embedder: cross-store stream/future transfer stalls consumers and loses producer faults #344

Assessed scope: cross-store transfer loses progress and producer failures

This replaces the original missing-refusal framing. Accepting a direct reference is not inherently wrong: the intended semantics may be those of host-proxied operations between stores. Assessment at 5616bce6347ee22be3e12073aed4acbc2cf6be5c demonstrates that the current implementation does not satisfy that requirement. P1 / bug based on ordinary scalar liveness and failure-reporting defects.

The operator also explicitly permits blanket cross-store refusal as an interim resolution. Recommended mitigation: refuse such transfers before consuming the source handle or changing activity state, leaving the host free to construct an explicit proxy. This is an implementation limitation, not a claim that cross-store references are intrinsically invalid.

Confirmed failures

1. Delayed delivery does not wake/drive B — stream and future

Public-component probe:

1. A creates a guest stream/future and returns its readable end to the host.
2. Host passes that handle directly into independent B; B starts consuming.
3. A later export writes a value. The canonical write confirms completion.
4. B's original consuming call remains pending.
5. An unrelated export invocation in B makes the same original call return the correct value.

Same-store controls and explicit host adapters complete after the write alone. Results repeat under default scheduling and seeds 1/4242. The evidence is not a timeout alone: an unrelated B entry releases the existing completed copy.

Mechanism: lowerStream/lowerFuture preserve the original boundStore; HostActivity.bind binds once, while lifted wrappers disarm on lowering. Copy readiness crosses the shared object, but arrival notification/driver handoff does not reach B. A shared object's one-store bookkeeping is insufficient for endpoints in two stores.

2. Accepted transfer cannot be passed back — stream and future

A → host → B succeeds, but B → host rejects in liftAsyncValue:

• AssertionError: stream crossed into a second store; multi-store is unsupported
• Corresponding future assertion.

Same-store round trips and explicit cross-store proxy controls succeed. The source wrapper correctly relinquishes read authority on successful transfer; the assertion is a later incompatible lift rule, not evidence of numeric handle aliasing.

3. Source stream failure looks like ordinary termination in B

A natural JS producer attached at A throws, either before transfer or after B starts reading.

• Direct: B's consuming call succeeds with final canonical status DROPPED, count zero. A's next entry sees the original StreamProducerError.
• Explicit proxy and same-store controls: consuming call rejects with StreamProducerError carrying the source cause.

The scratch consumer uses synchronous canonical read and returns its final packed status, so this is not a discarded status or initial BLOCKED sentinel. The producer failure is recorded in A's original boundStore before dropping the writer; B sees only the drop. This establishes stream failure suppression; no corresponding general future-failure claim is made.

What worked / limits

• Host-fed immediate/delayed scalar values and some already-progressed guest producers transferred successfully. Simple successful transfer does not prove complete support.
• A B-side trap correctly rejected the producer with PeerTrappedError while A remained usable. Actual B-side copy cancellation/drop behaved consistently with the distinction between cancelling a copy and terminating the end. No broad cancellation failure is claimed.
• No wrong numeric-index lookup or sandbox escape was demonstrated in polyengine.
• Resource-bearing transfers require separate semantic conversion when origins differ; matching WIT/class is not nominal type identity. The resource probes do not establish successful proxy consumption or an automatic-cleanup defect. Explicit cleanup disposed once; no automatic cleanup or deterministic orphan is claimed.
• Deno/V8 assessment with public components and small scratch fixtures; no browser matrix. Independent review reran the probes and added same-store controls.

Resolution options

Recommended now: explicit cross-store refusal

• Reject a foreign-store Stream/Future before ownership-consuming takeValue effects, transfer hooks, or destination insertion; check raw lower seams as needed without relying on late lift assertions.
• Use a host-facing error naming the unsupported transfer, not AssertionError.
• Keep first binding and same-store transfers/round trips working.
• On refusal, leave the original handle usable so the caller can deliberately adapt it via a source-store host read/await and a fresh destination endpoint (e.g. .readable() / Promise.resolve(f) for tested scalar cases).
• Verify both stream/future export arguments and host import returns; do not leave an alternate lowering route that admits the same broken shared state.
• Document refusal as the current support boundary, with explicit proxying available. The existing contract sentence can describe this interim implementation choice rather than imply that sharing is inherently invalid.

Later support: endpoint-aware forwarding

Coordinate readiness/drive and producer failures across each endpoint's store; support return transfers without changing origin identity or reviving consumed wrappers. Alternatively introduce a real internal proxy boundary with the appropriate value conversion. Simply deleting the lift assertion or assigning boundStore = B is insufficient: A can still own the producer and its scheduling state.

Evidence / reproduction artifacts

Local scripts and WAT fixtures retained under:

• /tmp/opencode/assess-344-progress/: probe.ts, source.wat/.wasm, report and default/seed-1/seed-4242 logs.
• /tmp/opencode/assess-344-lifecycle/: probe.ts, status-reader.wat/.wasm, trap-end.wat/.wasm, resource-types.wat/.wasm, report and output.json.

Run from this checkout using its import map:

deno run --config deno.json --allow-read --allow-env=POLYENGINE_SCHED_SEED /tmp/opencode/assess-344-progress/probe.ts
deno run --config deno.json --allow-read --allow-env=POLYENGINE_SCHED_SEED /tmp/opencode/assess-344-lifecycle/probe.ts

Progress script asserts the decisive delayed-transfer matrix; pass-back/lifecycle results were inspected directly and independently reproduced. Paths inside the scratch scripts name the assessed checkout. No product files changed during assessment.

Related: #170's host-error vocabulary remains relevant. Pinned CM 7c676115 supplies canonical copy/ownership rules; cross-store embedding support, automatic producer error reporting, and per-instance poison behavior are local policies. Prior Wasmtime comparisons do not decide this support boundary.