@polyengine/runtime 0.5.0 → 0.6.0

package/esm/embedder/casing.js

@@ -38,6 +38,14 @@ function upperFirst(s) {
 const MANGLED = /^\[([a-z-]+)\](.*)$/;
 /**
  * Decode a mangled leaf name; unmangled names come back as `plain`.
+ *
+ * An unknown bracket form throws rather than falling back to `plain`
+ * (contracts/embedder-api.md §"Getters and setters (pre-ruling…)", final
+ * paragraph): "the runtime refuses unknown bracket forms in mangled names
+ * loudly at instantiation (rather than misbinding them as plain names — a
+ * `[get]foo` treated as a function named `[get]foo` would be wrong in both
+ * directions)". Getter/setter support (`[get]`/`[set]`, upstream
+ * WebAssembly/component-model#701) is tracked in polyengine#254.
  * @internal — leaf-name demangling, performed by the runtime and by
  * bindgen-generated code.
  */
@@ -48,20 +56,27 @@ export function parseLeafName(raw) {
     const [, tag, rest] = m;
     switch (tag) {
         case "constructor":
-            return { form: "constructor", resource: rest };
+            if (!rest.includes("["))
+                return { form: "constructor", resource: rest };
+            break;
         case "method":
         case "static": {
             const dot = rest.indexOf(".");
             if (dot < 0)
                 break;
-            return {
-                form: tag,
-                resource: rest.slice(0, dot),
-                member: rest.slice(dot + 1),
-            };
+            const resource = rest.slice(0, dot);
+            // A resource name carrying a further bracket (`[method][get]r.p`, the
+            // exact getter/setter-on-instance spelling the pre-ruling names) is
+            // NOT a plain `[method]`/`[static]` leaf — it is one of the still-
+            // unimplemented forms, and must be refused the same way, not
+            // misparsed as a method whose resource is literally `[get]r`.
+            if (resource.includes("["))
+                break;
+            return { form: tag, resource, member: rest.slice(dot + 1) };
         }
     }
-    // Unknown bracket forms (`[async]`, `[dtor]`, future spellings) are left
-    // alone rather than guessed at: they surface verbatim, which is loud.
-    return { form: "plain", name: raw };
+    throw new Error(`unrecognized mangled export/import name '${raw}': the bracket form is ` +
+        `not one this runtime understands (only [constructor]/[method]/` +
+        `[static] are implemented; getter/setter forms like [get]/[set] are ` +
+        `not yet implemented — polyengine#254)`);
 }

package/esm/embedder/copy.js

@@ -1,5 +1,5 @@
 // This runtime copy's identity (contracts/embedder-api.md §"Module identity
-// and @polyengine/protocol", amendment A9; issue #83).
+// and @polyengine/protocol"; issue #83).
 //
 // One module owns the copy's URL so every diagnostic composes the same
 // message, and so lowering sites deep in the value adapters can name the copy
@@ -12,7 +12,7 @@
 import { copyCensus } from "@polyengine/protocol";
 /**
  * The URL of this copy of the runtime. Identity of the copy.
- * @internal — copy-identity constant for the A9 multi-copy diagnostics; not
+ * @internal — copy-identity constant for the module identity multi-copy diagnostics; not
  * host-facing.
  */
 export const COPY_URL = import.meta.url;
@@ -26,15 +26,15 @@ export const COPY_URL = import.meta.url;
  *
  * INVARIANT: keep in sync with `version` in runtime/deno.json — pinned by
  * runtime/tests/embedder/cross_copy_test.ts.
- * @internal — copy-identity constant for the A9 multi-copy diagnostics; not
+ * @internal — copy-identity constant for the module identity multi-copy diagnostics; not
  * host-facing.
  */
-export const RUNTIME_VERSION = "0.5.0";
+export const RUNTIME_VERSION = "0.6.0";
 /**
  * Compose a cross-copy diagnostic: what was foreign, which copy is speaking,
  * the census of every copy in the graph, and the by-value remediation.
  *
- * Kept to one line but complete — the whole point of A9's stateful half is
+ * Kept to one line but complete — the whole point of module identity's stateful half is
  * that "recognized but foreign" is a NAMED failure, never a silent
  * adaptation (a foreign `Stream` pumped as an async iterable) and never a
  * misleading generic ("handle is not an error-context").
@@ -43,6 +43,6 @@ export function describeCrossCopy(what, remedy) {
     const census = copyCensus();
     return `${what} was minted by a DIFFERENT polyengine runtime copy and cannot ` +
         `be used through this one (this copy: ${COPY_URL}${census === "" ? "" : `; ${census}`}). Handles are stateful — their machinery lives in the copy that minted ` +
-        `them (contracts/embedder-api.md amendment A9, issue #83)` +
+        `them (contracts/embedder-api.md §"Module identity")` +
         `${remedy === undefined ? "" : `. ${remedy}`}`;
 }

package/esm/embedder/errors.js

@@ -1,11 +1,11 @@
 // The embedder-facing error model (contracts/embedder-api.md §"Error model").
 //
-// The canonical definitions live in `@polyengine/protocol` since amendment A9 —
+// The canonical definitions live in `@polyengine/protocol` since §"Module identity and @polyengine/protocol" —
 // this module is the unchanged import path for them (every existing
 // `from "./errors.ts"` / `@polyengine/runtime/embedder` import keeps working) plus
 // the runtime-local `NameCollisionError`, which never crosses a copy boundary
 // (it is raised while BUILDING a facade, before any value exists) and
-// therefore carries no brand: the A9 table's omissions are deliberate.
+// therefore carries no brand: the module identity table's omissions are deliberate.
 //
 // Recognition at the runtime's own boundaries is by BRAND, not class: use the
 // `is*` predicates re-exported below, never `instanceof`, for any value that

package/esm/embedder/imports.js

@@ -1,9 +1,9 @@
 // `requiredImports()` — the supported enumeration of a component's linkable
 // import leaves (contracts/embedder-api.md §"Module wiring and
-// instantiation"; C2 checklist item 2).
+// instantiation").
 //
-// C0 finding #8: `plan.imports` proved the right authority, and every embedder
-// that needed it hand-rolled the same walk (tools/smoke-c0/wasi_stub.ts).
+// `plan.imports` proved the right authority, and every embedder
+// that needed it would otherwise hand-roll the same walk.
 // Blessing it removes that. It is also this layer's own input: the facade
 // builds its import wrappers from exactly this list.
 import { loadPlan } from "../plan/loader.js";

package/esm/embedder/instantiate.js

@@ -1,6 +1,6 @@
 // The conventions facade: `instantiate(artifacts, imports, opts)`.
 //
-// DESIGN (orchestrator ruling, C2): the facade is **runtime-driven**. Every
+// DESIGN: the facade is **runtime-driven**. Every
 // camelCase name, every resource class and every import wrapper is built here,
 // at instantiate time, from the loaded plan's type tables — the plan already
 // carries names, kinds and function types. Bindgen emits compile-time *types*
@@ -11,9 +11,9 @@
 // contracts/plan-format.md for the wire shapes read here.
 import { loadEnvelope, loadPlan, PlanError } from "../plan/loader.js";
 import { Trap } from "../cabi/trap.js";
-import { CONSTRUCTOR_SYNC_ENTRY, hostResourceType, instantiateComponent, } from "../exec/mod.js";
+import { SYNC_ENTRY, hostResourceType, instantiateComponent, } from "../exec/mod.js";
 import { camelCase, parseLeafName, pascalCase } from "./casing.js";
-import { isSuspending, suspending } from "../jspi/suspending.js";
+import { abortable, deferCancel, isAbortable, isDeferCancel, isSuspending, suspending, } from "../jspi/suspending.js";
 import { Translator } from "../shim/mod.js";
 import { copyCensus, isTrap, isComponentException } from "@polyengine/protocol";
 import { NameCollisionError, ComponentException } from "./errors.js";
@@ -23,6 +23,28 @@ import { buildGuestResourceClass, HostResourceRegistry, invalidateWrapper, lendW
 import { BorrowScope, describe, fromHost, toHost, } from "./values.js";
 import { ImportResolver } from "./version.js";
 import { Future, Stream } from "./streams.js";
+import { markSyncCallable } from "./sync.js";
+/**
+ * Relay the per-declaration host-import marks from the embedder's function
+ * onto the wrapper the executor will actually receive, and return the
+ * wrapper.
+ *
+ * Every `#dispatcher` arm re-wraps the embedder's function in a closure, so a
+ * brand left on the original is INVISIBLE to `buildLoweredImport` — for suspending mark
+ * that surfaced as a `NeedsJspi`, for cancellation discard (`deferCancel()`) it would be a
+ * silently discarded commit, which is precisely the failure the brand exists
+ * to prevent. Both marks are relayed by the same helper so a third one cannot
+ * be added to one arm and forgotten in the other three.
+ */
+function relayMarks(from, to) {
+    if (isSuspending(from))
+        suspending(to);
+    if (isDeferCancel(from))
+        deferCancel(to);
+    if (isAbortable(from))
+        abortable(to);
+    return to;
+}
 /** Per-element codec for a `future<T>` returned in function-result position. */
 function elementCodec(element, o) {
     return {
@@ -37,7 +59,7 @@ function elementCodec(element, o) {
  * single-file JSON emitted by build-time translation (`tools/translate`,
  * or `Translator.translateRaw`), carrying the plan and the FACT adapter
  * modules. The production deploy set is `component.wasm` + its envelope +
- * the runtime: no translator ships (embedder-api.md amendment A4).
+ * the runtime: no translator ships (contracts/embedder-api.md §"Module wiring and instantiation").
  *
  * Pure and fetch-agnostic: acquire the two blobs however the platform
  * likes (HTTP, fs, bundler asset) and hand them over. The envelope embeds
@@ -55,7 +77,7 @@ export function artifactsFromEnvelope(envelopeJson, componentBytes) {
  * guest code runs: generated `instantiate` wrappers call this, verify the
  * plan, and only then delegate to `instantiate` below.
  * @internal — bindgen-generated code only — the digest handshake needs the
- * plan before instantiating (amendment A17).
+ * plan before instantiating (§"Module wiring and instantiation").
  */
 export async function resolveArtifacts(src) {
     if ("plan" in src)
@@ -105,7 +127,7 @@ export async function instantiate(source, imports = {}, opts = {}) {
     return instance;
 }
 /**
- * Alias matching the C2 dispatch's spelling.
+ * Alias matching bindgen's generated import spelling.
  * @internal — alias kept for bindgen-generated code only; hosts call
  * `instantiate`.
  */
@@ -154,7 +176,7 @@ class Facade {
         // guest `start` function can resolve resource types normally.
         //
         // One resource TYPE can be reached through several resource TABLES
-        // (plan-format.md C2 amendment #1: a type export's index is a table
+        // (plan-format.md "Type exports index into `resourceTables`": a type export's index is a table
         // index, and the executor sets impl/dtor on every table whose `resource`
         // matches), hence index-keyed bindings with tokens as aliases.
         artifacts.plan.resourceTables.forEach((table, i) => {
@@ -167,8 +189,8 @@ class Facade {
         this.leaves = requiredImports(this.loaded);
         // A component that imports a resource TYPE cannot be wired without
         // `plan.importedResources`: that table is the only thing mapping the
-        // import back to a `ResourceIndex` (plan-format.md v0.1 amendment #2 /
-        // v0.2). Without it every own/borrow of that type would fail late, deep
+        // import back to a `ResourceIndex` (the `importedResources` field,
+        // contracts/plan-format.md schema). Without it every own/borrow of that type would fail late, deep
         // inside a call, as an unattributable `InvalidHandleError`.
         const resourceLeaves = this.leaves.filter((l) => l.kind === "resource");
         if (resourceLeaves.length > 0 &&
@@ -238,7 +260,7 @@ class Facade {
     #guestClass(b) {
         b.cls ??= buildGuestResourceClass({ name: b.name, ctor: null, ctorParams: null, methods: [], statics: [] }, 
         // The rt is supplied per wrapper, so an anonymous class needs none here.
-        { impl: null, dtor: null }, () => Promise.reject(new TypeError("no methods")), () => []);
+        { impl: null, dtor: null }, () => () => Promise.reject(new TypeError("no methods")), () => []);
         return b.cls;
     }
     /**
@@ -249,7 +271,7 @@ class Facade {
      * construction — before instantiation, and therefore before a guest `start`
      * function can call an import that carries an `own`/`borrow` of one.
      * Imported resources occupy `ResourceIndex` 0..n-1 in `importedResources`
-     * order (plan-format.md v0.1 amendment #2 / v0.2).
+     * order (the `importedResources` field, contracts/plan-format.md schema).
      */
     #bindHostResources() {
         const importedResources = this.artifacts.plan.importedResources ?? [];
@@ -328,7 +350,7 @@ class Facade {
                 return rep;
             },
             dropOwn(rep, t) {
-                // A13: a lowered `own` the guest will never take (an un-taken
+                // resource stream: a lowered `own` the guest will never take (an un-taken
                 // stream element). Destroy it exactly as a guest-side drop would:
                 // host-implemented R runs the instance's [Symbol.dispose] through
                 // the registry; guest-implemented R runs the guest dtor via the
@@ -433,9 +455,10 @@ class Facade {
             }
             return impl(...raw);
         };
-        // A1 brand relay, layer 2 of 2 (see #dispatcher): the executor reads the
-        // brand off this wrapper, which is what lands in its hostImports record.
-        return isSuspending(dispatch) ? suspending(wrapper) : wrapper;
+        // suspending mark/cancellation discard brand relay, layer 2 of 2 (see #dispatcher): the executor reads
+        // the brands off this wrapper, which is what lands in its hostImports
+        // record.
+        return relayMarks(dispatch, wrapper);
     }
     /** A host-implemented resource type: register the class, own the mapping. */
     #wrapResourceType(leaf, importIndex, provider) {
@@ -471,10 +494,11 @@ class Facade {
                 throw new PlanError(`host import '${label(leaf)}' missing or not a function (got ` +
                     `${describe(fn)}); expected '${camelCase(m.name)}'`);
             }
-            // A1: the `suspending()` brand rides the dispatch closure so #wrapLeaf
-            // can relay it onto the value the executor actually receives.
+            // suspending mark/cancellation discard: the `suspending()` and `deferCancel()` brands ride the
+            // dispatch closure so #wrapLeaf can relay them onto the value the
+            // executor actually receives.
             //
-            // A2 receiver rule: an interface member is invoked with its containing
+            // suspending mark receiver rule: an interface member is invoked with its containing
             // object as receiver (matching the static arm's `apply(cls)`), so a
             // class INSTANCE is a fully supported spelling of an interface
             // provider — methods reading instance state work. A world-level bare
@@ -485,7 +509,7 @@ class Facade {
             // liberal-acceptance failure the contract forbids.)
             const receiver = leaf.path.length === 0 ? undefined : provider;
             const dispatch = (args) => fn.apply(receiver, args);
-            return isSuspending(fn) ? suspending(dispatch) : dispatch;
+            return relayMarks(fn, dispatch);
         }
         const clsName = pascalCase(m.resource);
         // World-level member leaves resolved the class itself (`#provider`);
@@ -499,12 +523,12 @@ class Facade {
         switch (m.form) {
             case "constructor":
                 // Never markable: guest-driven construction of a host resource is
-                // synchronous by the C2 amendment, and stage-3 reserves no
+                // synchronous (contracts/embedder-api.md §"Functions and async"), and stage-3 reserves no
                 // constructor-decorator position.
                 // deno-lint-ignore no-explicit-any
                 return (args) => new cls(...args);
             case "method": {
-                // A2: the brand authority for an instance method is the CLASS
+                // suspending mark: the brand authority for an instance method is the CLASS
                 // PROTOTYPE, read at wrap time — the Suspending-wrap decision is
                 // per-declaration and taken at instantiation, before any instance
                 // exists. Instance-level method overrides do not change
@@ -516,7 +540,7 @@ class Facade {
                 // `URLSearchParams.prototype.size`) brand-checks its receiver, and a
                 // raw `prototype[member]` read runs it with `this` = the prototype —
                 // an engine TypeError at instantiation, even for guests that never
-                // call the member. Only a data-property function can carry the A2
+                // call the member. Only a data-property function can carry the suspending mark
                 // mark (stage-3 method decorators install data properties), so an
                 // accessor-backed member yields no wrap-time function here and stays
                 // a call-time concern for the per-call lookup below.
@@ -530,7 +554,7 @@ class Facade {
                     }
                     return fn.apply(self, rest);
                 };
-                return isSuspending(protoFn) ? suspending(dispatch) : dispatch;
+                return relayMarks(protoFn, dispatch);
             }
             case "static": {
                 const fn = cls[camelCase(m.member)];
@@ -538,11 +562,11 @@ class Facade {
                     throw new PlanError(`host import '${label(leaf)}': ${clsName} has no static ` +
                         `'${camelCase(m.member)}'`);
                 }
-                // A2: a static's brand sits on the function itself (a stage-3
+                // suspending mark: a static's brand sits on the function itself (a stage-3
                 // static-method decorator marks the function value), readable here
                 // at wrap time.
                 const dispatch = (args) => fn.apply(cls, args);
-                return isSuspending(fn) ? suspending(dispatch) : dispatch;
+                return relayMarks(fn, dispatch);
             }
         }
     }
@@ -573,7 +597,7 @@ class Facade {
             return fromHost(v, resultType, o);
         };
         const fail = (e, args) => {
-            // Brand, not class (amendment A9): a `ComponentException` thrown by a host module
+            // Brand, not class (§"Module identity and @polyengine/protocol"): a `ComponentException` thrown by a host module
             // that resolved a DIFFERENT runtime copy — or hand-rolled with the
             // registry symbol — is the same value here (issue #83).
             if (isComponentException(e) && isResult) {
@@ -599,9 +623,9 @@ class Facade {
                     `only a fallible import may signal an error value`);
             }
             // The #83 signature: in a graph with several copies, an UNBRANDED throw
-            // is usually a pre-A9 copy's `ComponentException` (its brand rode class identity,
+            // is usually a pre-module identity copy's `ComponentException` (its brand rode class identity,
             // which does not survive the copy boundary). Say so rather than leaving
-            // the latent puzzle that motivated amendment A9.
+            // the latent puzzle that motivated §"Module identity and @polyengine/protocol".
             const census = copyCensus();
             throw new Trap(`${where} threw ${describeThrow(e)}. An unbranded throw from a host ` +
                 `import is a host bug and becomes a trap: signal a WIT error with ` +
@@ -609,12 +633,23 @@ class Facade {
                 (census === ""
                     ? ""
                     : ` (${census} — an error carrying no polyengine brand in a ` +
-                        `multi-copy graph usually means a pre-A9 runtime copy threw ` +
+                        `multi-copy graph usually means a pre-module identity runtime copy threw ` +
                         `it, issue #83.)`));
         };
         return (...raw) => {
             const scope = new BorrowScope();
             const args = ft.params.map((p, i) => toHost(raw[i], p, o, scope));
+            // CONTRACT: anything the executor appended PAST the WIT-declared
+            // params is a runtime-minted extra, not a component value — today
+            // exactly the `abortable()` signal `createLoweredImport` adds for a
+            // marked import. It is forwarded verbatim (no `toHost` conversion: it
+            // has no `ValType` and must reach the host as the platform object it
+            // is). Without this the facade would silently drop the signal and a
+            // marked import's `signal` parameter would be forever `undefined` —
+            // the failure the mark exists to prevent. The slice is empty for every
+            // unmarked import, so no existing path changes shape.
+            for (let i = ft.params.length; i < raw.length; i++)
+                args.push(raw[i]);
             let out;
             try {
                 out = dispatch(args);
@@ -624,7 +659,7 @@ class Facade {
                 return fail(e, args);
             }
             if (isThenable(out)) {
-                // Amendment A12: when the WIT result type is `future<T>`, a thenable
+                // When the WIT result type is `future<T>`, a thenable
                 // return IS the future source ("for `future<T>`, a `Promise<T>` or
                 // `Future<T>`" — §"Streams and futures"), not the call's async
                 // completion. The import completes immediately with the lowered
@@ -719,8 +754,8 @@ class Facade {
                 continue;
             }
             if (exp.kind === "module") {
-                // Not WIT-expressible, digest-excluded (plan-format.md v4 amendment
-                // 2): the WIT-shaped facade skips it, the type-export precedent. The
+                // Not WIT-expressible, digest-excluded (the `module` export kind,
+                // contracts/plan-format.md schema notes): the WIT-shaped facade skips it, the type-export precedent. The
                 // raw executor export surface still carries the compiled module.
                 continue;
             }
@@ -754,8 +789,8 @@ class Facade {
                     const s = spec(member.resource);
                     // Prefer the plain-entered variant in jspi mode: the JS `new`
                     // cannot await the Promise a promising-wrapped entry returns
-                    // (exec/boundary.ts CONSTRUCTOR_SYNC_ENTRY).
-                    s.ctor = (fn[CONSTRUCTOR_SYNC_ENTRY] ?? fn);
+                    // (exec/boundary.ts SYNC_ENTRY).
+                    s.ctor = (fn[SYNC_ENTRY] ?? fn);
                     s.ctorParams = ft.params;
                     rtOf(ft.results[0], specRt, member.resource);
                     break;
@@ -766,6 +801,7 @@ class Facade {
                         raw: fn,
                         params: ft.params,
                         results: ft.results,
+                        async: ft.async === true,
                     });
                     rtOf(ft.params[0], specRt, member.resource);
                     break;
@@ -776,6 +812,7 @@ class Facade {
                         raw: fn,
                         params: ft.params,
                         results: ft.results,
+                        async: ft.async === true,
                     });
                     break;
                 }
@@ -787,7 +824,7 @@ class Facade {
                 throw new PlanError(`export '${id}': resource '${name}' has leaves but no own/borrow ` +
                     `type to identify it by`);
             }
-            const cls = buildGuestResourceClass(s, rt, (fn, params, results, where, args) => this.#wrapExportFn(fn, { params, results }, where)(...args), (args, params, where) => args.map((a, i) => fromHost(a, params[i], this.#opts(where))));
+            const cls = buildGuestResourceClass(s, rt, (raw, params, results, async, where) => this.#wrapExportFn(raw, { params, results, async }, where), (args, params, where) => args.map((a, i) => fromHost(a, params[i], this.#opts(where))));
             obj[claim(pascalCase(name), name)] = cls;
             const index = this.#tokenIndex.get(rt);
             if (index !== undefined) {
@@ -844,13 +881,14 @@ class Facade {
     #wrapExportFn(fn, ft, where) {
         const o = this.#opts(where);
         const resultType = ft.results.length === 0 ? null : ft.results[0];
+        let wrapper;
         if (resultType !== null && resultType.kind === "future") {
             // See `Future.deferred`: a `future<T>` result cannot be delivered
             // *through* a Promise, because promise resolution adopts thenables and
             // `Future<T>` is one. The handle is returned eagerly instead; it is
             // PromiseLike, so `await` still yields `T`.
             const element = resultType.element;
-            return (...args) => {
+            wrapper = (...args) => {
                 // Advisory 9: the generic branch checks arity; so must this one.
                 if (args.length !== ft.params.length) {
                     throw new TypeError(`${where}: expected ${ft.params.length} argument(s), got ` +
@@ -869,20 +907,111 @@ class Facade {
                 return Future.deferred(pending, elementCodec(element, o));
             };
         }
-        return async (...args) => {
+        else {
+            wrapper = async (...args) => {
+                if (args.length !== ft.params.length) {
+                    throw new TypeError(`${where}: expected ${ft.params.length} argument(s), got ${args.length}`);
+                }
+                const { lowered, release } = this.#lowerParams(ft.params, args, o);
+                let raw;
+                try {
+                    raw = await fn(...lowered);
+                }
+                finally {
+                    // Call-scoped reps minted for `borrow<R>` arguments of a
+                    // host-implemented resource live exactly as long as the call.
+                    release();
+                }
+                if (resultType === null)
+                    return undefined;
+                if (resultType.kind === "result") {
+                    const v = raw;
+                    if ("error" in v) {
+                        throw new ComponentException(resultType.error === null
+                            ? undefined
+                            : toHost(v["error"], resultType.error, o));
+                    }
+                    return resultType.ok === null
+                        ? undefined
+                        : toHost(v["ok"], resultType.ok, o);
+                }
+                return toHost(raw, resultType, o);
+            };
+        }
+        // sync() brand (contracts/embedder-api.md §"Functions and async"): every
+        // returned wrapper is branded, additively — the default Promise-shaped
+        // surface above is unchanged either way.
+        if (ft.async === true) {
+            markSyncCallable(wrapper, { kind: "async" });
+        }
+        else {
+            markSyncCallable(wrapper, {
+                kind: "free",
+                fn: this.#buildSyncForm(fn, ft, where, o),
+            });
+        }
+        return wrapper;
+    }
+    /**
+     * The synchronous form of a sync-typed export (sync()'s `sync()` adapter),
+     * mirroring `#wrapExportFn`'s async form exactly minus the `await`:
+     * arity check, `#lowerParams`, the plain (`SYNC_ENTRY`) entry, result
+     * mapping.
+     *
+     * `SYNC_ENTRY` is the plain-entered variant `executor.ts` attaches to every
+     * sync-typed lifted export in jspi mode (exec/boundary.ts; in plain mode
+     * the lifted function itself already returns synchronously, so `fn` is
+     * used as-is — `fn[SYNC_ENTRY] ?? fn`).
+     */
+    #buildSyncForm(fn, ft, where, o) {
+        const resultType = ft.results.length === 0 ? null : ft.results[0];
+        const entry = fn[SYNC_ENTRY] ?? fn;
+        const unreachableThenable = (raw) => {
+            // Defensive (see the dispatch prompt / sync() failure ladder): a genuine
+            // park through a plain entry surfaces as a trap, `NeedsJspi`, or
+            // `SyncEntryBusy` — never a settled thenable VALUE. A silent
+            // Promise-as-value here would corrupt lifting rather than fail loudly,
+            // so this is a diagnostic backstop, not a documented outcome.
+            void raw;
+            throw new Error(`${where}: the sync entry returned a thenable, which should be ` +
+                `unreachable for a sync-typed WIT export (a genuine park surfaces ` +
+                `as a trap, NeedsJspi, or SyncEntryBusy instead) — this indicates ` +
+                `a runtime defect`);
+        };
+        if (resultType !== null && resultType.kind === "future") {
+            const element = resultType.element;
+            return (...args) => {
+                if (args.length !== ft.params.length) {
+                    throw new TypeError(`${where}: expected ${ft.params.length} argument(s), got ` +
+                        `${args.length}`);
+                }
+                const { lowered, release } = this.#lowerParams(ft.params, args, o);
+                let raw;
+                try {
+                    raw = entry(...lowered);
+                }
+                finally {
+                    release();
+                }
+                if (isThenable(raw))
+                    unreachableThenable(raw);
+                return Future.fromLifted(raw, elementCodec(element, o));
+            };
+        }
+        return (...args) => {
             if (args.length !== ft.params.length) {
                 throw new TypeError(`${where}: expected ${ft.params.length} argument(s), got ${args.length}`);
             }
             const { lowered, release } = this.#lowerParams(ft.params, args, o);
             let raw;
             try {
-                raw = await fn(...lowered);
+                raw = entry(...lowered);
             }
             finally {
-                // Call-scoped reps minted for `borrow<R>` arguments of a
-                // host-implemented resource live exactly as long as the call.
                 release();
             }
+            if (isThenable(raw))
+                unreachableThenable(raw);
             if (resultType === null)
                 return undefined;
             if (resultType.kind === "result") {
@@ -940,7 +1069,7 @@ function pick(container, path, names) {
 /**
  * Read a DATA property from `obj` (walking its prototype chain, nearest own
  * descriptor wins) without ever invoking accessors. Accessor-backed and
- * absent members both yield `undefined`. Used by the A2 wrap-time suspending
+ * absent members both yield `undefined`. Used by the wrap-time suspending-mark
  * probe, which must not run platform getters against a bare prototype.
  */
 function dataMember(obj, key) {

package/esm/embedder/mod.js

@@ -1,4 +1,4 @@
-// Embedder conventions layer (contracts/embedder-api.md; docs/milestones.md C2 / docs/consumers.md).
+// Embedder conventions layer (contracts/embedder-api.md; docs/consumers.md).
 //
 // The host-facing surface: camelCase facades, resource classes on both sides,
 // stream/future handles, version-canonical import resolution and the branded
@@ -6,7 +6,7 @@
 // the layer works fully untyped. Bindgen (a separate track) emits compile-time
 // types that cast this facade; no generated code participates.
 // Copy registration (contracts/embedder-api.md §"Module identity and
-// @polyengine/protocol", amendment A9; issue #83). Runs at module evaluation, so
+// @polyengine/protocol"; issue #83). Runs at module evaluation, so
 // merely importing the embedder surface puts this copy on the census — which
 // is what makes every cross-copy diagnostic below able to name both sides.
 // Multiple copies are DIAGNOSED, NEVER REFUSED: two isolated bundles on one
@@ -22,8 +22,8 @@ registerRuntimeCopy({
     protocolGeneration: PROTOCOL_GENERATION,
 });
 export { COPY_URL, RUNTIME_VERSION } from "./copy.js";
-// Amendment A22 (contracts/embedder-api.md §"The host-ABI surface and its
-// version"): the runtime's exported surface is application-only. The A9
+// The host-ABI version (contracts/embedder-api.md §"The host-ABI surface and its
+// version"): the runtime's exported surface is application-only. The
 // courtesy re-exports (error classes, predicates, brands, `suspending`,
 // realm crossing, the copy registry) are removed — host modules import that
 // vocabulary from `@polyengine/protocol` directly. The runtime still
@@ -34,9 +34,9 @@ export { requiredImports } from "./imports.js";
 // `NameCollisionError` is the one error class that stays here: it's raised
 // while building an instantiation facade, before any handle/value exists —
 // application machinery, not host-ABI vocabulary (contracts/embedder-api.md
-// §"The host-ABI surface and its version", amendment A22).
+// §"The host-ABI surface and its version", §"The host-ABI surface and its version").
 export { NameCollisionError } from "./errors.js";
-// `createStream<T>()` — the A22 stream-pair factory (contracts/embedder-api.md
+// `createStream<T>()` — the host-ABI version stream-pair factory (contracts/embedder-api.md
 // §"The host-ABI surface and its version" / §"Streams and futures"): the
 // `Stream.create()` static's application-surface spelling, since the
 // concrete `Stream`/`StreamWriter` classes are no longer exported. Handle
@@ -46,6 +46,7 @@ export function createStream() {
     return InternalStream.create();
 }
 export { GuestResource, HostResourceRegistry } from "./resources.js";
-export { camelCase, parseLeafName, pascalCase } from "./casing.js";
-export { asTrackKeySpelling, compareSemver, ImportRegistrationError, ImportResolutionError, ImportResolver, parseInterfaceId, parseSemver, trackKey, } from "./version.js";
+export { camelCase, pascalCase } from "./casing.js";
+export { ImportRegistrationError, ImportResolutionError, ImportResolver, } from "./version.js";
 export { BorrowScope, fromHost, toHost, } from "./values.js";
+export { sync } from "./sync.js";