plan v3: error-context tables, task-return result types, synthetic-root entering sets - #104
Merged
Conversation
errorContextTables section (TypeComponentLocalErrorContextTableIndex -> owning instance; closes v2 amendment 3(b), whose 'fails loudly' claim is corrected — the resource-table reuse could silently mis-route in composed components); task-return decls carry resultType (interned) with results repurposed to the raw TypeTupleIndex the FACT path keys on — result-type check enabled for FACT tasks, memory-identity half stays a named open gap; v1 amendment 4 (instance tree) closed runtime-side via the synthetic per-instantiation root, no wire form (#101 adjudication: host entering sets always include the root and guest-to-guest cycles are DAG-unreachable, so intermediate-ancestor locking is unobservable; matches wasmtime's top-level-id shortcut).
…etic-root entering sets
formatVersion 3 (strict, same-commit bump). Shim emits
errorContextTables from ComponentTypes.error_context_tables and interns
each task-return tuple (results = raw TypeTupleIndex, resultType =
plan.types index); loader requires both and builds the raw->interned
dictionary; executor gains errorContextTableInstance (loud PlanError,
no ?? 0) and resultTypesForTuple; error-context-transfer routes through
the correct index space. canon_task_return's result-type check now
covers FACT tasks (definitions.py:2395) — mismatch traps; the
memory-identity half remains open contract friction, re-justified at
the site.
Synthetic per-instantiation root (v3 amendment 4): every instance's
parent is a per-Store root flowing through selfAndAncestors, so host
entries lock {leaf, root} per the reference while guest-to-guest stays
{leaf}; trap poisoning releases the root (named divergence: post-trap
re-entry support stays per-instance) at all three bracket-break sites.
Bindgen envelope fixtures regenerated; digests byte-identical.
lann
enabled auto-merge
August 11, 2026 03:07
# Conflicts: # runtime/src/exec/boundary.ts
This was referenced Aug 11, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Wave 2 of the 2026-08-10 adversarial-review remediation (wave 1: #103).
Fixes #89, #101.
consumer in one commit per the compat rule; bindgen envelope fixtures
regenerated, worldDigests byte-identical (digest-neutral like the v2
table sections).
ComponentTypes.error_context_tables; the error-context-transferintrinsic resolves through a dedicated accessor in the correct index
space (closes v2 amendment 3(b) — whose "fails loudly" claim is
corrected in the contract: the resource-table reuse could silently
mis-route in composed components). No more
?? 0defaults on thetransfer path.
resultType: raw wasmtimeTypeTupleIndex(the FACTprepare-callkey) inresults, internedplan.typesindex inresultType; loader builds the raw→interned dictionary. Thecanon_task_returnresult-type check (definitions.py:2395) now coversFACT cross-component tasks — mismatch traps. The memory-identity half
of options equality remains a named open gap (not unblocked by the
type mapping; re-justified at the site).
4): every instance's parent is a per-Store root, so host entries lock
{leaf, root} per the reference's
entering_setwhile guest-to-gueststays {leaf} (sibling cycles are DAG-unreachable per enter-sync-call: sibling reentrance cycle (A -> C -> A) is untrapped — reference mandates trap; needs corpus/wasmtime differential #99). Trap
poisoning releases the root at all three bracket-break sites — the
documented post-trap re-entry divergence stays per-instance. No wire
form needed; matches wasmtime's top-level-id shortcut by construction.
Merged with #82 (jspi hop atomicity): its poison seam
(
notifyInstancePoisonedmarker) and the root release compose atboundary.ts poison().Still open on #89's related note: the executor never consumes
instantiate-module.instance(investigative, no known misbehavior).Gates
build, test-rust (19/0), test-runtime (455/0), conformance (1395 cmds,
0 failed, no stale xfails), sched-seeds (seeds 1/4242), test-bundle,
test-wasi-shims, test-ct-runner, examples, test-translate — all green
post-merge with origin/main.