@wildshard/shard-format 0.0.1 → 0.4.5

package/src/format/scriptAdmission.ts

@@ -0,0 +1,165 @@
+import { SCRIPT_ABI, SCRIPT_EXPORTS, SCRIPT_IMPORTS } from './scriptAbi.ts';
+import { SCRIPT_V1_EXPORTS, SCRIPT_V1_IMPORTS, SCRIPT_V1_LAYOUT } from './scriptAbiV1.ts';
+
+class Reader {
+  pos = 0;
+  readonly bytes: Uint8Array;
+  constructor(bytes: Uint8Array) { this.bytes = bytes; }
+  byte(): number { const n = this.bytes[this.pos++]; if (n === undefined) throw new Error('Truncated module'); return n; }
+  uint(): number {
+    let n = 0;
+    for (let i = 0; i < 5; i++) { const b = this.byte(); if (i === 4 && b > 15) throw new Error('Invalid u32'); n += (b & 127) * 2 ** (i * 7); if (b < 128) return n; }
+    throw new Error('Invalid u32');
+  }
+  signed(max = 5): number {
+    let n = 0, shift = 0;
+    for (let i = 0; i < max; i++) { const b = this.byte(); n += (b & 127) * 2 ** shift; shift += 7; if (b < 128) return b & 64 ? n - 2 ** shift : n; }
+    throw new Error('Invalid signed integer');
+  }
+  take(n: number): Uint8Array { if (n < 0 || this.pos + n > this.bytes.length) throw new Error('Truncated section'); const b = this.bytes.subarray(this.pos, this.pos + n); this.pos += n; return b; }
+  name(): string { return new TextDecoder('utf-8', { fatal: true }).decode(this.take(this.uint())); }
+  done(): boolean { return this.pos === this.bytes.length; }
+}
+interface Signature { params: number[]; result: number | undefined }
+interface Instruction { op: number; arg: number | undefined }
+/** Limits and complete mutable-global snapshot names established without executing module code. */
+export interface ScriptAdmission { initialPages: number; maximumPages: number; globals: readonly string[]; functions: number }
+const NUMERIC = new Set([0x7f, 0x7e, 0x7d, 0x7c]);
+function numeric(r: Reader): number { const n = r.byte(); if (!NUMERIC.has(n)) throw new Error('Non-numeric type'); return n; }
+function equal(a: readonly number[], b: readonly number[]): boolean { return a.length === b.length && a.every((n, i) => n === b[i]); }
+function signature(s: Signature): number[] { return [...s.params, s.result ?? 0]; }
+function instructions(r: Reader): Instruction[] {
+  const out: Instruction[] = [];
+  while (!r.done()) {
+    const op = r.byte(); let arg: number | undefined;
+    if (op >= 0x02 && op <= 0x04) { const t = r.byte(); if (t !== 0x40 && !NUMERIC.has(t)) throw new Error('Multivalue block'); }
+    else if ([0x0c, 0x0d, 0x10, 0x20, 0x21, 0x22, 0x23, 0x24].includes(op)) arg = r.uint();
+    else if (op === 0x0e) { const n = r.uint(); if (n > SCRIPT_ABI.maxBytes) throw new Error('Branch table cap'); for (let i = 0; i <= n; i++) r.uint(); }
+    else if (op >= 0x28 && op <= 0x3e) { r.uint(); r.uint(); }
+    else if (op === 0x3f || op === 0x40) { if (r.byte() !== 0) throw new Error('Multiple memories'); }
+    else if (op === 0x41) arg = r.signed();
+    else if (op === 0x42) r.signed(10);
+    else if (op === 0x43) r.take(4);
+    else if (op === 0x44) r.take(8);
+    else if (op === 0xfc) {
+      const sub = r.uint();
+      if (sub <= 7) { /* Saturating numeric conversions. */ }
+      else throw new Error('Unsupported bulk instruction');
+    } else if (![0x00, 0x01, 0x05, 0x0b, 0x0f, 0x1a, 0x1b].includes(op) && !(op >= 0x45 && op <= 0xc4)) throw new Error('Banned instruction or feature');
+    out.push({ op, arg });
+  }
+  return out;
+}
+function isCall(i: Instruction | undefined, target: number): boolean { return i?.op === 0x10 && i.arg === target; }
+function charge(code: readonly Instruction[], at: number, fuel: number, bytes: number): boolean {
+  const i = code[at]; return i?.op === 0x41 && (i.arg ?? 0) >= bytes && isCall(code[at + 1], fuel);
+}
+// Like v2 admission, retain only a small page-local set of successful byte
+// inspections. Compare the complete bytes on every hit: identity alone cannot
+// admit a mutated caller buffer. Results never share the mutable globals array.
+const recentAdmissions: { abi: 0 | 1; bytes: Uint8Array; admission: ScriptAdmission }[] = [];
+function sameBytes(a: Uint8Array, b: Uint8Array): boolean {
+  if (a.byteLength !== b.byteLength) return false;
+  for (let i = 0; i < a.byteLength; i++) if (a[i] !== b[i]) return false;
+  return true;
+}
+/** Validate bytes and metering without instantiating or executing any module code. Tables are capped at zero in v0. */
+export function admitScript(bytes: Uint8Array, abi: 0 | 1 = 0): ScriptAdmission {
+  if (bytes.length > SCRIPT_ABI.maxBytes) throw new Error('Invalid or oversized module');
+  // Read the typed array's actual storage, not caller-overridden slice,
+  // iterator or byteLength properties. Inspection and the cache share it.
+  const snapshot = new Uint8Array(bytes);
+  const known = recentAdmissions.find(row => row.abi === abi && sameBytes(row.bytes, snapshot));
+  if (known !== undefined) return { ...known.admission, globals: [...known.admission.globals] };
+  const admission = inspectScript(snapshot, abi);
+  recentAdmissions.unshift({ abi, bytes: snapshot, admission: { ...admission, globals: [...admission.globals] } });
+  recentAdmissions.length = Math.min(recentAdmissions.length, 16);
+  return admission;
+}
+function inspectScript(bytes: Uint8Array, abi: 0 | 1): ScriptAdmission {
+  const required = abi === 1 ? SCRIPT_V1_EXPORTS : SCRIPT_EXPORTS;
+  const allowed = abi === 1 ? SCRIPT_V1_IMPORTS : SCRIPT_IMPORTS;
+  if (bytes.length > SCRIPT_ABI.maxBytes || !WebAssembly.validate(new Uint8Array(bytes))) throw new Error('Invalid or oversized module');
+  const r = new Reader(bytes); r.take(8);
+  const types: Signature[] = [], functions: number[] = [], imports = new Map<string, number>();
+  const exports = new Map<string, { kind: number; index: number }>();
+  const mutable: number[] = [], bodies: { code: Instruction[]; bytes: number; locals: number }[] = [];
+  let imported = 0, initialPages = 0, maximumPages = 0;
+  let declaredDataCount: number | undefined, dataCount = 0;
+  while (!r.done()) {
+    const id = r.byte(), s = new Reader(r.take(r.uint()));
+    if (id === 0) continue;
+    if (id === 1) {
+      const count = s.uint(); if (count > SCRIPT_ABI.maxFunctions) throw new Error('Type cap');
+      for (let i = 0; i < count; i++) { if (s.byte() !== 0x60) throw new Error('GC type'); const n = s.uint(); if (n > 16) throw new Error('Parameter cap'); const params = Array.from({ length: n }, () => numeric(s)); const results = s.uint(); if (results > 1) throw new Error('Multivalue'); types.push({ params, result: results === 1 ? numeric(s) : undefined }); }
+    } else if (id === 2) {
+      const count = s.uint(); if (count > 9) throw new Error('Import cap');
+      for (let i = 0; i < count; i++) {
+        const mod = s.name(), name = s.name(), kind = s.byte(); if (mod !== 'env' || imports.has(name)) throw new Error('Import outside ABI');
+        if (kind === 0) {
+          const t = s.uint(), expected = allowed[name], actual = types[t];
+          if (!expected || !actual || !equal(signature(actual), expected)) throw new Error('Import signature outside ABI');
+          imports.set(name, imported++); functions.push(t);
+        } else if (kind === 2 && name === 'memory' && initialPages === 0) {
+          if (s.uint() !== 1) throw new Error('Memory must be capped and unshared'); initialPages = s.uint(); maximumPages = s.uint();
+          if (initialPages < 1 || maximumPages < initialPages || maximumPages > SCRIPT_ABI.memoryPages) throw new Error('Memory cap'); imports.set(name, -1);
+          if (abi === 1 && (maximumPages !== initialPages || maximumPages > SCRIPT_V1_LAYOUT.maximumPages)) throw new Error('Decision memory must be fixed at 1..4 pages');
+        } else throw new Error('Import outside ABI');
+      }
+    } else if (id === 3) { const count = s.uint(); if (count + imported > SCRIPT_ABI.maxFunctions) throw new Error('Function cap'); for (let i = 0; i < count; i++) functions.push(s.uint()); }
+    else if (id === 6) {
+      const globals = s.uint(); if (globals > SCRIPT_ABI.maxGlobals) throw new Error('Global cap');
+      for (let i = 0; i < globals; i++) { numeric(s); const mut = s.byte(); if (mut === 1) mutable.push(i); const op = s.byte(); if (op === 0x41) s.signed(); else if (op === 0x42) s.signed(10); else if (op === 0x43 || op === 0x44) { const b = s.take(op === 0x43 ? 4 : 8), view = new DataView(b.buffer, b.byteOffset, b.byteLength); if (!Number.isFinite(op === 0x43 ? view.getFloat32(0, true) : view.getFloat64(0, true))) throw new Error('Non-finite global initializer'); } else throw new Error('Global initializer'); if (s.byte() !== 0x0b) throw new Error('Global initializer'); }
+    } else if (id === 7) { const n = s.uint(); for (let i = 0; i < n; i++) exports.set(s.name(), { kind: s.byte(), index: s.uint() }); }
+    else if (id === 10) {
+      const count = s.uint();
+      for (let i = 0; i < count; i++) { const b = new Reader(s.take(s.uint())), size = b.bytes.length, groups = b.uint(); let locals = 0; for (let j = 0; j < groups; j++) { locals += b.uint(); numeric(b); } if (locals > SCRIPT_ABI.maxLocals) throw new Error('Local cap'); bodies.push({ code: instructions(b), bytes: size, locals }); }
+    } else if (id === 11) {
+      const n = s.uint(); dataCount = n; for (let i = 0; i < n; i++) { if (s.uint() !== 0 || s.byte() !== 0x41) throw new Error('Only active memory data'); const offset = s.signed(); if (s.byte() !== 0x0b || offset < 0) throw new Error('Data offset'); const len = s.uint(); if (offset + len > initialPages * 65536) throw new Error('Data cap'); s.take(len); }
+    } else if (id === 12) declaredDataCount = s.uint();
+    else throw new Error('Banned section (start, table, memory, tags or passive data)');
+    if (!s.done()) throw new Error('Trailing section bytes');
+  }
+  const enter = imports.get('enter'), leave = imports.get('leave'), fuel = imports.get('fuel');
+  if (declaredDataCount !== undefined && declaredDataCount !== dataCount) throw new Error('Wrong data count');
+  if (enter === undefined || leave === undefined || fuel === undefined || initialPages === 0) throw new Error('Missing instrumentation');
+  const wrappers = new Set<number>(), implementations = new Set<number>();
+  for (let i = 0; i < bodies.length; i++) {
+    const body = bodies[i]; if (!body) throw new Error('Missing body'); const type = types[functions[i + imported] ?? -1]; if (!type) throw new Error('Missing signature');
+    if (!isCall(body.code[0], enter)) continue;
+    const expected: Instruction[] = [{ op: 0x10, arg: enter }, ...type.params.map((_, arg) => ({ op: 0x20, arg }))];
+    const target = body.code[expected.length]?.arg;
+    if (target === undefined || target < imported || !equal(signature(type), signature(types[functions[target] ?? -1] ?? { params: [], result: undefined }))) throw new Error('Invalid depth wrapper target');
+    expected.push({ op: 0x10, arg: target });
+    if (type.result !== undefined) expected.push({ op: 0x21, arg: type.params.length });
+    expected.push({ op: 0x10, arg: leave });
+    if (type.result !== undefined) expected.push({ op: 0x20, arg: type.params.length });
+    expected.push({ op: 0x0b, arg: undefined });
+    if (body.locals !== (type.result === undefined ? 0 : 1) || body.code.length !== expected.length || body.code.some((v, j) => { const e = expected[j]; return !e || v.op !== e.op || v.arg !== e.arg; })) throw new Error('Invalid depth wrapper');
+    wrappers.add(i + imported); implementations.add(target);
+  }
+  for (let i = 0; i < bodies.length; i++) {
+    const body = bodies[i]; if (!body) throw new Error('Missing body'); const index = i + imported;
+    if (wrappers.has(index)) continue;
+    if (!implementations.has(index) || !charge(body.code, 0, fuel, body.bytes)) throw new Error('Missing function fuel instrumentation');
+    for (let j = 0; j < body.code.length; j++) {
+      const instr = body.code[j]; if (!instr) throw new Error('Missing instruction');
+      if (abi === 1 && instr.op === 0x40) throw new Error('Decision memory.grow is forbidden');
+      if (instr.op === 0x03 && !charge(body.code, j + 1, fuel, body.bytes)) throw new Error('Missing loop fuel instrumentation');
+      if (isCall(instr, fuel) && !charge(body.code, j - 1, fuel, body.bytes)) throw new Error('Invalid fuel charge');
+      const float32 = instr.op === 0x2a || instr.op === 0x43 || (instr.op >= 0x8b && instr.op <= 0x98) || (instr.op >= 0xb2 && instr.op <= 0xb6) || instr.op === 0xbe;
+      const float64 = instr.op === 0x2b || instr.op === 0x44 || (instr.op >= 0x99 && instr.op <= 0xa6) || (instr.op >= 0xb7 && instr.op <= 0xbb) || instr.op === 0xbf;
+      if (float32 || float64) { const check = imports.get(float32 ? 'finite32' : 'finite64'); if (check === undefined || !isCall(body.code[j + 1], check)) throw new Error('Missing finite float instrumentation'); }
+      if (instr.op === 0x10 && (instr.arg === enter || instr.arg === leave || ((instr.arg ?? -1) >= imported && !wrappers.has(instr.arg ?? -1)))) throw new Error('Bypassed depth instrumentation');
+    }
+  }
+  if (wrappers.size === 0 || bodies.length !== functions.length - imported) throw new Error('Missing instrumented functions');
+  for (const [name, contract] of Object.entries(required)) {
+    const exp = exports.get(name), type = types[functions[exp?.index ?? -1] ?? -1];
+    const expected = contract.length === 0 ? [0] : contract;
+    if (exp?.kind !== 0 || !wrappers.has(exp.index) || !type || !equal(signature(type), expected)) throw new Error(`Missing or wrong ABI export: ${name}`);
+  }
+  for (const exp of exports.values()) if (exp.kind === 0 && !wrappers.has(exp.index)) throw new Error('Unwrapped function export');
+  const stateNames = mutable.map((index) => { const name = `__state_${index}`, exp = exports.get(name); if (exp?.kind !== 3 || exp.index !== index) throw new Error('Missing mutable-global snapshot export'); return name; });
+  return { initialPages, maximumPages, globals: stateNames, functions: wrappers.size };
+}

package/src/format/scriptAdmissionV2.ts

@@ -0,0 +1,126 @@
+/** ABI v2 executable intake: validate actual bytes before any guest code runs.
+ * Kept separate from scriptAdmission so shipped v0/v1 contracts stay unchanged. */
+import type { V2Body,V2Instruction,V2Signature } from './scriptModuleV2.ts';
+import { inspectV2Fuel,type V2Lane } from './scriptFuelV2.ts';
+import * as v from 'valibot';
+
+/** H13 selects these versioned implementations explicitly. They describe the
+ * v2 toolchain only; the shipped v0/v1 compiler and admission remain separate. */
+export const SCRIPT_V2_REVISIONS: Readonly<{abi:2;minor:0;compiler:1;admission:1}> = Object.freeze({ abi: 2,minor: 0,compiler: 1,admission: 1 } as const);
+export const ScriptArtifactV2Schema: v.StrictObjectSchema<{ readonly abi: v.GenericSchema<ScriptArtifactV2RowsInput['abi'], ScriptArtifactV2Rows['abi']>; readonly minor: v.GenericSchema<ScriptArtifactV2RowsInput['minor'], ScriptArtifactV2Rows['minor']>; readonly compilerRevision: v.GenericSchema<ScriptArtifactV2RowsInput['compilerRevision'], ScriptArtifactV2Rows['compilerRevision']>; readonly admissionRevision: v.GenericSchema<ScriptArtifactV2RowsInput['admissionRevision'], ScriptArtifactV2Rows['admissionRevision']>; readonly hash: v.GenericSchema<ScriptArtifactV2RowsInput['hash'], ScriptArtifactV2Rows['hash']>; readonly lane: v.GenericSchema<ScriptArtifactV2RowsInput['lane'], ScriptArtifactV2Rows['lane']>; readonly pages: v.GenericSchema<ScriptArtifactV2RowsInput['pages'], ScriptArtifactV2Rows['pages']>; readonly ioBytes: v.GenericSchema<ScriptArtifactV2RowsInput['ioBytes'], ScriptArtifactV2Rows['ioBytes']>; }, undefined> = v.strictObject({
+  abi: v.literal(SCRIPT_V2_REVISIONS.abi),minor: v.literal(SCRIPT_V2_REVISIONS.minor),
+  compilerRevision: v.literal(SCRIPT_V2_REVISIONS.compiler),admissionRevision: v.literal(SCRIPT_V2_REVISIONS.admission),
+  hash: v.pipe(v.string(),v.length(64),v.regex(/^[a-f0-9]{64}$/u)),lane: v.picklist(['sim','project','view']),
+  pages: v.pipe(v.number(),v.integer(),v.minValue(1),v.maxValue(4)),
+  ioBytes: v.pipe(v.number(),v.integer(),v.minValue(656),v.maxValue(4*65536)),
+});
+export type ScriptArtifactV2 = Readonly<v.InferOutput<typeof ScriptArtifactV2Schema>>;
+/** Metadata selection is not executable admission or content-hash verification.
+ * The native asset owner verifies the hash before lending bytes to its lane. */
+export function parseScriptArtifactV2(input: unknown): ScriptArtifactV2 {
+  const row = v.parse(ScriptArtifactV2Schema,input);
+  if (row.ioBytes > row.pages*65536) throw new Error('V2 artifact IO exceeds its pages');
+  return Object.freeze(row);
+}
+
+interface Control { start: number; end: number; type: number; op: number }
+interface Guard { control: Control; type: number; set: number }
+const f32 = 0x7d, f64 = 0x7c;
+function op(code: readonly V2Instruction[],at: number,operation: number,arg?: number): boolean {
+  const value = code[at]; return value?.op === operation && (arg === undefined || value.args[0] === arg);
+}
+function finiteGuards(body: V2Body,type: V2Signature,code: readonly V2Instruction[],floatGlobals: ReadonlyMap<number,number>): void {
+  const root: Control = { start: -1,end: code.length-1,type: type.result ?? 0x40,op: 0x02 }, controls = [root], stack = [root];
+  const branches: { at: number; targets: Control[] }[] = [];
+  for (let i = 0; i < code.length; i++) {
+    const value = code[i]; if (value === undefined) throw new Error('Missing v2 finite instruction');
+    if (value.op >= 0x02 && value.op <= 0x04) {
+      const control = { start: i,end: -1,type: value.args[0] ?? -1,op: value.op }; controls.push(control); stack.push(control);
+    } else if (value.op === 0x0b) {
+      const control = stack.pop(); if (control === undefined) throw new Error('Unbalanced v2 finite control'); control.end = i;
+    } else if (value.op === 0x0c || value.op === 0x0d || value.op === 0x0e) {
+      branches.push({ at: i,targets: value.args.map(depth => { const target = stack.at(-1-depth); if (target === undefined) throw new Error('Invalid v2 branch depth'); return target; }) });
+    } else if (value.op === 0x0f) branches.push({ at: i,targets: [root] });
+  }
+  const locals = [...type.params,...body.locals], guards: Guard[] = [];
+  for (const control of controls) {
+    if (control.op !== 0x02 || (control.type !== f32 && control.type !== f64)) continue;
+    const at = control.end-13, local = code[at]?.args[0], narrow = control.type === f32;
+    if (local === undefined || locals[local] !== control.type || at <= control.start+1 || !op(code,at,0x21,local)) continue;
+    const maximum = code[at+6]?.literal, expected = narrow ? Math.fround(3.4028234663852886e38) : Number.MAX_VALUE;
+    if (maximum !== expected) continue;
+    const shape: readonly [number,number | undefined][] = [[0x20,local],[0x20,local],[narrow ? 0x5c : 0x62,undefined],[0x20,local],
+      [narrow ? 0x8b : 0x99,undefined],[narrow ? 0x43 : 0x44,undefined],[narrow ? 0x5e : 0x64,undefined],[0x72,undefined],[0x04,0x40],[0x00,undefined],[0x0b,undefined],[0x20,local],[0x0b,undefined]];
+    if (shape.every(([operation,arg],i) => op(code,at+1+i,operation,arg))) guards.push({ control,type: control.type,set: at });
+  }
+  const byEnd = new Map(guards.map(guard => [guard.control.end,guard])), checkedReinterpret = new Map(guards.map(guard => [guard.set-1,guard.type]));
+  const protectedControls = new Set(guards.map(guard => guard.control));
+  for (const branch of branches) if (branch.targets.some(target => protectedControls.has(target))) throw new Error('Branch bypasses a v2 finite guard');
+  for (let i = 0; i < code.length; i++) {
+    const value = code[i]; if (value === undefined) throw new Error('Missing v2 finite instruction');
+    const width = value.op === 0x38 || value.op === 0xbc ? f32 : value.op === 0x39 || value.op === 0xbd ? f64
+      : value.op === 0x24 ? floatGlobals.get(value.args[0] ?? -1) : undefined;
+    if (width !== undefined) {
+      const actual = byEnd.get(i-1)?.type;
+      if (actual === undefined || actual !== width) throw new Error('Missing v2 finite input guard');
+    }
+    if ((value.op === 0xbe && checkedReinterpret.get(i) !== f32) || (value.op === 0xbf && checkedReinterpret.get(i) !== f64)) throw new Error('Missing v2 finite reinterpret guard');
+  }
+}
+export interface ScriptAdmissionV2 {
+  initialPages: number; maximumPages: number; globals: readonly string[];
+  fuel: number; lane: V2Lane; io: number; ioBytes: number; entries: ReadonlyMap<string,number>;
+}
+/** G782: a page admits one module once per exact bytes and options. Nalati's crossing admitted its titan return module
+ *  three or four times (220 ms of admission on a phone-4x cold crossing). Same bytes, same verdict; a refusal is never
+ *  kept, and every hit compares the whole byte array. The key is the I/O size alone (T10): a runtime module has exactly
+ *  one work entry, so a requested lane admits only when it is the admitted one, and the contract (lane 'project'), the
+ *  projection and its ScriptModuleV2 (no lane) each inspected the same Nalati module again, ~5 ms an owner at phone 4x. */
+const RECENT_ADMISSIONS = 16, recentAdmissions: { readonly key: string; readonly bytes: Uint8Array; readonly admission: ScriptAdmissionV2 }[] = [];
+/** No instantiation, getters or initialization occurs during admission. The
+ * runtime must still validate host-owned output regions before publishing. */
+export function admitScriptV2(bytes: Uint8Array,options: { readonly ioBytes?: number; readonly lane?: V2Lane; readonly compilerRevision?: number; readonly admissionRevision?: number } = {}): ScriptAdmissionV2 {
+  if ((options.compilerRevision !== undefined && options.compilerRevision !== SCRIPT_V2_REVISIONS.compiler)
+    || (options.admissionRevision !== undefined && options.admissionRevision !== SCRIPT_V2_REVISIONS.admission)) throw new Error('Unsupported v2 compiler/admission revision');
+  const key = String(options.ioBytes ?? 656), known = recentAdmissions.find(row => row.key === key && sameBytes(row.bytes,bytes));
+  if (known !== undefined) {
+    if (options.lane !== undefined && options.lane !== known.admission.lane) throw new Error('V2 lane has missing or extra work entries');
+    return { ...known.admission };
+  }
+  const admission = inspectAdmission(bytes,options);
+  recentAdmissions.unshift({ key,bytes: bytes.slice(),admission }); recentAdmissions.length = Math.min(recentAdmissions.length,RECENT_ADMISSIONS);
+  return { ...admission };
+}
+function sameBytes(a: Uint8Array,b: Uint8Array): boolean {
+  if (a.byteLength !== b.byteLength) return false;
+  for (let i = 0; i < a.byteLength; i++) if (a[i] !== b[i]) return false;
+  return true;
+}
+function inspectAdmission(bytes: Uint8Array,options: { readonly ioBytes?: number; readonly lane?: V2Lane }): ScriptAdmissionV2 {
+  const fuel = inspectV2Fuel(bytes,options), image = fuel.image;
+  const floats = new Map(image.globals.flatMap((global,index): [number,number][] => global.type === f32 || global.type === f64 ? [[index,global.type]] : []));
+  for (let i = 0; i < image.bodies.length; i++) {
+    const body = image.bodies[i], type = image.types[image.functions[i] ?? -1], code = fuel.unmetered[i];
+    if (body === undefined || type === undefined || code === undefined) throw new Error('Missing v2 finite body'); finiteGuards(body,type,code,floats);
+  }
+  const index = image.exports.get('ws_io')?.index, io = image.bodies[index ?? -1]?.code[0]?.literal;
+  if (typeof io !== 'number') throw new Error('Missing v2 IO constant');
+  const ioBytes = options.ioBytes ?? 656;
+  if (!Number.isSafeInteger(ioBytes) || ioBytes < 656 || ioBytes > image.pages*65536-io) throw new Error('V2 IO does not fit fixed memory');
+  if (image.data.some(row => row.length > 0 && row.offset < io+ioBytes && row.offset+row.length > io)) throw new Error('V2 static data overlaps host IO');
+  return { initialPages: fuel.pages,maximumPages: fuel.pages,globals: fuel.globals,fuel: fuel.fuel,lane: fuel.lane,io,ioBytes,entries: fuel.entries };
+}
+
+/** Admitted data contracts, independent of validator implementation metadata. */
+export type ScriptArtifactV2RowsInput = ScriptArtifactV2Rows;
+interface ScriptArtifactV2RowsFields {
+    abi: (typeof SCRIPT_V2_REVISIONS)['abi'];
+    minor: (typeof SCRIPT_V2_REVISIONS)['minor'];
+    compilerRevision: (typeof SCRIPT_V2_REVISIONS)['compiler'];
+    admissionRevision: (typeof SCRIPT_V2_REVISIONS)['admission'];
+    hash: string;
+    lane: 'sim' | 'project' | 'view';
+    pages: number;
+    ioBytes: number;
+}
+export type ScriptArtifactV2Rows = { [Key in keyof ScriptArtifactV2RowsFields]: ScriptArtifactV2RowsFields[Key] };

package/src/format/scriptContract.ts

@@ -0,0 +1,170 @@
+import { isJsonData } from './json.ts';
+import { SpawnScriptsSchema } from './spawnScripts.ts';
+import * as v from 'valibot';
+import { admitScript, type ScriptAdmission } from './scriptAdmission.ts';
+import { admitScriptV2, SCRIPT_V2_REVISIONS, type ScriptAdmissionV2 } from './scriptAdmissionV2.ts';
+import { DecisionScriptsSchema, parseDecisionScripts, type DecisionScripts } from './decisionScripts.ts';
+
+/** Fixed ABI2 byte admission metadata, independent of execution or source sniffing. */
+export const ScriptV2ContractSchema: v.StrictObjectSchema<{ readonly abi: v.GenericSchema<ScriptV2ContractRowsInput['abi'], ScriptV2ContractRows['abi']>; readonly lane: v.GenericSchema<ScriptV2ContractRowsInput['lane'], ScriptV2ContractRows['lane']>; readonly pages: v.GenericSchema<ScriptV2ContractRowsInput['pages'], ScriptV2ContractRows['pages']>; readonly ioBytes: v.GenericSchema<ScriptV2ContractRowsInput['ioBytes'], ScriptV2ContractRows['ioBytes']>; readonly compilerRevision: v.GenericSchema<ScriptV2ContractRowsInput['compilerRevision'], ScriptV2ContractRows['compilerRevision']>; readonly admissionRevision: v.GenericSchema<ScriptV2ContractRowsInput['admissionRevision'], ScriptV2ContractRows['admissionRevision']>; }, undefined> = v.strictObject({ abi: v.literal(2), lane: v.picklist(['sim', 'project', 'view']), pages: v.pipe(v.number(), v.integer(), v.minValue(1), v.maxValue(4)),
+    ioBytes: v.pipe(v.number(), v.integer(), v.minValue(656), v.maxValue(4 * 65536)),
+    compilerRevision: v.literal(SCRIPT_V2_REVISIONS.compiler), admissionRevision: v.literal(SCRIPT_V2_REVISIONS.admission) });
+/** Explicit byte-admission contract. It is build metadata, never an extra output-index field. */
+export const ScriptContractSchema: v.GenericSchema<ScriptContractInput, ScriptContract> = v.variant('abi', [
+  v.strictObject({ abi: v.literal(0) }),
+  v.strictObject({ abi: v.literal(1), pages: v.pipe(v.number(), v.integer(), v.minValue(1), v.maxValue(4)) }),
+  ScriptV2ContractSchema,
+]);
+
+/** An explicit view module survives named-file reconstruction, disk and worker transport. */
+export const ViewModuleSchema: v.StrictObjectSchema<{ readonly id: v.GenericSchema<ViewModuleRowInput['id'], ViewModuleRow['id']>; readonly module: v.GenericSchema<ViewModuleRowInput['module'], ViewModuleRow['module']>; readonly side: v.GenericSchema<ViewModuleRowInput['side'], ViewModuleRow['side']>; readonly abi: v.GenericSchema<ViewModuleRowInput['abi'], ViewModuleRow['abi']>; readonly lane: v.GenericSchema<ViewModuleRowInput['lane'], ViewModuleRow['lane']>; readonly pages: v.GenericSchema<ViewModuleRowInput['pages'], ViewModuleRow['pages']>; readonly ioBytes: v.GenericSchema<ViewModuleRowInput['ioBytes'], ViewModuleRow['ioBytes']>; readonly compilerRevision: v.GenericSchema<ViewModuleRowInput['compilerRevision'], ViewModuleRow['compilerRevision']>; readonly admissionRevision: v.GenericSchema<ViewModuleRowInput['admissionRevision'], ViewModuleRow['admissionRevision']>; }, undefined> = v.strictObject({ id: v.pipe(v.string(), v.minLength(1), v.maxLength(128)),
+  module: v.pipe(v.string(), v.regex(/^blobs\/wasm\/[a-f0-9]{64}\.wasm$/u)), side: v.literal('view'),
+  ...ScriptV2ContractSchema.entries, lane: v.literal('view') });
+export const ViewModulesSchema: v.GenericSchema<ViewModuleRowsInput, ViewModuleRows> = v.pipe(v.array(ViewModuleSchema), v.maxLength(64),
+  v.check(rows => new Set(rows.map(row => row.id)).size === rows.length && new Set(rows.map(row => row.module)).size === rows.length, 'Unique view module ids and paths'));
+
+const OwnedSimModuleSchema: v.GenericSchema<OwnedSimModuleRowsInput, OwnedSimModuleRows> = v.strictObject({ ...ViewModuleSchema.entries,side: v.literal('sim'),lane: v.literal('sim') });
+/** Stateless project modules use the same persistent inventory as legacy return
+ * policies, never view or scheduled spawn declarations. */
+const ProjectModuleSchema = v.strictObject({ ...ViewModuleSchema.entries,side: v.literal('sim'),lane: v.literal('project') });
+const ProjectReturnModulesSchema = v.pipe(v.unknown(),v.check(isJsonData,'plain JSON return modules'),
+  v.array(v.union([DecisionScriptsSchema.pipe[2].item,ProjectModuleSchema])),v.maxLength(64),
+  v.check(rows=>new Set(rows.map(row=>row.id)).size===rows.length,'unique return module ids'),
+  v.check(rows=>new Set(rows.map(row=>row.module)).size<=8,'at most eight return modules'),
+  v.check(rows=>rows.reduce((count,row)=>count+(row.abi!==2&&'spawnGroup' in row.binding?Object.keys(row.actors).length:1),0)<=64,'at most 64 logical return bindings'),
+  v.check(rows=>rows.some(row=>row.abi===2),'explicit project module required'));
+export const ReturnModulesSchema: v.GenericSchema<ReturnModuleRowsInput, ReturnModuleRows> = v.union([DecisionScriptsSchema,ProjectReturnModulesSchema]);
+export type ReturnModuleRow = v.InferOutput<typeof ReturnModulesSchema>[number];
+const OwnedV2ModulesSchema = v.array(v.union([ViewModuleSchema,OwnedSimModuleSchema,ProjectModuleSchema]));
+export type ScriptAdmissionRows = readonly (DecisionScripts[number] | ViewModuleRow | v.InferOutput<typeof OwnedSimModuleSchema> | ReturnModuleRow)[];
+/** Admit the declared ABI, including instrumentation; v1 and v2 fixed memory must match its row exactly. A v2 module is
+ *  admitted (admitScriptV2, its declared lane, I/O and revisions) on a copy of its bytes, before anything instantiates it. */
+export function admitScriptContract(bytes: Uint8Array, input: Extract<ScriptContract, { abi: 0 | 1 }>): ScriptAdmission;
+export function admitScriptContract(bytes: Uint8Array, input: Extract<ScriptContract, { abi: 2 }>): ScriptAdmissionV2;
+export function admitScriptContract(bytes: Uint8Array, input: ScriptContract): ScriptAdmission | ScriptAdmissionV2;
+export function admitScriptContract(bytes: Uint8Array, input: ScriptContract): ScriptAdmission | ScriptAdmissionV2 {
+  const contract = v.parse(ScriptContractSchema, input);
+  if (contract.abi === 2) {
+    if (contract.ioBytes > contract.pages * 65536) throw new Error('V2 script I/O exceeds its pages');
+    const { lane, ioBytes, compilerRevision, admissionRevision } = contract;
+    const admitted = admitScriptV2(Uint8Array.from(bytes), { lane, ioBytes, compilerRevision, admissionRevision });
+    if (admitted.initialPages !== contract.pages || admitted.maximumPages !== contract.pages) throw new Error('V2 script fixed pages differ from declaration');
+    return admitted;
+  }
+  const admitted = admitScript(bytes, contract.abi);
+  if (contract.abi === 1 && (admitted.initialPages !== contract.pages || admitted.maximumPages !== contract.pages)) throw new Error('Decision script fixed pages differ from declaration');
+  return admitted;
+}
+/** Read only the declared platform payload; absent rows retain the separate legacy v0 format. */
+export function decisionScriptsFromSections(sections?: ReadonlyMap<string, unknown>): DecisionScripts {
+  return sections?.has('sim/scripts') === true ? parseDecisionScripts(sections.get('sim/scripts')) : [];
+}
+/** Resolve complete module paths against the inventory, never by sniffing bytes or matching a loose filename. */
+export function decisionModuleContracts(input: ScriptAdmissionRows, files: readonly { hash: string; kind: string; path?: string }[]): ReadonlyMap<string, Extract<ScriptContract, { abi: 1 | 2 }>> {
+  const decisions = parseDecisionScripts(input.filter(row => row.abi !== 2));
+  const views = v.parse(OwnedV2ModulesSchema, input.filter(row => row.abi === 2));
+  const rows = [...decisions, ...views], contracts = new Map<string, Extract<ScriptContract, { abi: 1 | 2 }>>(), sides = new Map<string, string>();
+  if (new Set(rows.map(row => row.id)).size !== rows.length) throw new Error('Duplicate script admission id');
+  for (const row of rows) {
+    const file = files.find(value => value.kind === 'wasm' && `blobs/wasm/${value.hash}.wasm` === row.module && (value.path === undefined || value.path === row.module));
+    if (file === undefined) throw new Error('Decision script module is not an exact declared Wasm path');
+    const contract = row.abi === 2 ? v.parse(ScriptV2ContractSchema, { abi: row.abi, lane: row.lane, pages: row.pages, ioBytes: row.ioBytes,
+      compilerRevision: row.compilerRevision, admissionRevision: row.admissionRevision }) : { abi: 1 as const, pages: row.pages };
+    const old = contracts.get(file.hash);
+    if (old !== undefined && (JSON.stringify(old) !== JSON.stringify(contract) || sides.get(file.hash) !== row.side)) throw new Error('Conflicting decision module contracts');
+    contracts.set(file.hash, contract); sides.set(file.hash, row.side);
+  }
+  return contracts;
+}
+
+/** Every explicitly owned v1 module participates in byte, memory and inventory admission. */
+export function scriptAdmissionRows(sections?: ReadonlyMap<string, unknown>): ScriptAdmissionRows {
+  const spawn = v.parse(SpawnScriptsSchema, sections?.get('actors/spawn-scripts') ?? []);
+  const returns = v.parse(ReturnModulesSchema,sections?.get('actors/return-scripts') ?? []);
+  const decisions = parseDecisionScripts([...decisionScriptsFromSections(sections), ...spawn.map(row => row.script),
+    ...returns.filter(row=>row.abi!==2)]);
+  const owned = spawn.flatMap(row => row.v2 === undefined ? [] : [{ abi: 2 as const,id: `${row.step}:v2`,side: 'sim' as const,lane: 'sim' as const,module: `blobs/wasm/${row.v2.artifact.hash}.wasm`,pages: row.v2.artifact.pages,ioBytes: row.v2.artifact.ioBytes,compilerRevision: row.v2.artifact.compilerRevision,admissionRevision: row.v2.artifact.admissionRevision }]);
+  return [...decisions, ...v.parse(ViewModulesSchema, sections?.get('view/modules') ?? []),...owned,...returns.filter(row=>row.abi===2)];
+}
+
+/** Fresh v1 memory is consumed only by stateful sim decisions, once per module.
+ * Validate the complete inventory first; stateless returns/spawns and v2/view
+ * modules retain their existing admission and separate memory ownership. */
+export function decisionMemoryPreparationPages(sections?: ReadonlyMap<string, unknown>): readonly number[] {
+  const inventory = scriptAdmissionRows(sections);
+  const decisions = new Set(decisionScriptsFromSections(sections).map(row => row.id));
+  const modules = new Map<string, number>();
+  for (const row of inventory) {
+    if (row.abi === 2 || !decisions.has(row.id)) continue;
+    const previous = modules.get(row.module);
+    if (previous !== undefined && previous !== row.pages) throw new Error('Conflicting decision memory pages');
+    modules.set(row.module, row.pages);
+  }
+  return [...modules.values()];
+}
+
+/** Admitted data contracts, independent of validator implementation metadata. */
+export type OwnedSimModuleRowsInput = Omit<ViewModuleRowInput, keyof ({
+    side: 'sim';
+    lane: 'sim';
+})> & {
+    side: 'sim';
+    lane: 'sim';
+};
+export type OwnedSimModuleRows = Omit<ViewModuleRow, keyof ({
+    side: 'sim';
+    lane: 'sim';
+})> & {
+    side: 'sim';
+    lane: 'sim';
+};
+export type ScriptV2ContractRowsInput = ScriptV2ContractRows;
+interface ScriptV2ContractRowsFields {
+    abi: 2;
+    lane: 'sim' | 'project' | 'view';
+    pages: number;
+    ioBytes: number;
+    compilerRevision: (typeof SCRIPT_V2_REVISIONS)['compiler'];
+    admissionRevision: (typeof SCRIPT_V2_REVISIONS)['admission'];
+}
+export type ScriptV2ContractRows = { [Key in keyof ScriptV2ContractRowsFields]: ScriptV2ContractRowsFields[Key] };
+export type ScriptContractInput = ({
+    abi: 0;
+}) | ({
+    abi: 1;
+    pages: number;
+}) | (ScriptV2ContractRowsInput);
+export type ScriptContract = ({
+    abi: 0;
+}) | ({
+    abi: 1;
+    pages: number;
+}) | (ScriptV2ContractRows);
+export type ViewModuleRowInput = Omit<Omit<{
+    id: string;
+    module: string;
+    side: 'view';
+}, keyof (ScriptV2ContractRowsInput)> & ScriptV2ContractRowsInput, keyof ({
+    lane: 'view';
+})> & {
+    lane: 'view';
+};
+export type ViewModuleRow = Omit<Omit<{
+    id: string;
+    module: string;
+    side: 'view';
+}, keyof (ScriptV2ContractRows)> & ScriptV2ContractRows, keyof ({
+    lane: 'view';
+})> & {
+    lane: 'view';
+};
+export type ViewModuleRowsInput = (ViewModuleRowInput)[];
+export type ViewModuleRows = (ViewModuleRow)[];
+export type ReturnModuleRowsInput = unknown;
+export type ReturnModuleRows = (v.InferOutput<typeof DecisionScriptsSchema>) | (((v.InferOutput<(typeof DecisionScriptsSchema)['pipe'][2]['item']>) | (Omit<ViewModuleRow, keyof ({
+    side: 'sim';
+    lane: 'project';
+})> & {
+    side: 'sim';
+    lane: 'project';
+}))[]);

package/src/format/scriptFuelV2.ts

@@ -0,0 +1,124 @@
+/** ABI v2 fuel verification. This is one prerequisite of complete admission,
+ * not permission to instantiate an image by itself. */
+import { SCRIPT_ABI } from './scriptAbi.ts';
+import { readV2Module,type V2Instruction,type V2Module,type V2Signature } from './scriptModuleV2.ts';
+
+export const V2_ENTRY_SIGNATURES: Readonly<Record<string,readonly number[]>> = Object.freeze({
+  ws_init: [0x7f,0x7f,0x7f], ws_step: [0x7f,0x7f], ws_project: [0x7f], ws_view: [0x7c,0x7c,0x7f],
+});
+export const V2_WORK_ENTRIES: Readonly<{ sim: "ws_step"; project: "ws_project"; view: "ws_view"; }> = Object.freeze({ sim: 'ws_step',project: 'ws_project',view: 'ws_view' });
+export type V2Lane = keyof typeof V2_WORK_ENTRIES;
+/** Runtime modules have exactly one work entry; build input may select one of
+ * several authored exports before the others are removed. */
+export function v2Lane(image: V2Module,requested?: V2Lane,build = false): V2Lane {
+  const present = Object.entries(V2_WORK_ENTRIES).filter(([,name]) => image.exports.has(name));
+  if (requested !== undefined) {
+    if (!Object.hasOwn(V2_WORK_ENTRIES,requested) || !image.exports.has(V2_WORK_ENTRIES[requested]) || (!build && present.length !== 1)) throw new Error('V2 lane has missing or extra work entries'); return requested;
+  }
+  const lane = present.length === 1 ? present[0]?.[0] : undefined;
+  if (lane !== 'sim' && lane !== 'project' && lane !== 'view') throw new Error('Select one explicit v2 lane'); return lane;
+}
+/** H0 measured >15% overhead on tiny blocks. Coalesce each acyclic control
+ * region, precharging its scalar instruction count once. Conditional paths
+ * may consume fewer instructions than charged; nested loop bodies belong to
+ * their own region and are charged again at every loop back-edge. Calls charge
+ * their own bodies, while their call opcode belongs to this region. */
+export function v2BlockCosts(code: readonly V2Instruction[],constantCalls: ReadonlyMap<number,number> = new Map()): ReadonlyMap<number,number> {
+  const costs = new Map<number,number>([[0,0]]), regions = [0], controls: boolean[] = [];
+  for (let i = 0; i < code.length; i++) {
+    const op = code[i]?.op, region = regions.at(-1); if (region === undefined) throw new Error('Invalid v2 region');
+    costs.set(region,(costs.get(region) ?? 0)+1+(op === 0x10 ? constantCalls.get(code[i]?.args[0] ?? -1) ?? 0 : 0));
+    if (op === 0x02 || op === 0x03 || op === 0x04) {
+      controls.push(op === 0x03);
+      if (op === 0x03) { regions.push(i+1); costs.set(i+1,0); }
+    } else if (op === 0x0b && controls.pop() === true) regions.pop();
+  }
+  return costs;
+}
+function same(a: readonly number[],b: readonly number[]): boolean { return a.length === b.length && a.every((value,i) => value === b[i]); }
+function signature(image: V2Module,index: number): V2Signature {
+  const result = image.types[image.functions[index] ?? -1]; if (result === undefined) throw new Error('Missing v2 function signature'); return result;
+}
+function instruction(code: readonly V2Instruction[],at: number,op: number,arg?: number): boolean {
+  const value = code[at]; return value?.op === op && (arg === undefined || (op === 0x41 ? value.literal === arg : value.args[0] === arg));
+}
+function chargeAt(code: readonly V2Instruction[],at: number,fuel: number): number | undefined {
+  const cost = code[at+1]?.literal;
+  if (typeof cost !== 'number' || !Number.isInteger(cost) || cost < 1 || cost > SCRIPT_ABI.maxBytes) return undefined;
+  const shape: readonly [number,number | undefined][] = [[0x23,fuel],[0x41,cost],[0x6b,undefined],[0x24,fuel],[0x23,fuel],[0x41,0],[0x48,undefined],[0x04,0x40],[0x00,undefined],[0x0b,undefined]];
+  return shape.every(([op,arg],i) => instruction(code,at+i,op,arg)) ? cost : undefined;
+}
+export interface V2FuelInspection {
+  /** Same structural parse checked for fuel; finite/IO admission is still required. */
+  readonly image: V2Module;
+  fuel: number; lane: V2Lane; globals: readonly string[]; pages: number;
+  entries: ReadonlyMap<string,number>; unmetered: readonly (readonly V2Instruction[])[];
+}
+/** Verify the actual bytes, including all charge writes and all possible direct
+ * calls, without invoking getters, init, start or any other guest function. */
+export function inspectV2Fuel(bytes: Uint8Array,options: { readonly lane?: V2Lane } = {}): V2FuelInspection {
+  const image = readV2Module(bytes), lane = v2Lane(image,options.lane), fuel = image.globals.length-1, privateGlobal = image.globals[fuel];
+  if (privateGlobal?.type !== 0x7f || !privateGlobal.mutable || privateGlobal.value !== 0) throw new Error('Missing private v2 fuel global');
+  const entries = new Map<string,number>(), getters = new Set<number>(), implementations = new Set<number>(), globals: string[] = [];
+  for (const name of ['ws_init',V2_WORK_ENTRIES[lane]]) {
+    const params = V2_ENTRY_SIGNATURES[name]; if (params === undefined) throw new Error('Missing v2 entry contract');
+    const entry = image.exports.get(name); if (entry?.kind !== 0) throw new Error('Missing v2 fueled entry');
+    const type = signature(image,entry.index); if (type.result !== 0x7f || !same(type.params,params) || [...entries.values()].includes(entry.index)) throw new Error('Wrong v2 entry signature or alias');
+    entries.set(name,entry.index);
+  }
+  for (const name of ['ws_abi','ws_io']) {
+    const exp = image.exports.get(name); if (exp?.kind !== 0) throw new Error('Missing v2 constant getter');
+    const type = signature(image,exp.index), code = image.bodies[exp.index]?.code, value = code?.[0]?.literal;
+    if (type.params.length > 0 || type.result !== 0x7f || code?.length !== 2 || !instruction(code,0,0x41) || !instruction(code,1,0x0b) || typeof value !== 'number'
+      || (name === 'ws_abi' ? value !== 2 : value < 0 || value%8 !== 0 || value > image.pages*65536-656)) throw new Error('Invalid v2 constant getter');
+    getters.add(exp.index);
+  }
+  for (let i = 0; i < image.globals.length; i++) if (i !== fuel && image.globals[i]?.mutable) {
+    const name = `__state_${i}`, exp = image.exports.get(name); if (exp?.kind !== 3 || exp.index !== i) throw new Error('Missing v2 mutable-global snapshot'); globals.push(name);
+  }
+  const allowedFunctions = new Set([...entries.values(),...getters]);
+  for (const [name,exp] of image.exports) {
+    if (exp.kind === 0 && (!allowedFunctions.has(exp.index) || !(entries.has(name) || name === 'ws_abi' || name === 'ws_io'))) throw new Error('Unexpected v2 function export');
+    if (exp.kind === 3 && (exp.index === fuel || name !== `__state_${exp.index}` || !image.globals[exp.index]?.mutable)) throw new Error('V2 fuel exported or noncanonical global alias');
+  }
+  for (const index of entries.values()) {
+    const body = image.bodies[index]; if (body === undefined) throw new Error('Missing v2 entry wrapper');
+    if (body.locals.length > 0) throw new Error('Invalid v2 entry wrapper');
+    const params = signature(image,index).params, code = body.code, target = code[8+params.length]?.args[0];
+    if (target === undefined || allowedFunctions.has(target) || implementations.has(target)) throw new Error('Invalid v2 entry target');
+    const type = signature(image,target); if (type.result !== 0x7f || !same(type.params,params)) throw new Error('V2 entry implementation signature');
+    const expected: [number,number | undefined][] = [[0x20,params.length-1],[0x24,fuel],[0x23,fuel],[0x41,0],[0x48,undefined],[0x04,0x40],[0x00,undefined],[0x0b,undefined],
+      ...params.map((_,i): [number,number] => [0x20,i]),[0x10,target],[0x1a,undefined],[0x23,fuel],[0x0b,undefined]];
+    if (code.length !== expected.length || expected.some(([op,arg],i) => !instruction(code,i,op,arg))) throw new Error('Invalid v2 entry fuel setup');
+    implementations.add(target);
+  }
+  const unmetered: V2Instruction[][] = [], calls: number[][] = [];
+  for (let index = 0; index < image.bodies.length; index++) {
+    const body = image.bodies[index]; if (body === undefined) throw new Error('Missing v2 body');
+    if (allowedFunctions.has(index)) { unmetered.push([...body.code]); calls.push(body.code.filter(value => value.op === 0x10).map(value => value.args[0] ?? -1)); continue; }
+    const plain: V2Instruction[] = [], charges = new Map<number,number>(), edges: number[] = [];
+    for (let at = 0; at < body.code.length;) {
+      const cost = chargeAt(body.code,at,fuel);
+      if (cost !== undefined) { if (charges.has(plain.length)) throw new Error('Duplicate v2 block charge'); charges.set(plain.length,cost); at += 10; continue; }
+      const value = body.code[at++]; if (value === undefined) throw new Error('Missing v2 instruction');
+      if (value.op === 0x24 && value.args[0] === fuel) throw new Error('V2 fuel access outside a verified charge');
+      if (value.op === 0x10) {
+        const target = value.args[0]; if (target === undefined || [...entries.values()].includes(target) || implementations.has(target)) throw new Error('Guest calls a v2 entry or its implementation'); edges.push(target);
+      }
+      plain.push(value);
+    }
+    const costs = v2BlockCosts(plain,new Map([...getters].map(target => [target,2])));
+    if (costs.size !== charges.size || [...costs].some(([at,cost]) => charges.get(at) !== cost)) throw new Error('Missing or underpriced v2 basic block region');
+    unmetered.push(plain); calls.push(edges);
+  }
+  const depths = new Map<number,number>(), active = new Set<number>();
+  const visit = (index: number): number => {
+    const previous = depths.get(index); if (previous !== undefined) return previous;
+    if (active.has(index)) throw new Error('V2 call graph cycle'); if (active.size >= SCRIPT_ABI.callDepth) throw new Error('V2 call graph depth exceeds 64');
+    active.add(index); let depth = 1;
+    for (const target of calls[index] ?? []) depth = Math.max(depth,visit(target)+1);
+    active.delete(index); if (depth > SCRIPT_ABI.callDepth) throw new Error('V2 call graph depth exceeds 64'); depths.set(index,depth); return depth;
+  };
+  for (let i = 0; i < image.bodies.length; i++) visit(i);
+  return { image,fuel,lane,globals,pages: image.pages,entries,unmetered };
+}