CM-4 correction: wasmtime holds the gate and defers entry; switch the working assumption (#43) (#44)

Author: lann

contracts/intrinsics.md

@@ -202,11 +202,20 @@ Status: **auto-detection is ON by default** (M2 exit, commit 652c1dc):
 all blocking sites lit, per-declaration suspendability classification
 (async-form copy built-ins never block; sync forms do; cancel forms per
 their own flag), `KNOWN_DIVERGENT` empty, the plain path pinned
-zero-cost for sync-only components. Two spots where wasmtime supersedes
-definitions.py are implemented and tracked upstream: cancel-copy
-completion superseding (CM-3) and entry-gating ending at
-resolution-plus-block rather than activation end (see
-upstream-component-model-repo-findings.md). Host-import lowers are
-deliberately outside the suspension classification — a sync-lowered
-Promise-returning host function degrades to a clean `NeedsJspi`
-capability signal.
+zero-cost for sync-only components. One spot where wasmtime supersedes
+definitions.py is implemented and tracked upstream: cancel-copy
+completion superseding (CM-3). The former second spot — "entry-gating
+ending at resolution-plus-block rather than activation end" — was a
+mischaracterization of wasmtime corrected on 2026-08-10 (wasmtime holds
+the gate for the whole invocation and defers the entry *decision*; see
+upstream-component-model-repo-findings.md CM-4 and
+exams/wasmtime-exclusivity/wasmtime-actual-semantics.md). deltic's
+shipping release-at-resolution rule is a deltic-only divergence slated
+for replacement by the hold + deferred-entry model
+([#43](https://github.com/lann/deltic/issues/43)); note the migration
+touches suspendability classification (a deferred async-lowered call
+trampoline becomes a potential suspension point — #43 carries the
+constraint that the plain path stays zero-cost for sync-only
+components). Host-import lowers are deliberately outside the suspension
+classification — a sync-lowered Promise-returning host function degrades
+to a clean `NeedsJspi` capability signal.

docs/architecture.md

@@ -56,15 +56,22 @@ contracts throughout the repo. Related documents:
   wasmtime exhibits it too. The tie-breaking authority for semantic
   questions is the spec + `definitions.py`, with wasmtime as corroborating
   evidence — never the other way around. **One bounded exception**
-  (operator decision, 2026-08-09): where `definitions.py` contradicts the
-  spec repo's *own wast corpus* and wasmtime implements the corpus side,
-  the corpus semantics is adopted as the working assumption — the
-  expectation is that the reference will be amended, not the tests. Each
-  such case must be a named finding in
+  (operator decision, 2026-08-09; content corrected 2026-08-10): where
+  `definitions.py` contradicts the spec repo's *own wast corpus* and
+  wasmtime implements the corpus side, the corpus semantics — **as
+  wasmtime actually implements it, verified against wasmtime source or
+  trace, not as inferred from the test alone** (the CM-4 lesson:
+  sync-streams.wast was satisfiable by two different semantics, and the
+  first inference picked the wrong one) — is adopted as the working
+  assumption; the expectation is that the reference will be amended, not
+  the tests. Each such case must be a named finding in
   `upstream-component-model-repo-findings.md` (currently CM-3 and CM-4;
-  CM-4's amendment sketch: `exams/wasmtime-exclusivity/spec-amendment.md`)
-  and flips back if upstream adjudicates the other way. Bare wasmtime
-  behavior with no corpus backing never supersedes the reference.
+  CM-4's corrected model — hold-lifetime gate + deferred entry decision —
+  is tracked for runtime adoption at
+  [#43](https://github.com/lann/deltic/issues/43); amendment sketch:
+  `exams/wasmtime-exclusivity/spec-amendment.md`) and flips back if
+  upstream adjudicates the other way. Bare wasmtime behavior with no
+  corpus backing never supersedes the reference.
 - TypeScript throughout the JS side: the runtime, the harness, and all
   generated bindings.
 - A performance story that can get fast later without rearchitecting.

docs/milestones.md

@@ -14,7 +14,7 @@ track: [consumers.md](consumers.md).
 | S0 | **Spike**: wasmtime-environ + FACT on wasm32 | **DONE — GO** (2026-08-08). `wasmtime-environ =47.0.3` builds for wasm32-unknown-unknown with zero imports; runs under Deno; FACT adapters (sync + async) emitted as core wasm; 1.66 MiB size-tuned (~0.5 MiB gzip); sub-ms steady-state translation. Fallback (vendoring FACT) not needed. The spike crate was promoted into `crates/translator-shim`. |
 | M0 | Contracts + plan executor on the task-model skeleton | **DONE** (2026-08-08). `contracts/{plan-format,descriptor-ir,intrinsics}.md` v0 pinned (the Phase-2 fan-out gate); spike promoted to `translator-shim` emitting plan v0; runtime structured around Task/Thread/Subtask from the start; `examples/guests/build/hello.component.wasm` (real wit-bindgen guest: strings, realloc, post-return) runs in Deno. |
 | M1 | Canonical ABI core | **DONE** (2026-08-08). Official suite green on Deno across all five sync directories — binary 119/122 (3 xfail: wasmtime-pin drift ×2, module-exports plan gap), validation 446/448 (+2 same-drift xfails), linking 272/272, resources 36/36, values 155/191 (+36 xfails, all M2-task-core-shaped) — zero unexpected failures; sync + async wit-bindgen guest fixtures roundtrip; transcoder trampoline (all 12 ops); imported resources; live component imports; structured verdicts; canonical world digest handshake (`contracts/digest.md`); typed TS facades for fixture worlds. Multi-agent per `AGENTS.md`: 3 parallel tracks, 2 reviewer rounds (5 blocking findings fixed), interrupted mid-flight by a driver restart and recovered via task_id resumes. |
-| M2 | **Concurrency complete on Deno** | **DONE** (2026-08-08, exit review APPROVE-WITH-NITS at 652c1dc). JSPI auto-detection ON by default; **1250/1349 executing suite commands pass, zero failures, every one of the 99 xfails in a named class** (47 wasmparser pin-drift → exits on the wasmtime bump, [#1](https://github.com/lann/deltic/issues/1); 41 🧵-deferred cascades, [#12](https://github.com/lann/deltic/issues/12); 5 shim gaps + 6 small named residues, [#13](https://github.com/lann/deltic/issues/13)). Delivered: the 0.3 task core, callback ABI, FACT cross-component calls (all four ABI combos), streams/futures/error-context with full rendezvous, host-side ends, cross-component cancellation, JSPI stackful+blocking paths with per-declaration suspendability, instance poisoning, deadlock detection with wasmtime-exact wording. wit-bindgen async roundtrip trio + producer guests green. Empirical engine pins (a)–(j) incl. "the fast path still suspends"; five JSPI host constraints recorded in `contracts/intrinsics.md`; two wasmtime-supersedes-reference findings (CM-3, CM-4) + NOTE-1 tracked upstream. Plain path pinned zero-cost for sync-only components. |
+| M2 | **Concurrency complete on Deno** | **DONE** (2026-08-08, exit review APPROVE-WITH-NITS at 652c1dc). JSPI auto-detection ON by default; **1250/1349 executing suite commands pass, zero failures, every one of the 99 xfails in a named class** (47 wasmparser pin-drift → exits on the wasmtime bump, [#1](https://github.com/lann/deltic/issues/1); 41 🧵-deferred cascades, [#12](https://github.com/lann/deltic/issues/12); 5 shim gaps + 6 small named residues, [#13](https://github.com/lann/deltic/issues/13)). Delivered: the 0.3 task core, callback ABI, FACT cross-component calls (all four ABI combos), streams/futures/error-context with full rendezvous, host-side ends, cross-component cancellation, JSPI stackful+blocking paths with per-declaration suspendability, instance poisoning, deadlock detection with wasmtime-exact wording. wit-bindgen async roundtrip trio + producer guests green. Empirical engine pins (a)–(j) incl. "the fast path still suspends"; five JSPI host constraints recorded in `contracts/intrinsics.md`; two wasmtime-supersedes-reference findings (CM-3, CM-4) + NOTE-1 tracked upstream (CM-4 recharacterized 2026-08-10 — wasmtime holds the gate and defers the entry decision; runtime migration [#43](https://github.com/lann/deltic/issues/43); see findings tracker). Plain path pinned zero-cost for sync-only components. |
 | M3 | Cross-engine | **Substantially done** (2026-08-09). Browser lanes over the full 1395-command corpus via `deno bundle` + playwright, per-lane expectation overlays with stale-delta detection (Deno's xfail.ts untouched): **Chromium at exact Deno parity (1250/0/99/41/5, deltas [])**; Firefox green behind the JSPI pref with ONE variance (trap message text — SpiderMonkey wording; explicitly tolerated per architecture.md §1); WebKit (WPE 26.5) capped by **JSC lacking multi-memory** (58 compile failures + cascades — engine gap; notable: its JSPI works UNFLAGGED — [#11](https://github.com/lann/deltic/issues/11)). En route: **M3A-1** — the scheduler's ambient rode `node:async_hooks`, invisible on Deno, fatal in every browser; replaced by explicit ambient threading (differentially verified to zero disagreement over the corpus), pinned by `platform_purity_test.ts`. Artifact cache (architecture.md §10 layer 1) landed: content-addressed by component sha × translator-wasm sha × features, dir + Cache API backends, instantiate-from-cache proven. Residuals became issues: CI service [#6](https://github.com/lann/deltic/issues/6); code-cache empirical check + in-browser webCache exercise [#7](https://github.com/lann/deltic/issues/7). |
 | C0 | **Consumer smoke test** ([consumers.md](consumers.md)) | **DONE** (2026-08-09, `tools/smoke-c0/` + REPORT.md). Real consumer artifacts under deltic on Deno with throwaway glue: experiment-mosh's `compose-async-tdz` repro green (pins the lann/jco#51 shape — `ok(42)` through 2 FACT adapters); iroh's `exec-model` probe green including the jco#11 kill shot (later export calls against a live detached pump); websocket conformance suite translated (first shim contact). Found and fixed two runtime defects no corpus reached (R-1 host-pump starvation of `pendingHostCalls`; R-2 check-then-act poisoning via `hostFailure`) — fail-on-pre-fix pins added. Translator throughput on multi-MB componentize-go artifacts: 10.5 MB in 73 ms warm, 9/9 accepted, zero rejections. Pin-bump ruling: deferred (observed drift was consumer-side WIT drift, not wasmtime drift) — staged as [#1](https://github.com/lann/deltic/issues/1). Deno capability audit: WebRTC verified via `tools/probes/webrtc-deno/`. |
 | C1 | Embedder conventions design — `contracts/embedder-api.md` | **DONE** (2026-08-08, v0.1). All open sub-questions decided: branded `WitError` throw model (unbranded host throw = trap — the anti-jco-footgun inversion); `{tag, val}` variant family covering nested options and results-as-values; outermost-option-as-undefined rule; exports uniformly Promise-shaped; resource classes both directions with runtime-owned identity mapping; `Stream<T>`/`Future<T>` handles over web-native producers with auto-closing pumps; **semver-canonical version resolution** matching the spec's canonical-interface-names design and wasmtime's `NameMap`/`alternate_lookup_key` (exact-first, track-alternate max-wins, prerelease/`0.0.z` exact-only; unversioned folding stays banned — corrected same-day from an initial version-exact-only ruling after reviewing the spec and wasmtime's linker); `requiredImports()` blessed. **WASI examined as ruled**: paper signatures for wasi:clocks p3, wasi:io p2 (pollable/streams — the one real friction, p2 sync-blocking, gets a three-tier strategy grounded in C0 finding #6), wasi:sockets p3 TCP, wasi:http p3 sketch, and webrtc data-channel; verdict — no new conventions needed. Superseded descriptor-ir's interim table. |

exams/wasmtime-exclusivity/RESULTS.md

@@ -1,5 +1,22 @@
 # wasmtime exclusivity check — is the sync-streams pass deterministic?
 
+> **CORRECTION (2026-08-10) — see `wasmtime-actual-semantics.md`, which
+> supersedes this file's wasmtime claims.** Source + trace verification
+> against wasmtime main (and v47.0.3) shows wasmtime does **not** release
+> its entry gate at resolution: `do_not_enter` is held for the whole core
+> invocation (same lifetime as the reference's `exclusive_thread`), across
+> post-`task.return` mid-frame parks included. Its sync-streams pass comes
+> from **deferred entry evaluation + FIFO scheduling**: the async caller
+> suspends until the first status event, the ready-parked `$C.get` runs to
+> *exit* first, and `$C.set` is admitted only after `get` is deleted — no
+> same-instance execution ever overlaps the parked span. Consequently: the
+> "STARTED while a resolved task sits parked mid-frame" reading of the
+> official test below is wrong for wasmtime; §"What the official test
+> already demonstrates" item 3 and the "one true scheduling accident"
+> section describe the **release-rule** (deltic/fix-patch) execution, not
+> wasmtime's. The determinism measurement (50/50) and the CI-provenance
+> analysis stand.
+
 Evidence backing `upstream-component-model-repo-findings.md` CM-4's
 2026-08-09 review and the IROH-1 consumer finding. Question posed by the
 operator: wasmtime runs the official CM test suite — is *its* pass on the

exams/wasmtime-exclusivity/root-cause.md

@@ -1,5 +1,20 @@
 # CM-4 root cause: the reference's unit tests pin the semantics its wast suite contradicts
 
+> **CORRECTION (2026-08-10) — see `wasmtime-actual-semantics.md`.** This
+> file's reference-side traces are accurate, but its framing of
+> `cm4-reference-fix.patch` as "the wasmtime/deltic rule" is wrong:
+> release-at-resolution is **deltic's** rule only. wasmtime holds its gate
+> for the whole invocation (like pristine `definitions.py`) and passes the
+> wast suite via deferred entry evaluation — under wasmtime's actual
+> semantics `test_callback_interleaving` passes **unchanged**, so the
+> "irreconcilable" verdict below applies to the release-rule fix, not to
+> wasmtime alignment. Likewise `test_resolved_task_gates_entry`'s
+> shared-state assertions (`poke_saw == 1`, `pump_observed == 2`) encode
+> the release rule: under wasmtime's model poke is deferred until pump's
+> invocation exits. The wasmtime-aligned reference fix is an entry-timing
+> change in `canon_lower` (report STARTING only after the instance's
+> runnable work is exhausted), not a gate-lifetime change.
+
 Companion to `RESULTS.md`; produced while building the filing artifacts
 (`cm4-run-tests.patch`, `cm4-reference-fix.patch`). Line numbers are
 pristine `run_tests.py` / `definitions.py` at submodule `73b7ad5`.