@polyengine/runtime 0.5.1 → 0.6.0

package/esm/task/mod.js

@@ -12,8 +12,9 @@
 //      and friends, 🧵) are absent rather than approximated — https://github.com/polymorph-components/polyengine/issues/12
 //      defers that feature with memory64.
 import { Table } from "../cabi/handles.js";
+import { COMPONENT_INSTANCE } from "../cabi/context.js";
 import { assert_, trapIf } from "../cabi/trap.js";
-import { CANCELLED_TRUE, chooseCandidate, Store, dbgId, NeedsJspi, notifyInstancePoisoned, PendingCapability, } from "./scheduler.js";
+import { CANCELLED_TRUE, chooseCandidate, isInstancePoisoned, Store, dbgId, NeedsJspi, notifyInstancePoisoned, PendingCapability, } from "./scheduler.js";
 import { Thread } from "./thread.js";
 import { Waitable, WaitableSet } from "./waitable.js";
 import { Subtask } from "./subtask.js";
@@ -22,16 +23,6 @@ export * from "./thread.js";
 export * from "./waitable.js";
 export * from "./subtask.js";
 export * from "./streams.js";
-/**
- * Synthetic-root registry: one root per `Store` (see
- * `ComponentInstanceState.rootOf`). A `WeakMap` so a dead store's root dies
- * with it.
- */
-const syntheticRoots = new WeakMap();
-/** `index` of the synthetic root — outside the real instance index space. */
-const ROOT_INDEX = -1;
-/** Constructor marker: "this one IS the root, do not give it a parent". */
-const ROOT_TOKEN = Symbol("synthetic-root");
 /**
  * Per-component-instance runtime state (definitions.py `ComponentInstance`,
  * line 191).
@@ -39,8 +30,19 @@ const ROOT_TOKEN = Symbol("synthetic-root");
  * `mayLeave` is backed by a real `WebAssembly.Global(i32, mutable)` because
  * FACT adapters import that global (`flags` namespace) and read/write it as
  * the may_leave boolean (wasmtime 47 FACT treats the whole flags global as
- * may_leave; there is no bitmask). Initial value 1 (true). `mayEnter` is
- * host-side state: nothing wasm-visible reads it.
+ * may_leave; there is no bitmask). Initial value 1 (true).
+ *
+ * There is no `may_enter` counterpart and no instance tree: at the pinned
+ * reference (definitions.py @ 2f13265, CM#705) there is no `may_enter`,
+ * `parent`, `entering_set`, `enter_from` or `leave_to`, so nothing gates
+ * entry into a live instance. What polyengine adds beyond the reference is
+ * per-instance POISONING — a named divergence
+ * living entirely in ./scheduler.ts (`isInstancePoisoned`, `entryRefusal`),
+ * not in any state on this class.
+ *
+ * `COMPONENT_INSTANCE` brands this class as a real component instance for
+ * the layers that only see the structural `ComponentInstanceLike`
+ * (cabi/handles.ts `isComponentInstance`; cabi must not import task/).
  */
 export class ComponentInstanceState {
     index;
@@ -48,80 +50,19 @@ export class ComponentInstanceState {
     handles = new Table();
     /** definitions.py `ComponentInstance.threads` — a Table, so `thread.index`. */
     threads = new Table();
-    mayEnter = true;
+    /** cabi's real-instance discriminator; see the class doc. */
+    [COMPONENT_INSTANCE] = true;
     /** definitions.py `backpressure: int` — a *counter* (backpressure.{inc,dec}). */
     backpressure = 0;
     /** definitions.py `num_waiting_to_enter`. */
     numWaitingToEnter = 0;
     /** definitions.py `exclusive_thread`. */
     exclusiveThread = null;
-    /**
-     * definitions.py `ComponentInstance.parent`.
-     *
-     * The plan still gives us a flat instance space, but the tree is no longer
-     * needed: every instance of one instantiation gets the same **synthetic
-     * root** as its parent (contracts/plan-format.md v3 amendment 4 /
-     * polyengine#101). See `enteringSet` for why that is observably equivalent to
-     * the real chain. The root itself has no parent.
-     */
-    parent;
     store;
-    /**
-     * The synthetic per-instantiation root (v3 amendment 4). One per `Store`:
-     * a `Store` is exactly one component instantiation's scheduling scope, so
-     * "all `ComponentInstanceState`s sharing a `Store`" is the set that shares
-     * a top-level component — which is the granularity wasmtime's own
-     * top-level-instance-id comparison uses (concurrent.rs:1876-1886).
-     *
-     * It is a real `ComponentInstanceState` (index -1) rather than a bare flag
-     * so it flows through `selfAndAncestors`/`enteringSet` unchanged; its
-     * handle table stays empty and no task ever runs on it.
-     */
-    static rootOf(store) {
-        let root = syntheticRoots.get(store);
-        if (root === undefined) {
-            root = new ComponentInstanceState(ROOT_INDEX, store, ROOT_TOKEN);
-            syntheticRoots.set(store, root);
-        }
-        return root;
-    }
-    /** Is this the synthetic root (never a real component instance)? */
-    get isSyntheticRoot() {
-        return this.index === ROOT_INDEX && this.parent === null;
-    }
-    constructor(index, store, root) {
+    constructor(index, store) {
         this.index = index;
         this.store = store ?? new Store();
         this.flags = new WebAssembly.Global({ value: "i32", mutable: true }, 1);
-        // The root is its own tree's top; everything else hangs off it. Built
-        // lazily here so no call site has to remember to wire it up.
-        this.parent = root === ROOT_TOKEN
-            ? null
-            : ComponentInstanceState.rootOf(this.store);
-    }
-    /**
-     * Release the synthetic root after a trap broke the enter/leave bracket
-     * (v3 amendment 4, and a **named divergence** from the reference).
-     *
-     * definitions.py poisons the whole entering set: `Store.lift` never reaches
-     * `leave_to`, so the root — which is in every host entry's entering set —
-     * stays `may_enter == False` forever and NO instance of the component can
-     * be entered again. wasmtime is the same by other means (it poisons the
-     * store). polyengine deliberately supports post-trap re-entry of instances the
-     * trap did not touch (exec/boundary.ts `poison`: "sibling instances stay
-     * usable, which is why the lock is released per-instance rather than by
-     * poisoning a whole store the way wasmtime does"), and the synthetic root
-     * must not silently convert that documented divergence into store-wide
-     * poisoning. So a trap poisons the LEAF set only, and the root is released
-     * here — the reentrance gate the root exists for (a *second, concurrent*
-     * host entry) is about a live entry, and after a trap unwinds to the host
-     * there is none.
-     */
-    releaseSyntheticRootOnPoison() {
-        for (const inst of this.selfAndAncestors()) {
-            if (inst.isSyntheticRoot)
-                inst.mayEnter = true;
-        }
     }
     get mayLeave() {
         return this.flags.value !== 0;
@@ -129,84 +70,6 @@ export class ComponentInstanceState {
     set mayLeave(v) {
         this.flags.value = v ? 1 : 0;
     }
-    /** definitions.py `ComponentInstance.self_and_ancestors` (line 236). */
-    selfAndAncestors() {
-        const s = new Set([this]);
-        let a = this.parent;
-        while (a !== null) {
-            s.add(a);
-            a = a.parent;
-        }
-        return s;
-    }
-    /**
-     * definitions.py `ComponentInstance.entering_set` (line 230):
-     * `self_and_ancestors() - caller.self_and_ancestors()`.
-     *
-     * CONTRACT (contracts/plan-format.md v3 amendment 4, polyengine#101): the plan
-     * still carries no wire form for the component-instance tree, and it no
-     * longer needs one. Every instance's parent is the synthetic
-     * per-instantiation root, so:
-     *
-     *   * host entry (`caller === null`): `{this, root}` — the reference's
-     *     entering set for a host entry is `self_and_ancestors()`, which always
-     *     contains the top-level root, so a second host entry anywhere in the
-     *     tree trips on the root either way. This is the divergence #101
-     *     reported (host -> A.f -> host import -> host enters a *different*
-     *     instance): now caught.
-     *   * guest-to-guest (`caller !== null`): `{this}` — the root is in the
-     *     caller's ancestor set and cancels out. Intermediate ancestors would
-     *     be the only difference from the real chain, and they are never
-     *     reachably consulted: FACT compiles same-instance and ancestor calls
-     *     to unconditional compile-time traps, and sibling cycles are
-     *     unreachable because instance imports form a DAG (polyengine#99
-     *     adjudication).
-     *
-     * So the synthetic root is observably equivalent to the full chain, and it
-     * matches wasmtime's own shortcut — a top-level instance-id comparison
-     * (concurrent.rs:1876-1886) — by construction. This reopens only if some
-     * future upstream shape makes nesting depth observable.
-     *
-     * One deliberate departure remains, at the trap path rather than here: see
-     * `releaseSyntheticRootOnPoison`.
-     */
-    enteringSet(caller) {
-        const mine = this.selfAndAncestors();
-        if (caller === null)
-            return mine;
-        for (const c of caller.selfAndAncestors())
-            mine.delete(c);
-        return mine;
-    }
-    /** definitions.py `ComponentInstance.may_enter_from` (line 214). */
-    mayEnterFrom(caller) {
-        for (const inst of this.enteringSet(caller)) {
-            if (!inst.mayEnter)
-                return false;
-        }
-        return true;
-    }
-    /** definitions.py `ComponentInstance.enter_from` (line 220). */
-    enterFrom(caller) {
-        for (const inst of this.enteringSet(caller)) {
-            assert_(inst.mayEnter, "enter_from without may_enter");
-            inst.mayEnter = false;
-        }
-    }
-    /** definitions.py `ComponentInstance.leave_to` (line 225). */
-    leaveTo(caller) {
-        for (const inst of this.enteringSet(caller)) {
-            assert_(!inst.mayEnter, "leave_to without a matching enter_from");
-            inst.mayEnter = true;
-        }
-    }
-    /** Backwards-compatible host-entry helpers (the M0 spelling). */
-    enter() {
-        this.enterFrom(null);
-    }
-    leave() {
-        this.leaveTo(null);
-    }
 }
 /** definitions.py `LiftOptions.equal` (line 643): encoding + memory identity. */
 export function liftOptionsEqual(a, b) {
@@ -258,7 +121,8 @@ export class Task {
      * A FACT callee task's result type arrives as the raw wasmtime
      * `TypeTupleIndex` `prepare-call` passes as `task_return_type`; v3's
      * `task-return.results` / `resultType` pair is the dictionary for it
-     * (contracts/plan-format.md v3 amendment 3). It resolves for every callee
+     * (the task-return trampoline's raw `results` key + interned `resultType`;
+     * contracts/plan-format.md schema). It resolves for every callee
      * that has a `task.return` trampoline of its own — which is every callee
      * that can call `task.return` — but a callee with none (sync-lifted,
      * reached through an async-to-sync adapter) contributes no entry, and then
@@ -376,12 +240,16 @@ export class Task {
         thread.index = null;
     }
     /**
-     * definitions.py `Task.request_cancellation` (line 519). Delivered to a
-     * cancellable thread if one exists and the instance is enterable; otherwise
-     * recorded as pending, to be picked up at the next cancellable block point
-     * (`deliverPendingCancel`).
+     * definitions.py `Task.request_cancellation` (@ 2f13265). Delivered to a
+     * cancellable thread if one exists; otherwise recorded as pending, to be
+     * picked up at the next cancellable block point (`deliverPendingCancel`).
+     *
+     * `caller` is retained for the call-site shape (fact_calls.ts's
+     * `subtask.onCancel`) and for diagnostics; no condition here consults it
+     * (CM#705: entry into a live instance is ungated).
      */
     requestCancellation(caller) {
+        void caller;
         if (this.state === "initial") {
             this.state = "cancel-delivered";
             this.implicitThread.resume(CANCELLED_TRUE);
@@ -408,39 +276,34 @@ export class Task {
                 }
             }
         }
-        if (candidates.length > 0 && this.inst.mayEnterFrom(caller)) {
+        // Merged reference (definitions.py @ 2f13265): `if candidates: deliver`,
+        // full stop — no enterability condition, no bracket (CM#705).
+        //
+        // ONE divergence conjunct survives: a POISONED instance is a corpse whose
+        // threads never resume, so the request parks as pending-cancel forever —
+        // which is the honest state, since a corpse can never reach a cancellable
+        // suspension to deliver at. The reference never faces this because a trap
+        // there kills the whole store. The marker is the authoritative input.
+        if (candidates.length > 0 && !isInstancePoisoned(this.inst)) {
             this.state = "cancel-delivered";
-            this.inst.enterFrom(caller);
             try {
                 chooseCandidate(candidates).resume(CANCELLED_TRUE);
             }
             catch (e) {
-                // Deliberately NOT a `finally`, mirroring `Store.tick`'s
-                // bracket-break discipline (scheduler.ts): the reference wraps the
-                // delivery `resume(Cancelled.TRUE)` in no handler at all
-                // (definitions.py `Task.request_cancellation`, lines 519-532; the
-                // delivery is line 531), so a Trap escaping it never reaches
-                // `leave_to` on line 532 — the entered set stays locked, i.e. the
-                // Component Model's instance poisoning. A `finally` here would
-                // un-poison a half-unwound callee.
+                // A trap escaping the delivery poisons the callee instance
+                // (polyengine#164/#212) — polyengine's per-instance corpse divergence;
+                // the reference wraps this `resume(Cancelled.TRUE)` in no handler at
+                // all and simply ends the world.
                 //
                 // Capability signals are the exception, exactly as in `tick`: they
-                // mark this RUNTIME incomplete, not the component faulted, and in
-                // the reference the blocking operation completes and `leave_to` IS
-                // reached.
-                if (e instanceof NeedsJspi || e instanceof PendingCapability) {
-                    this.inst.leaveTo(caller);
-                }
-                else {
-                    // The synthetic root is released so the poisoning stays
-                    // per-instance (plan v3 amendment 4); for a guest caller the
-                    // entering set is the leaf alone and the release is a no-op.
-                    this.inst.releaseSyntheticRootOnPoison();
+                // mark this RUNTIME incomplete, not the component faulted, and in the
+                // reference the blocking operation they stand in for completes
+                // normally.
+                if (!(e instanceof NeedsJspi) && !(e instanceof PendingCapability)) {
                     notifyInstancePoisoned(this.inst, e);
                 }
                 throw e;
             }
-            this.inst.leaveTo(caller);
         }
         else {
             this.state = "pending-cancel";