@polyengine/runtime 0.5.0 → 0.6.0

package/types/digest/verify.d.ts

@@ -3,17 +3,11 @@ import type { WirePlan } from "../plan/format.js";
 export interface DigestMismatch {
     expected: string;
     actual: string;
-    /** Human-readable description of the first structural divergence found,
-     * or `null` if a divergence exists but no finer-grained cause could be
-     * isolated (e.g. the two canonical JSON trees have the same top-level
-     * shape but the digest still differs — should not happen in practice
-     * since the digest is a pure hash of that JSON, but guarded anyway). */
-    firstDivergence: string | null;
 }
 /**
  * Thrown by generated `instantiate` wrappers when the loaded plan's world
  * digest does not match the constant bindgen embedded at generation time
- * (contracts/digest.md: "fails fast with a structural diff on mismatch").
+ * (contracts/digest.md: "fails fast on mismatch").
  * Raised BEFORE the component is instantiated, so no guest code has run
  * when a caller catches this.
  *
@@ -25,7 +19,7 @@ export declare class WorldDigestMismatchError extends Error {
     readonly name = "WorldDigestMismatchError";
     /** The world these bindings were generated from. */
     readonly world: string;
-    /** The full mismatch report (expected/actual digest, first divergence). */
+    /** The full mismatch report (expected/actual digest). */
     readonly mismatch: DigestMismatch;
     constructor(world: string, mismatch: DigestMismatch);
     /** Digest the generated bindings were built against. */
@@ -36,17 +30,7 @@ export declare class WorldDigestMismatchError extends Error {
 /**
  * Verify `plan`'s computed world digest against `expectedDigest` (the
  * constant bindgen embedded at generation time). Returns `null` on match,
- * or a `DigestMismatch` report naming the first divergent path on
- * mismatch.
+ * or a `DigestMismatch` report on mismatch.
  * @internal
  */
 export declare function verifyWorldDigest(plan: WirePlan, expectedDigest: string): Promise<DigestMismatch | null>;
-/**
- * `diffWorldDigest` — richer variant for tests/tooling: compare against
- * another plan's (or a WIT-derived) canonical JSON directly, walking both
- * trees in parallel to name the first divergent import/export/type path.
- * `expectedCanonicalJson` is normally produced by `crates/bindgen`'s
- * `digest --json` output, or by `computeWorldDigest` on a reference plan.
- * @internal
- */
-export declare function diffWorldDigest(plan: WirePlan, expectedCanonicalJson: string): Promise<DigestMismatch | null>;

package/types/embedder/casing.d.ts

@@ -25,7 +25,7 @@ export declare function pascalCase(label: string): string;
  *
  * The Component Model mangles resource membership into the name itself
  * (`[constructor]counter`, `[method]counter.increment`,
- * `[static]counter.merge`); C0 finding #2 was embedders hand-transcribing
+ * `[static]counter.merge`); embedders would otherwise hand-transcribe
  * these. Assembling and disassembling them is a runtime obligation.
  */
 export type LeafName = {
@@ -45,6 +45,14 @@ export type LeafName = {
 };
 /**
  * Decode a mangled leaf name; unmangled names come back as `plain`.
+ *
+ * An unknown bracket form throws rather than falling back to `plain`
+ * (contracts/embedder-api.md §"Getters and setters (pre-ruling…)", final
+ * paragraph): "the runtime refuses unknown bracket forms in mangled names
+ * loudly at instantiation (rather than misbinding them as plain names — a
+ * `[get]foo` treated as a function named `[get]foo` would be wrong in both
+ * directions)". Getter/setter support (`[get]`/`[set]`, upstream
+ * WebAssembly/component-model#701) is tracked in polyengine#254.
  * @internal — leaf-name demangling, performed by the runtime and by
  * bindgen-generated code.
  */

package/types/embedder/copy.d.ts

@@ -1,6 +1,6 @@
 /**
  * The URL of this copy of the runtime. Identity of the copy.
- * @internal — copy-identity constant for the A9 multi-copy diagnostics; not
+ * @internal — copy-identity constant for the module identity multi-copy diagnostics; not
  * host-facing.
  */
 export declare const COPY_URL: string;
@@ -14,15 +14,15 @@ export declare const COPY_URL: string;
  *
  * INVARIANT: keep in sync with `version` in runtime/deno.json — pinned by
  * runtime/tests/embedder/cross_copy_test.ts.
- * @internal — copy-identity constant for the A9 multi-copy diagnostics; not
+ * @internal — copy-identity constant for the module identity multi-copy diagnostics; not
  * host-facing.
  */
-export declare const RUNTIME_VERSION = "0.5.0";
+export declare const RUNTIME_VERSION = "0.6.0";
 /**
  * Compose a cross-copy diagnostic: what was foreign, which copy is speaking,
  * the census of every copy in the graph, and the by-value remediation.
  *
- * Kept to one line but complete — the whole point of A9's stateful half is
+ * Kept to one line but complete — the whole point of module identity's stateful half is
  * that "recognized but foreign" is a NAMED failure, never a silent
  * adaptation (a foreign `Stream` pumped as an async iterable) and never a
  * misleading generic ("handle is not an error-context").

package/types/embedder/instantiate.d.ts

@@ -10,7 +10,7 @@ export interface ComponentArtifacts {
 }
 /**
  * Untranslated alternative to `ComponentArtifacts` (embedder-api.md
- * amendment A3): hand `instantiate` the raw component plus the translator
+ * §"Module wiring and instantiation"): hand `instantiate` the raw component plus the translator
  * and it runs the translation internally — the pipeline collapses to
  * bytes-in, instance-out.
  *
@@ -33,7 +33,7 @@ export type InstantiateSource = ComponentArtifacts | UntranslatedArtifacts;
  * single-file JSON emitted by build-time translation (`tools/translate`,
  * or `Translator.translateRaw`), carrying the plan and the FACT adapter
  * modules. The production deploy set is `component.wasm` + its envelope +
- * the runtime: no translator ships (embedder-api.md amendment A4).
+ * the runtime: no translator ships (contracts/embedder-api.md §"Module wiring and instantiation").
  *
  * Pure and fetch-agnostic: acquire the two blobs however the platform
  * likes (HTTP, fs, bundler asset) and hand them over. The envelope embeds
@@ -48,7 +48,7 @@ export declare function artifactsFromEnvelope(envelopeJson: string, componentByt
  * guest code runs: generated `instantiate` wrappers call this, verify the
  * plan, and only then delegate to `instantiate` below.
  * @internal — bindgen-generated code only — the digest handshake needs the
- * plan before instantiating (amendment A17).
+ * plan before instantiating (§"Module wiring and instantiation").
  */
 export declare function resolveArtifacts(src: InstantiateSource): Promise<ComponentArtifacts>;
 export interface EmbedderOptions {
@@ -80,7 +80,7 @@ export interface EmbedderInstance {
  */
 export declare function instantiate(source: InstantiateSource, imports?: Record<string, unknown>, opts?: EmbedderOptions): Promise<EmbedderInstance>;
 /**
- * Alias matching the C2 dispatch's spelling.
+ * Alias matching bindgen's generated import spelling.
  * @internal — alias kept for bindgen-generated code only; hosts call
  * `instantiate`.
  */

package/types/embedder/mod.d.ts

@@ -9,6 +9,7 @@ export declare function createStream<T>(): {
     writer: ProtocolStreamWriter<T>;
 };
 export { GuestResource, HostResourceRegistry } from "./resources.js";
-export { camelCase, type LeafName, parseLeafName, pascalCase } from "./casing.js";
-export { asTrackKeySpelling, compareSemver, ImportRegistrationError, ImportResolutionError, ImportResolver, type ParsedId, parseInterfaceId, parseSemver, type Semver, trackKey, } from "./version.js";
+export { camelCase, pascalCase } from "./casing.js";
+export { ImportRegistrationError, ImportResolutionError, ImportResolver, } from "./version.js";
 export { type AdapterOptions, BorrowScope, fromHost, toHost, type ValueBridge, } from "./values.js";
+export { type Sync, sync } from "./sync.js";

package/types/embedder/resources.d.ts

@@ -2,17 +2,17 @@ import type { ResourceTypeInfo, ValType } from "../cabi/types.js";
 /**
  * Internal state of a guest-resource wrapper.
  *
- * The KEY is the process-global `polyengine.resourceState/1` brand since amendment
- * A9 (it used to be a module-local `Symbol(...)`, on the now-repealed
+ * The KEY is the process-global `polyengine.resourceState/1` brand
+ * (contracts/embedder-api.md §"Module identity": it used to be a module-local `Symbol(...)`, on the now-repealed
  * assumption that bundle and source runtimes are never mixed in one process —
  * issue #83 showed they routinely are). The state SHAPE stays strictly
- * runtime-internal, exactly as the A9 brand table notes: another copy may
+ * runtime-internal, exactly as the module identity brand table notes: another copy may
  * RECOGNIZE a wrapper, and must never read or write this object. `copyUrl` is
  * what lets this copy tell its own wrappers from a foreign copy's.
  */
 declare const STATE: symbol;
 interface WrapperState {
-    /** The runtime copy that minted this wrapper (A9). */
+    /** The runtime copy that minted this wrapper. */
     copyUrl: string;
     rep: number;
     /** False once the handle was transferred away or dropped. */
@@ -69,7 +69,7 @@ export declare function initWrapper(w: GuestResource, state: Omit<WrapperState,
  *
  * A wrapper minted by ANOTHER copy carries the same (process-global) brand key
  * but its state belongs to that copy — reading it here would be reading a
- * foreign copy's private shape (A9). So it is not a state: it is
+ * foreign copy's private shape. So it is not a state: it is
  * `undefined` here, and `requireLive` turns that into the named cross-copy
  * error rather than a misleading "not a resource handle" / "not live".
  */
@@ -100,15 +100,28 @@ export interface GuestResourceSpec {
         raw: (...a: unknown[]) => unknown;
         params: ValType[];
         results: ValType[];
+        /** True for an `async func` — see sync()'s `{ kind: "async" }` brand. */
+        async: boolean;
     }[];
     statics: {
         member: string;
         raw: (...a: unknown[]) => unknown;
         params: ValType[];
         results: ValType[];
+        async: boolean;
     }[];
 }
-export type CallAdapter = (raw: (...a: unknown[]) => unknown, params: ValType[], results: ValType[], where: string, args: unknown[]) => Promise<unknown>;
+/**
+ * Build (once, at class-build time — never per call) the Promise-shaped
+ * wrapper for one method/static's raw lifted function, exactly as
+ * `Facade#wrapExportFn` would for a plain export. `buildGuestResourceClass`
+ * reads the sync() brand off the returned wrapper to install the matching
+ * `"method"`/`"free"`/`"async"` brand on the class member it builds around
+ * it — the wrapper itself IS what a per-call closure invokes, so a `self`
+ * receiver is `wrapper(self, ...args)` for a method the same way a bare
+ * export is `wrapper(...args)`.
+ */
+export type ExportWrapper = (raw: (...a: unknown[]) => unknown, params: ValType[], results: ValType[], async: boolean, where: string) => (...args: unknown[]) => Promise<unknown>;
 /**
  * Build the class for a guest-implemented resource.
  *
@@ -118,7 +131,7 @@ export type CallAdapter = (raw: (...a: unknown[]) => unknown, params: ValType[],
  * synchronously is reported as such rather than silently returning a
  * half-built object (see the report's contract-friction list).
  */
-export declare function buildGuestResourceClass(spec: GuestResourceSpec, rt: ResourceTypeInfo, adapt: CallAdapter, lowerArgs: (args: unknown[], params: ValType[], where: string) => unknown[]): any;
+export declare function buildGuestResourceClass(spec: GuestResourceSpec, rt: ResourceTypeInfo, wrapExport: ExportWrapper, lowerArgs: (args: unknown[], params: ValType[], where: string) => unknown[]): any;
 /** Materialize an `own`/`borrow` wrapper for a rep coming out of a guest. */
 export declare function makeWrapper(cls: any, rep: number, rt: ResourceTypeInfo, owns: boolean): GuestResource;
 /**

package/types/embedder/streams.d.ts

@@ -15,7 +15,7 @@ export interface ElemCodec<T> {
     /** conventions value -> internal component value */
     fromHost(v: T): ComponentValue;
     /**
-     * Destroy a LOWERED element the reader will never take (amendment A13);
+     * Destroy a LOWERED element the reader will never take (§"Streams and futures");
      * present only for element types that hold resources (`own<R>`), where
      * abandonment without destruction is a leak.
      */
@@ -69,7 +69,7 @@ export declare class Stream<T> implements ProtocolStream<T> {
     read(max: number): Promise<Chunk<T>>;
     /**
      * Consume the writer's bytes in place, without an intermediate chunk
-     * (`stream<u8>` only — contracts/embedder-api.md amendment A21,
+     * (`stream<u8>` only — contracts/embedder-api.md §"Streams and futures" ("Direct-access byte edges"),
      * polyengine#128).
      *
      * At every rendezvous with a writer of nonzero capacity, `consume` runs
@@ -86,7 +86,7 @@ export declare class Stream<T> implements ProtocolStream<T> {
      * writer's parked operation survives and the stream stays alive.
      *
      * Refusals mirror `read`: an unbound `Stream.create()` handle and a handle
-     * already passed to a guest (the A15 transfer guard) both throw, as does a
+     * already passed to a guest (the deadlock-verdict suppression transfer guard) both throw, as does a
      * non-`u8` element type.
      */
     readDirect(consume: (src: DirectSource) => DirectVerdict): Promise<number>;
@@ -113,7 +113,7 @@ export declare class Stream<T> implements ProtocolStream<T> {
      * DROPPED event into the trapping instance's waitables, and a later
      * driving loop asserted on the corpse).
      *
-     * The arm is released on this path too (#162, amendment A15): the wrapper's
+     * The arm is released on this path too (#162, §"Streams and futures"): the wrapper's
      * `HostActivity` now closes through the shared object's drop observers,
      * which `dropSharedForTeardown` fires unconditionally — so a teardown with
      * nothing parked no longer leaves the arm outliving the stream. (This
@@ -143,7 +143,7 @@ export declare class StreamWriter<T> implements ProtocolStreamWriter<T> {
     write(values: Chunk<T>): Promise<number>;
     /**
      * Fill the reader's landing zone in place, without an intermediate chunk
-     * (`stream<u8>` only — contracts/embedder-api.md amendment A21,
+     * (`stream<u8>` only — contracts/embedder-api.md §"Streams and futures" ("Direct-access byte edges"),
      * polyengine#128).
      *
      * At every rendezvous with a reader of nonzero capacity, `produce` runs
@@ -197,7 +197,6 @@ export declare class Future<T> implements ProtocolFuture<T> {
      * is itself PromiseLike, so `await` still works and still yields `T`), which
      * keeps `drop()`/`cancel()` reachable for a caller that does not await. The
      * alternative — resolving a Promise *to* the handle — is not expressible.
-     * Flagged in the C2 report.
      */
     static deferred<T>(pending: Promise<ComponentValue>, codec: ElemCodec<T>): Future<T>;
     /** @internal */

package/types/embedder/sync.d.ts

@@ -0,0 +1,81 @@
+/** The registry symbol. `Symbol.for` per module identity: N runtime copies agree on it
+ * without sharing modules. */
+export declare const SYNC_CALLABLE: unique symbol;
+/**
+ * The brand payload, keyed by what the branded value is.
+ *
+ * - `"free"` — a lifted export function (plain export, interface member, or
+ *   resource static): `fn` is the fully-wrapped synchronous form.
+ * - `"method"` — a guest-resource prototype method: `fn` takes the resource
+ *   instance as its first argument (the `borrow<R>`/`own<R>` self param the
+ *   lifted function already declares).
+ * - `"async"` — an async-typed export: carries no synchronous form, named so
+ *   `sync()` can report the real reason.
+ */
+export type SyncPayload = {
+    kind: "free";
+    fn: (...args: unknown[]) => unknown;
+} | {
+    kind: "method";
+    fn: (self: unknown, ...args: unknown[]) => unknown;
+} | {
+    kind: "async";
+};
+/**
+ * Stamp `payload` on `target` under the brand: non-enumerable, non-writable,
+ * matching `@polyengine/protocol`'s `defineBrand` (protocol/src/brands.ts) —
+ * implemented locally since the runtime does not add application-tier
+ * vocabulary to the protocol package.
+ *
+ * @internal — written by `instantiate.ts` and `resources.ts` at wrap/
+ * class-build time; not part of the public `sync()` surface.
+ */
+export declare function markSyncCallable(target: object, payload: SyncPayload): void;
+/**
+ * Read the brand payload off `target`, or `undefined` if unbranded.
+ * Structural, like `hasBrand`: accepts a payload minted by any copy.
+ * @internal
+ */
+export declare function syncPayloadOf(target: unknown): SyncPayload | undefined;
+/** `Promise<R>`-returning functions synchronize to `R`; records map
+ * recursively; everything else passes through. Type-level refusal of an
+ * async export is not attempted (the contract only requires the runtime
+ * error) — `Sync<F>` stays structural.
+ *
+ * CONTRACT: the naive `F extends Record<string, unknown>` branch (checked
+ * before this fix) only matches object-LITERAL type aliases — named
+ * interfaces (generated `*Exports`) and class instance types (generated
+ * resource classes, e.g. `Counter`) have no implicit index signature and
+ * are not assignable to it, so they fell through to the `: F` passthrough
+ * and stayed Promise-shaped. Ordering matters: a non-Promise function type
+ * (e.g. a resource's `drop(): void`, or `[Symbol.dispose]`) must be checked
+ * and passed through BEFORE the generic `object` branch, or `{ [K in keyof
+ * F]: ... }` would try to map over a function's call signature (losing it)
+ * instead of leaving the function itself alone. */
+export type Sync<F> = F extends (...a: infer A) => Promise<infer R> ? (...a: A) => R : F extends (...a: never[]) => unknown ? F : F extends object ? {
+    [K in keyof F]: Sync<F[K]>;
+} : F;
+/**
+ * The synchronous form of a WIT-sync export (contracts/embedder-api.md
+ * §"Functions and async", §"Functions and async").
+ *
+ * - `sync(fn)` — a lifted export function (plain export, interface member,
+ *   or resource static): returns the synchronous form `(...args) => T`.
+ * - `sync(instance)` — a guest-resource wrapper: a view whose members call
+ *   the synchronous forms with `instance` as receiver.
+ * - `sync(cls)` — a guest-resource class: a view of synchronous statics
+ *   (constructors are already synchronous; `new` the class itself).
+ * - `sync(record)` — an exports record or nested interface record: a view
+ *   with every member mapped by these same rules, recursively; non-branded
+ *   members pass through unchanged.
+ * - Views are stable: `sync(x) === sync(x)`.
+ * - An async-typed export, a bare resource-method function, or anything
+ *   unbranded throws `TypeError`.
+ */
+export declare function sync<F extends (...a: never[]) => Promise<unknown>>(target: F): Sync<F>;
+export declare function sync<T extends object>(target: T): Sync<T>;
+/** Fallback for a non-branded/primitive target — always throws at runtime
+ * (see the dispatch above); typed loosely so a caller passing an arbitrary
+ * value (as opposed to a known export/record/instance/class shape) still
+ * type-checks, matching the runtime's willingness to name the mistake. */
+export declare function sync(target: unknown): unknown;

package/types/embedder/values.d.ts

@@ -23,8 +23,8 @@ export interface ValueBridge {
         kind: "borrow";
     }): number;
     /**
-     * Destroy a LOWERED `own<R>` the guest will never receive (amendment
-     * A13: a stream element the producer lowered but the reader never took).
+     * Destroy a LOWERED `own<R>` the guest will never receive (a resource
+     * stream element the producer lowered but the reader never took).
      * Runs the resource's destructor — for a host-implemented R the
      * instance's `[Symbol.dispose]`, for a guest-implemented R the guest
      * dtor — exactly as if the guest had taken the handle and dropped it.

package/types/exec/boundary.d.ts

@@ -114,7 +114,7 @@ export declare function normalizeCoreValues(values: CoreValue[], lanes: CoreType
  * repeat. Reimplementing it there diverged: that copy only drained
  * `store.awaiting` and never awaited `pendingHostCalls`, so a guest parked on
  * a Promise-returning host import was never resumed and the host's read of
- * the stream it was feeding hung (C0 finding R-1).
+ * the stream it was feeding hung (host-pump starvation of `pendingHostCalls`).
  *
  * Callers that must not hit the deadlock traps below (the host pump: an
  * embedder that never does its half is documented to hang, not trap) can
@@ -146,26 +146,35 @@ export declare function ensureSettlementPump(store: Store): void;
  *     needs genuine wasm-frame suspension: `needsJspi`, at the precise point.
  */
 /**
- * The plain-entered variant of a `[constructor]` export in jspi mode,
- * attached to the promising-wrapped lifted function under this symbol.
+ * The plain-entered variant of a **sync-typed** lifted export in jspi mode,
+ * attached to the promising-wrapped lifted function under this symbol
+ * (contracts/embedder-api.md §"Functions and async", §"Functions and async").
  *
- * A WIT constructor is surfaced as a JS class constructor
- * (contracts/embedder-api.md §"Resources"), and a JS constructor cannot
- * await — but in jspi mode every promising-wrapped entry returns a Promise
- * even when the activation completes without suspending (jspi pin (e)). So
- * constructor exports carry a second lifted function whose ENTRY is plain
- * (unwrapped): a constructor that completes synchronously — the
- * overwhelmingly common case; WIT constructors are always sync-typed —
- * returns its rep synchronously through it.
+ * In jspi mode every promising-wrapped entry returns a Promise even when the
+ * activation completes without suspending (jspi pin (e)). Some host contexts
+ * cannot use a Promise no matter how promptly it resolves, so each sync-typed
+ * export carries a second lifted function whose ENTRY is plain (unwrapped):
+ * a guest activation that completes synchronously — the overwhelmingly common
+ * case for sync-typed WIT — delivers its results synchronously through it.
  *
- * The cost is confined to genuinely-suspending constructors, which no JS
- * host can surface as `new` anyway: a blocking built-in reached through the
- * plain entry signals `NeedsJspi` (a capability error, instance left
- * enterable), and a Suspending-wrapped host import reached from the
- * unwrapped frame fails as a trap. Both name the constructor rather than
- * silently deadlocking.
+ * Two consumers, one mechanism:
+ *
+ *  * **resource constructors** — a WIT constructor is surfaced as a JS class
+ *    constructor (§"Resources") and a JS constructor cannot await, so the
+ *    embedder layer reads this symbol unconditionally for `[constructor]`
+ *    exports;
+ *  * **the embedder `sync()` adapter** — the explicit per-use
+ *    synchronous view of any sync-typed export.
+ *
+ * The cost is confined to genuinely-suspending activations: a blocking
+ * built-in reached through the plain entry signals `NeedsJspi` (a capability
+ * error, instance left enterable), and a `Suspending`-wrapped host import
+ * reached from the unwrapped frame fails as a trap. Both name the export
+ * rather than silently deadlocking. A call made while the instance has
+ * hop-parked activations refuses with `SyncEntryBusy` before entering
+ * (`refuseOnEntryHops` below).
  */
-export declare const CONSTRUCTOR_SYNC_ENTRY: unique symbol;
+export declare const SYNC_ENTRY: unique symbol;
 export declare function createLiftedFunction(input: {
     name: string;
     ft: FuncType;
@@ -212,6 +221,22 @@ export declare function createLiftedFunction(input: {
      * Promise, which it can never advance, and declares a bogus deadlock.
      */
     allowAsyncCompletion?: boolean;
+    /**
+     * Refuse — synchronously, before entering — a call made while the instance
+     * has HOP-parked activations, instead of deferring it (§"Functions and async",
+     * failure-ladder arm 2).
+     *
+     * Set for the `SYNC_ENTRY` variant, which is built with
+     * `suspensionMode: "plain"` inside a *jspi-mode* instantiation: the
+     * hop-quiescence gate below is keyed on this function's own mode and so is
+     * dead for that variant, yet the hazard it exists to prevent is the
+     * instance's, not the entry's — a hop-parked activation's pending lift
+     * reads memory a fresh guest turn would mutate (see the gate's comment).
+     * A synchronous caller cannot be deferred, so it refuses instead. The
+     * refusal is pre-enter, hence non-poisoning: nothing was entered, so there
+     * is nothing to poison — the same structural safety as `entryRefusal`.
+     */
+    refuseOnEntryHops?: boolean;
 }): (...args: ComponentValue[]) => unknown;
 /**
  * Build the host-callable entry for a resource destructor — a full canonical
@@ -224,27 +249,13 @@ export declare function createLiftedFunction(input: {
  *   callee = inst.store.lift(dtor, ft, opts, rt.impl)
  * ```
  *
- * Before #160 the host-initiated path (embedder `drop()`, the GC backstop,
- * `dropOwn`) hand-rolled the bracket in cabi/handles.ts `callDtorGated`: a
- * bare call to the dtor with `enterFrom(null)` HELD across the returned
- * promise. Three defects followed from having no Task/Thread behind the
- * activation:
- *
- *  - **#160 itself**: the held bracket left the impl instance non-enterable,
- *    so `Store.tick`'s enterability filter (#155) could never resume a
- *    suspension point belonging to the dtor's own activation. The completion
- *    promise sat in `pendingHostCalls` looking like external work, and every
- *    driver parked on it forever.
- *  - it was the runtime's only `enterFrom(null)` bracket spanning an await —
- *    the macro-scale reachability window of the #156 class, through which a
- *    sibling instance looked non-enterable from the synthetic root.
- *  - built-ins reached inside the dtor had no ambient task (`currentTask()`
- *    → `PendingCapability`, or a foreign-task misattribution, the #24 class).
- *
- * Under the lift harness all three go away structurally: the activation has a
- * real `Task` + implicit `Thread`, the entry bracket is released when the
- * first segment parks (`leave()` before `drive`), and settled tails flow
- * through `serviceSettled` like any other lifted sync call.
+ * The host-initiated paths (embedder `drop()`, the GC backstop, `dropOwn`)
+ * route through this harness rather than calling the dtor bare, because the
+ * activation then has a real `Task` + implicit `Thread`: built-ins reached
+ * inside the dtor are well-attributed (a bare call leaves `currentTask()`
+ * with no ambient task — `PendingCapability`, or a foreign-task
+ * misattribution, the #24 class), and settled tails flow through
+ * `serviceSettled` like any other lifted sync call.
  *
  * The returned function takes the rep and returns either `undefined` (the
  * activation completed synchronously — the overwhelmingly common case) or a
@@ -256,7 +267,7 @@ export declare function createDtorEntry(input: {
     /**
      * The destructor's core function, unwrapped: `createLiftedFunction` applies
      * `enterWasm` itself per `suspensionMode`. `null` is the reference's
-     * `rt.dtor or (lambda rep: [])` — the bracket still runs.
+     * `rt.dtor or (lambda rep: [])` — the lift still runs.
      */
     dtor: CoreFn | null;
     /** `rt.impl`, the implementing instance the lift enters. */
@@ -293,7 +304,7 @@ export declare function hostDtorCall(rt: ResourceTypeInfo, rep: number): void;
  * This is the whole of the jspi entry seam. In **plain** mode the entry is not
  * `promising`-wrapped, `callCore` returns core values, and this returns them
  * without yielding — no await, no Promise allocation, the identical
- * synchronous path M1 shipped. In **jspi** mode the entry *is* wrapped, so the
+ * synchronous path plain mode always used. In **jspi** mode the entry *is* wrapped, so the
  * call returns a Promise (jspi pin (e)) and we park the thread on it via the
  * `awaitValue` block request; the driving loop resumes us with the values, or
  * throws the rejection in (a post-resume trap).
@@ -334,8 +345,21 @@ export declare function createLoweredImport(input: {
     stats: ExecutionStats;
     /** Executor's suspension mode; decides whether a sync lower may park. */
     mode: SuspensionMode;
-    /** Host fn carries the `suspending()` brand (embedder-api.md A1). */
+    /** Host fn carries the `suspending()` brand (embedder-api.md suspending mark). */
     suspendable: boolean;
+    /**
+     * Host fn carries the `deferCancel()` brand (embedder-api.md cancellation discard): the
+     * import must run to completion, so a cancellation is accepted and ignored
+     * instead of taking the default discard.
+     */
+    deferCancel: boolean;
+    /**
+     * Host fn carries the `abortable()` brand (embedder-api.md abortable()): every call
+     * receives a fresh `AbortSignal` appended after the WIT-declared params, and
+     * the runtime aborts it when — and only when — the call is discarded by a
+     * guest cancellation.
+     */
+    abortable: boolean;
 }): CoreFn;
 /**
  * The callback-ABI dispatch loop of `canon_lift` (definitions.py lines

package/types/exec/executor.d.ts

@@ -6,7 +6,8 @@ import { type ExecutionStats } from "./boundary.js";
 /**
  * Host-provided imports: a nested record keyed by the component's *exact*
  * import strings. A plan import with a non-empty `path` (an item extracted
- * from an imported instance — plan-format.md v0.1 amendment #4) is looked up
+ * from an imported instance — `imports[].path`, contracts/plan-format.md
+ * schema) is looked up
  * by walking `imports[name]` then each path segment in order. So an import
  * of `"ns:pkg/iface"` exposing `f` is supplied as
  * `{ "ns:pkg/iface": { f: (…) => … } }`.
@@ -65,7 +66,7 @@ export interface InstantiateInput {
      * returns a Promise (empirical fact (e) — `WebAssembly.promising` always
      * does), which is an API-shape change. Ignored on an engine without JSPI,
      * where every blocking site keeps raising the precise `NeedsJspi` it raises
-     * today (the M3 degradation path).
+     * today (the browser-matrix degradation path; see `just browsers`).
      */
     jspi?: boolean;
     /**

package/types/exec/host_streams.d.ts

@@ -41,7 +41,7 @@ export declare class HostBuffer {
     advanceBytes(k: number): void;
     endWindow(): void;
 }
-/** The scoped landing zone handed to a `writeDirect` producer (A21, #128). */
+/** The scoped landing zone handed to a `writeDirect` producer (direct-access byte edge, #128). */
 export interface DirectDestination {
     /**
      * The reader's still-unfilled bytes. Re-derived on every call (a
@@ -56,7 +56,7 @@ export interface DirectDestination {
      */
     markWritten(n: number): void;
 }
-/** The scoped view handed to a `readDirect` consumer (A21, #128). */
+/** The scoped view handed to a `readDirect` consumer (direct-access byte edge, #128). */
 export interface DirectSource {
     /**
      * The writer's unread bytes; read-only by contract. Same scoping and
@@ -66,14 +66,14 @@ export interface DirectSource {
     /** Acknowledge bytes consumed from the view. See `markWritten`. */
     markRead(n: number): void;
 }
-/** The callback's poll cadence, spelled event-style (A21). */
+/** The callback's poll cadence, spelled event-style. */
 export type DirectVerdict = "more" | "done";
 /**
  * Out-parameter of the low-level direct forms: `true` iff the session ended
  * because the callback itself returned `"done"`, rather than because the peer
  * dropped / the operation was cancelled / the peer's instance trapped.
  *
- * The conventions layer needs the distinction for A7 precision — a session
+ * The conventions layer needs the distinction for loud component fault precision — a session
  * the producer already completed keeps its resolution even if the peer then
  * trapped — and `Promise<number>` is the contract's return shape, so it rides
  * here rather than in the resolved value.
@@ -110,7 +110,7 @@ export interface HostWritableEnd<T> {
     writeAll(values: T[]): Promise<number>;
     /**
      * Park a **direct session** on this end (`stream<u8>` only — embedder-api
-     * amendment A21, polyengine#128).
+     * §"Streams and futures" ("Direct-access byte edges") (polyengine#128)).
      *
      * At every rendezvous with a reader of nonzero capacity, `produce` runs
      * exactly once, synchronously, inside the rendezvous, with a
@@ -138,9 +138,9 @@ export interface HostWritableEnd<T> {
     drop(): void;
     /**
      * Fire `fn` once the stream becomes dropped — by either end, including
-     * the A7 teardown walk (immediately, if it already is). The embedder's
+     * the loud component fault teardown walk (immediately, if it already is). The embedder's
      * producer pump uses it to cancel a producer parked on an external
-     * event (amendment A13's cancellation companion).
+     * event (§"Streams and futures"'s cancellation companion).
      */
     onDropped(fn: () => void): void;
 }
@@ -155,7 +155,7 @@ export interface HostReadableEnd<T> {
     read(max: number): Promise<T[]>;
     /**
      * Park a **direct session** on this end (`stream<u8>` only — embedder-api
-     * amendment A21, polyengine#128). The mirror of
+     * §"Streams and futures" ("Direct-access byte edges") (polyengine#128)). The mirror of
      * `HostWritableEnd.writeDirect`: `consume` receives a `DirectSource` over
      * the writer's unread bytes (a view of guest memory, or of the offered
      * host chunk itself) and may take a prefix — a partial take is normal, and

package/types/intrinsics/errors.d.ts

@@ -1,5 +1,5 @@
-/** Instantiate-time failure for functionality scheduled after M0. */
+/** Instantiate-time failure for functionality gated on a missing capability. */
 export declare class UnsupportedFeatureError extends Error {
-    milestone: "M1" | "M2" | "M2-streams" | "M2-jspi";
-    constructor(milestone: "M1" | "M2" | "M2-streams" | "M2-jspi", what: string);
+    capability: "resources" | "task-core" | "streams" | "jspi";
+    constructor(capability: "resources" | "task-core" | "streams" | "jspi", what: string);
 }

package/types/intrinsics/mod.d.ts

@@ -182,6 +182,6 @@ export interface TrampolineContext {
  * unsupported kind fails instantiation, not the first call
  * (plan-format.md "Executor obligations"). Unreferenced trampolines are
  * never created and therefore never fail (intrinsics.md §B tolerates e.g.
- * an unreferenced task-return until M2).
+ * an unreferenced task-return until the task core exists).
  */
 export declare function createTrampoline(decl: WireTrampoline, ctx: TrampolineContext): CoreFn;

package/types/intrinsics/stream_builtins.d.ts

@@ -99,8 +99,8 @@ export declare function createFutureTransfer(ctx: AsyncTransferContext): CoreFn;
  * rather than removing it, so the source keeps its own.
  */
 /**
- * Plan v3 (contracts/plan-format.md v3 amendment 2): `instanceOf` resolves
- * through the plan's `errorContextTables` section — the
+ * `instanceOf` resolves through the plan's `errorContextTables` section
+ * (contracts/plan-format.md schema) — the
  * `TypeComponentLocalErrorContextTableIndex` space these arguments actually
  * live in. It replaced a resource-table lookup, which shared neither the
  * index space nor (in a multi-instance composition) the answer.