Host imports do not break 0014 D or E, and the last commit over-claimed

That commit said imports "break both of 0014's per-call decisions". Measured,
they break neither. A host callback that tries to call back into the instance
currently executing gets

  wasm trap: cannot enter component instance

so the component model forbids the nesting independently, which means the
argument buffer 0014 E reuses cannot be clobbered by a nested call, and D's
throw is correct rather than a false positive. Predicted before running --
the Canonical ABI's may_enter flag exists for exactly this -- and confirmed.

What was genuinely wrong is the message, not the decision. One flag was doing
two jobs and reporting both as contention: "the store is already in use by
another call" sends the reader looking for a second thread that does not exist.
The flag now records the thread holding it, so nesting says nesting
(:cljwit/error :reentrant, naming the export that was running) and contention
names the thread. Throwing before wasmtime traps is worth keeping either way,
because a trap poisons the instance and every later call then fails with the
same message, hiding the cause.

The spike also learned to read wasmtime's error text, which is how "re-entrant
func_call failed" became the sentence above. That is the second time in two
commits that the message was the whole finding.

Claude-Session: https://claude.ai/code/session_01XF5Hfq4Ca2N2XYEzWQQuHt

Author: chaploud

dev/cljwit/spike/host_import.clj

@@ -48,8 +48,20 @@
                                          (FunctionDescriptor/ofVoid ls))
                                      (into-array java.lang.foreign.Linker$Option []))))
             call (fn [^MethodHandle mh & as] (.invokeWithArguments mh ^java.util.List (vec as)))
-            ok!  (fn [what v] (when-not (.equals MemorySegment/NULL ^MemorySegment v)
-                                (throw (ex-info (str what " failed") {})))
+            emsg (fx "wasmtime_error_message" nil ADDR ADDR)
+            edel (fx "wasmtime_error_delete" nil ADDR)
+            ;; Reading wasmtime's own message is the difference between a
+            ;; bounded question and a guess — see 0016.
+            ok!  (fn [what v]
+                   (when-not (.equals MemorySegment/NULL ^MemorySegment v)
+                     (let [nm ^MemorySegment (.allocate arena (long 16))]
+                       (call emsg v nm)
+                       (let [n (.get nm I64 (long 0))
+                             p ^MemorySegment (.get nm ADDR (long 8))
+                             b (byte-array n)]
+                         (MemorySegment/copy (.reinterpret p n) I8 0 b 0 (int n))
+                         (call edel v)
+                         (throw (ex-info (str what ": " (String. b "UTF-8")) {})))))
                    v)
             cstr (fn [^String t]
                    (let [b (.getBytes t "UTF-8")
@@ -58,6 +70,8 @@
                      (.set s I8 (long (alength b)) (byte 0))
                      s))
             seen (atom [])
+            reenter (atom nil)   ; set once `run` is resolvable
+            reentry (atom :not-tried)
             ;; The host function the guest imports. Reads one u32 out of the
             ;; argument val and writes one back — the same layout every other
             ;; lane in this repo uses.
@@ -67,6 +81,10 @@
                                    I32 (long UNION))
                            out ^MemorySegment (.reinterpret ^MemorySegment res (long VAL))]
                        (swap! seen conj v)
+                       ;; Does the component model let a host callback call
+                       ;; back into the instance that is currently executing?
+                       (when-let [f @reenter]
+                         (reset! reentry (try (f 1) (catch Exception ex (ex-message ex)))))
                        (.set out I8 (long 0) (byte KIND-U32))
                        (.set out I32 (long UNION) (int (* 2 v)))
                        MemorySegment/NULL)))
@@ -119,10 +137,21 @@
                      (throw (ex-info "no export run" {})))
             args   ^MemorySegment (.allocate arena (long VAL))
             res    ^MemorySegment (.allocate arena (long VAL))]
+        (reset! reenter
+                (fn [n]
+                  (let [a2 ^MemorySegment (.allocate arena (long VAL))
+                        r2 ^MemorySegment (.allocate arena (long VAL))]
+                    (.set a2 I8 (long 0) (byte KIND-U32))
+                    (.set a2 I32 (long UNION) (int n))
+                    (ok! "re-entrant func_call"
+                         (call (fx "wasmtime_component_func_call" ADDR ADDR ADDR ADDR I64 ADDR I64)
+                               f ctx a2 (long 1) r2 (long 1)))
+                    (.get r2 I32 (long UNION)))))
         (.set args I8 (long 0) (byte KIND-U32))
         (.set args I32 (long UNION) (int 20))
         (ok! "func_call" (call (fx "wasmtime_component_func_call" ADDR ADDR ADDR ADDR I64 ADDR I64)
                                f ctx args (long 1) res (long 1)))
         (println "run(20) =" (.get res I32 (long UNION))
                  "  host saw" @seen
-                 "  (expected 41 and [20])")))))
+                 "  (expected 41 and [20])")
+        (println "re-entry from the host callback:" (pr-str @reentry))))))

doc/design/0014-cljwit-host-api.md

@@ -79,6 +79,16 @@ in-call flag, thrown on contention with the name of the thread already inside.
 It guards **every** entry, not only calls: `close`, and dropping a lifted
 `own<T>` handle, both take the context and are the same memory-unsafety.
 
+**Amended 2026-07-30, after host imports were shown to work.** The flag does
+two jobs, and only one of them is contention. A host import calling back into
+the instance that is executing is *nesting*, not concurrency — and the
+component model forbids that too: measured, `wasm trap: cannot enter component
+instance`. So throwing is right, and throwing *before* wasmtime traps is better,
+because a trap poisons the instance and every later call fails with the same
+message, hiding the cause. The flag now records the thread holding it, so
+re-entry says so (`:cljwit/error :reentrant`) instead of blaming a second
+thread that does not exist.
+
 ### E. Arguments reuse a buffer; results are lifted eagerly and never retained
 
 A result payload is **invalid after the next call on that function**. So every
@@ -98,6 +108,10 @@ recycles its own result allocation: measured, 300k `result` calls grow RSS by
 Argument buffers are built once per export and reused, which is safe for the
 same reason `0013` gives: the values are written immediately before the call.
 
+**This survives host imports**, which was not obvious and is now measured: the
+nested call that would clobber the buffer cannot happen, because a component
+instance cannot be re-entered at all.
+
 ## Why
 
 **A, because reflection is complete and codegen is not reversible.** The nested

doc/status.md

@@ -17,10 +17,12 @@ _Short by design, and printed at every session start — so findings live in
    express today. What is left of `0012` is `map`, `list<T,N>`,
    `stream`/`future` and `error-context`, none of which are in a shipped
    release.
-2. **Host imports.** `0014` names them as its most-likely-to-fire falsifier,
-   WASI requires them, and nothing has touched them. They also invalidate
-   `0014` E's argument-buffer reuse, which is safe today only because no guest
-   can call back.
+2. **Host imports.** The mechanism works — an FFM upcall stub reaches Clojure
+   from inside a component call (`bb spike-import`), pure Clojure, no C shim.
+   What is left is the `cljwit.host` API for declaring them. `0014` D and E
+   both **survive**: a host callback cannot re-enter the instance that is
+   executing (`wasm trap: cannot enter component instance`), so the nested
+   call that would clobber the argument buffer cannot happen.
 3. **`0012`'s `ex-data` contract.** It promises a WIT type name that reflection
    cannot supply; `0015` declined to be the codegen layer that would, so the
    contract has to shrink instead.

src/cljwit/host.clj

@@ -17,7 +17,7 @@
   (:import [java.lang.foreign Arena Linker SymbolLookup MemorySegment
             FunctionDescriptor ValueLayout]
            [java.lang.invoke MethodHandle]
-           [java.util.concurrent.atomic AtomicBoolean]))
+           [java.util.concurrent.atomic AtomicBoolean AtomicReference]))
 
 (set! *warn-on-reflection* true)
 
@@ -579,7 +579,7 @@
     nil))
 
 (deftype Instance [^Artifact artifact ^Arena arena exports aliases sigs
-                   ^MemorySegment store ^AtomicBoolean closed ^AtomicBoolean in-call
+                   ^MemorySegment store ^AtomicBoolean closed ^AtomicReference in-call
                    registry]
   java.lang.AutoCloseable
   (close [_]
@@ -588,7 +588,7 @@
     ;; then throws, leaving the store never deleted and the arena never closed,
     ;; with every retry a silent no-op because the CAS already won.
     (when-not (.get closed)
-      (when-not (.compareAndSet in-call false true)
+      (when (some? (.compareAndExchange ^AtomicReference in-call nil (Thread/currentThread)))
         (throw (ex-info "cannot close while a call is in flight"
                         {:cljwit/error :concurrent-use})))
       (when (.compareAndSet closed false true)
@@ -663,7 +663,7 @@
    and reused; the result is lifted eagerly and nothing backed by it escapes
    (`0014` E)."
   [api ^Arena arena ^MemorySegment ctx ^MemorySegment f sig
-   ^AtomicBoolean closed ^AtomicBoolean in-call nm rt]
+   ^AtomicBoolean closed ^AtomicReference in-call nm rt]
   (let [ptypes  (mapv (comp lower-fn second) (:params sig))
         n       (count ptypes)
         rlift   (when (:result sig) (lift-fn (:result sig) rt))
@@ -679,9 +679,22 @@
       (when-not (= n (count vs))
         (throw (ex-info (str nm " takes " n " argument(s)")
                         {:cljwit/error :wrong-arity :cljwit/export nm})))
-      (when-not (.compareAndSet in-call false true)
-        (throw (ex-info "the store is already in use by another call"
-                        {:cljwit/error :concurrent-use :cljwit/export nm})))
+      ;; 0014 D is one flag doing two jobs. Which one it is depends on whether
+      ;; *this* thread already holds it: a host import calling back into the
+      ;; instance that is executing is nesting, which the component model also
+      ;; forbids ("wasm trap: cannot enter component instance"), and saying
+      ;; "another call" about it sends the reader looking for a second thread.
+      (let [me (Thread/currentThread)
+            holder (.compareAndExchange ^AtomicReference in-call nil me)]
+        (when (some? holder)
+          (throw (ex-info (if (identical? holder me)
+                            (str "re-entered the store while " nm
+                                 " was running — a component instance cannot be"
+                                 " re-entered, including from a host import")
+                            (str "the store is in use by " (.getName ^Thread holder)))
+                          {:cljwit/error (if (identical? holder me)
+                                           :reentrant :concurrent-use)
+                           :cljwit/export nm}))))
       (try
         (with-open [scratch (Arena/ofConfined)]
           (dotimes [i n]
@@ -700,7 +713,7 @@
             (when (seq ps)
               (reset! (:pending rt) [])
               (run! (fn [p] (invoke (:res-delete api) p)) ps)))
-          (.set in-call false))))))
+          (.set ^AtomicReference in-call nil))))))
 
 (defn instantiate
   "Instantiates a compiled component. Cheap — tens of microseconds — so a
@@ -719,7 +732,7 @@
                    (invoke (:instantiate api) clink ctx (.-ptr art) inst))
         ct    (invoke (:comp-type api) (.-ptr art))
         closed  (AtomicBoolean. false)
-        in-call (AtomicBoolean. false)
+        in-call (AtomicReference. nil)
         ;; 0016 D: one call can yield handles the caller never destructured, so
         ;; the instance keeps the list and closes what is left before deleting
         ;; the store a handle's context points into.