@polyengine/runtime 0.5.1 → 0.6.1

package/esm/exec/executor.js

@@ -12,7 +12,7 @@ import { Trap } from "../cabi/trap.js";
 import { ComponentInstanceState, Store } from "../task/mod.js";
 import { anySuspendingImport, assertModeConsistent, chooseMode, isAbortable, isDeferCancel, isSuspending, planNeedsSuspension, suspendingImport, trampolineCanBlock, trampolineNeedsSuspension, } from "../jspi/mod.js";
 import { loadPlan, PlanError, resourceIndexOfDefined, } from "../plan/loader.js";
-import { CONSTRUCTOR_SYNC_ENTRY, createDtorEntry, createLiftedFunction, createLoweredImport, LiveMemory, newStats, } from "./boundary.js";
+import { SYNC_ENTRY, createDtorEntry, createLiftedFunction, createLoweredImport, LiveMemory, newStats, } from "./boundary.js";
 import { createTrampoline, createUnsafeIntrinsic, TranscodeMemory, } from "../intrinsics/mod.js";
 /**
  * Standing probe (CE_COPY_TRACE): log which import made a core instance
@@ -179,7 +179,7 @@ class Executor {
     /** Scratch: set by `importValue` while one module's imports are resolved. */
     sawBlockingImport = false;
     /** LoweredIndex-es whose host functions carry the `suspending()` brand —
-     * populated by `buildLoweredImport`, read by `importValue` (A1). */
+     * populated by `buildLoweredImport`, read by `importValue`. */
     suspendableLowerings = new Set();
     /** Host trap held across a FACT exception barrier (see `HostTrapState`). */
     trapState = { pending: undefined };
@@ -192,13 +192,13 @@ class Executor {
         this.adapterBytes = input.adapters ?? new Map();
         this.hostImports = input.imports ?? {};
         this.verifyHash = input.verifyHash ?? true;
-        // AUTO-DETECTION IS ON (M2 exit). `chooseMode` picks jspi when the
+        // AUTO-DETECTION IS ON by default. `chooseMode` picks jspi when the
         // embedder opts in OR when the plan needs suspension: a stackful async
         // lift, or a genuinely blocking built-in — classified per DECLARATION
         // (`trampolineNeedsSuspension`; the async form of a copy/cancel built-in
         // never blocks and is not evidence). An explicit `jspi: false` still
         // forces plain, and a sync-only component never detects as needing
-        // suspension, so the M1 synchronous API is untouched (pinned by
+        // suspension, so the synchronous API is untouched (pinned by
         // bridge_test "plain mode: lifted exports still return values" and the
         // planNeedsSuspension(hello) === false pin beside it).
         //
@@ -223,7 +223,7 @@ class Executor {
         // stackful async lift or a blocking built-in — per-declaration), and
         // the IMPORTS RECORD (a `suspending()`-marked host function: the
         // embedder's declared intent to park a sync-lowered frame, which no
-        // plan field can express — embedder-api.md amendment A1).
+        // plan field can express — contracts/embedder-api.md §"Functions and async").
         planNeedsSuspension(loaded.wire) || anySuspendingImport(this.hostImports));
     }
     async verifyComponent() {
@@ -492,15 +492,15 @@ class Executor {
                 case "resource": {
                     // Wire the dtor + implementing instance into every concrete
                     // resource-table token for this defined resource
-                    // (tolerate-if-unreferenced for M0; plan-format.md open item).
+                    // (tolerate-if-unreferenced; plan-format.md open item).
                     const dtor = init.dtor === null
                         ? null
                         : this.resolveFunction(init.dtor, `resource ${init.index} dtor`);
                     const inst = this.componentInstance(init.instance);
                     // `init.index` is a DefinedResourceIndex; resource *tables* key off
                     // the component-wide ResourceIndex, which counts imported resources
-                    // first (plan-format.md v0.1 amendment #2 / v0.2
-                    // `importedResources`; wasmtime `Component::resource_index`).
+                    // first (the `importedResources` field, contracts/plan-format.md
+                    // schema; wasmtime `Component::resource_index`).
                     const resourceIndex = resourceIndexOfDefined(this.loaded, init.index);
                     this.wire.resourceTables.forEach((table, tableIndex) => {
                         if (table.kind === "concrete" && table.resource === resourceIndex) {
@@ -622,17 +622,22 @@ class Executor {
                     syncCallStack: this.syncCallStack,
                     allInstances: () => this.componentInstances.values(),
                 });
-                // Constructor exports additionally carry a plain-entered variant
-                // (see CONSTRUCTOR_SYNC_ENTRY): in jspi mode the promising-wrapped
-                // entry above necessarily returns a Promise, which a JS class
-                // constructor cannot await. Deliberately NOT noteEntry()-recorded —
-                // this is the one documented exception to the bridge invariant
-                // (entries wrapped iff imports wrapped), safe because a
-                // synchronously-completing activation never reaches the Suspending
-                // seam.
-                if (this.suspensionMode === "jspi" &&
-                    exp.name.startsWith("[constructor]")) {
-                    value[CONSTRUCTOR_SYNC_ENTRY] = createLiftedFunction({
+                // Every SYNC-TYPED export additionally carries a plain-entered
+                // variant (see SYNC_ENTRY, contracts/embedder-api.md §"Functions and async"):
+                // in jspi mode the promising-wrapped entry above necessarily returns
+                // a Promise, which some host contexts cannot use however promptly it
+                // resolves — a JS class constructor cannot await it at all, and the
+                // embedder's `sync()` adapter exists to ask for the synchronous form
+                // of any sync-typed export. Async-typed exports have no synchronous
+                // form by definition and get none.
+                //
+                // Deliberately NOT noteEntry()-recorded — this is the documented
+                // exception to the bridge invariant (entries wrapped iff imports
+                // wrapped), safe because a synchronously-completing activation never
+                // reaches the Suspending seam. sync() extends the exception from
+                // constructors to all sync entries.
+                if (this.suspensionMode === "jspi" && !ft.async) {
+                    value[SYNC_ENTRY] = createLiftedFunction({
                         name: `${path} (sync entry)`,
                         ft,
                         opts,
@@ -642,6 +647,12 @@ class Executor {
                         trapState: this.trapState,
                         syncCallStack: this.syncCallStack,
                         allInstances: () => this.componentInstances.values(),
+                        // sync() arm 2: a synchronous caller cannot be deferred by the
+                        // hop-quiescence gate, so it refuses (SyncEntryBusy) instead.
+                        // This deliberately changes constructor behaviour: the
+                        // constructor sync entry previously bypassed the gate
+                        // entirely, a latent lift-corruption window.
+                        refuseOnEntryHops: true,
                     });
                 }
                 return { kind: "value", value };
@@ -664,8 +675,9 @@ class Executor {
                     reason: "type export: no runtime surface",
                 };
             case "module": {
-                // plan-format.md v4 amendment 2: an exported embedded core module
-                // surfaces as the already-compiled `WebAssembly.Module` — the same
+                // The `module` export kind (contracts/plan-format.md schema notes):
+                // an exported embedded core module surfaces as the already-compiled
+                // `WebAssembly.Module` — the same
                 // compilation `instantiate-module` initializers use.
                 const module = this.modules[exp.module];
                 if (module === undefined) {
@@ -747,7 +759,7 @@ class Executor {
             return value;
         const optionsAsync = (i) => this.wire.canonicalOptions[i]?.async === true;
         const d = decl;
-        // Host lowers (A1): `trampolineCanBlock` classifies DECLARATIONS and a
+        // Host lowers: `trampolineCanBlock` classifies DECLARATIONS and a
         // `lower-import` declaration says nothing about the host's intent — the
         // evidence is the `suspending()` brand on the host function, recorded by
         // `buildLoweredImport` into `suspendableLowerings` (which resolving this
@@ -931,14 +943,14 @@ class Executor {
         const ft = this.funcType(decl.type, `import '${label}'`);
         const opts = this.resolveOptions(decl.options);
         const suspendable = isSuspending(value);
-        // A23 (contracts/embedder-api.md §"Functions and async"): does this import
+        // cancellation discard (contracts/embedder-api.md §"Functions and async"): does this import
         // opt out of cancel-discard? Unlike `suspendable` above, this needs no
         // executor-state detour — the brand is consumed by `createLoweredImport`
         // itself (it only decides which `onCancel` the lowered import installs, not
         // whether the CoreFn gets wrapped), so nothing downstream has to read a
         // brand off a replaced function identity.
         const deferCancel = isDeferCancel(value);
-        // A24 (same section): does this import want a per-call `AbortSignal`?
+        // abortable() (same section): does this import want a per-call `AbortSignal`?
         // Read exactly like `deferCancel` above and for the same reason — the
         // brand is consumed inside `createLoweredImport`, which mints the
         // controller and appends the signal itself, so no function identity is
@@ -968,7 +980,7 @@ class Executor {
     /**
      * Resolve one plan import against the host-provided import record: index by
      * the component's exact import string, then walk `path` (instance imports —
-     * plan-format.md v0.1 amendment #4).
+     * `imports[].path`, contracts/plan-format.md schema).
      */
     lookupHostImport(name, path, label) {
         if (!(name in this.hostImports)) {

package/esm/exec/host_streams.js

@@ -42,7 +42,7 @@
 //     the event loop".
 //
 // Retention, stated as the rule the arm implements (#162, embedder-api
-// amendment A15): the arm is live iff the host holds a retained end, a parked
+// §"Streams and futures"): the arm is live iff the host holds a retained end, a parked
 // host operation, or an unfinished producer pump. Which ends the host holds
 // follows from where the wrapper came from — a host-CREATED stream keeps its
 // writable end across every lower (only readable ends transfer,
@@ -56,12 +56,12 @@
 // a guest and then never writes to it or drops it will *hang* rather than
 // trap. That is the honest outcome — the component is not deadlocked, the
 // embedder simply has not done its half — and it matches how any other
-// unresolved Promise behaves in JS. That policy is unchanged by A15; what
+// unresolved Promise behaves in JS. That policy is unchanged by deadlock-verdict suppression; what
 // changed is that the claim now EXPIRES with retention, so a store that once
 // round-tripped a stream through the host no longer misreports every later
 // genuine deadlock as this hang.
 //
-// The inverse case is NOT a hang (#66, embedder-api amendment A7): when the
+// The inverse case is NOT a hang (#66, contracts/embedder-api.md §"Streams and futures"): when the
 // GUEST side dies — a trap poisons the instance holding the peer end — the
 // poisoned table's ends are retired (task/streams.ts
 // `retireInstanceAsyncEnds`), so a parked host operation settles DROPPED-
@@ -186,14 +186,14 @@ export class HostBuffer {
         }
         return out;
     }
-    // --- A21 `ByteWindow` (embedder-api amendment A21, polyengine#128) ---
+    // --- `ByteWindow` (embedder-api.md §"Streams and futures" ("Direct-access byte edges"), polyengine#128) ---
     //
     // A host buffer can be the PEER of a direct session on the other end of a
     // host↔host rendezvous. Which of the two shapes it takes follows from the
     // direction it was built for, exactly as `read`/`write` above do:
     //
     //   * SOURCE (`values !== null`, a parked `write`): the window is a view of
-    //     the offered chunk itself — the A5 borrow, scoped to the callback. No
+    //     the offered chunk itself — the stream/future round-trip borrow, scoped to the callback. No
     //     extra copy at all.
     //   * DESTINATION (`values === null`, a parked/arriving `read(max)`): there
     //     is no landing zone to view, so the window is a fresh scratch; the
@@ -255,14 +255,14 @@ export class HostBuffer {
  * driving loop treats "waiting for the embedder" as progress-is-possible
  * rather than deadlock. Re-arms after every notification.
  *
- * RETENTION IS THE LIVENESS RULE (#162, embedder-api amendment A15). The arm
+ * RETENTION IS THE LIVENESS RULE (#162, contracts/embedder-api.md §"Streams and futures"). The arm
  * is live iff the host retains a way to act on this shared object: a retained
  * end, a parked host operation, or an unfinished producer pump. The claim it
  * makes to the deadlock verdicts — "the embedder may still act" — therefore
  * *expires*. Three state transitions implement it:
  *
  *   * `close()` — terminal: DROPPED, an explicit drop, or the shared object's
- *     drop observers (either end, the A7 teardown walk). Nothing can revive
+ *     drop observers (either end, the loud component fault teardown walk). Nothing can revive
  *     the wrapper.
  *   * `disarm()` — NON-terminal: the host handed its last end back to a guest
  *     (a lifted stream/future lowered back in — the identity round trip). The
@@ -319,9 +319,9 @@ class HostActivity {
      * outstanding — by handing the store to the *same* loop an export call
      * would have used, `driveStoreAsync`. Without the asynchronous half a guest
      * parked in a background forwarding task would never be resumed to consume
-     * what we just offered, and the host read would await forever (C0 finding
-     * R-1: the previous local drain only serviced `store.awaiting` and never
-     * awaited `store.pendingHostCalls`, so a writer parked on a
+     * what we just offered, and the host read would await forever (host-pump
+     * starvation: the previous local drain only serviced `store.awaiting` and
+     * never awaited `store.pendingHostCalls`, so a writer parked on a
      * Promise-returning host import stalled the reader).
      *
      * Traps from the synchronous half propagate to the caller of the host
@@ -435,7 +435,7 @@ class HostActivity {
     }
     /**
      * The host retains no way to act: its lifted end was lowered back into a
-     * guest, which now owns it (#162, amendment A15). NON-terminal — a re-lift
+     * guest, which now owns it (#162, §"Streams and futures"). NON-terminal — a re-lift
      * of the same shared object restores retention via `rearm()`.
      *
      * Resolving the stale arm is required, not tidiness: a `driveAsync` parked
@@ -455,7 +455,7 @@ class HostActivity {
         r?.();
     }
     /**
-     * A lift handed the host the readable end again — the A5 cache-hit wrapper
+     * A lift handed the host the readable end again — the stream/future round-trip cache-hit wrapper
      * for a shared object that round-tripped back out of the guest (#162).
      * A no-op for a closed activity (the object is gone for good) and for one
      * that was never disarmed.
@@ -504,7 +504,7 @@ class DirectScope {
         if (this.marked + n > this.capacity) {
             throw new TypeError(`${who}(${n}) would take the invocation's cumulative mark to ` +
                 `${this.marked + n}, past the ${this.capacity} byte(s) the view ` +
-                `held on entry (embedder-api amendment A21)`);
+                `held on entry (embedder-api.md §"Streams and futures" ("Direct-access byte edges"))`);
         }
         this.marked += n;
     }
@@ -512,8 +512,8 @@ class DirectScope {
         if (!this.#live) {
             throw new TypeError("this direct-access view is dead: a DirectDestination/DirectSource " +
                 "is scoped to the synchronous callback invocation it was passed " +
-                "to, and retaining one past its return is misuse (embedder-api " +
-                "amendment A21, polyengine#128)");
+                "to, and retaining one past its return is misuse (embedder-api.md " +
+                `§"Streams and futures" ("Direct-access byte edges"), polyengine#128)`);
         }
     }
     /**
@@ -544,7 +544,7 @@ class DirectSession {
     total = 0;
     /** The callback said `"done"`, or the session failed / was settled. */
     ended = false;
-    /** `ended` because the callback said so (A7 precision; see `DirectSessionInfo`). */
+    /** `ended` because the callback said so (loud component fault precision; see `DirectSessionInfo`). */
     endedByVerdict = false;
     /** Installed in the shared object's pending slot right now. */
     pending = false;
@@ -567,10 +567,10 @@ class DirectSession {
         return false;
     }
     read(_n) {
-        throw new Error("internal: a direct session must go through the A21 seam");
+        throw new Error("internal: a direct session must go through the direct-access byte edge seam");
     }
     write(_vs) {
-        throw new Error("internal: a direct session must go through the A21 seam");
+        throw new Error("internal: a direct session must go through the direct-access byte edge seam");
     }
     // --- the direct protocol ---
     runDirect(peer, n) {
@@ -600,7 +600,7 @@ class DirectSession {
         scope.die();
         if (verdict !== "more" && verdict !== "done") {
             this.#fail(new TypeError(`a direct-access callback must return "more" or "done", got ` +
-                `${JSON.stringify(verdict)} (embedder-api amendment A21)`));
+                `${JSON.stringify(verdict)} (embedder-api.md §"Streams and futures" ("Direct-access byte edges"))`));
             return "failed";
         }
         const k = scope.marked;
@@ -614,7 +614,7 @@ class DirectSession {
             }
             this.#fail(new TypeError('a direct-access callback returned "more" without marking any ' +
                 "bytes; a session that has nothing to offer retracts by " +
-                'returning "done" (embedder-api amendment A21, polyengine#128)'));
+                'returning "done" (embedder-api.md §"Streams and futures" ("Direct-access byte edges") (polyengine#128))'));
             return "failed";
         }
         // Marks acknowledge ON CLEAN RETURN ONLY: this is the first and only
@@ -662,18 +662,18 @@ class DirectSession {
         s?.("reissue");
     }
 }
-/** A21 is `stream<u8>` only; `null` (zero-width) is not u8 either. */
+/** direct-access byte edge is `stream<u8>` only; `null` (zero-width) is not u8 either. */
 function requireU8Element(t, who) {
     if (t === null || despecialize(t).kind !== "u8") {
         throw new TypeError(`${who} is available on stream<u8> only; this stream's element type ` +
             `is ${t === null ? "the zero-width payload" : despecialize(t).kind} ` +
-            `(embedder-api amendment A21, polyengine#128)`);
+            `(embedder-api.md §"Streams and futures" ("Direct-access byte edges") (polyengine#128))`);
     }
 }
 /**
  * Attach host-activity bookkeeping to a shared object at the CABI seam.
  *
- * `kind` is the retention model (#162, amendment A15) — WHICH ends the host
+ * `kind` is the retention model (#162, §"Streams and futures") — WHICH ends the host
  * holds, which is decided entirely by where the wrapper came from:
  *
  *   * `"created"` — `hostStream()`/`hostFuture()`. Only READABLE ends
@@ -700,7 +700,7 @@ function bindOnLower(shared, activity, kind, alsoOnLowered) {
     // activity binding for future lowers (review advisory, host-streams
     // round). The public entry points cannot get here with a wrapped object —
     // `hostStreamFor`/`hostFutureFor` return the cached wrapper instead
-    // (amendment A5) — so a trip here is a bug in this module. The class field
+    // (§"Streams and futures") — so a trip here is a bug in this module. The class field
     // initializes to null; == null covers both sentinels.
     assert_(holder.onLowered == null, "internal: a second host wrapper was built for an already-wrapped " +
         "stream/future (the wrapper cache should have returned the first)");
@@ -768,13 +768,13 @@ function mkStreamEnds(shared, activity) {
         else
             activity.notify();
     };
-    /** The live direct session on each end, if any (A21, polyengine#128). */
+    /** The live direct session on each end, if any (direct-access byte edge, polyengine#128). */
     const direct = {
         read: null,
         write: null,
     };
     /**
-     * Drive one direct session from park to end (A21).
+     * Drive one direct session from park to end.
      *
      * Two shapes reach us, and the difference is *which side arrived second*:
      *
@@ -841,8 +841,8 @@ function mkStreamEnds(shared, activity) {
     };
     /** Shared tail of `cancelWrite`/`cancelRead` for a parked direct session. */
     const cancelDirect = (session) => {
-        // A21: cancelling RETRACTS the session — it resolves with its running
-        // total (A8's indistinguishability caveats unchanged). `shared.cancel()`
+        // direct-access byte edge: cancelling RETRACTS the session — it resolves with its running
+        // total (future abandonment's indistinguishability caveats unchanged). `shared.cancel()`
         // only when the session actually holds the pending slot: a session caught
         // between two issuances holds nothing, and `SharedBase.cancel` asserts
         // that something is pending.
@@ -919,7 +919,7 @@ function mkStreamEnds(shared, activity) {
             },
             writeDirect(produce, info) {
                 // Same one-in-flight-per-end rule, same wording shape as `write`:
-                // `writeDirect` participates in it exactly as `write` does (A21).
+                // `writeDirect` participates in it exactly as `write` does.
                 if (parked.write) {
                     throw new TypeError("a write is already in flight on this stream's writable end; " +
                         "await it or cancelWrite() first");
@@ -1025,8 +1025,8 @@ function mkStreamEnds(shared, activity) {
     };
 }
 /**
- * One host wrapper per shared object, by identity (embedder-api amendment
- * A5). A stream/future value that round-trips host → guest → host lifts back
+ * One host wrapper per shared object, by identity (contracts/embedder-api.md
+ * §"Streams and futures"). A stream/future value that round-trips host → guest → host lifts back
  * as the SAME wrapper the host already holds, so wrapping is idempotent —
  * there is never a second `HostActivity` competing to pump one shared object
  * (the hazard the old double-wrap assert guarded against), and the readable

package/esm/intrinsics/async_builtins.js

@@ -1,5 +1,5 @@
 // The 0.3 async canonical built-ins, as host trampolines
-// (contracts/intrinsics.md §B "M2"): task.{return,cancel},
+// (contracts/intrinsics.md §B): task.{return,cancel},
 // backpressure.{set,inc,dec}, waitable-set.{new,wait,poll,drop},
 // waitable.join, subtask.{drop,cancel} and thread.yield.
 //
@@ -77,8 +77,9 @@ export function createTaskReturn(decl, ctx) {
         //
         // Plan v3 enables this for FACT cross-component tasks too: the callee
         // task's declared result type is now resolvable from the raw
-        // `TypeTupleIndex` `prepare-call` carried (contracts/plan-format.md v3
-        // amendment 3, wired in fact_calls.ts). It remains skipped for the one
+        // `TypeTupleIndex` `prepare-call` carried (the task-return trampoline's
+        // raw `results` key + interned `resultType`, contracts/plan-format.md
+        // schema; wired in fact_calls.ts). It remains skipped for the one
         // case v3 does not answer — a callee the plan maps no `task.return`
         // tuple for, where `ft.results` is a placeholder rather than a
         // declaration (`factResultTypesKnown === false`); comparing against a
@@ -415,7 +416,7 @@ export function createSubtaskCancel(decl, inst, mode = "plain") {
                 // cancel sits parked non-cancellably, which is determinate, so the
                 // genuine BLOCKED answer is still immediate. Host-import subtasks
                 // carry no callee task, and their state cannot be mid-hop: the
-                // default (A23) onCancel resolves them before this branch is ever
+                // default onCancel resolves them before this branch is ever
                 // reached, and a `deferCancel` import's no-op onCancel leaves them
                 // simply unresolved — either way the pre-jspi immediate answer
                 // stands.
@@ -495,6 +496,13 @@ function requireWaitableSet(inst, si, what) {
     trapIf(!(wset instanceof WaitableSet), `${what}: handle ${si} is not a waitable set`);
     return wset;
 }
+/**
+ * The two event payload words. Hoisted out of `unpackEvent` because
+ * cabi/layout.ts and cabi/types.ts memoize on `ValType` identity (issue
+ * #261): a fresh literal per call is a guaranteed cache miss plus a
+ * `WeakMap.set` on immediate garbage, twice per event delivered.
+ */
+const EVENT_PAYLOAD_TYPE = Object.freeze({ kind: "u32" });
 /**
  * definitions.py `unpack_event` (line 2422): store the two payload words at
  * `ptr` and return the event code.
@@ -502,11 +510,11 @@ function requireWaitableSet(inst, si, what) {
 function unpackEvent(opts, inst, ptr, e) {
     const [event, p1, p2] = e;
     const cx = new LiftLowerContext(cabiOptions(opts), inst, null);
-    storeValue(cx, p1, { kind: "u32" }, ptr);
-    storeValue(cx, p2, { kind: "u32" }, ptr + 4);
+    storeValue(cx, p1, EVENT_PAYLOAD_TYPE, ptr);
+    storeValue(cx, p2, EVENT_PAYLOAD_TYPE, ptr + 4);
     return event;
 }
-// Structural `ValType` equality (the C2-D bugfix) moved to cabi/types.ts
+// Structural `ValType` equality (the circular-structure bugfix) moved to cabi/types.ts
 // (`valTypesEqual`) when the #18 tls smoke found its stream-element sibling;
 // the contract note lives there now.
 /** Unused-import guard: `trap` is re-exported for symmetry with cabi. */

package/esm/intrinsics/context.js

@@ -83,7 +83,7 @@ export function createUnsafeIntrinsic(symbol,
 inst) {
     const match = /^context-(get|set)-i32-(\d+)$/.exec(symbol);
     if (match === null) {
-        throw new UnsupportedFeatureError("M2", `component imports the unsafe intrinsic '${symbol}', which has no ` +
+        throw new UnsupportedFeatureError("task-core", `component imports the unsafe intrinsic '${symbol}', which has no ` +
             `portable meaning in a JS host (only context.{get,set} do)`);
     }
     const slot = Number(match[2]);

package/esm/intrinsics/errors.js

@@ -1,13 +1,13 @@
-// Shared failure type for trampolines/intrinsics scheduled after the current
-// milestone. Split out of ./mod.ts so sibling intrinsic modules can raise it
-// without importing the (much larger) trampoline dispatcher.
-/** Instantiate-time failure for functionality scheduled after M0. */
+// Shared failure type for trampolines/intrinsics gated on a not-yet-built
+// runtime capability. Split out of ./mod.ts so sibling intrinsic modules can
+// raise it without importing the (much larger) trampoline dispatcher.
+/** Instantiate-time failure for functionality gated on a missing capability. */
 export class UnsupportedFeatureError extends Error {
-    milestone;
-    constructor(milestone, what) {
-        super(`${what} — scheduled for ${milestone}, not implemented in the current ` +
-            `executor (contracts/intrinsics.md §B)`);
-        this.milestone = milestone;
+    capability;
+    constructor(capability, what) {
+        super(`${what} — needs the "${capability}" capability, not yet implemented ` +
+            `in the current executor (contracts/intrinsics.md §B)`);
+        this.capability = capability;
         this.name = "UnsupportedFeatureError";
     }
 }