@polyengine/runtime 0.5.0 → 0.6.0

package/esm/cabi/async_values.js

@@ -26,8 +26,9 @@ import { assert_, trapIf } from "./trap.js";
 import { contains, fmtValType } from "./types.js";
 import { CopyState, ErrorContext, ReadableFutureEnd, ReadableStreamEnd, SharedFutureImpl, sameElemType, SharedStreamImpl, } from "../task/streams.js";
 /**
- * Diagnostic for a handle-table entry that carries the A9 error-context brand
- * without being one of THIS copy's `ErrorContext`s (amendment A9, issue #83).
+ * Diagnostic for a handle-table entry that carries the error-context brand
+ * without being one of THIS copy's `ErrorContext`s (contracts/embedder-api.md
+ * §"Module identity").
  *
  * A backstop, deliberately: the embedder's lowering site (embedder/values.ts)
  * refuses a foreign error-context before it can ever reach a handle table, so
@@ -46,7 +47,7 @@ export function errorContextTrapMessage(where, e) {
     return `${where}: this error-context was minted by a DIFFERENT polyengine ` +
         `runtime copy and cannot be used through this one` +
         `${census === "" ? "" : ` (${census})`} ` +
-        `(contracts/embedder-api.md amendment A9, issue #83)`;
+        `(contracts/embedder-api.md §"Module identity")`;
 }
 /** definitions.py `contains_borrow` — async values may never carry borrows. */
 function containsBorrow(t) {
@@ -81,7 +82,7 @@ EndT, elem, what) {
     const holder = end.shared;
     const store = inst.store;
     if (holder.boundStore != null && store != null) {
-        // A9: when several runtime copies are loaded, "a second store" is very
+        // module identity: when several runtime copies are loaded, "a second store" is very
         // often "a second COPY" — the shared object was minted by one runtime and
         // is being driven by another. The two stores are indistinguishable from
         // here (stores carry no copy identity), so the census is appended as the
@@ -94,7 +95,7 @@ EndT, elem, what) {
                     `another)`));
     }
     holder.boundStore ??= store;
-    // Host-wrapper re-arm hook (#162, embedder-api amendment A15): the readable
+    // Host-wrapper re-arm hook (#162, contracts/embedder-api.md §"Streams and futures"): the readable
     // end just left a guest table, so whoever receives it can act on it again.
     // See `bindOnLower` in exec/host_streams.ts for the retention rule.
     end.shared.onLifted?.(inst);

package/esm/cabi/bulk_lists.js

@@ -67,11 +67,6 @@ const FLOAT_CTORS = {
     f32: Float32Array,
     f64: Float64Array,
 };
-/** Kinds these helpers handle (besides them, u8 has its own path). */
-export function isBulkListKind(kind) {
-    return kind === "bool" || kind in INT_CTORS || kind in BIG_CTORS ||
-        kind in FLOAT_CTORS;
-}
 function viewOf(ctor, mem, ptr, length) {
     if (!PLATFORM_LITTLE_ENDIAN)
         return null;

package/esm/cabi/context.js

@@ -16,6 +16,17 @@ export function requireMemory(opts) {
     assert_(opts.memory !== null, "canonical option `memory` required");
     return opts.memory;
 }
+/**
+ * Brand marking a value as a REAL component instance (task/mod.ts
+ * `ComponentInstanceState`), as opposed to the many structural
+ * `ComponentInstanceLike` stand-ins — imported/host resources carry no
+ * instance at all, and test harnesses supply bare `{handles, mayLeave}`
+ * doubles. cabi must not depend on task/, so the symbol lives here and
+ * `ComponentInstanceState` declares it; cabi/handles.ts `isComponentInstance`
+ * is the only reader. `ComponentInstanceLike` stays deliberately structural:
+ * the brand is NOT part of it.
+ */
+export const COMPONENT_INSTANCE = Symbol("polyengine.ComponentInstance");
 export class LiftLowerContext {
     opts;
     inst;
@@ -30,9 +41,8 @@ export class LiftLowerContext {
      * with `may_leave` cleared, so a realloc that lowers an import traps
      * (`canon_lower`'s `trap_if(not ...may_leave)`, implemented here by
      * exec/boundary.ts `createLoweredImport`). That bracket is implemented
-     * below. What remains deferred is only the reference's routing of the call
-     * through `canon_lift`; upstream component-model PR #705 removes that
-     * routing, leaving this bracket as the whole story. polyengine issue #147.
+     * below, and it is the whole story: the pinned reference does not route
+     * the call through `canon_lift` (CM#705). polyengine issue #147.
      */
     reallocate(old, oldByteLength, alignment, newByteLength) {
         const realloc = this.opts.realloc;

package/esm/cabi/flatten.js

@@ -4,15 +4,7 @@ import { despecialize, discriminantType, } from "./types.js";
 import { requireMemory } from "./context.js";
 export const MAX_FLAT_PARAMS = 16;
 export const MAX_FLAT_ASYNC_PARAMS = 4;
-// Mutable to mirror run_tests.py toggling definitions.MAX_FLAT_RESULTS.
-export let MAX_FLAT_RESULTS = 1;
-// Test-only mirror of run_tests.py's constant toggling; not for production
-// use (naming convention: see `schedulerSeedForTesting`).
-export function setMaxFlatResultsForTesting(n) {
-    const prev = MAX_FLAT_RESULTS;
-    MAX_FLAT_RESULTS = n;
-    return prev;
-}
+export const MAX_FLAT_RESULTS = 1;
 export function flattenFunctype(opts, ft, context) {
     let flatParams = flattenTypes(ft.params, opts);
     let flatResults = flattenTypes(ft.results, opts);
@@ -62,6 +54,46 @@ export function flattenFunctype(opts, ft, context) {
 export function flattenTypes(ts, opts) {
     return ts.flatMap((t) => flattenType(t, opts));
 }
+/**
+ * `flattenTypes(ts, opts).length`, memoized on (ts array identity, ptrType).
+ *
+ * Every arm of `flattenType` reaches `opts` only through
+ * `requireMemory(opts).ptrType()` (string/list-without-length read the
+ * pointer width; every other arm is opts-free or recurses structurally), so
+ * the flattened element count is a pure function of `(ts, ptrType)` — one
+ * map per pointer width is the whole of the cache key. `ts` is always a
+ * plan-owned `ft.params`/`ft.results` array, the same stability argument
+ * `spillTupleType` (values.ts) relies on, so its identity is a valid key.
+ *
+ * This caches the COUNT, not the flattened array: `values.ts`'s only use of
+ * `flattenTypes` on the per-call path is `.length`, and a cached number has
+ * no aliasing/mutation hazard to guard (a cached array would need freezing
+ * plus a lossy `readonly`-to-mutable cast at every read site — the shape
+ * this replaced). Callers that need the actual flat types (instantiate-time
+ * `flattenFunctype`) still call `flattenTypes` directly, uncached; that path
+ * runs once per function, not once per call, so it doesn't need this.
+ *
+ * The null-memory path is deliberately NOT cached: `requireMemory` throws
+ * when `opts.memory` is null (for any `ts` containing a string/unbounded
+ * list), and that throw must still surface on every call, not just the
+ * first.
+ */
+const flatCountCacheByPtrType = {
+    i32: new WeakMap(),
+    i64: new WeakMap(),
+};
+export function flatCount(ts, opts) {
+    const mem = opts.memory;
+    if (mem === null)
+        return flattenTypes(ts, opts).length;
+    const cache = flatCountCacheByPtrType[mem.ptrType()];
+    const hit = cache.get(ts);
+    if (hit !== undefined)
+        return hit;
+    const count = flattenTypes(ts, opts).length;
+    cache.set(ts, count);
+    return count;
+}
 export function flattenType(t, opts) {
     const d = despecialize(t);
     switch (d.kind) {

package/esm/cabi/handles.js

@@ -8,11 +8,12 @@
 //     current_instance() from the running thread;
 //   - canon_resource_drop routes the dtor through `callDtorGated` below,
 //     which reconstructs the reference's store.lift/store.lower bracket
-//     (may_enter gating + trap poisoning) around the destructor call (#85).
+//     (entry refusal + trap poisoning) around the destructor call (#85).
 //     Host-initiated drops do NOT come here: they run the dtor through the
 //     real lift harness (`hostDtorCall`, exec/boundary.ts) — see #160.
 import { assert_, Trap, trap, trapIf } from "./trap.js";
-import { NeedsJspi, notifyInstancePoisoned, PendingCapability, withPoisonCause, } from "../task/scheduler.js";
+import { NeedsJspi, notifyInstancePoisoned, PendingCapability, entryRefusal, } from "../task/scheduler.js";
+import { COMPONENT_INSTANCE } from "./context.js";
 export class Table {
     static MAX_LENGTH = 2 ** 28 - 1;
     array = [null];
@@ -111,12 +112,24 @@ export function canonResourceNew(inst, rt, rep) {
     const h = new ResourceHandle(rt, rep, true);
     return inst.handles.add(h);
 }
-function asGate(x) {
+/**
+ * Is `x` a REAL component instance (`task/mod.ts` `ComponentInstanceState`),
+ * as opposed to something that has no instance behind it at all?
+ *
+ * Two populations must answer false, and both are load-bearing for
+ * `callDtorGated`: an imported/host-implemented resource, whose
+ * `ResourceTypeInfo.impl` is `null` by construction (exec/executor.ts
+ * `bindImportedResources`), and the bare `{handles, mayLeave}` doubles test
+ * harnesses supply — neither has an instance to refuse entry into or to
+ * poison. So this is deliberately NOT a structural match on
+ * `ComponentInstanceLike`, which those doubles satisfy: it reads the
+ * `COMPONENT_INSTANCE` brand, declared on `ComponentInstanceState` and
+ * defined in ./context.ts so that cabi does not have to import task/.
+ */
+function isComponentInstance(x) {
     if (x === null || typeof x !== "object")
         return null;
-    const g = x;
-    return typeof g.mayEnterFrom === "function" &&
-        typeof g.enterFrom === "function" && typeof g.leaveTo === "function"
+    return x[COMPONENT_INSTANCE] === true
         ? x
         : null;
 }
@@ -125,11 +138,8 @@ function isThenable(v) {
         typeof v.then === "function";
 }
 /**
- * Invoke a resource destructor through the reference's entry bracket.
- *
- * definitions.py `canon_resource_drop` (line 2319) does not call `rt.dtor`
- * directly. It builds the dtor into a function instance and calls it through
- * `Store.lift` / `Store.lower` (lines 2330-2333):
+ * Invoke a resource destructor, as definitions.py `canon_resource_drop`
+ * (@ 2f13265) does — through `Store.lift`/`Store.lower`:
  *
  * ```python
  *   dtor = rt.dtor or (lambda rep: [])
@@ -138,69 +148,63 @@ function isThenable(v) {
  *   caller([h.rep])
  * ```
  *
- * so the dtor inherits `Store.lift`'s gate verbatim (lines 579-584):
- * `trap_if(not inst.may_enter_from(caller))`, `enter_from(caller)`, the call,
- * then `leave_to(caller)` — which a trap skips, leaving the *implementing*
- * instance permanently unenterable (poisoned).
- *
- * Two consequences that are easy to get wrong, both taken from the reference
- * rather than from intuition:
+ * That lift carries NO gate (CM#705): dropping a handle whose implementing
+ * instance is mid-execution is VALID, including the dtor-less case.
  *
- *  - the bracket runs even when `rt.dtor is None` (the `or (lambda rep: [])`
- *    above), so a dtor-less resource whose impl instance is mid-execution is
- *    still a trap. `may_enter_from`/`enter_from` walk `entering_set(caller)`
- *    (line 230), which is empty when the caller *is* the implementing
- *    instance — that, not a special case, is the same-instance exemption:
- *    a component dropping a handle to its own resource never traps.
- *  - poisoning applies to `rt.impl`, not to the dropping instance. The
- *    dropper's own bracket (its `Store.lift` frame) is broken by the same
- *    propagating trap at its own level; here only the callee is retired.
+ * What this adds is polyengine's per-instance poisoning divergence, and it
+ * applies to `rt.impl`, not to the dropping instance: a trap out of the dtor
+ * buries the implementing instance (refusal names the original trap,
+ * polyengine#145; its live stream/future ends are retired, #66). The
+ * dropper is poisoned, if at all, by the same trap propagating at its own
+ * level. `entryRefusal`'s `caller !== callee` guard keeps a component
+ * dropping a handle to its OWN resource admissible even against a marked
+ * instance.
  *
  * Capability signals (`NeedsJspi`, `PendingCapability`) are not traps — see
- * `isCapabilitySignal` in exec/boundary.ts — so they release the gate.
+ * `isCapabilitySignal` in exec/boundary.ts — so they do not poison.
  *
  * SCOPE (#160): this is the **guest-initiated** path only. A guest-initiated
  * drop must complete synchronously (the reference lifts the dtor with
  * `async_ = False`), so a thenable here is a trap. The host-initiated path
- * used to share this function with an `allowAsync` flag that held the entry
- * bracket across the dtor's promise; it now goes through the full lift
- * harness instead (`hostDtorCall` in exec/boundary.ts), which is what
- * definitions.py actually does and what unwedges #160.
+ * goes through the full lift harness instead (`hostDtorCall` in
+ * exec/boundary.ts), which is what definitions.py actually does.
  */
 export function callDtorGated(rt, rep, caller) {
-    const impl = asGate(rt.impl);
+    const impl = isComponentInstance(rt.impl);
     // Always the raw synchronous dtor: `dtorHost` is the host path's lifted
     // entry, which is not callable from inside a guest activation.
     const dtorFn = rt.dtor;
-    // No gate available: an imported (host-implemented) resource has
-    // `impl === null` by construction (executor.ts `bindImportedResources`),
-    // and there is no component instance to gate entry into. Test doubles that
-    // supply a bare `{handles, mayLeave}` instance land here too.
+    // No component instance behind the resource: an imported (host-implemented)
+    // resource has `impl === null` by construction (executor.ts
+    // `bindImportedResources`), so there is no instance to refuse entry into and
+    // none to poison. Test doubles that supply a bare `{handles, mayLeave}`
+    // instance land here too — see `isComponentInstance`.
     if (impl === null) {
         const r = dtorFn?.(rep);
         trapIf(isThenable(r), "resource destructor did not complete synchronously");
         return;
     }
-    // definitions.py `entering_set` (line 230): `self_and_ancestors() -
-    // caller.self_and_ancestors()`. The caller is only meaningful when it is a
-    // real component instance; a host-initiated drop passes null, which is the
-    // reference's `caller = None` (Store.invoke).
-    const callerInst = asGate(caller) === null ? null : caller;
+    // The caller is only meaningful when it is a real component instance; a
+    // host-initiated drop passes null, which is the reference's `caller = None`
+    // (Store.invoke). It feeds `entryRefusal`'s `caller !== callee` guard below.
+    const callerInst = isComponentInstance(caller) === null ? null : caller;
     // A poisoned target's refusal names the original trap (polyengine#145).
-    if (!impl.mayEnterFrom(callerInst)) {
-        trap(withPoisonCause(impl, "cannot enter component instance"));
+    // `callerInst` can legitimately BE `impl` here (a guest dropping its own
+    // resource): `entryRefusal`'s self-call guard keeps that entry allowed
+    // even against a marked instance.
+    {
+        const refusal = entryRefusal(impl, callerInst, "cannot enter component instance");
+        if (refusal !== null)
+            trap(refusal);
     }
-    impl.enterFrom(callerInst);
     const poison = (e) => {
-        if (e instanceof NeedsJspi || e instanceof PendingCapability) {
-            // Not a trap: the reference reaches `leave_to` on every execution these
-            // stand in for, so the instance stays enterable.
-            impl.leaveTo(callerInst);
+        // Capability signals are not traps: the operation they stand in for
+        // completes normally in the reference, so the instance stays healthy.
+        if (e instanceof NeedsJspi || e instanceof PendingCapability)
             return;
-        }
-        // `leave_to` is NOT reached (the gate stays taken, permanently), and the
-        // poisoned instance's live stream/future ends are retired (#66) through
-        // the same seam fact_calls.ts uses for its bracket-break sites.
+        // A real trap buries the implementing instance, and its live
+        // stream/future ends are retired (#66) through the same seam
+        // fact_calls.ts uses for its poisoning sites.
         notifyInstancePoisoned(impl, e);
     };
     let out;
@@ -219,7 +223,6 @@ export function callDtorGated(rt, rep, caller) {
         poison(e);
         throw e;
     }
-    impl.leaveTo(callerInst);
 }
 export function canonResourceDrop(inst, rt, i) {
     trapIf(!inst.mayLeave, "may_leave violation");

package/esm/cabi/layout.js

@@ -2,48 +2,140 @@
 // Size`): byte layout of component values in linear memory.
 import { assert_ } from "./trap.js";
 import { ptrSize } from "./memory.js";
-import { despecialize, discriminantType, } from "./types.js";
+import { despecialize, discriminantSize, } from "./types.js";
 export function alignTo(ptr, alignment) {
     return Math.ceil(ptr / alignment) * alignment;
 }
-export function alignment(t, ptrType) {
+/**
+ * Layout memo, keyed on type identity — see the despecialization memo in
+ * types.ts for why identity is a sound key.
+ *
+ * One map PER POINTER WIDTH, because layout is a function of both: `string`,
+ * variable-length `list` and the handle types all size off `ptrSize(ptrType)`.
+ * A single map keyed on the type alone would return i32 layouts to a memory64
+ * instance — silently, and with no corpus coverage to catch it, which is why
+ * layout_cache_test.ts pins it explicitly.
+ */
+const layoutsI32 = new WeakMap();
+const layoutsI64 = new WeakMap();
+export function layoutOf(t, ptrType) {
+    const cache = ptrType === "i32" ? layoutsI32 : layoutsI64;
+    const hit = cache.get(t);
+    if (hit !== undefined)
+        return hit;
+    const l = computeLayout(t, ptrType);
+    // Cached only after the computation returns, so a type that trips
+    // `elemSizeRecord`'s "empty record" assert keeps tripping it on every call
+    // instead of leaving a half-built node behind.
+    cache.set(t, l);
+    return l;
+}
+/** Frozen for the same reason the despecialized nodes are: the node is now
+ * shared by every caller, and the engine is a better guarantor of that than
+ * an audit of today's call sites. */
+function mkLayout(d, align, size, fieldOffsets = null, discSize = 0, payloadOffset = 0) {
+    // The premise the whole cache rests on: every alignment is a power of two.
+    // It is what lets `load`/`store` substitute `ptr % align === 0` for
+    // `ptr === alignTo(ptr, align)`, and what lets the retained field/payload
+    // offsets be base-relative (the aligned base factors out of `alignTo`).
+    // True by induction over `computeLayout` — asserted here so it stays true,
+    // once per type rather than per value.
+    assert_(align > 0 && (align & (align - 1)) === 0, "layout alignment must be a power of two");
+    return Object.freeze({
+        d,
+        align,
+        size,
+        fieldOffsets: fieldOffsets === null ? null : Object.freeze(fieldOffsets),
+        discSize,
+        payloadOffset,
+    });
+}
+/**
+ * definitions.py `alignment` (line 1201) and `elem_size` (line 1259) fused:
+ * the two functions switch over the same despecialized kinds, and every hot
+ * caller wants both. The compound kinds delegate to the per-kind kernels
+ * below, which stay the line-by-line spec mirror.
+ */
+function computeLayout(t, ptrType) {
     const d = despecialize(t);
     switch (d.kind) {
         case "bool":
         case "s8":
         case "u8":
-            return 1;
+            return mkLayout(d, 1, 1);
         case "s16":
         case "u16":
-            return 2;
+            return mkLayout(d, 2, 2);
         case "s32":
         case "u32":
         case "f32":
         case "char":
-            return 4;
+            return mkLayout(d, 4, 4);
         case "s64":
         case "u64":
         case "f64":
-            return 8;
+            return mkLayout(d, 8, 8);
         case "string":
-            return ptrSize(ptrType);
+            return mkLayout(d, ptrSize(ptrType), 2 * ptrSize(ptrType));
         case "error-context":
-            return 4;
-        case "list":
-            return alignmentList(d.element, d.length ?? null, ptrType);
+            return mkLayout(d, 4, 4);
+        case "list": {
+            const len = d.length ?? null;
+            return mkLayout(d, alignmentList(d.element, len, ptrType), elemSizeList(d.element, len, ptrType));
+        }
         case "record":
-            return alignmentRecord(d.fields, ptrType);
+            return recordLayout(d, d.fields, ptrType);
         case "variant":
-            return alignmentVariant(d.cases, ptrType);
+            return variantLayout(d, d.cases, ptrType);
         case "flags":
-            return alignmentFlags(d.labels);
+            return mkLayout(d, alignmentFlags(d.labels), elemSizeFlags(d.labels));
+        // `own`/`borrow` are a constant 4 and their `ResourceTypeInfo` is NOT
+        // walked: that graph cycles back to live instance state (see the
+        // `valTypeEqual` contract note in types.ts).
         case "own":
         case "borrow":
         case "stream":
         case "future":
-            return 4;
+            return mkLayout(d, 4, 4);
     }
 }
+/**
+ * The field offsets are exactly the intermediate `p` that
+ * `elemSizeRecord` computes and discards — the same accumulation, retained
+ * rather than re-derived, so the offsets cannot drift from the spec's own
+ * arithmetic. Size and alignment still come from the kernels themselves,
+ * which remain the single source of truth (and the "empty record" assert).
+ *
+ * They are BASE-RELATIVE, where the spec realigns a running absolute `p`.
+ * The two agree because `load`/`store` have already asserted that the base is
+ * aligned to this record's own alignment, which is the max over its fields',
+ * and alignments are powers of two: `alignTo(base + p, a) == base +
+ * alignTo(p, a)` whenever `a` divides `base`.
+ */
+function recordLayout(d, fields, ptrType) {
+    const offsets = [];
+    let p = 0;
+    for (const f of fields) {
+        p = alignTo(p, alignment(f.type, ptrType));
+        offsets.push(p);
+        p += elemSize(f.type, ptrType);
+    }
+    return mkLayout(d, alignmentRecord(fields, ptrType), elemSizeRecord(fields, ptrType), offsets);
+}
+/**
+ * `payloadOffset` is `elemSizeVariant`'s intermediate `s` after it has been
+ * aligned up to `maxCaseAlignment` — the offset every case payload sits at.
+ * Base-relative for the same reason as the record offsets above: the variant's
+ * alignment is at least `maxCaseAlignment`, so the asserted-aligned base
+ * factors out of the `alignTo`.
+ */
+function variantLayout(d, cases, ptrType) {
+    const discSize = discriminantSize(cases.length);
+    return mkLayout(d, alignmentVariant(cases, ptrType), elemSizeVariant(cases, ptrType), null, discSize, alignTo(discSize, maxCaseAlignment(cases, ptrType)));
+}
+export function alignment(t, ptrType) {
+    return layoutOf(t, ptrType).align;
+}
 export function alignmentList(elemType, maybeLength, ptrType) {
     if (maybeLength !== null)
         return alignment(elemType, ptrType);
@@ -56,7 +148,10 @@ export function alignmentRecord(fields, ptrType) {
     return a;
 }
 export function alignmentVariant(cases, ptrType) {
-    return Math.max(alignment(discriminantType(cases), ptrType), maxCaseAlignment(cases, ptrType));
+    // definitions.py takes `alignment(discriminant_type(cases))`; the
+    // discriminant is always u8/u16/u32, whose alignment equals its size, so
+    // `discriminantSize` is the same number without allocating the PrimType.
+    return Math.max(discriminantSize(cases.length), maxCaseAlignment(cases, ptrType));
 }
 export function maxCaseAlignment(cases, ptrType) {
     let a = 1;
@@ -76,42 +171,7 @@ export function alignmentFlags(labels) {
     return 4;
 }
 export function elemSize(t, ptrType) {
-    const d = despecialize(t);
-    switch (d.kind) {
-        case "bool":
-        case "s8":
-        case "u8":
-            return 1;
-        case "s16":
-        case "u16":
-            return 2;
-        case "s32":
-        case "u32":
-        case "f32":
-        case "char":
-            return 4;
-        case "s64":
-        case "u64":
-        case "f64":
-            return 8;
-        case "string":
-            return 2 * ptrSize(ptrType);
-        case "error-context":
-            return 4;
-        case "list":
-            return elemSizeList(d.element, d.length ?? null, ptrType);
-        case "record":
-            return elemSizeRecord(d.fields, ptrType);
-        case "variant":
-            return elemSizeVariant(d.cases, ptrType);
-        case "flags":
-            return elemSizeFlags(d.labels);
-        case "own":
-        case "borrow":
-        case "stream":
-        case "future":
-            return 4;
-    }
+    return layoutOf(t, ptrType).size;
 }
 export function elemSizeList(elemType, maybeLength, ptrType) {
     if (maybeLength !== null)
@@ -128,7 +188,8 @@ export function elemSizeRecord(fields, ptrType) {
     return alignTo(s, alignmentRecord(fields, ptrType));
 }
 export function elemSizeVariant(cases, ptrType) {
-    let s = elemSize(discriminantType(cases), ptrType);
+    // See `alignmentVariant`: size of u8/u16/u32 == `discriminantSize`.
+    let s = discriminantSize(cases.length);
     s = alignTo(s, maxCaseAlignment(cases, ptrType));
     let cs = 0;
     for (const c of cases) {

package/esm/cabi/load.js

@@ -2,19 +2,23 @@
 import { assert_, trapIf } from "./trap.js";
 import { bytesOf, loadIntS, loadIntU, loadPtr } from "./memory.js";
 import { decodeI32AsFloat, decodeI64AsFloat } from "./float.js";
-import { alignment, alignTo, elemSize, elemSizeFlags, maxCaseAlignment, } from "./layout.js";
+import { elemSizeFlags, layoutOf } from "./layout.js";
 import { convertI32ToChar, loadString } from "./strings.js";
 import { requireMemory } from "./context.js";
 import { tryLoadNumericList } from "./bulk_lists.js";
 import { liftBorrow, liftOwn } from "./handles.js";
-import { despecialize, discriminantType, } from "./types.js";
 import { liftErrorContext, liftFuture, liftStream, } from "./async_values.js";
 export const MAX_LIST_BYTE_LENGTH = (1 << 28) - 1;
 export function load(cx, ptr, t) {
     const mem = requireMemory(cx.opts);
-    assert_(ptr === alignTo(ptr, alignment(t, mem.ptrType())), "load misaligned");
-    assert_(ptr + elemSize(t, mem.ptrType()) <= mem.length, "load OOB");
-    const d = despecialize(t);
+    // One cached layout node per (type, pointer width) — issue #261; it carries
+    // the despecialized type too, so this is the only map lookup on the path.
+    const L = layoutOf(t, mem.ptrType());
+    // Alignments are always powers of two, so `ptr % align === 0` decides
+    // exactly what `ptr === alignTo(ptr, align)` did, without the float divide.
+    assert_(ptr % L.align === 0, "load misaligned");
+    assert_(ptr + L.size <= mem.length, "load OOB");
+    const d = L.d;
     switch (d.kind) {
         case "bool":
             return convertIntToBool(loadIntU(mem, ptr, 1));
@@ -47,9 +51,11 @@ export function load(cx, ptr, t) {
         case "list":
             return loadList(cx, ptr, d.element, d.length ?? null);
         case "record":
-            return loadRecord(cx, ptr, d.fields);
+            return loadRecord(cx, ptr, d.fields, L.fieldOffsets);
         case "variant":
-            return loadVariant(cx, ptr, d.cases);
+            // discSize is 0 only on the kinds that have no discriminant; inside
+            // this arm `variantLayout` established it as 1|2|4.
+            return loadVariant(cx, ptr, d.cases, L.discSize, L.payloadOffset);
         case "flags":
             return loadFlags(cx, ptr, d.labels);
         case "own":
@@ -77,8 +83,7 @@ export function loadList(cx, ptr, elemType, maybeLength) {
 }
 export function loadListFromRange(cx, ptr, length, elemType) {
     const mem = requireMemory(cx.opts);
-    const size = elemSize(elemType, mem.ptrType());
-    const align = alignment(elemType, mem.ptrType());
+    const { size, align } = layoutOf(elemType, mem.ptrType());
     const byteLengthBig = BigInt(length) * BigInt(size);
     trapIf(byteLengthBig > BigInt(MAX_LIST_BYTE_LENGTH), "list too long");
     const ptrBig = BigInt(ptr);
@@ -88,7 +93,8 @@ export function loadListFromRange(cx, ptr, length, elemType) {
 }
 export function loadListFromValidRange(cx, ptr, length, elemType) {
     const mem = requireMemory(cx.opts);
-    const kind = despecialize(elemType).kind;
+    const L = layoutOf(elemType, mem.ptrType());
+    const kind = L.d.kind;
     // docs/architecture.md §7: list<u8> lifts to a Uint8Array copy.
     if (kind === "u8") {
         return bytesOf(mem, ptr, length).slice();
@@ -100,35 +106,37 @@ export function loadListFromValidRange(cx, ptr, length, elemType) {
     const bulk = tryLoadNumericList(mem, ptr, length, kind);
     if (bulk !== null)
         return bulk;
-    const size = elemSize(elemType, mem.ptrType());
+    const size = L.size;
     const a = [];
     for (let i = 0; i < length; i++) {
         a.push(load(cx, ptr + i * size, elemType));
     }
     return a;
 }
-export function loadRecord(cx, ptr, fields) {
-    const mem = requireMemory(cx.opts);
+/**
+ * `offsets[i]` is field i's byte offset from `ptr`, precomputed on the layout
+ * node, so the loop is an indexed read rather than the per-field
+ * `alignTo`/`alignment`/`elemSize` recomputation it used to be (issue #261).
+ * Taking the offsets rather than the whole `Layout` keeps the function
+ * self-consistent: its two arguments are the ones the result depends on, and
+ * there is no unchecked "these came from the same type" invariant to violate.
+ */
+export function loadRecord(cx, ptr, fields, offsets) {
     const record = {};
-    let p = ptr;
-    for (const field of fields) {
-        p = alignTo(p, alignment(field.type, mem.ptrType()));
-        record[field.label] = load(cx, p, field.type);
-        p += elemSize(field.type, mem.ptrType());
+    for (let i = 0; i < fields.length; i++) {
+        const field = fields[i];
+        record[field.label] = load(cx, ptr + offsets[i], field.type);
     }
     return record;
 }
-export function loadVariant(cx, ptr, cases) {
+export function loadVariant(cx, ptr, cases, discSize, payloadOffset) {
     const mem = requireMemory(cx.opts);
-    const discSize = elemSize(discriminantType(cases), mem.ptrType());
     const caseIndex = loadIntU(mem, ptr, discSize);
-    let p = ptr + discSize;
     trapIf(caseIndex >= cases.length, "invalid variant discriminant");
     const c = cases[caseIndex];
-    p = alignTo(p, maxCaseAlignment(cases, mem.ptrType()));
     if (c.type === null)
         return { [c.label]: null };
-    return { [c.label]: load(cx, p, c.type) };
+    return { [c.label]: load(cx, ptr + payloadOffset, c.type) };
 }
 export function loadFlags(cx, ptr, labels) {
     const mem = requireMemory(cx.opts);