[avrabe]

Fixes the defect #235 surfaced: the composite exported gust:os correctly while containing three schedulers and two clocks.

Principle: a provider must import every capability it does not own.

provider	owns	imports	exports
exec	the executor	gust:os/taskdisp	gust:os/exec + gust:sched/tasks
spawn	nothing	gust:sched/tasks	gust:os/spawn
timer	nothing	gust:sched/tasks, gust:os/time	gust:os/timer
time	the clock	gust:hal/mmio	gust:os/time

plain/src/executor.rs is untouched — it stays in exec-provider with its proofs; spawn and timer lost their #[path] includes and all statics.

The composite is sealed

world root {
  import gust:os/taskdisp@0.1.0;
  import gust:hal/mmio@0.1.0;
  export gust:os/time@0.1.0;   export gust:os/log@0.1.0;
  export gust:os/spawn@0.1.0;  export gust:os/exec@0.1.0;
  export gust:os/timer@0.1.0;
}

No gust:sched anywhere. That was the reason for putting the scheduler seam in its own package rather than widening gust:os: a downstream tenant importing the published, signed world cannot reach set-deadline and mutate scheduling state. 20 741 B (was 16 905; the delta is exec's second exported interface and its WIT type section).

One scheduler, verified by routing

module0  7573 B  dispatch=1 spawn-route=0 timer-route=0  gust:os/taskdisp poll-task
module1  1219 B  dispatch=0 ...                          gust:hal/mmio read32
module2  1078 B  dispatch=0 ...                          gust:hal/mmio write32
module3  1452 B  dispatch=0 spawn-route=1 timer-route=0  gust:sched/tasks state poll-round admit wake
module4  1463 B  dispatch=0 spawn-route=0 timer-route=1  gust:os/time now deadline; gust:sched/tasks set-deadline slept-status

Exactly one module owns dispatch and imports no gust:sched; spawn and timer route their scheduler operations to it. A provider with a private table would do those locally and not import them.

A gate was written, disproved, and thrown away

The first ownership check searched each core module for plain/src/executor.rs (rustc bakes it into bounds-check panic locations). It is not a detector: rebuilding the pre-change spawn and timer providers showed neither module contains that string — both bounds-check before indexing, so the panic path is elided — while both held a full private Tasks. That gate would have printed "exactly one" over the triplicated composite. A Tasks lives in wasm .bss, which a module never declares, so there is no binary signal for "holds a table".

Replaced with two decidable checks: source-level (only one crate may #[path]-include the executor) and composite-level routing (above). Negative-tested against the pre-change providers — it fires on all three signals.

The residual-import negative test runs in-band on every invocation: the script composes the same five components with an unwired script and requires the same function to reject it.

wac plug now works — and still cannot build this

The edges are real now, and wac plug timer-provider --plug exec-provider --plug time-provider succeeds where every pre-change ordering failed. It still can't produce the deliverable: a plug result exports only the socket's exports, and plug never wires plug→plug, so gust:sched/tasks goes unsatisfied. So wac compose — but the script now names real edges instead of a bare { ... } union.

Not claimed

• Not executed. "One scheduler" is verified structurally. Nobody has called spawn.start() and observed the handle in timer.sleep() through this composite. The two qemu probes exercise the executor natively and confirm no regression, not the new wiring.
• Linear memories are still 5 (1/17/17/1/17 pages), unchanged. That is the Component Model being shared-nothing — not the defect, not a regression. No memory reduction is claimed because none was measured.
• spawn-provider-cm3.o, timer-provider-cm3.o and os-ts-cm3.o are deliberately not regenerated; standalone re-measurements recorded in the RESULTS files (spawn text 1108→376, timer 844→552).
• A stale claim was corrected rather than inherited: timer-provider/RESULTS.md said sleep was blocked on synth#518. Measured pre- and post-change at synth 0.49.0 — both compile 5/5. That text described an older ticks: u64 WIT; this change did not fix it, and the file now says so.

🤖 Generated with Claude Code

https://claude.ai/code/session_011QG86sovTbfnPNY9SfhSmo

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!