plan v3: error-context tables + task_return_type mapping (transfer intrinsic resolves the wrong index space; contract loudness claim false) #89

Severity: medium (latent silent mis-route) + closes two known contract gaps.

plan-format.md v2 amendment 3 records both gaps; this issue implements the
v3 it prescribes.

(b) error-context: the transfer intrinsic's table args are
TypeComponentLocalErrorContextTableIndex (trusted
fact/trampoline.rs:3526-3539), but the runtime routes them through
resourceTableInstance (intrinsics/mod.ts:689-695 ->
exec/executor.ts:988-1000) — the TypeResourceTableIndex space. The
contract claims this "fails loudly (never silently mis-routes)"; that
claim is false: the accessor succeeds whenever a concrete resource
table exists at the colliding index, and in a multi-instance composition
with an ErrorContext at the colliding slot the transfer passes the
instanceof check (stream_builtins.ts:865-870) and reads/writes the wrong
instance's table. The contract text gets corrected as part of this issue
(the amendment is authored by the orchestrator).

(a) task_return_type arrives as a wasmtime TypeTupleIndex with no
mapping into plan.types, so two canon_task_return checks remain
skipped for FACT tasks (type-index comparison; the memory-identity half of
options equality) — see the CONTRACT notes at async_builtins.ts:116-157.

v3 shape (contract amendment first, then implementation):

• shim: emit errorContextTables (table index -> owning runtime instance)
  and map each TaskReturn trampoline's TypeTupleIndex into plan.types;
• loader: require the new sections at formatVersion 3 (strict equality
  bump 2 -> 3 on both sides);
• executor: dedicated errorContextTableInstance(i) accessor; wire the
  transfer intrinsic through it; enable the two skipped task.return
  checks.

Related (same territory, investigate while there): the executor never
reads instantiate-module's instance field
(RuntimeComponentInstanceIndex, trusted info.rs:247-249) — it reconstructs
instance scoping from trampoline/options fields. Either consume it, or
document why it is redundant, with a test.

Found in the 2026-08-10 adversarial conformance review (runtime + translator vs component-model @ 73b7ad5 definitions.py; wasmtime-environ 47.0.3 treated as trusted).