task core: remove the may_enter reentrance gates (CM#705 adoption, #173) - #255
Merged
Conversation
The pinned reference (definitions.py @ 2f13265) no longer has may_enter, entering_set, enter_from, leave_to, or ComponentInstance.parent: Store.lift runs canon_lift with no gate, Store.tick resumes any ready thread with no bracket, and reentrance into a live instance is valid. This PR removes every runtime call into that model — the host-entry gate, the FACT sync/async start-call brackets, enter-sync-call's transient check, the dtor entry bracket, resumeWith's bracket and backstop assert, tick's bracket and enterability filter, and requestCancellation's delivery gate — plus entryRefusal's transient clause (#251's marker re-key made this a pure subtraction). What survives is the named divergence: per-instance poisoning. A trap still marks the instance's corpse (notifyInstancePoisoned; capability signals excepted) and every entry site refuses a marked instance with the recorded cause (#145); the '(reentrance forbidden)' qualifier is dropped from the host-entry message (the suite matches by substring). The model definitions and the #155/#156/#161 deferral machinery stay in place inert - a follow-up deletes them with the plan-format amendment. Corpus: zero xfail changes by design - FACT-47 statically masks every row this would flip (#248); builtin-trap-poisons-instance stays green via the marker. Runtime suites carry the proof: the synthetic-root/deferral pins invert to merged semantics, and the headline pin is new - a host import synchronously re-entering its own live instance, both activations completing (e2e_imports_test.ts). Docs/contracts (orchestrator): intrinsics.md v0.3 amendment withdraws the reentrance-gate rule; architecture.md closes #165's divergence entry as resolved-by-adoption, names per-instance poisoning as the sole entry refusal, and updates the JSPI enforcement and dtor sections.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Step 4 of the #173 sequencing, after #251 (poisoning re-key) and #252 (pin advance): remove every runtime call into the
may_entermodel, per the merged reference (definitions.py @2f13265— no gate inStore.lift, no bracket inStore.tick, noentering_set; reentrance into a live instance is valid).Removed
enteredSet/enterFrom/leaveTo, exec/boundary.ts) — the(reentrance forbidden)qualifier leaves the trap message (suite matches by substring).enter-sync-call's transient check (intrinsics/mod.ts) — closing reentrance: enter-sync-call checks the callee gate but never takes it — host-mediated reentry passes where the reference traps #165's adjudicated divergence as resolved-by-adoption.Thread.resumeWith's bracket + backstop assert;Store.tick's bracket + enterability filter;Task.requestCancellation's delivery gate.entryRefusal's transient clause — task core: re-key poisoning refusal onto the poison marker (#173) #251's marker re-key made this a pure subtraction; poisoning never depended onmay_enter.Survives
Per-instance poisoning, now a purely-ours named divergence (pre-#705 it fell out of the reference's broken bracket; post-#705 the reference has no instance trap state and wasmtime kills the whole store): traps still mark the corpse (capability signals excepted), every entry site refuses a marked instance with the recorded cause (#145), same-instance exemption preserved for dtor self-drops. The model definitions (
mayEnter, synthetic root,enteringSet…) and the #155/#156/#161 deferral machinery stay defined but inert — a follow-up deletes them together with the plan-format amendment 4 rewrite.Out of scope, unchanged:
canon_subtask_cancel/pending-cancel (#250 — now blocked on CM#716) anddriveSyncLift's exclusive-thread exclusion (#249).Proof
Corpus proves nothing here by design — FACT-47 statically masks every row this PR would flip (#248, see the
wasm trap:discriminator note) — sojust conformanceis pinned at zero xfail changes, withbuiltin-trap-poisons-instance.wastgreen via the marker. The runtime suites carry the proof: the synthetic-root/deferral pins invert to merged semantics, poisoning pins survive re-keyed, and the headline pin is new — a host import synchronously re-enters its own live instance and both activations complete (integration/e2e_imports_test.ts).Docs/contracts (orchestrator-authored)
Gates
Full local
just gatespass: core suites, conformance (1475 cmds, 0 failed, 0 stale xfails, xfail set byte-identical), sched-seeds, shells, browser lanes, smoke-tls, smoke-c0. Not breaking: application-facing surface unchanged (previously-trapping calls now succeed — strictly loosening); conventions goldens untouched.