opts = this.resolveOptions(decl.options);
         const suspendable = isSuspending(value);
+        // A23 (contracts/embedder-api.md §"Functions and async"): does this import
+        // opt out of cancel-discard? Unlike `suspendable` above, this needs no
+        // executor-state detour — the brand is consumed by `createLoweredImport`
+        // itself (it only decides which `onCancel` the lowered import installs, not
+        // whether the CoreFn gets wrapped), so nothing downstream has to read a
+        // brand off a replaced function identity.
+        const deferCancel = isDeferCancel(value);
+        // A24 (same section): does this import want a per-call `AbortSignal`?
+        // Read exactly like `deferCancel` above and for the same reason — the
+        // brand is consumed inside `createLoweredImport`, which mints the
+        // controller and appends the signal itself, so no function identity is
+        // replaced downstream of the read.
+        const abortable_ = isAbortable(value);
         // The Suspending-wrap decision is taken in `importValue`, which sees the
         // trampoline only AFTER `createTrampoline`'s trap-recording wrapper has
         // replaced this function's identity — a brand on the CoreFn would die
@@ -948,6 +961,8 @@ class Executor {
             stats: this.stats,
             mode: this.suspensionMode,
             suspendable,
+            deferCancel,
+            abortable: abortable_,
         });
     }
     /**

package/esm/intrinsics/async_builtins.js

@@ -414,8 +414,11 @@ export function createSubtaskCancel(decl, inst, mode = "plain") {
                 // rule (fact_calls.ts). A callee with a pending (undeliverable)
                 // cancel sits parked non-cancellably, which is determinate, so the
                 // genuine BLOCKED answer is still immediate. Host-import subtasks
-                // carry no callee task: their onCancel is a no-op and their state
-                // cannot be mid-hop, so the pre-jspi immediate answer stands.
+                // carry no callee task, and their state cannot be mid-hop: the
+                // default (A23) onCancel resolves them before this branch is ever
+                // reached, and a `deferCancel` import's no-op onCancel leaves them
+                // simply unresolved — either way the pre-jspi immediate answer
+                // stands.
                 //
                 // NAMED DIVERGENCE (docs/architecture.md §6, #92): this park makes
                 // the async built-in non-atomic — other ready threads may run while

package/esm/jspi/suspending.js

@@ -11,5 +11,10 @@
 // Layering: this module was import-free on purpose (jspi/ stays standalone);
 // A9 relaxes that to "imports `@polyengine/protocol` only" — the protocol package
 // is itself dependency-free, so jspi/ still pulls in no runtime machinery.
-// The embedder surface re-exports `suspending` from `@polyengine/runtime/embedder`.
-export { anySuspendingImport, isSuspending, suspending } from "@polyengine/protocol";
+// A23 (`deferCancel`/`isDeferCancel`) and A24 (`abortable`/`isAbortable`)
+// ride the same re-export: they are the other per-declaration host-import
+// marks, they live in the same dependency-free package, and
+// `exec/executor.ts` reads all three through `jspi/mod.ts`.
+// (Host modules import the marks from `@polyengine/protocol` directly —
+// the embedder surface stopped re-exporting the vocabulary at A22.)
+export { abortable, anySuspendingImport, deferCancel, isAbortable, isDeferCancel, isSuspending, suspending, } from "@polyengine/protocol";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@polyengine/runtime",
-  "version": "0.5.0",
+  "version": "0.5.1",
   "description": "A WebAssembly Component Model host for JavaScript engines: plan executor, canonical ABI, 0.3 task scheduler, JSPI bridge, and embedder API.",
   "homepage": "https://github.com/polymorph-components/polyengine#readme",
   "repository": {
@@ -55,7 +55,7 @@
     "access": "public"
   },
   "dependencies": {
-    "@polyengine/protocol": "^0.2.2"
+    "@polyengine/protocol": "^0.2.3"
   },
   "_generatedBy": "dnt@0.43.2"
 }

package/types/embedder/copy.d.ts

@@ -17,7 +17,7 @@ export declare const COPY_URL: string;
  * @internal — copy-identity constant for the A9 multi-copy diagnostics; not
  * host-facing.
  */
-export declare const RUNTIME_VERSION = "0.5.0";
+export declare const RUNTIME_VERSION = "0.5.1";
 /**
  * Compose a cross-copy diagnostic: what was foreign, which copy is speaking,
  * the census of every copy in the graph, and the by-value remediation.

package/types/exec/boundary.d.ts

@@ -336,6 +336,19 @@ export declare function createLoweredImport(input: {
     mode: SuspensionMode;
     /** Host fn carries the `suspending()` brand (embedder-api.md A1). */
     suspendable: boolean;
+    /**
+     * Host fn carries the `deferCancel()` brand (embedder-api.md A23): the
+     * import must run to completion, so a cancellation is accepted and ignored
+     * instead of taking the default discard.
+     */
+    deferCancel: boolean;
+    /**
+     * Host fn carries the `abortable()` brand (embedder-api.md A24): every call
+     * receives a fresh `AbortSignal` appended after the WIT-declared params, and
+     * the runtime aborts it when — and only when — the call is discarded by a
+     * guest cancellation.
+     */
+    abortable: boolean;
 }): CoreFn;
 /**
  * The callback-ABI dispatch loop of `canon_lift` (definitions.py lines

package/types/jspi/suspending.d.ts

@@ -1 +1 @@
-export { anySuspendingImport, isSuspending, suspending } from "@polyengine/protocol";
+export { abortable, anySuspendingImport, deferCancel, isAbortable, isDeferCancel, isSuspending, suspending, } from "@polyengine/protocol";