diff --git a/.cargo/config.toml b/.cargo/config.toml
index 79d08f1d..d64d61cd 100644
--- a/.cargo/config.toml
+++ b/.cargo/config.toml
@@ -2,11 +2,9 @@
 runner = 'wasmtime run --dir=.::/cwd --dir=. --dir=/tmp -Sinherit-env=y,inherit-network=y,http=y,tcp=y,udp=y -C native-unwind-info=n'
 
 [target.wasm32-wasip2]
-# Keep in sync with the RUSTFLAGS overrides in scripts/build-runtime.sh and scripts/build-dylib.sh.
 rustflags = ["-C", "target-feature=+simd128"]
 runner = 'wasmtime run --dir=.::/cwd --dir=. --dir=/tmp -Sinherit-env=y,inherit-network=y,http=y,tcp=y,udp=y -C native-unwind-info=n'
 
 [target.wasm32-wasip3]
-# Keep in sync with the RUSTFLAGS overrides in scripts/build-runtime.sh and scripts/build-dylib.sh.
 rustflags = ["-C", "target-feature=+simd128"]
 runner = 'wasmtime run --dir=.::/cwd --dir=. --dir=/tmp -Sinherit-env=y,inherit-network=y,http=y,tcp=y,udp=y -C native-unwind-info=n'
diff --git a/.github/actions/setup/action.yml b/.github/actions/setup/action.yml
index 1931ac32..cfe0dc66 100644
--- a/.github/actions/setup/action.yml
+++ b/.github/actions/setup/action.yml
@@ -1,6 +1,6 @@
 # SPDX-License-Identifier: Apache-2.0-WITH-LLVM-exception
 name: Setup build environment
-description: Install system deps, Rust toolchain, WASI SDK, wasmtime, and configure sccache.
+description: Install system deps, Rust toolchain, WASI SDK, wasmtime, wasm-tools, and configure sccache.
 
 inputs:
   target:
@@ -10,19 +10,20 @@ inputs:
 runs:
   using: composite
   steps:
+    - name: Add the tool versions to the environment
+      shell: bash
+      run: grep -v '^#' "${{ github.action_path }}/../../tool-versions.env" >>"$GITHUB_ENV"
+
     - name: Install system dependencies
       shell: bash
       run: |
         sudo apt-get update
         sudo apt-get install -y build-essential python3 m4 libclang-dev llvm
 
+    # `install-tool.sh` checks each download's SHA-256 digest.
     - name: Install just
       shell: bash
-      run: |
-        mkdir -p "$HOME/.just/bin"
-        curl --proto '=https' --tlsv1.2 -sSf https://just.systems/install.sh \
-          | bash -s -- --to "$HOME/.just/bin"
-        echo "$HOME/.just/bin" >> "$GITHUB_PATH"
+      run: ${{ github.action_path }}/install-tool.sh just
 
     - name: Install Rust toolchain
       shell: bash
@@ -34,30 +35,30 @@ runs:
       run: rustup target add wasm32-wasip2
 
     # The pinned toolchain ships no wasm32-wasip3 std, so the justfile builds that target with the
-    # nightly toolchain `STARLING_NIGHTLY` names. The pinned toolchain is still needed for the
+    # beta toolchain `STARLING_BETA` names. The pinned toolchain is still needed for the
     # host-side test harnesses.
-    - name: Install nightly Rust toolchain with the wasm32-wasip3 target
+    - name: Install beta Rust toolchain with the wasm32-wasip3 target
       if: inputs.target == 'wasm32-wasip3'
       shell: bash
       run: |
-        rustup toolchain install "$STARLING_NIGHTLY" --profile minimal --target wasm32-wasip3
-        rustc "+$STARLING_NIGHTLY" --version
+        rustup toolchain install "$STARLING_BETA" --profile minimal --component clippy \
+          --target wasm32-wasip3
+        rustc "+$STARLING_BETA" --version
 
     - name: Install WASI SDK
       if: inputs.target != 'native'
       shell: bash
-      run: |
-        sudo mkdir -p /opt/wasi-sdk
-        curl -sSfL "https://github.com/WebAssembly/wasi-sdk/releases/download/wasi-sdk-${WASI_SDK_VERSION}/wasi-sdk-${WASI_SDK_VERSION}.0-x86_64-linux.tar.gz" \
-          | sudo tar xz --strip-components=1 -C /opt/wasi-sdk
-        echo "WASI_SDK_PATH=/opt/wasi-sdk" >> "$GITHUB_ENV"
+      run: ${{ github.action_path }}/install-tool.sh wasi-sdk
 
     - name: Install wasmtime
       if: inputs.target != 'native'
       shell: bash
-      run: |
-        curl -sSf https://wasmtime.dev/install.sh | bash -s -- --version "v$WASMTIME_VERSION"
-        echo "$HOME/.wasmtime/bin" >> "$GITHUB_PATH"
+      run: ${{ github.action_path }}/install-tool.sh wasmtime
+
+    - name: Install wasm-tools
+      if: inputs.target != 'native'
+      shell: bash
+      run: ${{ github.action_path }}/install-tool.sh wasm-tools
 
     - name: Run sccache-cache
-      uses: mozilla-actions/sccache-action@v0.0.9
+      uses: mozilla-actions/sccache-action@fc920bf0ec8de6ee65d409111f7ec508035751ba # v0.0.11
diff --git a/.github/actions/setup/install-tool.sh b/.github/actions/setup/install-tool.sh
new file mode 100755
index 00000000..404c0d87
--- /dev/null
+++ b/.github/actions/setup/install-tool.sh
@@ -0,0 +1,84 @@
+#!/usr/bin/env bash
+# SPDX-License-Identifier: Apache-2.0-WITH-LLVM-exception
+#
+# Download the x86_64 Linux release of a tool at the version `.github/tool-versions.env` names,
+# check its SHA-256 digest against the digest listed below for that version, install it, and add
+# it to `GITHUB_PATH`. The WASI SDK goes to /opt/wasi-sdk, which `WASI_SDK_PATH` is set to in
+# `GITHUB_ENV`, and the other tools go to `~/.<tool>/bin`. A version without a listed digest
+# fails.
+#
+# Usage:
+#   install-tool.sh <just|wasi-sdk|wasmtime|wasm-tools>
+
+set -euo pipefail
+
+TOOL="$1"
+# shellcheck source=../../tool-versions.env
+. "$(dirname "$0")/../../tool-versions.env"
+case "$TOOL" in
+    just) VERSION="$JUST_VERSION" ;;
+    wasi-sdk) VERSION="$WASI_SDK_VERSION" ;;
+    wasmtime) VERSION="$WASMTIME_VERSION" ;;
+    wasm-tools) VERSION="$WASM_TOOLS_VERSION" ;;
+    *) echo "unknown tool $TOOL" >&2; exit 1 ;;
+esac
+GH=https://github.com
+
+case "$TOOL-$VERSION" in
+    just-1.58.0)
+        URL="$GH/casey/just/releases/download/$VERSION/just-$VERSION-x86_64-unknown-linux-musl.tar.gz"
+        SHA256=4a5cc2f53e6f0f8c59092a6cc38291eb729d46a7dd95d3ae582008881b84931d
+        ;;
+    wasi-sdk-34)
+        URL="$GH/WebAssembly/wasi-sdk/releases/download/wasi-sdk-$VERSION/wasi-sdk-$VERSION.0-x86_64-linux.tar.gz"
+        SHA256=b761e3a0721dbae9c09a0059e5fdb2bf917d1b4a8a7b430fb3b5aafb0984b2c4
+        ;;
+    wasmtime-50.0.0)
+        URL="$GH/bytecodealliance/wasmtime/releases/download/v$VERSION/wasmtime-v$VERSION-x86_64-linux.tar.xz"
+        SHA256=77c19ee0437991f9ac7837b9c269d9c7076744f85dad263fea5214cc2723c7ff
+        ;;
+    wasm-tools-1.262.0)
+        URL="$GH/bytecodealliance/wasm-tools/releases/download/v$VERSION/wasm-tools-$VERSION-x86_64-linux.tar.gz"
+        SHA256=655b8df67d54c3ef9b52fc237c4e94bbfbb5f5f43825245cb0940a7002a9ed65
+        ;;
+    *)
+        echo "No SHA-256 digest for $TOOL $VERSION. Add it to $0." >&2
+        exit 1
+        ;;
+esac
+
+TMP="$(mktemp -d)"
+trap 'rm -rf "$TMP"' EXIT
+ARCHIVE="$TMP/$(basename "$URL")"
+curl --fail --silent --show-error --location -o "$ARCHIVE" "$URL"
+ACTUAL="$(sha256sum "$ARCHIVE" | cut -d' ' -f1)"
+if [[ "$ACTUAL" != "$SHA256" ]]; then
+    echo "SHA-256 mismatch for $URL:" >&2
+    echo "  expected $SHA256" >&2
+    echo "  got      $ACTUAL" >&2
+    exit 1
+fi
+
+case "$TOOL" in
+    just)
+        mkdir -p "$HOME/.just/bin"
+        tar -xzf "$ARCHIVE" -C "$HOME/.just/bin" just
+        echo "$HOME/.just/bin" >>"$GITHUB_PATH"
+        ;;
+    wasi-sdk)
+        sudo rm -rf /opt/wasi-sdk
+        sudo mkdir /opt/wasi-sdk
+        sudo tar -xzf "$ARCHIVE" --no-same-owner --strip-components=1 -C /opt/wasi-sdk
+        echo "WASI_SDK_PATH=/opt/wasi-sdk" >>"$GITHUB_ENV"
+        ;;
+    wasmtime)
+        mkdir -p "$HOME/.wasmtime/bin"
+        tar -xJf "$ARCHIVE" --strip-components=1 -C "$HOME/.wasmtime/bin" "wasmtime-v$VERSION-x86_64-linux/wasmtime"
+        echo "$HOME/.wasmtime/bin" >>"$GITHUB_PATH"
+        ;;
+    wasm-tools)
+        mkdir -p "$HOME/.wasm-tools/bin"
+        tar -xzf "$ARCHIVE" --strip-components=1 -C "$HOME/.wasm-tools/bin" "wasm-tools-$VERSION-x86_64-linux/wasm-tools"
+        echo "$HOME/.wasm-tools/bin" >>"$GITHUB_PATH"
+        ;;
+esac
diff --git a/.github/tool-versions.env b/.github/tool-versions.env
new file mode 100644
index 00000000..d8f62a52
--- /dev/null
+++ b/.github/tool-versions.env
@@ -0,0 +1,12 @@
+# The tool versions CI and releases install. The setup action adds them to the job's environment,
+# and `actions/setup/install-tool.sh` installs the version given here, checking the digest it
+# lists for it. A new release changes nothing until these are bumped.
+JUST_VERSION=1.58.0
+WASI_SDK_VERSION=34
+# The wasmtime CLI the wasm tests run under, and the wasm-tools CLI `scripts/build-runtime.sh`
+# wraps the runtime with, each at the version of the crates `componentize/Cargo.lock` holds.
+WASMTIME_VERSION=50.0.0
+WASM_TOOLS_VERSION=1.262.0
+# The beta toolchain wasm32-wasip3 builds use.
+STARLING_BETA=beta-2026-10-18
+NODE_VERSION=24.21.0
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 693a9305..8c974a0c 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -16,14 +16,13 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 env:
   CARGO_TERM_COLOR: always
   CARGO_INCREMENTAL: 0
-  WASI_SDK_VERSION: "34"
-  # The wasmtime CLI the wasm tests run under, and the nightly toolchain wasm32-wasip3 builds use.
-  # Both are pinned, so a new release changes nothing until these are bumped.
-  WASMTIME_VERSION: "49.0.0"
-  STARLING_NIGHTLY: nightly-2026-09-24
+  # The setup action adds the tool versions of `.github/tool-versions.env`.
   RUSTC_WRAPPER: sccache
   CCACHE: sccache
   # Bump to purge the sccache GHA cache.
@@ -37,7 +36,7 @@ jobs:
     name: Lint
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - uses: ./.github/actions/setup
         with:
@@ -49,9 +48,33 @@ jobs:
       - name: Run clippy
         run: just clippy --all
 
+      - name: Run the componentizer's unit tests
+        run: just test-componentize-unit
+
+  # ---------------------------------------------------------------------------
+  # The `init` interface between the runtime and the componentizer
+  # (`starling/wit/init.wit`) changes only with a version not compatible with the latest
+  # release's, since the componentizer accepts runtimes with a compatible version.
+  # ---------------------------------------------------------------------------
+  init-wit:
+    name: init.wit versioning
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          # The release tags the check compares with.
+          fetch-depth: 0
+
+      - name: Install wasm-tools
+        run: ./.github/actions/setup/install-tool.sh wasm-tools
+
+      - name: Check init.wit's version
+        run: ./scripts/check-init-wit.sh
+
   # ---------------------------------------------------------------------------
   # Cargo tests: {native, wasm32-wasip2, wasm32-wasip3} × {debug+debugmozjs, release}
-  # The wasm recipes also run the serve end-to-end suite (`just test-serve-wasm`).
+  # The wasm recipes also run the serve end-to-end suite (`just test-serve-wasm`). The debug wasm
+  # jobs first lint the code each wasm target compiles (`just clippy-wasm`).
   # ---------------------------------------------------------------------------
   test:
     name: Test (${{ matrix.target }}, ${{ matrix.profile }})
@@ -74,12 +97,16 @@ jobs:
       WASMTIME_BACKTRACE_DETAILS: '1'
       RUST_BACKTRACE: 'full'
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - uses: ./.github/actions/setup
         with:
           target: ${{ matrix.target }}
 
+      - name: Run clippy for the wasm target
+        if: matrix.target != 'native' && matrix.profile == 'debug'
+        run: just clippy-wasm
+
       - name: Run tests
         run: just ${{ matrix.recipe }}
 
@@ -87,6 +114,43 @@ jobs:
         if: matrix.target != 'native'
         run: just ${{ matrix.recipe }} --examples
 
+  # ---------------------------------------------------------------------------
+  # Componentization suites against the debug runtime (`just test-componentize`).
+  # That recipe builds the runtime for wasm32-wasip3, the target the componentizer
+  # links against, so this job installs beta and a wasi-sdk with a sysroot for it.
+  # ---------------------------------------------------------------------------
+  componentize:
+    name: Componentize
+    runs-on: ubuntu-latest
+    env:
+      WASMTIME_BACKTRACE_DETAILS: '1'
+      RUST_BACKTRACE: 'full'
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - uses: ./.github/actions/setup
+        with:
+          target: wasm32-wasip3
+
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
+        with:
+          node-version: ${{ env.NODE_VERSION }}
+
+      # `--tests` includes the `wit_to_ts` suite, which type-checks its output.
+      - name: Install the TypeScript compiler
+        run: npm ci
+
+      - name: Build the debug runtime and run the componentization suites
+        run: just test-componentize
+
+      # Runs scripts and a late-rejecting top level with the debug runtime component itself.
+      - name: Run scripts with the runtime component
+        run: just test-runtime
+
+      # Snapshots with `wizer-initialize`, including CLI tools whose `run` export a snapshot calls.
+      - name: Test Wizer snapshots
+        run: WASM_TARGET=p3 just test-wizer
+
   # ---------------------------------------------------------------------------
   # WPT suite: {native, wasm32-wasip2, wasm32-wasip3}
   # ---------------------------------------------------------------------------
@@ -102,15 +166,15 @@ jobs:
       WASMTIME_BACKTRACE_DETAILS: '1'
       RUST_BACKTRACE: 'full'
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - uses: ./.github/actions/setup
         with:
           target: ${{ matrix.target }}
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
-          node-version: "lts/*"
+          node-version: ${{ env.NODE_VERSION }}
 
       - name: Clone WPT suite
         run: ./scripts/clone-wpt.sh
@@ -135,25 +199,44 @@ jobs:
 
   gc_rooting:
     name: GC Rooting Checks
-    strategy:
-      fail-fast: false
     runs-on: ubuntu-latest
     env:
       RUST_BACKTRACE: full
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
+      # `just check-gc` also checks the wasm32-wasip2 build, which needs the target's std and the
+      # WASI SDK, and runs crown's own tests.
       - uses: ./.github/actions/setup
         with:
-          target: native
+          target: wasm32-wasip2
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
-          node-version: "lts/*"
+          node-version: ${{ env.NODE_VERSION }}
 
       - name: Crown static analysis
-        run: |
-          ./scripts/check-crown.sh --workspace --examples
+        run: just check-gc
+
+  # ---------------------------------------------------------------------------
+  # GC zeal tests of the default `scripts/test-gc-zeal.sh` packages, each shard
+  # running every third mode of the full set.
+  # ---------------------------------------------------------------------------
+  gc_zeal:
+    name: GC Zeal (${{ matrix.shard }}/3)
+    strategy:
+      fail-fast: false
+      matrix:
+        shard: [1, 2, 3]
+    runs-on: ubuntu-latest
+    env:
+      RUST_BACKTRACE: full
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - uses: ./.github/actions/setup
+        with:
+          target: native
 
       - name: GC Zeal tests
-        run: just gc-zeal --zeal full --examples --workspace
\ No newline at end of file
+        run: just gc-zeal --zeal full --shard ${{ matrix.shard }}/3
\ No newline at end of file
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
new file mode 100644
index 00000000..b2f7e538
--- /dev/null
+++ b/.github/workflows/release.yml
@@ -0,0 +1,238 @@
+# SPDX-License-Identifier: Apache-2.0-WITH-LLVM-exception
+
+# Release the runtime and `starling-componentize` together, under the workspace's version in the
+# repository's `Cargo.toml`, which `componentize/Cargo.toml` repeats. Build the release runtime,
+# `starling-componentize` for every platform of `componentize/npm/platforms.json` with that runtime
+# embedded, and the npm packages `componentize/npm/package.mjs` assembles from them. The
+# assembly fails unless the matrix below built a binary for every platform.
+#
+# A `v<version>` tag, which must name the workspace's version, publishes the npm packages and
+# creates a GitHub release with `starling.wasm`, each platform's `starling-componentize` and a
+# `SHA256SUMS` file of their digests. A manual run publishes the npm packages only with `publish`
+# set, and otherwise runs `npm publish --dry-run`. Every run uploads the packages' tarballs as the
+# `npm-tarballs` artifact.
+
+name: Release
+
+on:
+  push:
+    tags: ["v*"]
+  workflow_dispatch:
+    inputs:
+      publish:
+        description: Publish the packages to npm, rather than doing a dry run
+        type: boolean
+        default: false
+      version:
+        description: >-
+          The npm packages' version, such as 0.3.0-preview.1. Defaults to the workspace's
+          version in Cargo.toml
+        type: string
+        default: ""
+
+defaults:
+  run:
+    shell: bash
+
+permissions:
+  contents: read
+
+env:
+  CARGO_TERM_COLOR: always
+  # The setup action adds the tool versions of `.github/tool-versions.env`.
+  RUSTC_WRAPPER: sccache
+  CCACHE: sccache
+  SCCACHE_GHA_VERSION: 1
+
+jobs:
+  runtime:
+    name: Build the runtime
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          # The release tags `check-init-wit.sh` compares with.
+          fetch-depth: 0
+
+      - uses: ./.github/actions/setup
+        with:
+          target: wasm32-wasip3
+
+      - name: Check the version
+        run: |
+          version=$(sed -n 's/^version = "\(.*\)"$/\1/p' Cargo.toml | head -1)
+          componentize=$(sed -n 's/^version = "\(.*\)"$/\1/p' componentize/Cargo.toml | head -1)
+          if [ "$componentize" != "$version" ]; then
+            echo "componentize/Cargo.toml has version $componentize, the workspace $version" >&2
+            exit 1
+          fi
+          if [ "${GITHUB_REF_TYPE}" = tag ] && [ "${GITHUB_REF_NAME}" != "v$version" ]; then
+            echo "The tag ${GITHUB_REF_NAME} does not name the workspace's version $version" >&2
+            exit 1
+          fi
+          ./scripts/check-init-wit.sh
+
+      - name: Build the release runtime
+        run: just build-runtime
+
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: runtime
+          path: target/wasm32-wasip3/release/starling.wasm
+          if-no-files-found: error
+
+  binaries:
+    name: Build for ${{ matrix.platform }}
+    needs: runtime
+    strategy:
+      matrix:
+        include:
+          # The Linux binaries link musl statically, so they run on any Linux distribution,
+          # whichever C library it uses.
+          - { platform: linux-x64, os: ubuntu-latest, target: x86_64-unknown-linux-musl }
+          - { platform: linux-arm64, os: ubuntu-24.04-arm, target: aarch64-unknown-linux-musl }
+          - { platform: darwin-arm64, os: macos-latest }
+          - { platform: darwin-x64, os: macos-15-intel }
+          - { platform: win32-x64, os: windows-latest }
+    runs-on: ${{ matrix.os }}
+    env:
+      # The per-platform builds share no cache with the runtime build.
+      RUSTC_WRAPPER: ""
+      CCACHE: ""
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Install the Rust toolchain
+        run: rustup show
+
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        with:
+          name: runtime
+          path: runtime
+
+      - name: Install musl-gcc
+        if: matrix.target
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y musl-tools
+
+      - name: Build starling-componentize
+        working-directory: componentize
+        env:
+          STARLING_EMBED_RUNTIME: ${{ github.workspace }}/runtime/starling.wasm
+          TARGET: ${{ matrix.target }}
+        run: |
+          if [ -n "$TARGET" ]; then
+            rustup target add "$TARGET"
+            # `musl-gcc` compiles the C dependencies, such as zstd.
+            export "CC_${TARGET//-/_}=musl-gcc"
+            cargo build --release --locked --bin starling-componentize --target "$TARGET"
+            mkdir -p ../target/release
+            cp "../target/$TARGET/release/starling-componentize" ../target/release/
+          else
+            cargo build --release --locked --bin starling-componentize
+          fi
+
+      - name: Check the binary runs
+        run: |
+          exe=target/release/starling-componentize
+          if [ "${{ runner.os }}" = Windows ]; then exe="$exe.exe"; fi
+          "$exe" --version
+          mkdir -p out
+          cp "$exe" out/
+
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: binary-${{ matrix.platform }}
+          path: out/
+          if-no-files-found: error
+
+  publish:
+    name: Publish the npm packages
+    needs: binaries
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      # For npm's provenance statement.
+      id-token: write
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Add the tool versions to the environment
+        run: grep -v '^#' .github/tool-versions.env >>"$GITHUB_ENV"
+
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
+        with:
+          node-version: ${{ env.NODE_VERSION }}
+          registry-url: https://registry.npmjs.org
+
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        with:
+          pattern: binary-*
+          path: binaries
+
+      - name: Assemble the packages
+        env:
+          INPUT_VERSION: ${{ inputs.version }}
+        run: |
+          binaries=()
+          for dir in binaries/binary-*; do
+            platform=${dir#binaries/binary-}
+            binaries+=("$platform=$(ls "$dir"/starling-componentize*)")
+          done
+          node componentize/npm/package.mjs ${INPUT_VERSION:+--version "$INPUT_VERSION"} \
+            --out npm --pack npm-tarballs --all-platforms "${binaries[@]}"
+
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: npm-tarballs
+          path: npm-tarballs/
+          if-no-files-found: error
+
+      - name: Publish
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+        run: |
+          dry_run=--dry-run
+          if [ "${GITHUB_REF_TYPE}" = tag ] || [ "${{ inputs.publish }}" = true ]; then
+            dry_run=
+          fi
+          # The platform packages go first, so the package depending on them never
+          # names an unpublished version.
+          for dir in npm/starling-componentize-* npm/starling-componentize; do
+            (cd "$dir" && npm publish --provenance $dry_run)
+          done
+
+  github-release:
+    name: Create the GitHub release
+    if: github.ref_type == 'tag'
+    needs: publish
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        with:
+          name: runtime
+          path: assets
+
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        with:
+          pattern: binary-*
+          path: binaries
+
+      - name: Create the release
+        env:
+          GH_TOKEN: ${{ github.token }}
+          GH_REPO: ${{ github.repository }}
+        run: |
+          for dir in binaries/binary-*; do
+            platform=${dir#binaries/binary-}
+            for exe in "$dir"/starling-componentize*; do
+              name=$(basename "$exe")
+              cp "$exe" "assets/starling-componentize-${platform}${name#starling-componentize}"
+            done
+          done
+          (cd assets && sha256sum -- * > SHA256SUMS)
+          gh release create "$GITHUB_REF_NAME" --title "StarlingMonkey $GITHUB_REF_NAME" \
+            --generate-notes assets/*
diff --git a/.gitignore b/.gitignore
index 8f54e946..482650a4 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,2 +1,3 @@
 /target
 /deps/wpt
+/node_modules
diff --git a/Cargo.lock b/Cargo.lock
index 5d53900c..9e6aa0bf 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -386,6 +386,8 @@ dependencies = [
  "shlex 2.0.1",
  "tempfile",
  "tokio",
+ "url",
+ "wit-name-mapping",
 ]
 
 [[package]]
@@ -408,9 +410,7 @@ name = "cpp-builtins"
 version = "0.3.0"
 dependencies = [
  "cc",
- "core-runtime",
  "js",
- "libstarling",
  "mozjs",
  "mozjs_sys",
 ]
@@ -572,7 +572,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb"
 dependencies = [
  "libc",
- "windows-sys 0.52.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -1442,6 +1442,7 @@ dependencies = [
  "mozjs_sys",
  "num-traits",
  "rustc-hash",
+ "slab",
  "smallvec",
  "starling-macro",
 ]
@@ -1514,6 +1515,7 @@ dependencies = [
  "js",
  "platform",
  "serve-test-support",
+ "tempfile",
  "tokio",
  "url",
  "wasip3",
@@ -2064,7 +2066,7 @@ dependencies = [
  "once_cell",
  "socket2",
  "tracing",
- "windows-sys 0.52.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -2243,7 +2245,7 @@ dependencies = [
  "errno",
  "libc",
  "linux-raw-sys",
- "windows-sys 0.52.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -2300,7 +2302,7 @@ dependencies = [
  "security-framework",
  "security-framework-sys",
  "webpki-root-certs",
- "windows-sys 0.52.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -2546,7 +2548,9 @@ dependencies = [
  "libstarling",
  "tempfile",
  "wasip3",
+ "web-fetch",
  "wit-bindgen",
+ "wit-bridge",
 ]
 
 [[package]]
@@ -2639,7 +2643,7 @@ dependencies = [
  "getrandom 0.4.3",
  "once_cell",
  "rustix",
- "windows-sys 0.52.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -3006,7 +3010,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b1d0246511d901aacf25d2dc9111f0054947de5e093fe662099e709ff7530dc3"
 dependencies = [
  "leb128fmt",
- "wasmparser",
+ "wasmparser 0.259.0",
 ]
 
 [[package]]
@@ -3018,7 +3022,7 @@ dependencies = [
  "anyhow",
  "indexmap",
  "wasm-encoder",
- "wasmparser",
+ "wasmparser 0.259.0",
 ]
 
 [[package]]
@@ -3046,6 +3050,16 @@ dependencies = [
  "semver",
 ]
 
+[[package]]
+name = "wasmparser"
+version = "0.262.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "974d643b125b272607e2fff8012ea14a8328acd7621e4bafa7afb32500052b1b"
+dependencies = [
+ "bitflags",
+ "semver",
+]
+
 [[package]]
 name = "web-fetch"
 version = "0.3.0"
@@ -3086,7 +3100,9 @@ dependencies = [
  "core-runtime",
  "js",
  "libstarling",
+ "platform",
  "smallvec",
+ "tokio",
  "web-globals",
 ]
 
@@ -3136,7 +3152,7 @@ version = "0.1.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22"
 dependencies = [
- "windows-sys 0.52.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -3397,6 +3413,21 @@ dependencies = [
  "wit-bindgen-rust",
 ]
 
+[[package]]
+name = "wit-bridge"
+version = "0.3.0"
+dependencies = [
+ "core-runtime",
+ "js",
+ "platform",
+ "slab",
+ "smallvec",
+ "web-streams",
+ "wit-bindgen",
+ "wit-dylib-ffi",
+ "wit-name-mapping",
+]
+
 [[package]]
 name = "wit-component"
 version = "0.259.0"
@@ -3412,10 +3443,27 @@ dependencies = [
  "serde_json",
  "wasm-encoder",
  "wasm-metadata",
- "wasmparser",
+ "wasmparser 0.259.0",
  "wit-parser",
 ]
 
+[[package]]
+name = "wit-dylib-ffi"
+version = "0.1.0"
+source = "git+https://github.com/bytecodealliance/wasm-tools/?rev=e22db44da4eaf17a0e46ec55b911c7539589a3cc#e22db44da4eaf17a0e46ec55b911c7539589a3cc"
+dependencies = [
+ "wit-bindgen",
+]
+
+[[package]]
+name = "wit-name-mapping"
+version = "0.3.0"
+dependencies = [
+ "heck",
+ "semver",
+ "wasmparser 0.262.0",
+]
+
 [[package]]
 name = "wit-parser"
 version = "0.259.0"
@@ -3432,7 +3480,7 @@ dependencies = [
  "serde_derive",
  "serde_json",
  "unicode-ident",
- "wasmparser",
+ "wasmparser 0.259.0",
 ]
 
 [[package]]
diff --git a/Cargo.toml b/Cargo.toml
index 060c7ce6..c3a5c2bf 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -8,6 +8,8 @@ edition = "2021"
 [workspace]
 members = [
     "starling",
+    "crates/wit-bridge",
+    "crates/wit-name-mapping",
     "crates/platform",
     "crates/builtins/*",
 ]
@@ -39,14 +41,19 @@ libstarling = { path = "crates/libstarling" }
 oxc_resolver = "11"
 platform = { path = "crates/platform" }
 reqwest = { version = "0.13", default-features = false, features = ["rustls", "stream"] }
+semver = "1.0.28"
 serve-test-support = { path = "crates/serve-test-support" }
+slab = "0.4.12"
 smallvec = "1.16"
 starling-macro = { path = "crates/starling-macro" }
 tokio = { version = "1", features = ["rt", "time", "net", "io-util"] }
 url = "2.5.8"
 wasip3 = { version = "0.9.0", features = ["http-compat"] }
+wasmparser = { version = "0.262", default-features = false, features = ["validate", "component-model"] }
 # Must equal the `wit-bindgen` version `wasip3` depends on. See `starling/Cargo.toml`.
 wit-bindgen = { version = "=0.62.0", features = ["macros"] }
+wit-bridge = { path = "crates/wit-bridge" }
+wit-name-mapping = { path = "crates/wit-name-mapping" }
 wpt-support = { path = "crates/wpt-support" }
 
 # Builtins
@@ -57,7 +64,6 @@ web-streams = { path = "crates/builtins/web-streams" }
 web-url = { path = "crates/builtins/web-url" }
 cpp-builtins = { path = "crates/builtins/cpp-builtins" }
 
-
 [profile.release]
 lto = "thin"
 strip = "symbols"
diff --git a/README.md b/README.md
index edc8fd77..104e3c17 100644
--- a/README.md
+++ b/README.md
@@ -7,6 +7,9 @@ StarlingMonkey is designed to be extensible and provides safe high-level
 abstractions for defining additional builtins as JS classes, WebIDL interfaces,
 JS modules, and functions and properties on the global object.
 
+[`starling-componentize`](#componentizing-javascript) builds WebAssembly components from a
+JavaScript application and a WIT world.
+
 ---
 
 ## Contents
@@ -14,6 +17,20 @@ JS modules, and functions and properties on the global object.
 - [Running JavaScript](#running-javascript)
 - [Built-in APIs](#built-in-apis)
 - [CLI Reference](#cli-reference)
+- [Componentizing JavaScript](#componentizing-javascript)
+  - [Installing](#installing)
+  - [Command line](#command-line)
+  - [Export names](#export-names)
+  - [HTTP servers](#http-servers)
+  - [CLI tools](#cli-tools-wasiclirun)
+  - [Components that serve and run](#components-that-serve-and-run)
+  - [Initialization](#initialization)
+  - [Refused worlds](#refused-worlds)
+  - [Disabling WASI features](#disabling-wasi-features)
+  - [The interfaces the runtime imports](#the-interfaces-the-runtime-imports)
+  - [WIT values in JavaScript](#wit-values-in-javascript)
+  - [Bundling and build caching](#bundling-and-build-caching)
+  - [TypeScript declarations for a world](#typescript-declarations-for-a-world)
 - [Extending with Custom Builtins](#extending-with-custom-builtins)
   - [`#[jsclass]` / `#[jsmethods]`](#jsclass--jsmethods)
   - [`#[jsmodule]`](#jsmodule)
@@ -25,9 +42,10 @@ JS modules, and functions and properties on the global object.
 - [Inheritance](#inheritance)
 - [Promise / Async](#promise--async)
 - [Building and Testing](#building-and-testing)
+  - [The runtime component](#the-runtime-component)
+  - [The componentizer](#the-componentizer)
 - [Web Platform Tests (WPT)](#web-platform-tests-wpt)
 - [GC Rooting Checks](#gc-rooting-checks)
-- [Key Design Points](#key-design-points)
 
 ---
 
@@ -83,18 +101,14 @@ starlingmonkey --legacy-script old-code.js
 
 ## Built-in APIs
 
-StarlingMonkey's suite of builtins is a work in progress for now.
-
 ### C++ built-ins
 
-The previous incarnation of StarlingMonkey was written in C++. This one has
-support for running built-ins from that version, in the
-[crates/builtins/cpp-builtins](crates/builtins/cpp-builtins) crate. Only the old
-`console` builtin is added right now.
+[crates/builtins/cpp-builtins](crates/builtins/cpp-builtins) runs builtins written for
+StarlingMonkey's earlier C++ implementation through a compatibility layer. It provides `console`.
 
 Builtins are tested against the
 [Web Platform Tests](https://github.com/web-platform-tests/wpt) suite running
-on both native and `wasm32-wasip2` targets.
+on both native and wasm targets.
 
 ---
 
@@ -104,44 +118,41 @@ on both native and `wasm32-wasip2` targets.
 starlingmonkey [OPTIONS] [SCRIPT_PATH]
 
 Arguments:
-  [SCRIPT_PATH]   Path to the entry JS/MJS file (default: ./index.js)
+  [SCRIPT_PATH]     Path to the entry JS/MJS file (default: ./index.js)
 
 Options:
-  -e, --eval <SCRIPT>                Evaluate inline script instead of a file
-  -i, --initializer-script <PATH>    Run an init script (classic, synchronous) before the content script
-      --legacy-script                Run as a classic script instead of an ES module
-  -v, --verbose                      Enable verbose logging
-  -d, --debug                        Enable script debugging via socket
-      --async-stacks                 Show async parent frames in Error.stack (always on under a debugger)
-      --wpt-mode                     Enable WPT (Web Platform Tests) mode
-      --init-location <URL>          Override the location URL for initialization
-      --strip-path-prefix <PREFIX>   Strip this prefix from script paths
-      --serve <PORT>                 Serve HTTP on this port, dispatching fetch events
-      --serve-isolated               Handle each served request in its own global
-      --dispatch-timeout <SECONDS>   Give up on a request whose respondWith hasn't settled (0 = no limit)
-      --response-body-timeout <SECONDS>   Cut a response body not fully sent by then, truncating it visibly (0 = no limit)
-      --waituntil-timeout <SECONDS>   Stop driving a served request's leftover waitUntil work (0 = no limit)
-      --end-to-end-timeout <SECONDS>   Wall-clock ceiling over all of a request's phases together (0 = no limit)
-      --request-read-timeout <SECONDS>   Give up on a client that stopped sending (default 30, 0 = no limit)
-      --keepalive-timeout <SECONDS>   Close an idle kept-alive connection (default 30, 0 = no limit)
-      --max-connection-buffer-size <BYTES>   The maximum number of bytes the server will read from the client's connection at once. (default ca 400KiB, minimum 8KiB)
-      --max-request-headers <COUNT>   Cap the number of header fields (default 128)
-      --max-request-body-bytes <BYTES>   Cap a request body (default 512MiB)
-      --max-body-drain-bytes <BYTES>   Spend at most this reading a body the handler ignored (default 256KiB)
-      --max-connections <COUNT>      Serve at most this many connections at once (default 1024)
-  -h, --help                         Print help
-```
-
-The serve timeouts are unlimited by default, except under `--wpt-mode`, where the
-per-phase ones default to 120s. The per-phase timeouts each bound their own phase,
-while `--end-to-end-timeout` caps the whole request regardless of how the phases
-divide it.
-
-The `--max-…` limits, `--request-read-timeout` and `--keepalive-timeout` bound
-guest controlled allocation and wait times.
-
-All transport related limits exist in native builds only, since on wasm, the host
-runtime enforces equivalent limits.
+  -e, --eval <SCRIPT>                  Evaluate inline script instead of a file
+  -i, --initializer-script <PATH>      Run an init script (classic, synchronous) before the content script
+      --async-stacks                   Show async parent frames in Error.stack (always on under a debugger)
+      --legacy-script                  Run as a classic script instead of an ES module
+      --wpt-mode                       Enable WPT (Web Platform Tests) mode
+      --web-security-restrictions[=<BOOL>]  Enforce the browser-security Fetch constraints and coarsen performance.now() and Event.timeStamp (default: only with --wpt-mode)
+      --init-location <URL>            Override the location URL for initialization
+      --serve <PORT>                   Serve HTTP on this port, dispatching fetch events
+      --serve-isolated                 Handle each served request in its own global
+      --dispatch-timeout <SECONDS>     Give up on a request whose respondWith hasn't settled
+      --response-body-timeout <SECONDS>  Truncate a response body not fully sent by then
+      --waituntil-timeout <SECONDS>    Stop driving a served request's leftover waitUntil work
+      --end-to-end-timeout <SECONDS>   Wall-clock ceiling over all of a request's phases together
+      --max-connection-buffer-size <BYTES>  Bytes read from a connection at once (default 408KiB, minimum 8KiB)
+      --max-request-headers <COUNT>    Cap the number of header fields (default 128)
+      --max-request-body-bytes <BYTES> Cap a request body (default 512MiB)
+      --max-body-drain-bytes <BYTES>   Read at most this much of a body the handler ignored (default 256KiB)
+      --max-connections <COUNT>        Serve at most this many connections at once (default 1024)
+      --request-read-timeout <SECONDS> Give up on a client that stopped sending (default 30)
+      --keepalive-timeout <SECONDS>    Close an idle kept-alive connection (default 30)
+  -v, --verbose                        No effect
+  -d, --debug                          No effect
+      --strip-path-prefix <PREFIX>     No effect
+  -h, --help                           Print help
+```
+
+`starlingmonkey --help` describes each option in full. The serve timeouts take whole or
+fractional seconds, and `0` means no limit. Without a value, `--dispatch-timeout`,
+`--response-body-timeout` and `--waituntil-timeout` have no limit, or 120 seconds under
+`--wpt-mode`. A phase timeout longer than `--end-to-end-timeout` is rejected. The `--max-…`
+limits, `--request-read-timeout`, `--keepalive-timeout` and `--serve-isolated` exist in native
+builds only.
 
 **Module mode** (default) — strict mode, `import`/`export` supported, `this`
 is `undefined` at the top level.
@@ -166,7 +177,516 @@ or whose top-level `await` rejects, fails startup. The native server exits with
 status 1 once that happens, which for a top-level `await` can be after it began
 listening. A wasm instance logs the error once and answers every request with a
 500. With `--serve-isolated`, the script is evaluated for each request, and a
-request whose evaluation fails is answered with a 500.
+request whose evaluation fails is answered with a 500. The native server prints
+`serving on http://127.0.0.1:<PORT>` on stderr once it listens. With `--serve 0`, it listens on
+a port the OS assigns, which that line names.
+
+---
+
+## Componentizing JavaScript
+
+`starling-componentize` builds a WebAssembly component from a JavaScript module and a WIT world.
+The component implements the world's exports in JavaScript, and the application calls the world's
+imports as ordinary JS functions. The component contains the whole runtime, SpiderMonkey
+included, and runs under `wasmtime` or composes with other components through `wasm-tools`.
+
+```bash
+starling-componentize -w <wit-dir> -n <world> componentize <app.js> -o out.wasm
+```
+
+### Installing
+
+- The npm package `@bytecodealliance/starling-componentize` installs a prebuilt binary for the
+  platform from an optional dependency, one package per platform, and runs as
+  `npx @bytecodealliance/starling-componentize`. Its `binaryPath()` export returns the binary's
+  path. There are packages for macOS (arm64 and x64), Linux (arm64 and x64) and Windows (x64).
+  The Linux binaries are statically linked, so they run with any C library.
+- Each GitHub release has `starling.wasm`, a `starling-componentize` binary per platform and a
+  `SHA256SUMS` file of their digests. The runtime and `starling-componentize` are
+  released together, under the same version.
+- In a checkout, `just install-componentize` builds the release runtime and installs
+  `starling-componentize` with it embedded, so the installed binary needs no other file.
+  [The componentizer](#the-componentizer) describes the other recipes.
+
+### Command line
+
+`starling-componentize [OPTIONS] <COMMAND>` takes one of three subcommands:
+`componentize <input>` builds a component, [`types`](#typescript-declarations-for-a-world)
+prints TypeScript declarations for the world, and [`imports`](#bundling-and-build-caching) lists
+the modules the application may import. These options apply to all three, and may come before or
+after the subcommand:
+
+| Option | Effect |
+|--------|--------|
+| `-w`, `--wit <PATH>` | A `.wit` file or a directory of them. Repeatable. |
+| `-n`, `--world-name <NAME>` | The world to target. Repeatable. Requires `-w`. |
+| `--export-cli` | Export `wasi:cli/run` ([CLI tools](#cli-tools-wasiclirun)). |
+| `--export-http` | Export `wasi:http/handler` ([HTTP servers](#http-servers)). |
+| `--disable <FEATURES>` | Leave WASI features out of the component ([Disabling WASI features](#disabling-wasi-features)). |
+| `--unstable-features <FEATURES>` | Include the WIT items annotated `@unstable(feature = …)` with these features. Repeat, or separate them with commas or whitespace. |
+| `--all-unstable-features` | Include every WIT item annotated `@unstable`. |
+| `-q`, `--quiet` | Print only errors. Without it, what the application prints while it initializes is shown. |
+
+`componentize` also takes these:
+
+| Option | Effect |
+|--------|--------|
+| `-o`, `--output <FILE>` | The component to write. Defaults to `js.wasm`. |
+| `-p`, `--base-directory <DIR>` | The directory the application's relative `import`s resolve within. Defaults to the input file's directory. |
+| `--runtime <PATH>` | The runtime build to link against (also for `types` and `imports`). |
+| `--init-location <URL>` | The URL `globalThis.location` reflects while the application's top level runs. Without it, reading `location` there throws a `TypeError`, which fails componentization unless the application catches it. |
+| `--deterministic-insecure-random-seed <SEED>` | Leave out `wasi:random/insecure-seed` ([Disabling WASI features](#disabling-wasi-features)). |
+| `--no-cache` | Keep the compiled component out of wasmtime's compilation cache, which otherwise speeds up componentizing the same world again. |
+
+`-w`, `--export-cli` or `--export-http` is required. A directory passed to `-w` brings the packages
+in its `deps` directory along. Repeated `-w`s are read in order, so a package comes after the
+packages it uses. A package several of them define is merged into one, with the interfaces, types
+and functions of every definition, so libraries can each ship the part of a package they use. The
+definitions must agree on the functions they have in common.
+
+`-n` names a world in the last package loaded, or any world by its qualified name,
+`namespace:package/world@version`. Without `-n`, the last package's only world is targeted.
+Repeated `-n`s target several worlds, merged into one, `starling:componentize/merged`, which
+imports and exports everything they do.
+
+The runtime is the one `--runtime` names, or else the one the `STARLING_RUNTIME` environment
+variable names, or else the one embedded in `starling-componentize`. It must be a `starling.wasm`
+that `scripts/build-runtime.sh` built ([The runtime component](#the-runtime-component)). The
+componentizer refuses one that a plain `cargo build` wrote, since it lacks the metadata the script
+adds. The
+componentizer also refuses a runtime whose version of the `starling:componentize/init` interface,
+which `starling/wit/init.wit` declares, is not
+[compatible](#the-interfaces-the-runtime-imports) with its own.
+
+### Export names
+
+The component's type is exactly the world's: it exports what the world declares and nothing else.
+The runtime's own `wasi:cli/run` and `wasi:http/handler` are exported only when the world
+declares them, which the worlds of `--export-cli` and `--export-http` do. The `init` interface the
+componentizer calls is not exported.
+
+The main module provides each function and resource class of an exported interface in exactly one
+of the shapes below. For `greet` in the interface `greeter` of the package `test:app@1.0.0`:
+
+```js
+// The package layer: `test-app` in lowerCamelCase, then the interface's name.
+// The version is not part of the name.
+export const testApp = { greeter: { greet } };
+// The interface layer.
+export const greeter = { greet };
+// A bare export.
+export function greet(name) { /* … */ }
+```
+
+The interface layer is allowed only when no other exported interface has the same name, and a bare
+export only when no other exported item or world-level function has the same name. Where the names
+of two shapes coincide, the package layer's name takes precedence over an interface-layer and a
+bare name, and an interface-layer name over a bare name. A world-level exported function is always
+a bare export, and takes precedence over an interface-layer name. An interface the world exports
+under a plain name (`export local: interface { … }`) has no package layer. Functions are
+lowerCamelCase and resource classes UpperCamelCase. A reserved word such as `default` or `new` is
+exported with an export clause (`export { make as new }`).
+
+Two versions of one interface have the same package-layer and interface-layer names, so each is
+provided only by the export named by its full WIT name. A TypeScript build needs
+`"module": "es2022"` or later for such a name:
+
+```js
+export { v1 as "local:hello/hello@1.0.0", v2 as "local:hello/hello@2.0.0" };
+```
+
+Every export is resolved when the snapshot is taken. An item the main module provides in more than
+one shape, or in none, fails componentization with a message listing the shapes it may take.
+
+### HTTP servers
+
+For an HTTP server, pass `--export-http`, or declare `export wasi:http/handler@0.3.0;` in your own
+world, and the component exports `wasi:http/handler`. With `-w`, `--export-http` merges the world
+`-n` selects with a world exporting the interface, so the application can import the interfaces its
+WIT declares as well. The application serves requests in one of two ways:
+
+- Register a listener with `addEventListener('fetch', …)`. The runtime dispatches each request as
+  a `fetch` event.
+- Export its own `handle`, in one of the shapes of `wasi:http/handler`'s exports:
+  `wasiHttp.handler.handle`, `handler.handle` or a bare `handle`. `handle` takes a
+  `wasi:http/types` request and returns a response: a `Response` object, such as the one `fetch`
+  resolved to, whose body is then passed on without being read, or a `wasi:http/types` one.
+  `fetch` takes the `wasi:http/types` request as its input, so `return fetch(request)` forwards a
+  request unchanged. The request can't be used after `fetch` took it.
+
+```js
+export async function handle(request) {
+  if (request.getPathWithQuery() === "/proxy") {
+    return fetch(request);
+  }
+  return new Response(`hello from ${request.getPathWithQuery()}`);
+}
+```
+
+Which of the two the application uses is determined when the snapshot is taken. An application
+that does both, or neither, fails componentization. A world that declares the `wasi:http`
+interfaces itself must agree with the runtime on every item both declare, or leave
+`wasi:http/handler` empty (`interface handler {}`).
+
+The `wasi:http/types` resources a `handle` receives have the methods the runtime's builtins use,
+since the component imports nothing beyond them. A world that imports `wasi:http/types` itself,
+with `-w`/`-n`, adds the functions it declares, for example `fields`' `get` and `has`.
+
+### CLI tools (`wasi:cli/run`)
+
+A command-line tool needs no WIT of its own. Pass `--export-cli`, which with `-w` merges the
+selected world with one exporting `wasi:cli/run`, and have the application `export` a `run`
+function:
+
+```bash
+starling-componentize --export-cli componentize <app.js> -o cli.wasm
+wasmtime run -Sinherit-env=y,http=y cli.wasm
+```
+
+```js
+// app.js
+export async function run() {
+  console.log("hello from a componentized CLI tool");
+}
+```
+
+Invoking the component's `wasi:cli/run` export calls the JavaScript `run` export, which runs as
+[an `async` export](#asynchronous-calls) does. Running the module as a plain script evaluates its
+top level without calling `run`. Componentizing a module without a `run` function as a CLI tool
+fails, naming the export to add.
+
+### Components that serve and run
+
+`--export-cli` and `--export-http` combine, alone or with `-w`, into one component exporting both
+`wasi:cli/run` and `wasi:http/handler`. The application then exports `run`, and registers a `fetch`
+listener or exports `handle`. The host picks the export it calls, so `wasmtime run` calls `run` and
+`wasmtime serve` serves requests, each in instances of its own resumed from the same snapshot:
+
+```bash
+starling-componentize --export-cli --export-http componentize <app.js> -o app.wasm
+```
+
+### Initialization
+
+The application's top level runs to completion under Wizer, and the component starts from the
+snapshot taken after it. Its relative and JSON imports are read from the base directory, and a
+top-level `await` may wait on timers and dynamic `import()`s. A module that imports the input file
+gets the application's main module itself. Exports are resolved once the top level has finished,
+so an export declared after a top-level `await` is found. A top level that throws, rejects, or
+awaits a promise that never settles fails componentization with the reason. A dynamic
+`import()` of a module the top level did not load reads the file when an export calls it, through
+the component's own filesystem imports and relative to the working directory the host gives it, so
+it fails with `--disable filesystem`.
+
+A snapshot holds memory, not a running event loop, so the top level must leave no asynchronous
+work behind when it finishes: no timer or interval still pending, no `fetch` it did not await.
+Componentization fails otherwise, listing each piece of work with the stack that created it:
+
+```text
+Error: the application's top level finished evaluating with asynchronous work still pending, [...]
+  - a pending `interval` timer, created at:
+      startPolling@app.js:2:14
+      @app.js:4:1
+  - a host operation in flight, created at:
+      @app.js:6:20
+```
+
+The component opens its own standard streams when it first writes after resuming. Calling an
+import during initialization throws a `TypeError` naming it, since the host's imports are not
+linked while the snapshot is taken, and fails componentization unless the application catches it.
+An `async` import returns a promise rejected with that error instead, which fails
+componentization when the top level awaits it.
+
+### Refused worlds
+
+Componentizing these worlds fails with an error naming the function or export:
+
+- a world with a function that uses a `map`, a fixed-length `list` or `error-context`;
+- a world with a synchronous export that takes or returns a `stream` or `future`, since no event
+  loop drives their transfer (declare it `async`);
+- a world with a world-level import function that takes a `borrow` anywhere in its parameters,
+  such as a method of a resource declared directly in the world rather than in an interface,
+  since the composition step cannot encode a `borrow` outside an interface (`types` still
+  describes such a world);
+- a world that exports `wizer-initialize`, `wasi-http-handler` or the
+  `starling:componentize/init` interface, whose names the componentizer's own exports use;
+- a world that exports `wasi:cli/run` or `wasi:http/handler` in a version not
+  [compatible](#the-interfaces-the-runtime-imports) with the one the runtime provides;
+- a world that imports an interface at several compatible versions, from its own WIT or the
+  runtime's, where a version lacks a type or function that a lower one declares.
+
+### Disabling WASI features
+
+`--disable` takes a comma-separated list of `stdio`, `random`, `clocks`, `http` and `filesystem`,
+and may be repeated. The interfaces of the named WASI features are left out of the component's
+imports, and stubs that trap when called take their place. With all five disabled, a world that
+imports no WASI produces a component that imports nothing beyond `wasi:cli/environment`,
+`wasi:cli/exit` and `wasi:random/insecure-seed`. The application's top level still runs with every feature during
+componentization.
+
+A disabled clock's `now` returns zero instead of trapping, since the runtime reads it whatever the
+application does. `Date.now()` and `performance.now()` then return constants, and only waiting on
+the clock traps. `random` leaves out `wasi:random/random` only. A trap in a stub names the disabled
+function in the backtrace, as in
+`disabled-features!wasi:random/random@0.3.0#get-random-bytes (disabled)`.
+
+`wasi:io` is left out once no remaining feature uses it. A feature that a remaining feature uses
+cannot be disabled by itself: `filesystem` uses the clocks' types, so disabling `clocks` alone is
+refused with a message listing every such use and the features to disable with it.
+
+SpiderMonkey seeds its hash tables from `wasi:random/insecure-seed`, so the component imports it
+unless `--deterministic-insecure-random-seed <SEED>` is given. SEED is a 128-bit number, in decimal
+or with a `0x` prefix in hex, and `get-insecure-seed` then always returns its high and low 64 bits.
+With SEED, an attacker can craft input that collides in those hash tables and degrades the
+application's performance, so use it only with trusted input.
+
+### The interfaces the runtime imports
+
+The targeted world also imports every interface the runtime imports, whether it comes from `-w`,
+`--export-cli` or `--export-http`: `wasi:cli`'s environment, exit, standard streams and terminals,
+`wasi:clocks`, `wasi:filesystem`, `wasi:random`, `wasi:http/types` and `wasi:http/client`, except
+those of the features `--disable` names. Each has the functions the runtime itself imports, so the
+application can import them without adding to what the component imports:
+
+```js
+import { getEnvironment } from "wasi:cli/environment@0.3";
+```
+
+Two versions of an interface are compatible if they have the same canonical version, as the
+component model defines it for interface names:
+
+- the major number, for a version from `1.0.0` on, such as `1` for `1.2.3`;
+- `0.` followed by the minor number, for a `0.x.y` version whose minor number isn't 0, such as
+  `0.3` for `0.3.1`;
+- the whole version without its build metadata, for a `0.0.x` version or a pre-release, such as
+  `0.0.4` or `0.3.0-rc.1`. Such a version is compatible only with itself.
+
+A world imports each interface once, even if its WIT and the runtime declare several compatible
+versions of it: at the lowest of them if they all declare the same types and functions, and at the
+highest otherwise. Its types then have their plain names. A version that lacks a type or function
+of a lower compatible version is [refused](#refused-worlds).
+
+A module specifier names an interface by its canonical version, as in `wasi:cli/environment@0.3`,
+and `starling-componentize imports` and the
+[TypeScript declarations](#typescript-declarations-for-a-world) name it that way. A specifier with
+any compatible full version, such as `wasi:cli/environment@0.3.0`, resolves to the same module.
+
+### WIT values in JavaScript
+
+These WIT types work: all scalars (`u64` and `s64` are always BigInts, like the elements of a
+`BigUint64Array`), `string`, `list` (numeric lists as typed arrays, `list<u64>` and `list<s64>` as
+`BigUint64Array` and `BigInt64Array`, and a numeric list also takes a plain `Array`), `record`,
+`tuple`, `variant`, `enum`, `option`, `result`, `flags`, `resource`s with constructors, methods,
+static methods and borrows, and [`stream<T>` and `future<T>`](#streams-and-futures). Worlds that
+use a `map`, a fixed-length `list` or `error-context` are [refused](#refused-worlds).
+
+Imports are surfaced as ES modules the application can `import` (see
+[`imports`](#bundling-and-build-caching)). An interface the world only exports has no module, so
+the application cannot import the objects or error classes of its types.
+
+Every imported resource has a class, including one that no constructor, method or static function
+names. An imported resource wrapper has a `[Symbol.dispose]()` method that releases the host handle
+early (so `using` works, and a second call does nothing). Disposing of a wrapper an `async` import
+call still borrows releases the handle once that call returns. A guest class implementing an
+exported resource may define `[Symbol.dispose]()`, which the runtime calls when the host drops the
+resource. Its methods are looked up on the instance, so a subclass's override runs.
+
+A variant's tag and a record's fields are their WIT names in lowerCamelCase (`db-null` is
+`dbNull`). An `enum` crosses as its case index, and a `flags` set as an int32 of its bits, the bit
+of the n-th flag being `1 << n`. The module of the interface defining an enum or flags type, and of
+each interface that `use`s it, exports a frozen object under the type's name in that interface, in
+UpperCamelCase, as a TypeScript enum's object would be: it maps each case's lowerCamelCase name to
+its value and each value back to the name (`Qos.atLeastOnce` is `1`, `Qos[1]` is `"atLeastOnce"`).
+An error class of the same name takes the name instead.
+
+An import argument that does not match its WIT type throws a `TypeError` naming the argument, the
+part of it that failed and its value, such as ``argument 1 of `bigArgument` `.a1`: expected a
+string, got 5``. The arguments of one call are also checked together: a resource wrapper passed as
+an `own` must not appear anywhere else in them, a wrapper the guest received as a `borrow`, or one
+an `async` import call still borrows, cannot be passed as an `own`, and a `ReadableStream` must be
+unlocked and passed only once. An export result that does not match traps the call, and the
+message printed on stderr names the export and the part of the result the same way.
+
+#### Synchronous exports
+
+A synchronous export runs without an event loop. The microtasks it queues run before it returns. A
+timer it starts throws a `TypeError` naming the export. A `fetch`, an `async` import, or a read of
+a response body or of a stream from the host it starts returns a promise rejected with one.
+Passing a stream or a future to an import throws one too, since nothing would transfer it. A value
+it writes to a stream or future that an earlier asynchronous call returned, such as by settling a
+promise lowered to a future, is written in the next asynchronous call.
+
+#### Asynchronous calls
+
+`async` exported functions return a JS `Promise` that the component lifts into a WASIp3 async
+return. `async` imports are called as ordinary `async` JS functions and `await`ed. Their arguments
+are checked and lowered when the call starts, so a change to an argument after the call, such as to
+a typed array's elements, has no effect on what the host receives.
+
+Each call to an `async` export runs its own event loop, which drives guest promises,
+imported-function calls, and the builtins' work (`fetch`, timers, web streams), so one call can
+`await` a `fetch` and run `setTimeout` callbacks. The call finishes once its promise has settled
+and its imports, streams and futures are done. Timers still pending then are dropped without
+running. An `async` export whose promise is still pending once its call's event loop has nothing
+left to run traps, even if a later call could settle the promise.
+
+#### Streams and futures
+
+Streams and futures are web streams and promises:
+
+- A `stream<T>` the guest receives is a `ReadableStream`. A `stream<u8>` is a readable byte stream
+  of `Uint8Array` chunks, so BYOB readers work, and any other `stream<T>` has one chunk per
+  element. The stream reads from the host only when something reads it, and cancelling it drops
+  it.
+- A `stream<T>` the guest hands over may be a `ReadableStream` or any async or sync iterable, such
+  as an async generator or an array of chunks. A `stream<u8>` takes `ArrayBufferView` and
+  `ArrayBuffer` chunks. A source that errors, or produces a chunk or element that does not match
+  the stream's type, ends the stream early and logs why on stderr. After the host stops reading,
+  the source is cancelled when it produces its next chunk. It is also cancelled when the call's
+  event loop runs out of other work while the source produces nothing more. When the host doesn't
+  read a stream element that is an imported resource, its handle is restored to the guest's
+  wrapper. For one nested in a record, tuple, option or list, the wrapper holds no handle
+  afterwards. A stream
+  the guest received and returns unread is passed to the host unchanged.
+- A `stream` without a payload type has one `undefined` chunk per element in both directions. A
+  chunk the guest hands over that is not `undefined` ends the stream early, as a chunk that does
+  not match a `stream<T>`'s type does.
+- A `future<T>` the guest receives is a `Promise`. Its value is read whether or not the guest uses
+  the promise. A `future<T>` the guest hands over may be a promise or any other value. A promise
+  that never settles does not keep the call running, and its value is still written if it settles
+  later. An `async` import the call started and did not await keeps the call running until the
+  import returns, so if the import's host side waits on such a future, the call never finishes.
+  An `async` export returning a `future<T>` returns it as the promise it produces, so the call
+  completes before the future does.
+- A `future` without a payload type is a `Promise` that fulfills with `undefined`. A promise the
+  guest hands over as one must fulfill with `undefined`. Fulfilling with any other value or
+  rejecting traps.
+
+Streams work with `fetch` in both directions: a received `stream<u8>` can be a request body
+(`fetch(url, { method: "POST", body, duplex: "half" })`), and a response's `body` can be returned
+as a `stream<u8>`. A stream or body that JavaScript hasn't read from is handed over directly, so
+its bytes don't pass through JavaScript. This also applies to a `stream<u8>` passed on as another
+`stream<u8>` type, and to one piped through an identity `TransformStream`.
+
+#### Errors
+
+The `err` arm of a `result` crosses as an error. An import's `err`, or a rejected
+`future<result<T, E>>`, throws or rejects with an instance of `E`'s class when `E` is a named type
+other than a resource, and a `ComponentError` otherwise. `E`'s class is named after the type,
+extends `ComponentError`, and holds the payload as `payload`. It is exported from the module of the
+interface whose function names the type, under the name that interface uses for it
+(`import { ErrorCode } from "wasi:http/types@0.3"`), so a `use`d or renamed type's class is
+exported by the interface that `use`s it. The class of a type the world names is exported from
+`external`. A type that an interface the world only exports `use`s from another interface has that
+interface's class.
+
+An export failing, or a promise the guest hands over as a `future<result<T, E>>` rejecting,
+produces an `err` from:
+
+- a `ComponentError` or an instance of a class extending it: its `payload`,
+- any other `Error`: its `message`, if `E` is a `string`, or an `enum` or `variant` with a
+  payload-less case whose JS (camelCase) name it is,
+- any other value: the value itself.
+
+Anything else traps, as does a rejection where the WIT type has no `err` arm. An `err` arm without
+a payload takes any thrown or rejected value, and logs it to stderr.
+
+### Bundling and build caching
+
+`imports` prints the module specifiers the guest may import for the selected world, one per line:
+each imported interface's WIT name with its canonical version (see
+[The interfaces the runtime imports](#the-interfaces-the-runtime-imports)), and `external` for the
+world's own imports. A module is listed only if the runtime registers it, which it does if the
+module exports a function, a resource class, an error class, or an enum or flags object. A bundler
+has to leave these unresolved. A world exporting `wasi:http/handler` includes the `wasi:http`
+interfaces the runtime's handler uses:
+
+```bash
+starling-componentize -w wit -n app --export-http imports
+```
+
+`--version` (`-V`) prints the componentizer's version and the version of the `init` interface it
+calls, and for the runtime in `$STARLING_RUNTIME`, or else the embedded one, the SHA-256 digest of
+its module and the version of the interface it implements. A build tool can tell from it when a
+rebuild would produce a different component.
+
+### TypeScript declarations for a world
+
+To scaffold (or type-check) the guest module a world expects, generate a TypeScript declaration
+(`.d.ts`) from the WIT:
+
+```bash
+starling-componentize -w <wit-dir> -n <world> types -o world.d.ts
+starling-componentize --export-cli types    # the built-in wasi:cli/run world
+starling-componentize --export-http types   # the built-in serve world
+```
+
+Without `-o`, `types` prints the declarations to stdout. Add the generated file to the TypeScript
+program (a `files` or `include` entry in `tsconfig.json`, or a `/// <reference path=…/>`). It
+has no file-level declarations, which makes each `declare module` in it an ambient module
+declaration the guest can import from:
+
+- `starling:types/<world>`, where `<world>` is the world's qualified name (for example
+  `starling:types/wasi:http/proxy@0.3.0`), declares every WIT type the world uses, a class per
+  resource, and an error class per `err` type that has one. It is named after the world so
+  declarations generated for different worlds can be part of one program. They live in a module
+  rather than at file level so a WIT type named `permissions` or `response` cannot collide with the
+  standard library. A name that several types share is qualified there with the interface's name,
+  then also with the package's (`AThing`, `WasiHttpTypesErrorCode`). An interface the world both
+  imports and exports has two classes per resource there, the host's and the guest's (`Item` and
+  `ExportedItem`).
+- One module per WIT interface the world imports, named by its WIT name with its canonical
+  version, plus `external` for the world-level imports. Each declares the interface's
+  functions and re-exports the types, resource classes and error classes the interface defines or
+  `use`s under their WIT names, so `import { ErrorCode } from 'wasi:filesystem/types@0.3'` is the
+  filesystem one. The runtime registers no module for an interface without functions, resources,
+  error classes, enums or flags, so only the types of such a module are usable.
+- `starling:guest` declares what the guest module exports. Reference it to have the compiler check
+  the guest:
+
+  ```ts
+  import type * as Guest from 'starling:guest';
+  export const greeter: typeof Guest.greeter = { /* … */ };
+  ```
+
+`starling:guest` declares every shape the world allows for each item (see
+[Export names](#export-names)). `types` fails for a world whose exports cannot all be named: a
+world-level function with a package layer's name.
+
+The WIT→TypeScript types match the runtime's own value mapping. Numeric `list`s are typed arrays
+(`list<u8>` is `Uint8Array`, `list<u64>` is `BigUint64Array`), `u64`/`s64` are `bigint`, and a
+record's `option` field is an optional key. `result<T, E>` on a return type is unwrapped to its
+`ok` payload (errors are thrown), while a `result` parameter is the `{ tag, val }` union. `enum` is
+an `enum` numbered from zero, and `flags` an `enum` of its bits plus a `number` alias for a set of
+them. A set crosses as an int32, matching the result of `|`, so the member for bit 31 is
+`1 << 31`. Each is imported from the module that exports its object, so builds that compile files
+one at a time (`isolatedModules`, as esbuild, swc, tsx and Bun do) can use them. A type of an
+interface the world only exports is a `const enum`, whose members `tsc` inlines.
+
+For the two command worlds, `wasi:cli/run` is `export function run(): void | Promise<void>`. For
+`wasi:http/handler`, the guest either registers an `addEventListener('fetch', …)` listener, whose
+`FetchEvent` the file declares, or implements `handle` in one of the shapes
+[HTTP servers](#http-servers) lists. `handle` receives the WIT `request` and returns a `Response`,
+or the WIT `response` resource when the world declares one, or a promise of either. The file
+declares an overload of `fetch` taking the WIT `request` when the world imports
+`wasi:http/types@0.3.x`. `types` takes the interface's declaration from the runtime the
+[command line](#command-line) selects. Without a runtime, the request in the built-in serve world,
+which declares no `wasi:http/types`, is `unknown`.
+
+A resource renders as a class with the constructor, methods and statics its WIT declares. An
+imported resource's class declares `[Symbol.dispose](): void`, has a private member so that no
+other object type-checks as one of its handles, and has a private constructor when the WIT
+declares none. An exported resource's class declares `[Symbol.dispose]` as optional, and is also a
+member of its interface object (`Counter: typeof Counter`), since the runtime looks it up there.
+
+Where the guest receives them, `stream<T>` renders as the DOM library's `ReadableStream<T>`
+(`ReadableStream<Uint8Array>` for `stream<u8>`) and `future<T>` as `Promise<T>`. Where the guest
+hands them over, they render as what it may pass. A `stream` without a payload type renders with
+`undefined` chunks (`ReadableStream<undefined>`), and a `future` without one with `void`
+(`Promise<void>`). The error class of an `err` type extends the global `ComponentError`, which
+the file always declares, and is exported from the module [Errors](#errors) names. That module
+does not re-export the payload type under the class's name. Name it as `ErrorCode['payload']`
+instead.
 
 ---
 
@@ -175,6 +695,9 @@ request whose evaluation fails is answered with a 500.
 StarlingMonkey provides proc macros for exposing Rust code to JavaScript. All
 builtins in the `web-globals` crate are implemented using these macros.
 
+[docs/builtin-development.md](docs/builtin-development.md) describes the practices builtins
+follow, and [docs/rooting.md](docs/rooting.md) describes GC rooting.
+
 ### `#[jsclass]` / `#[jsmethods]`
 
 Expose a Rust struct as a JS constructor with methods, getters, setters, and
@@ -213,10 +736,8 @@ fields are reached through `self.data()` and `self.data_mut()` rather than
 directly. From Rust, the generated constructor allocates a JS object and so
 returns `Result<Counter<'s>, ExnThrown>`.
 
-Note: `self.data()` and `self.data_mut()` should only ever be used ephemerally.
-Otherwise there's a risk of having multiple incompatible borrows, which we
-can't statically guard against. There's a dynamic check, but it results in
-slightly opaque error stacks and is hence hard to debug.
+A borrow from `self.data()` or `self.data_mut()` must not be held across a call into JavaScript
+(see [Borrows and re-entrancy](docs/builtin-development.md#borrows-and-re-entrancy)).
 
 The `#[jsclass]` macro generates two types from the annotated struct, allowing
 the type to be used from JS and Rust while ensuring proper GC rooting:
@@ -224,11 +745,10 @@ the type to be used from JS and Rust while ensuring proper GC rooting:
 | Generated type | Purpose |
 |----------------|---------|
 | `CounterImpl` | Inner data struct implementing `ClassDef` (`#[doc(hidden)]`). |
-| `Counter<'s>` | Stack newtype wrapping `Stack<'s, CounterImpl>` — use within a GC scope. |
+| `Counter<'s>` | Stack newtype wrapping `Stack<'s, CounterImpl>`, for use within a GC scope. |
 
-To store a reference to an instance in a long-lived struct, hold a
-`Heap<CounterImpl>` inside a `#[derive(Traceable)]` struct — see
-[`#[derive(Traceable)]`](#derivetraceable).
+A long-lived reference to an instance is a `Heap<CounterImpl>` in a traced struct (see
+[docs/rooting.md](docs/rooting.md)).
 
 **`#[jsclass]` options:**
 
@@ -237,6 +757,7 @@ To store a reference to an instance in a long-lived struct, hold a
 #[jsclass(extends = Parent)]           // set up a prototype chain
 #[jsclass(js_proto = "Error")]         // inherit from a built-in JS prototype
 #[jsclass(to_string_tag = "MyClass")]  // set Symbol.toStringTag
+#[jsclass(hidden)]                     // register without defining the constructor on the global
 ```
 
 **`#[jsmethods]` attributes:**
@@ -255,11 +776,11 @@ To store a reference to an instance in a long-lived struct, hold a
 | Rust return type | JS behaviour |
 |------------------|-------------|
 | `()` | `undefined` |
-| `T: ToJSValConvertible` | Value returned to JS. |
+| `T: ToJSVal` | Value returned to JS. |
 | `Result<T, E>` where `E: ThrowException` | `Ok` → value; `Err` → typed JS exception. |
 | `Self` (from `#[static_method]` / `#[method]`) | New JS instance of the same class. |
 | `PromiseFuture` | JS `Promise` resolved to the result of a Rust future. |
-| `Ref<'_, T>` where `T: ToJSValConvertible + ?Sized` | Value returned to JS, converted from data the class still owns. |
+| `Ref<'_, T>` where `T: ToJSVal + ?Sized` | Value returned to JS, converted from data the class still owns. |
 
 **Returning borrowed data:**
 
@@ -405,7 +926,7 @@ mod math_utils {
 }
 
 // Register before evaluating any JS that imports it:
-unsafe { math_utils::register(&scope); }
+math_utils::register(&scope);
 ```
 
 Exported functions are renamed to camelCase; constants keep their declared name.
@@ -488,7 +1009,7 @@ Pair it with `#[webidl_methods]` rather than `#[jsmethods]`: it takes the same
 member attributes, but registers methods with WebIDL's property flags (they're
 enumerable, unlike JS builtins').
 
-Same options as `#[jsclass]`: `name`, `extends`, `js_proto`, `to_string_tag`.
+Same options as `#[jsclass]`: `name`, `extends`, `js_proto`, `to_string_tag`, `hidden`.
 
 ### `#[derive(Traceable)]`
 
@@ -504,10 +1025,7 @@ struct AppState {
 }
 ```
 
-Whenever a JS object reference outlives the GC scope it was created in, store
-it as `Heap<MyClassImpl>` (naming the inner data type from `#[jsclass]`) inside
-a `#[derive(Traceable)]` struct. Root it back onto the stack with
-`Heap::get(&scope)`, which hands back the stack newtype (`MyClass<'s>`).
+[docs/rooting.md](docs/rooting.md) describes when and how to store JS references.
 
 ---
 
@@ -612,7 +1130,7 @@ let back: Result<Circle<'s>, _> = shape.cast::<Circle<'_>>(); // narrowing
 
 ## Promise / Async
 
-Return `PromiseFuture` from any method to create a JS `Promise` that resolves 
+Return `PromiseFuture` from any method to create a JS `Promise` that resolves
 to the result of a Rust future:
 
 ```rust
@@ -622,9 +1140,9 @@ use js::promise::PromiseFuture;
 impl Fetcher {
     #[method]
     fn fetch(&self, url: String) -> PromiseFuture {
-        PromiseFuture::new(async move {
+        PromiseFuture::from_value(async move {
             // ... async work ...
-            Ok("response body".to_string())
+            Ok::<_, String>("response body".to_string())
         })
     }
 }
@@ -633,9 +1151,9 @@ impl Fetcher {
 The method returns the `Promise` to JS immediately, and the future is queued on
 the event loop. `ScriptEvaluation::run_to_completion`, which
 `libstarling::run` drives for you, polls it and settles the `Promise` with the
-future's `Ok`/`Err`. Two other constructors cover the cases `new` doesn't:
-`PromiseFuture::new_void` for futures resolving to `()`, and `PromiseFuture::from_value`
-for futures resolving to a value.
+future's `Ok`/`Err`. `PromiseFuture::new_void` takes a future resolving to
+`Result<(), E>`, and `PromiseFuture::new` one resolving to a `PromiseOutcome`, for
+settling that needs the scope.
 
 ---
 
@@ -643,10 +1161,16 @@ for futures resolving to a value.
 
 **Prerequisites:**
 
-- [Rust toolchain](./rust-toolchain.toml)
+- [Rust toolchain](./rust-toolchain.toml), and a beta toolchain for wasm32-wasip3 builds
 - [just](https://github.com/casey/just)
 - [WASI-SDK 34](https://github.com/WebAssembly/wasi-sdk/releases/tag/wasi-sdk-34)
-- [Node.js](https://nodejs.org/), to run the WPT harness
+- [wasmtime](https://github.com/bytecodealliance/wasmtime), to run the wasm tests and the wasm WPT
+  harness
+- [wasm-tools](https://github.com/bytecodealliance/wasm-tools), to build the runtime component
+- [Node.js](https://nodejs.org/), to run the WPT harness, the componentizer's TypeScript test and
+  `just npm-componentize`
+
+[`.github/tool-versions.env`](.github/tool-versions.env) lists the versions CI uses.
 
 Checking, building, and testing is done using a [`justfile`](justfile).
 Commands include:
@@ -657,7 +1181,7 @@ just test              # all Rust tests, use `-p` for specific packages
 just wpt-test          # all Web Platform Tests, optionally filtered by a pattern
 just fmt               # format code
 just clippy            # run clippy
-just check             # fmt-check + clippy + tests
+just check             # fmt-check + clippy + the examples' tests + the componentizer's unit tests
 just check-all         # more extensive tests, including GC checks
 ```
 
@@ -673,8 +1197,8 @@ just test-wasm         # all Rust tests, on wasm32-wasip2
 just check-wasm        # fmt-check + clippy + wasm tests
 ```
 
-`WASM_TARGET` retargets those recipes and the wasm WPT recipes. It accepts `p2`, `p3`, or a
-full triple, and defaults to `p2`:
+`WASM_TARGET` selects the wasm target of the recipes above, the wasm WPT recipes and
+`just test-wizer`, as `p2`, `p3` or a full triple. It defaults to `p2`:
 
 ```bash
 WASM_TARGET=p3 just test-wasm
@@ -682,14 +1206,76 @@ WASM_TARGET=p3 just wpt-test-wasm
 ```
 
 `rust-toolchain.toml` pins a toolchain that ships no wasm32-wasip3 std, so `p3` builds through
-`cargo +nightly`, and `p3` needs wasi-sdk 34, the first with a wasm32-wasip3 sysroot.
+`cargo +beta`, or the toolchain `STARLING_BETA` names, and `p3` needs wasi-sdk 34, the first
+with a wasm32-wasip3 sysroot.
+
+`cargo build` produces the native binary `target/debug/starlingmonkey`. A wasm build produces the
+component `target/wasm32-wasip2/debug/starling.wasm` from the crate's `cdylib` target.
+
+### The runtime component
+
+`just build-runtime` builds the runtime component releases ship,
+`target/wasm32-wasip3/release/starling.wasm`, with SpiderMonkey, libc and libc++ statically linked
+and dead-code eliminated. `just build-runtime-debug` builds it with `debugmozjs`, at
+`target/wasm32-wasip3/debug/starling.wasm`. `RUNTIME_TARGET` selects their target as `WASM_TARGET`
+does, and defaults to `p3`. `RUNTIME_TARGET=p2` builds for wasm32-wasip2 from the stable toolchain
+and an older SDK.
+
+The component runs scripts under `wasmtime run`, serves under `wasmtime serve`, and is the runtime
+`starling-componentize` links against. `just test-runtime` builds the debug component and runs two
+scripts with it under wasmtime: a hello-world that logs before and after a timer, and a top level
+that rejects after a timer, which must fail the run.
+
+Running a script calls no `run` export: the script's top level and the event loop it starts are
+the whole program. A main module's `run` export is called only in an instance pre-initialized with
+Wizer, such as one [componentized as a CLI tool](#cli-tools-wasiclirun) or one wizened directly
+through the runtime's `wizer-initialize` export:
+
+```bash
+wasmtime wizer --keep-init-func=true --dir=. -Scli=y,http=y \
+    --env STARLINGMONKEY_CONFIG=app.js target/wasm32-wasip3/release/starling.wasm -o tool.wasm
+wasmtime run -Shttp=y tool.wasm
+```
+
+A snapshot whose main module registers no `fetch` listener and exports no `run` function is
+refused, since it can neither serve nor run. As when [componentizing](#initialization), the top
+level has to settle and leave no work behind, such as a timer or a `fetch` in flight. A host
+resource the script keeps without pending work, such as the body of a `fetch` response it did not
+read, is not detected. Its handle is not valid in an instance resumed from the snapshot.
+
+### The componentizer
+
+`componentize` is a Cargo workspace of its own, so its recipes run cargo from its directory.
 
-The package builds two targets. `cargo build` produces the native binary
-`target/debug/starlingmonkey`. A wasm build produces the component
-`target/wasm32-wasip2/debug/starling.wasm` from the crate's `cdylib` target. The binary is
-not the wasm entry point, because a binary links `crt1-command.o`, which exports
-`wasi:cli/run` itself and collides with the component's own export on wasm32-wasip3. It is
-still built on wasm targets, where it does nothing.
+`just componentize <args>` builds `starling-componentize` from the checkout and runs it with
+`<args>` in the directory you run it from. It embeds `target/wasm32-wasip3/release/starling.wasm`,
+the runtime `just build-runtime` writes, or no runtime if there is none. `STARLING_EMBED_RUNTIME`
+names another runtime to embed at build time, and the build fails if that file can't be read.
+`just install-componentize` and `just npm-componentize [VERSION]` build the release runtime for
+`RUNTIME_TARGET` and embed it. `npm-componentize` assembles the npm packages for the current
+platform in `target/npm`, and their tarballs in `target/npm/tarballs`.
+`just ts-bindings <wit-path> [<world>]` prints the TypeScript declarations for a world.
+
+```bash
+just test-componentize        # build the debug runtime, run every suite against it
+just test-componentize-only   # run the suites against a prebuilt runtime, without building one
+just test-componentize-only large_byte_stream   # only the tests whose name matches
+just test-componentize-unit   # the componentizer's unit tests, which need no runtime build
+```
+
+The suites componentize JS applications and run them under wasmtime. `test-componentize-only`
+reads the runtime from `STARLING_RUNTIME`, by default the one `just build-runtime-debug` writes.
+It runs several suites at a time, one per 8 GiB of memory by default, and prints a suite's output
+only if it fails. `COMPONENTIZE_JOBS` sets the number of suites, and
+[`scripts/test-componentize.sh`](scripts/test-componentize.sh) describes the other settings.
+The `wit_to_ts` suite type-checks the generated declarations with the TypeScript compiler that
+`npm ci` at the repository root installs, and fails without it.
+
+A change to `starling/wit/init.wit` needs a version of its package that is not
+[compatible](#the-interfaces-the-runtime-imports) with the latest release's, which CI checks with
+`scripts/check-init-wit.sh`. The `release` workflow
+publishes the runtime, the componentizer binaries and the npm packages, and
+[its header](.github/workflows/release.yml) describes each kind of run.
 
 ---
 
@@ -727,7 +1313,7 @@ just wpt-test DOMException # only DOMException tests
 just wpt-update            # run and update expectation files
 ```
 
-use `just wpt-test-wasm` to run under WebAssembly instead of native, and
+Use `just wpt-test-wasm` to run under WebAssembly instead of native, and
 `just wpt-update-wasm` to update wasm-specific expectations.
 
 Tests run concurrently (defaulting to number of CPUs * 2 since many aren't
@@ -759,59 +1345,10 @@ skipping a whole file gives up the subtests that would have passed.
 
 ## GC Rooting Checks
 
-StarlingMonkey's `js` API tries hard to provide everything needed to write code that's
-GC safe, i.e. doesn't run the risk of GC causing use-after-free, etc. The correctness
-of these APIs depends on annotations that are statically checked by a custom linter
-called [crown](./crown), adapted from [Servo's lint of the same name][crown].
-
-`crown` uses annotations that enable tracking of GC references, and enforces that wherever a
-GC reference is held or stored, it's properly rooted. All core types representing GC references
-are annotated with `#[js::must_root]`, which means they must be stored in `Stack`, `Handle`,
-`Heap`, or more advanced types such as `RootedTraceableBox`. Builtins created using one of the 
-macros such as `#[jsclass]` or `#[jsmodule]` are automatically annotated with `#[js::must_root]`.
-
-The analysis can be run using `just check-gc`, and is also part of `just check-all`.
+The `js` crate's GC-safety guarantees rest on annotations that a custom linter,
+[crown](./crown) (adapted from [Servo's lint of the same name][crown]), checks
+statically, and on SpiderMonkey's dynamic GC checks. `just check-gc` runs crown
+and `just gc-zeal` the dynamic checks, and `just check-all` runs both.
+[docs/rooting.md](docs/rooting.md) describes them.
 
 [crown]: https://github.com/servo/servo/tree/main/support/crown
-
-Usually that check should be sufficient when working on anything but the `js` and `core-runtime`
-crates, but to suss out rooting issues not caught by the static analysis, StarlingMonkey also uses
-SpiderMonkey's dynamic GC rooting checks:
-
-```bash
-just gc-zeal                               # quick mode, covering the `js` and `core-runtime` crates
-just gc-zeal full                          # exhaustive checks for the same crates, takes a few minutes
-just gc-zeal full --workspace --examples   # check all the things. Please file a bug if this finds anything!
-```
-
-If the dynamic GC checks find anything outside of the `js` and `core-runtime` crates, that indicates a bug
-in either of those crates. Please file a bug report!
-
----
-
-## Key Design Points
-
-**GC-safe value ownership**
-
-StarlingMonkey provides safe abstractions that ensure GC references are
-properly rooted on both the stack and the heap:
-
-- *Stack* — `Foo<'s>` wrapping `Stack<'s, FooImpl>` with lifetime tied to the GC scope.
-- *Heap* — `Heap<FooImpl>` inside a `Trace`-implementing struct for persistent references.
-
-These make proper rooting the default and much easier to get right. The
-GC rooting linter will additionally catch almost all violations of GC rooting.
-
-**Safe, high-level JS API**
-
-Built on top of `mozjs`, the `js` crate provides a higher-level API designed to
-make use of SpiderMonkey easier and safer.
-
-While there are some cases where lower-level constructs leak through for now,
-the goal is to eventually make `js` a full abstraction layer.
-
-**Proc-macro code generation**
-
-As described above, StarlingMonkey has an extensive suite of proc macros to
-make implementation and use of additional builtins as easy and safe as
-possible.
diff --git a/componentize/.cargo/config.toml b/componentize/.cargo/config.toml
new file mode 100644
index 00000000..3501dfdb
--- /dev/null
+++ b/componentize/.cargo/config.toml
@@ -0,0 +1,5 @@
+# Share the repository's build directory: the suites read the runtime builds from
+# `target/wasm32-wasip3/`, and one directory keeps a single copy of the dependencies both
+# workspaces compile.
+[build]
+target-dir = "../target"
diff --git a/componentize/Cargo.lock b/componentize/Cargo.lock
new file mode 100644
index 00000000..52e6d9db
--- /dev/null
+++ b/componentize/Cargo.lock
@@ -0,0 +1,3100 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+version = 4
+
+[[package]]
+name = "addr2line"
+version = "0.26.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "59317f77929f0e679d39364702289274de2f0f0b22cbf50b2b8cff2169a0b27a"
+dependencies = [
+ "gimli",
+]
+
+[[package]]
+name = "adler2"
+version = "2.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "320119579fcad9c21884f5c4861d16174d0e06250625266f50fe6898340abefa"
+
+[[package]]
+name = "aho-corasick"
+version = "1.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c982642fa9e8606056828ee9a8505737230110bb1099153c79efe865c59d12ba"
+dependencies = [
+ "memchr",
+]
+
+[[package]]
+name = "allocator-api2"
+version = "0.2.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "683d7910e743518b0e34f1186f92494becacb047c7b6bf616c96772180fef923"
+
+[[package]]
+name = "anstream"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "824a212faf96e9acacdbd09febd34438f8f711fb84e09a8916013cd7815ca28d"
+dependencies = [
+ "anstyle",
+ "anstyle-parse",
+ "anstyle-query",
+ "anstyle-wincon",
+ "colorchoice",
+ "is_terminal_polyfill",
+ "utf8parse",
+]
+
+[[package]]
+name = "anstyle"
+version = "1.0.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "940b3a0ca603d1eade50a4846a2afffd5ef57a9feac2c0e2ec2e14f9ead76000"
+
+[[package]]
+name = "anstyle-parse"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "52ce7f38b242319f7cabaa6813055467063ecdc9d355bbb4ce0c68908cd8130e"
+dependencies = [
+ "utf8parse",
+]
+
+[[package]]
+name = "anstyle-query"
+version = "1.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "40c48f72fd53cd289104fc64099abca73db4166ad86ea0b4341abe65af83dadc"
+dependencies = [
+ "windows-sys",
+]
+
+[[package]]
+name = "anstyle-wincon"
+version = "3.0.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "291e6a250ff86cd4a820112fb8898808a366d8f9f58ce16d1f538353ad55747d"
+dependencies = [
+ "anstyle",
+ "once_cell_polyfill",
+ "windows-sys",
+]
+
+[[package]]
+name = "anyhow"
+version = "1.0.104"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "330a5ed07fa54e4702c9d6c4174f74427fc0ef6e214bbd677ae50a5099946470"
+
+[[package]]
+name = "arbitrary"
+version = "1.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c3d036a3c4ab069c7b410a2ce876bd74808d2d0888a82667669f8e783a898bf1"
+
+[[package]]
+name = "async-trait"
+version = "0.1.92"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "82f6aeea286b8eb4dd3431a1be1b59d290ace00f5bfd8e2a159bc2a05e2c1667"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.5",
+]
+
+[[package]]
+name = "atomic-waker"
+version = "1.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1505bd5d3d116872e7271a6d4e16d81d0c8570876c8de68093a09ac269d8aac0"
+
+[[package]]
+name = "auditable-serde"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d026218ae25ba5c72834245412dd1338f6d270d2c5109ee03a4badec288d4056"
+dependencies = [
+ "semver",
+ "serde",
+ "serde_json",
+ "topological-sort",
+]
+
+[[package]]
+name = "autocfg"
+version = "1.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f2032f911046de80f0a198e0901378627c33f59ea0ac00e363d481118bd70a53"
+
+[[package]]
+name = "base64"
+version = "0.22.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "72b3254f16251a8381aa12e40e3c4d2f0199f8c6508fbecb9d91f575e0fbb8c6"
+
+[[package]]
+name = "bit-set"
+version = "0.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "08807e080ed7f9d5433fa9b275196cfc35414f66a0c79d864dc51a0d825231a3"
+dependencies = [
+ "bit-vec",
+]
+
+[[package]]
+name = "bit-vec"
+version = "0.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5e764a1d40d510daf35e07be9eb06e75770908c27d411ee6c92109c9840eaaf7"
+
+[[package]]
+name = "bitflags"
+version = "2.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b588b76d00fde79687d7646a9b5bdf3cc0f655e0bbd080335a95d7e96f3587da"
+
+[[package]]
+name = "block-buffer"
+version = "0.10.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3078c7629b62d3f0439517fa394996acacc5cbc91c5a20d8c658e77abd503a71"
+dependencies = [
+ "generic-array",
+]
+
+[[package]]
+name = "block-buffer"
+version = "0.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d2f6c7dbe95a6ed67ad9f18e57daf93a2f034c524b99fd2b76d18fdfeb6660aa"
+dependencies = [
+ "hybrid-array",
+]
+
+[[package]]
+name = "bumpalo"
+version = "3.20.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "72f5acc6cb2ba439de613abc23857ec3d78374d8ed5ac84e9d11336e87da8649"
+dependencies = [
+ "allocator-api2",
+]
+
+[[package]]
+name = "bytes"
+version = "1.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fc652a48c352aef3ea3aed32080501cf3ef6ed5da78602a020c991775b0aff04"
+
+[[package]]
+name = "cc"
+version = "1.4.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "005ec2760ca554fae18df7a11195552ec576cd665632a881bc011d5bb2fd4d80"
+dependencies = [
+ "find-msvc-tools",
+ "jobserver",
+ "libc",
+ "shlex",
+]
+
+[[package]]
+name = "cfg-if"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9330f8b2ff13f34540b44e946ef35111825727b38d33286ef986142615121801"
+
+[[package]]
+name = "chacha20"
+version = "0.10.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "65c35e4b699c7e15ccbe7ee35c005e4fc0a278d22238a2857e6ce2dadeda1b06"
+dependencies = [
+ "cfg-if",
+ "cpufeatures 0.3.1",
+ "rand_core 0.10.1",
+]
+
+[[package]]
+name = "clap"
+version = "4.6.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "473c7e07f409a8d772161724aa8db6a765a2532a70f9667eeb7b49d3d02fbdca"
+dependencies = [
+ "clap_builder",
+ "clap_derive",
+]
+
+[[package]]
+name = "clap_builder"
+version = "4.6.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7b48fea5a88e9ae728a2dcbedbfc0e730f7d60da42e1cb049a83c9fb8b789889"
+dependencies = [
+ "anstream",
+ "anstyle",
+ "clap_lex",
+ "strsim",
+]
+
+[[package]]
+name = "clap_derive"
+version = "4.6.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d012d2b9d65aca7f18f4d9878a045bc17899bba951561ba5ec3c2ba1eed9a061"
+dependencies = [
+ "heck",
+ "proc-macro2",
+ "quote",
+ "syn 3.0.5",
+]
+
+[[package]]
+name = "clap_lex"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c8d4a3bb8b1e0c1050499d1815f5ab16d04f0959b233085fb31653fbfc9d98f9"
+
+[[package]]
+name = "cobs"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0fa961b519f0b462e3a3b4a34b64d119eeaca1d59af726fe450bbba07a9fc0a1"
+dependencies = [
+ "thiserror 2.0.20",
+]
+
+[[package]]
+name = "colorchoice"
+version = "1.0.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1d07550c9036bf2ae0c684c4297d503f838287c83c53686d05370d0e139ae570"
+
+[[package]]
+name = "componentize"
+version = "0.3.0"
+dependencies = [
+ "anyhow",
+ "bytes",
+ "clap",
+ "futures",
+ "hex",
+ "http",
+ "http-body",
+ "http-body-util",
+ "indexmap",
+ "mimalloc",
+ "preserve-component-type",
+ "proptest",
+ "sha2 0.11.1",
+ "tokio",
+ "url",
+ "wac-graph",
+ "wasm-encoder 0.262.0",
+ "wasmparser 0.262.0",
+ "wasmtime",
+ "wasmtime-wasi",
+ "wasmtime-wasi-http",
+ "wasmtime-wizer",
+ "wit-component 0.262.0",
+ "wit-dylib",
+ "wit-name-mapping",
+ "wit-parser 0.262.0",
+]
+
+[[package]]
+name = "const-oid"
+version = "0.10.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a6ef517f0926dd24a1582492c791b6a4818a4d94e789a334894aa15b0d12f55c"
+
+[[package]]
+name = "core_detect"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7f8f80099a98041a3d1622845c271458a2d73e688351bf3cb999266764b81d48"
+
+[[package]]
+name = "cpp_demangle"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0667304c32ea56cb4cd6d2d7c0cfe9a2f8041229db8c033af7f8d69492429def"
+dependencies = [
+ "cfg-if",
+]
+
+[[package]]
+name = "cpufeatures"
+version = "0.2.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "59ed5838eebb26a2bb2e58f6d5b5316989ae9d08bab10e0e6d103e656d1b0280"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "cpufeatures"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5ca28b0ae3115b884660db4118d803791fd6756b6e88f39c0f3f7859060d7566"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "cranelift-assembler-x64"
+version = "0.137.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d3307701abcb90554ee72fdb0db36ee0334a4abe380c4d87a5b04a6942613c3a"
+dependencies = [
+ "cranelift-assembler-x64-meta",
+]
+
+[[package]]
+name = "cranelift-assembler-x64-meta"
+version = "0.137.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e62d0e19f9f5fa0c4243236df1ffdf139d207600b4402ac41ceba8dbe7ca0f3d"
+dependencies = [
+ "cranelift-srcgen",
+]
+
+[[package]]
+name = "cranelift-bforest"
+version = "0.137.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "47784bc3c4b57c0182bb8ff04aae5d5f5fc6bae8ba26b1212c9a659b90dab84e"
+dependencies = [
+ "cranelift-entity",
+ "wasmtime-internal-core",
+]
+
+[[package]]
+name = "cranelift-bitset"
+version = "0.137.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e13d120406f713dbce1940751e77bbb14daad1261379b7200c19285953e79a1d"
+dependencies = [
+ "serde",
+ "serde_derive",
+ "wasmtime-internal-core",
+]
+
+[[package]]
+name = "cranelift-codegen"
+version = "0.137.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a53dbec33ff86909e44be6f0ec2d17841aa38b931013707c9fc7279f1f0e5760"
+dependencies = [
+ "bumpalo",
+ "cranelift-assembler-x64",
+ "cranelift-bforest",
+ "cranelift-bitset",
+ "cranelift-codegen-meta",
+ "cranelift-codegen-shared",
+ "cranelift-control",
+ "cranelift-entity",
+ "cranelift-isle",
+ "gimli",
+ "hashbrown 0.17.1",
+ "libm",
+ "log",
+ "postcard",
+ "pulley-interpreter",
+ "regalloc2",
+ "rustc-hash",
+ "serde",
+ "serde_derive",
+ "sha2 0.10.9",
+ "smallvec",
+ "target-lexicon",
+ "wasmtime-internal-core",
+]
+
+[[package]]
+name = "cranelift-codegen-meta"
+version = "0.137.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "42295b38e9182954cb32a71812e3d64d66a90efc0a2ababb73e465ad4a1efccf"
+dependencies = [
+ "cranelift-assembler-x64-meta",
+ "cranelift-codegen-shared",
+ "cranelift-srcgen",
+ "heck",
+ "pulley-interpreter",
+]
+
+[[package]]
+name = "cranelift-codegen-shared"
+version = "0.137.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b5200fa877fb64cd30cabe0603f394333f88f69adf63e4db8d48a111d0c9d0dd"
+
+[[package]]
+name = "cranelift-control"
+version = "0.137.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b86250e480795fbb4425ea703bca7b75282998458ce74f5360843a31949f2bbc"
+dependencies = [
+ "arbitrary",
+]
+
+[[package]]
+name = "cranelift-entity"
+version = "0.137.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "903c6592c7d600c251d20929f143543b7303ac70b072ad3394d65b29caf56f69"
+dependencies = [
+ "cranelift-bitset",
+ "serde",
+ "serde_derive",
+ "wasmtime-internal-core",
+]
+
+[[package]]
+name = "cranelift-frontend"
+version = "0.137.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b929f09b82a270e2aae062945cf86cd9db39c59ad9bead6986ea6b09fcf8a969"
+dependencies = [
+ "cranelift-codegen",
+ "hashbrown 0.17.1",
+ "log",
+ "smallvec",
+ "target-lexicon",
+]
+
+[[package]]
+name = "cranelift-isle"
+version = "0.137.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b1c5809e8636a37e5a25ecc35242d33d6e7391c49b67488b83446e2898af2a2f"
+
+[[package]]
+name = "cranelift-native"
+version = "0.137.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "815c559daf605a5b4ea35530604643c1e87504353c0d1a14763f9c2b9d518493"
+dependencies = [
+ "cranelift-codegen",
+ "libc",
+ "mach2",
+ "target-lexicon",
+]
+
+[[package]]
+name = "cranelift-srcgen"
+version = "0.137.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d633ff621e7f31a943431da0d7dd37c4376766c60bd7171216de1c7ccabfb370"
+
+[[package]]
+name = "crc32fast"
+version = "1.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8498c871161e1742aaa9d52551b2d6ebdd4c3d45a3be423e3728f33b955be550"
+dependencies = [
+ "cfg-if",
+]
+
+[[package]]
+name = "crossbeam-deque"
+version = "0.8.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "622f3fc73690be383c7214310406f28a90e6edeadc3cea882f9d71e495b9711a"
+dependencies = [
+ "crossbeam-epoch",
+ "crossbeam-utils",
+]
+
+[[package]]
+name = "crossbeam-epoch"
+version = "0.9.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dc74980687109a3b14c72fd458107bf0baa1da1a1a805e178d15501ba9b86d9d"
+dependencies = [
+ "crossbeam-utils",
+]
+
+[[package]]
+name = "crossbeam-utils"
+version = "0.8.23"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a31eee39dddec8330830986fcd7625edb5a24ec90ea038215273bbc3adb08ac6"
+
+[[package]]
+name = "crypto-common"
+version = "0.1.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "78c8292055d1c1df0cce5d180393dc8cce0abec0a7102adb6c7b1eef6016d60a"
+dependencies = [
+ "generic-array",
+ "typenum",
+]
+
+[[package]]
+name = "crypto-common"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ce6e4c961d6cd6c9a86db418387425e8bdeaf05b3c8bc1411e6dca4c252f1453"
+dependencies = [
+ "hybrid-array",
+]
+
+[[package]]
+name = "debugid"
+version = "0.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bef552e6f588e446098f6ba40d89ac146c8c7b64aade83c051ee00bb5d2bc18d"
+dependencies = [
+ "uuid",
+]
+
+[[package]]
+name = "digest"
+version = "0.10.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9ed9a281f7bc9b7576e61468ba615a66a5c8cfdff42420a70aa82701a3b1e292"
+dependencies = [
+ "block-buffer 0.10.4",
+ "crypto-common 0.1.7",
+]
+
+[[package]]
+name = "digest"
+version = "0.11.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f1dd6dbb5841937940781866fa1281a1ff7bd3bf827091440879f9994983d5c2"
+dependencies = [
+ "block-buffer 0.12.1",
+ "const-oid",
+ "crypto-common 0.2.2",
+]
+
+[[package]]
+name = "directories-next"
+version = "2.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "339ee130d97a610ea5a5872d2bbb130fdf68884ff09d3028b81bec8a1ac23bbc"
+dependencies = [
+ "cfg-if",
+ "dirs-sys-next",
+]
+
+[[package]]
+name = "dirs-sys-next"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4ebda144c4fe02d1f7ea1a7d9641b6fc6b580adcfa024ae48797ecdeb6825b4d"
+dependencies = [
+ "libc",
+ "redox_users",
+ "winapi",
+]
+
+[[package]]
+name = "displaydoc"
+version = "0.2.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c6232dd377dcc64799954cbd3a9bb882e9cdc1308ccd87b1c098f1fb2eaf82a8"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.5",
+]
+
+[[package]]
+name = "either"
+version = "1.18.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "252afb9ae5eaa683babdc6a068b3f5726eb19e05070c731f9b2a23a7c3e8ed34"
+
+[[package]]
+name = "embedded-io"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ef1a6892d9eef45c8fa6b9e0086428a2cca8491aca8f787c534a3d6d0bcb3ced"
+
+[[package]]
+name = "embedded-io"
+version = "0.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "edd0f118536f44f5ccd48bcb8b111bdc3de888b58c74639dfb034a357d0f206d"
+
+[[package]]
+name = "encoding_rs"
+version = "0.8.40"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2a7a45518d2863d18aa47f4a0cf9faec2aa4304cc09df5e41299f276b3ad135e"
+dependencies = [
+ "cfg-if",
+ "core_detect",
+ "multiversion",
+ "multiversion_no_op",
+ "rustversion",
+ "scopeguard",
+ "simdutf8",
+]
+
+[[package]]
+name = "equivalent"
+version = "1.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "877a4ace8713b0bcf2a4e7eec82529c029f1d0619886d18145fea96c3ffe5c0f"
+
+[[package]]
+name = "errno"
+version = "0.3.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb"
+dependencies = [
+ "libc",
+ "windows-sys",
+]
+
+[[package]]
+name = "fastrand"
+version = "2.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "da7c62ceae207dd37ea5b845da6a0696c799f85e97da1ab5b7910be3c1c80223"
+
+[[package]]
+name = "find-msvc-tools"
+version = "0.1.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3e0f1c7c3a72c66fd80abe965175f7523475c0489a87d3ff9d6e8c87d87a9d2d"
+
+[[package]]
+name = "fixedbitset"
+version = "0.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0ce7134b9999ecaf8bcd65542e436736ef32ddca1b3e06094cb6ec5755203b80"
+
+[[package]]
+name = "flate2"
+version = "1.1.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6e634e2e0ebac1ee034020da1ca582e17ffe4e0f5e985823721e168928136dcb"
+dependencies = [
+ "crc32fast",
+ "miniz_oxide",
+ "zlib-rs",
+]
+
+[[package]]
+name = "fnv"
+version = "1.0.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3f9eec918d3f24069decb9af1554cad7c880e2da24a9afd88aca000531ab82c1"
+
+[[package]]
+name = "foldhash"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "77ce24cb58228fbb8aa041425bb1050850ac19177686ea6e0f41a70416f56fdb"
+
+[[package]]
+name = "form_urlencoded"
+version = "1.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cb4cb245038516f5f85277875cdaa4f7d2c9a0fa0468de06ed190163b1581fcf"
+dependencies = [
+ "percent-encoding",
+]
+
+[[package]]
+name = "futures"
+version = "0.3.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9a31d2a3fbaaeb2af2368bbdd904aa8e812d3c04a1ee10d3171f52d556e5d0a3"
+dependencies = [
+ "futures-channel",
+ "futures-core",
+ "futures-executor",
+ "futures-io",
+ "futures-sink",
+ "futures-task",
+ "futures-util",
+]
+
+[[package]]
+name = "futures-channel"
+version = "0.3.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b1f9e3d69d39e4862ffed03ed071a76f9a13ba1d9109d355b0f0aa6b15e393c4"
+dependencies = [
+ "futures-core",
+ "futures-sink",
+]
+
+[[package]]
+name = "futures-core"
+version = "0.3.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "92d699e522242e69e3003b94ecc1f960f3a5e015aa7c5d7486e65ad01dd94f5e"
+
+[[package]]
+name = "futures-executor"
+version = "0.3.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "031b47cf1a3c6cc8bc2fc76cd437f521619387907d469316e7c0bc278f1f5432"
+dependencies = [
+ "futures-core",
+ "futures-task",
+ "futures-util",
+]
+
+[[package]]
+name = "futures-io"
+version = "0.3.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "53c0fa8157de1303bfffdaa1cc2a673bfffb60102f76b0ef4441659124373fed"
+
+[[package]]
+name = "futures-macro"
+version = "0.3.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9fb9654ba8355388abeb8dcb4fc62f511300867002afc858860463bdd9fe0c44"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.5",
+]
+
+[[package]]
+name = "futures-sink"
+version = "0.3.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1944426bf7d03f1d14f708785e4b33efd750b36d48a157b836b3efc15ede8e1d"
+
+[[package]]
+name = "futures-task"
+version = "0.3.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cd417de3d1d015fc3bfd2b1ea46dfc7bab72ef86f1cc7cc9c78e728b34a6d1fd"
+
+[[package]]
+name = "futures-util"
+version = "0.3.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0d50a92467f8ba5dd6e3ee5d4bd04d73ab2e4e1c44474a0674821dfce14b79bc"
+dependencies = [
+ "futures-channel",
+ "futures-core",
+ "futures-io",
+ "futures-macro",
+ "futures-sink",
+ "futures-task",
+ "memchr",
+ "pin-project-lite",
+ "slab",
+]
+
+[[package]]
+name = "fxprof-processed-profile"
+version = "0.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "25234f20a3ec0a962a61770cfe39ecf03cb529a6e474ad8cff025ed497eda557"
+dependencies = [
+ "bitflags",
+ "debugid",
+ "rustc-hash",
+ "serde",
+ "serde_derive",
+ "serde_json",
+]
+
+[[package]]
+name = "generic-array"
+version = "0.14.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "85649ca51fd72272d7821adaf274ad91c288277713d9c18820d8499a7ff69e9a"
+dependencies = [
+ "typenum",
+ "version_check",
+]
+
+[[package]]
+name = "getrandom"
+version = "0.2.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ff2abc00be7fca6ebc474524697ae276ad847ad0a6b3faa4bcb027e9a4614ad0"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "wasi",
+]
+
+[[package]]
+name = "getrandom"
+version = "0.3.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "899def5c37c4fd7b2664648c28120ecec138e4d395b459e5ca34f9cce2dd77fd"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "r-efi 5.3.0",
+ "wasip2",
+]
+
+[[package]]
+name = "getrandom"
+version = "0.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "300e883d756b2e4ec94e02791f39b04b522276138852cfc41d9fb7e904106099"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "r-efi 6.0.0",
+ "rand_core 0.10.1",
+]
+
+[[package]]
+name = "gimli"
+version = "0.33.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0bf7f043f89559805f8c7cacc432749b2fa0d0a0a9ee46ce47164ed5ba7f126c"
+dependencies = [
+ "fnv",
+ "hashbrown 0.16.1",
+ "indexmap",
+ "stable_deref_trait",
+]
+
+[[package]]
+name = "h2"
+version = "0.4.19"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ef8e5e5a340588f4452631496976cf8636d4a7ecf600239fdc27615d2530bc16"
+dependencies = [
+ "atomic-waker",
+ "bytes",
+ "fnv",
+ "futures-core",
+ "futures-sink",
+ "http",
+ "indexmap",
+ "slab",
+ "tokio",
+ "tokio-util",
+ "tracing",
+]
+
+[[package]]
+name = "hashbrown"
+version = "0.16.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "841d1cc9bed7f9236f321df977030373f4a4163ae1a7dbfe1a51a2c1a51d9100"
+
+[[package]]
+name = "hashbrown"
+version = "0.17.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ed5909b6e89a2db4456e54cd5f673791d7eca6732202bbf2a9cc504fe2f9b84a"
+dependencies = [
+ "foldhash",
+ "serde",
+ "serde_core",
+]
+
+[[package]]
+name = "heck"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2304e00983f87ffb38b55b444b5e3b60a884b5d30c0fca7d82fe33449bbe55ea"
+
+[[package]]
+name = "hex"
+version = "0.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7f24254aa9a54b5c858eaee2f5bccdb46aaf0e486a595ed5fd8f86ba55232a70"
+
+[[package]]
+name = "http"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "918d3568bebf352712bc2ef3d46a8bcf1a75b373be6539de198e9105cbbf9ce0"
+dependencies = [
+ "bytes",
+ "itoa",
+]
+
+[[package]]
+name = "http-body"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ca2a8f2913ee65f60facd6a5905613afaa448497a0230cc41ce022d93290bc2c"
+dependencies = [
+ "bytes",
+ "http",
+]
+
+[[package]]
+name = "http-body-util"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "23169fe34a5fbcdd3f3862e78fb9b6fccd5f02a6dc6f732547005d45631ce71c"
+dependencies = [
+ "bytes",
+ "futures-core",
+ "http",
+ "http-body",
+ "pin-project-lite",
+]
+
+[[package]]
+name = "httparse"
+version = "1.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6dbf3de79e51f3d586ab4cb9d5c3e2c14aa28ed23d180cf89b4df0454a69cc87"
+
+[[package]]
+name = "httpdate"
+version = "1.0.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "df3b46402a9d5adb4c86a0cf463f42e19994e3ee891101b1841f30a545cb49a9"
+
+[[package]]
+name = "hybrid-array"
+version = "0.4.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "27f864f10dfb56725ce5ce5472bc52252c8f93a4ab86327122cebf62c5f59a17"
+dependencies = [
+ "typenum",
+]
+
+[[package]]
+name = "hyper"
+version = "1.11.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "27b501faa50e7a26c3d3560ca625132f4078a17771f4810baf70475ae48cbe43"
+dependencies = [
+ "atomic-waker",
+ "bytes",
+ "futures-channel",
+ "futures-core",
+ "h2",
+ "http",
+ "http-body",
+ "httparse",
+ "httpdate",
+ "itoa",
+ "pin-project-lite",
+ "smallvec",
+ "tokio",
+ "want",
+]
+
+[[package]]
+name = "icu_collections"
+version = "2.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4c6b649701667bbe825c3b7e6388cb521c23d88644678e83c0c4d0a621a34b43"
+dependencies = [
+ "displaydoc",
+ "potential_utf",
+ "yoke",
+ "zerofrom",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_locale_core"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d56e28588da92eee5c3201a6eff33fabdd49b62269c8938d4ff050ce4d900deb"
+dependencies = [
+ "displaydoc",
+ "litemap",
+ "tinystr",
+ "writeable",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_normalizer"
+version = "2.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5f6c8828b67bf8908d82127b2054ea1b4427ff0230ee9141c54251934ab1b599"
+dependencies = [
+ "icu_collections",
+ "icu_normalizer_data",
+ "icu_properties",
+ "icu_provider",
+ "smallvec",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_normalizer_data"
+version = "2.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7aedcccd01fc5fe81e6b489c15b247b8b0690feb23304303a9e560f37efc560a"
+
+[[package]]
+name = "icu_properties"
+version = "2.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "020bfc02fe870ec3a66d93e677ccca0562506e5872c650f893269e08615d74ec"
+dependencies = [
+ "icu_collections",
+ "icu_locale_core",
+ "icu_properties_data",
+ "icu_provider",
+ "zerotrie",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_properties_data"
+version = "2.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "616c294cf8d725c6afcd8f55abc17c56464ef6211f9ed59cccffe534129c77af"
+
+[[package]]
+name = "icu_provider"
+version = "2.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d27bbb9d3abbefac45d55f647c9de1d44aafcd1186eb91879afef17c396c3e73"
+dependencies = [
+ "displaydoc",
+ "icu_locale_core",
+ "writeable",
+ "yoke",
+ "zerofrom",
+ "zerotrie",
+ "zerovec",
+]
+
+[[package]]
+name = "id-arena"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3d3067d79b975e8844ca9eb072e16b31c3c1c36928edf9c6789548c524d0d954"
+
+[[package]]
+name = "idna"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3b0875f23caa03898994f6ddc501886a45c7d3d62d04d2d90788d47be1b1e4de"
+dependencies = [
+ "idna_adapter",
+ "smallvec",
+ "utf8_iter",
+]
+
+[[package]]
+name = "idna_adapter"
+version = "1.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3acae9609540aa318d1bc588455225fb2085b9ed0c4f6bd0d9d5bcd86f1a0344"
+dependencies = [
+ "icu_normalizer",
+ "icu_properties",
+]
+
+[[package]]
+name = "indexmap"
+version = "2.14.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cc4e190f5d26ca7051642629da2c52fc03bde85a03197c99408dcd291734c855"
+dependencies = [
+ "equivalent",
+ "hashbrown 0.17.1",
+ "serde",
+ "serde_core",
+]
+
+[[package]]
+name = "is_terminal_polyfill"
+version = "1.70.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a6cb138bb79a146c1bd460005623e142ef0181e3d0219cb493e02f7d08a35695"
+
+[[package]]
+name = "itertools"
+version = "0.14.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2b192c782037fadd9cfa75548310488aabdbf3d2da73885b31bd0abd03351285"
+dependencies = [
+ "either",
+]
+
+[[package]]
+name = "itoa"
+version = "1.0.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8f42a60cbdf9a97f5d2305f08a87dc4e09308d1276d28c869c684d7777685682"
+
+[[package]]
+name = "ittapi"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6b996fe614c41395cdaedf3cf408a9534851090959d90d54a535f675550b64b1"
+dependencies = [
+ "anyhow",
+ "ittapi-sys",
+ "log",
+]
+
+[[package]]
+name = "ittapi-sys"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "52f5385394064fa2c886205dba02598013ce83d3e92d33dbdc0c52fe0e7bf4fc"
+dependencies = [
+ "cc",
+]
+
+[[package]]
+name = "jobserver"
+version = "0.1.35"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1c00acbd29eabad4a2392fa0e921c874934dbbf4194312ad20f04a0ed67a3cb3"
+dependencies = [
+ "getrandom 0.4.3",
+ "libc",
+]
+
+[[package]]
+name = "js-sys"
+version = "0.3.105"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ce57d20d1ea864ce2ac172ab472d409214f4fd359f0b2a2775abdf522e2af99e"
+dependencies = [
+ "cfg-if",
+ "futures-util",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "leb128"
+version = "0.2.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c83bff1d572d6b9aeef67ddfc8448e4a3737909cb28e81f97c791b9018703e52"
+
+[[package]]
+name = "leb128fmt"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "09edd9e8b54e49e587e4f6295a7d29c3ea94d469cb40ab8ca70b288248a81db2"
+
+[[package]]
+name = "libc"
+version = "0.2.189"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3eaf3ede3fee6db1a4c2ee091bf8a8b4dccdc6d17f656fb07896ee72867612f2"
+
+[[package]]
+name = "libm"
+version = "0.2.16"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6d2cec3eae94f9f509c767b45932f1ada8350c4bdb85af2fcab4a3c14807981"
+
+[[package]]
+name = "libmimalloc-sys"
+version = "0.1.49"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6a45a52f43e1c16f667ccfe4dd8c85b7f7c204fd5e3bf46c5b0db9a5c3c0b8e9"
+dependencies = [
+ "cc",
+]
+
+[[package]]
+name = "libredox"
+version = "0.1.24"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6480ccc157a1389bb2e4891b24751b0f798ba640d22386f23143fbcc89da195a"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "linux-raw-sys"
+version = "0.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "32a66949e030da00e8c7d4434b251670a91556f4144941d37452769c25d58a53"
+
+[[package]]
+name = "litemap"
+version = "0.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "47d9d19d1d6efa0109d2f65ff4c85cddd50bd572e5a00127ab10987290bcefae"
+
+[[package]]
+name = "log"
+version = "0.4.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f9f8bd3e56ce4dfc153cf470fffbfa98c7620958b312ca5c3a4b8d5181fd13c6"
+
+[[package]]
+name = "logos"
+version = "0.16.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "eb2c55a318a87600ea870ff8c2012148b44bf18b74fad48d0f835c38c7d07c5f"
+dependencies = [
+ "logos-derive",
+]
+
+[[package]]
+name = "logos-codegen"
+version = "0.16.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "58b3ffaa284e1350d017a57d04ada118c4583cf260c8fb01e0fe28a2e9cf8970"
+dependencies = [
+ "fnv",
+ "proc-macro2",
+ "quote",
+ "regex-automata",
+ "regex-syntax",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "logos-derive"
+version = "0.16.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "52d3a9855747c17eaf4383823f135220716ab49bea5fbea7dd42cc9a92f8aa31"
+dependencies = [
+ "logos-codegen",
+]
+
+[[package]]
+name = "mach2"
+version = "0.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dae608c151f68243f2b000364e1f7b186d9c29845f7d2d85bd31b9ad77ad552b"
+
+[[package]]
+name = "memchr"
+version = "2.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cf8baf1c55e62ffcace7a9f06f4bd9cd3f0c4beb022d3b367256b91b87513d98"
+
+[[package]]
+name = "memfd"
+version = "0.6.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "57804b2c9b69967f1536a56f86297e367a33b19e98852ed624b84551cdbc0d90"
+dependencies = [
+ "rustix",
+]
+
+[[package]]
+name = "mimalloc"
+version = "0.1.52"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2d4139bb28d14ad1facf21d5eb8825051b326e172d216b39f6d31df53cc97862"
+dependencies = [
+ "libmimalloc-sys",
+]
+
+[[package]]
+name = "miniz_oxide"
+version = "0.9.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b63fbc4a50860e98e7b2aa7804ded1db5cbc3aff9193adaff57a6931bf7c4b4c"
+dependencies = [
+ "adler2",
+ "simd-adler32",
+]
+
+[[package]]
+name = "mio"
+version = "1.2.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4b18443e9c262bfe8fa82f51666e2642c53393f7e5c27b3e1aeab922cff5b9d8"
+dependencies = [
+ "libc",
+ "wasi",
+ "windows-sys",
+]
+
+[[package]]
+name = "multiversion"
+version = "0.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7edb7f0ff51249dfda9ab96b5823695e15a052dc15074c9dbf3d118afaf2c201"
+dependencies = [
+ "multiversion-macros",
+ "target-features",
+]
+
+[[package]]
+name = "multiversion-macros"
+version = "0.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b093064383341eb3271f42e381cb8f10a01459478446953953c75d24bd339fc0"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+ "target-features",
+]
+
+[[package]]
+name = "multiversion_no_op"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "743fb55ba31b18fb1ecef6bdc9aa2743314978ac084044301a7eee33fb99a20d"
+
+[[package]]
+name = "num-traits"
+version = "0.2.19"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "071dfc062690e90b734c0b2273ce72ad0ffa95f0c74596bc250dcfd960262841"
+dependencies = [
+ "autocfg",
+]
+
+[[package]]
+name = "object"
+version = "0.40.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dd229a0361b9d0d4396176e02d65897f487eebeab7caa6d443855ee152ca0b9c"
+dependencies = [
+ "crc32fast",
+ "hashbrown 0.17.1",
+ "indexmap",
+ "memchr",
+]
+
+[[package]]
+name = "once_cell"
+version = "1.21.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9f7c3e4beb33f85d45ae3e3a1792185706c8e16d043238c593331cc7cd313b50"
+
+[[package]]
+name = "once_cell_polyfill"
+version = "1.70.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "384b8ab6d37215f3c5301a95a4accb5d64aa607f1fcb26a11b5303878451b4fe"
+
+[[package]]
+name = "percent-encoding"
+version = "2.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9b4f627cb1b25917193a259e49bdad08f671f8d9708acfd5fe0a8c1455d87220"
+
+[[package]]
+name = "petgraph"
+version = "0.6.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b4c5cc86750666a3ed20bdaf5ca2a0344f9c67674cae0515bec2da16fbaa47db"
+dependencies = [
+ "fixedbitset",
+ "indexmap",
+]
+
+[[package]]
+name = "pin-project-lite"
+version = "0.2.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a89322df9ebe1c1578d689c92318e070967d1042b512afbe49518723f4e6d5cd"
+
+[[package]]
+name = "pkg-config"
+version = "0.3.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f6b464fbc74e149a392436b17d523f769e057cb6877f6a5c4618bc6f11800548"
+
+[[package]]
+name = "postcard"
+version = "1.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6764c3b5dd454e283a30e6dfe78e9b31096d9e32036b5d1eaac7a6119ccb9a24"
+dependencies = [
+ "cobs",
+ "embedded-io 0.4.0",
+ "embedded-io 0.6.1",
+ "serde",
+]
+
+[[package]]
+name = "potential_utf"
+version = "0.1.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d83eb9bc6d8e5cf568e7a1101d60ee05e81ed50ea106026f3d18deeb046d7661"
+dependencies = [
+ "zerovec",
+]
+
+[[package]]
+name = "ppv-lite86"
+version = "0.2.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "85eae3c4ed2f50dcfe72643da4befc30deadb458a9b590d720cde2f2b1e97da9"
+dependencies = [
+ "zerocopy",
+]
+
+[[package]]
+name = "preserve-component-type"
+version = "0.3.0"
+dependencies = [
+ "anyhow",
+ "wasm-encoder 0.262.0",
+ "wasmparser 0.262.0",
+]
+
+[[package]]
+name = "proc-macro2"
+version = "1.0.107"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "985e7ec9bb745e6ce6535b544d84d6cd6f7ad8bd711c398938ae983b91a766d9"
+dependencies = [
+ "unicode-ident",
+]
+
+[[package]]
+name = "proptest"
+version = "1.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4b45fcc2344c680f5025fe57779faef368840d0bd1f42f216291f0dc4ace4744"
+dependencies = [
+ "bit-set",
+ "bit-vec",
+ "bitflags",
+ "num-traits",
+ "rand 0.9.5",
+ "rand_chacha",
+ "rand_xorshift",
+ "regex-syntax",
+ "rusty-fork",
+ "tempfile",
+ "unarray",
+]
+
+[[package]]
+name = "pulley-interpreter"
+version = "50.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6af498fa3ca312fe5a07178757781059b75a331f24d53aeb3706e51ad73317bd"
+dependencies = [
+ "cranelift-bitset",
+ "log",
+ "pulley-macros",
+ "wasmtime-internal-core",
+]
+
+[[package]]
+name = "pulley-macros"
+version = "50.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f0ba9959a3a286b7a2fb16466b7d1a804a117f81a98b7ac6d86cabd5ba037f3d"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.5",
+]
+
+[[package]]
+name = "quick-error"
+version = "1.2.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a1d01941d82fa2ab50be1e79e6714289dd7cde78eba4c074bc5a4374f650dfe0"
+
+[[package]]
+name = "quote"
+version = "1.0.47"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1fbf4db142a473a8d80c26bbf18454ed458bf8d26c8219c331daecfdbd079001"
+dependencies = [
+ "proc-macro2",
+]
+
+[[package]]
+name = "r-efi"
+version = "5.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "69cdb34c158ceb288df11e18b4bd39de994f6657d83847bdffdbd7f346754b0f"
+
+[[package]]
+name = "r-efi"
+version = "6.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f8dcc9c7d52a811697d2151c701e0d08956f92b0e24136cf4cf27b57a6a0d9bf"
+
+[[package]]
+name = "rand"
+version = "0.9.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b9ef1d0d795eb7d84685bca4f72f3649f064e6641543d3a8c415898726a57b41"
+dependencies = [
+ "rand_chacha",
+ "rand_core 0.9.5",
+]
+
+[[package]]
+name = "rand"
+version = "0.10.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c7f5fa3a058cd35567ef9bfa5e75732bee0f9e4c55fa90477bef2dfcdbc4be80"
+dependencies = [
+ "chacha20",
+ "getrandom 0.4.3",
+ "rand_core 0.10.1",
+]
+
+[[package]]
+name = "rand_chacha"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d3022b5f1df60f26e1ffddd6c66e8aa15de382ae63b3a0c1bfc0e4d3e3f325cb"
+dependencies = [
+ "ppv-lite86",
+ "rand_core 0.9.5",
+]
+
+[[package]]
+name = "rand_core"
+version = "0.9.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "76afc826de14238e6e8c374ddcc1fa19e374fd8dd986b0d2af0d02377261d83c"
+dependencies = [
+ "getrandom 0.3.4",
+]
+
+[[package]]
+name = "rand_core"
+version = "0.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "63b8176103e19a2643978565ca18b50549f6101881c443590420e4dc998a3c69"
+
+[[package]]
+name = "rand_xorshift"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "513962919efc330f829edb2535844d1b912b0fbe2ca165d613e4e8788bb05a5a"
+dependencies = [
+ "rand_core 0.9.5",
+]
+
+[[package]]
+name = "rayon"
+version = "1.12.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fb39b166781f92d482534ef4b4b1b2568f42613b53e5b6c160e24cfbfa30926d"
+dependencies = [
+ "either",
+ "rayon-core",
+]
+
+[[package]]
+name = "rayon-core"
+version = "1.13.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "22e18b0f0062d30d4230b2e85ff77fdfe4326feb054b9783a3460d8435c8ab91"
+dependencies = [
+ "crossbeam-deque",
+ "crossbeam-utils",
+]
+
+[[package]]
+name = "redox_users"
+version = "0.4.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ba009ff324d1fc1b900bd1fdb31564febe58a8ccc8a6fdbb93b543d33b13ca43"
+dependencies = [
+ "getrandom 0.2.17",
+ "libredox",
+ "thiserror 1.0.69",
+]
+
+[[package]]
+name = "regalloc2"
+version = "0.15.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "757712e8e61590d6d4f5d563483755538b5aa13467837a3b41cd9832509a7f85"
+dependencies = [
+ "allocator-api2",
+ "bumpalo",
+ "hashbrown 0.17.1",
+ "log",
+ "rustc-hash",
+ "serde",
+ "smallvec",
+]
+
+[[package]]
+name = "regex-automata"
+version = "0.4.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ad8553b9b26413251cbf30e620595c7a41b3887f03da04579c0e6b0d6a06b4b2"
+dependencies = [
+ "aho-corasick",
+ "memchr",
+ "regex-syntax",
+]
+
+[[package]]
+name = "regex-syntax"
+version = "0.8.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d6f6ff9a378485b298a5286656da665ba74413d36db0979633275d2e708145d4"
+
+[[package]]
+name = "rustc-demangle"
+version = "0.1.28"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b74b56ffa8bb2830709a538c2cbcae9aa062db0d2a42563bfb09bdaae44020eb"
+
+[[package]]
+name = "rustc-hash"
+version = "2.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6b1e7f9a428571be2dc5bc0505c13fb6bf936822b894ec87abf8a08a4e51742d"
+
+[[package]]
+name = "rustix"
+version = "1.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6fe4565b9518b83ef4f91bb47ce29620ca828bd32cb7e408f0062e9930ba190"
+dependencies = [
+ "bitflags",
+ "errno",
+ "libc",
+ "linux-raw-sys",
+ "windows-sys",
+]
+
+[[package]]
+name = "rustix-linux-procfs"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2fc84bf7e9aa16c4f2c758f27412dc9841341e16aa682d9c7ac308fe3ee12056"
+dependencies = [
+ "once_cell",
+ "rustix",
+]
+
+[[package]]
+name = "rustversion"
+version = "1.0.23"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cf54715a573b99ac80df0bc206da022bcd442c974952c7b9720069370852e21f"
+
+[[package]]
+name = "rusty-fork"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cc6bf79ff24e648f6da1f8d1f011e9cac26491b619e6b9280f2b47f1774e6ee2"
+dependencies = [
+ "fnv",
+ "quick-error",
+ "tempfile",
+ "wait-timeout",
+]
+
+[[package]]
+name = "scopeguard"
+version = "1.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "94143f37725109f92c262ed2cf5e59bce7498c01bcc1502d7b9afe439a4e9f49"
+
+[[package]]
+name = "semver"
+version = "1.0.28"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8a7852d02fc848982e0c167ef163aaff9cd91dc640ba85e263cb1ce46fae51cd"
+dependencies = [
+ "serde",
+ "serde_core",
+]
+
+[[package]]
+name = "serde"
+version = "1.0.229"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4148590afebada386688f18773da617792bf2ef03ffc1e4cbd2b1d45b023e0ba"
+dependencies = [
+ "serde_core",
+ "serde_derive",
+]
+
+[[package]]
+name = "serde_core"
+version = "1.0.229"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "67dca2c9c51e58a4791a4b1ed58308b39c64224d349a935ab5039aa360942a48"
+dependencies = [
+ "serde_derive",
+]
+
+[[package]]
+name = "serde_derive"
+version = "1.0.229"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e7a5d71263a5a7d47b41f6b3f06ba276f10cc18b0931f1799f710578e2309348"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.5",
+]
+
+[[package]]
+name = "serde_json"
+version = "1.0.151"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c841b55ecdae098c80dcae9cf767f6f8a0c2cdb3416bbef72181df4d0fe73f14"
+dependencies = [
+ "itoa",
+ "memchr",
+ "serde",
+ "serde_core",
+ "zmij",
+]
+
+[[package]]
+name = "serde_spanned"
+version = "1.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6662b5879511e06e8999a8a235d848113e942c9124f211511b16466ee2995f26"
+dependencies = [
+ "serde_core",
+]
+
+[[package]]
+name = "sha2"
+version = "0.10.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a7507d819769d01a365ab707794a4084392c824f54a7a6a7862f8c3d0892b283"
+dependencies = [
+ "cfg-if",
+ "cpufeatures 0.2.17",
+ "digest 0.10.7",
+]
+
+[[package]]
+name = "sha2"
+version = "0.11.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "47d7069beb7d6ac7b9acd1039986e73443f24234f41074da099d6f994ac9ad19"
+dependencies = [
+ "cfg-if",
+ "cpufeatures 0.3.1",
+ "digest 0.11.3",
+]
+
+[[package]]
+name = "shlex"
+version = "2.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f8fadd59c855ef2080decdef8ff161eb6661b86933c9d82e5ba29dc602a55aba"
+
+[[package]]
+name = "simd-adler32"
+version = "0.3.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3a219298ac11a56ea9a6d2120044824d6f01aeb034955e7af7bc16858527deea"
+
+[[package]]
+name = "simdutf8"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e3a9fe34e3e7a50316060351f37187a3f546bce95496156754b601a5fa71b76e"
+
+[[package]]
+name = "slab"
+version = "0.4.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0c790de23124f9ab44544d7ac05d60440adc586479ce501c1d6d7da3cd8c9cf5"
+
+[[package]]
+name = "smallvec"
+version = "1.16.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b9be42f50aa861c555654aa3a37f52f4b1074bacf4e48fe0ef7fa584e80f1f0f"
+dependencies = [
+ "serde",
+]
+
+[[package]]
+name = "socket2"
+version = "0.6.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c3d1e2c7f27f8d4cb10542a02c49005dbd6e93095799d6f3be745fae9f8fedd4"
+dependencies = [
+ "libc",
+ "windows-sys",
+]
+
+[[package]]
+name = "spdx"
+version = "0.13.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "081670c233dfbed55690cc0cd38424e0e24ac1b2673d0b408b3f7b684738dfa9"
+dependencies = [
+ "smallvec",
+]
+
+[[package]]
+name = "stable_deref_trait"
+version = "1.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6ce2be8dc25455e1f91df71bfa12ad37d7af1092ae736f3a6cd0e37bc7810596"
+
+[[package]]
+name = "strsim"
+version = "0.11.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7da8b5736845d9f2fcb837ea5d9e2628564b3b043a70948a3f0b778838c5fb4f"
+
+[[package]]
+name = "syn"
+version = "2.0.119"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "872831b642d1a07999a962a351ed35b955ea2cfc8f3862091e2a240a84f17297"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
+[[package]]
+name = "syn"
+version = "3.0.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "12df2e0110f65b775f769bb17ef989067a1d931b2eb822bd4346631eeada89f9"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
+[[package]]
+name = "synstructure"
+version = "0.13.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "728a70f3dbaf5bab7f0c4b1ac8d7ae5ea60a4b5549c8a5914361c99147a709d2"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "target-features"
+version = "0.1.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c1bbb9f3c5c463a01705937a24fdabc5047929ac764b2d5b9cf681c1f5041ed5"
+
+[[package]]
+name = "target-lexicon"
+version = "0.13.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "adb6935a6f5c20170eeceb1a3835a49e12e19d792f6dd344ccc76a985ca5a6ca"
+
+[[package]]
+name = "tempfile"
+version = "3.27.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "32497e9a4c7b38532efcdebeef879707aa9f794296a4f0244f6f69e9bc8574bd"
+dependencies = [
+ "fastrand",
+ "getrandom 0.4.3",
+ "once_cell",
+ "rustix",
+ "windows-sys",
+]
+
+[[package]]
+name = "termcolor"
+version = "1.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "06794f8f6c5c898b3275aebefa6b8a1cb24cd2c6c79397ab15774837a0bc5755"
+dependencies = [
+ "winapi-util",
+]
+
+[[package]]
+name = "thiserror"
+version = "1.0.69"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6aaf5339b578ea85b50e080feb250a3e8ae8cfcdff9a461c9ec2904bc923f52"
+dependencies = [
+ "thiserror-impl 1.0.69",
+]
+
+[[package]]
+name = "thiserror"
+version = "2.0.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ec86235f5fcc2a73650310756d2ac5b138a5780bbbdfae3eeccec992c435ba4f"
+dependencies = [
+ "thiserror-impl 2.0.20",
+]
+
+[[package]]
+name = "thiserror-impl"
+version = "1.0.69"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4fee6c4efc90059e10f81e6d42c60a18f76588c3d74cb83a0b242a2b6c7504c1"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "thiserror-impl"
+version = "2.0.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bc04cd3e1236dd4a98afca4569f2deb3f120e5422a4023be2cb683f8486292af"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.5",
+]
+
+[[package]]
+name = "tinystr"
+version = "0.8.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b1e27c91459209c2986af3dcf603a5a74a4368754ce37414f59acc971167f643"
+dependencies = [
+ "displaydoc",
+ "zerovec",
+]
+
+[[package]]
+name = "tokio"
+version = "1.53.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "202caea871b69668250d242070849eb495be178ed697a3e98aebce5bc81a0bed"
+dependencies = [
+ "bytes",
+ "libc",
+ "mio",
+ "pin-project-lite",
+ "socket2",
+ "tokio-macros",
+ "windows-sys",
+]
+
+[[package]]
+name = "tokio-macros"
+version = "2.7.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "78773a2a397f451582ce068015985c33193cf6dea8b74d2a639fe457b2f07b0e"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.5",
+]
+
+[[package]]
+name = "tokio-util"
+version = "0.7.19"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "494815d09bf52b5548659851081238f0ca39ff638363907596da739561c62c52"
+dependencies = [
+ "bytes",
+ "futures-core",
+ "futures-sink",
+ "libc",
+ "pin-project-lite",
+ "tokio",
+]
+
+[[package]]
+name = "toml"
+version = "1.1.6+spec-1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "920602543f0911ab71da12c50d59701da54c196d1a2bf5cb4b75667f137a406a"
+dependencies = [
+ "indexmap",
+ "serde_core",
+ "serde_spanned",
+ "toml_datetime",
+ "toml_parser",
+ "toml_writer",
+ "winnow",
+]
+
+[[package]]
+name = "toml_datetime"
+version = "1.1.1+spec-1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3165f65f62e28e0115a00b2ebdd37eb6f3b641855f9d636d3cd4103767159ad7"
+dependencies = [
+ "serde_core",
+]
+
+[[package]]
+name = "toml_parser"
+version = "1.1.3+spec-1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1d38ac1cf9b95face32296c0a3ede1fdc270627c9d9c02a7274dd6d960dc4d56"
+dependencies = [
+ "winnow",
+]
+
+[[package]]
+name = "toml_writer"
+version = "1.1.2+spec-1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7d56353a2a665ad0f41a421187180aab746c8c325620617ad883a99a1cbe66d2"
+
+[[package]]
+name = "topological-sort"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ea68304e134ecd095ac6c3574494fc62b909f416c4fca77e440530221e549d3d"
+
+[[package]]
+name = "tracing"
+version = "0.1.44"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "63e71662fa4b2a2c3a26f570f037eb95bb1f85397f3cd8076caed2f026a6d100"
+dependencies = [
+ "pin-project-lite",
+ "tracing-attributes",
+ "tracing-core",
+]
+
+[[package]]
+name = "tracing-attributes"
+version = "0.1.31"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7490cfa5ec963746568740651ac6781f701c9c5ea257c58e057f3ba8cf69e8da"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "tracing-core"
+version = "0.1.36"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "db97caf9d906fbde555dd62fa95ddba9eecfd14cb388e4f491a66d74cd5fb79a"
+dependencies = [
+ "once_cell",
+]
+
+[[package]]
+name = "try-lock"
+version = "0.2.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e421abadd41a4225275504ea4d6566923418b7f05506fbc9c0fe86ba7396114b"
+
+[[package]]
+name = "typenum"
+version = "1.20.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6f5e870be6c3b371b77fe0ee0bafb859fa4964b4404c27de1d380043c4dda20"
+
+[[package]]
+name = "unarray"
+version = "0.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "eaea85b334db583fe3274d12b4cd1880032beab409c0d774be044d4480ab9a94"
+
+[[package]]
+name = "unicode-ident"
+version = "1.0.24"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e6e4313cd5fcd3dad5cafa179702e2b244f760991f45397d14d4ebf38247da75"
+
+[[package]]
+name = "unicode-width"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b4ac048d71ede7ee76d585517add45da530660ef4390e49b098733c6e897f254"
+
+[[package]]
+name = "url"
+version = "2.5.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ff67a8a4397373c3ef660812acab3268222035010ab8680ec4215f38ba3d0eed"
+dependencies = [
+ "form_urlencoded",
+ "idna",
+ "percent-encoding",
+ "serde",
+]
+
+[[package]]
+name = "utf8_iter"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6c140620e7ffbb22c2dee59cafe6084a59b5ffc27a8859a5f0d494b5d52b6be"
+
+[[package]]
+name = "utf8parse"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "06abde3611657adf66d383f00b093d7faecc7fa57071cce2578660c9f1010821"
+
+[[package]]
+name = "uuid"
+version = "1.26.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2ef6dac1e96601b4fb3acccccff2139741fcb757cb9a36089bf5be91cfb285ce"
+dependencies = [
+ "js-sys",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "version_check"
+version = "0.9.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0b928f33d975fc6ad9f86c8f283853ad26bdd5b10b7f1542aa2fa15e2289105a"
+
+[[package]]
+name = "wac-graph"
+version = "0.12.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f0418130ea1c8f995ac51fd495080942604bca6455e6fb11f110aa1cefd3f549"
+dependencies = [
+ "anyhow",
+ "id-arena",
+ "indexmap",
+ "log",
+ "petgraph",
+ "semver",
+ "thiserror 1.0.69",
+ "wac-types",
+ "wasm-encoder 0.258.0",
+ "wasm-metadata 0.258.0",
+ "wasmparser 0.258.0",
+]
+
+[[package]]
+name = "wac-types"
+version = "0.12.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5580726576266490359b1457abbc0393e1780295e48a6892500f2b7e68edc74d"
+dependencies = [
+ "anyhow",
+ "id-arena",
+ "indexmap",
+ "semver",
+ "wasm-encoder 0.258.0",
+ "wasmparser 0.258.0",
+]
+
+[[package]]
+name = "wait-timeout"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "09ac3b126d3914f9849036f826e054cbabdc8519970b8998ddaf3b5bd3c65f11"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "want"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bfa7760aed19e106de2c7c0b581b509f2f25d3dacaf737cb82ac61bc6d760b0e"
+dependencies = [
+ "try-lock",
+]
+
+[[package]]
+name = "wasi"
+version = "0.11.1+wasi-snapshot-preview1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ccf3ec651a847eb01de73ccad15eb7d99f80485de043efb2f370cd654f4ea44b"
+
+[[package]]
+name = "wasip2"
+version = "1.0.4+wasi-0.2.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b67efb37e106e55ce722a510d6b5f9c17f083e5fc79afc2badeb12cc313d9487"
+dependencies = [
+ "wit-bindgen",
+]
+
+[[package]]
+name = "wasm-bindgen"
+version = "0.2.128"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "aecb87a33d3b0c5e3b7aa46336eaf486cffafbd281b195e4c8b80d50df2351bf"
+dependencies = [
+ "cfg-if",
+ "once_cell",
+ "rustversion",
+ "wasm-bindgen-macro",
+ "wasm-bindgen-shared",
+]
+
+[[package]]
+name = "wasm-bindgen-macro"
+version = "0.2.128"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a690d511e3c1a8b3a55e33511e3c2c00c78415cd23650f32b808627f5696b9ed"
+dependencies = [
+ "quote",
+ "wasm-bindgen-macro-support",
+]
+
+[[package]]
+name = "wasm-bindgen-macro-support"
+version = "0.2.128"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "411e4887f0071ef2d2164a9d5fdf2d20efbef78fccd3a78b0c10a1dc5295e48a"
+dependencies = [
+ "bumpalo",
+ "proc-macro2",
+ "quote",
+ "syn 3.0.5",
+ "wasm-bindgen-shared",
+]
+
+[[package]]
+name = "wasm-bindgen-shared"
+version = "0.2.128"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "81941cd78d0c92026c33e5e01312845a4cb1e9af3407f9134b100dd03144103e"
+dependencies = [
+ "unicode-ident",
+]
+
+[[package]]
+name = "wasm-compose"
+version = "0.261.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "df7deb87d659b1df555d3195e3df56d1f03b73d165c5a1bc3a0bad24274ea147"
+dependencies = [
+ "anyhow",
+ "indexmap",
+ "log",
+ "petgraph",
+ "smallvec",
+ "wasm-encoder 0.261.0",
+ "wasmparser 0.261.0",
+ "wat",
+]
+
+[[package]]
+name = "wasm-encoder"
+version = "0.258.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e974fe6821a8cf64575d51ea2194e2c8f77e7b66e9afe7419ce8a97f9ee0d251"
+dependencies = [
+ "leb128fmt",
+ "wasmparser 0.258.0",
+]
+
+[[package]]
+name = "wasm-encoder"
+version = "0.261.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2608e8bb6d67fd68f5a8d0eb1363d6e7bcbc1f8ded5a0bd3a1e382462b876b22"
+dependencies = [
+ "leb128fmt",
+ "wasmparser 0.261.0",
+]
+
+[[package]]
+name = "wasm-encoder"
+version = "0.262.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4495a6f85dd94c411c749303efcbc5defade0b0cbdbc0541495241ab917a9b5a"
+dependencies = [
+ "leb128fmt",
+ "wasmparser 0.262.0",
+]
+
+[[package]]
+name = "wasm-metadata"
+version = "0.258.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "18a11585adb92fe9b55ad1d760e8d8fb5d87e0d2e303cb8eed57f078d54293a2"
+dependencies = [
+ "anyhow",
+ "auditable-serde",
+ "flate2",
+ "indexmap",
+ "serde",
+ "serde_derive",
+ "serde_json",
+ "spdx",
+ "url",
+ "wasm-encoder 0.258.0",
+ "wasmparser 0.258.0",
+]
+
+[[package]]
+name = "wasm-metadata"
+version = "0.261.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b88de21560ecd49deb8d8f1616b9b695f66fc312c5eca503f43accdc5795339e"
+dependencies = [
+ "anyhow",
+ "indexmap",
+ "wasm-encoder 0.261.0",
+ "wasmparser 0.261.0",
+]
+
+[[package]]
+name = "wasm-metadata"
+version = "0.262.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c86ff6668190d9fb70372b306b4f9fe8930f0e2f57ce72e4922bf2f117900949"
+dependencies = [
+ "anyhow",
+ "indexmap",
+ "wasm-encoder 0.262.0",
+ "wasmparser 0.262.0",
+]
+
+[[package]]
+name = "wasm-wave"
+version = "0.261.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2c3077ed029568755b5d3557bc27688360f7daa19cb182aa32ff2a1035c818d0"
+dependencies = [
+ "anyhow",
+ "logos",
+ "thiserror 2.0.20",
+ "wit-parser 0.261.0",
+]
+
+[[package]]
+name = "wasmparser"
+version = "0.258.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d9a61719f93a87b16d325921e251800c4833f8fab50fa21c7de73aed50086313"
+dependencies = [
+ "bitflags",
+ "hashbrown 0.17.1",
+ "indexmap",
+ "semver",
+ "serde",
+]
+
+[[package]]
+name = "wasmparser"
+version = "0.261.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4f20f20e44f7e8aeb6744823ea9d869ede51e51be4fdaedede2852282e54d2d8"
+dependencies = [
+ "bitflags",
+ "hashbrown 0.17.1",
+ "indexmap",
+ "semver",
+ "serde",
+]
+
+[[package]]
+name = "wasmparser"
+version = "0.262.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "974d643b125b272607e2fff8012ea14a8328acd7621e4bafa7afb32500052b1b"
+dependencies = [
+ "bitflags",
+ "hashbrown 0.17.1",
+ "indexmap",
+ "semver",
+ "serde",
+]
+
+[[package]]
+name = "wasmprinter"
+version = "0.261.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "86a21c9e3325655ba02de3e645bc8357a8b3651a2e3ada25b6dbc37560deb9b7"
+dependencies = [
+ "anyhow",
+ "termcolor",
+ "wasmparser 0.261.0",
+]
+
+[[package]]
+name = "wasmtime"
+version = "50.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2d93539aae382faee7b19650fd966f1f8185599b9cc4adc0a5a8b8f768c11ba9"
+dependencies = [
+ "addr2line",
+ "async-trait",
+ "bitflags",
+ "bumpalo",
+ "bytes",
+ "cc",
+ "encoding_rs",
+ "futures",
+ "fxprof-processed-profile",
+ "gimli",
+ "ittapi",
+ "libc",
+ "log",
+ "mach2",
+ "memfd",
+ "object",
+ "once_cell",
+ "postcard",
+ "pulley-interpreter",
+ "rayon",
+ "rustix",
+ "semver",
+ "serde",
+ "serde_derive",
+ "serde_json",
+ "smallvec",
+ "target-lexicon",
+ "tempfile",
+ "wasm-compose",
+ "wasm-encoder 0.261.0",
+ "wasm-wave",
+ "wasmparser 0.261.0",
+ "wasmtime-environ",
+ "wasmtime-internal-cache",
+ "wasmtime-internal-component-macro",
+ "wasmtime-internal-component-util",
+ "wasmtime-internal-core",
+ "wasmtime-internal-cranelift",
+ "wasmtime-internal-fiber",
+ "wasmtime-internal-jit-debug",
+ "wasmtime-internal-jit-icache-coherence",
+ "wasmtime-internal-unwinder",
+ "wasmtime-internal-versioned-export-macros",
+ "wat",
+ "windows-sys",
+ "wit-parser 0.261.0",
+]
+
+[[package]]
+name = "wasmtime-environ"
+version = "50.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "34fd44c205ef29cc3c254253dceb916be586887602e0e380361ed022776cfc10"
+dependencies = [
+ "anyhow",
+ "cpp_demangle",
+ "cranelift-bforest",
+ "cranelift-bitset",
+ "cranelift-entity",
+ "gimli",
+ "hashbrown 0.17.1",
+ "indexmap",
+ "log",
+ "object",
+ "postcard",
+ "rustc-demangle",
+ "semver",
+ "serde",
+ "serde_derive",
+ "smallvec",
+ "target-lexicon",
+ "wasm-encoder 0.261.0",
+ "wasmparser 0.261.0",
+ "wasmprinter",
+ "wasmtime-internal-component-util",
+ "wasmtime-internal-core",
+]
+
+[[package]]
+name = "wasmtime-internal-cache"
+version = "50.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "067440fa60ddd5145840e0335ffe0ab4d908a021932b6844c3ad61570abddfef"
+dependencies = [
+ "base64",
+ "directories-next",
+ "log",
+ "postcard",
+ "rustix",
+ "serde",
+ "serde_derive",
+ "sha2 0.10.9",
+ "toml",
+ "wasmtime-environ",
+ "windows-sys",
+ "zstd",
+]
+
+[[package]]
+name = "wasmtime-internal-component-macro"
+version = "50.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "adf0938f1a0f067a60aa07a7f4369fae05ef227314aca64c1abc7b2dc5e80743"
+dependencies = [
+ "anyhow",
+ "proc-macro2",
+ "quote",
+ "syn 3.0.5",
+ "wasmtime-internal-component-util",
+ "wasmtime-internal-wit-bindgen",
+ "wit-parser 0.261.0",
+]
+
+[[package]]
+name = "wasmtime-internal-component-util"
+version = "50.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2626398b21bf4b1547fdbadc68afd5cbe69c89ca2a1d6c45fd56fd3b28177b93"
+
+[[package]]
+name = "wasmtime-internal-core"
+version = "50.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "83d4ac46034b149aed44335595402503094a04e3b70d0cff8c169d83437318b8"
+dependencies = [
+ "anyhow",
+ "hashbrown 0.17.1",
+ "libm",
+ "serde",
+]
+
+[[package]]
+name = "wasmtime-internal-cranelift"
+version = "50.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1f496bf29d3f2a1d060e0a497a20bfba2a36befe80bdf3e640ba8d3dcab7df35"
+dependencies = [
+ "cranelift-codegen",
+ "cranelift-control",
+ "cranelift-entity",
+ "cranelift-frontend",
+ "cranelift-native",
+ "gimli",
+ "itertools",
+ "log",
+ "object",
+ "pulley-interpreter",
+ "smallvec",
+ "target-lexicon",
+ "thiserror 2.0.20",
+ "wasmparser 0.261.0",
+ "wasmtime-environ",
+ "wasmtime-internal-core",
+ "wasmtime-internal-unwinder",
+ "wasmtime-internal-versioned-export-macros",
+]
+
+[[package]]
+name = "wasmtime-internal-fiber"
+version = "50.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2074dc297d5ec7f0cfff65c248798dfe4bbee4d760fc2956cc0eaf49d2eadef1"
+dependencies = [
+ "cc",
+ "libc",
+ "rustix",
+ "wasmtime-environ",
+ "wasmtime-internal-versioned-export-macros",
+ "windows-sys",
+]
+
+[[package]]
+name = "wasmtime-internal-jit-debug"
+version = "50.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4e990e2fb7710dd73af071ecf60908072935be7a5c689b4a07e9a2adc7995151"
+dependencies = [
+ "cc",
+ "object",
+ "rustix",
+ "wasmtime-internal-versioned-export-macros",
+]
+
+[[package]]
+name = "wasmtime-internal-jit-icache-coherence"
+version = "50.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cf25a1b3b925915f845927967554400554db9cebd3a7038a6fca0cf6e9bbaf6a"
+dependencies = [
+ "libc",
+ "wasmtime-internal-core",
+ "windows-sys",
+]
+
+[[package]]
+name = "wasmtime-internal-unwinder"
+version = "50.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e69eb39fe5baf9e181269e6ced40f407d31afc8e514864e228ef0e087f4f5348"
+dependencies = [
+ "cranelift-codegen",
+ "log",
+ "object",
+ "wasmtime-environ",
+]
+
+[[package]]
+name = "wasmtime-internal-versioned-export-macros"
+version = "50.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a805a26effdf564820580b7c4ce1c00fdee3f4a9465a5aeef944f9e0c254ec2e"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.5",
+]
+
+[[package]]
+name = "wasmtime-internal-wit-bindgen"
+version = "50.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8511353a609cd60bb91c85f96beef39a63e96ccdc20eb20af1da9b805c499ece"
+dependencies = [
+ "anyhow",
+ "bitflags",
+ "heck",
+ "indexmap",
+ "wit-component 0.261.0",
+ "wit-parser 0.261.0",
+]
+
+[[package]]
+name = "wasmtime-wasi"
+version = "50.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ed63d0061d45fdf32d8f47913845491395a6918e5b4bee51d1910c3777bcbaca"
+dependencies = [
+ "async-trait",
+ "bitflags",
+ "bytes",
+ "futures",
+ "rand 0.10.2",
+ "rustix",
+ "rustix-linux-procfs",
+ "thiserror 2.0.20",
+ "tokio",
+ "tracing",
+ "url",
+ "wasmtime",
+ "wasmtime-wasi-io",
+ "wiggle",
+ "windows-sys",
+]
+
+[[package]]
+name = "wasmtime-wasi-http"
+version = "50.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cc344236952fbd212ce75fea430207783603669661f6634deff84dbc63ec13c0"
+dependencies = [
+ "async-trait",
+ "bytes",
+ "futures",
+ "http",
+ "http-body",
+ "http-body-util",
+ "hyper",
+ "pin-project-lite",
+ "rustix",
+ "tokio",
+ "tokio-util",
+ "tracing",
+ "wasmtime",
+ "wasmtime-wasi",
+ "wasmtime-wasi-io",
+]
+
+[[package]]
+name = "wasmtime-wasi-io"
+version = "50.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "273d9f9178b9415fba5a1b84d6634e82a1d95b5a0b657bd12d90a7d1073d27e0"
+dependencies = [
+ "async-trait",
+ "bytes",
+ "futures",
+ "tracing",
+ "wasmtime",
+]
+
+[[package]]
+name = "wasmtime-wizer"
+version = "50.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3e191c8db47bfab08f8d863d914d3c3843c0fc83ca0fcccaf8c2059860a161ae"
+dependencies = [
+ "log",
+ "rayon",
+ "wasm-encoder 0.261.0",
+ "wasmparser 0.261.0",
+ "wasmtime",
+]
+
+[[package]]
+name = "wast"
+version = "35.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2ef140f1b49946586078353a453a1d28ba90adfc54dde75710bc1931de204d68"
+dependencies = [
+ "leb128",
+]
+
+[[package]]
+name = "wast"
+version = "262.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "30612a0c29249b5f185888a107e8a519d920226b7d07f9d351fd094e9f75eb23"
+dependencies = [
+ "bumpalo",
+ "leb128fmt",
+ "memchr",
+ "unicode-width",
+ "wasm-encoder 0.262.0",
+]
+
+[[package]]
+name = "wat"
+version = "1.262.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e228027f2b07bbaf946980ebbe2437fca73be6f54c40c2a8d4f42f277075f8d1"
+dependencies = [
+ "wast 262.0.0",
+]
+
+[[package]]
+name = "wiggle"
+version = "50.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "028cb8da5fd85d7b77684a990d54e66963939ddb5829334d8f7b11e4640f8109"
+dependencies = [
+ "bitflags",
+ "thiserror 2.0.20",
+ "tracing",
+ "wasmtime",
+ "wasmtime-environ",
+ "wiggle-macro",
+]
+
+[[package]]
+name = "wiggle-generate"
+version = "50.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9f27d5dbfe2ddd0ccb850e6ce8ab0639ed326f44d53acdc1193770c4008a65cd"
+dependencies = [
+ "heck",
+ "proc-macro2",
+ "quote",
+ "syn 3.0.5",
+ "wasmtime-environ",
+ "witx",
+]
+
+[[package]]
+name = "wiggle-macro"
+version = "50.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a0ae0f398e1b68b4d9947ebff55e9bf14a6ecb98e7666f08497058058a793a66"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.5",
+ "wiggle-generate",
+]
+
+[[package]]
+name = "winapi"
+version = "0.3.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5c839a674fcd7a98952e593242ea400abe93992746761e38641405d28b00f419"
+dependencies = [
+ "winapi-i686-pc-windows-gnu",
+ "winapi-x86_64-pc-windows-gnu",
+]
+
+[[package]]
+name = "winapi-i686-pc-windows-gnu"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ac3b87c63620426dd9b991e5ce0329eff545bccbbb34f3be09ff6fb6ab51b7b6"
+
+[[package]]
+name = "winapi-util"
+version = "0.1.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22"
+dependencies = [
+ "windows-sys",
+]
+
+[[package]]
+name = "winapi-x86_64-pc-windows-gnu"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
+
+[[package]]
+name = "windows-link"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f0805222e57f7521d6a62e36fa9163bc891acd422f971defe97d64e70d0a4fe5"
+
+[[package]]
+name = "windows-sys"
+version = "0.61.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ae137229bcbd6cdf0f7b80a31df61766145077ddf49416a728b02cb3921ff3fc"
+dependencies = [
+ "windows-link",
+]
+
+[[package]]
+name = "winnow"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "23b97319f7b8343df12cc98938e5c3eb436064524c8d2b4e30a1d3a36eecdf81"
+
+[[package]]
+name = "wit-bindgen"
+version = "0.57.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1ebf944e87a7c253233ad6766e082e3cd714b5d03812acc24c318f549614536e"
+
+[[package]]
+name = "wit-component"
+version = "0.261.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2818766842bd2321074c348fb5c15d8fdb105a9eb78374e6d77c7d4127e1f2f9"
+dependencies = [
+ "anyhow",
+ "bitflags",
+ "indexmap",
+ "log",
+ "serde",
+ "serde_derive",
+ "serde_json",
+ "wasm-encoder 0.261.0",
+ "wasm-metadata 0.261.0",
+ "wasmparser 0.261.0",
+ "wit-parser 0.261.0",
+]
+
+[[package]]
+name = "wit-component"
+version = "0.262.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "078def49fdb49cab405c3006e05793b3fdaf7069126ba6b9c97d01ec8c98fe4c"
+dependencies = [
+ "anyhow",
+ "bitflags",
+ "indexmap",
+ "log",
+ "serde",
+ "serde_derive",
+ "serde_json",
+ "wasm-encoder 0.262.0",
+ "wasm-metadata 0.262.0",
+ "wasmparser 0.262.0",
+ "wit-parser 0.262.0",
+]
+
+[[package]]
+name = "wit-dylib"
+version = "0.262.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4afb62bd2b1a374611ff4125cf51a36d1a35cf36d2bbfd0e9ac32573bbb199cb"
+dependencies = [
+ "anyhow",
+ "indexmap",
+ "wasm-encoder 0.262.0",
+ "wit-parser 0.262.0",
+]
+
+[[package]]
+name = "wit-name-mapping"
+version = "0.3.0"
+dependencies = [
+ "heck",
+ "semver",
+ "wasmparser 0.262.0",
+]
+
+[[package]]
+name = "wit-parser"
+version = "0.261.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "962e43c4db2da607b50839a531e5b63473268b40efdf8028d5c54b572ca4f6f6"
+dependencies = [
+ "anyhow",
+ "hashbrown 0.17.1",
+ "id-arena",
+ "indexmap",
+ "log",
+ "semver",
+ "serde",
+ "serde_derive",
+ "serde_json",
+ "unicode-ident",
+ "wasmparser 0.261.0",
+]
+
+[[package]]
+name = "wit-parser"
+version = "0.262.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "00f0dc051466ffe46787721fca3d088536f158ae400be044f1b1c386ba9397ad"
+dependencies = [
+ "anyhow",
+ "hashbrown 0.17.1",
+ "id-arena",
+ "indexmap",
+ "log",
+ "semver",
+ "serde",
+ "serde_derive",
+ "serde_json",
+ "unicode-ident",
+ "wasmparser 0.262.0",
+]
+
+[[package]]
+name = "witx"
+version = "0.9.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e366f27a5cabcddb2706a78296a40b8fcc451e1a6aba2fc1d94b4a01bdaaef4b"
+dependencies = [
+ "anyhow",
+ "log",
+ "thiserror 1.0.69",
+ "wast 35.0.2",
+]
+
+[[package]]
+name = "writeable"
+version = "0.6.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3ad82d2a33cdc9674dc7465672f271e096168fcdbe0f799d9e6db8c5892679dc"
+
+[[package]]
+name = "yoke"
+version = "0.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "709fe23a0424b6a435d82152b1bd3fdfb0833487d5fa90d05d42762a9891fef5"
+dependencies = [
+ "stable_deref_trait",
+ "yoke-derive",
+ "zerofrom",
+]
+
+[[package]]
+name = "yoke-derive"
+version = "0.8.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "de844c262c8848816172cef550288e7dc6c7b7814b4ee56b3e1553f275f1858e"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+ "synstructure",
+]
+
+[[package]]
+name = "zerocopy"
+version = "0.8.57"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d35102a9f36d089ccae9e4c6802bc118be4487b80aaffc0ab4e0cf5ce92d2873"
+dependencies = [
+ "zerocopy-derive",
+]
+
+[[package]]
+name = "zerocopy-derive"
+version = "0.8.57"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "146c01f5ab44258da43cf276c74a2763db2ff3969c9c652c3f2de07041d0b2bc"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "zerofrom"
+version = "0.1.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0ec05a11813ea801ff6d75110ad09cd0824ddba17dfe17128ea0d5f68e6c5272"
+dependencies = [
+ "zerofrom-derive",
+]
+
+[[package]]
+name = "zerofrom-derive"
+version = "0.1.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "11532158c46691caf0f2593ea8358fed6bbf68a0315e80aae9bd41fbade684a1"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+ "synstructure",
+]
+
+[[package]]
+name = "zerotrie"
+version = "0.2.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4ea269c3bd32f0a32c321907a2ae912ba6f4649bb0fc764a15627e99a7095a3f"
+dependencies = [
+ "displaydoc",
+ "yoke",
+ "zerofrom",
+]
+
+[[package]]
+name = "zerovec"
+version = "0.11.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bb0464e17806c1d976d5cba29399c7f08e516e279e2ba493f63123b5fca67dd8"
+dependencies = [
+ "yoke",
+ "zerofrom",
+ "zerovec-derive",
+]
+
+[[package]]
+name = "zerovec-derive"
+version = "0.11.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "34df6fc39dbd26ddc9c10e6a2984476e13acce22e64e4487636ef494369225da"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.5",
+]
+
+[[package]]
+name = "zlib-rs"
+version = "0.6.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b268e58e7c693d7c271f93ffc4ba3b380412554231c85bf61ca7af91042a4112"
+
+[[package]]
+name = "zmij"
+version = "1.0.23"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "29666d0abbfad1e3dc4dcf6144730dd3a3ab225bbbdac83319345b1b44ccfc1b"
+
+[[package]]
+name = "zstd"
+version = "0.13.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e91ee311a569c327171651566e07972200e76fcfe2242a4fa446149a3881c08a"
+dependencies = [
+ "zstd-safe",
+]
+
+[[package]]
+name = "zstd-safe"
+version = "7.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "64d80649ab6db9d9f6f9c80a40becd948eda4714a0a5ac8c4d157a32231c7882"
+dependencies = [
+ "zstd-sys",
+]
+
+[[package]]
+name = "zstd-sys"
+version = "2.1.0+zstd.1.5.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0ef0a8027ec3ee71300ab3bcbcd0393f434aa72b91ca6d635a39941deae8eea0"
+dependencies = [
+ "cc",
+ "pkg-config",
+]
diff --git a/componentize/Cargo.toml b/componentize/Cargo.toml
new file mode 100644
index 00000000..2c755e19
--- /dev/null
+++ b/componentize/Cargo.toml
@@ -0,0 +1,66 @@
+[package]
+name = "componentize"
+version = "0.3.0"
+edition = "2021"
+license = "Apache-2.0 WITH LLVM-exception"
+authors = ["The StarlingMonkey project contributors"]
+repository = "https://github.com/bytecodealliance/starlingmonkey"
+
+# A workspace of its own: its dependencies (wasmtime, Wizer, wac-graph, and the versions of the
+# wasm-tools crates they depend on) are resolved in `componentize/Cargo.lock`, apart from the
+# runtime workspace's. `.cargo/config.toml` points its build directory at the repository's
+# `target/`.
+[workspace]
+members = ["preserve-component-type"]
+
+# Optimize every dependency in dev and test builds, leaving this crate at debug for fast
+# iteration. The host tests drive wasmtime and Wizer to compile and snapshot a ~200 MB component.
+# Unoptimized that takes minutes per world and gets killed by test timeouts. Optimized it takes a
+# few seconds.
+[profile.dev.package."*"]
+opt-level = 3
+
+[[bin]]
+name = "starling-componentize"
+path = "src/bin/starling-componentize.rs"
+
+[dependencies]
+anyhow = "1"
+bytes = "1"
+clap = { version = "4.5.60", features = ["derive", "env"] }
+wit-name-mapping = { path = "../crates/wit-name-mapping" }
+tokio = { version = "1", features = ["rt"] }
+indexmap = "2"
+preserve-component-type = { path = "preserve-component-type" }
+# `wac-graph` composes the stub component of the finalize pass in for disabled
+# WASI features.
+wac-graph = "0.12"
+wasm-encoder = "0.262"
+wasmparser = "0.262"
+# `version` prints the SHA-256 digest of the runtime.
+hex = "0.4"
+sha2 = "0.11"
+# `--init-location` is checked to be a URL.
+url = "2"
+wasmtime = { version = "50", features = ["cache"] }
+# `p3` enables the WASIp3 host (`wasmtime_wasi::p3`), which `add_wasi` adds.
+wasmtime-wasi = { version = "50", features = ["p3"] }
+wasmtime-wizer = { version = "50", features = ["component-model", "wasmtime"] }
+wit-component = "0.262"
+wit-dylib = "0.262"
+wit-parser = "0.262"
+
+# musl builds use mimalloc as the global allocator. With musl's allocator, componentizing takes
+# about three times as long.
+[target.'cfg(target_env = "musl")'.dependencies]
+mimalloc = "0.1.52"
+
+[dev-dependencies]
+tokio = { version = "1", features = ["macros", "rt"] }
+proptest = "1.11"
+# `default-features = false` drops `default-send-request`, so no request reaches a real network.
+wasmtime-wasi-http = { version = "50", features = ["p3"], default-features = false }
+http = "1"
+http-body = "1"
+http-body-util = "0.1"
+futures = "0.3"
diff --git a/componentize/build.rs b/componentize/build.rs
new file mode 100644
index 00000000..3decab4a
--- /dev/null
+++ b/componentize/build.rs
@@ -0,0 +1,43 @@
+// SPDX-License-Identifier: Apache-2.0-WITH-LLVM-exception
+
+//! Copy the runtime `starling-componentize` embeds as its default `--runtime` to
+//! `$OUT_DIR/runtime.wasm`.
+//!
+//! The embedded runtime is the file `STARLING_EMBED_RUNTIME` names, or else the
+//! runtime component `just build-runtime` writes for wasm32-wasip3, under
+//! `CARGO_TARGET_DIR` or the repository's `target/`. A relative path in either
+//! variable resolves against `componentize/`. An empty `STARLING_EMBED_RUNTIME`
+//! counts as unset. A file it names that can't be read fails the build. Without
+//! a runtime at the default path, the copy is empty, and the binary embeds none.
+
+use std::env;
+use std::path::PathBuf;
+
+fn main() {
+    println!("cargo:rerun-if-env-changed=STARLING_EMBED_RUNTIME");
+    println!("cargo:rerun-if-env-changed=CARGO_TARGET_DIR");
+    let manifest_dir = PathBuf::from(env::var_os("CARGO_MANIFEST_DIR").expect("set by cargo"));
+    let explicit = env::var_os("STARLING_EMBED_RUNTIME")
+        .filter(|path| !path.is_empty())
+        .map(PathBuf::from);
+    let runtime = explicit.clone().unwrap_or_else(|| {
+        env::var_os("CARGO_TARGET_DIR")
+            .map(PathBuf::from)
+            .unwrap_or_else(|| manifest_dir.join("../target"))
+            .join("wasm32-wasip3/release/starling.wasm")
+    });
+    println!("cargo:rerun-if-changed={}", runtime.display());
+    let bytes = match std::fs::read(&runtime) {
+        Ok(bytes) => bytes,
+        Err(e) if explicit.is_some() => {
+            panic!("reading STARLING_EMBED_RUNTIME={}: {e}", runtime.display())
+        }
+        Err(_) => Vec::new(),
+    };
+    let out = PathBuf::from(env::var_os("OUT_DIR").expect("set by cargo")).join("runtime.wasm");
+    // The file is rewritten only when its contents changed, since the binary
+    // embeds it and is rebuilt whenever the file is newer.
+    if std::fs::read(&out).ok().as_deref() != Some(bytes.as_slice()) {
+        std::fs::write(&out, bytes).expect("writing the embedded runtime");
+    }
+}
diff --git a/componentize/npm/package.mjs b/componentize/npm/package.mjs
new file mode 100644
index 00000000..439acf40
--- /dev/null
+++ b/componentize/npm/package.mjs
@@ -0,0 +1,118 @@
+// SPDX-License-Identifier: Apache-2.0-WITH-LLVM-exception
+
+// Assemble the npm packages of `starling-componentize`: the package in
+// `starling-componentize/`, which resolves the binary, and one package per
+// platform holding it, named `<scope>/starling-componentize-<platform>`.
+//
+// Usage:
+//
+//   node package.mjs --out <dir> [--version 0.3.0] [--scope @bytecodealliance] \
+//     [--pack <tarballs dir>] [--all-platforms] <platform>=<binary> [<platform>=<binary> ...]
+//
+// `<platform>` is a key of `platforms.json`, such as `linux-x64`, and
+// `<binary>` the `starling-componentize` built for it. Each package is written
+// to `<dir>/<package directory name>`, ready for `npm pack` or `npm publish`.
+// The resolver package lists every platform of `platforms.json` as an optional
+// dependency, whether or not a binary for it was given, and `--all-platforms`
+// fails unless one was given for each. The version defaults to the one in
+// `componentize/Cargo.toml`. With `--pack`, `npm pack` writes each package's
+// tarball to `<tarballs dir>`.
+
+import { execFileSync } from 'node:child_process';
+import { chmodSync, copyFileSync, cpSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { parseArgs } from 'node:util';
+
+const NAME = 'starling-componentize';
+const here = path.dirname(fileURLToPath(import.meta.url));
+const platforms = JSON.parse(readFileSync(path.join(here, 'platforms.json'), 'utf8'));
+const cargoToml = readFileSync(path.join(here, '..', 'Cargo.toml'), 'utf8');
+
+const { values, positionals } = parseArgs({
+  options: {
+    version: { type: 'string', default: cargoToml.match(/^version = "(.*)"$/m)[1] },
+    out: { type: 'string' },
+    scope: { type: 'string', default: '@bytecodealliance' },
+    pack: { type: 'string' },
+    'all-platforms': { type: 'boolean', default: false },
+  },
+  allowPositionals: true,
+});
+if (!values.out) {
+  throw new Error('--out is required');
+}
+const { version, out, scope, pack } = values;
+const given = new Set(positionals.map(arg => arg.split('=')[0]));
+const missing = Object.keys(platforms).filter(platform => !given.has(platform));
+if (values['all-platforms'] && missing.length > 0) {
+  throw new Error(`no binary for the platforms ${missing.join(', ')} of platforms.json`);
+}
+
+const common = {
+  version,
+  license: 'Apache-2.0 WITH LLVM-exception',
+  repository: {
+    type: 'git',
+    url: `git+${cargoToml.match(/^repository = "(.*)"$/m)[1]}.git`,
+    directory: 'componentize',
+  },
+  publishConfig: { access: 'public', provenance: true },
+};
+
+function writeJson(file, value) {
+  writeFileSync(file, `${JSON.stringify(value, null, 2)}\n`);
+}
+
+for (const arg of positionals) {
+  const [platform, binary] = arg.split('=');
+  const target = platforms[platform];
+  if (!target || !binary) {
+    throw new Error(`\`${arg}\` is not <platform>=<binary> with a platform of platforms.json`);
+  }
+  const dir = path.join(out, `${NAME}-${platform}`);
+  mkdirSync(path.join(dir, 'bin'), { recursive: true });
+  const exe = target.os === 'win32' ? `${NAME}.exe` : NAME;
+  copyFileSync(binary, path.join(dir, 'bin', exe));
+  chmodSync(path.join(dir, 'bin', exe), 0o755);
+  writeJson(path.join(dir, 'package.json'), {
+    name: `${scope}/${NAME}-${platform}`,
+    description: `The ${platform} binary of ${scope}/${NAME}`,
+    ...common,
+    os: [target.os],
+    cpu: [target.cpu],
+    files: ['bin'],
+  });
+  writeFileSync(
+    path.join(dir, 'README.md'),
+    `# ${scope}/${NAME}-${platform}\n\nThe \`${NAME}\` binary for ${platform}. Install \`${scope}/${NAME}\`, which depends on it.\n`,
+  );
+}
+
+const main = path.join(out, NAME);
+cpSync(path.join(here, NAME), main, { recursive: true });
+chmodSync(path.join(main, 'bin', `${NAME}.js`), 0o755);
+writeJson(path.join(main, 'package.json'), {
+  name: `${scope}/${NAME}`,
+  description: 'Build WebAssembly components from JavaScript on the StarlingMonkey runtime',
+  ...common,
+  main: 'index.js',
+  bin: { [NAME]: `bin/${NAME}.js` },
+  files: ['index.js', 'bin'],
+  engines: { node: '>=22' },
+  optionalDependencies: Object.fromEntries(
+    Object.keys(platforms).map(platform => [`${scope}/${NAME}-${platform}`, version]),
+  ),
+  // Read by `index.js` to name the platform packages.
+  starlingComponentize: { scope, name: NAME },
+});
+
+if (pack) {
+  mkdirSync(pack, { recursive: true });
+  for (const dir of [...[...given].map(platform => `${NAME}-${platform}`), NAME]) {
+    execFileSync('npm', ['pack', '--silent', '--pack-destination', path.resolve(pack)], {
+      cwd: path.join(out, dir),
+      stdio: ['ignore', 'ignore', 'inherit'],
+    });
+  }
+}
diff --git a/componentize/npm/platforms.json b/componentize/npm/platforms.json
new file mode 100644
index 00000000..27dbbf83
--- /dev/null
+++ b/componentize/npm/platforms.json
@@ -0,0 +1,7 @@
+{
+  "darwin-arm64": { "os": "darwin", "cpu": "arm64" },
+  "darwin-x64": { "os": "darwin", "cpu": "x64" },
+  "linux-arm64": { "os": "linux", "cpu": "arm64" },
+  "linux-x64": { "os": "linux", "cpu": "x64" },
+  "win32-x64": { "os": "win32", "cpu": "x64" }
+}
diff --git a/componentize/npm/starling-componentize/README.md b/componentize/npm/starling-componentize/README.md
new file mode 100644
index 00000000..879b8adf
--- /dev/null
+++ b/componentize/npm/starling-componentize/README.md
@@ -0,0 +1,14 @@
+# starling-componentize
+
+`starling-componentize` builds WebAssembly components from JavaScript modules on the StarlingMonkey runtime. The
+[StarlingMonkey README](https://github.com/bytecodealliance/starlingmonkey#componentizing-javascript) describes its
+usage.
+
+```bash
+npx @bytecodealliance/starling-componentize --export-http componentize app.js -o app.wasm
+```
+
+This package holds no binary itself. npm installs the one for your platform from an optional dependency, and
+`require('@bytecodealliance/starling-componentize').binaryPath()` returns its path. There are binaries for macOS
+(arm64 and x64), Linux (arm64 and x64) and Windows (x64). The Linux binaries are statically linked, so they run with
+any C library, such as glibc or musl.
diff --git a/componentize/npm/starling-componentize/bin/starling-componentize.js b/componentize/npm/starling-componentize/bin/starling-componentize.js
new file mode 100644
index 00000000..22180766
--- /dev/null
+++ b/componentize/npm/starling-componentize/bin/starling-componentize.js
@@ -0,0 +1,14 @@
+#!/usr/bin/env node
+// SPDX-License-Identifier: Apache-2.0-WITH-LLVM-exception
+
+'use strict';
+
+// Run this platform's `starling-componentize` with the arguments given.
+const { spawnSync } = require('node:child_process');
+const { binaryPath } = require('..');
+
+const result = spawnSync(binaryPath(), process.argv.slice(2), { stdio: 'inherit' });
+if (result.error) {
+  throw result.error;
+}
+process.exitCode = result.status ?? 1;
diff --git a/componentize/npm/starling-componentize/index.js b/componentize/npm/starling-componentize/index.js
new file mode 100644
index 00000000..7d014627
--- /dev/null
+++ b/componentize/npm/starling-componentize/index.js
@@ -0,0 +1,33 @@
+// SPDX-License-Identifier: Apache-2.0-WITH-LLVM-exception
+
+'use strict';
+
+const path = require('node:path');
+
+const { scope, name } = require('./package.json').starlingComponentize;
+
+/**
+ * The path of the `starling-componentize` binary for this platform, from the
+ * platform package npm installed as an optional dependency.
+ *
+ * Throws if this platform has no package, or if its package is not installed,
+ * such as after an install with `--no-optional`.
+ */
+function binaryPath() {
+  const platform = `${process.platform}-${process.arch}`;
+  const packageName = `${scope}/${name}-${platform}`;
+  const exe = process.platform === 'win32' ? `${name}.exe` : name;
+  let packageJson;
+  try {
+    packageJson = require.resolve(`${packageName}/package.json`);
+  } catch {
+    throw new Error(
+      `${packageName} is not installed. It provides \`${name}\` for ${platform}. ` +
+        'Reinstall without --no-optional or --omit=optional, or, if there is no ' +
+        'package for this platform, build `starling-componentize` from source.',
+    );
+  }
+  return path.join(path.dirname(packageJson), 'bin', exe);
+}
+
+module.exports = { binaryPath };
diff --git a/componentize/preserve-component-type/Cargo.toml b/componentize/preserve-component-type/Cargo.toml
new file mode 100644
index 00000000..d98f2434
--- /dev/null
+++ b/componentize/preserve-component-type/Cargo.toml
@@ -0,0 +1,13 @@
+[package]
+name = "preserve-component-type"
+version = "0.3.0"
+edition = "2021"
+license = "Apache-2.0 WITH LLVM-exception"
+authors = ["The StarlingMonkey project contributors"]
+repository = "https://github.com/bytecodealliance/starlingmonkey"
+publish = false
+
+[dependencies]
+anyhow = "1"
+wasm-encoder = "0.262"
+wasmparser = "0.262"
diff --git a/componentize/preserve-component-type/src/lib.rs b/componentize/preserve-component-type/src/lib.rs
new file mode 100644
index 00000000..75524e67
--- /dev/null
+++ b/componentize/preserve-component-type/src/lib.rs
@@ -0,0 +1,168 @@
+// SPDX-License-Identifier: Apache-2.0-WITH-LLVM-exception
+
+//! Copies of a core module's `component-type*` custom sections, and their
+//! restoration.
+//!
+//! The `component-type*` sections hold the worlds of the module's wit-bindgen
+//! bindings. `wasm-tools component new` consumes and removes them, and the
+//! component's own type keeps only the interfaces from which the module imports
+//! functions. Linking wit-dylib bindings against the core module again needs the
+//! complete worlds: a stream intrinsic such as
+//! `[stream-read-0]read-via-stream` is resolved through the type of the
+//! function it names, which the module doesn't necessarily import.
+//!
+//! `scripts/build-runtime.sh` runs [`preserve`] on the runtime's core module
+//! before `wasm-tools component new`, and `starling-componentize` runs
+//! [`restore`] on the core module it takes out of the runtime component.
+
+use std::borrow::Cow;
+
+use anyhow::Context as _;
+use wasm_encoder::{CustomSection, RawSection, Section as _};
+use wasmparser::{Parser, Payload};
+
+/// The prefix of the sections [`preserve`] adds: each is named this, followed
+/// by the name of the section it copies.
+pub const PREFIX: &str = "starling:";
+
+/// The prefix of the names of the sections copied by [`preserve`].
+const SOURCE_PREFIX: &str = "component-type";
+
+/// Returns `module` with a copy of each of its `component-type*` sections
+/// appended, named [`PREFIX`] followed by the original name.
+///
+/// Returns `None` if `module` already has a section named with [`PREFIX`].
+/// Fails if `module` is not a core module, or has no `component-type*`
+/// section.
+pub fn preserve(module: &[u8]) -> anyhow::Result<Option<Vec<u8>>> {
+    if Parser::is_component(module) || !Parser::is_core_wasm(module) {
+        anyhow::bail!("not a core wasm module");
+    }
+    let mut copies = Vec::new();
+    for payload in Parser::new(0).parse_all(module) {
+        let Payload::CustomSection(section) = payload.context("parsing the core module")? else {
+            continue;
+        };
+        if section.name().starts_with(PREFIX) {
+            return Ok(None);
+        }
+        if section.name().starts_with(SOURCE_PREFIX) {
+            CustomSection {
+                name: Cow::Owned(format!("{PREFIX}{}", section.name())),
+                data: Cow::Borrowed(section.data()),
+            }
+            .append_to(&mut copies);
+        }
+    }
+    if copies.is_empty() {
+        anyhow::bail!("the core module has no `{SOURCE_PREFIX}` sections");
+    }
+    let mut preserved = Vec::with_capacity(module.len() + copies.len());
+    preserved.extend_from_slice(module);
+    preserved.extend_from_slice(&copies);
+    Ok(Some(preserved))
+}
+
+/// Returns the core module `module` with the [`PREFIX`] removed from the name
+/// of each section whose name starts with it, and the number of renamed
+/// sections.
+pub fn restore(module: &[u8]) -> anyhow::Result<(Vec<u8>, usize)> {
+    let mut restored = Vec::with_capacity(module.len());
+    restored.extend_from_slice(module.get(..8).context("truncated core module")?);
+    let mut renamed = 0;
+    for payload in Parser::new(0).parse_all(module) {
+        let payload = payload.context("parsing the core module")?;
+        if let Payload::CustomSection(section) = &payload {
+            if let Some(name) = section.name().strip_prefix(PREFIX) {
+                CustomSection {
+                    name: Cow::Borrowed(name),
+                    data: Cow::Borrowed(section.data()),
+                }
+                .append_to(&mut restored);
+                renamed += 1;
+                continue;
+            }
+        }
+        if let Some((id, range)) = payload.as_section() {
+            RawSection {
+                id,
+                data: &module[range.start as usize..range.end as usize],
+            }
+            .append_to(&mut restored);
+        }
+    }
+    Ok((restored, renamed))
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    /// The custom sections of `module`, by name and contents.
+    fn custom_sections(module: &[u8]) -> Vec<(String, Vec<u8>)> {
+        Parser::new(0)
+            .parse_all(module)
+            .filter_map(|payload| match payload.unwrap() {
+                Payload::CustomSection(section) => {
+                    Some((section.name().to_string(), section.data().to_vec()))
+                }
+                _ => None,
+            })
+            .collect()
+    }
+
+    fn module_with(sections: &[(&str, &[u8])]) -> Vec<u8> {
+        let mut module = wasm_encoder::Module::new();
+        for (name, data) in sections {
+            module.section(&CustomSection {
+                name: Cow::Borrowed(name),
+                data: Cow::Borrowed(data),
+            });
+        }
+        module.finish()
+    }
+
+    #[test]
+    fn copies_are_added_and_restored() {
+        let module = module_with(&[
+            ("component-type:a", b"a"),
+            ("name", b"n"),
+            ("component-type:b", b"b"),
+        ]);
+        let preserved = preserve(&module).unwrap().unwrap();
+        assert_eq!(&preserved[..module.len()], &module[..]);
+        assert_eq!(
+            custom_sections(&preserved)[3..],
+            [
+                ("starling:component-type:a".to_string(), b"a".to_vec()),
+                ("starling:component-type:b".to_string(), b"b".to_vec()),
+            ]
+        );
+        assert_eq!(preserve(&preserved).unwrap(), None);
+
+        // `wasm-tools component new` removes the originals.
+        let componentized = module_with(&[
+            ("name", b"n"),
+            ("starling:component-type:a", b"a"),
+            ("starling:component-type:b", b"b"),
+        ]);
+        let (restored, renamed) = restore(&componentized).unwrap();
+        assert_eq!(renamed, 2);
+        assert_eq!(
+            custom_sections(&restored),
+            [
+                ("name".to_string(), b"n".to_vec()),
+                ("component-type:a".to_string(), b"a".to_vec()),
+                ("component-type:b".to_string(), b"b".to_vec()),
+            ]
+        );
+    }
+
+    #[test]
+    fn modules_without_component_type_sections_are_refused() {
+        let error = preserve(&module_with(&[("name", b"n")])).unwrap_err();
+        assert!(error.to_string().contains("no `component-type`"), "{error}");
+        let error = preserve(&wasm_encoder::Component::new().finish()).unwrap_err();
+        assert!(error.to_string().contains("not a core"), "{error}");
+    }
+}
diff --git a/componentize/preserve-component-type/src/main.rs b/componentize/preserve-component-type/src/main.rs
new file mode 100644
index 00000000..b9a99b93
--- /dev/null
+++ b/componentize/preserve-component-type/src/main.rs
@@ -0,0 +1,28 @@
+// SPDX-License-Identifier: Apache-2.0-WITH-LLVM-exception
+
+//! Usage: `preserve-component-type <core module>`
+//!
+//! Rewrites the module in place with the copies `preserve_component_type::preserve` adds. A module
+//! that already has them is left unchanged.
+
+use anyhow::Context as _;
+
+fn main() -> anyhow::Result<()> {
+    let mut args = std::env::args_os().skip(1);
+    let (Some(path), None) = (args.next(), args.next()) else {
+        anyhow::bail!("usage: preserve-component-type <core module>");
+    };
+    let path = std::path::PathBuf::from(path);
+    let module = std::fs::read(&path).with_context(|| format!("reading `{}`", path.display()))?;
+    match preserve_component_type::preserve(&module)
+        .with_context(|| format!("`{}`", path.display()))?
+    {
+        Some(preserved) => {
+            std::fs::write(&path, preserved)
+                .with_context(|| format!("writing `{}`", path.display()))?;
+            println!("{}: copied the component-type sections", path.display());
+        }
+        None => println!("{}: already has the copies", path.display()),
+    }
+    Ok(())
+}
diff --git a/componentize/src/bin/starling-componentize.rs b/componentize/src/bin/starling-componentize.rs
new file mode 100644
index 00000000..08f5c45f
--- /dev/null
+++ b/componentize/src/bin/starling-componentize.rs
@@ -0,0 +1,13 @@
+// SPDX-License-Identifier: Apache-2.0-WITH-LLVM-exception
+
+/// The runtime `build.rs` embeds, which is empty when it found none.
+static EMBEDDED_RUNTIME: &[u8] = include_bytes!(concat!(env!("OUT_DIR"), "/runtime.wasm"));
+
+#[cfg(target_env = "musl")]
+#[global_allocator]
+static ALLOCATOR: mimalloc::MiMalloc = mimalloc::MiMalloc;
+
+fn main() -> anyhow::Result<()> {
+    let embedded = (!EMBEDDED_RUNTIME.is_empty()).then_some(EMBEDDED_RUNTIME);
+    componentize::command::run(std::env::args_os(), embedded)
+}
diff --git a/componentize/src/command.rs b/componentize/src/command.rs
new file mode 100644
index 00000000..509b5f6e
--- /dev/null
+++ b/componentize/src/command.rs
@@ -0,0 +1,822 @@
+// SPDX-License-Identifier: Apache-2.0-WITH-LLVM-exception
+
+//! The `starling-componentize` command-line tool.
+
+use {
+    crate::Wit,
+    anyhow::Context as _,
+    clap::Parser as _,
+    std::{
+        ffi::OsString,
+        fs,
+        io::Write,
+        path::{Path, PathBuf},
+    },
+    tokio::runtime::Builder as RuntimeBuilder,
+};
+
+/// A utility to convert JavaScript modules into Wasm components.
+#[derive(clap::Parser, Debug)]
+#[command(
+    name = "starling-componentize",
+    author,
+    about,
+    disable_version_flag = true
+)]
+pub struct Options {
+    #[command(flatten)]
+    pub common: Common,
+
+    /// Print the version of this componentizer and of the runtime `init`
+    /// interface it calls. For the runtime in `$STARLING_RUNTIME`, or else the
+    /// embedded runtime, also print the SHA-256 digest of its module and the
+    /// version of the `init` interface it implements.
+    #[arg(short = 'V', long)]
+    pub version: bool,
+
+    /// The subcommand to run, required unless `--version` is given.
+    #[command(subcommand)]
+    pub command: Option<Command>,
+}
+
+/// The name of the world selected by `--export-cli`, which exports
+/// `wasi:cli/run`. The component exports the runtime's implementation of
+/// `wasi:cli/run`, which calls the application's `run` function.
+const CLI_WORLD_NAME: &str = "command";
+
+/// The name of the world selected by `--export-http`, which exports
+/// `wasi:http/handler`. The interface is implemented by the application, or by
+/// the runtime, which dispatches each request to the `fetch` listeners that the
+/// application added while it was initialized.
+const SERVE_WORLD_NAME: &str = "serve";
+
+/// The WIT sources of the worlds selected by `--export-cli` and
+/// `--export-http`.
+///
+/// Each world exports an empty interface under the name of the runtime's export
+/// of that interface, such as `wasi:cli/run@0.3.0`. Without a runtime, or if
+/// the runtime doesn't export the interface, the name has no version.
+struct BuiltinWorlds {
+    /// The package `starling:cli` with the world [`CLI_WORLD_NAME`].
+    cli: String,
+    /// The package `starling:serve` with the world [`SERVE_WORLD_NAME`].
+    serve: String,
+}
+
+impl BuiltinWorlds {
+    fn new(runtime: Option<&crate::Runtime>) -> anyhow::Result<Self> {
+        let interface = |prefix: &str| -> anyhow::Result<String> {
+            let name = match runtime {
+                Some(runtime) => crate::builtin_export_name(runtime, prefix)?,
+                None => None,
+            };
+            Ok(name.unwrap_or_else(|| prefix.to_string()))
+        };
+        Ok(BuiltinWorlds {
+            cli: builtin_world_wit(
+                "starling:cli",
+                CLI_WORLD_NAME,
+                &interface(crate::CLI_RUN_INTERFACE_PREFIX)?,
+            ),
+            serve: builtin_world_wit(
+                "starling:serve",
+                SERVE_WORLD_NAME,
+                &interface(crate::HTTP_HANDLER_INTERFACE_PREFIX)?,
+            ),
+        })
+    }
+}
+
+/// The WIT source of the package `package` with the world `world`, which
+/// exports the empty interface `interface`, a name such as
+/// `wasi:cli/run@0.3.0` or `wasi:cli/run`.
+fn builtin_world_wit(package: &str, world: &str, interface: &str) -> String {
+    // `version` is empty or starts with the `@`.
+    let (path, version) = interface
+        .find('@')
+        .map_or((interface, ""), |at| interface.split_at(at));
+    let (interface_package, name) = path
+        .rsplit_once('/')
+        .expect("a builtin interface name has a package");
+    format!(
+        "package {package};\n\n\
+         world {world} {{\n  export {interface};\n}}\n\n\
+         package {interface_package}{version} {{\n  interface {name} {{}}\n}}\n"
+    )
+}
+
+#[derive(clap::Args, Clone, Debug)]
+pub struct Common {
+    /// Files or directories containing WIT documents.
+    ///
+    /// The packages in a directory's `deps` directory are loaded as well. This
+    /// can be repeated, for example: `-w ./wit/deps/<pkg> -w ./wit/app`. A
+    /// package defined in several places is merged into one, with the
+    /// interfaces and functions of each definition. The definitions must agree
+    /// on the functions they have in common.
+    ///
+    /// The target world also imports every interface that the runtime imports,
+    /// with the functions that the runtime imports, except those of the WASI
+    /// APIs named by `--disable`.
+    ///
+    /// `-w`, `--export-cli` or `--export-http` is required.
+    #[arg(short = 'w', long, global = true, value_name = "PATH")]
+    pub wit: Vec<PathBuf>,
+
+    /// Build a `wasi:cli/run` command component from a JavaScript module that
+    /// exports a `run` function.
+    ///
+    /// The application needs no WIT of its own. The component exports
+    /// `wasi:cli/run`, which calls the module's `run` export. With `-w`, the
+    /// selected world is merged with a world that exports `wasi:cli/run`. With
+    /// `--export-http`, the component also exports `wasi:http/handler`, and the
+    /// module must also handle requests.
+    #[arg(long, global = true)]
+    pub export_cli: bool,
+
+    /// Build a `wasi:http/handler` serve component from a JavaScript module that
+    /// either registers a `fetch` listener with `addEventListener('fetch', …)`
+    /// or exports its own implementation of the interface's `handle`.
+    ///
+    /// The application needs no WIT of its own. With a listener, the runtime's
+    /// `wasi:http/handler` export dispatches each request to it as a `fetch`
+    /// event. Componentization fails if the module does both or neither. With
+    /// `-w`, the selected world is merged with a world that exports
+    /// `wasi:http/handler`. With `--export-cli`, the component also exports
+    /// `wasi:cli/run`, and the module must also export a `run` function.
+    #[arg(long, global = true)]
+    pub export_http: bool,
+
+    /// The world to target: the name of a world in the last package loaded by
+    /// `-w`, or a qualified name such as `namespace:package/world@version`.
+    /// Defaults to that package's only world.
+    ///
+    /// Repeat it to target several worlds, which are merged into the world
+    /// `starling:componentize/merged`. That world imports and exports
+    /// everything that they do. Requires `-w`.
+    #[arg(
+        short = 'n',
+        long,
+        global = true,
+        requires = "wit",
+        value_name = "NAME"
+    )]
+    pub world_name: Vec<String>,
+
+    /// Disable non-error output, including the output that the application
+    /// prints while it is being initialized.
+    #[arg(short = 'q', long, global = true)]
+    pub quiet: bool,
+
+    /// WIT features to enable. Items annotated with `@unstable(feature = …)`
+    /// for an enabled feature are included in the WIT. Repeat, or separate
+    /// features with commas or whitespace.
+    #[arg(long, global = true)]
+    pub unstable_features: Vec<String>,
+
+    /// Enable every WIT feature, which includes every item annotated with
+    /// `@unstable` in the WIT.
+    #[arg(long, global = true)]
+    pub all_unstable_features: bool,
+
+    /// WASI APIs to leave out of the component. Repeat, or separate them with
+    /// commas.
+    ///
+    /// The component imports none of the interfaces of a disabled API. Calling
+    /// one of their functions traps, except that a disabled clock returns zero.
+    /// An API whose interfaces are used by the interfaces of another API can't
+    /// be disabled alone. The error names the API to disable with it.
+    #[arg(long, global = true, value_delimiter = ',', value_enum)]
+    pub disable: Vec<crate::finalize::WasiApiSet>,
+}
+
+#[derive(clap::Subcommand, Debug)]
+pub enum Command {
+    /// Generate a component from the specified JavaScript module.
+    Componentize(Box<Componentize>),
+    /// Generate TypeScript declarations (`.d.ts`) for the JavaScript module that
+    /// implements the selected world.
+    ///
+    /// The output declares the exports that the module must provide, and the
+    /// modules that it can import.
+    Types(Types),
+    /// Print the specifiers of the modules that the JavaScript module can import
+    /// for the selected world, one per line.
+    ///
+    /// A bundler must leave these imports unresolved. There is one module per
+    /// imported interface, and `external` for the functions and types imported
+    /// directly by the world. An interface is only listed if its module exports
+    /// something: a function, a resource class, an error class, or an enum or
+    /// flags object.
+    Imports(Imports),
+}
+
+#[derive(clap::Args, Debug)]
+pub struct Componentize {
+    /// The filename of a JavaScript module from which to generate a component.
+    pub input: PathBuf,
+
+    /// The directory within which the relative imports of the input, and of the
+    /// modules it imports, are resolved. Defaults to the input's directory.
+    #[arg(short = 'p', long)]
+    pub base_directory: Option<PathBuf>,
+
+    /// Output file to which to write the resulting component.
+    #[arg(short = 'o', long, default_value = "js.wasm")]
+    pub output: PathBuf,
+
+    #[command(flatten)]
+    pub runtime: RuntimeArg,
+
+    /// The URL `globalThis.location` reflects while the application's top level
+    /// runs. If not provided, reading `location` there throws a `TypeError`, which
+    /// fails componentization unless the application catches it.
+    #[arg(long)]
+    pub init_location: Option<url::Url>,
+
+    /// Leave `wasi:random/insecure-seed` out of the component's imports, and
+    /// make `get-insecure-seed` always return SEED, split into its high and low
+    /// 64 bits. SEED is a 128-bit number, in decimal or with a `0x` prefix in
+    /// hex.
+    ///
+    /// SpiderMonkey seeds its hash tables from this interface. With SEED, an
+    /// attacker can craft input that collides in those tables and slows the
+    /// application down drastically. Use this only if the component must not
+    /// import the interface, and never with untrusted input.
+    #[arg(long, value_name = "SEED", value_parser = parse_seed)]
+    pub deterministic_insecure_random_seed: Option<u128>,
+
+    /// Keep the compiled component out of wasmtime's global compilation cache.
+    #[arg(long)]
+    pub no_cache: bool,
+}
+
+#[derive(clap::Args, Debug)]
+pub struct Types {
+    /// Output file for the generated `.d.ts`. Defaults to stdout.
+    #[arg(short = 'o', long)]
+    pub output: Option<PathBuf>,
+
+    #[command(flatten)]
+    pub runtime: RuntimeArg,
+}
+
+#[derive(clap::Args, Debug)]
+pub struct Imports {
+    #[command(flatten)]
+    pub runtime: RuntimeArg,
+}
+
+/// The runtime used by a subcommand.
+#[derive(clap::Args, Debug)]
+pub struct RuntimeArg {
+    /// Path to the StarlingMonkey runtime to use. If not provided, the runtime embedded in this
+    /// tool is used.
+    ///
+    /// [env: STARLING_RUNTIME=]
+    // `$STARLING_RUNTIME` is read by [`RuntimeArg::load`], which `--version` uses without a
+    // subcommand.
+    #[arg(long)]
+    pub runtime: Option<PathBuf>,
+}
+
+impl RuntimeArg {
+    /// Load the runtime at `--runtime`, or else at `$STARLING_RUNTIME`, or else
+    /// `embedded`. Returns `None` if none of them is given.
+    fn load(&self, embedded: Option<&[u8]>) -> anyhow::Result<Option<crate::Runtime>> {
+        let path = self
+            .runtime
+            .clone()
+            .or_else(|| std::env::var_os("STARLING_RUNTIME").map(PathBuf::from));
+        match (path, embedded) {
+            (Some(path), _) => crate::Runtime::new(
+                fs::read(&path).with_context(|| format!("unable to read `{}`", path.display()))?,
+            )
+            .map(Some),
+            (None, Some(embedded)) => crate::Runtime::new(embedded.to_vec()).map(Some),
+            (None, None) => Ok(None),
+        }
+    }
+}
+
+/// Run the command line `args`. `embedded_runtime` is the runtime embedded in the
+/// binary, which is used if neither `--runtime` nor `$STARLING_RUNTIME` is given.
+pub fn run<T: Into<OsString> + Clone, I: IntoIterator<Item = T>>(
+    args: I,
+    embedded_runtime: Option<&[u8]>,
+) -> anyhow::Result<()> {
+    let options = Options::parse_from(args);
+    if options.version {
+        return print_version(embedded_runtime);
+    }
+    match options.command {
+        Some(Command::Componentize(opts)) => componentize(options.common, *opts, embedded_runtime),
+        Some(Command::Types(opts)) => types(options.common, opts, embedded_runtime),
+        Some(Command::Imports(opts)) => imports(options.common, opts, embedded_runtime),
+        None => <Options as clap::CommandFactory>::command()
+            .error(
+                clap::error::ErrorKind::MissingSubcommand,
+                "a subcommand or `--version` is required",
+            )
+            .exit(),
+    }
+}
+
+/// Select the WIT source and the target worlds from `common`. The built-in
+/// worlds of `--export-cli` and `--export-http`, whose sources are in `worlds`,
+/// are merged with the worlds selected with `-w`. Without `-w`, only the
+/// built-in worlds are selected.
+fn select_wit<'a>(
+    common: &'a Common,
+    worlds: &'a BuiltinWorlds,
+) -> anyhow::Result<(Wit<'a>, crate::WorldSelection<'a>)> {
+    let mut builtins = Vec::new();
+    if common.export_cli {
+        builtins.push((worlds.cli.as_str(), CLI_WORLD_NAME));
+    }
+    if common.export_http {
+        builtins.push((worlds.serve.as_str(), SERVE_WORLD_NAME));
+    }
+    match common.wit.as_slice() {
+        [] if builtins.is_empty() => anyhow::bail!(
+            "no world to target: pass `-w|--wit` with a WIT file or directory, `--export-cli` \
+             for a `wasi:cli/run` command, and/or `--export-http` for a `wasi:http/handler` \
+             server"
+        ),
+        [] => {
+            let (wit, name) = builtins.remove(0);
+            Ok((
+                Wit::String(wit),
+                crate::WorldSelection {
+                    worlds: vec![name],
+                    builtins,
+                    resolved: Vec::new(),
+                },
+            ))
+        }
+        paths => Ok((
+            Wit::Paths(paths),
+            crate::WorldSelection {
+                worlds: common.world_name.iter().map(String::as_str).collect(),
+                builtins,
+                resolved: Vec::new(),
+            },
+        )),
+    }
+}
+
+/// Load the world described by the `types` and `imports` subcommands, from
+/// `common` and the runtime selected by `runtime`, if any.
+fn load_types_world(
+    common: &Common,
+    runtime: &RuntimeArg,
+    embedded_runtime: Option<&[u8]>,
+) -> anyhow::Result<(wit_parser::Resolve, wit_parser::WorldId)> {
+    let runtime = runtime.load(embedded_runtime)?;
+    let builtin_worlds = BuiltinWorlds::new(runtime.as_ref())?;
+    let (wit, mut world) = select_wit(common, &builtin_worlds)?;
+    if let Some(runtime) = &runtime {
+        world
+            .resolved
+            .push(crate::runtime_imports_world(runtime, &common.disable)?);
+    }
+    crate::load_world_for_types(
+        wit,
+        world,
+        &common.unstable_features,
+        common.all_unstable_features,
+        runtime.as_ref(),
+    )
+}
+
+fn types(common: Common, opts: Types, embedded_runtime: Option<&[u8]>) -> anyhow::Result<()> {
+    let (resolve, world) = load_types_world(&common, &opts.runtime, embedded_runtime)?;
+    let dts = crate::wit_to_ts::generate(&resolve, world)?;
+    match &opts.output {
+        Some(path) => {
+            fs::write(path, &dts)
+                .with_context(|| format!("unable to write `{}`", path.display()))?;
+            if !common.quiet {
+                println!("Wrote TypeScript declarations to `{}`", path.display());
+            }
+        }
+        None => print!("{dts}"),
+    }
+    Ok(())
+}
+
+fn imports(common: Common, opts: Imports, embedded_runtime: Option<&[u8]>) -> anyhow::Result<()> {
+    let (resolve, world) = load_types_world(&common, &opts.runtime, embedded_runtime)?;
+    for module in crate::wit_to_ts::import_modules(&resolve, world) {
+        println!("{module}");
+    }
+    Ok(())
+}
+
+/// Print output for `--version` (see [`Options::version`]).
+fn print_version(embedded_runtime: Option<&[u8]>) -> anyhow::Result<()> {
+    let runtime = RuntimeArg { runtime: None }.load(embedded_runtime)?;
+    write_version(&mut std::io::stdout().lock(), runtime.as_ref())
+}
+
+/// Write the output of `--version` for `runtime` to `out`.
+fn write_version(out: &mut impl Write, runtime: Option<&crate::Runtime>) -> anyhow::Result<()> {
+    use sha2::Digest as _;
+    writeln!(out, "starling-componentize {}", env!("CARGO_PKG_VERSION"))?;
+    writeln!(out, "calls {}", crate::init_interface_name())?;
+    let Some(runtime) = runtime else {
+        writeln!(
+            out,
+            "runtime none: this componentizer embeds none, and STARLING_RUNTIME is unset"
+        )?;
+        return Ok(());
+    };
+    writeln!(
+        out,
+        "runtime sha256:{}",
+        hex::encode(sha2::Sha256::digest(runtime.module()))
+    )?;
+    match crate::runtime_init_interface(runtime)? {
+        Some(name) => writeln!(out, "runtime implements {name}")?,
+        None => writeln!(
+            out,
+            "runtime implements no {}",
+            crate::INIT_INTERFACE_PREFIX
+        )?,
+    }
+    Ok(())
+}
+
+/// Return `runtime`, the runtime selected on the command line, or an error if
+/// none was selected.
+fn select_runtime(runtime: Option<crate::Runtime>) -> anyhow::Result<crate::Runtime> {
+    runtime.ok_or_else(|| {
+        anyhow::anyhow!(
+            "this componentizer embeds no runtime. Pass --runtime with the path of a \
+             starling.wasm, which `just build-runtime` builds"
+        )
+    })
+}
+
+/// The directory of the file `input`, the default `--base-directory`.
+fn default_base_directory(input: &Path) -> PathBuf {
+    match input.parent() {
+        Some(parent) if !parent.as_os_str().is_empty() => parent.to_path_buf(),
+        _ => PathBuf::from("."),
+    }
+}
+
+/// Parse a 128-bit seed, in decimal or with a `0x` prefix in hex.
+fn parse_seed(seed: &str) -> Result<u128, std::num::ParseIntError> {
+    match seed.strip_prefix("0x") {
+        Some(hex) => u128::from_str_radix(hex, 16),
+        None => seed.parse(),
+    }
+}
+
+fn componentize(
+    common: Common,
+    componentize: Componentize,
+    embedded_runtime: Option<&[u8]>,
+) -> anyhow::Result<()> {
+    let input = fs::read_to_string(&componentize.input)
+        .with_context(|| format!("unable to read `{}`", componentize.input.display()))?;
+
+    // The WIT is parsed first, so that an invalid `-w` or world is reported
+    // before the runtime is read. `crate::componentize` parses it again, because
+    // it modifies the `Resolve`. The built-in worlds name their interfaces
+    // without a version here, because the runtime isn't read yet.
+    let unversioned_worlds = BuiltinWorlds::new(None)?;
+    let (wit, world) = select_wit(&common, &unversioned_worlds)?;
+    crate::load_world(
+        wit,
+        world,
+        &common.unstable_features,
+        common.all_unstable_features,
+    )?;
+
+    let runtime = select_runtime(componentize.runtime.load(embedded_runtime)?)?;
+
+    let builtin_worlds = BuiltinWorlds::new(Some(&runtime))?;
+    let (wit, mut world) = select_wit(&common, &builtin_worlds)?;
+    world
+        .resolved
+        .push(crate::runtime_imports_world(&runtime, &common.disable)?);
+    let base_directory = componentize
+        .base_directory
+        .clone()
+        .unwrap_or_else(|| default_base_directory(&componentize.input));
+
+    let output = RuntimeBuilder::new_current_thread()
+        .enable_all()
+        .build()?
+        .block_on(crate::componentize(
+            wit,
+            world,
+            crate::JsSource {
+                name: &componentize.input.display().to_string(),
+                text: &input,
+            },
+            &runtime,
+            &crate::ComponentizeOptions {
+                features: &common.unstable_features,
+                all_features: common.all_unstable_features,
+                base_directory: Some(&base_directory),
+                disabled: &common.disable,
+                insecure_seed: componentize.deterministic_insecure_random_seed,
+                init_location: componentize.init_location.as_ref().map(url::Url::as_str),
+                cache: !componentize.no_cache,
+            },
+        ))?;
+
+    if !common.quiet {
+        print!("{}", output.init_output);
+    }
+    fs::write(&componentize.output, &output.component)
+        .with_context(|| format!("unable to write `{}`", componentize.output.display()))?;
+
+    if !common.quiet {
+        println!("Component built successfully");
+    }
+
+    Ok(())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn cli_parses() {
+        let options = Options::try_parse_from([
+            "starling-componentize",
+            "--wit",
+            "wit",
+            "--world-name",
+            "hello",
+            "componentize",
+            "app.js",
+            "-o",
+            "out.wasm",
+        ])
+        .unwrap();
+        assert_eq!(options.common.wit, [PathBuf::from("wit")]);
+        assert_eq!(options.common.world_name, ["hello"]);
+        assert!(!options.common.export_cli);
+        let Some(Command::Componentize(c)) = &options.command else {
+            panic!("expected the componentize subcommand");
+        };
+        assert_eq!(c.input, PathBuf::from("app.js"));
+        assert_eq!(c.output, PathBuf::from("out.wasm"));
+        // `STARLING_RUNTIME` is read when the runtime is loaded, not parsed into
+        // the option.
+        assert_eq!(c.runtime.runtime, None);
+    }
+
+    /// The seed is a 128-bit number in decimal or `0x`-prefixed hex.
+    #[test]
+    fn deterministic_insecure_random_seed_parses() {
+        let seed = |value: &str| {
+            let options = Options::try_parse_from([
+                "starling-componentize",
+                "--export-cli",
+                "componentize",
+                "app.js",
+                "--deterministic-insecure-random-seed",
+                value,
+            ])?;
+            let Some(Command::Componentize(c)) = options.command else {
+                panic!("expected the componentize subcommand");
+            };
+            Ok::<_, clap::Error>(c.deterministic_insecure_random_seed)
+        };
+        assert_eq!(seed("42").unwrap(), Some(42));
+        assert_eq!(seed("0x2a").unwrap(), Some(42));
+        assert_eq!(seed(&u128::MAX.to_string()).unwrap(), Some(u128::MAX));
+        for invalid in [
+            "-1",
+            "0x",
+            "seed",
+            "340282366920938463463374607431768211456",
+        ] {
+            assert!(seed(invalid).is_err(), "{invalid}");
+        }
+    }
+
+    #[test]
+    fn types_subcommand_parses() {
+        let options = Options::try_parse_from([
+            "starling-componentize",
+            "-w",
+            "wit",
+            "-n",
+            "hello",
+            "types",
+            "-o",
+            "world.d.ts",
+        ])
+        .unwrap();
+        assert_eq!(options.common.world_name, ["hello"]);
+        let Some(Command::Types(t)) = &options.command else {
+            panic!("expected the types subcommand");
+        };
+        assert_eq!(t.output, Some(PathBuf::from("world.d.ts")));
+    }
+
+    /// `-n` may repeat, and `--export-http` with `-w` adds the built-in serve
+    /// world to the worlds it names.
+    #[test]
+    fn several_worlds_and_the_serve_world() {
+        let options = Options::try_parse_from([
+            "starling-componentize",
+            "--export-http",
+            "-w",
+            "a",
+            "-w",
+            "b",
+            "-n",
+            "x:y/one",
+            "-n",
+            "two",
+            "componentize",
+            "app.js",
+        ])
+        .unwrap();
+        let worlds = BuiltinWorlds::new(None).unwrap();
+        let (wit, selection) = select_wit(&options.common, &worlds).unwrap();
+        assert!(matches!(wit, Wit::Paths(paths) if paths.len() == 2));
+        assert_eq!(selection.worlds, ["x:y/one", "two"]);
+        assert_eq!(
+            selection.builtins,
+            [(worlds.serve.as_str(), SERVE_WORLD_NAME)]
+        );
+    }
+
+    /// `-n` names a world in the WIT `-w` loads, so it requires `-w`.
+    #[test]
+    fn world_name_requires_wit() {
+        let err = Options::try_parse_from([
+            "starling-componentize",
+            "--export-http",
+            "-n",
+            "app",
+            "componentize",
+            "app.js",
+        ])
+        .unwrap_err();
+        assert_eq!(err.kind(), clap::error::ErrorKind::MissingRequiredArgument);
+    }
+
+    /// `--version` without a runtime prints the componentizer's version, the
+    /// interface it calls, and a `runtime none` line.
+    #[test]
+    fn version_without_a_runtime_says_so() {
+        let mut out = Vec::new();
+        write_version(&mut out, None).unwrap();
+        assert_eq!(
+            String::from_utf8(out).unwrap(),
+            format!(
+                "starling-componentize {}\ncalls {}\nruntime none: this componentizer embeds \
+                 none, and STARLING_RUNTIME is unset\n",
+                env!("CARGO_PKG_VERSION"),
+                crate::init_interface_name()
+            )
+        );
+    }
+
+    /// Componentizing without a runtime fails, naming the flag to pass.
+    #[test]
+    fn componentizing_without_a_runtime_names_the_flag() {
+        let error = select_runtime(None).err().unwrap().to_string();
+        assert!(
+            error.starts_with("this componentizer embeds no runtime. Pass --runtime"),
+            "{error}"
+        );
+    }
+
+    /// `-V` and `--version` need no subcommand.
+    #[test]
+    fn version_flag_parses_without_a_subcommand() {
+        for flag in ["-V", "--version"] {
+            let options = Options::try_parse_from(["starling-componentize", flag]).unwrap();
+            assert!(options.version && options.command.is_none(), "{flag}");
+        }
+    }
+
+    /// `--export-cli` and `--export-http` combine. Without `-w`, they target the
+    /// two built-in worlds, merged into one exporting both interfaces. Without a
+    /// runtime, the interfaces have no version.
+    #[test]
+    fn export_cli_and_export_http_combine() {
+        let options = Options::try_parse_from([
+            "starling-componentize",
+            "--export-http",
+            "--export-cli",
+            "componentize",
+            "app.js",
+        ])
+        .unwrap();
+        let worlds = BuiltinWorlds::new(None).unwrap();
+        let (wit, selection) = select_wit(&options.common, &worlds).unwrap();
+        assert!(matches!(wit, Wit::String(wit) if wit == worlds.cli));
+        assert_eq!(selection.worlds, [CLI_WORLD_NAME]);
+        assert_eq!(
+            selection.builtins,
+            [(worlds.serve.as_str(), SERVE_WORLD_NAME)]
+        );
+
+        let (resolve, world) = crate::load_world(wit, selection, &[], false).unwrap();
+        let exports: Vec<String> = resolve.worlds[world]
+            .exports
+            .keys()
+            .map(|key| resolve.name_world_key(key))
+            .collect();
+        assert_eq!(exports, ["wasi:cli/run", "wasi:http/handler"]);
+    }
+
+    /// A built-in world exports its interface under the name it is given,
+    /// version included.
+    #[test]
+    fn builtin_world_exports_the_named_version() {
+        let wit = builtin_world_wit("starling:cli", CLI_WORLD_NAME, "wasi:cli/run@0.3.0-rc.1");
+        let (resolve, world) = crate::load_world(
+            Wit::<PathBuf>::String(&wit),
+            Some(CLI_WORLD_NAME),
+            &[],
+            false,
+        )
+        .unwrap();
+        let exports: Vec<String> = resolve.worlds[world]
+            .exports
+            .keys()
+            .map(|key| resolve.name_world_key(key))
+            .collect();
+        assert_eq!(exports, ["wasi:cli/run@0.3.0-rc.1"]);
+    }
+
+    /// With `-w`, `--export-cli` and `--export-http` both add their built-in world.
+    #[test]
+    fn export_cli_and_export_http_combine_with_wit() {
+        let options = Options::try_parse_from([
+            "starling-componentize",
+            "--export-cli",
+            "--export-http",
+            "-w",
+            "wit",
+            "componentize",
+            "app.js",
+        ])
+        .unwrap();
+        let worlds = BuiltinWorlds::new(None).unwrap();
+        let (_, selection) = select_wit(&options.common, &worlds).unwrap();
+        assert!(selection.worlds.is_empty());
+        assert_eq!(
+            selection.builtins,
+            [
+                (worlds.cli.as_str(), CLI_WORLD_NAME),
+                (worlds.serve.as_str(), SERVE_WORLD_NAME)
+            ]
+        );
+    }
+
+    #[test]
+    fn wit_required_unless_export_cli_or_export_http() {
+        let options =
+            Options::try_parse_from(["starling-componentize", "componentize", "app.js"]).unwrap();
+        let worlds = BuiltinWorlds::new(None).unwrap();
+        let error = select_wit(&options.common, &worlds)
+            .err()
+            .expect("no world is selected");
+        assert!(
+            error.to_string().starts_with("no world to target"),
+            "{error}"
+        );
+    }
+
+    /// The common flags may follow the subcommand.
+    #[test]
+    fn common_flags_follow_the_subcommand() {
+        let options = Options::try_parse_from([
+            "starling-componentize",
+            "componentize",
+            "--export-cli",
+            "app.js",
+            "-q",
+        ])
+        .unwrap();
+        assert!(options.common.export_cli && options.common.quiet);
+    }
+
+    /// The base directory defaults to the input's directory.
+    #[test]
+    fn base_directory_defaults_to_the_input_directory() {
+        assert_eq!(
+            default_base_directory(Path::new("src/app.js")),
+            PathBuf::from("src")
+        );
+        assert_eq!(
+            default_base_directory(Path::new("app.js")),
+            PathBuf::from(".")
+        );
+    }
+}
diff --git a/componentize/src/finalize.rs b/componentize/src/finalize.rs
new file mode 100644
index 00000000..a6491609
--- /dev/null
+++ b/componentize/src/finalize.rs
@@ -0,0 +1,904 @@
+// SPDX-License-Identifier: Apache-2.0-WITH-LLVM-exception
+
+//! Wrapping a wizened component so that it exports only the world's exports, and
+//! doesn't import from disabled WASI APIs.
+//!
+//! A wizened component exports everything that the runtime exports, such as the
+//! `starling:componentize/init` interface, `wizer-initialize`, and the
+//! runtime's `wasi:cli/run` and `wasi:http/handler`, in addition to the world's
+//! exports. It imports every WASI interface that the runtime imports, whether or
+//! not the application uses it. [`finalize`] wraps it in a composition that
+//! exports only the names in `keep_exports`, and that satisfies the imports of
+//! every disabled [`WasiApiSet`] with a stub component.
+//!
+//! The stub component is generated from the snapshot's own import types, so the
+//! resource types that the remaining imports share with the stubbed ones stay
+//! the same types. An interface whose types are used by a remaining interface
+//! can't be stubbed, because the composition would have to import it twice.
+//!
+//! The stub functions trap, with two exceptions:
+//!
+//! - The `now` function of each `wasi:clocks` interface returns zero, because
+//!   the runtime calls it whether or not the application does. For example, the
+//!   event loop reads the monotonic clock on its first step.
+//! - If an insecure seed is given, `wasi:random/insecure-seed` is stubbed as
+//!   well, and its `get-insecure-seed` returns the seed. SpiderMonkey seeds its
+//!   hash tables from this function.
+
+use std::collections::HashMap;
+
+use anyhow::{bail, Context as _};
+use indexmap::IndexSet;
+use wac_graph::{types::Package, CompositionGraph, EncodeOptions};
+use wit_parser::{
+    abi::{AbiVariant, WasmSignature, WasmType},
+    decoding::DecodedWasm,
+    Function, InterfaceId, ManglingAndAbi, PackageName, Resolve, Type, TypeDefKind, TypeOwner,
+    WasmExport, WasmExportKind, World, WorldId, WorldItem, WorldKey,
+};
+
+/// Sets of WASI APIs the componentizer can disable.
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, clap::ValueEnum)]
+pub enum WasiApiSet {
+    /// `wasi:cli/std*` and `wasi:cli/terminal-*`: `console` output and the
+    /// standard io streams.
+    Stdio,
+    /// `wasi:random/random`: `Math.random` seeding and `crypto.getRandomValues`.
+    /// SpiderMonkey calls `wasi:random/insecure-seed` regardless, which only
+    /// `--deterministic-insecure-random-seed` removes.
+    Random,
+    /// `wasi:clocks/*`: `Date.now`, `performance.now`, and timers.
+    Clocks,
+    /// `wasi:http/*`: `fetch`.
+    Http,
+    /// `wasi:filesystem/*`: module loading from disk.
+    Filesystem,
+}
+
+impl WasiApiSet {
+    /// The interface-name prefixes of the feature's interfaces, without the
+    /// package version.
+    fn prefixes(self) -> &'static [&'static str] {
+        match self {
+            WasiApiSet::Stdio => &[
+                "wasi:cli/stdin",
+                "wasi:cli/stdout",
+                "wasi:cli/stderr",
+                "wasi:cli/terminal-",
+            ],
+            WasiApiSet::Random => &["wasi:random/random"],
+            WasiApiSet::Clocks => &["wasi:clocks/"],
+            WasiApiSet::Http => &["wasi:http/"],
+            WasiApiSet::Filesystem => &["wasi:filesystem/"],
+        }
+    }
+
+    /// Whether the interface `name`, such as `wasi:http/types@0.3.0`, belongs
+    /// to the feature.
+    pub(crate) fn owns(self, name: &str) -> bool {
+        self.prefixes()
+            .iter()
+            .any(|prefix| name.starts_with(prefix))
+    }
+
+    /// The name of the feature for `--disable`.
+    fn name(self) -> String {
+        clap::ValueEnum::to_possible_value(&self)
+            .expect("no variant is skipped")
+            .get_name()
+            .to_string()
+    }
+}
+
+/// Interfaces not owned by any feature, stubbed once every interface using
+/// their types is stubbed.
+///
+/// `wasi:io` defines the p2 streams and pollables. `wasi:cli/types` defines the
+/// `error-code` returned by the p3 standard streams. Neither is reached except
+/// through an interface owned by a feature.
+const DEPENDENCY_ONLY: &[&str] = &["wasi:io/", "wasi:cli/types"];
+
+/// The package the generated stub world lives in.
+const STUB_PACKAGE: (&str, &str) = ("starling", "stubs");
+
+/// The address of the zeroed return area. A zero-returning stub returns a
+/// pointer to it.
+const ZERO_AREA: i32 = 8;
+
+/// The address of the return area of the deterministic `get-insecure-seed`,
+/// which writes its seed there and returns a pointer to it.
+const SEED_AREA: i32 = 16;
+
+/// The interface stubbed if an insecure seed is given, without the package
+/// version.
+const INSECURE_SEED_INTERFACE: &str = "wasi:random/insecure-seed";
+
+/// An export of the snapshot that the finalized component keeps.
+///
+/// Both names are component export names: an interface's WIT name
+/// (`starling:bench/api`) or a plain name, such as the name of a world-level
+/// function.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct KeptExport {
+    /// The snapshot's name for the export.
+    pub snapshot_name: String,
+    /// The finalized component's name for the export.
+    pub name: String,
+}
+
+impl KeptExport {
+    /// An export kept under the snapshot's name for it.
+    pub fn unrenamed(name: String) -> Self {
+        KeptExport {
+            snapshot_name: name.clone(),
+            name,
+        }
+    }
+}
+
+/// Wrap `snapshot` so the result exports exactly `keep_exports` and imports
+/// nothing from the interfaces of `disabled`. If `insecure_seed` is set, it
+/// also doesn't import `wasi:random/insecure-seed`, and `get-insecure-seed`
+/// returns the seed's high and low 64 bits, in that order.
+///
+/// Fails if the snapshot does not export a [`KeptExport::snapshot_name`].
+pub fn finalize(
+    snapshot: &[u8],
+    keep_exports: &[KeptExport],
+    disabled: &[WasiApiSet],
+    insecure_seed: Option<u128>,
+) -> anyhow::Result<Vec<u8>> {
+    let DecodedWasm::Component(mut resolve, world) =
+        wit_parser::decoding::decode(snapshot).context("decoding the snapshot's world")?
+    else {
+        bail!("the snapshot is not a component");
+    };
+
+    let stubbed = stub_set(
+        &resolve,
+        world,
+        keep_exports,
+        disabled,
+        insecure_seed.is_some(),
+    )?;
+    let stub_names: Vec<String> = stubbed
+        .iter()
+        .map(|id| interface_name(&resolve, world, *id))
+        .collect();
+
+    let stub = if stubbed.is_empty() {
+        None
+    } else {
+        Some(stub_component(&mut resolve, &stubbed, insecure_seed)?)
+    };
+
+    let mut graph = CompositionGraph::new();
+    let main = Package::from_bytes("main", None, snapshot.to_vec(), graph.types_mut())
+        .context("registering the snapshot")?;
+    let main = graph.register_package(main)?;
+    let main_instance = graph.instantiate(main);
+    if let Some(stub) = stub {
+        let stub = Package::from_bytes("stubs", None, stub, graph.types_mut())
+            .context("registering the stub component")?;
+        let stub = graph.register_package(stub)?;
+        // The stub is instantiated before the main instance, so its imports
+        // come first among the composition's imports. Those are the interfaces
+        // that the stubbed interfaces use.
+        let stub_instance = graph.instantiate(stub);
+        for name in &stub_names {
+            let export = graph.alias_instance_export(stub_instance, name)?;
+            graph.set_instantiation_argument(main_instance, name, export)?;
+        }
+    }
+    for kept in keep_exports {
+        let snapshot_name = &kept.snapshot_name;
+        let export = graph
+            .alias_instance_export(main_instance, snapshot_name)
+            .with_context(|| format!("the snapshot does not export `{snapshot_name}`"))?;
+        graph.export(export, &kept.name)?;
+    }
+    graph
+        .encode(EncodeOptions::default())
+        .context("encoding the finalized component")
+}
+
+/// The imported interfaces to stub: every interface of a disabled feature,
+/// `wasi:random/insecure-seed` if `seeded` is set, and each dependency-only
+/// interface not used by any remaining interface.
+fn stub_set(
+    resolve: &Resolve,
+    world: WorldId,
+    keep_exports: &[KeptExport],
+    disabled: &[WasiApiSet],
+    seeded: bool,
+) -> anyhow::Result<IndexSet<InterfaceId>> {
+    let imports: Vec<InterfaceId> = resolve.worlds[world]
+        .imports
+        .values()
+        .filter_map(|item| match item {
+            WorldItem::Interface { id, .. } => Some(*id),
+            _ => None,
+        })
+        .collect();
+    let owner = |id: InterfaceId| -> Option<WasiApiSet> {
+        let name = interface_name(resolve, world, id);
+        disabled.iter().copied().find(|f| f.owns(&name))
+    };
+    // The feature an interface belongs to, disabled or not.
+    let feature_of = |id: InterfaceId| -> Option<WasiApiSet> {
+        let name = interface_name(resolve, world, id);
+        <WasiApiSet as clap::ValueEnum>::value_variants()
+            .iter()
+            .copied()
+            .find(|f| f.owns(&name))
+    };
+    let dependency_only = |id: InterfaceId| {
+        let name = interface_name(resolve, world, id);
+        DEPENDENCY_ONLY.iter().any(|p| name.starts_with(p))
+    };
+
+    let insecure_seed = |id: InterfaceId| {
+        seeded && interface_name(resolve, world, id).starts_with(INSECURE_SEED_INTERFACE)
+    };
+
+    let mut stubbed: IndexSet<InterfaceId> = imports
+        .iter()
+        .copied()
+        .filter(|id| owner(*id).is_some() || dependency_only(*id) || insecure_seed(*id))
+        .collect();
+
+    // The interfaces whose types the world `use`s at its top level. If one of
+    // them belongs to a disabled feature, an error is reported. Dependency-only
+    // interfaces among them are kept rather than stubbed.
+    let world_deps: IndexSet<InterfaceId> = resolve.worlds[world]
+        .imports
+        .values()
+        .chain(resolve.worlds[world].exports.values())
+        .filter_map(|item| match item {
+            WorldItem::Type { id, .. } => match resolve.types[*id].kind {
+                TypeDefKind::Type(Type::Id(used)) => match resolve.types[used].owner {
+                    TypeOwner::Interface(interface) => Some(interface),
+                    _ => None,
+                },
+                _ => None,
+            },
+            _ => None,
+        })
+        .collect();
+    let world_uses: Vec<String> = world_deps
+        .iter()
+        .filter_map(|dep| {
+            owner(*dep).map(|feature| {
+                format!(
+                    "`{}` of `{}` is used by the world",
+                    interface_name(resolve, world, *dep),
+                    feature.name(),
+                )
+            })
+        })
+        .collect();
+    stubbed.retain(|id| owner(*id).is_some() || !world_deps.contains(id));
+
+    // The interfaces that are kept: the remaining imports and the kept exports.
+    // Every interface they use is kept as well.
+    let kept_exports: Vec<InterfaceId> = resolve.worlds[world]
+        .exports
+        .iter()
+        .filter(|(key, _)| {
+            let name = resolve.name_world_key(key);
+            keep_exports.iter().any(|kept| kept.snapshot_name == name)
+        })
+        .filter_map(|(_, item)| match item {
+            WorldItem::Interface { id, .. } => Some(*id),
+            _ => None,
+        })
+        .collect();
+    loop {
+        let users: Vec<InterfaceId> = imports
+            .iter()
+            .copied()
+            .filter(|id| !stubbed.contains(id))
+            .chain(kept_exports.iter().copied())
+            .collect();
+        let mut unstubbed = None;
+        // Each use of an interface of a disabled feature by a kept interface,
+        // given as the feature, the used interface and the using interface.
+        let mut conflicts = Vec::new();
+        for user in users {
+            for dep in resolve.interface_direct_deps(user) {
+                if !stubbed.contains(&dep) {
+                    continue;
+                }
+                match owner(dep) {
+                    Some(feature) if !conflicts.contains(&(feature, dep, user)) => {
+                        conflicts.push((feature, dep, user))
+                    }
+                    Some(_) => {}
+                    None => unstubbed = unstubbed.or(Some(dep)),
+                }
+            }
+        }
+        if !conflicts.is_empty() || !world_uses.is_empty() {
+            let uses: Vec<String> = world_uses
+                .iter()
+                .cloned()
+                .chain(conflicts.iter().map(|(feature, dep, user)| {
+                    let user_is = if kept_exports.contains(user) {
+                        ", which the component exports".to_string()
+                    } else {
+                        feature_of(*user)
+                            .map(|f| format!(" (feature `{}`)", f.name()))
+                            .unwrap_or_default()
+                    };
+                    format!(
+                        "`{}` of `{}` is used by `{}`{user_is}",
+                        interface_name(resolve, world, *dep),
+                        feature.name(),
+                        interface_name(resolve, world, *user)
+                    )
+                }))
+                .collect();
+            // The features that must be disabled as well: the features of the remaining
+            // imports that use a disabled feature, except those already disabled.
+            let mut also: Vec<String> = conflicts
+                .iter()
+                .filter(|(_, _, user)| !kept_exports.contains(user))
+                .filter_map(|(_, _, user)| feature_of(*user))
+                .filter(|feature| !disabled.contains(feature))
+                .map(|feature| feature.name())
+                .collect();
+            also.sort_unstable();
+            also.dedup();
+            let hint = if also.is_empty() {
+                String::new()
+            } else {
+                format!(
+                    " Disable {} as well.",
+                    also.iter()
+                        .map(|name| format!("`{name}`"))
+                        .collect::<Vec<_>>()
+                        .join(" and ")
+                )
+            };
+            bail!(
+                "cannot disable these features while interfaces that stay enabled use them: \
+                 {}.{hint}",
+                uses.join(", ")
+            );
+        }
+        match unstubbed {
+            Some(dep) => {
+                stubbed.shift_remove(&dep);
+            }
+            None => return Ok(stubbed),
+        }
+    }
+}
+
+/// A stub component exporting `stubbed`, with every function trapping except a
+/// clock's `now`, and except `get-insecure-seed` if `insecure_seed` is set.
+// TODO: make this not allocate a `memory` once we have lazy lowering.
+fn stub_component(
+    resolve: &mut Resolve,
+    stubbed: &IndexSet<InterfaceId>,
+    insecure_seed: Option<u128>,
+) -> anyhow::Result<Vec<u8>> {
+    // The stub world imports what its exports use, transitively, so the types
+    // line up with the snapshot's. Each import comes after the interfaces it
+    // uses, which encoding the world requires.
+    fn import_deps(
+        resolve: &Resolve,
+        id: InterfaceId,
+        stubbed: &IndexSet<InterfaceId>,
+        imports: &mut IndexSet<InterfaceId>,
+    ) {
+        for dep in resolve.interface_direct_deps(id).collect::<Vec<_>>() {
+            if !stubbed.contains(&dep) && !imports.contains(&dep) {
+                import_deps(resolve, dep, stubbed, imports);
+                imports.insert(dep);
+            }
+        }
+    }
+    let mut imports = IndexSet::new();
+    for &id in stubbed {
+        import_deps(resolve, id, stubbed, &mut imports);
+    }
+    let item = |id: InterfaceId| {
+        (
+            WorldKey::Interface(id),
+            WorldItem::Interface {
+                id,
+                stability: Default::default(),
+                external_id: None,
+                docs: Default::default(),
+                span: Default::default(),
+            },
+        )
+    };
+    let package = resolve.packages.alloc(wit_parser::Package {
+        name: PackageName {
+            namespace: STUB_PACKAGE.0.into(),
+            name: STUB_PACKAGE.1.into(),
+            version: None,
+        },
+        docs: Default::default(),
+        interfaces: Default::default(),
+        worlds: Default::default(),
+    });
+    let world = resolve.worlds.alloc(World {
+        name: STUB_PACKAGE.1.into(),
+        imports: imports.iter().copied().map(item).collect(),
+        exports: stubbed.iter().copied().map(item).collect(),
+        package: Some(package),
+        docs: Default::default(),
+        stability: Default::default(),
+        includes: Default::default(),
+        span: Default::default(),
+    });
+    resolve.packages[package]
+        .worlds
+        .insert(STUB_PACKAGE.1.into(), world);
+
+    let mut module = stub_module(resolve, world, insecure_seed)?;
+    wit_component::embed_component_metadata(
+        &mut module,
+        resolve,
+        world,
+        wit_component::StringEncoding::UTF8,
+        false,
+    )?;
+    wit_component::ComponentEncoder::default()
+        .validate(true)
+        .module(&module)
+        .context("registering the stub module")?
+        .encode()
+        .context("encoding the stub component")
+}
+
+/// The body of a stub function.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+enum StubBody {
+    /// Traps.
+    Trap,
+    /// Returns zeroes.
+    Zero,
+    /// Returns the high and low 64 bits of the seed, in that order.
+    Seed(u128),
+}
+
+/// The body of the stub of `func` in the interface named `interface`: zeroes
+/// for a clock's `now`, the seed for `get-insecure-seed` if `insecure_seed` is
+/// set, and a trap for everything else.
+fn stub_body(interface: &str, func: &Function, insecure_seed: Option<u128>) -> StubBody {
+    match (func.name.as_str(), insecure_seed) {
+        ("now", _) if interface.starts_with("wasi:clocks/") => StubBody::Zero,
+        ("get-insecure-seed", Some(seed)) if interface.starts_with(INSECURE_SEED_INTERFACE) => {
+            StubBody::Seed(seed)
+        }
+        _ => StubBody::Trap,
+    }
+}
+
+/// The core module of the stub component for `world`, which exports the
+/// stubbed interfaces, in the standard name mangling.
+///
+/// The module exports each function of the exported interfaces with the body
+/// [`stub_body`] gives it, its empty post-return function, and an empty
+/// destructor for each resource. It also exports the memory and the trapping
+/// `cabi_realloc` that the canonical options of the lifted functions need. The
+/// memory has a page for the return areas at [`ZERO_AREA`] and [`SEED_AREA`] if
+/// a body returns through one, and none otherwise. The module has no imports.
+///
+/// The module is named `disabled-features`. Each function is named
+/// `<interface>#<function> (disabled)`, or `<interface>#<function>
+/// (deterministic)` for the seed, so the backtrace of a trap in a stub names the
+/// disabled function.
+fn stub_module(
+    resolve: &Resolve,
+    world: WorldId,
+    insecure_seed: Option<u128>,
+) -> anyhow::Result<Vec<u8>> {
+    use wasm_encoder::{
+        CodeSection, ExportKind, ExportSection, Function as Body, FunctionSection, Instruction,
+        MemorySection, MemoryType, NameMap, NameSection, TypeSection, ValType,
+    };
+
+    const MANGLING: ManglingAndAbi = ManglingAndAbi::Standard32;
+
+    let mut types = TypeSection::new();
+    let mut type_indices: HashMap<(Vec<ValType>, Vec<ValType>), u32> = HashMap::new();
+    let mut functions = FunctionSection::new();
+    let mut code = CodeSection::new();
+    let mut exports = ExportSection::new();
+    let mut names = NameMap::new();
+    let mut return_area = false;
+    let mut add =
+        |name: &str, debug_name: &str, params: &[ValType], results: &[ValType], body: &Body| {
+            let next = type_indices.len() as u32;
+            let ty = *type_indices
+                .entry((params.to_vec(), results.to_vec()))
+                .or_insert_with(|| {
+                    types
+                        .ty()
+                        .function(params.iter().copied(), results.iter().copied());
+                    next
+                });
+            let index = functions.len();
+            functions.function(ty);
+            code.function(body);
+            exports.export(name, ExportKind::Func, index);
+            names.append(index, debug_name);
+        };
+    let val_types = |types: &[WasmType]| -> Vec<ValType> {
+        types
+            .iter()
+            .map(|ty| match ty {
+                WasmType::I32 | WasmType::Pointer | WasmType::Length => ValType::I32,
+                WasmType::I64 | WasmType::PointerOrI64 => ValType::I64,
+                WasmType::F32 => ValType::F32,
+                WasmType::F64 => ValType::F64,
+            })
+            .collect()
+    };
+    let empty = || {
+        let mut body = Body::new([]);
+        body.instruction(&Instruction::End);
+        body
+    };
+
+    for (key, item) in &resolve.worlds[world].exports {
+        let WorldItem::Interface { id, .. } = item else {
+            continue;
+        };
+        let interface = resolve.name_world_key(key);
+        for func in resolve.interfaces[*id].functions.values() {
+            let sig = resolve.wasm_signature(AbiVariant::GuestExport, func);
+            let (params, results) = (val_types(&sig.params), val_types(&sig.results));
+            let body = stub_body(&interface, func, insecure_seed);
+            return_area |= sig.retptr && body != StubBody::Trap;
+            let export = |kind| {
+                resolve.wasm_export_name(
+                    MANGLING,
+                    WasmExport::Func {
+                        interface: Some(key),
+                        func,
+                        kind,
+                    },
+                )
+            };
+            let state = match body {
+                StubBody::Seed(_) => "deterministic",
+                StubBody::Trap | StubBody::Zero => "disabled",
+            };
+            add(
+                &export(WasmExportKind::Normal),
+                &format!("{interface}#{} ({state})", func.name),
+                &params,
+                &results,
+                &stub_function(&sig, &results, body)?,
+            );
+            add(
+                &export(WasmExportKind::PostReturn),
+                &format!("{interface}#{} post-return", func.name),
+                &results,
+                &[],
+                &empty(),
+            );
+        }
+        for &resource in resolve.interfaces[*id].types.values() {
+            if !matches!(resolve.types[resource].kind, TypeDefKind::Resource) {
+                continue;
+            }
+            let name = resolve.wasm_export_name(
+                MANGLING,
+                WasmExport::ResourceDtor {
+                    interface: key,
+                    resource,
+                },
+            );
+            let resource_name = resolve.types[resource]
+                .name
+                .as_deref()
+                .unwrap_or("resource");
+            add(
+                &name,
+                &format!("{interface}#{resource_name} destructor"),
+                &[ValType::I32],
+                &[],
+                &empty(),
+            );
+        }
+    }
+    let mut realloc = Body::new([]);
+    realloc.instruction(&Instruction::Unreachable);
+    realloc.instruction(&Instruction::End);
+    add(
+        &resolve.wasm_export_name(MANGLING, WasmExport::Realloc),
+        "cabi_realloc (disabled)",
+        &[ValType::I32; 4],
+        &[ValType::I32],
+        &realloc,
+    );
+
+    let mut memories = MemorySection::new();
+    memories.memory(MemoryType {
+        minimum: u64::from(return_area),
+        maximum: None,
+        memory64: false,
+        shared: false,
+        page_size_log2: None,
+    });
+    exports.export(
+        &resolve.wasm_export_name(MANGLING, WasmExport::Memory),
+        ExportKind::Memory,
+        0,
+    );
+
+    let mut name_section = NameSection::new();
+    name_section.module("disabled-features");
+    name_section.functions(&names);
+
+    let mut module = wasm_encoder::Module::new();
+    module
+        .section(&types)
+        .section(&functions)
+        .section(&memories)
+        .section(&exports)
+        .section(&code)
+        .section(&name_section);
+    Ok(module.finish())
+}
+
+/// Return the code of the stub function described by `body`, with the core
+/// signature `sig` and the result types `results`.
+fn stub_function(
+    sig: &WasmSignature,
+    results: &[wasm_encoder::ValType],
+    body: StubBody,
+) -> anyhow::Result<wasm_encoder::Function> {
+    use wasm_encoder::{Instruction, ValType};
+
+    let mut f = wasm_encoder::Function::new([]);
+    match body {
+        StubBody::Trap => {
+            f.instruction(&Instruction::Unreachable);
+        }
+        // The zeroed return area holds the zero value of every result type.
+        StubBody::Zero if sig.retptr => {
+            f.instruction(&Instruction::I32Const(ZERO_AREA));
+        }
+        StubBody::Zero => {
+            for result in results {
+                f.instruction(&match result {
+                    ValType::I32 => Instruction::I32Const(0),
+                    ValType::I64 => Instruction::I64Const(0),
+                    ValType::F32 => Instruction::F32Const(0.0.into()),
+                    ValType::F64 => Instruction::F64Const(0.0.into()),
+                    other => bail!("a zero-returning stub has an unexpected {other:?} result"),
+                });
+            }
+        }
+        StubBody::Seed(seed) => {
+            if !sig.params.is_empty() || !sig.retptr {
+                bail!("`get-insecure-seed` has the unexpected core signature {sig:?}");
+            }
+            for (offset, half) in [(0, (seed >> 64) as u64), (8, seed as u64)] {
+                f.instruction(&Instruction::I32Const(SEED_AREA));
+                f.instruction(&Instruction::I64Const(half as i64));
+                f.instruction(&Instruction::I64Store(wasm_encoder::MemArg {
+                    offset,
+                    align: 3,
+                    memory_index: 0,
+                }));
+            }
+            f.instruction(&Instruction::I32Const(SEED_AREA));
+        }
+    }
+    f.instruction(&Instruction::End);
+    Ok(f)
+}
+
+/// The WIT name of an interface the world imports or exports.
+fn interface_name(resolve: &Resolve, world: WorldId, id: InterfaceId) -> String {
+    let w = &resolve.worlds[world];
+    let key = w
+        .imports
+        .iter()
+        .chain(w.exports.iter())
+        .find_map(|(key, item)| match item {
+            WorldItem::Interface { id: i, .. } if *i == id => Some(key),
+            _ => None,
+        });
+    match key {
+        Some(key) => resolve.name_world_key(key),
+        // An interface reached only through `use`, named by its package.
+        None => resolve.id_of(id).expect("a used interface has a package"),
+    }
+}
+
+/// The names of `world`'s exports, which a component built for the world
+/// keeps.
+pub fn world_export_names(resolve: &Resolve, world: WorldId) -> Vec<String> {
+    resolve.worlds[world]
+        .exports
+        .keys()
+        .map(|key| resolve.name_world_key(key))
+        .collect()
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    /// The kinds of interface stubbed by `stub_component`: clocks, whose `now`
+    /// returns zeroes directly or through the return area, the insecure seed,
+    /// and ordinary randomness.
+    const STUBBED_WIT: &str = "\
+package test:stubbed;
+
+package wasi:clocks@0.3.0 {
+  interface monotonic-clock {
+    now: func() -> u64;
+    get-resolution: func() -> u64;
+  }
+  interface system-clock {
+    record instant {
+      seconds: s64,
+      nanoseconds: u32,
+    }
+    now: func() -> instant;
+  }
+}
+
+package wasi:random@0.3.0 {
+  interface insecure-seed {
+    get-insecure-seed: func() -> tuple<u64, u64>;
+  }
+  interface random {
+    get-random-u64: func() -> u64;
+    get-random-bytes: func(len: u64) -> list<u8>;
+  }
+}
+";
+
+    /// The stub component of every interface in [`STUBBED_WIT`], instantiated.
+    fn stub_instance(
+        insecure_seed: Option<u128>,
+    ) -> (wasmtime::Store<()>, wasmtime::component::Instance) {
+        let mut resolve = Resolve::default();
+        resolve.push_str("stubbed.wit", STUBBED_WIT).unwrap();
+        let stubbed: IndexSet<InterfaceId> = resolve.interfaces.iter().map(|(id, _)| id).collect();
+        let component = stub_component(&mut resolve, &stubbed, insecure_seed).unwrap();
+
+        let engine = wasmtime::Engine::default();
+        let component = wasmtime::component::Component::new(&engine, &component).unwrap();
+        let mut store = wasmtime::Store::new(&engine, ());
+        let instance = wasmtime::component::Linker::new(&engine)
+            .instantiate(&mut store, &component)
+            .unwrap();
+        (store, instance)
+    }
+
+    /// Call `function` of `interface` on `instance`, returning its result.
+    fn call(
+        store: &mut wasmtime::Store<()>,
+        instance: &wasmtime::component::Instance,
+        interface: &str,
+        function: &str,
+        params: &[wasmtime::component::Val],
+    ) -> wasmtime::Result<wasmtime::component::Val> {
+        let interface = instance
+            .get_export_index(&mut *store, None, interface)
+            .unwrap();
+        let function = instance
+            .get_export_index(&mut *store, Some(&interface), function)
+            .unwrap();
+        let function = instance.get_func(&mut *store, function).unwrap();
+        let mut results = [wasmtime::component::Val::Bool(false)];
+        function.call(&mut *store, params, &mut results)?;
+        Ok(results.into_iter().next().unwrap())
+    }
+
+    /// A stubbed interface whose types come from a chain of interfaces that stay
+    /// imported, as WASI 0.2's standard streams use `wasi:io/streams`, which uses
+    /// `wasi:io/poll`. The stub component imports the chain in the order of use,
+    /// and is valid.
+    #[test]
+    fn stub_component_imports_used_interfaces_in_order() {
+        let mut resolve = Resolve::default();
+        resolve
+            .push_str(
+                "chain.wit",
+                "package test:chain;\n\
+                 interface poll { resource pollable; }\n\
+                 interface streams {\n  use poll.{pollable};\n  \
+                 resource input-stream { subscribe: func() -> pollable; }\n}\n\
+                 interface stdin {\n  use streams.{input-stream};\n  \
+                 get-stdin: func() -> input-stream;\n}\n",
+            )
+            .unwrap();
+        let stdin = resolve
+            .interfaces
+            .iter()
+            .find(|(_, interface)| interface.name.as_deref() == Some("stdin"))
+            .map(|(id, _)| id)
+            .unwrap();
+        let stubbed: IndexSet<InterfaceId> = [stdin].into_iter().collect();
+        let component = stub_component(&mut resolve, &stubbed, None).unwrap();
+        wasmparser::Validator::new_with_features(wasmparser::WasmFeatures::all())
+            .validate_all(&component)
+            .unwrap();
+    }
+
+    /// A clock's `now` returns zeroes, `get-insecure-seed` returns the seed if
+    /// there is one and traps otherwise, and every other function traps.
+    #[test]
+    fn stub_component_bodies() {
+        use wasmtime::component::Val;
+
+        let (mut store, instance) = stub_instance(Some((1 << 64) | 2));
+        assert_eq!(
+            call(
+                &mut store,
+                &instance,
+                "wasi:clocks/monotonic-clock@0.3.0",
+                "now",
+                &[]
+            )
+            .unwrap(),
+            Val::U64(0)
+        );
+        assert_eq!(
+            call(
+                &mut store,
+                &instance,
+                "wasi:clocks/system-clock@0.3.0",
+                "now",
+                &[]
+            )
+            .unwrap(),
+            Val::Record(vec![
+                ("seconds".to_string(), Val::S64(0)),
+                ("nanoseconds".to_string(), Val::U32(0)),
+            ])
+        );
+        assert_eq!(
+            call(
+                &mut store,
+                &instance,
+                "wasi:random/insecure-seed@0.3.0",
+                "get-insecure-seed",
+                &[]
+            )
+            .unwrap(),
+            Val::Tuple(vec![Val::U64(1), Val::U64(2)])
+        );
+
+        for (interface, function, params) in [
+            (
+                "wasi:clocks/monotonic-clock@0.3.0",
+                "get-resolution",
+                vec![],
+            ),
+            ("wasi:random/random@0.3.0", "get-random-u64", vec![]),
+            (
+                "wasi:random/random@0.3.0",
+                "get-random-bytes",
+                vec![Val::U64(4)],
+            ),
+            (
+                "wasi:random/insecure-seed@0.3.0",
+                "get-insecure-seed",
+                vec![],
+            ),
+        ] {
+            let (mut store, instance) = stub_instance(None);
+            let err = call(&mut store, &instance, interface, function, &params)
+                .expect_err("a disabled function traps");
+            assert!(
+                format!("{err:?}").contains(&format!("{interface}#{function} (disabled)")),
+                "{err:?}"
+            );
+        }
+    }
+}
diff --git a/componentize/src/lib.rs b/componentize/src/lib.rs
new file mode 100644
index 00000000..752e9449
--- /dev/null
+++ b/componentize/src/lib.rs
@@ -0,0 +1,1577 @@
+// SPDX-License-Identifier: Apache-2.0-WITH-LLVM-exception
+
+//! Building WebAssembly components from JavaScript applications.
+//!
+//! [`componentize`] links bindings for a WIT world with the StarlingMonkey
+//! runtime, evaluates the application's main module, and snapshots the result
+//! with Wizer. [`command`] implements the `starling-componentize` command-line
+//! tool, and [`wit_to_ts`] generates TypeScript declarations for a world.
+
+use {
+    anyhow::Context as _,
+    bytes::Bytes,
+    std::{
+        borrow::Cow,
+        path::{Path, PathBuf},
+    },
+    versions::canonicalize_compatible_versions,
+    wasm_encoder::{CustomSection, Section as _},
+    wasmparser::names::ComponentName,
+    wasmtime::{
+        component::{Component, Linker, ResourceTable, ResourceType},
+        format_err, Config, Engine, Store,
+    },
+    wasmtime_wasi::p2::pipe::{MemoryInputPipe, MemoryOutputPipe},
+    wasmtime_wasi::{FsPerms, WasiCtx, WasiCtxBuilder, WasiCtxView, WasiView},
+    wasmtime_wizer::{WasmtimeWizerComponent, Wizer},
+    wit_component::metadata,
+    wit_dylib::{AsyncFilterSet, DylibOpts, StackPointer},
+    wit_name_mapping::{same_interface, unversioned},
+    wit_parser::{Resolve, WorldId, WorldKey},
+};
+
+/// Host bindings of the runtime's `init` interface, `starling/wit/init.wit`.
+mod bindings {
+    wasmtime::component::bindgen!({
+        path: "../starling/wit/init.wit",
+        world: "runtime",
+        exports: { default: async },
+    });
+}
+
+/// `starling/wit/init.wit`, which declares the interface between the runtime
+/// and the componentizer.
+const INIT_WIT: &str = include_str!("../../starling/wit/init.wit");
+
+/// The name of the interface implemented by the runtime's `init` export,
+/// without its version.
+pub(crate) const INIT_INTERFACE_PREFIX: &str = "starling:componentize/init";
+
+/// The name of the interface implemented by the runtime's `init` export, with
+/// the version of `starling/wit/init.wit` this componentizer calls, such as
+/// `starling:componentize/init@0.1.0`.
+pub fn init_interface_name() -> String {
+    let mut resolve = Resolve::default();
+    let package = resolve
+        .push_str("init.wit", INIT_WIT)
+        .expect("`starling/wit/init.wit` parses");
+    let world = resolve
+        .select_world(&[package], Some("runtime"))
+        .expect("`starling/wit/init.wit` declares the world `runtime`");
+    let key = resolve.worlds[world]
+        .exports
+        .keys()
+        .next()
+        .expect("the world `runtime` exports `init`");
+    resolve.name_world_key(key)
+}
+
+/// Return the name of `runtime`'s export of the `init` interface, such as
+/// `starling:componentize/init@0.1.0`, or `None` if `runtime` doesn't export
+/// the interface.
+pub fn runtime_init_interface(runtime: &Runtime) -> anyhow::Result<Option<String>> {
+    builtin_export_name(runtime, INIT_INTERFACE_PREFIX)
+}
+
+/// Fail unless `runtime` implements the version of the `init` interface this
+/// componentizer calls, or a compatible one (see [`same_interface`]). The
+/// interface's version changes whenever the interface does.
+pub fn check_runtime_interface(runtime: &Runtime) -> anyhow::Result<()> {
+    let expected = init_interface_name();
+    match runtime_init_interface(runtime)? {
+        Some(name) if same_interface(&name, &expected) => Ok(()),
+        Some(name) => anyhow::bail!(
+            "the runtime implements `{name}`, but this componentizer calls `{expected}`. \
+             Use a runtime with a compatible version of the interface, such as the runtime \
+             released with this componentizer."
+        ),
+        None => anyhow::bail!(
+            "the runtime exports no `{INIT_INTERFACE_PREFIX}` interface, which this \
+             componentizer calls as `{expected}`. It is not a StarlingMonkey runtime."
+        ),
+    }
+}
+
+pub mod command;
+pub mod finalize;
+mod static_link;
+mod supported;
+mod versions;
+pub mod wit_to_ts;
+
+/// The store data of the instance [`componentize`] initializes.
+struct Ctx {
+    wasi: WasiCtx,
+    table: ResourceTable,
+}
+
+impl WasiView for Ctx {
+    fn ctx(&mut self) -> WasiCtxView<'_> {
+        WasiCtxView {
+            ctx: &mut self.wasi,
+            table: &mut self.table,
+        }
+    }
+}
+
+/// The WIT source of a world: a string, or the paths of WIT files and
+/// directories.
+pub enum Wit<'a, P = PathBuf> {
+    String(&'a str),
+    Paths(&'a [P]),
+}
+
+/// The runtime with which [`componentize`] links a world's bindings. It holds
+/// the core module of the runtime component `starling.wasm`, which is built by
+/// `scripts/build-runtime.sh`, including the runtime's `component-type`
+/// sections.
+pub struct Runtime {
+    module: Vec<u8>,
+}
+
+impl Runtime {
+    /// Create a runtime from `bytes`, which hold either the runtime component
+    /// built by `scripts/build-runtime.sh`, or a core module with the runtime's
+    /// `component-type` sections.
+    ///
+    /// For a component, its largest core module is used. `build-runtime.sh`
+    /// stores copies of that module's `component-type*` sections under other
+    /// names, which [`preserve_component_type::restore`] renames back. Fails if
+    /// a component has no such copies.
+    pub fn new(bytes: Vec<u8>) -> anyhow::Result<Runtime> {
+        if !wasmparser::Parser::is_component(&bytes) {
+            return Ok(Runtime { module: bytes });
+        }
+        let mut main: Option<&[u8]> = None;
+        for payload in wasmparser::Parser::new(0).parse_all(&bytes) {
+            if let wasmparser::Payload::ModuleSection {
+                unchecked_range, ..
+            } = payload.context("parsing the runtime component")?
+            {
+                let module = &bytes[unchecked_range.start as usize..unchecked_range.end as usize];
+                if main.is_none_or(|main| module.len() > main.len()) {
+                    main = Some(module);
+                }
+            }
+        }
+        let main = main.context("the runtime component contains no core module")?;
+        let (module, restored) =
+            preserve_component_type::restore(main).context("parsing the runtime's core module")?;
+        if restored == 0 {
+            anyhow::bail!(
+                "the runtime component has no `{}component-type` sections. Build it with \
+                 `just build-runtime`, which adds them.",
+                preserve_component_type::PREFIX
+            );
+        }
+        Ok(Runtime { module })
+    }
+
+    /// The runtime's core module.
+    pub fn module(&self) -> &[u8] {
+        &self.module
+    }
+}
+
+/// The name of the runtime's own `wasi:cli/run` export, without its version.
+///
+/// If the world exports `wasi:cli/run` too, the export is removed from the
+/// world before the bindings are generated, because the component encoder
+/// fails on duplicate exports. The component then exports the runtime's
+/// implementation under the world's name for the interface, so the world must
+/// name a version compatible with the runtime's.
+pub(crate) const CLI_RUN_INTERFACE_PREFIX: &str = "wasi:cli/run";
+
+/// Like [`CLI_RUN_INTERFACE_PREFIX`], for the runtime's own `wasi:http/handler`
+/// export. The application can also implement the interface itself (see
+/// [`RAW_HTTP_HANDLER_EXPORT`]).
+pub(crate) const HTTP_HANDLER_INTERFACE_PREFIX: &str = "wasi:http/handler";
+
+/// The name of a second export of the runtime's `wasi:http/handler` interface,
+/// which is added to a world that exports `wasi:http/handler`, so that the
+/// application can implement the interface itself. The main module exports its
+/// `handle` under the names for `wasi:http/handler`: `wasiHttp.handler.handle`,
+/// `handler.handle` or `handle`.
+pub(crate) const RAW_HTTP_HANDLER_EXPORT: &str = "wasi-http-handler";
+
+/// The worlds selected by [`load_world`]: the worlds in `worlds`, or the default
+/// world of the last package loaded if `worlds` is empty, and the worlds in
+/// `builtins`.
+///
+/// If one world is selected, the worlds in `resolved` are merged into it, and it
+/// is the target world. If several are selected, they are merged with the
+/// worlds in `resolved` into a new world, [`MERGED_WORLD_NAME`] in the package
+/// [`MERGED_PACKAGE_NAME`], which is the target world.
+#[derive(Clone, Debug, Default)]
+pub struct WorldSelection<'a> {
+    /// The worlds to target. Each is a world name, looked up in the last
+    /// package loaded, or a qualified `namespace:package/world@version`.
+    pub worlds: Vec<&'a str>,
+    /// Worlds selected in addition to `worlds`, each given as the WIT source
+    /// that defines it and its name in that source's package.
+    pub builtins: Vec<(&'a str, &'a str)>,
+    /// Worlds whose imports and exports are merged into the target world, each
+    /// in its own `Resolve`, such as the one returned by
+    /// [`runtime_imports_world`].
+    pub resolved: Vec<(Resolve, WorldId)>,
+}
+
+impl<'a> From<Option<&'a str>> for WorldSelection<'a> {
+    fn from(world: Option<&'a str>) -> Self {
+        WorldSelection {
+            worlds: world.into_iter().collect(),
+            builtins: Vec::new(),
+            resolved: Vec::new(),
+        }
+    }
+}
+
+/// The package of the world [`load_world`] merges several worlds into.
+pub const MERGED_PACKAGE_NAME: &str = "starling:componentize";
+
+/// The name of the world [`load_world`] merges several worlds into.
+pub const MERGED_WORLD_NAME: &str = "merged";
+
+/// Parse `wit` into a `Resolve`, and select the target world (see
+/// [`WorldSelection`]). `features` holds WIT feature names separated by commas
+/// or whitespace. `all_features` enables every gated item.
+///
+/// Each path of a [`Wit::Paths`], and the source of each of
+/// [`WorldSelection::builtins`], is parsed on its own and then merged into the
+/// result. A package defined by several of them is merged into one, whose
+/// interfaces have the types and functions of every definition. The
+/// definitions must agree on the functions they have in common.
+pub fn load_world<'a>(
+    wit: Wit<'_, impl AsRef<Path>>,
+    world: impl Into<WorldSelection<'a>>,
+    features: &[String],
+    all_features: bool,
+) -> anyhow::Result<(Resolve, WorldId)> {
+    let selection = world.into();
+    let new_resolve = || {
+        let mut resolve = Resolve {
+            all_features,
+            ..Default::default()
+        };
+        for features in features {
+            for feature in features
+                .split(',')
+                .flat_map(|s| s.split_whitespace())
+                .filter(|f| !f.is_empty())
+            {
+                resolve.features.insert(feature.to_string());
+            }
+        }
+        resolve
+    };
+
+    // Parse one source with `parse` into a separate `Resolve`, and merge it into
+    // `resolve`. Returns the id in `resolve` of the package returned by `parse`.
+    // Errors are rendered against `parsed`, the `Resolve` that holds the source,
+    // because only that shows their file, line and column.
+    let push = |resolve: &mut Resolve,
+                source: &dyn std::fmt::Display,
+                parse: &dyn Fn(&mut Resolve) -> anyhow::Result<wit_parser::PackageId>|
+     -> anyhow::Result<wit_parser::PackageId> {
+        let mut parsed = new_resolve();
+        let package =
+            parse(&mut parsed).map_err(|err| anyhow::anyhow!(parsed.render_error(&err)))?;
+        let remap = resolve
+            .merge(parsed)
+            .with_context(|| format!("merging the WIT in {source} with the WIT loaded before"))?;
+        // `Remap::packages` is indexed by the package's id in the merged-in
+        // `Resolve`.
+        Ok(remap.packages[package.index()])
+    };
+
+    let mut resolve = new_resolve();
+    let last_package = match wit {
+        Wit::String(wit) => push(&mut resolve, &"the WIT source", &|r: &mut Resolve| {
+            r.push_str("wit", wit)
+        })?,
+        Wit::Paths(paths) => {
+            let mut last_package = None;
+            for path in paths.iter().map(AsRef::as_ref) {
+                let source = format!("`{}`", path.display());
+                last_package = Some(push(&mut resolve, &source, &|r: &mut Resolve| {
+                    if path.is_dir() {
+                        r.push_dir(path).map(|(package, _)| package)
+                    } else {
+                        r.push_file(path)
+                    }
+                })?);
+            }
+            last_package
+                .ok_or_else(|| anyhow::anyhow!("Wit::Paths must contain at least one path"))?
+        }
+    };
+
+    let mut worlds = Vec::new();
+    for world in &selection.worlds {
+        worlds.push(resolve.select_world(&[last_package], Some(world))?);
+    }
+    if worlds.is_empty() {
+        worlds.push(resolve.select_world(&[last_package], None)?);
+    }
+    let mut additions = Vec::new();
+    for (source, world) in selection.resolved {
+        let remap = resolve
+            .merge(source)
+            .context("merging a world with the WIT loaded before")?;
+        additions.push(remap.worlds[world.index()].expect("a merged world keeps its id"));
+    }
+    for (wit, name) in selection.builtins {
+        let package = push(
+            &mut resolve,
+            &format!("the `{name}` world"),
+            &|r: &mut Resolve| r.push_str(name, wit),
+        )?;
+        worlds.push(resolve.select_world(&[package], Some(name))?);
+    }
+    if let [world] = worlds[..] {
+        let mut clone_maps = wit_parser::CloneMaps::default();
+        for addition in additions {
+            resolve
+                .merge_worlds(addition, world, &mut clone_maps)
+                .context("merging a world into the target world")?;
+        }
+        return Ok((resolve, world));
+    }
+    worlds.extend(additions);
+
+    if resolve
+        .package_names
+        .keys()
+        .any(|name| name.version.is_none() && name.to_string() == MERGED_PACKAGE_NAME)
+    {
+        anyhow::bail!(
+            "the WIT defines the package `{MERGED_PACKAGE_NAME}`, which merging several worlds \
+             needs for the merged world"
+        );
+    }
+    let package = resolve.push_str(
+        "merged.wit",
+        &format!("package {MERGED_PACKAGE_NAME};\n\nworld {MERGED_WORLD_NAME} {{}}\n"),
+    )?;
+    let merged = resolve.select_world(&[package], Some(MERGED_WORLD_NAME))?;
+    let mut clone_maps = wit_parser::CloneMaps::default();
+    for world in worlds {
+        let name = resolve.id_of_name(
+            resolve.worlds[world]
+                .package
+                .expect("a selected world has a package"),
+            &resolve.worlds[world].name,
+        );
+        resolve
+            .merge_worlds(world, merged, &mut clone_maps)
+            .with_context(|| format!("merging the world `{name}` into the target world"))?;
+    }
+    Ok((resolve, merged))
+}
+
+/// The package of the world [`runtime_imports_world`] returns.
+const RUNTIME_IMPORTS_PACKAGE: &str = "starling:runtime-imports";
+
+/// Return a world that imports every interface imported by the runtime, except
+/// those of the `disabled` features. The interfaces have only the functions
+/// that the runtime's core module imports, so bindings generated from the world
+/// import nothing that the runtime doesn't.
+///
+/// The interfaces are taken from the runtime's `component-type` sections. The
+/// world also imports the interfaces `use`d by these, including interfaces of
+/// disabled features, which [`finalize::finalize`] reports.
+///
+/// The core module can import an interface at several compatible versions (see
+/// [`same_interface`]), which the encoded component imports as one. The world
+/// imports each of these versions, with the functions imported from any of
+/// them.
+pub fn runtime_imports_world(
+    runtime: &Runtime,
+    disabled: &[finalize::WasiApiSet],
+) -> anyhow::Result<(Resolve, WorldId)> {
+    // The interfaces from which the runtime's core module imports functions.
+    let imported: std::collections::BTreeSet<&str> = module_imports(runtime.module())?
+        .into_iter()
+        .map(|(module, _)| module)
+        .filter(|module| !module.starts_with('[') && module.contains(':'))
+        .collect();
+
+    let mut resolve = Resolve::default();
+    let mut known = std::collections::BTreeSet::new();
+    for (decoded, world) in component_type_worlds(runtime.module())? {
+        for key in decoded.worlds[world].imports.keys() {
+            known.insert(decoded.name_world_key(key));
+        }
+        resolve
+            .merge(decoded)
+            .context("merging the runtime's component-type sections")?;
+    }
+
+    let imports: Vec<String> = imported
+        .into_iter()
+        .filter(|name| known.contains(*name))
+        .filter(|name| !disabled.iter().any(|feature| feature.owns(name)))
+        .map(|name| format!("  import {name};\n"))
+        .collect();
+    let package = resolve.push_str(
+        "runtime-imports.wit",
+        &format!(
+            "package {RUNTIME_IMPORTS_PACKAGE};\n\nworld imports {{\n{}}}\n",
+            imports.concat()
+        ),
+    )?;
+    let world = resolve.select_world(&[package], Some("imports"))?;
+    retain_imported_functions(&mut resolve, world, runtime.module())?;
+    Ok((resolve, world))
+}
+
+/// Like [`load_world`], but for [`wit_to_ts::generate`]. Fails for a type that
+/// [`componentize`] can't lift or lower. An interface imported at several
+/// compatible versions is imported only once (see
+/// `canonicalize_compatible_versions`).
+///
+/// If `runtime` is `Some` and the world exports `wasi:http/handler`, the export
+/// is replaced as in [`componentize`], by an export named
+/// `RAW_HTTP_HANDLER_EXPORT` with the runtime's declaration of the interface.
+/// The declarations then describe the `handle` implemented by the application.
+pub fn load_world_for_types<'a>(
+    wit: Wit<'_, impl AsRef<Path>>,
+    world: impl Into<WorldSelection<'a>>,
+    features: &[String],
+    all_features: bool,
+    runtime: Option<&Runtime>,
+) -> anyhow::Result<(Resolve, WorldId)> {
+    let (mut resolve, world) = load_world(wit, world, features, all_features)?;
+    supported::check_supported_types(&resolve, world)?;
+    let Some(runtime) = runtime else {
+        return canonicalize_compatible_versions(resolve, world);
+    };
+    let Some(removed) = remove_world_export(&mut resolve, world, HTTP_HANDLER_INTERFACE_PREFIX)
+        .into_iter()
+        .next()
+    else {
+        return canonicalize_compatible_versions(resolve, world);
+    };
+    match builtin_export(runtime.module(), HTTP_HANDLER_INTERFACE_PREFIX)? {
+        Some((builtin, name)) if same_interface(&name, &removed) => {
+            add_raw_http_handler_export(&mut resolve, world, builtin, &name)?;
+            canonicalize_compatible_versions(resolve, world)
+        }
+        builtin => anyhow::bail!(
+            "the world exports `{removed}`, but the runtime provides {}",
+            builtin.map_or("none".to_string(), |(_, name)| format!("`{name}`"))
+        ),
+    }
+}
+
+/// The settings of a [`componentize`] call besides its inputs. The default
+/// enables no WIT features, sets no base directory, disables no WASI APIs, and uses
+/// the compilation cache.
+#[derive(Clone, Copy, Debug)]
+pub struct ComponentizeOptions<'a> {
+    /// WIT feature names to enable, each entry comma- or whitespace-separated.
+    pub features: &'a [String],
+    /// Whether to enable every gated WIT item.
+    pub all_features: bool,
+    /// The directory within which the application's relative imports are
+    /// resolved. It is preopened read-only at `/` while the application is
+    /// initialized.
+    pub base_directory: Option<&'a Path>,
+    /// The WASI APIs from which the component doesn't import anything (see
+    /// [`finalize::finalize`]).
+    pub disabled: &'a [finalize::WasiApiSet],
+    /// If set, the component doesn't import `wasi:random/insecure-seed`, and
+    /// `get-insecure-seed` always returns this seed (see
+    /// [`finalize::finalize`]).
+    pub insecure_seed: Option<u128>,
+    /// The URL `globalThis.location` reflects while the application's top level
+    /// runs, if any.
+    pub init_location: Option<&'a str>,
+    /// Whether to cache the compiled component in wasmtime's global
+    /// compilation cache.
+    pub cache: bool,
+}
+
+impl Default for ComponentizeOptions<'_> {
+    fn default() -> Self {
+        ComponentizeOptions {
+            features: &[],
+            all_features: false,
+            base_directory: None,
+            disabled: &[],
+            insecure_seed: None,
+            init_location: None,
+            cache: true,
+        }
+    }
+}
+
+/// What [`componentize`] produces.
+pub struct Componentized {
+    /// The component.
+    pub component: Vec<u8>,
+    /// The output that the application's top level printed on stdout and
+    /// stderr while it was initialized.
+    pub init_output: String,
+}
+
+/// Build a component from the JavaScript application `js` and the world
+/// selected from `wit`:
+///
+/// 1. The world's bindings are generated with wit-dylib, and linked with the
+///    runtime's core module by `static_link::link`.
+/// 2. The component is instantiated, and its `init` export is called with
+///    `js`, which evaluates the application's main module.
+/// 3. The instance is snapshotted with Wizer.
+/// 4. [`finalize::finalize`] wraps the snapshot, so that the component exports
+///    exactly the world's exports, and doesn't import from the interfaces of
+///    `options.disabled`.
+pub async fn componentize(
+    wit: Wit<'_, impl AsRef<Path>>,
+    world: impl Into<WorldSelection<'_>>,
+    js: impl Into<JsSource<'_>>,
+    runtime: &Runtime,
+    options: &ComponentizeOptions<'_>,
+) -> anyhow::Result<Componentized> {
+    let ComponentizeOptions {
+        features,
+        all_features,
+        base_directory,
+        disabled,
+        insecure_seed,
+        init_location,
+        cache,
+    } = *options;
+    check_runtime_interface(runtime)?;
+    let (mut resolve, world) = load_world(wit, world, features, all_features)?;
+    supported::check_supported_types(&resolve, world)?;
+    supported::reject_world_level_borrows(&resolve, world)?;
+    check_export_names(&resolve, world)?;
+
+    // The finalized component exports what the world declares, including the
+    // two builtins removed from the world below, under the names the world gave
+    // them.
+    let mut keep_exports: Vec<finalize::KeptExport> = finalize::world_export_names(&resolve, world)
+        .into_iter()
+        .map(finalize::KeptExport::unrenamed)
+        .collect();
+
+    // The world's name for its `wasi:http/handler` export, if it has one.
+    let mut http_handler = None;
+    let mut cli = false;
+    // A world's `wasi:cli/run` and `wasi:http/handler` exports are implemented
+    // by the runtime's own exports. They are removed from the world before the
+    // bindings and the metadata section below are generated, because they would
+    // otherwise be duplicate exports.
+    for prefix in [CLI_RUN_INTERFACE_PREFIX, HTTP_HANDLER_INTERFACE_PREFIX] {
+        if let Some(removed) = remove_world_export(&mut resolve, world, prefix).first() {
+            cli |= prefix == CLI_RUN_INTERFACE_PREFIX;
+            // The output component exports the runtime's builtin, so the world
+            // must name a version the builtin is compatible with. The export
+            // keeps the world's name for it.
+            let builtin = builtin_export(runtime.module(), prefix)?;
+            let builtin_name = builtin.as_ref().map(|(_, name)| name.as_str());
+            if !builtin_name.is_some_and(|builtin| same_interface(builtin, removed)) {
+                anyhow::bail!(
+                    "the world exports `{removed}`, but the runtime provides {}. \
+                     A world exporting `{prefix}` must name a version compatible with the one \
+                     the runtime provides.",
+                    builtin_name
+                        .map(|b| format!("`{b}`"))
+                        .unwrap_or_else(|| format!("no `{prefix}`"))
+                );
+            }
+            if let Some(builtin_name) = builtin_name {
+                for kept in &mut keep_exports {
+                    if kept.name == *removed {
+                        kept.snapshot_name = builtin_name.to_string();
+                    }
+                }
+            }
+            if let (HTTP_HANDLER_INTERFACE_PREFIX, Some((builtin, name))) = (prefix, builtin) {
+                add_raw_http_handler_export(&mut resolve, world, builtin, &name)?;
+                http_handler = Some(removed.clone());
+            }
+        }
+    }
+
+    // This runs after the runtime's declaration of `wasi:http/handler` is merged
+    // in, so that its packages are canonicalized with the others.
+    let (resolve, world) = canonicalize_compatible_versions(resolve, world)?;
+    // The bindings use the runtime's shadow stack pointer.
+    let stack_pointer = stack_pointer_location(runtime.module())?;
+    let (mut bindings, _metadata) = wit_dylib::create_with_metadata(
+        &resolve,
+        world,
+        Some(&mut DylibOpts {
+            interpreter: None,
+            // With the default filter set, functions declared `async` in WIT
+            // are bound as async, and all others as sync.
+            async_: AsyncFilterSet::default(),
+            stack_pointer: stack_pointer.clone(),
+        }),
+    )
+    .context("generating the world's wit-dylib bindings")?;
+
+    CustomSection {
+        name: Cow::Borrowed("component-type:starling"),
+        data: Cow::Owned(metadata::encode(
+            &resolve,
+            world,
+            wit_component::StringEncoding::UTF8,
+            None,
+            false,
+        )?),
+    }
+    .append_to(&mut bindings);
+
+    let component = static_link::link(runtime.module(), &bindings, &stack_pointer)?;
+
+    // The pipes are uncapped. They collect whatever the application's top level
+    // logs during `init`, and `MemoryOutputPipe::write` traps rather than
+    // truncating once a write would exceed the capacity.
+    let stdout = MemoryOutputPipe::new(usize::MAX);
+    let stderr = MemoryOutputPipe::new(usize::MAX);
+
+    let js = js.into();
+    let main_path = base_directory.and_then(|base| path_in(Path::new(js.name), base));
+    let mut wasi = WasiCtxBuilder::new();
+    if let Some(dir) = base_directory {
+        // `init` only reads the application's dependency modules.
+        wasi.preopened_dir(dir, "/", FsPerms::ReadOnly)?;
+    }
+    let wasi = wasi
+        .stdin(MemoryInputPipe::new(Bytes::new()))
+        .stdout(stdout.clone())
+        .stderr(stderr.clone())
+        .build();
+    let table = ResourceTable::new();
+
+    let mut config = Config::new();
+    config.wasm_component_model(true);
+    config.wasm_component_model_async(true);
+    // This engine runs the component's `init` export exactly once, then the heap is wizened
+    // and the compiled code discarded. Optimizing it would take several seconds per
+    // world on a component of tens to hundreds of megabytes, so it is compiled
+    // without optimization.
+    config.cranelift_opt_level(wasmtime::OptLevel::None);
+    // We don't register the compiled code's unwind information with the system unwinder, which
+    // wasmtime's own backtraces don't use. On macOS, registering and unregistering it takes one
+    // process-wide lock, which serializes every thread that compiles or drops a component.
+    config.native_unwind_info(false);
+    // Compiling the component dominates a componentization. Reuse the compilation across
+    // runs whenever the component and the engine's configuration are unchanged. The world's
+    // bindings library is linked in before this point, so the cache hits for a rerun of the same
+    // world against the same runtime build and misses for any other.
+    if cache {
+        config.cache(wasmtime::Cache::from_file(None).ok());
+    }
+
+    let engine = Engine::new(&config)?;
+    let mut store = Store::new(&engine, Ctx { wasi, table });
+
+    let wizer = Wizer::new();
+    let (cx, component) = wizer.instrument_component(&component)?;
+    let component = Component::new(&engine, &component)?;
+
+    let mut linker = Linker::new(&engine);
+    add_wasi(&mut linker)?;
+
+    // The runtime imports more than the user's world declares, such as the
+    // `wasi:http` interfaces `fetch` uses, which `add_wasi` does not cover.
+    // `init` never calls those, so each import not defined by anything else is
+    // defined as a trap. The component therefore instantiates without an http
+    // host.
+    trap_unsatisfied_imports(&engine, &component, &mut linker, &[])?;
+
+    let instance = linker.instantiate_async(&mut store, &component).await?;
+    let init_output;
+    {
+        let instance = bindings::Runtime::new(&mut store, &instance)?;
+        // `init` builds the import modules from the wit-dylib `Wit` metadata, so
+        // no module sources are passed to it. It reads the application's own
+        // dependency modules through the preopened `base_directory`, and the
+        // snapshot includes them.
+        let raw_http_handler = http_handler
+            .as_ref()
+            .map(|_| RAW_HTTP_HANDLER_EXPORT.to_string());
+        // `init` is an async export, so it runs as a concurrent task, which
+        // lets the application's top-level `await` complete.
+        let result = store
+            .run_concurrent(async |accessor| {
+                instance
+                    .starling_componentize_init()
+                    .call_init(
+                        accessor,
+                        js.text.to_string(),
+                        js.name.to_string(),
+                        main_path,
+                        cli,
+                        raw_http_handler,
+                        init_location.map(str::to_string),
+                    )
+                    .await
+            })
+            .await
+            .and_then(|call| call);
+        let printed = format!(
+            "{}{}",
+            String::from_utf8_lossy(&stdout.contents()),
+            String::from_utf8_lossy(&stderr.contents())
+        );
+        let with_printed = |message: String| {
+            if printed.is_empty() {
+                message
+            } else {
+                format!("{message}\n\nThe application printed:\n{printed}")
+            }
+        };
+        let raw_serves = match result {
+            Ok(Ok(raw_serves)) => raw_serves,
+            Ok(Err(message)) => anyhow::bail!(with_printed(message)),
+            Err(trap) => {
+                return Err(anyhow::Error::from(trap).context(with_printed(
+                    "initializing the application trapped".to_string(),
+                )));
+            }
+        };
+        init_output = printed;
+        // The application implements `wasi:http/handler` itself, so its own
+        // export replaces the runtime's builtin.
+        if let (true, Some(name)) = (raw_serves, &http_handler) {
+            for kept in &mut keep_exports {
+                if kept.name == *name {
+                    kept.snapshot_name = RAW_HTTP_HANDLER_EXPORT.to_string();
+                }
+            }
+        }
+    }
+
+    let snapshot = wizer
+        .snapshot_component(
+            &cx,
+            &mut WasmtimeWizerComponent {
+                store: &mut store,
+                instance,
+            },
+        )
+        .await?;
+
+    let component = finalize::finalize(&snapshot, &keep_exports, disabled, insecure_seed)?;
+    Ok(Componentized {
+        component,
+        init_output,
+    })
+}
+
+/// Fail if `world` exports something under a name the componentizer's own
+/// exports take: the `init` interface, at any version, the runtime's
+/// `wizer-initialize`, or [`RAW_HTTP_HANDLER_EXPORT`]. Names are compared with
+/// the equality of [`ComponentName`], which the Component Model uses for the
+/// uniqueness of export names: ignoring case and `-`.
+fn check_export_names(resolve: &Resolve, world: WorldId) -> anyhow::Result<()> {
+    let reserved = [
+        INIT_INTERFACE_PREFIX,
+        "wizer-initialize",
+        RAW_HTTP_HANDLER_EXPORT,
+    ]
+    .map(|name| ComponentName::new(name, 0).expect("a reserved name is a valid export name"));
+    for key in resolve.worlds[world].exports.keys() {
+        let name = resolve.name_world_key(key);
+        let parsed = ComponentName::new(unversioned(&name), 0)
+            .with_context(|| format!("the world's export name `{name}` is invalid"))?;
+        if reserved.contains(&parsed) {
+            anyhow::bail!(
+                "the world exports `{name}`, a name the componentizer uses for an export of its \
+                 own. Rename the world's export."
+            );
+        }
+    }
+    Ok(())
+}
+
+/// The path of the file `file` names, relative to the directory `base`, if the
+/// file exists inside `base`, with `/` separating its components.
+fn path_in(file: &Path, base: &Path) -> Option<String> {
+    let file = std::fs::canonicalize(file).ok()?;
+    let base = std::fs::canonicalize(base).ok()?;
+    let relative = file.strip_prefix(&base).ok()?;
+    let components: Option<Vec<&str>> = relative.iter().map(|part| part.to_str()).collect();
+    Some(components?.join("/"))
+}
+
+/// A JavaScript module's source, and the name shown for it in stack traces and
+/// error messages. A `&str` converts to a source named `main.js`.
+///
+/// If the name is the path of a file in the base directory, a module that
+/// imports that file gets this module.
+#[derive(Clone, Copy, Debug)]
+pub struct JsSource<'a> {
+    pub name: &'a str,
+    pub text: &'a str,
+}
+
+impl<'a> From<&'a str> for JsSource<'a> {
+    fn from(text: &'a str) -> Self {
+        JsSource {
+            name: "main.js",
+            text,
+        }
+    }
+}
+
+/// Add the export [`RAW_HTTP_HANDLER_EXPORT`] to `world`: an interface with the
+/// same types and function as the runtime's builtin `wasi:http/handler`, which
+/// `builtin` exports as `handler`.
+///
+/// `builtin`'s packages are merged into `resolve` first, so that the export uses
+/// the `wasi:http/types` resources imported by the runtime. If `resolve`
+/// already has one of these packages, the two must agree on every item that
+/// both declare.
+fn add_raw_http_handler_export(
+    resolve: &mut Resolve,
+    world: WorldId,
+    builtin: Resolve,
+    handler: &str,
+) -> anyhow::Result<()> {
+    resolve.merge(builtin).with_context(|| {
+        format!(
+            "merging the runtime's `{handler}` into the world. A world declaring \
+             `{HTTP_HANDLER_INTERFACE_PREFIX}` must declare it as the runtime does, or leave \
+             the interface empty."
+        )
+    })?;
+    let version = handler
+        .split_once('@')
+        .map(|(_, version)| format!("@{version}"))
+        .unwrap_or_default();
+    let raw = resolve
+        .push_str(
+            "raw-http-handler.wit",
+            &format!(
+                "package starling:raw-http-handler;\n\
+                 world raw {{\n\
+                   export {RAW_HTTP_HANDLER_EXPORT}: interface {{\n\
+                     use wasi:http/types{version}.{{request, response, error-code}};\n\
+                     handle: async func(request: request) -> result<response, error-code>;\n\
+                   }}\n\
+                 }}\n"
+            ),
+        )
+        .context("declaring the raw `wasi:http/handler` export")?;
+    let raw = resolve.select_world(&[raw], Some("raw"))?;
+    resolve
+        .merge_worlds(raw, world, &mut wit_parser::CloneMaps::default())
+        .context("adding the raw `wasi:http/handler` export to the world")
+}
+
+/// Remove from `world` every export of the interface `prefix` at any version,
+/// returning the names removed. `prefix` is an interface name without a
+/// version, such as `wasi:cli/run`. Returns an empty `Vec` if `world` doesn't
+/// export the interface.
+fn remove_world_export(resolve: &mut Resolve, world: WorldId, prefix: &str) -> Vec<String> {
+    let to_remove: Vec<(WorldKey, String)> = resolve.worlds[world]
+        .exports
+        .keys()
+        .filter_map(|key| {
+            let name = resolve.name_world_key(key);
+            (matches!(key, WorldKey::Interface(_)) && unversioned(&name) == prefix)
+                .then(|| (key.clone(), name))
+        })
+        .collect();
+
+    for (key, _) in &to_remove {
+        resolve.worlds[world].exports.shift_remove(key);
+    }
+
+    to_remove.into_iter().map(|(_, name)| name).collect()
+}
+
+/// Where `module` keeps its shadow stack pointer.
+///
+/// A wasm32-wasip2 build keeps it in a `__stack_pointer` global. A wasm32-wasip3 build gives each
+/// task its own in the task context, reached through the `env` accessors wit-component lowers to
+/// `[context-get-0]` and `[context-set-0]`, and has no such global.
+fn stack_pointer_location(module: &[u8]) -> anyhow::Result<StackPointer> {
+    let task_context = module_imports(module)?.contains(&("env", "__wasm_get_stack_pointer"));
+    Ok(if task_context {
+        StackPointer::TaskContext
+    } else {
+        StackPointer::Global
+    })
+}
+
+/// The module and name of every import of the runtime's core module `module`.
+fn module_imports(module: &[u8]) -> anyhow::Result<Vec<(&str, &str)>> {
+    let mut imports = Vec::new();
+    for payload in wasmparser::Parser::new(0).parse_all(module) {
+        let payload = payload.context("parsing the runtime module")?;
+        let wasmparser::Payload::ImportSection(reader) = payload else {
+            continue;
+        };
+        for import in reader.into_imports() {
+            let import = import.context("parsing the runtime module's imports")?;
+            imports.push((import.module, import.name));
+        }
+    }
+    Ok(imports)
+}
+
+/// Return the world of `module` that exports the interface `prefix` at any
+/// version, decoded into its own `Resolve`, and the export's name. `prefix` is
+/// an interface name without a version. Returns `None` if `module` doesn't
+/// export the interface.
+///
+/// The interfaces imported by the world keep only the functions that `module`
+/// imports, so bindings generated from the `Resolve` import nothing that the
+/// runtime doesn't.
+fn builtin_export(module: &[u8], prefix: &str) -> anyhow::Result<Option<(Resolve, String)>> {
+    let Some((mut resolve, world, name)) = find_builtin_export(module, prefix)? else {
+        return Ok(None);
+    };
+    retain_imported_functions(&mut resolve, world, module)?;
+    Ok(Some((resolve, name)))
+}
+
+/// Return the name of the runtime's export of the interface `prefix`, such as
+/// `wasi:cli/run@0.3.0` for `wasi:cli/run`, or `None` if the runtime doesn't
+/// export the interface.
+pub(crate) fn builtin_export_name(
+    runtime: &Runtime,
+    prefix: &str,
+) -> anyhow::Result<Option<String>> {
+    Ok(find_builtin_export(runtime.module(), prefix)?.map(|(_, _, name)| name))
+}
+
+/// Like [`builtin_export`], but without removing any functions, and also
+/// returning the world's id.
+///
+/// The worlds of `module` are searched in the order of their sections.
+fn find_builtin_export(
+    module: &[u8],
+    prefix: &str,
+) -> anyhow::Result<Option<(Resolve, WorldId, String)>> {
+    for (resolve, world) in component_type_worlds(module)? {
+        let found = resolve.worlds[world].exports.keys().find(|key| {
+            matches!(key, WorldKey::Interface(_))
+                && unversioned(&resolve.name_world_key(key)) == prefix
+        });
+        if let Some(key) = found {
+            let name = resolve.name_world_key(key);
+            return Ok(Some((resolve, world, name)));
+        }
+    }
+    Ok(None)
+}
+
+/// Decode each `component-type*` custom section of the core module `module`,
+/// which holds one world, into its own `Resolve`.
+fn component_type_worlds(module: &[u8]) -> anyhow::Result<Vec<(Resolve, WorldId)>> {
+    let mut worlds = Vec::new();
+    for payload in wasmparser::Parser::new(0).parse_all(module) {
+        let wasmparser::Payload::CustomSection(section) =
+            payload.context("parsing the runtime module")?
+        else {
+            continue;
+        };
+        if section.name().starts_with("component-type") {
+            worlds.push(
+                wit_parser::decoding::decode_world(section.data())
+                    .context("decoding a component-type section into a world")?,
+            );
+        }
+    }
+    Ok(worlds)
+}
+
+/// From each interface imported by `world`, remove the functions that `module`
+/// doesn't import, either synchronously or as an `[async-lower]` import, from
+/// any version of the interface compatible with the world's (see
+/// [`same_interface`]).
+fn retain_imported_functions(
+    resolve: &mut Resolve,
+    world: WorldId,
+    module: &[u8],
+) -> anyhow::Result<()> {
+    // The modules importing each function, by the function's name.
+    let mut imported: std::collections::HashMap<&str, Vec<&str>> = Default::default();
+    for (module, name) in module_imports(module)? {
+        let name = name.strip_prefix("[async-lower]").unwrap_or(name);
+        imported.entry(name).or_default().push(module);
+    }
+    let interfaces: Vec<_> = resolve.worlds[world]
+        .imports
+        .iter()
+        .filter_map(|(key, item)| match item {
+            wit_parser::WorldItem::Interface { id, .. } => Some((resolve.name_world_key(key), *id)),
+            _ => None,
+        })
+        .collect();
+    for (name, id) in interfaces {
+        resolve.interfaces[id].functions.retain(|function, _| {
+            imported
+                .get(function.as_str())
+                .is_some_and(|modules| modules.iter().any(|module| same_interface(module, &name)))
+        });
+    }
+    Ok(())
+}
+
+/// Define every import of `component` that isn't provided by the WASI host or
+/// by `provided` as a stub that traps.
+///
+/// `Linker::define_unknown_imports_as_traps` does almost the same, but gives
+/// every imported resource a placeholder type. That fails for a resource that a
+/// world's own interface `use`s from a provided interface. This function stubs
+/// each remaining function, with `func_new_concurrent` for async functions and
+/// `func_new` for sync ones, and each resource with the type a provider defines
+/// for it (see `provided_resource_types`), or a placeholder if none does.
+///
+/// The WASI host added by [`add_wasi`] provides compatible versions of its
+/// interfaces under its own version string, so its instances (see
+/// `is_wasi_host_instance`) are skipped without looking them up in the
+/// linker.
+///
+/// `provided` holds the interface name prefixes of other hosts that the caller
+/// added to the linker, such as `wasi:http`. Their instances are skipped as
+/// well. An interface's type aliases appear in the component's imports as
+/// separate resources, such as `headers`, an alias of `fields` in
+/// `wasi:http/types`, while the host defines only the underlying resource. A
+/// stub would define the alias as an unrelated type, and instantiation would
+/// fail.
+pub fn trap_unsatisfied_imports<T: Send + 'static>(
+    engine: &Engine,
+    component: &Component,
+    linker: &mut Linker<T>,
+    provided: &[&str],
+) -> anyhow::Result<()> {
+    use wasmtime::component::types::ComponentItem;
+
+    // Define each of `items` in `instance` as a stub, named `{prefix}#{name}` in
+    // the trap's message, or `{name}` if `prefix` is `None`. Defining a name
+    // that the linker already has fails, and the failure is ignored.
+    // `instance()` reopens an instance that a provider already defined, so the
+    // provider's items are kept, and only the missing items get stubs.
+    fn stub_items<T: Send + 'static>(
+        engine: &Engine,
+        instance: &mut wasmtime::component::LinkerInstance<'_, T>,
+        items: impl Iterator<Item = (String, ComponentItem)>,
+        prefix: Option<&str>,
+        host_types: &[(ResourceType, ResourceType)],
+    ) -> anyhow::Result<()> {
+        for (name, item) in items {
+            let qualified = match prefix {
+                Some(prefix) => format!("{prefix}#{name}"),
+                None => name.clone(),
+            };
+            match item {
+                ComponentItem::ComponentFunc(func) => {
+                    let message = format!("called trapping stub: {qualified}");
+                    let result = if func.async_() {
+                        instance.func_new_concurrent(&name, move |_, _, _, _| {
+                            let message = message.clone();
+                            Box::pin(async move { Err(format_err!("{message}")) })
+                        })
+                    } else {
+                        instance.func_new(&name, move |_, _, _, _| Err(format_err!("{message}")))
+                    };
+                    let _ = result;
+                }
+                ComponentItem::Resource(ty) => {
+                    let ty = host_type(host_types, ty);
+                    let _ = instance.resource(&name, ty, |_, _| Ok(()));
+                }
+                ComponentItem::ComponentInstance(inner) => {
+                    let exports = inner
+                        .exports(engine)
+                        .map(|(n, i)| (n.to_string(), i.ty))
+                        .collect::<Vec<_>>();
+                    if let Ok(mut sub) = instance.instance(&name) {
+                        stub_items::<T>(
+                            engine,
+                            &mut sub,
+                            exports.into_iter(),
+                            Some(&qualified),
+                            host_types,
+                        )?;
+                    }
+                }
+                _ => {}
+            }
+        }
+        Ok(())
+    }
+
+    // The provider's type for `ty`, a resource type of the component's imports,
+    // if a provider defines it, and a placeholder otherwise.
+    fn host_type(host_types: &[(ResourceType, ResourceType)], ty: ResourceType) -> ResourceType {
+        host_types
+            .iter()
+            .find(|(imported, _)| *imported == ty)
+            .map_or_else(ResourceType::host::<()>, |(_, host)| *host)
+    }
+
+    let is_provided =
+        |name: &str| is_wasi_host_instance(name) || provided.iter().any(|p| name.starts_with(p));
+    let host_types = provided_resource_types(engine, component, linker, &is_provided);
+    let imports: Vec<(String, ComponentItem)> = component
+        .component_type()
+        .imports(engine)
+        .filter(|(name, item)| {
+            !(matches!(item.ty, ComponentItem::ComponentInstance(_)) && is_provided(name))
+        })
+        .map(|(name, item)| (name.to_string(), item.ty))
+        .collect();
+    stub_items::<T>(
+        engine,
+        &mut linker.root(),
+        imports.into_iter(),
+        None,
+        &host_types,
+    )
+}
+
+/// For each resource of a provided import instance (see `is_provided`) that is
+/// used by a stubbed import, return the resource's type in `component`'s
+/// imports, paired with the type defined for it in `linker`.
+///
+/// Such a resource, such as `descriptor` of `wasi:filesystem/types` used by a
+/// world's own interface, has the provider's type in the stubbed import too,
+/// so its stub must have that type (see [`probe_resource_type`]). A resource
+/// whose type isn't found isn't returned, and gets a placeholder type.
+fn provided_resource_types<T: Send + 'static>(
+    engine: &Engine,
+    component: &Component,
+    linker: &Linker<T>,
+    is_provided: &dyn Fn(&str) -> bool,
+) -> Vec<(ResourceType, ResourceType)> {
+    use wasmtime::component::types::ComponentItem;
+
+    fn resources(engine: &Engine, item: &ComponentItem) -> Vec<(String, ResourceType)> {
+        let ComponentItem::ComponentInstance(instance) = item else {
+            return Vec::new();
+        };
+        instance
+            .exports(engine)
+            .filter_map(|(name, export)| match export.ty {
+                ComponentItem::Resource(ty) => Some((name.to_string(), ty)),
+                _ => None,
+            })
+            .collect()
+    }
+
+    let imports: Vec<(String, ComponentItem)> = component
+        .component_type()
+        .imports(engine)
+        .map(|(name, item)| (name.to_string(), item.ty))
+        .collect();
+    let stubbed: Vec<ResourceType> = imports
+        .iter()
+        .filter(|(name, _)| !is_provided(name))
+        .flat_map(|(_, item)| match item {
+            ComponentItem::Resource(ty) => vec![*ty],
+            item => resources(engine, item)
+                .into_iter()
+                .map(|(_, ty)| ty)
+                .collect(),
+        })
+        .collect();
+    let mut host_types: Vec<(ResourceType, ResourceType)> = Vec::new();
+    for (name, item) in imports.iter().filter(|(name, _)| is_provided(name)) {
+        for (resource, ty) in resources(engine, item) {
+            if !stubbed.contains(&ty) || host_types.iter().any(|(known, _)| *known == ty) {
+                continue;
+            }
+            // An instance can re-export another's resource, which the provider
+            // defines only in the one that declares it, so each instance
+            // exporting the resource is tried until a probe typechecks.
+            if let Some(host) = probe_resource_type(engine, linker, name, &resource) {
+                host_types.push((ty, host));
+            }
+        }
+    }
+    host_types
+}
+
+/// The type `linker` defines for the resource `resource` of the instance
+/// `instance`, found by typechecking a component that imports only that
+/// resource. `None` if the linker does not define it there.
+fn probe_resource_type<T: Send + 'static>(
+    engine: &Engine,
+    linker: &Linker<T>,
+    instance: &str,
+    resource: &str,
+) -> Option<ResourceType> {
+    use wasmtime::component::types::ComponentItem;
+
+    let mut instance_type = wasm_encoder::InstanceType::new();
+    instance_type.export(
+        resource,
+        wasm_encoder::ComponentTypeRef::Type(wasm_encoder::TypeBounds::SubResource),
+    );
+    let mut types = wasm_encoder::ComponentTypeSection::new();
+    types.instance(&instance_type);
+    let mut imports = wasm_encoder::ComponentImportSection::new();
+    imports.import(instance, wasm_encoder::ComponentTypeRef::Instance(0));
+    let mut probe = wasm_encoder::Component::new();
+    probe.section(&types);
+    probe.section(&imports);
+    let probe = Component::new(engine, probe.finish()).ok()?;
+    let probe = linker.substituted_component_type(&probe).ok()?;
+    let (_, item) = probe.imports(engine).next()?;
+    let ComponentItem::ComponentInstance(imported) = item.ty else {
+        return None;
+    };
+    let (_, export) = imported.exports(engine).next()?;
+    match export.ty {
+        ComponentItem::Resource(ty) => Some(ty),
+        _ => None,
+    }
+}
+
+/// Add the WASI p2 and p3 hosts to `linker`. A runtime built for wasm32-wasip2
+/// imports the p2 interfaces for most of WASI, and the p3 interfaces for the
+/// monotonic clock and `wasi:http`. A runtime built for wasm32-wasip3 imports
+/// only p3 interfaces.
+pub fn add_wasi<T: WasiView + 'static>(linker: &mut Linker<T>) -> anyhow::Result<()> {
+    wasmtime_wasi::p2::add_to_linker_async(linker)?;
+    wasmtime_wasi::p3::add_to_linker(linker)?;
+    Ok(())
+}
+
+/// Whether the WASI host added by [`add_wasi`] provides `interface_name`: an
+/// interface of the p2 host at a version compatible with `0.2.0`, or of the p3
+/// host at a version compatible with `0.3.0` (see [`same_interface`]). The p3
+/// host provides the same packages as the p2 host, except `wasi:io`.
+/// Pre-release versions aren't provided.
+fn is_wasi_host_instance(interface_name: &str) -> bool {
+    let Some((interface, _)) = interface_name.split_once('@') else {
+        return false;
+    };
+    let both_generations = interface.starts_with("wasi:cli/")
+        || interface.starts_with("wasi:clocks/")
+        || interface.starts_with("wasi:random/")
+        || interface.starts_with("wasi:filesystem/")
+        || interface.starts_with("wasi:sockets/");
+    let compatible =
+        |version: &str| same_interface(interface_name, &format!("{interface}@{version}"));
+    (both_generations || interface.starts_with("wasi:io/")) && compatible("0.2.0")
+        || both_generations && compatible("0.3.0")
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    /// The names of the componentizer's own exports are refused. All other names
+    /// are accepted.
+    #[test]
+    fn reserved_export_names_are_refused() {
+        for (export, reserved) in [
+            ("wizer-initialize: func()", true),
+            ("wizer-INITIALIZE: func()", true),
+            (&format!("{RAW_HTTP_HANDLER_EXPORT}: func()"), true),
+            ("starling:componentize/init@0.1.0", true),
+            ("starling:componentize/init@9.0.0", true),
+            ("init: func()", false),
+            ("run: func()", false),
+        ] {
+            let mut resolve = Resolve::default();
+            let package = resolve
+                .push_str(
+                    "w.wit",
+                    &format!(
+                        "package t:w; world w {{ export {export}; }}\n\
+                         package starling:componentize@0.1.0 {{ interface init {{}} }}\n\
+                         package starling:componentize@9.0.0 {{ interface init {{}} }}\n"
+                    ),
+                )
+                .unwrap();
+            let world = resolve.select_world(&[package], Some("w")).unwrap();
+            let result = check_export_names(&resolve, world);
+            assert_eq!(result.is_err(), reserved, "{export}: {result:?}");
+        }
+    }
+
+    /// The componentizer is released together with the runtime, under the
+    /// version of the runtime workspace, `[workspace.package]` in the
+    /// repository's `Cargo.toml`. This crate is a workspace of its own and cannot
+    /// inherit it, so its own version has to be kept equal.
+    #[test]
+    fn version_is_the_workspace_version() {
+        let manifest =
+            std::fs::read_to_string(Path::new(env!("CARGO_MANIFEST_DIR")).join("../Cargo.toml"))
+                .unwrap();
+        let section = manifest
+            .split("[workspace.package]")
+            .nth(1)
+            .expect("the repository's `Cargo.toml` has a `[workspace.package]` table");
+        let version = section
+            .lines()
+            .find_map(|line| line.strip_prefix("version = \""))
+            .and_then(|rest| rest.strip_suffix('"'))
+            .expect("`[workspace.package]` sets `version`");
+        assert_eq!(
+            env!("CARGO_PKG_VERSION"),
+            version,
+            "set `version` in `componentize/Cargo.toml` to the workspace's"
+        );
+    }
+
+    /// The WASI host provides compatible versions of its interfaces, and not
+    /// their pre-releases or other versions.
+    #[test]
+    fn wasi_host_instances_match_compatible_versions() {
+        for (name, owned) in [
+            ("wasi:io/poll@0.2.0", true),
+            ("wasi:io/poll@0.2.12", true),
+            ("wasi:cli/environment@0.3.0", true),
+            ("wasi:cli/environment@0.3.4", true),
+            ("wasi:io/poll@0.3.0", false),
+            ("wasi:cli/environment@0.3.0-rc.1", false),
+            ("wasi:cli/environment@0.4.0", false),
+            ("wasi:http/types@0.3.0", false),
+            ("wasi:cli/environment", false),
+        ] {
+            assert_eq!(is_wasi_host_instance(name), owned, "{name}");
+        }
+    }
+
+    /// A runtime is accepted if its `init` interface is compatible with the
+    /// componentizer's, and refused otherwise, or if it exports none.
+    #[test]
+    fn runtime_init_interface_versions_are_checked() {
+        let runtime = |wit: &str| {
+            let mut resolve = Resolve::default();
+            let package = resolve.push_str("runtime.wit", wit).unwrap();
+            let world = resolve.select_world(&[package], Some("runtime")).unwrap();
+            let mut module = wasm_encoder::Module::new().finish();
+            CustomSection {
+                name: Cow::Borrowed("component-type"),
+                data: Cow::Owned(
+                    metadata::encode(
+                        &resolve,
+                        world,
+                        wit_component::StringEncoding::UTF8,
+                        None,
+                        false,
+                    )
+                    .unwrap(),
+                ),
+            }
+            .append_to(&mut module);
+            Runtime::new(module).unwrap()
+        };
+        let with_version = |version: &str| {
+            runtime(&format!(
+                "package starling:componentize@{version};\n\
+                 interface init {{ init: func(); }}\n\
+                 world runtime {{ export init; }}\n"
+            ))
+        };
+        let own = init_interface_name();
+        let (major_minor, patch) = own.rsplit_once('@').unwrap().1.rsplit_once('.').unwrap();
+        let patch: u32 = patch.parse().unwrap();
+
+        check_runtime_interface(&with_version(&format!("{major_minor}.{patch}"))).unwrap();
+        check_runtime_interface(&with_version(&format!("{major_minor}.{}", patch + 1))).unwrap();
+        let error = check_runtime_interface(&with_version("99.0.0"))
+            .unwrap_err()
+            .to_string();
+        assert!(
+            error.contains("implements `starling:componentize/init@99.0.0`"),
+            "{error}"
+        );
+        let error = check_runtime_interface(&runtime(
+            "package t:other;\ninterface i {}\nworld runtime { export i; }\n",
+        ))
+        .unwrap_err()
+        .to_string();
+        assert!(
+            error.contains("exports no `starling:componentize/init`"),
+            "{error}"
+        );
+    }
+
+    /// A fresh directory under the system temp directory, named after `name`
+    /// and the process, holding `files` at their relative paths.
+    fn wit_tree(name: &str, files: &[(&str, &str)]) -> PathBuf {
+        let root = std::env::temp_dir().join(format!("starling-{name}-{}", std::process::id()));
+        let _ = std::fs::remove_dir_all(&root);
+        for (path, contents) in files {
+            let path = root.join(path);
+            std::fs::create_dir_all(path.parent().unwrap()).unwrap();
+            std::fs::write(path, contents).unwrap();
+        }
+        root
+    }
+
+    /// The names of `world`'s imports and exports.
+    fn world_items(resolve: &Resolve, world: WorldId) -> (Vec<String>, Vec<String>) {
+        let names = |items: &wit_parser::IndexMap<WorldKey, wit_parser::WorldItem>| {
+            items
+                .keys()
+                .map(|key| resolve.name_world_key(key))
+                .collect()
+        };
+        (
+            names(&resolve.worlds[world].imports),
+            names(&resolve.worlds[world].exports),
+        )
+    }
+
+    /// A WIT package passed twice, directly or through a directory's `deps`,
+    /// is loaded once.
+    #[test]
+    fn a_package_loaded_twice_is_merged() {
+        let root = wit_tree(
+            "wit-twice",
+            &[
+                (
+                    "wit/deps/dep/dep.wit",
+                    "package test:dep;\ninterface i {}\n",
+                ),
+                (
+                    "wit/app.wit",
+                    "package test:app;\nworld w { import test:dep/i; }\n",
+                ),
+            ],
+        );
+        let (wit, dep) = (root.join("wit"), root.join("wit/deps/dep"));
+        for paths in [vec![wit.clone(), wit.clone()], vec![dep, wit]] {
+            let (resolve, world) = load_world(Wit::Paths(&paths), None, &[], false).unwrap();
+            assert_eq!(resolve.worlds[world].name, "w");
+        }
+        std::fs::remove_dir_all(&root).unwrap();
+    }
+
+    /// Partial definitions of one package are merged into a package with the
+    /// interfaces and functions of each, and several worlds into one.
+    #[test]
+    fn partial_packages_and_several_worlds_are_merged() {
+        let root = wit_tree(
+            "wit-partial",
+            &[
+                (
+                    "kv/kv.wit",
+                    "package test:spin@1.0.0;\n\
+                     interface kv { get: func() -> u32; }\n\
+                     world kv-world { import kv; }\n",
+                ),
+                (
+                    "vars/vars.wit",
+                    "package test:spin@1.0.0;\n\
+                     interface vars { get: func() -> string; }\n\
+                     interface kv { set: func(v: u32); }\n\
+                     world vars-world { import vars; export run: func(); }\n",
+                ),
+            ],
+        );
+        let paths = [root.join("kv"), root.join("vars")];
+        let selection = WorldSelection {
+            worlds: vec!["test:spin/kv-world@1.0.0", "vars-world"],
+            builtins: Vec::new(),
+            resolved: Vec::new(),
+        };
+        let (resolve, world) = load_world(Wit::Paths(&paths), selection, &[], false).unwrap();
+        assert_eq!(resolve.worlds[world].name, MERGED_WORLD_NAME);
+        assert_eq!(
+            world_items(&resolve, world),
+            (
+                vec![
+                    "test:spin/kv@1.0.0".to_string(),
+                    "test:spin/vars@1.0.0".to_string()
+                ],
+                vec!["run".to_string()]
+            )
+        );
+        let kv = resolve
+            .interfaces
+            .iter()
+            .find(|(_, i)| i.name.as_deref() == Some("kv"))
+            .unwrap()
+            .1;
+        let functions: Vec<&str> = kv.functions.keys().map(String::as_str).collect();
+        assert_eq!(functions, ["get", "set"]);
+        std::fs::remove_dir_all(&root).unwrap();
+    }
+
+    /// A builtin world is merged into the selected one, and its partial
+    /// definition of an interface into the WIT's full one.
+    #[test]
+    fn a_builtin_world_is_merged_into_the_selected_one() {
+        const BUILTIN: &str = "package test:serve;\n\
+             world serve { export test:http/handler@1.0.0; }\n\
+             package test:http@1.0.0 { interface handler {} }\n";
+        let root = wit_tree(
+            "wit-builtin",
+            &[(
+                "app.wit",
+                "package test:app;\n\
+                 world app { import log: func(); }\n\
+                 package test:http@1.0.0 { interface handler { handle: func(); } }\n",
+            )],
+        );
+        let selection = WorldSelection {
+            worlds: vec![],
+            builtins: vec![(BUILTIN, "serve")],
+            resolved: Vec::new(),
+        };
+        let (resolve, world) =
+            load_world(Wit::Paths(&[root.join("app.wit")]), selection, &[], false).unwrap();
+        assert_eq!(
+            world_items(&resolve, world),
+            (
+                vec!["log".to_string()],
+                vec!["test:http/handler@1.0.0".to_string()]
+            )
+        );
+        let handler = resolve
+            .interfaces
+            .iter()
+            .find(|(_, i)| i.name.as_deref() == Some("handler"))
+            .unwrap()
+            .1;
+        assert!(handler.functions.contains_key("handle"));
+        std::fs::remove_dir_all(&root).unwrap();
+    }
+
+    /// If definitions of a package disagree on a function, the error names the
+    /// path that disagrees.
+    #[test]
+    fn disagreeing_package_definitions_are_refused() {
+        let root = wit_tree(
+            "wit-disagree",
+            &[
+                (
+                    "a.wit",
+                    "package test:p;\ninterface i { f: func(); }\nworld w {}\n",
+                ),
+                (
+                    "b.wit",
+                    "package test:p;\ninterface i { f: func(x: u32); }\nworld v {}\n",
+                ),
+            ],
+        );
+        let paths = [root.join("a.wit"), root.join("b.wit")];
+        let err = load_world(Wit::Paths(&paths), Some("v"), &[], false).unwrap_err();
+        let message = format!("{err:#}");
+        assert!(message.contains("b.wit"), "{message}");
+        assert!(message.contains("mismatch in function `f`"), "{message}");
+        std::fs::remove_dir_all(&root).unwrap();
+    }
+
+    /// A WIT syntax error names the file, line and column it was found at.
+    #[test]
+    fn wit_errors_name_their_location() {
+        let err = load_world(
+            Wit::<PathBuf>::String("package a:b;\nworld w {\n  export f: func() -> u32\n}\n"),
+            None,
+            &[],
+            false,
+        )
+        .unwrap_err()
+        .to_string();
+        assert!(err.contains("wit:4:1"), "{err}");
+    }
+}
diff --git a/componentize/src/static_link.rs b/componentize/src/static_link.rs
new file mode 100644
index 00000000..2d93fe8a
--- /dev/null
+++ b/componentize/src/static_link.rs
@@ -0,0 +1,849 @@
+// SPDX-License-Identifier: Apache-2.0-WITH-LLVM-exception
+
+//! Linking a statically built runtime with wit-dylib bindings.
+//!
+//! [`link`] produces the component that is then initialized with Wizer. The
+//! runtime is the non-PIC core module of the runtime component built by
+//! `scripts/build-runtime.sh`, and the bindings are the wit-dylib module for
+//! the user's world. They become the main module and one library of a
+//! [`wit_component::ComponentEncoder`].
+//!
+//! The bindings module imports from `env`: the memory, the function table, the
+//! immutable `__memory_base` and `__table_base` globals, and the `wit_dylib_*`
+//! intrinsic functions. Bindings for a wasm32-wasip2 runtime also import the
+//! mutable `__stack_pointer` global from `env`. Bindings for a wasm32-wasip3
+//! runtime instead import the `[context-get-0]` and `[context-set-0]` builtins
+//! from `$root`, which reach the stack pointer in the task context, and their
+//! start function runs on a dedicated stack (see [`START_STACK_SIZE`]). The
+//! bindings module's only data segment, which holds the WIT metadata, is placed
+//! at `__memory_base`, and its only element segment is placed at `__table_base`.
+//! Two rewrites satisfy the `env` imports from the runtime:
+//!
+//! - [`reserve_in_runtime`] raises the runtime's memory and table minimums by
+//!   the sizes the bindings' `dylink.0` section declares, and appends two
+//!   constant globals holding the old ends, exported as `__memory_base` and
+//!   `__table_base`. The reserved memory lies past the end of wasi-libc's
+//!   initial heap, the link-time constant `__heap_end`. `sbrk` grows memory
+//!   from its current size, so `malloc` never allocates the reserved memory.
+//! - [`rewrite_bindings`] renames the bindings' `env` imports other than
+//!   `memory` to `__main_module__`, which the encoder resolves to the main
+//!   module's exports of the same name. It drops the `dylink.0` section and
+//!   adds a start function that runs `__wasm_apply_data_relocs`, which
+//!   relocates the metadata's pointers by `__memory_base`, and then
+//!   `__wasm_call_ctors`, which passes the metadata to `wit_dylib_initialize`.
+//!   Both therefore run at instantiation, before any export is called. Wizer
+//!   runs the start function during initialization and omits it from the
+//!   snapshot.
+
+use {
+    anyhow::{anyhow, bail, Context as _},
+    wasm_encoder::{
+        reencode::{Reencode as _, RoundtripReencoder},
+        CodeSection, ConstExpr, ExportKind, ExportSection, Function, FunctionSection,
+        GlobalSection, GlobalType, ImportSection, Instruction, MemorySection, MemoryType, Module,
+        RawSection, StartSection, TableSection, TableType, TypeSection, ValType,
+    },
+    wasmparser::{
+        Dylink0Subsection, ExternalKind, KnownCustom, MemInfo, Parser, Payload, TableInit, TypeRef,
+    },
+    wit_component::{ComponentEncoder, LibraryInfo},
+    wit_dylib::StackPointer,
+};
+
+/// The library name the bindings module is registered under.
+const BINDINGS_LIBRARY: &str = "starling-bindings";
+
+/// The import module the encoder resolves against the main module's exports.
+const MAIN_MODULE: &str = "__main_module__";
+
+/// The canonical builtin the bindings call to set task context slot 0, imported when they were
+/// generated for a runtime that keeps its stack pointer there.
+const CONTEXT_SET: &str = "[context-set-0]";
+
+/// The global the bindings import for the base of their reserved memory region.
+const MEMORY_BASE: &str = "__memory_base";
+
+/// The global the bindings import for the base of their reserved table region.
+const TABLE_BASE: &str = "__table_base";
+
+/// Size in bytes of one wasm memory page.
+const PAGE_SIZE: u64 = 65536;
+
+/// Shadow stack the start function runs on when the runtime keeps its stack pointer in the task
+/// context.
+///
+/// The start function runs at instantiation, before any task exists, so context slot 0 holds 0 and
+/// the runtime's `wit_dylib_initialize` would address memory below zero. This much is reserved
+/// immediately below `__memory_base`, and the start function points the stack at `__memory_base` so
+/// it grows down through the reservation. The reservation lies below the bindings' region rather
+/// than above it, so an overrun runs off the bottom of the reservation instead of into the metadata
+/// the same start function is about to read.
+///
+/// The size isn't measured. Pages that the start function doesn't touch stay zero, so the
+/// snapshot only grows by the pages it uses.
+const START_STACK_SIZE: u32 = 16 * PAGE_SIZE as u32;
+
+/// Link the runtime's core module (`runtime`) and the target world's wit-dylib
+/// module (`bindings`) into a component. `stack_pointer` is the location of the
+/// shadow stack pointer for which the bindings were generated.
+pub fn link(
+    runtime: &[u8],
+    bindings: &[u8],
+    stack_pointer: &StackPointer,
+) -> anyhow::Result<Vec<u8>> {
+    let mut mem_info = bindings_mem_info(bindings)?;
+    let start_stack = matches!(stack_pointer, StackPointer::TaskContext);
+    if start_stack {
+        mem_info.memory_size += START_STACK_SIZE;
+    }
+    let runtime = reserve_in_runtime(runtime, &mem_info, start_stack)?;
+    let bindings = rewrite_bindings(bindings, start_stack)?;
+    ComponentEncoder::default()
+        .validate(true)
+        .module(&runtime)
+        .context("registering the runtime as the main module")?
+        .library(
+            BINDINGS_LIBRARY,
+            &bindings,
+            LibraryInfo {
+                arguments: Vec::new(),
+            },
+        )
+        .context("registering the bindings library")?
+        .encode()
+        .context("encoding the component")
+}
+
+/// The memory and table reservation the bindings module declares in its
+/// `dylink.0` section.
+fn bindings_mem_info(bindings: &[u8]) -> anyhow::Result<MemInfo> {
+    for payload in Parser::new(0).parse_all(bindings) {
+        let Payload::CustomSection(section) = payload.context("parsing the bindings module")?
+        else {
+            continue;
+        };
+        let KnownCustom::Dylink0(reader) = section.as_known() else {
+            continue;
+        };
+        for subsection in reader {
+            if let Dylink0Subsection::MemInfo(info) =
+                subsection.context("parsing the bindings' `dylink.0` section")?
+            {
+                return Ok(info);
+            }
+        }
+    }
+    bail!("the bindings module has no `dylink.0` memory info")
+}
+
+/// Reserve room for the bindings in the runtime's memory and table, and export
+/// the reserved regions' start offsets as `__memory_base` and `__table_base`.
+///
+/// The runtime must define its memory and table rather than import them, and
+/// the memory must be 32-bit. Every section other than the table, memory,
+/// global and export sections is copied unchanged.
+fn reserve_in_runtime(
+    runtime: &[u8],
+    mem_info: &MemInfo,
+    start_stack: bool,
+) -> anyhow::Result<Vec<u8>> {
+    let mut module = Module::new();
+    let mut imported_globals = 0u32;
+    let mut defined_globals = 0u32;
+    let mut memory_base = None;
+    let mut table_base = None;
+    let mut global_section_seen = false;
+
+    for payload in Parser::new(0).parse_all(runtime) {
+        let payload = payload.context("parsing the runtime module")?;
+        match &payload {
+            Payload::ImportSection(reader) => {
+                for import in reader.clone().into_imports() {
+                    let import = import?;
+                    match import.ty {
+                        wasmparser::TypeRef::Global(_) => imported_globals += 1,
+                        wasmparser::TypeRef::Memory(_) | wasmparser::TypeRef::Table(_) => bail!(
+                            "the runtime imports `{}::{}`, but must define its memory and table",
+                            import.module,
+                            import.name
+                        ),
+                        _ => {}
+                    }
+                }
+                copy_raw(&mut module, &payload, runtime);
+            }
+            Payload::TableSection(reader) => {
+                let mut tables = TableSection::new();
+                for (index, table) in reader.clone().into_iter().enumerate() {
+                    let table = table?;
+                    let mut ty = RoundtripReencoder.table_type(table.ty)?;
+                    if index == 0 {
+                        let (base, minimum) = reserve(
+                            ty.minimum,
+                            u64::from(mem_info.table_size),
+                            mem_info.table_alignment,
+                        )?;
+                        table_base = Some(base);
+                        ty.minimum = minimum;
+                        ty.maximum = ty.maximum.map(|max| max.max(minimum));
+                    }
+                    push_table(&mut tables, ty, table.init)?;
+                }
+                module.section(&tables);
+            }
+            Payload::MemorySection(reader) => {
+                let mut memories = MemorySection::new();
+                for (index, memory) in reader.clone().into_iter().enumerate() {
+                    let mut ty: MemoryType = RoundtripReencoder.memory_type(memory?)?;
+                    if index == 0 {
+                        if ty.memory64 {
+                            bail!("the runtime's memory is 64-bit, which is unsupported");
+                        }
+                        let (base, minimum) = reserve(
+                            ty.minimum * PAGE_SIZE,
+                            u64::from(mem_info.memory_size),
+                            mem_info.memory_alignment,
+                        )?;
+                        // The bindings' own region starts above the start function's stack, whose
+                        // size is already included in the reservation.
+                        memory_base = Some(if start_stack {
+                            base + u64::from(START_STACK_SIZE)
+                        } else {
+                            base
+                        });
+                        ty.minimum = minimum.div_ceil(PAGE_SIZE);
+                        ty.maximum = ty.maximum.map(|max| max.max(ty.minimum));
+                    }
+                    memories.memory(ty);
+                }
+                module.section(&memories);
+            }
+            Payload::GlobalSection(reader) => {
+                global_section_seen = true;
+                let mut globals = GlobalSection::new();
+                RoundtripReencoder.parse_global_section(&mut globals, reader.clone())?;
+                defined_globals = globals.len();
+                push_base_globals(&mut globals, memory_base, table_base)?;
+                module.section(&globals);
+            }
+            Payload::ExportSection(reader) => {
+                if !global_section_seen {
+                    let mut globals = GlobalSection::new();
+                    push_base_globals(&mut globals, memory_base, table_base)?;
+                    module.section(&globals);
+                }
+                let mut exports = ExportSection::new();
+                RoundtripReencoder.parse_export_section(&mut exports, reader.clone())?;
+                let first_base = imported_globals + defined_globals;
+                exports.export(MEMORY_BASE, ExportKind::Global, first_base);
+                exports.export(TABLE_BASE, ExportKind::Global, first_base + 1);
+                module.section(&exports);
+            }
+            _ => copy_raw(&mut module, &payload, runtime),
+        }
+    }
+
+    if memory_base.is_none() || table_base.is_none() {
+        bail!("the runtime defines no memory or no table");
+    }
+    Ok(module.finish())
+}
+
+/// Rewrite the bindings module to be linked against the main module directly:
+/// `env` imports other than `memory` move to `__main_module__`, the `dylink.0`
+/// section is dropped, and a start function is added that calls
+/// `__wasm_apply_data_relocs`, when the module exports one, and then
+/// `__wasm_call_ctors`.
+///
+/// If `start_stack` is set, the start function first installs `__memory_base` in task context
+/// slot 0, so it runs on the shadow stack reserved immediately below the bindings' region. Both the
+/// slot and the global are already imported by such a bindings module, so this adds no import and
+/// shifts no index.
+///
+/// The start function is appended after the module's own functions, with a
+/// new `[] -> []` type appended to the type section, so no existing index
+/// changes.
+fn rewrite_bindings(bindings: &[u8], start_stack: bool) -> anyhow::Result<Vec<u8>> {
+    let mut module = Module::new();
+    let mut imported_funcs = 0u32;
+    let mut imported_globals = 0u32;
+    let mut context_set = None;
+    let mut memory_base = None;
+    let mut start_type = None;
+    let mut start_index = None;
+    let mut start_body = None;
+    // The code section under construction while its entries are being read.
+    // It is emitted, with the start body appended, at the first payload after
+    // the last entry.
+    let mut code: Option<CodeSection> = None;
+
+    for payload in Parser::new(0).parse_all(bindings) {
+        let payload = payload.context("parsing the bindings module")?;
+        if !matches!(payload, Payload::CodeSectionEntry(_)) {
+            if let Some(mut code) = code.take() {
+                let body = start_body
+                    .take()
+                    .ok_or_else(|| anyhow!("the bindings module's code precedes its exports"))?;
+                code.function(&body);
+                module.section(&code);
+            }
+        }
+        match &payload {
+            Payload::TypeSection(reader) => {
+                let mut types = TypeSection::new();
+                RoundtripReencoder.parse_type_section(&mut types, reader.clone())?;
+                start_type = Some(types.len());
+                types.ty().function([], []);
+                module.section(&types);
+            }
+            Payload::ImportSection(reader) => {
+                let mut imports = ImportSection::new();
+                for import in reader.clone().into_imports() {
+                    let import = import?;
+                    match import.ty {
+                        TypeRef::Func(_) => {
+                            if import.name == CONTEXT_SET {
+                                context_set = Some(imported_funcs);
+                            }
+                            imported_funcs += 1;
+                        }
+                        TypeRef::Global(_) => {
+                            if import.name == MEMORY_BASE {
+                                memory_base = Some(imported_globals);
+                            }
+                            imported_globals += 1;
+                        }
+                        _ => {}
+                    }
+                    let module_name = if import.module == "env" && import.name != "memory" {
+                        MAIN_MODULE
+                    } else {
+                        import.module
+                    };
+                    imports.import(
+                        module_name,
+                        import.name,
+                        RoundtripReencoder.entity_type(import.ty)?,
+                    );
+                }
+                module.section(&imports);
+            }
+            Payload::FunctionSection(reader) => {
+                let mut functions = FunctionSection::new();
+                RoundtripReencoder.parse_function_section(&mut functions, reader.clone())?;
+                start_index = Some(imported_funcs + functions.len());
+                let start_type =
+                    start_type.ok_or_else(|| anyhow!("the bindings module has no type section"))?;
+                functions.function(start_type);
+                module.section(&functions);
+            }
+            Payload::ExportSection(reader) => {
+                copy_raw(&mut module, &payload, bindings);
+                let mut apply_relocs = None;
+                let mut ctors = None;
+                for export in reader.clone() {
+                    let export = export?;
+                    if export.kind != ExternalKind::Func {
+                        continue;
+                    }
+                    match export.name {
+                        "__wasm_apply_data_relocs" => apply_relocs = Some(export.index),
+                        "__wasm_call_ctors" => ctors = Some(export.index),
+                        _ => {}
+                    }
+                }
+                let ctors = ctors
+                    .ok_or_else(|| anyhow!("the bindings module exports no `__wasm_call_ctors`"))?;
+                let mut body = Function::new([]);
+                if start_stack {
+                    let context_set = context_set
+                        .ok_or_else(|| anyhow!("the bindings module imports no `{CONTEXT_SET}`"))?;
+                    let memory_base = memory_base
+                        .ok_or_else(|| anyhow!("the bindings module imports no `{MEMORY_BASE}`"))?;
+                    body.instruction(&Instruction::GlobalGet(memory_base));
+                    body.instruction(&Instruction::Call(context_set));
+                }
+                if let Some(apply_relocs) = apply_relocs {
+                    body.instruction(&Instruction::Call(apply_relocs));
+                }
+                body.instruction(&Instruction::Call(ctors));
+                body.instruction(&Instruction::End);
+                start_body = Some(body);
+                let function_index = start_index
+                    .ok_or_else(|| anyhow!("the bindings module has no function section"))?;
+                module.section(&StartSection { function_index });
+            }
+            Payload::StartSection { .. } => {
+                bail!("the bindings module already has a start function")
+            }
+            Payload::CodeSectionStart { .. } => code = Some(CodeSection::new()),
+            Payload::CodeSectionEntry(body) => {
+                code.as_mut()
+                    .ok_or_else(|| anyhow!("a code entry outside the code section"))?
+                    .raw(&bindings[usize_range(body.range())]);
+            }
+            Payload::CustomSection(section) if section.name() == "dylink.0" => {}
+            _ => copy_raw(&mut module, &payload, bindings),
+        }
+    }
+    Ok(module.finish())
+}
+
+/// Append the region-start globals to a runtime global section.
+fn push_base_globals(
+    globals: &mut GlobalSection,
+    memory_base: Option<u64>,
+    table_base: Option<u64>,
+) -> anyhow::Result<()> {
+    let (Some(memory_base), Some(table_base)) = (memory_base, table_base) else {
+        bail!("the runtime's global section precedes its memory or table section");
+    };
+    let i32_const = GlobalType {
+        val_type: ValType::I32,
+        mutable: false,
+        shared: false,
+    };
+    let offset = |base: u64| -> anyhow::Result<i32> {
+        u32::try_from(base)
+            .map(|v| v as i32)
+            .map_err(|_| anyhow!("region base {base} exceeds the 32-bit address space"))
+    };
+    globals.global(i32_const, &ConstExpr::i32_const(offset(memory_base)?));
+    globals.global(i32_const, &ConstExpr::i32_const(offset(table_base)?));
+    Ok(())
+}
+
+/// Place a region of `size` units aligned to `2^alignment` units at or past
+/// `end`, returning the region's start and the new end.
+fn reserve(end: u64, size: u64, alignment: u32) -> anyhow::Result<(u64, u64)> {
+    let align = 1u64
+        .checked_shl(alignment)
+        .ok_or_else(|| anyhow!("unsupported region alignment 2^{alignment}"))?;
+    let base = end.next_multiple_of(align);
+    Ok((base, base + size))
+}
+
+fn push_table(tables: &mut TableSection, ty: TableType, init: TableInit<'_>) -> anyhow::Result<()> {
+    match init {
+        TableInit::RefNull => tables.table(ty),
+        TableInit::Expr(expr) => tables.table_with_init(ty, &RoundtripReencoder.const_expr(expr)?),
+    };
+    Ok(())
+}
+
+/// Narrow a wasmparser byte range to index a slice. Ranges are `u64` for 64-bit
+/// memories. Every module here is wasm32, so the bounds fit.
+fn usize_range(range: std::ops::Range<u64>) -> std::ops::Range<usize> {
+    range.start as usize..range.end as usize
+}
+
+/// Copy a section into `module` byte for byte.
+///
+/// A payload that is not a whole section (a code entry, the version header,
+/// the end marker) is skipped, since the code section is copied from its
+/// `CodeSectionStart` payload.
+fn copy_raw(module: &mut Module, payload: &Payload<'_>, source: &[u8]) {
+    if let Some((id, range)) = payload.as_section() {
+        module.section(&RawSection {
+            id,
+            data: &source[usize_range(range)],
+        });
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use {
+        super::*,
+        wasm_encoder::{
+            CodeSection, Function, FunctionSection, Instruction, Section as _, TypeSection,
+        },
+        wasmparser::{ExternalKind, TypeRef, Validator, WasmFeatures},
+        wit_dylib::{AsyncFilterSet, DylibOpts},
+        wit_parser::Resolve,
+    };
+
+    const WORLD: &str = "\
+package test:static-link;
+
+world w {
+  import log: func(message: string);
+  export greet: func(name: string) -> string;
+}
+";
+
+    /// The bindings for `WORLD` and a wasm32-wasip2 runtime, with the world's
+    /// `component-type` section appended as `componentize` does, so the encoder
+    /// reads the world from the library.
+    fn bindings() -> Vec<u8> {
+        bindings_with(StackPointer::Global)
+    }
+
+    /// Like [`bindings`], for a runtime that keeps its stack pointer in `stack_pointer`.
+    fn bindings_with(stack_pointer: StackPointer) -> Vec<u8> {
+        let mut resolve = Resolve::default();
+        let package = resolve.push_str("w.wit", WORLD).unwrap();
+        let world = resolve.select_world(&[package], Some("w")).unwrap();
+        let mut opts = DylibOpts {
+            interpreter: None,
+            async_: AsyncFilterSet::default(),
+            stack_pointer,
+        };
+        let mut bindings = wit_dylib::create(&resolve, world, Some(&mut opts)).unwrap();
+        wasm_encoder::CustomSection {
+            name: "component-type:test".into(),
+            data: wit_component::metadata::encode(
+                &resolve,
+                world,
+                wit_component::StringEncoding::UTF8,
+                None,
+                false,
+            )
+            .unwrap()
+            .into(),
+        }
+        .append_to(&mut bindings);
+        bindings
+    }
+
+    /// A stand-in for the runtime: it exports what the runtime's core module exports,
+    /// plus a trapping function for every function `bindings` imports from
+    /// `env`, with the imported type.
+    fn fake_runtime(bindings: &[u8], memory_pages: u64, table_size: u64) -> Vec<u8> {
+        let mut types = TypeSection::new();
+        let mut functions = FunctionSection::new();
+        let mut code = CodeSection::new();
+        let mut exports = ExportSection::new();
+
+        let mut import_types = Vec::new();
+        for payload in Parser::new(0).parse_all(bindings) {
+            match payload.unwrap() {
+                Payload::TypeSection(reader) => {
+                    import_types = reader
+                        .into_iter_err_on_gc_types()
+                        .map(|t| t.unwrap())
+                        .collect();
+                }
+                Payload::ImportSection(reader) => {
+                    for import in reader.into_imports() {
+                        let import = import.unwrap();
+                        if import.module != "env" {
+                            continue;
+                        }
+                        if let TypeRef::Func(ty) = import.ty {
+                            let ty = &import_types[ty as usize];
+                            let params = ty
+                                .params()
+                                .iter()
+                                .map(|p| RoundtripReencoder.val_type(*p).unwrap());
+                            let results = ty
+                                .results()
+                                .iter()
+                                .map(|r| RoundtripReencoder.val_type(*r).unwrap());
+                            let index = types.len();
+                            types.ty().function(params, results);
+                            functions.function(index);
+                            let mut body = Function::new([]);
+                            body.instruction(&Instruction::Unreachable);
+                            body.instruction(&Instruction::End);
+                            code.function(&body);
+                            exports.export(import.name, ExportKind::Func, index);
+                        }
+                    }
+                }
+                _ => {}
+            }
+        }
+
+        let mut tables = TableSection::new();
+        tables.table(TableType {
+            element_type: wasm_encoder::RefType::FUNCREF,
+            table64: false,
+            minimum: table_size,
+            maximum: None,
+            shared: false,
+        });
+        let mut memories = MemorySection::new();
+        memories.memory(MemoryType {
+            minimum: memory_pages,
+            maximum: None,
+            memory64: false,
+            shared: false,
+            page_size_log2: None,
+        });
+        let mut globals = GlobalSection::new();
+        globals.global(
+            GlobalType {
+                val_type: ValType::I32,
+                mutable: true,
+                shared: false,
+            },
+            &ConstExpr::i32_const(1024),
+        );
+        exports.export("memory", ExportKind::Memory, 0);
+        exports.export("__indirect_function_table", ExportKind::Table, 0);
+        exports.export("__stack_pointer", ExportKind::Global, 0);
+
+        let mut module = Module::new();
+        module
+            .section(&types)
+            .section(&functions)
+            .section(&tables)
+            .section(&memories)
+            .section(&globals)
+            .section(&exports)
+            .section(&code);
+        module.finish()
+    }
+
+    fn validate(bytes: &[u8]) {
+        Validator::new_with_features(WasmFeatures::all())
+            .validate_all(bytes)
+            .expect("the output validates");
+    }
+
+    fn exported_global_value(module: &[u8], name: &str) -> i32 {
+        let mut globals = Vec::new();
+        let mut index = None;
+        for payload in Parser::new(0).parse_all(module) {
+            match payload.unwrap() {
+                Payload::GlobalSection(reader) => {
+                    for global in reader {
+                        let global = global.unwrap();
+                        let mut ops = global.init_expr.get_operators_reader();
+                        let wasmparser::Operator::I32Const { value } = ops.read().unwrap() else {
+                            panic!("a non-constant global initializer");
+                        };
+                        globals.push(value);
+                    }
+                }
+                Payload::ExportSection(reader) => {
+                    index = reader
+                        .into_iter()
+                        .map(|e| e.unwrap())
+                        .find(|e| e.name == name && e.kind == ExternalKind::Global)
+                        .map(|e| e.index);
+                }
+                _ => {}
+            }
+        }
+        globals[index.expect("the global is exported") as usize]
+    }
+
+    fn limits(module: &[u8]) -> (u64, u64) {
+        let mut memory = None;
+        let mut table = None;
+        for payload in Parser::new(0).parse_all(module) {
+            match payload.unwrap() {
+                Payload::MemorySection(reader) => {
+                    memory = Some(reader.into_iter().next().unwrap().unwrap().initial)
+                }
+                Payload::TableSection(reader) => {
+                    table = Some(reader.into_iter().next().unwrap().unwrap().ty.initial)
+                }
+                _ => {}
+            }
+        }
+        (memory.unwrap(), table.unwrap())
+    }
+
+    #[test]
+    fn runtime_reserves_regions_past_its_own() {
+        let bindings = bindings();
+        let info = bindings_mem_info(&bindings).unwrap();
+        assert!(info.memory_size > 0, "the metadata segment is not empty");
+        assert!(
+            info.table_size > 0,
+            "the export trampolines occupy table slots"
+        );
+
+        let runtime = fake_runtime(&bindings, 3, 5);
+        let reserved = reserve_in_runtime(&runtime, &info, false).unwrap();
+        validate(&reserved);
+
+        assert_eq!(exported_global_value(&reserved, MEMORY_BASE), 3 * 65536);
+        assert_eq!(exported_global_value(&reserved, TABLE_BASE), 5);
+        let (pages, slots) = limits(&reserved);
+        assert_eq!(pages, 3 + u64::from(info.memory_size).div_ceil(PAGE_SIZE));
+        assert_eq!(slots, 5 + u64::from(info.table_size));
+    }
+
+    #[test]
+    fn bindings_import_from_main_module_and_start_with_ctors() {
+        let rewritten = rewrite_bindings(&bindings(), false).unwrap();
+        validate(&rewritten);
+
+        let mut env_imports = Vec::new();
+        let mut main_imports = Vec::new();
+        let mut imported_funcs = 0;
+        let mut start = None;
+        let mut apply_relocs = None;
+        let mut ctors = None;
+        let mut custom = Vec::new();
+        let mut bodies = Vec::new();
+        for payload in Parser::new(0).parse_all(&rewritten) {
+            match payload.unwrap() {
+                Payload::ImportSection(reader) => {
+                    for import in reader.into_imports() {
+                        let import = import.unwrap();
+                        if let TypeRef::Func(_) = import.ty {
+                            imported_funcs += 1;
+                        }
+                        match import.module {
+                            "env" => env_imports.push(import.name.to_string()),
+                            MAIN_MODULE => main_imports.push(import.name.to_string()),
+                            _ => {}
+                        }
+                    }
+                }
+                Payload::ExportSection(reader) => {
+                    for export in reader.into_iter().map(|e| e.unwrap()) {
+                        match export.name {
+                            "__wasm_apply_data_relocs" => apply_relocs = Some(export.index),
+                            "__wasm_call_ctors" => ctors = Some(export.index),
+                            _ => {}
+                        }
+                    }
+                }
+                Payload::StartSection { func, .. } => start = Some(func),
+                Payload::CodeSectionEntry(body) => {
+                    let ops = body
+                        .get_operators_reader()
+                        .unwrap()
+                        .into_iter()
+                        .map(|op| op.unwrap())
+                        .collect::<Vec<_>>();
+                    bodies.push(ops);
+                }
+                Payload::CustomSection(section) => custom.push(section.name().to_string()),
+                _ => {}
+            }
+        }
+        assert_eq!(env_imports, ["memory"]);
+        for name in [
+            "__indirect_function_table",
+            "__stack_pointer",
+            MEMORY_BASE,
+            TABLE_BASE,
+        ] {
+            assert!(
+                main_imports.iter().any(|n| n == name),
+                "{name} is imported from the main module"
+            );
+        }
+        assert!(main_imports.iter().any(|n| n.starts_with("wit_dylib_")));
+        assert!(!custom.iter().any(|n| n == "dylink.0"));
+
+        let start = start.expect("a start function was added");
+        let body = &bodies[(start - imported_funcs) as usize];
+        let expected = [
+            wasmparser::Operator::Call {
+                function_index: apply_relocs.expect("the metadata has pointers to relocate"),
+            },
+            wasmparser::Operator::Call {
+                function_index: ctors.expect("the ctors are exported"),
+            },
+            wasmparser::Operator::End,
+        ];
+        assert_eq!(
+            body, &expected,
+            "the start function applies relocations, then runs the ctors"
+        );
+    }
+
+    #[test]
+    fn links_into_a_valid_component() {
+        let bindings = bindings();
+        let runtime = fake_runtime(&bindings, 2, 1);
+        let component = link(&runtime, &bindings, &StackPointer::Global).unwrap();
+        validate(&component);
+
+        let wit_component::DecodedWasm::Component(resolve, world) =
+            wit_component::decode(&component).unwrap()
+        else {
+            panic!("the output is a component");
+        };
+        let world = &resolve.worlds[world];
+        let names = |keys: &mut dyn Iterator<Item = &wit_parser::WorldKey>| {
+            keys.map(|key| resolve.name_world_key(key))
+                .collect::<Vec<_>>()
+        };
+        assert_eq!(names(&mut world.exports.keys()), ["greet"]);
+        assert_eq!(names(&mut world.imports.keys()), ["log"]);
+    }
+
+    /// Bindings that reach the stack pointer through the task context get the
+    /// start stack below their own region.
+    #[test]
+    fn task_context_bindings_reserve_the_start_stack() {
+        let bindings = bindings_with(StackPointer::TaskContext);
+
+        let mut info = bindings_mem_info(&bindings).unwrap();
+        let region = info.memory_size;
+        info.memory_size += START_STACK_SIZE;
+        let runtime = fake_runtime(&bindings, 3, 5);
+        let reserved = reserve_in_runtime(&runtime, &info, true).unwrap();
+        validate(&reserved);
+
+        assert_eq!(
+            exported_global_value(&reserved, MEMORY_BASE),
+            3 * 65536 + START_STACK_SIZE as i32
+        );
+        let (pages, _) = limits(&reserved);
+        assert_eq!(
+            pages,
+            3 + u64::from(START_STACK_SIZE + region).div_ceil(PAGE_SIZE)
+        );
+    }
+
+    /// The start function of bindings that reach the stack pointer through the
+    /// task context first sets context slot 0 to `__memory_base`, the top of the
+    /// start stack.
+    #[test]
+    fn task_context_start_function_sets_the_stack_pointer_first() {
+        let rewritten = rewrite_bindings(&bindings_with(StackPointer::TaskContext), true).unwrap();
+        validate(&rewritten);
+
+        let (mut funcs, mut globals) = (Vec::new(), Vec::new());
+        let mut start = None;
+        let mut bodies = Vec::new();
+        for payload in Parser::new(0).parse_all(&rewritten) {
+            match payload.unwrap() {
+                Payload::ImportSection(reader) => {
+                    for import in reader.into_imports() {
+                        let import = import.unwrap();
+                        match import.ty {
+                            TypeRef::Func(_) => funcs.push(import.name),
+                            TypeRef::Global(_) => globals.push(import.name),
+                            _ => {}
+                        }
+                    }
+                }
+                Payload::StartSection { func, .. } => start = Some(func),
+                Payload::CodeSectionEntry(body) => bodies.push(
+                    body.get_operators_reader()
+                        .unwrap()
+                        .into_iter()
+                        .map(|op| op.unwrap())
+                        .collect::<Vec<_>>(),
+                ),
+                _ => {}
+            }
+        }
+        let start = start.expect("a start function was added") as usize;
+        let body = &bodies[start - funcs.len()];
+        let index =
+            |names: &[&str], name: &str| names.iter().position(|n| *n == name).unwrap() as u32;
+        assert_eq!(
+            body[..2],
+            [
+                wasmparser::Operator::GlobalGet {
+                    global_index: index(&globals, MEMORY_BASE),
+                },
+                wasmparser::Operator::Call {
+                    function_index: index(&funcs, CONTEXT_SET),
+                },
+            ]
+        );
+    }
+}
diff --git a/componentize/src/supported.rs b/componentize/src/supported.rs
new file mode 100644
index 00000000..3a71bfa6
--- /dev/null
+++ b/componentize/src/supported.rs
@@ -0,0 +1,321 @@
+// SPDX-License-Identifier: Apache-2.0-WITH-LLVM-exception
+
+//! Rejecting worlds that use WIT types that the runtime can't lift or lower, so
+//! that they fail at componentization instead of trapping at instantiation or on
+//! the first call.
+
+use std::collections::HashSet;
+
+use anyhow::bail;
+use wit_parser::{Function, Resolve, Type, TypeDefKind, TypeId, WorldId, WorldItem, WorldKey};
+
+/// Fail if any function the world imports or exports uses a `map`, a fixed-length
+/// list or `error-context`, or a synchronous function the world exports takes or
+/// returns a `stream` or `future`, naming the first such function.
+///
+/// A synchronous export runs without an event loop, which the reads and writes
+/// of streams and futures require.
+pub(crate) fn check_supported_types(resolve: &Resolve, world: WorldId) -> anyhow::Result<()> {
+    let world = &resolve.worlds[world];
+    for (name, func) in functions(resolve, world.exports.iter()) {
+        if !func.kind.is_async() && types(func).any(|ty| has_stream_or_future(resolve, ty)) {
+            bail!(
+                "the synchronous export `{name}` takes or returns a `stream` or `future`, \
+                 which componentize supports only for `async` functions. Declare it `async`."
+            );
+        }
+    }
+    for (name, func) in functions(resolve, world.imports.iter().chain(world.exports.iter())) {
+        if let Some(unsupported) = types(func).find_map(|ty| unsupported_type(resolve, ty)) {
+            bail!("`{name}` uses a {unsupported}, which componentize does not support yet");
+        }
+    }
+    Ok(())
+}
+
+/// The functions of the world items `items`, each with its name in error
+/// messages: `<interface>#<function>`, or the function's own name for a
+/// world-level function.
+fn functions<'a>(
+    resolve: &'a Resolve,
+    items: impl Iterator<Item = (&'a WorldKey, &'a WorldItem)>,
+) -> impl Iterator<Item = (String, &'a Function)> {
+    items.flat_map(move |(key, item)| {
+        let (interface, funcs): (Option<String>, Vec<&Function>) = match item {
+            WorldItem::Function(func) => (None, vec![func]),
+            WorldItem::Interface { id, .. } => (
+                Some(resolve.name_world_key(key)),
+                resolve.interfaces[*id].functions.values().collect(),
+            ),
+            WorldItem::Type { .. } => (None, Vec::new()),
+        };
+        funcs.into_iter().map(move |func| {
+            let name = wit_name_mapping::function_wit_name(interface.as_deref(), &func.name);
+            (name, func)
+        })
+    })
+}
+
+/// The types of `func`'s parameters and result.
+fn types(func: &Function) -> impl Iterator<Item = Type> + '_ {
+    func.params.iter().map(|p| p.ty).chain(func.result)
+}
+
+/// Whether `ty` contains a `stream` or a `future`.
+fn has_stream_or_future(resolve: &Resolve, ty: Type) -> bool {
+    contains(resolve, ty, &|kind| {
+        matches!(kind, TypeDefKind::Stream(_) | TypeDefKind::Future(_))
+    })
+}
+
+/// Whether `ty` contains a `borrow`.
+fn has_borrow(resolve: &Resolve, ty: Type) -> bool {
+    contains(resolve, ty, &|kind| {
+        matches!(kind, TypeDefKind::Handle(wit_parser::Handle::Borrow(_)))
+    })
+}
+
+/// Whether `ty`, or a type it is made of, is a type whose kind `matches`. The
+/// payloads of streams and futures are not searched.
+fn contains(resolve: &Resolve, ty: Type, matches: &impl Fn(&TypeDefKind) -> bool) -> bool {
+    contains_unvisited(resolve, ty, matches, &mut HashSet::new())
+}
+
+/// Like [`contains`], but skips the types in `visited` and adds each type it walks.
+/// A type walked before contains no match, since the walk ends at the first one.
+fn contains_unvisited(
+    resolve: &Resolve,
+    ty: Type,
+    matches: &impl Fn(&TypeDefKind) -> bool,
+    visited: &mut HashSet<TypeId>,
+) -> bool {
+    let Type::Id(id) = ty else {
+        return false;
+    };
+    if !visited.insert(id) {
+        return false;
+    }
+    let kind = &resolve.types[id].kind;
+    if matches(kind) {
+        return true;
+    }
+    let mut walk = |t: Type| contains_unvisited(resolve, t, matches, visited);
+    match kind {
+        TypeDefKind::Record(r) => r.fields.iter().any(|f| walk(f.ty)),
+        TypeDefKind::Tuple(t) => t.types.iter().any(|&t| walk(t)),
+        TypeDefKind::Variant(v) => v.cases.iter().any(|c| c.ty.is_some_and(&mut walk)),
+        TypeDefKind::Option(t) | TypeDefKind::List(t) | TypeDefKind::Type(t) => walk(*t),
+        TypeDefKind::Result(r) => [r.ok, r.err].into_iter().flatten().any(walk),
+        _ => false,
+    }
+}
+
+/// Fail if a function imported directly by the world has a parameter whose type
+/// contains a `borrow`. wac-graph 0.11 can't encode such a function: its type
+/// encoder asserts that a `borrow` is inside an interface
+/// (`TypeEncoder::borrow`), so composing the snapshot would panic. The methods
+/// of a resource defined directly on the world are such functions.
+pub(crate) fn reject_world_level_borrows(resolve: &Resolve, world: WorldId) -> anyhow::Result<()> {
+    for (key, item) in &resolve.worlds[world].imports {
+        let WorldItem::Function(func) = item else {
+            continue;
+        };
+        if func
+            .params
+            .iter()
+            .any(|param| has_borrow(resolve, param.ty))
+        {
+            bail!(
+                "the world-level import `{}` takes a `borrow`, which the component composition \
+                 (wac-graph) cannot encode outside an interface. Declare the resource in an \
+                 interface the world imports instead.",
+                resolve.name_world_key(key)
+            );
+        }
+    }
+    Ok(())
+}
+
+/// The kind of the first unsupported type `ty` contains, if any.
+fn unsupported_type(resolve: &Resolve, ty: Type) -> Option<&'static str> {
+    unsupported_unvisited(resolve, ty, &mut HashSet::new())
+}
+
+/// Like [`unsupported_type`], but skips the types in `visited` and adds each type
+/// it walks. A type walked before contains no unsupported type, since the walk ends
+/// at the first one.
+fn unsupported_unvisited(
+    resolve: &Resolve,
+    ty: Type,
+    visited: &mut HashSet<TypeId>,
+) -> Option<&'static str> {
+    let id = match ty {
+        Type::ErrorContext => return Some("`error-context`"),
+        Type::Id(id) => id,
+        _ => return None,
+    };
+    if !visited.insert(id) {
+        return None;
+    }
+    let mut walk = |t: Type| unsupported_unvisited(resolve, t, visited);
+    match &resolve.types[id].kind {
+        TypeDefKind::Map(..) => Some("`map`"),
+        TypeDefKind::FixedLengthList(..) => Some("fixed-length `list`"),
+        TypeDefKind::Record(r) => r.fields.iter().find_map(|f| walk(f.ty)),
+        TypeDefKind::Tuple(t) => t.types.iter().find_map(|&t| walk(t)),
+        TypeDefKind::Variant(v) => v.cases.iter().find_map(|c| c.ty.and_then(&mut walk)),
+        TypeDefKind::Option(t) | TypeDefKind::List(t) | TypeDefKind::Type(t) => walk(*t),
+        TypeDefKind::Result(r) => [r.ok, r.err].into_iter().flatten().find_map(walk),
+        TypeDefKind::Future(t) | TypeDefKind::Stream(t) => t.and_then(walk),
+        TypeDefKind::Resource
+        | TypeDefKind::Handle(_)
+        | TypeDefKind::Flags(_)
+        | TypeDefKind::Enum(_)
+        | TypeDefKind::Unknown => None,
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn check(wit: &str) -> anyhow::Result<()> {
+        let (resolve, world) = crate::load_world(
+            crate::Wit::<std::path::PathBuf>::String(wit),
+            None,
+            &[],
+            true,
+        )?;
+        check_supported_types(&resolve, world)
+    }
+
+    #[test]
+    fn a_world_level_import_with_a_nested_borrow_is_refused() {
+        let (resolve, world) = crate::load_world(
+            crate::Wit::<std::path::PathBuf>::String(
+                "package test:bad;
+                 world w {
+                   resource r { constructor(); }
+                   import f: func(x: option<borrow<r>>) -> u32;
+                   export run: func() -> u32;
+                 }",
+            ),
+            None,
+            &[],
+            true,
+        )
+        .unwrap();
+        let err = reject_world_level_borrows(&resolve, world)
+            .unwrap_err()
+            .to_string();
+        assert!(err.contains("`f` takes a `borrow`"), "{err}");
+    }
+
+    #[test]
+    fn a_sync_export_with_a_stream_is_refused() {
+        let err = check(
+            "package test:bad;
+             interface i {
+               g: func(s: option<stream<u8>>);
+             }
+             world w { export i; }",
+        )
+        .unwrap_err()
+        .to_string();
+        assert!(
+            err.contains("test:bad/i#g") && err.contains("async"),
+            "{err}"
+        );
+    }
+
+    #[test]
+    fn an_async_export_or_a_sync_import_with_a_future_passes() {
+        check(
+            "package test:ok;
+             interface i {
+               g: async func(f: future<u32>) -> stream<u8>;
+             }
+             interface h {
+               s: func(f: future<u32>);
+             }
+             world w { export i; import h; }",
+        )
+        .unwrap();
+    }
+
+    #[test]
+    fn a_map_or_a_fixed_length_list_is_refused() {
+        for (ty, kind) in [
+            ("map<string, u32>", "`map`"),
+            ("list<u8, 4>", "fixed-length `list`"),
+        ] {
+            let err = check(&format!(
+                "package test:bad;
+                 interface i {{ g: func(x: {ty}); }}
+                 world w {{ import i; }}"
+            ))
+            .unwrap_err()
+            .to_string();
+            assert!(
+                err.contains("`test:bad/i#g`") && err.contains(kind),
+                "{err}"
+            );
+        }
+    }
+
+    /// A type that is `depth` levels of `tuple<t, t>` over `u32`, so a walk that
+    /// visits a shared type once per path reaching it takes 2^`depth` steps.
+    fn doubling_tuples(depth: usize) -> String {
+        let mut wit = String::from("type t0 = u32;\n");
+        for i in 1..=depth {
+            let _ = std::fmt::Write::write_fmt(
+                &mut wit,
+                format_args!("type t{i} = tuple<t{0}, t{0}>;\n", i - 1),
+            );
+        }
+        wit
+    }
+
+    /// A walk visiting each path to a shared type would not finish.
+    #[test]
+    fn shared_sub_types_are_checked_once() {
+        const DEPTH: usize = 64;
+        let types = doubling_tuples(DEPTH);
+        check(&format!(
+            "package test:ok;
+             interface i {{
+               {types}
+               g: func(x: t{DEPTH}) -> t{DEPTH};
+             }}
+             world w {{ export i; import i; }}"
+        ))
+        .unwrap();
+        let err = check(&format!(
+            "package test:bad;
+             interface i {{
+               {types}
+               g: func(x: tuple<t{DEPTH}, map<string, u32>>);
+             }}
+             world w {{ import i; }}"
+        ))
+        .unwrap_err()
+        .to_string();
+        assert!(err.contains("`map`"), "{err}");
+    }
+
+    #[test]
+    fn a_nested_error_context_names_the_function() {
+        let err = check(
+            "package test:bad;
+             interface i {
+               record r { e: option<error-context> }
+               g: func() -> r;
+             }
+             world w { export i; }",
+        )
+        .unwrap_err()
+        .to_string();
+        assert!(err.contains("`test:bad/i#g`"), "{err}");
+        assert!(err.contains("error-context"), "{err}");
+    }
+}
diff --git a/componentize/src/versions.rs b/componentize/src/versions.rs
new file mode 100644
index 00000000..37f4b071
--- /dev/null
+++ b/componentize/src/versions.rs
@@ -0,0 +1,223 @@
+// SPDX-License-Identifier: Apache-2.0-WITH-LLVM-exception
+
+//! Canonicalizing the interfaces a world imports at several compatible versions, such as
+//! `wasi:io/poll@0.2.0` and `wasi:io/poll@0.2.12` (see [`same_interface`]).
+
+use anyhow::Context as _;
+use wit_name_mapping::same_interface;
+use wit_parser::{Resolve, WorldId, WorldKey};
+
+/// Return `resolve` with `world` changed to import each interface only once if it imports the
+/// interface at several compatible versions, so that the interface gets one module, and each of
+/// its types one name. Returns `resolve` unchanged if `world` imports no interface at several
+/// compatible versions.
+///
+/// The interface is imported at the highest of the versions, and every `use` of a type from a
+/// lower version names the highest version instead (see
+/// `Resolve::merge_world_imports_based_on_semver`). A version that lacks a type or function of a
+/// lower compatible version isn't rejected.
+pub(crate) fn canonicalize_compatible_versions(
+    mut resolve: Resolve,
+    world: WorldId,
+) -> anyhow::Result<(Resolve, WorldId)> {
+    if !imports_compatible_versions(&resolve, world) {
+        return Ok((resolve, world));
+    }
+    resolve
+        .merge_world_imports_based_on_semver(world)
+        .context("importing each interface at one of its compatible versions")?;
+
+    // TODO: Remove the round trip through WIT once `merge_world_imports_based_on_semver` keeps
+    // `Resolve::types` topologically sorted.
+    // `merge_world_imports_based_on_semver` changes a `use` of a type from a lower version to
+    // refer to the type in the highest version, which can come after it in `Resolve::types`.
+    // Code that walks the types in order, such as `SizeAlign::fill`, requires each type to come
+    // after the types it refers to, so we print the merged `resolve` as WIT and parse it again.
+    let main = resolve.worlds[world]
+        .package
+        .context("the world has a package")?;
+    let nested: Vec<_> = resolve
+        .packages
+        .iter()
+        .map(|(id, _)| id)
+        .filter(|id| *id != main)
+        .collect();
+    let mut printer = wit_component::WitPrinter::default();
+    printer
+        .print(&resolve, main, &nested)
+        .context("printing the world's WIT")?;
+    let mut canonical = Resolve {
+        features: resolve.features.clone(),
+        all_features: resolve.all_features,
+        ..Resolve::default()
+    };
+    let package = canonical
+        .push_str("canonical.wit", &printer.output.to_string())
+        .context("parsing the world's WIT with each interface at one version")?;
+    let world = canonical
+        .select_world(&[package], Some(&resolve.worlds[world].name))
+        .context("selecting the world in its canonicalized WIT")?;
+    Ok((canonical, world))
+}
+
+/// Returns whether `world` imports an interface at several compatible versions.
+fn imports_compatible_versions(resolve: &Resolve, world: WorldId) -> bool {
+    let names: Vec<String> = resolve.worlds[world]
+        .imports
+        .keys()
+        .filter_map(|key| match key {
+            WorldKey::Interface(id) => resolve.id_of(*id),
+            WorldKey::Name(_) => None,
+        })
+        .collect();
+    names.iter().enumerate().any(|(index, name)| {
+        names[index + 1..]
+            .iter()
+            .any(|other| same_interface(name, other))
+    })
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    /// A world importing `test:cli/stdout@{older}`, which uses `test:io/poll@{older}`, and
+    /// `test:cli/net@{newer}`, which uses `test:io/poll@{newer}`. `test:io/poll@{newer}` declares
+    /// an additional function `extra`. `newer_first` is passed to [`with_older_app`].
+    fn two_versions(older: &str, newer: &str, newer_first: bool) -> (Resolve, WorldId) {
+        let newer = format!(
+            "package test:newer;\n\
+             world newer {{\n  import test:cli/net@{newer};\n}}\n\
+             package test:io@{newer} {{\n  interface poll {{\n    resource pollable;\n    \
+             extra: func();\n  }}\n}}\n\
+             package test:cli@{newer} {{\n  interface net {{\n    use test:io/poll@{newer}.{{pollable}};\n    \
+             get: func() -> pollable;\n  }}\n}}\n"
+        );
+        with_older_app(older, &newer, newer_first)
+    }
+
+    /// The world `newer` from the WIT `newer` merged into a world importing
+    /// `test:cli/stdout@{older}`, which uses `test:io/poll@{older}`. The packages of `newer` are
+    /// added to the `Resolve` before those of the older world if `newer_first` is set, and after
+    /// them otherwise.
+    fn with_older_app(older: &str, newer: &str, newer_first: bool) -> (Resolve, WorldId) {
+        let older = format!(
+            "package test:app;\n\
+             world app {{\n  import test:cli/stdout@{older};\n}}\n\
+             package test:io@{older} {{\n  interface poll {{\n    resource pollable;\n  }}\n}}\n\
+             package test:cli@{older} {{\n  interface stdout {{\n    use test:io/poll@{older}.{{pollable}};\n    \
+             get: func() -> pollable;\n  }}\n}}\n"
+        );
+        let mut resolve = Resolve::default();
+        let mut push = |name: &str, wit: &str, world: &str| {
+            let package = resolve.push_str(name, wit).unwrap();
+            resolve.select_world(&[package], Some(world)).unwrap()
+        };
+        let (newer, app) = if newer_first {
+            let newer = push("newer.wit", newer, "newer");
+            (newer, push("app.wit", &older, "app"))
+        } else {
+            let app = push("app.wit", &older, "app");
+            (push("newer.wit", newer, "newer"), app)
+        };
+        resolve
+            .merge_worlds(newer, app, &mut wit_parser::CloneMaps::default())
+            .unwrap();
+        (resolve, app)
+    }
+
+    fn imports(resolve: &Resolve, world: WorldId) -> Vec<String> {
+        let mut imports: Vec<String> = resolve.worlds[world]
+            .imports
+            .keys()
+            .map(|key| resolve.name_world_key(key))
+            .collect();
+        imports.sort();
+        imports
+    }
+
+    fn canonicalized((resolve, world): (Resolve, WorldId)) -> (Resolve, WorldId) {
+        let (resolve, world) = canonicalize_compatible_versions(resolve, world).unwrap();
+        resolve.assert_valid();
+        // Computes the sizes of the types in their arena order, which fails on a type that uses
+        // one defined after it.
+        wit_parser::SizeAlign::default().fill(&resolve).unwrap();
+        (resolve, world)
+    }
+
+    #[test]
+    fn compatible_versions_are_imported_at_the_highest() {
+        let (resolve, world) = canonicalized(two_versions("0.2.0", "0.2.1", true));
+        assert_eq!(
+            imports(&resolve, world),
+            [
+                "test:cli/net@0.2.1",
+                "test:cli/stdout@0.2.0",
+                "test:io/poll@0.2.1"
+            ]
+        );
+    }
+
+    /// The types of the highest version are defined after the types that use the lower version.
+    #[test]
+    fn types_are_defined_before_they_are_used() {
+        let (resolve, world) = canonicalized(two_versions("0.2.0", "0.2.1", false));
+        assert_eq!(
+            imports(&resolve, world),
+            [
+                "test:cli/net@0.2.1",
+                "test:cli/stdout@0.2.0",
+                "test:io/poll@0.2.1"
+            ]
+        );
+    }
+
+    /// Compatible versions are ordered by semver, so `1.10.0` is higher than `1.2.0`.
+    #[test]
+    fn minor_versions_are_ordered_by_semver() {
+        let (resolve, world) = canonicalized(two_versions("1.2.0", "1.10.0", true));
+        assert_eq!(
+            imports(&resolve, world),
+            [
+                "test:cli/net@1.10.0",
+                "test:cli/stdout@1.2.0",
+                "test:io/poll@1.10.0"
+            ]
+        );
+    }
+
+    #[test]
+    fn a_world_without_compatible_versions_is_unchanged() {
+        let (resolve, world) = two_versions("0.2.0", "0.3.0", true);
+        let types = resolve.types.len();
+        let (resolve, world) = canonicalize_compatible_versions(resolve, world).unwrap();
+        assert_eq!(resolve.types.len(), types);
+        assert_eq!(
+            imports(&resolve, world),
+            [
+                "test:cli/net@0.3.0",
+                "test:cli/stdout@0.2.0",
+                "test:io/poll@0.2.0",
+                "test:io/poll@0.3.0"
+            ]
+        );
+    }
+
+    /// An interface that `use`s a lower version from its own package uses the highest version.
+    #[test]
+    fn a_use_within_a_package_names_the_imported_version() {
+        let newer = "package test:newer;\n\
+             world newer {\n  import test:io/streams@0.2.1;\n}\n\
+             package test:io@0.2.1 {\n  interface poll {\n    resource pollable;\n  }\n  \
+             interface streams {\n    use poll.{pollable};\n    get: func() -> pollable;\n  }\n}\n";
+        let (resolve, world) = canonicalized(with_older_app("0.2.0", newer, true));
+        assert_eq!(
+            imports(&resolve, world),
+            [
+                "test:cli/stdout@0.2.0",
+                "test:io/poll@0.2.1",
+                "test:io/streams@0.2.1"
+            ]
+        );
+    }
+}
diff --git a/componentize/src/wit_to_ts.rs b/componentize/src/wit_to_ts.rs
new file mode 100644
index 00000000..f1c6092d
--- /dev/null
+++ b/componentize/src/wit_to_ts.rs
@@ -0,0 +1,2578 @@
+// SPDX-License-Identifier: Apache-2.0-WITH-LLVM-exception
+
+//! Generating TypeScript declarations (`.d.ts`) for the JavaScript module that
+//! implements a WIT world.
+//!
+//! The output is one declaration file with nothing exported at file level, so
+//! every `declare module` in it is an ambient module declaration. It declares:
+//!
+//! - `starling:types/<world>`: every named WIT type the world reaches, one class per
+//!   resource, and one error class per `err` type that has one. Names that
+//!   several types share are qualified (see `Generator::assign_names`).
+//! - `starling:guest`: what the guest implements, in every naming shape the
+//!   runtime accepts for the world (see `export_layout`).
+//! - One module per imported interface, named by its module specifier (see
+//!   [`module_specifier`]), plus `external` for the world-level imports.
+//!   Each declares the interface's functions and re-exports its types,
+//!   resource classes and error classes from that module under their plain
+//!   WIT names. These match the modules created by
+//!   `wit_bridge::imports::synthesize_import_modules`.
+//!
+//! A world exporting `wasi:http/handler` also gets file-level declarations for
+//! the `fetch` event the runtime dispatches to listeners.
+//!
+//! The TypeScript types follow the conversions in `wit_bridge::value`.
+//! Each rendering function names the conversion functions it matches.
+//!
+//! `error-context` and other unsupported types are rendered as `unknown`, with
+//! a `// TODO` comment. The file's header lists the unsupported types that the
+//! world uses.
+
+use std::cell::Cell;
+use std::collections::{HashMap, HashSet};
+use std::fmt::Write as _;
+
+use anyhow::{bail, Result};
+use wit_name_mapping::{
+    mangle_name, mangle_resource_name, module_specifier, possible_export_names, same_interface,
+    InterfaceNames, Item, Shape, WORLD_MODULE_NAME,
+};
+use wit_parser::{
+    Function, FunctionKind, Handle, InterfaceId, Resolve, Type, TypeDefKind, TypeId, TypeOwner,
+    World, WorldId, WorldItem, WorldKey,
+};
+
+/// The global `ComponentError` class the runtime installs, which error classes
+/// extend. Declared as an interface and a variable, as the DOM library declares
+/// its classes, so two generated files can both declare it.
+const COMPONENT_ERROR_DECL: &str = "\
+// `ComponentError` holds the `err` payload of a WIT `result`. A string payload
+// is also its `message`. The error classes in the types module extend it.
+interface ComponentError extends Error {
+  readonly payload: unknown;
+}
+declare var ComponentError: {
+  new (payload: unknown): ComponentError;
+  readonly prototype: ComponentError;
+};
+
+";
+
+/// The globals the runtime provides to a world exporting `wasi:http/handler`,
+/// which the DOM library lacks. Declared by interface merging only, so the file
+/// also compiles against the `webworker` library, which declares `FetchEvent`
+/// itself. Adding `fetch` to `WindowEventMap` types the event of an
+/// `addEventListener('fetch', …)` listener.
+const FETCH_EVENT_DECL: &str = "\
+// The event the runtime dispatches to `addEventListener('fetch', …)` listeners.
+interface FetchEvent extends Event {
+  readonly request: Request;
+  respondWith(response: Response | PromiseLike<Response>): void;
+  waitUntil(promise: PromiseLike<unknown>): void;
+}
+interface WindowEventMap {
+  fetch: FetchEvent;
+}
+
+";
+
+/// The `wasi:http/types` interface whose `request` resource is accepted by the
+/// runtime's `fetch`. Versions for which [`same_interface`] returns `true` are
+/// accepted as well.
+const WASI_HTTP_TYPES: &str = "wasi:http/types@0.3.0";
+
+/// The specifier of the module that declares the JavaScript module's exports.
+///
+/// The file has no top-level `export`s, so that every `declare module` in it is
+/// an ambient module declaration, and not an augmentation of a module that
+/// can't be resolved. An import such as `import … from '<wit-interface>'` only
+/// resolves to an ambient declaration, so the exports are declared in a module
+/// of their own instead of at file level.
+const GUEST_MODULE_NAME: &str = "starling:guest";
+
+/// The prefix of the specifier of the module that declares the world's WIT
+/// types (see [`types_module_name`]).
+///
+/// The types can't be declared at file level: in a file without top-level
+/// `export`s, such declarations are global, and a WIT type named `permissions`,
+/// `response` or `event` would collide with the standard library.
+const TYPES_MODULE_PREFIX: &str = "starling:types";
+
+/// The specifier of the module that declares the WIT types of `world`:
+/// `starling:types/` followed by the world's qualified name, as in
+/// `starling:types/wasi:http/proxy@0.3.0`. Declarations generated for different
+/// worlds can then be part of one program.
+pub fn types_module_name(resolve: &Resolve, world: WorldId) -> String {
+    let world = &resolve.worlds[world];
+    match world.package {
+        Some(package) => format!(
+            "{TYPES_MODULE_PREFIX}/{}",
+            resolve.id_of_name(package, &world.name)
+        ),
+        None => format!("{TYPES_MODULE_PREFIX}/{}", world.name),
+    }
+}
+
+/// The name under which every other module block imports the types module.
+/// Mangled WIT identifiers contain only letters and digits, so no generated
+/// name can shadow it.
+const TYPES_NAMESPACE: &str = "$t";
+
+/// Indent every non-empty line of `text` by two spaces, for nesting a rendered
+/// block inside a `declare module`.
+fn indent(text: &str) -> String {
+    let mut out = String::new();
+    for line in text.lines() {
+        if line.is_empty() {
+            out.push('\n');
+        } else {
+            let _ = writeln!(out, "  {line}");
+        }
+    }
+    out
+}
+
+/// The names a mangled WIT identifier cannot be bound to in a strict-mode
+/// module: JavaScript's reserved words, the strict-mode reserved words,
+/// `arguments` and `eval`, plus `globalThis`, which declarations here refer to.
+/// A WIT name escaped with `%`, such as `%new` or `%for`, mangles to one of
+/// these.
+///
+/// The runtime looks up an export under its mangled name, so an exported name
+/// can't be changed, and the module must define a member with that name. Only
+/// the declaration's spelling changes. A parameter name is not looked
+/// up, so a parameter is renamed instead (see [`param_name`]).
+const RESERVED_BINDINGS: &[&str] = &[
+    "arguments",
+    "await",
+    "break",
+    "case",
+    "catch",
+    "class",
+    "const",
+    "continue",
+    "debugger",
+    "default",
+    "delete",
+    "do",
+    "else",
+    "enum",
+    "eval",
+    "export",
+    "extends",
+    "false",
+    "finally",
+    "for",
+    "function",
+    "globalThis",
+    "if",
+    "implements",
+    "import",
+    "in",
+    "instanceof",
+    "interface",
+    "let",
+    "new",
+    "null",
+    "package",
+    "private",
+    "protected",
+    "public",
+    "return",
+    "static",
+    "super",
+    "switch",
+    "this",
+    "throw",
+    "true",
+    "try",
+    "typeof",
+    "var",
+    "void",
+    "while",
+    "with",
+    "yield",
+];
+
+fn is_reserved_binding(name: &str) -> bool {
+    RESERVED_BINDINGS.contains(&name)
+}
+
+/// A member name for an object type literal. `new` is quoted, since `new(x): T`
+/// in a type literal is a construct signature rather than a method. Every other
+/// reserved word is an ordinary property name and isn't quoted.
+fn member_name(js_name: &str) -> String {
+    if js_name == "new" {
+        format!("'{js_name}'")
+    } else {
+        js_name.to_string()
+    }
+}
+
+/// The TypeScript name of a WIT parameter: its mangled name, with `_` appended
+/// when that is a reserved binding. A parameter named `this` would otherwise
+/// declare the type of the receiver rather than an argument.
+fn param_name(wit_name: &str) -> String {
+    let name = mangle_name(wit_name);
+    if is_reserved_binding(&name) {
+        format!("{name}_")
+    } else {
+        name
+    }
+}
+
+/// Declare the bare export `js_name` with `decl`, a declaration missing only its
+/// name, e.g. `function {}(): void` or `const {}: number`.
+///
+/// A reserved word cannot be a binding, so it is declared under a local with
+/// `_` appended and exported under the real name. An export clause accepts any
+/// identifier name, and the guest's module exports it the same way, as
+/// `export { make as new }`. A WIT `%default` becomes the `default` export,
+/// which is the property the runtime looks up on the namespace.
+fn bare_export(js_name: &str, decl: &str) -> Vec<String> {
+    if is_reserved_binding(js_name) {
+        let local = format!("{js_name}_");
+        vec![
+            format!("{};", decl.replace("{}", &local)),
+            format!("export {{ {local} as {js_name} }};"),
+        ]
+    } else {
+        vec![format!("export {};", decl.replace("{}", js_name))]
+    }
+}
+
+/// Whether the world key name `wit_name` refers to `interface`, at any version.
+fn names_interface(wit_name: &str, interface: &str) -> bool {
+    wit_name_mapping::unversioned(wit_name) == interface
+}
+
+/// Generate the `.d.ts` source for `world` in `resolve`.
+///
+/// The serve declarations are emitted for every world exporting
+/// `wasi:http/handler`, or the `RAW_HTTP_HANDLER_EXPORT`
+/// that [`load_world_for_types`](crate::load_world_for_types) replaces it with.
+///
+/// `world` must import each interface at one of its compatible versions at most,
+/// as a world from [`load_world_for_types`](crate::load_world_for_types) does.
+///
+/// Fails when the world's exports cannot all be given a JS name (see
+/// `export_layout`).
+pub fn generate(resolve: &Resolve, world: WorldId) -> Result<String> {
+    Generator::new(resolve, world).run()
+}
+
+/// The specifiers of the modules that provide `world`'s imports: the
+/// [`module_specifier`] of each imported interface, and `external` for the
+/// world-level imports. A module is listed only if the
+/// runtime registers it, which it does if the module exports a function, a
+/// resource class, an error class, or an enum or flags object.
+///
+/// `world` must import each interface at one of its compatible versions at most,
+/// as a world from [`load_world_for_types`](crate::load_world_for_types) does.
+pub fn import_modules(resolve: &Resolve, world: WorldId) -> Vec<String> {
+    import_module_exports(resolve, world)
+        .into_iter()
+        .map(|(spec, _)| spec)
+        .collect()
+}
+
+/// Like [`import_modules`], but also return the names of the values that each
+/// module exports: its functions, resource classes, error classes, and enum
+/// and flags objects.
+pub fn import_module_exports(resolve: &Resolve, world: WorldId) -> Vec<(String, Vec<String>)> {
+    let mut generator = Generator::new(resolve, world);
+    generator.collect();
+    generator
+        .import_module_groups()
+        .into_iter()
+        .filter(|module| generator.registers_module(module))
+        .map(|module| {
+            let exports = generator.runtime_exports(&module);
+            (module.spec, exports)
+        })
+        .collect()
+}
+
+/// Who implements a function or resource.
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash)]
+enum Side {
+    /// The host: an imported function, or a resource of an imported interface.
+    Import,
+    /// The guest: an exported function, or a resource of an exported interface.
+    Export,
+}
+
+/// Where a type is rendered.
+#[derive(Clone, Copy)]
+struct Cx {
+    /// The side of the function or declaration the type is part of. A named
+    /// type referring to a resource of an exported interface has a separate
+    /// declaration for the export side (see [`Generator::side_of`]).
+    side: Side,
+    /// Whether the guest hands the value to the runtime, rather than receiving
+    /// it. A `stream` or `future` the guest hands over accepts more than the
+    /// `ReadableStream` or `Promise` it receives.
+    produces: bool,
+    /// Whether the type is rendered inside the types module, which names its own
+    /// declarations directly and every other block names through
+    /// [`TYPES_NAMESPACE`].
+    in_types: bool,
+}
+
+impl Cx {
+    /// The parameters of a function implemented on `side`, which the guest
+    /// hands over when it calls an import.
+    fn params(side: Side, in_types: bool) -> Cx {
+        Cx {
+            side,
+            produces: side == Side::Import,
+            in_types,
+        }
+    }
+
+    /// The result of a function implemented on `side`, which the guest hands
+    /// over when it implements an export.
+    fn result(side: Side, in_types: bool) -> Cx {
+        Cx {
+            side,
+            produces: side == Side::Export,
+            in_types,
+        }
+    }
+}
+
+/// A declaration in the types module.
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash)]
+enum Decl {
+    /// A named type by its canonical id (see [`Generator::canonical`]), and the
+    /// side whose resources it refers to.
+    Type(TypeId, Side),
+    /// The error class of an `err` type, by the id with which the `result`
+    /// names it.
+    /// A `use`d or renamed type has an id of its own, owned by the interface
+    /// that `use`s it. The runtime identifies the class by that id's interface
+    /// and name.
+    ErrorClass(TypeId),
+}
+
+/// The running state of one `.d.ts` generation.
+struct Generator<'a> {
+    resolve: &'a Resolve,
+    world: WorldId,
+    /// The interfaces the world exports, whose resources the guest implements.
+    exported_interfaces: HashSet<InterfaceId>,
+    /// The interfaces the world imports.
+    imported_interfaces: HashSet<InterfaceId>,
+    /// The world key name of every interface the world imports or exports.
+    interface_keys: HashMap<InterfaceId, String>,
+    /// The module specifier the world's types are declared under (see
+    /// [`types_module_name`]).
+    types_module: String,
+    /// The declarations of the types module, in discovery order.
+    decls: Vec<Decl>,
+    /// The position of each declaration in `decls`.
+    decl_index: HashMap<Decl, usize>,
+    /// The name of each declaration in `decls`, set by
+    /// [`Generator::assign_names`].
+    names: Vec<String>,
+    /// Every name the types module declares.
+    declared_names: HashSet<String>,
+    /// The `err` types with error classes, each with the interface whose module
+    /// exports the class, or `None` for `external`.
+    error_classes: Vec<(TypeId, Option<InterfaceId>)>,
+    /// Whether any `unknown`-placeholder shape (error-context, or an
+    /// otherwise-unsupported WIT kind) was rendered, so the header can note it.
+    used_unknown_placeholder: Cell<bool>,
+}
+
+impl<'a> Generator<'a> {
+    fn new(resolve: &'a Resolve, world: WorldId) -> Self {
+        let w = &resolve.worlds[world];
+        let mut interface_keys = HashMap::new();
+        let mut imported_interfaces = HashSet::new();
+        let mut exported_interfaces = HashSet::new();
+        for (key, item) in &w.imports {
+            if let WorldItem::Interface { id, .. } = item {
+                imported_interfaces.insert(*id);
+                interface_keys.insert(*id, resolve.name_world_key(key));
+            }
+        }
+        for (key, item) in &w.exports {
+            if let WorldItem::Interface { id, .. } = item {
+                exported_interfaces.insert(*id);
+                interface_keys.insert(*id, resolve.name_world_key(key));
+            }
+        }
+        Generator {
+            resolve,
+            world,
+            exported_interfaces,
+            imported_interfaces,
+            interface_keys,
+            types_module: types_module_name(resolve, world),
+            decls: Vec::new(),
+            decl_index: HashMap::new(),
+            names: Vec::new(),
+            declared_names: HashSet::new(),
+            error_classes: Vec::new(),
+            used_unknown_placeholder: Cell::new(false),
+        }
+    }
+
+    fn world(&self) -> &'a World {
+        &self.resolve.worlds[self.world]
+    }
+
+    fn run(mut self) -> Result<String> {
+        let groups = export_groups(self.resolve, self.world);
+        let world_funcs: Vec<String> = world_export_functions(self.world())
+            .map(|func| mangle_name(&func.name))
+            .collect();
+        let layout = export_layout(&groups, &world_funcs)?;
+        self.collect();
+        self.assign_names();
+
+        let types = self.render_types_module();
+        let guest = self.render_guest_module(&groups, &layout);
+        let imports = self.render_import_modules();
+
+        let mut out = String::new();
+        self.write_header(&mut out);
+        out.push_str(COMPONENT_ERROR_DECL);
+        if groups.iter().any(|group| group.http_handler) {
+            out.push_str(FETCH_EVENT_DECL);
+        }
+        if let Some(request) = self.wit_request_type() {
+            let name = self.decl_name(Decl::Type(request, Side::Import));
+            let _ = write!(
+                out,
+                "// `fetch` also takes a `wasi:http/types` `request`, such as the one a\n\
+                 // `wasi:http/handler` implementation receives, and sends it.\n\
+                 declare function fetch(\n  \
+                   input: import('{types}').{name},\n  \
+                   init?: RequestInit,\n\
+                 ): Promise<Response>;\n\n",
+                types = self.types_module,
+            );
+        }
+        out.push_str(&types);
+        out.push_str(&guest);
+        out.push_str(&imports);
+        Ok(out)
+    }
+
+    // -----------------------------------------------------------------------
+    // Collection: every declaration the types module needs
+    // -----------------------------------------------------------------------
+
+    /// Collect every declaration the rendered blocks refer to, and the error
+    /// classes the runtime creates.
+    fn collect(&mut self) {
+        let world = self.world();
+        for item in world.imports.values() {
+            match item {
+                WorldItem::Function(func) => self.visit_func(func, Side::Import),
+                WorldItem::Interface { id, .. } => {
+                    let iface = &self.resolve.interfaces[*id];
+                    for func in iface.functions.values() {
+                        self.visit_func(func, Side::Import);
+                    }
+                    // Every type is re-exported from the interface's module.
+                    for &ty in iface.types.values() {
+                        self.visit_id(ty, Side::Import);
+                    }
+                }
+                WorldItem::Type { id, .. } => self.visit_id(*id, Side::Import),
+            }
+        }
+        for (key, item) in &world.exports {
+            match item {
+                WorldItem::Function(func) => self.visit_func(func, Side::Export),
+                WorldItem::Interface { id, .. } => {
+                    // `run` is declared without WIT types.
+                    if names_interface(
+                        &self.resolve.name_world_key(key),
+                        crate::CLI_RUN_INTERFACE_PREFIX,
+                    ) {
+                        continue;
+                    }
+                    let iface = &self.resolve.interfaces[*id];
+                    for func in iface.functions.values() {
+                        self.visit_func(func, Side::Export);
+                    }
+                    for res in self.interface_resources(*id) {
+                        self.visit_id(res, Side::Export);
+                    }
+                }
+                WorldItem::Type { id, .. } => self.visit_id(*id, Side::Import),
+            }
+        }
+        for err in self.world_error_types() {
+            let def = &self.resolve.types[err];
+            let module = match def.owner {
+                TypeOwner::World(_) => Some(None),
+                TypeOwner::Interface(iface) if self.imported_interfaces.contains(&iface) => {
+                    Some(Some(iface))
+                }
+                // A type an exported interface defines has no module to export
+                // its class from.
+                _ => None,
+            };
+            if let Some(module) = module {
+                self.visit_id(err, Side::Import);
+                self.add_decl(Decl::ErrorClass(err));
+                self.error_classes.push((err, module));
+            }
+        }
+    }
+
+    /// Add `decl` to the types module, returning whether it was new.
+    fn add_decl(&mut self, decl: Decl) -> bool {
+        if self.decl_index.contains_key(&decl) {
+            return false;
+        }
+        self.decl_index.insert(decl, self.decls.len());
+        self.decls.push(decl);
+        true
+    }
+
+    /// Collect the types a function implemented on `side` refers to.
+    fn visit_func(&mut self, func: &Function, side: Side) {
+        for param in &func.params {
+            self.visit_type(&param.ty, side);
+        }
+        if let Some(result) = &func.result {
+            self.visit_type(result, side);
+        }
+    }
+
+    fn visit_type(&mut self, ty: &Type, side: Side) {
+        if let Type::Id(id) = ty {
+            self.visit_id(*id, side);
+        }
+    }
+
+    /// Collect the declarations referred to by type `id` where it is part of a
+    /// function or declaration of `side`.
+    fn visit_id(&mut self, id: TypeId, side: Side) {
+        let root = self.canonical(id);
+        let def = &self.resolve.types[root];
+        if def.name.is_none() {
+            self.visit_structure(root, side);
+            return;
+        }
+        let side = self.side_of(root, side);
+        if !self.add_decl(Decl::Type(root, side)) {
+            return;
+        }
+        if matches!(def.kind, TypeDefKind::Resource) {
+            for func in self.resource_funcs(root) {
+                self.visit_func(func, side);
+            }
+        } else {
+            self.visit_structure(root, side);
+        }
+    }
+
+    fn visit_structure(&mut self, id: TypeId, side: Side) {
+        match &self.resolve.types[id].kind {
+            TypeDefKind::Type(inner)
+            | TypeDefKind::List(inner)
+            | TypeDefKind::Option(inner)
+            | TypeDefKind::Future(Some(inner))
+            | TypeDefKind::Stream(Some(inner)) => self.visit_type(inner, side),
+            TypeDefKind::Result(result) => {
+                for arm in [&result.ok, &result.err].into_iter().flatten() {
+                    self.visit_type(arm, side);
+                }
+            }
+            TypeDefKind::Tuple(tuple) => {
+                for element in &tuple.types {
+                    self.visit_type(element, side);
+                }
+            }
+            TypeDefKind::Record(record) => {
+                for field in &record.fields {
+                    self.visit_type(&field.ty, side);
+                }
+            }
+            TypeDefKind::Variant(variant) => {
+                for payload in variant.cases.iter().filter_map(|case| case.ty.as_ref()) {
+                    self.visit_type(payload, side);
+                }
+            }
+            TypeDefKind::Handle(Handle::Own(res) | Handle::Borrow(res)) => {
+                self.visit_id(*res, side)
+            }
+            _ => {}
+        }
+    }
+
+    /// The side of the declaration a reference to the named type `root` from a
+    /// function or declaration of `side` resolves to.
+    ///
+    /// An interface the world both imports and exports has one set of types but
+    /// two classes per resource, the host's and the guest's. A type referring to
+    /// a resource of an exported interface is therefore declared once per side,
+    /// and every other type once, on the import side.
+    fn side_of(&self, root: TypeId, side: Side) -> Side {
+        if side == Side::Export && self.refers_to_exported_resource(root) {
+            Side::Export
+        } else {
+            Side::Import
+        }
+    }
+
+    /// Whether type `id` is, or contains, a resource of an interface the world
+    /// exports.
+    fn refers_to_exported_resource(&self, id: TypeId) -> bool {
+        let id = self.canonical(id);
+        let refers = |ty: &Type| match ty {
+            Type::Id(id) => self.refers_to_exported_resource(*id),
+            _ => false,
+        };
+        match &self.resolve.types[id].kind {
+            TypeDefKind::Resource => matches!(
+                self.resolve.types[id].owner,
+                TypeOwner::Interface(iface) if self.exported_interfaces.contains(&iface)
+            ),
+            TypeDefKind::Handle(Handle::Own(res) | Handle::Borrow(res)) => {
+                self.refers_to_exported_resource(*res)
+            }
+            TypeDefKind::Type(inner)
+            | TypeDefKind::List(inner)
+            | TypeDefKind::Option(inner)
+            | TypeDefKind::Future(Some(inner))
+            | TypeDefKind::Stream(Some(inner)) => refers(inner),
+            TypeDefKind::Result(result) => {
+                [&result.ok, &result.err].into_iter().flatten().any(refers)
+            }
+            TypeDefKind::Tuple(tuple) => tuple.types.iter().any(refers),
+            TypeDefKind::Record(record) => record.fields.iter().any(|field| refers(&field.ty)),
+            TypeDefKind::Variant(variant) => variant
+                .cases
+                .iter()
+                .filter_map(|case| case.ty.as_ref())
+                .any(refers),
+            _ => false,
+        }
+    }
+
+    /// The `err` types with error classes in every function the world imports or
+    /// exports, in first-use order. This follows the runtime's
+    /// `collect_err_classes`.
+    fn world_error_types(&self) -> Vec<TypeId> {
+        let world = self.world();
+        let mut types = Vec::new();
+        let funcs = world
+            .imports
+            .values()
+            .chain(world.exports.values())
+            .flat_map(|item| match item {
+                WorldItem::Function(func) => vec![func],
+                WorldItem::Interface { id, .. } => {
+                    self.resolve.interfaces[*id].functions.values().collect()
+                }
+                WorldItem::Type { .. } => Vec::new(),
+            });
+        for func in funcs {
+            for param in &func.params {
+                self.collect_error_types(&param.ty, false, &mut types);
+            }
+            if let Some(result) = &func.result {
+                self.collect_error_types(result, true, &mut types);
+            }
+        }
+        types
+    }
+
+    /// Add to `types` the `err` types with error classes of the `result` types
+    /// in `ty` whose `err` values are lifted as errors: `ty` itself if `direct`
+    /// is set, and the payload type of each `future` in `ty`. This follows the
+    /// runtime's `collect_err_classes`.
+    fn collect_error_types(&self, ty: &Type, direct: bool, types: &mut Vec<TypeId>) {
+        let Type::Id(id) = ty else {
+            return;
+        };
+        if direct {
+            if let Some(err) = self.error_class_type(ty) {
+                if !types.contains(&err) {
+                    types.push(err);
+                }
+            }
+        }
+        match &self.resolve.types[*id].kind {
+            TypeDefKind::Type(inner) => self.collect_error_types(inner, direct, types),
+            TypeDefKind::Future(Some(payload)) => self.collect_error_types(payload, true, types),
+            TypeDefKind::List(inner) | TypeDefKind::Option(inner) => {
+                self.collect_error_types(inner, false, types)
+            }
+            TypeDefKind::Result(result) => {
+                for arm in [&result.ok, &result.err].into_iter().flatten() {
+                    self.collect_error_types(arm, false, types);
+                }
+            }
+            TypeDefKind::Tuple(tuple) => {
+                for element in &tuple.types {
+                    self.collect_error_types(element, false, types);
+                }
+            }
+            TypeDefKind::Record(record) => {
+                for field in &record.fields {
+                    self.collect_error_types(&field.ty, false, types);
+                }
+            }
+            TypeDefKind::Variant(variant) => {
+                for payload in variant.cases.iter().filter_map(|case| case.ty.as_ref()) {
+                    self.collect_error_types(payload, false, types);
+                }
+            }
+            _ => {}
+        }
+    }
+
+    /// Return the `err` type of `ty` if `ty` is a `result` whose `err` type has
+    /// an error class, which requires a named type other than a resource.
+    ///
+    /// As in the runtime's `err_class_of`, the id is the one used by the
+    /// `result`, not its canonical definition. An alias in an interface that the
+    /// world only exports is followed to the type it refers to, because that
+    /// interface has no module that could export the class.
+    fn error_class_type(&self, ty: &Type) -> Option<TypeId> {
+        let (_, Some(Type::Id(mut err))) = self.as_result(ty)? else {
+            return None;
+        };
+        while let (TypeOwner::Interface(iface), TypeDefKind::Type(Type::Id(target))) =
+            (self.resolve.types[err].owner, &self.resolve.types[err].kind)
+        {
+            if !self.exported_interfaces.contains(&iface)
+                || self.imported_interfaces.contains(&iface)
+            {
+                break;
+            }
+            err = *target;
+        }
+        self.resolve.types[err].name.as_ref()?;
+        let root = &self.resolve.types[self.canonical(err)];
+        if matches!(root.kind, TypeDefKind::Resource | TypeDefKind::Handle(_)) {
+            return None;
+        }
+        Some(err)
+    }
+
+    // -----------------------------------------------------------------------
+    // Naming the types module
+    // -----------------------------------------------------------------------
+
+    /// Name every declaration of the types module.
+    ///
+    /// A declaration is named after its WIT type in UpperCamelCase, and an error
+    /// class after its type with `Error` appended. The export-side declaration of
+    /// a type that also has an import-side one is prefixed with `Exported`. Where
+    /// several declarations have the same name, each of them is qualified with
+    /// its interface's name, then with its package's namespace and name, then
+    /// with its package's version, and finally has `_` and its position appended.
+    /// A flags type also occupies its name with `Set` appended.
+    fn assign_names(&mut self) {
+        let candidates: Vec<Vec<String>> = self
+            .decls
+            .iter()
+            .map(|&decl| self.name_candidates(decl))
+            .collect();
+        let is_flags: Vec<bool> = self
+            .decls
+            .iter()
+            .map(|decl| match decl {
+                Decl::Type(id, _) => matches!(self.resolve.types[*id].kind, TypeDefKind::Flags(_)),
+                Decl::ErrorClass(_) => false,
+            })
+            .collect();
+        let name_at = |i: usize, level: usize| match candidates[i].get(level) {
+            Some(name) => name.clone(),
+            None => format!("{}_{i}", candidates[i].last().expect("a name")),
+        };
+        let mut levels = vec![0; self.decls.len()];
+        loop {
+            let mut owners: HashMap<String, Vec<usize>> = HashMap::new();
+            for (i, &level) in levels.iter().enumerate() {
+                let name = name_at(i, level);
+                if is_flags[i] {
+                    owners.entry(flags_set_name(&name)).or_default().push(i);
+                }
+                owners.entry(name).or_default().push(i);
+            }
+            let mut colliding: Vec<usize> = owners
+                .into_values()
+                .filter(|owners| owners.len() > 1)
+                .flatten()
+                .collect();
+            colliding.sort_unstable();
+            colliding.dedup();
+            // A name with `_` and a position appended is unique, since no
+            // mangled name contains `_`.
+            colliding.retain(|&i| levels[i] < candidates[i].len());
+            if colliding.is_empty() {
+                break;
+            }
+            for i in colliding {
+                levels[i] += 1;
+            }
+        }
+        self.names = (0..self.decls.len())
+            .map(|i| name_at(i, levels[i]))
+            .collect();
+        for (i, name) in self.names.iter().enumerate() {
+            if is_flags[i] {
+                self.declared_names.insert(flags_set_name(name));
+            }
+            self.declared_names.insert(name.clone());
+        }
+    }
+
+    /// The names of `decl` from least to most qualified.
+    fn name_candidates(&self, decl: Decl) -> Vec<String> {
+        let (id, stem) = match decl {
+            Decl::Type(id, _) => (id, mangle_resource_name(self.type_name(id))),
+            Decl::ErrorClass(id) => (
+                id,
+                format!("{}Error", mangle_resource_name(self.type_name(id))),
+            ),
+        };
+        let prefix = match decl {
+            Decl::Type(id, Side::Export)
+                if self.decl_index.contains_key(&Decl::Type(id, Side::Import)) =>
+            {
+                "Exported"
+            }
+            _ => "",
+        };
+        let mut candidates = vec![format!("{prefix}{stem}")];
+        for qualifier in self.owner_qualifiers(self.resolve.types[id].owner) {
+            let name = format!("{prefix}{qualifier}{stem}");
+            if !candidates.contains(&name) {
+                candidates.push(name);
+            }
+        }
+        candidates
+    }
+
+    /// The qualifiers of a type owned by `owner`: its interface's (or world's)
+    /// name, that name with its package's namespace and name, and that with its
+    /// package's version, each in UpperCamelCase.
+    fn owner_qualifiers(&self, owner: TypeOwner) -> Vec<String> {
+        let (short, package) = match owner {
+            TypeOwner::Interface(iface) => {
+                let interface = &self.resolve.interfaces[iface];
+                let short = interface
+                    .name
+                    .clone()
+                    .or_else(|| self.interface_keys.get(&iface).cloned())
+                    .unwrap_or_default();
+                (short, interface.package)
+            }
+            TypeOwner::World(world) => {
+                let world = &self.resolve.worlds[world];
+                (world.name.clone(), world.package)
+            }
+            TypeOwner::None => return Vec::new(),
+        };
+        let mut qualifiers = vec![mangle_resource_name(&short)];
+        if let Some(package) = package {
+            let name = &self.resolve.packages[package].name;
+            let qualified = format!("{}-{}-{short}", name.namespace, name.name);
+            qualifiers.push(mangle_resource_name(&qualified));
+            if let Some(version) = &name.version {
+                qualifiers.push(mangle_resource_name(&format!("{qualified}-{version}")));
+            }
+        }
+        qualifiers
+    }
+
+    /// The name of declaration `decl`.
+    fn decl_name(&self, decl: Decl) -> &str {
+        let index = self.decl_index[&decl];
+        &self.names[index]
+    }
+
+    /// Returns `name`, a global the rendered type refers to, qualified with
+    /// `globalThis.` if a declaration in the types module shadows it.
+    fn global(&self, name: &str, cx: Cx) -> String {
+        if cx.in_types && self.declared_names.contains(name) {
+            format!("globalThis.{name}")
+        } else {
+            name.to_string()
+        }
+    }
+
+    /// A reference to the declaration of the named type `id`, as a value of it.
+    /// A flags type is named by its set alias.
+    fn type_ref(&self, id: TypeId, cx: Cx) -> String {
+        let root = self.canonical(id);
+        let name = self.decl_name(Decl::Type(root, self.side_of(root, cx.side)));
+        let name = if matches!(self.resolve.types[root].kind, TypeDefKind::Flags(_)) {
+            flags_set_name(name)
+        } else {
+            name.to_string()
+        };
+        self.qualify(name, cx)
+    }
+
+    /// Returns `name`, a declaration of the types module, in the form a block
+    /// rendered in `cx` uses to refer to it.
+    fn qualify(&self, name: String, cx: Cx) -> String {
+        if cx.in_types {
+            name
+        } else {
+            format!("{TYPES_NAMESPACE}.{name}")
+        }
+    }
+
+    // -----------------------------------------------------------------------
+    // Blocks
+    // -----------------------------------------------------------------------
+
+    fn write_header(&self, out: &mut String) {
+        let _ = writeln!(
+            out,
+            "// Generated by `starling-componentize types`. Do not edit by hand.\n//\n\
+             // The guest JavaScript module a `{world}` componentize target implements, and\n\
+             // the modules it may import. Add this file to the program (a `files` or\n\
+             // `include` entry in `tsconfig.json`, or a `/// <reference path=…/>`).\n\
+             //\n\
+             // Nothing here is exported at file level, which makes every `declare\n\
+             // module` below an ambient module declaration. An import then\n\
+             // resolves:\n\
+             //\n\
+             //   import {{ log }} from 'test:example/logger';\n\
+             //\n\
+             // The guest's own obligations are `{guest}`. Reference it to have the\n\
+             // compiler check what the module exports:\n\
+             //\n\
+             //   import type * as Guest from '{guest}';\n\
+             //   export const example: typeof Guest.example = {{ … }};\n\
+             //\n\
+             // Every WIT type the world uses is declared in the module\n\
+             //\n\
+             //   {types}\n\
+             //\n\
+             // Each interface's module re-exports the types the interface defines or\n\
+             // `use`s under their WIT names. A name that several types share is\n\
+             // qualified there.",
+            world = self.world().name,
+            guest = GUEST_MODULE_NAME,
+            types = self.types_module,
+        );
+        if self.used_unknown_placeholder.get() {
+            out.push_str(
+                "//\n// Deferred shapes (placeholder types, see the TODOs below):\n\
+                 //   - error-context and other unsupported types render as `unknown`.\n",
+            );
+        }
+        out.push('\n');
+    }
+
+    fn render_types_module(&self) -> String {
+        if self.decls.is_empty() {
+            return String::new();
+        }
+        let decls: Vec<String> = self
+            .decls
+            .iter()
+            .map(|&decl| self.render_decl(decl))
+            .collect();
+        format!(
+            "declare module '{}' {{\n{}}}\n\n",
+            self.types_module,
+            indent(decls.join("\n").trim_end())
+        )
+    }
+
+    fn render_decl(&self, decl: Decl) -> String {
+        let name = self.decl_name(decl);
+        match decl {
+            Decl::ErrorClass(err) => self.render_error_class(name, err),
+            Decl::Type(id, side) => match &self.resolve.types[id].kind {
+                TypeDefKind::Resource => self.render_resource_class(name, id, side),
+                TypeDefKind::Enum(e) => declare_enum(name, e, self.has_runtime_object(id)),
+                TypeDefKind::Flags(f) => declare_flags(name, f, self.has_runtime_object(id)),
+                _ => {
+                    // A declaration is shared by every position that names the
+                    // type. A value the guest receives is also one it may hand
+                    // over.
+                    let cx = Cx {
+                        side,
+                        produces: false,
+                        in_types: true,
+                    };
+                    format!("export type {name} = {};\n", self.render_structure(id, cx))
+                }
+            },
+        }
+    }
+
+    /// Whether the runtime creates an object for the enum or flags type `id`.
+    /// The module of the interface defining the type creates one unless the
+    /// world only exports the interface, and `external` creates one for a type
+    /// of the world.
+    fn has_runtime_object(&self, id: TypeId) -> bool {
+        match self.resolve.types[id].owner {
+            TypeOwner::Interface(interface) => self.imported_interfaces.contains(&interface),
+            TypeOwner::World(_) => true,
+            TypeOwner::None => false,
+        }
+    }
+
+    /// Declare the error class of the `err` type `err`: a class extending
+    /// `ComponentError` whose `payload` has the type.
+    fn render_error_class(&self, name: &str, err: TypeId) -> String {
+        let cx = Cx {
+            side: Side::Import,
+            produces: false,
+            in_types: true,
+        };
+        let payload = self.type_ref(err, cx);
+        let base = self.global("ComponentError", cx);
+        format!(
+            "export class {name} extends {base} {{\n  \
+             constructor(payload: {payload});\n  \
+             readonly payload: {payload};\n\
+             }}\n"
+        )
+    }
+
+    /// Declare a resource's class, with the constructor, methods and statics its
+    /// WIT declares, rendered for the side implementing them.
+    ///
+    /// The host's class has a private member, so no other object type-checks as
+    /// one of its handles, and a private constructor when the WIT declares none.
+    /// The runtime installs `[Symbol.dispose]` on it. A guest class may define
+    /// `[Symbol.dispose]`, which the runtime calls when the host drops the
+    /// resource. A guest class whose WIT declares no constructor may take any
+    /// constructor arguments, since the runtime never constructs it.
+    fn render_resource_class(&self, name: &str, res: TypeId, side: Side) -> String {
+        let funcs = self.resource_funcs(res);
+        let mut out = format!("export class {name} {{\n");
+        let host = side == Side::Import;
+        let has_constructor = funcs
+            .iter()
+            .any(|func| matches!(func.kind, FunctionKind::Constructor(_)));
+        if !has_constructor {
+            out.push_str(if host {
+                "  private constructor();\n"
+            } else {
+                "  constructor(...args: any[]);\n"
+            });
+        }
+        for func in funcs {
+            let line = match &func.kind {
+                FunctionKind::Constructor(_) => {
+                    format!("constructor({})", self.render_params(func, side, true))
+                }
+                FunctionKind::Static(_) | FunctionKind::AsyncStatic(_) => format!(
+                    "static {}",
+                    self.render_signature(&mangle_name(func.item_name()), func, side, true)
+                ),
+                _ => self.render_signature(&mangle_name(func.item_name()), func, side, true),
+            };
+            let _ = writeln!(out, "  {line};");
+        }
+        let cx = Cx::result(side, true);
+        let symbol = self.global("Symbol", cx);
+        if host {
+            let _ = writeln!(out, "  private $brand: unknown;");
+            let _ = writeln!(out, "  [{symbol}.dispose](): void;");
+        } else {
+            let _ = writeln!(out, "  [{symbol}.dispose]?(): void;");
+        }
+        out.push_str("}\n");
+        out
+    }
+
+    fn render_guest_module(&self, groups: &[ExportGroup<'_>], layout: &Layout) -> String {
+        let mut sections: Vec<String> = Vec::new();
+
+        if groups.iter().any(|group| group.http_handler) {
+            sections.push(self.render_http_handler_guidance(groups));
+        }
+        if (0..groups.len()).any(|g| layout.versioned(g)) {
+            sections.push(
+                "// Each item of an exported interface is implemented through exactly one\n\
+                 // of the shapes below: a member of its package's object, a member of its\n\
+                 // interface's object, a bare export, or, for one of several versions of an\n\
+                 // interface, a member of the export named by its full WIT name. A shape is\n\
+                 // declared only where the world allows it for the item."
+                    .to_string(),
+            );
+        } else if groups.iter().any(|group| !group.items.is_empty()) {
+            sections.push(
+                "// Each item of an exported interface is implemented through exactly one\n\
+                 // of the shapes below: a member of its package's object, a member of its\n\
+                 // interface's object, or a bare export. A shape is declared only where the\n\
+                 // world allows it for the item."
+                    .to_string(),
+            );
+        }
+
+        let members: Vec<Vec<String>> = groups
+            .iter()
+            .map(|group| {
+                group
+                    .items
+                    .iter()
+                    .map(|item| self.render_item_member(item))
+                    .collect()
+            })
+            .collect();
+        let object = |g: usize, depth: usize| {
+            let pad = "  ".repeat(depth);
+            let mut out = String::from("{\n");
+            for member in &members[g] {
+                let _ = writeln!(out, "{pad}  {member};");
+            }
+            let _ = write!(out, "{pad}}}");
+            out
+        };
+
+        // Package objects, one per package, in first-use order.
+        let mut packages: Vec<&str> = Vec::new();
+        for (g, group) in groups.iter().enumerate() {
+            if group.items.is_empty() || layout.versioned(g) {
+                continue;
+            }
+            if let Some(package) = group.names.package.as_deref() {
+                if !packages.contains(&package) {
+                    packages.push(package);
+                }
+            }
+        }
+        for package in packages {
+            let mut body = String::from("{\n");
+            for (g, group) in groups.iter().enumerate() {
+                if group.items.is_empty()
+                    || layout.versioned(g)
+                    || group.names.package.as_deref() != Some(package)
+                {
+                    continue;
+                }
+                let _ = writeln!(
+                    body,
+                    "  // The exported interface `{}`.\n  {}: {};",
+                    group.names.wit_name,
+                    member_name(&group.names.interface),
+                    object(g, 1)
+                );
+            }
+            body.push('}');
+            sections.push(bare_export(package, &format!("const {{}}: {body}")).join("\n"));
+        }
+
+        for (g, group) in groups.iter().enumerate() {
+            if layout.versioned(g) {
+                let local = format!("versioned{g}_");
+                sections.push(format!(
+                    "// The exported interface `{0}`, one of several versions.\n\
+                     const {local}: {1};\n\
+                     export {{ {local} as \"{0}\" }};",
+                    group.names.wit_name,
+                    object(g, 0)
+                ));
+            }
+        }
+
+        for (g, group) in groups.iter().enumerate() {
+            if layout.interface_layer(g) {
+                let decl = format!("const {{}}: {}", object(g, 0));
+                sections.push(format!(
+                    "// The exported interface `{}`.\n{}",
+                    group.names.wit_name,
+                    bare_export(&group.names.interface, &decl).join("\n")
+                ));
+            }
+        }
+
+        for (g, group) in groups.iter().enumerate() {
+            let bare: Vec<String> = group
+                .items
+                .iter()
+                .enumerate()
+                .filter(|&(i, _)| layout.bare(g, i))
+                .flat_map(|(_, item)| self.render_item_bare(item))
+                .collect();
+            if !bare.is_empty() {
+                sections.push(format!(
+                    "// Items of the exported interface `{}`.\n{}",
+                    group.names.wit_name,
+                    bare.join("\n")
+                ));
+            }
+        }
+
+        let world_funcs: Vec<String> = world_export_functions(self.world())
+            .flat_map(|func| self.render_func_lines(func, Side::Export))
+            .collect();
+        if !world_funcs.is_empty() {
+            sections.push(world_funcs.join("\n"));
+        }
+        if groups.iter().any(|group| group.cli_run) {
+            sections.push(
+                "// The `wasi:cli/run` command entry point. It may be synchronous or\n\
+                 // `async`. Throwing, or a rejected promise, maps to a failed run.\n\
+                 export function run(): void | Promise<void>;"
+                    .to_string(),
+            );
+        }
+
+        if sections.is_empty() {
+            return String::new();
+        }
+        self.render_module_block(GUEST_MODULE_NAME, &sections.join("\n\n"))
+    }
+
+    /// The comment describing the two ways a `wasi:http/handler` export is
+    /// served.
+    fn render_http_handler_guidance(&self, groups: &[ExportGroup<'_>]) -> String {
+        let Some(group) = groups.iter().find(|group| group.http_handler) else {
+            return String::new();
+        };
+        let wit_response = group.items.iter().any(|item| match item.kind {
+            ExportItemKind::HttpHandle(func) => self.http_response_type(func).is_some(),
+            _ => false,
+        });
+        let returns = if wit_response {
+            "a `Response` or the WIT `response`, or a promise of either"
+        } else {
+            "a `Response` or a promise of one"
+        };
+        let mut paragraph = format!(
+            "Or implement `handle` below, which receives the WIT request and returns \
+             {returns}. `fetch(request)` sends the request on."
+        );
+        let types = self
+            .world()
+            .imports
+            .keys()
+            .map(|key| self.resolve.name_world_key(key))
+            .find(|name| names_interface(name, "wasi:http/types"));
+        if let Some(types) = types {
+            let _ = write!(
+                paragraph,
+                " It fails with an `error-code` by throwing an `ErrorCode` from `{types}`."
+            );
+        }
+        let mut out = format!(
+            "// The `{handler}` export is served in one of two ways. Either\n\
+             // register a listener on the global, and the runtime dispatches each\n\
+             // request to it as a `FetchEvent`:\n\
+             //\n\
+             //   addEventListener('fetch', (event) => {{\n\
+             //     event.respondWith(new Response('hello'));\n\
+             //   }});\n\
+             //",
+            handler = crate::HTTP_HANDLER_INTERFACE_PREFIX,
+        );
+        // The paragraph, wrapped to lines of at most 76 characters after `// `.
+        let mut line = String::new();
+        for word in paragraph.split(' ') {
+            if !line.is_empty() && line.len() + 1 + word.len() > 76 {
+                let _ = write!(out, "\n// {line}");
+                line.clear();
+            }
+            if !line.is_empty() {
+                line.push(' ');
+            }
+            line.push_str(word);
+        }
+        let _ = write!(out, "\n// {line}");
+        out.push_str(
+            "\n//\n\
+             // An application that does both, or neither, fails to componentize.",
+        );
+        out
+    }
+
+    /// An item's member of its interface object, without the trailing `;`.
+    fn render_item_member(&self, item: &ExportItem<'_>) -> String {
+        match item.kind {
+            ExportItemKind::Func(func) => {
+                self.render_signature(&member_name(&item.js_name), func, Side::Export, false)
+            }
+            ExportItemKind::Resource(res) => {
+                let class = self.qualify(
+                    self.decl_name(Decl::Type(res, Side::Export)).to_string(),
+                    Cx::result(Side::Export, false),
+                );
+                format!("{}: typeof {class}", item.js_name)
+            }
+            ExportItemKind::HttpHandle(func) => {
+                format!("{}{}", item.js_name, self.render_http_handle(func))
+            }
+        }
+    }
+
+    /// An item's bare export statements.
+    fn render_item_bare(&self, item: &ExportItem<'_>) -> Vec<String> {
+        match item.kind {
+            ExportItemKind::Func(func) => self.render_func_lines(func, Side::Export),
+            ExportItemKind::Resource(res) => {
+                vec![self.reexport(
+                    "export",
+                    &[(
+                        self.decl_name(Decl::Type(res, Side::Export)).to_string(),
+                        item.js_name.clone(),
+                    )],
+                )]
+            }
+            ExportItemKind::HttpHandle(func) => bare_export(
+                &item.js_name,
+                &format!("function {{}}{}", self.render_http_handle(func)),
+            ),
+        }
+    }
+
+    /// The `(request): …` signature of the guest's `wasi:http/handler`
+    /// implementation. `func` is the WIT `handle`, or `None` for the empty
+    /// `wasi:http/handler` of the built-in serve world, in which case the
+    /// request's type is `unknown`.
+    ///
+    /// The runtime passes the WIT request, and accepts a `Response` or the
+    /// resource [`Generator::http_response_type`] finds.
+    fn render_http_handle(&self, func: Option<&Function>) -> String {
+        let request = func
+            .and_then(|func| func.params.first())
+            .map(|param| self.render_type(&param.ty, Cx::params(Side::Export, false)))
+            .unwrap_or_else(|| "unknown".to_string());
+        let mut returned = "Response".to_string();
+        if let Some(response) = self.http_response_type(func) {
+            let _ = write!(
+                returned,
+                " | {}",
+                self.render_type(&response, Cx::result(Side::Export, false))
+            );
+        }
+        format!("(request: {request}): {returned} | Promise<{returned}>")
+    }
+
+    /// The `request` resource of [`WASI_HTTP_TYPES`], or of an interface for
+    /// which [`same_interface`] returns `true`, if the world imports it and the
+    /// declarations name it.
+    fn wit_request_type(&self) -> Option<TypeId> {
+        let id = self
+            .world()
+            .imports
+            .iter()
+            .find_map(|(key, item)| match item {
+                WorldItem::Interface { id, .. }
+                    if same_interface(&self.resolve.name_world_key(key), WASI_HTTP_TYPES) =>
+                {
+                    self.resolve.interfaces[*id].types.get("request").copied()
+                }
+                _ => None,
+            })?;
+        let id = self.canonical(id);
+        self.decl_index
+            .contains_key(&Decl::Type(id, Side::Import))
+            .then_some(id)
+    }
+
+    /// The `ok` type of the WIT `handle`'s `result`, if it is a resource.
+    fn http_response_type(&self, func: Option<&Function>) -> Option<Type> {
+        let (ok, _) = self.as_result(&func?.result?)?;
+        let Some(Type::Id(id)) = ok else {
+            return None;
+        };
+        match self.resolve.types[self.canonical(id)].kind {
+            TypeDefKind::Resource | TypeDefKind::Handle(Handle::Own(_)) => ok,
+            _ => None,
+        }
+    }
+
+    /// The modules the runtime may register for the world's imports: one per
+    /// imported interface, and `external` for the world-level imports.
+    fn import_module_groups(&self) -> Vec<ImportModule<'a>> {
+        let world = self.world();
+
+        // World-level imports, grouped into `external`.
+        let mut funcs: Vec<&Function> = Vec::new();
+        let mut types: Vec<(&str, TypeId)> = Vec::new();
+        let mut member_funcs = false;
+        for (key, item) in &world.imports {
+            match item {
+                WorldItem::Function(func) if func.kind.resource().is_none() => funcs.push(func),
+                WorldItem::Function(_) => member_funcs = true,
+                WorldItem::Type { id, .. } => {
+                    if let WorldKey::Name(name) = key {
+                        types.push((name, *id));
+                    }
+                }
+                WorldItem::Interface { .. } => {}
+            }
+        }
+        let mut modules = vec![ImportModule {
+            spec: WORLD_MODULE_NAME.to_string(),
+            owner: TypeOwner::World(self.world),
+            funcs,
+            types,
+            member_funcs,
+        }];
+
+        for (key, item) in &world.imports {
+            let WorldItem::Interface { id, .. } = item else {
+                continue;
+            };
+            let iface = &self.resolve.interfaces[*id];
+            let funcs: Vec<&Function> = iface
+                .functions
+                .values()
+                .filter(|func| func.kind.resource().is_none())
+                .collect();
+            let member_funcs = iface.functions.len() > funcs.len();
+            let types: Vec<(&str, TypeId)> = iface
+                .types
+                .iter()
+                .map(|(name, id)| (name.as_str(), *id))
+                .collect();
+            modules.push(ImportModule {
+                spec: module_specifier(&self.resolve.name_world_key(key)).into_owned(),
+                owner: TypeOwner::Interface(*id),
+                funcs,
+                types,
+                member_funcs,
+            });
+        }
+        modules
+    }
+
+    fn render_import_modules(&self) -> String {
+        self.import_module_groups()
+            .iter()
+            .map(|module| self.render_import_module(module))
+            .collect()
+    }
+
+    /// The `err` types whose error classes the module of `owner` exports.
+    fn module_error_classes(&self, owner: TypeOwner) -> impl Iterator<Item = TypeId> + '_ {
+        let interface = match owner {
+            TypeOwner::Interface(iface) => Some(iface),
+            _ => None,
+        };
+        self.error_classes
+            .iter()
+            .filter(move |(_, module)| *module == interface)
+            .map(|(err, _)| *err)
+    }
+
+    /// The names of the values that the runtime's module for `module` exports:
+    /// its functions, the classes of the resources its interface defines, its
+    /// error classes, and an object for each of its enum and flags types. An
+    /// enum or flags type with the name of an error class is left out, because
+    /// the error class is exported instead. This follows the runtime's
+    /// `build_world_desc`.
+    fn runtime_exports(&self, module: &ImportModule<'_>) -> Vec<String> {
+        let mut names: Vec<String> = module
+            .funcs
+            .iter()
+            .map(|func| mangle_name(&func.name))
+            .collect();
+        let error_names: Vec<String> = self
+            .module_error_classes(module.owner)
+            .map(|err| mangle_resource_name(self.type_name(err)))
+            .collect();
+        for &(wit_name, id) in &module.types {
+            let root = self.canonical(id);
+            let name = mangle_resource_name(wit_name);
+            let exported = match self.resolve.types[root].kind {
+                // The runtime creates a resource's class in the module of the
+                // interface defining it, under the resource's own name, whether
+                // or not the resource has functions. A `use`d or renamed
+                // resource is a type only.
+                TypeDefKind::Resource => {
+                    id == root && self.resolve.types[root].owner == module.owner
+                }
+                TypeDefKind::Enum(_) | TypeDefKind::Flags(_) => !error_names.contains(&name),
+                _ => false,
+            };
+            if exported && !names.contains(&name) {
+                names.push(name);
+            }
+        }
+        names.extend(error_names);
+        names
+    }
+
+    /// Whether the runtime registers `module`, which it does if the module
+    /// exports a value (see [`Generator::runtime_exports`]), or if its
+    /// interface has resource functions.
+    fn registers_module(&self, module: &ImportModule<'_>) -> bool {
+        module.member_funcs || !self.runtime_exports(module).is_empty()
+    }
+
+    /// Render the `declare module '<spec>'` block of `module`. It declares the
+    /// module's freestanding functions, and re-exports its types (each with its
+    /// WIT name) and the error classes the module exports.
+    fn render_import_module(&self, module: &ImportModule<'_>) -> String {
+        let ImportModule {
+            spec,
+            owner,
+            funcs,
+            types,
+            ..
+        } = module;
+        let mut values: Vec<(String, String)> = Vec::new();
+        let mut type_only: Vec<(String, String)> = Vec::new();
+        // The declared names of the flags types' set aliases. Each is re-exported unless another
+        // type of the interface has its name, such as a record `perms-set` next to flags `perms`.
+        let mut sets: HashSet<String> = HashSet::new();
+        let mut error_names = HashSet::new();
+        for err in self.module_error_classes(*owner) {
+            let plain = mangle_resource_name(self.type_name(err));
+            values.push((
+                self.decl_name(Decl::ErrorClass(err)).to_string(),
+                plain.clone(),
+            ));
+            error_names.insert(plain);
+        }
+        for &(wit_name, id) in types {
+            let plain = mangle_resource_name(wit_name);
+            let root = self.canonical(id);
+            let decl = self.decl_name(Decl::Type(root, Side::Import)).to_string();
+            match &self.resolve.types[root].kind {
+                // The runtime creates a resource's class in the module of the
+                // interface defining it, under the resource's own name, whether
+                // or not the resource has functions. A `use`d or renamed
+                // resource is a type only.
+                TypeDefKind::Resource => {
+                    if id == root && self.resolve.types[root].owner == *owner {
+                        values.push((decl, plain));
+                    } else {
+                        type_only.push((decl, plain));
+                    }
+                }
+                kind => {
+                    if let TypeDefKind::Flags(_) = kind {
+                        sets.insert(flags_set_name(&decl));
+                        values.push((flags_set_name(&decl), flags_set_name(&plain)));
+                    }
+                    // The error class of the same name is exported instead. Its
+                    // `payload` property has this type.
+                    if !error_names.contains(&plain) {
+                        values.push((decl, plain));
+                    }
+                }
+            }
+        }
+
+        let taken: HashSet<String> = values
+            .iter()
+            .chain(&type_only)
+            .filter(|(decl, _)| !sets.contains(decl))
+            .map(|(_, name)| name.clone())
+            .collect();
+        values.retain(|(decl, name)| !sets.contains(decl) || !taken.contains(name));
+
+        let mut lines: Vec<String> = Vec::new();
+        for func in funcs {
+            lines.extend(self.render_func_lines(func, Side::Import));
+        }
+        let mut reexports: Vec<String> = Vec::new();
+        if !values.is_empty() {
+            reexports.push(self.reexport("export", &values));
+        }
+        if !type_only.is_empty() {
+            reexports.push(self.reexport("export type", &type_only));
+        }
+        if lines.is_empty() && reexports.is_empty() {
+            return String::new();
+        }
+
+        let mut body = String::new();
+        if !self.registers_module(module) {
+            body.push_str(
+                "// The runtime registers no module under this name, so only its types\n\
+                 // are usable.\n",
+            );
+        }
+        let lines = lines.join("\n");
+        if !lines.is_empty() {
+            let _ = writeln!(body, "{lines}");
+        }
+        if !reexports.is_empty() {
+            if !lines.is_empty() {
+                body.push('\n');
+            }
+            body.push_str(&reexports.join("\n"));
+        }
+        self.render_module_block(spec, body.trim_end())
+    }
+
+    // -----------------------------------------------------------------------
+    // Functions
+    // -----------------------------------------------------------------------
+
+    /// Declare a freestanding function implemented on `side` as a bare export,
+    /// e.g. `export function foo(a: number): bigint;`.
+    fn render_func_lines(&self, func: &Function, side: Side) -> Vec<String> {
+        let js_name = mangle_name(&func.name);
+        let signature = self.render_signature("{}", func, side, false);
+        bare_export(&js_name, &format!("function {signature}"))
+    }
+
+    /// Render a function's `name(params): return` signature (no keyword, no
+    /// trailing `;`), used for bare functions, interface-object members and
+    /// resource members.
+    fn render_signature(
+        &self,
+        js_name: &str,
+        func: &Function,
+        side: Side,
+        in_types: bool,
+    ) -> String {
+        let params = self.render_params(func, side, in_types);
+        let ret = self.render_func_return(func, side, in_types);
+        format!("{js_name}({params}): {ret}")
+    }
+
+    /// Render a function's parameter list, without the surrounding parentheses.
+    ///
+    /// A method's first WIT parameter is its `borrow<resource>` receiver, which
+    /// reaches JavaScript as `this` rather than as an argument, so it is dropped.
+    fn render_params(&self, func: &Function, side: Side, in_types: bool) -> String {
+        let skip = usize::from(matches!(
+            func.kind,
+            FunctionKind::Method(_) | FunctionKind::AsyncMethod(_)
+        ));
+        let cx = Cx::params(side, in_types);
+        let params: Vec<String> = func
+            .params
+            .iter()
+            .skip(skip)
+            .map(|param| {
+                format!(
+                    "{}: {}",
+                    param_name(&param.name),
+                    self.render_type(&param.ty, cx)
+                )
+            })
+            .collect();
+        params.join(", ")
+    }
+
+    /// Render the return type of a function implemented on `side`, applying the
+    /// two return-position rules:
+    ///
+    /// - A `result<T, E>` return is unwrapped to its `ok` payload, `T`, or to
+    ///   `void` for a `result` with no `ok` payload. The `err` case is thrown
+    ///   instead of returned (see `handle_import_result` and `call_export`).
+    /// - An `async` function wraps its return in `Promise<…>`. An exported one is
+    ///   `T | Promise<T>`, since `export_call_async` accepts a settled value from
+    ///   a plain `function`. An import stays `Promise<T>`, since the host always
+    ///   returns one.
+    fn render_func_return(&self, func: &Function, side: Side, in_types: bool) -> String {
+        let cx = Cx::result(side, in_types);
+        let returned = func.result.and_then(|ty| match self.as_result(&ty) {
+            Some((ok, _err)) => ok,
+            None => Some(ty),
+        });
+        let inner = match &returned {
+            None => "void".to_string(),
+            Some(ty) => self.render_type(ty, cx),
+        };
+        // A `future<T>` result is already a promise, which an `async` function's
+        // own promise adopts rather than wrapping.
+        let returns_future = returned.is_some_and(|ty| self.is_future(&ty));
+        let promise = self.global("Promise", cx);
+        if returns_future || !func.kind.is_async() {
+            inner
+        } else if side == Side::Export {
+            format!("{inner} | {promise}<{inner}>")
+        } else {
+            format!("{promise}<{inner}>")
+        }
+    }
+
+    // -----------------------------------------------------------------------
+    // Types
+    // -----------------------------------------------------------------------
+
+    /// Render a WIT type as its TypeScript form in a non-return position,
+    /// meaning parameters and nested types, where `result<T, E>` is the
+    /// `{tag, val?}` union.
+    fn render_type(&self, ty: &Type, cx: Cx) -> String {
+        match ty {
+            Type::Bool => "boolean".to_string(),
+            // JS numbers, per `value.rs`'s `push_u8` family and `push_f32`.
+            Type::U8 | Type::U16 | Type::U32 | Type::S8 | Type::S16 | Type::S32 => {
+                "number".to_string()
+            }
+            // `push_u64` and `push_s64` lift a BigInt.
+            Type::U64 | Type::S64 => "bigint".to_string(),
+            Type::F32 | Type::F64 => "number".to_string(),
+            // `char` is a one-code-point string, per `push_char`.
+            Type::Char => "string".to_string(),
+            Type::String => "string".to_string(),
+            Type::ErrorContext => {
+                self.used_unknown_placeholder.set(true);
+                "unknown /* TODO: error-context, deferred */".to_string()
+            }
+            Type::Id(id) => {
+                let root = self.canonical(*id);
+                if self.resolve.types[root].name.is_some() {
+                    self.type_ref(root, cx)
+                } else {
+                    self.render_structure(root, cx)
+                }
+            }
+        }
+    }
+
+    /// Render a type definition's structural form: the body of a named type's
+    /// declaration, or an anonymous type inline. An enum, a flags type and a
+    /// resource have a declaration of their own and are never rendered here.
+    fn render_structure(&self, id: TypeId, cx: Cx) -> String {
+        match &self.resolve.types[id].kind {
+            TypeDefKind::Type(inner) => self.render_type(inner, cx),
+            TypeDefKind::List(elem) => self.render_list(elem, cx),
+            TypeDefKind::Option(inner) => self.render_option(inner, cx),
+            TypeDefKind::Result(r) => self.render_result_union(r.ok.as_ref(), r.err.as_ref(), cx),
+            TypeDefKind::Tuple(t) => {
+                let elems: Vec<String> =
+                    t.types.iter().map(|ty| self.render_type(ty, cx)).collect();
+                format!("[{}]", elems.join(", "))
+            }
+            TypeDefKind::Record(r) => self.render_record(r, cx),
+            TypeDefKind::Variant(v) => self.render_variant(v, cx),
+            TypeDefKind::Handle(Handle::Own(res) | Handle::Borrow(res)) => self.type_ref(*res, cx),
+            // `readable.rs` in `wit-bridge`: a `stream<u8>` the guest
+            // receives is a byte stream of `Uint8Array`s, and one it hands over
+            // takes `ArrayBufferView` and `ArrayBuffer` chunks. The chunks of a
+            // `stream` without a payload type are `undefined`.
+            TypeDefKind::Stream(elem) => {
+                let elem = match elem {
+                    None => "undefined".to_string(),
+                    Some(elem) => match (self.unaliased(elem) == Type::U8, cx.produces) {
+                        (true, true) => format!(
+                            "{} | {}",
+                            self.global("ArrayBufferView", cx),
+                            self.global("ArrayBuffer", cx)
+                        ),
+                        (true, false) => self.global("Uint8Array", cx),
+                        (false, _) => self.render_type(elem, cx),
+                    },
+                };
+                let stream = self.global("ReadableStream", cx);
+                if cx.produces {
+                    format!(
+                        "{stream}<{elem}> | {}<{elem}> | {}<{elem}>",
+                        self.global("AsyncIterable", cx),
+                        self.global("Iterable", cx)
+                    )
+                } else {
+                    format!("{stream}<{elem}>")
+                }
+            }
+            // `promises.rs` in `wit-bridge`: a `future<result<T, E>>`
+            // settles with `T` or rejects with the `err` payload's error. A
+            // `future` without a payload type settles with `undefined`.
+            TypeDefKind::Future(value) => {
+                let value = match value {
+                    None => "void".to_string(),
+                    Some(value) => match self.as_result(value) {
+                        Some((Some(ok), _)) => self.render_type(&ok, cx),
+                        Some((None, _)) => "void".to_string(),
+                        None => self.render_type(value, cx),
+                    },
+                };
+                if cx.produces {
+                    format!("{value} | {}<{value}>", self.global("PromiseLike", cx))
+                } else {
+                    format!("{}<{value}>", self.global("Promise", cx))
+                }
+            }
+            _ => {
+                self.used_unknown_placeholder.set(true);
+                "unknown /* TODO: unsupported WIT type, deferred */".to_string()
+            }
+        }
+    }
+
+    /// Render `list<T>`. A list of a number type with a typed-array kind (see
+    /// `wit_bridge::value::TypeShape::view_kind`) is the matching typed
+    /// array. A list that the guest hands over can also be a plain array, and a
+    /// `list<u8>` also a `Uint8ClampedArray`. Any other list is `T[]`.
+    fn render_list(&self, elem: &Type, cx: Cx) -> String {
+        let (typed_array, element) = match self.unaliased(elem) {
+            Type::U8 => ("Uint8Array", "number"),
+            Type::S8 => ("Int8Array", "number"),
+            Type::U16 => ("Uint16Array", "number"),
+            Type::S16 => ("Int16Array", "number"),
+            Type::U32 => ("Uint32Array", "number"),
+            Type::S32 => ("Int32Array", "number"),
+            Type::F32 => ("Float32Array", "number"),
+            Type::F64 => ("Float64Array", "number"),
+            Type::U64 => ("BigUint64Array", "bigint"),
+            Type::S64 => ("BigInt64Array", "bigint"),
+            _ => {
+                let inner = self.render_type(elem, cx);
+                // Wrap a union/object element so `(T)[]` parses unambiguously.
+                return if inner.contains('|') || inner.starts_with('{') {
+                    format!("({inner})[]")
+                } else {
+                    format!("{inner}[]")
+                };
+            }
+        };
+        let typed_array = self.global(typed_array, cx);
+        if cx.produces && self.unaliased(elem) == Type::U8 {
+            let clamped = self.global("Uint8ClampedArray", cx);
+            format!("{typed_array} | {clamped} | {element}[]")
+        } else if cx.produces {
+            format!("{typed_array} | {element}[]")
+        } else {
+            typed_array
+        }
+    }
+
+    /// Render `option<T>`. `none` is `undefined` and `some(v)` is `v`, except
+    /// for a nested `option<option<T>>`, where `some` wraps the inner option in
+    /// `{ val }` so `some(none)` is distinguishable from `none`. See
+    /// `push_option`. An option the guest hands over may also be `null` for
+    /// `none`, which `pop_option` accepts.
+    fn render_option(&self, inner: &Type, cx: Cx) -> String {
+        let inner_ts = self.render_type(inner, cx);
+        let none = if cx.produces {
+            "undefined | null"
+        } else {
+            "undefined"
+        };
+        if self.is_option(inner) {
+            format!("{none} | {{ val: {inner_ts} }}")
+        } else if inner_ts.contains('|') {
+            format!("({inner_ts}) | {none}")
+        } else {
+            format!("{inner_ts} | {none}")
+        }
+    }
+
+    /// Render `result<T, E>` as the `{tag, val?}` union, the shape `push_result`
+    /// and `pop_result` build in non-return positions. The `val` field is present
+    /// only on an arm that has a payload (see [`Self::render_tagged`]).
+    fn render_result_union(&self, ok: Option<&Type>, err: Option<&Type>, cx: Cx) -> String {
+        format!(
+            "{} | {}",
+            self.render_tagged("ok", ok, cx),
+            self.render_tagged("err", err, cx)
+        )
+    }
+
+    /// Render one arm of a result or case of a variant: `{ tag }`, with `val`
+    /// when it has a payload. An `option` payload's `val` is optional, since
+    /// `pop_result` and `pop_variant` read a missing `val` as `none`.
+    fn render_tagged(&self, tag: &str, payload: Option<&Type>, cx: Cx) -> String {
+        match payload {
+            Some(ty) => {
+                let optional = if self.is_option(ty) { "?" } else { "" };
+                format!(
+                    "{{ tag: '{tag}'; val{optional}: {} }}",
+                    self.render_type(ty, cx)
+                )
+            }
+            None => format!("{{ tag: '{tag}' }}"),
+        }
+    }
+
+    /// Render a record as a TypeScript object type. Field names are mangled
+    /// (`push_record` uses the mangled names verbatim). An `option` field is
+    /// optional, since `pop_record` reads a missing key as `none`.
+    fn render_record(&self, r: &wit_parser::Record, cx: Cx) -> String {
+        let mut out = String::from("{ ");
+        for field in &r.fields {
+            let optional = if self.is_option(&field.ty) { "?" } else { "" };
+            let _ = write!(
+                out,
+                "{}{optional}: {}; ",
+                mangle_name(&field.name),
+                self.render_type(&field.ty, cx)
+            );
+        }
+        out.push('}');
+        out
+    }
+
+    /// Render a variant as a discriminated union keyed by `tag`. A case with a
+    /// payload also has `val`, and a payloadless case has only `tag`. See
+    /// `push_variant`.
+    fn render_variant(&self, v: &wit_parser::Variant, cx: Cx) -> String {
+        let arms: Vec<String> = v
+            .cases
+            .iter()
+            .map(|case| self.render_tagged(&mangle_name(&case.name), case.ty.as_ref(), cx))
+            .collect();
+        arms.join(" | ")
+    }
+
+    // -----------------------------------------------------------------------
+    // WIT helpers
+    // -----------------------------------------------------------------------
+
+    /// The resource types an interface declares, in declaration order.
+    fn interface_resources(&self, id: InterfaceId) -> Vec<TypeId> {
+        self.resolve.interfaces[id]
+            .types
+            .values()
+            .copied()
+            .filter(|id| matches!(self.resolve.types[*id].kind, TypeDefKind::Resource))
+            .collect()
+    }
+
+    /// The constructor, methods and statics of resource `res`, in the order its
+    /// owning interface or world declares them.
+    fn resource_funcs(&self, res: TypeId) -> Vec<&'a Function> {
+        let resolve = self.resolve;
+        let is_member = |func: &&Function| func.kind.resource() == Some(res);
+        match resolve.types[res].owner {
+            TypeOwner::Interface(iface) => resolve.interfaces[iface]
+                .functions
+                .values()
+                .filter(is_member)
+                .collect(),
+            TypeOwner::World(world) => resolve.worlds[world]
+                .imports
+                .values()
+                .chain(resolve.worlds[world].exports.values())
+                .filter_map(|item| match item {
+                    WorldItem::Function(func) => Some(func),
+                    _ => None,
+                })
+                .filter(is_member)
+                .collect(),
+            TypeOwner::None => Vec::new(),
+        }
+    }
+
+    /// The declared name of a type def, or a synthetic name for an anonymous one.
+    fn type_name(&self, id: TypeId) -> &str {
+        self.resolve.types[id]
+            .name
+            .as_deref()
+            .unwrap_or("Anonymous")
+    }
+
+    /// Follow `use`-alias links (`type x = root`, encoded as
+    /// `TypeDefKind::Type(Type::Id(root))`) to the canonical definition.
+    ///
+    /// A type pulled into several interfaces with `use` appears as a distinct
+    /// [`TypeId`] per interface, each an alias to one root. Collapsing to the root
+    /// gives it exactly one declaration in the types module, which each
+    /// interface's module re-exports under the name it uses.
+    fn canonical(&self, id: TypeId) -> TypeId {
+        let mut current = id;
+        while let TypeDefKind::Type(Type::Id(next)) = self.resolve.types[current].kind {
+            current = next;
+        }
+        current
+    }
+
+    /// `ty` with aliases resolved, so an alias of a primitive type is that type.
+    /// The runtime resolves them the same way when it picks a typed array for a
+    /// list or a byte stream for a stream.
+    fn unaliased(&self, ty: &Type) -> Type {
+        match ty {
+            Type::Id(id) => match self.resolve.types[self.canonical(*id)].kind {
+                TypeDefKind::Type(primitive) => primitive,
+                _ => Type::Id(self.canonical(*id)),
+            },
+            primitive => *primitive,
+        }
+    }
+
+    /// If `ty` is a `result<T, E>`, return its `(ok, err)` arms, each `Some(Type)`
+    /// iff that arm has a payload. Used by return-position unwrapping.
+    ///
+    /// `use`-aliases are resolved first, since the runtime's `type_shape` follows
+    /// `Type::Alias` through to the underlying `result`. Without that step an
+    /// aliased `result` in return position would render as the `{tag, val?}` union
+    /// instead, diverging from what the runtime lowers.
+    fn as_result(&self, ty: &Type) -> Option<(Option<Type>, Option<Type>)> {
+        if let Type::Id(id) = ty {
+            if let TypeDefKind::Result(r) = &self.resolve.types[self.canonical(*id)].kind {
+                return Some((r.ok, r.err));
+            }
+        }
+        None
+    }
+
+    /// Whether `ty` is a `future<_>`, after resolving `use`-aliases.
+    fn is_future(&self, ty: &Type) -> bool {
+        match ty {
+            Type::Id(id) => matches!(
+                self.resolve.types[self.canonical(*id)].kind,
+                TypeDefKind::Future(_)
+            ),
+            _ => false,
+        }
+    }
+
+    /// Whether `ty` is an `option<_>`, after resolving `use`-aliases. The runtime
+    /// follows aliases through to the `option`, so the nested-option `{ val }`
+    /// wrap applies to an aliased `option<option<_>>` the same way.
+    fn is_option(&self, ty: &Type) -> bool {
+        match ty {
+            Type::Id(id) => matches!(
+                self.resolve.types[self.canonical(*id)].kind,
+                TypeDefKind::Option(_)
+            ),
+            _ => false,
+        }
+    }
+}
+
+impl Generator<'_> {
+    /// A `declare module '<spec>' { … }` block around `body`, which imports
+    /// the types module as [`TYPES_NAMESPACE`] when `body` refers to it.
+    fn render_module_block(&self, spec: &str, body: &str) -> String {
+        let import = if body.contains(&format!("{TYPES_NAMESPACE}.")) {
+            format!(
+                "import type * as {TYPES_NAMESPACE} from '{}';\n\n",
+                self.types_module
+            )
+        } else {
+            String::new()
+        };
+        format!(
+            "declare module '{spec}' {{\n{}}}\n\n",
+            indent(&format!("{import}{body}"))
+        )
+    }
+
+    /// An `export { a as b, … } from '<types module>';` statement re-exporting
+    /// each `(declaration, name)` pair. `keyword` is `export` or `export type`.
+    fn reexport(&self, keyword: &str, names: &[(String, String)]) -> String {
+        let specifiers: Vec<String> = names
+            .iter()
+            .map(|(decl, name)| {
+                if decl == name {
+                    format!("  {name},\n")
+                } else {
+                    format!("  {decl} as {name},\n")
+                }
+            })
+            .collect();
+        format!(
+            "{keyword} {{\n{}}} from '{}';",
+            specifiers.concat(),
+            self.types_module
+        )
+    }
+}
+
+/// The name of the `number` alias declared next to a flags enum. A set
+/// of its members has that type.
+fn flags_set_name(name: &str) -> String {
+    format!("{name}Set")
+}
+
+/// The keyword declaring an enum or flags type: `enum` when the runtime creates
+/// an object for it (see [`Generator::has_runtime_object`]), which the guest
+/// imports from the interface's module, and `const enum` otherwise, whose
+/// members `tsc` inlines at each use, since there is no object to import.
+fn enum_keyword(runtime_object: bool) -> &'static str {
+    if runtime_object {
+        "enum"
+    } else {
+        "const enum"
+    }
+}
+
+/// Declare an enum numbered from zero, which is the case index `push_enum`
+/// lifts and `pop_enum` lowers. See [`enum_keyword`] on `runtime_object`.
+fn declare_enum(name: &str, e: &wit_parser::Enum, runtime_object: bool) -> String {
+    let members: Vec<String> = e
+        .cases
+        .iter()
+        .enumerate()
+        .map(|(i, case)| format!("  {} = {i},\n", mangle_name(&case.name)))
+        .collect();
+    format!(
+        "export {} {name} {{\n{}}}\n",
+        enum_keyword(runtime_object),
+        members.concat()
+    )
+}
+
+/// Declare a flags set as an enum of its bits, plus the `number` alias a set of
+/// them has. `push_flags` lifts and `pop_flags` lowers that bit set as an
+/// int32, matching the result of `|`, so the member for bit 31 is `1 << 31`, a
+/// negative number. See [`enum_keyword`] on `runtime_object`.
+///
+/// The alias is needed because a bitwise-or of two members is a `number` and
+/// not a member, so the enum type itself cannot be the parameter type.
+fn declare_flags(name: &str, f: &wit_parser::Flags, runtime_object: bool) -> String {
+    let members: Vec<String> = f
+        .flags
+        .iter()
+        .enumerate()
+        .map(|(i, flag)| {
+            let value = if i == 31 {
+                "1 << 31".to_string()
+            } else {
+                (1u64 << i).to_string()
+            };
+            format!("  {} = {value},\n", mangle_name(&flag.name))
+        })
+        .collect();
+    let set = flags_set_name(name);
+    format!(
+        "export {} {name} {{\n{}}}\n\n\
+         // A set of `{name}` members, combined with `|`.\n\
+         export type {set} = number;\n",
+        enum_keyword(runtime_object),
+        members.concat()
+    )
+}
+
+// ---------------------------------------------------------------------------
+// Export naming
+// ---------------------------------------------------------------------------
+
+/// The imports the runtime may serve from one module: those of an imported
+/// interface, or the world-level imports.
+struct ImportModule<'a> {
+    /// The module specifier.
+    spec: String,
+    /// The interface, or the world.
+    owner: TypeOwner,
+    /// The freestanding functions.
+    funcs: Vec<&'a Function>,
+    /// The types, each with its WIT name.
+    types: Vec<(&'a str, TypeId)>,
+    /// Whether `owner` has resource functions.
+    member_funcs: bool,
+}
+
+/// The items of one exported interface, which the guest implements.
+struct ExportGroup<'a> {
+    /// The JS names of the interface, whose WIT name is its world key name,
+    /// e.g. `wasi:http/handler@0.3.0`.
+    names: InterfaceNames,
+    items: Vec<ExportItem<'a>>,
+    /// Whether this is the `wasi:cli/run` export, which has no items and makes
+    /// the guest export a bare `run`.
+    cli_run: bool,
+    /// Whether this is the `wasi:http/handler` export, whose one item is
+    /// `handle`.
+    http_handler: bool,
+}
+
+struct ExportItem<'a> {
+    /// The item's JS name: lowerCamelCase for a function, UpperCamelCase for a
+    /// resource class.
+    js_name: String,
+    kind: ExportItemKind<'a>,
+}
+
+#[derive(Clone, Copy)]
+enum ExportItemKind<'a> {
+    Func(&'a Function),
+    Resource(TypeId),
+    /// The `handle` of a `wasi:http/handler` export, with its WIT declaration if
+    /// the world declares one.
+    HttpHandle(Option<&'a Function>),
+}
+
+/// The freestanding functions `world` exports at world level.
+fn world_export_functions(world: &World) -> impl Iterator<Item = &Function> {
+    world.exports.values().filter_map(|item| match item {
+        WorldItem::Function(func) if func.kind.resource().is_none() => Some(func),
+        _ => None,
+    })
+}
+
+/// The exported interfaces of `world`, with their JS names (see
+/// [`InterfaceNames::of`]) and items.
+///
+/// Its items are its freestanding functions and the resources it declares a
+/// constructor, method or static function of. Two interfaces are
+/// special-cased. `wasi:cli/run` has no items, since the guest exports a bare
+/// `run`. `wasi:http/handler`, which the componentizer exports as the
+/// plain-named interface [`RAW_HTTP_HANDLER_EXPORT`](crate::RAW_HTTP_HANDLER_EXPORT),
+/// keeps the names of `wasi:http/handler` and has the one item `handle`.
+fn export_groups(resolve: &Resolve, world: WorldId) -> Vec<ExportGroup<'_>> {
+    let mut groups = Vec::new();
+    for (key, item) in &resolve.worlds[world].exports {
+        let WorldItem::Interface { id, .. } = item else {
+            continue;
+        };
+        let wit_name = resolve.name_world_key(key);
+        let iface = &resolve.interfaces[*id];
+        if names_interface(&wit_name, crate::CLI_RUN_INTERFACE_PREFIX) {
+            groups.push(ExportGroup {
+                names: InterfaceNames::of(&wit_name),
+                items: Vec::new(),
+                cli_run: true,
+                http_handler: false,
+            });
+            continue;
+        }
+        if names_interface(&wit_name, crate::HTTP_HANDLER_INTERFACE_PREFIX)
+            || wit_name == crate::RAW_HTTP_HANDLER_EXPORT
+        {
+            let handle = iface.functions.get("handle");
+            // Comments name the raw export by its interface, `wasi:http/handler`.
+            let wit_name = if wit_name == crate::RAW_HTTP_HANDLER_EXPORT {
+                crate::HTTP_HANDLER_INTERFACE_PREFIX.to_string()
+            } else {
+                wit_name
+            };
+            groups.push(ExportGroup {
+                names: InterfaceNames::of(&wit_name),
+                items: vec![ExportItem {
+                    js_name: "handle".to_string(),
+                    kind: ExportItemKind::HttpHandle(handle),
+                }],
+                cli_run: false,
+                http_handler: true,
+            });
+            continue;
+        }
+        let mut items: Vec<ExportItem<'_>> = iface
+            .functions
+            .values()
+            .filter(|func| func.kind.resource().is_none())
+            .map(|func| ExportItem {
+                js_name: mangle_name(&func.name),
+                kind: ExportItemKind::Func(func),
+            })
+            .collect();
+        items.extend(
+            iface
+                .types
+                .iter()
+                .filter(|(_, ty)| {
+                    matches!(resolve.types[**ty].kind, TypeDefKind::Resource)
+                        && iface
+                            .functions
+                            .values()
+                            .any(|func| func.kind.resource() == Some(**ty))
+                })
+                .map(|(name, ty)| ExportItem {
+                    js_name: mangle_resource_name(name),
+                    kind: ExportItemKind::Resource(*ty),
+                }),
+        );
+        groups.push(ExportGroup {
+            names: InterfaceNames::of(&wit_name),
+            items,
+            cli_run: false,
+            http_handler: false,
+        });
+    }
+    groups
+}
+
+/// The shapes [`possible_export_names`] returns for each exported item, per
+/// group and item.
+struct Layout(Vec<Vec<Vec<Shape>>>);
+
+impl Layout {
+    /// Whether group `g`'s items are provided only by the export named by its
+    /// full WIT name.
+    fn versioned(&self, g: usize) -> bool {
+        self.0[g]
+            .iter()
+            .flatten()
+            .any(|shape| matches!(shape, Shape::Versioned(_)))
+    }
+
+    /// Whether group `g`'s interface-layer object may provide its items.
+    fn interface_layer(&self, g: usize) -> bool {
+        self.0[g]
+            .iter()
+            .flatten()
+            .any(|shape| matches!(shape, Shape::Interface(_)))
+    }
+
+    /// Whether a bare export may provide item `i` of group `g`.
+    fn bare(&self, g: usize, i: usize) -> bool {
+        self.0[g][i].contains(&Shape::Bare)
+    }
+}
+
+/// Return the shapes in which the main module may export each item of
+/// `groups`. The main module must export each item in exactly one of them.
+///
+/// A world-level exported function, named in `world_funcs`, and the `run` of
+/// `wasi:cli/run` are always bare exports. Fails when one of them has a
+/// package-layer name (see [`possible_export_names`]), or when `run` is also a world-level
+/// function.
+fn export_layout(groups: &[ExportGroup<'_>], world_funcs: &[String]) -> Result<Layout> {
+    let mut fixed: Vec<&str> = world_funcs.iter().map(String::as_str).collect();
+    if groups.iter().any(|group| group.cli_run) {
+        if fixed.contains(&"run") {
+            bail!("the world exports `run` both as a world-level function and as `wasi:cli/run`");
+        }
+        fixed.push("run");
+    }
+    let items: Vec<Item> = groups
+        .iter()
+        .flat_map(|group| {
+            group
+                .items
+                .iter()
+                .map(|item| (Some(group.names.clone()), item.js_name.clone()))
+        })
+        .collect();
+    let mut shapes = possible_export_names(&items, &fixed)
+        .map_err(anyhow::Error::msg)?
+        .into_iter();
+    Ok(Layout(
+        groups
+            .iter()
+            .map(|group| shapes.by_ref().take(group.items.len()).collect())
+            .collect(),
+    ))
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    /// An exported item and the JS paths it is accepted under.
+    type Accepted = (&'static str, &'static [&'static str]);
+
+    /// The JS paths of the exports of WIT worlds, as `(world, accepted)` cases.
+    /// `world` is the body of `world w` in package `test:naming`, and `accepted`
+    /// lists each exported item as `<wit interface>#<js item>` with every JS path
+    /// from the main module's namespace that the runtime accepts it under. A
+    /// world-level function is listed as `world#<js name>`.
+    const NAMING_CASES: &[(&str, &[Accepted])] = &[
+        // Every shape is allowed when the names are unique.
+        (
+            "export api;",
+            &[
+                (
+                    "test:naming/api#greet",
+                    &["testNaming.api.greet", "api.greet", "greet"],
+                ),
+                (
+                    "test:naming/api#Counter",
+                    &["testNaming.api.Counter", "api.Counter", "Counter"],
+                ),
+            ],
+        ),
+        // A plain-named interface has no package layer.
+        (
+            "export local: interface { greet: func(); }",
+            &[("local#greet", &["local.greet", "greet"])],
+        ),
+        // A world-level function is always bare, so no interface item is bare
+        // under its name.
+        (
+            "export api; export greet: func();",
+            &[
+                (
+                    "test:naming/api#greet",
+                    &["testNaming.api.greet", "api.greet"],
+                ),
+                (
+                    "test:naming/api#Counter",
+                    &["testNaming.api.Counter", "api.Counter", "Counter"],
+                ),
+                ("world#greet", &["greet"]),
+            ],
+        ),
+        // An interface without items has no object, and its name makes no other
+        // interface-layer name ambiguous.
+        (
+            "export test:a/types-only; export test:b/api;",
+            &[(
+                "test:b/api#greet",
+                &["testB.api.greet", "api.greet", "greet"],
+            )],
+        ),
+        // `wasi:http/handler` keeps its names, though the componentizer
+        // exports it as the plain-named `wasi-http-handler`.
+        (
+            "export wasi:http/handler@0.3.0;",
+            &[(
+                "wasi:http/handler@0.3.0#handle",
+                &["wasiHttp.handler.handle", "handler.handle", "handle"],
+            )],
+        ),
+        // Two versions of one interface are provided only by the exports named
+        // by their full WIT names.
+        (
+            "export test:v/api@1.0.0; export test:v/api@2.0.0; export test:b/api;",
+            &[
+                ("test:v/api@1.0.0#greet", &["[\"test:v/api@1.0.0\"].greet"]),
+                ("test:v/api@2.0.0#greet", &["[\"test:v/api@2.0.0\"].greet"]),
+                ("test:b/api#greet", &["testB.api.greet"]),
+            ],
+        ),
+        // `wasi:cli/run` is a bare `run`.
+        ("export wasi:cli/run@0.3.0;", &[("world#run", &["run"])]),
+    ];
+
+    /// The packages the naming cases' worlds refer to.
+    const NAMING_PACKAGES: &str = "
+        package test:a { interface types-only { type t = u32; } }
+        package test:b { interface api { greet: func(); } }
+        package test:v@1.0.0 { interface api { greet: func(); } }
+        package test:v@2.0.0 { interface api { greet: func(); } }
+        package wasi:http@0.3.0 { interface handler { handle: func(); } }
+        package wasi:cli@0.3.0 { interface run { run: async func() -> result; } }
+    ";
+
+    /// The interfaces of `test:naming` the naming cases' worlds refer to.
+    const NAMING_INTERFACES: &str = "
+        interface api { greet: func(); resource counter { get: func() -> u32; } }
+    ";
+
+    fn resolve_naming_world(world: &str) -> (Resolve, WorldId) {
+        let wit = format!(
+            "package test:naming;\n{NAMING_INTERFACES}\nworld w {{ {world} }}\n{NAMING_PACKAGES}"
+        );
+        let mut resolve = Resolve::default();
+        let package = resolve.push_str("naming.wit", &wit).expect("parsing");
+        let world = resolve
+            .select_world(&[package], Some("w"))
+            .expect("selecting");
+        (resolve, world)
+    }
+
+    /// Every exported item of `world` with the JS paths it is accepted under.
+    fn accepted_paths(world: &str) -> Result<Vec<(String, Vec<String>)>> {
+        let (resolve, world) = resolve_naming_world(world);
+        let groups = export_groups(&resolve, world);
+        let world_funcs: Vec<String> = world_export_functions(&resolve.worlds[world])
+            .map(|func| mangle_name(&func.name))
+            .collect();
+        let layout = export_layout(&groups, &world_funcs)?;
+        let mut accepted = Vec::new();
+        for (group, shapes) in groups.iter().zip(&layout.0) {
+            if group.cli_run {
+                accepted.push(("world#run".to_string(), vec!["run".to_string()]));
+            }
+            for (item, shapes) in group.items.iter().zip(shapes) {
+                let paths = shapes.iter().map(|shape| shape.path(&item.js_name));
+                let name = format!("{}#{}", group.names.wit_name, item.js_name);
+                accepted.push((name, paths.collect()));
+            }
+        }
+        for name in world_funcs {
+            accepted.push((format!("world#{name}"), vec![name]));
+        }
+        Ok(accepted)
+    }
+
+    #[test]
+    fn export_paths_of_wit_worlds() {
+        for (world, expected) in NAMING_CASES {
+            let expected: Vec<(String, Vec<String>)> = expected
+                .iter()
+                .map(|(item, paths)| {
+                    (
+                        item.to_string(),
+                        paths.iter().map(|path| path.to_string()).collect(),
+                    )
+                })
+                .collect();
+            let actual = accepted_paths(world).expect("a valid layout");
+            assert_eq!(actual, expected, "for `{world}`");
+        }
+    }
+
+    #[test]
+    fn export_naming_rejects_unrepresentable_worlds() {
+        // A world-level function with a package-layer name.
+        assert!(accepted_paths("export api; export test-naming: func();").is_err());
+        // `run` both as a world-level function and as `wasi:cli/run`.
+        assert!(accepted_paths("export wasi:cli/run@0.3.0; export run: func();").is_err());
+    }
+
+    /// `import_modules` lists the modules that export a function, a resource
+    /// class, an error class, or an enum or flags object, and no others.
+    #[test]
+    fn import_modules_lists_registered_modules() {
+        let wit = r#"
+            package test:modules;
+            interface records { record point { x: u32 } }
+            interface funcs { f: func(); }
+            interface resources { resource handle; }
+            interface enums { enum color { red } }
+            interface flagged { flags perms { read } }
+            interface errors { variant failure { bad } }
+            interface uses-enum { use enums.{color}; }
+            interface uses-record { use records.{point}; }
+            interface api {
+                use errors.{failure};
+                g: func() -> result<_, failure>;
+            }
+            world types-only {
+                import records;
+                import uses-record;
+                use records.{point};
+            }
+            world registered {
+                import funcs;
+                import resources;
+                import enums;
+                import flagged;
+                import errors;
+                import uses-enum;
+                import records;
+                export api;
+            }
+            world world-funcs { import h: func(); }
+            world world-errors {
+                use errors.{failure};
+                export g: func() -> result<_, failure>;
+            }
+        "#;
+        let mut resolve = Resolve::default();
+        let package = resolve.push_str("modules.wit", wit).expect("parsing");
+        let modules = |world: &str| {
+            let world = resolve
+                .select_world(&[package], Some(world))
+                .expect("world");
+            import_modules(&resolve, world)
+        };
+        assert_eq!(modules("types-only"), Vec::<String>::new());
+        assert_eq!(
+            modules("registered"),
+            [
+                "test:modules/funcs",
+                "test:modules/resources",
+                "test:modules/enums",
+                "test:modules/flagged",
+                "test:modules/errors",
+                "test:modules/uses-enum",
+            ]
+        );
+        assert_eq!(modules("world-funcs"), ["external"]);
+        // The error class of a type the world `use`s is exported from
+        // `external`, not from the interface defining the type.
+        assert_eq!(modules("world-errors"), ["external"]);
+    }
+
+    /// An imported interface's module is named by its canonical version.
+    #[test]
+    fn import_modules_name_the_canonical_version() {
+        let wit = r#"
+            package test:app;
+            world app {
+                import test:one/api@1.2.3;
+                import test:two/api@0.2.5-rc.1;
+            }
+            package test:one@1.2.3 { interface api { f: func(); } }
+            package test:two@0.2.5-rc.1 { interface api { f: func(); } }
+        "#;
+        let mut resolve = Resolve::default();
+        let package = resolve.push_str("versions.wit", wit).expect("parsing");
+        let world = resolve
+            .select_world(&[package], Some("app"))
+            .expect("world");
+        assert_eq!(
+            import_modules(&resolve, world),
+            ["test:one/api@1", "test:two/api@0.2.5-rc.1"]
+        );
+    }
+}
diff --git a/componentize/tests/async_export.rs b/componentize/tests/async_export.rs
new file mode 100644
index 00000000..c5c5c89b
--- /dev/null
+++ b/componentize/tests/async_export.rs
@@ -0,0 +1,264 @@
+// SPDX-License-Identifier: Apache-2.0-WITH-LLVM-exception
+
+//! Async exports: the world of `fixtures/async_export.{wit,js}`, which exports a sync
+//! `simple-export.foo` and an async `simple-async-export.foo`.
+
+mod shared;
+
+use shared::Ctx;
+
+use {
+    tokio::sync::{Notify, OnceCell},
+    wasmtime::{
+        component::{Accessor, HasSelf},
+        Engine, Store,
+    },
+};
+
+wasmtime::component::bindgen!({
+    path: "tests/fixtures/async_export.wit",
+    world: "async-export",
+    imports: { default: async },
+    exports: { default: async },
+});
+
+impl test::async_export::host::Host for Ctx {}
+
+/// Released once by [`sync_exports_run_while_an_async_export_is_parked`].
+static RELEASE: Notify = Notify::const_new();
+
+impl test::async_export::host::HostWithStore<Ctx> for HasSelf<Ctx> {
+    async fn release(_accessor: &Accessor<Ctx, Self>) {
+        RELEASE.notified().await;
+    }
+}
+
+static ENGINE: std::sync::LazyLock<Engine> = std::sync::LazyLock::new(shared::engine);
+
+/// Componentize the async-export world once and hold the instantiation-ready `Pre`.
+async fn pre() -> &'static AsyncExportPre<Ctx> {
+    static PRE: OnceCell<Result<AsyncExportPre<Ctx>, String>> = OnceCell::const_new();
+    shared::build_once(&PRE, async {
+        let component = shared::compile_fixture(
+            &ENGINE,
+            include_str!("fixtures/async_export.wit"),
+            "async-export",
+            include_str!("fixtures/async_export.js"),
+        )
+        .await;
+
+        let linker = shared::linker(&ENGINE, &component, &[], |linker| {
+            AsyncExport::add_to_linker::<_, HasSelf<_>>(linker, |ctx| ctx)
+        });
+        AsyncExportPre::new(linker.instantiate_pre(&component).expect("instantiate_pre"))
+            .expect("AsyncExportPre")
+    })
+    .await
+}
+
+/// A fresh store for one test case. The world needs nothing but WASI.
+fn store() -> Store<Ctx> {
+    shared::store(&ENGINE)
+}
+
+/// An async export that delivers its result but leaves a perpetual `setInterval`
+/// running, so the per-call event loop never becomes idle. The export's subtask
+/// completes regardless: the driver completes the call and abandons the timer when
+/// it drops the loop. With the `timeout`, a driver that instead runs the loop to
+/// full idle fails the test rather than hanging the suite. Exports called
+/// on the same instance afterwards still complete.
+#[tokio::test]
+async fn perpetual_trailing_work_does_not_hang() -> anyhow::Result<()> {
+    let mut store = store();
+    let instance = pre().await.instantiate_async(&mut store).await?;
+    let result = tokio::time::timeout(
+        std::time::Duration::from_secs(30),
+        store.run_concurrent(async |accessor| {
+            instance
+                .test_async_export_simple_async_export()
+                .call_perpetual(accessor, 42)
+                .await
+        }),
+    )
+    .await
+    .expect("perpetual-trailing-work async export must complete, not hang")??;
+    assert_eq!(
+        result, 45,
+        "perpetual(42) should return 45 even though a setInterval is left running"
+    );
+
+    // The instance stays usable: exports called after it still complete,
+    // including the async one, which waits for a timer.
+    let (again, after) = tokio::time::timeout(
+        std::time::Duration::from_secs(30),
+        store.run_concurrent(async |accessor| {
+            let exports = instance.test_async_export_simple_async_export();
+            let again = exports.call_perpetual(accessor, 1).await?;
+            let after = exports.call_foo(accessor, 2).await?;
+            anyhow::Ok((again, after))
+        }),
+    )
+    .await
+    .expect("exports called after abandoned work must complete")??;
+    assert_eq!((again, after), (4, 5));
+    let sync = instance
+        .test_async_export_simple_export()
+        .call_foo(&mut store, 7)
+        .await?;
+    assert_eq!(sync, 10);
+    Ok(())
+}
+
+/// A deadlocking async export. The guest `await`s a never-resolving promise with
+/// no loop work behind it, so the per-call event loop goes idle while the returned
+/// promise is still `Pending`. The call traps, and the reason, which names the
+/// export, is printed to stderr.
+#[tokio::test]
+async fn deadlocked_async_export_traps() -> anyhow::Result<()> {
+    let (mut store, stderr) = shared::store_capturing_stderr(&ENGINE);
+    let instance = pre().await.instantiate_async(&mut store).await?;
+    let result = store
+        .run_concurrent(async |accessor| {
+            instance
+                .test_async_export_simple_async_export()
+                .call_hang(accessor)
+                .await
+        })
+        .await;
+    let trapped = shared::call_failed(&result);
+    assert!(
+        trapped,
+        "a deadlocked async export must trap (host-observable Err), got {result:?}"
+    );
+    let stderr = shared::pipe_text(&stderr);
+    assert!(
+        stderr.contains(
+            "the async export `test:async-export/simple-async-export#hang` did not settle"
+        ),
+        "{stderr}"
+    );
+    Ok(())
+}
+
+/// An async export whose promise rejects with an `Error` after a timer turn
+/// returns the message as its `err`, and the rejection is not reported on stderr
+/// as unhandled.
+#[tokio::test]
+async fn rejected_async_export_returns_err() -> anyhow::Result<()> {
+    let (mut store, stderr) = shared::store_capturing_stderr(&ENGINE);
+    let instance = pre().await.instantiate_async(&mut store).await?;
+    let result = store
+        .run_concurrent(async |accessor| {
+            instance
+                .test_async_export_simple_async_export()
+                .call_fail(accessor, "boom".to_string())
+                .await
+        })
+        .await??;
+    assert_eq!(result, Err("boom".to_string()));
+    let stderr = shared::pipe_text(&stderr);
+    assert!(!stderr.contains("Uncaught (in promise)"), "{stderr}");
+    Ok(())
+}
+
+/// `setTimeout` in a sync export throws a `TypeError` naming the export.
+#[tokio::test]
+async fn timers_in_a_sync_export_throw() -> anyhow::Result<()> {
+    let mut store = store();
+    let instance = pre().await.instantiate_async(&mut store).await?;
+    let message = instance
+        .test_async_export_simple_export()
+        .call_timer_message(&mut store)
+        .await?;
+    assert!(
+        message.starts_with("setTimeout needs an active event loop")
+            && message.contains("`test:async-export/simple-export#timer-message`"),
+        "{message}"
+    );
+    Ok(())
+}
+
+/// `fetch` in a sync export returns a promise rejected with a `TypeError` naming
+/// the export.
+#[tokio::test]
+async fn fetch_in_a_sync_export_rejects() -> anyhow::Result<()> {
+    let mut store = store();
+    let instance = pre().await.instantiate_async(&mut store).await?;
+    let simple = instance.test_async_export_simple_export();
+    assert_eq!(simple.call_fetch_message(&mut store).await?, "none");
+    let message = simple.call_fetch_message(&mut store).await?;
+    assert!(
+        message.starts_with("`fetch` needs an active event loop")
+            && message.contains("`test:async-export/simple-export#fetch-message`"),
+        "{message}"
+    );
+    Ok(())
+}
+
+/// The microtasks a sync export queues run before the call returns.
+#[tokio::test]
+async fn sync_export_microtasks_run_before_it_returns() -> anyhow::Result<()> {
+    let mut store = store();
+    let instance = pre().await.instantiate_async(&mut store).await?;
+    let simple = instance.test_async_export_simple_export();
+    for expected in 0..3 {
+        assert_eq!(simple.call_drained_microtasks(&mut store).await?, expected);
+    }
+    Ok(())
+}
+
+/// Sync exports called while an async export waits on a host import run at
+/// once, without the waiting export's event loop: their microtasks run before
+/// they return, and `setTimeout` throws in them.
+#[tokio::test]
+async fn sync_exports_run_while_an_async_export_is_parked() -> anyhow::Result<()> {
+    let mut store = store();
+    let instance = pre()
+        .await
+        .instance_pre()
+        .instantiate_async(&mut store)
+        .await?;
+    let bindings = AsyncExport::new(&mut store, &instance)?;
+    let interface = instance
+        .get_export_index(&mut store, None, "test:async-export/simple-export")
+        .expect("the sync interface is exported");
+    let mut func = |name: &str| {
+        instance
+            .get_export_index(&mut store, Some(&interface), name)
+            .unwrap_or_else(|| panic!("`{name}` is exported"))
+    };
+    let (drained, timer) = (func("drained-microtasks"), func("timer-message"));
+    let drained = instance.get_typed_func::<(), (u32,)>(&mut store, drained)?;
+    let timer = instance.get_typed_func::<(), (String,)>(&mut store, timer)?;
+
+    let (parked, sync) = store
+        .run_concurrent(async |accessor| {
+            // `join` polls the async export first, so it waits on `release`
+            // when the sync calls start.
+            futures::future::join(
+                bindings
+                    .test_async_export_simple_async_export()
+                    .call_parked(accessor),
+                async {
+                    let first = drained.call_concurrent(accessor, ()).await?.0;
+                    let second = drained.call_concurrent(accessor, ()).await?.0;
+                    let message = timer.call_concurrent(accessor, ()).await?.0;
+                    RELEASE.notify_one();
+                    anyhow::Ok((first, second, message))
+                },
+            )
+            .await
+        })
+        .await?;
+    let (first, second, message) = sync?;
+    assert_eq!((first, second), (0, 1));
+    assert!(
+        message.starts_with("setTimeout needs an active event loop"),
+        "{message}"
+    );
+    assert_eq!(
+        parked?, 2,
+        "both microtasks ran while the async export waited"
+    );
+    Ok(())
+}
diff --git a/componentize/tests/async_import.rs b/componentize/tests/async_import.rs
new file mode 100644
index 00000000..183a515a
--- /dev/null
+++ b/componentize/tests/async_import.rs
@@ -0,0 +1,137 @@
+// SPDX-License-Identifier: Apache-2.0-WITH-LLVM-exception
+
+//! Async imports: the world of `fixtures/async_import.{wit,js}`, whose async export `runner.foo`
+//! calls the async host import `host.bar` and adds 3 to its result. The host's `bar(x)` yields to
+//! the executor before returning `x + 2`, so `foo(42)` returns 47.
+
+mod shared;
+
+use {
+    shared::Ctx,
+    tokio::sync::OnceCell,
+    wasmtime::{component::HasSelf, Engine, Store},
+};
+
+wasmtime::component::bindgen!({
+    path: "tests/fixtures/async_import.wit",
+    world: "async-import",
+    imports: { default: async },
+    exports: { default: async },
+});
+
+impl test::async_import::host::Host for Ctx {}
+
+/// The async host imports. Each yields to the executor before answering, so the
+/// call cannot complete inline and the per-call event loop must poll the
+/// import's future again.
+impl test::async_import::host::HostWithStore<Ctx> for HasSelf<Ctx> {
+    async fn bar(_accessor: &wasmtime::component::Accessor<Ctx, Self>, x: u32) -> u32 {
+        tokio::task::yield_now().await;
+        x + 2
+    }
+
+    /// `+ 2` on `ok`, `+ 3` on `err`.
+    async fn baz(
+        _accessor: &wasmtime::component::Accessor<Ctx, Self>,
+        v: Result<u32, u32>,
+    ) -> Result<u32, u32> {
+        tokio::task::yield_now().await;
+        v.map(|x| x + 2).map_err(|x| x + 3)
+    }
+}
+
+static ENGINE: std::sync::LazyLock<Engine> = std::sync::LazyLock::new(shared::engine);
+
+/// Componentize the async-import world once and hold the instantiation-ready `Pre`.
+async fn pre() -> &'static AsyncImportPre<Ctx> {
+    static PRE: OnceCell<Result<AsyncImportPre<Ctx>, String>> = OnceCell::const_new();
+    shared::build_once(&PRE, async {
+        let component = shared::compile_fixture(
+            &ENGINE,
+            include_str!("fixtures/async_import.wit"),
+            "async-import",
+            include_str!("fixtures/async_import.js"),
+        )
+        .await;
+
+        let linker = shared::linker(&ENGINE, &component, &[], |linker| {
+            test::async_import::host::add_to_linker::<Ctx, HasSelf<Ctx>>(linker, |c| c)
+        });
+        AsyncImportPre::new(linker.instantiate_pre(&component).expect("instantiate_pre"))
+            .expect("AsyncImportPre")
+    })
+    .await
+}
+
+fn store() -> Store<Ctx> {
+    shared::store(&ENGINE)
+}
+
+/// The async export calls the async host import: `foo(42)` is `await bar(42)`,
+/// which yields and returns 44, `+ 3` => 47.
+#[tokio::test]
+async fn async_import_and_export() -> anyhow::Result<()> {
+    let mut store = store();
+    let instance = pre().await.instantiate_async(&mut store).await?;
+    let result = store
+        .run_concurrent(async |accessor| {
+            instance
+                .test_async_import_runner()
+                .call_foo(accessor, 42)
+                .await
+        })
+        .await??;
+
+    assert_eq!(
+        result, 47,
+        "async foo(42) must await the async host import bar(42)=44 then add 3"
+    );
+    Ok(())
+}
+
+/// The `result`-typed async export forwards each arm of its argument through
+/// the `result`-typed async host import: `ok(42)` is `await baz(ok(42))` =>
+/// `ok(44)`, `+ 3` => `ok(47)`, and `err(42)` is `err(45)` from the host, which
+/// rejects the guest's promise with a `ComponentError`, `+ 3` => `err(48)`.
+#[tokio::test]
+async fn async_import_and_export_result() -> anyhow::Result<()> {
+    let mut store = store();
+    let instance = pre().await.instantiate_async(&mut store).await?;
+    let ok = store
+        .run_concurrent(async |accessor| {
+            instance
+                .test_async_import_runner()
+                .call_qux(accessor, Ok(42))
+                .await
+        })
+        .await??;
+    assert_eq!(ok, Ok(47), "ok(42) must come back as ok(42 + 2 + 3)");
+
+    let err = store
+        .run_concurrent(async |accessor| {
+            instance
+                .test_async_import_runner()
+                .call_qux(accessor, Err(42))
+                .await
+        })
+        .await??;
+    assert_eq!(err, Err(48), "err(42) must come back as err(42 + 3 + 3)");
+    Ok(())
+}
+
+/// An async import called from a sync export returns a promise rejected with a
+/// `TypeError` naming the export, rather than throwing.
+#[tokio::test]
+async fn async_import_in_a_sync_export_rejects() -> anyhow::Result<()> {
+    let mut store = store();
+    let instance = pre().await.instantiate_async(&mut store).await?;
+    let runner = instance.test_async_import_runner();
+    assert_eq!(runner.call_bar_message(&mut store).await?, "none");
+    let message = runner.call_bar_message(&mut store).await?;
+    assert!(
+        message.starts_with("the async import `bar` needs an active event loop")
+            && message.contains("`test:async-import/runner#bar-message`"),
+        "{message}"
+    );
+    Ok(())
+}
diff --git a/componentize/tests/cli.rs b/componentize/tests/cli.rs
new file mode 100644
index 00000000..3d73586a
--- /dev/null
+++ b/componentize/tests/cli.rs
@@ -0,0 +1,173 @@
+// SPDX-License-Identifier: Apache-2.0-WITH-LLVM-exception
+
+//! The `starling-componentize` command line, run as a process in `tests/fixtures`.
+
+mod shared;
+
+use std::path::{Path, PathBuf};
+
+use sha2::Digest as _;
+
+static ENGINE: std::sync::LazyLock<wasmtime::Engine> = std::sync::LazyLock::new(shared::engine);
+
+fn fixtures() -> PathBuf {
+    Path::new(env!("CARGO_MANIFEST_DIR")).join("tests/fixtures")
+}
+
+/// A fresh output directory for the test `name` under `CARGO_TARGET_TMPDIR`.
+fn out_dir(name: &str) -> PathBuf {
+    let dir = Path::new(env!("CARGO_TARGET_TMPDIR")).join(format!("cli-{name}"));
+    let _ = std::fs::remove_dir_all(&dir);
+    std::fs::create_dir_all(&dir).expect("creating the output directory");
+    dir
+}
+
+/// Run the command line `args` in `tests/fixtures`, returning its stdout and
+/// panicking with its stderr if it fails.
+fn succeed(args: &[&str]) -> String {
+    let output = shared::run_cli(args, Some(&fixtures()));
+    assert!(
+        output.status.success(),
+        "`starling-componentize {}` failed:\n{}",
+        args.join(" "),
+        String::from_utf8_lossy(&output.stderr)
+    );
+    String::from_utf8(output.stdout).expect("UTF-8 output")
+}
+
+/// Run the command line `args` in `tests/fixtures`, returning its exit code and
+/// stderr and panicking if it succeeds.
+fn fail(args: &[&str]) -> (Option<i32>, String) {
+    let output = shared::run_cli(args, Some(&fixtures()));
+    assert!(
+        !output.status.success(),
+        "`starling-componentize {}` succeeded",
+        args.join(" ")
+    );
+    (
+        output.status.code(),
+        String::from_utf8_lossy(&output.stderr).into_owned(),
+    )
+}
+
+/// Two `-w` packages and two `-n` worlds build one component exporting both
+/// worlds' functions. An explicit `--base-directory` resolves the input's
+/// imports, `--init-location` sets `location` at init, and `--no-cache` builds
+/// as well. Without `-q`, stdout holds what the application printed and the
+/// success line.
+#[tokio::test]
+async fn merged_packages_and_worlds_build_and_run() -> anyhow::Result<()> {
+    let output = out_dir("merged").join("merged.wasm");
+    let output = output.to_str().expect("a UTF-8 path");
+    let stdout = succeed(&[
+        "-w",
+        "cli/a.wit",
+        "-w",
+        "cli/b.wit",
+        "-n",
+        "test:cli-a/one",
+        "-n",
+        "two",
+        "componentize",
+        "cli/app/src/main.js",
+        "--base-directory",
+        "cli/app",
+        "--init-location",
+        "http://example.localhost/app/",
+        "--no-cache",
+        "-o",
+        output,
+    ]);
+    assert_eq!(
+        stdout,
+        "initializing at http://example.localhost/app/\nComponent built successfully\n"
+    );
+
+    let component = wasmtime::component::Component::new(&ENGINE, std::fs::read(output)?)?;
+    let linker = shared::linker(&ENGINE, &component, &[], |_| Ok(()));
+    let mut store = shared::store(&ENGINE);
+    let instance = linker.instantiate_async(&mut store, &component).await?;
+    for (name, expected) in [("one", 41), ("two", 42)] {
+        let func = instance.get_typed_func::<(), (u32,)>(&mut store, name)?;
+        assert_eq!(
+            func.call_async(&mut store, ()).await?,
+            (expected,),
+            "{name}"
+        );
+    }
+    Ok(())
+}
+
+/// `types -o` writes the declarations to the file and names it on stdout,
+/// which `-q` leaves empty.
+#[test]
+fn types_writes_its_output_file() {
+    let dir = out_dir("types");
+    let file = dir.join("a.d.ts");
+    let file = file.to_str().expect("a UTF-8 path");
+    assert_eq!(
+        succeed(&["-w", "cli/a.wit", "types", "-o", file]),
+        format!("Wrote TypeScript declarations to `{file}`\n")
+    );
+    let dts = std::fs::read_to_string(file).expect("reading the declarations");
+    assert!(dts.starts_with("// Generated by"), "{dts}");
+    assert!(dts.contains("one"), "{dts}");
+
+    std::fs::remove_file(file).unwrap();
+    assert_eq!(succeed(&["-q", "-w", "cli/a.wit", "types", "-o", file]), "");
+    assert!(Path::new(file).exists());
+}
+
+/// `imports` lists `external` for a world that imports a function at world
+/// level.
+#[test]
+fn imports_lists_external_for_world_level_imports() {
+    let modules = succeed(&["-w", "surface.wit", "imports"]);
+    assert!(modules.lines().any(|line| line == "external"), "{modules}");
+}
+
+/// `--version` names the runtime's digest and the version of the `init`
+/// interface it implements.
+#[test]
+fn version_names_the_runtime() {
+    let runtime = shared::runtime().expect("reading the runtime build");
+    let stdout = succeed(&["--version"]);
+    let lines: Vec<&str> = stdout.lines().collect();
+    assert_eq!(
+        lines[0],
+        format!("starling-componentize {}", env!("CARGO_PKG_VERSION"))
+    );
+    assert_eq!(
+        lines[1],
+        format!("calls {}", componentize::init_interface_name())
+    );
+    assert_eq!(
+        lines[2],
+        format!(
+            "runtime sha256:{}",
+            hex::encode(sha2::Sha256::digest(runtime.module()))
+        )
+    );
+    let implemented = componentize::runtime_init_interface(&runtime)
+        .unwrap()
+        .expect("the runtime implements the `init` interface");
+    assert_eq!(lines[3], format!("runtime implements {implemented}"));
+}
+
+/// An input file that cannot be read fails, naming it.
+#[test]
+fn unreadable_input_fails() {
+    let (_, stderr) = fail(&["--export-cli", "componentize", "missing.js"]);
+    assert!(stderr.contains("unable to read `missing.js`"), "{stderr}");
+}
+
+/// A command line with neither a subcommand nor `--version` fails with a usage error.
+#[test]
+fn a_missing_subcommand_fails_with_a_usage_error() {
+    let (code, stderr) = fail(&["--export-cli"]);
+    assert_eq!(code, Some(2));
+    assert!(
+        stderr.contains("a subcommand or `--version` is required"),
+        "{stderr}"
+    );
+}
diff --git a/componentize/tests/cli_run.rs b/componentize/tests/cli_run.rs
new file mode 100644
index 00000000..e509ecc8
--- /dev/null
+++ b/componentize/tests/cli_run.rs
@@ -0,0 +1,250 @@
+// SPDX-License-Identifier: Apache-2.0-WITH-LLVM-exception
+
+//! `wasi:cli/run` components: JS modules that export `run`, componentized against the world of
+//! `fixtures/cli_run.wit` and run through `wasi:cli/run.run()`.
+
+mod shared;
+
+use {
+    bytes::Bytes,
+    tokio::sync::OnceCell,
+    wasmtime::{
+        component::{Component, Linker},
+        Engine, Store,
+    },
+    wasmtime_wasi::{
+        p2::pipe::{MemoryInputPipe, MemoryOutputPipe},
+        p3::bindings::Command,
+        WasiCtxBuilder, WasiCtxView, WasiView,
+    },
+};
+
+/// The host store data: WASI context (with captured stdout/stderr) + resource
+/// table. The CLI world has no imports of its own.
+struct Ctx {
+    wasi: shared::Wasi,
+    stdout: MemoryOutputPipe,
+    stderr: MemoryOutputPipe,
+}
+
+impl WasiView for Ctx {
+    fn ctx(&mut self) -> WasiCtxView<'_> {
+        self.wasi.view()
+    }
+}
+
+static ENGINE: std::sync::LazyLock<Engine> = std::sync::LazyLock::new(shared::engine);
+
+const WIT: &str = include_str!("fixtures/cli_run.wit");
+
+/// Componentize a CLI application against the fixed CLI world and compile it.
+async fn componentize_cli(js: &'static str) -> Component {
+    shared::compile_fixture(&ENGINE, WIT, "command", js).await
+}
+
+/// The componentized CLI app that exports `run`, built once.
+async fn run_exporting_app() -> &'static Component {
+    static POSITIVE: OnceCell<Result<Component, String>> = OnceCell::const_new();
+    shared::build_once(
+        &POSITIVE,
+        componentize_cli(include_str!("fixtures/cli_run.js")),
+    )
+    .await
+}
+
+/// A CLI app whose async `run` rejects, built once.
+async fn rejecting() -> &'static Component {
+    static REJECTING: OnceCell<Result<Component, String>> = OnceCell::const_new();
+    shared::build_once(
+        &REJECTING,
+        componentize_cli("export async function run() { throw new Error('boom from run'); }"),
+    )
+    .await
+}
+
+/// A CLI app whose async `run` never settles, built once.
+async fn unsettled() -> &'static Component {
+    static UNSETTLED: OnceCell<Result<Component, String>> = OnceCell::const_new();
+    shared::build_once(
+        &UNSETTLED,
+        componentize_cli("export async function run() { await new Promise(() => {}); }"),
+    )
+    .await
+}
+
+/// A fresh store with captured stdout/stderr.
+fn store() -> Store<Ctx> {
+    let stdout = MemoryOutputPipe::new(64 * 1024);
+    let stderr = MemoryOutputPipe::new(64 * 1024);
+    let wasi = shared::Wasi::from_builder(
+        WasiCtxBuilder::new()
+            .stdin(MemoryInputPipe::new(Bytes::new()))
+            .stdout(stdout.clone())
+            .stderr(stderr.clone()),
+    );
+    Store::new(
+        &ENGINE,
+        Ctx {
+            wasi,
+            stdout,
+            stderr,
+        },
+    )
+}
+
+/// A linker for the CLI world: the WASI host, and trapping stubs for the
+/// runtime's other imports.
+fn linker(component: &Component) -> Linker<Ctx> {
+    let mut linker = Linker::new(&ENGINE);
+    componentize::add_wasi(&mut linker).expect("wasi linker");
+    componentize::trap_unsatisfied_imports(&ENGINE, component, &mut linker, &[])
+        .expect("trap-stub unknown imports");
+    linker
+}
+
+/// Drive `wasi:cli/run.run()` on a component, returning the program result and
+/// the captured stdout/stderr.
+async fn run_cli(component: &Component) -> anyhow::Result<(Result<(), ()>, String, String)> {
+    let mut store = store();
+    let command = Command::instantiate_async(&mut store, component, &linker(component)).await?;
+    let result = store
+        .run_concurrent(async move |store| command.wasi_cli_run().call_run(store).await)
+        .await??;
+    let stdout = String::from_utf8_lossy(&store.data().stdout.contents()).into_owned();
+    let stderr = String::from_utf8_lossy(&store.data().stderr.contents()).into_owned();
+    Ok((result, stdout, stderr))
+}
+
+/// A CLI app that exports `run` has `wasi:cli/run.run()` forwarded to it: the
+/// JS `run` awaits a real timer, writes its lines, and the call exits 0. Output
+/// its top level wrote under Wizer is not part of `run()`'s output, and
+/// `performance.now()` counts from the resume. The component exports
+/// `wasi:cli/run` under the world's name for it, a version compatible with the
+/// runtime builtin's but different from it.
+#[tokio::test]
+async fn cli_run_forwards_to_js_run() -> anyhow::Result<()> {
+    let exports: Vec<String> = run_exporting_app()
+        .await
+        .component_type()
+        .exports(&ENGINE)
+        .map(|(name, _)| name.to_string())
+        .collect();
+    assert!(
+        exports.contains(&"wasi:cli/run@0.3.5".to_string()),
+        "{exports:?}"
+    );
+    let (result, stdout, _stderr) = run_cli(run_exporting_app().await).await?;
+    assert_eq!(
+        result,
+        Ok(()),
+        "cli/run.run() on a run-exporting app should exit 0"
+    );
+    assert!(
+        stdout.contains("cli run start") && stdout.contains("cli run done"),
+        "both run() log lines should reach stdout; got: {stdout:?}"
+    );
+    let (start, done) = (
+        stdout.find("cli run start").unwrap(),
+        stdout.find("cli run done").unwrap(),
+    );
+    assert!(
+        start < done,
+        "run() should log start before done (the timer turn ran in between); got: {stdout:?}"
+    );
+    assert!(
+        !stdout.contains("logged under Wizer"),
+        "output written under Wizer should stay in the componentizer's capture; got: {stdout:?}"
+    );
+
+    // Componentizing takes seconds, so a `performance.now()` still measured against the
+    // wizened instance's clock would read in the thousands rather than the single digits.
+    let elapsed: f64 = stdout
+        .split("cli run elapsed ")
+        .nth(1)
+        .and_then(|rest| rest.split('\n').next())
+        .expect("run() logs the elapsed time")
+        .trim()
+        .parse()
+        .expect("the elapsed time is a number");
+    assert!(
+        (0.0..1000.0).contains(&elapsed),
+        "`performance.now()` in a resumed instance should be the time since it resumed, got \
+         {elapsed} ms"
+    );
+    Ok(())
+}
+
+/// Componentizing a CLI app that exports no `run` fails, naming the function to
+/// export.
+#[tokio::test]
+async fn cli_run_without_run_export_fails_componentization() {
+    let error =
+        shared::try_componentize(WIT, "command", include_str!("fixtures/cli_run_no_run.js"))
+            .await
+            .expect_err("an app without `run` must not componentize as a CLI tool");
+    let message = format!("{error:#}");
+    assert!(
+        message.contains("the main module exports no `run` function"),
+        "{message}"
+    );
+}
+
+/// A world exporting `wasi:cli/run` at a version not compatible with the
+/// runtime builtin's is rejected, rather than silently componentized against
+/// the builtin's version.
+#[tokio::test]
+async fn cli_run_version_mismatch_is_rejected() {
+    const OLD_WIT: &str = "\
+package test:cli-run-old;
+
+world command {
+  export wasi:cli/run@0.2.3;
+}
+
+package wasi:cli@0.2.3 {
+  interface run {
+    run: func() -> result;
+  }
+}
+";
+
+    let error = shared::try_componentize(OLD_WIT, "command", include_str!("fixtures/cli_run.js"))
+        .await
+        .expect_err("a mismatched cli/run version should be rejected");
+
+    let message = format!("{error:#}");
+    assert!(
+        message.contains("wasi:cli/run@0.2.3") && message.contains("wasi:cli/run@0.3.0"),
+        "the error should name both the world's version and the runtime's; got: {message}"
+    );
+}
+
+/// An async `run` that rejects reports failure, and stderr holds the rejection
+/// reason's message and where it was thrown.
+#[tokio::test]
+async fn cli_run_rejection_reports_the_reason() -> anyhow::Result<()> {
+    let (result, _stdout, stderr) = run_cli(rejecting().await).await?;
+    assert_eq!(result, Err(()));
+    assert!(
+        stderr.contains("run() failed: boom from run"),
+        "stderr should hold the rejection message; got: {stderr:?}"
+    );
+    assert!(
+        stderr.contains("main.js:1:"),
+        "stderr should hold the rejection's location; got: {stderr:?}"
+    );
+    Ok(())
+}
+
+/// An async `run` whose promise is still pending once the event loop goes idle
+/// reports failure.
+#[tokio::test]
+async fn cli_run_unsettled_promise_fails() -> anyhow::Result<()> {
+    let (result, _stdout, stderr) = run_cli(unsettled().await).await?;
+    assert_eq!(result, Err(()));
+    assert!(
+        stderr.contains("run() did not settle"),
+        "stderr should report the unsettled promise; got: {stderr:?}"
+    );
+    Ok(())
+}
diff --git a/componentize/tests/exported_resource.rs b/componentize/tests/exported_resource.rs
new file mode 100644
index 00000000..0f657d08
--- /dev/null
+++ b/componentize/tests/exported_resource.rs
@@ -0,0 +1,152 @@
+// SPDX-License-Identifier: Apache-2.0-WITH-LLVM-exception
+
+//! A guest-owned resource: the world of `fixtures/exported_resource.{wit,js}`, which exports
+//! `counters.counter`. The host calls the methods and statics of counters the guest constructs,
+//! and the `live-count` and `dispose-calls` statics observe the `[Symbol.dispose]()` a host-side
+//! drop runs.
+
+mod shared;
+
+use shared::Ctx;
+
+use {
+    std::sync::LazyLock,
+    tokio::sync::OnceCell,
+    wasmtime::{Engine, Store},
+};
+
+wasmtime::component::bindgen!({
+    path: "tests/fixtures/exported_resource.wit",
+    world: "exported-resource",
+    imports: { default: async },
+    exports: { default: async },
+});
+
+static ENGINE: LazyLock<Engine> = LazyLock::new(shared::engine);
+
+/// Componentize the exported-resource world once and hold the instantiation-ready
+/// `Pre`.
+async fn pre() -> &'static ExportedResourcePre<Ctx> {
+    static PRE: OnceCell<Result<ExportedResourcePre<Ctx>, String>> = OnceCell::const_new();
+    shared::build_once(&PRE, async {
+        let component = shared::compile_fixture(
+            &ENGINE,
+            include_str!("fixtures/exported_resource.wit"),
+            "exported-resource",
+            include_str!("fixtures/exported_resource.js"),
+        )
+        .await;
+
+        let linker = shared::linker(&ENGINE, &component, &[], |_| Ok(()));
+        ExportedResourcePre::new(linker.instantiate_pre(&component).expect("instantiate_pre"))
+            .expect("ExportedResourcePre")
+    })
+    .await
+}
+
+/// A fresh store for one test case. The world needs nothing but WASI.
+fn store() -> Store<Ctx> {
+    shared::store(&ENGINE)
+}
+
+/// The exported-resource lifecycle through `make-counter`: construct, call
+/// methods and statics, and drop. Each host-side drop runs the guest's
+/// `[Symbol.dispose]` exactly once, which no later call into the guest repeats.
+#[tokio::test]
+async fn exported_resource_lifecycle() -> anyhow::Result<()> {
+    let mut store = store();
+    let instance = pre().await.instantiate_async(&mut store).await?;
+    let counters = instance.test_exported_resource_counters();
+    let counter_class = counters.counter();
+
+    let counter = counters.call_make_counter(&mut store, 10).await?;
+    assert_eq!(15, counter_class.call_bump(&mut store, counter, 5).await?);
+    assert_eq!(22, counter_class.call_bump(&mut store, counter, 7).await?);
+    assert_eq!(22, counter_class.call_value(&mut store, counter).await?);
+    assert_eq!(1, counter_class.call_total_created(&mut store).await?);
+    assert_eq!(1, counter_class.call_live_count(&mut store).await?);
+    assert_eq!(0, counter_class.call_dispose_calls(&mut store).await?);
+
+    counter.resource_drop_async(&mut store).await?;
+    assert_eq!(0, counter_class.call_live_count(&mut store).await?);
+    assert_eq!(1, counter_class.call_dispose_calls(&mut store).await?);
+    assert_eq!(1, counter_class.call_total_created(&mut store).await?);
+
+    // A counter constructed after the drop is usable, and the dropped counter's
+    // hook does not run again.
+    let counter2 = counters.call_make_counter(&mut store, 100).await?;
+    assert_eq!(103, counter_class.call_bump(&mut store, counter2, 3).await?);
+    assert_eq!(2, counter_class.call_total_created(&mut store).await?);
+    assert_eq!(1, counter_class.call_live_count(&mut store).await?);
+    assert_eq!(1, counter_class.call_dispose_calls(&mut store).await?);
+
+    counter2.resource_drop_async(&mut store).await?;
+    assert_eq!(0, counter_class.call_live_count(&mut store).await?);
+    assert_eq!(2, counter_class.call_dispose_calls(&mut store).await?);
+    Ok(())
+}
+
+/// The host constructs a counter through the generated `[constructor]counter`
+/// rather than the freestanding `make-counter`.
+#[tokio::test]
+async fn exported_resource_constructor() -> anyhow::Result<()> {
+    let mut store = store();
+    let instance = pre().await.instantiate_async(&mut store).await?;
+    let counters = instance.test_exported_resource_counters();
+
+    let counter = counters.counter().call_constructor(&mut store, 1).await?;
+    assert_eq!(
+        4,
+        counters.counter().call_bump(&mut store, counter, 3).await?
+    );
+    assert_eq!(4, counters.counter().call_value(&mut store, counter).await?);
+    counter.resource_drop_async(&mut store).await?;
+
+    Ok(())
+}
+
+/// An object that cannot take new properties, such as a frozen or sealed one, can
+/// back an exported resource.
+#[tokio::test]
+async fn non_extensible_object_backs_a_resource() -> anyhow::Result<()> {
+    let mut store = store();
+    let instance = pre().await.instantiate_async(&mut store).await?;
+    let counters = instance.test_exported_resource_counters();
+    let counter = counters.call_make_sealed_counter(&mut store, 2).await?;
+    assert_eq!(
+        5,
+        counters.counter().call_bump(&mut store, counter, 3).await?
+    );
+    counter.resource_drop_async(&mut store).await?;
+    Ok(())
+}
+
+/// An async export borrows a guest-owned resource across a timer turn, and the
+/// borrow ending leaves the resource to its owner.
+#[tokio::test]
+async fn async_export_reads_a_borrow_after_a_timer() -> anyhow::Result<()> {
+    let mut store = store();
+    let instance = pre().await.instantiate_async(&mut store).await?;
+    let counters = instance.test_exported_resource_counters();
+    let counter = counters.call_make_counter(&mut store, 10).await?;
+
+    let value = store
+        .run_concurrent(async |accessor| {
+            instance
+                .test_exported_resource_counters()
+                .call_read_later(accessor, counter)
+                .await
+        })
+        .await??;
+    assert_eq!(value, 10);
+    assert_eq!(1, counters.counter().call_live_count(&mut store).await?);
+    assert_eq!(0, counters.counter().call_dispose_calls(&mut store).await?);
+    assert_eq!(
+        11,
+        counters.counter().call_bump(&mut store, counter, 1).await?
+    );
+
+    counter.resource_drop_async(&mut store).await?;
+    assert_eq!(0, counters.counter().call_live_count(&mut store).await?);
+    Ok(())
+}
diff --git a/componentize/tests/fetch_streams.rs b/componentize/tests/fetch_streams.rs
new file mode 100644
index 00000000..a847407b
--- /dev/null
+++ b/componentize/tests/fetch_streams.rs
@@ -0,0 +1,252 @@
+// SPDX-License-Identifier: Apache-2.0-WITH-LLVM-exception
+
+//! `stream<u8>` values and `fetch`: the world of `fixtures/fetch_streams.{wit,js}`, whose exports
+//! hand a `stream<u8>` argument to `fetch` as a request body and return a response's body as a
+//! `stream<u8>`. [`shared::UpstreamHooks`] returns the responses to the outgoing requests.
+
+mod shared;
+
+use {
+    shared::{chunked_input, read_bytes, HttpCtx as Ctx},
+    tokio::sync::OnceCell,
+    wasmtime::{Engine, Store},
+};
+
+wasmtime::component::bindgen!({
+    path: "tests/fixtures/fetch_streams.wit",
+    world: "fetch-streams",
+    exports: { default: async },
+});
+
+/// The body the harness serves for a `GET`.
+const SERVED_BODY: &str = "served from the host";
+
+static ENGINE: std::sync::LazyLock<Engine> = std::sync::LazyLock::new(shared::engine);
+
+/// Componentize the world once and hold the instantiation-ready `Pre`.
+async fn pre() -> &'static FetchStreamsPre<Ctx> {
+    static PRE: OnceCell<Result<FetchStreamsPre<Ctx>, String>> = OnceCell::const_new();
+    shared::build_once(&PRE, async {
+        let component = shared::compile_fixture(
+            &ENGINE,
+            include_str!("fixtures/fetch_streams.wit"),
+            "fetch-streams",
+            include_str!("fixtures/fetch_streams.js"),
+        )
+        .await;
+        let linker = shared::http_linker(&ENGINE, &component);
+        FetchStreamsPre::new(linker.instantiate_pre(&component).expect("instantiate_pre"))
+            .expect("FetchStreamsPre")
+    })
+    .await
+}
+
+fn store() -> Store<Ctx> {
+    shared::http_store(&ENGINE, SERVED_BODY)
+}
+
+/// A lifted `stream<u8>` is the body of an outgoing request, which the host
+/// echoes back.
+#[tokio::test]
+async fn stream_as_request_body() -> anyhow::Result<()> {
+    let mut store = store();
+    let instance = pre().await.instantiate_async(&mut store).await?;
+    store
+        .run_concurrent(async |store| {
+            let (body, _) = chunked_input(store, &[b"posted ", b"in ", b"chunks"], false)?;
+            let text = instance
+                .test_fetch_streams_fetching()
+                .call_post_stream(store, body)
+                .await?;
+            assert_eq!(text, "posted in chunks");
+            anyhow::Ok(())
+        })
+        .await??;
+    Ok(())
+}
+
+/// A response's body is returned as a `stream<u8>`.
+#[tokio::test]
+async fn response_body_as_stream() -> anyhow::Result<()> {
+    let mut store = store();
+    let instance = pre().await.instantiate_async(&mut store).await?;
+    store
+        .run_concurrent(async |store| {
+            let body = instance
+                .test_fetch_streams_fetching()
+                .call_get_body(store)
+                .await?;
+            let (bytes, ended) = read_bytes(store, body, usize::MAX).await?;
+            assert!(ended, "the body stream must end");
+            assert_eq!(bytes, SERVED_BODY.as_bytes());
+            anyhow::Ok(())
+        })
+        .await??;
+    Ok(())
+}
+
+/// A response's body piped through an identity `TransformStream` is returned as
+/// a `stream<u8>`, and the pipe finishes although the host reads the body
+/// directly.
+#[tokio::test]
+async fn piped_response_body_as_stream() -> anyhow::Result<()> {
+    let mut store = store();
+    let instance = pre().await.instantiate_async(&mut store).await?;
+    let settled = store
+        .run_concurrent(async |store| {
+            let fetching = instance.test_fetch_streams_fetching();
+            let body = fetching.call_get_piped_body(store).await?;
+            let (bytes, ended) = read_bytes(store, body, usize::MAX).await?;
+            assert!(ended, "the body stream must end");
+            assert_eq!(bytes, SERVED_BODY.as_bytes());
+            let mut settled = false;
+            for _ in 0..1_000 {
+                settled = fetching.call_piped_body_settled(store).await?;
+                if settled {
+                    break;
+                }
+                tokio::task::yield_now().await;
+            }
+            anyhow::Ok(settled)
+        })
+        .await??;
+    assert!(settled, "the pipe must finish");
+    Ok(())
+}
+
+/// A response body that the host aborts, returned as a `stream<u8>`, ends after
+/// the bytes that arrived, and the abort is reported on stderr, since a
+/// `stream` can't hold an error.
+#[tokio::test]
+async fn aborted_response_body_as_stream() -> anyhow::Result<()> {
+    let (mut store, stderr) = shared::http_store_capturing_stderr(&ENGINE, SERVED_BODY);
+    let instance = pre().await.instantiate_async(&mut store).await?;
+    let text = store
+        .run_concurrent(async |store| {
+            let body = instance
+                .test_fetch_streams_fetching()
+                .call_get_broken_body(store)
+                .await?;
+            let (bytes, ended) = read_bytes(store, body, usize::MAX).await?;
+            assert!(ended, "the body stream must end");
+            assert_eq!(bytes, b"partial ");
+            // The report is printed once the host has resolved the body's
+            // trailers.
+            let mut text = String::new();
+            for _ in 0..1_000 {
+                text = shared::pipe_text(&stderr);
+                if text.contains("ended the stream early") {
+                    break;
+                }
+                tokio::task::yield_now().await;
+            }
+            anyhow::Ok(text)
+        })
+        .await??;
+    assert!(
+        text.contains("ended the stream early") && text.contains("ConnectionTerminated"),
+        "stderr should report the aborted body; got: {text}"
+    );
+    Ok(())
+}
+
+/// A lifted `stream<u8>` goes out as a request body and comes back as the
+/// response body, which is returned as a `stream<u8>`.
+#[tokio::test]
+async fn stream_through_fetch() -> anyhow::Result<()> {
+    let mut store = store();
+    let instance = pre().await.instantiate_async(&mut store).await?;
+    store
+        .run_concurrent(async |store| {
+            let (body, _) = chunked_input(store, &[b"round ", b"trip"], false)?;
+            let echoed = instance
+                .test_fetch_streams_fetching()
+                .call_post_and_stream(store, body)
+                .await?;
+            let (bytes, ended) = read_bytes(store, echoed, usize::MAX).await?;
+            assert!(ended, "the echoed body must end");
+            assert_eq!(bytes, b"round trip");
+            anyhow::Ok(())
+        })
+        .await??;
+    Ok(())
+}
+
+/// Reading a response body in a sync export, with `text()` or through the body's
+/// reader, rejects with a `TypeError` naming the export.
+#[tokio::test]
+async fn body_reads_in_a_sync_export_reject() -> anyhow::Result<()> {
+    let mut store = store();
+    let instance = pre().await.instantiate_async(&mut store).await?;
+    let fetching = instance.test_fetch_streams_fetching();
+    store
+        .run_concurrent(async |store| fetching.call_hold_responses(store).await)
+        .await??;
+    assert!(fetching
+        .call_sync_read_messages(&mut store)
+        .await?
+        .is_empty());
+    let messages = fetching.call_sync_read_messages(&mut store).await?;
+    assert_eq!(messages.len(), 2, "{messages:?}");
+    // `text()` reads a body, and reading `body` reads a stream.
+    let mut activities: Vec<&str> = messages
+        .iter()
+        .map(|message| {
+            assert!(
+                message.contains("`test:fetch-streams/fetching#sync-read-messages`"),
+                "{message}"
+            );
+            let (activity, _) = message
+                .split_once(" needs an active event loop")
+                .unwrap_or_else(|| panic!("{message}"));
+            activity
+        })
+        .collect();
+    activities.sort_unstable();
+    assert_eq!(activities, ["reading a body", "reading a stream"]);
+    Ok(())
+}
+
+/// `run(1)` combines a timer turn, a drained `ReadableStream` and a `fetch`
+/// through the WASIp3 HTTP client, all under the call's one event loop.
+#[tokio::test]
+async fn combined_builtins_export_runs() -> anyhow::Result<()> {
+    let mut store = store();
+    let instance = pre().await.instantiate_async(&mut store).await?;
+    let result = store
+        .run_concurrent(async |store| {
+            instance
+                .test_fetch_streams_fetching()
+                .call_run(store, 1)
+                .await
+        })
+        .await??;
+    assert_eq!(
+        result,
+        format!("timer=1 stream=part-apart-bpart-c fetch={SERVED_BODY}")
+    );
+    Ok(())
+}
+
+/// Two `delayed` calls in flight at once on the same store, with distinct tags,
+/// each return their own tag, so the per-call event loops do not mix up their
+/// work. The first, with the shorter delay, counts both calls in flight, which a
+/// serialized run would not.
+#[tokio::test]
+async fn concurrent_async_exports_interleave() -> anyhow::Result<()> {
+    let mut store = store();
+    let instance = pre().await.instantiate_async(&mut store).await?;
+    let (first, second) = store
+        .run_concurrent(async |store| {
+            let fetching = instance.test_fetch_streams_fetching();
+            futures::future::join(
+                fetching.call_delayed(store, "first".to_string(), 20),
+                fetching.call_delayed(store, "second".to_string(), 200),
+            )
+            .await
+        })
+        .await?;
+    assert_eq!(first?, "first:2");
+    assert_eq!(second?, "second:1");
+    Ok(())
+}
diff --git a/componentize/tests/fixtures/async_export.js b/componentize/tests/fixtures/async_export.js
new file mode 100644
index 00000000..4f5ce135
--- /dev/null
+++ b/componentize/tests/fixtures/async_export.js
@@ -0,0 +1,94 @@
+// SPDX-License-Identifier: Apache-2.0-WITH-LLVM-exception
+//
+// The async-export world guest module.
+//
+// Each exported interface is an object named after the interface, the
+// interface layer of the export names: `simple-export`'s `foo` is
+// `simpleExport.foo`. `foo` is in both interfaces, so it cannot be a bare
+// export.
+
+import { release } from "test:async-export/host";
+
+let drained = 0;
+let fetchMessage = "none";
+
+export const simpleExport = {
+  // A plain (sync) export: lowered synchronously through `export_call`.
+  foo: function (v) {
+    return v + 3;
+  },
+
+  timerMessage: function () {
+    try {
+      setTimeout(() => {}, 1);
+    } catch (e) {
+      if (e instanceof TypeError) {
+        return e.message;
+      }
+      throw e;
+    }
+    throw new Error("setTimeout succeeded in a sync export");
+  },
+
+  fetchMessage: function () {
+    const recorded = fetchMessage;
+    fetch("http://example.com/").then(
+      () => { fetchMessage = "fetch succeeded in a sync export"; },
+      (e) => { fetchMessage = e instanceof TypeError ? e.message : String(e); },
+    );
+    return recorded;
+  },
+
+  drainedMicrotasks: function () {
+    const before = drained;
+    Promise.resolve().then(() => { drained += 1; });
+    return before;
+  }
+};
+
+export const simpleAsyncExport = {
+  // A genuine `async function`: it `await`s a real timer, so the returned
+  // promise is pending when the runtime first observes it. Driving it to
+  // settlement forces the per-call event loop through a `setTimeout` timer
+  // turn, so the loop-driving the runtime must do is real, not a
+  // synchronously-resolved `Promise.resolve(...)`.
+  foo: async function (v) {
+    await new Promise((resolve) => setTimeout(resolve, 1));
+    return v + 3;
+  },
+
+  // Awaits a promise that never resolves, with no timer or other loop work
+  // behind it. The per-call event loop goes idle while the returned promise is
+  // still pending, which is a guest deadlock. The runtime must trap cleanly here, not
+  // panic-abort.
+  hang: async function () {
+    await new Promise(() => {});
+    return 0;
+  },
+
+  // Delivers `v + 3`, but first arms a perpetual `setInterval` that never
+  // clears. The result promise settles immediately, so `task-return` lowers
+  // `v + 3`, and the interval then keeps the per-call event loop non-idle forever.
+  // It is not a Component Model waitable, so the runtime must complete this
+  // export's subtask (returning the result) and abandon the timer when the
+  // call's loop is dropped, and never wait on the interval, which would hang the
+  // host. The body itself does not await anything, so the returned promise is
+  // already settled when the runtime first observes it.
+  perpetual: async function (v) {
+    setInterval(() => {}, 1);
+    return v + 3;
+  },
+
+  // Rejects after a timer turn, so the runtime sees the returned promise
+  // pending first. An `Error` becomes the `err` string by its message.
+  fail: async function (message) {
+    await new Promise((resolve) => setTimeout(resolve, 1));
+    throw new Error(message);
+  },
+
+  parked: async function () {
+    const before = drained;
+    await release();
+    return drained - before;
+  }
+};
diff --git a/componentize/tests/fixtures/async_export.wit b/componentize/tests/fixtures/async_export.wit
new file mode 100644
index 00000000..744f210e
--- /dev/null
+++ b/componentize/tests/fixtures/async_export.wit
@@ -0,0 +1,64 @@
+// SPDX-License-Identifier: Apache-2.0-WITH-LLVM-exception
+
+package test:async-export;
+
+// The async-export world.
+//
+// Two exported interfaces in one component, so a single componentization shows
+// that sync and async exports coexist on the same runtime. Both `foo`s return
+// `v + 3`. The async one awaits a `setTimeout` first, so the runtime must drive
+// its per-call event loop through a timer turn before the promise settles.
+
+interface simple-export {
+  foo: func(v: u32) -> u32;
+
+  // Calls `setTimeout` and returns the message of the `TypeError` it throws,
+  // since a sync export runs without an event loop.
+  timer-message: func() -> string;
+
+  // Calls `fetch`, whose promise rejects without an event loop, and returns
+  // the rejection's message a previous call recorded, or "none".
+  fetch-message: func() -> string;
+
+  // Queues a microtask that increments a counter, and returns the counter's
+  // value from before the call. The microtask runs before the call returns, so
+  // each call returns the number of calls before it.
+  drained-microtasks: func() -> u32;
+}
+
+interface simple-async-export {
+  foo: async func(v: u32) -> u32;
+
+  // A deadlocking async export: it `await`s a promise that never resolves and
+  // schedules no timer/loop work, so the per-call event loop goes idle while the
+  // returned promise is still pending. The driver must surface this as a clean
+  // trap (host-observable `Err`), not a panic that aborts the process.
+  hang: async func() -> u32;
+
+  // An async export that delivers its result but leaves a perpetual
+  // `setInterval` running. The result settles normally (so `task-return` lowers
+  // it), but the per-call event loop stays non-idle forever. The interval is not
+  // a canonical-ABI waitable, so the export's subtask does not wait for it: the
+  // driver completes the call (returning the result) and abandons the timer,
+  // and never waits on it (which would hang the host's `task.block`).
+  perpetual: async func(v: u32) -> u32;
+
+  // Rejects with an `Error` holding `message` after a timer turn. The rejection
+  // becomes the `err` string, and is not reported as an unhandled rejection.
+  fail: async func(message: string) -> result<u32, string>;
+
+  // Waits for the host's `release` to return, then returns how many
+  // `drained-microtasks` microtasks ran while it waited.
+  parked: async func() -> u32;
+}
+
+interface host {
+  // Returns once the host releases it.
+  release: async func();
+}
+
+world async-export {
+  import host;
+  export simple-export;
+  export simple-async-export;
+}
diff --git a/componentize/tests/fixtures/async_import.js b/componentize/tests/fixtures/async_import.js
new file mode 100644
index 00000000..1e15f930
--- /dev/null
+++ b/componentize/tests/fixtures/async_import.js
@@ -0,0 +1,51 @@
+// SPDX-License-Identifier: Apache-2.0-WITH-LLVM-exception
+//
+// The async-import-and-export world guest module.
+//
+// `bar` is the async WIT import, synthesized into the ES module named after its
+// interface (`test:async-import/host`). Its synthesized function returns a
+// Promise that settles once the host subtask completes, so the guest `await`s it.
+//
+// `runner.foo` is the async WIT export, provided in the package layer as
+// `testAsyncImport.runner.foo`. It is a genuine `async function`, so the runtime
+// drives a per-call event loop until the promise it returns settles, and that
+// same loop drives the async import's future.
+
+import { bar, baz } from "test:async-import/host";
+
+let barMessage = "none";
+
+const runner = {
+    barMessage() {
+        const recorded = barMessage;
+        bar(1).then(
+            () => { barMessage = "bar succeeded in a sync export"; },
+            (e) => { barMessage = e instanceof TypeError ? e.message : String(e); },
+        );
+        return recorded;
+    },
+
+    // `await bar(v)` suspends through the host (the host yields before answering
+    // `v + 2`), then `+ 3`. So `foo(42)` => await 44 => 47.
+    foo: async function (v) {
+        const fromHost = await bar(v);
+        return fromHost + 3;
+    },
+    // The `result` argument arrives as `{tag, val}` and is passed on as-is. The
+    // import's `ok` settles the promise with the bare payload, and its `err`
+    // rejects with a `ComponentError` whose payload is the value. Each gets `+ 3`.
+    qux: async function (v) {
+        let fromHost;
+        try {
+            fromHost = await baz(v);
+        } catch (e) {
+            if (!(e instanceof ComponentError)) throw e;
+            throw new ComponentError(/** @type {number} */ (e.payload) + 3);
+        }
+        return fromHost + 3;
+    },
+};
+
+// The package layer of the export names: `test:async-import/runner`'s items
+// are members of `testAsyncImport.runner`.
+export const testAsyncImport = { runner };
diff --git a/componentize/tests/fixtures/async_import.wit b/componentize/tests/fixtures/async_import.wit
new file mode 100644
index 00000000..e7430623
--- /dev/null
+++ b/componentize/tests/fixtures/async_import.wit
@@ -0,0 +1,37 @@
+// SPDX-License-Identifier: Apache-2.0-WITH-LLVM-exception
+
+package test:async-import;
+
+// The async-import-and-export world.
+//
+// `host.bar` is an `async` WIT import, so its JS function returns a Promise
+// that settles once the host subtask completes. `runner.foo` is an `async` WIT
+// export, whose per-call event loop drives the import's future. The guest's
+// `foo(v)` does `await bar(v)` then returns the awaited value `+ 3`, and the
+// host's `bar(x)` yields before returning `x + 2`, so `foo(42)` is 47.
+
+interface host {
+  // The async host import. `x + 2`, but only after a host-side yield, so the
+  // guest's `await bar(x)` cannot complete synchronously.
+  bar: async func(x: u32) -> u32;
+  // The `result`-typed async host import: `ok(x)` becomes `ok(x + 2)` and
+  // `err(x)` becomes `err(x + 3)`, after the same host-side yield.
+  baz: async func(v: result<u32, u32>) -> result<u32, u32>;
+}
+
+interface runner {
+  // The async export: `await bar(v)` then `+ 3`.
+  foo: async func(v: u32) -> u32;
+  // The `result`-typed async export: `await baz(v)`, then `+ 3` on whichever
+  // arm came back. An `err` arrives in the guest as a rejection with a
+  // `ComponentError` and leaves it as a thrown `ComponentError`.
+  qux: async func(v: result<u32, u32>) -> result<u32, u32>;
+  // A sync export: calls `bar`, whose promise rejects without an event loop,
+  // and returns the rejection's message a previous call recorded, or "none".
+  bar-message: func() -> string;
+}
+
+world async-import {
+  import host;
+  export runner;
+}
diff --git a/componentize/tests/fixtures/cli/a.wit b/componentize/tests/fixtures/cli/a.wit
new file mode 100644
index 00000000..27522934
--- /dev/null
+++ b/componentize/tests/fixtures/cli/a.wit
@@ -0,0 +1,7 @@
+// SPDX-License-Identifier: Apache-2.0-WITH-LLVM-exception
+
+package test:cli-a;
+
+world one {
+  export one: func() -> u32;
+}
diff --git a/componentize/tests/fixtures/cli/app/lib.js b/componentize/tests/fixtures/cli/app/lib.js
new file mode 100644
index 00000000..5fb89a5b
--- /dev/null
+++ b/componentize/tests/fixtures/cli/app/lib.js
@@ -0,0 +1,3 @@
+// SPDX-License-Identifier: Apache-2.0-WITH-LLVM-exception
+
+export const base = 40;
diff --git a/componentize/tests/fixtures/cli/app/src/main.js b/componentize/tests/fixtures/cli/app/src/main.js
new file mode 100644
index 00000000..7d4ec83d
--- /dev/null
+++ b/componentize/tests/fixtures/cli/app/src/main.js
@@ -0,0 +1,11 @@
+// SPDX-License-Identifier: Apache-2.0-WITH-LLVM-exception
+//
+// The guest of the merged worlds of `cli/a.wit` and `cli/b.wit`. Its import resolves only with
+// `cli/app` as the base directory.
+
+import { base } from "../lib.js";
+
+console.log(`initializing at ${location.href}`);
+
+export const one = () => base + 1;
+export const two = () => base + 2;
diff --git a/componentize/tests/fixtures/cli/b.wit b/componentize/tests/fixtures/cli/b.wit
new file mode 100644
index 00000000..915b8429
--- /dev/null
+++ b/componentize/tests/fixtures/cli/b.wit
@@ -0,0 +1,7 @@
+// SPDX-License-Identifier: Apache-2.0-WITH-LLVM-exception
+
+package test:cli-b;
+
+world two {
+  export two: func() -> u32;
+}
diff --git a/componentize/tests/fixtures/cli_and_serve.js b/componentize/tests/fixtures/cli_and_serve.js
new file mode 100644
index 00000000..ed3da439
--- /dev/null
+++ b/componentize/tests/fixtures/cli_and_serve.js
@@ -0,0 +1,17 @@
+// SPDX-License-Identifier: Apache-2.0-WITH-LLVM-exception
+//
+// A module that serves requests and runs as a command, for a component built
+// with both `--export-cli` and `--export-http`.
+
+const greeting = "hello from one component";
+
+addEventListener("fetch", (event) => {
+  event.respondWith(
+    new Response(`${greeting}, serving ${new URL(event.request.url).pathname}`),
+  );
+});
+
+export async function run() {
+  await new Promise((resolve) => setTimeout(resolve, 10));
+  console.log(`${greeting}, running`);
+}
diff --git a/componentize/tests/fixtures/cli_run.js b/componentize/tests/fixtures/cli_run.js
new file mode 100644
index 00000000..9b0ded7d
--- /dev/null
+++ b/componentize/tests/fixtures/cli_run.js
@@ -0,0 +1,34 @@
+// SPDX-License-Identifier: Apache-2.0-WITH-LLVM-exception
+//
+// A CLI application for the cli/run-via-pipeline e2e.
+//
+// `wasi:cli/run.run()` forwards to the exported `run` function. It awaits a
+// `setTimeout`, so the event loop must take a timer turn before the returned
+// promise settles, writes its lines to stdout, and resolves. A componentized snapshot of this app
+// run as a CLI tool prints the start and done lines in order and exits 0.
+
+// Written under Wizer, so libc's stdout stream is opened before the snapshot.
+// `run` writes to stdout again in the resumed instance, which works only if the
+// snapshot holds no stale stream handle.
+console.log("logged under Wizer");
+
+export async function run() {
+  console.log("cli run start");
+  // Measured against a time origin recorded before the snapshot. The resume fixups
+  // advance the clock past everything the snapshot holds, so this is the time since the
+  // resumed instance started rather than the seconds `init` spent under Wizer.
+  console.log(`cli run elapsed ${performance.now()}`);
+  // Await a timer whose callback allocates garbage while the runtime holds the
+  // returned promise across the suspension, so a collection can run while the
+  // promise needs its root. A missing root surfaces as a stale-pointer crash.
+  await new Promise((resolve) =>
+    setTimeout(() => {
+      for (let i = 0; i < 200000; i++) {
+        const junk = { a: i, b: `chunk-${i}`, c: [i, i + 1, i + 2] };
+        if (junk.a < 0) console.log(junk.b);
+      }
+      resolve(undefined);
+    }, 10),
+  );
+  console.log("cli run done");
+}
diff --git a/componentize/tests/fixtures/cli_run.wit b/componentize/tests/fixtures/cli_run.wit
new file mode 100644
index 00000000..083e2462
--- /dev/null
+++ b/componentize/tests/fixtures/cli_run.wit
@@ -0,0 +1,16 @@
+// SPDX-License-Identifier: Apache-2.0-WITH-LLVM-exception
+
+package test:cli-run;
+
+// A CLI world. The runtime's builtin `wasi:cli/run` serves the export by calling the
+// application's JavaScript `run` export. The world's version of `wasi:cli/run` is compatible with
+// the builtin's, and has a patch number that differs from it.
+world command {
+  export wasi:cli/run@0.3.5;
+}
+
+package wasi:cli@0.3.5 {
+  interface run {
+    run: async func() -> result;
+  }
+}
diff --git a/componentize/tests/fixtures/cli_run_no_run.js b/componentize/tests/fixtures/cli_run_no_run.js
new file mode 100644
index 00000000..46923396
--- /dev/null
+++ b/componentize/tests/fixtures/cli_run_no_run.js
@@ -0,0 +1,8 @@
+// SPDX-License-Identifier: Apache-2.0-WITH-LLVM-exception
+//
+// The negative case of the CLI suite: an app that exports no `run` function,
+// which componentizing it as a CLI tool refuses.
+
+export function notRun() {
+  return 42;
+}
diff --git a/componentize/tests/fixtures/exported_resource.js b/componentize/tests/fixtures/exported_resource.js
new file mode 100644
index 00000000..1d22058f
--- /dev/null
+++ b/componentize/tests/fixtures/exported_resource.js
@@ -0,0 +1,74 @@
+// SPDX-License-Identifier: Apache-2.0-WITH-LLVM-exception
+//
+// The exported-resource guest module.
+//
+// `Counter` is a plain JS class the guest owns. When an instance crosses out to
+// the host (returned from `makeCounter`, or from the `[constructor]counter`
+// path), the interpreter mints a canonical handle for it through the resource's
+// `[resource-new]` extern and parks the object in the exported-resource slab,
+// keyed by its rep. Host calls to `bump`/`value` arrive as `[method]` exports
+// whose `this` is the slab-resident object (looked up by rep). `totalCreated`
+// and `liveCount` are statics, dispatched on the class object.
+//
+// When the host drops the handle, the runtime's `resource_dtor` removes the slab
+// entry and calls the object's `[Symbol.dispose]()`. That method decrements
+// `liveCount`, so a host-side drop is observable across the boundary as
+// `live-count` falling.
+//
+// `makeCounter` and the `Counter` class are bare exports. The runtime looks
+// instance methods up on `Counter.prototype` and statics on `Counter`.
+
+let totalCreated = 0;
+let liveCount = 0;
+let disposeCalls = 0;
+
+class Counter {
+  constructor(start) {
+    this.value_ = start;
+    totalCreated += 1;
+    liveCount += 1;
+  }
+
+  // The runtime calls this when the host drops the resource.
+  [Symbol.dispose]() {
+    liveCount -= 1;
+    disposeCalls += 1;
+  }
+
+  bump(by) {
+    this.value_ += by;
+    return this.value_;
+  }
+
+  value() {
+    return this.value_;
+  }
+
+  static totalCreated() {
+    return totalCreated;
+  }
+
+  static liveCount() {
+    return liveCount;
+  }
+
+  static disposeCalls() {
+    return disposeCalls;
+  }
+}
+
+// The interface's items are bare exports.
+export function makeCounter(start) {
+  return new Counter(start);
+}
+
+export function makeSealedCounter(start) {
+  return Object.preventExtensions(new Counter(start));
+}
+
+export { Counter };
+
+export async function readLater(counter) {
+  await new Promise((resolve) => setTimeout(resolve, 5));
+  return counter.value();
+}
diff --git a/componentize/tests/fixtures/exported_resource.wit b/componentize/tests/fixtures/exported_resource.wit
new file mode 100644
index 00000000..a1a4e277
--- /dev/null
+++ b/componentize/tests/fixtures/exported_resource.wit
@@ -0,0 +1,42 @@
+// SPDX-License-Identifier: Apache-2.0-WITH-LLVM-exception
+
+package test:exported-resource;
+
+// A world that exports a guest-owned resource. The guest implements
+// `counters.counter` in JavaScript and returns counters to the host, which calls
+// their methods through its handles and finally drops them.
+//
+// `read-later` is the one async export: it takes a borrow and reads it after a
+// timer turn.
+
+interface counters {
+  resource counter {
+    // Construct a counter starting at `start`.
+    constructor(start: u32);
+    // Add `by` to the running value and return the new value.
+    bump: func(by: u32) -> u32;
+    // The current running value.
+    value: func() -> u32;
+    // How many counters the guest has constructed so far (process-global).
+    total-created: static func() -> u32;
+    // How many counters are still live: constructed minus dropped. The guest
+    // decrements this from its `[Symbol.dispose]`, so the host observes a
+    // host-side drop as `live-count` falling.
+    live-count: static func() -> u32;
+    // How many times the guest's `[Symbol.dispose]` has run, so a host-side
+    // drop is observed to run it exactly once.
+    dispose-calls: static func() -> u32;
+  }
+
+  // A freestanding export returning a guest-owned resource.
+  make-counter: func(start: u32) -> counter;
+  // Returns a counter that `Object.preventExtensions` made non-extensible.
+  make-sealed-counter: func(start: u32) -> counter;
+
+  // Waits for a timer turn, then returns the value of the borrowed counter.
+  read-later: async func(c: borrow<counter>) -> u32;
+}
+
+world exported-resource {
+  export counters;
+}
diff --git a/componentize/tests/fixtures/fetch_streams.js b/componentize/tests/fixtures/fetch_streams.js
new file mode 100644
index 00000000..1cd71be2
--- /dev/null
+++ b/componentize/tests/fixtures/fetch_streams.js
@@ -0,0 +1,122 @@
+// SPDX-License-Identifier: Apache-2.0-WITH-LLVM-exception
+//
+// The `stream<u8>` and `fetch` guest module. A lifted `stream<u8>` is a
+// `ReadableStream` of bytes, which `fetch` takes as a request body, and a
+// response's `body` is a `ReadableStream` of bytes, which lowers to a
+// `stream<u8>`.
+
+async function postStream(body) {
+  // TypeScript's `RequestInit` has no `duplex` member, so `init` is built
+  // first, which exempts it from the excess-property check.
+  const init = { method: "POST", body, duplex: "half" };
+  const response = await fetch("http://example.com/echo", init);
+  return await response.text();
+}
+
+async function getBody() {
+  const response = await fetch("http://example.com/data");
+  return response.body;
+}
+
+let pipedBodySettled = false;
+
+async function getPipedBody() {
+  const response = await fetch("http://example.com/data");
+  const transform = new TransformStream();
+  /** @type {ReadableStream} */ (response.body)
+    .pipeTo(transform.writable)
+    .finally(() => { pipedBodySettled = true; });
+  return transform.readable;
+}
+
+async function getBrokenBody() {
+  const response = await fetch("http://example.com/broken");
+  return response.body;
+}
+
+async function postAndStream(body) {
+  // TypeScript's `RequestInit` has no `duplex` member, so `init` is built
+  // first, which exempts it from the excess-property check.
+  const init = { method: "POST", body, duplex: "half" };
+  const response = await fetch("http://example.com/echo", init);
+  return response.body;
+}
+
+/** @type {Response[]} */
+let held = [];
+/** @type {string[]} */
+let readMessages = [];
+
+async function holdResponses() {
+  held = [await fetch("http://example.com/data"), await fetch("http://example.com/data")];
+}
+
+/** @param {Promise<unknown>} read */
+function recordRead(read) {
+  read.then(
+    () => { readMessages.push("the read succeeded in a sync export"); },
+    (e) => { readMessages.push(e instanceof TypeError ? e.message : String(e)); },
+  );
+}
+
+function syncReadMessages() {
+  const recorded = readMessages;
+  readMessages = [];
+  for (const [i, response] of held.entries()) {
+    recordRead(i == 0 ? response.text() : /** @type {ReadableStream} */ (response.body).getReader().read());
+  }
+  held = [];
+  return recorded;
+}
+
+// The timer, the stream and the fetch each change the result, so a bug in any
+// of them changes the host's asserted output.
+async function run(ms) {
+  await new Promise((resolve) => setTimeout(resolve, ms));
+
+  const stream = new ReadableStream({
+    start(controller) {
+      for (const chunk of ["part-a", "part-b", "part-c"]) {
+        controller.enqueue(chunk);
+      }
+      controller.close();
+    },
+  });
+  const reader = stream.getReader();
+  let streamed = "";
+  for (;;) {
+    const { value, done } = await reader.read();
+    if (done) {
+      break;
+    }
+    streamed += value;
+  }
+
+  const response = await fetch("http://example.com/data");
+  const fetched = await response.text();
+
+  return `timer=${ms} stream=${streamed} fetch=${fetched}`;
+}
+
+let inFlight = 0;
+
+async function delayed(tag, ms) {
+  inFlight += 1;
+  await new Promise((resolve) => setTimeout(resolve, ms));
+  const count = inFlight;
+  inFlight -= 1;
+  return `${tag}:${count}`;
+}
+
+export const fetching = {
+  postStream,
+  getBody,
+  getPipedBody,
+  pipedBodySettled: () => pipedBodySettled,
+  getBrokenBody,
+  postAndStream,
+  holdResponses,
+  syncReadMessages,
+  run,
+  delayed,
+};
diff --git a/componentize/tests/fixtures/fetch_streams.wit b/componentize/tests/fixtures/fetch_streams.wit
new file mode 100644
index 00000000..20542bd3
--- /dev/null
+++ b/componentize/tests/fixtures/fetch_streams.wit
@@ -0,0 +1,40 @@
+// SPDX-License-Identifier: Apache-2.0-WITH-LLVM-exception
+
+package test:fetch-streams;
+
+// `stream<u8>` values meeting `fetch`: a lifted stream as an outgoing request's
+// body, and an incoming response's body returned as a stream. See
+// `fetch_streams.js`. Also an async export combining builtins under its event
+// loop, and one that counts the calls in flight.
+
+interface fetching {
+  // POSTs `body` and returns the text of the response, whose body the host
+  // echoes from the request's.
+  post-stream: async func(body: stream<u8>) -> string;
+  // Returns the body of a GET response as a stream.
+  get-body: async func() -> stream<u8>;
+  // Returns the body of a GET response piped through an identity
+  // `TransformStream`.
+  get-piped-body: async func() -> stream<u8>;
+  // Whether the pipe started by `get-piped-body` has finished.
+  piped-body-settled: async func() -> bool;
+  // Returns the body of a GET response that the host aborts after some bytes.
+  get-broken-body: async func() -> stream<u8>;
+  // POSTs `body` and returns the response's body as a stream.
+  post-and-stream: async func(body: stream<u8>) -> stream<u8>;
+  // Stores two GET responses unread for `sync-read-messages`.
+  hold-responses: async func();
+  // Starts reading the responses `hold-responses` stored, one with `text()` and
+  // one through its body's reader, which a sync export has no event loop for.
+  // Returns the rejection messages previous calls recorded.
+  sync-read-messages: func() -> list<string>;
+  // Sleeps `ms`, drains a `ReadableStream` of literal chunks, `fetch`es a GET,
+  // and returns a string combining all three results.
+  run: async func(ms: u32) -> string;
+  // Sleeps `ms`, then returns `<tag>:<calls in flight>`, counting this one.
+  delayed: async func(tag: string, ms: u32) -> string;
+}
+
+world fetch-streams {
+  export fetching;
+}
diff --git a/componentize/tests/fixtures/lowering.js b/componentize/tests/fixtures/lowering.js
new file mode 100644
index 00000000..e4c0f960
--- /dev/null
+++ b/componentize/tests/fixtures/lowering.js
@@ -0,0 +1,129 @@
+// SPDX-License-Identifier: Apache-2.0-WITH-LLVM-exception
+//
+// The lowering-world guest module. Each case of `runner.run` changes a value
+// after passing it to an import, and describes what the import received.
+
+import * as hostModule from "test:lowering/host";
+import { Thing, makeBare, bareValue, consume, peek, drain, takeTwo, accept, firstByte } from "test:lowering/host";
+
+/** @param {unknown} e */
+function describe(e) {
+  return e instanceof Error ? `${e.constructor.name}: ${e.message}` : `not an Error: ${e}`;
+}
+
+/** @param {() => Promise<unknown>} f */
+async function settled(f) {
+  try {
+    return `ok ${await f()}`;
+  } catch (e) {
+    return describe(e);
+  }
+}
+
+async function peekDisposed() {
+  using thing = new Thing(6);
+  return peek(thing);
+}
+
+/** @type {Record<string, () => Promise<string>>} */
+const cases = {
+  async disposeAfterConsume() {
+    const thing = new Thing(5);
+    const consumed = consume(thing);
+    thing[Symbol.dispose]();
+    return settled(() => consumed);
+  },
+  async consumeTwice() {
+    const thing = new Thing(5);
+    return settled(() => Promise.all([consume(thing), consume(thing)]));
+  },
+  async disposeWhilePeeked() {
+    return settled(peekDisposed);
+  },
+  async consumeWhilePeeked() {
+    const thing = new Thing(3);
+    const peeked = peek(thing);
+    const consumed = await settled(() => consume(thing));
+    return `${consumed}, ${await settled(() => peeked)}`;
+  },
+  async drainTwice() {
+    const stream = new ReadableStream({
+      start(controller) {
+        controller.enqueue(1);
+        controller.enqueue(2);
+        controller.close();
+      },
+    });
+    return settled(() => Promise.all([drain(stream), drain(stream)]));
+  },
+  async changeBufferAfterCall() {
+    const buffer = new Uint8Array([1, 2, 3]);
+    const first = firstByte(buffer);
+    buffer[0] = 99;
+    return settled(() => first);
+  },
+  async pullDisposesArgument() {
+    const thing = new Thing(9);
+    const stream = new ReadableStream({
+      pull(controller) {
+        thing[Symbol.dispose]();
+        controller.enqueue(1);
+        controller.close();
+      },
+    }, { highWaterMark: 0 });
+    return settled(async () => takeTwo(stream, thing));
+  },
+  async bareResource() {
+    const bare = makeBare();
+    const value = bareValue(bare);
+    bare[Symbol.dispose]();
+    return `${typeof hostModule.Bare} ${bare instanceof hostModule.Bare} ${value}`;
+  },
+};
+
+class Widget {
+  get() {
+    return 1;
+  }
+
+  /** @param {boolean} sub */
+  static make(sub) {
+    return sub ? new SubWidget() : new Widget();
+  }
+}
+
+class SubWidget extends Widget {
+  get() {
+    return 2;
+  }
+}
+
+export const runner = {
+  Widget,
+  /** @param {string} which */
+  run(which) {
+    return cases[which]();
+  },
+  give() {
+    try {
+      accept(Promise.resolve(42));
+      return "no error";
+    } catch (e) {
+      return describe(e);
+    }
+  },
+  /** @param {boolean} together */
+  async things(together) {
+    const thing = new Thing(3);
+    if (!together) {
+      return [thing, thing];
+    }
+    return new ReadableStream({
+      start(controller) {
+        controller.enqueue(thing);
+        controller.enqueue(thing);
+        controller.close();
+      },
+    });
+  },
+};
diff --git a/componentize/tests/fixtures/lowering.wit b/componentize/tests/fixtures/lowering.wit
new file mode 100644
index 00000000..b118559f
--- /dev/null
+++ b/componentize/tests/fixtures/lowering.wit
@@ -0,0 +1,52 @@
+// SPDX-License-Identifier: Apache-2.0-WITH-LLVM-exception
+
+package test:lowering;
+
+// Values whose state JavaScript can change after an import call starts: resource
+// wrappers, streams and typed arrays. See `lowering.js`.
+
+interface host {
+  resource thing {
+    constructor(v: u32);
+  }
+  // A resource with no constructor, method or static function.
+  resource bare;
+  make-bare: func() -> bare;
+  bare-value: func(b: borrow<bare>) -> u32;
+  // Returns the thing's value, after a yield, and drops it.
+  consume: async func(t: thing) -> u32;
+  // Returns the thing's value, after a yield.
+  peek: async func(t: borrow<thing>) -> u32;
+  // Returns the sum of the stream's elements.
+  drain: async func(s: stream<u32>) -> u32;
+  // Drops the stream unread, and returns the thing's value.
+  take-two: func(s: stream<u32>, t: thing) -> u32;
+  // Keeps the future for the host to read.
+  accept: func(f: future<u32>);
+  // Returns the list's first element.
+  first-byte: async func(data: list<u8>) -> u32;
+}
+
+interface runner {
+  use host.{thing};
+
+  // Runs the case named `which`, and describes its result.
+  run: async func(which: string) -> string;
+  // Returns a stream holding one `thing` twice: with `together`, from a source
+  // that enqueues both at once, and otherwise from an array.
+  things: async func(together: bool) -> stream<thing>;
+  // Passes a future to `accept`, and describes the result.
+  give: func() -> string;
+
+  resource widget {
+    get: func() -> u32;
+    // Returns a `Widget`, or with `sub` an instance of a subclass whose `get`
+    // returns 2.
+    make: static func(sub: bool) -> widget;
+  }
+}
+
+world lowering {
+  import host;
+  export runner;
+}
diff --git a/componentize/tests/fixtures/resources.js b/componentize/tests/fixtures/resources.js
new file mode 100644
index 00000000..11c07946
--- /dev/null
+++ b/componentize/tests/fixtures/resources.js
@@ -0,0 +1,238 @@
+// SPDX-License-Identifier: Apache-2.0-WITH-LLVM-exception
+//
+// The resources-world guest module.
+//
+// Each exported interface wraps the host resource of the imported interface of
+// the same name in a guest class: the guest `Thing` holds a host `Thing` in
+// `value`, and every exported function unwraps its arguments, forwards them to
+// the host import and re-wraps the host's results. Each function adds its own
+// arithmetic or string suffix, so the host can check the whole chain from one
+// return value.
+
+import { Thing as AggregatesThing, foo as aggregatesFoo } from "test:resources/aggregates";
+import {
+  Thing as BorrowInRecordThing,
+  test as borrowInRecordTest,
+} from "test:resources/borrow-in-record";
+import { Thing as Alias1Thing, a as alias1A } from "test:resources/alias1";
+import { b as alias2B } from "test:resources/alias2";
+import { Thing as ImportAndExportThing } from "test:resources/import-and-export";
+import { Counter, reject } from "test:resources/counters";
+
+// ---- aggregates ----
+
+class AggregatesGuestThing {
+  constructor(value) {
+    this.value = new AggregatesThing(value + 1);
+  }
+}
+
+function foo(r1, r2, r3, t1, t2, v1, v2, l1, l2, o1, o2, result1, result2) {
+  return (
+    aggregatesFoo(
+      { thing: r1.thing.value },
+      { thing: r2.thing.value },
+      { thing1: r3.thing1.value, thing2: r3.thing2.value },
+      [t1[0].value, { thing: t1[1].thing.value }],
+      [t2[0].value],
+      { tag: v1.tag, val: v1.val.value },
+      { tag: v2.tag, val: v2.val.value },
+      l1.map((x) => x.value),
+      l2.map((x) => x.value),
+      o1 === undefined ? undefined : o1.value,
+      o2 === undefined ? undefined : o2.value,
+      result1.tag === "ok" ? { tag: "ok", val: result1.val.value } : { tag: "err" },
+      result2.tag === "ok" ? { tag: "ok", val: result2.val.value } : { tag: "err" },
+    ) + 4
+  );
+}
+
+const aggregates = {
+  Thing: AggregatesGuestThing,
+  foo,
+};
+
+// ---- borrow-in-record ----
+
+class BorrowInRecordGuestThing {
+  constructor(value) {
+    this.value = new BorrowInRecordThing(value + " Thing");
+  }
+
+  get() {
+    return this.value.get() + " Thing.get";
+  }
+}
+
+// Wrap a host thing the host handed back without running the constructor,
+// which would create a second host thing.
+function wrapBorrowInRecord(hostThing) {
+  const thing = Object.create(BorrowInRecordGuestThing.prototype);
+  thing.value = hostThing;
+  return thing;
+}
+
+const borrowInRecord = {
+  Thing: BorrowInRecordGuestThing,
+  test(list) {
+    return borrowInRecordTest(list.map((x) => ({ thing: x.thing.value }))).map(
+      wrapBorrowInRecord,
+    );
+  },
+};
+
+// ---- alias1 / alias2 ----
+
+class Alias1GuestThing {
+  constructor(value) {
+    this.value = new Alias1Thing(value + " Thing");
+  }
+
+  get() {
+    return this.value.get() + " Thing.get";
+  }
+}
+
+function wrapAlias1(hostThing) {
+  const thing = Object.create(Alias1GuestThing.prototype);
+  thing.value = hostThing;
+  return thing;
+}
+
+export const alias1 = {
+  Thing: Alias1GuestThing,
+  a(f) {
+    return alias1A({ thing: f.thing.value }).map(wrapAlias1);
+  },
+};
+
+export const alias2 = {
+  b(f, g) {
+    return alias2B({ thing: f.thing.value }, { thing: g.thing.value }).map(wrapAlias1);
+  },
+};
+
+// ---- import-and-export ----
+
+class ImportAndExportGuestThing {
+  constructor(value) {
+    this.value = new ImportAndExportThing(value + 1);
+  }
+
+  foo() {
+    return this.value.foo() + 2;
+  }
+
+  bar(value) {
+    this.value.bar(value + 3);
+  }
+
+  static baz(a, b) {
+    return new ImportAndExportGuestThing(ImportAndExportThing.baz(a.value, b.value).foo() + 4);
+  }
+}
+
+export const importAndExport = {
+  Thing: ImportAndExportGuestThing,
+};
+
+// ---- world-level exports ----
+
+export function bump(counter) {
+  counter.set(counter.get() + 1);
+}
+
+export function test(things) {
+  return things;
+}
+
+export function disposeEarly(counter) {
+  const value = counter.get();
+  counter[Symbol.dispose]();
+  return value;
+}
+
+export function forgedDisposeMessages(counter) {
+  const dispose = Object.getPrototypeOf(counter)[Symbol.dispose];
+  const forgeries = [{}, Object.create(Object.getPrototypeOf(counter))];
+  return forgeries.map((forged) => {
+    try {
+      dispose.call(forged);
+      return "no error";
+    } catch (e) {
+      return e instanceof TypeError ? e.message : `not a TypeError: ${e}`;
+    }
+  });
+}
+
+// Two interfaces in the package layer, the rest in the interface layer.
+export const testResources = { aggregates, borrowInRecord };
+
+export function usingOwned(counter) {
+  let value;
+  {
+    using owned = counter;
+    value = owned.get();
+  }
+  counter[Symbol.dispose]();
+  return value;
+}
+
+export function describeResourceError(counter) {
+  try {
+    reject(counter);
+    return "no error";
+  } catch (e) {
+    return `${e.constructor.name} ${e.payload instanceof Counter} ${e.payload.get()}`;
+  }
+}
+
+export function plainObjectForResource() {
+  try {
+    // @ts-expect-error A plain object is not a `Counter`.
+    reject({});
+    return "no error";
+  } catch (e) {
+    return `${e instanceof TypeError} ${e.message}`;
+  }
+}
+
+/** @param {() => unknown} f */
+function typeErrorMessage(f) {
+  try {
+    f();
+    return "no error";
+  } catch (e) {
+    return e instanceof TypeError ? e.message : `not a TypeError: ${e}`;
+  }
+}
+
+export function resourceMisuseMessages(counter) {
+  const thing = new ImportAndExportThing(1);
+  const aliased = new Alias1Thing("aliased");
+  const disposed = new Alias1Thing("disposed");
+  const other = new Alias1Thing("other");
+  const borrowed = new BorrowInRecordThing("borrowed");
+  return [
+    typeErrorMessage(() => ImportAndExportThing.baz(thing, thing)),
+    typeErrorMessage(() => alias2B({ thing: aliased }, { thing: aliased })),
+    typeErrorMessage(() => reject(counter)),
+    typeErrorMessage(() =>
+      alias2B(
+        { thing: disposed },
+        {
+          get thing() {
+            disposed[Symbol.dispose]();
+            return other;
+          },
+        },
+      ),
+    ),
+    String(borrowInRecordTest([{ thing: borrowed }, { thing: borrowed }]).length),
+    typeErrorMessage(() => ImportAndExportThing.baz(thing, new ImportAndExportThing(2))),
+  ];
+}
+
+export function failQuietly() {
+  throw new Error("the reason for failing quietly");
+}
diff --git a/componentize/tests/fixtures/resources.wit b/componentize/tests/fixtures/resources.wit
new file mode 100644
index 00000000..3ba12f36
--- /dev/null
+++ b/componentize/tests/fixtures/resources.wit
@@ -0,0 +1,188 @@
+// SPDX-License-Identifier: Apache-2.0-WITH-LLVM-exception
+
+package test:resources;
+
+// Resource handles in every position the Component Model allows them.
+//
+// `aggregates` nests `own` and `borrow` handles inside records, tuples,
+// variants, options, results and lists. `borrow-in-record` returns a
+// `list<thing>` built from borrows inside records. `alias1`/`alias2` share one
+// resource type through `use` and `use ... as`. `import-and-export` is one
+// interface imported and exported at once, so the guest class wraps the host
+// class of the same name. The world declares its own resource `counter` and
+// `use`s `alias1.thing` for a world-level export.
+//
+// Every interface but `counters` is both imported (the host owns the
+// resources) and exported (the guest wraps each host resource in a class of
+// its own).
+
+interface aggregates {
+  resource thing {
+    constructor(v: u32);
+  }
+
+  record r1 {
+    thing: thing,
+  }
+
+  record r2 {
+    thing: borrow<thing>,
+  }
+
+  record r3 {
+    thing1: borrow<thing>,
+    thing2: thing,
+  }
+
+  type t1 = tuple<thing, r1>;
+
+  type t2 = tuple<borrow<thing>>;
+
+  variant v1 {
+    thing(thing),
+  }
+
+  variant v2 {
+    thing(borrow<thing>),
+  }
+
+  type l1 = list<thing>;
+
+  type l2 = list<borrow<thing>>;
+
+  // Sum every nested thing's value, plus a constant, so a handle that lifted
+  // or lowered wrongly changes the result.
+  foo: func(
+    r1: r1,
+    r2: r2,
+    r3: r3,
+    t1: t1,
+    t2: t2,
+    v1: v1,
+    v2: v2,
+    l1: l1,
+    l2: l2,
+    o1: option<thing>,
+    o2: option<borrow<thing>>,
+    result1: result<thing>,
+    result2: result<borrow<thing>>,
+  ) -> u32;
+}
+
+interface borrow-in-record {
+  resource thing {
+    constructor(s: string);
+    get: func() -> string;
+  }
+
+  record foo {
+    thing: borrow<thing>,
+  }
+
+  test: func(a: list<foo>) -> list<thing>;
+}
+
+interface alias1 {
+  resource thing {
+    constructor(s: string);
+    get: func() -> string;
+  }
+
+  record foo {
+    thing: thing,
+  }
+
+  a: func(f: foo) -> list<thing>;
+}
+
+interface alias2 {
+  use alias1.{thing, foo as bar};
+
+  record foo {
+    thing: thing,
+  }
+
+  b: func(f: foo, g: bar) -> list<thing>;
+}
+
+interface import-and-export {
+  resource thing {
+    constructor(v: u32);
+    foo: func() -> u32;
+    bar: func(v: u32);
+    baz: static func(a: thing, b: thing) -> thing;
+  }
+}
+
+// A host resource the guest reaches only through the borrows the world-level
+// exports receive.
+interface counters {
+  resource counter {
+    constructor(v: u32);
+    get: func() -> u32;
+    set: func(v: u32);
+  }
+
+  // Fails with `c` as the error.
+  reject: func(c: counter) -> result<u32, counter>;
+}
+
+world resources {
+  use alias1.{thing};
+  use counters.{counter};
+
+  import counters;
+
+  import aggregates;
+  export aggregates;
+
+  import borrow-in-record;
+  export borrow-in-record;
+
+  import alias1;
+  import alias2;
+  export alias1;
+  export alias2;
+
+  import import-and-export;
+  export import-and-export;
+
+  // Add one to the counter through its `get` and `set` methods.
+  export bump: func(c: borrow<counter>);
+
+  // Return the received host things unchanged.
+  export test: func(things: list<thing>) -> list<thing>;
+
+  // Read the counter, then call `[Symbol.dispose]()` on the borrowed wrapper
+  // before returning. The borrow is also released at call end, and that
+  // release must not drop the handle a second time.
+  export dispose-early: func(c: borrow<counter>) -> u32;
+  // Calls the `[Symbol.dispose]` of `c`'s class on objects that are not
+  // wrappers: a plain object, and an object with `c`'s prototype. Returns the
+  // message of each `TypeError` that throws, or "no error".
+  export forged-dispose-messages: func(c: borrow<counter>) -> list<string>;
+
+  // Reads the owned counter inside a `using` block, which disposes of it, then
+  // disposes of it again, and returns the value read.
+  export using-owned: func(c: counter) -> u32;
+
+  // Passes `c` to `counters.reject`, and describes the error that throws: its
+  // class, whether its payload is a `Counter`, and the payload's value.
+  export describe-resource-error: func(c: counter) -> string;
+
+  // Throws an `Error`, which the payload-less `err` takes, logging it.
+  export fail-quietly: func() -> result;
+
+  // Passes a plain object to `counters.reject` for its `counter`, and returns
+  // whether that throws a `TypeError`, and its message.
+  export plain-object-for-resource: func() -> string;
+
+  // Passes resources to imports in ways that do not lower, and returns the
+  // message of each `TypeError` that throws, or "no error": one wrapper for
+  // both `own` parameters of `thing.baz`, one wrapper in both records `b`
+  // takes, the borrowed `c` to `counters.reject`, and to `b` a record whose
+  // getter disposes of the resource the first record holds. Then returns the
+  // number of things `borrow-in-record.test` returns for one wrapper borrowed
+  // twice, and whether `thing.baz` then takes the wrapper of the first case.
+  export resource-misuse-messages: func(c: borrow<counter>) -> list<string>;
+}
diff --git a/componentize/tests/fixtures/serve.js b/componentize/tests/fixtures/serve.js
new file mode 100644
index 00000000..92d81503
--- /dev/null
+++ b/componentize/tests/fixtures/serve.js
@@ -0,0 +1,53 @@
+// SPDX-License-Identifier: Apache-2.0-WITH-LLVM-exception
+//
+// A serve application served by the runtime's native `wasi:http/handler`.
+//
+// The application registers its `fetch` listener after a top-level `await` on a
+// timer. The listener is in place before the component is wizened, so the first
+// request reaches it.
+//
+// For `/ready`, the listener writes to stdout and responds with the value the
+// top-level `await` waited for and the path. The top level writes to stdout
+// too, so the listener's write runs after the snapshot on a stream libc opens
+// again. For `/count`, the listener responds with the number of requests this instance
+// has served, and for `/echo-body` with the request's body. For `/no-response`
+// it does not call `respondWith`. For `/reject`, it leaves a rejected promise
+// unhandled and responds without waiting on anything. Otherwise the handler
+// echoes the request method and the URL's pathname into the response body,
+// after a `setTimeout` turn: `respondWith` is handed a promise that only
+// resolves after the timer fires, so a runtime that did not drive the request's
+// loop would never produce the body.
+
+const greeting = await new Promise((resolve) => setTimeout(() => resolve("ready"), 20));
+console.log(`top level ${greeting}`);
+
+let served = 0;
+
+addEventListener("fetch", (event) => {
+  served += 1;
+  const { pathname } = new URL(event.request.url);
+  if (pathname === "/ready") {
+    console.log(`handling ${event.request.url}`);
+    event.respondWith(new Response(`${greeting} ${pathname}`));
+  } else if (pathname === "/count") {
+    event.respondWith(new Response(String(served)));
+  } else if (pathname === "/echo-body") {
+    event.respondWith(event.request.text().then((text) => new Response(text)));
+  } else if (pathname === "/reject") {
+    Promise.reject(new Error("listener rejection"));
+    event.respondWith(new Response("ok"));
+  } else if (pathname !== "/no-response") {
+    event.respondWith(handle(event.request));
+  }
+});
+
+async function handle(request) {
+  await new Promise((resolve) => setTimeout(resolve, 5));
+
+  const url = new URL(request.url);
+  const body = `${request.method} ${url.pathname}`;
+  return new Response(body, {
+    status: 200,
+    headers: { "content-type": "text/plain" },
+  });
+}
diff --git a/componentize/tests/fixtures/serve.wit b/componentize/tests/fixtures/serve.wit
new file mode 100644
index 00000000..65cd6100
--- /dev/null
+++ b/componentize/tests/fixtures/serve.wit
@@ -0,0 +1,27 @@
+// SPDX-License-Identifier: Apache-2.0-WITH-LLVM-exception
+
+package test:serve;
+
+// The serve world for the componentize pipeline.
+//
+// The runtime already has a native `wasi:http/handler` export, StarlingMonkey's
+// web-platform serve path, which dispatches each incoming request as a `fetch`
+// event to the application's `addEventListener('fetch', …)` listeners. The
+// world declares that export so the finalized component keeps it. The
+// componentizer drops it from the world before generating the bindings (the
+// same handling as `wasi:cli/run`) and merges in the runtime's own `wasi:http`
+// package, so only the version has to match the builtin's. The interface is
+// empty because a declaration of it must match the runtime's on every item
+// both declare.
+//
+// The componentizer also adds an export the application can implement instead
+// of registering a listener (see `fixtures/serve_raw.js`). The component
+// exports whichever of the two the application provides as
+// `wasi:http/handler`.
+world serve {
+  export wasi:http/handler@0.3.0;
+}
+
+package wasi:http@0.3.0 {
+  interface handler {}
+}
diff --git a/componentize/tests/fixtures/serve_no_listener.js b/componentize/tests/fixtures/serve_no_listener.js
new file mode 100644
index 00000000..311fd3d0
--- /dev/null
+++ b/componentize/tests/fixtures/serve_no_listener.js
@@ -0,0 +1,7 @@
+// SPDX-License-Identifier: Apache-2.0-WITH-LLVM-exception
+//
+// A serve application that neither implements `wasi:http/handler` nor registers
+// a `fetch` listener. Its component could not serve any request, so
+// componentizing it fails.
+
+globalThis.__ready = true;
diff --git a/componentize/tests/fixtures/serve_raw.js b/componentize/tests/fixtures/serve_raw.js
new file mode 100644
index 00000000..7945e2e6
--- /dev/null
+++ b/componentize/tests/fixtures/serve_raw.js
@@ -0,0 +1,41 @@
+// SPDX-License-Identifier: Apache-2.0-WITH-LLVM-exception
+//
+// A serve application that implements `wasi:http/handler` itself instead of
+// registering a `fetch` listener, so the finalized component exports this
+// implementation as `wasi:http/handler`.
+//
+// The handler awaits a real `setTimeout`, so the export's per-call event loop
+// takes a turn, then responds with a `200` whose body holds the request's method
+// and path, which come from the imported `request` resource's methods. The
+// response is a `wasi:http/types` one, imported as `WasiResponse` so the global
+// `Response` stays visible. A request for `/fail` fails with the `error-code`
+// variant's `internal-error` case instead, thrown as an instance of `ErrorCode`,
+// the class of the handler's `err` type. A request for `/throw` throws an
+// `Error` before `handle` returns, and the `error-code` cannot hold it. The
+// handler is in the package layer.
+
+import { ErrorCode, Fields, Response as WasiResponse } from "wasi:http/types@0.3";
+
+export const wasiHttp = {
+  handler: {
+    handle(request) {
+      if (request.getPathWithQuery() === "/throw") {
+        throw new Error("boom from handle");
+      }
+      return respond(request);
+    },
+  },
+};
+
+async function respond(request) {
+  await new Promise((resolve) => setTimeout(resolve, 5));
+  const method = request.getMethod().tag;
+  const path = request.getPathWithQuery();
+  if (path === "/fail") {
+    throw new ErrorCode({ tag: "internalError", val: `raw ${method} ${path}` });
+  }
+  const body = new TextEncoder().encode(`raw ${method} ${path}`);
+  // The body is any iterable of chunks, and the trailers a promise of none.
+  const [response] = WasiResponse.new(new Fields(), [body], Promise.resolve(undefined));
+  return response;
+}
diff --git a/componentize/tests/fixtures/serve_raw_and_listener.js b/componentize/tests/fixtures/serve_raw_and_listener.js
new file mode 100644
index 00000000..618bea84
--- /dev/null
+++ b/componentize/tests/fixtures/serve_raw_and_listener.js
@@ -0,0 +1,15 @@
+// SPDX-License-Identifier: Apache-2.0-WITH-LLVM-exception
+//
+// A serve application that both implements `wasi:http/handler` and registers a
+// `fetch` listener. Only one of them can serve the component's export, so
+// componentizing it fails. The handler is in the interface layer.
+
+export const handler = {
+  async handle(_request) {
+    throw new ComponentError({ tag: "internalError", val: "unreachable" });
+  },
+};
+
+addEventListener("fetch", (event) => {
+  event.respondWith(new Response("unreachable"));
+});
diff --git a/componentize/tests/fixtures/serve_raw_response.js b/componentize/tests/fixtures/serve_raw_response.js
new file mode 100644
index 00000000..e7ac143b
--- /dev/null
+++ b/componentize/tests/fixtures/serve_raw_response.js
@@ -0,0 +1,88 @@
+// SPDX-License-Identifier: Apache-2.0-WITH-LLVM-exception
+//
+// A serve application whose own `wasi:http/handler` returns `Response` objects,
+// which lower to the handler's `wasi:http/types` `response`: the one `fetch`
+// resolves to for `/proxy`, the one `fetch` resolves to when it sends the
+// request itself for paths starting with `/echo`, one whose body a stream
+// produces after a timer per chunk for `/slow`, one whose body never produces
+// anything for `/stall`, one whose body was already read for `/used`, and a
+// constructed one otherwise. `handle` is a bare export.
+//
+// For `/plain-object` and `/unusable`, it passes a plain object and unusable
+// `Response`s where `Response.consumeBody` of `wasi:http/types` takes an owned
+// `response`, and responds with what each attempt threw.
+
+import { Response as WasiResponse } from "wasi:http/types@0.3";
+
+function attempt(out, label, response) {
+  try {
+    WasiResponse.consumeBody(response, Promise.resolve());
+    out.push(`${label}: sent`);
+  } catch (e) {
+    out.push(`${label}: ${e.constructor.name}: ${e.message}`);
+  }
+}
+
+export async function handle(request) {
+  const path = request.getPathWithQuery();
+  if (path === "/plain-object") {
+    let outcome;
+    try {
+      // @ts-expect-error A plain object is passed where a `Response` is expected.
+      WasiResponse.consumeBody({}, Promise.resolve());
+      outcome = "returned";
+    } catch (e) {
+      outcome = `threw ${e.constructor.name}: ${e.message}`;
+    }
+    return new Response(outcome);
+  }
+  if (path === "/unusable") {
+    const out = [];
+    const read = new Response("read");
+    await read.text();
+    attempt(out, "read", read);
+    const locked = new Response("locked");
+    locked.body?.getReader();
+    attempt(out, "locked", locked);
+    const fetched = await fetch("http://upstream.example/data");
+    attempt(out, "fetched", fetched);
+    attempt(out, "again", fetched);
+    await new Promise((resolve) => setTimeout(resolve, 5));
+    return new Response(out.join("\n"));
+  }
+  if (path === "/proxy") {
+    return await fetch("http://upstream.example/data");
+  }
+  if (path.startsWith("/echo")) {
+    return await fetch(request);
+  }
+  if (path === "/slow") {
+    const encoder = new TextEncoder();
+    let remaining = ["one ", "two ", "three"];
+    return new Response(
+      new ReadableStream({
+        async pull(controller) {
+          await new Promise((resolve) => setTimeout(resolve, 2));
+          const next = remaining.shift();
+          if (next === undefined) {
+            controller.close();
+          } else {
+            controller.enqueue(encoder.encode(next));
+          }
+        },
+      }),
+    );
+  }
+  if (path === "/stall") {
+    return new Response(new ReadableStream({ pull() { return new Promise(() => {}); } }));
+  }
+  if (path === "/used") {
+    const response = new Response("read already");
+    await response.text();
+    return response;
+  }
+  return new Response(`built ${path}`, {
+    status: 201,
+    headers: { "x-built": "yes" },
+  });
+}
diff --git a/componentize/tests/fixtures/serve_wasi_imports.js b/componentize/tests/fixtures/serve_wasi_imports.js
new file mode 100644
index 00000000..fc6c9651
--- /dev/null
+++ b/componentize/tests/fixtures/serve_wasi_imports.js
@@ -0,0 +1,27 @@
+// SPDX-License-Identifier: Apache-2.0-WITH-LLVM-exception
+//
+// A serve application importing interfaces the runtime imports, which the
+// `--export-cli` and `--export-http` worlds import for it. For `/seed`, it
+// responds with the high and low 64 bits `getInsecureSeed` returns.
+
+import { getArguments } from "wasi:cli/environment@0.3";
+import { getRandomBytes } from "wasi:random/random@0.3";
+import { now } from "wasi:clocks/monotonic-clock@0.3";
+import { getInsecureSeed } from "wasi:random/insecure-seed@0.3";
+
+addEventListener("fetch", (event) => {
+  if (new URL(event.request.url).pathname === "/seed") {
+    const [high, low] = getInsecureSeed();
+    event.respondWith(new Response(`${high},${low}`));
+    return;
+  }
+  event.respondWith(
+    new Response(
+      JSON.stringify({
+        arguments: Array.isArray(getArguments()),
+        random: getRandomBytes(16n).length,
+        clock: typeof now(),
+      }),
+    ),
+  );
+});
diff --git a/componentize/tests/fixtures/streams.js b/componentize/tests/fixtures/streams.js
new file mode 100644
index 00000000..bdc06394
--- /dev/null
+++ b/componentize/tests/fixtures/streams.js
@@ -0,0 +1,514 @@
+// SPDX-License-Identifier: Apache-2.0-WITH-LLVM-exception
+//
+// The Component Model streams and futures world guest module.
+//
+// A `stream<T>` argument arrives as a `ReadableStream`: a byte stream of
+// `Uint8Array` chunks for `stream<u8>`, and one chunk per element otherwise. A
+// `future<T>` argument arrives as a `Promise`. A `stream<T>` result may be any
+// `ReadableStream` or iterable, and a `future<T>` result any promise or value.
+//
+// `HostThing` is the class the runtime synthesized for the imported `host-thing`
+// resource: the elements of a `stream<host-thing>` are instances of it.
+
+import { HostThing } from "test:streams/host-thing-interface";
+import { Failure, lookup } from "test:streams/failing";
+import {
+  after,
+  count,
+  countTicks as hostCountTicks,
+  done,
+  later,
+  plusOne,
+  sum,
+  ticks,
+} from "test:streams/transfers";
+
+async function echoStreamIdiomatic(incoming) {
+  let { readable, writable } = new TransformStream();
+  incoming.pipeTo(writable);
+  return readable;
+}
+
+async function echoFutureIdiomatic(incoming) {
+  let value = await incoming;
+  return value;
+}
+
+function passStream(incoming) {
+  return incoming;
+}
+
+async function* reyield(incoming) {
+  for await (const element of incoming) {
+    yield element;
+  }
+}
+
+async function echoElements(incoming) {
+  return reyield(incoming);
+}
+
+// A guest-owned resource streamed as `stream<thing>`. Streaming a `thing` lifts
+// each incoming `own<thing>` to its slab object and lowers it back out.
+class Thing {
+  constructor(value) {
+    this.value_ = value;
+  }
+
+  get() {
+    return this.value_;
+  }
+}
+
+async function byobRead(incoming) {
+  const reader = incoming.getReader({ mode: "byob" });
+  const decoder = new TextDecoder();
+  let text = "";
+  let buffer = new ArrayBuffer(7);
+  for (;;) {
+    const { value, done } = await reader.read(new Uint8Array(buffer));
+    if (done) {
+      break;
+    }
+    text += decoder.decode(value, { stream: true });
+    buffer = value.buffer;
+  }
+  return text + decoder.decode();
+}
+
+function sleep(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+
+async function* timedChunks(count) {
+  for (let i = 0; i < count; i++) {
+    await sleep(2);
+    yield new Uint8Array([i]);
+  }
+}
+
+async function timedChunksExport(count) {
+  return timedChunks(count);
+}
+
+async function afterFirstChunk(incoming) {
+  const reader = incoming.getReader();
+  const { done } = await reader.read();
+  assert(!done, "expected a first chunk");
+  reader.releaseLock();
+  return incoming;
+}
+
+async function cancelAfterFirstChunk(incoming) {
+  const reader = incoming.getReader();
+  const { value, done } = await reader.read();
+  assert(!done, "expected a first chunk");
+  await reader.cancel("enough");
+  return value.length;
+}
+
+let endlessCancelled = false;
+
+function endless() {
+  return new ReadableStream({
+    pull(controller) {
+      controller.enqueue(new Uint8Array(1024));
+    },
+    cancel() {
+      endlessCancelled = true;
+    },
+  });
+}
+
+function wrongChunks() {
+  // @ts-expect-error TypeScript's DOM library has no `ReadableStream.from`.
+  return ReadableStream.from(["not", "bytes"]);
+}
+
+function notAStream() {
+  return 42;
+}
+
+// An async export returning a `future<T>` returns the future itself: the
+// function's own promise becomes the future, so these settle it after the call
+// has returned.
+async function futureResult(ok, value) {
+  await sleep(1);
+  if (ok) {
+    return value;
+  }
+  throw new Error(value);
+}
+
+async function futureResultBare(value) {
+  await sleep(1);
+  throw value;
+}
+
+async function describeFutureResult(incoming) {
+  try {
+    return `ok: ${await incoming}`;
+  } catch (e) {
+    return `err: ${e instanceof ComponentError} ${e.payload}`;
+  }
+}
+
+async function describeFailureFuture(incoming) {
+  try {
+    return `ok: ${await incoming}`;
+  } catch (e) {
+    return [
+      e instanceof Failure,
+      e instanceof ComponentError,
+      e.name,
+      JSON.stringify(e.payload),
+    ].join(" ");
+  }
+}
+
+// The imported `lookup` fails with an instance of `Failure`, the class of its
+// `err` type, which extends `ComponentError`.
+async function describeLookup(key) {
+  try {
+    return `found ${await lookup(key)}`;
+  } catch (e) {
+    return [
+      e instanceof Failure,
+      e instanceof ComponentError,
+      e.name,
+      JSON.stringify(e.payload),
+    ].join(" ");
+  }
+}
+
+async function forwardLookup(key) {
+  return await lookup(key);
+}
+
+async function futureDenied() {
+  await sleep(1);
+  throw new Error("denied");
+}
+
+// Read every host thing, check each one, then return them all.
+async function shortReadsHost(incoming) {
+  const things = [];
+  for await (const thing of incoming) {
+    things.push(thing);
+  }
+  const expected = ["a", "b", "c", "d", "e"];
+  assert(
+    things.length === expected.length,
+    `expected ${expected.length} things, got ${things.length}`,
+  );
+  for (let i = 0; i < things.length; i++) {
+    assert(things[i] instanceof HostThing, `element ${i} is not a HostThing`);
+    assert(things[i].get() === expected[i], `element ${i} get() is not ${expected[i]}`);
+    assert(
+      HostThing.getStatic(things[i]) === expected[i],
+      `element ${i} getStatic() is not ${expected[i]}`,
+    );
+  }
+  return things;
+}
+
+// A stream and a future passed to imports, and the ones imports return.
+async function useTransfers() {
+  const total = await sum([1, 2, 3, 4]);
+  const counted = [];
+  for await (const value of await count(3)) {
+    counted.push(value);
+  }
+  const delivered = await later(7);
+  const incremented = await plusOne(Promise.resolve(41));
+  return `sum=${total} count=${counted.join(",")} later=${delivered} plus-one=${incremented}`;
+}
+
+/** @param {ReadableStream<undefined>} incoming */
+async function countTicks(incoming) {
+  let n = 0;
+  for await (const chunk of incoming) {
+    if (chunk !== undefined) {
+      throw new Error(`chunk ${n} is ${chunk}, not undefined`);
+    }
+    n++;
+  }
+  return n;
+}
+
+/** @param {number} n */
+function makeTicks(n) {
+  return new ReadableStream({
+    start(controller) {
+      for (let i = 0; i < n; i++) {
+        controller.enqueue(undefined);
+      }
+      controller.close();
+    },
+  });
+}
+
+async function useTickTransfers() {
+  const fromArray = await hostCountTicks([undefined, undefined, undefined]);
+  const fromStream = await hostCountTicks(makeTicks(70));
+  const received = await countTicks(await ticks(5));
+  await done();
+  const afterPromise = await after(sleep(1).then(() => undefined), 1);
+  const afterValue = await after(undefined, 2);
+  const afterHostFuture = await after(done(), 3);
+  return [
+    `array=${fromArray}`,
+    `stream=${fromStream}`,
+    `ticks=${received}`,
+    `after=${afterPromise},${afterValue},${afterHostFuture}`,
+  ].join(" ");
+}
+
+async function* manyStrings() {
+  for (let i = 0; i < 50; i++) {
+    yield `s${i}`.repeat(20);
+  }
+}
+
+async function* manyLists() {
+  for (let i = 0; i < 50; i++) {
+    yield new Uint32Array(8 + (i % 5));
+  }
+}
+
+function stringLater() {
+  return sleep(1).then(() => "later".repeat(20));
+}
+
+/** @param {string} s */
+async function ping(s) {
+  await sleep(5);
+  return `${s}${s.length}`;
+}
+
+function arrayBufferChunks() {
+  // @ts-expect-error TypeScript's DOM library has no `ReadableStream.from`.
+  return ReadableStream.from([new Uint8Array([1, 2]).buffer, new Uint8Array([3]).buffer]);
+}
+
+function emptyChunks() {
+  // @ts-expect-error TypeScript's DOM library has no `ReadableStream.from`.
+  return ReadableStream.from([
+    new Uint8Array(0),
+    new Uint8Array([1]),
+    new ArrayBuffer(0),
+    new Uint8Array([2, 3]),
+    new Uint8Array(0),
+  ]);
+}
+
+function lockedStream() {
+  const stream = new ReadableStream();
+  stream.getReader();
+  return stream;
+}
+
+async function plusOnePlain() {
+  return await plusOne(41);
+}
+
+function wrongPoints() {
+  // @ts-expect-error TypeScript's DOM library has no `ReadableStream.from`.
+  return ReadableStream.from([{ x: 1, y: 2 }, { x: "a", y: 3 }]);
+}
+
+function shiftingPoints() {
+  let reads = 0;
+  // @ts-expect-error TypeScript's DOM library has no `ReadableStream.from`.
+  return ReadableStream.from([{ get x() { return ++reads === 1 ? 1 : "a"; }, y: 2 }]);
+}
+
+function rejectLater() {
+  return sleep(1).then(() => {
+    throw new Error("no value");
+  });
+}
+
+async function slowFuture(value) {
+  await sleep(20);
+  return value;
+}
+
+async function thingFuture(value) {
+  await sleep(1);
+  return new Thing(value);
+}
+
+async function cancelPendingRead(incoming) {
+  const reader = incoming.getReader();
+  const read = reader.read();
+  await sleep(5);
+  await reader.cancel("waited long enough");
+  const { done } = await read;
+  return done ? "cancelled" : "read a chunk";
+}
+
+let idleCancelled = false;
+
+function idleStream() {
+  return new ReadableStream({
+    start(controller) {
+      controller.enqueue(new Uint8Array([1]));
+    },
+    pull() {
+      return new Promise(() => {});
+    },
+    cancel() {
+      idleCancelled = true;
+    },
+  });
+}
+
+async function streamMisuseMessages() {
+  const locked = new ReadableStream();
+  locked.getReader();
+  const messages = [];
+  for (const arg of [5, {}, locked]) {
+    messages.push(await sum(/** @type {any} */ (arg)).then(
+      () => "no error",
+      (e) => e instanceof TypeError ? e.message : `not a TypeError: ${e}`,
+    ));
+  }
+  messages.push(String(await sum(/** @type {any} */ (new Set([1, 2])))));
+  return messages;
+}
+
+/** @type {ReadableStream<Uint8Array> | null} */
+let heldStream = null;
+let syncReadMessage = "none";
+
+function syncStreamMessage() {
+  const recorded = syncReadMessage;
+  if (heldStream) {
+    heldStream.getReader().read().then(
+      () => { syncReadMessage = "the read succeeded in a sync export"; },
+      (e) => { syncReadMessage = e instanceof TypeError ? e.message : String(e); },
+    );
+    heldStream = null;
+  }
+  return recorded;
+}
+
+function assert(condition, message) {
+  if (!condition) {
+    throw new Error(message);
+  }
+}
+
+/** @type {(value: number) => void} */
+let settleHeld = () => {};
+
+/** @type {WeakRef<Promise<number>> | null} */
+let unreferencedFuture = null;
+
+/** A promise that never settles, which only `unreferencedFuture` references. */
+function unreferencedNeverFuture() {
+  const promise = new Promise(() => {});
+  unreferencedFuture = new WeakRef(promise);
+  return promise;
+}
+
+/**
+ * Allocate garbage and wait on timers until the promise `unreferencedNeverFuture`
+ * returned is collected, for at most 1000 turns. Returns whether it was. Each
+ * turn's allocation stays referenced into the next turn, so it outlives a minor
+ * collection and the tenured heap grows until a major collection runs. The
+ * allocation comes before the `deref` in each turn, since `deref` keeps the
+ * target alive until the turn ends.
+ */
+async function collectUnreferencedFuture() {
+  const future = unreferencedFuture;
+  if (future === null) {
+    throw new Error('unreferencedNeverFuture has not been called');
+  }
+  let retained = null;
+  let collected = false;
+  for (let turn = 0; turn < 1000 && !collected; turn++) {
+    retained = Array.from({ length: 20000 }, (_, i) => ({ i, s: `garbage ${i}` }));
+    collected = future.deref() === undefined;
+    await new Promise((resolve) => setTimeout(resolve, 0));
+  }
+  retained = null;
+  return collected;
+}
+
+export const echoes = {
+  Thing,
+  echoStreamU8: echoStreamIdiomatic,
+  passStreamU8: passStream,
+  echoFutureString: echoFutureIdiomatic,
+  echoFutureU32: echoFutureIdiomatic,
+  echoStreamString: echoElements,
+  echoStreamPoint: echoElements,
+  echoStreamThing: echoElements,
+  byobRead,
+  timedChunks: timedChunksExport,
+  afterFirstChunk,
+  cancelAfterFirstChunk,
+  endless,
+  endlessCancelled: () => endlessCancelled,
+  wrongChunks,
+  notAStream,
+  futureResult,
+  futureResultBare,
+  describeFutureResult,
+  describeFailureFuture,
+  describeLookup,
+  forwardLookup,
+  futureDenied,
+  shortReadsHost,
+  useTransfers,
+  wrongPoints,
+  arrayBufferChunks,
+  emptyChunks,
+  manyStrings: async () => manyStrings(),
+  manyLists: async () => manyLists(),
+  stringLater,
+  ping,
+  lockedStream,
+  plusOnePlain,
+  shiftingPoints,
+  slowFuture,
+  rejectedFuture: rejectLater,
+  rejectedResultFuture: rejectLater,
+  thingFuture,
+  cancelPendingRead,
+  passAsBytes: passStream,
+  idleStream,
+  idleCancelled: () => idleCancelled,
+  streamMisuseMessages,
+  holdStream: async (s) => { heldStream = s; },
+  syncStreamMessage,
+  neverFuture: () => new Promise(() => {}),
+  unreferencedNeverFuture,
+  collectUnreferencedFuture,
+  heldFuture: () => new Promise((resolve) => { settleHeld = resolve; }),
+  /** @param {number} value */
+  settleHeldFuture(value) { settleHeld(value); },
+  /** @param {number} value */
+  settleHeldFutureAsync: async (value) => { settleHeld(value); },
+  /** @param {string} value */
+  disposedThingFuture(value) {
+    const thing = new HostThing(value);
+    setTimeout(() => thing[Symbol.dispose](), 0);
+    return Promise.resolve(thing);
+  },
+  echoTicks: echoElements,
+  passTicks: passStream,
+  echoDone: echoFutureIdiomatic,
+  countTicks,
+  /** @param {Promise<void>} incoming */
+  describeDone: async (incoming) => String(await incoming),
+  makeTicks,
+  makeDone: () => sleep(1).then(() => undefined),
+  useTickTransfers,
+  // @ts-expect-error TypeScript's DOM library has no `ReadableStream.from`.
+  wrongTicks: () => ReadableStream.from([undefined, 7, undefined]),
+  valuedDone: () => sleep(1).then(() => 5),
+  rejectedDone: rejectLater,
+};
diff --git a/componentize/tests/fixtures/streams.wit b/componentize/tests/fixtures/streams.wit
new file mode 100644
index 00000000..9d34bb96
--- /dev/null
+++ b/componentize/tests/fixtures/streams.wit
@@ -0,0 +1,218 @@
+// SPDX-License-Identifier: Apache-2.0-WITH-LLVM-exception
+
+package test:streams;
+
+// The streams and futures world. A `stream<T>` crosses into JS as a
+// `ReadableStream` and a `future<T>` as a `Promise`, in both directions. See
+// `streams.js` for what each export does with them.
+
+interface host-thing-interface {
+  resource host-thing {
+    constructor(s: string);
+    get: func() -> string;
+    get-static: static func(v: borrow<host-thing>) -> string;
+  }
+}
+
+interface failing {
+  variant failure {
+    denied,
+    not-found(string),
+  }
+
+  // Fails with `not-found(key)` unless `key` is "present".
+  lookup: async func(key: string) -> result<string, failure>;
+}
+
+// Imported functions that take and return streams and futures.
+interface transfers {
+  // Returns the sum of the stream's elements.
+  sum: async func(s: stream<u32>) -> u32;
+  // Returns a stream of the numbers from 0 up to `n`, exclusive.
+  count: async func(n: u32) -> stream<u32>;
+  // Returns a future that delivers `v`.
+  later: async func(v: u32) -> future<u32>;
+  // Returns the future's value plus one.
+  plus-one: async func(f: future<u32>) -> u32;
+  // Returns the number of elements of a stream without a payload type.
+  count-ticks: async func(s: stream) -> u32;
+  // Returns a stream without a payload type of `n` elements.
+  ticks: async func(n: u32) -> stream;
+  // Returns a future without a payload type the host has written.
+  done: async func() -> future;
+  // Returns `n` once the future without a payload type is written.
+  after: async func(f: future, n: u32) -> u32;
+}
+
+interface echoes {
+  use host-thing-interface.{host-thing};
+  use failing.{failure};
+
+  record point {
+    x: u32,
+    y: u32,
+  }
+
+  type byte = u8;
+
+  resource thing {
+    constructor(value: string);
+    get: func() -> string;
+  }
+
+  // Pipes the incoming stream through a `TransformStream`.
+  echo-stream-u8: async func(s: stream<u8>) -> stream<u8>;
+  // Returns the incoming stream as it is.
+  pass-stream-u8: async func(s: stream<u8>) -> stream<u8>;
+  // Awaits the incoming future and returns its value.
+  echo-future-string: async func(f: future<string>) -> future<string>;
+  echo-future-u32: async func(f: future<u32>) -> future<u32>;
+  // Re-yield every element of the incoming stream from an async generator.
+  echo-stream-string: async func(s: stream<string>) -> stream<string>;
+  echo-stream-point: async func(s: stream<point>) -> stream<point>;
+  echo-stream-thing: async func(s: stream<thing>) -> stream<thing>;
+
+  // Reads the stream with a BYOB reader and returns its bytes as a string.
+  byob-read: async func(s: stream<u8>) -> string;
+  // Returns `count` one-byte chunks, each produced after a timer.
+  timed-chunks: async func(count: u32) -> stream<u8>;
+  // Reads the first chunk, then returns the rest of the stream.
+  after-first-chunk: async func(s: stream<u8>) -> stream<u8>;
+  // Reads one chunk, cancels the stream, and returns how many bytes it read.
+  cancel-after-first-chunk: async func(s: stream<u8>) -> u32;
+  // Returns a stream that produces chunks until it is cancelled.
+  endless: async func() -> stream<u8>;
+  // Whether the stream `endless` returned was cancelled.
+  endless-cancelled: async func() -> bool;
+  // Return 50 strings, 50 `list<u32>`s and, after a timer, a string, for the
+  // host to drop the reader of while a write is pending.
+  many-strings: async func() -> stream<string>;
+  many-lists: async func() -> stream<list<u32>>;
+  string-later: async func() -> future<string>;
+  // Returns `s` followed by its length, after a timer.
+  ping: async func(s: string) -> string;
+  // Returns a stream of two `ArrayBuffer` chunks holding 1, 2 and 3.
+  array-buffer-chunks: async func() -> stream<u8>;
+  // Returns a stream holding 1, 2 and 3, with empty `Uint8Array` and
+  // `ArrayBuffer` chunks before, between and after them.
+  empty-chunks: async func() -> stream<u8>;
+  // Returns a `ReadableStream` a reader has locked.
+  locked-stream: async func() -> stream<u8>;
+  // Passes the number 41, not a promise, to `transfers.plus-one` as its future.
+  plus-one-plain: async func() -> u32;
+  // Returns a stream whose chunks are strings, which a `stream<u8>` cannot hold.
+  wrong-chunks: async func() -> stream<u8>;
+  // Returns a value that is not a stream.
+  not-a-stream: async func() -> stream<u8>;
+
+  // Fulfills with `value` if `ok`, and otherwise rejects with `new Error(value)`.
+  future-result: async func(ok: bool, value: string) -> future<result<string, string>>;
+  // Rejects with the bare string `value`.
+  future-result-bare: async func(value: string) -> future<result<string, string>>;
+  // Awaits the future and describes how it settled.
+  describe-future-result: async func(f: future<result<string, string>>) -> string;
+  // Awaits a future whose `err` is a `failure`, and describes how it settled.
+  describe-failure-future: async func(f: future<result<string, failure>>) -> string;
+
+  // Calls `failing.lookup(key)` and describes how it failed.
+  describe-lookup: async func(key: string) -> string;
+  // Fails with the error `lookup(key)` fails with.
+  forward-lookup: async func(key: string) -> result<string, failure>;
+  // Rejects with `new Error("denied")`, which names a case of `failure`.
+  future-denied: async func() -> future<result<string, failure>>;
+
+  // Reads every host thing, checks each, then returns them all as a stream.
+  short-reads-host: async func(s: stream<host-thing>) -> stream<host-thing>;
+
+  // Calls every function of `transfers` and describes the results.
+  use-transfers: async func() -> string;
+  // Returns a stream of two points, the second with a string for `x`.
+  wrong-points: async func() -> stream<point>;
+  // Returns a stream of one point whose `x` getter returns 1 on its first read
+  // and a string after that.
+  shifting-points: async func() -> stream<point>;
+  // Returns a future that delivers `v` after a timer.
+  slow-future: async func(v: u32) -> future<u32>;
+  // Returns a future whose promise rejects after a timer, which a `future<u32>`
+  // has no way to deliver.
+  rejected-future: async func() -> future<u32>;
+  // Returns a future whose promise rejects with an `Error` after a timer, which
+  // a `u32` `err` cannot hold.
+  rejected-result-future: async func() -> future<result<u32, u32>>;
+  // Returns a future that delivers a new `thing` holding `value`.
+  thing-future: async func(value: string) -> future<thing>;
+  // Starts reading the stream, cancels the read after a timer, and returns the
+  // reason the cancel was for.
+  cancel-pending-read: async func(s: stream<u8>) -> string;
+  // Returns the incoming stream as a stream of `byte`, a type the incoming one
+  // is not.
+  pass-as-bytes: async func(s: stream<u8>) -> stream<byte>;
+  // Returns a stream with one byte whose source never produces another.
+  idle-stream: async func() -> stream<u8>;
+  // Whether the stream `idle-stream` returned was cancelled.
+  idle-cancelled: async func() -> bool;
+
+  // Passes 5, `{}` and a locked `ReadableStream` to `transfers.sum`, and
+  // returns the message of each `TypeError` it rejects with, or "no error".
+  // Then returns the sum of a `Set` of 1 and 2 passed as the stream.
+  stream-misuse-messages: async func() -> list<string>;
+  // Stores the stream unread for `sync-stream-message`.
+  hold-stream: async func(s: stream<u8>);
+  // Starts reading the stream `hold-stream` stored, which a sync export has no
+  // event loop for, and returns the rejection's message a previous call
+  // recorded, or "none".
+  sync-stream-message: func() -> string;
+
+  // Returns a future whose promise never settles.
+  never-future: async func() -> future<u32>;
+  // Returns a future whose promise never settles, and which the guest only
+  // references weakly.
+  unreferenced-never-future: async func() -> future<u32>;
+  // Allocates garbage and waits on timers until the promise
+  // `unreferenced-never-future` returned is collected, and returns whether it
+  // was.
+  collect-unreferenced-future: async func() -> bool;
+  // Returns a future that delivers a host thing holding `value`, which a timer
+  // disposes of once the promise fulfilled.
+  disposed-thing-future: async func(value: string) -> future<host-thing>;
+
+  // Returns a future whose promise a later call to one of the two below
+  // fulfills with `value`.
+  held-future: async func() -> future<u32>;
+  settle-held-future: func(value: u32);
+  settle-held-future-async: async func(value: u32);
+
+  // Streams and futures without a payload type.
+  //
+  // Re-yields every element of the incoming stream from an async generator.
+  echo-ticks: async func(s: stream) -> stream;
+  // Returns the incoming stream as it is.
+  pass-ticks: async func(s: stream) -> stream;
+  // Awaits the incoming future and returns its value.
+  echo-done: async func(f: future) -> future;
+  // Reads the stream and returns how many chunks it had. Fails if a chunk is
+  // not `undefined`.
+  count-ticks: async func(s: stream) -> u32;
+  // Awaits the future and returns its value converted to a string.
+  describe-done: async func(f: future) -> string;
+  // Returns a `ReadableStream` of `n` `undefined` chunks.
+  make-ticks: async func(n: u32) -> stream;
+  // Returns a future whose promise fulfills with `undefined` after a timer.
+  make-done: async func() -> future;
+  // Calls the functions of `transfers` that take and return streams and
+  // futures without a payload type, and describes the results.
+  use-tick-transfers: async func() -> string;
+  // Returns a stream of `undefined`, 7 and `undefined`.
+  wrong-ticks: async func() -> stream;
+  // Returns a future whose promise fulfills with 5 after a timer.
+  valued-done: async func() -> future;
+  // Returns a future whose promise rejects after a timer.
+  rejected-done: async func() -> future;
+}
+
+world streams {
+  import host-thing-interface;
+  import failing;
+  import transfers;
+  export echoes;
+}
diff --git a/componentize/tests/fixtures/surface.js b/componentize/tests/fixtures/surface.js
new file mode 100644
index 00000000..986dec76
--- /dev/null
+++ b/componentize/tests/fixtures/surface.js
@@ -0,0 +1,18 @@
+// SPDX-License-Identifier: Apache-2.0-WITH-LLVM-exception
+//
+// The surface-world guest module.
+
+import { log } from "external";
+
+export function run(n) {
+  log(`run ${n}`);
+  return n + 1;
+}
+
+export function random() {
+  return Math.random();
+}
+
+export function now() {
+  return Date.now();
+}
diff --git a/componentize/tests/fixtures/surface.wit b/componentize/tests/fixtures/surface.wit
new file mode 100644
index 00000000..23bde885
--- /dev/null
+++ b/componentize/tests/fixtures/surface.wit
@@ -0,0 +1,15 @@
+// SPDX-License-Identifier: Apache-2.0-WITH-LLVM-exception
+
+package test:surface;
+
+// The surface world: what a componentized custom world exports and imports.
+//
+// `run` is the sanity call, and `random` reads `Math.random`, which reaches
+// `wasi:random`, so a build with `random` disabled traps in it. `now` reads
+// `Date.now()`, which a build with `clocks` disabled reads as zero.
+world surface {
+  import log: func(msg: string);
+  export run: func(n: u32) -> u32;
+  export random: func() -> f64;
+  export now: func() -> f64;
+}
diff --git a/componentize/tests/fixtures/sync_suite.js b/componentize/tests/fixtures/sync_suite.js
new file mode 100644
index 00000000..ba3c0e76
--- /dev/null
+++ b/componentize/tests/fixtures/sync_suite.js
@@ -0,0 +1,149 @@
+// SPDX-License-Identifier: Apache-2.0-WITH-LLVM-exception
+//
+// The sync-suite guest module.
+//
+// Every echo handler forwards the value to the host import of the same name, so
+// a marshalling bug in either direction (lift on the import, lower on the
+// import return, lower on the export return) fails the round-trip. Exports are
+// provided in the package layer, as members of `testSyncSuite`.
+
+import * as echoes from "test:sync-suite/echoes";
+import * as hostThingInterface from "test:sync-suite/host-thing-interface";
+
+const echoesImpl = {
+  echoNothing: function () {
+    return echoes.echoNothing();
+  },
+  echoBool: function (v) {
+    return echoes.echoBool(v);
+  },
+  echoU8: function (v) {
+    return echoes.echoU8(v);
+  },
+  echoS8: function (v) {
+    return echoes.echoS8(v);
+  },
+  echoU16: function (v) {
+    return echoes.echoU16(v);
+  },
+  echoS16: function (v) {
+    return echoes.echoS16(v);
+  },
+  echoU32: function (v) {
+    return echoes.echoU32(v);
+  },
+  echoS32: function (v) {
+    return echoes.echoS32(v);
+  },
+  echoU64: function (v) {
+    return echoes.echoU64(v);
+  },
+  echoS64: function (v) {
+    return echoes.echoS64(v);
+  },
+  echoChar: function (v) {
+    return echoes.echoChar(v);
+  },
+  echoF32: function (v) {
+    return echoes.echoF32(v);
+  },
+  echoF64: function (v) {
+    return echoes.echoF64(v);
+  },
+  echoString: function (v) {
+    return echoes.echoString(v);
+  },
+  echoListBool: function (v) {
+    return echoes.echoListBool(v);
+  },
+  echoListU8: function (v) {
+    return echoes.echoListU8(v);
+  },
+  echoListListU8: function (v) {
+    return echoes.echoListListU8(v);
+  },
+  echoListListListU8: function (v) {
+    return echoes.echoListListListU8(v);
+  },
+  echoOptionU8: function (v) {
+    return echoes.echoOptionU8(v);
+  },
+  echoOptionOptionU8: function (v) {
+    return echoes.echoOptionOptionU8(v);
+  },
+  echoResultU8U8: function (v) {
+    return echoes.echoResultU8U8(v);
+  },
+  echoResultResultU8U8U8: function (v) {
+    return echoes.echoResultResultU8U8U8(v);
+  },
+  echoListS8: function (v) {
+    return echoes.echoListS8(v);
+  },
+  echoListU16: function (v) {
+    return echoes.echoListU16(v);
+  },
+  echoListS16: function (v) {
+    return echoes.echoListS16(v);
+  },
+  echoListU32: function (v) {
+    return echoes.echoListU32(v);
+  },
+  echoListS32: function (v) {
+    return echoes.echoListS32(v);
+  },
+  echoListU64: function (v) {
+    return echoes.echoListU64(v);
+  },
+  echoListS64: function (v) {
+    return echoes.echoListS64(v);
+  },
+  echoListChar: function (v) {
+    return echoes.echoListChar(v);
+  },
+  echoListF32: function (v) {
+    return echoes.echoListF32(v);
+  },
+  echoListF64: function (v) {
+    return echoes.echoListF64(v);
+  },
+  echoListString: function (v) {
+    return echoes.echoListString(v);
+  },
+  echoMany: function (v1, v2, v3, v4, v5, v6, v7, v8, v9, v10, v11, v12, v13, v14, v15, v16) {
+    return echoes.echoMany(
+      v1, v2, v3, v4, v5, v6, v7, v8, v9, v10, v11, v12, v13, v14, v15, v16,
+    );
+  },
+  echoResource: function (v) {
+    return echoes.echoResource(v);
+  },
+  acceptBorrow: function (v) {
+    return echoes.acceptBorrow(v);
+  },
+  echoRecord: function (v) {
+    return echoes.echoRecord(v);
+  },
+  echoEnum: function (v) {
+    return echoes.echoEnum(v);
+  },
+  echoVariant: function (v) {
+    return echoes.echoVariant(v);
+  },
+};
+
+const hostThingDriverImpl = {
+  drive: function (s) {
+    const thing = new hostThingInterface.HostThing(s);
+    const a = thing.get();
+    const b = hostThingInterface.HostThing.getStatic(thing);
+    return `${a}|${b}`;
+  },
+};
+
+// The package layer of the export names: `test:sync-suite`'s interfaces
+// are members of `testSyncSuite`.
+export const testSyncSuite = {
+  echoes: echoesImpl,
+  hostThingDriver: hostThingDriverImpl,
+};
diff --git a/componentize/tests/fixtures/sync_suite.wit b/componentize/tests/fixtures/sync_suite.wit
new file mode 100644
index 00000000..2be0480e
--- /dev/null
+++ b/componentize/tests/fixtures/sync_suite.wit
@@ -0,0 +1,100 @@
+// SPDX-License-Identifier: Apache-2.0-WITH-LLVM-exception
+
+package test:sync-suite;
+
+// Every WIT value type but flags, exported and imported resources, and sync imports.
+
+interface types {
+  resource resource-type { }
+
+  record record-type {
+    a: u32,
+    b: string,
+    c: result<u32, u64>,
+  }
+
+  enum enum-type {
+    a,
+    b,
+    c
+  }
+
+  variant variant-type {
+    a(u32),
+    b(string),
+    c(result<u32, u64>),
+    d
+  }
+}
+
+interface echoes {
+  use types.{resource-type, record-type, enum-type, variant-type};
+
+  echo-nothing: func();
+  echo-bool: func(v: bool) -> bool;
+  echo-u8: func(v: u8) -> u8;
+  echo-s8: func(v: s8) -> s8;
+  echo-u16: func(v: u16) -> u16;
+  echo-s16: func(v: s16) -> s16;
+  echo-u32: func(v: u32) -> u32;
+  echo-s32: func(v: s32) -> s32;
+  echo-char: func(v: char) -> char;
+  echo-u64: func(v: u64) -> u64;
+  echo-s64: func(v: s64) -> s64;
+  echo-f32: func(v: f32) -> f32;
+  echo-f64: func(v: f64) -> f64;
+  echo-string: func(v: string) -> string;
+  echo-list-bool: func(v: list<bool>) -> list<bool>;
+  echo-list-u8: func(v: list<u8>) -> list<u8>;
+  echo-list-s8: func(v: list<s8>) -> list<s8>;
+  echo-list-u16: func(v: list<u16>) -> list<u16>;
+  echo-list-s16: func(v: list<s16>) -> list<s16>;
+  echo-list-u32: func(v: list<u32>) -> list<u32>;
+  echo-list-s32: func(v: list<s32>) -> list<s32>;
+  echo-list-char: func(v: list<char>) -> list<char>;
+  echo-list-u64: func(v: list<u64>) -> list<u64>;
+  echo-list-s64: func(v: list<s64>) -> list<s64>;
+  echo-list-f32: func(v: list<f32>) -> list<f32>;
+  echo-list-f64: func(v: list<f64>) -> list<f64>;
+  echo-list-string: func(v: list<string>) -> list<string>;
+  echo-list-list-u8: func(v: list<list<u8>>) -> list<list<u8>>;
+  echo-list-list-list-u8: func(v: list<list<list<u8>>>) -> list<list<list<u8>>>;
+  echo-option-u8: func(v: option<u8>) -> option<u8>;
+  echo-option-option-u8: func(v: option<option<u8>>) -> option<option<u8>>;
+  echo-result-u8-u8: func(v: result<u8, u8>) -> result<u8, u8>;
+  echo-result-result-u8-u8-u8: func(v: result<result<u8, u8>, u8>) -> result<result<u8, u8>, u8>;
+  echo-many: func(v1: bool, v2: u8, v3: u16, v4: u32, v5: u64, v6: s8, v7: s16, v8: s32, v9: s64, v10: f32, v11: f64, v12: char, v13: string, v14: list<bool>, v15: list<u8>, v16: list<u16>) -> tuple<bool, u8, u16, u32, u64, s8, s16, s32, s64, f32, f64, char, string, list<bool>, list<u8>, list<u16>>;
+  echo-resource: func(v: resource-type) -> resource-type;
+  accept-borrow: func(v: borrow<resource-type>);
+  echo-record: func(v: record-type) -> record-type;
+  echo-enum: func(v: enum-type) -> enum-type;
+  echo-variant: func(v: variant-type) -> variant-type;
+}
+
+interface host-thing-interface {
+  resource host-thing {
+    constructor(s: string);
+    get: func() -> string;
+    get-static: static func(v: borrow<host-thing>) -> string;
+  }
+}
+
+// Sync driver for the imported `host-thing` resource. This small sync exported
+// interface drives the imported resource's
+// constructor / instance method / static method / borrow through the real
+// import-synthesis path.
+interface host-thing-driver {
+  use host-thing-interface.{host-thing};
+
+  // Construct a `host-thing` from `s`, call `.get()`, then `HostThing.getStatic`
+  // on it, and return both results joined as "<get>|<get-static>".
+  drive: func(s: string) -> string;
+}
+
+world sync-suite {
+  import echoes;
+  export echoes;
+
+  import host-thing-interface;
+  export host-thing-driver;
+}
diff --git a/componentize/tests/fixtures/top_level.wit b/componentize/tests/fixtures/top_level.wit
new file mode 100644
index 00000000..9d4c2b39
--- /dev/null
+++ b/componentize/tests/fixtures/top_level.wit
@@ -0,0 +1,15 @@
+// SPDX-License-Identifier: Apache-2.0-WITH-LLVM-exception
+
+package test:top-level;
+
+// The top-level world: what the main module's top level may do before the
+// component is wizened.
+//
+// `greeting` returns what the top level computed: a value from a module it
+// imports by relative path, and one a top-level `await` waited on a timer for.
+// `log-event` is never called: a top-level call of it fails componentization.
+world top-level {
+  import log-event: func(event: string);
+
+  export greeting: func() -> string;
+}
diff --git a/componentize/tests/fixtures/top_level/entry.js b/componentize/tests/fixtures/top_level/entry.js
new file mode 100644
index 00000000..fc88b537
--- /dev/null
+++ b/componentize/tests/fixtures/top_level/entry.js
@@ -0,0 +1,10 @@
+// SPDX-License-Identifier: Apache-2.0-WITH-LLVM-exception
+//
+// A main module that a module it imports imports back. The importer gets this
+// module itself, so its top level runs once.
+
+import { entryType } from "./lib/back.js";
+
+globalThis.entryRuns = (globalThis.entryRuns ?? 0) + 1;
+export const marker = {};
+export const greeting = () => `${globalThis.entryRuns} ${entryType()}`;
diff --git a/componentize/tests/fixtures/top_level/lib/back.js b/componentize/tests/fixtures/top_level/lib/back.js
new file mode 100644
index 00000000..594a76bf
--- /dev/null
+++ b/componentize/tests/fixtures/top_level/lib/back.js
@@ -0,0 +1,7 @@
+// SPDX-License-Identifier: Apache-2.0-WITH-LLVM-exception
+//
+// Imports the main module `entry.js` back.
+
+import * as entry from "../entry.js";
+
+export const entryType = () => typeof entry.marker;
diff --git a/componentize/tests/fixtures/top_level/lib/config.json b/componentize/tests/fixtures/top_level/lib/config.json
new file mode 100644
index 00000000..e9a05908
--- /dev/null
+++ b/componentize/tests/fixtures/top_level/lib/config.json
@@ -0,0 +1 @@
+{ "punctuation": "!" }
diff --git a/componentize/tests/fixtures/top_level/lib/late.js b/componentize/tests/fixtures/top_level/lib/late.js
new file mode 100644
index 00000000..9d9572e5
--- /dev/null
+++ b/componentize/tests/fixtures/top_level/lib/late.js
@@ -0,0 +1,3 @@
+// SPDX-License-Identifier: Apache-2.0-WITH-LLVM-exception
+
+export const late = "and a dynamic import";
diff --git a/componentize/tests/fixtures/top_level/lib/name.js b/componentize/tests/fixtures/top_level/lib/name.js
new file mode 100644
index 00000000..61fa9cde
--- /dev/null
+++ b/componentize/tests/fixtures/top_level/lib/name.js
@@ -0,0 +1,3 @@
+// SPDX-License-Identifier: Apache-2.0-WITH-LLVM-exception
+
+export const name = "from a relative import";
diff --git a/componentize/tests/fixtures/top_level/main.js b/componentize/tests/fixtures/top_level/main.js
new file mode 100644
index 00000000..3b057585
--- /dev/null
+++ b/componentize/tests/fixtures/top_level/main.js
@@ -0,0 +1,18 @@
+// SPDX-License-Identifier: Apache-2.0-WITH-LLVM-exception
+//
+// The top-level-world guest module.
+//
+// It imports a module by relative path and a JSON module, both resolved against
+// the base directory at componentize time, awaits a dynamic import and a timer
+// at top level, and writes to stdout. The export is a `const` declared after the
+// `await`s, so it is only initialized once the top level has finished
+// evaluating.
+
+import { name } from "./lib/name.js";
+import config from "./lib/config.json" with { type: "json" };
+
+const { late } = await import("./lib/late.js");
+const suffix = await new Promise((resolve) => setTimeout(() => resolve("after a timer"), 20));
+console.log("top level finished");
+
+export const greeting = () => `hello ${name} ${late} ${suffix}${config.punctuation}`;
diff --git a/componentize/tests/fixtures/values.js b/componentize/tests/fixtures/values.js
new file mode 100644
index 00000000..41886148
--- /dev/null
+++ b/componentize/tests/fixtures/values.js
@@ -0,0 +1,148 @@
+// SPDX-License-Identifier: Apache-2.0-WITH-LLVM-exception
+//
+// The values-world guest module.
+//
+// Flags arrive and leave as numbers holding the bit set, enums as case
+// indices, `u64`s as bigints, `list<u64>` as a `BigUint64Array`, and a
+// `result` argument as `{ tag, val }`. Every function of an imported and
+// exported interface forwards to the host import of the same name and adds a
+// change of its own on the way back.
+//
+// The exports use every shape of export names: `flags`, `variants` and `many`
+// in the package layer, `keywords` as bare exports, `strings` and `checks` in
+// the interface layer, and the world-level `fallible` as a bare export.
+
+import * as flags from "test:values/flags";
+import { type as hostType } from "test:values/keyword-imports";
+import { echoRecord as hostEchoRecord } from "test:values/keywords";
+import * as variants from "test:values/variants";
+import * as many from "test:values/many";
+import { Failure, KvError } from "external";
+import { KvError as KvErrorCases } from "test:values/errors";
+
+const flagsImpl = {
+  roundtripFlag1: (f) => flags.roundtripFlag1(f) | 1,
+  roundtripFlag2: (f) => flags.roundtripFlag2(f) | 1,
+  roundtripFlag4: (f) => flags.roundtripFlag4(f) | 1,
+  roundtripFlag8: (f) => flags.roundtripFlag8(f) | 1,
+  roundtripFlag16: (f) => flags.roundtripFlag16(f) | 1,
+  // `1 << 31` is a negative int32, which lowers as bit 31.
+  roundtripFlag32: (f) => flags.roundtripFlag32(f) | (1 << 31),
+};
+
+export const func = (v) => hostType(v) + 1;
+export const echoRecord = (record) => hostEchoRecord(record);
+
+const variantsImpl = {
+  casts: (a, b, c, d, e, f) => variants.casts(a, b, c, d, e, f),
+  echoListVariant: (v) => variants.echoListVariant(v),
+  echoResult(v) {
+    try {
+      return variants.echoResult(v);
+    } catch (e) {
+      // A host `err` arrives as a `ComponentError` whose payload is the
+      // `list<u8>`. Anything else is a guest bug and traps.
+      if (!(e instanceof ComponentError) || !(e.payload instanceof Uint8Array)) {
+        throw new Error(`unexpected import failure: ${e}`);
+      }
+      throw new ComponentError(e.payload);
+    }
+  },
+  failWith(bytes) {
+    throw new ComponentError(bytes);
+  },
+};
+
+const manyImpl = {
+  manyArgs(...args) {
+    // @ts-expect-error The sixteen arguments are passed on as they came.
+    const list = many.manyArgs(...args);
+    if (!(list instanceof BigUint64Array)) {
+      throw new Error(`list<u64> must lift to a BigUint64Array, got ${list}`);
+    }
+    return list;
+  },
+  bigArgument: (x) => many.bigArgument(x),
+};
+
+export const strings = {
+  echo: (s) => s,
+  hello: () => "hello",
+};
+
+export const checks = {
+  bytesFromArray: (n) => Array.from({ length: n }, (_, i) => i & 0xff),
+  badPoint: () => ({ x: 310, y: 1 }),
+  badImportArgument() {
+    const field = (i) => `value${i}`;
+    // Deliberately not a `BigStruct`: `a1` becomes a number below.
+    /** @type {any} */
+    const record = Object.fromEntries(
+      Array.from({ length: 20 }, (_, i) => [`a${i + 1}`, field(i + 1)]),
+    );
+    record.a1 = 5;
+    try {
+      many.bigArgument(record);
+    } catch (e) {
+      if (e instanceof TypeError) {
+        return e.message;
+      }
+      throw e;
+    }
+    throw new Error("bigArgument accepted a number for a string field");
+  },
+  async promised() {
+    return "never lowered";
+  },
+  enumObjects: () =>
+    JSON.stringify([
+      flags.Flag2.b1,
+      flags.Flag32.b31,
+      flags.Flag32[-2147483648],
+      Object.isFrozen(flags.Flag4),
+      KvErrorCases.denied,
+      KvErrorCases[0],
+      Object.isFrozen(KvErrorCases),
+      KvError.prototype instanceof ComponentError,
+    ]),
+  shiftingImportArgument() {
+    let reads = 0;
+    /** @type {any} */
+    const record = Object.fromEntries(
+      Array.from({ length: 20 }, (_, i) => [`a${i + 1}`, `value${i + 1}`]),
+    );
+    Object.defineProperty(record, "a1", {
+      get: () => (++reads === 1 ? "first" : 5),
+      enumerable: true,
+    });
+    return many.bigArgument(record).a1;
+  },
+  loneSurrogates: () => "a\uD800b\uDC00c",
+  loneSurrogateChar: () => "\uD800",
+};
+
+export function fallible(worse) {
+  if (!(Failure.prototype instanceof ComponentError)) {
+    throw new Error("Failure must extend ComponentError");
+  }
+  throw new Failure(worse ? { tag: "worse" } : { tag: "bad", val: "bad" });
+}
+
+// An `Error` names an enum `err` case by its message, and a `KvError` holds the
+// case's index.
+export function lookup(key) {
+  if (key === "missing") {
+    throw new Error("notFound");
+  }
+  if (key === "secret") {
+    throw new KvError(1);
+  }
+  return key;
+}
+
+export async function lookupAsync(key) {
+  await new Promise((resolve) => setTimeout(resolve, 1));
+  return lookup(key);
+}
+
+export const testValues = { flags: flagsImpl, variants: variantsImpl, many: manyImpl };
diff --git a/componentize/tests/fixtures/values.wit b/componentize/tests/fixtures/values.wit
new file mode 100644
index 00000000..6882a42d
--- /dev/null
+++ b/componentize/tests/fixtures/values.wit
@@ -0,0 +1,242 @@
+// SPDX-License-Identifier: Apache-2.0-WITH-LLVM-exception
+
+package test:values;
+
+// Value shapes the sync suite's echoes do not reach: flags of every width,
+// escaped keyword identifiers, variants whose payloads pun the same flat
+// slots, a `list<variant>`, `result<string, list<u8>>` in both directions,
+// sixteen `u64` arguments and a twenty-string record, a plain string
+// export for large payloads and repeated calls, and checks of the values the
+// guest passes and returns.
+//
+// Every interface but `errors`, `strings` and `checks` is imported and
+// exported: the guest forwards each call to the host import and adds its own
+// change on the way back, so the value crosses the boundary in both
+// directions.
+
+interface %flags {
+  flags flag1 {
+    b0,
+  }
+
+  flags flag2 {
+    b0, b1,
+  }
+
+  flags flag4 {
+    b0, b1, b2, b3,
+  }
+
+  flags flag8 {
+    b0, b1, b2, b3, b4, b5, b6, b7,
+  }
+
+  flags flag16 {
+    b0, b1, b2, b3, b4, b5, b6, b7,
+    b8, b9, b10, b11, b12, b13, b14, b15,
+  }
+
+  flags flag32 {
+    b0, b1, b2, b3, b4, b5, b6, b7,
+    b8, b9, b10, b11, b12, b13, b14, b15,
+    b16, b17, b18, b19, b20, b21, b22, b23,
+    b24, b25, b26, b27, b28, b29, b30, b31,
+  }
+
+  // Each round trip sets the width's highest bit on the host and `b0` in the
+  // guest. `roundtrip-flag32` sets `b31` in the guest and `b0` on the host.
+  roundtrip-flag1: func(x: flag1) -> flag1;
+  roundtrip-flag2: func(x: flag2) -> flag2;
+  roundtrip-flag4: func(x: flag4) -> flag4;
+  roundtrip-flag8: func(x: flag8) -> flag8;
+  roundtrip-flag16: func(x: flag16) -> flag16;
+  roundtrip-flag32: func(x: flag32) -> flag32;
+}
+
+// Imported only: wasmtime's bindgen cannot name an export after `type`, so
+// the guest reaches this function from `keywords.%func`.
+interface keyword-imports {
+  type %flags = s32;
+
+  // The host adds one.
+  %type: func(v: u32) -> %flags;
+}
+
+interface keywords {
+  use keyword-imports.{%flags};
+
+  record %record {
+    %type: u32,
+    %flags: u32,
+  }
+
+  // Calls `keyword-imports.%type` and adds one more.
+  %func: func(v: u32) -> %flags;
+
+  // The host swaps the fields.
+  echo-record: func(%record: %record) -> %record;
+}
+
+interface variants {
+  variant casts1 {
+    a(s32),
+    b(f32),
+  }
+
+  variant casts2 {
+    a(f64),
+    b(f32),
+  }
+
+  variant casts3 {
+    a(f64),
+    b(u64),
+  }
+
+  variant casts4 {
+    a(u32),
+    b(s64),
+  }
+
+  variant casts5 {
+    a(f32),
+    b(s64),
+  }
+
+  variant casts6 {
+    a(tuple<f32, u32>),
+    b(tuple<u32, u32>),
+  }
+
+  casts: func(
+    a: casts1,
+    b: casts2,
+    c: casts3,
+    d: casts4,
+    e: casts5,
+    f: casts6,
+  ) -> tuple<casts1, casts2, casts3, casts4, casts5, casts6>;
+
+  variant v1 {
+    a,
+    b(u32),
+    c(string),
+  }
+
+  // The host reverses the list.
+  echo-list-variant: func(v: list<v1>) -> list<v1>;
+
+  // The host appends "!" to an `ok` string and reverses the bytes of an `err`.
+  echo-result: func(v: result<string, list<u8>>) -> result<string, list<u8>>;
+
+  // The guest throws a `ComponentError` whose payload is `bytes`. The host
+  // import returns it as `err`.
+  fail-with: func(bytes: list<u8>) -> result<string, list<u8>>;
+}
+
+interface many {
+  // The host returns the arguments as a list, so the guest receives a
+  // `BigUint64Array` and lowers it back.
+  many-args: func(
+    a1: u64, a2: u64, a3: u64, a4: u64, a5: u64, a6: u64, a7: u64, a8: u64,
+    a9: u64, a10: u64, a11: u64, a12: u64, a13: u64, a14: u64, a15: u64, a16: u64,
+  ) -> list<u64>;
+
+  record big-struct {
+    a1: string, a2: string, a3: string, a4: string, a5: string,
+    a6: string, a7: string, a8: string, a9: string, a10: string,
+    a11: string, a12: string, a13: string, a14: string, a15: string,
+    a16: string, a17: string, a18: string, a19: string, a20: string,
+  }
+
+  // The host appends the field name to every field.
+  big-argument: func(x: big-struct) -> big-struct;
+}
+
+interface strings {
+  echo: func(s: string) -> string;
+  hello: func() -> string;
+}
+
+// Types only. The world `use`s `failure`, so its error class is exported from
+// the world-level module, `external`, although the world imports no function
+// of its own.
+interface errors {
+  variant failure {
+    bad(string),
+    worse,
+  }
+
+  enum kv-error {
+    not-found,
+    denied,
+  }
+}
+
+interface checks {
+  record point {
+    x: u8,
+    y: u8,
+  }
+
+  // The guest returns a plain `Array` of the numbers 0 to n - 1, each modulo 256.
+  bytes-from-array: func(n: u32) -> list<u8>;
+
+  // The guest returns `{ x: 310, y: 1 }`, which traps, since `x` does not fit
+  // a `u8`.
+  bad-point: func() -> point;
+
+  // The guest calls `many.big-argument` with a number for `a1`, and returns the
+  // message of the `TypeError` that throws.
+  bad-import-argument: func() -> string;
+
+  // The guest calls `many.big-argument` with a record whose `a1` getter returns
+  // "first" on its first read and a number after that, and returns the `a1` of
+  // the host's result.
+  shifting-import-argument: func() -> string;
+
+  // Implemented as an `async` method, so it returns a promise, which a
+  // function WIT does not declare `async` cannot return.
+  promised: func() -> string;
+
+  // The guest returns, as JSON, members of the objects the `flags` and
+  // `errors` modules export for their flags and enum types, and whether
+  // `external`'s `KvError` is the error class of the world's `kv-error`.
+  enum-objects: func() -> string;
+
+  // Returns "a", a lone high surrogate, "b", a lone low surrogate and "c".
+  lone-surrogates: func() -> string;
+
+  // Returns a lone high surrogate.
+  lone-surrogate-char: func() -> char;
+}
+
+world values {
+  use errors.{failure, kv-error};
+
+  import %flags;
+  export %flags;
+
+  import keyword-imports;
+  import keywords;
+  export keywords;
+
+  import variants;
+  export variants;
+
+  import many;
+  export many;
+
+  export strings;
+  export checks;
+
+  // The guest throws `failure.worse` if `worse` is set, and `failure.bad`
+  // holding "bad" otherwise, as an instance of the `Failure` class.
+  export fallible: func(worse: bool) -> result<u32, failure>;
+
+  // The guest returns `key` for "present", throws an `Error` whose message is
+  // `notFound` for "missing", and throws a `KvError` holding `denied` for
+  // "secret". `lookup-async` rejects the same ways.
+  export lookup: func(key: string) -> result<string, kv-error>;
+  export lookup-async: async func(key: string) -> result<string, kv-error>;
+}
diff --git a/componentize/tests/fixtures/wit_dir.js b/componentize/tests/fixtures/wit_dir.js
new file mode 100644
index 00000000..164cb068
--- /dev/null
+++ b/componentize/tests/fixtures/wit_dir.js
@@ -0,0 +1,39 @@
+// SPDX-License-Identifier: Apache-2.0-WITH-LLVM-exception
+//
+// The wit-dir world guest module.
+//
+// The two versions of `local:hello/hello` are distinct modules, imported under
+// their full specifiers. The two exported versions share every other export
+// name, so each is exported under its full WIT name. The inline `exports`
+// interface is in the interface layer, and the world-level `make-bar` is a
+// bare export.
+
+import { hello as hello1 } from "local:hello/hello@1";
+import { hello as hello2 } from "local:hello/hello@2";
+import { hello as helloOther } from "local:other/hello";
+
+const helloV1 = {
+  hello: (name) => hello1(name),
+};
+
+const helloV2 = {
+  hello: (name) => hello2(name),
+};
+
+export { helloV1 as "local:hello/hello@1.0.0", helloV2 as "local:hello/hello@2.0.0" };
+
+export const exports = {
+  hello(name) {
+    if (name === "hello") {
+      return `world ${name} (${hello1("world")})`;
+    }
+    if (name === "other") {
+      return `world ${name} (${helloOther("world")})`;
+    }
+    return `world unknown ${name}`;
+  },
+};
+
+export function makeBar() {
+  return { thing: 5 };
+}
diff --git a/componentize/tests/fixtures/wit_dir/deps/b/b.wit b/componentize/tests/fixtures/wit_dir/deps/b/b.wit
new file mode 100644
index 00000000..debb3931
--- /dev/null
+++ b/componentize/tests/fixtures/wit_dir/deps/b/b.wit
@@ -0,0 +1,9 @@
+// SPDX-License-Identifier: Apache-2.0-WITH-LLVM-exception
+
+package local:b;
+
+interface foo {
+  record bar {
+    thing: u8,
+  }
+}
diff --git a/componentize/tests/fixtures/wit_dir/deps/hello-1.0.0/hello.wit b/componentize/tests/fixtures/wit_dir/deps/hello-1.0.0/hello.wit
new file mode 100644
index 00000000..a61f02cf
--- /dev/null
+++ b/componentize/tests/fixtures/wit_dir/deps/hello-1.0.0/hello.wit
@@ -0,0 +1,7 @@
+// SPDX-License-Identifier: Apache-2.0-WITH-LLVM-exception
+
+package local:hello@1.0.0;
+
+interface hello {
+  hello: func(name: string) -> string;
+}
diff --git a/componentize/tests/fixtures/wit_dir/deps/hello-2.0.0/hello.wit b/componentize/tests/fixtures/wit_dir/deps/hello-2.0.0/hello.wit
new file mode 100644
index 00000000..4adff208
--- /dev/null
+++ b/componentize/tests/fixtures/wit_dir/deps/hello-2.0.0/hello.wit
@@ -0,0 +1,7 @@
+// SPDX-License-Identifier: Apache-2.0-WITH-LLVM-exception
+
+package local:hello@2.0.0;
+
+interface hello {
+  hello: func(name: option<string>) -> option<string>;
+}
diff --git a/componentize/tests/fixtures/wit_dir/deps/other/hello.wit b/componentize/tests/fixtures/wit_dir/deps/other/hello.wit
new file mode 100644
index 00000000..9471a13a
--- /dev/null
+++ b/componentize/tests/fixtures/wit_dir/deps/other/hello.wit
@@ -0,0 +1,7 @@
+// SPDX-License-Identifier: Apache-2.0-WITH-LLVM-exception
+
+package local:other;
+
+interface hello {
+  hello: func(name: string) -> string;
+}
diff --git a/componentize/tests/fixtures/wit_dir/world.wit b/componentize/tests/fixtures/wit_dir/world.wit
new file mode 100644
index 00000000..83eefdd4
--- /dev/null
+++ b/componentize/tests/fixtures/wit_dir/world.wit
@@ -0,0 +1,25 @@
+// SPDX-License-Identifier: Apache-2.0-WITH-LLVM-exception
+
+package test:wit-dir;
+
+// A WIT directory with `deps/`: two versions of `local:hello/hello` imported
+// and exported at once, the interface name `hello` from a third package, and
+// a world-level `use` of a dependency package's record.
+
+world versions {
+  use local:b/foo.{bar};
+
+  import local:hello/hello@1.0.0;
+  export local:hello/hello@1.0.0;
+  import local:hello/hello@2.0.0;
+  export local:hello/hello@2.0.0;
+  import local:other/hello;
+
+  export exports: interface {
+    // "hello" and "other" select the import that `world` is forwarded to.
+    // Any other name is returned after "world unknown".
+    hello: func(name: string) -> string;
+  }
+
+  export make-bar: func() -> bar;
+}
diff --git a/componentize/tests/fixtures/world_resource.js b/componentize/tests/fixtures/world_resource.js
new file mode 100644
index 00000000..26f60abe
--- /dev/null
+++ b/componentize/tests/fixtures/world_resource.js
@@ -0,0 +1,7 @@
+// SPDX-License-Identifier: Apache-2.0-WITH-LLVM-exception
+//
+// The world-resource guest module: add one to the borrowed host thing.
+
+export function f(thing) {
+  thing.set(thing.get() + 1);
+}
diff --git a/componentize/tests/fixtures/world_resource.wit b/componentize/tests/fixtures/world_resource.wit
new file mode 100644
index 00000000..cc2190da
--- /dev/null
+++ b/componentize/tests/fixtures/world_resource.wit
@@ -0,0 +1,18 @@
+// SPDX-License-Identifier: Apache-2.0-WITH-LLVM-exception
+
+package test:world-resource;
+
+// A resource declared directly in the world, with methods. The guest never
+// constructs one: its only export receives a borrow and drives the resource
+// through `get` and `set`.
+
+world world-resource {
+  resource thing {
+    constructor(v: u32);
+    get: func() -> u32;
+    set: func(v: u32);
+  }
+
+  // Add one to the thing through its `get` and `set` methods.
+  export f: func(thing: borrow<thing>);
+}
diff --git a/componentize/tests/lowering.rs b/componentize/tests/lowering.rs
new file mode 100644
index 00000000..66b744bd
--- /dev/null
+++ b/componentize/tests/lowering.rs
@@ -0,0 +1,298 @@
+// SPDX-License-Identifier: Apache-2.0-WITH-LLVM-exception
+
+//! Import arguments and stream elements whose state JavaScript changes after the call that passes
+//! them: the world of `fixtures/lowering.{wit,js}`, whose guest passes resource wrappers, streams
+//! and typed arrays to host imports, then disposes of, reuses or changes them, and describes what
+//! the imports received.
+
+mod shared;
+
+use shared::collect_all;
+use tokio::sync::OnceCell;
+use wasmtime::component::{Accessor, FutureReader, HasSelf, Resource, StreamReader};
+use wasmtime::{Engine, Store};
+use wasmtime_wasi::p2::pipe::MemoryOutputPipe;
+use wasmtime_wasi::{WasiCtxView, WasiView};
+
+wasmtime::component::bindgen!({
+    path: "tests/fixtures/lowering.wit",
+    world: "lowering",
+    imports: { default: async },
+    exports: { default: async },
+    with: {
+        "test:lowering/host.thing": ThingValue,
+        "test:lowering/host.bare": BareValue,
+    },
+});
+
+/// The host's representation of a `thing`: its value.
+pub struct ThingValue(u32);
+
+/// The host's representation of a `bare`: its value.
+pub struct BareValue(u32);
+
+struct Ctx {
+    wasi: shared::Wasi,
+    /// The future `accept` received.
+    accepted: Option<FutureReader<u32>>,
+    /// How many `thing`s the guest dropped.
+    thing_drops: u32,
+}
+
+impl WasiView for Ctx {
+    fn ctx(&mut self) -> WasiCtxView<'_> {
+        self.wasi.view()
+    }
+}
+
+impl test::lowering::host::Host for Ctx {
+    async fn take_two(&mut self, _s: StreamReader<u32>, t: Resource<ThingValue>) -> u32 {
+        self.wasi.table().delete(t).expect("a live thing").0
+    }
+
+    async fn make_bare(&mut self) -> Resource<BareValue> {
+        self.wasi
+            .table()
+            .push(BareValue(77))
+            .expect("pushing a bare")
+    }
+
+    async fn bare_value(&mut self, b: Resource<BareValue>) -> u32 {
+        self.wasi.table().get(&b).expect("a live bare").0
+    }
+
+    async fn accept(&mut self, f: FutureReader<u32>) {
+        self.accepted = Some(f);
+    }
+}
+
+impl test::lowering::host::HostThing for Ctx {
+    async fn new(&mut self, v: u32) -> Resource<ThingValue> {
+        self.wasi
+            .table()
+            .push(ThingValue(v))
+            .expect("pushing a thing")
+    }
+
+    async fn drop(&mut self, rep: Resource<ThingValue>) -> wasmtime::Result<()> {
+        self.wasi.table().delete(rep)?;
+        self.thing_drops += 1;
+        Ok(())
+    }
+}
+
+impl test::lowering::host::HostBare for Ctx {
+    async fn drop(&mut self, rep: Resource<BareValue>) -> wasmtime::Result<()> {
+        self.wasi.table().delete(rep)?;
+        Ok(())
+    }
+}
+
+impl test::lowering::host::HostWithStore<Ctx> for HasSelf<Ctx> {
+    async fn consume(accessor: &Accessor<Ctx, Self>, t: Resource<ThingValue>) -> u32 {
+        tokio::task::yield_now().await;
+        accessor.with(|mut access| access.get().wasi.table().delete(t).expect("a live thing").0)
+    }
+
+    async fn peek(accessor: &Accessor<Ctx, Self>, t: Resource<ThingValue>) -> u32 {
+        tokio::task::yield_now().await;
+        accessor.with(|mut access| access.get().wasi.table().get(&t).expect("a live thing").0)
+    }
+
+    async fn first_byte(_accessor: &Accessor<Ctx, Self>, data: Vec<u8>) -> u32 {
+        data[0].into()
+    }
+
+    async fn drain(accessor: &Accessor<Ctx, Self>, s: StreamReader<u32>) -> u32 {
+        let (values, _) = collect_all(accessor, s).await.expect("reading the stream");
+        values.into_iter().sum()
+    }
+}
+
+static ENGINE: std::sync::LazyLock<Engine> = std::sync::LazyLock::new(shared::engine);
+
+/// Componentize the lowering world once and hold the instantiation-ready `Pre`.
+async fn pre() -> &'static LoweringPre<Ctx> {
+    static PRE: OnceCell<Result<LoweringPre<Ctx>, String>> = OnceCell::const_new();
+    shared::build_once(&PRE, async {
+        let component = shared::compile_fixture(
+            &ENGINE,
+            include_str!("fixtures/lowering.wit"),
+            "lowering",
+            include_str!("fixtures/lowering.js"),
+        )
+        .await;
+        let linker = shared::linker(&ENGINE, &component, &["test:lowering/"], |linker| {
+            Lowering::add_to_linker::<_, HasSelf<_>>(linker, |ctx| ctx)
+        });
+        LoweringPre::new(linker.instantiate_pre(&component).expect("instantiate_pre"))
+            .expect("LoweringPre")
+    })
+    .await
+}
+
+/// A fresh store whose stderr goes to the returned pipe.
+fn store() -> (Store<Ctx>, MemoryOutputPipe) {
+    let (wasi, stderr) = shared::wasi_capturing_stderr();
+    let ctx = Ctx {
+        wasi,
+        accepted: None,
+        thing_drops: 0,
+    };
+    (Store::new(&ENGINE, ctx), stderr)
+}
+
+/// Run the guest's case `which` and return its description.
+async fn run(which: &str) -> anyhow::Result<String> {
+    let (mut store, _) = store();
+    run_in(&mut store, which).await
+}
+
+/// [`run`] in `store`.
+async fn run_in(store: &mut Store<Ctx>, which: &str) -> anyhow::Result<String> {
+    let instance = pre().await.instantiate_async(&mut *store).await?;
+    let which = which.to_string();
+    let described = store
+        .run_concurrent(async |store| instance.test_lowering_runner().call_run(store, which).await)
+        .await??;
+    Ok(described)
+}
+
+/// A wrapper passed as an `own` moves to the host when the call starts, so a
+/// dispose right after it does nothing.
+#[tokio::test]
+async fn dispose_after_an_own_argument_does_nothing() -> anyhow::Result<()> {
+    assert_eq!(run("disposeAfterConsume").await?, "ok 5");
+    Ok(())
+}
+
+/// A wrapper passed as an `own` to two calls started together rejects the
+/// second with a `TypeError`.
+#[tokio::test]
+async fn own_argument_to_two_pending_calls_rejects_the_second() -> anyhow::Result<()> {
+    assert_eq!(
+        run("consumeTwice").await?,
+        "TypeError: argument 1 of `consume`: the resource was disposed of, or moved to the host"
+    );
+    Ok(())
+}
+
+/// A wrapper disposed of while an import call borrows it is dropped once the
+/// call returns.
+#[tokio::test]
+async fn dispose_waits_for_a_pending_borrow() -> anyhow::Result<()> {
+    let (mut store, _) = store();
+    assert_eq!(run_in(&mut store, "disposeWhilePeeked").await?, "ok 6");
+    assert_eq!(store.data().thing_drops, 1);
+    Ok(())
+}
+
+/// A wrapper an import call borrows cannot be passed as an `own` until that
+/// call returns.
+#[tokio::test]
+async fn own_argument_while_borrowed_rejects() -> anyhow::Result<()> {
+    assert_eq!(
+        run("consumeWhilePeeked").await?,
+        "TypeError: argument 1 of `consume`: the resource is lent to an import call that has \
+         not returned, ok 3"
+    );
+    Ok(())
+}
+
+/// A `ReadableStream` passed to two calls started together rejects the second
+/// with a `TypeError`.
+#[tokio::test]
+async fn stream_argument_to_two_pending_calls_rejects_the_second() -> anyhow::Result<()> {
+    assert_eq!(
+        run("drainTwice").await?,
+        "TypeError: argument 1 of `drain`: the stream is locked"
+    );
+    Ok(())
+}
+
+/// A typed array is read when the call starts, so changing it afterwards does
+/// not change what the host receives.
+#[tokio::test]
+async fn typed_array_argument_is_read_when_the_call_starts() -> anyhow::Result<()> {
+    assert_eq!(run("changeBufferAfterCall").await?, "ok 1");
+    Ok(())
+}
+
+/// A stream argument's source runs after the call's arguments were lowered, so
+/// it cannot dispose of a later argument before the host receives it.
+#[tokio::test]
+async fn stream_source_runs_after_the_arguments_are_lowered() -> anyhow::Result<()> {
+    assert_eq!(run("pullDisposesArgument").await?, "ok 9");
+    Ok(())
+}
+
+/// An imported resource with no constructor, method or static function has a
+/// class, and its wrappers have `[Symbol.dispose]()`.
+#[tokio::test]
+async fn bare_imported_resource_has_a_class() -> anyhow::Result<()> {
+    assert_eq!(run("bareResource").await?, "function true 77");
+    Ok(())
+}
+
+/// A stream element holding a wrapper an earlier element holds ends the stream
+/// early, after the elements before it, and logs why. Chunks the source enqueues
+/// together are written together, and a later chunk finds the wrapper moved.
+#[tokio::test]
+async fn repeated_resource_in_a_stream_ends_it_early() -> anyhow::Result<()> {
+    for (together, reason) in [
+        (true, "the resource is used elsewhere in the same call"),
+        (false, "the resource was disposed of, or moved to the host"),
+    ] {
+        let (mut store, stderr) = store();
+        let instance = pre().await.instantiate_async(&mut store).await?;
+        let (received, ended) = store
+            .run_concurrent(async |store| {
+                let runner = instance.test_lowering_runner();
+                let things = runner.call_things(store, together).await?;
+                collect_all(store, things).await
+            })
+            .await??;
+        assert!(ended, "the stream must end");
+        assert_eq!(received.len(), 1);
+        let stderr = shared::pipe_text(&stderr);
+        assert!(
+            stderr.contains(&format!("ended the stream early: a chunk: {reason}")),
+            "{stderr}"
+        );
+    }
+    Ok(())
+}
+
+/// A sync export cannot pass a future to an import, since no event loop would
+/// write it. The import call throws a `TypeError` naming the export.
+#[tokio::test]
+async fn future_argument_in_a_sync_export_throws() -> anyhow::Result<()> {
+    let (mut store, _) = store();
+    let instance = pre().await.instantiate_async(&mut store).await?;
+    let described = instance
+        .test_lowering_runner()
+        .call_give(&mut store)
+        .await?;
+    assert!(
+        described.starts_with(
+            "TypeError: argument 1 of `accept`: passing a future needs an active event loop"
+        ) && described.contains("`test:lowering/runner#give`"),
+        "{described}"
+    );
+    assert!(store.data().accepted.is_none());
+    Ok(())
+}
+
+/// An exported resource's method is looked up on the instance, so a subclass's
+/// override runs.
+#[tokio::test]
+async fn exported_method_dispatches_on_the_instance() -> anyhow::Result<()> {
+    let (mut store, _) = store();
+    let instance = pre().await.instantiate_async(&mut store).await?;
+    let widget = instance.test_lowering_runner().widget();
+    let sub = widget.call_make(&mut store, true).await?;
+    assert_eq!(widget.call_get(&mut store, sub).await?, 2);
+    let base = widget.call_make(&mut store, false).await?;
+    assert_eq!(widget.call_get(&mut store, base).await?, 1);
+    Ok(())
+}
diff --git a/componentize/tests/resources.rs b/componentize/tests/resources.rs
new file mode 100644
index 00000000..b2cbb6aa
--- /dev/null
+++ b/componentize/tests/resources.rs
@@ -0,0 +1,633 @@
+// SPDX-License-Identifier: Apache-2.0-WITH-LLVM-exception
+
+//! Resource handles nested in aggregates, shared across interfaces, declared at world level, and
+//! disposed during a call: the world of `fixtures/resources.{wit,js}`. Every interface but
+//! `counters` is imported and exported, so the host holds the imported resources in its table, and
+//! the guest wraps each one in a class of its own that the host calls through the exported
+//! interface.
+
+mod shared;
+
+use {
+    std::sync::LazyLock,
+    tokio::sync::OnceCell,
+    wasmtime::{
+        component::{HasSelf, Resource, ResourceType},
+        Engine, Store,
+    },
+    wasmtime_wasi::{WasiCtxView, WasiView},
+};
+
+wasmtime::component::bindgen!({
+    path: "tests/fixtures/resources.wit",
+    world: "resources",
+    imports: { default: async },
+    exports: { default: async },
+    with: {
+        "test:resources/aggregates.thing": AggregatesThing,
+        "test:resources/borrow-in-record.thing": BorrowInRecordThing,
+        "test:resources/alias1.thing": AliasThing,
+        "test:resources/import-and-export.thing": ImportAndExportThing,
+        "test:resources/counters.counter": HostCounterValue,
+    },
+});
+
+use test::resources::{aggregates, alias1, alias2, borrow_in_record, counters, import_and_export};
+
+/// The host `aggregates.thing`: the constructor argument plus two.
+pub struct AggregatesThing(u32);
+
+/// The host `borrow-in-record.thing`: the constructor string with a suffix.
+pub struct BorrowInRecordThing(String);
+
+/// The host `alias1.thing`, which `alias2` shares through `use`.
+pub struct AliasThing(String);
+
+/// The host `import-and-export.thing`: the constructor argument plus one.
+pub struct ImportAndExportThing(u32);
+
+/// The host `counters.counter`.
+pub struct HostCounterValue(u32);
+
+struct Ctx {
+    wasi: shared::Wasi,
+    /// How many times the host dropped a `counter`, so a call that disposes a
+    /// borrowed counter can be checked not to have dropped the host's resource.
+    counter_drops: u32,
+}
+
+impl WasiView for Ctx {
+    fn ctx(&mut self) -> WasiCtxView<'_> {
+        self.wasi.view()
+    }
+}
+
+static ENGINE: LazyLock<Engine> = LazyLock::new(shared::engine);
+
+/// Componentize the resources world once and hold the instantiation-ready `Pre`.
+async fn pre() -> &'static ResourcesPre<Ctx> {
+    static PRE: OnceCell<Result<ResourcesPre<Ctx>, String>> = OnceCell::const_new();
+    shared::build_once(&PRE, async {
+        let component = shared::compile_fixture(
+            &ENGINE,
+            include_str!("fixtures/resources.wit"),
+            "resources",
+            include_str!("fixtures/resources.js"),
+        )
+        .await;
+
+        let linker = shared::linker(&ENGINE, &component, &["test:resources/"], |linker| {
+            Resources::add_to_linker::<_, HasSelf<_>>(linker, |ctx| ctx)?;
+            // The world-level `use`s import `thing` and `counter` at the root as
+            // aliases of the interfaces' resources. Bindgen registers only resources
+            // the world declares itself, and `trap_unsatisfied_imports` would stub
+            // the two with a resource type of its own, which the linker then rejects
+            // as a mismatch, so they are defined here.
+            for (name, ty) in [
+                ("thing", ResourceType::host::<AliasThing>()),
+                ("counter", ResourceType::host::<HostCounterValue>()),
+            ] {
+                linker.root().resource(name, ty, |_, _| Ok(()))?;
+            }
+            Ok(())
+        });
+        ResourcesPre::new(linker.instantiate_pre(&component).expect("instantiate_pre"))
+            .expect("ResourcesPre")
+    })
+    .await
+}
+
+fn store() -> Store<Ctx> {
+    Store::new(
+        &ENGINE,
+        Ctx {
+            wasi: shared::Wasi::inherit(),
+            counter_drops: 0,
+        },
+    )
+}
+
+// ===========================================================================
+// Host import implementations
+// ===========================================================================
+
+impl aggregates::Host for Ctx {
+    #[allow(clippy::too_many_arguments)]
+    async fn foo(
+        &mut self,
+        r1: aggregates::R1,
+        r2: aggregates::R2,
+        r3: aggregates::R3,
+        t1: aggregates::T1,
+        t2: aggregates::T2,
+        v1: aggregates::V1,
+        v2: aggregates::V2,
+        l1: aggregates::L1,
+        l2: aggregates::L2,
+        o1: Option<Resource<AggregatesThing>>,
+        o2: Option<Resource<AggregatesThing>>,
+        result1: Result<Resource<AggregatesThing>, ()>,
+        result2: Result<Resource<AggregatesThing>, ()>,
+    ) -> u32 {
+        let table = self.wasi.table();
+        // An `own` handle transfers to the host, which removes it from the table.
+        // A borrow is only read.
+        let mut own = |thing: Resource<AggregatesThing>| table.delete(thing).unwrap().0;
+        let mut sum = own(r1.thing);
+        let aggregates::V1::Thing(v1) = v1;
+        sum += own(r3.thing2) + own(t1.0) + own(t1.1.thing) + own(v1);
+        for thing in l1 {
+            sum += own(thing);
+        }
+        if let Some(thing) = o1 {
+            sum += own(thing);
+        }
+        if let Ok(thing) = result1 {
+            sum += own(thing);
+        }
+        let borrow = |thing: &Resource<AggregatesThing>| table.get(thing).unwrap().0;
+        sum += borrow(&r2.thing) + borrow(&r3.thing1) + borrow(&t2.0);
+        let aggregates::V2::Thing(v2) = v2;
+        sum += borrow(&v2);
+        for thing in &l2 {
+            sum += borrow(thing);
+        }
+        if let Some(thing) = &o2 {
+            sum += borrow(thing);
+        }
+        if let Ok(thing) = &result2 {
+            sum += borrow(thing);
+        }
+        sum + 3
+    }
+}
+
+impl aggregates::HostThing for Ctx {
+    async fn new(&mut self, v: u32) -> Resource<AggregatesThing> {
+        self.wasi.table().push(AggregatesThing(v + 2)).unwrap()
+    }
+    async fn drop(&mut self, rep: Resource<AggregatesThing>) -> wasmtime::Result<()> {
+        self.wasi.table().delete(rep)?;
+        Ok(())
+    }
+}
+
+impl borrow_in_record::Host for Ctx {
+    async fn test(&mut self, a: Vec<borrow_in_record::Foo>) -> Vec<Resource<BorrowInRecordThing>> {
+        let table = self.wasi.table();
+        a.into_iter()
+            .map(|record| {
+                let value = table.get(&record.thing).unwrap().0.clone();
+                table
+                    .push(BorrowInRecordThing(value + " test HostThing"))
+                    .unwrap()
+            })
+            .collect()
+    }
+}
+
+impl borrow_in_record::HostThing for Ctx {
+    async fn new(&mut self, s: String) -> Resource<BorrowInRecordThing> {
+        self.wasi
+            .table()
+            .push(BorrowInRecordThing(s + " HostThing"))
+            .unwrap()
+    }
+    async fn get(&mut self, self_: Resource<BorrowInRecordThing>) -> String {
+        self.wasi.table().get(&self_).unwrap().0.clone() + " HostThing.get"
+    }
+    async fn drop(&mut self, rep: Resource<BorrowInRecordThing>) -> wasmtime::Result<()> {
+        self.wasi.table().delete(rep)?;
+        Ok(())
+    }
+}
+
+impl alias1::Host for Ctx {
+    async fn a(&mut self, f: alias1::Foo) -> Vec<Resource<AliasThing>> {
+        vec![f.thing]
+    }
+}
+
+impl alias1::HostThing for Ctx {
+    async fn new(&mut self, s: String) -> Resource<AliasThing> {
+        self.wasi
+            .table()
+            .push(AliasThing(s + " HostThing"))
+            .unwrap()
+    }
+    async fn get(&mut self, self_: Resource<AliasThing>) -> String {
+        self.wasi.table().get(&self_).unwrap().0.clone() + " HostThing.get"
+    }
+    async fn drop(&mut self, rep: Resource<AliasThing>) -> wasmtime::Result<()> {
+        self.wasi.table().delete(rep)?;
+        Ok(())
+    }
+}
+
+impl alias2::Host for Ctx {
+    async fn b(&mut self, f: alias2::Foo, g: alias2::Bar) -> Vec<Resource<AliasThing>> {
+        vec![f.thing, g.thing]
+    }
+}
+
+impl import_and_export::Host for Ctx {}
+
+impl import_and_export::HostThing for Ctx {
+    async fn new(&mut self, v: u32) -> Resource<ImportAndExportThing> {
+        self.wasi.table().push(ImportAndExportThing(v + 1)).unwrap()
+    }
+    async fn foo(&mut self, self_: Resource<ImportAndExportThing>) -> u32 {
+        self.wasi.table().get(&self_).unwrap().0 + 2
+    }
+    async fn bar(&mut self, self_: Resource<ImportAndExportThing>, v: u32) {
+        self.wasi.table().get_mut(&self_).unwrap().0 = v + 3;
+    }
+    async fn baz(
+        &mut self,
+        a: Resource<ImportAndExportThing>,
+        b: Resource<ImportAndExportThing>,
+    ) -> Resource<ImportAndExportThing> {
+        let table = self.wasi.table();
+        let a = table.delete(a).unwrap().0;
+        let b = table.delete(b).unwrap().0;
+        // `foo` on each, plus four, through the constructor's plus one.
+        table
+            .push(ImportAndExportThing((a + 2) + (b + 2) + 4 + 1))
+            .unwrap()
+    }
+    async fn drop(&mut self, rep: Resource<ImportAndExportThing>) -> wasmtime::Result<()> {
+        self.wasi.table().delete(rep)?;
+        Ok(())
+    }
+}
+
+impl counters::Host for Ctx {
+    async fn reject(
+        &mut self,
+        c: Resource<HostCounterValue>,
+    ) -> Result<u32, Resource<HostCounterValue>> {
+        Err(c)
+    }
+}
+
+impl counters::HostCounter for Ctx {
+    async fn new(&mut self, v: u32) -> Resource<HostCounterValue> {
+        self.wasi.table().push(HostCounterValue(v)).unwrap()
+    }
+    async fn get(&mut self, self_: Resource<HostCounterValue>) -> u32 {
+        self.wasi.table().get(&self_).unwrap().0
+    }
+    async fn set(&mut self, self_: Resource<HostCounterValue>, v: u32) {
+        self.wasi.table().get_mut(&self_).unwrap().0 = v;
+    }
+    async fn drop(&mut self, rep: Resource<HostCounterValue>) -> wasmtime::Result<()> {
+        self.counter_drops += 1;
+        self.wasi.table().delete(rep)?;
+        Ok(())
+    }
+}
+
+// ===========================================================================
+// Test cases
+// ===========================================================================
+
+/// Own and borrow handles of the exported `thing` in every aggregate position.
+/// The guest unwraps each one to the host thing inside, passes the same shape
+/// to the host import, and adds a constant on the way back, so the one return
+/// value checks every position in both directions.
+#[tokio::test]
+async fn resources_nested_in_aggregates_round_trip() -> anyhow::Result<()> {
+    use exports::test::resources::aggregates::{R1, R2, R3, V1, V2};
+
+    let mut store = store();
+    let instance = pre().await.instantiate_async(&mut store).await?;
+    let aggregates = instance.test_resources_aggregates();
+
+    let mut things = Vec::new();
+    let mut expected = 0;
+    for i in 1..18 {
+        things.push(aggregates.thing().call_constructor(&mut store, i).await?);
+        // The guest constructor adds one, the host constructor two.
+        expected += i + 1 + 2;
+    }
+    // The host's constant, then the guest's.
+    expected += 3 + 4;
+
+    let sum = aggregates
+        .call_foo(
+            &mut store,
+            R1 { thing: things[0] },
+            R2 { thing: things[1] },
+            R3 {
+                thing1: things[2],
+                thing2: things[3],
+            },
+            (things[4], R1 { thing: things[5] }),
+            (things[6],),
+            V1::Thing(things[7]),
+            V2::Thing(things[8]),
+            &vec![things[9], things[10]],
+            &vec![things[11], things[12]],
+            Some(things[13]),
+            Some(things[14]),
+            Ok(things[15]),
+            Ok(things[16]),
+        )
+        .await?;
+    assert_eq!(sum, expected);
+
+    // The borrowed things stay owned by the host and are dropped here. The
+    // owned ones transferred into the guest.
+    for index in [1, 2, 6, 8, 11, 12, 14, 16] {
+        things[index].resource_drop_async(&mut store).await?;
+    }
+    Ok(())
+}
+
+/// A `list<record>` of borrows in, a `list<own>` out: each borrowed thing is
+/// read through the record and a fresh owned thing returned in its place.
+#[tokio::test]
+async fn borrows_in_records_return_owned_things() -> anyhow::Result<()> {
+    use exports::test::resources::borrow_in_record::Foo;
+
+    let mut store = store();
+    let instance = pre().await.instantiate_async(&mut store).await?;
+    let iface = instance.test_resources_borrow_in_record();
+
+    let thing1 = iface
+        .thing()
+        .call_constructor(&mut store, "Bonjour")
+        .await?;
+    let thing2 = iface
+        .thing()
+        .call_constructor(&mut store, "mon cher")
+        .await?;
+
+    let returned = iface
+        .call_test(&mut store, &[Foo { thing: thing1 }, Foo { thing: thing2 }])
+        .await?;
+    let mut values = Vec::new();
+    for thing in &returned {
+        values.push(iface.thing().call_get(&mut store, *thing).await?);
+    }
+    assert_eq!(
+        values,
+        [
+            "Bonjour Thing HostThing test HostThing HostThing.get Thing.get",
+            "mon cher Thing HostThing test HostThing HostThing.get Thing.get",
+        ]
+    );
+
+    for thing in returned.into_iter().chain([thing1, thing2]) {
+        thing.resource_drop_async(&mut store).await?;
+    }
+    Ok(())
+}
+
+/// One resource type shared by two interfaces through `use` and `use ... as`,
+/// and by the world through `use alias1.{thing}`: `alias2.b` takes a record of
+/// its own and the aliased `alias1.foo`, and the world-level `test` passes host
+/// things through the guest unchanged.
+#[tokio::test]
+async fn aliased_resources_are_one_type() -> anyhow::Result<()> {
+    let mut store = store();
+    let instance = pre().await.instantiate_async(&mut store).await?;
+
+    // World-level `test`: host-owned things pass through the guest and come
+    // back as the same table entries.
+    let host_thing = store
+        .data_mut()
+        .wasi
+        .table()
+        .push(AliasThing("Ni Hao HostThing".to_string()))?;
+    let returned = instance.call_test(&mut store, &[host_thing]).await?;
+    let values: Vec<String> = returned
+        .into_iter()
+        .map(|thing| store.data_mut().wasi.table().delete(thing).unwrap().0)
+        .collect();
+    assert_eq!(values, ["Ni Hao HostThing"]);
+
+    let alias1 = instance.test_resources_alias1();
+    let alias2 = instance.test_resources_alias2();
+
+    let thing2 = alias1.thing().call_constructor(&mut store, "Ciao").await?;
+    let returned = alias1
+        .call_a(
+            &mut store,
+            exports::test::resources::alias1::Foo { thing: thing2 },
+        )
+        .await?;
+    let mut values = Vec::new();
+    for thing in &returned {
+        values.push(alias1.thing().call_get(&mut store, *thing).await?);
+    }
+    assert_eq!(values, ["Ciao Thing HostThing HostThing.get Thing.get"]);
+    for thing in returned {
+        thing.resource_drop_async(&mut store).await?;
+    }
+
+    let thing3 = alias1.thing().call_constructor(&mut store, "Ciao").await?;
+    let thing4 = alias1.thing().call_constructor(&mut store, "Aloha").await?;
+    let returned = alias2
+        .call_b(
+            &mut store,
+            exports::test::resources::alias2::Foo { thing: thing3 },
+            exports::test::resources::alias2::Bar { thing: thing4 },
+        )
+        .await?;
+    let mut values = Vec::new();
+    for thing in &returned {
+        values.push(alias1.thing().call_get(&mut store, *thing).await?);
+    }
+    assert_eq!(
+        values,
+        [
+            "Ciao Thing HostThing HostThing.get Thing.get",
+            "Aloha Thing HostThing HostThing.get Thing.get",
+        ]
+    );
+    for thing in returned {
+        thing.resource_drop_async(&mut store).await?;
+    }
+    Ok(())
+}
+
+/// The same interface imported and exported: the guest class wraps the host
+/// class, and its static `baz` passes two owned guest things down to the host
+/// static and wraps the host's result.
+#[tokio::test]
+async fn guest_class_wraps_the_host_class_of_the_same_interface() -> anyhow::Result<()> {
+    let mut store = store();
+    let instance = pre().await.instantiate_async(&mut store).await?;
+    let thing = instance.test_resources_import_and_export().thing();
+
+    let thing1 = thing.call_constructor(&mut store, 42).await?;
+    assert_eq!(
+        thing.call_foo(&mut store, thing1).await?,
+        42 + 1 + 1 + 2 + 2
+    );
+
+    thing.call_bar(&mut store, thing1, 33).await?;
+    assert_eq!(
+        thing.call_foo(&mut store, thing1).await?,
+        33 + 3 + 3 + 2 + 2
+    );
+
+    let thing2 = thing.call_constructor(&mut store, 81).await?;
+    let thing3 = thing.call_baz(&mut store, thing1, thing2).await?;
+    assert_eq!(
+        thing.call_foo(&mut store, thing3).await?,
+        33 + 3 + 3 + 81 + 1 + 1 + 2 + 2 + 4 + 1 + 2 + 4 + 1 + 1 + 2 + 2
+    );
+    thing3.resource_drop_async(&mut store).await?;
+    Ok(())
+}
+
+/// An export that disposes its borrowed host resource before returning. The
+/// early dispose drops the borrow handle, and the release at call end finds no
+/// handle left to drop, so the call completes, the host's own resource is
+/// untouched, and the next call on it still works.
+#[tokio::test]
+async fn dispose_borrow_during_call() -> anyhow::Result<()> {
+    let mut store = store();
+    let instance = pre().await.instantiate_async(&mut store).await?;
+
+    let counter = store.data_mut().wasi.table().push(HostCounterValue(7))?;
+    let value = instance
+        .call_dispose_early(&mut store, Resource::new_borrow(counter.rep()))
+        .await?;
+    assert_eq!(value, 7);
+    assert_eq!(
+        store.data().counter_drops,
+        0,
+        "disposing a borrow must not drop the host's resource"
+    );
+    assert_eq!(store.data_mut().wasi.table().get(&counter)?.0, 7);
+
+    instance
+        .call_bump(&mut store, Resource::new_borrow(counter.rep()))
+        .await?;
+    assert_eq!(store.data_mut().wasi.table().get(&counter)?.0, 8);
+
+    let value = instance
+        .call_dispose_early(&mut store, Resource::new_borrow(counter.rep()))
+        .await?;
+    assert_eq!(value, 8);
+    assert_eq!(store.data().counter_drops, 0);
+    Ok(())
+}
+
+/// Calling a resource class's `[Symbol.dispose]` on an object that is not a
+/// wrapper throws a `TypeError`, for a plain object and for an object with a
+/// wrapper's prototype alike, and doesn't drop a handle.
+#[tokio::test]
+async fn forged_dispose_throws() -> anyhow::Result<()> {
+    let mut store = store();
+    let instance = pre().await.instantiate_async(&mut store).await?;
+    let counter = store.data_mut().wasi.table().push(HostCounterValue(1))?;
+    let messages = instance
+        .call_forged_dispose_messages(&mut store, Resource::new_borrow(counter.rep()))
+        .await?;
+    assert_eq!(
+        messages,
+        [
+            "dispose was called on an object that is not a resource wrapper",
+            "dispose was called on an object that is not a resource wrapper",
+        ]
+    );
+    assert_eq!(store.data().counter_drops, 0);
+    Ok(())
+}
+
+/// An owned imported resource disposed by a `using` block is dropped by the
+/// host during the call, and a second dispose does nothing.
+#[tokio::test]
+async fn using_disposes_an_owned_wrapper_once() -> anyhow::Result<()> {
+    let mut store = store();
+    let instance = pre().await.instantiate_async(&mut store).await?;
+    let counter = store.data_mut().wasi.table().push(HostCounterValue(4))?;
+    assert_eq!(instance.call_using_owned(&mut store, counter).await?, 4);
+    assert_eq!(store.data().counter_drops, 1);
+    Ok(())
+}
+
+/// An `err` whose type is a resource arrives as a `ComponentError` holding the
+/// resource's wrapper.
+#[tokio::test]
+async fn resource_err_is_a_component_error() -> anyhow::Result<()> {
+    let mut store = store();
+    let instance = pre().await.instantiate_async(&mut store).await?;
+    let counter = store.data_mut().wasi.table().push(HostCounterValue(7))?;
+    assert_eq!(
+        instance
+            .call_describe_resource_error(&mut store, counter)
+            .await?,
+        "ComponentError true 7"
+    );
+    Ok(())
+}
+
+/// A plain object passed where an imported resource is expected throws a
+/// `TypeError` the guest can catch, rather than trapping.
+#[tokio::test]
+async fn plain_object_for_imported_resource_throws() -> anyhow::Result<()> {
+    let mut store = store();
+    let instance = pre().await.instantiate_async(&mut store).await?;
+    let described = instance.call_plain_object_for_resource(&mut store).await?;
+    assert!(
+        described.starts_with(
+            "true argument 1 of `reject`: expected an instance of the imported resource's class"
+        ),
+        "{described}"
+    );
+    Ok(())
+}
+
+/// Resource wrappers passed to imports in ways that do not lower throw a
+/// `TypeError` the guest can catch, before anything is lowered.
+#[tokio::test]
+async fn resource_misuse_throws() -> anyhow::Result<()> {
+    let mut store = store();
+    let instance = pre().await.instantiate_async(&mut store).await?;
+    let counter = store.data_mut().wasi.table().push(HostCounterValue(0))?;
+    let messages = instance
+        .call_resource_misuse_messages(&mut store, Resource::new_borrow(counter.rep()))
+        .await?;
+    let used_elsewhere =
+        "the resource is used elsewhere in the same call, and an `own` use must be its only use";
+    assert_eq!(
+        messages,
+        [
+            format!("argument 2 of `Thing.baz`: {used_elsewhere}"),
+            format!("argument 2 of `b` `.thing`: {used_elsewhere}"),
+            "argument 1 of `reject`: expected an owned resource, got a borrowed one".to_string(),
+            "argument 1 of `b` `.thing`: the resource was disposed of, or moved to the host"
+                .to_string(),
+            "2".to_string(),
+            "no error".to_string(),
+        ]
+    );
+    Ok(())
+}
+
+/// A payload-less `err` takes a thrown `Error`, and the error is logged on
+/// stderr.
+#[tokio::test]
+async fn payload_less_err_logs_the_error() -> anyhow::Result<()> {
+    let (wasi, stderr) = shared::wasi_capturing_stderr();
+    let mut store = Store::new(
+        &ENGINE,
+        Ctx {
+            wasi,
+            counter_drops: 0,
+        },
+    );
+    let instance = pre().await.instantiate_async(&mut store).await?;
+    assert_eq!(instance.call_fail_quietly(&mut store).await?, Err(()));
+    let stderr = shared::pipe_text(&stderr);
+    assert!(
+        stderr.contains("the reason for failing quietly"),
+        "{stderr}"
+    );
+    Ok(())
+}
diff --git a/componentize/tests/serve.rs b/componentize/tests/serve.rs
new file mode 100644
index 00000000..d9c68515
--- /dev/null
+++ b/componentize/tests/serve.rs
@@ -0,0 +1,859 @@
+// SPDX-License-Identifier: Apache-2.0-WITH-LLVM-exception
+
+//! `wasi:http/handler` components: applications componentized against the serve world of
+//! `fixtures/serve.wit`, served either by the runtime's handler, which dispatches each request as
+//! a `fetch` event to the application's listeners, or by the application's own `handle`. The
+//! tests drive `wasi:http/handler.handle()` through wasmtime's p3 `wasi:http` bindings.
+
+mod shared;
+
+use shared::HttpCtx as Ctx;
+
+use {
+    tokio::sync::OnceCell,
+    wasmtime::{component::Component, Engine, Store},
+    wasmtime_wasi_http::p3::bindings::{http::types::ErrorCode, Service},
+};
+
+/// The body of the harness's response to every outgoing request.
+const UPSTREAM_BODY: &str = "from upstream";
+
+static ENGINE: std::sync::LazyLock<Engine> = std::sync::LazyLock::new(shared::engine);
+
+const SERVE_WIT: &str = include_str!("fixtures/serve.wit");
+
+/// Componentize a serve application against the serve world and compile it.
+async fn componentize_serve(js: &'static str) -> Component {
+    shared::compile_fixture(&ENGINE, SERVE_WIT, "serve", js).await
+}
+
+/// The componentized serve app that registers a `fetch` listener, and the
+/// component compiled from it, built once.
+async fn listener_build() -> &'static (Vec<u8>, Component) {
+    static LISTENER: OnceCell<Result<(Vec<u8>, Component), String>> = OnceCell::const_new();
+    shared::build_once(&LISTENER, async {
+        let bytes = shared::try_componentize(SERVE_WIT, "serve", include_str!("fixtures/serve.js"))
+            .await
+            .expect("componentizing the serve world");
+        let component = Component::new(&ENGINE, &bytes).expect("compiling component");
+        (bytes, component)
+    })
+    .await
+}
+
+/// The componentized serve app that registers a `fetch` listener, built once.
+async fn listener() -> &'static Component {
+    &listener_build().await.1
+}
+
+/// The `wasi:http/handler` export of a component built from the serve world, for
+/// finalizing it again.
+fn handler_export() -> [componentize::finalize::KeptExport; 1] {
+    [componentize::finalize::KeptExport::unrenamed(
+        "wasi:http/handler@0.3.0".to_string(),
+    )]
+}
+
+/// A store whose WASI context sends the guest's stderr to the returned pipe.
+fn store_capturing_stderr() -> (Store<Ctx>, wasmtime_wasi::p2::pipe::MemoryOutputPipe) {
+    let (wasi, stderr) = shared::wasi_capturing_stderr();
+    let store = Store::new(
+        &ENGINE,
+        Ctx {
+            wasi,
+            http: wasmtime_wasi_http::WasiHttpCtx::new(),
+            hooks: shared::UpstreamHooks {
+                body: UPSTREAM_BODY,
+            },
+        },
+    );
+    (store, stderr)
+}
+
+/// The componentized serve app that implements `wasi:http/handler` itself, built
+/// once.
+async fn raw() -> &'static Component {
+    static RAW: OnceCell<Result<Component, String>> = OnceCell::const_new();
+    shared::build_once(
+        &RAW,
+        componentize_serve(include_str!("fixtures/serve_raw.js")),
+    )
+    .await
+}
+
+/// A fresh store with a WASI + `wasi:http` context.
+fn store() -> Store<Ctx> {
+    shared::http_store(&ENGINE, UPSTREAM_BODY)
+}
+
+/// Drive `wasi:http/handler.handle()` on a fresh instance of a component with a
+/// bodyless `method` request to `path`. Returns the response status and the
+/// collected body as a string, or the `error-code` the handler returned.
+async fn handle_request(
+    component: &Component,
+    method: &str,
+    path: &str,
+) -> anyhow::Result<Result<(u16, String), ErrorCode>> {
+    let mut store = store();
+    let service = Service::instantiate_async(
+        &mut store,
+        component,
+        &shared::http_linker(&ENGINE, component),
+    )
+    .await?;
+    shared::handle_on(&mut store, &service, method, path, "").await
+}
+
+/// `--export-cli` and `--export-http` together build one component that serves
+/// requests and runs as a command, from a module that registers a `fetch`
+/// listener and exports `run`. It is built through the command line, whose `-q` leaves
+/// stdout empty.
+#[tokio::test]
+async fn cli_and_serve_component_serves_and_runs() -> anyhow::Result<()> {
+    let output = std::path::Path::new(env!("CARGO_TARGET_TMPDIR")).join("cli-and-serve.wasm");
+    let input = std::path::Path::new(env!("CARGO_MANIFEST_DIR"))
+        .join("tests/fixtures/cli_and_serve.js")
+        .display()
+        .to_string();
+    let args = [
+        "-q",
+        "--export-cli",
+        "--export-http",
+        "componentize",
+        &input,
+        "-o",
+        &output.display().to_string(),
+    ];
+    let cli = shared::run_cli(&args, None);
+    assert!(
+        cli.status.success(),
+        "{}",
+        String::from_utf8_lossy(&cli.stderr)
+    );
+    assert_eq!(String::from_utf8_lossy(&cli.stdout), "");
+    let component = Component::new(&ENGINE, std::fs::read(&output)?)?;
+
+    assert_eq!(
+        handle_request(&component, "GET", "/both").await??,
+        (200, "hello from one component, serving /both".to_string())
+    );
+
+    let stdout = wasmtime_wasi::p2::pipe::MemoryOutputPipe::new(64 * 1024);
+    let mut store = Store::new(
+        &ENGINE,
+        Ctx {
+            wasi: shared::Wasi::from_builder(
+                wasmtime_wasi::WasiCtxBuilder::new()
+                    .stdout(stdout.clone())
+                    .inherit_stderr(),
+            ),
+            http: wasmtime_wasi_http::WasiHttpCtx::new(),
+            hooks: shared::UpstreamHooks {
+                body: UPSTREAM_BODY,
+            },
+        },
+    );
+    let command = wasmtime_wasi::p3::bindings::Command::instantiate_async(
+        &mut store,
+        &component,
+        &shared::http_linker(&ENGINE, &component),
+    )
+    .await?;
+    let result = store
+        .run_concurrent(async move |store| command.wasi_cli_run().call_run(store).await)
+        .await??;
+    assert_eq!(result, Ok(()));
+    assert_eq!(
+        shared::pipe_text(&stdout),
+        "hello from one component, running\n"
+    );
+    Ok(())
+}
+
+/// `fixtures/serve_wasi_imports.js` componentized against the serve world with
+/// the interfaces the runtime imports, and the component compiled from it, built
+/// once.
+async fn wasi_imports() -> &'static (Vec<u8>, Component) {
+    static WASI_IMPORTS: OnceCell<Result<(Vec<u8>, Component), String>> = OnceCell::const_new();
+    shared::build_once(&WASI_IMPORTS, async {
+        let runtime = shared::runtime().expect("reading the runtime build");
+        let selection = componentize::WorldSelection {
+            worlds: vec!["serve"],
+            builtins: Vec::new(),
+            resolved: vec![componentize::runtime_imports_world(&runtime, &[])
+                .expect("the runtime's imports world")],
+        };
+        let bytes = componentize::componentize(
+            componentize::Wit::<std::path::PathBuf>::String(SERVE_WIT),
+            selection,
+            include_str!("fixtures/serve_wasi_imports.js"),
+            &runtime,
+            &Default::default(),
+        )
+        .await
+        .expect("componentizing the serve world with the runtime's imports")
+        .component;
+        let component = Component::new(&ENGINE, &bytes).expect("compiling component");
+        (bytes, component)
+    })
+    .await
+}
+
+/// The world of `--export-http` and `--export-cli` imports the interfaces the
+/// runtime imports, so an application can import them, and the component
+/// imports no more than the runtime does.
+#[tokio::test]
+async fn serve_world_imports_what_the_runtime_imports() -> anyhow::Result<()> {
+    let component = &wasi_imports().await.1;
+    assert_eq!(
+        handle_request(component, "GET", "/").await??,
+        (
+            200,
+            r#"{"arguments":true,"random":16,"clock":"bigint"}"#.to_string()
+        )
+    );
+
+    let imports = |component: &Component| -> Vec<String> {
+        let mut names: Vec<String> = component
+            .component_type()
+            .imports(&ENGINE)
+            .map(|(name, _)| name.to_string())
+            .collect();
+        names.sort();
+        names
+    };
+    assert_eq!(imports(component), imports(listener().await));
+    Ok(())
+}
+
+/// With a deterministic insecure seed, the component imports no
+/// `wasi:random/insecure-seed`, and `getInsecureSeed` returns the seed's high
+/// and low 64 bits. Disabling `random` leaves the interface in place without
+/// one. The cases run `finalize::finalize` over an already componentized
+/// component again.
+#[tokio::test]
+async fn deterministic_insecure_seed_is_returned() -> anyhow::Result<()> {
+    use componentize::finalize::WasiApiSet;
+    let built = &wasi_imports().await.0;
+    let finalize = |disabled: &[WasiApiSet], insecure_seed| {
+        let bytes =
+            componentize::finalize::finalize(built, &handler_export(), disabled, insecure_seed)?;
+        anyhow::Ok(Component::new(&ENGINE, &bytes)?)
+    };
+    let imports = |component: &Component| -> Vec<String> {
+        component
+            .component_type()
+            .imports(&ENGINE)
+            .map(|(name, _)| name.to_string())
+            .collect()
+    };
+
+    let seed = (1u128 << 64) | 2;
+    for disabled in [&[][..], &[WasiApiSet::Random][..]] {
+        let component = finalize(disabled, Some(seed))?;
+        assert_eq!(
+            handle_request(&component, "GET", "/seed").await??,
+            (200, "1,2".to_string()),
+            "{disabled:?}"
+        );
+        let imports = imports(&component);
+        assert!(
+            !imports
+                .iter()
+                .any(|name| name.starts_with("wasi:random/insecure-seed")),
+            "{disabled:?}: {imports:?}"
+        );
+        assert_eq!(
+            imports
+                .iter()
+                .any(|name| name.starts_with("wasi:random/random")),
+            disabled.is_empty(),
+            "{disabled:?}: {imports:?}"
+        );
+    }
+
+    let component = finalize(&[WasiApiSet::Random], None)?;
+    let imports = imports(&component);
+    assert!(
+        imports
+            .iter()
+            .any(|name| name.starts_with("wasi:random/insecure-seed")),
+        "{imports:?}"
+    );
+    Ok(())
+}
+
+/// The world of `--export-http` and `--export-cli` leaves out the interfaces of
+/// disabled features.
+#[tokio::test]
+async fn runtime_imports_world_leaves_out_disabled_features() -> anyhow::Result<()> {
+    let runtime = shared::runtime()?;
+    let names = |disabled: &[componentize::finalize::WasiApiSet]| -> anyhow::Result<Vec<String>> {
+        let (resolve, world) = componentize::runtime_imports_world(&runtime, disabled)?;
+        Ok(resolve.worlds[world]
+            .imports
+            .keys()
+            .map(|key| resolve.name_world_key(key))
+            .collect())
+    };
+    let all = names(&[])?;
+    assert!(
+        all.iter().any(|name| name.starts_with("wasi:filesystem/")),
+        "{all:?}"
+    );
+    let without = names(&[componentize::finalize::WasiApiSet::Filesystem])?;
+    assert!(
+        !without
+            .iter()
+            .any(|name| name.starts_with("wasi:filesystem/")),
+        "{without:?}"
+    );
+    assert!(
+        without.iter().any(|name| name.starts_with("wasi:random/")),
+        "{without:?}"
+    );
+    Ok(())
+}
+
+/// One instance serves several requests, as `wasmtime serve` reuses instances,
+/// with the application's state kept from one to the next, and each
+/// request's method and path reach the listener.
+#[tokio::test]
+async fn one_instance_serves_several_requests() -> anyhow::Result<()> {
+    let component = listener().await;
+    let mut store = store();
+    let service = Service::instantiate_async(
+        &mut store,
+        component,
+        &shared::http_linker(&ENGINE, component),
+    )
+    .await?;
+    for (method, path, expected) in [
+        ("GET", "/count", "1"),
+        ("GET", "/count", "2"),
+        ("GET", "/hello", "GET /hello"),
+        ("POST", "/other", "POST /other"),
+    ] {
+        let response = shared::handle_on(&mut store, &service, method, path, "")
+            .await?
+            .map_err(|code| anyhow::anyhow!("handler errored: {code:?}"))?;
+        assert_eq!(response, (200, expected.to_string()), "{method} {path}");
+    }
+    Ok(())
+}
+
+/// A listener reads the request's body.
+#[tokio::test]
+async fn listener_reads_the_request_body() -> anyhow::Result<()> {
+    let component = listener().await;
+    let mut store = store();
+    let service = Service::instantiate_async(
+        &mut store,
+        component,
+        &shared::http_linker(&ENGINE, component),
+    )
+    .await?;
+    let response = shared::handle_on(&mut store, &service, "POST", "/echo-body", "a body")
+        .await?
+        .map_err(|code| anyhow::anyhow!("handler errored: {code:?}"))?;
+    assert_eq!(response, (200, "a body".to_string()));
+    Ok(())
+}
+
+/// A listener that does not call `respondWith` gets a network error, which is
+/// sent as a `500`, and the instance serves the next request.
+#[tokio::test]
+async fn listener_without_respond_with_gets_500() -> anyhow::Result<()> {
+    let component = listener().await;
+    let mut store = store();
+    let service = Service::instantiate_async(
+        &mut store,
+        component,
+        &shared::http_linker(&ENGINE, component),
+    )
+    .await?;
+    let response = shared::handle_on(&mut store, &service, "GET", "/no-response", "").await?;
+    assert!(matches!(response, Ok((500, _))), "{response:?}");
+    let response = shared::handle_on(&mut store, &service, "GET", "/count", "")
+        .await?
+        .map_err(|code| anyhow::anyhow!("handler errored: {code:?}"))?;
+    assert_eq!(response, (200, "2".to_string()));
+    Ok(())
+}
+
+/// Like [`handle_request`], for a handler that must return a response.
+async fn serve_request(
+    component: &Component,
+    method: &str,
+    path: &str,
+) -> anyhow::Result<(u16, String)> {
+    handle_request(component, method, path)
+        .await?
+        .map_err(|code| anyhow::anyhow!("handler errored: {code:?}"))
+}
+
+/// An application that implements `wasi:http/handler` itself serves the
+/// component's export: its `handle` receives the request and builds the response,
+/// or fails with an `error-code`, which reaches the host.
+#[tokio::test]
+async fn serve_dispatches_to_raw_handler() -> anyhow::Result<()> {
+    let (status, body) = serve_request(raw().await, "GET", "/hello").await?;
+    assert_eq!(status, 200, "the application's handler should answer 200");
+    assert_eq!(
+        body, "raw get /hello",
+        "the application's handler should echo the method and path"
+    );
+
+    let result = handle_request(raw().await, "GET", "/fail").await?;
+    assert!(
+        matches!(&result, Err(ErrorCode::InternalError(Some(message))) if message == "raw get /fail"),
+        "the application's handler should fail with the error naming the request; got: {result:?}"
+    );
+    Ok(())
+}
+
+/// The componentized serve app whose own handler returns `Response` objects,
+/// built once.
+async fn raw_response() -> &'static Component {
+    static RAW_RESPONSE: OnceCell<Result<Component, String>> = OnceCell::const_new();
+    shared::build_once(
+        &RAW_RESPONSE,
+        componentize_serve(include_str!("fixtures/serve_raw_response.js")),
+    )
+    .await
+}
+
+/// An application's own `wasi:http/handler` can return a `Response`: the one
+/// `fetch` resolved to, whose body the host receives without the guest reading
+/// it, one whose body a stream produces across timers, or a constructed one,
+/// whose status it keeps.
+#[tokio::test]
+async fn raw_handler_returns_response_objects() -> anyhow::Result<()> {
+    let (status, body) = serve_request(raw_response().await, "GET", "/proxy").await?;
+    assert_eq!(status, 200);
+    assert_eq!(
+        body, UPSTREAM_BODY,
+        "the fetched response is served as it is"
+    );
+
+    let (status, body) = serve_request(raw_response().await, "GET", "/slow").await?;
+    assert_eq!(status, 200);
+    assert_eq!(
+        body, "one two three",
+        "a body a stream produces across timers is sent whole"
+    );
+
+    let (status, body) = serve_request(raw_response().await, "GET", "/built").await?;
+    assert_eq!(status, 201, "the constructed response keeps its status");
+    assert_eq!(body, "built /built");
+    Ok(())
+}
+
+/// A `Response` body that stops producing while nothing else is left for the
+/// handler's event loop to do is abandoned, so the request ends instead of
+/// hanging, and a `Response` whose body was read fails the call, naming the
+/// reason on stderr.
+#[tokio::test]
+async fn stalled_and_read_response_bodies_fail_the_request() -> anyhow::Result<()> {
+    let component = raw_response().await;
+    let request = async |path: &str| {
+        let (mut store, stderr) = store_capturing_stderr();
+        let service = Service::instantiate_async(
+            &mut store,
+            component,
+            &shared::http_linker(&ENGINE, component),
+        )
+        .await?;
+        let result = shared::handle_on(&mut store, &service, "GET", path, "").await;
+        anyhow::Ok((result, shared::pipe_text(&stderr)))
+    };
+
+    let (stalled, _) = tokio::time::timeout(std::time::Duration::from_secs(30), request("/stall"))
+        .await
+        .expect("a stalled body must be abandoned, not hang the request")?;
+    assert!(
+        !matches!(stalled, Ok(Ok((_, ref body))) if !body.is_empty()),
+        "a stalled body delivers nothing: {stalled:?}"
+    );
+
+    let (used, stderr) = request("/used").await?;
+    assert!(used.is_err(), "a read body must fail the call: {used:?}");
+    assert!(
+        stderr.contains("the Response has an unusable body: it was read, or is locked"),
+        "{stderr}"
+    );
+    Ok(())
+}
+
+/// `fetch` takes the `wasi:http/types` `request` an application's own handler
+/// receives, and sends it with its method and URL.
+#[tokio::test]
+async fn raw_handler_forwards_its_request_with_fetch() -> anyhow::Result<()> {
+    let (status, body) = serve_request(raw_response().await, "PUT", "/echo/forwarded").await?;
+    assert_eq!(status, 200);
+    assert_eq!(body, "echo PUT /echo/forwarded");
+    Ok(())
+}
+
+/// A listener registered after a top-level `await` on a timer is in place before
+/// the snapshot, so the first request reaches it.
+#[tokio::test]
+async fn listener_added_after_top_level_await_serves_the_first_request() -> anyhow::Result<()> {
+    let (status, body) = serve_request(listener().await, "GET", "/ready").await?;
+    assert_eq!(status, 200);
+    assert_eq!(body, "ready /ready");
+    Ok(())
+}
+
+/// An application that both implements `wasi:http/handler` and registers a
+/// `fetch` listener fails to componentize, naming the export.
+#[tokio::test]
+async fn serve_with_raw_handler_and_listener_is_rejected() {
+    let error = shared::try_componentize(
+        SERVE_WIT,
+        "serve",
+        include_str!("fixtures/serve_raw_and_listener.js"),
+    )
+    .await
+    .expect_err("an application with both handlers must not componentize");
+    let message = format!("{error:#}");
+    assert!(
+        message.contains(
+            "both exports a `wasi:http/handler` implementation as `wasiHttp.handler.handle` or \
+             `handler.handle` or `handle` and registers a `fetch` listener"
+        ),
+        "the error should name both handlers; got: {message}"
+    );
+}
+
+/// An application that neither implements `wasi:http/handler` nor registers a
+/// `fetch` listener fails to componentize, since its component could not serve
+/// any request.
+#[tokio::test]
+async fn serve_without_handler_is_rejected() {
+    let error = shared::try_componentize(
+        SERVE_WIT,
+        "serve",
+        include_str!("fixtures/serve_no_listener.js"),
+    )
+    .await
+    .expect_err("an application with no handler must not componentize");
+    let message = format!("{error:#}");
+    assert!(
+        message.contains(
+            "neither exports a `wasi:http/handler` implementation as `wasiHttp.handler.handle` \
+             or `handler.handle` or `handle` nor registers a `fetch` listener"
+        ),
+        "the error should name both ways to serve requests; got: {message}"
+    );
+}
+
+/// A world importing `wasi:http/types`, declaring `fields`' `get` and `has`,
+/// which the runtime's declaration lacks, and an interface whose `async`
+/// function borrows a `request`.
+const IMPORTS_WIT: &str = "\
+package test:serve-imports;
+
+interface peeker {
+  use wasi:http/types@0.3.0.{request};
+  peek: async func(r: borrow<request>) -> u32;
+}
+
+world serve {
+  import wasi:http/types@0.3.0;
+  import peeker;
+  export wasi:http/handler@0.3.0;
+}
+
+package wasi:http@0.3.0 {
+  interface types {
+    type field-name = string;
+    type field-value = list<u8>;
+    resource fields {
+      get: func(name: field-name) -> list<field-value>;
+      has: func(name: field-name) -> bool;
+    }
+    resource request;
+  }
+  interface handler {}
+}
+";
+
+/// A raw handler for [`IMPORTS_WIT`]. For `/lend`, it `fetch`es the request
+/// while `peek` borrows it, and responds with the outcome. Otherwise it
+/// responds with what `fields`' `get` and `has` return for the request's headers.
+const IMPORTS_JS: &str = "\
+import { peek } from 'test:serve-imports/peeker';
+export const handler = {
+  async handle(request) {
+    if (request.getPathWithQuery() === '/lend') {
+      const peeked = peek(request);
+      let outcome;
+      try {
+        await fetch(request);
+        outcome = 'fetched';
+      } catch (e) {
+        outcome = `threw ${e.constructor.name}: ${e.message}`;
+      }
+      await peeked;
+      return new Response(outcome);
+    }
+    const headers = request.getHeaders();
+    const [length] = headers.get('content-length');
+    const absent = headers.has('x-absent');
+    return new Response(`content-length=${new TextDecoder().decode(length)} absent=${absent}`);
+  },
+};
+";
+
+/// [`IMPORTS_JS`] componentized against [`IMPORTS_WIT`], built once.
+async fn imports_app() -> &'static Component {
+    static IMPORTS: OnceCell<Result<Component, String>> = OnceCell::const_new();
+    shared::build_once(
+        &IMPORTS,
+        shared::compile_fixture(&ENGINE, IMPORTS_WIT, "serve", IMPORTS_JS),
+    )
+    .await
+}
+
+/// Send a `GET` request to `path` to a fresh instance of [`imports_app`], whose
+/// `peek` returns on the second time it is polled, so the call does not return
+/// before the guest's next turn.
+async fn serve_imports_app(path: &str) -> anyhow::Result<(u16, String)> {
+    let component = imports_app().await;
+    let linker = shared::http_linker_with(&ENGINE, component, &["test:serve-imports/"], |linker| {
+        linker
+                .instance("test:serve-imports/peeker")?
+                .func_wrap_concurrent(
+                    "peek",
+                    |_accessor,
+                     (_request,): (
+                        wasmtime::component::Resource<wasmtime_wasi_http::p3::Request>,
+                    )| {
+                        Box::pin(async move {
+                            tokio::task::yield_now().await;
+                            Ok((1u32,))
+                        })
+                    },
+                )
+    });
+    let (mut store, stderr) = store_capturing_stderr();
+    let service = Service::instantiate_async(&mut store, component, &linker).await?;
+    shared::handle_on(&mut store, &service, "GET", path, "")
+        .await?
+        .map_err(|code| anyhow::anyhow!("{code:?}: {}", shared::pipe_text(&stderr)))
+}
+
+/// The runtime's `wasi:http/types` has only the functions its builtins call, and a
+/// world importing the interface adds the functions it declares: here `fields`'
+/// `get` and `has`, which a raw handler calls on the request's headers.
+#[tokio::test]
+async fn world_imports_extend_the_runtime_wasi_http_types() -> anyhow::Result<()> {
+    assert_eq!(
+        serve_imports_app("/").await?,
+        (200, "content-length=0 absent=false".to_string())
+    );
+    Ok(())
+}
+
+/// Disabling `http` for a component that exports `wasi:http/handler` is refused,
+/// once, saying the component exports the interface that uses it. The case runs
+/// `finalize::finalize` over an already componentized component again.
+#[tokio::test]
+async fn disabling_http_for_a_serve_component_is_refused() {
+    let error = componentize::finalize::finalize(
+        &listener_build().await.0,
+        &handler_export(),
+        &[componentize::finalize::WasiApiSet::Http],
+        None,
+    )
+    .expect_err("a serve component cannot go without `http`");
+    let message = format!("{error:#}");
+    assert!(
+        message.contains("is used by `wasi:http/handler@0.3.0`, which the component exports"),
+        "{message}"
+    );
+    assert_eq!(message.matches("is used by").count(), 1, "{message}");
+    assert!(!message.contains("Disable"), "{message}");
+}
+
+/// A failing `handle` is named `wasi:http/handler#handle` in the message, not by
+/// the export name the componentizer gives it internally.
+#[tokio::test]
+async fn failing_raw_handler_is_named_as_the_handler() -> anyhow::Result<()> {
+    let component = raw().await;
+    let (mut store, stderr) = store_capturing_stderr();
+    let service = Service::instantiate_async(
+        &mut store,
+        component,
+        &shared::http_linker(&ENGINE, component),
+    )
+    .await?;
+    let result = shared::handle_on(&mut store, &service, "GET", "/throw", "").await;
+    assert!(
+        !matches!(result, Ok(Ok(_))),
+        "a throwing handler cannot answer"
+    );
+    let stderr = shared::pipe_text(&stderr);
+    assert!(
+        stderr.contains("export `wasi:http/handler#handle` threw: boom from handle"),
+        "{stderr}"
+    );
+    Ok(())
+}
+
+/// A world declaring `wasi:http/handler` differently from the runtime fails to
+/// componentize, saying it must match the runtime's declaration.
+#[tokio::test]
+async fn mismatched_wasi_http_declaration_is_rejected() {
+    const WIT: &str = "\
+package test:serve-mismatch;
+
+world serve {
+  export wasi:http/handler@0.3.0;
+}
+
+package wasi:http@0.3.0 {
+  interface handler {
+    handle: func(n: u32) -> u32;
+  }
+}
+";
+    let error = shared::try_componentize(WIT, "serve", include_str!("fixtures/serve.js"))
+        .await
+        .expect_err("a mismatched `wasi:http` declaration must not componentize");
+    let message = format!("{error:#}");
+    assert!(
+        message.contains("must declare it as the runtime does"),
+        "{message}"
+    );
+}
+
+/// `fetch` given a request wrapper an `async` import call still borrows rejects
+/// with a `TypeError`, rather than moving the request while it is lent.
+#[tokio::test]
+async fn fetch_of_a_lent_request_rejects() -> anyhow::Result<()> {
+    assert_eq!(
+        serve_imports_app("/lend").await?,
+        (
+            200,
+            "threw TypeError: the resource is lent to an import call that has not returned"
+                .to_string()
+        )
+    );
+    Ok(())
+}
+
+/// A future a `fetch` listener passes to an import is written even when the host
+/// reads it only after the request has finished.
+#[tokio::test]
+async fn listener_future_is_written_after_the_request() -> anyhow::Result<()> {
+    const WIT: &str = "\
+package test:serve-future;
+
+interface sink {
+  accept: func(f: future<u32>);
+}
+
+world serve {
+  import sink;
+  export wasi:http/handler@0.3.0;
+}
+
+package wasi:http@0.3.0 {
+  interface handler {}
+}
+";
+    const JS: &str = "\
+import { accept } from 'test:serve-future/sink';
+addEventListener('fetch', (event) => {
+  accept(Promise.resolve(7));
+  event.respondWith(new Response('ok'));
+});
+";
+    static STASH: std::sync::Mutex<Vec<wasmtime::component::FutureReader<u32>>> =
+        std::sync::Mutex::new(Vec::new());
+    let component = shared::compile_fixture(&ENGINE, WIT, "serve", JS).await;
+    let linker = shared::http_linker_with(&ENGINE, &component, &["test:serve-future/"], |linker| {
+        linker.instance("test:serve-future/sink")?.func_wrap(
+            "accept",
+            |_store, (f,): (wasmtime::component::FutureReader<u32>,)| {
+                STASH.lock().unwrap().push(f);
+                Ok(())
+            },
+        )
+    });
+    let (mut store, stderr) = store_capturing_stderr();
+    let service = Service::instantiate_async(&mut store, &component, &linker).await?;
+    let (status, _) = shared::handle_on(&mut store, &service, "GET", "/", "")
+        .await?
+        .map_err(|code| anyhow::anyhow!("{code:?}"))?;
+    assert_eq!(status, 200);
+    // Let the request's background drain run before the future is read. The read
+    // succeeds whether or not the drain has finished by then.
+    store
+        .run_concurrent(async |_store| {
+            tokio::time::sleep(std::time::Duration::from_millis(300)).await;
+        })
+        .await?;
+    let reader = STASH.lock().unwrap().pop().expect("accept was called");
+    let read = store
+        .run_concurrent(async |store| shared::read_future(store, reader).await)
+        .await;
+    assert_eq!(read??, 7, "{}", shared::pipe_text(&stderr));
+    Ok(())
+}
+
+/// A `fetch` listener's rejection that nothing handles is reported during the
+/// request, even when the listener waits on nothing.
+#[tokio::test]
+async fn listener_unhandled_rejection_is_reported() -> anyhow::Result<()> {
+    let component = listener().await;
+    let (mut store, stderr) = store_capturing_stderr();
+    let service = Service::instantiate_async(
+        &mut store,
+        component,
+        &shared::http_linker(&ENGINE, component),
+    )
+    .await?;
+    let (status, _) = shared::handle_on(&mut store, &service, "GET", "/reject", "")
+        .await?
+        .map_err(|code| anyhow::anyhow!("{code:?}"))?;
+    assert_eq!(status, 200);
+    let stderr = shared::pipe_text(&stderr);
+    assert!(
+        stderr.contains("Uncaught (in promise) listener rejection"),
+        "{stderr}"
+    );
+    Ok(())
+}
+
+/// An object that is not a `Response` passed where an import takes an owned
+/// `response` throws a `TypeError` the guest can catch.
+#[tokio::test]
+async fn plain_object_for_an_owned_response_throws() -> anyhow::Result<()> {
+    let (status, body) = serve_request(raw_response().await, "GET", "/plain-object").await?;
+    assert_eq!(status, 200);
+    assert_eq!(
+        body,
+        "threw TypeError: argument 1 of `Response.consumeBody`: expected an instance of the \
+         imported resource's class, got an object"
+    );
+    Ok(())
+}
+
+/// A `Response` whose body was read, is locked, or was sent already, passed
+/// where an import takes an owned `response`, throws a `TypeError` the guest can
+/// catch.
+#[tokio::test]
+async fn unusable_response_for_an_owned_response_throws() -> anyhow::Result<()> {
+    let (status, body) = serve_request(raw_response().await, "GET", "/unusable").await?;
+    assert_eq!(status, 200);
+    let unusable = "TypeError: argument 1 of `Response.consumeBody`: the Response has an \
+                    unusable body: it was read, or is locked";
+    assert_eq!(
+        body,
+        format!("read: {unusable}\nlocked: {unusable}\nfetched: sent\nagain: {unusable}")
+    );
+    Ok(())
+}
diff --git a/componentize/tests/shared/mod.rs b/componentize/tests/shared/mod.rs
new file mode 100644
index 00000000..0c7ffdb1
--- /dev/null
+++ b/componentize/tests/shared/mod.rs
@@ -0,0 +1,749 @@
+// SPDX-License-Identifier: Apache-2.0-WITH-LLVM-exception
+
+//! Helpers shared by the componentization suites.
+
+#![allow(dead_code)]
+
+use futures::FutureExt as _;
+use std::any::Any;
+use std::collections::VecDeque;
+use std::future::Future;
+use std::panic::AssertUnwindSafe;
+use std::path::PathBuf;
+use std::pin::Pin;
+use std::sync::atomic::{AtomicBool, Ordering};
+use std::sync::{Arc, Mutex};
+use std::task::{Context, Poll};
+use tokio::sync::OnceCell;
+use wasmtime::component::{
+    Accessor, Destination, FutureConsumer, FutureReader, ResourceTable, Source, StreamConsumer,
+    StreamProducer, StreamReader, StreamResult, VecBuffer,
+};
+use wasmtime::{AsContextMut, Store, StoreContextMut};
+use wasmtime_wasi::p2::pipe::MemoryOutputPipe;
+use wasmtime_wasi::{WasiCtx, WasiCtxBuilder, WasiCtxView, WasiView};
+
+/// The repository root, which the runtime builds and the fixtures are found
+/// relative to.
+pub fn workspace_root() -> PathBuf {
+    PathBuf::from(env!("CARGO_MANIFEST_DIR"))
+        .join("..")
+        .canonicalize()
+        .expect("canonicalizing the workspace root")
+}
+
+/// The runtime component `STARLING_RUNTIME` names, defaulting to what `just
+/// build-runtime-debug` writes.
+pub fn runtime_path() -> PathBuf {
+    std::env::var("STARLING_RUNTIME")
+        .map(PathBuf::from)
+        .unwrap_or_else(|_| workspace_root().join("target/wasm32-wasip3/debug/starling.wasm"))
+}
+
+/// Run `starling-componentize <args>` in `dir`, or the test's working directory
+/// without one, with the runtime at [`runtime_path`] rather than the one it
+/// embeds.
+pub fn run_cli(args: &[&str], dir: Option<&std::path::Path>) -> std::process::Output {
+    let mut command = std::process::Command::new(env!("CARGO_BIN_EXE_starling-componentize"));
+    if let Some(dir) = dir {
+        command.current_dir(dir);
+    }
+    command
+        .args(args)
+        .env("STARLING_RUNTIME", runtime_path())
+        .stdin(std::process::Stdio::null())
+        .output()
+        .expect("running `starling-componentize`")
+}
+
+/// What `starling-componentize <args>` prints to stdout (see [`run_cli`]),
+/// panicking with its stderr if it fails.
+pub fn cli_output(args: &[&str]) -> String {
+    let output = run_cli(args, None);
+    assert!(
+        output.status.success(),
+        "`starling-componentize {}` failed:\n{}",
+        args.join(" "),
+        String::from_utf8_lossy(&output.stderr)
+    );
+    String::from_utf8(output.stdout).expect("UTF-8 output")
+}
+
+/// The runtime build at [`runtime_path`]. The error names the path, since a
+/// missing runtime build is the usual way a suite fails on a fresh checkout.
+pub fn runtime() -> anyhow::Result<componentize::Runtime> {
+    let path = runtime_path();
+    let bytes = std::fs::read(&path).map_err(|e| {
+        anyhow::anyhow!(
+            "unable to read `{}` ({e}); run `just build-runtime-debug` first",
+            path.display()
+        )
+    })?;
+    componentize::Runtime::new(bytes)
+}
+
+/// The WASI context and resource table a suite's store data holds.
+///
+/// A suite that needs host state of its own (a captured log, an HTTP context)
+/// holds this next to it, rather than repeating the two fields and the
+/// `WasiView` impl over them.
+pub struct Wasi {
+    ctx: WasiCtx,
+    table: ResourceTable,
+}
+
+impl Wasi {
+    /// A context inheriting the test process's stdout and stderr.
+    pub fn inherit() -> Wasi {
+        Wasi::from_builder(WasiCtxBuilder::new().inherit_stdout().inherit_stderr())
+    }
+
+    /// A context from a suite's own builder, for one that captures output or
+    /// preopens a directory.
+    pub fn from_builder(builder: &mut WasiCtxBuilder) -> Wasi {
+        Wasi {
+            ctx: builder.build(),
+            table: ResourceTable::default(),
+        }
+    }
+
+    /// The view a `WasiView` impl returns.
+    pub fn view(&mut self) -> WasiCtxView<'_> {
+        WasiCtxView {
+            ctx: &mut self.ctx,
+            table: &mut self.table,
+        }
+    }
+
+    /// The resource table, for a `WasiHttpView` that pairs it with its own
+    /// context.
+    pub fn table(&mut self) -> &mut ResourceTable {
+        &mut self.table
+    }
+}
+
+/// The store data for a suite whose world needs nothing but WASI.
+pub struct Ctx {
+    pub wasi: Wasi,
+}
+
+impl WasiView for Ctx {
+    fn ctx(&mut self) -> WasiCtxView<'_> {
+        self.wasi.view()
+    }
+}
+
+/// A fresh store for a suite whose world needs nothing but WASI.
+pub fn store(engine: &wasmtime::Engine) -> Store<Ctx> {
+    Store::new(
+        engine,
+        Ctx {
+            wasi: Wasi::inherit(),
+        },
+    )
+}
+
+/// A WASI context whose stderr goes to the returned pipe, for the tests that
+/// assert on the message the runtime prints when it traps a call.
+pub fn wasi_capturing_stderr() -> (Wasi, MemoryOutputPipe) {
+    let stderr = MemoryOutputPipe::new(64 * 1024);
+    let wasi = Wasi::from_builder(
+        WasiCtxBuilder::new()
+            .inherit_stdout()
+            .stderr(stderr.clone()),
+    );
+    (wasi, stderr)
+}
+
+/// A fresh store for a suite whose world needs nothing but WASI, with the
+/// guest's stderr going to the returned pipe.
+pub fn store_capturing_stderr(engine: &wasmtime::Engine) -> (Store<Ctx>, MemoryOutputPipe) {
+    let (wasi, stderr) = wasi_capturing_stderr();
+    (Store::new(engine, Ctx { wasi }), stderr)
+}
+
+/// Componentize `js` against `world` of `wit` with the runtime build [`runtime`]
+/// reads and `options`.
+pub async fn componentize_with<'a>(
+    wit: componentize::Wit<'_>,
+    world: impl Into<componentize::WorldSelection<'a>>,
+    js: impl Into<componentize::JsSource<'_>>,
+    options: &componentize::ComponentizeOptions<'_>,
+) -> anyhow::Result<componentize::Componentized> {
+    componentize::componentize(wit, world, js, &runtime()?, options).await
+}
+
+/// Componentize `js` against the world `world` of the WIT source `wit`, with the
+/// runtime build [`runtime`] reads and the default options.
+pub async fn try_componentize(wit: &str, world: &str, js: &str) -> anyhow::Result<Vec<u8>> {
+    componentize_with(
+        componentize::Wit::String(wit),
+        Some(world),
+        js,
+        &Default::default(),
+    )
+    .await
+    .map(|componentized| componentized.component)
+}
+
+/// Like [`try_componentize`], but compiles the result for `engine` and panics if
+/// either step fails.
+pub async fn compile_fixture(
+    engine: &wasmtime::Engine,
+    wit: &str,
+    world: &str,
+    js: &str,
+) -> wasmtime::component::Component {
+    let component = try_componentize(wit, world, js)
+        .await
+        .unwrap_or_else(|e| panic!("componentizing the `{world}` world: {e:#}"));
+    wasmtime::component::Component::new(engine, &component).expect("compiling the component")
+}
+
+/// Whether the call or the `run_concurrent` around it returned `Err`.
+pub fn call_failed<T>(outcome: &wasmtime::Result<wasmtime::Result<T>>) -> bool {
+    match outcome {
+        Err(_) => true,
+        Ok(inner) => inner.is_err(),
+    }
+}
+
+/// The text a [`MemoryOutputPipe`] holds.
+pub fn pipe_text(pipe: &MemoryOutputPipe) -> String {
+    String::from_utf8_lossy(&pipe.contents()).into_owned()
+}
+
+/// Componentize a suite's world once and hand every case in the binary the same value.
+///
+/// [`OnceCell::get_or_init`] abandons the cell when its initializer panics, so the next case
+/// would start the initializer again, and componentizing a world takes tens of seconds. This
+/// records the failure and replays it, so a broken world takes one attempt and every case after
+/// the first fails immediately.
+pub async fn build_once<T>(
+    cell: &'static OnceCell<Result<T, String>>,
+    build: impl Future<Output = T>,
+) -> &'static T {
+    cell.get_or_init(|| async {
+        AssertUnwindSafe(build)
+            .catch_unwind()
+            .await
+            .map_err(panic_message)
+    })
+    .await
+    .as_ref()
+    .unwrap_or_else(|message| panic!("{message}"))
+}
+
+/// The message from a panic payload, for replaying a recorded failure. The panic itself was
+/// already reported by the default hook when it happened.
+fn panic_message(payload: Box<dyn Any + Send>) -> String {
+    payload
+        .downcast_ref::<&str>()
+        .map(|s| (*s).to_string())
+        .or_else(|| payload.downcast_ref::<String>().cloned())
+        .unwrap_or_else(|| "componentizing the world panicked".to_string())
+}
+
+/// The engine configuration under which every suite runs its componentized app.
+///
+/// Compiling the snapshot is the second cranelift pass over the component in a suite, after the
+/// componentizer's own, and it repeats on every run. With wasmtime's compilation cache, a run that
+/// did not rebuild the runtime reuses the compilations of both the snapshot and the
+/// componentizer.
+pub fn engine() -> wasmtime::Engine {
+    let mut config = wasmtime::Config::new();
+    config.wasm_component_model(true);
+    config.wasm_component_model_async(true);
+    // As in the componentizer's own engine, the compiled code's unwind information isn't
+    // registered with the system unwinder, which serializes the suite's threads on macOS.
+    config.native_unwind_info(false);
+    config.cache(wasmtime::Cache::from_file(None).ok());
+    wasmtime::Engine::new(&config).unwrap()
+}
+
+/// A `StreamConsumer<u8>` that collects bytes until it has `limit` of them, then
+/// drops its end of the stream, and records when it is dropped: when the stream
+/// ends, or when it hangs up itself.
+pub struct BytesConsumer {
+    pub sink: Arc<Mutex<Vec<u8>>>,
+    pub ended: Arc<AtomicBool>,
+    pub limit: usize,
+}
+
+impl<D> StreamConsumer<D> for BytesConsumer {
+    type Item = u8;
+
+    fn poll_consume(
+        self: Pin<&mut Self>,
+        _cx: &mut Context<'_>,
+        mut store: StoreContextMut<D>,
+        mut source: Source<'_, u8>,
+        _finish: bool,
+    ) -> Poll<wasmtime::Result<StreamResult>> {
+        let pending = source.remaining(store.as_context_mut());
+        let mut buf: Vec<u8> = Vec::with_capacity(pending);
+        source.read(store.as_context_mut(), &mut buf)?;
+        let mut sink = self.sink.lock().unwrap();
+        sink.extend_from_slice(&buf);
+        if sink.len() >= self.limit {
+            Poll::Ready(Ok(StreamResult::Dropped))
+        } else {
+            Poll::Ready(Ok(StreamResult::Completed))
+        }
+    }
+}
+
+impl Drop for BytesConsumer {
+    fn drop(&mut self) {
+        self.ended.store(true, Ordering::SeqCst);
+    }
+}
+
+/// A `StreamProducer<u8>` that delivers one queued chunk per read, and records
+/// when it is dropped, which happens once the reader drops its end or every
+/// chunk is delivered. With `endless`, it delivers a 1 KiB chunk per read once
+/// the queue is empty, forever.
+pub struct ChunkProducer {
+    pub chunks: VecDeque<Vec<u8>>,
+    pub endless: bool,
+    pub dropped: Arc<AtomicBool>,
+}
+
+impl<D> StreamProducer<D> for ChunkProducer {
+    type Item = u8;
+    type Buffer = VecBuffer<u8>;
+
+    fn poll_produce<'a>(
+        self: Pin<&mut Self>,
+        _cx: &mut Context<'_>,
+        _store: StoreContextMut<'a, D>,
+        mut destination: Destination<'a, u8, VecBuffer<u8>>,
+        _finish: bool,
+    ) -> Poll<wasmtime::Result<StreamResult>> {
+        let this = self.get_mut();
+        let chunk = match this.chunks.pop_front() {
+            Some(chunk) => chunk,
+            None if this.endless => vec![7; 1024],
+            None => return Poll::Ready(Ok(StreamResult::Dropped)),
+        };
+        destination.set_buffer(chunk.into());
+        Poll::Ready(Ok(StreamResult::Completed))
+    }
+}
+
+impl Drop for ChunkProducer {
+    fn drop(&mut self) {
+        self.dropped.store(true, Ordering::SeqCst);
+    }
+}
+
+/// Yield to the guest until `done` holds. Panics if it still does not after
+/// 100 000 turns.
+pub async fn until(done: impl Fn() -> bool) {
+    for _ in 0..100_000 {
+        if done() {
+            return;
+        }
+        tokio::task::yield_now().await;
+    }
+    panic!("the awaited condition did not hold within 100 000 turns");
+}
+
+/// Read a stream the guest produced until it ends. Returns the values and
+/// whether it ended.
+pub async fn collect_all<T: 'static, D: wasmtime::component::HasData, E>(
+    store: &Accessor<T, D>,
+    stream: StreamReader<E>,
+) -> anyhow::Result<(Vec<E>, bool)>
+where
+    E: wasmtime::component::Lift + Send + Sync + 'static,
+{
+    let sink = Arc::new(Mutex::new(Vec::new()));
+    let ended = Arc::new(AtomicBool::new(false));
+    store.with(|store| {
+        stream.pipe(
+            store,
+            EndingConsumer {
+                sink: sink.clone(),
+                ended: ended.clone(),
+            },
+        )
+    })?;
+    until(|| ended.load(Ordering::SeqCst)).await;
+    let values = std::mem::take(&mut *sink.lock().unwrap());
+    Ok((values, ended.load(Ordering::SeqCst)))
+}
+
+/// A `StreamConsumer<T>` that collects every value it receives, and records when
+/// it is dropped, which happens once the stream ends.
+struct EndingConsumer<T> {
+    sink: Arc<Mutex<Vec<T>>>,
+    ended: Arc<AtomicBool>,
+}
+
+impl<D, T> StreamConsumer<D> for EndingConsumer<T>
+where
+    T: wasmtime::component::Lift + Send + Sync + 'static,
+{
+    type Item = T;
+
+    fn poll_consume(
+        self: Pin<&mut Self>,
+        _cx: &mut Context<'_>,
+        mut store: StoreContextMut<D>,
+        mut source: Source<'_, T>,
+        _finish: bool,
+    ) -> Poll<wasmtime::Result<StreamResult>> {
+        let pending = source.remaining(store.as_context_mut());
+        let mut buf: Vec<T> = Vec::with_capacity(pending);
+        source.read(store.as_context_mut(), &mut buf)?;
+        self.sink.lock().unwrap().extend(buf);
+        Poll::Ready(Ok(StreamResult::Completed))
+    }
+}
+
+impl<T> Drop for EndingConsumer<T> {
+    fn drop(&mut self) {
+        self.ended.store(true, Ordering::SeqCst);
+    }
+}
+
+/// A `FutureConsumer<T>` that stores the value it receives in a shared slot.
+pub struct OptionConsumer<T> {
+    pub slot: Arc<Mutex<Option<T>>>,
+}
+
+impl<D, T> FutureConsumer<D> for OptionConsumer<T>
+where
+    T: wasmtime::component::Lift + Send + Sync + 'static,
+{
+    type Item = T;
+
+    fn poll_consume(
+        self: Pin<&mut Self>,
+        _cx: &mut Context<'_>,
+        mut store: StoreContextMut<D>,
+        mut source: Source<'_, T>,
+        _finish: bool,
+    ) -> Poll<wasmtime::Result<()>> {
+        let mut buf: Vec<T> = Vec::with_capacity(1);
+        source.read(store.as_context_mut(), &mut buf)?;
+        if let Some(value) = buf.into_iter().next() {
+            *self.slot.lock().unwrap() = Some(value);
+        }
+        Poll::Ready(Ok(()))
+    }
+}
+
+/// Read a `future<E>` the guest wrote.
+pub async fn read_future<T: 'static, D: wasmtime::component::HasData, E>(
+    store: &Accessor<T, D>,
+    future: FutureReader<E>,
+) -> anyhow::Result<E>
+where
+    E: wasmtime::component::Lift + Send + Sync + 'static,
+{
+    let slot = Arc::new(Mutex::new(None));
+    store.with(|store| future.pipe(store, OptionConsumer { slot: slot.clone() }))?;
+    until(|| slot.lock().unwrap().is_some()).await;
+    let value = slot.lock().unwrap().take();
+    value.ok_or_else(|| anyhow::anyhow!("the future delivered no value"))
+}
+
+/// Read a `stream<u8>` the guest returned until it ends, or until `limit` bytes
+/// arrived, at which point the host drops its end. Returns the bytes and whether
+/// the host's end was dropped.
+pub async fn read_bytes<T: 'static>(
+    store: &Accessor<T>,
+    stream: StreamReader<u8>,
+    limit: usize,
+) -> anyhow::Result<(Vec<u8>, bool)> {
+    let sink = Arc::new(Mutex::new(Vec::new()));
+    let ended = Arc::new(AtomicBool::new(false));
+    store.with(|store| {
+        stream.pipe(
+            store,
+            BytesConsumer {
+                sink: sink.clone(),
+                ended: ended.clone(),
+                limit,
+            },
+        )
+    })?;
+    until(|| ended.load(Ordering::SeqCst)).await;
+    let bytes = std::mem::take(&mut *sink.lock().unwrap());
+    Ok((bytes, ended.load(Ordering::SeqCst)))
+}
+
+/// A host-produced `stream<u8>` delivering `chunks` one per read, and the flag its
+/// producer sets when it is dropped.
+pub fn chunked_input<T: 'static>(
+    store: &Accessor<T>,
+    chunks: &[&[u8]],
+    endless: bool,
+) -> anyhow::Result<(StreamReader<u8>, Arc<AtomicBool>)> {
+    let dropped = Arc::new(AtomicBool::new(false));
+    let producer = ChunkProducer {
+        chunks: chunks.iter().map(|chunk| chunk.to_vec()).collect(),
+        endless,
+        dropped: dropped.clone(),
+    };
+    let stream = store.with(|store| StreamReader::new(store, producer))?;
+    Ok((stream, dropped))
+}
+
+/// The `wasi:http` hooks of the suites that `fetch`: every outgoing request is
+/// answered with a `200` whose body is the request's body for a `POST`,
+/// `echo <method> <path>` for a path starting with `/echo`, `partial ` followed
+/// by a `connection-terminated` error for a path starting with `/broken`, and
+/// `body` otherwise. `default-features = false` on
+/// `wasmtime-wasi-http` drops `default-send-request`, so no request reaches a
+/// real network.
+pub struct UpstreamHooks {
+    pub body: &'static str,
+}
+
+impl wasmtime_wasi_http::WasiHttpHooks for UpstreamHooks {
+    fn send_request(
+        &mut self,
+        request: http::Request<
+            http_body_util::combinators::UnsyncBoxBody<bytes::Bytes, wasmtime_wasi_http::Error>,
+        >,
+        _options: Option<wasmtime_wasi_http::RequestOptions>,
+        _fut: Box<dyn Future<Output = Result<(), wasmtime_wasi_http::Error>> + Send>,
+    ) -> Box<
+        dyn Future<
+                Output = Result<
+                    (
+                        http::Response<
+                            http_body_util::combinators::UnsyncBoxBody<
+                                bytes::Bytes,
+                                wasmtime_wasi_http::Error,
+                            >,
+                        >,
+                        Box<dyn Future<Output = Result<(), wasmtime_wasi_http::Error>> + Send>,
+                    ),
+                    wasmtime_wasi_http::Error,
+                >,
+            > + Send,
+    > {
+        use http_body_util::BodyExt as _;
+        let path = request.uri().path().to_string();
+        let text = if path.starts_with("/echo") {
+            format!("echo {} {path}", request.method())
+        } else {
+            self.body.to_string()
+        };
+        let broken = path.starts_with("/broken");
+        Box::new(async move {
+            let body = if broken {
+                use wasmtime_wasi_http::p3::bindings::http::types::ErrorCode;
+                let frames = futures::stream::iter([
+                    Ok(http_body::Frame::data(bytes::Bytes::from_static(
+                        b"partial ",
+                    ))),
+                    Err(wasmtime_wasi_http::Error::from(
+                        ErrorCode::ConnectionTerminated,
+                    )),
+                ]);
+                http_body_util::StreamBody::new(frames).boxed_unsync()
+            } else if request.method() == http::Method::POST {
+                request.into_body()
+            } else {
+                http_body_util::Full::new(bytes::Bytes::from(text))
+                    .map_err(|never: std::convert::Infallible| match never {})
+                    .boxed_unsync()
+            };
+            let response = http::Response::builder()
+                .status(200)
+                .body(body)
+                .expect("building the upstream response");
+            let io: Box<dyn Future<Output = Result<(), wasmtime_wasi_http::Error>> + Send> =
+                Box::new(async { Ok(()) });
+            Ok((response, io))
+        })
+    }
+}
+
+/// The store data for a suite whose world needs WASI and `wasi:http`.
+pub struct HttpCtx {
+    pub wasi: Wasi,
+    pub http: wasmtime_wasi_http::WasiHttpCtx,
+    pub hooks: UpstreamHooks,
+}
+
+impl WasiView for HttpCtx {
+    fn ctx(&mut self) -> WasiCtxView<'_> {
+        self.wasi.view()
+    }
+}
+
+impl wasmtime_wasi_http::WasiHttpView for HttpCtx {
+    fn http(&mut self) -> wasmtime_wasi_http::WasiHttpCtxView<'_> {
+        wasmtime_wasi_http::WasiHttpCtxView {
+            ctx: &mut self.http,
+            table: self.wasi.table(),
+            hooks: &mut self.hooks,
+        }
+    }
+}
+
+/// A fresh store for a suite whose world needs WASI and `wasi:http`, whose
+/// outgoing requests are answered with `body` (see [`UpstreamHooks`]).
+pub fn http_store(engine: &wasmtime::Engine, body: &'static str) -> Store<HttpCtx> {
+    Store::new(
+        engine,
+        HttpCtx {
+            wasi: Wasi::inherit(),
+            http: wasmtime_wasi_http::WasiHttpCtx::new(),
+            hooks: UpstreamHooks { body },
+        },
+    )
+}
+
+/// Like [`http_store`], with the guest's stderr captured in the returned pipe.
+pub fn http_store_capturing_stderr(
+    engine: &wasmtime::Engine,
+    body: &'static str,
+) -> (Store<HttpCtx>, MemoryOutputPipe) {
+    let (wasi, stderr) = wasi_capturing_stderr();
+    let ctx = HttpCtx {
+        wasi,
+        http: wasmtime_wasi_http::WasiHttpCtx::new(),
+        hooks: UpstreamHooks { body },
+    };
+    (Store::new(engine, ctx), stderr)
+}
+
+/// A linker for `component`: the WASI host added by [`componentize::add_wasi`],
+/// the definitions from `add`, and trapping stubs for the component's other imports.
+/// `provided` names the interface prefixes `add` provides, as
+/// [`componentize::trap_unsatisfied_imports`] takes them.
+pub fn linker<T: WasiView + 'static>(
+    engine: &wasmtime::Engine,
+    component: &wasmtime::component::Component,
+    provided: &[&str],
+    add: impl FnOnce(&mut wasmtime::component::Linker<T>) -> wasmtime::Result<()>,
+) -> wasmtime::component::Linker<T> {
+    let mut linker = wasmtime::component::Linker::new(engine);
+    componentize::add_wasi(&mut linker).expect("wasi linker");
+    add(&mut linker).expect("adding the suite's host");
+    componentize::trap_unsatisfied_imports(engine, component, &mut linker, provided)
+        .expect("trap-stub unknown imports");
+    linker
+}
+
+/// Like [`linker`], for a component that exports `wasi:http/handler`, and with
+/// the p3 `wasi:http` host, which defines the handler's request and response
+/// resources.
+pub fn http_linker(
+    engine: &wasmtime::Engine,
+    component: &wasmtime::component::Component,
+) -> wasmtime::component::Linker<HttpCtx> {
+    http_linker_with(engine, component, &[], |_| Ok(()))
+}
+
+/// Like [`http_linker`], with the definitions from `add`, which provide the
+/// interfaces whose prefixes `provided` names.
+pub fn http_linker_with(
+    engine: &wasmtime::Engine,
+    component: &wasmtime::component::Component,
+    provided: &[&str],
+    add: impl FnOnce(&mut wasmtime::component::Linker<HttpCtx>) -> wasmtime::Result<()>,
+) -> wasmtime::component::Linker<HttpCtx> {
+    let provided: Vec<&str> = ["wasi:http/"]
+        .into_iter()
+        .chain(provided.iter().copied())
+        .collect();
+    linker(engine, component, &provided, |linker| {
+        wasmtime_wasi_http::p3::add_to_linker(linker)?;
+        add(linker)
+    })
+}
+
+/// Drive `wasi:http/handler.handle()` on `service`, an instance in `store`, with
+/// a `method` request to `path` whose body is `body`. Returns the response status
+/// and the collected body as a string, or the `error-code` the handler returned.
+pub async fn handle_on(
+    store: &mut Store<HttpCtx>,
+    service: &wasmtime_wasi_http::p3::bindings::Service,
+    method: &str,
+    path: &str,
+    body: &'static str,
+) -> anyhow::Result<Result<(u16, String), wasmtime_wasi_http::p3::bindings::http::types::ErrorCode>>
+{
+    use bytes::Bytes;
+    use futures::future::{select, Either};
+    use http_body_util::{BodyExt as _, Collected, Full};
+    use wasmtime_wasi_http::p3::bindings::http::types::ErrorCode;
+
+    // `Full<Bytes>`'s error type is `Infallible`, which `ErrorCode:
+    // From<Infallible>` lifts into the wit stream's element error.
+    let req = http::Request::builder()
+        .method(method)
+        .uri(format!("http://example.com{path}"))
+        .header(http::header::CONTENT_LENGTH, body.len())
+        .body(Full::new(Bytes::from_static(body.as_bytes())))
+        .expect("building the request");
+    let (req, io) = wasmtime_wasi_http::p3::Request::from_http(
+        &mut UpstreamHooks {
+            body: store.data().hooks.body,
+        },
+        req,
+    );
+
+    let response: Result<http::Response<Collected<Bytes>>, ErrorCode> = store
+        .run_concurrent(async |store| {
+            // The handler call and the request-body-processing future run
+            // concurrently: `io` resolves once the request body is consumed,
+            // while `handle` runs the guest until it responds. A handler that
+            // responds without consuming the body leaves `io` pending, so the
+            // response is returned without waiting for it.
+            let handled = std::pin::pin!(async {
+                let res = match service.handle(store, req).await? {
+                    Ok(res) => res,
+                    Err(code) => return anyhow::Ok(Err(code)),
+                };
+                let res = store.with(|store| res.into_http(store, async { Ok(()) }))?;
+                let (parts, body) = res.into_parts();
+                let body = body.collect().await?;
+                anyhow::Ok(Ok(http::Response::from_parts(parts, body)))
+            });
+            let io = std::pin::pin!(async {
+                io.await.map_err(|e| anyhow::anyhow!("request body: {e:?}"))
+            });
+            match select(handled, io).await {
+                Either::Left((res, _io)) => res,
+                Either::Right((io, handled)) => {
+                    io?;
+                    handled.await
+                }
+            }
+        })
+        .await??;
+
+    Ok(response.map(|response| {
+        let status = response.status().as_u16();
+        let body = String::from_utf8_lossy(&response.into_body().to_bytes()).into_owned();
+        (status, body)
+    }))
+}
+
+/// The import and export names of a component's world.
+pub fn surface(component: &[u8]) -> (Vec<String>, Vec<String>) {
+    let wit_parser::decoding::DecodedWasm::Component(resolve, world) =
+        wit_parser::decoding::decode(component).expect("decoding the component")
+    else {
+        panic!("not a component");
+    };
+    let names = |items: &indexmap::IndexMap<wit_parser::WorldKey, wit_parser::WorldItem>| {
+        items
+            .keys()
+            .map(|key| resolve.name_world_key(key))
+            .collect::<Vec<_>>()
+    };
+    (
+        names(&resolve.worlds[world].imports),
+        names(&resolve.worlds[world].exports),
+    )
+}
diff --git a/componentize/tests/streams.rs b/componentize/tests/streams.rs
new file mode 100644
index 00000000..6c2cae01
--- /dev/null
+++ b/componentize/tests/streams.rs
@@ -0,0 +1,1632 @@
+// SPDX-License-Identifier: Apache-2.0-WITH-LLVM-exception
+
+//! Component Model streams and futures: the `streams` world of `fixtures/streams.{wit,js}`,
+//! whose exports take and return `stream<T>` and `future<T>` values, which the guest handles as
+//! `ReadableStream`s and `Promise`s. The world also imports `host-thing-interface`, a host-owned
+//! resource whose elements `short_reads_host` streams, and `transfers`, whose functions take and
+//! return streams and futures.
+
+mod shared;
+
+use shared::{call_failed, chunked_input, collect_all, read_bytes, read_future, until, Ctx};
+
+use {
+    std::{
+        pin::Pin,
+        sync::{
+            atomic::{AtomicBool, Ordering},
+            Arc, Mutex,
+        },
+        task::{Context, Poll},
+    },
+    tokio::sync::OnceCell,
+    wasmtime::{
+        component::{
+            Accessor, Destination, FutureReader, HasSelf, Resource, Source, StreamConsumer,
+            StreamProducer, StreamReader, StreamResult, VecBuffer,
+        },
+        AsContextMut, Engine, Store, StoreContextMut,
+    },
+    wasmtime_wasi::p2::pipe::MemoryOutputPipe,
+};
+
+wasmtime::component::bindgen!({
+    path: "tests/fixtures/streams.wit",
+    world: "streams",
+    imports: { default: async },
+    exports: { default: async },
+    with: {
+        "test:streams/host-thing-interface.host-thing": ThingString,
+    },
+});
+
+/// The host `host-thing`, held in the resource table.
+pub struct ThingString(String);
+
+use test::streams::failing::Failure;
+
+impl test::streams::host_thing_interface::Host for Ctx {}
+
+impl test::streams::host_thing_interface::HostHostThing for Ctx {
+    async fn new(&mut self, s: String) -> Resource<ThingString> {
+        self.wasi.table().push(ThingString(s)).unwrap()
+    }
+    async fn get(&mut self, self_: Resource<ThingString>) -> String {
+        self.wasi.table().get(&self_).unwrap().0.clone()
+    }
+    async fn get_static(&mut self, v: Resource<ThingString>) -> String {
+        self.wasi.table().get(&v).unwrap().0.clone()
+    }
+    async fn drop(&mut self, rep: Resource<ThingString>) -> wasmtime::Result<()> {
+        self.wasi.table().delete(rep)?;
+        Ok(())
+    }
+}
+
+impl test::streams::failing::Host for Ctx {}
+
+impl test::streams::failing::HostWithStore<Ctx> for HasSelf<Ctx> {
+    async fn lookup(_accessor: &Accessor<Ctx, Self>, key: String) -> Result<String, Failure> {
+        if key == "present" {
+            Ok("value".to_string())
+        } else {
+            Err(Failure::NotFound(key))
+        }
+    }
+}
+
+impl test::streams::transfers::Host for Ctx {}
+
+impl test::streams::transfers::HostWithStore<Ctx> for HasSelf<Ctx> {
+    async fn sum(accessor: &Accessor<Ctx, Self>, s: StreamReader<u32>) -> u32 {
+        let (values, _) = collect_all(accessor, s).await.expect("reading the stream");
+        values.into_iter().sum()
+    }
+
+    async fn count(accessor: &Accessor<Ctx, Self>, n: u32) -> StreamReader<u32> {
+        accessor
+            .with(|store| StreamReader::new(store, (0..n).collect::<Vec<u32>>()))
+            .expect("creating the stream")
+    }
+
+    async fn later(accessor: &Accessor<Ctx, Self>, v: u32) -> FutureReader<u32> {
+        accessor
+            .with(|store| FutureReader::new(store, async move { Ok::<_, std::io::Error>(v) }))
+            .expect("creating the future")
+    }
+
+    async fn plus_one(accessor: &Accessor<Ctx, Self>, f: FutureReader<u32>) -> u32 {
+        read_future(accessor, f).await.expect("reading the future") + 1
+    }
+
+    async fn count_ticks(accessor: &Accessor<Ctx, Self>, s: StreamReader<()>) -> u32 {
+        let (ticks, _) = collect_all(accessor, s).await.expect("reading the stream");
+        ticks.len() as u32
+    }
+
+    async fn ticks(accessor: &Accessor<Ctx, Self>, n: u32) -> StreamReader<()> {
+        accessor
+            .with(|store| StreamReader::new(store, vec![(); n as usize]))
+            .expect("creating the stream")
+    }
+
+    async fn done(accessor: &Accessor<Ctx, Self>) -> FutureReader<()> {
+        future_of(accessor, ()).expect("creating the future")
+    }
+
+    async fn after(accessor: &Accessor<Ctx, Self>, f: FutureReader<()>, n: u32) -> u32 {
+        read_future(accessor, f).await.expect("reading the future");
+        n
+    }
+}
+
+/// A `StreamProducer<u8>` that doesn't produce a value until the read is cancelled,
+/// and records when it is dropped.
+struct PendingProducer {
+    dropped: Arc<AtomicBool>,
+}
+
+impl<D> StreamProducer<D> for PendingProducer {
+    type Item = u8;
+    type Buffer = VecBuffer<u8>;
+
+    fn poll_produce<'a>(
+        self: Pin<&mut Self>,
+        _cx: &mut Context<'_>,
+        _store: StoreContextMut<'a, D>,
+        _destination: Destination<'a, u8, VecBuffer<u8>>,
+        finish: bool,
+    ) -> Poll<wasmtime::Result<StreamResult>> {
+        if finish {
+            Poll::Ready(Ok(StreamResult::Cancelled))
+        } else {
+            Poll::Pending
+        }
+    }
+}
+
+impl Drop for PendingProducer {
+    fn drop(&mut self) {
+        self.dropped.store(true, Ordering::SeqCst);
+    }
+}
+
+/// A `StreamConsumer<T>` that reads exactly one element per `poll_consume`,
+/// collecting them into a shared `Vec<T>`. This turns each of the guest's writes
+/// into a partial write that sends one element and leaves the rest unsent, which
+/// a consumer reading every element at once never does.
+struct OneAtATimeConsumer<T> {
+    sink: Arc<Mutex<Vec<T>>>,
+}
+
+impl<D, T> StreamConsumer<D> for OneAtATimeConsumer<T>
+where
+    T: wasmtime::component::Lift + Send + Sync + 'static,
+{
+    type Item = T;
+
+    fn poll_consume(
+        self: Pin<&mut Self>,
+        _cx: &mut Context<'_>,
+        mut store: StoreContextMut<D>,
+        mut source: Source<'_, T>,
+        _finish: bool,
+    ) -> Poll<wasmtime::Result<StreamResult>> {
+        // An `Option` buffer makes `Source::read` take at most one element.
+        let mut slot: Option<T> = None;
+        source.read(store.as_context_mut(), &mut slot)?;
+        if let Some(value) = slot {
+            self.sink.lock().unwrap().push(value);
+        }
+        Poll::Ready(Ok(StreamResult::Completed))
+    }
+}
+
+static ENGINE: std::sync::LazyLock<Engine> = std::sync::LazyLock::new(shared::engine);
+
+/// Componentize the streams world once and hold the instantiation-ready `Pre`.
+async fn pre() -> &'static StreamsPre<Ctx> {
+    static PRE: OnceCell<Result<StreamsPre<Ctx>, String>> = OnceCell::const_new();
+    shared::build_once(&PRE, async {
+        let component = shared::compile_fixture(
+            &ENGINE,
+            include_str!("fixtures/streams.wit"),
+            "streams",
+            include_str!("fixtures/streams.js"),
+        )
+        .await;
+
+        let linker = shared::linker(&ENGINE, &component, &["test:streams/"], |linker| {
+            Streams::add_to_linker::<_, HasSelf<_>>(linker, |ctx| ctx)
+        });
+        StreamsPre::new(linker.instantiate_pre(&component).expect("instantiate_pre"))
+            .expect("StreamsPre")
+    })
+    .await
+}
+
+fn store() -> Store<Ctx> {
+    shared::store(&ENGINE)
+}
+
+fn store_capturing_stderr() -> (Store<Ctx>, MemoryOutputPipe) {
+    shared::store_capturing_stderr(&ENGINE)
+}
+
+/// A host-produced `future<T>` delivering `value`.
+fn future_of<T>(store: &Accessor<Ctx>, value: T) -> anyhow::Result<FutureReader<T>>
+where
+    T: wasmtime::component::Lower + wasmtime::component::Lift + Send + Sync + 'static,
+{
+    Ok(store
+        .with(|store| FutureReader::new(store, async move { Ok::<_, std::io::Error>(value) }))?)
+}
+
+/// The guest pipes the incoming `stream<u8>` through a `TransformStream` and
+/// returns its readable side. A byte stream several times the pump's 64 KiB
+/// batch, in chunks larger than one batch, arrives whole and in order.
+#[tokio::test]
+async fn large_byte_stream() -> anyhow::Result<()> {
+    let mut store = store();
+    let instance = pre().await.instantiate_async(&mut store).await?;
+    let data: Vec<u8> = (0..210_000u32).map(|i| (i % 251) as u8).collect();
+    let chunks: Vec<&[u8]> = data.chunks(70_000).collect();
+    store
+        .run_concurrent(async |store| {
+            let (input, _) = chunked_input(store, &chunks, false)?;
+            let echoed = instance
+                .test_streams_echoes()
+                .call_echo_stream_u8(store, input)
+                .await?;
+            let (bytes, ended) = read_bytes(store, echoed, usize::MAX).await?;
+            assert!(ended, "the echoed stream must end");
+            assert!(bytes == data, "the echoed bytes must equal the input");
+            anyhow::Ok(())
+        })
+        .await??;
+    Ok(())
+}
+
+/// A stream of several times the pump's 64-element batch arrives whole and in
+/// order.
+#[tokio::test]
+async fn many_elements() -> anyhow::Result<()> {
+    let mut store = store();
+    let instance = pre().await.instantiate_async(&mut store).await?;
+    store
+        .run_concurrent(async |store| {
+            let expected: Vec<String> = (0..300).map(|i| format!("element {i}")).collect();
+            let input = store.with(|store| StreamReader::new(store, expected.clone()))?;
+            let echoed = instance
+                .test_streams_echoes()
+                .call_echo_stream_string(store, input)
+                .await?;
+            let (received, ended) = collect_all(store, echoed).await?;
+            assert!(ended, "the echoed stream must end");
+            assert_eq!(expected, received);
+            anyhow::Ok(())
+        })
+        .await??;
+    Ok(())
+}
+
+/// The guest returns the incoming `stream<u8>` unread, which hands its handle
+/// straight back to the host.
+#[tokio::test]
+async fn pass_stream_u8() -> anyhow::Result<()> {
+    let mut store = store();
+    let instance = pre().await.instantiate_async(&mut store).await?;
+    store
+        .run_concurrent(async |store| {
+            let (input, _) = chunked_input(store, &[b"one", b"two", b"three"], false)?;
+            let passed = instance
+                .test_streams_echoes()
+                .call_pass_stream_u8(store, input)
+                .await?;
+            let (bytes, ended) = read_bytes(store, passed, usize::MAX).await?;
+            assert!(ended, "the passed-through stream must end");
+            assert_eq!(bytes, b"onetwothree");
+            anyhow::Ok(())
+        })
+        .await??;
+    Ok(())
+}
+
+/// The guest awaits an incoming `future<string>` or `future<u32>` and returns
+/// its value.
+#[tokio::test]
+async fn echo_futures() -> anyhow::Result<()> {
+    let mut store = store();
+    let instance = pre().await.instantiate_async(&mut store).await?;
+    store
+        .run_concurrent(async |store| {
+            let echoes = instance.test_streams_echoes();
+            let expected = "Beware the Jubjub bird, and shun\n\tThe frumious Bandersnatch!";
+            let input = future_of(store, expected.to_string())?;
+            let echoed = echoes.call_echo_future_string(store, input).await?;
+            assert_eq!(read_future(store, echoed).await?, expected);
+
+            let input = future_of(store, 0xCAFE_F00Du32)?;
+            let echoed = echoes.call_echo_future_u32(store, input).await?;
+            assert_eq!(read_future(store, echoed).await?, 0xCAFE_F00D);
+            anyhow::Ok(())
+        })
+        .await??;
+    Ok(())
+}
+
+/// A `stream<string>` reaches the guest one string per chunk, and the async
+/// generator the guest returns yields them back to a host reading one element
+/// per read, which forces the guest's writes into a sequence of partial writes.
+#[tokio::test]
+async fn short_reads_string() -> anyhow::Result<()> {
+    let mut store = store();
+    let instance = pre().await.instantiate_async(&mut store).await?;
+    store
+        .run_concurrent(async |store| {
+            let expected: Vec<String> = ["alpha", "", "βeta", "gamma\n\tδ", "ω", "last"]
+                .into_iter()
+                .map(str::to_string)
+                .collect();
+            let input = store.with(|store| StreamReader::new(store, expected.clone()))?;
+            let echoed = instance
+                .test_streams_echoes()
+                .call_echo_stream_string(store, input)
+                .await?;
+            let received = Arc::new(Mutex::new(Vec::new()));
+            store.with(|store| {
+                echoed.pipe(
+                    store,
+                    OneAtATimeConsumer {
+                        sink: received.clone(),
+                    },
+                )
+            })?;
+            until(|| received.lock().unwrap().len() >= expected.len()).await;
+            assert_eq!(&expected, &*received.lock().unwrap());
+            anyhow::Ok(())
+        })
+        .await??;
+    Ok(())
+}
+
+/// A `stream<point>` round-trips its records through the guest.
+#[tokio::test]
+async fn echo_stream_point() -> anyhow::Result<()> {
+    use exports::test::streams::echoes::Point;
+
+    let mut store = store();
+    let instance = pre().await.instantiate_async(&mut store).await?;
+    store
+        .run_concurrent(async |store| {
+            let expected: Vec<Point> = (0..5u32).map(|i| Point { x: i, y: i * 10 }).collect();
+            let input = store.with(|store| StreamReader::new(store, expected.clone()))?;
+            let echoed = instance
+                .test_streams_echoes()
+                .call_echo_stream_point(store, input)
+                .await?;
+            let (received, ended) = collect_all(store, echoed).await?;
+            assert!(ended, "the echoed stream must end");
+            let received: Vec<(u32, u32)> = received.iter().map(|p| (p.x, p.y)).collect();
+            let expected: Vec<(u32, u32)> = expected.iter().map(|p| (p.x, p.y)).collect();
+            assert_eq!(received, expected);
+            anyhow::Ok(())
+        })
+        .await??;
+    Ok(())
+}
+
+/// A `stream<thing>` of guest-owned resources round-trips through the guest,
+/// and each echoed handle still reaches the same `thing`.
+#[tokio::test]
+async fn echo_stream_thing() -> anyhow::Result<()> {
+    use wasmtime::component::ResourceAny;
+
+    let mut store = store();
+    let instance = pre().await.instantiate_async(&mut store).await?;
+    let strings = ["a", "b", "c", "d", "e"];
+    let mut things: Vec<ResourceAny> = Vec::with_capacity(strings.len());
+    for s in strings {
+        let thing = instance
+            .test_streams_echoes()
+            .thing()
+            .call_constructor(&mut store, s)
+            .await?;
+        things.push(thing);
+    }
+
+    let echoed_things = store
+        .run_concurrent(async |store| {
+            let input = store.with(|store| StreamReader::new(store, things))?;
+            let echoed = instance
+                .test_streams_echoes()
+                .call_echo_stream_thing(store, input)
+                .await?;
+            let (received, ended) = collect_all::<_, _, ResourceAny>(store, echoed).await?;
+            assert!(ended, "the echoed stream must end");
+            anyhow::Ok(received)
+        })
+        .await??;
+
+    assert_eq!(echoed_things.len(), strings.len());
+    for (got, want) in echoed_things.into_iter().zip(strings) {
+        let value = instance
+            .test_streams_echoes()
+            .thing()
+            .call_get(&mut store, got)
+            .await?;
+        assert_eq!(value, want, "echoed thing must wrap the same string");
+        got.resource_drop_async(&mut store).await?;
+    }
+    Ok(())
+}
+
+/// A `stream<u8>` is a readable byte stream, so a BYOB reader reads it into its
+/// own buffers, here smaller than the chunks the host delivers.
+#[tokio::test]
+async fn byob_read() -> anyhow::Result<()> {
+    let mut store = store();
+    let instance = pre().await.instantiate_async(&mut store).await?;
+    store
+        .run_concurrent(async |store| {
+            let (input, _) =
+                chunked_input(store, &[b"Twas brillig, and the ", b"slithy toves"], false)?;
+            let text = instance
+                .test_streams_echoes()
+                .call_byob_read(store, input)
+                .await?;
+            assert_eq!(text, "Twas brillig, and the slithy toves");
+            anyhow::Ok(())
+        })
+        .await??;
+    Ok(())
+}
+
+/// A returned async generator is converted with the same rules as
+/// `ReadableStream.from`, and the pump keeps the call's event loop alive across the timers the
+/// generator waits on between chunks.
+#[tokio::test]
+async fn async_generator_chunks_across_timers() -> anyhow::Result<()> {
+    let mut store = store();
+    let instance = pre().await.instantiate_async(&mut store).await?;
+    store
+        .run_concurrent(async |store| {
+            let chunks = instance
+                .test_streams_echoes()
+                .call_timed_chunks(store, 5)
+                .await?;
+            let (bytes, ended) = read_bytes(store, chunks, usize::MAX).await?;
+            assert!(ended, "the stream must end after the last chunk");
+            assert_eq!(bytes, [0, 1, 2, 3, 4]);
+            anyhow::Ok(())
+        })
+        .await??;
+    Ok(())
+}
+
+/// A stream the guest read from is returned through the pump, which delivers
+/// what the guest left unread.
+#[tokio::test]
+async fn partly_read_stream_returns_the_rest() -> anyhow::Result<()> {
+    let mut store = store();
+    let instance = pre().await.instantiate_async(&mut store).await?;
+    store
+        .run_concurrent(async |store| {
+            let (input, _) = chunked_input(store, &[b"first", b"second", b"third"], false)?;
+            let rest = instance
+                .test_streams_echoes()
+                .call_after_first_chunk(store, input)
+                .await?;
+            let (bytes, ended) = read_bytes(store, rest, usize::MAX).await?;
+            assert!(ended, "the rest of the stream must end");
+            assert_eq!(bytes, b"secondthird");
+            anyhow::Ok(())
+        })
+        .await??;
+    Ok(())
+}
+
+/// Cancelling a lifted stream drops its readable end, which the host sees as its
+/// producer being dropped, even though the producer never ends by itself.
+#[tokio::test]
+async fn cancel_after_first_chunk() -> anyhow::Result<()> {
+    let mut store = store();
+    let instance = pre().await.instantiate_async(&mut store).await?;
+    store
+        .run_concurrent(async |store| {
+            let (input, dropped) = chunked_input(store, &[b"0123456789"], true)?;
+            let read = instance
+                .test_streams_echoes()
+                .call_cancel_after_first_chunk(store, input)
+                .await?;
+            assert_eq!(read, 10, "the guest reads the first chunk");
+            until(|| dropped.load(Ordering::SeqCst)).await;
+            assert!(
+                dropped.load(Ordering::SeqCst),
+                "cancelling the stream must drop the host's producer"
+            );
+            anyhow::Ok(())
+        })
+        .await??;
+    Ok(())
+}
+
+/// A host that stops reading a returned stream cancels the guest's source, and
+/// the instance then streams again.
+#[tokio::test]
+async fn host_stops_reading() -> anyhow::Result<()> {
+    let mut store = store();
+    let instance = pre().await.instantiate_async(&mut store).await?;
+    let cancelled = store
+        .run_concurrent(async |store| {
+            let endless = instance.test_streams_echoes().call_endless(store).await?;
+            let (bytes, ended) = read_bytes(store, endless, 4096).await?;
+            assert!(
+                ended && bytes.len() >= 4096,
+                "the host reads, then hangs up"
+            );
+            let mut cancelled = false;
+            for _ in 0..1_000 {
+                cancelled = instance
+                    .test_streams_echoes()
+                    .call_endless_cancelled(store)
+                    .await?;
+                if cancelled {
+                    break;
+                }
+                tokio::task::yield_now().await;
+            }
+            // The abandoned pump leaves the instance usable for another stream.
+            let chunks = instance
+                .test_streams_echoes()
+                .call_timed_chunks(store, 3)
+                .await?;
+            let (bytes, ended) = read_bytes(store, chunks, usize::MAX).await?;
+            assert!(ended, "the later stream must end");
+            assert_eq!(bytes, [0, 1, 2]);
+            anyhow::Ok(cancelled)
+        })
+        .await??;
+    assert!(cancelled, "the guest's source must be cancelled");
+    Ok(())
+}
+
+/// A source that produces chunks that a `stream<u8>` can't take ends the stream early,
+/// and the runtime reports why on stderr.
+#[tokio::test]
+async fn wrong_chunks_end_the_stream() -> anyhow::Result<()> {
+    let (mut store, stderr) = store_capturing_stderr();
+    let instance = pre().await.instantiate_async(&mut store).await?;
+    store
+        .run_concurrent(async |store| {
+            let stream = instance
+                .test_streams_echoes()
+                .call_wrong_chunks(store)
+                .await?;
+            let (bytes, ended) = read_bytes(store, stream, usize::MAX).await?;
+            assert!(ended, "the stream must end");
+            assert!(bytes.is_empty(), "no chunk can be delivered");
+            anyhow::Ok(())
+        })
+        .await??;
+    let stderr = shared::pipe_text(&stderr);
+    assert!(
+        stderr.contains("a stream<u8> chunk must be an ArrayBufferView or an ArrayBuffer"),
+        "stderr should hold why the stream ended; got: {stderr}"
+    );
+    Ok(())
+}
+
+/// Returning a value that is neither a `ReadableStream` nor iterable for a
+/// `stream<u8>` traps.
+#[tokio::test]
+async fn not_a_stream_traps() -> anyhow::Result<()> {
+    let (mut store, stderr) = store_capturing_stderr();
+    let instance = pre().await.instantiate_async(&mut store).await?;
+    let outcome = store
+        .run_concurrent(async |store| {
+            instance
+                .test_streams_echoes()
+                .call_not_a_stream(store)
+                .await
+                .map(drop)
+        })
+        .await;
+    assert!(call_failed(&outcome), "returning 42 for a stream must trap");
+    let stderr = shared::pipe_text(&stderr);
+    assert!(
+        stderr.contains("expected a ReadableStream or an iterable object, got 42"),
+        "stderr should hold the reason; got: {stderr}"
+    );
+    Ok(())
+}
+
+/// A returned promise is the `future<result<string, string>>` itself: fulfilling
+/// it delivers `ok`, and rejecting it with an `Error` delivers its message as
+/// `err`, since a `string` can hold it.
+#[tokio::test]
+async fn future_result() -> anyhow::Result<()> {
+    let mut store = store();
+    let instance = pre().await.instantiate_async(&mut store).await?;
+    store
+        .run_concurrent(async |store| {
+            let echoes = instance.test_streams_echoes();
+            let fulfilled = echoes
+                .call_future_result(store, true, "fine".to_string())
+                .await?;
+            assert_eq!(read_future(store, fulfilled).await?, Ok("fine".to_string()));
+            let rejected = echoes
+                .call_future_result(store, false, "broken".to_string())
+                .await?;
+            assert_eq!(
+                read_future(store, rejected).await?,
+                Err("broken".to_string())
+            );
+            let bare = echoes
+                .call_future_result_bare(store, "bare".to_string())
+                .await?;
+            assert_eq!(read_future(store, bare).await?, Err("bare".to_string()));
+            anyhow::Ok(())
+        })
+        .await??;
+    Ok(())
+}
+
+/// A lifted `future<result<string, string>>` fulfills with its `ok` payload and
+/// rejects with a `ComponentError` holding its `err` payload.
+#[tokio::test]
+async fn future_result_settles_with_ok_or_component_error() -> anyhow::Result<()> {
+    let mut store = store();
+    let instance = pre().await.instantiate_async(&mut store).await?;
+    store
+        .run_concurrent(async |store| {
+            let echoes = instance.test_streams_echoes();
+            let ok = future_of(store, Ok::<String, String>("yes".to_string()))?;
+            assert_eq!(
+                echoes.call_describe_future_result(store, ok).await?,
+                "ok: yes"
+            );
+            let err = future_of(store, Err::<String, String>("no".to_string()))?;
+            assert_eq!(
+                echoes.call_describe_future_result(store, err).await?,
+                "err: true no"
+            );
+            anyhow::Ok(())
+        })
+        .await??;
+    Ok(())
+}
+
+/// A lifted `future<result<string, failure>>` rejects with an instance of the
+/// class of its named `err` type, holding the payload. The exported `echoes`
+/// names the type through `use`, so the class is the one `failing` exports.
+#[tokio::test]
+async fn future_result_rejects_with_the_named_error_class() -> anyhow::Result<()> {
+    let mut store = store();
+    let instance = pre().await.instantiate_async(&mut store).await?;
+    let described = store
+        .run_concurrent(async |store| {
+            let echoes = instance.test_streams_echoes();
+            let err = future_of(
+                store,
+                Err::<String, Failure>(Failure::NotFound("key".to_string())),
+            )?;
+            anyhow::Ok(echoes.call_describe_failure_future(store, err).await?)
+        })
+        .await??;
+    assert_eq!(
+        described, r#"true true Failure {"tag":"notFound","val":"key"}"#,
+        "the rejection must be an instance of the `Failure` the guest imports"
+    );
+    Ok(())
+}
+
+/// A `stream<host-thing>` reaches the guest as instances of the imported
+/// resource's class, and each one returns to the host intact, read back one per
+/// read.
+#[tokio::test]
+async fn stream_of_host_resources_round_trips() -> anyhow::Result<()> {
+    let mut store = store();
+    let instance = pre().await.instantiate_async(&mut store).await?;
+    let strings = ["a", "b", "c", "d", "e"];
+
+    let mut things = Vec::with_capacity(strings.len());
+    for s in strings {
+        things.push(
+            store
+                .data_mut()
+                .wasi
+                .table()
+                .push(ThingString(s.to_string()))?,
+        );
+    }
+
+    let received = store
+        .run_concurrent(async |store| {
+            let input = store.with(|store| StreamReader::new(store, things))?;
+            let echoed = instance
+                .test_streams_echoes()
+                .call_short_reads_host(store, input)
+                .await?;
+            let received = Arc::new(Mutex::new(Vec::<Resource<ThingString>>::new()));
+            store.with(|store| {
+                echoed.pipe(
+                    store,
+                    OneAtATimeConsumer {
+                        sink: received.clone(),
+                    },
+                )
+            })?;
+            until(|| received.lock().unwrap().len() >= strings.len()).await;
+            let received = std::mem::take(&mut *received.lock().unwrap());
+            anyhow::Ok(received)
+        })
+        .await??;
+
+    let values: Vec<String> = received
+        .into_iter()
+        .map(|thing| store.data_mut().wasi.table().delete(thing).unwrap().0)
+        .collect();
+    assert_eq!(values, strings, "every host thing must come back in order");
+    Ok(())
+}
+
+/// An imported function's `err` arm reaches the guest as an instance of the
+/// class its `err` type has, which the interface's module exports and which
+/// extends `ComponentError`.
+#[tokio::test]
+async fn import_errors_are_error_class_instances() -> anyhow::Result<()> {
+    let mut store = store();
+    let instance = pre().await.instantiate_async(&mut store).await?;
+    store
+        .run_concurrent(async |store| {
+            let echoes = instance.test_streams_echoes();
+            let found = echoes
+                .call_describe_lookup(store, "present".to_string())
+                .await?;
+            assert_eq!(found, "found value");
+            let missing = echoes
+                .call_describe_lookup(store, "absent".to_string())
+                .await?;
+            assert_eq!(
+                missing,
+                r#"true true Failure {"tag":"notFound","val":"absent"}"#
+            );
+            anyhow::Ok(())
+        })
+        .await??;
+    Ok(())
+}
+
+/// An export rethrowing an imported function's error returns its payload as
+/// `err`, and a promise lowered to a `future<result<string, failure>>` that
+/// rejects with an `Error` named after a payload-less case of `failure` delivers
+/// that case.
+#[tokio::test]
+async fn error_classes_lower_to_err() -> anyhow::Result<()> {
+    let mut store = store();
+    let instance = pre().await.instantiate_async(&mut store).await?;
+    store
+        .run_concurrent(async |store| {
+            let echoes = instance.test_streams_echoes();
+            let forwarded = echoes
+                .call_forward_lookup(store, "absent".to_string())
+                .await?;
+            assert!(
+                matches!(&forwarded, Err(Failure::NotFound(key)) if key == "absent"),
+                "the rethrown error's payload must come back as err; got {forwarded:?}"
+            );
+            let denied = echoes.call_future_denied(store).await?;
+            let denied = read_future(store, denied).await?;
+            assert!(
+                matches!(denied, Err(Failure::Denied)),
+                "an Error naming `denied` must deliver it; got {denied:?}"
+            );
+            anyhow::Ok(())
+        })
+        .await??;
+    Ok(())
+}
+
+/// The guest passes a stream and a future to imported functions, and reads the
+/// stream and the future imported functions return.
+#[tokio::test]
+async fn import_streams_and_futures() -> anyhow::Result<()> {
+    let mut store = store();
+    let instance = pre().await.instantiate_async(&mut store).await?;
+    let described = store
+        .run_concurrent(async |store| {
+            instance
+                .test_streams_echoes()
+                .call_use_transfers(store)
+                .await
+        })
+        .await??;
+    assert_eq!(described, "sum=10 count=0,1,2 later=7 plus-one=42");
+    Ok(())
+}
+
+/// A chunk that can't be lowered to a `point` ends the stream after the chunks
+/// before it, and the runtime reports the failing field and the reason on stderr.
+#[tokio::test]
+async fn wrong_element_ends_the_stream() -> anyhow::Result<()> {
+    let (mut store, stderr) = store_capturing_stderr();
+    let instance = pre().await.instantiate_async(&mut store).await?;
+    let points = store
+        .run_concurrent(async |store| {
+            let stream = instance
+                .test_streams_echoes()
+                .call_wrong_points(store)
+                .await?;
+            let (points, ended) = collect_all(store, stream).await?;
+            assert!(ended, "the stream must end");
+            anyhow::Ok(points)
+        })
+        .await??;
+    let points: Vec<(u32, u32)> = points.iter().map(|p| (p.x, p.y)).collect();
+    assert_eq!(points, [(1, 2)]);
+    let stderr = shared::pipe_text(&stderr);
+    assert!(
+        stderr.contains("a chunk `.x`: expected a u32") && stderr.contains(r#"got "a""#),
+        "stderr must say which field failed; got: {stderr}"
+    );
+    Ok(())
+}
+
+/// A chunk is read once, when the stream takes it, so a getter that returns
+/// something else on a later read does not change what is sent.
+#[tokio::test]
+async fn chunk_is_read_once() -> anyhow::Result<()> {
+    let mut store = store();
+    let instance = pre().await.instantiate_async(&mut store).await?;
+    let points = store
+        .run_concurrent(async |store| {
+            let stream = instance
+                .test_streams_echoes()
+                .call_shifting_points(store)
+                .await?;
+            let (points, ended) = collect_all(store, stream).await?;
+            assert!(ended, "the stream must end");
+            anyhow::Ok(points)
+        })
+        .await??;
+    let points: Vec<(u32, u32)> = points.iter().map(|p| (p.x, p.y)).collect();
+    assert_eq!(points, [(1, 2)]);
+    Ok(())
+}
+
+/// Dropping the reader of a `stream<string>`, a `stream<list<u32>>` or a
+/// `future<string>` the guest writes hands the unsent element back to the guest,
+/// whose lift then owns its strings and lists. Many rounds of that, each
+/// followed by calls that allocate strings, leave the instance working: every
+/// call completes, with the right result.
+///
+/// A guest that loops forever blocks the thread polling it, which no async
+/// timeout interrupts, so the calls run on a thread of their own.
+#[test]
+fn dropped_readers_leave_the_instance_intact() -> anyhow::Result<()> {
+    let (done, finished) = std::sync::mpsc::channel();
+    std::thread::spawn(move || {
+        let runtime = tokio::runtime::Runtime::new().expect("creating a runtime");
+        let _ = done.send(runtime.block_on(drop_readers_and_ping()));
+    });
+    match finished.recv_timeout(std::time::Duration::from_secs(120)) {
+        Ok(result) => result,
+        Err(std::sync::mpsc::RecvTimeoutError::Timeout) => {
+            anyhow::bail!("the instance stopped completing calls")
+        }
+        Err(std::sync::mpsc::RecvTimeoutError::Disconnected) => {
+            anyhow::bail!("the calls panicked")
+        }
+    }
+}
+
+async fn drop_readers_and_ping() -> anyhow::Result<()> {
+    let mut store = store();
+    let instance = pre().await.instantiate_async(&mut store).await?;
+    store
+        .run_concurrent(async |store| {
+            let echoes = instance.test_streams_echoes();
+            for round in 0..250 {
+                let mut strings = echoes.call_many_strings(store).await?;
+                strings.close_with(store)?;
+                let mut lists = echoes.call_many_lists(store).await?;
+                lists.close_with(store)?;
+                let mut later = echoes.call_string_later(store).await?;
+                later.close_with(store)?;
+                for call in 0..4 {
+                    let s = format!("round {round} call {call} ω ").repeat(20);
+                    let expected = format!("{s}{}", s.encode_utf16().count());
+                    assert_eq!(echoes.call_ping(store, s).await?, expected);
+                }
+                if round % 50 == 49 {
+                    let expected = vec![format!("round {round}").repeat(10), "ω".repeat(30)];
+                    let input = store.with(|store| StreamReader::new(store, expected.clone()))?;
+                    let echoed = echoes.call_echo_stream_string(store, input).await?;
+                    let (received, ended) = collect_all(store, echoed).await?;
+                    assert!(ended, "the echoed stream must end");
+                    assert_eq!(expected, received, "round {round}");
+                }
+            }
+            anyhow::Ok(())
+        })
+        .await?
+}
+
+/// A `stream<u8>` takes `ArrayBuffer` chunks as well as views.
+#[tokio::test]
+async fn array_buffer_chunks() -> anyhow::Result<()> {
+    let mut store = store();
+    let instance = pre().await.instantiate_async(&mut store).await?;
+    store
+        .run_concurrent(async |store| {
+            let stream = instance
+                .test_streams_echoes()
+                .call_array_buffer_chunks(store)
+                .await?;
+            let (bytes, ended) = read_bytes(store, stream, usize::MAX).await?;
+            assert!(ended, "the stream must end");
+            assert_eq!(bytes, [1, 2, 3]);
+            anyhow::Ok(())
+        })
+        .await??;
+    Ok(())
+}
+
+/// Empty chunks a guest's `stream<u8>` source yields are skipped.
+#[tokio::test]
+async fn empty_chunks_are_skipped() -> anyhow::Result<()> {
+    let mut store = store();
+    let instance = pre().await.instantiate_async(&mut store).await?;
+    store
+        .run_concurrent(async |store| {
+            let stream = instance
+                .test_streams_echoes()
+                .call_empty_chunks(store)
+                .await?;
+            let (bytes, ended) = read_bytes(store, stream, usize::MAX).await?;
+            assert!(ended, "the stream must end");
+            assert_eq!(bytes, [1, 2, 3]);
+            anyhow::Ok(())
+        })
+        .await??;
+    Ok(())
+}
+
+/// Returning a `ReadableStream` a reader has locked for a `stream<u8>` traps,
+/// since nothing else can read it.
+#[tokio::test]
+async fn locked_stream_traps() -> anyhow::Result<()> {
+    let (mut store, stderr) = store_capturing_stderr();
+    let instance = pre().await.instantiate_async(&mut store).await?;
+    let outcome = store
+        .run_concurrent(async |store| {
+            instance
+                .test_streams_echoes()
+                .call_locked_stream(store)
+                .await
+                .map(drop)
+        })
+        .await;
+    assert!(call_failed(&outcome), "returning a locked stream must trap");
+    let stderr = shared::pipe_text(&stderr);
+    assert!(
+        stderr.contains("the stream is locked"),
+        "stderr must say the stream is locked; got: {stderr}"
+    );
+    Ok(())
+}
+
+/// A plain value the guest hands over as a `future<u32>` is written as the
+/// future's value.
+#[tokio::test]
+async fn plain_value_as_future() -> anyhow::Result<()> {
+    let mut store = store();
+    let instance = pre().await.instantiate_async(&mut store).await?;
+    let result = store
+        .run_concurrent(async |store| {
+            instance
+                .test_streams_echoes()
+                .call_plus_one_plain(store)
+                .await
+        })
+        .await??;
+    assert_eq!(result, 42);
+    Ok(())
+}
+
+/// A value for an import's `stream<T>` argument that does not lower rejects the
+/// call with a `TypeError`, and an iterable object is read as the stream.
+#[tokio::test]
+async fn stream_argument_misuse_rejects() -> anyhow::Result<()> {
+    let mut store = store();
+    let instance = pre().await.instantiate_async(&mut store).await?;
+    let messages = store
+        .run_concurrent(async |store| {
+            instance
+                .test_streams_echoes()
+                .call_stream_misuse_messages(store)
+                .await
+        })
+        .await??;
+    assert_eq!(messages.len(), 4, "{messages:?}");
+    assert_eq!(
+        messages[0],
+        "argument 1 of `sum`: expected a ReadableStream or an iterable object, got 5"
+    );
+    assert!(
+        messages[1].starts_with(
+            "argument 1 of `sum`: expected a ReadableStream or an iterable object, got an object: "
+        ),
+        "{}",
+        messages[1]
+    );
+    assert_eq!(messages[2], "argument 1 of `sum`: the stream is locked");
+    assert_eq!(messages[3], "3");
+    Ok(())
+}
+
+/// Reading a stream in a sync export rejects with a `TypeError` naming the
+/// export.
+#[tokio::test]
+async fn stream_read_in_a_sync_export_rejects() -> anyhow::Result<()> {
+    let mut store = store();
+    let instance = pre().await.instantiate_async(&mut store).await?;
+    let echoes = instance.test_streams_echoes();
+    store
+        .run_concurrent(async |store| {
+            let (input, _) = chunked_input(store, &[b"unread"], false)?;
+            echoes.call_hold_stream(store, input).await?;
+            anyhow::Ok(())
+        })
+        .await??;
+    assert_eq!(echoes.call_sync_stream_message(&mut store).await?, "none");
+    let message = echoes.call_sync_stream_message(&mut store).await?;
+    assert!(
+        message.starts_with("reading a stream needs an active event loop")
+            && message.contains("`test:streams/echoes#sync-stream-message`"),
+        "{message}"
+    );
+    Ok(())
+}
+
+/// A promise lowered to a `future<u32>` that rejects traps the instance, since the
+/// future has no way to deliver the rejection.
+#[tokio::test]
+async fn rejected_future_traps() -> anyhow::Result<()> {
+    let (mut store, stderr) = store_capturing_stderr();
+    let instance = pre().await.instantiate_async(&mut store).await?;
+    let outcome = store
+        .run_concurrent(async |store| {
+            let future = instance
+                .test_streams_echoes()
+                .call_rejected_future(store)
+                .await?;
+            read_future(store, future).await
+        })
+        .await;
+    assert!(
+        !matches!(outcome, Ok(Ok(_))),
+        "a rejected future<u32> must trap"
+    );
+    let stderr = shared::pipe_text(&stderr);
+    assert!(
+        stderr.contains("component trapped") && stderr.contains("no value"),
+        "stderr must name the rejection; got: {stderr}"
+    );
+    Ok(())
+}
+
+/// A promise lowered to a `future<result<u32, u32>>` that rejects with an `Error`
+/// traps the instance, because the `Error` can't be converted into a `u32` `err` value.
+#[tokio::test]
+async fn rejected_result_future_traps() -> anyhow::Result<()> {
+    let (mut store, stderr) = store_capturing_stderr();
+    let instance = pre().await.instantiate_async(&mut store).await?;
+    let outcome = store
+        .run_concurrent(async |store| {
+            let future = instance
+                .test_streams_echoes()
+                .call_rejected_result_future(store)
+                .await?;
+            read_future(store, future).await
+        })
+        .await;
+    assert!(
+        !matches!(outcome, Ok(Ok(_))),
+        "an unholdable rejection must trap"
+    );
+    let stderr = shared::pipe_text(&stderr);
+    assert!(
+        stderr.contains("its error type") && stderr.contains("no value"),
+        "stderr must say the error type cannot hold the rejection; got: {stderr}"
+    );
+    Ok(())
+}
+
+/// A host that drops a future's reader before the guest's promise settles
+/// leaves the instance usable: the guest's write fails quietly.
+#[tokio::test]
+async fn host_drops_future_reader() -> anyhow::Result<()> {
+    let mut store = store();
+    let instance = pre().await.instantiate_async(&mut store).await?;
+    store
+        .run_concurrent(async |store| {
+            let echoes = instance.test_streams_echoes();
+            let mut dropped = echoes.call_slow_future(store, 5).await?;
+            dropped.close_with(store)?;
+            let kept = echoes.call_slow_future(store, 6).await?;
+            assert_eq!(read_future(store, kept).await?, 6);
+            anyhow::Ok(())
+        })
+        .await??;
+    Ok(())
+}
+
+/// A `future<thing>` delivers a guest-owned resource, whose handle reaches the
+/// object the guest created.
+#[tokio::test]
+async fn future_of_a_resource() -> anyhow::Result<()> {
+    use wasmtime::component::ResourceAny;
+
+    let mut store = store();
+    let instance = pre().await.instantiate_async(&mut store).await?;
+    let thing = store
+        .run_concurrent(async |store| {
+            let future = instance
+                .test_streams_echoes()
+                .call_thing_future(store, "held".to_string())
+                .await?;
+            anyhow::Ok(read_future::<_, _, ResourceAny>(store, future).await?)
+        })
+        .await??;
+    let value = instance
+        .test_streams_echoes()
+        .thing()
+        .call_get(&mut store, thing)
+        .await?;
+    assert_eq!(value, "held");
+    thing.resource_drop_async(&mut store).await?;
+    Ok(())
+}
+
+/// Cancelling a stream while its read from the host is in flight cancels the
+/// read and drops the host's producer.
+#[tokio::test]
+async fn cancel_with_a_read_in_flight() -> anyhow::Result<()> {
+    let mut store = store();
+    let instance = pre().await.instantiate_async(&mut store).await?;
+    store
+        .run_concurrent(async |store| {
+            let dropped = Arc::new(AtomicBool::new(false));
+            let input = store.with(|store| {
+                StreamReader::new(
+                    store,
+                    PendingProducer {
+                        dropped: dropped.clone(),
+                    },
+                )
+            })?;
+            let outcome = instance
+                .test_streams_echoes()
+                .call_cancel_pending_read(store, input)
+                .await?;
+            assert_eq!(outcome, "cancelled");
+            until(|| dropped.load(Ordering::SeqCst)).await;
+            assert!(
+                dropped.load(Ordering::SeqCst),
+                "cancelling must drop the host's producer"
+            );
+            anyhow::Ok(())
+        })
+        .await??;
+    Ok(())
+}
+
+/// A received stream returned as another stream type isn't lowered as its own
+/// readable end. A pump writes its bytes instead.
+#[tokio::test]
+async fn pass_stream_as_another_type() -> anyhow::Result<()> {
+    let mut store = store();
+    let instance = pre().await.instantiate_async(&mut store).await?;
+    store
+        .run_concurrent(async |store| {
+            let (input, _) = chunked_input(store, &[b"one", b"two"], false)?;
+            let passed = instance
+                .test_streams_echoes()
+                .call_pass_as_bytes(store, input)
+                .await?;
+            let (bytes, ended) = read_bytes(store, passed, usize::MAX).await?;
+            assert!(ended, "the stream must end");
+            assert_eq!(bytes, b"onetwo");
+            anyhow::Ok(())
+        })
+        .await??;
+    Ok(())
+}
+
+/// A returned stream whose source can never produce more, with nothing else
+/// left for the call's event loop to do, ends after what it produced, and its
+/// source is cancelled.
+#[tokio::test]
+async fn idle_source_is_cancelled() -> anyhow::Result<()> {
+    let mut store = store();
+    let instance = pre().await.instantiate_async(&mut store).await?;
+    let cancelled = store
+        .run_concurrent(async |store| {
+            let echoes = instance.test_streams_echoes();
+            let stream = echoes.call_idle_stream(store).await?;
+            let (bytes, ended) = read_bytes(store, stream, usize::MAX).await?;
+            assert!(ended, "the stream must end");
+            assert_eq!(bytes, [1]);
+            let mut cancelled = false;
+            for _ in 0..1_000 {
+                cancelled = echoes.call_idle_cancelled(store).await?;
+                if cancelled {
+                    break;
+                }
+                tokio::task::yield_now().await;
+            }
+            anyhow::Ok(cancelled)
+        })
+        .await??;
+    assert!(cancelled, "the idle source must be cancelled");
+    Ok(())
+}
+
+/// A promise lowered to a `future<u32>` that never settles does not keep the
+/// call running: once the loop has nothing left that could settle it, the call
+/// finishes.
+#[tokio::test]
+async fn never_settling_future_lets_the_call_finish() -> anyhow::Result<()> {
+    let mut store = store();
+    let instance = pre().await.instantiate_async(&mut store).await?;
+    let echoes = instance.test_streams_echoes();
+    let drive = async || {
+        for _ in 0..1000 {
+            tokio::task::yield_now().await;
+        }
+    };
+    store
+        .run_concurrent(async |store| {
+            let later = echoes.call_slow_future(store, 6).await?;
+            assert_eq!(read_future(store, later).await?, 6);
+            drive().await;
+            anyhow::Ok(())
+        })
+        .await??;
+    // `concurrent_state_table_size` is wasmtime's own leak check for tests: it
+    // counts the store's live tasks and waitables.
+    let settled = store.concurrent_state_table_size();
+    store
+        .run_concurrent(async |store| {
+            let mut never = echoes.call_never_future(store).await?;
+            never.close_with(store)?;
+            drive().await;
+            anyhow::Ok(())
+        })
+        .await??;
+    // The future keeps entries of its own, since its writer stays registered for
+    // a later settlement. A call whose task never finishes leaves 10.
+    let left = store.concurrent_state_table_size() - settled;
+    assert!(left < 10, "the call left {left} entries");
+    Ok(())
+}
+
+/// A promise lowered to a `future<u32>` that is garbage-collected without
+/// settling is reported on stderr, since the future's writer then stays
+/// unwritten for the instance's lifetime. The guest has no way to force a
+/// collection, so it allocates garbage until a `WeakRef` to the promise is
+/// cleared.
+#[tokio::test]
+async fn collected_unsettled_future_is_reported() -> anyhow::Result<()> {
+    let (mut store, stderr) = store_capturing_stderr();
+    let instance = pre().await.instantiate_async(&mut store).await?;
+    let echoes = instance.test_streams_echoes();
+    let collected = store
+        .run_concurrent(async |store| {
+            let mut future = echoes.call_unreferenced_never_future(store).await?;
+            let collected = echoes.call_collect_unreferenced_future(store).await?;
+            future.close_with(store)?;
+            anyhow::Ok(collected)
+        })
+        .await??;
+    let stderr = shared::pipe_text(&stderr);
+    assert!(collected, "the promise must be collected; stderr: {stderr}");
+    assert!(
+        stderr.contains(
+            "Warning: a promise lowered to a future<u32> was garbage-collected without \
+             settling, so the future's writable end leaks for the instance's lifetime"
+        ),
+        "stderr must report the leaked writer; got: {stderr}"
+    );
+    Ok(())
+}
+
+/// A future's value is lowered when its promise settles, so a wrapper disposed
+/// of right after that is still delivered.
+#[tokio::test]
+async fn future_value_is_lowered_when_the_promise_settles() -> anyhow::Result<()> {
+    let mut store = store();
+    let instance = pre().await.instantiate_async(&mut store).await?;
+    let value =
+        store
+            .run_concurrent(async |store| {
+                let future = instance
+                    .test_streams_echoes()
+                    .call_disposed_thing_future(store, "delivered".to_string())
+                    .await?;
+                let thing = read_future(store, future).await?;
+                anyhow::Ok(store.with(|mut access| {
+                    access.get().wasi.table().delete(thing).map(|thing| thing.0)
+                })?)
+            })
+            .await??;
+    assert_eq!(value, "delivered");
+    Ok(())
+}
+
+/// Fulfill the promise `held-future` returned with 7, from a sync export if
+/// `sync_settle`, and read the future, before the promise settles if
+/// `read_first`. Returns the value read.
+///
+/// A sync export has no event loop, so the write it starts runs in the next
+/// async call, which `ping` makes.
+async fn settle_held_future(sync_settle: bool, read_first: bool) -> anyhow::Result<Option<u32>> {
+    let mut store = store();
+    let instance = pre().await.instantiate_async(&mut store).await?;
+    let echoes = instance.test_streams_echoes();
+    let held = store
+        .run_concurrent(async |store| echoes.call_held_future(store).await)
+        .await??;
+    let slot = Arc::new(Mutex::new(None));
+    let settle_async = async |store: &Accessor<Ctx>| -> anyhow::Result<()> {
+        if !sync_settle {
+            echoes.call_settle_held_future_async(store, 7).await?;
+        }
+        Ok(())
+    };
+    if read_first {
+        store
+            .run_concurrent(async |store| {
+                store.with(|store| {
+                    held.pipe(store, shared::OptionConsumer { slot: slot.clone() })
+                })?;
+                settle_async(store).await
+            })
+            .await??;
+        if sync_settle {
+            echoes.call_settle_held_future(&mut store, 7).await?;
+        }
+        store
+            .run_concurrent(async |store| {
+                echoes.call_ping(store, String::new()).await?;
+                until(|| slot.lock().unwrap().is_some()).await;
+                anyhow::Ok(())
+            })
+            .await??;
+    } else {
+        if sync_settle {
+            echoes.call_settle_held_future(&mut store, 7).await?;
+        }
+        store
+            .run_concurrent(async |store| {
+                settle_async(store).await?;
+                store.with(|store| {
+                    held.pipe(store, shared::OptionConsumer { slot: slot.clone() })
+                })?;
+                if sync_settle {
+                    echoes.call_ping(store, String::new()).await?;
+                }
+                until(|| slot.lock().unwrap().is_some()).await;
+                anyhow::Ok(())
+            })
+            .await??;
+    }
+    let value = *slot.lock().unwrap();
+    Ok(value)
+}
+
+/// A promise lowered to a future that a later sync export fulfills is written in
+/// the next async call, whether the host reads the future before or after that.
+#[tokio::test]
+async fn future_settled_by_a_sync_export_is_written() -> anyhow::Result<()> {
+    assert_eq!(settle_held_future(true, false).await?, Some(7));
+    assert_eq!(settle_held_future(true, true).await?, Some(7));
+    Ok(())
+}
+
+/// A promise lowered to a future that a later async export fulfills is written,
+/// whether the host reads the future before or after that.
+#[tokio::test]
+async fn future_settled_by_an_async_export_is_written() -> anyhow::Result<()> {
+    assert_eq!(settle_held_future(false, false).await?, Some(7));
+    assert_eq!(settle_held_future(false, true).await?, Some(7));
+    Ok(())
+}
+
+/// Two async export calls on one instance, each taking a future the host
+/// delivers later, both finish: each call's event loop reads its own future.
+#[tokio::test]
+async fn concurrent_calls_with_future_arguments_finish() -> anyhow::Result<()> {
+    let mut store = store();
+    let instance = pre().await.instantiate_async(&mut store).await?;
+    let delayed = |store: &Accessor<Ctx>, ms: u64| -> anyhow::Result<_> {
+        Ok(store.with(|store| {
+            FutureReader::new(store, async move {
+                tokio::time::sleep(std::time::Duration::from_millis(ms)).await;
+                Ok::<_, std::io::Error>(Ok::<String, String>("v".to_string()))
+            })
+        })?)
+    };
+    let (first, second) = tokio::time::timeout(
+        std::time::Duration::from_secs(10),
+        store.run_concurrent(async |store| {
+            let echoes = instance.test_streams_echoes();
+            let (first, second) = futures::join!(
+                echoes.call_describe_future_result(store, delayed(store, 100)?),
+                echoes.call_describe_future_result(store, delayed(store, 300)?)
+            );
+            anyhow::Ok((first?, second?))
+        }),
+    )
+    .await
+    .expect("both calls must finish")??;
+    assert_eq!((first.as_str(), second.as_str()), ("ok: v", "ok: v"));
+    Ok(())
+}
+
+/// A `stream` and a `future` without a payload type are passed to the guest and
+/// back: re-yielded by an async generator, returned unread, and awaited and
+/// returned. The stream is longer than the pump's 64-element batch.
+#[tokio::test]
+async fn payloadless_echo() -> anyhow::Result<()> {
+    let mut store = store();
+    let instance = pre().await.instantiate_async(&mut store).await?;
+    store
+        .run_concurrent(async |store| {
+            let echoes = instance.test_streams_echoes();
+            let input = store.with(|store| StreamReader::new(store, vec![(); 150]))?;
+            let echoed = echoes.call_echo_ticks(store, input).await?;
+            let (ticks, ended) = collect_all(store, echoed).await?;
+            assert!(ended, "the echoed stream must end");
+            assert_eq!(ticks.len(), 150);
+
+            let input = store.with(|store| StreamReader::new(store, vec![(); 3]))?;
+            let passed = echoes.call_pass_ticks(store, input).await?;
+            let (ticks, ended) = collect_all(store, passed).await?;
+            assert!(ended, "the passed-through stream must end");
+            assert_eq!(ticks.len(), 3);
+
+            let input = future_of(store, ())?;
+            let echoed = echoes.call_echo_done(store, input).await?;
+            read_future(store, echoed).await?;
+            anyhow::Ok(())
+        })
+        .await??;
+    Ok(())
+}
+
+/// The guest reads a host-written `stream` without a payload type as one
+/// `undefined` chunk per element, and a `future` without one as a promise
+/// fulfilled with `undefined`.
+#[tokio::test]
+async fn payloadless_consumed() -> anyhow::Result<()> {
+    let mut store = store();
+    let instance = pre().await.instantiate_async(&mut store).await?;
+    store
+        .run_concurrent(async |store| {
+            let echoes = instance.test_streams_echoes();
+            let input = store.with(|store| StreamReader::new(store, vec![(); 70]))?;
+            assert_eq!(echoes.call_count_ticks(store, input).await?, 70);
+
+            let input = store.with(|store| StreamReader::new(store, Vec::<()>::new()))?;
+            assert_eq!(echoes.call_count_ticks(store, input).await?, 0);
+
+            let input = future_of(store, ())?;
+            assert_eq!(echoes.call_describe_done(store, input).await?, "undefined");
+            anyhow::Ok(())
+        })
+        .await??;
+    Ok(())
+}
+
+/// The guest returns a `ReadableStream` of `undefined` chunks as a `stream`
+/// without a payload type, and a promise that fulfills with `undefined` as a
+/// `future` without one.
+#[tokio::test]
+async fn payloadless_produced() -> anyhow::Result<()> {
+    let mut store = store();
+    let instance = pre().await.instantiate_async(&mut store).await?;
+    store
+        .run_concurrent(async |store| {
+            let echoes = instance.test_streams_echoes();
+            let stream = echoes.call_make_ticks(store, 5).await?;
+            let (ticks, ended) = collect_all(store, stream).await?;
+            assert!(ended, "the stream must end");
+            assert_eq!(ticks.len(), 5);
+
+            let future = echoes.call_make_done(store).await?;
+            read_future(store, future).await?;
+
+            // A host reading one element per read turns each write into a
+            // partial write.
+            let stream = echoes.call_make_ticks(store, 70).await?;
+            let received = Arc::new(Mutex::new(Vec::new()));
+            store.with(|store| {
+                stream.pipe(
+                    store,
+                    OneAtATimeConsumer {
+                        sink: received.clone(),
+                    },
+                )
+            })?;
+            until(|| received.lock().unwrap().len() >= 70).await;
+            assert_eq!(received.lock().unwrap().len(), 70);
+            anyhow::Ok(())
+        })
+        .await??;
+    Ok(())
+}
+
+/// Imports take and return a `stream` and a `future` without a payload type:
+/// the guest hands over an array, a `ReadableStream`, a promise, `undefined`
+/// and a host-written future, and reads the stream and future the host returns.
+#[tokio::test]
+async fn payloadless_imports() -> anyhow::Result<()> {
+    let mut store = store();
+    let instance = pre().await.instantiate_async(&mut store).await?;
+    let described = store
+        .run_concurrent(async |store| {
+            instance
+                .test_streams_echoes()
+                .call_use_tick_transfers(store)
+                .await
+        })
+        .await??;
+    assert_eq!(described, "array=3 stream=70 ticks=5 after=1,2,3");
+    Ok(())
+}
+
+/// A chunk other than `undefined` ends a `stream` without a payload type after
+/// the chunks before it, and the runtime reports why on stderr.
+#[tokio::test]
+async fn wrong_tick_ends_the_stream() -> anyhow::Result<()> {
+    let (mut store, stderr) = store_capturing_stderr();
+    let instance = pre().await.instantiate_async(&mut store).await?;
+    let ticks = store
+        .run_concurrent(async |store| {
+            let stream = instance
+                .test_streams_echoes()
+                .call_wrong_ticks(store)
+                .await?;
+            let (ticks, ended) = collect_all(store, stream).await?;
+            assert!(ended, "the stream must end");
+            anyhow::Ok(ticks)
+        })
+        .await??;
+    assert_eq!(ticks.len(), 1);
+    let stderr = shared::pipe_text(&stderr);
+    assert!(
+        stderr.contains("a chunk: expected undefined, got 7"),
+        "stderr must say why the stream ended; got: {stderr}"
+    );
+    Ok(())
+}
+
+/// A promise lowered to a `future` without a payload type that fulfills with a
+/// value other than `undefined` traps the instance.
+#[tokio::test]
+async fn valued_payloadless_future_traps() -> anyhow::Result<()> {
+    let (mut store, stderr) = store_capturing_stderr();
+    let instance = pre().await.instantiate_async(&mut store).await?;
+    let outcome = store
+        .run_concurrent(async |store| {
+            let future = instance
+                .test_streams_echoes()
+                .call_valued_done(store)
+                .await?;
+            read_future(store, future).await
+        })
+        .await;
+    assert!(
+        !matches!(outcome, Ok(Ok(_))),
+        "a future without a payload type fulfilled with 5 must trap"
+    );
+    let stderr = shared::pipe_text(&stderr);
+    assert!(
+        stderr.contains("component trapped")
+            && stderr.contains(
+                "the value a promise lowered to a future settled with: expected undefined, got 5"
+            ),
+        "stderr must name the value; got: {stderr}"
+    );
+    Ok(())
+}
+
+/// A promise lowered to a `future` without a payload type that rejects traps
+/// the instance.
+#[tokio::test]
+async fn rejected_payloadless_future_traps() -> anyhow::Result<()> {
+    let (mut store, stderr) = store_capturing_stderr();
+    let instance = pre().await.instantiate_async(&mut store).await?;
+    let outcome = store
+        .run_concurrent(async |store| {
+            let future = instance
+                .test_streams_echoes()
+                .call_rejected_done(store)
+                .await?;
+            read_future(store, future).await
+        })
+        .await;
+    assert!(
+        !matches!(outcome, Ok(Ok(_))),
+        "a rejected future without a payload type must trap"
+    );
+    let stderr = shared::pipe_text(&stderr);
+    assert!(
+        stderr.contains("a promise lowered to a future rejected") && stderr.contains("no value"),
+        "stderr must name the rejection; got: {stderr}"
+    );
+    Ok(())
+}
diff --git a/componentize/tests/surface.rs b/componentize/tests/surface.rs
new file mode 100644
index 00000000..4ad8a9c3
--- /dev/null
+++ b/componentize/tests/surface.rs
@@ -0,0 +1,350 @@
+// SPDX-License-Identifier: Apache-2.0-WITH-LLVM-exception
+
+//! The finalized component's imports and exports: the world of `fixtures/surface.{wit,js}`,
+//! componentized once with nothing disabled. The cases that disable features run
+//! `finalize::finalize` over that component again.
+
+mod shared;
+
+use {
+    componentize::finalize::{KeptExport, WasiApiSet},
+    tokio::sync::OnceCell,
+    wasmtime::{
+        component::{Component, HasSelf},
+        Engine, Store,
+    },
+    wasmtime_wasi::{WasiCtxView, WasiView},
+};
+
+wasmtime::component::bindgen!({
+    path: "tests/fixtures/surface.wit",
+    world: "surface",
+    imports: { default: async },
+    exports: { default: async },
+});
+
+struct Ctx {
+    wasi: shared::Wasi,
+    logged: Vec<String>,
+}
+
+impl WasiView for Ctx {
+    fn ctx(&mut self) -> WasiCtxView<'_> {
+        self.wasi.view()
+    }
+}
+
+impl SurfaceImports for Ctx {
+    async fn log(&mut self, msg: String) -> () {
+        self.logged.push(msg);
+    }
+}
+
+static ENGINE: std::sync::LazyLock<Engine> = std::sync::LazyLock::new(shared::engine);
+
+/// The world componentized with no feature given to disable, built once.
+async fn component() -> &'static [u8] {
+    static COMPONENT: OnceCell<Result<Vec<u8>, String>> = OnceCell::const_new();
+    shared::build_once(&COMPONENT, async {
+        shared::try_componentize(WIT, "surface", include_str!("fixtures/surface.js"))
+            .await
+            .expect("componentizing the surface world")
+    })
+    .await
+}
+
+/// [`component`] finalized again with the features `disabled`.
+async fn disable(disabled: &[WasiApiSet]) -> anyhow::Result<Vec<u8>> {
+    let exports = ["run", "random", "now"].map(|name| KeptExport::unrenamed(name.to_string()));
+    componentize::finalize::finalize(component().await, &exports, disabled, None)
+}
+
+const WIT: &str = include_str!("fixtures/surface.wit");
+
+async fn instantiate(component: &[u8]) -> anyhow::Result<(Store<Ctx>, Surface)> {
+    let component = Component::new(&ENGINE, component)?;
+    let linker = shared::linker(&ENGINE, &component, &[], |linker| {
+        Surface::add_to_linker::<_, HasSelf<_>>(linker, |ctx| ctx)
+    });
+    let mut store = Store::new(
+        &ENGINE,
+        Ctx {
+            wasi: shared::Wasi::inherit(),
+            logged: Vec::new(),
+        },
+    );
+    let instance = SurfacePre::new(linker.instantiate_pre(&component)?)?
+        .instantiate_async(&mut store)
+        .await?;
+    Ok((store, instance))
+}
+
+/// With nothing disabled the component exports the world's three functions and
+/// nothing else, and still imports the runtime's WASI surface. `run` calls the
+/// world's `log` import with a string.
+#[tokio::test]
+async fn exports_are_exactly_the_worlds() -> anyhow::Result<()> {
+    let component = component().await;
+    let (imports, exports) = shared::surface(component);
+    assert_eq!(exports, ["run", "random", "now"]);
+    assert!(
+        imports.iter().any(|i| i.starts_with("wasi:random/")),
+        "random stays imported when enabled: {imports:?}"
+    );
+    // The dependency-only interface the standard streams use stays as well: a
+    // wasm32-wasip2 runtime reaches them through `wasi:io`, a wasm32-wasip3 one
+    // through `wasi:cli/types`.
+    assert!(
+        imports
+            .iter()
+            .any(|i| i.starts_with("wasi:io/") || i.starts_with("wasi:cli/types")),
+        "the standard streams' dependency interface stays: {imports:?}"
+    );
+
+    let (mut store, instance) = instantiate(component).await?;
+    assert_eq!(instance.call_run(&mut store, 41).await?, 42);
+    assert_eq!(store.data().logged, ["run 41"]);
+    let value = instance.call_random(&mut store).await?;
+    assert!((0.0..1.0).contains(&value), "Math.random gave {value}");
+    let now = instance.call_now(&mut store).await?;
+    assert!(now > 1.7e12, "Date.now() gave {now}");
+    Ok(())
+}
+
+/// With every feature disabled the component imports no WASI interface beyond
+/// the environment, exit and insecure seed, runs, and traps where a disabled
+/// feature is reached.
+#[tokio::test]
+async fn disabled_features_are_stubbed() -> anyhow::Result<()> {
+    let component = disable(&[
+        WasiApiSet::Stdio,
+        WasiApiSet::Random,
+        WasiApiSet::Clocks,
+        WasiApiSet::Http,
+        WasiApiSet::Filesystem,
+    ])
+    .await?;
+    let (imports, exports) = shared::surface(&component);
+    assert_eq!(exports, ["run", "random", "now"]);
+    let (wasi, own): (Vec<&String>, Vec<&String>) =
+        imports.iter().partition(|i| i.starts_with("wasi:"));
+    assert!(
+        wasi.iter().all(|i| i.starts_with("wasi:cli/environment")
+            || i.starts_with("wasi:cli/exit")
+            || i.starts_with("wasi:random/insecure-seed")),
+        "only the environment, exit and insecure seed remain: {imports:?}"
+    );
+    assert_eq!(
+        own,
+        ["log"],
+        "the world's own import and nothing else remains"
+    );
+
+    let (mut store, instance) = instantiate(&component).await?;
+    assert_eq!(instance.call_run(&mut store, 1).await?, 2);
+    assert_eq!(
+        instance.call_now(&mut store).await?,
+        0.0,
+        "a disabled clock reads as zero"
+    );
+    let err = instance
+        .call_random(&mut store)
+        .await
+        .expect_err("Math.random must trap with random disabled");
+    assert!(
+        format!("{err:?}").contains("disabled-features!wasi:random/random@0.3.0#"),
+        "the trap is in the disabled function's stub: {err:?}"
+    );
+    Ok(())
+}
+
+/// The filesystem interfaces use the clock's types, so disabling the clocks
+/// alone is refused, naming every interface that keeps them and the features to
+/// disable with them.
+#[tokio::test]
+async fn a_feature_another_depends_on_cannot_be_disabled_alone() {
+    let err = disable(&[WasiApiSet::Clocks])
+        .await
+        .expect_err("clocks cannot go while the filesystem stays");
+    let message = format!("{err:#}");
+    assert!(
+        message.contains("cannot disable these features")
+            && message.contains("of `clocks` is used by `wasi:filesystem/types@")
+            && message.contains("(feature `filesystem`)"),
+        "{message}"
+    );
+    assert!(message.contains("Disable `filesystem`"), "{message}");
+}
+
+/// A world that `use`s a disabled feature's type at its top level is refused,
+/// naming the world as the user.
+#[tokio::test]
+async fn a_feature_the_world_uses_cannot_be_disabled() {
+    let err = shared::componentize_with(
+        componentize::Wit::String(
+            "package test:uses;
+             world uses {
+               use wasi:filesystem/types@0.3.0.{descriptor};
+               import open-root: func() -> descriptor;
+               export count: func() -> u32;
+             }
+             package wasi:filesystem@0.3.0 {
+               interface types { resource descriptor; }
+             }",
+        ),
+        Some("uses"),
+        "export function count() { return 1; }",
+        &componentize::ComponentizeOptions {
+            disabled: &[WasiApiSet::Filesystem],
+            ..Default::default()
+        },
+    )
+    .await
+    .err()
+    .expect("the filesystem cannot go while the world uses its types");
+    let message = format!("{err:#}");
+    assert!(
+        message.contains("cannot disable these features")
+            && message.contains("of `filesystem` is used by the world"),
+        "{message}"
+    );
+}
+
+/// A guest that does not define a function for one of the world's exports is
+/// refused at componentize time, with the message naming the missing JS export
+/// and the statement that would define it.
+#[tokio::test]
+async fn missing_export_fails_at_componentize_time() {
+    let err = shared::try_componentize(WIT, "surface", "export function run(n) { return n + 1; }")
+        .await
+        .expect_err("a guest without `random` must not componentize");
+    let message = format!("{err:#}");
+    assert!(
+        message.contains(
+            "does not provide a function `random` for the WIT export `random`. Export it as \
+             `random`, for example: export function random(...) { ... }"
+        ),
+        "{message}"
+    );
+}
+
+/// A world with an export gated on a WIT feature.
+const GATED_WIT: &str = "\
+package test:gated;
+
+world gated {
+  export base: func() -> u32;
+  @unstable(feature = extra)
+  export extra: func() -> u32;
+}
+";
+
+/// An export gated on a feature is part of the world only with the feature
+/// enabled, by name or with every feature.
+#[test]
+fn features_select_gated_exports() -> anyhow::Result<()> {
+    for (features, all, expected) in [
+        (vec![], false, &["base"][..]),
+        (vec!["extra".to_string()], false, &["base", "extra"]),
+        (vec![], true, &["base", "extra"]),
+    ] {
+        let (resolve, world) = componentize::load_world(
+            componentize::Wit::<std::path::PathBuf>::String(GATED_WIT),
+            Some("gated"),
+            &features,
+            all,
+        )?;
+        assert_eq!(
+            componentize::finalize::world_export_names(&resolve, world),
+            expected,
+            "features {features:?}, all {all}"
+        );
+    }
+    Ok(())
+}
+
+/// With a gated export's feature enabled, the guest must provide the export.
+#[tokio::test]
+async fn enabled_gated_export_must_be_provided() {
+    let err = shared::componentize_with(
+        componentize::Wit::String(GATED_WIT),
+        Some("gated"),
+        "export const base = () => 1;",
+        &componentize::ComponentizeOptions {
+            features: &["extra".to_string()],
+            ..Default::default()
+        },
+    )
+    .await
+    .err()
+    .expect("with `extra` enabled, the guest must provide it");
+    assert!(
+        format!("{err:#}").contains("does not provide a function `extra`"),
+        "{err:#}"
+    );
+}
+
+/// Each feature that no other one uses can be disabled by itself, which leaves
+/// out its interfaces and keeps the others'.
+#[tokio::test]
+async fn single_features_are_disabled_alone() -> anyhow::Result<()> {
+    for (feature, prefixes) in [
+        (
+            WasiApiSet::Stdio,
+            &["wasi:cli/std", "wasi:cli/terminal-"][..],
+        ),
+        (WasiApiSet::Random, &["wasi:random/random"]),
+        (WasiApiSet::Http, &["wasi:http/"]),
+        (WasiApiSet::Filesystem, &["wasi:filesystem/"]),
+    ] {
+        let (imports, _) = shared::surface(&disable(&[feature]).await?);
+        assert!(
+            !imports
+                .iter()
+                .any(|i| prefixes.iter().any(|prefix| i.starts_with(prefix))),
+            "{feature:?} disabled: {imports:?}"
+        );
+        assert!(
+            imports.iter().any(|i| i.starts_with("wasi:clocks/")),
+            "{feature:?} disabled keeps the clocks: {imports:?}"
+        );
+    }
+    Ok(())
+}
+
+/// A world whose function uses `error-context` is refused at componentize
+/// time, naming the function.
+#[tokio::test]
+async fn error_context_is_refused() {
+    let err = shared::try_componentize(
+        "package test:ec;\nworld w { export f: func(e: error-context); }\n",
+        "w",
+        "export function f(e) {}",
+    )
+    .await
+    .expect_err("a world using `error-context` is refused");
+    let message = format!("{err:#}");
+    assert!(
+        message.contains("`f` uses a `error-context`, which componentize does not support yet"),
+        "{message}"
+    );
+}
+
+/// A world-level resource's method imports take a `borrow` outside any
+/// interface, which the component composition cannot encode, so the world is
+/// refused with a message naming the import.
+#[tokio::test]
+async fn world_level_resource_methods_are_refused() {
+    let err = shared::try_componentize(
+        include_str!("fixtures/world_resource.wit"),
+        "world-resource",
+        include_str!("fixtures/world_resource.js"),
+    )
+    .await
+    .expect_err("a world-level resource with methods is refused");
+    let message = format!("{err:#}");
+    assert!(
+        message.contains("[method]thing.get") && message.contains("interface"),
+        "{message}"
+    );
+}
diff --git a/componentize/tests/sync_suite.rs b/componentize/tests/sync_suite.rs
new file mode 100644
index 00000000..e0c0d3af
--- /dev/null
+++ b/componentize/tests/sync_suite.rs
@@ -0,0 +1,1079 @@
+// SPDX-License-Identifier: Apache-2.0-WITH-LLVM-exception
+
+//! Every WIT value type, exported and imported resources, and sync imports: the world of
+//! `fixtures/sync_suite.{wit,js}`, whose echo exports forward to the host import of the same name.
+//! The cases of a property test share one instance.
+
+mod shared;
+
+use {
+    proptest::{
+        prelude::{Just, Strategy},
+        test_runner::{self, TestRng, TestRunner},
+    },
+    shared::Ctx,
+    std::{cell::RefCell, env, sync::LazyLock},
+    tokio::{runtime::Runtime, sync::OnceCell},
+    wasmtime::{
+        component::{HasSelf, Resource},
+        Engine, Store,
+    },
+};
+
+wasmtime::component::bindgen!({
+    path: "tests/fixtures/sync_suite.wit",
+    world: "sync-suite",
+    imports: { default: async },
+    exports: { default: async },
+    additional_derives: [PartialEq, Eq],
+    with: {
+        // wasmtime's bindgen keys a resource as `<interface-id>.<resource>`
+        // (the interface id has its own `pkg/iface` separator).
+        "test:sync-suite/host-thing-interface.host-thing": ThingString,
+    },
+});
+
+use test::sync_suite::echoes::{EnumType, RecordType, ResourceType, VariantType};
+
+/// The rep of the borrow the host's `accept-borrow` received last.
+static BORROWED_REP: std::sync::atomic::AtomicU32 = std::sync::atomic::AtomicU32::new(0);
+
+pub struct ThingString(String);
+
+static ENGINE: LazyLock<Engine> = LazyLock::new(shared::engine);
+
+/// Componentize the sync-suite world once and hold the instantiation-ready `Pre`.
+async fn pre() -> &'static SyncSuitePre<Ctx> {
+    static PRE: OnceCell<Result<SyncSuitePre<Ctx>, String>> = OnceCell::const_new();
+    shared::build_once(&PRE, async {
+        let component = shared::compile_fixture(
+            &ENGINE,
+            include_str!("fixtures/sync_suite.wit"),
+            "sync-suite",
+            include_str!("fixtures/sync_suite.js"),
+        )
+        .await;
+
+        let linker = shared::linker(&ENGINE, &component, &["test:sync-suite/"], |linker| {
+            SyncSuite::add_to_linker::<_, HasSelf<_>>(linker, |ctx| ctx)
+        });
+        SyncSuitePre::new(linker.instantiate_pre(&component).expect("instantiate_pre"))
+            .expect("SyncSuitePre")
+    })
+    .await
+}
+
+fn store() -> Store<Ctx> {
+    shared::store(&ENGINE)
+}
+
+// ===========================================================================
+// Host import implementations
+// ===========================================================================
+
+impl test::sync_suite::types::HostResourceType for Ctx {
+    async fn drop(&mut self, v: Resource<ResourceType>) -> wasmtime::Result<()> {
+        _ = v;
+        Ok(())
+    }
+}
+
+impl test::sync_suite::types::Host for Ctx {}
+
+impl test::sync_suite::echoes::Host for Ctx {
+    async fn echo_nothing(&mut self) {}
+    async fn echo_bool(&mut self, v: bool) -> bool {
+        v
+    }
+    async fn echo_u8(&mut self, v: u8) -> u8 {
+        v
+    }
+    async fn echo_s8(&mut self, v: i8) -> i8 {
+        v
+    }
+    async fn echo_u16(&mut self, v: u16) -> u16 {
+        v
+    }
+    async fn echo_s16(&mut self, v: i16) -> i16 {
+        v
+    }
+    async fn echo_u32(&mut self, v: u32) -> u32 {
+        v
+    }
+    async fn echo_s32(&mut self, v: i32) -> i32 {
+        v
+    }
+    async fn echo_char(&mut self, v: char) -> char {
+        v
+    }
+    async fn echo_u64(&mut self, v: u64) -> u64 {
+        v
+    }
+    async fn echo_s64(&mut self, v: i64) -> i64 {
+        v
+    }
+    async fn echo_f32(&mut self, v: f32) -> f32 {
+        v
+    }
+    async fn echo_f64(&mut self, v: f64) -> f64 {
+        v
+    }
+    async fn echo_string(&mut self, v: String) -> String {
+        v
+    }
+    async fn echo_list_bool(&mut self, v: Vec<bool>) -> Vec<bool> {
+        v
+    }
+    async fn echo_list_u8(&mut self, v: Vec<u8>) -> Vec<u8> {
+        v
+    }
+    async fn echo_list_s8(&mut self, v: Vec<i8>) -> Vec<i8> {
+        v
+    }
+    async fn echo_list_u16(&mut self, v: Vec<u16>) -> Vec<u16> {
+        v
+    }
+    async fn echo_list_s16(&mut self, v: Vec<i16>) -> Vec<i16> {
+        v
+    }
+    async fn echo_list_u32(&mut self, v: Vec<u32>) -> Vec<u32> {
+        v
+    }
+    async fn echo_list_s32(&mut self, v: Vec<i32>) -> Vec<i32> {
+        v
+    }
+    async fn echo_list_char(&mut self, v: Vec<char>) -> Vec<char> {
+        v
+    }
+    async fn echo_list_u64(&mut self, v: Vec<u64>) -> Vec<u64> {
+        v
+    }
+    async fn echo_list_s64(&mut self, v: Vec<i64>) -> Vec<i64> {
+        v
+    }
+    async fn echo_list_f32(&mut self, v: Vec<f32>) -> Vec<f32> {
+        v
+    }
+    async fn echo_list_f64(&mut self, v: Vec<f64>) -> Vec<f64> {
+        v
+    }
+    async fn echo_list_string(&mut self, v: Vec<String>) -> Vec<String> {
+        v
+    }
+    async fn echo_list_list_u8(&mut self, v: Vec<Vec<u8>>) -> Vec<Vec<u8>> {
+        v
+    }
+    async fn echo_list_list_list_u8(&mut self, v: Vec<Vec<Vec<u8>>>) -> Vec<Vec<Vec<u8>>> {
+        v
+    }
+    async fn echo_option_u8(&mut self, v: Option<u8>) -> Option<u8> {
+        v
+    }
+    async fn echo_option_option_u8(&mut self, v: Option<Option<u8>>) -> Option<Option<u8>> {
+        v
+    }
+    async fn echo_result_u8_u8(&mut self, v: Result<u8, u8>) -> Result<u8, u8> {
+        v
+    }
+    async fn echo_result_result_u8_u8_u8(
+        &mut self,
+        v: Result<Result<u8, u8>, u8>,
+    ) -> Result<Result<u8, u8>, u8> {
+        v
+    }
+    #[allow(clippy::type_complexity)]
+    async fn echo_many(
+        &mut self,
+        v1: bool,
+        v2: u8,
+        v3: u16,
+        v4: u32,
+        v5: u64,
+        v6: i8,
+        v7: i16,
+        v8: i32,
+        v9: i64,
+        v10: f32,
+        v11: f64,
+        v12: char,
+        v13: String,
+        v14: Vec<bool>,
+        v15: Vec<u8>,
+        v16: Vec<u16>,
+    ) -> (
+        bool,
+        u8,
+        u16,
+        u32,
+        u64,
+        i8,
+        i16,
+        i32,
+        i64,
+        f32,
+        f64,
+        char,
+        String,
+        Vec<bool>,
+        Vec<u8>,
+        Vec<u16>,
+    ) {
+        (
+            v1, v2, v3, v4, v5, v6, v7, v8, v9, v10, v11, v12, v13, v14, v15, v16,
+        )
+    }
+    async fn echo_resource(&mut self, v: Resource<ResourceType>) -> Resource<ResourceType> {
+        v
+    }
+    async fn accept_borrow(&mut self, v: Resource<ResourceType>) {
+        BORROWED_REP.store(v.rep(), std::sync::atomic::Ordering::SeqCst);
+    }
+    async fn echo_record(&mut self, v: RecordType) -> RecordType {
+        v
+    }
+    async fn echo_enum(&mut self, v: EnumType) -> EnumType {
+        v
+    }
+    async fn echo_variant(&mut self, v: VariantType) -> VariantType {
+        v
+    }
+}
+
+impl test::sync_suite::host_thing_interface::Host for Ctx {}
+
+impl test::sync_suite::host_thing_interface::HostHostThing for Ctx {
+    async fn new(&mut self, s: String) -> Resource<ThingString> {
+        self.wasi.table().push(ThingString(s)).unwrap()
+    }
+    async fn get(&mut self, self_: Resource<ThingString>) -> String {
+        self.wasi.table().get(&self_).unwrap().0.clone()
+    }
+    async fn get_static(&mut self, v: Resource<ThingString>) -> String {
+        self.wasi.table().get(&v).unwrap().0.clone()
+    }
+    async fn drop(&mut self, rep: Resource<ThingString>) -> wasmtime::Result<()> {
+        self.wasi.table().delete(rep)?;
+        Ok(())
+    }
+}
+
+// ===========================================================================
+// proptest harness
+// ===========================================================================
+
+fn get_seed() -> [u8; 32] {
+    if let Ok(seed) = env::var("STARLING_COMPONENTIZE_TEST_SEED") {
+        let bytes = hex::decode(&seed).expect("STARLING_COMPONENTIZE_TEST_SEED must be hex");
+        <[u8; 32]>::try_from(bytes.as_slice()).expect("seed must be 32 bytes")
+    } else {
+        // Derive a non-deterministic seed without pulling in `rand`: hash the
+        // current time and thread id. Reproduce a failure by re-running with
+        // STARLING_COMPONENTIZE_TEST_SEED set to the printed value.
+        use std::hash::{Hash, Hasher};
+        let mut seed = [0u8; 32];
+        for (i, chunk) in seed.chunks_mut(8).enumerate() {
+            let mut h = std::collections::hash_map::DefaultHasher::new();
+            std::time::SystemTime::now().hash(&mut h);
+            std::thread::current().id().hash(&mut h);
+            i.hash(&mut h);
+            chunk.copy_from_slice(&h.finish().to_le_bytes());
+        }
+        seed
+    }
+}
+
+static SEED: LazyLock<[u8; 32]> = LazyLock::new(|| {
+    let seed = get_seed();
+    eprintln!(
+        "using seed {} (set STARLING_COMPONENTIZE_TEST_SEED env var to override)",
+        hex::encode(seed)
+    );
+    seed
+});
+
+/// Run `test` on the values `strategy` generates, each call with the same store and
+/// instance of the shared component.
+fn proptest<S: Strategy>(
+    strategy: &S,
+    test: impl AsyncFn(&mut Store<Ctx>, &SyncSuite, S::Value) -> anyhow::Result<()>,
+) -> anyhow::Result<()>
+where
+    S::Value: Send + Sync + 'static,
+{
+    let runtime = Runtime::new()?;
+    // `Config::default()` reads `PROPTEST_CASES` itself (default 256), matching
+    // it.
+    let config = test_runner::Config::default();
+    let algorithm = config.rng_algorithm;
+    let mut runner = TestRunner::new_with_rng(config, TestRng::from_seed(algorithm, &*SEED));
+    let mut store = store();
+    let instance = runtime.block_on(async { pre().await.instantiate_async(&mut store).await })?;
+    let store = RefCell::new(store);
+
+    Ok(runner.run(strategy, move |v| {
+        runtime
+            .block_on(test(&mut store.borrow_mut(), &instance, v))
+            .unwrap();
+        Ok(())
+    })?)
+}
+
+const MAX_SIZE: usize = 100;
+
+// ===========================================================================
+// Test cases
+// ===========================================================================
+
+#[tokio::test]
+async fn echo_nothing() -> anyhow::Result<()> {
+    let mut store = store();
+    let instance = pre().await.instantiate_async(&mut store).await?;
+    instance
+        .test_sync_suite_echoes()
+        .call_echo_nothing(&mut store)
+        .await?;
+    Ok(())
+}
+
+// ---- scalar round-trips ----
+
+#[tokio::test]
+async fn echo_bools() -> anyhow::Result<()> {
+    let mut store = store();
+    let instance = pre().await.instantiate_async(&mut store).await?;
+    for value in [true, false] {
+        assert_eq!(
+            value,
+            instance
+                .test_sync_suite_echoes()
+                .call_echo_bool(&mut store, value)
+                .await?
+        );
+    }
+    Ok(())
+}
+
+#[test]
+fn echo_u8s() -> anyhow::Result<()> {
+    proptest(&proptest::num::u8::ANY, async |store, instance, value| {
+        assert_eq!(
+            value,
+            instance
+                .test_sync_suite_echoes()
+                .call_echo_u8(store, value)
+                .await?
+        );
+        Ok(())
+    })
+}
+
+#[test]
+fn echo_s8s() -> anyhow::Result<()> {
+    proptest(&proptest::num::i8::ANY, async |store, instance, value| {
+        assert_eq!(
+            value,
+            instance
+                .test_sync_suite_echoes()
+                .call_echo_s8(store, value)
+                .await?
+        );
+        Ok(())
+    })
+}
+
+#[test]
+fn echo_u16s() -> anyhow::Result<()> {
+    proptest(&proptest::num::u16::ANY, async |store, instance, value| {
+        assert_eq!(
+            value,
+            instance
+                .test_sync_suite_echoes()
+                .call_echo_u16(store, value)
+                .await?
+        );
+        Ok(())
+    })
+}
+
+#[test]
+fn echo_s16s() -> anyhow::Result<()> {
+    proptest(&proptest::num::i16::ANY, async |store, instance, value| {
+        assert_eq!(
+            value,
+            instance
+                .test_sync_suite_echoes()
+                .call_echo_s16(store, value)
+                .await?
+        );
+        Ok(())
+    })
+}
+
+#[test]
+fn echo_u32s() -> anyhow::Result<()> {
+    proptest(&proptest::num::u32::ANY, async |store, instance, value| {
+        assert_eq!(
+            value,
+            instance
+                .test_sync_suite_echoes()
+                .call_echo_u32(store, value)
+                .await?
+        );
+        Ok(())
+    })
+}
+
+#[test]
+fn echo_s32s() -> anyhow::Result<()> {
+    proptest(&proptest::num::i32::ANY, async |store, instance, value| {
+        assert_eq!(
+            value,
+            instance
+                .test_sync_suite_echoes()
+                .call_echo_s32(store, value)
+                .await?
+        );
+        Ok(())
+    })
+}
+
+#[test]
+fn echo_u64s() -> anyhow::Result<()> {
+    proptest(&proptest::num::u64::ANY, async |store, instance, value| {
+        assert_eq!(
+            value,
+            instance
+                .test_sync_suite_echoes()
+                .call_echo_u64(store, value)
+                .await?
+        );
+        Ok(())
+    })
+}
+
+#[test]
+fn echo_s64s() -> anyhow::Result<()> {
+    proptest(&proptest::num::i64::ANY, async |store, instance, value| {
+        assert_eq!(
+            value,
+            instance
+                .test_sync_suite_echoes()
+                .call_echo_s64(store, value)
+                .await?
+        );
+        Ok(())
+    })
+}
+
+#[test]
+fn echo_chars() -> anyhow::Result<()> {
+    proptest(&proptest::char::any(), async |store, instance, value| {
+        assert_eq!(
+            value,
+            instance
+                .test_sync_suite_echoes()
+                .call_echo_char(store, value)
+                .await?
+        );
+        Ok(())
+    })
+}
+
+#[derive(Debug, Copy, Clone)]
+struct MyF32(f32);
+
+impl PartialEq<MyF32> for MyF32 {
+    fn eq(&self, other: &Self) -> bool {
+        (self.0.is_nan() && other.0.is_nan()) || (self.0 == other.0)
+    }
+}
+
+#[test]
+fn echo_f32s() -> anyhow::Result<()> {
+    proptest(
+        &proptest::num::f32::ANY.prop_map(MyF32),
+        async |store, instance, value| {
+            assert_eq!(
+                value,
+                MyF32(
+                    instance
+                        .test_sync_suite_echoes()
+                        .call_echo_f32(store, value.0)
+                        .await?
+                )
+            );
+            Ok(())
+        },
+    )
+}
+
+#[derive(Debug, Copy, Clone)]
+struct MyF64(f64);
+
+impl PartialEq<MyF64> for MyF64 {
+    fn eq(&self, other: &Self) -> bool {
+        (self.0.is_nan() && other.0.is_nan()) || (self.0 == other.0)
+    }
+}
+
+#[test]
+fn echo_f64s() -> anyhow::Result<()> {
+    proptest(
+        &proptest::num::f64::ANY.prop_map(MyF64),
+        async |store, instance, value| {
+            assert_eq!(
+                value,
+                MyF64(
+                    instance
+                        .test_sync_suite_echoes()
+                        .call_echo_f64(store, value.0)
+                        .await?
+                )
+            );
+            Ok(())
+        },
+    )
+}
+
+#[test]
+fn echo_strings() -> anyhow::Result<()> {
+    proptest(
+        &proptest::string::string_regex(".*")?,
+        async |store, instance, value| {
+            assert_eq!(
+                value,
+                instance
+                    .test_sync_suite_echoes()
+                    .call_echo_string(store, &value)
+                    .await?
+            );
+            Ok(())
+        },
+    )
+}
+
+// ---- list round-trips ----
+
+#[test]
+fn echo_lists_bool() -> anyhow::Result<()> {
+    proptest(
+        &proptest::collection::vec(proptest::bool::ANY, 0..MAX_SIZE),
+        async |store, instance, value| {
+            assert_eq!(
+                value,
+                instance
+                    .test_sync_suite_echoes()
+                    .call_echo_list_bool(store, &value)
+                    .await?
+            );
+            Ok(())
+        },
+    )
+}
+
+#[test]
+fn echo_lists_u8() -> anyhow::Result<()> {
+    proptest(
+        &proptest::collection::vec(proptest::num::u8::ANY, 0..MAX_SIZE),
+        async |store, instance, value| {
+            assert_eq!(
+                value,
+                instance
+                    .test_sync_suite_echoes()
+                    .call_echo_list_u8(store, &value)
+                    .await?
+            );
+            Ok(())
+        },
+    )
+}
+
+#[test]
+fn echo_lists_s8() -> anyhow::Result<()> {
+    proptest(
+        &proptest::collection::vec(proptest::num::i8::ANY, 0..MAX_SIZE),
+        async |store, instance, value| {
+            assert_eq!(
+                value,
+                instance
+                    .test_sync_suite_echoes()
+                    .call_echo_list_s8(store, &value)
+                    .await?
+            );
+            Ok(())
+        },
+    )
+}
+
+#[test]
+fn echo_lists_u16() -> anyhow::Result<()> {
+    proptest(
+        &proptest::collection::vec(proptest::num::u16::ANY, 0..MAX_SIZE),
+        async |store, instance, value| {
+            assert_eq!(
+                value,
+                instance
+                    .test_sync_suite_echoes()
+                    .call_echo_list_u16(store, &value)
+                    .await?
+            );
+            Ok(())
+        },
+    )
+}
+
+#[test]
+fn echo_lists_s16() -> anyhow::Result<()> {
+    proptest(
+        &proptest::collection::vec(proptest::num::i16::ANY, 0..MAX_SIZE),
+        async |store, instance, value| {
+            assert_eq!(
+                value,
+                instance
+                    .test_sync_suite_echoes()
+                    .call_echo_list_s16(store, &value)
+                    .await?
+            );
+            Ok(())
+        },
+    )
+}
+
+#[test]
+fn echo_lists_u32() -> anyhow::Result<()> {
+    proptest(
+        &proptest::collection::vec(proptest::num::u32::ANY, 0..MAX_SIZE),
+        async |store, instance, value| {
+            assert_eq!(
+                value,
+                instance
+                    .test_sync_suite_echoes()
+                    .call_echo_list_u32(store, &value)
+                    .await?
+            );
+            Ok(())
+        },
+    )
+}
+
+#[test]
+fn echo_lists_s32() -> anyhow::Result<()> {
+    proptest(
+        &proptest::collection::vec(proptest::num::i32::ANY, 0..MAX_SIZE),
+        async |store, instance, value| {
+            assert_eq!(
+                value,
+                instance
+                    .test_sync_suite_echoes()
+                    .call_echo_list_s32(store, &value)
+                    .await?
+            );
+            Ok(())
+        },
+    )
+}
+
+#[test]
+fn echo_lists_u64() -> anyhow::Result<()> {
+    proptest(
+        &proptest::collection::vec(proptest::num::u64::ANY, 0..MAX_SIZE),
+        async |store, instance, value| {
+            assert_eq!(
+                value,
+                instance
+                    .test_sync_suite_echoes()
+                    .call_echo_list_u64(store, &value)
+                    .await?
+            );
+            Ok(())
+        },
+    )
+}
+
+#[test]
+fn echo_lists_s64() -> anyhow::Result<()> {
+    proptest(
+        &proptest::collection::vec(proptest::num::i64::ANY, 0..MAX_SIZE),
+        async |store, instance, value| {
+            assert_eq!(
+                value,
+                instance
+                    .test_sync_suite_echoes()
+                    .call_echo_list_s64(store, &value)
+                    .await?
+            );
+            Ok(())
+        },
+    )
+}
+
+#[test]
+fn echo_lists_char() -> anyhow::Result<()> {
+    proptest(
+        &proptest::collection::vec(proptest::char::any(), 0..MAX_SIZE),
+        async |store, instance, value| {
+            assert_eq!(
+                value,
+                instance
+                    .test_sync_suite_echoes()
+                    .call_echo_list_char(store, &value)
+                    .await?
+            );
+            Ok(())
+        },
+    )
+}
+
+#[test]
+fn echo_lists_f32() -> anyhow::Result<()> {
+    proptest(
+        &proptest::collection::vec(proptest::num::f32::ANY.prop_map(MyF32), 0..MAX_SIZE),
+        async |store, instance, value| {
+            assert_eq!(
+                value,
+                instance
+                    .test_sync_suite_echoes()
+                    .call_echo_list_f32(store, &value.iter().map(|v| v.0).collect::<Vec<_>>())
+                    .await?
+                    .into_iter()
+                    .map(MyF32)
+                    .collect::<Vec<_>>()
+            );
+            Ok(())
+        },
+    )
+}
+
+#[test]
+fn echo_lists_f64() -> anyhow::Result<()> {
+    proptest(
+        &proptest::collection::vec(proptest::num::f64::ANY.prop_map(MyF64), 0..MAX_SIZE),
+        async |store, instance, value| {
+            assert_eq!(
+                value,
+                instance
+                    .test_sync_suite_echoes()
+                    .call_echo_list_f64(store, &value.iter().map(|v| v.0).collect::<Vec<_>>())
+                    .await?
+                    .into_iter()
+                    .map(MyF64)
+                    .collect::<Vec<_>>()
+            );
+            Ok(())
+        },
+    )
+}
+
+#[test]
+fn echo_lists_string() -> anyhow::Result<()> {
+    proptest(
+        &proptest::collection::vec(proptest::string::string_regex(".*")?, 0..MAX_SIZE),
+        async |store, instance, value| {
+            assert_eq!(
+                value,
+                instance
+                    .test_sync_suite_echoes()
+                    .call_echo_list_string(store, &value)
+                    .await?
+            );
+            Ok(())
+        },
+    )
+}
+
+#[test]
+fn echo_lists_list_u8() -> anyhow::Result<()> {
+    proptest(
+        &proptest::collection::vec(
+            proptest::collection::vec(proptest::num::u8::ANY, 0..MAX_SIZE / 2),
+            0..MAX_SIZE,
+        ),
+        async |store, instance, value| {
+            assert_eq!(
+                value,
+                instance
+                    .test_sync_suite_echoes()
+                    .call_echo_list_list_u8(store, &value)
+                    .await?
+            );
+            Ok(())
+        },
+    )
+}
+
+#[test]
+fn echo_lists_list_list_u8() -> anyhow::Result<()> {
+    proptest(
+        &proptest::collection::vec(
+            proptest::collection::vec(
+                proptest::collection::vec(proptest::num::u8::ANY, 0..MAX_SIZE / 4),
+                0..MAX_SIZE / 2,
+            ),
+            0..MAX_SIZE,
+        ),
+        async |store, instance, value| {
+            assert_eq!(
+                value,
+                instance
+                    .test_sync_suite_echoes()
+                    .call_echo_list_list_list_u8(store, &value)
+                    .await?
+            );
+            Ok(())
+        },
+    )
+}
+
+// ---- option / result round-trips ----
+
+#[test]
+fn echo_options_u8() -> anyhow::Result<()> {
+    proptest(
+        &proptest::option::of(proptest::num::u8::ANY),
+        async |store, instance, value| {
+            assert_eq!(
+                value,
+                instance
+                    .test_sync_suite_echoes()
+                    .call_echo_option_u8(store, value)
+                    .await?
+            );
+            Ok(())
+        },
+    )
+}
+
+#[test]
+fn echo_options_option_u8() -> anyhow::Result<()> {
+    proptest(
+        &proptest::option::of(proptest::option::of(proptest::num::u8::ANY)),
+        async |store, instance, value| {
+            assert_eq!(
+                value,
+                instance
+                    .test_sync_suite_echoes()
+                    .call_echo_option_option_u8(store, value)
+                    .await?
+            );
+            Ok(())
+        },
+    )
+}
+
+#[test]
+fn echo_results_u8_u8() -> anyhow::Result<()> {
+    proptest(
+        &proptest::result::maybe_ok(proptest::num::u8::ANY, proptest::num::u8::ANY),
+        async |store, instance, value| {
+            assert_eq!(
+                value,
+                instance
+                    .test_sync_suite_echoes()
+                    .call_echo_result_u8_u8(store, value)
+                    .await?
+            );
+            Ok(())
+        },
+    )
+}
+
+#[test]
+fn echo_results_result_u8_u8_u8() -> anyhow::Result<()> {
+    proptest(
+        &proptest::result::maybe_ok(
+            proptest::result::maybe_ok(proptest::num::u8::ANY, proptest::num::u8::ANY),
+            proptest::num::u8::ANY,
+        ),
+        async |store, instance, value| {
+            assert_eq!(
+                value,
+                instance
+                    .test_sync_suite_echoes()
+                    .call_echo_result_result_u8_u8_u8(store, value)
+                    .await?
+            );
+            Ok(())
+        },
+    )
+}
+
+// ---- echo_many (tuple of every scalar + a few lists) ----
+
+#[test]
+fn echo_many() -> anyhow::Result<()> {
+    proptest(
+        &(
+            (
+                proptest::bool::ANY,
+                proptest::num::u8::ANY,
+                proptest::num::u16::ANY,
+                proptest::num::u32::ANY,
+                proptest::num::u64::ANY,
+                proptest::num::i8::ANY,
+                proptest::num::i16::ANY,
+                proptest::num::i32::ANY,
+            ),
+            (
+                proptest::num::i64::ANY,
+                proptest::num::f32::ANY.prop_map(MyF32),
+                proptest::num::f64::ANY.prop_map(MyF64),
+                proptest::char::any(),
+                proptest::string::string_regex(".*")?,
+                proptest::collection::vec(proptest::bool::ANY, 0..MAX_SIZE),
+                proptest::collection::vec(proptest::num::u8::ANY, 0..MAX_SIZE),
+                proptest::collection::vec(proptest::num::u16::ANY, 0..MAX_SIZE),
+            ),
+        ),
+        async |store, instance, ((v1, v2, v3, v4, v5, v6, v7, v8), (v9, v10, v11, v12, v13, v14, v15, v16))| {
+            let (r1, r2, r3, r4, r5, r6, r7, r8, r9, r10, r11, r12, r13, r14, r15, r16) = instance
+                .test_sync_suite_echoes()
+                .call_echo_many(
+                    store, v1, v2, v3, v4, v5, v6, v7, v8, v9, v10.0, v11.0, v12, &v13, &v14,
+                    &v15, &v16,
+                )
+                .await?;
+            assert_eq!(
+                (
+                    (v1, v2, v3, v4, v5, v6, v7, v8),
+                    (v9, v10, v11, v12, v13, v14, v15, v16)
+                ),
+                (
+                    (r1, r2, r3, r4, r5, r6, r7, r8),
+                    (r9, MyF32(r10), MyF64(r11), r12, r13, r14, r15, r16)
+                ),
+            );
+            Ok(())
+        },
+    )
+}
+
+// ---- record / enum / flags / variant round-trips ----
+
+#[test]
+fn echo_records() -> anyhow::Result<()> {
+    proptest(
+        &(
+            proptest::num::u32::ANY,
+            proptest::string::string_regex(".*")?,
+            proptest::bool::ANY.prop_flat_map(|v| {
+                if v {
+                    proptest::num::u32::ANY.prop_map(Ok).boxed()
+                } else {
+                    proptest::num::u64::ANY.prop_map(Err).boxed()
+                }
+            }),
+        )
+            .prop_map(|(a, b, c)| RecordType { a, b, c }),
+        async |store, instance, v| {
+            assert_eq!(
+                v,
+                instance
+                    .test_sync_suite_echoes()
+                    .call_echo_record(store, &v)
+                    .await?
+            );
+            Ok(())
+        },
+    )
+}
+
+#[test]
+fn echo_enums() -> anyhow::Result<()> {
+    proptest(
+        &(0..3).prop_map(|v| match v {
+            0 => EnumType::A,
+            1 => EnumType::B,
+            2 => EnumType::C,
+            _ => unreachable!(),
+        }),
+        async |store, instance, v| {
+            assert_eq!(
+                v,
+                instance
+                    .test_sync_suite_echoes()
+                    .call_echo_enum(store, v)
+                    .await?
+            );
+            Ok(())
+        },
+    )
+}
+
+#[test]
+fn echo_variants() -> anyhow::Result<()> {
+    proptest(
+        &(0..5).prop_flat_map(|v| match v {
+            0 => proptest::num::u32::ANY.prop_map(VariantType::A).boxed(),
+            1 => proptest::string::string_regex(".*")
+                .unwrap()
+                .prop_map(VariantType::B)
+                .boxed(),
+            2 => proptest::num::u32::ANY
+                .prop_map(|v| VariantType::C(Ok(v)))
+                .boxed(),
+            3 => proptest::num::u64::ANY
+                .prop_map(|v| VariantType::C(Err(v)))
+                .boxed(),
+            4 => Just(VariantType::D).boxed(),
+            _ => unreachable!(),
+        }),
+        async |store, instance, v| {
+            assert_eq!(
+                v,
+                instance
+                    .test_sync_suite_echoes()
+                    .call_echo_variant(store, &v)
+                    .await?
+            );
+            Ok(())
+        },
+    )
+}
+
+// ---- resources / borrows ----
+
+/// An owned resource handle the guest echoes keeps its rep.
+#[tokio::test]
+async fn owned_resource_round_trips() -> anyhow::Result<()> {
+    let mut store = store();
+    let instance = pre().await.instantiate_async(&mut store).await?;
+    assert_eq!(
+        42,
+        instance
+            .test_sync_suite_echoes()
+            .call_echo_resource(&mut store, Resource::new_own(42))
+            .await?
+            .rep()
+    );
+    Ok(())
+}
+
+/// A `borrow<resource>` argument passes through the guest to the host import
+/// with its rep.
+#[tokio::test]
+async fn borrowed_resource_reaches_the_import() -> anyhow::Result<()> {
+    let mut store = store();
+    let instance = pre().await.instantiate_async(&mut store).await?;
+    instance
+        .test_sync_suite_echoes()
+        .call_accept_borrow(&mut store, Resource::new_borrow(42))
+        .await?;
+    assert_eq!(BORROWED_REP.load(std::sync::atomic::Ordering::SeqCst), 42);
+    Ok(())
+}
+
+// ---- imported resource (constructor / instance method / static method / borrow) ----
+
+/// The guest constructs a host resource, and calls its instance method and its
+/// static method with a borrow of it.
+#[tokio::test]
+async fn guest_drives_a_host_resource() -> anyhow::Result<()> {
+    let mut store = store();
+    let instance = pre().await.instantiate_async(&mut store).await?;
+    let out = instance
+        .test_sync_suite_host_thing_driver()
+        .call_drive(&mut store, "hello")
+        .await?;
+    assert_eq!("hello|hello", out);
+    Ok(())
+}
diff --git a/componentize/tests/top_level.rs b/componentize/tests/top_level.rs
new file mode 100644
index 00000000..1d4c66ba
--- /dev/null
+++ b/componentize/tests/top_level.rs
@@ -0,0 +1,278 @@
+// SPDX-License-Identifier: Apache-2.0-WITH-LLVM-exception
+
+//! What the main module's top level may do before the component is wizened: the world of
+//! `fixtures/top_level.wit`, with the guest in `fixtures/top_level/` and inline guests.
+
+mod shared;
+
+use {
+    std::{
+        path::{Path, PathBuf},
+        time::Duration,
+    },
+    tokio::sync::OnceCell,
+    wasmtime::{component::Component, Engine, Store},
+};
+
+wasmtime::component::bindgen!({
+    path: "tests/fixtures/top_level.wit",
+    world: "top-level",
+    exports: { default: async },
+});
+
+static ENGINE: std::sync::LazyLock<Engine> = std::sync::LazyLock::new(shared::engine);
+
+/// The directory the guest's relative imports resolve against.
+fn base_directory() -> PathBuf {
+    Path::new(env!("CARGO_MANIFEST_DIR")).join("tests/fixtures/top_level")
+}
+
+/// Componentize `js` against the world, with [`base_directory`] as the base
+/// directory and `init_location` as the location.
+///
+/// Every case builds the same world, so the componentizer compiles the same instrumented
+/// component for each, and wasmtime's cache holds the compilation only once the first build
+/// wrote it. The first build runs alone, so the cases that start together don't each compile
+/// it with a cold cache.
+async fn build_with(
+    js: impl Into<componentize::JsSource<'_>>,
+    init_location: Option<&str>,
+) -> anyhow::Result<componentize::Componentized> {
+    let base_directory = base_directory();
+    let options = componentize::ComponentizeOptions {
+        base_directory: Some(&base_directory),
+        init_location,
+        ..Default::default()
+    };
+    static WARM: OnceCell<()> = OnceCell::const_new();
+    WARM.get_or_init(|| async {
+        // A failure is reported by the cases themselves.
+        let _ = shared::componentize_with(
+            componentize::Wit::String(WIT),
+            Some("top-level"),
+            "export const greeting = () => '';",
+            &options,
+        )
+        .await;
+    })
+    .await;
+    shared::componentize_with(
+        componentize::Wit::String(WIT),
+        Some("top-level"),
+        js,
+        &options,
+    )
+    .await
+}
+
+const WIT: &str = include_str!("fixtures/top_level.wit");
+
+async fn build(js: impl Into<componentize::JsSource<'_>>) -> anyhow::Result<Vec<u8>> {
+    Ok(build_with(js, None).await?.component)
+}
+
+/// An instance of `component` in a fresh store.
+async fn instantiate(component: &[u8]) -> anyhow::Result<(Store<shared::Ctx>, TopLevel)> {
+    let component = Component::new(&ENGINE, component)?;
+    let linker = shared::linker(&ENGINE, &component, &[], |_| Ok(()));
+    let mut store = shared::store(&ENGINE);
+    let instance = TopLevelPre::new(linker.instantiate_pre(&component)?)?
+        .instantiate_async(&mut store)
+        .await?;
+    Ok((store, instance))
+}
+
+/// The guest's static, JSON and dynamic imports and the value for which its
+/// top-level `await` waited on a timer are all in the snapshot, and its `const` export
+/// is initialized.
+#[tokio::test]
+async fn imports_and_top_level_await_are_wizened() -> anyhow::Result<()> {
+    let component = build(include_str!("fixtures/top_level/main.js")).await?;
+    let (mut store, instance) = instantiate(&component).await?;
+    let greeting = instance.call_greeting(&mut store).await?;
+    assert_eq!(
+        greeting,
+        "hello from a relative import and a dynamic import after a timer!"
+    );
+    Ok(())
+}
+
+/// A relative import of a module that does not exist fails componentization,
+/// naming the specifier.
+#[tokio::test]
+async fn missing_relative_import_fails_componentization() {
+    let err =
+        build("import { name } from './lib/missing.js';\nexport const greeting = () => name;")
+            .await
+            .expect_err("a guest importing a missing module must not componentize");
+    let message = format!("{err:#}");
+    assert!(
+        message.contains("Cannot resolve module './lib/missing.js'"),
+        "{message}"
+    );
+}
+
+/// A top-level `await` that rejects after a timer fails componentization with
+/// the rejection's message.
+#[tokio::test]
+async fn top_level_rejection_after_a_timer_fails_componentization() {
+    let err = build(
+        "await new Promise((resolve) => setTimeout(resolve, 5));\n\
+         throw new Error('configuration failed');",
+    )
+    .await
+    .expect_err("a guest whose top level rejects must not componentize");
+    let message = format!("{err:#}");
+    assert!(
+        message.contains("main module threw during evaluation: configuration failed"),
+        "{message}"
+    );
+}
+
+/// A top-level call of an export that throws synchronously fails
+/// componentization with the exception's message.
+#[tokio::test]
+async fn top_level_call_of_a_throwing_export_fails_componentization() {
+    let err = build(
+        "export function greeting() { throw new Error('greeting failed'); }\n\
+         greeting();",
+    )
+    .await
+    .expect_err("a guest whose top level throws must not componentize");
+    let message = format!("{err:#}");
+    assert!(
+        message.contains("main module threw during evaluation: greeting failed"),
+        "{message}"
+    );
+}
+
+/// A top-level `await` on a promise that never settles fails componentization
+/// once the event loop has no work left.
+#[tokio::test]
+async fn unsettled_top_level_await_fails_componentization() {
+    let err = build("await new Promise(() => {});\nexport const greeting = () => '';")
+        .await
+        .expect_err("a guest whose top level never finishes must not componentize");
+    let message = format!("{err:#}");
+    assert!(
+        message.contains("the application's top-level `await` never settled"),
+        "{message}"
+    );
+}
+
+/// Work the top level leaves pending once it has finished fails componentization
+/// with a message listing each piece of work and the stack that created it.
+#[tokio::test]
+async fn pending_work_fails_componentization_naming_its_origin() {
+    let text = "function poll() {\n\
+                  setInterval(() => {}, 1000);\n\
+                }\n\
+                poll();\n\
+                setTimeout(() => {}, 50);\n\
+                export const greeting = () => '';";
+    let err = build(componentize::JsSource {
+        name: "pending.js",
+        text,
+    })
+    .await
+    .expect_err("a guest that leaves work pending must not componentize");
+    let message = format!("{err:#}");
+    assert!(
+        message.contains("finished evaluating with asynchronous work still pending"),
+        "{message}"
+    );
+    let interval = message
+        .find("a pending `interval` timer, created at:\n      poll@pending.js:2:")
+        .unwrap_or_else(|| panic!("the interval and its stack are listed: {message}"));
+    let timeout = message
+        .find("a pending `timeout` timer, created at:\n      @pending.js:5:")
+        .unwrap_or_else(|| panic!("the timeout and its stack are listed: {message}"));
+    assert!(
+        interval < timeout,
+        "work is listed in creation order: {message}"
+    );
+}
+
+/// A top-level call of an import fails componentization, naming the import.
+#[tokio::test]
+async fn top_level_import_call_fails_componentization() {
+    let err = build(
+        "import { logEvent } from 'external';\n\
+         logEvent('started');\n\
+         export const greeting = () => '';",
+    )
+    .await
+    .expect_err("a guest calling an import at top level must not componentize");
+    let message = format!("{err:#}");
+    assert!(
+        message.contains(
+            "the import `logEvent` was called while the application initializes, before the \
+             component is wizened"
+        ),
+        "{message}"
+    );
+}
+
+/// What the top level prints while it initializes is returned with the
+/// component, and reading `location` without an init location throws.
+/// `performance.now()` in an export of a resumed instance continues past the
+/// reading taken by the top level before the snapshot, though the resumed
+/// instance's host clock starts over at zero.
+#[tokio::test]
+async fn init_output_is_returned_location_throws_and_the_clock_continues() -> anyhow::Result<()> {
+    let componentized = build_with(
+        "let href;\n\
+         try { href = location.href; } catch (e) { href = e.name; }\n\
+         console.log(`location: ${href}`);\n\
+         console.error('warned at init');\n\
+         await new Promise((resolve) => setTimeout(resolve, 50));\n\
+         const atInit = performance.now();\n\
+         export const greeting = () => String(performance.now() - atInit);",
+        None,
+    )
+    .await?;
+    assert_eq!(
+        componentized.init_output,
+        "location: TypeError\nError: warned at init\n"
+    );
+    let (mut store, instance) = instantiate(&componentized.component).await?;
+    let first: f64 = instance.call_greeting(&mut store).await?.parse()?;
+    tokio::time::sleep(Duration::from_millis(50)).await;
+    let second: f64 = instance.call_greeting(&mut store).await?.parse()?;
+    assert!(
+        first >= 0.0,
+        "the clock went back past the snapshot: {first}"
+    );
+    assert!(second - first >= 40.0, "{first} then {second}");
+    Ok(())
+}
+
+/// A module importing the main module's file gets the main module itself, so
+/// the main module's top level runs once.
+#[tokio::test]
+async fn importing_the_main_module_gets_the_main_module() -> anyhow::Result<()> {
+    let path = base_directory().join("entry.js");
+    let text = std::fs::read_to_string(&path)?;
+    let name = path.display().to_string();
+    let component = build(componentize::JsSource {
+        name: &name,
+        text: &text,
+    })
+    .await?;
+    let (mut store, instance) = instantiate(&component).await?;
+    assert_eq!(instance.call_greeting(&mut store).await?, "1 object");
+    Ok(())
+}
+
+/// The top level reads the location it is given as `globalThis.location`.
+#[tokio::test]
+async fn top_level_reads_the_init_location() -> anyhow::Result<()> {
+    const MAIN: &str = "const href = location.href;\nexport const greeting = () => href;";
+    let componentized = build_with(MAIN, Some("http://example.localhost/app/")).await?;
+    let (mut store, instance) = instantiate(&componentized.component).await?;
+    assert_eq!(
+        instance.call_greeting(&mut store).await?,
+        "http://example.localhost/app/"
+    );
+    Ok(())
+}
diff --git a/componentize/tests/values.rs b/componentize/tests/values.rs
new file mode 100644
index 00000000..136340db
--- /dev/null
+++ b/componentize/tests/values.rs
@@ -0,0 +1,662 @@
+// SPDX-License-Identifier: Apache-2.0-WITH-LLVM-exception
+
+//! Value shapes beyond the sync suite's echoes: the world of `fixtures/values.{wit,js}`. Every
+//! interface but `errors`, `strings` and `checks` is imported and exported, so each value is
+//! passed in both directions.
+
+mod shared;
+
+use shared::Ctx;
+
+use {
+    std::sync::LazyLock,
+    tokio::sync::OnceCell,
+    wasmtime::{component::HasSelf, Engine, Store},
+};
+
+wasmtime::component::bindgen!({
+    path: "tests/fixtures/values.wit",
+    world: "values",
+    imports: { default: async },
+    exports: { default: async },
+    additional_derives: [PartialEq],
+});
+
+use test::values::{errors, flags, keyword_imports, keywords, many, variants};
+
+static ENGINE: LazyLock<Engine> = LazyLock::new(shared::engine);
+
+/// Componentize the values world once and hold the instantiation-ready `Pre`.
+async fn pre() -> &'static ValuesPre<Ctx> {
+    static PRE: OnceCell<Result<ValuesPre<Ctx>, String>> = OnceCell::const_new();
+    shared::build_once(&PRE, async {
+        let component = shared::compile_fixture(
+            &ENGINE,
+            include_str!("fixtures/values.wit"),
+            "values",
+            include_str!("fixtures/values.js"),
+        )
+        .await;
+
+        let linker = shared::linker(&ENGINE, &component, &["test:values/"], |linker| {
+            Values::add_to_linker::<_, HasSelf<_>>(linker, |ctx| ctx)
+        });
+        ValuesPre::new(linker.instantiate_pre(&component).expect("instantiate_pre"))
+            .expect("ValuesPre")
+    })
+    .await
+}
+
+fn store() -> Store<Ctx> {
+    shared::store(&ENGINE)
+}
+
+// ===========================================================================
+// Host import implementations
+// ===========================================================================
+
+impl flags::Host for Ctx {
+    async fn roundtrip_flag1(&mut self, x: flags::Flag1) -> flags::Flag1 {
+        x | flags::Flag1::B0
+    }
+    async fn roundtrip_flag2(&mut self, x: flags::Flag2) -> flags::Flag2 {
+        x | flags::Flag2::B1
+    }
+    async fn roundtrip_flag4(&mut self, x: flags::Flag4) -> flags::Flag4 {
+        x | flags::Flag4::B3
+    }
+    async fn roundtrip_flag8(&mut self, x: flags::Flag8) -> flags::Flag8 {
+        x | flags::Flag8::B7
+    }
+    async fn roundtrip_flag16(&mut self, x: flags::Flag16) -> flags::Flag16 {
+        x | flags::Flag16::B15
+    }
+    async fn roundtrip_flag32(&mut self, x: flags::Flag32) -> flags::Flag32 {
+        x | flags::Flag32::B0
+    }
+}
+
+impl errors::Host for Ctx {}
+
+impl keyword_imports::Host for Ctx {
+    async fn type_(&mut self, v: u32) -> keyword_imports::Flags {
+        v as i32 + 1
+    }
+}
+
+impl keywords::Host for Ctx {
+    async fn func(&mut self, _v: u32) -> keywords::Flags {
+        unreachable!("the guest calls `keyword-imports.%type` instead")
+    }
+    async fn echo_record(&mut self, record: keywords::Record) -> keywords::Record {
+        keywords::Record {
+            type_: record.flags,
+            flags: record.type_,
+        }
+    }
+}
+
+impl variants::Host for Ctx {
+    async fn casts(
+        &mut self,
+        a: variants::Casts1,
+        b: variants::Casts2,
+        c: variants::Casts3,
+        d: variants::Casts4,
+        e: variants::Casts5,
+        f: variants::Casts6,
+    ) -> (
+        variants::Casts1,
+        variants::Casts2,
+        variants::Casts3,
+        variants::Casts4,
+        variants::Casts5,
+        variants::Casts6,
+    ) {
+        (a, b, c, d, e, f)
+    }
+    async fn echo_list_variant(&mut self, mut v: Vec<variants::V1>) -> Vec<variants::V1> {
+        v.reverse();
+        v
+    }
+    async fn echo_result(&mut self, v: Result<String, Vec<u8>>) -> Result<String, Vec<u8>> {
+        match v {
+            Ok(s) => Ok(s + "!"),
+            Err(mut bytes) => {
+                bytes.reverse();
+                Err(bytes)
+            }
+        }
+    }
+    async fn fail_with(&mut self, bytes: Vec<u8>) -> Result<String, Vec<u8>> {
+        Err(bytes)
+    }
+}
+
+impl many::Host for Ctx {
+    #[allow(clippy::too_many_arguments)]
+    async fn many_args(
+        &mut self,
+        a1: u64,
+        a2: u64,
+        a3: u64,
+        a4: u64,
+        a5: u64,
+        a6: u64,
+        a7: u64,
+        a8: u64,
+        a9: u64,
+        a10: u64,
+        a11: u64,
+        a12: u64,
+        a13: u64,
+        a14: u64,
+        a15: u64,
+        a16: u64,
+    ) -> Vec<u64> {
+        vec![
+            a1, a2, a3, a4, a5, a6, a7, a8, a9, a10, a11, a12, a13, a14, a15, a16,
+        ]
+    }
+    async fn big_argument(&mut self, x: many::BigStruct) -> many::BigStruct {
+        many::BigStruct {
+            a1: x.a1 + "a1",
+            a2: x.a2 + "a2",
+            a3: x.a3 + "a3",
+            a4: x.a4 + "a4",
+            a5: x.a5 + "a5",
+            a6: x.a6 + "a6",
+            a7: x.a7 + "a7",
+            a8: x.a8 + "a8",
+            a9: x.a9 + "a9",
+            a10: x.a10 + "a10",
+            a11: x.a11 + "a11",
+            a12: x.a12 + "a12",
+            a13: x.a13 + "a13",
+            a14: x.a14 + "a14",
+            a15: x.a15 + "a15",
+            a16: x.a16 + "a16",
+            a17: x.a17 + "a17",
+            a18: x.a18 + "a18",
+            a19: x.a19 + "a19",
+            a20: x.a20 + "a20",
+        }
+    }
+}
+
+// ===========================================================================
+// Test cases
+// ===========================================================================
+
+/// Flags of widths 1 to 32 round-trip with the bits set by the host and the
+/// guest on the way, so the value the guest lowers is checked bit for bit, including
+/// bit 31, which the guest sets past the signed-int32 range.
+#[tokio::test]
+async fn flags_of_every_width() -> anyhow::Result<()> {
+    use exports::test::values::flags::{Flag1, Flag16, Flag2, Flag32, Flag4, Flag8};
+
+    let mut store = store();
+    let instance = pre().await.instantiate_async(&mut store).await?;
+    let flags = instance.test_values_flags();
+
+    assert_eq!(
+        flags
+            .call_roundtrip_flag1(&mut store, Flag1::empty())
+            .await?,
+        Flag1::B0
+    );
+    assert_eq!(
+        flags
+            .call_roundtrip_flag2(&mut store, Flag2::empty())
+            .await?,
+        Flag2::B0 | Flag2::B1
+    );
+    assert_eq!(
+        flags.call_roundtrip_flag4(&mut store, Flag4::B1).await?,
+        Flag4::B0 | Flag4::B1 | Flag4::B3
+    );
+    assert_eq!(
+        flags.call_roundtrip_flag8(&mut store, Flag8::B4).await?,
+        Flag8::B0 | Flag8::B4 | Flag8::B7
+    );
+    assert_eq!(
+        flags
+            .call_roundtrip_flag16(&mut store, Flag16::B8 | Flag16::B9)
+            .await?,
+        Flag16::B0 | Flag16::B8 | Flag16::B9 | Flag16::B15
+    );
+    assert_eq!(
+        flags
+            .call_roundtrip_flag32(&mut store, Flag32::B16 | Flag32::B30)
+            .await?,
+        Flag32::B0 | Flag32::B16 | Flag32::B30 | Flag32::B31
+    );
+    assert_eq!(
+        flags
+            .call_roundtrip_flag32(&mut store, Flag32::all())
+            .await?,
+        Flag32::all()
+    );
+    Ok(())
+}
+
+/// Escaped keyword identifiers: functions, a type alias, a record, its fields
+/// and a parameter all named with `%`-escaped WIT keywords, which the guest
+/// sees under their plain names.
+#[tokio::test]
+async fn escaped_keywords() -> anyhow::Result<()> {
+    use exports::test::values::keywords::Record;
+
+    let mut store = store();
+    let instance = pre().await.instantiate_async(&mut store).await?;
+    let keywords = instance.test_values_keywords();
+
+    assert_eq!(keywords.call_func(&mut store, 5).await?, 7);
+    assert_eq!(
+        keywords
+            .call_echo_record(&mut store, Record { type_: 1, flags: 2 })
+            .await?,
+        Record { type_: 2, flags: 1 }
+    );
+    Ok(())
+}
+
+/// Variants whose cases share flat slots of different types (`s32`/`f32`,
+/// `f64`/`u64`, `f32`/`s64`, a pair of tuples) round-trip with each case's
+/// payload intact.
+#[tokio::test]
+async fn payload_punning_variants() -> anyhow::Result<()> {
+    use exports::test::values::variants::{Casts1, Casts2, Casts3, Casts4, Casts5, Casts6};
+
+    let mut store = store();
+    let instance = pre().await.instantiate_async(&mut store).await?;
+    let variants = instance.test_values_variants();
+
+    let cases = [
+        (
+            Casts1::A(-1),
+            Casts2::A(1.5),
+            Casts3::A(-2.25),
+            Casts4::A(u32::MAX),
+            Casts5::A(0.125),
+            Casts6::A((3.5, 7)),
+        ),
+        (
+            Casts1::B(-0.5),
+            Casts2::B(2.5),
+            Casts3::B(u64::MAX),
+            Casts4::B(i64::MIN),
+            Casts5::B(-(1 << 40)),
+            Casts6::B((u32::MAX, 1)),
+        ),
+    ];
+    for (a, b, c, d, e, f) in cases {
+        let got = variants.call_casts(&mut store, a, b, c, d, e, f).await?;
+        assert_eq!(got, (a, b, c, d, e, f));
+    }
+    Ok(())
+}
+
+/// A `list<variant>` with a payload-less case, a numeric case and a string
+/// case, reversed by the host on the way through.
+#[tokio::test]
+async fn list_of_variants() -> anyhow::Result<()> {
+    use exports::test::values::variants::V1;
+
+    let mut store = store();
+    let instance = pre().await.instantiate_async(&mut store).await?;
+    let variants = instance.test_values_variants();
+
+    let list = vec![V1::A, V1::B(7), V1::C("seven".to_string()), V1::B(0)];
+    let mut expected = list.clone();
+    expected.reverse();
+    assert_eq!(
+        variants.call_echo_list_variant(&mut store, &list).await?,
+        expected
+    );
+    Ok(())
+}
+
+/// `result<string, list<u8>>` in both directions: an `err` the host returns
+/// reaches the guest as a `ComponentError` whose payload is a `Uint8Array`,
+/// which the guest rethrows as the export's `err`, and an `err` the guest
+/// raises itself arrives as `Err`.
+#[tokio::test]
+async fn result_with_bytes_error() -> anyhow::Result<()> {
+    let mut store = store();
+    let instance = pre().await.instantiate_async(&mut store).await?;
+    let variants = instance.test_values_variants();
+
+    assert_eq!(
+        variants.call_echo_result(&mut store, Ok("hi")).await?,
+        Ok("hi!".to_string())
+    );
+    assert_eq!(
+        variants
+            .call_echo_result(&mut store, Err(&[1, 2, 3]))
+            .await?,
+        Err(vec![3, 2, 1])
+    );
+    assert_eq!(
+        variants.call_fail_with(&mut store, &[9, 8, 7]).await?,
+        Err(vec![9, 8, 7])
+    );
+    Ok(())
+}
+
+/// An `enum` `err` lowers from an `Error` whose message names a case and from an
+/// instance of the enum's error class, for a sync export and for a rejected
+/// async one.
+#[tokio::test]
+async fn enum_err_lowers_from_errors() -> anyhow::Result<()> {
+    let mut store = store();
+    let instance = pre().await.instantiate_async(&mut store).await?;
+
+    assert_eq!(
+        instance.call_lookup(&mut store, "present").await?,
+        Ok("present".to_string())
+    );
+    assert_eq!(
+        instance.call_lookup(&mut store, "missing").await?,
+        Err(errors::KvError::NotFound)
+    );
+    assert_eq!(
+        instance.call_lookup(&mut store, "secret").await?,
+        Err(errors::KvError::Denied)
+    );
+    let results = store
+        .run_concurrent(async |store| {
+            let mut results = Vec::new();
+            for key in ["present", "missing", "secret"] {
+                results.push(instance.call_lookup_async(store, key.to_string()).await?);
+            }
+            anyhow::Ok(results)
+        })
+        .await??;
+    assert_eq!(
+        results,
+        [
+            Ok("present".to_string()),
+            Err(errors::KvError::NotFound),
+            Err(errors::KvError::Denied),
+        ]
+    );
+    Ok(())
+}
+
+/// Sixteen `u64` arguments, the last ones above the 32-bit and 53-bit ranges,
+/// lift as bigints and come back as a `list<u64>` the guest lowers from a
+/// `BigUint64Array`.
+#[tokio::test]
+async fn sixteen_u64_arguments() -> anyhow::Result<()> {
+    let mut store = store();
+    let instance = pre().await.instantiate_async(&mut store).await?;
+    let many = instance.test_values_many();
+
+    let args: [u64; 16] = [
+        1,
+        2,
+        3,
+        4,
+        5,
+        6,
+        7,
+        8,
+        9,
+        10,
+        u32::MAX as u64,
+        u32::MAX as u64 + 1,
+        1 << 53,
+        (1 << 53) + 1,
+        u64::MAX - 1,
+        u64::MAX,
+    ];
+    let [a1, a2, a3, a4, a5, a6, a7, a8, a9, a10, a11, a12, a13, a14, a15, a16] = args;
+    let got = many
+        .call_many_args(
+            &mut store, a1, a2, a3, a4, a5, a6, a7, a8, a9, a10, a11, a12, a13, a14, a15, a16,
+        )
+        .await?;
+    assert_eq!(got, args);
+    Ok(())
+}
+
+/// A record of twenty strings, past the sixteen-flat-value limit, so the
+/// arguments and the results both go through memory.
+#[tokio::test]
+async fn twenty_string_record() -> anyhow::Result<()> {
+    use exports::test::values::many::BigStruct;
+
+    let mut store = store();
+    let instance = pre().await.instantiate_async(&mut store).await?;
+    let many = instance.test_values_many();
+
+    let field = |i: u32| format!("value{i}");
+    let input = BigStruct {
+        a1: field(1),
+        a2: field(2),
+        a3: field(3),
+        a4: field(4),
+        a5: field(5),
+        a6: field(6),
+        a7: field(7),
+        a8: field(8),
+        a9: field(9),
+        a10: field(10),
+        a11: field(11),
+        a12: field(12),
+        a13: field(13),
+        a14: field(14),
+        a15: field(15),
+        a16: field(16),
+        a17: field(17),
+        a18: field(18),
+        a19: field(19),
+        a20: field(20),
+    };
+    let got = many.call_big_argument(&mut store, &input).await?;
+    let expected = |i: u32| format!("value{i}a{i}");
+    assert_eq!(
+        [
+            got.a1, got.a2, got.a3, got.a4, got.a5, got.a6, got.a7, got.a8, got.a9, got.a10,
+            got.a11, got.a12, got.a13, got.a14, got.a15, got.a16, got.a17, got.a18, got.a19,
+            got.a20,
+        ],
+        std::array::from_fn::<_, 20, _>(|i| expected(i as u32 + 1))
+    );
+    Ok(())
+}
+
+/// A string of about 120 KB, mixing one-, two- and three-byte UTF-8, comes back
+/// intact.
+#[tokio::test]
+async fn large_string() -> anyhow::Result<()> {
+    let mut store = store();
+    let instance = pre().await.instantiate_async(&mut store).await?;
+
+    let unit = "Beware the Jubjub bird, and shun\n\tThe frumious Bandersnatch! ߀";
+    let big: String = std::iter::repeat_n(unit, 120 * 1024 / unit.len() + 1).collect();
+    assert!(big.len() > 120 * 1024);
+    let got = instance
+        .test_values_strings()
+        .call_echo(&mut store, &big)
+        .await?;
+    assert_eq!(got, big);
+    Ok(())
+}
+
+/// Two thousand calls on one instance, each returning a fresh string.
+#[tokio::test]
+async fn two_thousand_calls() -> anyhow::Result<()> {
+    let mut store = store();
+    let instance = pre().await.instantiate_async(&mut store).await?;
+    let strings = instance.test_values_strings();
+
+    for i in 0..2000 {
+        let got = strings.call_hello(&mut store).await?;
+        assert_eq!(got, "hello", "call {i}");
+    }
+    Ok(())
+}
+
+/// A plain `Array` of numbers lowers to a `list<u8>` element by element.
+#[tokio::test]
+async fn plain_array_for_a_numeric_list() -> anyhow::Result<()> {
+    let mut store = store();
+    let instance = pre().await.instantiate_async(&mut store).await?;
+    let checks = instance.test_values_checks();
+
+    assert_eq!(
+        checks.call_bytes_from_array(&mut store, 5).await?,
+        vec![0, 1, 2, 3, 4]
+    );
+    assert_eq!(
+        checks.call_bytes_from_array(&mut store, 0).await?,
+        Vec::<u8>::new()
+    );
+    // A list far longer than the others the suites pass.
+    let large = checks.call_bytes_from_array(&mut store, 100_000).await?;
+    assert_eq!(large.len(), 100_000);
+    assert!(large.iter().enumerate().all(|(i, b)| *b == i as u8));
+    Ok(())
+}
+
+/// The module of an interface exports a frozen object for each flags and enum
+/// type, mapping case names to values and values to case names. An error class
+/// of the same name takes the name in its module.
+#[tokio::test]
+async fn enum_and_flags_objects() -> anyhow::Result<()> {
+    let mut store = store();
+    let instance = pre().await.instantiate_async(&mut store).await?;
+    let json = instance
+        .test_values_checks()
+        .call_enum_objects(&mut store)
+        .await?;
+    assert_eq!(json, r#"[2,-2147483648,"b31",true,1,"notFound",true,true]"#);
+    Ok(())
+}
+
+/// An export result that does not match its WIT type traps, and the message on
+/// stderr names the export, the field and the value.
+#[tokio::test]
+async fn mismatched_export_result_names_the_field() -> anyhow::Result<()> {
+    let (mut store, stderr) = shared::store_capturing_stderr(&ENGINE);
+    let instance = pre().await.instantiate_async(&mut store).await?;
+
+    let result = instance
+        .test_values_checks()
+        .call_bad_point(&mut store)
+        .await;
+    assert!(result.is_err(), "a u8 field holding 310 must trap");
+    let stderr = shared::pipe_text(&stderr);
+    assert!(
+        stderr.contains("the result of export `test:values/checks#bad-point` `.x`")
+            && stderr.contains("expected a u8, got 310"),
+        "{stderr}"
+    );
+    Ok(())
+}
+
+/// A lone surrogate in a string the guest returns is lowered as U+FFFD.
+#[tokio::test]
+async fn lone_surrogates_in_a_string_become_replacement_characters() -> anyhow::Result<()> {
+    let mut store = store();
+    let instance = pre().await.instantiate_async(&mut store).await?;
+    let lowered = instance
+        .test_values_checks()
+        .call_lone_surrogates(&mut store)
+        .await?;
+    assert_eq!(lowered, "a\u{FFFD}b\u{FFFD}c");
+    Ok(())
+}
+
+/// A lone surrogate returned as a `char` traps, and the message on stderr names
+/// the export.
+#[tokio::test]
+async fn lone_surrogate_char_traps() -> anyhow::Result<()> {
+    let (mut store, stderr) = shared::store_capturing_stderr(&ENGINE);
+    let instance = pre().await.instantiate_async(&mut store).await?;
+    let result = instance
+        .test_values_checks()
+        .call_lone_surrogate_char(&mut store)
+        .await;
+    assert!(result.is_err(), "a lone surrogate is not a `char`");
+    let stderr = shared::pipe_text(&stderr);
+    assert!(
+        stderr.contains("test:values/checks#lone-surrogate-char"),
+        "{stderr}"
+    );
+    Ok(())
+}
+
+/// An import argument that does not match its WIT type throws a `TypeError`
+/// naming the argument, the field and the value.
+#[tokio::test]
+async fn mismatched_import_argument_throws() -> anyhow::Result<()> {
+    let mut store = store();
+    let instance = pre().await.instantiate_async(&mut store).await?;
+
+    let message = instance
+        .test_values_checks()
+        .call_bad_import_argument(&mut store)
+        .await?;
+    assert!(
+        message.contains("argument 1 of `bigArgument` `.a1`")
+            && message.contains("expected a string, got 5"),
+        "{message}"
+    );
+    Ok(())
+}
+
+/// A sync export that returns a promise traps, and the message suggests declaring
+/// the function `async`.
+#[tokio::test]
+async fn sync_export_returning_a_promise_traps_with_a_hint() -> anyhow::Result<()> {
+    let (mut store, stderr) = shared::store_capturing_stderr(&ENGINE);
+    let instance = pre().await.instantiate_async(&mut store).await?;
+    let result = instance
+        .test_values_checks()
+        .call_promised(&mut store)
+        .await;
+    assert!(result.is_err(), "returning a promise must trap");
+    let stderr = shared::pipe_text(&stderr);
+    assert!(
+        stderr.contains("got a Promise") && stderr.contains("Declare it `async`"),
+        "{stderr}"
+    );
+    Ok(())
+}
+
+/// An import argument is read once, so a getter that returns something else on a
+/// later read changes neither what is checked nor what the host receives.
+#[tokio::test]
+async fn import_argument_is_read_once() -> anyhow::Result<()> {
+    let mut store = store();
+    let instance = pre().await.instantiate_async(&mut store).await?;
+    let a1 = instance
+        .test_values_checks()
+        .call_shifting_import_argument(&mut store)
+        .await?;
+    // The host appends each field's name to its value.
+    assert_eq!(a1, "firsta1");
+    Ok(())
+}
+
+/// The error class of a type the world `use`s is exported from `external`,
+/// though the world imports no function of its own, and an instance of it
+/// thrown from an export becomes the export's `err`.
+#[tokio::test]
+async fn world_level_error_class() -> anyhow::Result<()> {
+    let mut store = store();
+    let instance = pre().await.instantiate_async(&mut store).await?;
+
+    assert_eq!(
+        instance.call_fallible(&mut store, false).await?,
+        Err(errors::Failure::Bad("bad".to_string()))
+    );
+    assert_eq!(
+        instance.call_fallible(&mut store, true).await?,
+        Err(errors::Failure::Worse)
+    );
+    Ok(())
+}
diff --git a/componentize/tests/wit_dir.rs b/componentize/tests/wit_dir.rs
new file mode 100644
index 00000000..7d6597e6
--- /dev/null
+++ b/componentize/tests/wit_dir.rs
@@ -0,0 +1,224 @@
+// SPDX-License-Identifier: Apache-2.0-WITH-LLVM-exception
+
+//! A WIT directory with `deps/`, componentized through `Wit::Paths`, whose world imports and
+//! exports two versions of one interface, imports the same interface name from a third package,
+//! and `use`s a type from a dependency package at world level.
+
+mod shared;
+
+use shared::Ctx;
+
+use {
+    std::{path::PathBuf, sync::LazyLock},
+    tokio::sync::OnceCell,
+    wasmtime::{
+        component::{Component, HasSelf},
+        Engine, Store,
+    },
+};
+
+wasmtime::component::bindgen!({
+    path: "tests/fixtures/wit_dir",
+    world: "versions",
+    imports: { default: async },
+    exports: { default: async },
+    additional_derives: [PartialEq],
+});
+
+static ENGINE: LazyLock<Engine> = LazyLock::new(shared::engine);
+
+/// Componentize the world once from its WIT directory and hold the
+/// instantiation-ready `Pre`.
+async fn pre() -> &'static VersionsPre<Ctx> {
+    static PRE: OnceCell<Result<VersionsPre<Ctx>, String>> = OnceCell::const_new();
+    shared::build_once(&PRE, async {
+        let wit_dir = PathBuf::from(env!("CARGO_MANIFEST_DIR")).join("tests/fixtures/wit_dir");
+        let component_bytes = shared::componentize_with(
+            componentize::Wit::Paths(&[wit_dir]),
+            Some("versions"),
+            include_str!("fixtures/wit_dir.js"),
+            &Default::default(),
+        )
+        .await
+        .expect("componentizing the wit-dir world")
+        .component;
+        let component = Component::new(&ENGINE, &component_bytes).expect("compiling component");
+        let linker = shared::linker(
+            &ENGINE,
+            &component,
+            &["local:hello/", "local:other/"],
+            |linker| Versions::add_to_linker::<_, HasSelf<_>>(linker, |ctx| ctx),
+        );
+        VersionsPre::new(linker.instantiate_pre(&component).expect("instantiate_pre"))
+            .expect("VersionsPre")
+    })
+    .await
+}
+
+fn store() -> Store<Ctx> {
+    shared::store(&ENGINE)
+}
+
+// ===========================================================================
+// Host import implementations
+// ===========================================================================
+
+impl local::hello1_0_0::hello::Host for Ctx {
+    async fn hello(&mut self, name: String) -> String {
+        format!("Hello 1.0.0, {name}")
+    }
+}
+
+impl local::hello2_0_0::hello::Host for Ctx {
+    async fn hello(&mut self, name: Option<String>) -> Option<String> {
+        name.map(|name| format!("Hello 2.0.0, {name}"))
+    }
+}
+
+impl local::b::foo::Host for Ctx {}
+
+impl local::other::hello::Host for Ctx {
+    async fn hello(&mut self, name: String) -> String {
+        format!("Hello other, {name}")
+    }
+}
+
+// ===========================================================================
+// Test cases
+// ===========================================================================
+
+/// Each exported version forwards to the import of the same version, and the
+/// two signatures differ, so a call reaching the wrong version fails to
+/// lift.
+#[tokio::test]
+async fn two_versions_of_one_interface() -> anyhow::Result<()> {
+    let mut store = store();
+    let instance = pre().await.instantiate_async(&mut store).await?;
+
+    assert_eq!(
+        instance
+            .local_hello1_0_0_hello()
+            .call_hello(&mut store, "foo")
+            .await?,
+        "Hello 1.0.0, foo"
+    );
+    assert_eq!(
+        instance
+            .local_hello2_0_0_hello()
+            .call_hello(&mut store, Some("bar"))
+            .await?,
+        Some("Hello 2.0.0, bar".to_string())
+    );
+    assert_eq!(
+        instance
+            .local_hello2_0_0_hello()
+            .call_hello(&mut store, None)
+            .await?,
+        None
+    );
+    Ok(())
+}
+
+/// The same interface name from two packages resolves to two distinct import
+/// modules.
+#[tokio::test]
+async fn same_interface_name_from_two_packages_is_two_modules() -> anyhow::Result<()> {
+    let mut store = store();
+    let instance = pre().await.instantiate_async(&mut store).await?;
+    let exports = instance.exports();
+
+    assert_eq!(
+        exports.call_hello(&mut store, "hello").await?,
+        "world hello (Hello 1.0.0, world)"
+    );
+    assert_eq!(
+        exports.call_hello(&mut store, "other").await?,
+        "world other (Hello other, world)"
+    );
+    assert_eq!(
+        exports.call_hello(&mut store, "else").await?,
+        "world unknown else"
+    );
+    Ok(())
+}
+
+/// A world-level `use` of a record from a dependency package.
+#[tokio::test]
+async fn world_level_use_of_dependency_type() -> anyhow::Result<()> {
+    let mut store = store();
+    let instance = pre().await.instantiate_async(&mut store).await?;
+    assert_eq!(
+        instance.call_make_bar(&mut store).await?,
+        local::b::foo::Bar { thing: 5 }
+    );
+    Ok(())
+}
+
+/// A world can `use` a resource of an interface the WASI host provides, in an
+/// interface of its own and at world level, in an imported function's result
+/// and an exported function's parameter: the component builds, and
+/// instantiates against the host.
+#[tokio::test]
+async fn world_using_a_wasi_resource() -> anyhow::Result<()> {
+    const WIT: &str = "
+package test:alias;
+interface files {
+  use wasi:filesystem/types@0.3.0.{descriptor};
+  size: func(d: borrow<descriptor>) -> u64;
+}
+world w {
+  use wasi:filesystem/types@0.3.0.{descriptor};
+  import files;
+  import open-root: func() -> descriptor;
+  export count: func() -> u32;
+  export take: func(d: descriptor) -> u32;
+}
+package wasi:filesystem@0.3.0 {
+  interface types {
+    resource descriptor;
+  }
+}
+";
+    let bytes = shared::try_componentize(
+        WIT,
+        "w",
+        "export function count() { return 1; }\nexport function take(d) { return 1; }",
+    )
+    .await?;
+    let component = Component::new(&ENGINE, &bytes)?;
+    let linker = shared::linker(&ENGINE, &component, &[], |_| Ok(()));
+    let mut store = store();
+    linker.instantiate_async(&mut store, &component).await?;
+    Ok(())
+}
+
+/// A world from `-w` alone also imports the interfaces the runtime imports,
+/// except those of the WASI APIs `--disable` names. `imports` leaves out an
+/// interface that declares only records.
+#[test]
+fn wit_dir_world_imports_what_the_runtime_imports() {
+    let wit = shared::workspace_root().join("componentize/tests/fixtures/wit_dir");
+    let wit = wit.to_string_lossy();
+    let modules = shared::cli_output(&["-w", &wit, "imports"]);
+    let modules: Vec<&str> = modules.lines().collect();
+    for module in [
+        "local:hello/hello@1",
+        "wasi:cli/environment@0.3",
+        "wasi:random/random@0.3",
+        "wasi:http/client@0.3",
+    ] {
+        assert!(modules.contains(&module), "`{module}` in {modules:?}");
+    }
+    assert!(!modules.contains(&"local:b/foo"), "{modules:?}");
+
+    let modules = shared::cli_output(&["-w", &wit, "--disable", "random", "imports"]);
+    let modules: Vec<&str> = modules.lines().collect();
+    assert!(
+        !modules.contains(&"wasi:random/random@0.3"),
+        "no `wasi:random/random` in {modules:?}"
+    );
+    assert!(
+        modules.contains(&"wasi:random/insecure-seed@0.3"),
+        "`wasi:random/insecure-seed` in {modules:?}"
+    );
+}
diff --git a/componentize/tests/wit_to_ts.rs b/componentize/tests/wit_to_ts.rs
new file mode 100644
index 00000000..f007362b
--- /dev/null
+++ b/componentize/tests/wit_to_ts.rs
@@ -0,0 +1,653 @@
+// SPDX-License-Identifier: Apache-2.0-WITH-LLVM-exception
+
+//! Snapshot tests for the WIT-world → guest `.d.ts` generator
+//! (`componentize::wit_to_ts`).
+//!
+//! Each fixture targets one WIT shape group, and the generated declaration is
+//! compared against the committed `tests/wit_to_ts/<name>.d.ts.expected`
+//! snapshot. Set `BLESS=1` to rewrite the snapshots from the current generator
+//! output.
+//!
+//! Every generated declaration is also type-checked with `tsc --noEmit --strict`,
+//! so a snapshot that is structurally invalid TypeScript fails even if it matches
+//! its committed form. A fixture may list hand-written guest modules
+//! (`tests/wit_to_ts/<name>.*.ts`), which are type-checked against the
+//! declaration together with it. The JavaScript guests the componentize suites
+//! use are type-checked with `--checkJs` against the declarations of their
+//! worlds (`tests/fixtures`). The compiler is the one `npm ci` installs at the
+//! workspace root, and the tests fail without it.
+//!
+//! Every declaration is generated once and shared by the tests. The type-checks run
+//! [`TSC_JOBS`] compiler processes at a time, one per fixture, since the `declare module`
+//! blocks of different fixtures would merge in one program. Every compiler process runs with
+//! no stdin and a wall-clock limit, and is killed if it exceeds it.
+
+mod shared;
+
+use std::fmt::Write as _;
+use std::path::{Path, PathBuf};
+use std::process::{Command, Output, Stdio};
+use std::sync::atomic::{AtomicUsize, Ordering};
+use std::sync::LazyLock;
+use std::time::{Duration, Instant};
+
+use componentize::wit_to_ts;
+use wit_parser::Resolve;
+
+/// Where a fixture's world comes from.
+enum Source {
+    /// The world named by the second element in `tests/wit_to_ts/<first>.wit`.
+    Wit(&'static str, &'static str),
+    /// The world named by the second element in `tests/fixtures/<first>.wit`,
+    /// a world from which the componentize suites build components.
+    Suite(&'static str, &'static str),
+    /// A built-in world, selected by passing this flag to the
+    /// `starling-componentize types` binary.
+    Builtin(&'static str),
+}
+
+/// One fixture: its name, which names its snapshot `<name>.d.ts.expected`, its
+/// world, and the guest modules type-checked against its declaration, as file
+/// names in `tests/wit_to_ts`.
+struct Fixture {
+    name: &'static str,
+    source: Source,
+    guests: &'static [&'static str],
+}
+
+/// A fixture for the world `world` in `tests/wit_to_ts/<name>.wit`, with no
+/// guest modules.
+const fn wit(name: &'static str, world: &'static str) -> Fixture {
+    Fixture {
+        name,
+        source: Source::Wit(name, world),
+        guests: &[],
+    }
+}
+
+/// The fixtures: one per WIT shape group, the naming shapes, and the two
+/// built-in worlds.
+const FIXTURES: &[Fixture] = &[
+    wit("primitives", "primitives"),
+    wit("lists", "lists"),
+    wit("option_result", "option-result"),
+    wit("records_tuples", "records-tuples"),
+    wit("variant_enum_flags", "variant-enum-flags"),
+    wit("imports", "imports"),
+    wit("world_funcs", "world-funcs"),
+    // WIT names escaped with `%` that mangle to JavaScript reserved words.
+    wit("reserved_names", "reserved-names"),
+    // Parameters named after reserved words, and `this`.
+    wit("reserved_params", "reserved-params"),
+    // A guest-owned resource, from the world of the `exported_resource` suite.
+    Fixture {
+        name: "exported_resource",
+        source: Source::Suite("exported_resource", "exported-resource"),
+        guests: &[],
+    },
+    // Imported resources at interface and world level. The class lives in the
+    // shared-types module, and each importing block re-exports it. An exported
+    // interface names an imported resource in its own signature.
+    wit("imported_resources", "imported-resources"),
+    // An imported resource with async methods and stream parameters, reached
+    // only through an exported interface's signatures.
+    wit("resource_polarity", "resource-polarity"),
+    // An interface both imported and exported: a host class and a guest class
+    // for one resource.
+    Fixture {
+        name: "dual",
+        source: Source::Wit("dual", "dual"),
+        guests: &["dual.guest.ts"],
+    },
+    // Types with the same name in several interfaces and packages.
+    wit("duplicate_names", "duplicate-names"),
+    // WIT types named after the globals the declarations refer to.
+    wit("global_names", "global-names"),
+    // Error classes of `use`d, renamed and world-level `err` types, and an enum
+    // used only as an exported function's `err` type.
+    Fixture {
+        name: "error_types",
+        source: Source::Wit("error_types", "error-types"),
+        guests: &["error_types.guest.ts"],
+    },
+    // Streams, futures and error classes.
+    wit("streams", "streams"),
+    // A `stream` and a `future` without a payload type, with a guest module.
+    Fixture {
+        name: "payloadless",
+        source: Source::Wit("payloadless", "payloadless"),
+        guests: &["payloadless.guest.ts"],
+    },
+    // The naming shapes of `starling:guest`.
+    Fixture {
+        name: "naming_unique",
+        source: Source::Wit("naming", "naming-unique"),
+        guests: &[
+            "naming_unique.package.ts",
+            "naming_unique.interface.ts",
+            "naming_unique.bare.ts",
+        ],
+    },
+    Fixture {
+        name: "naming_ambiguous",
+        source: Source::Wit("naming", "naming-ambiguous"),
+        guests: &["naming_ambiguous.guest.ts"],
+    },
+    Fixture {
+        name: "naming_reserved",
+        source: Source::Wit("naming", "naming-reserved"),
+        guests: &["naming_reserved.guest.ts"],
+    },
+    Fixture {
+        name: "naming_versions",
+        source: Source::Wit("naming", "naming-versions"),
+        guests: &["naming_versions.guest.ts"],
+    },
+    // Exported-resource and handed-over value shapes, with a guest module.
+    Fixture {
+        name: "guest_shapes",
+        source: Source::Wit("guest_shapes", "guest-shapes"),
+        guests: &["guest_shapes.guest.ts"],
+    },
+    // A world declaring `wasi:http/handler` and `wasi:http/types` itself.
+    Fixture {
+        name: "serve",
+        source: Source::Wit("serve", "serve"),
+        guests: &["serve.handler.ts"],
+    },
+    Fixture {
+        name: "builtin_cli",
+        source: Source::Builtin("--export-cli"),
+        guests: &["builtin_cli.guest.ts"],
+    },
+    Fixture {
+        name: "builtin_serve",
+        source: Source::Builtin("--export-http"),
+        guests: &["builtin_serve.listener.ts", "builtin_serve.handler.ts"],
+    },
+];
+
+fn fixtures_dir() -> PathBuf {
+    PathBuf::from(env!("CARGO_MANIFEST_DIR")).join("tests/wit_to_ts")
+}
+
+fn suite_fixtures_dir() -> PathBuf {
+    PathBuf::from(env!("CARGO_MANIFEST_DIR")).join("tests/fixtures")
+}
+
+/// The `.d.ts` of each of [`FIXTURES`], in order, generated once.
+static GENERATED: LazyLock<Vec<String>> = LazyLock::new(|| FIXTURES.iter().map(generate).collect());
+
+/// Generate the `.d.ts` for one fixture.
+fn generate(fixture: &Fixture) -> String {
+    match fixture.source {
+        Source::Wit(stem, world) => generate_wit(&fixtures_dir(), stem, world),
+        Source::Suite(stem, world) => generate_wit(&suite_fixtures_dir(), stem, world),
+        Source::Builtin(flag) => shared::cli_output(&[flag, "types"]),
+    }
+}
+
+/// Generate the `.d.ts` for the world `world` in `<dir>/<stem>.wit`.
+fn generate_wit(dir: &Path, stem: &str, world: &str) -> String {
+    let wit = dir.join(format!("{stem}.wit"));
+    let mut resolve = Resolve::default();
+    let package = resolve
+        .push_file(&wit)
+        .unwrap_or_else(|e| panic!("parsing `{}`: {e}", wit.display()));
+    let world_id = resolve
+        .select_world(&[package], Some(world))
+        .unwrap_or_else(|e| panic!("selecting world `{world}` in `{stem}.wit`: {e}"));
+    wit_to_ts::generate(&resolve, world_id).expect("generating .d.ts")
+}
+
+/// A world from which the componentize suites build components, and the
+/// JavaScript guest modules they componentize against it.
+struct SuiteFixture {
+    /// The name of the world's `.d.ts` file.
+    name: &'static str,
+    /// The `starling-componentize` flags that select the world, with paths
+    /// relative to `tests/fixtures`.
+    world: &'static [&'static str],
+    /// The guests, as paths relative to `tests/fixtures`.
+    guests: &'static [&'static str],
+}
+
+/// Every suite world with its guests.
+const SUITE_FIXTURES: &[SuiteFixture] = &[
+    SuiteFixture {
+        name: "async_export",
+        world: &["-w", "async_export.wit"],
+        guests: &["async_export.js"],
+    },
+    SuiteFixture {
+        name: "async_import",
+        world: &["-w", "async_import.wit"],
+        guests: &["async_import.js"],
+    },
+    SuiteFixture {
+        name: "cli_and_serve",
+        world: &["--export-cli", "--export-http"],
+        guests: &["cli_and_serve.js"],
+    },
+    SuiteFixture {
+        name: "cli_merged",
+        world: &[
+            "-w",
+            "cli/a.wit",
+            "-w",
+            "cli/b.wit",
+            "-n",
+            "test:cli-a/one",
+            "-n",
+            "two",
+        ],
+        guests: &["cli/app/lib.js", "cli/app/src/main.js"],
+    },
+    SuiteFixture {
+        name: "cli_run",
+        world: &["-w", "cli_run.wit"],
+        guests: &["cli_run.js", "cli_run_no_run.js"],
+    },
+    SuiteFixture {
+        name: "exported_resource",
+        world: &["-w", "exported_resource.wit"],
+        guests: &["exported_resource.js"],
+    },
+    SuiteFixture {
+        name: "fetch_streams",
+        world: &["-w", "fetch_streams.wit"],
+        guests: &["fetch_streams.js"],
+    },
+    SuiteFixture {
+        name: "lowering",
+        world: &["-w", "lowering.wit"],
+        guests: &["lowering.js"],
+    },
+    SuiteFixture {
+        name: "resources",
+        world: &["-w", "resources.wit"],
+        guests: &["resources.js"],
+    },
+    SuiteFixture {
+        name: "serve",
+        world: &["-w", "serve.wit"],
+        guests: &[
+            "serve.js",
+            "serve_no_listener.js",
+            "serve_raw.js",
+            "serve_raw_and_listener.js",
+            "serve_raw_response.js",
+            "serve_wasi_imports.js",
+        ],
+    },
+    SuiteFixture {
+        name: "streams",
+        world: &["-w", "streams.wit"],
+        guests: &["streams.js"],
+    },
+    SuiteFixture {
+        name: "surface",
+        world: &["-w", "surface.wit"],
+        guests: &["surface.js"],
+    },
+    SuiteFixture {
+        name: "sync_suite",
+        world: &["-w", "sync_suite.wit"],
+        guests: &["sync_suite.js"],
+    },
+    SuiteFixture {
+        name: "top_level",
+        world: &["-w", "top_level.wit"],
+        guests: &[
+            "top_level/main.js",
+            "top_level/entry.js",
+            "top_level/lib/back.js",
+            "top_level/lib/late.js",
+            "top_level/lib/name.js",
+        ],
+    },
+    SuiteFixture {
+        name: "values",
+        world: &["-w", "values.wit"],
+        guests: &["values.js"],
+    },
+    SuiteFixture {
+        name: "wit_dir",
+        world: &["-w", "wit_dir"],
+        guests: &["wit_dir.js"],
+    },
+    SuiteFixture {
+        name: "world_resource",
+        world: &["-w", "world_resource.wit"],
+        guests: &["world_resource.js"],
+    },
+];
+
+#[test]
+fn snapshots_match() {
+    let bless = std::env::var_os("BLESS").is_some();
+    let mut mismatches = Vec::new();
+
+    for (fixture, actual) in FIXTURES.iter().zip(GENERATED.iter()) {
+        let stem = fixture.name;
+        let snapshot = fixtures_dir().join(format!("{stem}.d.ts.expected"));
+
+        if bless {
+            std::fs::write(&snapshot, actual).expect("writing blessed snapshot");
+            continue;
+        }
+
+        let expected = std::fs::read_to_string(&snapshot)
+            .unwrap_or_else(|e| panic!("reading snapshot `{}`: {e}", snapshot.display()));
+        if *actual != expected {
+            mismatches.push(format!(
+                "--- {stem} ---\nEXPECTED:\n{expected}\nACTUAL:\n{actual}"
+            ));
+        }
+    }
+
+    assert!(
+        mismatches.is_empty(),
+        "{} snapshot(s) differ (run with BLESS=1 to update):\n\n{}",
+        mismatches.len(),
+        mismatches.join("\n\n")
+    );
+}
+
+/// Type-check every generated declaration with `tsc --noEmit --strict`, together
+/// with a consumer module that imports from each module the declaration declares
+/// and with the fixture's guest modules.
+///
+/// A declaration file parses on its own
+/// however its `declare module` blocks are reached, and only an import from
+/// another file distinguishes an ambient module declaration, which resolves,
+/// from an augmentation of a module that does not exist, which does not.
+#[test]
+fn generated_dts_is_valid_typescript() {
+    let tsc = tsc();
+
+    let out_dir = PathBuf::from(env!("CARGO_TARGET_TMPDIR")).join("wit_to_ts_dts");
+    std::fs::create_dir_all(&out_dir).expect("creating tsc scratch dir");
+
+    let mut checks = Vec::new();
+    for (fixture, dts) in FIXTURES.iter().zip(GENERATED.iter()) {
+        let stem = fixture.name;
+        let dts_path = out_dir.join(format!("{stem}.d.ts"));
+        std::fs::write(&dts_path, dts).expect("writing generated .d.ts for tsc");
+        let consumer_path = out_dir.join(format!("{stem}_consumer.ts"));
+        std::fs::write(&consumer_path, consumer_for(dts)).expect("writing consumer for tsc");
+
+        let mut files = vec![dts_path, consumer_path];
+        files.extend(
+            fixture
+                .guests
+                .iter()
+                .map(|guest| fixtures_dir().join(guest)),
+        );
+        checks.push((stem.to_string(), files));
+    }
+    let failures = run_tsc_all(&tsc, checks, Guests::TypeScript);
+
+    assert!(
+        failures.is_empty(),
+        "{} generated declaration(s) failed `tsc --noEmit --strict`:\n\n{}",
+        failures.len(),
+        failures.join("\n\n")
+    );
+}
+
+/// Type-check the JavaScript guests of every suite world against the declarations
+/// `starling-componentize types` generates for it, with `tsc --checkJs`.
+///
+/// Untyped parameters and caught values are left as `any`, since the guests are
+/// plain JavaScript. A guest that misuses a type on purpose, or uses an API the
+/// TypeScript DOM library lacks, marks the line with `@ts-expect-error`.
+#[test]
+fn suite_guests_type_check() {
+    let tsc = tsc();
+    let out_dir = PathBuf::from(env!("CARGO_TARGET_TMPDIR")).join("wit_to_ts_suite_guests");
+    std::fs::create_dir_all(&out_dir).expect("creating tsc scratch dir");
+    let suite_fixtures = suite_fixtures_dir();
+
+    let mut checks = Vec::new();
+    for fixture in SUITE_FIXTURES {
+        let args: Vec<&str> = fixture.world.iter().copied().chain(["types"]).collect();
+        let output = shared::run_cli(&args, Some(&suite_fixtures));
+        assert!(
+            output.status.success(),
+            "`starling-componentize {}` failed:\n{}",
+            args.join(" "),
+            String::from_utf8_lossy(&output.stderr)
+        );
+        let dts = String::from_utf8(output.stdout).expect("UTF-8 output");
+        let stem = fixture.name;
+        let dts_path = out_dir.join(format!("{stem}.d.ts"));
+        std::fs::write(&dts_path, &dts).expect("writing generated .d.ts for tsc");
+
+        let mut files = vec![dts_path];
+        files.extend(
+            fixture
+                .guests
+                .iter()
+                .map(|guest| suite_fixtures.join(guest)),
+        );
+        checks.push((stem.to_string(), files));
+    }
+    let failures = run_tsc_all(&tsc, checks, Guests::JavaScript);
+
+    assert!(
+        failures.is_empty(),
+        "{} suite world(s) failed `tsc --checkJs`:\n\n{}",
+        failures.len(),
+        failures.join("\n\n")
+    );
+}
+
+/// Every JavaScript module in `tests/fixtures` is a guest of one of
+/// [`SUITE_FIXTURES`].
+#[test]
+fn every_suite_guest_is_type_checked() {
+    fn modules(dir: &Path, base: &Path, out: &mut Vec<String>) {
+        for entry in std::fs::read_dir(dir).expect("reading a fixtures directory") {
+            let path = entry.expect("reading a fixtures directory").path();
+            if path.is_dir() {
+                modules(&path, base, out);
+            } else if path.extension().is_some_and(|ext| ext == "js") {
+                let relative = path
+                    .strip_prefix(base)
+                    .expect("a path under `tests/fixtures`");
+                out.push(relative.to_string_lossy().replace('\\', "/"));
+            }
+        }
+    }
+    let base = suite_fixtures_dir();
+    let mut found = Vec::new();
+    modules(&base, &base, &mut found);
+    let checked: Vec<&str> = SUITE_FIXTURES
+        .iter()
+        .flat_map(|fixture| fixture.guests.iter().copied())
+        .collect();
+    let unchecked: Vec<&String> = found
+        .iter()
+        .filter(|module| !checked.contains(&module.as_str()))
+        .collect();
+    assert!(
+        unchecked.is_empty(),
+        "add these guests to `SUITE_FIXTURES`: {unchecked:?}"
+    );
+}
+
+/// A TypeScript module importing every module `dts` declares, so a specifier
+/// that does not resolve is a compile error.
+///
+/// The specifiers are read back out of the generated text, which keeps the
+/// consumer in step with whatever the generator emitted.
+fn consumer_for(dts: &str) -> String {
+    let mut out = String::from("// Generated by the `wit_to_ts` type-check.\n");
+    for (i, line) in dts
+        .lines()
+        .filter_map(|line| line.strip_prefix("declare module '"))
+        .filter_map(|rest| rest.split_once('\''))
+        .map(|(spec, _)| spec)
+        .enumerate()
+    {
+        let _ = writeln!(out, "import * as m{i} from '{line}';");
+        let _ = writeln!(out, "void m{i};");
+    }
+    out
+}
+
+/// How long one type-check may run before it is killed.
+const TSC_TIME_LIMIT: Duration = Duration::from_secs(120);
+
+/// The TypeScript compiler `npm ci` installs at the workspace root, as the argv
+/// prefix to invoke it.
+fn tsc() -> Vec<String> {
+    let tsc = shared::workspace_root().join("node_modules/.bin/tsc");
+    assert!(
+        tsc.exists(),
+        "no TypeScript compiler at `{}`: install it with `npm ci` at the workspace root",
+        tsc.display()
+    );
+    vec![tsc.to_string_lossy().into_owned()]
+}
+
+/// The language of the guest modules [`run_tsc`] checks.
+#[derive(Clone, Copy, PartialEq, Eq)]
+enum Guests {
+    TypeScript,
+    JavaScript,
+}
+
+/// How many type-checks run at a time.
+const TSC_JOBS: usize = 4;
+
+/// Type-check each named set of files with [`run_tsc`], [`TSC_JOBS`] at a time.
+/// Returns a report for each set that failed, in the order of `checks`.
+fn run_tsc_all(tsc: &[String], checks: Vec<(String, Vec<PathBuf>)>, guests: Guests) -> Vec<String> {
+    let next = AtomicUsize::new(0);
+    let mut results: Vec<(usize, String)> = std::thread::scope(|scope| {
+        let workers: Vec<_> = (0..TSC_JOBS)
+            .map(|_| {
+                scope.spawn(|| {
+                    let mut failures = Vec::new();
+                    loop {
+                        let index = next.fetch_add(1, Ordering::Relaxed);
+                        let Some((name, files)) = checks.get(index) else {
+                            break;
+                        };
+                        let files: Vec<&Path> = files.iter().map(PathBuf::as_path).collect();
+                        let output = run_tsc(tsc, &files, guests);
+                        if !output.status.success() {
+                            failures.push((
+                                index,
+                                format!(
+                                    "--- {name} ---\n{}{}",
+                                    String::from_utf8_lossy(&output.stdout),
+                                    String::from_utf8_lossy(&output.stderr),
+                                ),
+                            ));
+                        }
+                    }
+                    failures
+                })
+            })
+            .collect();
+        workers
+            .into_iter()
+            .flat_map(|worker| worker.join().expect("a type-check panicked"))
+            .collect()
+    });
+    results.sort_by_key(|(index, _)| *index);
+    results.into_iter().map(|(_, report)| report).collect()
+}
+
+fn run_tsc(tsc: &[String], files: &[&Path], guests: Guests) -> Output {
+    let (prog, pre) = tsc.split_first().expect("non-empty tsc argv");
+    let mut cmd = Command::new(prog);
+    // `esnext` for `Symbol.dispose`, which the resource classes declare, and
+    // `dom` for `ReadableStream`, `Request` and `Response`, with
+    // `dom.asynciterable` for iterating a `ReadableStream`. `esnext` as the
+    // target for `using` in the guest modules, and as the module format for the
+    // string export names of versioned interfaces.
+    cmd.args(pre).args([
+        "--noEmit",
+        "--strict",
+        "--target",
+        "esnext",
+        "--module",
+        "esnext",
+        "--lib",
+        "esnext,dom,dom.asynciterable",
+    ]);
+    if guests == Guests::JavaScript {
+        // Every guest file is a module, including one with no imports or
+        // exports. JSON modules are imported with `with { type: "json" }`.
+        cmd.args([
+            "--allowJs",
+            "--checkJs",
+            "--noImplicitAny",
+            "false",
+            "--useUnknownInCatchVariables",
+            "false",
+            "--moduleDetection",
+            "force",
+            "--moduleResolution",
+            "bundler",
+            "--resolveJsonModule",
+        ]);
+    }
+    cmd.args(files);
+    run_bounded(cmd, TSC_TIME_LIMIT).unwrap_or_else(|| {
+        panic!(
+            "`{}` did not finish within {TSC_TIME_LIMIT:?}",
+            tsc.join(" ")
+        )
+    })
+}
+
+/// Run `cmd` to completion and collect its output, killing it and returning `None` if it takes
+/// longer than `limit` or cannot be spawned at all.
+///
+/// stdin is `/dev/null`, so a child that reads stdin reads EOF.
+fn run_bounded(mut cmd: Command, limit: Duration) -> Option<Output> {
+    let mut child = cmd
+        .stdin(Stdio::null())
+        .stdout(Stdio::piped())
+        .stderr(Stdio::piped())
+        .spawn()
+        .ok()?;
+    // The pipes are read while the child runs, so output larger than a pipe's
+    // buffer cannot block it.
+    let drain = |pipe: Option<Box<dyn std::io::Read + Send>>| {
+        std::thread::spawn(move || {
+            let mut bytes = Vec::new();
+            if let Some(mut pipe) = pipe {
+                let _ = pipe.read_to_end(&mut bytes);
+            }
+            bytes
+        })
+    };
+    let stdout = drain(child.stdout.take().map(|p| Box::new(p) as _));
+    let stderr = drain(child.stderr.take().map(|p| Box::new(p) as _));
+
+    let start = Instant::now();
+    loop {
+        match child.try_wait() {
+            Ok(Some(status)) => {
+                return Some(Output {
+                    status,
+                    stdout: stdout.join().ok()?,
+                    stderr: stderr.join().ok()?,
+                });
+            }
+            Ok(None) if start.elapsed() < limit => std::thread::sleep(Duration::from_millis(25)),
+            Ok(None) => {
+                let _ = child.kill();
+                let _ = child.wait();
+                return None;
+            }
+            Err(_) => return None,
+        }
+    }
+}
diff --git a/componentize/tests/wit_to_ts/builtin_cli.d.ts.expected b/componentize/tests/wit_to_ts/builtin_cli.d.ts.expected
new file mode 100644
index 00000000..17eee1d4
--- /dev/null
+++ b/componentize/tests/wit_to_ts/builtin_cli.d.ts.expected
@@ -0,0 +1,438 @@
+// Generated by `starling-componentize types`. Do not edit by hand.
+//
+// The guest JavaScript module a `command` componentize target implements, and
+// the modules it may import. Add this file to the program (a `files` or
+// `include` entry in `tsconfig.json`, or a `/// <reference path=…/>`).
+//
+// Nothing here is exported at file level, which makes every `declare
+// module` below an ambient module declaration. An import then
+// resolves:
+//
+//   import { log } from 'test:example/logger';
+//
+// The guest's own obligations are `starling:guest`. Reference it to have the
+// compiler check what the module exports:
+//
+//   import type * as Guest from 'starling:guest';
+//   export const example: typeof Guest.example = { … };
+//
+// Every WIT type the world uses is declared in the module
+//
+//   starling:types/starling:cli/command
+//
+// Each interface's module re-exports the types the interface defines or
+// `use`s under their WIT names. A name that several types share is
+// qualified there.
+
+// `ComponentError` holds the `err` payload of a WIT `result`. A string payload
+// is also its `message`. The error classes in the types module extend it.
+interface ComponentError extends Error {
+  readonly payload: unknown;
+}
+declare var ComponentError: {
+  new (payload: unknown): ComponentError;
+  readonly prototype: ComponentError;
+};
+
+// `fetch` also takes a `wasi:http/types` `request`, such as the one a
+// `wasi:http/handler` implementation receives, and sends it.
+declare function fetch(
+  input: import('starling:types/starling:cli/command').Request,
+  init?: RequestInit,
+): Promise<Response>;
+
+declare module 'starling:types/starling:cli/command' {
+  export enum WasiCliTypesErrorCode {
+    io = 0,
+    illegalByteSequence = 1,
+    pipe = 2,
+  }
+
+  export class TerminalInput {
+    private constructor();
+    private $brand: unknown;
+    [Symbol.dispose](): void;
+  }
+
+  export class TerminalOutput {
+    private constructor();
+    private $brand: unknown;
+    [Symbol.dispose](): void;
+  }
+
+  export type Duration = bigint;
+
+  export type Mark = bigint;
+
+  export type Instant = { seconds: bigint; nanoseconds: number; };
+
+  export class Descriptor {
+    private constructor();
+    readViaStream(offset: Filesize): [ReadableStream<Uint8Array>, Promise<void>];
+    writeViaStream(data: ReadableStream<ArrayBufferView | ArrayBuffer> | AsyncIterable<ArrayBufferView | ArrayBuffer> | Iterable<ArrayBufferView | ArrayBuffer>, offset: Filesize): Promise<void>;
+    appendViaStream(data: ReadableStream<ArrayBufferView | ArrayBuffer> | AsyncIterable<ArrayBufferView | ArrayBuffer> | Iterable<ArrayBufferView | ArrayBuffer>): Promise<void>;
+    getFlags(): Promise<DescriptorFlagsSet>;
+    stat(): Promise<DescriptorStat>;
+    statAt(pathFlags: PathFlagsSet, path: string): Promise<DescriptorStat>;
+    openAt(pathFlags: PathFlagsSet, path: string, openFlags: OpenFlagsSet, flags: DescriptorFlagsSet): Promise<Descriptor>;
+    readlinkAt(path: string): Promise<string>;
+    removeDirectoryAt(path: string): Promise<void>;
+    unlinkFileAt(path: string): Promise<void>;
+    metadataHash(): Promise<MetadataHashValue>;
+    metadataHashAt(pathFlags: PathFlagsSet, path: string): Promise<MetadataHashValue>;
+    private $brand: unknown;
+    [Symbol.dispose](): void;
+  }
+
+  export type Filesize = bigint;
+
+  export type WasiFilesystemTypesErrorCode = { tag: 'access' } | { tag: 'already' } | { tag: 'badDescriptor' } | { tag: 'busy' } | { tag: 'deadlock' } | { tag: 'quota' } | { tag: 'exist' } | { tag: 'fileTooLarge' } | { tag: 'illegalByteSequence' } | { tag: 'inProgress' } | { tag: 'interrupted' } | { tag: 'invalid' } | { tag: 'io' } | { tag: 'isDirectory' } | { tag: 'loop' } | { tag: 'tooManyLinks' } | { tag: 'messageSize' } | { tag: 'nameTooLong' } | { tag: 'noDevice' } | { tag: 'noEntry' } | { tag: 'noLock' } | { tag: 'insufficientMemory' } | { tag: 'insufficientSpace' } | { tag: 'notDirectory' } | { tag: 'notEmpty' } | { tag: 'notRecoverable' } | { tag: 'unsupported' } | { tag: 'noTty' } | { tag: 'noSuchDevice' } | { tag: 'overflow' } | { tag: 'notPermitted' } | { tag: 'pipe' } | { tag: 'readOnly' } | { tag: 'invalidSeek' } | { tag: 'textFileBusy' } | { tag: 'crossDevice' } | { tag: 'other'; val?: string | undefined };
+
+  export enum DescriptorFlags {
+    read = 1,
+    write = 2,
+    fileIntegritySync = 4,
+    dataIntegritySync = 8,
+    requestedWriteSync = 16,
+    mutateDirectory = 32,
+  }
+
+  // A set of `DescriptorFlags` members, combined with `|`.
+  export type DescriptorFlagsSet = number;
+
+  export type DescriptorStat = { type: DescriptorType; linkCount: LinkCount; size: Filesize; dataAccessTimestamp?: Instant | undefined; dataModificationTimestamp?: Instant | undefined; statusChangeTimestamp?: Instant | undefined; };
+
+  export type DescriptorType = { tag: 'blockDevice' } | { tag: 'characterDevice' } | { tag: 'directory' } | { tag: 'fifo' } | { tag: 'symbolicLink' } | { tag: 'regularFile' } | { tag: 'socket' } | { tag: 'other'; val?: string | undefined };
+
+  export type LinkCount = bigint;
+
+  export enum PathFlags {
+    symlinkFollow = 1,
+  }
+
+  // A set of `PathFlags` members, combined with `|`.
+  export type PathFlagsSet = number;
+
+  export enum OpenFlags {
+    create = 1,
+    directory = 2,
+    exclusive = 4,
+    truncate = 8,
+  }
+
+  // A set of `OpenFlags` members, combined with `|`.
+  export type OpenFlagsSet = number;
+
+  export type MetadataHashValue = { lower: bigint; upper: bigint; };
+
+  export type NewTimestamp = { tag: 'noChange' } | { tag: 'now' } | { tag: 'timestamp'; val: Instant };
+
+  export type DirectoryEntry = { type: DescriptorType; name: string; };
+
+  export enum Advice {
+    normal = 0,
+    sequential = 1,
+    random = 2,
+    willNeed = 3,
+    dontNeed = 4,
+    noReuse = 5,
+  }
+
+  export class Fields {
+    constructor();
+    append(name: FieldName, value: FieldValue): void;
+    copyAll(): [FieldName, FieldValue][];
+    private $brand: unknown;
+    [Symbol.dispose](): void;
+  }
+
+  export type FieldName = string;
+
+  export type FieldValue = Uint8Array;
+
+  export type HeaderError = { tag: 'invalidSyntax' } | { tag: 'forbidden' } | { tag: 'immutable' } | { tag: 'sizeExceeded' } | { tag: 'other'; val?: string | undefined };
+
+  export type WasiHttpTypesErrorCode = { tag: 'dnsTimeout' } | { tag: 'dnsError'; val: DnsErrorPayload } | { tag: 'destinationNotFound' } | { tag: 'destinationUnavailable' } | { tag: 'destinationIpProhibited' } | { tag: 'destinationIpUnroutable' } | { tag: 'connectionRefused' } | { tag: 'connectionTerminated' } | { tag: 'connectionTimeout' } | { tag: 'connectionReadTimeout' } | { tag: 'connectionWriteTimeout' } | { tag: 'connectionLimitReached' } | { tag: 'tlsProtocolError' } | { tag: 'tlsCertificateError' } | { tag: 'tlsAlertReceived'; val: TlsAlertReceivedPayload } | { tag: 'httpRequestDenied' } | { tag: 'httpRequestLengthRequired' } | { tag: 'httpRequestBodySize'; val?: bigint | undefined } | { tag: 'httpRequestMethodInvalid' } | { tag: 'httpRequestUriInvalid' } | { tag: 'httpRequestUriTooLong' } | { tag: 'httpRequestHeaderSectionSize'; val?: number | undefined } | { tag: 'httpRequestHeaderSize'; val?: FieldSizePayload | undefined } | { tag: 'httpRequestTrailerSectionSize'; val?: number | undefined } | { tag: 'httpRequestTrailerSize'; val: FieldSizePayload } | { tag: 'httpResponseIncomplete' } | { tag: 'httpResponseHeaderSectionSize'; val?: number | undefined } | { tag: 'httpResponseHeaderSize'; val: FieldSizePayload } | { tag: 'httpResponseBodySize'; val?: bigint | undefined } | { tag: 'httpResponseTrailerSectionSize'; val?: number | undefined } | { tag: 'httpResponseTrailerSize'; val: FieldSizePayload } | { tag: 'httpResponseTransferCoding'; val?: string | undefined } | { tag: 'httpResponseContentCoding'; val?: string | undefined } | { tag: 'httpResponseTimeout' } | { tag: 'httpUpgradeFailed' } | { tag: 'httpProtocolError' } | { tag: 'loopDetected' } | { tag: 'configurationError' } | { tag: 'internalError'; val?: string | undefined };
+
+  export type DnsErrorPayload = { rcode?: string | undefined; infoCode?: number | undefined; };
+
+  export type TlsAlertReceivedPayload = { alertId?: number | undefined; alertMessage?: string | undefined; };
+
+  export type FieldSizePayload = { fieldName?: string | undefined; fieldSize?: number | undefined; };
+
+  export class RequestOptions {
+    private constructor();
+    private $brand: unknown;
+    [Symbol.dispose](): void;
+  }
+
+  export class Request {
+    private constructor();
+    static new(headers: Fields, contents: (ReadableStream<ArrayBufferView | ArrayBuffer> | AsyncIterable<ArrayBufferView | ArrayBuffer> | Iterable<ArrayBufferView | ArrayBuffer>) | undefined | null, trailers: Fields | undefined | null | PromiseLike<Fields | undefined | null>, options: RequestOptions | undefined | null): [Request, Promise<void>];
+    getMethod(): Method;
+    setMethod(method: Method): void;
+    getPathWithQuery(): string | undefined;
+    setPathWithQuery(pathWithQuery: string | undefined | null): void;
+    getScheme(): Scheme | undefined;
+    setScheme(scheme: Scheme | undefined | null): void;
+    getAuthority(): string | undefined;
+    setAuthority(authority: string | undefined | null): void;
+    getHeaders(): Fields;
+    static consumeBody(this_: Request, res: void | PromiseLike<void>): [ReadableStream<Uint8Array>, Promise<Fields | undefined>];
+    private $brand: unknown;
+    [Symbol.dispose](): void;
+  }
+
+  export type Method = { tag: 'get' } | { tag: 'head' } | { tag: 'post' } | { tag: 'put' } | { tag: 'delete' } | { tag: 'connect' } | { tag: 'options' } | { tag: 'trace' } | { tag: 'patch' } | { tag: 'other'; val: string };
+
+  export type Scheme = { tag: 'http' } | { tag: 'https' } | { tag: 'other'; val: string };
+
+  export class Response {
+    private constructor();
+    static new(headers: Fields, contents: (ReadableStream<ArrayBufferView | ArrayBuffer> | AsyncIterable<ArrayBufferView | ArrayBuffer> | Iterable<ArrayBufferView | ArrayBuffer>) | undefined | null, trailers: Fields | undefined | null | PromiseLike<Fields | undefined | null>): [Response, Promise<void>];
+    getStatusCode(): StatusCode;
+    setStatusCode(statusCode: StatusCode): void;
+    getHeaders(): Fields;
+    static consumeBody(this_: Response, res: void | PromiseLike<void>): [ReadableStream<Uint8Array>, Promise<Fields | undefined>];
+    private $brand: unknown;
+    [Symbol.dispose](): void;
+  }
+
+  export type StatusCode = number;
+
+  export type RequestOptionsError = { tag: 'notSupported' } | { tag: 'immutable' } | { tag: 'other'; val?: string | undefined };
+
+  export class StderrErrorCodeError extends ComponentError {
+    constructor(payload: WasiCliTypesErrorCode);
+    readonly payload: WasiCliTypesErrorCode;
+  }
+
+  export class StdinErrorCodeError extends ComponentError {
+    constructor(payload: WasiCliTypesErrorCode);
+    readonly payload: WasiCliTypesErrorCode;
+  }
+
+  export class StdoutErrorCodeError extends ComponentError {
+    constructor(payload: WasiCliTypesErrorCode);
+    readonly payload: WasiCliTypesErrorCode;
+  }
+
+  export class WasiFilesystemTypesErrorCodeError extends ComponentError {
+    constructor(payload: WasiFilesystemTypesErrorCode);
+    readonly payload: WasiFilesystemTypesErrorCode;
+  }
+
+  export class HeaderErrorError extends ComponentError {
+    constructor(payload: HeaderError);
+    readonly payload: HeaderError;
+  }
+
+  export class WasiHttpTypesErrorCodeError extends ComponentError {
+    constructor(payload: WasiHttpTypesErrorCode);
+    readonly payload: WasiHttpTypesErrorCode;
+  }
+
+  export class ClientErrorCodeError extends ComponentError {
+    constructor(payload: WasiHttpTypesErrorCode);
+    readonly payload: WasiHttpTypesErrorCode;
+  }
+}
+
+declare module 'starling:guest' {
+  // The `wasi:cli/run` command entry point. It may be synchronous or
+  // `async`. Throwing, or a rejected promise, maps to a failed run.
+  export function run(): void | Promise<void>;
+}
+
+declare module 'wasi:cli/environment@0.3' {
+  export function getEnvironment(): [string, string][];
+  export function getArguments(): string[];
+}
+
+declare module 'wasi:cli/exit@0.3' {
+  export function exit(status: { tag: 'ok' } | { tag: 'err' }): void;
+  export function exitWithCode(statusCode: number): void;
+}
+
+declare module 'wasi:cli/types@0.3' {
+  export {
+    WasiCliTypesErrorCode as ErrorCode,
+  } from 'starling:types/starling:cli/command';
+}
+
+declare module 'wasi:cli/stderr@0.3' {
+  export function writeViaStream(data: ReadableStream<ArrayBufferView | ArrayBuffer> | AsyncIterable<ArrayBufferView | ArrayBuffer> | Iterable<ArrayBufferView | ArrayBuffer>): Promise<void>;
+
+  export {
+    StderrErrorCodeError as ErrorCode,
+  } from 'starling:types/starling:cli/command';
+}
+
+declare module 'wasi:cli/stdin@0.3' {
+  export function readViaStream(): [ReadableStream<Uint8Array>, Promise<void>];
+
+  export {
+    StdinErrorCodeError as ErrorCode,
+  } from 'starling:types/starling:cli/command';
+}
+
+declare module 'wasi:cli/stdout@0.3' {
+  export function writeViaStream(data: ReadableStream<ArrayBufferView | ArrayBuffer> | AsyncIterable<ArrayBufferView | ArrayBuffer> | Iterable<ArrayBufferView | ArrayBuffer>): Promise<void>;
+
+  export {
+    StdoutErrorCodeError as ErrorCode,
+  } from 'starling:types/starling:cli/command';
+}
+
+declare module 'wasi:cli/terminal-input@0.3' {
+  export {
+    TerminalInput,
+  } from 'starling:types/starling:cli/command';
+}
+
+declare module 'wasi:cli/terminal-output@0.3' {
+  export {
+    TerminalOutput,
+  } from 'starling:types/starling:cli/command';
+}
+
+declare module 'wasi:cli/terminal-stderr@0.3' {
+  import type * as $t from 'starling:types/starling:cli/command';
+
+  export function getTerminalStderr(): $t.TerminalOutput | undefined;
+
+  export type {
+    TerminalOutput,
+  } from 'starling:types/starling:cli/command';
+}
+
+declare module 'wasi:cli/terminal-stdin@0.3' {
+  import type * as $t from 'starling:types/starling:cli/command';
+
+  export function getTerminalStdin(): $t.TerminalInput | undefined;
+
+  export type {
+    TerminalInput,
+  } from 'starling:types/starling:cli/command';
+}
+
+declare module 'wasi:cli/terminal-stdout@0.3' {
+  import type * as $t from 'starling:types/starling:cli/command';
+
+  export function getTerminalStdout(): $t.TerminalOutput | undefined;
+
+  export type {
+    TerminalOutput,
+  } from 'starling:types/starling:cli/command';
+}
+
+declare module 'wasi:clocks/types@0.3' {
+  // The runtime registers no module under this name, so only its types
+  // are usable.
+  export {
+    Duration,
+  } from 'starling:types/starling:cli/command';
+}
+
+declare module 'wasi:clocks/monotonic-clock@0.3' {
+  import type * as $t from 'starling:types/starling:cli/command';
+
+  export function now(): $t.Mark;
+  export function waitFor(howLong: $t.Duration): Promise<void>;
+
+  export {
+    Duration,
+    Mark,
+  } from 'starling:types/starling:cli/command';
+}
+
+declare module 'wasi:clocks/system-clock@0.3' {
+  import type * as $t from 'starling:types/starling:cli/command';
+
+  export function now(): $t.Instant;
+
+  export {
+    Duration,
+    Instant,
+  } from 'starling:types/starling:cli/command';
+}
+
+declare module 'wasi:filesystem/types@0.3' {
+  export {
+    WasiFilesystemTypesErrorCodeError as ErrorCode,
+    Instant,
+    Filesize,
+    DescriptorType,
+    DescriptorFlagsSet,
+    DescriptorFlags,
+    PathFlagsSet,
+    PathFlags,
+    OpenFlagsSet,
+    OpenFlags,
+    LinkCount,
+    DescriptorStat,
+    NewTimestamp,
+    DirectoryEntry,
+    Advice,
+    MetadataHashValue,
+    Descriptor,
+  } from 'starling:types/starling:cli/command';
+}
+
+declare module 'wasi:filesystem/preopens@0.3' {
+  import type * as $t from 'starling:types/starling:cli/command';
+
+  export function getDirectories(): [$t.Descriptor, string][];
+
+  export type {
+    Descriptor,
+  } from 'starling:types/starling:cli/command';
+}
+
+declare module 'wasi:http/types@0.3' {
+  export {
+    HeaderErrorError as HeaderError,
+    WasiHttpTypesErrorCodeError as ErrorCode,
+    Duration,
+    Method,
+    Scheme,
+    DnsErrorPayload,
+    TlsAlertReceivedPayload,
+    FieldSizePayload,
+    RequestOptionsError,
+    FieldName,
+    FieldValue,
+    Fields,
+    Request,
+    RequestOptions,
+    StatusCode,
+    Response,
+  } from 'starling:types/starling:cli/command';
+  export type {
+    Fields as Headers,
+    Fields as Trailers,
+  } from 'starling:types/starling:cli/command';
+}
+
+declare module 'wasi:http/client@0.3' {
+  import type * as $t from 'starling:types/starling:cli/command';
+
+  export function send(request: $t.Request): Promise<$t.Response>;
+
+  export {
+    ClientErrorCodeError as ErrorCode,
+  } from 'starling:types/starling:cli/command';
+  export type {
+    Request,
+    Response,
+  } from 'starling:types/starling:cli/command';
+}
+
+declare module 'wasi:random/insecure-seed@0.3' {
+  export function getInsecureSeed(): [bigint, bigint];
+}
+
+declare module 'wasi:random/random@0.3' {
+  export function getRandomBytes(maxLen: bigint): Uint8Array;
+}
+
diff --git a/componentize/tests/wit_to_ts/builtin_cli.guest.ts b/componentize/tests/wit_to_ts/builtin_cli.guest.ts
new file mode 100644
index 00000000..85abff27
--- /dev/null
+++ b/componentize/tests/wit_to_ts/builtin_cli.guest.ts
@@ -0,0 +1,9 @@
+// SPDX-License-Identifier: Apache-2.0-WITH-LLVM-exception
+//
+// A command guest exporting `run`.
+import type * as Guest from 'starling:guest';
+
+export async function run(): Promise<void> {
+  console.log('hello');
+}
+run satisfies typeof Guest.run;
diff --git a/componentize/tests/wit_to_ts/builtin_serve.d.ts.expected b/componentize/tests/wit_to_ts/builtin_serve.d.ts.expected
new file mode 100644
index 00000000..07f9b8cd
--- /dev/null
+++ b/componentize/tests/wit_to_ts/builtin_serve.d.ts.expected
@@ -0,0 +1,481 @@
+// Generated by `starling-componentize types`. Do not edit by hand.
+//
+// The guest JavaScript module a `serve` componentize target implements, and
+// the modules it may import. Add this file to the program (a `files` or
+// `include` entry in `tsconfig.json`, or a `/// <reference path=…/>`).
+//
+// Nothing here is exported at file level, which makes every `declare
+// module` below an ambient module declaration. An import then
+// resolves:
+//
+//   import { log } from 'test:example/logger';
+//
+// The guest's own obligations are `starling:guest`. Reference it to have the
+// compiler check what the module exports:
+//
+//   import type * as Guest from 'starling:guest';
+//   export const example: typeof Guest.example = { … };
+//
+// Every WIT type the world uses is declared in the module
+//
+//   starling:types/starling:serve/serve
+//
+// Each interface's module re-exports the types the interface defines or
+// `use`s under their WIT names. A name that several types share is
+// qualified there.
+
+// `ComponentError` holds the `err` payload of a WIT `result`. A string payload
+// is also its `message`. The error classes in the types module extend it.
+interface ComponentError extends Error {
+  readonly payload: unknown;
+}
+declare var ComponentError: {
+  new (payload: unknown): ComponentError;
+  readonly prototype: ComponentError;
+};
+
+// The event the runtime dispatches to `addEventListener('fetch', …)` listeners.
+interface FetchEvent extends Event {
+  readonly request: Request;
+  respondWith(response: Response | PromiseLike<Response>): void;
+  waitUntil(promise: PromiseLike<unknown>): void;
+}
+interface WindowEventMap {
+  fetch: FetchEvent;
+}
+
+// `fetch` also takes a `wasi:http/types` `request`, such as the one a
+// `wasi:http/handler` implementation receives, and sends it.
+declare function fetch(
+  input: import('starling:types/starling:serve/serve').Request,
+  init?: RequestInit,
+): Promise<Response>;
+
+declare module 'starling:types/starling:serve/serve' {
+  export type Duration = bigint;
+
+  export class Fields {
+    constructor();
+    append(name: FieldName, value: FieldValue): void;
+    copyAll(): [FieldName, FieldValue][];
+    private $brand: unknown;
+    [Symbol.dispose](): void;
+  }
+
+  export type FieldName = string;
+
+  export type FieldValue = Uint8Array;
+
+  export type HeaderError = { tag: 'invalidSyntax' } | { tag: 'forbidden' } | { tag: 'immutable' } | { tag: 'sizeExceeded' } | { tag: 'other'; val?: string | undefined };
+
+  export type WasiHttpTypesErrorCode = { tag: 'dnsTimeout' } | { tag: 'dnsError'; val: DnsErrorPayload } | { tag: 'destinationNotFound' } | { tag: 'destinationUnavailable' } | { tag: 'destinationIpProhibited' } | { tag: 'destinationIpUnroutable' } | { tag: 'connectionRefused' } | { tag: 'connectionTerminated' } | { tag: 'connectionTimeout' } | { tag: 'connectionReadTimeout' } | { tag: 'connectionWriteTimeout' } | { tag: 'connectionLimitReached' } | { tag: 'tlsProtocolError' } | { tag: 'tlsCertificateError' } | { tag: 'tlsAlertReceived'; val: TlsAlertReceivedPayload } | { tag: 'httpRequestDenied' } | { tag: 'httpRequestLengthRequired' } | { tag: 'httpRequestBodySize'; val?: bigint | undefined } | { tag: 'httpRequestMethodInvalid' } | { tag: 'httpRequestUriInvalid' } | { tag: 'httpRequestUriTooLong' } | { tag: 'httpRequestHeaderSectionSize'; val?: number | undefined } | { tag: 'httpRequestHeaderSize'; val?: FieldSizePayload | undefined } | { tag: 'httpRequestTrailerSectionSize'; val?: number | undefined } | { tag: 'httpRequestTrailerSize'; val: FieldSizePayload } | { tag: 'httpResponseIncomplete' } | { tag: 'httpResponseHeaderSectionSize'; val?: number | undefined } | { tag: 'httpResponseHeaderSize'; val: FieldSizePayload } | { tag: 'httpResponseBodySize'; val?: bigint | undefined } | { tag: 'httpResponseTrailerSectionSize'; val?: number | undefined } | { tag: 'httpResponseTrailerSize'; val: FieldSizePayload } | { tag: 'httpResponseTransferCoding'; val?: string | undefined } | { tag: 'httpResponseContentCoding'; val?: string | undefined } | { tag: 'httpResponseTimeout' } | { tag: 'httpUpgradeFailed' } | { tag: 'httpProtocolError' } | { tag: 'loopDetected' } | { tag: 'configurationError' } | { tag: 'internalError'; val?: string | undefined };
+
+  export type DnsErrorPayload = { rcode?: string | undefined; infoCode?: number | undefined; };
+
+  export type TlsAlertReceivedPayload = { alertId?: number | undefined; alertMessage?: string | undefined; };
+
+  export type FieldSizePayload = { fieldName?: string | undefined; fieldSize?: number | undefined; };
+
+  export class RequestOptions {
+    private constructor();
+    private $brand: unknown;
+    [Symbol.dispose](): void;
+  }
+
+  export class Request {
+    private constructor();
+    static new(headers: Fields, contents: (ReadableStream<ArrayBufferView | ArrayBuffer> | AsyncIterable<ArrayBufferView | ArrayBuffer> | Iterable<ArrayBufferView | ArrayBuffer>) | undefined | null, trailers: Fields | undefined | null | PromiseLike<Fields | undefined | null>, options: RequestOptions | undefined | null): [Request, Promise<void>];
+    getMethod(): Method;
+    setMethod(method: Method): void;
+    getPathWithQuery(): string | undefined;
+    setPathWithQuery(pathWithQuery: string | undefined | null): void;
+    getScheme(): Scheme | undefined;
+    setScheme(scheme: Scheme | undefined | null): void;
+    getAuthority(): string | undefined;
+    setAuthority(authority: string | undefined | null): void;
+    getHeaders(): Fields;
+    static consumeBody(this_: Request, res: void | PromiseLike<void>): [ReadableStream<Uint8Array>, Promise<Fields | undefined>];
+    private $brand: unknown;
+    [Symbol.dispose](): void;
+  }
+
+  export type Method = { tag: 'get' } | { tag: 'head' } | { tag: 'post' } | { tag: 'put' } | { tag: 'delete' } | { tag: 'connect' } | { tag: 'options' } | { tag: 'trace' } | { tag: 'patch' } | { tag: 'other'; val: string };
+
+  export type Scheme = { tag: 'http' } | { tag: 'https' } | { tag: 'other'; val: string };
+
+  export class Response {
+    private constructor();
+    static new(headers: Fields, contents: (ReadableStream<ArrayBufferView | ArrayBuffer> | AsyncIterable<ArrayBufferView | ArrayBuffer> | Iterable<ArrayBufferView | ArrayBuffer>) | undefined | null, trailers: Fields | undefined | null | PromiseLike<Fields | undefined | null>): [Response, Promise<void>];
+    getStatusCode(): StatusCode;
+    setStatusCode(statusCode: StatusCode): void;
+    getHeaders(): Fields;
+    static consumeBody(this_: Response, res: void | PromiseLike<void>): [ReadableStream<Uint8Array>, Promise<Fields | undefined>];
+    private $brand: unknown;
+    [Symbol.dispose](): void;
+  }
+
+  export type StatusCode = number;
+
+  export type RequestOptionsError = { tag: 'notSupported' } | { tag: 'immutable' } | { tag: 'other'; val?: string | undefined };
+
+  export enum WasiCliTypesErrorCode {
+    io = 0,
+    illegalByteSequence = 1,
+    pipe = 2,
+  }
+
+  export class TerminalInput {
+    private constructor();
+    private $brand: unknown;
+    [Symbol.dispose](): void;
+  }
+
+  export class TerminalOutput {
+    private constructor();
+    private $brand: unknown;
+    [Symbol.dispose](): void;
+  }
+
+  export type Mark = bigint;
+
+  export type Instant = { seconds: bigint; nanoseconds: number; };
+
+  export class Descriptor {
+    private constructor();
+    readViaStream(offset: Filesize): [ReadableStream<Uint8Array>, Promise<void>];
+    writeViaStream(data: ReadableStream<ArrayBufferView | ArrayBuffer> | AsyncIterable<ArrayBufferView | ArrayBuffer> | Iterable<ArrayBufferView | ArrayBuffer>, offset: Filesize): Promise<void>;
+    appendViaStream(data: ReadableStream<ArrayBufferView | ArrayBuffer> | AsyncIterable<ArrayBufferView | ArrayBuffer> | Iterable<ArrayBufferView | ArrayBuffer>): Promise<void>;
+    getFlags(): Promise<DescriptorFlagsSet>;
+    stat(): Promise<DescriptorStat>;
+    statAt(pathFlags: PathFlagsSet, path: string): Promise<DescriptorStat>;
+    openAt(pathFlags: PathFlagsSet, path: string, openFlags: OpenFlagsSet, flags: DescriptorFlagsSet): Promise<Descriptor>;
+    readlinkAt(path: string): Promise<string>;
+    removeDirectoryAt(path: string): Promise<void>;
+    unlinkFileAt(path: string): Promise<void>;
+    metadataHash(): Promise<MetadataHashValue>;
+    metadataHashAt(pathFlags: PathFlagsSet, path: string): Promise<MetadataHashValue>;
+    private $brand: unknown;
+    [Symbol.dispose](): void;
+  }
+
+  export type Filesize = bigint;
+
+  export type WasiFilesystemTypesErrorCode = { tag: 'access' } | { tag: 'already' } | { tag: 'badDescriptor' } | { tag: 'busy' } | { tag: 'deadlock' } | { tag: 'quota' } | { tag: 'exist' } | { tag: 'fileTooLarge' } | { tag: 'illegalByteSequence' } | { tag: 'inProgress' } | { tag: 'interrupted' } | { tag: 'invalid' } | { tag: 'io' } | { tag: 'isDirectory' } | { tag: 'loop' } | { tag: 'tooManyLinks' } | { tag: 'messageSize' } | { tag: 'nameTooLong' } | { tag: 'noDevice' } | { tag: 'noEntry' } | { tag: 'noLock' } | { tag: 'insufficientMemory' } | { tag: 'insufficientSpace' } | { tag: 'notDirectory' } | { tag: 'notEmpty' } | { tag: 'notRecoverable' } | { tag: 'unsupported' } | { tag: 'noTty' } | { tag: 'noSuchDevice' } | { tag: 'overflow' } | { tag: 'notPermitted' } | { tag: 'pipe' } | { tag: 'readOnly' } | { tag: 'invalidSeek' } | { tag: 'textFileBusy' } | { tag: 'crossDevice' } | { tag: 'other'; val?: string | undefined };
+
+  export enum DescriptorFlags {
+    read = 1,
+    write = 2,
+    fileIntegritySync = 4,
+    dataIntegritySync = 8,
+    requestedWriteSync = 16,
+    mutateDirectory = 32,
+  }
+
+  // A set of `DescriptorFlags` members, combined with `|`.
+  export type DescriptorFlagsSet = number;
+
+  export type DescriptorStat = { type: DescriptorType; linkCount: LinkCount; size: Filesize; dataAccessTimestamp?: Instant | undefined; dataModificationTimestamp?: Instant | undefined; statusChangeTimestamp?: Instant | undefined; };
+
+  export type DescriptorType = { tag: 'blockDevice' } | { tag: 'characterDevice' } | { tag: 'directory' } | { tag: 'fifo' } | { tag: 'symbolicLink' } | { tag: 'regularFile' } | { tag: 'socket' } | { tag: 'other'; val?: string | undefined };
+
+  export type LinkCount = bigint;
+
+  export enum PathFlags {
+    symlinkFollow = 1,
+  }
+
+  // A set of `PathFlags` members, combined with `|`.
+  export type PathFlagsSet = number;
+
+  export enum OpenFlags {
+    create = 1,
+    directory = 2,
+    exclusive = 4,
+    truncate = 8,
+  }
+
+  // A set of `OpenFlags` members, combined with `|`.
+  export type OpenFlagsSet = number;
+
+  export type MetadataHashValue = { lower: bigint; upper: bigint; };
+
+  export type NewTimestamp = { tag: 'noChange' } | { tag: 'now' } | { tag: 'timestamp'; val: Instant };
+
+  export type DirectoryEntry = { type: DescriptorType; name: string; };
+
+  export enum Advice {
+    normal = 0,
+    sequential = 1,
+    random = 2,
+    willNeed = 3,
+    dontNeed = 4,
+    noReuse = 5,
+  }
+
+  export class HeaderErrorError extends ComponentError {
+    constructor(payload: HeaderError);
+    readonly payload: HeaderError;
+  }
+
+  export class WasiHttpTypesErrorCodeError extends ComponentError {
+    constructor(payload: WasiHttpTypesErrorCode);
+    readonly payload: WasiHttpTypesErrorCode;
+  }
+
+  export class StderrErrorCodeError extends ComponentError {
+    constructor(payload: WasiCliTypesErrorCode);
+    readonly payload: WasiCliTypesErrorCode;
+  }
+
+  export class StdinErrorCodeError extends ComponentError {
+    constructor(payload: WasiCliTypesErrorCode);
+    readonly payload: WasiCliTypesErrorCode;
+  }
+
+  export class StdoutErrorCodeError extends ComponentError {
+    constructor(payload: WasiCliTypesErrorCode);
+    readonly payload: WasiCliTypesErrorCode;
+  }
+
+  export class WasiFilesystemTypesErrorCodeError extends ComponentError {
+    constructor(payload: WasiFilesystemTypesErrorCode);
+    readonly payload: WasiFilesystemTypesErrorCode;
+  }
+
+  export class ClientErrorCodeError extends ComponentError {
+    constructor(payload: WasiHttpTypesErrorCode);
+    readonly payload: WasiHttpTypesErrorCode;
+  }
+}
+
+declare module 'starling:guest' {
+  import type * as $t from 'starling:types/starling:serve/serve';
+
+  // The `wasi:http/handler` export is served in one of two ways. Either
+  // register a listener on the global, and the runtime dispatches each
+  // request to it as a `FetchEvent`:
+  //
+  //   addEventListener('fetch', (event) => {
+  //     event.respondWith(new Response('hello'));
+  //   });
+  //
+  // Or implement `handle` below, which receives the WIT request and returns a
+  // `Response` or the WIT `response`, or a promise of either. `fetch(request)`
+  // sends the request on. It fails with an `error-code` by throwing an
+  // `ErrorCode` from `wasi:http/types@0.3.0`.
+  //
+  // An application that does both, or neither, fails to componentize.
+
+  // Each item of an exported interface is implemented through exactly one
+  // of the shapes below: a member of its package's object, a member of its
+  // interface's object, or a bare export. A shape is declared only where the
+  // world allows it for the item.
+
+  export const wasiHttp: {
+    // The exported interface `wasi:http/handler`.
+    handler: {
+      handle(request: $t.Request): Response | $t.Response | Promise<Response | $t.Response>;
+    };
+  };
+
+  // The exported interface `wasi:http/handler`.
+  export const handler: {
+    handle(request: $t.Request): Response | $t.Response | Promise<Response | $t.Response>;
+  };
+
+  // Items of the exported interface `wasi:http/handler`.
+  export function handle(request: $t.Request): Response | $t.Response | Promise<Response | $t.Response>;
+}
+
+declare module 'wasi:clocks/types@0.3' {
+  // The runtime registers no module under this name, so only its types
+  // are usable.
+  export {
+    Duration,
+  } from 'starling:types/starling:serve/serve';
+}
+
+declare module 'wasi:http/types@0.3' {
+  export {
+    HeaderErrorError as HeaderError,
+    WasiHttpTypesErrorCodeError as ErrorCode,
+    Duration,
+    Method,
+    Scheme,
+    DnsErrorPayload,
+    TlsAlertReceivedPayload,
+    FieldSizePayload,
+    RequestOptionsError,
+    FieldName,
+    FieldValue,
+    Fields,
+    Request,
+    RequestOptions,
+    StatusCode,
+    Response,
+  } from 'starling:types/starling:serve/serve';
+  export type {
+    Fields as Headers,
+    Fields as Trailers,
+  } from 'starling:types/starling:serve/serve';
+}
+
+declare module 'wasi:cli/environment@0.3' {
+  export function getEnvironment(): [string, string][];
+  export function getArguments(): string[];
+}
+
+declare module 'wasi:cli/exit@0.3' {
+  export function exit(status: { tag: 'ok' } | { tag: 'err' }): void;
+  export function exitWithCode(statusCode: number): void;
+}
+
+declare module 'wasi:cli/types@0.3' {
+  export {
+    WasiCliTypesErrorCode as ErrorCode,
+  } from 'starling:types/starling:serve/serve';
+}
+
+declare module 'wasi:cli/stderr@0.3' {
+  export function writeViaStream(data: ReadableStream<ArrayBufferView | ArrayBuffer> | AsyncIterable<ArrayBufferView | ArrayBuffer> | Iterable<ArrayBufferView | ArrayBuffer>): Promise<void>;
+
+  export {
+    StderrErrorCodeError as ErrorCode,
+  } from 'starling:types/starling:serve/serve';
+}
+
+declare module 'wasi:cli/stdin@0.3' {
+  export function readViaStream(): [ReadableStream<Uint8Array>, Promise<void>];
+
+  export {
+    StdinErrorCodeError as ErrorCode,
+  } from 'starling:types/starling:serve/serve';
+}
+
+declare module 'wasi:cli/stdout@0.3' {
+  export function writeViaStream(data: ReadableStream<ArrayBufferView | ArrayBuffer> | AsyncIterable<ArrayBufferView | ArrayBuffer> | Iterable<ArrayBufferView | ArrayBuffer>): Promise<void>;
+
+  export {
+    StdoutErrorCodeError as ErrorCode,
+  } from 'starling:types/starling:serve/serve';
+}
+
+declare module 'wasi:cli/terminal-input@0.3' {
+  export {
+    TerminalInput,
+  } from 'starling:types/starling:serve/serve';
+}
+
+declare module 'wasi:cli/terminal-output@0.3' {
+  export {
+    TerminalOutput,
+  } from 'starling:types/starling:serve/serve';
+}
+
+declare module 'wasi:cli/terminal-stderr@0.3' {
+  import type * as $t from 'starling:types/starling:serve/serve';
+
+  export function getTerminalStderr(): $t.TerminalOutput | undefined;
+
+  export type {
+    TerminalOutput,
+  } from 'starling:types/starling:serve/serve';
+}
+
+declare module 'wasi:cli/terminal-stdin@0.3' {
+  import type * as $t from 'starling:types/starling:serve/serve';
+
+  export function getTerminalStdin(): $t.TerminalInput | undefined;
+
+  export type {
+    TerminalInput,
+  } from 'starling:types/starling:serve/serve';
+}
+
+declare module 'wasi:cli/terminal-stdout@0.3' {
+  import type * as $t from 'starling:types/starling:serve/serve';
+
+  export function getTerminalStdout(): $t.TerminalOutput | undefined;
+
+  export type {
+    TerminalOutput,
+  } from 'starling:types/starling:serve/serve';
+}
+
+declare module 'wasi:clocks/monotonic-clock@0.3' {
+  import type * as $t from 'starling:types/starling:serve/serve';
+
+  export function now(): $t.Mark;
+  export function waitFor(howLong: $t.Duration): Promise<void>;
+
+  export {
+    Duration,
+    Mark,
+  } from 'starling:types/starling:serve/serve';
+}
+
+declare module 'wasi:clocks/system-clock@0.3' {
+  import type * as $t from 'starling:types/starling:serve/serve';
+
+  export function now(): $t.Instant;
+
+  export {
+    Duration,
+    Instant,
+  } from 'starling:types/starling:serve/serve';
+}
+
+declare module 'wasi:filesystem/types@0.3' {
+  export {
+    WasiFilesystemTypesErrorCodeError as ErrorCode,
+    Instant,
+    Filesize,
+    DescriptorType,
+    DescriptorFlagsSet,
+    DescriptorFlags,
+    PathFlagsSet,
+    PathFlags,
+    OpenFlagsSet,
+    OpenFlags,
+    LinkCount,
+    DescriptorStat,
+    NewTimestamp,
+    DirectoryEntry,
+    Advice,
+    MetadataHashValue,
+    Descriptor,
+  } from 'starling:types/starling:serve/serve';
+}
+
+declare module 'wasi:filesystem/preopens@0.3' {
+  import type * as $t from 'starling:types/starling:serve/serve';
+
+  export function getDirectories(): [$t.Descriptor, string][];
+
+  export type {
+    Descriptor,
+  } from 'starling:types/starling:serve/serve';
+}
+
+declare module 'wasi:http/client@0.3' {
+  import type * as $t from 'starling:types/starling:serve/serve';
+
+  export function send(request: $t.Request): Promise<$t.Response>;
+
+  export {
+    ClientErrorCodeError as ErrorCode,
+  } from 'starling:types/starling:serve/serve';
+  export type {
+    Request,
+    Response,
+  } from 'starling:types/starling:serve/serve';
+}
+
+declare module 'wasi:random/insecure-seed@0.3' {
+  export function getInsecureSeed(): [bigint, bigint];
+}
+
+declare module 'wasi:random/random@0.3' {
+  export function getRandomBytes(maxLen: bigint): Uint8Array;
+}
+
diff --git a/componentize/tests/wit_to_ts/builtin_serve.handler.ts b/componentize/tests/wit_to_ts/builtin_serve.handler.ts
new file mode 100644
index 00000000..a9b4a04c
--- /dev/null
+++ b/componentize/tests/wit_to_ts/builtin_serve.handler.ts
@@ -0,0 +1,10 @@
+// SPDX-License-Identifier: Apache-2.0-WITH-LLVM-exception
+//
+// A serve guest implementing `handle` as a bare export, forwarding the WIT
+// request with `fetch`.
+import type * as Guest from 'starling:guest';
+
+export async function handle(request: Parameters<typeof Guest.handle>[0]): Promise<Response> {
+  return await fetch(request);
+}
+handle satisfies typeof Guest.handle;
diff --git a/componentize/tests/wit_to_ts/builtin_serve.listener.ts b/componentize/tests/wit_to_ts/builtin_serve.listener.ts
new file mode 100644
index 00000000..aaf0542b
--- /dev/null
+++ b/componentize/tests/wit_to_ts/builtin_serve.listener.ts
@@ -0,0 +1,9 @@
+// SPDX-License-Identifier: Apache-2.0-WITH-LLVM-exception
+//
+// A serve guest registering a `fetch` listener.
+addEventListener('fetch', (event) => {
+  event.waitUntil(Promise.resolve());
+  event.respondWith(new Response(`hello ${event.request.url}`));
+});
+
+export {};
diff --git a/componentize/tests/wit_to_ts/dual.d.ts.expected b/componentize/tests/wit_to_ts/dual.d.ts.expected
new file mode 100644
index 00000000..2a1b2fbd
--- /dev/null
+++ b/componentize/tests/wit_to_ts/dual.d.ts.expected
@@ -0,0 +1,101 @@
+// Generated by `starling-componentize types`. Do not edit by hand.
+//
+// The guest JavaScript module a `dual` componentize target implements, and
+// the modules it may import. Add this file to the program (a `files` or
+// `include` entry in `tsconfig.json`, or a `/// <reference path=…/>`).
+//
+// Nothing here is exported at file level, which makes every `declare
+// module` below an ambient module declaration. An import then
+// resolves:
+//
+//   import { log } from 'test:example/logger';
+//
+// The guest's own obligations are `starling:guest`. Reference it to have the
+// compiler check what the module exports:
+//
+//   import type * as Guest from 'starling:guest';
+//   export const example: typeof Guest.example = { … };
+//
+// Every WIT type the world uses is declared in the module
+//
+//   starling:types/test:dual/dual
+//
+// Each interface's module re-exports the types the interface defines or
+// `use`s under their WIT names. A name that several types share is
+// qualified there.
+
+// `ComponentError` holds the `err` payload of a WIT `result`. A string payload
+// is also its `message`. The error classes in the types module extend it.
+interface ComponentError extends Error {
+  readonly payload: unknown;
+}
+declare var ComponentError: {
+  new (payload: unknown): ComponentError;
+  readonly prototype: ComponentError;
+};
+
+declare module 'starling:types/test:dual/dual' {
+  export class Item {
+    constructor(v: number);
+    value(): number;
+    private $brand: unknown;
+    [Symbol.dispose](): void;
+  }
+
+  export enum Kind {
+    a = 0,
+    b = 1,
+  }
+
+  export type Entry = { item: Item; tag: string; };
+
+  export class ExportedItem {
+    constructor(v: number);
+    value(): number;
+    [Symbol.dispose]?(): void;
+  }
+
+  export type ExportedEntry = { item: ExportedItem; tag: string; };
+}
+
+declare module 'starling:guest' {
+  import type * as $t from 'starling:types/test:dual/dual';
+
+  // Each item of an exported interface is implemented through exactly one
+  // of the shapes below: a member of its package's object, a member of its
+  // interface's object, or a bare export. A shape is declared only where the
+  // world allows it for the item.
+
+  export const testDual: {
+    // The exported interface `test:dual/store`.
+    store: {
+      get(k: $t.Kind): $t.ExportedEntry;
+      Item: typeof $t.ExportedItem;
+    };
+  };
+
+  // The exported interface `test:dual/store`.
+  export const store: {
+    get(k: $t.Kind): $t.ExportedEntry;
+    Item: typeof $t.ExportedItem;
+  };
+
+  // Items of the exported interface `test:dual/store`.
+  export function get(k: $t.Kind): $t.ExportedEntry;
+  export {
+    ExportedItem as Item,
+  } from 'starling:types/test:dual/dual';
+}
+
+declare module 'test:dual/store' {
+  import type * as $t from 'starling:types/test:dual/dual';
+
+  export function get(k: $t.Kind): $t.Entry;
+
+  export {
+    Item,
+    Entry,
+    Kind,
+  } from 'starling:types/test:dual/dual';
+}
+
diff --git a/componentize/tests/wit_to_ts/dual.guest.ts b/componentize/tests/wit_to_ts/dual.guest.ts
new file mode 100644
index 00000000..bff0a601
--- /dev/null
+++ b/componentize/tests/wit_to_ts/dual.guest.ts
@@ -0,0 +1,31 @@
+// SPDX-License-Identifier: Apache-2.0-WITH-LLVM-exception
+//
+// A guest implementing an interface it also imports: its own `Item` class
+// wraps the host's.
+import type * as Guest from 'starling:guest';
+import { Item as HostItem, Kind, get as hostGet } from 'test:dual/store';
+
+class Item {
+  #host: HostItem;
+
+  constructor(v: number) {
+    this.#host = new HostItem(v);
+  }
+
+  value(): number {
+    return this.#host.value();
+  }
+}
+
+export const store: typeof Guest.store = {
+  get(k) {
+    const entry = hostGet(k);
+    return { item: new Item(entry.item.value()), tag: k === Kind.a ? 'a' : 'b' };
+  },
+  Item,
+};
+
+// The host's class is not the guest's.
+// @ts-expect-error
+const wrong: HostItem = new Item(1);
+void wrong;
diff --git a/componentize/tests/wit_to_ts/dual.wit b/componentize/tests/wit_to_ts/dual.wit
new file mode 100644
index 00000000..09981ccc
--- /dev/null
+++ b/componentize/tests/wit_to_ts/dual.wit
@@ -0,0 +1,31 @@
+// SPDX-License-Identifier: Apache-2.0-WITH-LLVM-exception
+//
+// An interface both imported and exported. The host's `item` class is exported
+// from the interface's module, and the guest exports a class of its own for the
+// same resource. The record `entry` holds an `item`, so it is declared once for
+// each side, while the enum `kind` is declared once.
+package test:dual;
+
+interface store {
+  resource item {
+    constructor(v: u32);
+    value: func() -> u32;
+  }
+
+  record entry {
+    item: item,
+    tag: string,
+  }
+
+  enum kind {
+    a,
+    b,
+  }
+
+  get: func(k: kind) -> entry;
+}
+
+world dual {
+  import store;
+  export store;
+}
diff --git a/componentize/tests/wit_to_ts/duplicate_names.d.ts.expected b/componentize/tests/wit_to_ts/duplicate_names.d.ts.expected
new file mode 100644
index 00000000..fd43466f
--- /dev/null
+++ b/componentize/tests/wit_to_ts/duplicate_names.d.ts.expected
@@ -0,0 +1,103 @@
+// Generated by `starling-componentize types`. Do not edit by hand.
+//
+// The guest JavaScript module a `duplicate-names` componentize target implements, and
+// the modules it may import. Add this file to the program (a `files` or
+// `include` entry in `tsconfig.json`, or a `/// <reference path=…/>`).
+//
+// Nothing here is exported at file level, which makes every `declare
+// module` below an ambient module declaration. An import then
+// resolves:
+//
+//   import { log } from 'test:example/logger';
+//
+// The guest's own obligations are `starling:guest`. Reference it to have the
+// compiler check what the module exports:
+//
+//   import type * as Guest from 'starling:guest';
+//   export const example: typeof Guest.example = { … };
+//
+// Every WIT type the world uses is declared in the module
+//
+//   starling:types/test:dup/duplicate-names
+//
+// Each interface's module re-exports the types the interface defines or
+// `use`s under their WIT names. A name that several types share is
+// qualified there.
+
+// `ComponentError` holds the `err` payload of a WIT `result`. A string payload
+// is also its `message`. The error classes in the types module extend it.
+interface ComponentError extends Error {
+  readonly payload: unknown;
+}
+declare var ComponentError: {
+  new (payload: unknown): ComponentError;
+  readonly prototype: ComponentError;
+};
+
+declare module 'starling:types/test:dup/duplicate-names' {
+  export class AThing {
+    constructor();
+    name(): string;
+    private $brand: unknown;
+    [Symbol.dispose](): void;
+  }
+
+  export type TestDupAErrorCode = { tag: 'denied' } | { tag: 'other'; val: string };
+
+  export class BThing {
+    private constructor();
+    get(): number;
+    private $brand: unknown;
+    [Symbol.dispose](): void;
+  }
+
+  export type BErrorCode = { tag: 'timeout' };
+
+  export type TestOtherAErrorCode = { tag: 'gone' };
+
+  export class TestDupAErrorCodeError extends ComponentError {
+    constructor(payload: TestDupAErrorCode);
+    readonly payload: TestDupAErrorCode;
+  }
+
+  export class BErrorCodeError extends ComponentError {
+    constructor(payload: BErrorCode);
+    readonly payload: BErrorCode;
+  }
+
+  export class TestOtherAErrorCodeError extends ComponentError {
+    constructor(payload: TestOtherAErrorCode);
+    readonly payload: TestOtherAErrorCode;
+  }
+}
+
+declare module 'test:dup/a' {
+  import type * as $t from 'starling:types/test:dup/duplicate-names';
+
+  export function doA(t: $t.AThing): string;
+
+  export {
+    TestDupAErrorCodeError as ErrorCode,
+    AThing as Thing,
+  } from 'starling:types/test:dup/duplicate-names';
+}
+
+declare module 'test:dup/b' {
+  import type * as $t from 'starling:types/test:dup/duplicate-names';
+
+  export function doB(): $t.BThing;
+
+  export {
+    BErrorCodeError as ErrorCode,
+    BThing as Thing,
+  } from 'starling:types/test:dup/duplicate-names';
+}
+
+declare module 'test:other/a' {
+  export function doOther(): void;
+
+  export {
+    TestOtherAErrorCodeError as ErrorCode,
+  } from 'starling:types/test:dup/duplicate-names';
+}
+
diff --git a/componentize/tests/wit_to_ts/duplicate_names.wit b/componentize/tests/wit_to_ts/duplicate_names.wit
new file mode 100644
index 00000000..2c88f5bf
--- /dev/null
+++ b/componentize/tests/wit_to_ts/duplicate_names.wit
@@ -0,0 +1,49 @@
+// SPDX-License-Identifier: Apache-2.0-WITH-LLVM-exception
+//
+// Types with the same name in several interfaces. `thing` and `error-code` of
+// `a` and `b` are qualified with their interface's name, and the `error-code`
+// of `test:dup/a` and `test:other/a` also with their package's. Each module
+// re-exports its own types under their WIT names.
+package test:dup;
+
+interface a {
+  resource thing {
+    constructor();
+    name: func() -> string;
+  }
+
+  variant error-code {
+    denied,
+    other(string),
+  }
+
+  do-a: func(t: borrow<thing>) -> result<string, error-code>;
+}
+
+interface b {
+  resource thing {
+    get: func() -> u32;
+  }
+
+  variant error-code {
+    timeout,
+  }
+
+  do-b: func() -> result<thing, error-code>;
+}
+
+world duplicate-names {
+  import a;
+  import b;
+  import test:other/a;
+}
+
+package test:other {
+  interface a {
+    variant error-code {
+      gone,
+    }
+
+    do-other: func() -> result<_, error-code>;
+  }
+}
diff --git a/componentize/tests/wit_to_ts/error_types.d.ts.expected b/componentize/tests/wit_to_ts/error_types.d.ts.expected
new file mode 100644
index 00000000..d86e62d7
--- /dev/null
+++ b/componentize/tests/wit_to_ts/error_types.d.ts.expected
@@ -0,0 +1,155 @@
+// Generated by `starling-componentize types`. Do not edit by hand.
+//
+// The guest JavaScript module a `error-types` componentize target implements, and
+// the modules it may import. Add this file to the program (a `files` or
+// `include` entry in `tsconfig.json`, or a `/// <reference path=…/>`).
+//
+// Nothing here is exported at file level, which makes every `declare
+// module` below an ambient module declaration. An import then
+// resolves:
+//
+//   import { log } from 'test:example/logger';
+//
+// The guest's own obligations are `starling:guest`. Reference it to have the
+// compiler check what the module exports:
+//
+//   import type * as Guest from 'starling:guest';
+//   export const example: typeof Guest.example = { … };
+//
+// Every WIT type the world uses is declared in the module
+//
+//   starling:types/test:errors/error-types
+//
+// Each interface's module re-exports the types the interface defines or
+// `use`s under their WIT names. A name that several types share is
+// qualified there.
+
+// `ComponentError` holds the `err` payload of a WIT `result`. A string payload
+// is also its `message`. The error classes in the types module extend it.
+interface ComponentError extends Error {
+  readonly payload: unknown;
+}
+declare var ComponentError: {
+  new (payload: unknown): ComponentError;
+  readonly prototype: ComponentError;
+};
+
+declare module 'starling:types/test:errors/error-types' {
+  export type E = { tag: 'bad'; val: string } | { tag: 'worse' };
+
+  export enum Code {
+    a = 0,
+    b = 1,
+  }
+
+  export type Res = { tag: 'ok'; val: string } | { tag: 'err'; val: E };
+
+  export type MyErr = { tag: 'a' } | { tag: 'b'; val: string };
+
+  export enum Werr {
+    one = 0,
+    two = 1,
+  }
+
+  export const enum Oops {
+    broken = 0,
+    missing = 1,
+  }
+
+  export class UserEError extends ComponentError {
+    constructor(payload: E);
+    readonly payload: E;
+  }
+
+  export class FailureError extends ComponentError {
+    constructor(payload: Code);
+    readonly payload: Code;
+  }
+
+  export class ErrsEError extends ComponentError {
+    constructor(payload: E);
+    readonly payload: E;
+  }
+
+  export class WerrError extends ComponentError {
+    constructor(payload: Werr);
+    readonly payload: Werr;
+  }
+
+  export class MyErrError extends ComponentError {
+    constructor(payload: MyErr);
+    readonly payload: MyErr;
+  }
+}
+
+declare module 'starling:guest' {
+  // Each item of an exported interface is implemented through exactly one
+  // of the shapes below: a member of its package's object, a member of its
+  // interface's object, or a bare export. A shape is declared only where the
+  // world allows it for the item.
+
+  export const testErrors: {
+    // The exported interface `test:errors/svc`.
+    svc: {
+      run(): void;
+    };
+    // The exported interface `test:errors/api`.
+    api: {
+      doIt(): number;
+    };
+  };
+
+  // The exported interface `test:errors/svc`.
+  export const svc: {
+    run(): void;
+  };
+
+  // The exported interface `test:errors/api`.
+  export const api: {
+    doIt(): number;
+  };
+
+  // Items of the exported interface `test:errors/svc`.
+  export function run(): void;
+
+  // Items of the exported interface `test:errors/api`.
+  export function doIt(): number;
+
+  export function worldRun(): number;
+}
+
+declare module 'external' {
+  export function worldOp(): void;
+
+  export {
+    WerrError as Werr,
+  } from 'starling:types/test:errors/error-types';
+}
+
+declare module 'test:errors/errs' {
+  export {
+    ErrsEError as E,
+    Code,
+    Res,
+  } from 'starling:types/test:errors/error-types';
+}
+
+declare module 'test:errors/user' {
+  export function get(): number;
+  export function check(): void;
+  export function fetch(): string;
+  export function later(): Promise<string>;
+
+  export {
+    UserEError as E,
+    FailureError as Failure,
+    Res,
+  } from 'starling:types/test:errors/error-types';
+}
+
+declare module 'test:errors/shared-errs' {
+  export {
+    MyErrError as MyErr,
+  } from 'starling:types/test:errors/error-types';
+}
+
diff --git a/componentize/tests/wit_to_ts/error_types.guest.ts b/componentize/tests/wit_to_ts/error_types.guest.ts
new file mode 100644
index 00000000..f9ed8650
--- /dev/null
+++ b/componentize/tests/wit_to_ts/error_types.guest.ts
@@ -0,0 +1,40 @@
+// SPDX-License-Identifier: Apache-2.0-WITH-LLVM-exception
+//
+// A guest calling imports that fail with error classes, and failing its own
+// exports with them.
+import type * as Guest from 'starling:guest';
+import { Code, E as ErrsE } from 'test:errors/errs';
+import { E, Failure, get } from 'test:errors/user';
+import { MyErr } from 'test:errors/shared-errs';
+import { Werr, worldOp } from 'external';
+
+export function worldRun(): number {
+  try {
+    worldOp();
+    return get();
+  } catch (error) {
+    if (error instanceof E || error instanceof ErrsE) {
+      const payload: E['payload'] = error.payload;
+      if (payload.tag === 'bad') {
+        throw new Werr(0);
+      }
+    }
+    if (error instanceof Failure && error.payload === Code.b) {
+      throw new Werr(1);
+    }
+    throw error;
+  }
+}
+worldRun satisfies typeof Guest.worldRun;
+
+export const svc: typeof Guest.svc = {
+  run() {
+    throw new ComponentError(0);
+  },
+};
+
+export const api: typeof Guest.api = {
+  doIt() {
+    throw new MyErr({ tag: 'b', val: 'failed' });
+  },
+};
diff --git a/componentize/tests/wit_to_ts/error_types.wit b/componentize/tests/wit_to_ts/error_types.wit
new file mode 100644
index 00000000..00dfa964
--- /dev/null
+++ b/componentize/tests/wit_to_ts/error_types.wit
@@ -0,0 +1,73 @@
+// SPDX-License-Identifier: Apache-2.0-WITH-LLVM-exception
+//
+// Error classes, which the runtime keys on the interface and name the `result`
+// uses for its `err` type.
+//
+// - `user` `use`s `e`, and renames `code` to `failure`, so its module exports
+//   the classes `E` and `Failure`.
+// - `user`'s `fetch` returns `errs`'s `res`, whose `err` type is `errs`'s own
+//   `e`, so `errs`'s module exports a class `E` too. `errs` has no functions.
+// - The world's own `werr` has its class in `external`.
+// - `svc` is exported, so its `oops` has no class, but is still declared.
+package test:errors;
+
+interface errs {
+  variant e {
+    bad(string),
+    worse,
+  }
+
+  enum code {
+    a,
+    b,
+  }
+
+  type res = result<string, e>;
+}
+
+interface user {
+  use errs.{e, code as failure, res};
+
+  get: func() -> result<u32, e>;
+  check: func() -> result<_, failure>;
+  fetch: func() -> res;
+  later: async func() -> future<result<string, failure>>;
+}
+
+// An `err` type an export-only interface `use`s has the class of the interface
+// that defines it, which the world imports through the `use`.
+interface shared-errs {
+  variant my-err {
+    a,
+    b(string),
+  }
+}
+
+interface api {
+  use shared-errs.{my-err};
+
+  do-it: func() -> result<u32, my-err>;
+}
+
+interface svc {
+  enum oops {
+    broken,
+    missing,
+  }
+
+  run: func() -> result<_, oops>;
+}
+
+world error-types {
+  import user;
+  export svc;
+  export api;
+
+  enum werr {
+    one,
+    two,
+  }
+
+  import world-op: func() -> result<_, werr>;
+  export world-run: func() -> result<u32, werr>;
+}
diff --git a/componentize/tests/wit_to_ts/exported_resource.d.ts.expected b/componentize/tests/wit_to_ts/exported_resource.d.ts.expected
new file mode 100644
index 00000000..4970161f
--- /dev/null
+++ b/componentize/tests/wit_to_ts/exported_resource.d.ts.expected
@@ -0,0 +1,83 @@
+// Generated by `starling-componentize types`. Do not edit by hand.
+//
+// The guest JavaScript module a `exported-resource` componentize target implements, and
+// the modules it may import. Add this file to the program (a `files` or
+// `include` entry in `tsconfig.json`, or a `/// <reference path=…/>`).
+//
+// Nothing here is exported at file level, which makes every `declare
+// module` below an ambient module declaration. An import then
+// resolves:
+//
+//   import { log } from 'test:example/logger';
+//
+// The guest's own obligations are `starling:guest`. Reference it to have the
+// compiler check what the module exports:
+//
+//   import type * as Guest from 'starling:guest';
+//   export const example: typeof Guest.example = { … };
+//
+// Every WIT type the world uses is declared in the module
+//
+//   starling:types/test:exported-resource/exported-resource
+//
+// Each interface's module re-exports the types the interface defines or
+// `use`s under their WIT names. A name that several types share is
+// qualified there.
+
+// `ComponentError` holds the `err` payload of a WIT `result`. A string payload
+// is also its `message`. The error classes in the types module extend it.
+interface ComponentError extends Error {
+  readonly payload: unknown;
+}
+declare var ComponentError: {
+  new (payload: unknown): ComponentError;
+  readonly prototype: ComponentError;
+};
+
+declare module 'starling:types/test:exported-resource/exported-resource' {
+  export class Counter {
+    constructor(start: number);
+    bump(by: number): number;
+    value(): number;
+    static totalCreated(): number;
+    static liveCount(): number;
+    static disposeCalls(): number;
+    [Symbol.dispose]?(): void;
+  }
+}
+
+declare module 'starling:guest' {
+  import type * as $t from 'starling:types/test:exported-resource/exported-resource';
+
+  // Each item of an exported interface is implemented through exactly one
+  // of the shapes below: a member of its package's object, a member of its
+  // interface's object, or a bare export. A shape is declared only where the
+  // world allows it for the item.
+
+  export const testExportedResource: {
+    // The exported interface `test:exported-resource/counters`.
+    counters: {
+      makeCounter(start: number): $t.Counter;
+      makeSealedCounter(start: number): $t.Counter;
+      readLater(c: $t.Counter): number | Promise<number>;
+      Counter: typeof $t.Counter;
+    };
+  };
+
+  // The exported interface `test:exported-resource/counters`.
+  export const counters: {
+    makeCounter(start: number): $t.Counter;
+    makeSealedCounter(start: number): $t.Counter;
+    readLater(c: $t.Counter): number | Promise<number>;
+    Counter: typeof $t.Counter;
+  };
+
+  // Items of the exported interface `test:exported-resource/counters`.
+  export function makeCounter(start: number): $t.Counter;
+  export function makeSealedCounter(start: number): $t.Counter;
+  export function readLater(c: $t.Counter): number | Promise<number>;
+  export {
+    Counter,
+  } from 'starling:types/test:exported-resource/exported-resource';
+}
+
diff --git a/componentize/tests/wit_to_ts/global_names.d.ts.expected b/componentize/tests/wit_to_ts/global_names.d.ts.expected
new file mode 100644
index 00000000..4c35af6b
--- /dev/null
+++ b/componentize/tests/wit_to_ts/global_names.d.ts.expected
@@ -0,0 +1,76 @@
+// Generated by `starling-componentize types`. Do not edit by hand.
+//
+// The guest JavaScript module a `global-names` componentize target implements, and
+// the modules it may import. Add this file to the program (a `files` or
+// `include` entry in `tsconfig.json`, or a `/// <reference path=…/>`).
+//
+// Nothing here is exported at file level, which makes every `declare
+// module` below an ambient module declaration. An import then
+// resolves:
+//
+//   import { log } from 'test:example/logger';
+//
+// The guest's own obligations are `starling:guest`. Reference it to have the
+// compiler check what the module exports:
+//
+//   import type * as Guest from 'starling:guest';
+//   export const example: typeof Guest.example = { … };
+//
+// Every WIT type the world uses is declared in the module
+//
+//   starling:types/test:global-names/global-names
+//
+// Each interface's module re-exports the types the interface defines or
+// `use`s under their WIT names. A name that several types share is
+// qualified there.
+
+// `ComponentError` holds the `err` payload of a WIT `result`. A string payload
+// is also its `message`. The error classes in the types module extend it.
+interface ComponentError extends Error {
+  readonly payload: unknown;
+}
+declare var ComponentError: {
+  new (payload: unknown): ComponentError;
+  readonly prototype: ComponentError;
+};
+
+declare module 'starling:types/test:global-names/global-names' {
+  export class Symbol {
+    constructor();
+    name(): string;
+    private $brand: unknown;
+    [globalThis.Symbol.dispose](): void;
+  }
+
+  export type Promise = { v: number; };
+
+  export type ComponentError = { tag: 'broken' };
+
+  export type Holder = { body: globalThis.ReadableStream<globalThis.Uint8Array>; done: globalThis.Promise<number>; bytes: globalThis.Uint8Array; p: Promise; };
+
+  export type ReadableStream = string[];
+
+  export type Uint8Array = { len: number; };
+
+  export class ComponentErrorError extends globalThis.ComponentError {
+    constructor(payload: ComponentError);
+    readonly payload: ComponentError;
+  }
+}
+
+declare module 'test:global-names/names' {
+  import type * as $t from 'starling:types/test:global-names/global-names';
+
+  export function wait(p: $t.Promise): Promise<$t.Symbol>;
+  export function hold(h: $t.Holder): $t.ReadableStream;
+
+  export {
+    ComponentErrorError as ComponentError,
+    Promise,
+    Symbol,
+    ReadableStream,
+    Uint8Array,
+    Holder,
+  } from 'starling:types/test:global-names/global-names';
+}
+
diff --git a/componentize/tests/wit_to_ts/global_names.wit b/componentize/tests/wit_to_ts/global_names.wit
new file mode 100644
index 00000000..95bc91f6
--- /dev/null
+++ b/componentize/tests/wit_to_ts/global_names.wit
@@ -0,0 +1,41 @@
+// SPDX-License-Identifier: Apache-2.0-WITH-LLVM-exception
+//
+// WIT types named after the globals the declarations refer to. Inside
+// `starling:types` each such declaration shadows the global, so references to
+// the global there are written `globalThis.<name>`.
+package test:global-names;
+
+interface names {
+  record promise {
+    v: u32,
+  }
+
+  resource symbol {
+    constructor();
+    name: func() -> string;
+  }
+
+  type readable-stream = list<string>;
+
+  record uint8-array {
+    len: u32,
+  }
+
+  variant component-error {
+    broken,
+  }
+
+  record holder {
+    body: stream<u8>,
+    done: future<u32>,
+    bytes: list<u8>,
+    p: promise,
+  }
+
+  wait: async func(p: promise) -> result<symbol, component-error>;
+  hold: func(h: holder) -> readable-stream;
+}
+
+world global-names {
+  import names;
+}
diff --git a/componentize/tests/wit_to_ts/guest_shapes.d.ts.expected b/componentize/tests/wit_to_ts/guest_shapes.d.ts.expected
new file mode 100644
index 00000000..32d2876b
--- /dev/null
+++ b/componentize/tests/wit_to_ts/guest_shapes.d.ts.expected
@@ -0,0 +1,97 @@
+// Generated by `starling-componentize types`. Do not edit by hand.
+//
+// The guest JavaScript module a `guest-shapes` componentize target implements, and
+// the modules it may import. Add this file to the program (a `files` or
+// `include` entry in `tsconfig.json`, or a `/// <reference path=…/>`).
+//
+// Nothing here is exported at file level, which makes every `declare
+// module` below an ambient module declaration. An import then
+// resolves:
+//
+//   import { log } from 'test:example/logger';
+//
+// The guest's own obligations are `starling:guest`. Reference it to have the
+// compiler check what the module exports:
+//
+//   import type * as Guest from 'starling:guest';
+//   export const example: typeof Guest.example = { … };
+//
+// Every WIT type the world uses is declared in the module
+//
+//   starling:types/test:guest-shapes/guest-shapes
+//
+// Each interface's module re-exports the types the interface defines or
+// `use`s under their WIT names. A name that several types share is
+// qualified there.
+
+// `ComponentError` holds the `err` payload of a WIT `result`. A string payload
+// is also its `message`. The error classes in the types module extend it.
+interface ComponentError extends Error {
+  readonly payload: unknown;
+}
+declare var ComponentError: {
+  new (payload: unknown): ComponentError;
+  readonly prototype: ComponentError;
+};
+
+declare module 'starling:types/test:guest-shapes/guest-shapes' {
+  export type Payload = { data: Uint8Array; body: ReadableStream<Uint8Array>; };
+
+  export type Failure = { tag: 'internal'; val?: string | undefined } | { tag: 'other' };
+
+  export class Session {
+    constructor(...args: any[]);
+    get(): number;
+    later(): number | Promise<number>;
+    static openCount(): number | Promise<number>;
+    [Symbol.dispose]?(): void;
+  }
+
+  export type Nested = { inner?: undefined | { val: number | undefined }; };
+}
+
+declare module 'starling:guest' {
+  import type * as $t from 'starling:types/test:guest-shapes/guest-shapes';
+
+  // Each item of an exported interface is implemented through exactly one
+  // of the shapes below: a member of its package's object, a member of its
+  // interface's object, or a bare export. A shape is declared only where the
+  // world allows it for the item.
+
+  export const testGuestShapes: {
+    // The exported interface `test:guest-shapes/api`.
+    api: {
+      open(id: number): $t.Session;
+      check(n: $t.Nested): $t.Failure;
+      Session: typeof $t.Session;
+    };
+  };
+
+  // The exported interface `test:guest-shapes/api`.
+  export const api: {
+    open(id: number): $t.Session;
+    check(n: $t.Nested): $t.Failure;
+    Session: typeof $t.Session;
+  };
+
+  // Items of the exported interface `test:guest-shapes/api`.
+  export function open(id: number): $t.Session;
+  export function check(n: $t.Nested): $t.Failure;
+  export {
+    Session,
+  } from 'starling:types/test:guest-shapes/guest-shapes';
+}
+
+declare module 'test:guest-shapes/host' {
+  import type * as $t from 'starling:types/test:guest-shapes/guest-shapes';
+
+  export function send(p: $t.Payload): void;
+  export function bytes(b: Uint8Array | Uint8ClampedArray | number[]): number;
+  export function maybe(v: number | undefined | null): boolean;
+
+  export {
+    Payload,
+    Failure,
+  } from 'starling:types/test:guest-shapes/guest-shapes';
+}
+
diff --git a/componentize/tests/wit_to_ts/guest_shapes.guest.ts b/componentize/tests/wit_to_ts/guest_shapes.guest.ts
new file mode 100644
index 00000000..087e3222
--- /dev/null
+++ b/componentize/tests/wit_to_ts/guest_shapes.guest.ts
@@ -0,0 +1,45 @@
+// SPDX-License-Identifier: Apache-2.0-WITH-LLVM-exception
+//
+// A guest whose resource class takes constructor arguments the WIT doesn't
+// declare, and which hands over values in the forms the runtime accepts.
+import type * as Guest from 'starling:guest';
+import { bytes, maybe, send } from 'test:guest-shapes/host';
+
+let opened = 0;
+
+class Session {
+  #id: number;
+
+  constructor(id: number) {
+    this.#id = id;
+    opened++;
+  }
+
+  get(): number {
+    return this.#id;
+  }
+
+  async later(): Promise<number> {
+    return this.#id;
+  }
+
+  static async openCount(): Promise<number> {
+    return opened;
+  }
+}
+
+export const api: typeof Guest.api = {
+  open(id) {
+    return new Session(id);
+  },
+  check(n) {
+    send({ data: new Uint8Array(2), body: new ReadableStream<Uint8Array>() });
+    bytes(new Uint8ClampedArray(2));
+    maybe(null);
+    if (n.inner === undefined) {
+      return { tag: 'internal' };
+    }
+    return n.inner.val === undefined ? { tag: 'internal', val: 'none' } : { tag: 'other' };
+  },
+  Session,
+};
diff --git a/componentize/tests/wit_to_ts/guest_shapes.wit b/componentize/tests/wit_to_ts/guest_shapes.wit
new file mode 100644
index 00000000..005dd556
--- /dev/null
+++ b/componentize/tests/wit_to_ts/guest_shapes.wit
@@ -0,0 +1,47 @@
+// SPDX-License-Identifier: Apache-2.0-WITH-LLVM-exception
+//
+// Shapes in positions where the guest hands a value over. The exported
+// resource `session` has no constructor, and an async method and an async
+// static. The guest's `Session` class takes constructor arguments, which the
+// runtime never passes, since it constructs no `session` itself. The guest
+// hands over a variant case with an `option` payload and no `val`, a `null`
+// option and a `Uint8ClampedArray` for a `list<u8>`.
+package test:guest-shapes;
+
+interface host {
+  record payload {
+    data: list<u8>,
+    body: stream<u8>,
+  }
+
+  variant failure {
+    internal(option<string>),
+    other,
+  }
+
+  send: func(p: payload);
+  bytes: func(b: list<u8>) -> u32;
+  maybe: func(v: option<u32>) -> bool;
+}
+
+interface api {
+  use host.{failure};
+
+  resource session {
+    get: func() -> u32;
+    later: async func() -> u32;
+    open-count: static async func() -> u32;
+  }
+
+  record nested {
+    inner: option<option<u32>>,
+  }
+
+  open: func(id: u32) -> session;
+  check: func(n: nested) -> failure;
+}
+
+world guest-shapes {
+  import host;
+  export api;
+}
diff --git a/componentize/tests/wit_to_ts/imported_resources.d.ts.expected b/componentize/tests/wit_to_ts/imported_resources.d.ts.expected
new file mode 100644
index 00000000..fe90e376
--- /dev/null
+++ b/componentize/tests/wit_to_ts/imported_resources.d.ts.expected
@@ -0,0 +1,98 @@
+// Generated by `starling-componentize types`. Do not edit by hand.
+//
+// The guest JavaScript module a `imported-resources` componentize target implements, and
+// the modules it may import. Add this file to the program (a `files` or
+// `include` entry in `tsconfig.json`, or a `/// <reference path=…/>`).
+//
+// Nothing here is exported at file level, which makes every `declare
+// module` below an ambient module declaration. An import then
+// resolves:
+//
+//   import { log } from 'test:example/logger';
+//
+// The guest's own obligations are `starling:guest`. Reference it to have the
+// compiler check what the module exports:
+//
+//   import type * as Guest from 'starling:guest';
+//   export const example: typeof Guest.example = { … };
+//
+// Every WIT type the world uses is declared in the module
+//
+//   starling:types/test:imported-resources/imported-resources
+//
+// Each interface's module re-exports the types the interface defines or
+// `use`s under their WIT names. A name that several types share is
+// qualified there.
+
+// `ComponentError` holds the `err` payload of a WIT `result`. A string payload
+// is also its `message`. The error classes in the types module extend it.
+interface ComponentError extends Error {
+  readonly payload: unknown;
+}
+declare var ComponentError: {
+  new (payload: unknown): ComponentError;
+  readonly prototype: ComponentError;
+};
+
+declare module 'starling:types/test:imported-resources/imported-resources' {
+  export class Bucket {
+    constructor(name: string);
+    get(key: string): string | undefined;
+    put(key: string, value: string): void;
+    static count(): number;
+    private $brand: unknown;
+    [Symbol.dispose](): void;
+  }
+
+  export class Ticket {
+    constructor(id: number);
+    id(): number;
+    private $brand: unknown;
+    [Symbol.dispose](): void;
+  }
+}
+
+declare module 'starling:guest' {
+  import type * as $t from 'starling:types/test:imported-resources/imported-resources';
+
+  // Each item of an exported interface is implemented through exactly one
+  // of the shapes below: a member of its package's object, a member of its
+  // interface's object, or a bare export. A shape is declared only where the
+  // world allows it for the item.
+
+  export const testImportedResources: {
+    // The exported interface `test:imported-resources/consumer`.
+    consumer: {
+      describe(b: $t.Bucket): string;
+    };
+  };
+
+  // The exported interface `test:imported-resources/consumer`.
+  export const consumer: {
+    describe(b: $t.Bucket): string;
+  };
+
+  // Items of the exported interface `test:imported-resources/consumer`.
+  export function describe(b: $t.Bucket): string;
+}
+
+declare module 'external' {
+  import type * as $t from 'starling:types/test:imported-resources/imported-resources';
+
+  export function issue(): $t.Ticket;
+
+  export {
+    Ticket,
+  } from 'starling:types/test:imported-resources/imported-resources';
+}
+
+declare module 'test:imported-resources/store' {
+  import type * as $t from 'starling:types/test:imported-resources/imported-resources';
+
+  export function open(name: string): $t.Bucket;
+
+  export {
+    Bucket,
+  } from 'starling:types/test:imported-resources/imported-resources';
+}
+
diff --git a/componentize/tests/wit_to_ts/imported_resources.wit b/componentize/tests/wit_to_ts/imported_resources.wit
new file mode 100644
index 00000000..c943c806
--- /dev/null
+++ b/componentize/tests/wit_to_ts/imported_resources.wit
@@ -0,0 +1,42 @@
+// SPDX-License-Identifier: Apache-2.0-WITH-LLVM-exception
+//
+// Imported resources, at both interface and world level.
+//
+// A class can only be exported from a module it is declared in, so the class
+// itself lives in `starling:types` and each module block imports it before
+// re-exporting it under the resource's name.
+//
+// A world-level resource joins the `external` group, the module the
+// interpreter's `synthesize_interface_module` registers it in: that group is
+// keyed on an import with no interface.
+package test:imported-resources;
+
+interface store {
+  resource bucket {
+    constructor(name: string);
+    get: func(key: string) -> option<string>;
+    put: func(key: string, value: string);
+    count: static func() -> u32;
+  }
+
+  open: func(name: string) -> bucket;
+}
+
+interface consumer {
+  use store.{bucket};
+
+  // An exported interface signature naming an imported resource, which is why
+  // the class cannot live inside the importing module's own block.
+  describe: func(b: borrow<bucket>) -> string;
+}
+
+world imported-resources {
+  import store;
+  // A world-level resource, reached through `external`.
+  resource ticket {
+    constructor(id: u32);
+    id: func() -> u32;
+  }
+  import issue: func() -> ticket;
+  export consumer;
+}
diff --git a/componentize/tests/wit_to_ts/imports.d.ts.expected b/componentize/tests/wit_to_ts/imports.d.ts.expected
new file mode 100644
index 00000000..6c37e40e
--- /dev/null
+++ b/componentize/tests/wit_to_ts/imports.d.ts.expected
@@ -0,0 +1,106 @@
+// Generated by `starling-componentize types`. Do not edit by hand.
+//
+// The guest JavaScript module a `imports` componentize target implements, and
+// the modules it may import. Add this file to the program (a `files` or
+// `include` entry in `tsconfig.json`, or a `/// <reference path=…/>`).
+//
+// Nothing here is exported at file level, which makes every `declare
+// module` below an ambient module declaration. An import then
+// resolves:
+//
+//   import { log } from 'test:example/logger';
+//
+// The guest's own obligations are `starling:guest`. Reference it to have the
+// compiler check what the module exports:
+//
+//   import type * as Guest from 'starling:guest';
+//   export const example: typeof Guest.example = { … };
+//
+// Every WIT type the world uses is declared in the module
+//
+//   starling:types/test:imports/imports
+//
+// Each interface's module re-exports the types the interface defines or
+// `use`s under their WIT names. A name that several types share is
+// qualified there.
+
+// `ComponentError` holds the `err` payload of a WIT `result`. A string payload
+// is also its `message`. The error classes in the types module extend it.
+interface ComponentError extends Error {
+  readonly payload: unknown;
+}
+declare var ComponentError: {
+  new (payload: unknown): ComponentError;
+  readonly prototype: ComponentError;
+};
+
+declare module 'starling:types/test:imports/imports' {
+  export enum TestImportsAccessPerms_0 {
+    read = 1,
+    write = 2,
+  }
+
+  // A set of `TestImportsAccessPerms_0` members, combined with `|`.
+  export type TestImportsAccessPerms_0Set = number;
+
+  export type TestImportsAccessPermsSet_1 = { bits: number; };
+
+  export class Token {
+    private constructor();
+    private $brand: unknown;
+    [Symbol.dispose](): void;
+  }
+}
+
+declare module 'starling:guest' {
+  // Each item of an exported interface is implemented through exactly one
+  // of the shapes below: a member of its package's object, a member of its
+  // interface's object, or a bare export. A shape is declared only where the
+  // world allows it for the item.
+
+  export const testImports: {
+    // The exported interface `test:imports/backend`.
+    backend: {
+      fetchData(key: string): Uint8Array | Uint8ClampedArray | number[];
+    };
+  };
+
+  // The exported interface `test:imports/backend`.
+  export const backend: {
+    fetchData(key: string): Uint8Array | Uint8ClampedArray | number[];
+  };
+
+  // Items of the exported interface `test:imports/backend`.
+  export function fetchData(key: string): Uint8Array | Uint8ClampedArray | number[];
+}
+
+declare module 'external' {
+  export function now(): bigint;
+}
+
+declare module 'test:imports/logger' {
+  export function log(msg: string): void;
+  export function level(): number;
+}
+
+declare module 'test:imports/backend' {
+  export function fetchData(key: string): Uint8Array;
+}
+
+declare module 'test:imports/access' {
+  import type * as $t from 'starling:types/test:imports/imports';
+
+  export function check(p: $t.TestImportsAccessPerms_0Set, s: $t.TestImportsAccessPermsSet_1): boolean;
+
+  export {
+    TestImportsAccessPerms_0 as Perms,
+    TestImportsAccessPermsSet_1 as PermsSet,
+  } from 'starling:types/test:imports/imports';
+}
+
+declare module 'test:imports/tokens' {
+  export {
+    Token,
+  } from 'starling:types/test:imports/imports';
+}
+
diff --git a/componentize/tests/wit_to_ts/imports.wit b/componentize/tests/wit_to_ts/imports.wit
new file mode 100644
index 00000000..a54ed2b9
--- /dev/null
+++ b/componentize/tests/wit_to_ts/imports.wit
@@ -0,0 +1,49 @@
+// SPDX-License-Identifier: Apache-2.0-WITH-LLVM-exception
+//
+// Imports: an imported interface becomes a `declare module '<wit-name>'` block
+// (the specifier is the interface's WIT name verbatim, members camelCased).
+// World-level imported functions are grouped into the `external` module.
+// Also covers an interface that is both imported and exported (the host call
+// the guest forwards to).
+package test:imports;
+
+interface logger {
+  log: func(msg: string);
+  level: func() -> u32;
+}
+
+interface backend {
+  fetch-data: func(key: string) -> list<u8>;
+}
+
+// An interface whose only item is a resource without functions still has a
+// module, which exports the resource's class.
+interface tokens {
+  resource token;
+}
+
+// A record named like the set alias of the flags `perms` takes that name, so the
+// alias is not re-exported.
+interface access {
+  flags perms {
+    read,
+    write,
+  }
+
+  record perms-set {
+    bits: u32,
+  }
+
+  check: func(p: perms, s: perms-set) -> bool;
+}
+
+world imports {
+  import logger;
+  import backend;
+  import access;
+  import tokens;
+  export backend;
+
+  // A world-level imported function -> the `external` module.
+  import now: func() -> u64;
+}
diff --git a/componentize/tests/wit_to_ts/lists.d.ts.expected b/componentize/tests/wit_to_ts/lists.d.ts.expected
new file mode 100644
index 00000000..7b903176
--- /dev/null
+++ b/componentize/tests/wit_to_ts/lists.d.ts.expected
@@ -0,0 +1,107 @@
+// Generated by `starling-componentize types`. Do not edit by hand.
+//
+// The guest JavaScript module a `lists` componentize target implements, and
+// the modules it may import. Add this file to the program (a `files` or
+// `include` entry in `tsconfig.json`, or a `/// <reference path=…/>`).
+//
+// Nothing here is exported at file level, which makes every `declare
+// module` below an ambient module declaration. An import then
+// resolves:
+//
+//   import { log } from 'test:example/logger';
+//
+// The guest's own obligations are `starling:guest`. Reference it to have the
+// compiler check what the module exports:
+//
+//   import type * as Guest from 'starling:guest';
+//   export const example: typeof Guest.example = { … };
+//
+// Every WIT type the world uses is declared in the module
+//
+//   starling:types/test:lists/lists
+//
+// Each interface's module re-exports the types the interface defines or
+// `use`s under their WIT names. A name that several types share is
+// qualified there.
+
+// `ComponentError` holds the `err` payload of a WIT `result`. A string payload
+// is also its `message`. The error classes in the types module extend it.
+interface ComponentError extends Error {
+  readonly payload: unknown;
+}
+declare var ComponentError: {
+  new (payload: unknown): ComponentError;
+  readonly prototype: ComponentError;
+};
+
+declare module 'starling:types/test:lists/lists' {
+  export type Byte = number;
+}
+
+declare module 'starling:guest' {
+  // Each item of an exported interface is implemented through exactly one
+  // of the shapes below: a member of its package's object, a member of its
+  // interface's object, or a bare export. A shape is declared only where the
+  // world allows it for the item.
+
+  export const testLists: {
+    // The exported interface `test:lists/seqs`.
+    seqs: {
+      listByte(v: Uint8Array): Uint8Array | Uint8ClampedArray | number[];
+      listU8(v: Uint8Array): Uint8Array | Uint8ClampedArray | number[];
+      listS8(v: Int8Array): Int8Array | number[];
+      listU16(v: Uint16Array): Uint16Array | number[];
+      listS16(v: Int16Array): Int16Array | number[];
+      listU32(v: Uint32Array): Uint32Array | number[];
+      listS32(v: Int32Array): Int32Array | number[];
+      listF32(v: Float32Array): Float32Array | number[];
+      listF64(v: Float64Array): Float64Array | number[];
+      listU64(v: BigUint64Array): BigUint64Array | bigint[];
+      listS64(v: BigInt64Array): BigInt64Array | bigint[];
+      listBool(v: boolean[]): boolean[];
+      listString(v: string[]): string[];
+      listChar(v: string[]): string[];
+      listListU8(v: Uint8Array[]): (Uint8Array | Uint8ClampedArray | number[])[];
+      listListString(v: string[][]): string[][];
+    };
+  };
+
+  // The exported interface `test:lists/seqs`.
+  export const seqs: {
+    listByte(v: Uint8Array): Uint8Array | Uint8ClampedArray | number[];
+    listU8(v: Uint8Array): Uint8Array | Uint8ClampedArray | number[];
+    listS8(v: Int8Array): Int8Array | number[];
+    listU16(v: Uint16Array): Uint16Array | number[];
+    listS16(v: Int16Array): Int16Array | number[];
+    listU32(v: Uint32Array): Uint32Array | number[];
+    listS32(v: Int32Array): Int32Array | number[];
+    listF32(v: Float32Array): Float32Array | number[];
+    listF64(v: Float64Array): Float64Array | number[];
+    listU64(v: BigUint64Array): BigUint64Array | bigint[];
+    listS64(v: BigInt64Array): BigInt64Array | bigint[];
+    listBool(v: boolean[]): boolean[];
+    listString(v: string[]): string[];
+    listChar(v: string[]): string[];
+    listListU8(v: Uint8Array[]): (Uint8Array | Uint8ClampedArray | number[])[];
+    listListString(v: string[][]): string[][];
+  };
+
+  // Items of the exported interface `test:lists/seqs`.
+  export function listByte(v: Uint8Array): Uint8Array | Uint8ClampedArray | number[];
+  export function listU8(v: Uint8Array): Uint8Array | Uint8ClampedArray | number[];
+  export function listS8(v: Int8Array): Int8Array | number[];
+  export function listU16(v: Uint16Array): Uint16Array | number[];
+  export function listS16(v: Int16Array): Int16Array | number[];
+  export function listU32(v: Uint32Array): Uint32Array | number[];
+  export function listS32(v: Int32Array): Int32Array | number[];
+  export function listF32(v: Float32Array): Float32Array | number[];
+  export function listF64(v: Float64Array): Float64Array | number[];
+  export function listU64(v: BigUint64Array): BigUint64Array | bigint[];
+  export function listS64(v: BigInt64Array): BigInt64Array | bigint[];
+  export function listBool(v: boolean[]): boolean[];
+  export function listString(v: string[]): string[];
+  export function listChar(v: string[]): string[];
+  export function listListU8(v: Uint8Array[]): (Uint8Array | Uint8ClampedArray | number[])[];
+  export function listListString(v: string[][]): string[][];
+}
+
diff --git a/componentize/tests/wit_to_ts/lists.wit b/componentize/tests/wit_to_ts/lists.wit
new file mode 100644
index 00000000..31d581a9
--- /dev/null
+++ b/componentize/tests/wit_to_ts/lists.wit
@@ -0,0 +1,31 @@
+// SPDX-License-Identifier: Apache-2.0-WITH-LLVM-exception
+//
+// list<T> mapping. Numeric element types, including `u64` and `s64`, map to the
+// matching typed array (the element types `TypeShape::view_kind` gives a kind).
+// Non-numeric element types stay `T[]`, and nested lists nest the element form.
+// An alias of a numeric type maps as that type does.
+package test:lists;
+
+interface seqs {
+  type byte = u8;
+  list-byte: func(v: list<byte>) -> list<byte>;
+  list-u8: func(v: list<u8>) -> list<u8>;
+  list-s8: func(v: list<s8>) -> list<s8>;
+  list-u16: func(v: list<u16>) -> list<u16>;
+  list-s16: func(v: list<s16>) -> list<s16>;
+  list-u32: func(v: list<u32>) -> list<u32>;
+  list-s32: func(v: list<s32>) -> list<s32>;
+  list-f32: func(v: list<f32>) -> list<f32>;
+  list-f64: func(v: list<f64>) -> list<f64>;
+  list-u64: func(v: list<u64>) -> list<u64>;
+  list-s64: func(v: list<s64>) -> list<s64>;
+  list-bool: func(v: list<bool>) -> list<bool>;
+  list-string: func(v: list<string>) -> list<string>;
+  list-char: func(v: list<char>) -> list<char>;
+  list-list-u8: func(v: list<list<u8>>) -> list<list<u8>>;
+  list-list-string: func(v: list<list<string>>) -> list<list<string>>;
+}
+
+world lists {
+  export seqs;
+}
diff --git a/componentize/tests/wit_to_ts/naming.wit b/componentize/tests/wit_to_ts/naming.wit
new file mode 100644
index 00000000..21e24ee6
--- /dev/null
+++ b/componentize/tests/wit_to_ts/naming.wit
@@ -0,0 +1,77 @@
+// SPDX-License-Identifier: Apache-2.0-WITH-LLVM-exception
+//
+// The naming shapes of `starling:guest`. An item of an exported interface is
+// provided as `<package>.<interface>.<item>`, `<interface>.<item>` or a bare
+// `<item>`, and the latter two only where no other export has the same name.
+package test:naming;
+
+interface api {
+  greet: func(name: string) -> string;
+
+  resource counter {
+    constructor(start: u32);
+    get: func() -> u32;
+  }
+}
+
+interface left {
+  greet: func(name: string) -> string;
+  only-left: func() -> u32;
+}
+
+interface right {
+  greet: func(name: string) -> string;
+}
+
+interface %default {
+  %new: func() -> u32;
+}
+
+// Every shape is allowed.
+world naming-unique {
+  export api;
+}
+
+// Two `api` interfaces leave only the package layer for `api`, and three
+// `greet`s leave no bare `greet` but the world-level one.
+world naming-ambiguous {
+  export api;
+  export test:other/api;
+  export left;
+  export right;
+  export greet: func() -> string;
+}
+
+// Reserved words as the interface-layer name and as bare names, and an
+// interface without a package layer.
+world naming-reserved {
+  export %default;
+  export local: interface {
+    %for: func() -> u32;
+  }
+}
+
+// Two versions of one interface, provided under their full WIT names.
+world naming-versions {
+  export test:versioned/api@1.0.0;
+  export test:versioned/api@2.0.0;
+}
+
+package test:other {
+  interface api {
+    greet: func(name: string) -> string;
+  }
+}
+
+package test:versioned@1.0.0 {
+  interface api {
+    greet: func(name: string) -> string;
+  }
+}
+
+package test:versioned@2.0.0 {
+  interface api {
+    greet: func(name: string) -> string;
+    wave: func() -> string;
+  }
+}
diff --git a/componentize/tests/wit_to_ts/naming_ambiguous.d.ts.expected b/componentize/tests/wit_to_ts/naming_ambiguous.d.ts.expected
new file mode 100644
index 00000000..b6558b7c
--- /dev/null
+++ b/componentize/tests/wit_to_ts/naming_ambiguous.d.ts.expected
@@ -0,0 +1,98 @@
+// Generated by `starling-componentize types`. Do not edit by hand.
+//
+// The guest JavaScript module a `naming-ambiguous` componentize target implements, and
+// the modules it may import. Add this file to the program (a `files` or
+// `include` entry in `tsconfig.json`, or a `/// <reference path=…/>`).
+//
+// Nothing here is exported at file level, which makes every `declare
+// module` below an ambient module declaration. An import then
+// resolves:
+//
+//   import { log } from 'test:example/logger';
+//
+// The guest's own obligations are `starling:guest`. Reference it to have the
+// compiler check what the module exports:
+//
+//   import type * as Guest from 'starling:guest';
+//   export const example: typeof Guest.example = { … };
+//
+// Every WIT type the world uses is declared in the module
+//
+//   starling:types/test:naming/naming-ambiguous
+//
+// Each interface's module re-exports the types the interface defines or
+// `use`s under their WIT names. A name that several types share is
+// qualified there.
+
+// `ComponentError` holds the `err` payload of a WIT `result`. A string payload
+// is also its `message`. The error classes in the types module extend it.
+interface ComponentError extends Error {
+  readonly payload: unknown;
+}
+declare var ComponentError: {
+  new (payload: unknown): ComponentError;
+  readonly prototype: ComponentError;
+};
+
+declare module 'starling:types/test:naming/naming-ambiguous' {
+  export class Counter {
+    constructor(start: number);
+    get(): number;
+    [Symbol.dispose]?(): void;
+  }
+}
+
+declare module 'starling:guest' {
+  import type * as $t from 'starling:types/test:naming/naming-ambiguous';
+
+  // Each item of an exported interface is implemented through exactly one
+  // of the shapes below: a member of its package's object, a member of its
+  // interface's object, or a bare export. A shape is declared only where the
+  // world allows it for the item.
+
+  export const testNaming: {
+    // The exported interface `test:naming/api`.
+    api: {
+      greet(name: string): string;
+      Counter: typeof $t.Counter;
+    };
+    // The exported interface `test:naming/left`.
+    left: {
+      greet(name: string): string;
+      onlyLeft(): number;
+    };
+    // The exported interface `test:naming/right`.
+    right: {
+      greet(name: string): string;
+    };
+  };
+
+  export const testOther: {
+    // The exported interface `test:other/api`.
+    api: {
+      greet(name: string): string;
+    };
+  };
+
+  // The exported interface `test:naming/left`.
+  export const left: {
+    greet(name: string): string;
+    onlyLeft(): number;
+  };
+
+  // The exported interface `test:naming/right`.
+  export const right: {
+    greet(name: string): string;
+  };
+
+  // Items of the exported interface `test:naming/api`.
+  export {
+    Counter,
+  } from 'starling:types/test:naming/naming-ambiguous';
+
+  // Items of the exported interface `test:naming/left`.
+  export function onlyLeft(): number;
+
+  export function greet(): string;
+}
+
diff --git a/componentize/tests/wit_to_ts/naming_ambiguous.guest.ts b/componentize/tests/wit_to_ts/naming_ambiguous.guest.ts
new file mode 100644
index 00000000..89bd9881
--- /dev/null
+++ b/componentize/tests/wit_to_ts/naming_ambiguous.guest.ts
@@ -0,0 +1,40 @@
+// SPDX-License-Identifier: Apache-2.0-WITH-LLVM-exception
+//
+// A guest of a world where two exported interfaces are named `api` and three
+// items are named `greet`.
+import type * as Guest from 'starling:guest';
+
+export const testNaming: typeof Guest.testNaming = {
+  api: {
+    greet: (name) => `api ${name}`,
+    Counter: class {
+      get() {
+        return 0;
+      }
+    },
+  },
+  left: {
+    greet: (name) => `left ${name}`,
+    onlyLeft: () => 1,
+  },
+  right: {
+    greet: (name) => `right ${name}`,
+  },
+};
+
+export const testOther: typeof Guest.testOther = {
+  api: { greet: (name) => `other ${name}` },
+};
+
+// The world-level `greet` is the only bare `greet`.
+export function greet(): string {
+  return 'world';
+}
+greet satisfies typeof Guest.greet;
+
+// Neither `api` has an interface-layer object.
+// @ts-expect-error
+type Api = typeof Guest.api;
+
+// `onlyLeft` is unique, so it may be bare.
+export const onlyLeft: typeof Guest.onlyLeft = () => 1;
diff --git a/componentize/tests/wit_to_ts/naming_reserved.d.ts.expected b/componentize/tests/wit_to_ts/naming_reserved.d.ts.expected
new file mode 100644
index 00000000..3ed2e8a9
--- /dev/null
+++ b/componentize/tests/wit_to_ts/naming_reserved.d.ts.expected
@@ -0,0 +1,69 @@
+// Generated by `starling-componentize types`. Do not edit by hand.
+//
+// The guest JavaScript module a `naming-reserved` componentize target implements, and
+// the modules it may import. Add this file to the program (a `files` or
+// `include` entry in `tsconfig.json`, or a `/// <reference path=…/>`).
+//
+// Nothing here is exported at file level, which makes every `declare
+// module` below an ambient module declaration. An import then
+// resolves:
+//
+//   import { log } from 'test:example/logger';
+//
+// The guest's own obligations are `starling:guest`. Reference it to have the
+// compiler check what the module exports:
+//
+//   import type * as Guest from 'starling:guest';
+//   export const example: typeof Guest.example = { … };
+//
+// Every WIT type the world uses is declared in the module
+//
+//   starling:types/test:naming/naming-reserved
+//
+// Each interface's module re-exports the types the interface defines or
+// `use`s under their WIT names. A name that several types share is
+// qualified there.
+
+// `ComponentError` holds the `err` payload of a WIT `result`. A string payload
+// is also its `message`. The error classes in the types module extend it.
+interface ComponentError extends Error {
+  readonly payload: unknown;
+}
+declare var ComponentError: {
+  new (payload: unknown): ComponentError;
+  readonly prototype: ComponentError;
+};
+
+declare module 'starling:guest' {
+  // Each item of an exported interface is implemented through exactly one
+  // of the shapes below: a member of its package's object, a member of its
+  // interface's object, or a bare export. A shape is declared only where the
+  // world allows it for the item.
+
+  export const testNaming: {
+    // The exported interface `test:naming/default`.
+    default: {
+      'new'(): number;
+    };
+  };
+
+  // The exported interface `test:naming/default`.
+  const default_: {
+    'new'(): number;
+  };
+  export { default_ as default };
+
+  // The exported interface `local`.
+  export const local: {
+    for(): number;
+  };
+
+  // Items of the exported interface `test:naming/default`.
+  function new_(): number;
+  export { new_ as new };
+
+  // Items of the exported interface `local`.
+  function for_(): number;
+  export { for_ as for };
+}
+
diff --git a/componentize/tests/wit_to_ts/naming_reserved.guest.ts b/componentize/tests/wit_to_ts/naming_reserved.guest.ts
new file mode 100644
index 00000000..22ee21d0
--- /dev/null
+++ b/componentize/tests/wit_to_ts/naming_reserved.guest.ts
@@ -0,0 +1,17 @@
+// SPDX-License-Identifier: Apache-2.0-WITH-LLVM-exception
+//
+// A guest providing the interface named `default` through its interface-layer
+// object, which is the module's default export, and `local`'s `for` as a bare
+// export under a reserved name.
+import type * as Guest from 'starling:guest';
+
+const implementation: typeof Guest.default = {
+  new: () => 1,
+};
+export default implementation;
+
+function forEach(): number {
+  return 2;
+}
+forEach satisfies typeof Guest.for;
+export { forEach as for };
diff --git a/componentize/tests/wit_to_ts/naming_unique.bare.ts b/componentize/tests/wit_to_ts/naming_unique.bare.ts
new file mode 100644
index 00000000..aae946d0
--- /dev/null
+++ b/componentize/tests/wit_to_ts/naming_unique.bare.ts
@@ -0,0 +1,24 @@
+// SPDX-License-Identifier: Apache-2.0-WITH-LLVM-exception
+//
+// A guest providing each item of `test:naming/api` as a bare export.
+import type * as Guest from 'starling:guest';
+
+export function greet(name: string): string {
+  return `hello ${name}`;
+}
+greet satisfies typeof Guest.greet;
+
+export class Counter {
+  constructor(private start: number) {}
+
+  get(): number {
+    return this.start;
+  }
+
+  [Symbol.dispose]() {}
+}
+Counter satisfies typeof Guest.Counter;
+
+// A handle the guest receives is an instance of its own class.
+const counter: Guest.Counter = new Counter(1);
+void counter;
diff --git a/componentize/tests/wit_to_ts/naming_unique.d.ts.expected b/componentize/tests/wit_to_ts/naming_unique.d.ts.expected
new file mode 100644
index 00000000..c470f7af
--- /dev/null
+++ b/componentize/tests/wit_to_ts/naming_unique.d.ts.expected
@@ -0,0 +1,73 @@
+// Generated by `starling-componentize types`. Do not edit by hand.
+//
+// The guest JavaScript module a `naming-unique` componentize target implements, and
+// the modules it may import. Add this file to the program (a `files` or
+// `include` entry in `tsconfig.json`, or a `/// <reference path=…/>`).
+//
+// Nothing here is exported at file level, which makes every `declare
+// module` below an ambient module declaration. An import then
+// resolves:
+//
+//   import { log } from 'test:example/logger';
+//
+// The guest's own obligations are `starling:guest`. Reference it to have the
+// compiler check what the module exports:
+//
+//   import type * as Guest from 'starling:guest';
+//   export const example: typeof Guest.example = { … };
+//
+// Every WIT type the world uses is declared in the module
+//
+//   starling:types/test:naming/naming-unique
+//
+// Each interface's module re-exports the types the interface defines or
+// `use`s under their WIT names. A name that several types share is
+// qualified there.
+
+// `ComponentError` holds the `err` payload of a WIT `result`. A string payload
+// is also its `message`. The error classes in the types module extend it.
+interface ComponentError extends Error {
+  readonly payload: unknown;
+}
+declare var ComponentError: {
+  new (payload: unknown): ComponentError;
+  readonly prototype: ComponentError;
+};
+
+declare module 'starling:types/test:naming/naming-unique' {
+  export class Counter {
+    constructor(start: number);
+    get(): number;
+    [Symbol.dispose]?(): void;
+  }
+}
+
+declare module 'starling:guest' {
+  import type * as $t from 'starling:types/test:naming/naming-unique';
+
+  // Each item of an exported interface is implemented through exactly one
+  // of the shapes below: a member of its package's object, a member of its
+  // interface's object, or a bare export. A shape is declared only where the
+  // world allows it for the item.
+
+  export const testNaming: {
+    // The exported interface `test:naming/api`.
+    api: {
+      greet(name: string): string;
+      Counter: typeof $t.Counter;
+    };
+  };
+
+  // The exported interface `test:naming/api`.
+  export const api: {
+    greet(name: string): string;
+    Counter: typeof $t.Counter;
+  };
+
+  // Items of the exported interface `test:naming/api`.
+  export function greet(name: string): string;
+  export {
+    Counter,
+  } from 'starling:types/test:naming/naming-unique';
+}
+
diff --git a/componentize/tests/wit_to_ts/naming_unique.interface.ts b/componentize/tests/wit_to_ts/naming_unique.interface.ts
new file mode 100644
index 00000000..05fc1216
--- /dev/null
+++ b/componentize/tests/wit_to_ts/naming_unique.interface.ts
@@ -0,0 +1,17 @@
+// SPDX-License-Identifier: Apache-2.0-WITH-LLVM-exception
+//
+// A guest providing `test:naming/api` through the interface layer.
+import type * as Guest from 'starling:guest';
+
+export const api: typeof Guest.api = {
+  greet(name) {
+    return `hello ${name}`;
+  },
+  Counter: class {
+    constructor(private start: number) {}
+
+    get() {
+      return this.start;
+    }
+  },
+};
diff --git a/componentize/tests/wit_to_ts/naming_unique.package.ts b/componentize/tests/wit_to_ts/naming_unique.package.ts
new file mode 100644
index 00000000..b3487e0c
--- /dev/null
+++ b/componentize/tests/wit_to_ts/naming_unique.package.ts
@@ -0,0 +1,23 @@
+// SPDX-License-Identifier: Apache-2.0-WITH-LLVM-exception
+//
+// A guest providing `test:naming/api` through the package layer.
+import type * as Guest from 'starling:guest';
+
+class Counter {
+  #value: number;
+
+  constructor(start: number) {
+    this.#value = start;
+  }
+
+  get(): number {
+    return this.#value;
+  }
+}
+
+export const testNaming: typeof Guest.testNaming = {
+  api: {
+    greet: (name) => `hello ${name}`,
+    Counter,
+  },
+};
diff --git a/componentize/tests/wit_to_ts/naming_versions.d.ts.expected b/componentize/tests/wit_to_ts/naming_versions.d.ts.expected
new file mode 100644
index 00000000..44aead79
--- /dev/null
+++ b/componentize/tests/wit_to_ts/naming_versions.d.ts.expected
@@ -0,0 +1,57 @@
+// Generated by `starling-componentize types`. Do not edit by hand.
+//
+// The guest JavaScript module a `naming-versions` componentize target implements, and
+// the modules it may import. Add this file to the program (a `files` or
+// `include` entry in `tsconfig.json`, or a `/// <reference path=…/>`).
+//
+// Nothing here is exported at file level, which makes every `declare
+// module` below an ambient module declaration. An import then
+// resolves:
+//
+//   import { log } from 'test:example/logger';
+//
+// The guest's own obligations are `starling:guest`. Reference it to have the
+// compiler check what the module exports:
+//
+//   import type * as Guest from 'starling:guest';
+//   export const example: typeof Guest.example = { … };
+//
+// Every WIT type the world uses is declared in the module
+//
+//   starling:types/test:naming/naming-versions
+//
+// Each interface's module re-exports the types the interface defines or
+// `use`s under their WIT names. A name that several types share is
+// qualified there.
+
+// `ComponentError` holds the `err` payload of a WIT `result`. A string payload
+// is also its `message`. The error classes in the types module extend it.
+interface ComponentError extends Error {
+  readonly payload: unknown;
+}
+declare var ComponentError: {
+  new (payload: unknown): ComponentError;
+  readonly prototype: ComponentError;
+};
+
+declare module 'starling:guest' {
+  // Each item of an exported interface is implemented through exactly one
+  // of the shapes below: a member of its package's object, a member of its
+  // interface's object, a bare export, or, for one of several versions of an
+  // interface, a member of the export named by its full WIT name. A shape is
+  // declared only where the world allows it for the item.
+
+  // The exported interface `test:versioned/api@1.0.0`, one of several versions.
+  const versioned0_: {
+    greet(name: string): string;
+  };
+  export { versioned0_ as "test:versioned/api@1.0.0" };
+
+  // The exported interface `test:versioned/api@2.0.0`, one of several versions.
+  const versioned1_: {
+    greet(name: string): string;
+    wave(): string;
+  };
+  export { versioned1_ as "test:versioned/api@2.0.0" };
+}
+
diff --git a/componentize/tests/wit_to_ts/naming_versions.guest.ts b/componentize/tests/wit_to_ts/naming_versions.guest.ts
new file mode 100644
index 00000000..48b8599a
--- /dev/null
+++ b/componentize/tests/wit_to_ts/naming_versions.guest.ts
@@ -0,0 +1,15 @@
+// SPDX-License-Identifier: Apache-2.0-WITH-LLVM-exception
+//
+// A guest providing two versions of one interface under their full WIT names.
+import type * as Guest from 'starling:guest';
+
+const v1: (typeof Guest)['test:versioned/api@1.0.0'] = {
+  greet: (name) => `hello ${name}`,
+};
+
+const v2: (typeof Guest)['test:versioned/api@2.0.0'] = {
+  greet: (name) => `hi ${name}`,
+  wave: () => 'wave',
+};
+
+export { v1 as 'test:versioned/api@1.0.0', v2 as 'test:versioned/api@2.0.0' };
diff --git a/componentize/tests/wit_to_ts/option_result.d.ts.expected b/componentize/tests/wit_to_ts/option_result.d.ts.expected
new file mode 100644
index 00000000..96d8224f
--- /dev/null
+++ b/componentize/tests/wit_to_ts/option_result.d.ts.expected
@@ -0,0 +1,99 @@
+// Generated by `starling-componentize types`. Do not edit by hand.
+//
+// The guest JavaScript module a `option-result` componentize target implements, and
+// the modules it may import. Add this file to the program (a `files` or
+// `include` entry in `tsconfig.json`, or a `/// <reference path=…/>`).
+//
+// Nothing here is exported at file level, which makes every `declare
+// module` below an ambient module declaration. An import then
+// resolves:
+//
+//   import { log } from 'test:example/logger';
+//
+// The guest's own obligations are `starling:guest`. Reference it to have the
+// compiler check what the module exports:
+//
+//   import type * as Guest from 'starling:guest';
+//   export const example: typeof Guest.example = { … };
+//
+// Every WIT type the world uses is declared in the module
+//
+//   starling:types/test:option-result/option-result
+//
+// Each interface's module re-exports the types the interface defines or
+// `use`s under their WIT names. A name that several types share is
+// qualified there.
+
+// `ComponentError` holds the `err` payload of a WIT `result`. A string payload
+// is also its `message`. The error classes in the types module extend it.
+interface ComponentError extends Error {
+  readonly payload: unknown;
+}
+declare var ComponentError: {
+  new (payload: unknown): ComponentError;
+  readonly prototype: ComponentError;
+};
+
+declare module 'starling:types/test:option-result/option-result' {
+  export type MyResult = { tag: 'ok'; val: number } | { tag: 'err'; val: string };
+}
+
+declare module 'starling:guest' {
+  import type * as $t from 'starling:types/test:option-result/option-result';
+
+  // Each item of an exported interface is implemented through exactly one
+  // of the shapes below: a member of its package's object, a member of its
+  // interface's object, or a bare export. A shape is declared only where the
+  // world allows it for the item.
+
+  export const testOptionResult: {
+    // The exported interface `test:option-result/opts`.
+    opts: {
+      echoOption(v: number | undefined): number | undefined | null;
+      echoOptionOption(v: undefined | { val: number | undefined }): undefined | null | { val: number | undefined | null };
+      echoOptionString(v: string | undefined): string | undefined | null;
+      makeResult(): number;
+      makeResultEmpty(): void;
+      makeResultNoOk(): void;
+      passResult(v: { tag: 'ok'; val: number } | { tag: 'err'; val: string }): void;
+      nestedResult(): { tag: 'ok'; val: number } | { tag: 'err'; val: string };
+      makeAliasedResult(): number;
+      passAliasedResult(v: $t.MyResult): void;
+    };
+  };
+
+  // The exported interface `test:option-result/opts`.
+  export const opts: {
+    echoOption(v: number | undefined): number | undefined | null;
+    echoOptionOption(v: undefined | { val: number | undefined }): undefined | null | { val: number | undefined | null };
+    echoOptionString(v: string | undefined): string | undefined | null;
+    makeResult(): number;
+    makeResultEmpty(): void;
+    makeResultNoOk(): void;
+    passResult(v: { tag: 'ok'; val: number } | { tag: 'err'; val: string }): void;
+    nestedResult(): { tag: 'ok'; val: number } | { tag: 'err'; val: string };
+    makeAliasedResult(): number;
+    passAliasedResult(v: $t.MyResult): void;
+  };
+
+  // Items of the exported interface `test:option-result/opts`.
+  export function echoOption(v: number | undefined): number | undefined | null;
+  export function echoOptionOption(v: undefined | { val: number | undefined }): undefined | null | { val: number | undefined | null };
+  export function echoOptionString(v: string | undefined): string | undefined | null;
+  export function makeResult(): number;
+  export function makeResultEmpty(): void;
+  export function makeResultNoOk(): void;
+  export function passResult(v: { tag: 'ok'; val: number } | { tag: 'err'; val: string }): void;
+  export function nestedResult(): { tag: 'ok'; val: number } | { tag: 'err'; val: string };
+  export function makeAliasedResult(): number;
+  export function passAliasedResult(v: $t.MyResult): void;
+}
+
+declare module 'test:option-result/aliases' {
+  // The runtime registers no module under this name, so only its types
+  // are usable.
+  export {
+    MyResult,
+  } from 'starling:types/test:option-result/option-result';
+}
+
diff --git a/componentize/tests/wit_to_ts/option_result.wit b/componentize/tests/wit_to_ts/option_result.wit
new file mode 100644
index 00000000..75db97e7
--- /dev/null
+++ b/componentize/tests/wit_to_ts/option_result.wit
@@ -0,0 +1,46 @@
+// SPDX-License-Identifier: Apache-2.0-WITH-LLVM-exception
+//
+// option<T> and result<T, E> mapping, including the two subtleties:
+//   - `option<option<T>>` wraps the inner option in `{ val }` so `some(none)`
+//     is distinguishable from `none` (value.rs `push_option`).
+//   - `result<T, E>` is position-dependent: as a function's direct return it is
+//     unwrapped to its `ok` payload (errors are thrown), but as a parameter or
+//     nested it is the `{ tag, val? }` union. The `pass-result` / `make-result`
+//     pair covers both forms. `result` arms with and without payloads are
+//     covered.
+package test:option-result;
+
+// A `result` behind a named type alias, pulled into `opts` with `use`. The
+// runtime's `type_shape` follows the alias to the underlying `result`, so the
+// generator must too (via `canonical`), so an aliased `result` in return position
+// is unwrapped to its ok payload, not rendered as the `{ tag, val? }` union.
+interface aliases {
+  type my-result = result<u32, string>;
+}
+
+interface opts {
+  use aliases.{my-result};
+
+  echo-option: func(v: option<u32>) -> option<u32>;
+  echo-option-option: func(v: option<option<u32>>) -> option<option<u32>>;
+  echo-option-string: func(v: option<string>) -> option<string>;
+
+  // `result` in return position -> unwrapped to the ok payload (`number`).
+  make-result: func() -> result<u32, string>;
+  // `result` with no payloads at all -> `void` return.
+  make-result-empty: func() -> result;
+  // `result` with only an err payload -> `void` return (err is thrown).
+  make-result-no-ok: func() -> result<_, string>;
+  // `result` as a parameter -> the `{ tag, val? }` union.
+  pass-result: func(v: result<u32, string>);
+  // nested `result` in a return -> outer unwrapped, inner stays a union.
+  nested-result: func() -> result<result<u32, string>, string>;
+  // a `use`-aliased `result` in return position -> still unwrapped (canonical).
+  make-aliased-result: func() -> my-result;
+  // the same aliased `result` as a parameter -> the `{ tag, val? }` union.
+  pass-aliased-result: func(v: my-result);
+}
+
+world option-result {
+  export opts;
+}
diff --git a/componentize/tests/wit_to_ts/payloadless.d.ts.expected b/componentize/tests/wit_to_ts/payloadless.d.ts.expected
new file mode 100644
index 00000000..768a7b26
--- /dev/null
+++ b/componentize/tests/wit_to_ts/payloadless.d.ts.expected
@@ -0,0 +1,83 @@
+// Generated by `starling-componentize types`. Do not edit by hand.
+//
+// The guest JavaScript module a `payloadless` componentize target implements, and
+// the modules it may import. Add this file to the program (a `files` or
+// `include` entry in `tsconfig.json`, or a `/// <reference path=…/>`).
+//
+// Nothing here is exported at file level, which makes every `declare
+// module` below an ambient module declaration. An import then
+// resolves:
+//
+//   import { log } from 'test:example/logger';
+//
+// The guest's own obligations are `starling:guest`. Reference it to have the
+// compiler check what the module exports:
+//
+//   import type * as Guest from 'starling:guest';
+//   export const example: typeof Guest.example = { … };
+//
+// Every WIT type the world uses is declared in the module
+//
+//   starling:types/test:payloadless/payloadless
+//
+// Each interface's module re-exports the types the interface defines or
+// `use`s under their WIT names. A name that several types share is
+// qualified there.
+
+// `ComponentError` holds the `err` payload of a WIT `result`. A string payload
+// is also its `message`. The error classes in the types module extend it.
+interface ComponentError extends Error {
+  readonly payload: unknown;
+}
+declare var ComponentError: {
+  new (payload: unknown): ComponentError;
+  readonly prototype: ComponentError;
+};
+
+declare module 'starling:types/test:payloadless/payloadless' {
+  export type TickStream = ReadableStream<undefined>;
+}
+
+declare module 'starling:guest' {
+  import type * as $t from 'starling:types/test:payloadless/payloadless';
+
+  // Each item of an exported interface is implemented through exactly one
+  // of the shapes below: a member of its package's object, a member of its
+  // interface's object, or a bare export. A shape is declared only where the
+  // world allows it for the item.
+
+  export const testPayloadless: {
+    // The exported interface `test:payloadless/relay`.
+    relay: {
+      echoTicks(s: ReadableStream<undefined>): ReadableStream<undefined> | AsyncIterable<undefined> | Iterable<undefined> | Promise<ReadableStream<undefined> | AsyncIterable<undefined> | Iterable<undefined>>;
+      echoDone(f: Promise<void>): void | PromiseLike<void>;
+      countTicks(s: $t.TickStream): number | Promise<number>;
+    };
+  };
+
+  // The exported interface `test:payloadless/relay`.
+  export const relay: {
+    echoTicks(s: ReadableStream<undefined>): ReadableStream<undefined> | AsyncIterable<undefined> | Iterable<undefined> | Promise<ReadableStream<undefined> | AsyncIterable<undefined> | Iterable<undefined>>;
+    echoDone(f: Promise<void>): void | PromiseLike<void>;
+    countTicks(s: $t.TickStream): number | Promise<number>;
+  };
+
+  // Items of the exported interface `test:payloadless/relay`.
+  export function echoTicks(s: ReadableStream<undefined>): ReadableStream<undefined> | AsyncIterable<undefined> | Iterable<undefined> | Promise<ReadableStream<undefined> | AsyncIterable<undefined> | Iterable<undefined>>;
+  export function echoDone(f: Promise<void>): void | PromiseLike<void>;
+  export function countTicks(s: $t.TickStream): number | Promise<number>;
+}
+
+declare module 'test:payloadless/signals' {
+  import type * as $t from 'starling:types/test:payloadless/payloadless';
+
+  export function ticks(n: number): Promise<$t.TickStream>;
+  export function count(s: ReadableStream<undefined> | AsyncIterable<undefined> | Iterable<undefined>): Promise<number>;
+  export function done(): Promise<void>;
+  export function wait(f: void | PromiseLike<void>): Promise<boolean>;
+
+  export {
+    TickStream,
+  } from 'starling:types/test:payloadless/payloadless';
+}
+
diff --git a/componentize/tests/wit_to_ts/payloadless.guest.ts b/componentize/tests/wit_to_ts/payloadless.guest.ts
new file mode 100644
index 00000000..ce331be5
--- /dev/null
+++ b/componentize/tests/wit_to_ts/payloadless.guest.ts
@@ -0,0 +1,35 @@
+// SPDX-License-Identifier: Apache-2.0-WITH-LLVM-exception
+//
+// A guest that receives and hands over a `stream` and a `future` without a
+// payload type, in the forms the runtime accepts.
+import type * as Guest from 'starling:guest';
+import { count, done, ticks, wait } from 'test:payloadless/signals';
+
+export const relay: typeof Guest.relay = {
+  async *echoTicks(s) {
+    for await (const tick of s) {
+      yield tick;
+    }
+  },
+  async echoDone(f) {
+    await f;
+    await wait(done());
+    await wait(Promise.resolve());
+    await wait(undefined);
+  },
+  async countTicks(s) {
+    const received = await ticks(2);
+    const chunk: undefined = (await received.getReader().read()).value;
+    await count([undefined, chunk]);
+    await count(
+      (async function* () {
+        yield;
+      })(),
+    );
+    let n = 0;
+    for await (const _ of s) {
+      n++;
+    }
+    return n;
+  },
+};
diff --git a/componentize/tests/wit_to_ts/payloadless.wit b/componentize/tests/wit_to_ts/payloadless.wit
new file mode 100644
index 00000000..b8097b9c
--- /dev/null
+++ b/componentize/tests/wit_to_ts/payloadless.wit
@@ -0,0 +1,30 @@
+// SPDX-License-Identifier: Apache-2.0-WITH-LLVM-exception
+
+package test:payloadless;
+
+// A `stream` and a `future` without a payload type. The guest receives the
+// stream as a `ReadableStream<undefined>` and hands it over also as an async or
+// sync iterable of `undefined`. It receives the future as a `Promise<void>` and
+// hands it over as `undefined` or a promise of it.
+
+interface signals {
+  type tick-stream = stream;
+
+  ticks: async func(n: u32) -> tick-stream;
+  count: async func(s: stream) -> u32;
+  done: async func() -> future;
+  wait: async func(f: future) -> bool;
+}
+
+interface relay {
+  use signals.{tick-stream};
+
+  echo-ticks: async func(s: stream) -> stream;
+  echo-done: async func(f: future) -> future;
+  count-ticks: async func(s: tick-stream) -> u32;
+}
+
+world payloadless {
+  import signals;
+  export relay;
+}
diff --git a/componentize/tests/wit_to_ts/primitives.d.ts.expected b/componentize/tests/wit_to_ts/primitives.d.ts.expected
new file mode 100644
index 00000000..3b506a6d
--- /dev/null
+++ b/componentize/tests/wit_to_ts/primitives.d.ts.expected
@@ -0,0 +1,97 @@
+// Generated by `starling-componentize types`. Do not edit by hand.
+//
+// The guest JavaScript module a `primitives` componentize target implements, and
+// the modules it may import. Add this file to the program (a `files` or
+// `include` entry in `tsconfig.json`, or a `/// <reference path=…/>`).
+//
+// Nothing here is exported at file level, which makes every `declare
+// module` below an ambient module declaration. An import then
+// resolves:
+//
+//   import { log } from 'test:example/logger';
+//
+// The guest's own obligations are `starling:guest`. Reference it to have the
+// compiler check what the module exports:
+//
+//   import type * as Guest from 'starling:guest';
+//   export const example: typeof Guest.example = { … };
+//
+// Every WIT type the world uses is declared in the module
+//
+//   starling:types/test:primitives/primitives
+//
+// Each interface's module re-exports the types the interface defines or
+// `use`s under their WIT names. A name that several types share is
+// qualified there.
+
+// `ComponentError` holds the `err` payload of a WIT `result`. A string payload
+// is also its `message`. The error classes in the types module extend it.
+interface ComponentError extends Error {
+  readonly payload: unknown;
+}
+declare var ComponentError: {
+  new (payload: unknown): ComponentError;
+  readonly prototype: ComponentError;
+};
+
+declare module 'starling:guest' {
+  // Each item of an exported interface is implemented through exactly one
+  // of the shapes below: a member of its package's object, a member of its
+  // interface's object, or a bare export. A shape is declared only where the
+  // world allows it for the item.
+
+  export const testPrimitives: {
+    // The exported interface `test:primitives/scalars`.
+    scalars: {
+      echoBool(v: boolean): boolean;
+      echoU8(v: number): number;
+      echoU16(v: number): number;
+      echoU32(v: number): number;
+      echoU64(v: bigint): bigint;
+      echoS8(v: number): number;
+      echoS16(v: number): number;
+      echoS32(v: number): number;
+      echoS64(v: bigint): bigint;
+      echoF32(v: number): number;
+      echoF64(v: number): number;
+      echoChar(v: string): string;
+      echoString(v: string): string;
+      noResult(): void;
+    };
+  };
+
+  // The exported interface `test:primitives/scalars`.
+  export const scalars: {
+    echoBool(v: boolean): boolean;
+    echoU8(v: number): number;
+    echoU16(v: number): number;
+    echoU32(v: number): number;
+    echoU64(v: bigint): bigint;
+    echoS8(v: number): number;
+    echoS16(v: number): number;
+    echoS32(v: number): number;
+    echoS64(v: bigint): bigint;
+    echoF32(v: number): number;
+    echoF64(v: number): number;
+    echoChar(v: string): string;
+    echoString(v: string): string;
+    noResult(): void;
+  };
+
+  // Items of the exported interface `test:primitives/scalars`.
+  export function echoBool(v: boolean): boolean;
+  export function echoU8(v: number): number;
+  export function echoU16(v: number): number;
+  export function echoU32(v: number): number;
+  export function echoU64(v: bigint): bigint;
+  export function echoS8(v: number): number;
+  export function echoS16(v: number): number;
+  export function echoS32(v: number): number;
+  export function echoS64(v: bigint): bigint;
+  export function echoF32(v: number): number;
+  export function echoF64(v: number): number;
+  export function echoChar(v: string): string;
+  export function echoString(v: string): string;
+  export function noResult(): void;
+}
+
diff --git a/componentize/tests/wit_to_ts/primitives.wit b/componentize/tests/wit_to_ts/primitives.wit
new file mode 100644
index 00000000..f3826635
--- /dev/null
+++ b/componentize/tests/wit_to_ts/primitives.wit
@@ -0,0 +1,27 @@
+// SPDX-License-Identifier: Apache-2.0-WITH-LLVM-exception
+//
+// Primitive WIT scalar mapping. Exercises every numeric kind (8/16/32-bit
+// integers and floats -> number; 64-bit integers -> bigint), bool, char, and
+// string, both as parameters and as the function return.
+package test:primitives;
+
+interface scalars {
+  echo-bool: func(v: bool) -> bool;
+  echo-u8: func(v: u8) -> u8;
+  echo-u16: func(v: u16) -> u16;
+  echo-u32: func(v: u32) -> u32;
+  echo-u64: func(v: u64) -> u64;
+  echo-s8: func(v: s8) -> s8;
+  echo-s16: func(v: s16) -> s16;
+  echo-s32: func(v: s32) -> s32;
+  echo-s64: func(v: s64) -> s64;
+  echo-f32: func(v: f32) -> f32;
+  echo-f64: func(v: f64) -> f64;
+  echo-char: func(v: char) -> char;
+  echo-string: func(v: string) -> string;
+  no-result: func();
+}
+
+world primitives {
+  export scalars;
+}
diff --git a/componentize/tests/wit_to_ts/records_tuples.d.ts.expected b/componentize/tests/wit_to_ts/records_tuples.d.ts.expected
new file mode 100644
index 00000000..77532997
--- /dev/null
+++ b/componentize/tests/wit_to_ts/records_tuples.d.ts.expected
@@ -0,0 +1,75 @@
+// Generated by `starling-componentize types`. Do not edit by hand.
+//
+// The guest JavaScript module a `records-tuples` componentize target implements, and
+// the modules it may import. Add this file to the program (a `files` or
+// `include` entry in `tsconfig.json`, or a `/// <reference path=…/>`).
+//
+// Nothing here is exported at file level, which makes every `declare
+// module` below an ambient module declaration. An import then
+// resolves:
+//
+//   import { log } from 'test:example/logger';
+//
+// The guest's own obligations are `starling:guest`. Reference it to have the
+// compiler check what the module exports:
+//
+//   import type * as Guest from 'starling:guest';
+//   export const example: typeof Guest.example = { … };
+//
+// Every WIT type the world uses is declared in the module
+//
+//   starling:types/test:records-tuples/records-tuples
+//
+// Each interface's module re-exports the types the interface defines or
+// `use`s under their WIT names. A name that several types share is
+// qualified there.
+
+// `ComponentError` holds the `err` payload of a WIT `result`. A string payload
+// is also its `message`. The error classes in the types module extend it.
+interface ComponentError extends Error {
+  readonly payload: unknown;
+}
+declare var ComponentError: {
+  new (payload: unknown): ComponentError;
+  readonly prototype: ComponentError;
+};
+
+declare module 'starling:types/test:records-tuples/records-tuples' {
+  export type Point = { x: number; y: number; };
+
+  export type KitchenSink = { aFlag: boolean; bigNum: bigint; label: string; nested: Point; items: string[]; note?: string | undefined; };
+}
+
+declare module 'starling:guest' {
+  import type * as $t from 'starling:types/test:records-tuples/records-tuples';
+
+  // Each item of an exported interface is implemented through exactly one
+  // of the shapes below: a member of its package's object, a member of its
+  // interface's object, or a bare export. A shape is declared only where the
+  // world allows it for the item.
+
+  export const testRecordsTuples: {
+    // The exported interface `test:records-tuples/shapes`.
+    shapes: {
+      echoPoint(v: $t.Point): $t.Point;
+      echoSink(v: $t.KitchenSink): $t.KitchenSink;
+      swap(v: [number, string]): [string, number];
+      triple(v: [boolean, $t.Point, Uint8Array]): [boolean, $t.Point, Uint8Array | Uint8ClampedArray | number[]];
+    };
+  };
+
+  // The exported interface `test:records-tuples/shapes`.
+  export const shapes: {
+    echoPoint(v: $t.Point): $t.Point;
+    echoSink(v: $t.KitchenSink): $t.KitchenSink;
+    swap(v: [number, string]): [string, number];
+    triple(v: [boolean, $t.Point, Uint8Array]): [boolean, $t.Point, Uint8Array | Uint8ClampedArray | number[]];
+  };
+
+  // Items of the exported interface `test:records-tuples/shapes`.
+  export function echoPoint(v: $t.Point): $t.Point;
+  export function echoSink(v: $t.KitchenSink): $t.KitchenSink;
+  export function swap(v: [number, string]): [string, number];
+  export function triple(v: [boolean, $t.Point, Uint8Array]): [boolean, $t.Point, Uint8Array | Uint8ClampedArray | number[]];
+}
+
diff --git a/componentize/tests/wit_to_ts/records_tuples.wit b/componentize/tests/wit_to_ts/records_tuples.wit
new file mode 100644
index 00000000..0a447565
--- /dev/null
+++ b/componentize/tests/wit_to_ts/records_tuples.wit
@@ -0,0 +1,31 @@
+// SPDX-License-Identifier: Apache-2.0-WITH-LLVM-exception
+//
+// record -> object type with mangled field names, and tuple -> fixed-length array.
+// Named records become top-level `export type` declarations referenced by name.
+// An `option` field is an optional key, since a missing key reads as `none`.
+package test:records-tuples;
+
+interface shapes {
+  record point {
+    x: f64,
+    y: f64,
+  }
+
+  record kitchen-sink {
+    a-flag: bool,
+    big-num: u64,
+    label: string,
+    nested: point,
+    items: list<string>,
+    note: option<string>,
+  }
+
+  echo-point: func(v: point) -> point;
+  echo-sink: func(v: kitchen-sink) -> kitchen-sink;
+  swap: func(v: tuple<u32, string>) -> tuple<string, u32>;
+  triple: func(v: tuple<bool, point, list<u8>>) -> tuple<bool, point, list<u8>>;
+}
+
+world records-tuples {
+  export shapes;
+}
diff --git a/componentize/tests/wit_to_ts/reserved_names.d.ts.expected b/componentize/tests/wit_to_ts/reserved_names.d.ts.expected
new file mode 100644
index 00000000..6f63a3df
--- /dev/null
+++ b/componentize/tests/wit_to_ts/reserved_names.d.ts.expected
@@ -0,0 +1,75 @@
+// Generated by `starling-componentize types`. Do not edit by hand.
+//
+// The guest JavaScript module a `reserved-names` componentize target implements, and
+// the modules it may import. Add this file to the program (a `files` or
+// `include` entry in `tsconfig.json`, or a `/// <reference path=…/>`).
+//
+// Nothing here is exported at file level, which makes every `declare
+// module` below an ambient module declaration. An import then
+// resolves:
+//
+//   import { log } from 'test:example/logger';
+//
+// The guest's own obligations are `starling:guest`. Reference it to have the
+// compiler check what the module exports:
+//
+//   import type * as Guest from 'starling:guest';
+//   export const example: typeof Guest.example = { … };
+//
+// Every WIT type the world uses is declared in the module
+//
+//   starling:types/test:reserved-names/reserved-names
+//
+// Each interface's module re-exports the types the interface defines or
+// `use`s under their WIT names. A name that several types share is
+// qualified there.
+
+// `ComponentError` holds the `err` payload of a WIT `result`. A string payload
+// is also its `message`. The error classes in the types module extend it.
+interface ComponentError extends Error {
+  readonly payload: unknown;
+}
+declare var ComponentError: {
+  new (payload: unknown): ComponentError;
+  readonly prototype: ComponentError;
+};
+
+declare module 'starling:guest' {
+  // Each item of an exported interface is implemented through exactly one
+  // of the shapes below: a member of its package's object, a member of its
+  // interface's object, or a bare export. A shape is declared only where the
+  // world allows it for the item.
+
+  export const testReservedNames: {
+    // The exported interface `test:reserved-names/keywords`.
+    keywords: {
+      'new'(start: number): number;
+      for(v: number): number;
+      class(): string;
+    };
+  };
+
+  // The exported interface `test:reserved-names/keywords`.
+  export const keywords: {
+    'new'(start: number): number;
+    for(v: number): number;
+    class(): string;
+  };
+
+  // Items of the exported interface `test:reserved-names/keywords`.
+  function new_(start: number): number;
+  export { new_ as new };
+  function for_(v: number): number;
+  export { for_ as for };
+  function class_(): string;
+  export { class_ as class };
+
+  function default_(): string;
+  export { default_ as default };
+}
+
+declare module 'external' {
+  function import_(): number;
+  export { import_ as import };
+}
+
diff --git a/componentize/tests/wit_to_ts/reserved_names.wit b/componentize/tests/wit_to_ts/reserved_names.wit
new file mode 100644
index 00000000..6b730211
--- /dev/null
+++ b/componentize/tests/wit_to_ts/reserved_names.wit
@@ -0,0 +1,24 @@
+// SPDX-License-Identifier: Apache-2.0-WITH-LLVM-exception
+//
+// WIT identifiers escaped with `%` can mangle to JavaScript reserved words.
+// The runtime looks members up under their mangled names, so the mangled
+// name has to stay as it is: only the way the declaration spells it changes. A
+// member of an object type is written unchanged unless it is `new`, which would
+// otherwise parse as a construct signature, and a binding needs the
+// `function new_(…); export { new_ as new }` form.
+package test:reserved-names;
+
+interface keywords {
+  // `new` in an object type literal is a construct signature unless quoted.
+  %new: func(start: u32) -> u32;
+  // Every other reserved word is an ordinary property name.
+  %for: func(v: u32) -> u32;
+  %class: func() -> string;
+}
+
+world reserved-names {
+  export keywords;
+  // A world-level function is a binding, which no reserved word can be.
+  export %default: func() -> string;
+  import %import: func() -> u32;
+}
diff --git a/componentize/tests/wit_to_ts/reserved_params.d.ts.expected b/componentize/tests/wit_to_ts/reserved_params.d.ts.expected
new file mode 100644
index 00000000..df41ac48
--- /dev/null
+++ b/componentize/tests/wit_to_ts/reserved_params.d.ts.expected
@@ -0,0 +1,76 @@
+// Generated by `starling-componentize types`. Do not edit by hand.
+//
+// The guest JavaScript module a `reserved-params` componentize target implements, and
+// the modules it may import. Add this file to the program (a `files` or
+// `include` entry in `tsconfig.json`, or a `/// <reference path=…/>`).
+//
+// Nothing here is exported at file level, which makes every `declare
+// module` below an ambient module declaration. An import then
+// resolves:
+//
+//   import { log } from 'test:example/logger';
+//
+// The guest's own obligations are `starling:guest`. Reference it to have the
+// compiler check what the module exports:
+//
+//   import type * as Guest from 'starling:guest';
+//   export const example: typeof Guest.example = { … };
+//
+// Every WIT type the world uses is declared in the module
+//
+//   starling:types/test:reserved-params/reserved-params
+//
+// Each interface's module re-exports the types the interface defines or
+// `use`s under their WIT names. A name that several types share is
+// qualified there.
+
+// `ComponentError` holds the `err` payload of a WIT `result`. A string payload
+// is also its `message`. The error classes in the types module extend it.
+interface ComponentError extends Error {
+  readonly payload: unknown;
+}
+declare var ComponentError: {
+  new (payload: unknown): ComponentError;
+  readonly prototype: ComponentError;
+};
+
+declare module 'starling:types/test:reserved-params/reserved-params' {
+  export class Request {
+    private constructor();
+    static consumeBody(this_: Request, in_: number): string;
+    static new(default_: number): Request;
+    private $brand: unknown;
+    [Symbol.dispose](): void;
+  }
+}
+
+declare module 'starling:guest' {
+  // Each item of an exported interface is implemented through exactly one
+  // of the shapes below: a member of its package's object, a member of its
+  // interface's object, or a bare export. A shape is declared only where the
+  // world allows it for the item.
+
+  export const testReservedParams: {
+    // The exported interface `test:reserved-params/handlers`.
+    handlers: {
+      handle(this_: number, static_: string, let_: boolean): number;
+    };
+  };
+
+  // The exported interface `test:reserved-params/handlers`.
+  export const handlers: {
+    handle(this_: number, static_: string, let_: boolean): number;
+  };
+
+  // Items of the exported interface `test:reserved-params/handlers`.
+  export function handle(this_: number, static_: string, let_: boolean): number;
+}
+
+declare module 'test:reserved-params/body-ops' {
+  export function take(in_: number, default_: string, new_: boolean, arguments_: number, eval_: number, globalThis_: number): number;
+
+  export {
+    Request,
+  } from 'starling:types/test:reserved-params/reserved-params';
+}
+
diff --git a/componentize/tests/wit_to_ts/reserved_params.wit b/componentize/tests/wit_to_ts/reserved_params.wit
new file mode 100644
index 00000000..339c18e9
--- /dev/null
+++ b/componentize/tests/wit_to_ts/reserved_params.wit
@@ -0,0 +1,25 @@
+// SPDX-License-Identifier: Apache-2.0-WITH-LLVM-exception
+//
+// Parameters named after reserved words. A parameter is not looked up by name,
+// so it is renamed with `_` appended. `this` would otherwise declare the type of
+// the receiver rather than an argument, and `%in`, `%default` and `%new` would
+// be syntax errors.
+package test:reserved-params;
+
+interface body-ops {
+  resource request {
+    consume-body: static func(this: request, %in: u32) -> string;
+    %new: static func(%default: u32) -> request;
+  }
+
+  take: func(%in: u32, %default: string, %new: bool, arguments: u32, eval: u32, global-this: u32) -> u32;
+}
+
+interface handlers {
+  handle: func(this: u32, %static: string, %let: bool) -> u32;
+}
+
+world reserved-params {
+  import body-ops;
+  export handlers;
+}
diff --git a/componentize/tests/wit_to_ts/resource_polarity.d.ts.expected b/componentize/tests/wit_to_ts/resource_polarity.d.ts.expected
new file mode 100644
index 00000000..e4e5f156
--- /dev/null
+++ b/componentize/tests/wit_to_ts/resource_polarity.d.ts.expected
@@ -0,0 +1,80 @@
+// Generated by `starling-componentize types`. Do not edit by hand.
+//
+// The guest JavaScript module a `resource-polarity` componentize target implements, and
+// the modules it may import. Add this file to the program (a `files` or
+// `include` entry in `tsconfig.json`, or a `/// <reference path=…/>`).
+//
+// Nothing here is exported at file level, which makes every `declare
+// module` below an ambient module declaration. An import then
+// resolves:
+//
+//   import { log } from 'test:example/logger';
+//
+// The guest's own obligations are `starling:guest`. Reference it to have the
+// compiler check what the module exports:
+//
+//   import type * as Guest from 'starling:guest';
+//   export const example: typeof Guest.example = { … };
+//
+// Every WIT type the world uses is declared in the module
+//
+//   starling:types/test:polarity/resource-polarity
+//
+// Each interface's module re-exports the types the interface defines or
+// `use`s under their WIT names. A name that several types share is
+// qualified there.
+
+// `ComponentError` holds the `err` payload of a WIT `result`. A string payload
+// is also its `message`. The error classes in the types module extend it.
+interface ComponentError extends Error {
+  readonly payload: unknown;
+}
+declare var ComponentError: {
+  new (payload: unknown): ComponentError;
+  readonly prototype: ComponentError;
+};
+
+declare module 'starling:types/test:polarity/resource-polarity' {
+  export class Body {
+    private constructor();
+    write(data: ReadableStream<ArrayBufferView | ArrayBuffer> | AsyncIterable<ArrayBufferView | ArrayBuffer> | Iterable<ArrayBufferView | ArrayBuffer>): Promise<void>;
+    read(): ReadableStream<Uint8Array>;
+    finish(): Promise<number>;
+    private $brand: unknown;
+    [Symbol.dispose](): void;
+  }
+}
+
+declare module 'starling:guest' {
+  import type * as $t from 'starling:types/test:polarity/resource-polarity';
+
+  // Each item of an exported interface is implemented through exactly one
+  // of the shapes below: a member of its package's object, a member of its
+  // interface's object, or a bare export. A shape is declared only where the
+  // world allows it for the item.
+
+  export const testPolarity: {
+    // The exported interface `test:polarity/guest-api`.
+    guestApi: {
+      take(b: $t.Body): number;
+      give(): $t.Body | Promise<$t.Body>;
+    };
+  };
+
+  // The exported interface `test:polarity/guest-api`.
+  export const guestApi: {
+    take(b: $t.Body): number;
+    give(): $t.Body | Promise<$t.Body>;
+  };
+
+  // Items of the exported interface `test:polarity/guest-api`.
+  export function take(b: $t.Body): number;
+  export function give(): $t.Body | Promise<$t.Body>;
+}
+
+declare module 'test:polarity/host' {
+  export {
+    Body,
+  } from 'starling:types/test:polarity/resource-polarity';
+}
+
diff --git a/componentize/tests/wit_to_ts/resource_polarity.wit b/componentize/tests/wit_to_ts/resource_polarity.wit
new file mode 100644
index 00000000..99f39d44
--- /dev/null
+++ b/componentize/tests/wit_to_ts/resource_polarity.wit
@@ -0,0 +1,27 @@
+// SPDX-License-Identifier: Apache-2.0-WITH-LLVM-exception
+//
+// An imported resource reached only through an exported interface's
+// signatures. Its class is the host's, so its members are rendered as imports:
+// the guest hands a `stream<u8>` argument over, receives a `stream<u8>` result,
+// and an async method returns a `Promise`. It has no constructor, so the class
+// declares a private one.
+package test:polarity;
+
+interface host {
+  resource body {
+    write: async func(data: stream<u8>) -> result;
+    read: func() -> stream<u8>;
+    finish: async func() -> u32;
+  }
+}
+
+interface guest-api {
+  use host.{body};
+
+  take: func(b: body) -> u32;
+  give: async func() -> body;
+}
+
+world resource-polarity {
+  export guest-api;
+}
diff --git a/componentize/tests/wit_to_ts/serve.d.ts.expected b/componentize/tests/wit_to_ts/serve.d.ts.expected
new file mode 100644
index 00000000..20c6723c
--- /dev/null
+++ b/componentize/tests/wit_to_ts/serve.d.ts.expected
@@ -0,0 +1,123 @@
+// Generated by `starling-componentize types`. Do not edit by hand.
+//
+// The guest JavaScript module a `serve` componentize target implements, and
+// the modules it may import. Add this file to the program (a `files` or
+// `include` entry in `tsconfig.json`, or a `/// <reference path=…/>`).
+//
+// Nothing here is exported at file level, which makes every `declare
+// module` below an ambient module declaration. An import then
+// resolves:
+//
+//   import { log } from 'test:example/logger';
+//
+// The guest's own obligations are `starling:guest`. Reference it to have the
+// compiler check what the module exports:
+//
+//   import type * as Guest from 'starling:guest';
+//   export const example: typeof Guest.example = { … };
+//
+// Every WIT type the world uses is declared in the module
+//
+//   starling:types/test:serve/serve
+//
+// Each interface's module re-exports the types the interface defines or
+// `use`s under their WIT names. A name that several types share is
+// qualified there.
+
+// `ComponentError` holds the `err` payload of a WIT `result`. A string payload
+// is also its `message`. The error classes in the types module extend it.
+interface ComponentError extends Error {
+  readonly payload: unknown;
+}
+declare var ComponentError: {
+  new (payload: unknown): ComponentError;
+  readonly prototype: ComponentError;
+};
+
+// The event the runtime dispatches to `addEventListener('fetch', …)` listeners.
+interface FetchEvent extends Event {
+  readonly request: Request;
+  respondWith(response: Response | PromiseLike<Response>): void;
+  waitUntil(promise: PromiseLike<unknown>): void;
+}
+interface WindowEventMap {
+  fetch: FetchEvent;
+}
+
+// `fetch` also takes a `wasi:http/types` `request`, such as the one a
+// `wasi:http/handler` implementation receives, and sends it.
+declare function fetch(
+  input: import('starling:types/test:serve/serve').Request,
+  init?: RequestInit,
+): Promise<Response>;
+
+declare module 'starling:types/test:serve/serve' {
+  export class Request {
+    private constructor();
+    path(): string;
+    private $brand: unknown;
+    [Symbol.dispose](): void;
+  }
+
+  export class Response {
+    constructor(status: number);
+    send(): void;
+    private $brand: unknown;
+    [Symbol.dispose](): void;
+  }
+
+  export type ErrorCode = { tag: 'internalError'; val?: string | undefined };
+
+  export class ErrorCodeError extends ComponentError {
+    constructor(payload: ErrorCode);
+    readonly payload: ErrorCode;
+  }
+}
+
+declare module 'starling:guest' {
+  import type * as $t from 'starling:types/test:serve/serve';
+
+  // The `wasi:http/handler` export is served in one of two ways. Either
+  // register a listener on the global, and the runtime dispatches each
+  // request to it as a `FetchEvent`:
+  //
+  //   addEventListener('fetch', (event) => {
+  //     event.respondWith(new Response('hello'));
+  //   });
+  //
+  // Or implement `handle` below, which receives the WIT request and returns a
+  // `Response` or the WIT `response`, or a promise of either. `fetch(request)`
+  // sends the request on. It fails with an `error-code` by throwing an
+  // `ErrorCode` from `wasi:http/types@0.3.0`.
+  //
+  // An application that does both, or neither, fails to componentize.
+
+  // Each item of an exported interface is implemented through exactly one
+  // of the shapes below: a member of its package's object, a member of its
+  // interface's object, or a bare export. A shape is declared only where the
+  // world allows it for the item.
+
+  export const wasiHttp: {
+    // The exported interface `wasi:http/handler@0.3.0`.
+    handler: {
+      handle(request: $t.Request): Response | $t.Response | Promise<Response | $t.Response>;
+    };
+  };
+
+  // The exported interface `wasi:http/handler@0.3.0`.
+  export const handler: {
+    handle(request: $t.Request): Response | $t.Response | Promise<Response | $t.Response>;
+  };
+
+  // Items of the exported interface `wasi:http/handler@0.3.0`.
+  export function handle(request: $t.Request): Response | $t.Response | Promise<Response | $t.Response>;
+}
+
+declare module 'wasi:http/types@0.3' {
+  export {
+    ErrorCodeError as ErrorCode,
+    Request,
+    Response,
+  } from 'starling:types/test:serve/serve';
+}
+
diff --git a/componentize/tests/wit_to_ts/serve.handler.ts b/componentize/tests/wit_to_ts/serve.handler.ts
new file mode 100644
index 00000000..7c3b7a58
--- /dev/null
+++ b/componentize/tests/wit_to_ts/serve.handler.ts
@@ -0,0 +1,25 @@
+// SPDX-License-Identifier: Apache-2.0-WITH-LLVM-exception
+//
+// A guest implementing `wasi:http/handler` itself in the package layer,
+// returning either a web `Response` or the WIT `response`, forwarding the WIT
+// request with `fetch`, and failing with an `ErrorCode`.
+import type * as Guest from 'starling:guest';
+import { ErrorCode, Response as WitResponse } from 'wasi:http/types@0.3';
+
+export const wasiHttp: typeof Guest.wasiHttp = {
+  handler: {
+    async handle(request) {
+      const path = request.path();
+      if (path === '/fail') {
+        throw new ErrorCode({ tag: 'internalError', val: 'failed' });
+      }
+      if (path === '/wit') {
+        return new WitResponse(204);
+      }
+      if (path === '/forward') {
+        return await fetch(request);
+      }
+      return new Response(`hello ${path}`);
+    },
+  },
+};
diff --git a/componentize/tests/wit_to_ts/serve.wit b/componentize/tests/wit_to_ts/serve.wit
new file mode 100644
index 00000000..3195271c
--- /dev/null
+++ b/componentize/tests/wit_to_ts/serve.wit
@@ -0,0 +1,38 @@
+// SPDX-License-Identifier: Apache-2.0-WITH-LLVM-exception
+//
+// A world that exports `wasi:http/handler` and declares the `wasi:http`
+// interfaces itself, against a minimal stub of `wasi:http/types`.
+//
+// The guest either registers a `fetch` listener or implements `handle` under
+// `wasiHttp.handler`, under `handler`, or as a bare export. `handle` receives a `Request` and
+// returns a `Response` or the `response` resource the WIT declares, and fails
+// with the `ErrorCode` class of `wasi:http/types`.
+package test:serve;
+
+world serve {
+  import wasi:http/types@0.3.0;
+  export wasi:http/handler@0.3.0;
+}
+
+package wasi:http@0.3.0 {
+  interface types {
+    variant error-code {
+      internal-error(option<string>),
+    }
+
+    resource request {
+      path: func() -> string;
+    }
+
+    resource response {
+      constructor(status: u16);
+      send: func() -> result<_, error-code>;
+    }
+  }
+
+  interface handler {
+    use types.{request, response, error-code};
+
+    handle: async func(request: request) -> result<response, error-code>;
+  }
+}
diff --git a/componentize/tests/wit_to_ts/streams.d.ts.expected b/componentize/tests/wit_to_ts/streams.d.ts.expected
new file mode 100644
index 00000000..153f9e2d
--- /dev/null
+++ b/componentize/tests/wit_to_ts/streams.d.ts.expected
@@ -0,0 +1,109 @@
+// Generated by `starling-componentize types`. Do not edit by hand.
+//
+// The guest JavaScript module a `streams` componentize target implements, and
+// the modules it may import. Add this file to the program (a `files` or
+// `include` entry in `tsconfig.json`, or a `/// <reference path=…/>`).
+//
+// Nothing here is exported at file level, which makes every `declare
+// module` below an ambient module declaration. An import then
+// resolves:
+//
+//   import { log } from 'test:example/logger';
+//
+// The guest's own obligations are `starling:guest`. Reference it to have the
+// compiler check what the module exports:
+//
+//   import type * as Guest from 'starling:guest';
+//   export const example: typeof Guest.example = { … };
+//
+// Every WIT type the world uses is declared in the module
+//
+//   starling:types/test:streams/streams
+//
+// Each interface's module re-exports the types the interface defines or
+// `use`s under their WIT names. A name that several types share is
+// qualified there.
+
+// `ComponentError` holds the `err` payload of a WIT `result`. A string payload
+// is also its `message`. The error classes in the types module extend it.
+interface ComponentError extends Error {
+  readonly payload: unknown;
+}
+declare var ComponentError: {
+  new (payload: unknown): ComponentError;
+  readonly prototype: ComponentError;
+};
+
+declare module 'starling:types/test:streams/streams' {
+  export type Failure = { tag: 'denied' } | { tag: 'notFound'; val: string };
+
+  export class Thing {
+    constructor(value: string);
+    get(): string;
+    [Symbol.dispose]?(): void;
+  }
+
+  export type Byte = number;
+
+  export type Point = { x: number; y: number; };
+
+  export class FailureError extends ComponentError {
+    constructor(payload: Failure);
+    readonly payload: Failure;
+  }
+}
+
+declare module 'starling:guest' {
+  import type * as $t from 'starling:types/test:streams/streams';
+
+  // Each item of an exported interface is implemented through exactly one
+  // of the shapes below: a member of its package's object, a member of its
+  // interface's object, or a bare export. A shape is declared only where the
+  // world allows it for the item.
+
+  export const testStreams: {
+    // The exported interface `test:streams/echoes`.
+    echoes: {
+      echoStreamU8(s: ReadableStream<Uint8Array>): ReadableStream<ArrayBufferView | ArrayBuffer> | AsyncIterable<ArrayBufferView | ArrayBuffer> | Iterable<ArrayBufferView | ArrayBuffer> | Promise<ReadableStream<ArrayBufferView | ArrayBuffer> | AsyncIterable<ArrayBufferView | ArrayBuffer> | Iterable<ArrayBufferView | ArrayBuffer>>;
+      echoStreamByte(s: ReadableStream<Uint8Array>): ReadableStream<ArrayBufferView | ArrayBuffer> | AsyncIterable<ArrayBufferView | ArrayBuffer> | Iterable<ArrayBufferView | ArrayBuffer> | Promise<ReadableStream<ArrayBufferView | ArrayBuffer> | AsyncIterable<ArrayBufferView | ArrayBuffer> | Iterable<ArrayBufferView | ArrayBuffer>>;
+      echoFutureString(f: Promise<string>): string | PromiseLike<string>;
+      echoStreamPoint(s: ReadableStream<$t.Point>): ReadableStream<$t.Point> | AsyncIterable<$t.Point> | Iterable<$t.Point> | Promise<ReadableStream<$t.Point> | AsyncIterable<$t.Point> | Iterable<$t.Point>>;
+      echoStreamThing(s: ReadableStream<$t.Thing>): ReadableStream<$t.Thing> | AsyncIterable<$t.Thing> | Iterable<$t.Thing> | Promise<ReadableStream<$t.Thing> | AsyncIterable<$t.Thing> | Iterable<$t.Thing>>;
+      settle(f: Promise<string>): string | PromiseLike<string>;
+      Thing: typeof $t.Thing;
+    };
+  };
+
+  // The exported interface `test:streams/echoes`.
+  export const echoes: {
+    echoStreamU8(s: ReadableStream<Uint8Array>): ReadableStream<ArrayBufferView | ArrayBuffer> | AsyncIterable<ArrayBufferView | ArrayBuffer> | Iterable<ArrayBufferView | ArrayBuffer> | Promise<ReadableStream<ArrayBufferView | ArrayBuffer> | AsyncIterable<ArrayBufferView | ArrayBuffer> | Iterable<ArrayBufferView | ArrayBuffer>>;
+    echoStreamByte(s: ReadableStream<Uint8Array>): ReadableStream<ArrayBufferView | ArrayBuffer> | AsyncIterable<ArrayBufferView | ArrayBuffer> | Iterable<ArrayBufferView | ArrayBuffer> | Promise<ReadableStream<ArrayBufferView | ArrayBuffer> | AsyncIterable<ArrayBufferView | ArrayBuffer> | Iterable<ArrayBufferView | ArrayBuffer>>;
+    echoFutureString(f: Promise<string>): string | PromiseLike<string>;
+    echoStreamPoint(s: ReadableStream<$t.Point>): ReadableStream<$t.Point> | AsyncIterable<$t.Point> | Iterable<$t.Point> | Promise<ReadableStream<$t.Point> | AsyncIterable<$t.Point> | Iterable<$t.Point>>;
+    echoStreamThing(s: ReadableStream<$t.Thing>): ReadableStream<$t.Thing> | AsyncIterable<$t.Thing> | Iterable<$t.Thing> | Promise<ReadableStream<$t.Thing> | AsyncIterable<$t.Thing> | Iterable<$t.Thing>>;
+    settle(f: Promise<string>): string | PromiseLike<string>;
+    Thing: typeof $t.Thing;
+  };
+
+  // Items of the exported interface `test:streams/echoes`.
+  export function echoStreamU8(s: ReadableStream<Uint8Array>): ReadableStream<ArrayBufferView | ArrayBuffer> | AsyncIterable<ArrayBufferView | ArrayBuffer> | Iterable<ArrayBufferView | ArrayBuffer> | Promise<ReadableStream<ArrayBufferView | ArrayBuffer> | AsyncIterable<ArrayBufferView | ArrayBuffer> | Iterable<ArrayBufferView | ArrayBuffer>>;
+  export function echoStreamByte(s: ReadableStream<Uint8Array>): ReadableStream<ArrayBufferView | ArrayBuffer> | AsyncIterable<ArrayBufferView | ArrayBuffer> | Iterable<ArrayBufferView | ArrayBuffer> | Promise<ReadableStream<ArrayBufferView | ArrayBuffer> | AsyncIterable<ArrayBufferView | ArrayBuffer> | Iterable<ArrayBufferView | ArrayBuffer>>;
+  export function echoFutureString(f: Promise<string>): string | PromiseLike<string>;
+  export function echoStreamPoint(s: ReadableStream<$t.Point>): ReadableStream<$t.Point> | AsyncIterable<$t.Point> | Iterable<$t.Point> | Promise<ReadableStream<$t.Point> | AsyncIterable<$t.Point> | Iterable<$t.Point>>;
+  export function echoStreamThing(s: ReadableStream<$t.Thing>): ReadableStream<$t.Thing> | AsyncIterable<$t.Thing> | Iterable<$t.Thing> | Promise<ReadableStream<$t.Thing> | AsyncIterable<$t.Thing> | Iterable<$t.Thing>>;
+  export function settle(f: Promise<string>): string | PromiseLike<string>;
+  export {
+    Thing,
+  } from 'starling:types/test:streams/streams';
+}
+
+declare module 'test:streams/storage' {
+  export function lookup(key: string): Promise<string>;
+  export function upload(body: ReadableStream<ArrayBufferView | ArrayBuffer> | AsyncIterable<ArrayBufferView | ArrayBuffer> | Iterable<ArrayBufferView | ArrayBuffer>): Promise<number>;
+  export function download(key: string): Promise<ReadableStream<Uint8Array>>;
+
+  export {
+    FailureError as Failure,
+  } from 'starling:types/test:streams/streams';
+}
+
diff --git a/componentize/tests/wit_to_ts/streams.wit b/componentize/tests/wit_to_ts/streams.wit
new file mode 100644
index 00000000..2b2e79ae
--- /dev/null
+++ b/componentize/tests/wit_to_ts/streams.wit
@@ -0,0 +1,56 @@
+// SPDX-License-Identifier: Apache-2.0-WITH-LLVM-exception
+
+package test:streams;
+
+// Streams, futures and error classes.
+//
+// A `stream<T>` the guest receives renders as a `ReadableStream<T>`, and one it
+// hands to the runtime also as an async or sync iterable of `T`. `stream<u8>`
+// reads `Uint8Array` chunks and takes any `ArrayBufferView` or `ArrayBuffer`, as
+// does a stream of an alias of `u8`. A
+// `future<T>` the guest receives renders as a `Promise<T>`, and one it hands over
+// as a `T` or a promise of one. A `future<result<T, E>>` settles with `T`.
+//
+// The exports receive their arguments and hand over their results. The imports
+// are the other way around.
+//
+// The imported `lookup` fails with a named `failure`, so its module exports a
+// `Failure` class extending `ComponentError`.
+
+interface storage {
+  variant failure {
+    denied,
+    not-found(string),
+  }
+
+  lookup: async func(key: string) -> result<string, failure>;
+  upload: async func(body: stream<u8>) -> future<result<u32, failure>>;
+  download: async func(key: string) -> stream<u8>;
+}
+
+interface echoes {
+  record point {
+    x: u32,
+    y: u32,
+  }
+
+  // A guest-owned resource holding a string, streamed as `stream<thing>`.
+  resource thing {
+    constructor(value: string);
+    get: func() -> string;
+  }
+
+  type byte = u8;
+
+  echo-stream-u8: async func(s: stream<u8>) -> stream<u8>;
+  echo-stream-byte: async func(s: stream<byte>) -> stream<byte>;
+  echo-future-string: async func(f: future<string>) -> future<string>;
+  echo-stream-point: async func(s: stream<point>) -> stream<point>;
+  echo-stream-thing: async func(s: stream<thing>) -> stream<thing>;
+  settle: async func(f: future<result<string, string>>) -> future<result<string, string>>;
+}
+
+world streams {
+  import storage;
+  export echoes;
+}
diff --git a/componentize/tests/wit_to_ts/variant_enum_flags.d.ts.expected b/componentize/tests/wit_to_ts/variant_enum_flags.d.ts.expected
new file mode 100644
index 00000000..9ed5faa6
--- /dev/null
+++ b/componentize/tests/wit_to_ts/variant_enum_flags.d.ts.expected
@@ -0,0 +1,126 @@
+// Generated by `starling-componentize types`. Do not edit by hand.
+//
+// The guest JavaScript module a `variant-enum-flags` componentize target implements, and
+// the modules it may import. Add this file to the program (a `files` or
+// `include` entry in `tsconfig.json`, or a `/// <reference path=…/>`).
+//
+// Nothing here is exported at file level, which makes every `declare
+// module` below an ambient module declaration. An import then
+// resolves:
+//
+//   import { log } from 'test:example/logger';
+//
+// The guest's own obligations are `starling:guest`. Reference it to have the
+// compiler check what the module exports:
+//
+//   import type * as Guest from 'starling:guest';
+//   export const example: typeof Guest.example = { … };
+//
+// Every WIT type the world uses is declared in the module
+//
+//   starling:types/test:variant-enum-flags/variant-enum-flags
+//
+// Each interface's module re-exports the types the interface defines or
+// `use`s under their WIT names. A name that several types share is
+// qualified there.
+
+// `ComponentError` holds the `err` payload of a WIT `result`. A string payload
+// is also its `message`. The error classes in the types module extend it.
+interface ComponentError extends Error {
+  readonly payload: unknown;
+}
+declare var ComponentError: {
+  new (payload: unknown): ComponentError;
+  readonly prototype: ComponentError;
+};
+
+declare module 'starling:types/test:variant-enum-flags/variant-enum-flags' {
+  export type Shape = { tag: 'circle'; val: number } | { tag: 'rectangle'; val: [number, number] } | { tag: 'point' };
+
+  export const enum Color {
+    red = 0,
+    green = 1,
+    blue = 2,
+  }
+
+  export const enum Permissions {
+    read = 1,
+    write = 2,
+    execute = 4,
+  }
+
+  // A set of `Permissions` members, combined with `|`.
+  export type PermissionsSet = number;
+
+  export const enum Wide {
+    b0 = 1,
+    b1 = 2,
+    b2 = 4,
+    b3 = 8,
+    b4 = 16,
+    b5 = 32,
+    b6 = 64,
+    b7 = 128,
+    b8 = 256,
+    b9 = 512,
+    b10 = 1024,
+    b11 = 2048,
+    b12 = 4096,
+    b13 = 8192,
+    b14 = 16384,
+    b15 = 32768,
+    b16 = 65536,
+    b17 = 131072,
+    b18 = 262144,
+    b19 = 524288,
+    b20 = 1048576,
+    b21 = 2097152,
+    b22 = 4194304,
+    b23 = 8388608,
+    b24 = 16777216,
+    b25 = 33554432,
+    b26 = 67108864,
+    b27 = 134217728,
+    b28 = 268435456,
+    b29 = 536870912,
+    b30 = 1073741824,
+    b31 = 1 << 31,
+  }
+
+  // A set of `Wide` members, combined with `|`.
+  export type WideSet = number;
+}
+
+declare module 'starling:guest' {
+  import type * as $t from 'starling:types/test:variant-enum-flags/variant-enum-flags';
+
+  // Each item of an exported interface is implemented through exactly one
+  // of the shapes below: a member of its package's object, a member of its
+  // interface's object, or a bare export. A shape is declared only where the
+  // world allows it for the item.
+
+  export const testVariantEnumFlags: {
+    // The exported interface `test:variant-enum-flags/choices`.
+    choices: {
+      echoShape(v: $t.Shape): $t.Shape;
+      echoColor(v: $t.Color): $t.Color;
+      echoPermissions(v: $t.PermissionsSet): $t.PermissionsSet;
+      echoWide(v: $t.WideSet): $t.WideSet;
+    };
+  };
+
+  // The exported interface `test:variant-enum-flags/choices`.
+  export const choices: {
+    echoShape(v: $t.Shape): $t.Shape;
+    echoColor(v: $t.Color): $t.Color;
+    echoPermissions(v: $t.PermissionsSet): $t.PermissionsSet;
+    echoWide(v: $t.WideSet): $t.WideSet;
+  };
+
+  // Items of the exported interface `test:variant-enum-flags/choices`.
+  export function echoShape(v: $t.Shape): $t.Shape;
+  export function echoColor(v: $t.Color): $t.Color;
+  export function echoPermissions(v: $t.PermissionsSet): $t.PermissionsSet;
+  export function echoWide(v: $t.WideSet): $t.WideSet;
+}
+
diff --git a/componentize/tests/wit_to_ts/variant_enum_flags.wit b/componentize/tests/wit_to_ts/variant_enum_flags.wit
new file mode 100644
index 00000000..35231be3
--- /dev/null
+++ b/componentize/tests/wit_to_ts/variant_enum_flags.wit
@@ -0,0 +1,72 @@
+// SPDX-License-Identifier: Apache-2.0-WITH-LLVM-exception
+//
+// variant -> discriminated union keyed by `tag`, where a payload case also has
+// `val` and a payloadless case has only `tag`. enum -> a `const enum` numbered
+// from zero, the case index `push_enum` lifts. flags -> a `const enum` of powers
+// of two plus a `number` alias for a set of them, the bit set `push_flags` lifts.
+// A set crosses as an int32, so the member for bit 31 is `1 << 31`.
+package test:variant-enum-flags;
+
+interface choices {
+  variant shape {
+    circle(f64),
+    rectangle(tuple<f64, f64>),
+    point,
+  }
+
+  enum color {
+    red,
+    green,
+    blue,
+  }
+
+  flags permissions {
+    read,
+    write,
+    execute,
+  }
+
+  flags wide {
+    b0,
+    b1,
+    b2,
+    b3,
+    b4,
+    b5,
+    b6,
+    b7,
+    b8,
+    b9,
+    b10,
+    b11,
+    b12,
+    b13,
+    b14,
+    b15,
+    b16,
+    b17,
+    b18,
+    b19,
+    b20,
+    b21,
+    b22,
+    b23,
+    b24,
+    b25,
+    b26,
+    b27,
+    b28,
+    b29,
+    b30,
+    b31,
+  }
+
+  echo-shape: func(v: shape) -> shape;
+  echo-color: func(v: color) -> color;
+  echo-permissions: func(v: permissions) -> permissions;
+  echo-wide: func(v: wide) -> wide;
+}
+
+world variant-enum-flags {
+  export choices;
+}
diff --git a/componentize/tests/wit_to_ts/world_funcs.d.ts.expected b/componentize/tests/wit_to_ts/world_funcs.d.ts.expected
new file mode 100644
index 00000000..ab08bc9b
--- /dev/null
+++ b/componentize/tests/wit_to_ts/world_funcs.d.ts.expected
@@ -0,0 +1,45 @@
+// Generated by `starling-componentize types`. Do not edit by hand.
+//
+// The guest JavaScript module a `world-funcs` componentize target implements, and
+// the modules it may import. Add this file to the program (a `files` or
+// `include` entry in `tsconfig.json`, or a `/// <reference path=…/>`).
+//
+// Nothing here is exported at file level, which makes every `declare
+// module` below an ambient module declaration. An import then
+// resolves:
+//
+//   import { log } from 'test:example/logger';
+//
+// The guest's own obligations are `starling:guest`. Reference it to have the
+// compiler check what the module exports:
+//
+//   import type * as Guest from 'starling:guest';
+//   export const example: typeof Guest.example = { … };
+//
+// Every WIT type the world uses is declared in the module
+//
+//   starling:types/test:world-funcs/world-funcs
+//
+// Each interface's module re-exports the types the interface defines or
+// `use`s under their WIT names. A name that several types share is
+// qualified there.
+
+// `ComponentError` holds the `err` payload of a WIT `result`. A string payload
+// is also its `message`. The error classes in the types module extend it.
+interface ComponentError extends Error {
+  readonly payload: unknown;
+}
+declare var ComponentError: {
+  new (payload: unknown): ComponentError;
+  readonly prototype: ComponentError;
+};
+
+declare module 'starling:guest' {
+  export function greet(name: string): string;
+  export function add(a: number, b: number): number;
+}
+
+declare module 'external' {
+  export function clock(): bigint;
+}
+
diff --git a/componentize/tests/wit_to_ts/world_funcs.wit b/componentize/tests/wit_to_ts/world_funcs.wit
new file mode 100644
index 00000000..18fc94a3
--- /dev/null
+++ b/componentize/tests/wit_to_ts/world_funcs.wit
@@ -0,0 +1,13 @@
+// SPDX-License-Identifier: Apache-2.0-WITH-LLVM-exception
+//
+// World-level functions (not behind an interface). An exported world-level
+// function is a flat `export function`, and an imported world-level function lands
+// in the `external` module. This is the `ns.baz` / flat-export convention
+// (exports.rs) versus the interface-member `ns.<iface>.baz` form.
+package test:world-funcs;
+
+world world-funcs {
+  export greet: func(name: string) -> string;
+  export add: func(a: u32, b: u32) -> u32;
+  import clock: func() -> u64;
+}
diff --git a/crates/builtins/cpp-builtins/Cargo.toml b/crates/builtins/cpp-builtins/Cargo.toml
index 2d1ae96c..0cb7b7c3 100644
--- a/crates/builtins/cpp-builtins/Cargo.toml
+++ b/crates/builtins/cpp-builtins/Cargo.toml
@@ -6,6 +6,10 @@ license.workspace = true
 authors.workspace = true
 edition.workspace = true
 
+[lib]
+# No unit tests. This skips building the (SpiderMonkey-sized) lib test harness binary.
+test = false
+
 [features]
 debugmozjs = []
 
@@ -25,7 +29,3 @@ mozjs_sys = { git = "https://github.com/tschneidereit/mozjs.git", branch = "main
 
 [build-dependencies]
 cc = "1.2.56"
-
-[dev-dependencies]
-core-runtime.workspace = true
-libstarling.workspace = true
diff --git a/crates/builtins/cpp-builtins/cpp/builtins/console.cpp b/crates/builtins/cpp-builtins/cpp/builtins/console.cpp
index 33f9c1e9..a522ca0d 100644
--- a/crates/builtins/cpp-builtins/cpp/builtins/console.cpp
+++ b/crates/builtins/cpp-builtins/cpp/builtins/console.cpp
@@ -2,6 +2,7 @@
 #include "encode.h"
 #include <chrono>
 #include <map>
+#include <string_view>
 
 #include <js/Array.h>
 #include <js/experimental/TypedData.h>
@@ -406,23 +407,28 @@ JS::Result<mozilla::Ok> ToSource(JSContext *cx, std::string &sourceOut, JS::Hand
 namespace builtins::web::console {
 
 // `log`, `info` and `debug` print the bare message on stdout. `warn` and `error` print it on
-// stderr, prefixed with the level.
+// stderr, prefixed with the level. The message is written with its length, so NUL characters in
+// it are printed too.
 __attribute__((weak))
-void builtin_impl_console_log(Console::LogType log_ty, const char *msg) {
+void builtin_impl_console_log(Console::LogType log_ty, std::string_view msg) {
+  FILE *stream = stdout;
+  const char *prefix = "";
   switch (log_ty) {
   case Console::LogType::Warn:
-    fprintf(stderr, "Warn: %s\n", msg);
-    fflush(stderr);
-    return;
+    stream = stderr;
+    prefix = "Warn: ";
+    break;
   case Console::LogType::Error:
-    fprintf(stderr, "Error: %s\n", msg);
-    fflush(stderr);
-    return;
+    stream = stderr;
+    prefix = "Error: ";
+    break;
   default:
-    fprintf(stdout, "%s\n", msg);
-    fflush(stdout);
-    return;
+    break;
   }
+  fputs(prefix, stream);
+  fwrite(msg.data(), 1, msg.size(), stream);
+  fputc('\n', stream);
+  fflush(stream);
 }
 
 template <Console::LogType log_ty>
@@ -450,7 +456,7 @@ static bool console_out(JSContext *cx, unsigned argc, JS::Value *vp) {
     }
   }
 
-  builtin_impl_console_log(log_ty, fullLogLine.c_str());
+  builtin_impl_console_log(log_ty, fullLogLine);
 
   args.rval().setUndefined();
   return true;
@@ -502,7 +508,7 @@ static bool assert_(JSContext *cx, unsigned argc, JS::Value *vp) {
   }
 
   // 5. Perform Logger("assert", data).
-  builtin_impl_console_log(Console::LogType::Error, message.c_str());
+  builtin_impl_console_log(Console::LogType::Error, message);
   return true;
 }
 
@@ -535,7 +541,7 @@ static bool count(JSContext *cx, unsigned argc, JS::Value *vp) {
   concat += ": ";
   concat += std::to_string(count);
   // 5. Perform Logger("count", « concat »).
-  builtin_impl_console_log(Console::LogType::Log, concat.c_str());
+  builtin_impl_console_log(Console::LogType::Log, concat);
   args.rval().setUndefined();
   return true;
 }
@@ -566,7 +572,7 @@ static bool countReset(JSContext *cx, unsigned argc, JS::Value *vp) {
     std::string message = "Count for '";
     message += label;
     message += "' does not exist";
-    builtin_impl_console_log(Console::LogType::Warn, message.c_str());
+    builtin_impl_console_log(Console::LogType::Warn, message);
   }
 
   args.rval().setUndefined();
@@ -623,7 +629,7 @@ static bool timeLog(JSContext *cx, unsigned argc, JS::Value *vp) {
     std::string message = "No such label '";
     message += label;
     message += "' for console.timeLog()";
-    builtin_impl_console_log(Console::LogType::Warn, message.c_str());
+    builtin_impl_console_log(Console::LogType::Warn, message);
     args.rval().setUndefined();
     return true;
   }
@@ -672,7 +678,7 @@ static bool timeLog(JSContext *cx, unsigned argc, JS::Value *vp) {
   concat += data;
 
   // 6. Perform Printer("timeLog", « concat »).
-  builtin_impl_console_log(Console::LogType::Log, concat.c_str());
+  builtin_impl_console_log(Console::LogType::Log, concat);
 
   args.rval().setUndefined();
   return true;
@@ -696,7 +702,7 @@ static bool timeEnd(JSContext *cx, unsigned argc, JS::Value *vp) {
     std::string message = "No such label '";
     message += label;
     message += "' for console.timeEnd()";
-    builtin_impl_console_log(Console::LogType::Warn, message.c_str());
+    builtin_impl_console_log(Console::LogType::Warn, message);
     args.rval().setUndefined();
     return true;
   }
@@ -717,7 +723,7 @@ static bool timeEnd(JSContext *cx, unsigned argc, JS::Value *vp) {
   concat += "ms";
 
   // 6. Perform Printer("timeEnd", « concat »).
-  builtin_impl_console_log(Console::LogType::Info, concat.c_str());
+  builtin_impl_console_log(Console::LogType::Info, concat);
 
   args.rval().setUndefined();
   return true;
@@ -744,7 +750,7 @@ static bool dir(JSContext *cx, unsigned argc, JS::Value *vp) {
     fullLogLine += source;
   }
 
-  builtin_impl_console_log(Console::LogType::Log, fullLogLine.c_str());
+  builtin_impl_console_log(Console::LogType::Log, fullLogLine);
 
   args.rval().setUndefined();
   return true;
@@ -795,7 +801,7 @@ static bool trace(JSContext *cx, unsigned argc, JS::Value *vp) {
   fullLogLine += stack_string.begin();
 
   // 3. Perform Printer("trace", « trace »).
-  builtin_impl_console_log(Console::LogType::Log, fullLogLine.c_str());
+  builtin_impl_console_log(Console::LogType::Log, fullLogLine);
   args.rval().setUndefined();
   return true;
 }
diff --git a/crates/builtins/cpp-builtins/src/lib.rs b/crates/builtins/cpp-builtins/src/lib.rs
index a8838d1e..6e108fd0 100644
--- a/crates/builtins/cpp-builtins/src/lib.rs
+++ b/crates/builtins/cpp-builtins/src/lib.rs
@@ -13,62 +13,3 @@ unsafe extern "C" {
 pub unsafe fn install(cx: *mut JSContext, global: HandleObject) -> bool {
     unsafe { console_install(cx, global.get()) }
 }
-
-#[cfg(test)]
-mod tests {
-    mod console_integration {
-        use core_runtime::test_util::throws_with_setup;
-
-        fn eval(code: &str) -> bool {
-            libstarling::register_builtins();
-            let rt =
-                libstarling::runtime::Runtime::init(&libstarling::config::RuntimeConfig::default())
-                    .expect("runtime init");
-            let scope = rt.default_global();
-            let rval = js::compile::evaluate_with_filename(&scope, code, "test.js", 1)
-                .expect("eval failed");
-            rval.is_undefined() || rval.to_boolean()
-        }
-
-        fn eval_throws(code: &str) -> bool {
-            throws_with_setup(libstarling::register_builtins, code)
-        }
-
-        #[test]
-        fn console_log_exists() {
-            assert!(eval("typeof console === 'object'"));
-        }
-
-        #[test]
-        fn console_methods_exist() {
-            assert!(eval("typeof console.log === 'function'"));
-            assert!(eval("typeof console.warn === 'function'"));
-            assert!(eval("typeof console.error === 'function'"));
-            assert!(eval("typeof console.info === 'function'"));
-            assert!(eval("typeof console.debug === 'function'"));
-        }
-
-        #[test]
-        fn console_log_returns_undefined() {
-            assert!(eval("console.log('test') === undefined"));
-        }
-
-        #[test]
-        fn console_log_no_args() {
-            // Should not throw with zero arguments.
-            assert!(!eval_throws("console.log()"));
-        }
-
-        #[test]
-        fn console_log_multiple_args() {
-            assert!(!eval_throws("console.log('a', 'b', 'c')"));
-        }
-
-        #[test]
-        fn console_log_non_string_args() {
-            assert!(!eval_throws(
-                "console.log(42, true, null, undefined, {x: 1})"
-            ));
-        }
-    }
-}
diff --git a/crates/builtins/fetch-event/Cargo.toml b/crates/builtins/fetch-event/Cargo.toml
index 5ae0c835..e75c9596 100644
--- a/crates/builtins/fetch-event/Cargo.toml
+++ b/crates/builtins/fetch-event/Cargo.toml
@@ -6,6 +6,10 @@ license.workspace = true
 authors.workspace = true
 edition.workspace = true
 
+[lib]
+# No unit tests. This skips building the (SpiderMonkey-sized) lib test harness binary.
+test = false
+
 [features]
 # For `cargo test --features debugmozjs`.
 debugmozjs = ["js/debugmozjs"]
diff --git a/crates/builtins/fetch-event/src/extendable_event.rs b/crates/builtins/fetch-event/src/extendable_event.rs
index 3c283b94..6c207c2f 100644
--- a/crates/builtins/fetch-event/src/extendable_event.rs
+++ b/crates/builtins/fetch-event/src/extendable_event.rs
@@ -96,8 +96,6 @@ impl ExtendableEvent {
                 &format!("`{caller}`"),
             ));
         };
-        // Note: if the allocation of `on_settled` were to fail, this would leak `handle` until
-        // the event loop is dropped. Working around that would be more trouble than it's worth.
         let holder = LifetimePromisePayload::new(scope, handle, *self)?;
         let on_settled =
             Function::new_callback(scope, c"", 1, lifetime_promise_settled_cb, holder)?;
diff --git a/crates/builtins/fetch-event/src/fetch_event.rs b/crates/builtins/fetch-event/src/fetch_event.rs
index 32e65c0d..141ab25f 100644
--- a/crates/builtins/fetch-event/src/fetch_event.rs
+++ b/crates/builtins/fetch-event/src/fetch_event.rs
@@ -23,9 +23,7 @@ use web_globals::events::algorithms::ScriptStackState;
 use web_globals::events::EventTarget;
 
 /// <https://w3c.github.io/ServiceWorker/#dictdef-fetcheventinit>
-// Note: the missing fields are intentionally omitted. The only difference that makes is that
-// validation will accept things the spec wouldn't, but that's really marginal: it'd reject
-// e.g. a `resultingClientId` property where `toString()` throws, but not much else.
+// Note: the other members are omitted, so their values are not converted.
 #[webidl_dictionary(extends = ExtendableEventInit)]
 pub struct FetchEventInit<'a> {
     parent: ExtendableEventInit,
@@ -63,8 +61,8 @@ pub struct FetchEvent {
     wait_to_respond: bool,
     /// <https://w3c.github.io/ServiceWorker/#fetchevent-respond-with-error-flag>
     respond_with_error: bool,
-    // Note: `preloadResponse`, `resultingClientId`, and `replacesClientId` omitted intentionally.
-    // The first isn't supported anywhere, and all three don't really matter to our use cases.
+    // Note: `preloadResponse` and `replacesClientId` are not implemented, and `resultingClientId`
+    // is always empty.
 }
 
 #[webidl_methods]
@@ -76,7 +74,7 @@ impl FetchEvent {
         r#type: &str,
         event_init_dict: &FetchEventInit<'_>,
     ) -> Result<Self, ExnThrown> {
-        // The spec-defined script constructor; the runtime creates its events via
+        // The spec-defined script constructor. The runtime creates its events with
         // `create_for_request` instead, and only those events are ever dispatched.
         // WPT still contains tests for the JS constructor though.
         let handled = Promise::new_pending(scope)?;
@@ -196,9 +194,9 @@ impl FetchEvent {
     /// <https://w3c.github.io/ServiceWorker/#dom-fetchevent-respondwith>
     // `r` is a WebIDL `Promise<Response>`: the trampoline accepts any value, hands over a promise
     // resolved with it, and rejects that promise if what it settles with isn't a `Response`. That
-    // rejection lands in step 9 below, which sets the `respond-with error flag` — the same flag
-    // step 10.1 sets for a non-`Response` fulfillment, which is why step 10.1 is unreachable here
-    // (see `on_respond_fulfilled`).
+    // rejection lands in step 9 below, which sets the `respond-with error flag`. Step 10.1 sets the
+    // same flag for a non-`Response` fulfillment, which is why step 10.1 is unreachable here (see
+    // `on_respond_fulfilled`).
     #[method]
     pub fn respond_with(
         &self,
@@ -295,8 +293,8 @@ fn on_respond_fulfilled(
     let unusable = response.is_body_unusable(scope);
     if !unusable {
         // Steps 10.2.2 to 10.2.5 are implemented at the platform layer instead of here, except
-        // for the effect step 10.2.2's transform has on the response handed in, which is to take
-        // its body, and step 10.2.5.1's getting a reader for the body's stream, which
+        // for the effect that step 10.2.2's transform has on the response handed in, which is to
+        // take its body, and step 10.2.5.1's getting a reader for the body's stream, which
         // `reserve_body_for_sending` acquires now so author code can no longer read from it.
         response.reserve_body_for_sending(scope)?;
     }
@@ -373,27 +371,22 @@ impl<'s> FetchEvent<'s> {
         self.data().respond_with_entered
     }
 
-    /// Settle the `handled` promise: steps 21–23 of
-    /// [Create Fetch Event and Dispatch](https://w3c.github.io/ServiceWorker/#create-fetch-event-and-dispatch),
-    /// where the event's outcome becomes final. `responded` says whether a `Response` is on its way
-    /// to the client.
+    /// Settle the `handled` promise, per steps 21–23 of
+    /// [Create Fetch Event and Dispatch](https://w3c.github.io/ServiceWorker/#create-fetch-event-and-dispatch):
+    /// resolve it if `responded` (a `Response` is on its way to the client), and reject it with a
+    /// "NetworkError" `DOMException` otherwise. Does nothing once `handled` is settled.
     ///
-    /// The spec settles `handled` three ways: resolve once a response is on its way (step 23),
-    /// reject when the event failed (steps 21.1.1 and 22.1), and, when the handler never called
-    /// `respondWith`, resolve (step 21.2), because that case returns null, which tells `Fetch`
-    /// to go get the response from the network itself.
-    ///
-    /// There is no network to fall back to here, so that third case ends in a `500` like the
-    /// failures do, and resolving would tell the handler its request was served. So this resolves
-    /// only when `responded`, and rejects otherwise. Which failure it was only affects the
-    /// rejection's message, which [`respond_with_error`](Self::respond_with_error_set) selects.
+    /// When the handler never called `respondWith`, the spec resolves `handled` (step 21.2), since
+    /// `Fetch` then falls back to the network. There is no network fallback here, so that case ends
+    /// in a `500` and rejects like the failures. The rejection's message depends on
+    /// [`Self::respond_with_error_set`].
     pub fn settle_handled(&self, scope: &'s Scope<'_>, responded: bool) {
         let handled = self.data().handled.get(scope);
         if !handled.is_pending() {
             return;
         }
         let result = if responded {
-            handled.resolve(scope, value::undefined())
+            handled.resolve(scope, HandleValue::undefined())
         } else {
             let reason = if self.data().respond_with_error {
                 "the promise passed to respondWith did not produce a Response"
diff --git a/crates/builtins/fetch-event/tests/dispatch.rs b/crates/builtins/fetch-event/tests/dispatch.rs
index 845aa542..098eafd6 100644
--- a/crates/builtins/fetch-event/tests/dispatch.rs
+++ b/crates/builtins/fetch-event/tests/dispatch.rs
@@ -2,9 +2,7 @@
 
 //! The server-side dispatch path: create a `FetchEvent` for a request, run a JS
 //! `fetch` handler against it, drive a **per-request** event loop, and read the
-//! response the handler produced with `respondWith`. Exercises the M2/M3 event
-//! bodies end to end, including `waitUntil` keeping the loop alive and that
-//! concurrent requests run on isolated event loops.
+//! response the handler produced with `respondWith`.
 
 #![cfg(not(target_arch = "wasm32"))]
 
@@ -30,8 +28,8 @@ fn eval<'s>(scope: &'s Scope, src: &str) -> HandleValue<'s> {
 
 /// A runtime with the builtins registered, ready for a global to be created from it. Every test
 /// here starts this way, and each has to clear the initializers first: they accumulate in a
-/// process-wide registry, so a test that inherited the previous one's would register each builtin
-/// twice over.
+/// process-wide registry, so a test that inherited the previous test's initializers would register
+/// each builtin twice over.
 ///
 /// The caller enters the global itself and calls [`install_globals`] on it — the scope borrows the
 /// runtime, so the two cannot be returned together.
@@ -138,16 +136,6 @@ fn dispatch(handler_src: &str, request_src: &str) -> (String, String) {
     (response, probe)
 }
 
-#[test]
-fn respond_with_captures_the_response() {
-    // The handler responds synchronously; the response is the value passed to respondWith.
-    let (response, _) = dispatch(
-        "(event) => { event.respondWith(mark('handled: ' + event.request.url)); }",
-        "new Request('http://example.com/')",
-    );
-    assert_eq!(response, "handled: http://example.com/");
-}
-
 #[test]
 fn responding_with_something_that_is_not_a_response_is_a_network_error() {
     // `respondWith` takes a WebIDL `Promise<Response>`, so a value of the wrong type is accepted at
@@ -161,7 +149,6 @@ fn responding_with_something_that_is_not_a_response_is_a_network_error() {
 
     for handler in [
         "(e) => e.respondWith('a string is not a Response')",
-        "(e) => e.respondWith(Promise.resolve(42))",
         "(e) => e.respondWith(new Promise(r => setTimeout(() => r({}), 2)))",
         "(e) => e.respondWith(Promise.reject(new RangeError('the author rejected')))",
     ] {
@@ -186,9 +173,7 @@ fn describing_a_rejection_runs_author_code_only_after_the_respond_state_is_settl
     // The event is nonetheless still *active*: the reaction runs in the microtask checkpoint after
     // the listener returns, which is inside the dispatch, so the `dispatch flag` has not been
     // cleared yet and `waitUntil` legitimately succeeds (WPT
-    // `extendable-event-async-waituntil.js`, `no-current-extension-different-microtask`). Extending
-    // the lifetime of an event whose response already failed is allowed — `waitUntil` is about the
-    // worker staying alive for background work, not about the response.
+    // `extendable-event-async-waituntil.js`, `no-current-extension-different-microtask`).
     let rt = test_runtime();
     let scope = rt.default_global();
     install_globals(&scope);
@@ -221,45 +206,6 @@ fn describing_a_rejection_runs_author_code_only_after_the_respond_state_is_settl
     assert_eq!(log, "extended,respondWith:InvalidStateError");
 }
 
-#[test]
-fn respond_with_a_promise_resolves() {
-    // respondWith a promise that resolves after a microtask — the loop runs until it settles.
-    let (response, _) = dispatch(
-        "(event) => { event.respondWith(Promise.resolve(mark('async-response'))); }",
-        "new Request('http://example.com/')",
-    );
-    assert_eq!(response, "async-response");
-}
-
-#[test]
-fn respond_with_a_timer_backed_promise_runs_to_completion() {
-    // The response resolves only inside a setTimeout — the loop must stay alive and run the timer.
-    let (response, _) = dispatch(
-        "(event) => { event.respondWith(new Promise(r => setTimeout(() => r(mark('after-timer')), 5))); }",
-        "new Request('http://example.com/')",
-    );
-    assert_eq!(response, "after-timer");
-}
-
-#[test]
-fn wait_until_keeps_the_loop_alive_past_respond() {
-    // respondWith settles immediately, but waitUntil holds a setTimeout-backed promise; the loop
-    // must stay alive long enough to run the timer (proving waitUntil extends the lifetime past the
-    // response). If waitUntil did not hold the loop, it would exit before the timer and __probe
-    // would stay "".
-    let (response, probe) = dispatch(
-        r#"(event) => {
-            event.respondWith(mark("done"));
-            event.waitUntil(new Promise(resolve => {
-                setTimeout(() => { globalThis.__probe = "waited"; resolve(); }, 5);
-            }));
-        }"#,
-        "new Request('http://example.com/')",
-    );
-    assert_eq!(response, "done");
-    assert_eq!(probe, "waited");
-}
-
 #[test]
 fn concurrent_requests_use_isolated_event_loops() {
     // Two requests, each dispatched on its own event loop, driven concurrently. Each handler
@@ -298,37 +244,6 @@ fn concurrent_requests_use_isolated_event_loops() {
     assert_eq!(resp_b, "B:http://example.com/b");
 }
 
-#[test]
-fn dispatch_delivers_to_a_script_registered_fetch_listener() {
-    // The full server entry point: script registers a handler with addEventListener("fetch", ...),
-    // and `dispatch` delivers an incoming request to it.
-    let rt = test_runtime();
-    let scope = rt.default_global();
-    install_globals(&scope);
-    let rawcx = unsafe { scope.cx_mut().raw_cx() };
-
-    let el = EventLoop::new();
-    let event = {
-        with_event_loop(&el, |_| {
-            eval(
-                &scope,
-                "addEventListener('fetch', (e) => e.respondWith(mark('registered: ' + e.request.url)))",
-            );
-            let request = eval(&scope, "new Request('http://example.com/req')");
-            let request = Request::from_jsval(&scope, request, ()).unwrap();
-            let event =
-                FetchEvent::dispatch(&scope, request, ScriptStackState::Empty).expect("dispatch");
-            event
-        })
-    };
-
-    tokio_rt()
-        .block_on(async { unsafe { run_to_completion(rawcx, &el, tokio::time::sleep).await } });
-
-    let response = response_marker(&scope, &event);
-    assert_eq!(response, "registered: http://example.com/req");
-}
-
 #[test]
 fn the_promise_attributes_return_the_same_object_every_access() {
     // `preloadResponse` and `handled` are WebIDL promise attributes, which return the value they
@@ -578,11 +493,8 @@ fn lifetime_interest_releases_on_the_acquiring_loop() {
 }
 
 /// `respondWith` stops propagation on its own: step 5 sets the `stop propagation` and `stop
-/// immediate propagation` flags, so a later `fetch` listener never runs. The test above calls
-/// `stopImmediatePropagation` by hand; this is the case WPT actually asserts
-/// (`resources/fetch-event-respond-with-stops-propagation-worker.js`), where the handler only ever
-/// calls `respondWith` — a runtime that delivered the event onward would let a second listener
-/// overwrite the first's answer.
+/// immediate propagation` flags, so a later `fetch` listener never runs. WPT
+/// `resources/fetch-event-respond-with-stops-propagation-worker.js` asserts this.
 #[test]
 fn respond_with_alone_stops_listener_delivery() {
     let rt = test_runtime();
@@ -630,7 +542,7 @@ fn the_constructor_surface_matches_the_idl() {
                 outcome(() => new FetchEvent('t', { request: null })),
                 // ExtendableEvent takes a bare type.
                 outcome(() => new ExtendableEvent('E').type),
-                // Dictionary defaults: an EventInit that says nothing leaves both flags false.
+                // Dictionary defaults: an EventInit without either flag leaves both flags false.
                 outcome(() => new FetchEvent('t', { request }).bubbles),
                 outcome(() => new FetchEvent('t', { request }).cancelable),
                 outcome(() => new FetchEvent('t', { request, cancelable: true }).cancelable),
@@ -673,34 +585,9 @@ fn the_constructor_surface_matches_the_idl() {
     );
 }
 
-#[test]
-fn stop_immediate_propagation_stops_listener_delivery() {
-    let rt = test_runtime();
-    let scope = rt.default_global();
-    install_globals(&scope);
-
-    eval(
-        &scope,
-        r#"
-        addEventListener('fetch', (e) => { e.stopImmediatePropagation(); e.respondWith(mark('first')); });
-        addEventListener('fetch', () => { globalThis.secondRan = true; });
-        "#,
-    );
-
-    let event = dispatch_once(&scope, "new Request('http://example.com/req')");
-    let response = response_marker(&scope, &event);
-    assert_eq!(response, "first");
-
-    let second = eval(&scope, "typeof globalThis.secondRan");
-    let second = String::from_jsval(&scope, second, ()).unwrap();
-    assert_eq!(second, "undefined");
-}
-
 /// A microtask queued by the handler is still inside the dispatch, so `respondWith` from one has
 /// to work: WPT `fetch-event-async-respond-with.https.html`, against the task case that must throw
-/// (`respond_with_state_machine_guards`). Not a niche path —
-/// `const body = await request.text(); event.respondWith(…)` lands in a microtask whenever the
-/// awaited promise is already resolved.
+/// (`respond_with_state_machine_guards`).
 ///
 /// Goes through `FetchEvent::dispatch` rather than the handler-called-directly shortcut, since the
 /// checkpoint lives in the dispatch itself.
@@ -793,10 +680,6 @@ fn wait_until_from_a_later_task_throws() {
 /// author's reaction runs before the decrement that would end the extension, so the count never
 /// reaches zero in between. WPT `resources/extendable-event-async-waituntil.js`,
 /// `during-event-handler-and-microtask`.
-///
-/// Pinned because that ordering is a property of how the settle reaction is wrapped rather than
-/// something this code states outright (`scaffold-delta.md` §B) — the kind of invariant that breaks
-/// quietly when the wrapping changes.
 #[test]
 fn wait_until_can_be_chained_off_a_settling_lifetime_promise() {
     let (response, probe) = dispatch(
@@ -825,8 +708,7 @@ fn wait_until_can_be_chained_off_a_settling_lifetime_promise() {
 /// count keeps the event active regardless of the dispatch flag.
 ///
 /// WPT `resources/extendable-event-async-waituntil.js`, fetch case
-/// `pending-respondwith-async-waituntil`. This passes today — and it is why the test above has to
-/// avoid calling `respondWith` to isolate the flag.
+/// `pending-respondwith-async-waituntil`.
 #[test]
 fn wait_until_in_a_microtask_is_allowed_while_respond_with_is_pending() {
     let (response, probe) = dispatch(
@@ -934,7 +816,7 @@ fn handled_settles_by_whether_a_response_is_on_its_way() {
     }
 }
 
-/// Settling twice is a no-op: the serve path settles `handled` once per request, but the event
+/// Settling twice does nothing: the serve path settles `handled` once per request, but the event
 /// outlives that call through `waitUntil` work, and a second settle must not replace the outcome
 /// the client was told about.
 #[test]
@@ -992,9 +874,8 @@ fn responding_with_an_unusable_body_is_a_network_error() {
 }
 
 /// Taking the response's body is step 10.2.2's transform, and it happens when the `respondWith`
-/// promise settles rather than when the transport reads — so a handler that keeps a reference sees
-/// `bodyUsed` flip before a single byte goes out. Pinned because it is the script-visible half of
-/// the body deviation `docs/server-side-deviations.md` records.
+/// promise settles rather than when the transport reads, so a handler that keeps a reference sees
+/// `bodyUsed` flip before a single byte goes out.
 #[test]
 fn responding_marks_the_body_used_at_settle_time() {
     let rt = test_runtime();
diff --git a/crates/builtins/web-fetch/Cargo.toml b/crates/builtins/web-fetch/Cargo.toml
index ef275fd6..5ae19bd5 100644
--- a/crates/builtins/web-fetch/Cargo.toml
+++ b/crates/builtins/web-fetch/Cargo.toml
@@ -7,7 +7,7 @@ authors.workspace = true
 edition.workspace = true
 
 [lib]
-# No unit tests; skip building the (SpiderMonkey-sized) lib test harness binary.
+# No unit tests. This skips building the (SpiderMonkey-sized) lib test harness binary.
 test = false
 
 [dependencies]
diff --git a/crates/builtins/web-fetch/src/abort.rs b/crates/builtins/web-fetch/src/abort.rs
index bfa7b571..8e635123 100644
--- a/crates/builtins/web-fetch/src/abort.rs
+++ b/crates/builtins/web-fetch/src/abort.rs
@@ -56,10 +56,10 @@ impl AbortFetchState<'_> {
     /// One with a body detaches it once that body has been read (see
     /// `Response::consume`), since aborting mid-read must still error the stream.
     pub(crate) fn deliver(&self, scope: &Scope<'_>, response: &Response<'_>) {
-        if response_body_is_abortable(scope, response) {
+        if response.body_is_abortable(scope) {
             debug_assert!(self.data().response.is_none());
             self.data_mut().response = Some(Heap::from(*response));
-            response.set_abort_state(self);
+            response.data_mut().abort_state = Some(Heap::from(*self));
         } else {
             self.detach(scope);
         }
@@ -83,14 +83,6 @@ impl AbortFetchState<'_> {
     }
 }
 
-/// Whether a delivered response still has something an abort could act on: an
-/// unread host body, or a `.body` stream that has not finished.
-///
-/// Once neither is true, aborting is a no-op, so the algorithm can be detached.
-pub(crate) fn response_body_is_abortable(scope: &Scope<'_>, response: &Response<'_>) -> bool {
-    response.has_unread_host_body() || response.body_stream_is_unfinished(scope)
-}
-
 /// <https://fetch.spec.whatwg.org/#abort-fetch>
 /// To abort a fetch() call with a promise, request, responseObject, and an error:
 pub(crate) fn abort_fetch(
@@ -101,7 +93,7 @@ pub(crate) fn abort_fetch(
     error: HandleValue<'_>,
 ) -> Result<(), ExnThrown> {
     // Step 1: `Reject` _promise_ with _error_.
-    // Note: This is a no-op if _promise_ has already fulfilled.
+    // Note: This does nothing if _promise_ has already fulfilled.
     promise.reject(scope, error)?;
 
     // Step 2: If _request_’s `body` is non-null and is `readable`, then `cancel` _request_’s `body`
diff --git a/crates/builtins/web-fetch/src/algorithms.rs b/crates/builtins/web-fetch/src/algorithms.rs
index 5b3d8dc6..0c93345d 100644
--- a/crates/builtins/web-fetch/src/algorithms.rs
+++ b/crates/builtins/web-fetch/src/algorithms.rs
@@ -96,10 +96,10 @@ pub(crate) fn extract_body<'r>(
         }
         // Step 10 `BufferSource`: Set _source_ to a `copy of the bytes` held by _object_.
         BodyInitOrBytes::BodyInit(BodyInit::ArrayBuffer(buffer)) => {
-            source = BodySource::Bytes(bytes::Bytes::from(buffer.copy_bytes()));
+            source = BodySource::Bytes(bytes::Bytes::from(buffer.copy_bytes(scope)?));
         }
         BodyInitOrBytes::BodyInit(BodyInit::ArrayBufferView(view)) => {
-            source = BodySource::Bytes(bytes::Bytes::from(view.copy_bytes()));
+            source = BodySource::Bytes(bytes::Bytes::from(view.copy_bytes(scope)?));
         }
         // Step 10 `URLSearchParams`: Set _source_ to the result of running the
         //     `application/x-www-form-urlencoded` serializer` with _object_’s `list`. Set _type_
@@ -801,7 +801,7 @@ pub(crate) fn append_to_headers(
     //     return.
     // Steps 3.1–3.4 run inside `is_no_cors_safelisted_request_header_after_append`, which checks
     // the combined value without materializing it.
-    if core_runtime::config::enforce_fetch_restrictions()
+    if core_runtime::config::web_security_restrictions()
         && headers.data().guard == Guard::RequestNoCors
     {
         let safelisted = {
@@ -847,7 +847,7 @@ pub(crate) fn validate_header_name(
     //     request-header`, then return false.
     // Forbidden request-headers are a browser-security policy; skip when an embedder has disabled
     // request restrictions (server-side mode).
-    if core_runtime::config::enforce_fetch_restrictions()
+    if core_runtime::config::web_security_restrictions()
         && headers.data().guard == Guard::Request
         && forbidden_request_header(name, value)
     {
@@ -855,7 +855,7 @@ pub(crate) fn validate_header_name(
     }
     // Step 4: If _headers_’s `guard` is "`response`" and _name_ is a `forbidden response-header
     //     name`, then return false.
-    if core_runtime::config::enforce_fetch_restrictions()
+    if core_runtime::config::web_security_restrictions()
         && headers.data().guard == Guard::Response
         && is_forbidden_response_header_name(name)
     {
@@ -910,7 +910,7 @@ pub(crate) fn fill_headers(
 /// entries taken from an existing header list most of it is already known to
 /// hold, so this runs only what can still change the result:
 ///
-/// - `append` Step 1 (`normalize`) and `validate` step 1 is a no-op: entries are already normalized.
+/// - `append` Step 1 (`normalize`) and `validate` Step 1 are no-ops: entries are already normalized.
 /// - `validate` Steps 1 & 2 cannot throw: the guard here is "`request`" or
 ///   "`request-no-cors`" (constructor steps 31–32), never "`immutable`".
 /// - `append` Step 5 (`remove privileged no-CORS request-headers`) is a no-op:
@@ -923,7 +923,7 @@ pub(crate) fn fill_headers(
 pub(crate) fn refill_headers_from_own_list(headers: &Headers<'_>) {
     // With request restrictions off, both filters below are disabled, and re-appending an
     // existing header list's entries results in the same list. So we can just do nothing.
-    if !core_runtime::config::enforce_fetch_restrictions() {
+    if !core_runtime::config::web_security_restrictions() {
         return;
     }
 
@@ -988,10 +988,9 @@ pub(crate) fn get_the_mime_type() {
 
 /// The `convertBytesToJSValue` algorithm a `consume body` caller supplies: how the
 /// fully-read byte sequence becomes the resolved value.
-#[derive(Clone, Copy, Default)]
+#[derive(Clone, Copy)]
 pub(crate) enum ConsumeType {
     /// `arrayBuffer()` — an `ArrayBuffer` over the bytes.
-    #[default]
     ArrayBuffer,
     /// `bytes()` — a `Uint8Array` over the bytes.
     Bytes,
@@ -999,10 +998,9 @@ pub(crate) enum ConsumeType {
     Text,
     /// `json()` — `parse JSON from bytes`.
     Json,
-    /// `blob()` — a `Blob` over the bytes. Blob is not yet available in this runtime, so the
-    /// conversion fails; the body is still consumed (disturbed) first, per `consume body`.
+    /// `blob()`: not implemented, so the conversion fails after the body is consumed.
     Blob,
-    /// `formData()` — parse the body as form data. Not yet supported; consumes then fails.
+    /// `formData()`: not implemented, so the conversion fails after the body is consumed.
     FormData,
 }
 
@@ -1329,9 +1327,6 @@ fn main_fetch<'r>(
     // The HTTP(S) arm of Step 12 runs on a future; the "`data`" arm is synchronous and needs none.
     // Step 12: If _response_ is null, then set _response_ to the result of running the steps
     //     corresponding to the first matching statement:
-    // The switch keys on `origin`, `response tainting` and `mode`. This runtime has no requester
-    // `origin`, so no arm that compares one can be evaluated; what is left is a dispatch on the
-    // `current URL`’s `scheme`, and only two arms are reachable.
     let current_url = request.current_url();
     match current_url.scheme() {
         // Step 12 _request_’s `current URL`’s `scheme` is "`data`".1: Set _request_’s `response
@@ -1356,7 +1351,7 @@ fn main_fetch<'r>(
             //     status`, set _internalResponse_’s `body` to null and disregard any enqueuing
             //     toward it (if any).
             // A `data:` response is always 200, so only the method matters here.
-            let method = request.http_method();
+            let method = request.method();
             if method.eq_ignore_ascii_case("HEAD") || method.eq_ignore_ascii_case("CONNECT") {
                 response.clear_body();
             }
diff --git a/crates/builtins/web-fetch/src/body_mixin.rs b/crates/builtins/web-fetch/src/body_mixin.rs
index 742faeac..fd3439b1 100644
--- a/crates/builtins/web-fetch/src/body_mixin.rs
+++ b/crates/builtins/web-fetch/src/body_mixin.rs
@@ -5,9 +5,7 @@
 //! The `Body` interface mixin, which both `Request` and `Response` include.
 
 use crate::algorithms::{self, Body, BodySource, ConsumeType};
-use crate::incoming_body::{
-    consume_host_body, materialize_host_body, HostBackedBodyOwner, HostBodySourceImpl,
-};
+use crate::incoming_body::{consume_host_body, materialize_host_body, HostBackedBodyOwner};
 use core_runtime::webidl_union;
 use js::error::{throw_type_error, ExnThrown};
 use js::gc::handle::Heap;
@@ -16,6 +14,7 @@ use js::prelude::HandleValue;
 use js::{ArrayBuffer, ArrayBufferView, Promise};
 use platform::http::IncomingBody;
 use std::ffi::CStr;
+use web_streams::readable::native_byte_source::NativeByteSourceImpl;
 use web_streams::readable::readable_stream::ReadableStream;
 use web_streams::readable::readable_stream::ReadableStreamImpl;
 use web_url::url_search_params::URLSearchParams;
@@ -35,7 +34,7 @@ pub(crate) struct BodyStorage {
     pub(crate) host: Option<IncomingBody>,
     /// The `.body` stream's native host source, kept so an abort can cancel an in-flight host
     /// read. Set when `.body` materializes a host-backed stream.
-    pub(crate) source: Option<Heap<HostBodySourceImpl>>,
+    pub(crate) source: Option<Heap<NativeByteSourceImpl>>,
     /// The record's byte source, attributed to the owning object for the GC. Kept in sync by
     /// [`sync_accounting`](Self::sync_accounting).
     #[no_trace]
@@ -90,14 +89,6 @@ pub(crate) trait BodyMixin: HostBackedBodyOwner + Sized {
     /// The `TypeError` message for the not-yet-supported `textStream()`.
     const TEXT_STREAM_UNSUPPORTED: &'static CStr;
 
-    /// Store the `.body` stream materialized from the body's byte source.
-    fn set_body_stream(&self, stream: ReadableStream<'_>) {
-        self.with_body(|body| {
-            debug_assert!(body.stream.is_none());
-            body.stream = Some(Heap::from(stream));
-        });
-    }
-
     /// Mark the body's byte source as read — the `disturbed` of the stream it
     /// would have materialized into.
     fn set_source_disturbed(&self) {
@@ -164,7 +155,10 @@ pub(crate) trait BodyMixin: HostBackedBodyOwner + Sized {
             // body to expose.
             BodySource::Null => return Ok(None),
         };
-        self.set_body_stream(stream);
+        self.with_body(|body| {
+            debug_assert!(body.stream.is_none());
+            body.stream = Some(Heap::from(stream));
+        });
         Ok(Some(stream))
     }
 
@@ -280,8 +274,7 @@ pub(crate) trait BodyMixin: HostBackedBodyOwner + Sized {
         //     value of a ``Content-Type`` header and regardless of the presence or the value of a
         //     ``charset`` parameter.
         // Step 6: Return the result of _stream_, `piped through` _decoder_.
-        // `textStream()` depends on `TextDecoderStream` piping, deferred to a later milestone;
-        // throw for now.
+        // `textStream()` is not implemented.
         Err(throw_type_error(scope, Self::TEXT_STREAM_UNSUPPORTED))
     }
 }
diff --git a/crates/builtins/web-fetch/src/body_proxy.rs b/crates/builtins/web-fetch/src/body_proxy.rs
index 9e1482ce..49082755 100644
--- a/crates/builtins/web-fetch/src/body_proxy.rs
+++ b/crates/builtins/web-fetch/src/body_proxy.rs
@@ -159,7 +159,7 @@ fn proxy_close_step(scope: &Scope<'_>, payload: Object<'_>) -> Result<(), ExnThr
         .cast::<BodyProxySource>()
         .expect("payload is a BodyProxySource");
     let controller = state.controller(scope);
-    // The proxy can already be closed or cancelled by the time the stream it proxies closes:
+    // The proxy can already be closed or cancelled by the time the proxied stream closes:
     // `abort the fetch() call` cancels the request body, and cancelling the proxy cancels the
     // proxied stream, whose close re-enters here through any read request still pending on it
     // (a host-backed body always has one — its chunk read is in flight). Closing again is
@@ -183,8 +183,9 @@ fn proxy_error_step(
         .cast::<BodyProxySource>()
         .expect("payload is a BodyProxySource");
     let controller = state.controller(scope);
-    // Already-closed/cancelled proxy: erroring it is a no-op that fails. Ignore it for the
-    // same reason as the close step — these are a read request's `error steps`.
+    // Erroring an already closed or cancelled proxy fails without any effect. The failure
+    // is ignored for the same reason as in the close step: these are a read request's
+    // `error steps`.
     if controller.error(scope, Some(error)).is_err() {
         js::exception::clear(scope);
     }
diff --git a/crates/builtins/web-fetch/src/byte_string.rs b/crates/builtins/web-fetch/src/byte_string.rs
index 9f158527..3959d386 100644
--- a/crates/builtins/web-fetch/src/byte_string.rs
+++ b/crates/builtins/web-fetch/src/byte_string.rs
@@ -38,12 +38,6 @@ impl AsRef<str> for ByteString {
     }
 }
 
-impl From<ByteString> for String {
-    fn from(value: ByteString) -> Self {
-        value.0
-    }
-}
-
 impl<'s, 'v> FromJSVal<'s, 'v> for ByteString {
     type Config = ();
 
diff --git a/crates/builtins/web-fetch/src/globals.rs b/crates/builtins/web-fetch/src/globals.rs
index 786a35ea..94d0a8d5 100644
--- a/crates/builtins/web-fetch/src/globals.rs
+++ b/crates/builtins/web-fetch/src/globals.rs
@@ -70,9 +70,7 @@ pub mod globals {
             // Step 4.2: Return _p_.
             return Ok(p);
         }
-        let abort_state = Some(crate::abort::register_fetch_abort(
-            scope, signal, p, request,
-        )?);
+        let abort_state = crate::abort::register_fetch_abort(scope, signal, p, request)?;
 
         // Step 5: Let _globalObject_ be _request_’s `client`’s `global object`.
         // Step 6: If _globalObject_ is a `ServiceWorkerGlobalScope` object, then set _request_’s
@@ -114,9 +112,7 @@ pub mod globals {
             // object, given _response_, "`immutable`", and _relevantRealm_ — done by `scheme
             // fetch`'s "`data`" arm — then `Resolve` _p_ with _responseObject_.
             crate::algorithms::FetchOutcome::Response(response_object) => {
-                if let Some(state) = &abort_state {
-                    state.deliver(scope, &response_object);
-                }
+                abort_state.deliver(scope, &response_object);
                 p.resolve(scope, response_object)?;
                 return Ok(p);
             }
@@ -124,9 +120,7 @@ pub mod globals {
             // `TypeError` and abort these steps. Throw one to set the pending exception, then
             // take it as the rejection value.
             crate::algorithms::FetchOutcome::NetworkError => {
-                if let Some(state) = &abort_state {
-                    state.detach(scope);
-                }
+                abort_state.detach(scope);
                 throw_type_error(scope, c"Failed to fetch");
                 p.reject_with_pending(scope)?;
                 return Ok(p);
@@ -142,17 +136,17 @@ pub mod globals {
         // error`, rejecting _p_ with a `TypeError`.
         let platform_request = request.platform_request(scope);
         let url = request.current_url();
-        let redirect_mode = request.redirect_mode();
-        let mode = request.request_mode();
+        let redirect_mode = request.redirect();
+        let mode = request.mode();
         // The request's `origin` is "`client`", i.e. the requester's own origin, which is the
-        // worker location's, when one is set. It feeds `main fetch`'s origin/mode switch in
+        // worker location's origin when one is set. It feeds `main fetch`'s origin/mode switch in
         // `send_following_redirects`.
         let request_origin =
             web_globals::worker_location::current_location_url().map(|url| url.origin());
         let method = platform_request.method.clone();
         // Root the abort state across the host fetch, so the resolve callback can
         // deliver the response to it, or detach it if the response fails.
-        let abort_state = abort_state.map(RootedHeap::new);
+        let abort_state = RootedHeap::new(abort_state);
         let future = async move {
             match crate::transport::send_following_redirects(
                 platform_request,
@@ -173,20 +167,18 @@ pub mod globals {
                             redirect_mode,
                             tainting,
                         );
-                        if let Some(state) = &abort_state {
-                            match &response {
-                                Ok(response) => state.get(scope).deliver(scope, response),
-                                Err(_) => {
-                                    // Detaching runs with no exception pending.
-                                    let error = js::exception::take_pending(scope);
-                                    state.get(scope).detach(scope);
-                                    if let Some(error) = error {
-                                        js::exception::set_pending(
-                                            scope,
-                                            error,
-                                            js::native::ExceptionStackBehavior::DoNotCapture,
-                                        );
-                                    }
+                        match &response {
+                            Ok(response) => abort_state.get(scope).deliver(scope, response),
+                            Err(_) => {
+                                // Detaching runs with no exception pending.
+                                let error = js::exception::take_pending(scope);
+                                abort_state.get(scope).detach(scope);
+                                if let Some(error) = error {
+                                    js::exception::set_pending(
+                                        scope,
+                                        error,
+                                        js::native::ExceptionStackBehavior::DoNotCapture,
+                                    );
                                 }
                             }
                         }
@@ -194,9 +186,7 @@ pub mod globals {
                     }))
                 }
                 Err(error) => PromiseOutcome::Resolve(Box::new(move |scope: &Scope<'_>| {
-                    if let Some(state) = &abort_state {
-                        state.get(scope).detach(scope);
-                    }
+                    abort_state.get(scope).detach(scope);
                     Err(TypeError(format!("Failed to fetch: {error}")).throw(scope))
                 })),
             }
diff --git a/crates/builtins/web-fetch/src/headers.rs b/crates/builtins/web-fetch/src/headers.rs
index ded734e8..9a7914f2 100644
--- a/crates/builtins/web-fetch/src/headers.rs
+++ b/crates/builtins/web-fetch/src/headers.rs
@@ -138,6 +138,11 @@ impl Headers {
         }
     }
 
+    /// The header list: every header in the order it was added, duplicates included.
+    pub(crate) fn list(&self) -> Vec<(String, String)> {
+        self.data().header_list.to_vec()
+    }
+
     /// <https://fetch.spec.whatwg.org/#dom-headers-append>
     #[method]
     pub fn append(
@@ -314,17 +319,6 @@ impl Headers {
     }
 }
 
-impl Headers<'_> {
-    /// Define `Symbol.iterator` on `Headers.prototype` (an alias of `entries`).
-    fn install_symbol_iterator(scope: &Scope<'_>) {
-        js::class::add_symbol_alias::<HeadersImpl>(
-            scope,
-            c"entries",
-            js::native::SymbolCode::iterator,
-        );
-    }
-}
-
 /// <https://webidl.spec.whatwg.org/#dfn-default-iterator-object>
 #[webidl_interface(hidden, name = "Headers Iterator")]
 pub struct HeadersIterator {
@@ -374,7 +368,8 @@ impl HeadersIterator {
 
 pub(crate) fn add_to_global(scope: &Scope, global: Object) {
     Headers::add_to_global(scope, global);
-    Headers::install_symbol_iterator(scope);
+    // `Headers.prototype[Symbol.iterator]` is `entries`.
+    js::class::add_symbol_alias::<HeadersImpl>(scope, c"entries", js::native::SymbolCode::iterator);
     HeadersIterator::add_to_global(scope, global);
     js::class::inherit_from_iterator_prototype::<HeadersIteratorImpl>(scope)
         .expect("setting a class prototype's prototype can only fail due to OOM");
diff --git a/crates/builtins/web-fetch/src/incoming_body.rs b/crates/builtins/web-fetch/src/incoming_body.rs
index ce3319a6..85bbf6c7 100644
--- a/crates/builtins/web-fetch/src/incoming_body.rs
+++ b/crates/builtins/web-fetch/src/incoming_body.rs
@@ -2,29 +2,20 @@
 
 //! Streaming an incoming body straight from the host.
 //!
-//! Used as the underlying source for a `body` [`ReadableStream`], or directly in
+//! Read by the [`NativeByteSource`] of a `body` [`ReadableStream`], or directly in
 //! [`consume_host_body`] for `text`/`json`/`arrayBuffer`/`bytes`.
 
 use crate::algorithms::{convert_owned_bytes_to_js_value, Body, BodySource, ConsumeType};
 use crate::body_mixin::BodyStorage;
-use core_runtime::jsclass;
-use core_runtime::jsmethods;
-use js::conversion::FromJSVal;
-use js::error::{ExnThrown, TypeError};
-use js::function::cast_payload;
-use js::function::CallbackArgs;
-use js::gc::handle::{Heap, OptionHeapExt, RootedHeap};
+use js::error::ExnThrown;
+use js::gc::handle::{Heap, OptionHeapExt};
 use js::gc::scope::Scope;
-use js::native::Value;
-use js::prelude::HandleValue;
 use js::promise::{PromiseFuture, PromiseOutcome};
-use js::{value, Function, Promise};
+use js::Promise;
 use platform::http::IncomingBody;
-use web_streams::readable::default_controller::ReadableStreamDefaultControllerImpl;
 use web_streams::readable::default_reader::DefaultReader;
-use web_streams::readable::readable_stream::{ReadableStream, ReadableStreamImpl};
-use web_streams::readable::ReadableStreamDefaultController;
-use web_streams::AlgorithmArg;
+use web_streams::readable::native_byte_source::NativeByteSource;
+use web_streams::readable::readable_stream::ReadableStream;
 
 /// Back a new external `ArrayBuffer` with `bytes`, zero-copy when the chunk is
 /// uniquely owned. A shared chunk (another `Bytes` clone alive, e.g. a body
@@ -69,110 +60,13 @@ pub(crate) fn consume_host_body<'r>(
                 // it directly (no copy when aligned).
                 convert_owned_bytes_to_js_value(scope, bytes, conversion)
             })),
-            Err(error) => PromiseOutcome::Reject(format!("Failed to read response body: {error}")),
+            Err(error) => PromiseOutcome::Reject(format!("the body could not be read: {error}")),
         }
     };
     promise.spawn(PromiseFuture::new(future));
     Ok(promise)
 }
 
-/// Native byte source for a host-backed body's `.body` stream: holds the host
-/// body and hands out one chunk per pull. `current_pull` is the promise of the
-/// in-flight chunk read, kept so an abort can cancel that read (dropping it
-/// closes the host connection).
-///
-/// A pull can be deferred: if this body feeds an identity transform nobody has
-/// read yet, the host body is left whole. If the TS's readable end ends up being
-/// used as an outgoing body (or otherwise as a stream passed to the host), this
-/// body's stream can be used directly. See [`host_pull`].
-#[jsclass(hidden)]
-pub struct HostBodySource {
-    #[no_trace]
-    host_body: Option<IncomingBody>,
-    current_pull: Option<Heap<js::promise::Promise>>,
-    #[no_trace]
-    pulled: bool,
-    /// The `.body` stream this source backs, for asking whether anything
-    /// downstream wants bytes yet.
-    stream: Option<Heap<ReadableStreamImpl>>,
-    /// A deferred pull's promise, resolved once its deferred read has been
-    /// delivered — or when the body goes elsewhere and it never will be.
-    deferred_pull: Option<Heap<js::promise::Promise>>,
-    /// The controller a deferred pull will deliver to.
-    deferred_controller: Option<Heap<ReadableStreamDefaultControllerImpl>>,
-}
-
-#[jsmethods]
-impl HostBodySource {
-    fn new(host_body: IncomingBody) -> Self {
-        HostBodySourceImpl {
-            host_body: Some(host_body),
-            current_pull: None,
-            pulled: false,
-            stream: None,
-            deferred_pull: None,
-            deferred_controller: None,
-        }
-    }
-}
-
-impl HostBodySource<'_> {
-    /// Take the host body if it has not started being read.
-    ///
-    /// Returns `None` once a read operation has happened or the body has already been taken.
-    pub(crate) fn take_host_body(&self, scope: &Scope<'_>) -> Option<IncomingBody> {
-        if self.data().pulled || self.data().current_pull.is_some() {
-            return None;
-        }
-        let host_body = self.data_mut().host_body.take()?;
-        // The body will now be used by a sink directly, obviating the deferred pull.
-        self.settle_deferred_pull(scope, CloseStream::Yes);
-        Some(host_body)
-    }
-
-    /// Abort the body: cancel the in-flight chunk read (if any) — which drops the
-    /// host body and closes the connection — and drop any idle host body.
-    pub(crate) fn abort(&self, scope: &Scope<'_>) {
-        let pull = self.data_mut().current_pull.take_rooted(scope);
-        if let Some(pull) = pull {
-            js::promise::cancel_pending_future(pull);
-        }
-        // A deferred pull has no host read to cancel, but its promise must still be
-        // settled, or the stream is left believing a pull is still running. The
-        // stream is not closed here: the caller errors it instead.
-        self.settle_deferred_pull(scope, CloseStream::No);
-        self.data_mut().host_body = None;
-    }
-
-    /// See [`ReadableStream::deferred_demand`].
-    fn deferred_demand<'r>(&self, scope: &'r Scope<'_>) -> Option<Promise<'r>> {
-        let stream = self.data().stream.get(scope)?;
-        stream.deferred_demand(scope)
-    }
-
-    /// Settle a deferred pull, if there is one, so the stream stops waiting on a
-    /// read that is no longer coming.
-    fn settle_deferred_pull(&self, scope: &Scope<'_>, close: CloseStream) {
-        let Some(pull) = self.data_mut().deferred_pull.take_rooted(scope) else {
-            return;
-        };
-        let controller = self.data_mut().deferred_controller.take_rooted(scope);
-        if let (CloseStream::Yes, Some(controller)) = (close, controller) {
-            let _ = controller.close(scope);
-        }
-        let _ = pull.resolve(scope, HandleValue::undefined());
-    }
-}
-
-/// Whether settling a deferred pull should also close the stream it was pulling
-/// for: it should when the body went elsewhere, but not when the stream is
-/// already being torn down by a cancel or abort.
-#[derive(Clone, Copy, PartialEq, Eq)]
-enum CloseStream {
-    Yes,
-    No,
-}
-
 /// A `Request` or `Response` carrying a body still unread on the host.
 ///
 /// Both keep a [`BodyStorage`], so the operations over it ([`materialize_host_body`],
@@ -201,15 +95,6 @@ pub(crate) trait HostBackedBodyOwner {
         self.with_body(|body| body.stream.is_none().then(|| body.host.take())?)
     }
 
-    /// Store the stream the host body materialized into, and its native source.
-    fn set_host_body_stream(&self, stream: ReadableStream<'_>, source: HostBodySource<'_>) {
-        self.with_body(|body| {
-            debug_assert!(body.stream.is_none());
-            body.stream = Some(Heap::from(stream));
-            body.source = Some(Heap::from(source));
-        });
-    }
-
     /// The body record, if this object has a body. A copy: a [`BodySource::Bytes`] it carries is
     /// refcounted, so holding the copy holds the buffer.
     fn body_record(&self) -> Option<Body> {
@@ -297,176 +182,20 @@ pub(crate) fn materialize_host_body(
         return Ok(());
     };
     let (stream, source) = host_body_stream(scope, host_body)?;
-    object.set_host_body_stream(stream, source);
+    object.with_body(|body| {
+        debug_assert!(body.stream.is_none());
+        body.stream = Some(Heap::from(stream));
+        body.source = Some(Heap::from(source));
+    });
     Ok(())
 }
 
-/// Build the `.body` `ReadableStream` for a host-backed body: its underlying
-/// source reads the host body one chunk per pull and enqueues it, closing at end
-/// of body, so streaming or unbounded bodies are delivered progressively.
+/// Build the `.body` `ReadableStream` for a host-backed body: a byte stream that reads the host
+/// body when a reader asks for data, so streaming or unbounded bodies are delivered
+/// progressively.
 pub(crate) fn host_body_stream<'r>(
     scope: &'r Scope<'_>,
     host_body: IncomingBody,
-) -> Result<(ReadableStream<'r>, HostBodySource<'r>), ExnThrown> {
-    let state = HostBodySource::new(scope, host_body)?;
-    let pull = AlgorithmArg::native(scope, host_pull, state)?;
-    let cancel = AlgorithmArg::native(scope, host_cancel, state)?;
-    // Record the source so the stream can be recognized as host-backed via
-    // `ReadableStream::native_source`.
-    let stream = ReadableStream::new_native(scope, state, pull, cancel)?;
-    // Backlink the stream, so a pull can ask what it is feeding.
-    state.data_mut().stream = Some(Heap::from(stream));
-    Ok((stream, state))
-}
-
-/// Underlying-source `pull`: read the next host chunk and enqueue it (or close at
-/// end of body / error on a read failure). Returns a promise resolved once the
-/// chunk has been handled.
-///
-/// Makes use of the deferral machinery described in [`ReadableStream::deferred_demand`]
-/// to avoid needlessly reading from a host stream. If, later on, the body used as an
-/// outgoing stream, this allows it to be forwarded wholesale, skipping all handling
-/// inside StarlingMonkey itself entirely.
-fn host_pull(
-    scope: &Scope<'_>,
-    args: CallbackArgs<'_>,
-    payload: HandleValue<'_>,
-) -> Result<Value, ExnThrown> {
-    let state = cast_payload::<HostBodySource>(scope, payload);
-    let promise = Promise::new_pending(scope)?;
-    // Only an active event loop drives the host read, and a rejected pull errors the stream.
-    if core_runtime::event_loop::reject_without_event_loop(scope, &promise, "reading a body")? {
-        return Ok(promise.as_value());
-    }
-    let controller = ReadableStreamDefaultController::from_jsval_throwing(scope, args.get(0), ())?;
-    if let Some(demand) = state.deferred_demand(scope) {
-        state.data_mut().deferred_pull = Some(Heap::from(promise));
-        state.data_mut().deferred_controller = Some(Heap::from(controller));
-        let resume = Function::new_callback(scope, c"", 0, host_pull_resume, state)?;
-        demand.add_reactions_ignoring_unhandled_rejection(scope, Some(*resume), None)?;
-        return Ok(promise.as_value());
-    }
-    start_host_read(scope, state, controller, promise)?;
-    Ok(promise.as_value())
-}
-
-/// Demand arrived for a deferred pull: perform the host read it deferred.
-fn host_pull_resume(
-    scope: &Scope<'_>,
-    _args: CallbackArgs<'_>,
-    payload: HandleValue<'_>,
-) -> Result<Value, ExnThrown> {
-    let state = cast_payload::<HostBodySource>(scope, payload);
-    let controller = state.data_mut().deferred_controller.take_rooted(scope);
-    let pull = state.data_mut().deferred_pull.take_rooted(scope);
-    // Already settled: the body was claimed for direct forwarding, cancelled, or aborted while
-    // this pull sat deferred.
-    let (Some(controller), Some(promise)) = (controller, pull) else {
-        return Ok(value::undefined());
-    };
-    // Demand can arrive where no event loop is active to drive the host read.
-    if core_runtime::event_loop::reject_without_event_loop(scope, &promise, "reading a body")? {
-        return Ok(value::undefined());
-    }
-    start_host_read(scope, state, controller, promise)?;
-    Ok(value::undefined())
-}
-
-/// Read the next host chunk into `controller`, resolving `promise` once the chunk
-/// has been handled. Shared by an immediate pull and a deferred one resuming.
-fn start_host_read(
-    scope: &Scope<'_>,
-    state: HostBodySource<'_>,
-    controller: ReadableStreamDefaultController<'_>,
-    promise: Promise<'_>,
-) -> Result<(), ExnThrown> {
-    state.data_mut().pulled = true;
-    let Some(host_body) = state.data_mut().host_body.take() else {
-        // The body is gone: cancelled, or claimed for direct forwarding. Close the stream so
-        // a reader does not hang waiting for a chunk that will never arrive.
-        controller.close(scope)?;
-        promise.resolve(scope, HandleValue::undefined())?;
-        return Ok(());
-    };
-    // Remember the in-flight read so an abort can cancel it.
-    state.data_mut().current_pull = Some(Heap::from(promise));
-    // The controller and state are used after the host read, keep them rooted across it.
-    let controller = RootedHeap::new(controller);
-    let state = RootedHeap::new(state);
-    let future = async move {
-        let mut host_body = host_body;
-        let result = host_body.next_chunk().await;
-        PromiseOutcome::Resolve(Box::new(move |scope: &Scope<'_>| {
-            deliver_chunk(
-                scope,
-                controller.get(scope),
-                state.get(scope),
-                result,
-                host_body,
-            )
-            .map(|_| HandleValue::undefined())
-        }))
-    };
-    promise.spawn(PromiseFuture::new(future));
-    Ok(())
-}
-
-/// Enqueue `result`'s chunk into the controller (keeping the host body for the
-/// next pull), close at end of body, or error the stream on a read failure.
-fn deliver_chunk(
-    scope: &Scope<'_>,
-    controller: ReadableStreamDefaultController,
-    state: HostBodySource,
-    result: Result<Option<platform::http::BodyBytes>, platform::http::Error>,
-    host_body: IncomingBody,
-) -> Result<(), ExnThrown> {
-    // This pull has completed and can no longer be canceled.
-    state.data_mut().current_pull = None;
-    match result {
-        Ok(Some(bytes)) => {
-            // More may follow: keep the host body for the next pull.
-            state.data_mut().host_body = Some(host_body);
-            // Hand the host bytes to the engine without copying when they are uniquely owned
-            // and aligned (a fresh host read buffer is both); shared or unaligned chunks are
-            // copied.
-            let len = bytes.len();
-            let buffer = array_buffer_from_body_bytes(scope, bytes)?;
-            let chunk = js::typedarray::construct_view(
-                scope,
-                js::typedarray::ViewKind::Uint8,
-                buffer,
-                0,
-                len,
-            )?;
-            let chunk_value = scope.root_value(chunk.as_value());
-            // Deliver via the controller abstract operation, not the
-            // author-patchable `…prototype.enqueue` — a page must not be able to
-            // observe or corrupt the network body's bytes.
-            controller.enqueue(scope, chunk_value)?;
-        }
-        // End of body (host body dropped): close the stream.
-        Ok(None) => {
-            controller.close(scope)?;
-        }
-        // Read failure (host body dropped): error the stream.
-        Err(error) => {
-            let _ = TypeError(format!("Failed to read response body: {error}")).throw(scope);
-            let reason = js::exception::take_pending(scope).ok_or(ExnThrown)?;
-            controller.error(scope, Some(reason))?;
-        }
-    }
-    Ok(())
-}
-
-/// Underlying-source `cancel`: drop the host body, ending the host read.
-fn host_cancel(
-    scope: &Scope<'_>,
-    _args: CallbackArgs<'_>,
-    payload: HandleValue<'_>,
-) -> Result<Value, ExnThrown> {
-    let state = cast_payload::<HostBodySource>(scope, payload);
-    state.data_mut().host_body = None;
-    // The stream is being torn down, so a deferred pull's demand will never arrive.
-    state.settle_deferred_pull(scope, CloseStream::No);
-    Ok(value::undefined())
+) -> Result<(ReadableStream<'r>, NativeByteSource<'r>), ExnThrown> {
+    NativeByteSource::create_stream(scope, host_body)
 }
diff --git a/crates/builtins/web-fetch/src/lib.rs b/crates/builtins/web-fetch/src/lib.rs
index 7cd48fa2..1a306050 100644
--- a/crates/builtins/web-fetch/src/lib.rs
+++ b/crates/builtins/web-fetch/src/lib.rs
@@ -26,10 +26,8 @@ pub fn add_to_global(scope: &Scope<'_>, global: Object<'_>) {
     // `fetchLater()` / `FetchLaterResult` are deliberately not exposed: the API is
     // `[Exposed=Window]`-only and unimplemented here.
 
-    // `AbortFetchState` is an internal state object (the fetch abort algorithm), created via
-    // `create_instance_with` (so its prototype must be registered) but not web-exposed.
+    // The internal classes below are registered so instances can be created, and are not
+    // web-exposed.
     abort::AbortFetchState::add_to_global(scope, global);
-    incoming_body::HostBodySource::add_to_global(scope, global);
-    outgoing_body::OutgoingBodyPump::add_to_global(scope, global);
     body_proxy::BodyProxySource::add_to_global(scope, global);
 }
diff --git a/crates/builtins/web-fetch/src/outgoing_body.rs b/crates/builtins/web-fetch/src/outgoing_body.rs
index f08664c8..80a8c6c1 100644
--- a/crates/builtins/web-fetch/src/outgoing_body.rs
+++ b/crates/builtins/web-fetch/src/outgoing_body.rs
@@ -15,35 +15,29 @@
 //! internal reader are sent through a channel which the platform transport reads
 //! as it sends the body.
 
-use core_runtime::jsclass;
-use core_runtime::jsmethods;
-use js::class::create_instance_with;
+use std::future::Future;
+
 use js::conversion::FromJSVal;
 use js::error::ExnThrown;
-use js::gc::handle::{Heap, RootedHeap};
 use js::gc::scope::Scope;
 use js::prelude::HandleValue;
 use js::promise::{PromiseFuture, PromiseOutcome};
-use js::{Object, Promise, Uint8Array};
-use platform::http::{BodySender, OutgoingBody};
-use web_streams::readable::default_reader::{DefaultReader, DefaultReaderImpl};
-use web_streams::readable::native_read::{
-    acquire_native_reader, native_reader_read, NativeReadSteps,
+use js::{Promise, Uint8Array};
+use platform::http::{BodySender, IncomingBody, OutgoingBody};
+use web_streams::readable::default_reader::DefaultReader;
+use web_streams::readable::native_byte_source::take_untouched_reader;
+use web_streams::readable::native_pump::{
+    append_bytes, NativePump, PumpBatch, PumpEnd, PumpSink, PUMP_BATCH_BYTES,
 };
+use web_streams::readable::native_read::acquire_native_reader;
 use web_streams::readable::readable_stream::ReadableStream;
 
 use crate::incoming_body::HostBackedBodyOwner;
 
-/// A running tally of how outgoing bodies reached the transport.
-///
-/// Whether a host body is handed to the wire whole or pumped through JS chunk by chunk is
-/// deliberately not observable from content — both deliver the same bytes, leave the donor stream
-/// locked and disturbed, and read only internally. That also means losing the shortcut is invisible:
-/// every byte would start travelling through JS and nothing would fail. These counters are the one
-/// place that difference is visible, so a test can hold the choice in place.
+/// Counts of how outgoing bodies reached the transport, for tests.
 ///
-/// Whether an in-memory body's owner let go of its buffer on the way out is invisible the same way:
-/// the same bytes reach the wire either way, and only how long the buffer outlives them differs.
+/// Content cannot observe whether a host body was handed to the transport whole or pumped through
+/// JS, or whether an in-memory body's owner released its buffer when handing it over.
 pub mod paths_taken {
     use std::sync::atomic::{AtomicUsize, Ordering};
 
@@ -85,8 +79,8 @@ pub mod paths_taken {
         match body {
             platform::http::OutgoingBody::Host(_) => &SHORTCUT,
             platform::http::OutgoingBody::Stream(_) => &PUMPED,
-            // Empty ones sit out: there is no buffer to hold on to, and `Bytes::is_unique` answers
-            // for the static one an empty body carries as though it were shared.
+            // Empty ones sit out: there is no buffer to hold on to, and `Bytes::is_unique` returns
+            // `false` for the static buffer of an empty body.
             platform::http::OutgoingBody::Bytes(bytes) if !bytes.is_empty() => {
                 if bytes.is_unique() {
                     &SOLE_BYTES
@@ -135,55 +129,10 @@ fn outgoing_body_inner(
     }
 }
 
-/// State for the body pump: the reader being drained, the channel's write end, and the bytes read
-/// but not yet sent. The sender is taken out while a send waits for channel capacity, and dropped
-/// (closing the body) when the stream ends or errors.
-#[jsclass(hidden)]
-pub struct OutgoingBodyPump {
-    reader: Heap<DefaultReaderImpl>,
-    #[no_trace]
-    sender: Option<BodySender>,
-    /// Bytes of the chunks read since the last send.
-    #[no_trace]
-    batch: Vec<u8>,
-    /// How the stream ended, once its close or error steps ran, or a chunk was not a
-    /// `Uint8Array`.
-    #[no_trace]
-    end: Option<StreamEnd>,
-    /// Whether a read request is waiting for a chunk.
-    #[no_trace]
-    reading: bool,
-    /// Whether [`run`] is on the stack.
-    #[no_trace]
-    running: bool,
-}
-
-/// How a pumped stream ended.
-enum StreamEnd {
-    Closed,
-    Errored(String),
-}
-
-#[jsmethods]
-impl OutgoingBodyPump {
-    fn new() -> Self {
-        // Internal type, always created with a real reader/sender via `create_instance_with`; this
-        // hidden constructor exists only so the prototype is registered.
-        OutgoingBodyPumpImpl {
-            reader: Heap::default(),
-            sender: None,
-            batch: Vec::new(),
-            end: None,
-            reading: false,
-            running: false,
-        }
-    }
-}
-
 /// Turn a body's materialized `ReadableStream` into a [`OutgoingBody`].
 ///
 /// A host body that has never been read is handed straight through; anything
-/// else is pumped through a `DefaultReader`, or cancelled unsent where
+/// else is pumped through a `DefaultReader`, or cancelled unsent if
 /// `start_reading` is false. The pump reads through `reader` when the caller
 /// already locked the stream with one, and acquires its own otherwise.
 ///
@@ -200,21 +149,11 @@ pub(crate) fn outgoing_body_from_stream(
     // buffer the shortcut cannot see (a transform's queue), and bypassing the stream would
     // drop those bytes. The pump drains the stream in order instead. A pipe that has merely
     // _asked_ for a chunk does not count: that pull is deferred without touching the host body
-    // (see `incoming_body::host_pull`).
-    let host_body = stream
-        .native_source(scope)
-        .and_then(|source| source.cast::<crate::incoming_body::HostBodySource>().ok())
-        .and_then(|source| source.take_host_body(scope));
+    // (see `NativeByteSource`). Taking the host body leaves the stream locked and disturbed, as
+    // the pump would: author code can no longer read it and `bodyUsed` reports true.
+    let host_body = take_untouched_reader::<IncomingBody>(scope, &stream);
     match host_body {
-        Some(host_body) => {
-            // The bytes are transmitted directly, bypassing the stream, so leave the donor
-            // stream in the same locked + disturbed state the pump path (acquiring a reader)
-            // would: author code can no longer read it and `bodyUsed` reports true.
-            stream
-                .lock_and_disturb(scope)
-                .expect("If this happens, there's a bug in the runtime");
-            OutgoingBody::Host(host_body)
-        }
+        Some(host_body) => OutgoingBody::Host(host_body),
         // Cancelled rather than left alone: nothing will read this stream now, and cancelling is
         // what makes it release whatever it draws from — an upstream response feeding a transform,
         // say. It runs the handler's `cancel()`, not its `pull()`, so no content is produced.
@@ -247,253 +186,92 @@ fn pump_body_from_stream(
         Some(reader) => reader,
         None => acquire_native_reader(scope, &stream)?,
     };
-    let state = create_instance_with::<OutgoingBodyPumpImpl>(scope, |_| OutgoingBodyPumpImpl {
-        reader: Heap::from(reader),
-        sender: Some(sender),
-        batch: Vec::new(),
-        end: None,
-        reading: false,
-        running: false,
-    })?;
-    run(scope, &state);
+    let pump = NativePump::create(scope, reader, BodySink(sender), BodyBatch::default())?;
+    pump.start(scope);
     Ok(body)
 }
 
-/// The most bytes the pump reads into one batch before sending it.
-const BATCH_LIMIT: usize = 64 * 1024;
+/// The bytes of the chunks read since the last send.
+#[derive(Default)]
+struct BodyBatch(Vec<u8>);
 
-/// The pump's native read-request steps. Each records what it received in the pump's state and
-/// then calls [`run`], which does nothing when the step ran from inside it.
-const PUMP_STEPS: NativeReadSteps = NativeReadSteps {
-    chunk: pump_chunk_step,
-    close: pump_close_step,
-    error: pump_error_step,
-};
-
-/// Advance the pump. Reads chunks into the batch for as long as reads complete synchronously and
-/// the batch is below [`BATCH_LIMIT`], then sends the batch once a read has to wait, the batch is
-/// full, or the stream has ended. A batch the channel accepts right away is followed by more
-/// reads. Otherwise the pump waits until the channel accepts it (`spawn_send` resumes it), so it
-/// never outruns the peer. At most one read or send is outstanding at a time.
-fn run(scope: &Scope<'_>, state: &OutgoingBodyPump<'_>) {
-    if state.data().running {
-        return;
-    }
-    state.data_mut().running = true;
-    loop {
-        while can_read(state) {
-            state.data_mut().reading = true;
-            if read_next(scope, state).is_err() {
-                js::exception::report_and_clear(scope, "reading a request or response body");
-                state.data_mut().reading = false;
-                fail_body(state, "the body stream could not be read");
-            }
-            if state.data().reading {
-                break;
-            }
-        }
-        if !send_batch(scope, state) {
-            break;
-        }
+impl PumpBatch for BodyBatch {
+    /// Append a `Uint8Array` chunk's bytes. Any other chunk ends the body with an error, since the
+    /// spec's transmit-body chunk steps treat a non-`Uint8Array` chunk as a fatal error.
+    fn append(&mut self, scope: &Scope<'_>, chunk: HandleValue<'_>) -> Result<(), String> {
+        let Ok(array) = Uint8Array::from_jsval(scope, chunk, ()) else {
+            return Err("Body stream chunks must be of type Uint8Array".to_string());
+        };
+        // The spec's "a copy of chunk": the chunk's bytes are copied once, into the batch.
+        array
+            .with_slice(|bytes| append_bytes(&mut self.0, bytes))
+            .map_err(|_| "The body chunk could not be allocated".to_string())
     }
-    state.data_mut().running = false;
-}
-
-/// Whether the pump may issue another read: the channel is not waiting for a send, the stream has
-/// not ended, no read is outstanding, and the batch has room.
-fn can_read(state: &OutgoingBodyPump<'_>) -> bool {
-    let data = state.data();
-    data.sender.is_some() && data.end.is_none() && !data.reading && data.batch.len() < BATCH_LIMIT
-}
 
-/// Send the batch, or end the body, if there is reason to. Returns whether [`run`] should continue
-/// reading: true if the channel accepted the batch right away.
-fn send_batch(scope: &Scope<'_>, state: &OutgoingBodyPump<'_>) -> bool {
-    let mut data = state.data_mut();
-    if data.sender.is_none() {
-        // A send is waiting for capacity, or the body is done.
-        return false;
+    fn is_empty(&self) -> bool {
+        self.0.is_empty()
     }
-    let ready = data.reading || data.end.is_some() || data.batch.len() >= BATCH_LIMIT;
-    if !data.batch.is_empty() && ready {
-        let batch = std::mem::take(&mut data.batch);
-        let sent = data
-            .sender
-            .as_mut()
-            .expect("checked above")
-            .try_send_chunk(batch);
-        drop(data);
-        return match sent {
-            Ok(()) => true,
-            Err(batch) => {
-                spawn_send(scope, state, Send::Chunk(batch));
-                false
-            }
-        };
+
+    fn is_full(&self) -> bool {
+        self.0.len() >= PUMP_BATCH_BYTES
     }
-    if data.batch.is_empty() {
-        match data.end.take() {
-            // End of body: dropping the sender closes the channel.
-            Some(StreamEnd::Closed) => data.sender = None,
-            Some(StreamEnd::Errored(message)) => {
-                drop(data);
-                spawn_send(scope, state, Send::Error(message));
-            }
-            None => {}
-        }
+
+    fn take(&mut self) -> Self {
+        BodyBatch(std::mem::take(&mut self.0))
     }
-    false
 }
 
-/// Issue the next internal read, delivering to the pump's steps.
-fn read_next(scope: &Scope<'_>, state: &OutgoingBodyPump<'_>) -> Result<(), ExnThrown> {
-    let reader = state.data().reader.get(scope);
-    native_reader_read(scope, reader, PUMP_STEPS, state.as_object())
-}
+/// The write end of the channel from which the platform transport reads the body. A batch that the
+/// channel doesn't accept right away waits for capacity, so the pump never outruns the peer.
+struct BodySink(BodySender);
 
-/// A pending send to the body channel: a batch of bytes (after which the pump reads on) or a
-/// terminal error (after which the pump stops).
-enum Send {
-    Chunk(Vec<u8>),
-    Error(String),
-}
+impl PumpSink for BodySink {
+    type Batch = BodyBatch;
 
-/// Chunk steps: append a `Uint8Array` chunk's bytes to the batch. Anything else ends the body with
-/// an error, since the spec's transmit-body chunk steps treat a non-`Uint8Array` chunk as a fatal
-/// error.
-fn pump_chunk_step(
-    scope: &Scope<'_>,
-    payload: Object<'_>,
-    chunk: HandleValue<'_>,
-) -> Result<(), ExnThrown> {
-    let state = payload
-        .cast::<OutgoingBodyPump>()
-        .expect("payload is an OutgoingBodyPump");
-    let mut data = state.data_mut();
-    data.reading = false;
-    match Uint8Array::from_jsval(scope, chunk, ()) {
-        // The spec's "a copy of chunk": the chunk's bytes are copied once, into the batch.
-        Ok(array) => {
-            // SAFETY: the view's bytes are only read by the copy, which cannot run JS or trigger a
-            // GC.
-            let bytes = unsafe { array.as_array_buffer_view().bytes() };
-            // Appending to a batch reserves room up to the limit, so the batch is copied once
-            // rather than through every doubling of its capacity.
-            if !data.batch.is_empty() && data.batch.capacity() - data.batch.len() < bytes.len() {
-                let wanted = BATCH_LIMIT.max(data.batch.len() + bytes.len()) - data.batch.len();
-                data.batch.reserve_exact(wanted);
-            }
-            data.batch.extend_from_slice(bytes);
-        }
-        Err(_) => {
-            data.end = Some(StreamEnd::Errored(
-                "Body stream chunks must be of type Uint8Array".to_string(),
-            ))
-        }
+    fn try_write(&mut self, batch: BodyBatch) -> Result<(), BodyBatch> {
+        self.0.try_send_chunk(batch.0).map_err(BodyBatch)
     }
-    drop(data);
-    run(scope, &state);
-    Ok(())
-}
 
-/// Close steps: end of body, after the batch is sent.
-fn pump_close_step(scope: &Scope<'_>, payload: Object<'_>) -> Result<(), ExnThrown> {
-    let state = payload
-        .cast::<OutgoingBodyPump>()
-        .expect("payload is an OutgoingBodyPump");
-    let mut data = state.data_mut();
-    data.reading = false;
-    data.end = Some(StreamEnd::Closed);
-    drop(data);
-    run(scope, &state);
-    Ok(())
-}
+    fn write(mut self, batch: BodyBatch) -> impl Future<Output = Option<Self>> + 'static {
+        // The event loop is kept alive until the receiver accepts the batch.
+        let interest =
+            core_runtime::event_loop::with_active_event_loop(|el| el.acquire_interest_handle());
+        async move {
+            let accepted = self.0.send_chunk(batch.0).await;
+            drop(interest);
+            accepted.then_some(self)
+        }
+    }
 
-/// Error steps: abort the body with the stream's error, after the batch is sent.
-fn pump_error_step(
-    scope: &Scope<'_>,
-    payload: Object<'_>,
-    _error: HandleValue<'_>,
-) -> Result<(), ExnThrown> {
-    let state = payload
-        .cast::<OutgoingBodyPump>()
-        .expect("payload is an OutgoingBodyPump");
-    let mut data = state.data_mut();
-    data.reading = false;
-    data.end = Some(StreamEnd::Errored("body stream errored".to_string()));
-    drop(data);
-    run(scope, &state);
-    Ok(())
-}
+    fn describe_source_error(_scope: &Scope<'_>, _error: HandleValue<'_>) -> String {
+        "body stream errored".to_string()
+    }
 
-/// End the pump's body with an error, so the transport fails the send instead of treating the
-/// body as complete.
-fn fail_body(state: &OutgoingBodyPump<'_>, message: &str) {
-    if let Some(sender) = state.data_mut().sender.take() {
-        sender.fail(message.to_string());
+    /// End the body. A failed pump aborts it with the failure's message, which fails the send.
+    /// Otherwise, dropping the sender closes the channel.
+    fn finish(self, scope: &Scope<'_>, end: &PumpEnd) {
+        if let PumpEnd::Failed(message) = end {
+            spawn_send_error(scope, self.0, message.clone());
+        }
     }
 }
 
-/// Send `item` to the body channel (taking the sender out of the pump), awaiting
-/// channel capacity for backpressure. After a batch is accepted, the pump runs again.
-/// After an error, the pump stops and the sender is dropped (closing the channel after
-/// the queued error).
-fn spawn_send(scope: &Scope<'_>, state: &OutgoingBodyPump<'_>, item: Send) {
-    if state.data().sender.is_none() {
-        return;
-    }
+/// Abort the body with `message`, waiting for channel capacity so the error is queued after the
+/// chunks already sent. The sender is dropped afterwards, which closes the channel.
+fn spawn_send_error(scope: &Scope<'_>, mut sender: BodySender, message: String) {
     let Ok(promise) = Promise::new_pending(scope) else {
         js::exception::report_and_clear(scope, "sending a request or response body");
-        fail_body(state, "the body could not be sent");
-        return;
-    };
-    let Some(sender) = state.data_mut().sender.take() else {
+        sender.fail(message);
         return;
     };
     let _ = promise.set_any_is_handled(scope);
-    let state = RootedHeap::new(*state);
-    let is_chunk = matches!(item, Send::Chunk(_));
-    // Ensure the event loop stays alive until the receiver accepts the chunk or error.
+    // The event loop is kept alive until the receiver accepts the error.
     let interest =
         core_runtime::event_loop::with_active_event_loop(|el| el.acquire_interest_handle());
     let future = async move {
-        let mut sender = sender;
-        let accepted = match item {
-            Send::Chunk(bytes) => sender.send_chunk(bytes).await,
-            Send::Error(message) => {
-                sender.send_error(message).await;
-                false
-            }
-        };
-        PromiseOutcome::Resolve(Box::new(move |scope: &Scope<'_>| {
-            drop(interest);
-            if is_chunk {
-                let state = state.get(scope);
-                if accepted {
-                    state.data_mut().sender = Some(sender);
-                    run(scope, &state);
-                } else {
-                    // A refused chunk means the receiver is gone: the peer stopped reading the
-                    // body, typically because the client disconnected. Cancel the stream, and
-                    // transitively the underlying source, so it can stop producing chunks.
-                    let reader = state.data().reader.get(scope);
-                    match reader.cancel(scope, None) {
-                        // Cancelling rejects if the underlying source's `cancel()` throws.
-                        // There is no caller left to report that to: the body is already
-                        // undeliverable. Mark it handled so it is not announced as an unhandled
-                        // rejection on top.
-                        Ok(promise) => {
-                            let _ = promise.set_any_is_handled(scope);
-                        }
-                        Err(_) => js::exception::report_and_clear(
-                            scope,
-                            "cancelling an abandoned response body",
-                        ),
-                    }
-                }
-            }
-            Ok(HandleValue::undefined())
-        }))
+        sender.send_error(message).await;
+        drop(interest);
+        PromiseOutcome::Resolve(Box::new(|_scope: &Scope<'_>| Ok(HandleValue::undefined())))
     };
     promise.spawn(PromiseFuture::new(future));
 }
diff --git a/crates/builtins/web-fetch/src/request.rs b/crates/builtins/web-fetch/src/request.rs
index aa5df91f..3c70f4ff 100644
--- a/crates/builtins/web-fetch/src/request.rs
+++ b/crates/builtins/web-fetch/src/request.rs
@@ -234,7 +234,7 @@ fn request_init_if_not_empty(init: Option<RequestInit>) -> Option<RequestInit> {
 #[webidl_interface]
 pub struct Request {
     /// <https://fetch.spec.whatwg.org/#concept-request-request>
-    /// Note: The header list lives in `headers` and the body in `body`/`body_stream`.
+    /// Note: The header list lives in `headers` and the body in `body`.
     #[no_trace]
     request: RequestRecord,
     /// <https://fetch.spec.whatwg.org/#concept-request-body>, with its stream and host body.
@@ -260,7 +260,7 @@ pub type RequestInputAdapter =
     for<'s> fn(&'s Scope<'_>, HandleValue<'_>) -> Result<Option<Request<'s>>, ExnThrown>;
 
 js::instance_local! {
-    /// The adapter [`register_request_input_adapter`] registered.
+    /// The adapter registered by [`register_request_input_adapter`].
     static REQUEST_INPUT_ADAPTER: std::cell::Cell<Option<RequestInputAdapter>> =
         const { std::cell::Cell::new(None) };
 }
@@ -326,7 +326,7 @@ impl Request {
                     throw_type_error(scope, c"Failed to parse URL from Request input")
                 })?;
                 // Step 5.3: If _parsedURL_ `includes credentials`, then `throw` a `TypeError`.
-                if config::enforce_fetch_restrictions()
+                if config::web_security_restrictions()
                     && !input.is_empty()
                     && (!parsed.username().is_empty() || parsed.password().is_some())
                 {
@@ -374,7 +374,7 @@ impl Request {
         // Step 10: If _init_["`window`"] `exists` and is non-null, then `throw` a `TypeError`.
         // (There is no window in this runtime, so the rejection is a browser-model rule, gated by
         // the request-restrictions switch.)
-        if config::enforce_fetch_restrictions() {
+        if config::web_security_restrictions() {
             if let Some(window) = init.as_ref().and_then(|i| i.window.as_ref()) {
                 if !window.is_null_or_undefined() {
                     return Err(throw_type_error(scope, c"Request window must be null"));
@@ -450,7 +450,7 @@ impl Request {
         // Step 16: Let _mode_ be _init_["`mode`"] if it `exists`, and _fallbackMode_ otherwise.
         let mode = init.as_ref().and_then(|i| i.mode).or(fallback_mode);
         // Step 17: If _mode_ is "`navigate`", then `throw` a `TypeError`.
-        if config::enforce_fetch_restrictions() && mode == Some(RequestMode::Navigate) {
+        if config::web_security_restrictions() && mode == Some(RequestMode::Navigate) {
             return Err(throw_type_error(
                 scope,
                 c"Request mode must not be navigate",
@@ -473,7 +473,7 @@ impl Request {
         }
         // Step 21: If _request_’s `cache mode` is "`only-if-cached`" and _request_’s `mode` is
         //     _not_ "`same-origin`", then `throw` a `TypeError`.
-        if config::enforce_fetch_restrictions()
+        if config::web_security_restrictions()
             && request.cache_mode == RequestCache::OnlyIfCached
             && request.mode != RequestMode::SameOrigin
         {
@@ -504,7 +504,7 @@ impl Request {
                 // Step 25.2: If _method_ is not a `method` or _method_ is a `forbidden method`,
                 //     then `throw` a `TypeError`.
                 if !algorithms::is_method(&method)
-                    || (config::enforce_fetch_restrictions()
+                    || (config::web_security_restrictions()
                         && algorithms::is_forbidden_method(&method))
                 {
                     return Err(throw_type_error(scope, c"Invalid request method"));
@@ -541,7 +541,7 @@ impl Request {
         let headers = Headers::from_list(scope, init_header_list, Guard::Request)?;
         // Step 32: If `this`’s `request`’s `mode` is "`no-cors`", then:
         // (A browser-security policy, gated by the request-restrictions switch.)
-        if config::enforce_fetch_restrictions() && self.data().request.mode == RequestMode::NoCors {
+        if config::web_security_restrictions() && self.data().request.mode == RequestMode::NoCors {
             // Step 32.1: If `this`’s `request`’s `method` is not a `CORS-safelisted method`, then
             //     `throw` a `TypeError`.
             if !algorithms::is_cors_safelisted_method(&self.data().request.method) {
@@ -565,11 +565,8 @@ impl Request {
             // Step 33.4: If _headers_ is a `Headers` object, then `for each` _header_ of its
             //     `header list`, `append` _header_ to `this`’s `headers`.
             // Step 33.5: Otherwise, `fill` `this`’s `headers` with _headers_.
-            // (Filling from _init_["`headers`"] is user input and goes through the fully
-            // validating `fill`. Without it, steps 33.1/33.3/33.4 amount to re-filtering the
-            // headers' own former list — already validated and normalized, so it needs only the
-            // guard's policy filtering, which is skipped entirely when request restrictions are
-            // off; see `refill_headers_from_own_list`.)
+            // Without _init_["`headers`"], `refill_headers_from_own_list` runs steps 33.1, 33.3
+            // and 33.4.
             match init.headers.take() {
                 Some(init_headers) => {
                     headers.data_mut().header_list.clear();
@@ -650,7 +647,7 @@ impl Request {
                     }
                     // Step 39.2: If `this`’s `request`’s `mode` is neither "`same-origin`" nor
                     //     "`cors`", then throw a `TypeError`.
-                    if config::enforce_fetch_restrictions() {
+                    if config::web_security_restrictions() {
                         let mode = self.data().request.mode;
                         if mode != RequestMode::SameOrigin && mode != RequestMode::Cors {
                             return Err(throw_type_error(
@@ -710,9 +707,7 @@ impl Request {
             // bytes, so the input's own handle on them holds the buffer for a body it can no
             // longer read.
             let _ = input_request.take_byte_source();
-            if let Some(body) = input_request.data_mut().body.record.as_mut() {
-                body.source_disturbed = true;
-            }
+            input_request.set_source_disturbed();
         }
         Ok(())
     }
@@ -760,7 +755,7 @@ impl Request {
 
     /// <https://fetch.spec.whatwg.org/#dom-request-method>
     #[getter]
-    fn method(&self) -> Ref<'_, str> {
+    pub(crate) fn method(&self) -> Ref<'_, str> {
         // Step 1: Return `this`’s `request`’s `method`.
         Ref::map(self.data(), |data| data.request.method.as_str())
     }
@@ -809,7 +804,7 @@ impl Request {
 
     /// <https://fetch.spec.whatwg.org/#dom-request-mode>
     #[getter]
-    fn mode(&self) -> RequestMode {
+    pub(crate) fn mode(&self) -> RequestMode {
         // Step 1: Return `this`’s `request`’s `mode`.
         self.data().request.mode
     }
@@ -830,7 +825,7 @@ impl Request {
 
     /// <https://fetch.spec.whatwg.org/#dom-request-redirect>
     #[getter]
-    fn redirect(&self) -> RequestRedirect {
+    pub(crate) fn redirect(&self) -> RequestRedirect {
         // Step 1: Return `this`’s `request`’s `redirect mode`.
         self.data().request.redirect_mode
     }
@@ -925,9 +920,8 @@ impl Request {
         //     and `guard` is _guard_.
         let (header_list, guard) = {
             let headers = self.data().headers.get(scope);
-            let header_list = headers.data().header_list.clone();
             let guard = headers.data().guard;
-            (header_list, guard)
+            (headers.list(), guard)
         };
         let cloned_headers = Headers::from_list(scope, header_list, guard)?;
         // [inlined create a Request object] Steps 1, 2, 4: Let _requestObject_ be a `new`
@@ -1056,21 +1050,6 @@ impl Request<'_> {
     pub(crate) fn current_url(&self) -> Url {
         self.data().request.current_url().clone()
     }
-
-    /// The request's method (e.g. `"GET"`, `"HEAD"`).
-    pub(crate) fn http_method(&self) -> String {
-        self.data().request.method.clone()
-    }
-
-    /// The request's redirect mode.
-    pub(crate) fn redirect_mode(&self) -> RequestRedirect {
-        self.data().request.redirect_mode
-    }
-
-    /// The request's mode (the concept-record field, distinct from the JS `mode` getter).
-    pub(crate) fn request_mode(&self) -> RequestMode {
-        self.data().request.mode
-    }
 }
 
 impl BodyMixin for Request<'_> {
diff --git a/crates/builtins/web-fetch/src/response.rs b/crates/builtins/web-fetch/src/response.rs
index c4d3dfa8..89a14661 100644
--- a/crates/builtins/web-fetch/src/response.rs
+++ b/crates/builtins/web-fetch/src/response.rs
@@ -196,7 +196,7 @@ impl Response {
         })
     }
 
-    /// Returns a reference to the [`Url`] of this response.
+    /// The response's URL.
     pub fn url(&self) -> Option<Url> {
         self.data().response.url().cloned()
     }
@@ -273,12 +273,11 @@ impl Response {
         // Step 3: Return the result of `creating` a `Response` object, given _clonedResponse_,
         //     `this`’s `headers`’s `guard`, and `this`’s `relevant realm`.
         let headers = self.headers(scope);
-        let header_list = headers.data().header_list.clone();
         let guard = headers.data().guard;
         algorithms::create_a_response_object(
             scope,
             new_response,
-            header_list,
+            headers.list(),
             guard,
             cloned_body,
             cloned_stream,
@@ -458,33 +457,16 @@ impl Response<'_> {
         self.sync_body_accounting();
     }
 
-    /// Whether a host body is still sitting unread on this response.
-    pub(crate) fn has_unread_host_body(&self) -> bool {
-        self.data().body.host.is_some()
-    }
-
-    /// Remember the `fetch` abort algorithm's state, so consuming the body can detach it.
-    pub(crate) fn set_abort_state(&self, state: &crate::abort::AbortFetchState<'_>) {
-        self.data_mut().abort_state = Some(Heap::from(*state));
-    }
-
-    /// The body has been consumed, so an abort can no longer affect it: detach the `fetch` abort
-    /// algorithm from its signal.
-    fn detach_abort_state(&self, scope: &Scope<'_>) {
-        let state = self.data_mut().abort_state.take_rooted(scope);
-        if let Some(state) = state {
-            state.detach(scope);
-        }
-    }
-
-    /// Whether this response's `.body` stream exists and has not finished, i.e. erroring it
-    /// would still have an observable effect.
-    pub(crate) fn body_stream_is_unfinished(&self, scope: &Scope<'_>) -> bool {
-        self.data()
-            .body
-            .stream
-            .get(scope)
-            .is_some_and(|stream| stream.is_readable())
+    /// Whether an abort can still act on this response's body: it has an unread host body, or a
+    /// `.body` stream that is still readable.
+    pub(crate) fn body_is_abortable(&self, scope: &Scope<'_>) -> bool {
+        let data = self.data();
+        data.body.host.is_some()
+            || data
+                .body
+                .stream
+                .get(scope)
+                .is_some_and(|stream| stream.is_readable())
     }
 
     /// Abort this response's body: error its `.body` stream with `reason` (so pending reads
@@ -579,7 +561,7 @@ pub(crate) fn response_from_platform<'r>(
     // (Hiding the redirect target is a browser-security policy, gated by the request-restrictions
     // switch: without it, `redirect: "manual"` hands the caller the real redirect response —
     // status, `Location` header, body and all.)
-    if core_runtime::config::enforce_fetch_restrictions()
+    if core_runtime::config::web_security_restrictions()
         && redirect_mode == RequestRedirect::Manual
         && is_redirect_status(response.status)
     {
@@ -671,7 +653,10 @@ impl BodyMixin for Response<'_> {
     /// The body is being read to completion, so an abort can no longer error it:
     /// drop the `fetch` abort algorithm that was keeping this response alive.
     fn on_body_consumed(&self, scope: &Scope<'_>) {
-        self.detach_abort_state(scope);
+        let state = self.data_mut().abort_state.take_rooted(scope);
+        if let Some(state) = state {
+            state.detach(scope);
+        }
     }
 }
 
@@ -692,12 +677,7 @@ impl HostBackedBodyOwner for Response<'_> {
 impl Response<'_> {
     /// Returns a copy of the response's header list.
     pub fn headers_list(&self, scope: &Scope<'_>) -> Vec<(String, String)> {
-        self.headers(scope)
-            .data()
-            .header_list
-            .iter()
-            .map(|(name, value)| (name.clone(), value.clone()))
-            .collect()
+        self.headers(scope).list()
     }
 
     /// The response's body as a [`platform::http::OutgoingBody`] for sending on the wire, on the
diff --git a/crates/builtins/web-fetch/src/transport.rs b/crates/builtins/web-fetch/src/transport.rs
index f8df0617..0ea2ae3a 100644
--- a/crates/builtins/web-fetch/src/transport.rs
+++ b/crates/builtins/web-fetch/src/transport.rs
@@ -43,8 +43,8 @@ pub(crate) enum ResponseTainting {
 /// recurse through `main fetch`, so `send_following_redirects` re-runs it for
 /// the initial URL and for every redirect target.
 ///
-/// The request's origin is its client's. For us: the worker location's. Without
-/// one there is nothing to compare against, and in permissive server mode the
+/// The request's origin is that of its client, which here is the worker location.
+/// Without one there is nothing to compare against, and in permissive server mode the
 /// browser security policies are off wholesale, so in both cases every hop
 /// proceeds as "basic".
 fn apply_main_fetch_switch(
@@ -54,7 +54,7 @@ fn apply_main_fetch_switch(
     redirect_mode: RequestRedirect,
     tainting: &mut ResponseTainting,
 ) -> Result<(), Error> {
-    if !core_runtime::config::enforce_fetch_restrictions() {
+    if !core_runtime::config::web_security_restrictions() {
         return Ok(());
     }
     let Some(request_origin) = request_origin else {
@@ -66,8 +66,8 @@ fn apply_main_fetch_switch(
     //     "`websocket`" → set _request_'s `response tainting` to "`basic`" (and run `scheme
     //     fetch`).
     // `data:` URLs never reach the transport, "`navigate`" is rewritten to "`same-origin`" by
-    // the `Request` constructor, and there are no WebSockets, so the arm reduces to the origin
-    // check.
+    // the `Request` constructor, and no request has mode "`websocket`", so the arm reduces to the
+    // origin check.
     if *tainting == ResponseTainting::Basic && url.origin() == *request_origin {
         return Ok(());
     }
@@ -131,19 +131,15 @@ pub(crate) async fn send_following_redirects(
     let mut url_list = vec![initial_url];
     loop {
         // Build this attempt's request, taking the body: a byte body is kept for replay on a
-        // body-preserving redirect (its clone is a refcount bump, not a copy); a stream body is
-        // moved (and cannot be replayed).
-        let body_is_stream = matches!(
-            request.body,
-            OutgoingBody::Stream(_) | OutgoingBody::Host(_)
-        );
-        let send_body = match &mut request.body {
-            OutgoingBody::Bytes(bytes) => OutgoingBody::Bytes(bytes.clone()),
-            // A streamed or host-piped body is consumed by the send and cannot be replayed.
-            OutgoingBody::Stream(_) | OutgoingBody::Host(_) => {
-                std::mem::replace(&mut request.body, OutgoingBody::Consumed)
-            }
-            OutgoingBody::Consumed => OutgoingBody::Consumed,
+        // body-preserving redirect (its clone is a refcount bump, not a copy). A streamed or
+        // host-piped body is moved, since the send consumes it.
+        let (send_body, body_is_stream) = match &mut request.body {
+            OutgoingBody::Bytes(bytes) => (OutgoingBody::Bytes(bytes.clone()), false),
+            OutgoingBody::Stream(_) | OutgoingBody::Host(_) => (
+                std::mem::replace(&mut request.body, OutgoingBody::Consumed),
+                true,
+            ),
+            OutgoingBody::Consumed => (OutgoingBody::Consumed, false),
         };
         let attempt = Request {
             method: request.method.clone(),
@@ -196,8 +192,8 @@ pub(crate) async fn send_following_redirects(
         // Established above: a non-redirect status already returned as the final response.
         // [inlined location URL] Step 2: Let _location_ be the result of `extracting header list
         //     values` given `Location` and _response_'s `header list`.
-        // The `ABNF` for `Location` allows a single `header`, so a second one (identical or not)
-        // is an error.
+        // The `ABNF` for `Location` allows a single `header`, so a second one, identical or not,
+        // makes the location URL a failure.
         let mut locations = response
             .headers
             .iter()
@@ -256,10 +252,8 @@ pub(crate) async fn send_following_redirects(
         //     `includes credentials`, then return a `network error`. This catches a cross-origin
         //     resource redirecting to a same-origin URL.
         //
-        // There is no origin or response-tainting model in this runtime — the requester has no
-        // origin — so the same-origin conditions cannot be evaluated. A credentialed Location on
-        // a cors-mode request is rejected outright: the strictest reading of steps 9–10, and what
-        // browsers observe for `fetch()` (always cors-mode here) of cross-origin resources.
+        // The origin conditions are not evaluated: a credentialed Location on a cors-mode request
+        // is rejected regardless of origin, the strictest reading of steps 9 and 10.
         let includes_credentials =
             !location_url.username().is_empty() || location_url.password().is_some();
         if mode == RequestMode::Cors && includes_credentials {
@@ -303,13 +297,9 @@ pub(crate) async fn send_following_redirects(
         //     moment another origin is seen after the initial request, the `Authorization` header
         //     is removed.
         if current_url.origin() != location_url.origin() {
-            // The spec's `CORS non-wildcard request-header name` list is just
-            // `Authorization`, because in a browser `Cookie`/`Proxy-Authorization`
-            // are forbidden request headers a script cannot set. This runtime's
-            // server mode lets a handler set them (forbidden-header enforcement
-            // off), so also strip them on a cross-origin redirect — defense in
-            // depth against leaking credentials to another origin. This only ever
-            // strips *more* than the spec, never fewer.
+            // `Cookie` and `Proxy-Authorization` are stripped as well. The spec leaves them out
+            // because they are forbidden request headers, but scripts can set them when
+            // forbidden-header enforcement is off.
             request.headers.retain(|(name, _)| {
                 !name.eq_ignore_ascii_case("authorization")
                     && !name.eq_ignore_ascii_case("cookie")
@@ -347,21 +337,13 @@ pub(crate) async fn send_following_redirects(
     }
 }
 
-/// Percent-encode the non-ASCII bytes of a `Location` header value, so the URL
-/// parser resolves it as the byte sequence it is.
-///
-/// A header value is bytes, and the platform layer hands it over isomorphic-
-/// decoded, one code unit per byte. Passing that straight to the URL parser
-/// would have it treat those code units as *text* and percent-encode each one's
-/// UTF-8 encoding — so a `Location` of the three bytes `E2 98 83` would resolve
-/// to `%C3%A2%C2%98%C2%83` rather than `%E2%98%83`, a different URL. Encoding
-/// them here as the bytes they are avoids that.
-///
-/// ASCII is left untouched, so an already-escaped `%e2` keeps its spelling and
-/// a literal `%` stays literal — the URL parser does not re-encode either.
+/// Percent-encode the non-ASCII code units of an isomorphic-decoded `Location` header value as the
+/// bytes they represent, so the URL parser resolves the byte sequence rather than encoding each
+/// code unit as UTF-8 (`E2 98 83` becomes `%E2%98%83`, not `%C3%A2%C2%98%C2%83`). ASCII, including
+/// `%`, is left as is.
 ///
-/// <https://github.com/whatwg/fetch/issues/883> — the behaviour
-/// `redirect-location-escape.tentative.any.js` covers, not yet in the spec.
+/// <https://github.com/whatwg/fetch/issues/883>, tested by
+/// `redirect-location-escape.tentative.any.js`.
 fn percent_encode_location_bytes(location: &str) -> std::borrow::Cow<'_, str> {
     use std::fmt::Write;
 
diff --git a/crates/builtins/web-fetch/tests/body_memory.rs b/crates/builtins/web-fetch/tests/body_memory.rs
index 1a721691..83e279fa 100644
--- a/crates/builtins/web-fetch/tests/body_memory.rs
+++ b/crates/builtins/web-fetch/tests/body_memory.rs
@@ -24,7 +24,7 @@ fn evaluate(scope: &js::gc::scope::Scope<'_>, code: &str) {
     }
 }
 
-/// Builds 256 objects each holding a 1 MiB byte source and returns how many collections that
+/// Builds 96 objects each holding a 1 MiB byte source and returns how many collections that
 /// caused. The objects are garbage as soon as they are built, and the JS heap sees only their
 /// small wrappers.
 fn collections_while_building(constructor: &str) -> u32 {
@@ -36,7 +36,7 @@ fn collections_while_building(constructor: &str) -> u32 {
     let before = gc_count(&scope);
     evaluate(
         &scope,
-        &format!("for (let i = 0; i < 256; i++) {{ {constructor}; }}"),
+        &format!("for (let i = 0; i < 96; i++) {{ {constructor}; }}"),
     );
     gc_count(&scope) - before
 }
diff --git a/crates/builtins/web-fetch/tests/config.rs b/crates/builtins/web-fetch/tests/config.rs
index e9c40b24..8a8e29a7 100644
--- a/crates/builtins/web-fetch/tests/config.rs
+++ b/crates/builtins/web-fetch/tests/config.rs
@@ -1,16 +1,9 @@
 // SPDX-License-Identifier: Apache-2.0-WITH-LLVM-exception
 
-//! Keystone test for the request-restrictions configuration.
-//!
-//! The browser-security constraints — forbidden request headers, forbidden
-//! methods, no-CORS safelisting, origin/mode enforcement — are off by default:
-//! StarlingMonkey is primarily a server runtime, where a script must be able to
-//! set `Host` or use `CONNECT`. WPT mode turns them on by default, and an
-//! explicit `--enforce-fetch-restrictions[=bool]` overrides either default.
-//! `Runtime::init` applies the configured value, which is what these tests
-//! exercise end to end: with restrictions off, a forbidden header (`Host`) and
-//! a forbidden method (`CONNECT`) are accepted; with them on, they are
-//! filtered/rejected.
+//! The web security restrictions configuration: off by default, on by default in WPT mode, and
+//! overridable by `--web-security-restrictions[=bool]`. With restrictions off, a forbidden header
+//! (`Host`) and a forbidden method (`CONNECT`) are accepted. With them on, they are filtered or
+//! rejected.
 
 // This file contains nothing platform-specific, so skip it on wasm32.
 #![cfg(not(target_arch = "wasm32"))]
@@ -62,17 +55,17 @@ fn wpt_mode_enforces_restrictions() {
     assert_eq!(out, "host=null,connectThrew=true");
 }
 
-/// An explicit `--enforce-fetch-restrictions=false` overrides WPT mode's
-/// default, and `--enforce-fetch-restrictions` (bare) enables them without
+/// An explicit `--web-security-restrictions=false` overrides WPT mode's
+/// default, and `--web-security-restrictions` (bare) enables them without
 /// WPT mode.
 #[test]
 fn explicit_flag_overrides_either_default() {
     let config =
-        RuntimeConfig::from_arg_string("--wpt-mode --enforce-fetch-restrictions=false").unwrap();
+        RuntimeConfig::from_arg_string("--wpt-mode --web-security-restrictions=false").unwrap();
     let out = run(&config, PERMISSIVE_PROBE);
     assert_eq!(out, "host=example.com,method=CONNECT");
 
-    let config = RuntimeConfig::from_arg_string("--enforce-fetch-restrictions").unwrap();
+    let config = RuntimeConfig::from_arg_string("--web-security-restrictions").unwrap();
     let out = run(&config, ENFORCED_PROBE);
     assert_eq!(out, "host=null,connectThrew=true");
 }
@@ -85,21 +78,21 @@ fn setter_overrides_after_init() {
     libstarling::register_builtins();
     let rt = Runtime::init(&RuntimeConfig::default()).expect("runtime init");
     let scope = rt.default_global();
-    core_runtime::config::set_enforce_fetch_restrictions(true);
-    assert!(core_runtime::config::enforce_fetch_restrictions());
+    core_runtime::config::set_web_security_restrictions(true);
+    assert!(core_runtime::config::web_security_restrictions());
     assert_eq!(
         eval_and_read_out(&scope, ENFORCED_PROBE),
         "host=null,connectThrew=true"
     );
     // Restore for other tests on this thread.
-    core_runtime::config::set_enforce_fetch_restrictions(false);
+    core_runtime::config::set_web_security_restrictions(false);
 }
 
 /// `referrerPolicy` is stored and validated whether or not fetch restrictions
 /// are enforced.
 #[test]
 fn referrer_policy_is_kept_without_restrictions() {
-    let config = RuntimeConfig::from_arg_string("--enforce-fetch-restrictions=false").unwrap();
+    let config = RuntimeConfig::from_arg_string("--web-security-restrictions=false").unwrap();
     let out = run(
         &config,
         r#"
diff --git a/crates/builtins/web-fetch/tests/fetch_network.rs b/crates/builtins/web-fetch/tests/fetch_network.rs
index 8f5b8692..295b550a 100644
--- a/crates/builtins/web-fetch/tests/fetch_network.rs
+++ b/crates/builtins/web-fetch/tests/fetch_network.rs
@@ -5,39 +5,52 @@
 //! Exercises the whole networking path: the `fetch` global builds a `Request`,
 //! the platform transport (reqwest) sends it over a real TCP socket, the
 //! async-promise event-loop driver settles the promise, and the `Response` is
-//! consumed with `text()`. Networking is otherwise not covered by the offline
-//! WPT suite.
+//! consumed with `text()`.
 
 #![cfg(not(target_arch = "wasm32"))]
 
 use core_runtime::event_loop::{run_to_completion, with_event_loop, EventLoop};
 use core_runtime::runtime::{clear_global_initializers, Runtime};
 use js::conversion::FromJSVal;
+use js::gc::scope::Scope;
 use std::io::{Read, Write};
 use std::net::TcpListener;
 
-/// Start a one-shot HTTP/1.1 server on `127.0.0.1` that replies to a single
-/// request with `body`, and return its URL.
-fn start_loopback_server(body: &'static str) -> String {
+/// Start a server on `127.0.0.1` that accepts one connection per entry of `replies`, in order,
+/// replies with that entry's bytes, and return its URL.
+fn start_server(replies: Vec<Vec<u8>>) -> String {
     let listener = TcpListener::bind("127.0.0.1:0").unwrap();
     let port = listener.local_addr().unwrap().port();
     std::thread::spawn(move || {
-        if let Ok((mut stream, _)) = listener.accept() {
-            // Read the request headers (up to the blank line); we don't need the body.
-            let mut buf = [0u8; 1024];
-            let _ = stream.read(&mut buf);
-            let response = format!(
-                "HTTP/1.1 200 OK\r\nContent-Type: text/plain\r\nContent-Length: {}\r\nConnection: close\r\n\r\n{}",
-                body.len(),
-                body,
-            );
-            let _ = stream.write_all(response.as_bytes());
-            let _ = stream.flush();
+        for reply in replies {
+            if let Ok((mut stream, _)) = listener.accept() {
+                let mut buf = [0u8; 4096];
+                let _ = stream.read(&mut buf);
+                let _ = stream.write_all(&reply);
+                let _ = stream.flush();
+            }
         }
     });
     format!("http://127.0.0.1:{port}/")
 }
 
+/// A `200` reply with `body`.
+fn ok(body: &str) -> Vec<u8> {
+    format!(
+        "HTTP/1.1 200 OK\r\nContent-Length: {}\r\nConnection: close\r\n\r\n{body}",
+        body.len()
+    )
+    .into_bytes()
+}
+
+/// A `302` reply to `location`.
+fn found(location: &str) -> Vec<u8> {
+    format!(
+        "HTTP/1.1 302 Found\r\nLocation: {location}\r\nContent-Length: 0\r\nConnection: close\r\n\r\n"
+    )
+    .into_bytes()
+}
+
 /// Start a server that streams chunked data with a small delay between chunks,
 /// until the client disconnects, so a test can read some then abort mid-stream.
 fn start_streaming_server() -> String {
@@ -162,24 +175,6 @@ fn start_echo_server() -> String {
     format!("http://127.0.0.1:{port}/")
 }
 
-/// Start a one-shot server replying 302 with `location` (which may be a path,
-/// an absolute URL, or a non-HTTP URL), and return its URL.
-fn start_redirect_server(location: String) -> String {
-    let listener = TcpListener::bind("127.0.0.1:0").unwrap();
-    let port = listener.local_addr().unwrap().port();
-    std::thread::spawn(move || {
-        if let Ok((mut stream, _)) = listener.accept() {
-            let mut buf = [0u8; 4096];
-            let _ = stream.read(&mut buf);
-            let response = format!(
-                "HTTP/1.1 302 Found\r\nLocation: {location}\r\nContent-Length: 0\r\nConnection: close\r\n\r\n",
-            );
-            let _ = stream.write_all(response.as_bytes());
-        }
-    });
-    format!("http://127.0.0.1:{port}/")
-}
-
 /// Extract the `Authorization` header value out of a raw HTTP request, or "none".
 fn authorization_of(raw: &[u8]) -> String {
     String::from_utf8_lossy(raw)
@@ -192,57 +187,31 @@ fn authorization_of(raw: &[u8]) -> String {
         .unwrap_or_else(|| "none".to_string())
 }
 
-/// Start a one-shot server that echoes the request's `Authorization` header as
-/// `auth:<value-or-none>`, and return its URL.
-fn start_auth_echo_server() -> String {
+/// Start a server that echoes the request's `Authorization` header as `auth:<value-or-none>`, and
+/// return its URL. With `redirect_first`, it first redirects to `/target` on the same origin.
+fn start_auth_echo_server(redirect_first: bool) -> String {
     let listener = TcpListener::bind("127.0.0.1:0").unwrap();
     let port = listener.local_addr().unwrap().port();
     std::thread::spawn(move || {
-        if let Ok((mut stream, _)) = listener.accept() {
-            let mut buf = [0u8; 4096];
-            let n = stream.read(&mut buf).unwrap_or(0);
-            let body = format!("auth:{}", authorization_of(&buf[..n]));
-            let response = format!(
-                "HTTP/1.1 200 OK\r\nContent-Length: {}\r\nConnection: close\r\n\r\n{}",
-                body.len(),
-                body,
-            );
-            let _ = stream.write_all(response.as_bytes());
-        }
-    });
-    format!("http://127.0.0.1:{port}/")
-}
-
-/// Start a server that 302-redirects its first request to `/target` on the same
-/// origin, and answers the second request with `auth:<value-or-none>`.
-fn start_same_origin_redirect_auth_server() -> String {
-    let listener = TcpListener::bind("127.0.0.1:0").unwrap();
-    let port = listener.local_addr().unwrap().port();
-    std::thread::spawn(move || {
-        if let Ok((mut stream, _)) = listener.accept() {
-            let mut buf = [0u8; 4096];
-            let _ = stream.read(&mut buf);
-            let response = "HTTP/1.1 302 Found\r\nLocation: /target\r\nContent-Length: 0\r\nConnection: close\r\n\r\n";
-            let _ = stream.write_all(response.as_bytes());
+        if redirect_first {
+            if let Ok((mut stream, _)) = listener.accept() {
+                let mut buf = [0u8; 4096];
+                let _ = stream.read(&mut buf);
+                let _ = stream.write_all(&found("/target"));
+            }
         }
         if let Ok((mut stream, _)) = listener.accept() {
             let mut buf = [0u8; 4096];
             let n = stream.read(&mut buf).unwrap_or(0);
-            let body = format!("auth:{}", authorization_of(&buf[..n]));
-            let response = format!(
-                "HTTP/1.1 200 OK\r\nContent-Length: {}\r\nConnection: close\r\n\r\n{}",
-                body.len(),
-                body,
-            );
-            let _ = stream.write_all(response.as_bytes());
+            let _ = stream.write_all(&ok(&format!("auth:{}", authorization_of(&buf[..n]))));
         }
     });
     format!("http://127.0.0.1:{port}/")
 }
 
-/// Evaluate `code` (which sets `globalThis.__out`), drive the event loop to
-/// completion, and return `__out`.
-fn run_and_get_out(code: &str) -> String {
+/// Evaluate `code`, drive the event loop to completion, and return the result of `inspect`, which
+/// runs while the runtime is still alive.
+fn run<T>(code: &str, inspect: impl FnOnce(&Scope<'_>) -> T) -> T {
     clear_global_initializers();
     libstarling::register_builtins();
     let rt = Runtime::init(&core_runtime::config::RuntimeConfig::default()).expect("runtime init");
@@ -250,11 +219,9 @@ fn run_and_get_out(code: &str) -> String {
     let rawcx = unsafe { scope.cx_mut().raw_cx() };
     let el = EventLoop::new();
 
-    {
-        with_event_loop(&el, |_| {
-            js::compile::evaluate_with_filename(&scope, code, "<test>", 1).expect("eval failed");
-        });
-    }
+    with_event_loop(&el, |_| {
+        js::compile::evaluate_with_filename(&scope, code, "<test>", 1).expect("eval failed");
+    });
     // Drain microtasks queued during top-level evaluation (e.g. a synchronously settled promise's
     // reactions), as the runtime does before stepping the event loop.
     js::jobs::run_jobs(&scope);
@@ -264,25 +231,19 @@ fn run_and_get_out(code: &str) -> String {
         .build()
         .unwrap();
     tokio_rt.block_on(async { unsafe { run_to_completion(rawcx, &el, tokio::time::sleep).await } });
+    inspect(&scope)
+}
 
-    let out =
-        js::compile::evaluate_with_filename(&scope, "globalThis.__out", "<check>", 1).unwrap();
-    String::from_jsval(&scope, out, ()).unwrap()
+/// Evaluate `code` (which sets `globalThis.__out`), drive the event loop to completion, and
+/// return `__out`.
+fn run_and_get_out(code: &str) -> String {
+    run(code, read_out)
 }
 
-#[test]
-fn fetch_get_loopback_resolves_with_response_text() {
-    let url = start_loopback_server("hello from loopback");
-    let out = run_and_get_out(&format!(
-        r#"
-        globalThis.__out = "pending";
-        fetch("{url}")
-            .then(r => Promise.all([r.status, r.headers.get("content-type"), r.text()]))
-            .then(([status, ct, text]) => {{ globalThis.__out = `${{status}}|${{ct}}|${{text}}`; }})
-            .catch(e => {{ globalThis.__out = "error:" + e; }});
-        "#
-    ));
-    assert_eq!(out, "200|text/plain|hello from loopback");
+/// Returns `String(globalThis.__out)`.
+fn read_out(scope: &Scope<'_>) -> String {
+    let out = js::compile::evaluate_with_filename(scope, "globalThis.__out", "<check>", 1).unwrap();
+    String::from_jsval(scope, out, ()).unwrap()
 }
 
 #[test]
@@ -311,46 +272,55 @@ fn fetch_streams_a_readable_stream_request_body() {
 }
 
 #[test]
-fn fetch_pipes_a_response_body_into_a_request_body() {
-    // The incoming→outgoing shortcut: a response body used directly as another request's body is
-    // streamed straight through to the second server, which echoes it.
-    let source = start_loopback_server("piped through the shortcut");
+fn fetch_pipes_a_response_body_through_an_identity_transform() {
+    // The complex incoming→outgoing shortcut: a response body piped through an identity
+    // TransformStream into another request is still handed straight through (the native source is
+    // propagated across the identity transform), so the second server echoes it unchanged.
+    let source = start_server(vec![ok("piped through identity transform")]);
     let echo = start_echo_server();
     let out = run_and_get_out(&format!(
         r#"
         globalThis.__out = "pending";
         fetch("{source}")
-            .then(response => fetch("{echo}", {{ method: "POST", body: response.body, duplex: "half" }}))
+            .then(response => fetch("{echo}", {{
+                method: "POST",
+                body: response.body.pipeThrough(new TransformStream()),
+                duplex: "half",
+            }}))
             .then(r => r.text())
             .then(text => {{ globalThis.__out = text; }})
             .catch(e => {{ globalThis.__out = "error:" + e; }});
         "#
     ));
-    assert_eq!(out, "piped through the shortcut");
+    assert_eq!(out, "piped through identity transform");
 }
 
 #[test]
-fn fetch_pipes_a_response_body_through_an_identity_transform() {
-    // The complex incoming→outgoing shortcut: a response body piped through an identity
-    // TransformStream into another request is still handed straight through (the native source is
-    // propagated across the identity transform), so the second server echoes it unchanged.
-    let source = start_loopback_server("piped through identity transform");
+fn a_pipe_whose_body_is_taken_before_it_reads_still_finishes() {
+    // `fetch()` takes the host body before the pipe's first read, so the pipe's read finds the
+    // body gone and must close the stream rather than wait for demand that never comes.
+    let source = start_server(vec![ok("taken before the pipe reads")]);
     let echo = start_echo_server();
     let out = run_and_get_out(&format!(
         r#"
         globalThis.__out = "pending";
         fetch("{source}")
-            .then(response => fetch("{echo}", {{
-                method: "POST",
-                body: response.body.pipeThrough(new TransformStream()),
-                duplex: "half",
-            }}))
-            .then(r => r.text())
-            .then(text => {{ globalThis.__out = text; }})
+            .then(async (response) => {{
+                const transform = new TransformStream();
+                const piped = response.body.pipeTo(transform.writable);
+                const echoed = await fetch("{echo}", {{
+                    method: "POST",
+                    body: transform.readable,
+                    duplex: "half",
+                }});
+                const text = await echoed.text();
+                await piped;
+                globalThis.__out = text;
+            }})
             .catch(e => {{ globalThis.__out = "error:" + e; }});
         "#
     ));
-    assert_eq!(out, "piped through identity transform");
+    assert_eq!(out, "taken before the pipe reads");
 }
 
 #[test]
@@ -383,10 +353,7 @@ fn fetch_pumps_a_piped_multichunk_body_without_dropping_chunks() {
 #[test]
 fn a_delayed_piped_identity_transform_still_delivers_the_whole_body() {
     // A pipe left running well ahead of the `fetch` that consumes it must still deliver every
-    // byte. The pipe's first pull parks rather than reading the host body, so this takes the
-    // shortcut where it once took the pump — whichever it picks, all 40 chunks must arrive in
-    // order. (Which path ran is deliberately not content-observable: both leave the donor stream
-    // locked and disturbed, and the pump reads internally so content cannot see its reads.)
+    // byte in order. The pipe's first pull parks rather than reading the host body.
     let (source, expected) = start_multichunk_server(40);
     let echo = start_echo_server();
     let out = run_and_get_out(&format!(
@@ -434,7 +401,7 @@ fn a_parked_body_read_resumes_when_the_transform_is_read() {
 fn fetch_applies_a_non_identity_transform_to_a_piped_body() {
     // A non-identity transform must NOT be shortcut: its transform runs, so the second server sees
     // the transformed (uppercased) body.
-    let source = start_loopback_server("transform me");
+    let source = start_server(vec![ok("transform me")]);
     let echo = start_echo_server();
     let out = run_and_get_out(&format!(
         r#"
@@ -533,10 +500,9 @@ fn aborting_a_parked_body_read_rejects_rather_than_hanging() {
 #[test]
 fn transform_start_chunks_are_not_dropped_by_the_shortcut() {
     // A transformer with only a start callback is not an identity transform: its
-    // enqueued prefix must reach the destination. The incoming→outgoing shortcut
-    // previously treated any transformer without a `transform` callback as
-    // identity and handed the host body straight through, dropping the prefix.
-    let source = start_loopback_server("rest-of-body");
+    // enqueued prefix must reach the destination rather than the shortcut handing the host
+    // body straight through.
+    let source = start_server(vec![ok("rest-of-body")]);
     let echo = start_echo_server();
     let out = run_and_get_out(&format!(
         r#"
@@ -561,8 +527,8 @@ fn transform_start_chunks_are_not_dropped_by_the_shortcut() {
 fn redirect_strips_authorization_cross_origin() {
     // HTTP-redirect fetch step 13: the moment another origin is seen, the Authorization header is
     // removed. Two loopback ports are two origins.
-    let target = start_auth_echo_server();
-    let origin = start_redirect_server(target);
+    let target = start_auth_echo_server(false);
+    let origin = start_server(vec![found(&target)]);
     let out = run_and_get_out(&format!(
         r#"
         globalThis.__out = "pending";
@@ -578,7 +544,7 @@ fn redirect_strips_authorization_cross_origin() {
 #[test]
 fn redirect_keeps_authorization_same_origin() {
     // A same-origin redirect keeps the Authorization header.
-    let url = start_same_origin_redirect_auth_server();
+    let url = start_auth_echo_server(true);
     let out = run_and_get_out(&format!(
         r#"
         globalThis.__out = "pending";
@@ -592,14 +558,14 @@ fn redirect_keeps_authorization_same_origin() {
 }
 
 #[test]
-fn redirect_to_non_http_scheme_is_a_network_error() {
-    // HTTP-redirect fetch step 6: a Location whose scheme is not HTTP(S) is a network error.
-    //
-    // This confirms the observable outcome (a network error), but cannot isolate the step-6 check
-    // from the transport: the reqwest backend rejects every non-HTTP(S) scheme on its own, so a
-    // `file://` Location rejects either way. The step-6 check is the sole guard for a backend that
-    // would otherwise follow such a Location (e.g. the WASI HTTP path), which is what this asserts.
-    let origin = start_redirect_server("file:///etc/passwd".to_string());
+fn redirect_with_credentialed_location_is_a_network_error() {
+    // HTTP-redirect fetch steps 9–10: a Location that includes credentials is a network error for
+    // a cors-mode request (every fetch() here). The redirect target is a *reachable* server that
+    // returns 200, so the oracle discriminates: with the check, the fetch rejects before following
+    // (rejected:TypeError); without it, the fetch would follow and resolve (resolved:200).
+    let upstream = start_server(vec![ok("creds-followed")]);
+    let credentialed = upstream.replace("http://", "http://user:pass@");
+    let origin = start_server(vec![found(&credentialed)]);
     let out = run_and_get_out(&format!(
         r#"
         globalThis.__out = "pending";
@@ -612,36 +578,63 @@ fn redirect_to_non_http_scheme_is_a_network_error() {
 }
 
 #[test]
-fn redirect_with_credentialed_location_is_a_network_error() {
-    // HTTP-redirect fetch steps 9–10: a Location that includes credentials is a network error for
-    // a cors-mode request (every fetch() here). The redirect target is a *reachable* server that
-    // returns 200, so the oracle discriminates: with the check, the fetch rejects before following
-    // (rejected:TypeError); without it, the fetch would follow and resolve (resolved:200).
-    let upstream = start_loopback_server("creds-followed");
-    let credentialed = upstream.replace("http://", "http://user:pass@");
-    let origin = start_redirect_server(credentialed);
+fn a_transport_error_message_includes_its_causes() {
+    // Nothing listens on port 1, so connecting to it is refused.
+    let out = run_and_get_out(
+        r#"
+        globalThis.__out = "pending";
+        fetch("http://127.0.0.1:1/")
+            .then(r => { globalThis.__out = "resolved:" + r.status; })
+            .catch(e => { globalThis.__out = e.constructor.name + ":" + e.message; });
+        "#,
+    );
+    assert!(
+        out.starts_with("TypeError:Failed to fetch: ") && out.contains("refused"),
+        "{out}"
+    );
+}
+
+#[test]
+fn a_network_body_is_a_byte_stream() {
+    // A body read into views of 4 bytes arrives in chunks larger than the view. A view of 64 bytes
+    // holds the whole body.
+    let url = start_server(vec![ok("seventeen bytes!!"), ok("seventeen bytes!!")]);
     let out = run_and_get_out(&format!(
         r#"
         globalThis.__out = "pending";
-        fetch("{origin}")
-            .then(r => {{ globalThis.__out = "resolved:" + r.status; }})
-            .catch(e => {{ globalThis.__out = "rejected:" + e.constructor.name; }});
+        async function readInto(viewLength) {{
+            const response = await fetch("{url}");
+            const reader = response.body.getReader({{ mode: "byob" }});
+            const dec = new TextDecoder();
+            const reads = [];
+            for (;;) {{
+                const {{ value, done }} = await reader.read(new Uint8Array(viewLength));
+                if (done) break;
+                reads.push(dec.decode(value));
+            }}
+            return reads.join("|");
+        }}
+        (async () => {{
+            const small = await readInto(4);
+            const large = await readInto(64);
+            globalThis.__out = small + " / " + large;
+        }})().catch(e => {{ globalThis.__out = "error:" + e; }});
         "#
     ));
-    assert_eq!(out, "rejected:TypeError");
+    assert_eq!(out, "seve|ntee|n by|tes!|! / seventeen bytes!!");
 }
 
 #[test]
 fn response_body_unaffected_by_patched_controller_enqueue() {
     // A network response body is delivered through the controller abstract
-    // operation, not the author-visible ReadableStreamDefaultController.prototype
-    // methods. Patching prototype.enqueue to drop chunks must not affect the
-    // body's bytes.
-    let url = start_loopback_server("untampered body bytes");
+    // operation, not the author-visible controller prototypes' methods. Patching
+    // their `enqueue` to drop chunks must not affect the body's bytes.
+    let url = start_server(vec![ok("untampered body bytes")]);
     let out = run_and_get_out(&format!(
         r#"
         globalThis.__out = "pending";
         ReadableStreamDefaultController.prototype.enqueue = function () {{ /* drop */ }};
+        ReadableByteStreamController.prototype.enqueue = function () {{ /* drop */ }};
         fetch("{url}")
             .then(async (response) => {{
                 const reader = response.body.getReader();
@@ -666,7 +659,7 @@ fn response_body_transmitted_via_shortcut_marks_it_used() {
     // to the transport (the incoming→outgoing shortcut). The donor stream must be
     // left locked and disturbed, as if the pump had read it: bodyUsed is true and
     // the stream is locked.
-    let source = start_loopback_server("shortcut body bytes");
+    let source = start_server(vec![ok("shortcut body bytes")]);
     let echo = start_echo_server();
     let out = run_and_get_out(&format!(
         r#"
@@ -686,32 +679,15 @@ fn response_body_transmitted_via_shortcut_marks_it_used() {
     assert_eq!(out, "echoed=shortcut body bytes|used=true|locked=true");
 }
 
-/// Start a one-shot server that replies with `raw` verbatim, so a test can
-/// control the status line and header bytes exactly (including bytes that are
-/// not valid UTF-8, which no `format!`-built response could carry).
-fn start_raw_server(raw: &'static [u8]) -> String {
-    let listener = TcpListener::bind("127.0.0.1:0").unwrap();
-    let port = listener.local_addr().unwrap().port();
-    std::thread::spawn(move || {
-        if let Ok((mut stream, _)) = listener.accept() {
-            let mut buf = [0u8; 1024];
-            let _ = stream.read(&mut buf);
-            let _ = stream.write_all(raw);
-            let _ = stream.flush();
-        }
-    });
-    format!("http://127.0.0.1:{port}/")
-}
-
 #[test]
 fn status_text_is_empty_because_the_reason_phrase_is_not_recoverable() {
     // Neither transport surfaces the reason-phrase the peer sent, and it cannot be guessed from
     // the status code — a server may send any phrase, as this one does. Reporting the registered
     // phrase for the code would invent a value the peer never sent, so `statusText` stays empty.
     // Locks in the behaviour `fetch/api/basic/status.h2.any.js` depends on.
-    let url = start_raw_server(
-        b"HTTP/1.1 404 Totally Fine\r\nContent-Length: 2\r\nConnection: close\r\n\r\nhi",
-    );
+    let url = start_server(vec![
+        b"HTTP/1.1 404 Totally Fine\r\nContent-Length: 2\r\nConnection: close\r\n\r\nhi".to_vec(),
+    ]);
     let out = run_and_get_out(&format!(
         r#"
         globalThis.__out = "pending";
@@ -750,45 +726,13 @@ fn cancelling_a_derived_request_body_cancels_the_original() {
     assert_eq!(out, "cancelled=done here|derivedLocked=false");
 }
 
-/// Start a server that serves `count` sequential one-shot responses, so a test
-/// can make several fetches against one URL.
-fn start_repeating_server(count: usize, body: &'static str) -> String {
-    let listener = TcpListener::bind("127.0.0.1:0").unwrap();
-    let port = listener.local_addr().unwrap().port();
-    std::thread::spawn(move || {
-        for _ in 0..count {
-            if let Ok((mut stream, _)) = listener.accept() {
-                let mut buf = [0u8; 1024];
-                let _ = stream.read(&mut buf);
-                let response = format!(
-                    "HTTP/1.1 200 OK\r\nContent-Length: {}\r\nConnection: close\r\n\r\n{}",
-                    body.len(),
-                    body,
-                );
-                let _ = stream.write_all(response.as_bytes());
-                let _ = stream.flush();
-            }
-        }
-    });
-    format!("http://127.0.0.1:{port}/")
-}
-
 #[test]
 fn a_reused_abort_signal_does_not_accumulate_fetch_abort_algorithms() {
     // `fetch` registers an abort algorithm on the request's signal. An `AbortSignal` outlives the
     // fetches made with it, so an algorithm that is never removed accumulates one entry per fetch
     // — each rooting that fetch's promise and Response, and through the Response its host body and
     // connection. Reading each body must detach it again.
-    //
-    // Inlined rather than run through `run_and_get_out` because the signal has to be inspected
-    // while its runtime is still alive.
-    let url = start_repeating_server(3, "body");
-    clear_global_initializers();
-    libstarling::register_builtins();
-    let rt = Runtime::init(&core_runtime::config::RuntimeConfig::default()).expect("runtime init");
-    let scope = rt.default_global();
-    let rawcx = unsafe { scope.cx_mut().raw_cx() };
-    let el = EventLoop::new();
+    let url = start_server(vec![ok("body"); 3]);
     let code = format!(
         r#"
         globalThis.__out = "pending";
@@ -802,31 +746,25 @@ fn a_reused_abort_signal_does_not_accumulate_fetch_abort_algorithms() {
         }})().catch(e => {{ globalThis.__out = "error:" + e; }});
         "#
     );
-    with_event_loop(&el, |_| {
-        js::compile::evaluate_with_filename(&scope, &code, "<test>", 1).expect("eval failed");
-    });
-    js::jobs::run_jobs(&scope);
-    let tokio_rt = tokio::runtime::Builder::new_current_thread()
-        .enable_all()
-        .build()
+    let (out, count) = run(&code, |scope| {
+        // The signal is still reachable from the global, so anything it holds is still alive.
+        let signal_value = js::compile::evaluate_with_filename(
+            scope,
+            "globalThis.__controller.signal",
+            "<sig>",
+            1,
+        )
         .unwrap();
-    tokio_rt.block_on(async { unsafe { run_to_completion(rawcx, &el, tokio::time::sleep).await } });
-
-    let out =
-        js::compile::evaluate_with_filename(&scope, "globalThis.__out", "<check>", 1).unwrap();
-    assert_eq!(String::from_jsval(&scope, out, ()).unwrap(), "done");
-
-    // The signal is still reachable from the global, so anything it holds is still alive.
-    let signal_value =
-        js::compile::evaluate_with_filename(&scope, "globalThis.__controller.signal", "<sig>", 1)
+        let signal = js::Object::from_raw_value(scope, signal_value.get())
+            .unwrap()
+            .cast::<web_globals::signals::AbortSignal>()
             .unwrap();
-    let signal = js::Object::from_value(&scope, signal_value.get())
-        .unwrap()
-        .cast::<web_globals::signals::AbortSignal>()
-        .unwrap();
-    let count = web_globals::signals::algorithms::abort_algorithm_count_including_dependents(
-        &scope, &signal,
-    );
+        let count = web_globals::signals::algorithms::abort_algorithm_count_including_dependents(
+            scope, &signal,
+        );
+        (read_out(scope), count)
+    });
+    assert_eq!(out, "done");
     assert_eq!(
         count, 0,
         "3 fetches left {count} abort algorithms registered on the reused signal's dependents"
@@ -844,10 +782,7 @@ fn static_json_ignores_a_patched_json_stringify() {
         (async () => {
             let observed = false;
             JSON.stringify = () => { observed = true; return '"hijacked"'; };
-            const patchedTotal = new Response(); // keep the patch live
-            const r = Response.json({ a: 1 });
-            const text = await r.text();
-            // Also check the not-serializable path still throws a TypeError.
+            const text = await Response.json({ a: 1 }).text();
             let threw = "no";
             try { Response.json(Symbol("nope")); } catch (e) { threw = e.constructor.name; }
             globalThis.__out = `${text}|observed=${observed}|threw=${threw}`;
@@ -859,8 +794,8 @@ fn static_json_ignores_a_patched_json_stringify() {
 
 #[test]
 fn static_json_still_serializes_null_and_rejects_undefined() {
-    // A real null serializes to the string "null", while values `JSON.stringify` returns
-    // undefined for must be rejected — the two must not be conflated.
+    // A real null serializes to the string "null", while values for which
+    // `JSON.stringify` returns undefined must be rejected. The two must not be conflated.
     let out = run_and_get_out(
         r#"
         globalThis.__out = "pending";
@@ -887,43 +822,15 @@ fn static_json_still_serializes_null_and_rejects_undefined() {
     );
 }
 
-/// Start a one-shot server that captures the request head it receives and
-/// replies `ok`, so a test can assert on what actually went on the wire.
-fn start_capturing_server() -> (String, std::sync::mpsc::Receiver<String>) {
-    let listener = TcpListener::bind("127.0.0.1:0").unwrap();
-    let port = listener.local_addr().unwrap().port();
-    let (tx, rx) = std::sync::mpsc::channel();
-    std::thread::spawn(move || {
-        if let Ok((mut stream, _)) = listener.accept() {
-            // Note: long timeout because GC_ZEAL can make things real slow.
-            stream
-                .set_read_timeout(Some(std::time::Duration::from_secs(10)))
-                .ok();
-            let mut buf = Vec::new();
-            let mut tmp = [0u8; 4096];
-            while let Ok(n) = stream.read(&mut tmp) {
-                if n == 0 {
-                    break;
-                }
-                buf.extend_from_slice(&tmp[..n]);
-                if buf.windows(4).any(|w| w == b"\r\n\r\n") {
-                    break;
-                }
-            }
-            let _ = tx.send(String::from_utf8_lossy(&buf).into_owned());
-            let _ = stream
-                .write_all(b"HTTP/1.1 200 OK\r\nContent-Length: 2\r\nConnection: close\r\n\r\nok");
-        }
-    });
-    (format!("http://127.0.0.1:{port}/"), rx)
-}
-
 /// The `Content-Length` header of a request made by running `code`, or `None`.
 fn content_length_of_fetch(code: &str) -> Option<String> {
-    let (url, rx) = start_capturing_server();
+    let (url, rx) = start_byte_capture_server(
+        b"HTTP/1.1 200 OK\r\nContent-Length: 2\r\nConnection: close\r\n\r\nok",
+    );
     let out = run_and_get_out(&code.replace("URL", &url));
     assert_eq!(out, "ok", "the fetch itself failed");
     let head = rx.recv_timeout(std::time::Duration::from_secs(3)).unwrap();
+    let head = String::from_utf8_lossy(&head);
     let found: Vec<String> = head
         .lines()
         .filter(|line| {
@@ -1079,9 +986,7 @@ fn header_values_are_isomorphic_encoded_on_the_wire() {
 #[test]
 fn header_values_are_isomorphic_decoded_from_the_wire() {
     // The mirror of the above: a response header byte of 0xE6 is the code unit U+00E6, so
-    // `headers.get` must yield "bæte". This has been wrong two ways: rejecting the value as
-    // not-UTF-8 dropped the header entirely, and decoding it as UTF-8 turned the lone 0xE6 into
-    // U+FFFD. Isomorphic decoding is total, so neither can happen.
+    // `headers.get` must yield "bæte", not drop the header or decode it to U+FFFD.
     let (url, _rx) = start_byte_capture_server(
         b"HTTP/1.1 200 OK\r\nContent-Length: 2\r\nX-Echo: b\xe6te\r\nConnection: close\r\n\r\nok",
     );
@@ -1099,63 +1004,3 @@ fn header_values_are_isomorphic_decoded_from_the_wire() {
     ));
     assert_eq!(out, "62,e6,74,65");
 }
-
-/// Start a one-shot server that answers the first request with `redirect` and
-/// the second with a 200, so a test can observe where a redirect landed.
-fn start_redirecting_server(redirect: &'static [u8]) -> String {
-    let listener = TcpListener::bind("127.0.0.1:0").unwrap();
-    let port = listener.local_addr().unwrap().port();
-    std::thread::spawn(move || {
-        for hop in 0..2 {
-            if let Ok((mut stream, _)) = listener.accept() {
-                let mut buf = [0u8; 2048];
-                let _ = stream.read(&mut buf);
-                let reply: &[u8] = if hop == 0 {
-                    redirect
-                } else {
-                    b"HTTP/1.1 200 OK\r\nContent-Length: 2\r\nConnection: close\r\n\r\nok"
-                };
-                let _ = stream.write_all(reply);
-                let _ = stream.flush();
-            }
-        }
-    });
-    format!("http://127.0.0.1:{port}/")
-}
-
-#[test]
-fn a_redirect_location_is_resolved_as_bytes_not_as_text() {
-    // A `Location` header value is a byte sequence. Resolving it as text percent-encodes each
-    // decoded code unit as UTF-8, so the three bytes E2 98 83 come back as %C3%A2%C2%98%C2%83
-    // — six bytes, a different URL. They must be percent-encoded as the bytes they are.
-    let url = start_redirecting_server(
-        b"HTTP/1.1 302 Found\r\nLocation: /t?\xe2\x98\x83\r\nContent-Length: 0\r\nConnection: close\r\n\r\n",
-    );
-    let out = run_and_get_out(&format!(
-        r#"
-        globalThis.__out = "pending";
-        fetch("{url}")
-            .then(r => {{ globalThis.__out = new URL(r.url).pathname + new URL(r.url).search; }})
-            .catch(e => {{ globalThis.__out = "error:" + e; }});
-        "#
-    ));
-    assert_eq!(out, "/t?%E2%98%83");
-}
-
-#[test]
-fn a_redirect_location_preserves_already_escaped_and_literal_percents() {
-    // Escaped sequences keep their case and are not re-encoded, and a literal `%` that is not
-    // part of an escape survives — WPT's "Escaping produces double-percent" case.
-    let url = start_redirecting_server(
-        b"HTTP/1.1 302 Found\r\nLocation: /t?%\xe2\x98\x83%e2%98%83\r\nContent-Length: 0\r\nConnection: close\r\n\r\n",
-    );
-    let out = run_and_get_out(&format!(
-        r#"
-        globalThis.__out = "pending";
-        fetch("{url}")
-            .then(r => {{ globalThis.__out = new URL(r.url).search; }})
-            .catch(e => {{ globalThis.__out = "error:" + e; }});
-        "#
-    ));
-    assert_eq!(out, "?%%E2%98%83%e2%98%83");
-}
diff --git a/crates/builtins/web-globals/Cargo.toml b/crates/builtins/web-globals/Cargo.toml
index da8ec285..979f8b72 100644
--- a/crates/builtins/web-globals/Cargo.toml
+++ b/crates/builtins/web-globals/Cargo.toml
@@ -6,6 +6,10 @@ license.workspace = true
 authors.workspace = true
 edition.workspace = true
 
+[lib]
+# No unit tests. This skips building the (SpiderMonkey-sized) lib test harness binary.
+test = false
+
 [dependencies]
 bitflags.workspace = true
 core-runtime.workspace = true
diff --git a/crates/builtins/web-globals/src/base64.rs b/crates/builtins/web-globals/src/base64.rs
index 50cbf220..ccb759b6 100644
--- a/crates/builtins/web-globals/src/base64.rs
+++ b/crates/builtins/web-globals/src/base64.rs
@@ -8,23 +8,30 @@
 //!
 //! [Forgiving Base64]: https://infra.spec.whatwg.org/#forgiving-base64
 
+use js::error::{ExnThrown, ThrowException};
+use js::gc::scope::Scope;
+
+use crate::dom_exception::DOMExceptionError;
+
 #[core_runtime::jsglobals]
 pub mod base64_globals {
+    use super::BtoaError;
     use crate::dom_exception::DOMExceptionError;
 
     /// WHATWG `btoa(data)`: encode a byte string to base64.
     ///
     /// Coerces the argument to a string via `ToString`, then base64-encodes it.
     /// Throws `DOMException` with name `"InvalidCharacterError"` if the string
-    /// contains any code point above U+00FF.
-    pub fn btoa(data: String) -> Result<String, DOMExceptionError> {
+    /// contains any code point above U+00FF, and reports out of memory if the
+    /// encoded string can't be allocated.
+    pub fn btoa(data: String) -> Result<String, BtoaError> {
         // <https://html.spec.whatwg.org/#dom-btoa>: The `btoa(data)` method must throw an
         // "``InvalidCharacterError``" ``DOMException`` if _data_ contains any character whose code
         // point is greater than U+00FF. Otherwise, the user agent must convert _data_ to a byte
         // sequence whose _n_th byte is the eight-bit representation of the _n_th code point of
         // _data_, and then must apply `forgiving-base64 encode` to that byte sequence and return
         // the result.
-        super::btoa(&data).map_err(|msg| DOMExceptionError::new("InvalidCharacterError", msg))
+        super::btoa(&data)
     }
 
     /// WHATWG `atob(data)`: forgiving-base64 decode.
@@ -42,71 +49,75 @@ pub mod base64_globals {
     }
 }
 
-// ---------------------------------------------------------------------------
-// Base64 alphabet
-// ---------------------------------------------------------------------------
-
-const BASE64_CHARS: &[u8; 64] = b"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
+/// Why [`btoa`] failed.
+#[derive(Debug, PartialEq)]
+pub enum BtoaError {
+    /// The input contains a code point above U+00FF.
+    InvalidCharacter,
+    /// Allocating the encoded text failed.
+    OutOfMemory,
+}
 
-// ---------------------------------------------------------------------------
-// btoa implementation
-// ---------------------------------------------------------------------------
+impl ThrowException for BtoaError {
+    fn throw(self, scope: &Scope<'_>) -> ExnThrown {
+        match self {
+            BtoaError::InvalidCharacter => DOMExceptionError::new(
+                "InvalidCharacterError",
+                "The string to be encoded contains characters outside of the Latin1 range.",
+            )
+            .throw(scope),
+            BtoaError::OutOfMemory => js::error::OutOfMemory.throw(scope),
+        }
+    }
+}
 
 /// WHATWG `btoa`: encode a byte string to base64.
 ///
 /// The input string must contain only code points in the range U+0000..U+00FF
 /// (i.e., it must be a "byte string"). If any code point exceeds U+00FF, an
 /// `InvalidCharacterError` is thrown.
-pub(crate) fn btoa(data: &str) -> Result<String, String> {
+pub(crate) fn btoa(data: &str) -> Result<String, BtoaError> {
+    const ALPHABET: &[u8; 64] = b"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
+
     // Validate that all characters are ≤ U+00FF (Latin-1 range).
+    let mut length = 0usize;
     for ch in data.chars() {
         if ch as u32 > 0x00FF {
-            return Err(
-                "The string to be encoded contains characters outside of the Latin1 range."
-                    .to_string(),
-            );
-        }
-    }
-
-    // Collect the Latin-1 byte values.
-    let bytes: Vec<u8> = data.chars().map(|ch| ch as u8).collect();
-    Ok(base64_encode(&bytes))
-}
-
-/// Standard base64 encoding with `=` padding.
-fn base64_encode(input: &[u8]) -> String {
-    let mut output = String::with_capacity(input.len().div_ceil(3) * 4);
-
-    for chunk in input.chunks(3) {
-        let b0 = chunk[0] as u32;
-        let b1 = if chunk.len() > 1 { chunk[1] as u32 } else { 0 };
-        let b2 = if chunk.len() > 2 { chunk[2] as u32 } else { 0 };
-
-        let triple = (b0 << 16) | (b1 << 8) | b2;
-
-        output.push(BASE64_CHARS[((triple >> 18) & 0x3F) as usize] as char);
-        output.push(BASE64_CHARS[((triple >> 12) & 0x3F) as usize] as char);
-
-        if chunk.len() > 1 {
-            output.push(BASE64_CHARS[((triple >> 6) & 0x3F) as usize] as char);
-        } else {
-            output.push('=');
-        }
-
-        if chunk.len() > 2 {
-            output.push(BASE64_CHARS[(triple & 0x3F) as usize] as char);
-        } else {
-            output.push('=');
+            return Err(BtoaError::InvalidCharacter);
         }
+        length += 1;
     }
 
+    // Encode the Latin-1 byte values with `=` padding.
+    let mut output = String::new();
+    let encoded_length = length
+        .div_ceil(3)
+        .checked_mul(4)
+        .ok_or(BtoaError::OutOfMemory)?;
     output
+        .try_reserve_exact(encoded_length)
+        .map_err(|_| BtoaError::OutOfMemory)?;
+    let mut bytes = data.chars().map(|ch| ch as u8);
+    while let Some(b0) = bytes.next() {
+        let b1 = bytes.next();
+        let b2 = bytes.next();
+        let triple =
+            (u32::from(b0) << 16) | (u32::from(b1.unwrap_or(0)) << 8) | u32::from(b2.unwrap_or(0));
+
+        output.push(ALPHABET[((triple >> 18) & 0x3F) as usize] as char);
+        output.push(ALPHABET[((triple >> 12) & 0x3F) as usize] as char);
+        output.push(match b1 {
+            Some(_) => ALPHABET[((triple >> 6) & 0x3F) as usize] as char,
+            None => '=',
+        });
+        output.push(match b2 {
+            Some(_) => ALPHABET[(triple & 0x3F) as usize] as char,
+            None => '=',
+        });
+    }
+    Ok(output)
 }
 
-// ---------------------------------------------------------------------------
-// atob implementation
-// ---------------------------------------------------------------------------
-
 /// WHATWG `atob`: forgiving-base64 decode.
 ///
 /// Forgiving-base64 decodes `data` and returns the decoded byte string as a
@@ -131,207 +142,3 @@ pub fn forgiving_base64_decode(data: &str) -> Result<Vec<u8>, String> {
     data_url::forgiving_base64::decode_to_vec(data.as_bytes())
         .map_err(|_| "The string to be decoded is not correctly encoded.".to_string())
 }
-
-// Nothing platform-specific in these tests, so skip them on wasm32.
-#[cfg(all(test, not(target_arch = "wasm32")))]
-mod tests {
-    use crate::base64::{atob, btoa};
-
-    // -- btoa tests --
-
-    #[test]
-    fn btoa_empty() {
-        assert_eq!(btoa("").unwrap(), "");
-    }
-
-    #[test]
-    fn btoa_basic() {
-        assert_eq!(btoa("ab").unwrap(), "YWI=");
-        assert_eq!(btoa("abc").unwrap(), "YWJj");
-        assert_eq!(btoa("abcd").unwrap(), "YWJjZA==");
-        assert_eq!(btoa("abcde").unwrap(), "YWJjZGU=");
-    }
-
-    #[test]
-    fn btoa_latin1() {
-        assert_eq!(btoa("\u{FF}\u{FF}\u{C0}").unwrap(), "///A");
-    }
-
-    #[test]
-    fn btoa_null_bytes() {
-        assert_eq!(btoa("\0a").unwrap(), "AGE=");
-        assert_eq!(btoa("a\0b").unwrap(), "YQBi");
-    }
-
-    #[test]
-    fn btoa_coerced_types() {
-        // These test the JS-side coercion, but we can verify the Rust core:
-        assert_eq!(btoa("undefined").unwrap(), "dW5kZWZpbmVk");
-        assert_eq!(btoa("null").unwrap(), "bnVsbA==");
-        assert_eq!(btoa("7").unwrap(), "Nw==");
-        assert_eq!(btoa("true").unwrap(), "dHJ1ZQ==");
-        assert_eq!(btoa("false").unwrap(), "ZmFsc2U=");
-        assert_eq!(btoa("NaN").unwrap(), "TmFO");
-    }
-
-    #[test]
-    fn btoa_rejects_non_latin1() {
-        let result = btoa("עברית");
-        assert!(result.is_err());
-        assert!(result.unwrap_err().contains("outside of the Latin1 range"));
-    }
-
-    #[test]
-    fn btoa_all_single_bytes() {
-        // U+0000..U+00FF should all succeed
-        for i in 0..=0xFF_u32 {
-            let ch = char::from_u32(i).unwrap();
-            let s = ch.to_string();
-            assert!(btoa(&s).is_ok(), "btoa should accept U+{i:04X}");
-        }
-    }
-
-    #[test]
-    fn btoa_first_non_latin1() {
-        // U+0100 should fail
-        let ch = char::from_u32(0x100).unwrap();
-        assert!(btoa(&ch.to_string()).is_err());
-    }
-
-    // -- atob tests --
-
-    #[test]
-    fn atob_empty() {
-        assert_eq!(atob("").unwrap(), "");
-    }
-
-    #[test]
-    fn atob_basic() {
-        assert_eq!(atob("YWI=").unwrap(), "ab");
-        assert_eq!(atob("YWJj").unwrap(), "abc");
-        assert_eq!(atob("YWJjZA==").unwrap(), "abcd");
-        assert_eq!(atob("YWJjZGU=").unwrap(), "abcde");
-    }
-
-    #[test]
-    fn atob_no_padding() {
-        // atob should work without padding too
-        assert_eq!(atob("YWI").unwrap(), "ab");
-        assert_eq!(atob("YWJjZA").unwrap(), "abcd");
-    }
-
-    #[test]
-    fn atob_whitespace_stripping() {
-        assert_eq!(atob(" Y W J j ").unwrap(), "abc");
-        assert_eq!(atob("\tYWJj\n").unwrap(), "abc");
-        assert_eq!(atob("\r\nYWJj\r\n").unwrap(), "abc");
-    }
-
-    #[test]
-    fn atob_invalid_length() {
-        // After stripping whitespace and removing padding, length % 4 == 1 is invalid
-        let result = atob("A");
-        assert!(result.is_err());
-        assert!(result.unwrap_err().contains("not correctly encoded"));
-    }
-
-    #[test]
-    fn atob_invalid_chars() {
-        let result = atob("====");
-        assert!(result.is_err());
-    }
-
-    #[test]
-    fn atob_roundtrip() {
-        for s in &["", "a", "ab", "abc", "abcd", "hello world", "\0\x01\x7F"] {
-            let encoded = btoa(s).unwrap();
-            let decoded = atob(&encoded).unwrap();
-            assert_eq!(*s, decoded, "roundtrip failed for {:?}", s);
-        }
-    }
-
-    // -- Integration tests (require JS engine) --
-
-    mod integration {
-        use core_runtime::test_util::{eval_with_setup, throws_with_setup};
-
-        fn eval(code: &str) -> String {
-            eval_with_setup(
-                || {
-                    core_runtime::runtime::register_global_initializer(crate::add_to_global);
-                },
-                code,
-            )
-        }
-
-        fn eval_throws(code: &str) -> bool {
-            throws_with_setup(
-                || {
-                    core_runtime::runtime::register_global_initializer(crate::add_to_global);
-                },
-                code,
-            )
-        }
-
-        #[test]
-        fn js_btoa_basic() {
-            assert_eq!(eval("btoa('abc')"), "YWJj");
-            assert_eq!(eval("btoa('')"), "");
-            assert_eq!(eval("btoa('abcde')"), "YWJjZGU=");
-        }
-
-        #[test]
-        fn js_atob_basic() {
-            assert_eq!(eval("atob('YWJj')"), "abc");
-            assert_eq!(eval("atob('')"), "");
-        }
-
-        #[test]
-        fn js_btoa_throws_on_non_latin1() {
-            assert!(eval_throws("btoa('\\u0100')"));
-        }
-
-        #[test]
-        fn js_btoa_throws_dom_exception() {
-            // btoa must throw a DOMException with name "InvalidCharacterError"
-            assert_eq!(
-                eval(
-                    "try { btoa('\\u0100'); 'no-throw' } catch(e) { \
-                     (e instanceof DOMException) + ',' + e.name + ',' + e.code }"
-                ),
-                "true,InvalidCharacterError,5"
-            );
-        }
-
-        #[test]
-        fn js_atob_throws_on_invalid() {
-            assert!(eval_throws("atob('====')"));
-        }
-
-        #[test]
-        fn js_atob_throws_dom_exception() {
-            // atob must throw a DOMException with name "InvalidCharacterError"
-            assert_eq!(
-                eval(
-                    "try { atob('===='); 'no-throw' } catch(e) { \
-                     (e instanceof DOMException) + ',' + e.name + ',' + e.code }"
-                ),
-                "true,InvalidCharacterError,5"
-            );
-        }
-
-        #[test]
-        fn js_roundtrip() {
-            assert_eq!(eval("atob(btoa('hello'))"), "hello");
-        }
-
-        #[test]
-        fn js_btoa_coercion() {
-            // JS coerces arguments to string: btoa(undefined) encodes "undefined"
-            assert_eq!(eval("btoa(undefined)"), "dW5kZWZpbmVk");
-            assert_eq!(eval("btoa(null)"), "bnVsbA==");
-            assert_eq!(eval("btoa(7)"), "Nw==");
-            assert_eq!(eval("btoa(true)"), "dHJ1ZQ==");
-        }
-    }
-}
diff --git a/crates/builtins/web-globals/src/console.rs b/crates/builtins/web-globals/src/console.rs
deleted file mode 100644
index 1b57310b..00000000
--- a/crates/builtins/web-globals/src/console.rs
+++ /dev/null
@@ -1,79 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0-WITH-LLVM-exception
-
-//! Minimal `console` object implementation.
-//!
-//! Provides `console.log`, `console.warn`, `console.error`, `console.info`,
-//! and `console.debug`. Each method converts its arguments to strings via
-//! `ToString` and prints them space-separated to stdout (for `log`, `info`,
-//! `debug`) or stderr (for `warn`, `error`).
-
-use std::io::Write;
-use std::ptr::NonNull;
-
-use js::gc::scope::Scope;
-use js::native::CallArgs;
-
-/// Format call arguments as a space-separated string.
-///
-/// Each argument is converted to a string via the JS `ToString` operation.
-fn format_args(scope: &Scope<'_>, args: &CallArgs) -> String {
-    let mut parts = Vec::with_capacity(args.argc_ as usize);
-    for i in 0..args.argc_ {
-        // SAFETY: `args.get(i)` dereferences vp which is valid for the duration
-        // of the native call.
-        let val = *args.get(i);
-        // Fast path for strings; slow path calls JS ToString.
-        let js_str = if val.is_string() {
-            NonNull::new(val.to_string())
-                .map(|p| js::JSString::from_non_null(scope, p))
-        } else {
-            js::JSString::from_value(scope, val).ok()
-        };
-        match js_str {
-            Some(s) => match s.to_utf8(scope) {
-                Ok(utf8) => parts.push(utf8),
-                Err(_) => parts.push(String::from("[error converting to UTF-8]")),
-            },
-            None => parts.push(String::from("[error converting to string]")),
-        }
-    }
-    parts.join(" ")
-}
-
-/// Print to stdout (for `log`, `info`, `debug`).
-fn print_stdout(scope: &Scope<'_>, args: &CallArgs) {
-    let output = format_args(scope, args);
-    let _ = writeln!(std::io::stdout(), "{output}");
-}
-
-/// Print to stderr (for `warn`, `error`).
-fn print_stderr(scope: &Scope<'_>, args: &CallArgs) {
-    let output = format_args(scope, args);
-    let _ = writeln!(std::io::stderr(), "{output}");
-}
-
-#[core_runtime::jsnamespace(name = "console")]
-pub mod console_ns {
-    use js::gc::scope::Scope;
-    use js::native::CallArgs;
-
-    pub fn log(scope: &Scope<'_>, args: &CallArgs) {
-        super::print_stdout(scope, args);
-    }
-
-    pub fn info(scope: &Scope<'_>, args: &CallArgs) {
-        super::print_stdout(scope, args);
-    }
-
-    pub fn debug(scope: &Scope<'_>, args: &CallArgs) {
-        super::print_stdout(scope, args);
-    }
-
-    pub fn warn(scope: &Scope<'_>, args: &CallArgs) {
-        super::print_stderr(scope, args);
-    }
-
-    pub fn error(scope: &Scope<'_>, args: &CallArgs) {
-        super::print_stderr(scope, args);
-    }
-}
diff --git a/crates/builtins/web-globals/src/dom_exception.rs b/crates/builtins/web-globals/src/dom_exception.rs
index b3a44d1f..4c42cb65 100644
--- a/crates/builtins/web-globals/src/dom_exception.rs
+++ b/crates/builtins/web-globals/src/dom_exception.rs
@@ -6,9 +6,6 @@
 //! including the constructor, prototype accessors, legacy error code constants,
 //! and the `Symbol.toStringTag` property.
 //!
-//! Uses `#[webidl_interface]` and `#[webidl_methods]` proc macros for declarative
-//! class registration.
-//!
 //! [`DOMException`]: https://webidl.spec.whatwg.org/#idl-DOMException
 
 use core_runtime::{webidl_interface, webidl_methods};
@@ -18,10 +15,6 @@ use js::gc::scope::Scope;
 use js::native::ExceptionStackBehavior;
 use js::prelude::ToJSVal;
 
-// ---------------------------------------------------------------------------
-// DOMException names table
-// ---------------------------------------------------------------------------
-
 /// https://webidl.spec.whatwg.org/#dfn-error-names-table
 ///
 /// Maps DOMException error names to their legacy error code values.
@@ -57,22 +50,13 @@ const ERROR_NAMES: &[(&str, u16)] = &[
 /// "Return the legacy code indicated in the error names table for this
 /// DOMException object's name, or 0 if no such entry exists."
 fn legacy_code_for_name(name: &str) -> u16 {
-    for &(n, code) in ERROR_NAMES {
-        if n == name {
-            return code;
-        }
-    }
-    0
+    ERROR_NAMES
+        .iter()
+        .find(|(n, _)| *n == name)
+        .map_or(0, |&(_, code)| code)
 }
 
-// ---------------------------------------------------------------------------
-// DOMException class
-// ---------------------------------------------------------------------------
-
-/// Internal data for a `DOMException` instance.
-///
-/// Stores the exception name and message as Rust `String`s. The legacy
-/// error code is computed from the name on demand via `legacy_code_for_name`.
+/// <https://webidl.spec.whatwg.org/#idl-DOMException>
 #[webidl_interface(js_proto = "Error")]
 pub struct DOMException {
     name: String,
@@ -81,9 +65,6 @@ pub struct DOMException {
 
 #[webidl_methods]
 impl DOMException {
-    // -----------------------------------------------------------------------
-    // Legacy error code constants (WebIDL §2.8.1)
-    // -----------------------------------------------------------------------
     pub const INDEX_SIZE_ERR: u16 = 1;
     pub const DOMSTRING_SIZE_ERR: u16 = 2;
     pub const HIERARCHY_REQUEST_ERR: u16 = 3;
@@ -110,10 +91,6 @@ impl DOMException {
     pub const INVALID_NODE_TYPE_ERR: u16 = 24;
     pub const DATA_CLONE_ERR: u16 = 25;
 
-    // -----------------------------------------------------------------------
-    // Constructor
-    // -----------------------------------------------------------------------
-
     /// https://webidl.spec.whatwg.org/#dom-domexception-domexception
     ///
     /// `constructor(optional DOMString message = "", optional DOMString name = "Error")`
@@ -130,25 +107,21 @@ impl DOMException {
     /// Creates a new `DOMException`.
     ///
     /// In difference to the JS-facing constructor `new_js`, both arguments
-    /// to `new` are required, with no defaults.`
+    /// to `new` are required, with no defaults.
     pub fn new(message: String, name: String) -> Self {
         Self { name, message }
     }
 
-    // -----------------------------------------------------------------------
-    // Getters
-    // -----------------------------------------------------------------------
-
     /// https://webidl.spec.whatwg.org/#dom-domexception-name
     #[getter]
-    fn name(&self) -> Ref<'_, str> {
+    pub fn name(&self) -> Ref<'_, str> {
         // Return `this`'s `name`.
         Ref::map(self.data(), |data| data.name.as_str())
     }
 
     /// https://webidl.spec.whatwg.org/#dom-domexception-message
     #[getter]
-    fn message(&self) -> Ref<'_, str> {
+    pub fn message(&self) -> Ref<'_, str> {
         // Return `this`'s `message`.
         Ref::map(self.data(), |data| data.message.as_str())
     }
@@ -158,36 +131,26 @@ impl DOMException {
     /// Returns the legacy code indicated in the error names table for this
     /// DOMException object's name, or 0 if no such entry exists.
     #[getter]
-    fn code(&self) -> i32 {
+    pub fn code(&self) -> i32 {
         legacy_code_for_name(&self.data().name) as i32
     }
 }
 
-// ---------------------------------------------------------------------------
-// Public API: throw_dom_exception
-// ---------------------------------------------------------------------------
-
 /// Throw a DOMException with the given name and message.
 ///
 /// This creates a new DOMException object and sets it as the pending exception.
 pub fn throw_dom_exception(scope: &Scope<'_>, name: &str, message: &str) -> ExnThrown {
-    // Get the DOMException constructor from the global.
     let exception = match DOMException::new(scope, message.into(), name.into()) {
         Ok(exc) => exc,
         Err(_) => return ExnThrown,
     };
 
-    // Set the created DOMException as the pending exception.
     let exc_val = exception
         .to_jsval(scope)
         .expect("Value conversion doesn't fail");
     js::exception::set_pending(scope, exc_val, ExceptionStackBehavior::Capture)
 }
 
-// ---------------------------------------------------------------------------
-// DOMExceptionError — typed error for use with ThrowException
-// ---------------------------------------------------------------------------
-
 /// A typed error representing a `DOMException` to be thrown.
 ///
 /// Use this as the `Err` type in `Result<T, DOMExceptionError>` in
@@ -239,276 +202,3 @@ impl ThrowException for DOMExceptionError {
         throw_dom_exception(scope, self.name, &self.message)
     }
 }
-
-// Nothing platform-specific in these tests, so skip them on wasm32.
-#[cfg(all(test, not(target_arch = "wasm32")))]
-mod dom_exception_integration {
-    use core_runtime::{
-        config::RuntimeConfig,
-        runtime::{self, Runtime},
-        test_util::eval_with_setup,
-    };
-
-    fn eval(code: &str) -> String {
-        eval_with_setup(
-            || {
-                runtime::register_global_initializer(super::DOMException::add_to_global);
-            },
-            code,
-        )
-    }
-
-    #[test]
-    fn constructor_no_args() {
-        assert_eq!(eval("let e = new DOMException(); e.name"), "Error");
-        assert_eq!(eval("let e = new DOMException(); e.message"), "");
-        assert_eq!(eval("let e = new DOMException(); e.code"), "0");
-    }
-
-    #[test]
-    fn rust_new() {
-        runtime::register_global_initializer(super::DOMException::add_to_global);
-        let rt = Runtime::init(&RuntimeConfig::default()).expect("runtime init");
-        let scope = rt.default_global();
-        let e = super::DOMException::new(&scope, String::new(), "Error".into()).unwrap();
-        assert_eq!(&*e.name(), "Error");
-        assert_eq!(&*e.message(), "");
-        assert_eq!(e.code(), 0);
-    }
-
-    #[test]
-    fn constructor_message_only() {
-        assert_eq!(eval("new DOMException('hello').message"), "hello");
-        assert_eq!(eval("new DOMException('hello').name"), "Error");
-    }
-
-    #[test]
-    fn constructor_message_and_name() {
-        assert_eq!(
-            eval("new DOMException('msg', 'NotFoundError').name"),
-            "NotFoundError"
-        );
-        assert_eq!(eval("new DOMException('msg', 'NotFoundError').code"), "8");
-    }
-
-    #[test]
-    fn instanceof() {
-        assert_eq!(eval("new DOMException() instanceof DOMException"), "true");
-        assert_eq!(eval("new DOMException() instanceof Error"), "true");
-    }
-
-    #[test]
-    fn prototype_chain() {
-        assert_eq!(
-            eval("Object.getPrototypeOf(DOMException.prototype) === Error.prototype"),
-            "true"
-        );
-    }
-
-    #[test]
-    fn to_string_tag() {
-        assert_eq!(
-            eval("Object.prototype.toString.call(new DOMException())"),
-            "[object DOMException]"
-        );
-    }
-
-    #[test]
-    fn constants_on_constructor() {
-        assert_eq!(eval("DOMException.INDEX_SIZE_ERR"), "1");
-        assert_eq!(eval("DOMException.NOT_FOUND_ERR"), "8");
-        assert_eq!(eval("DOMException.NOT_SUPPORTED_ERR"), "9");
-        assert_eq!(eval("DOMException.INVALID_STATE_ERR"), "11");
-        assert_eq!(eval("DOMException.SYNTAX_ERR"), "12");
-    }
-
-    #[test]
-    fn constants_on_prototype() {
-        assert_eq!(eval("DOMException.prototype.INDEX_SIZE_ERR"), "1");
-        assert_eq!(eval("DOMException.prototype.NOT_FOUND_ERR"), "8");
-    }
-
-    #[test]
-    fn code_not_affected_by_name_shadow() {
-        assert_eq!(
-            eval(
-                "let e = new DOMException('msg', 'InvalidCharacterError'); \
-                    Object.defineProperty(e, 'name', { value: 'WrongDocumentError' }); \
-                    e.code"
-            ),
-            "5"
-        );
-    }
-
-    #[test]
-    fn brand_check_rejects_non_instance() {
-        // Calling getter on a non-DOMException should throw TypeError.
-        assert_eq!(
-            eval(
-                "let getter = Object.getOwnPropertyDescriptor(\
-                        DOMException.prototype, 'name').get; \
-                    try { getter.call({}); 'no-throw' } catch(e) { e instanceof TypeError }"
-            ),
-            "true"
-        );
-    }
-
-    #[test]
-    fn requires_new() {
-        // DOMException() without `new` should throw TypeError.
-        assert_eq!(
-            eval("try { DOMException(); 'no-throw' } catch(e) { e instanceof TypeError }"),
-            "true"
-        );
-    }
-
-    #[test]
-    fn stack_property() {
-        assert_eq!(eval("typeof (new DOMException()).stack"), "string");
-    }
-
-    #[test]
-    fn inherits_tostring_from_error() {
-        assert_eq!(
-            eval("new DOMException('hello', 'TestError').toString()"),
-            "TestError: hello"
-        );
-    }
-}
-
-/// Tests for typed error dispatch via `ThrowException` trait.
-///
-/// These tests use `#[jsglobals]` to register functions that return
-/// `Result<T, TypeError>`, `Result<T, RangeError>`, `Result<T, SyntaxError>`,
-/// `Result<T, DOMExceptionError>`, and `Result<T, String>`.
-// Nothing platform-specific in these tests, so skip them on wasm32.
-#[cfg(all(test, not(target_arch = "wasm32")))]
-mod throw_exception_integration {
-    use crate::dom_exception::DOMExceptionError;
-    use core_runtime::{jsglobals, test_util::eval_with_setup};
-    use js::error::{RangeError, SyntaxError, TypeError};
-
-    #[jsglobals]
-    mod test_error_globals {
-        use super::*;
-
-        /// Throws a TypeError.
-        pub fn throw_type_error() -> Result<(), TypeError> {
-            Err(TypeError("test type error".into()))
-        }
-
-        /// Throws a RangeError.
-        pub fn throw_range_error() -> Result<(), RangeError> {
-            Err(RangeError("test range error".into()))
-        }
-
-        /// Throws a SyntaxError.
-        pub fn throw_syntax_error() -> Result<(), SyntaxError> {
-            Err(SyntaxError("test syntax error".into()))
-        }
-
-        /// Throws a TypeError from a String error.
-        pub fn throw_string_error() -> Result<(), String> {
-            Err("test string error".into())
-        }
-
-        /// Throws a DOMExceptionError.
-        pub fn throw_dom_exception_error() -> Result<(), DOMExceptionError> {
-            Err(DOMExceptionError::new(
-                "NotFoundError",
-                "test dom exception",
-            ))
-        }
-
-        /// Succeeds.
-        pub fn no_error() -> Result<i32, TypeError> {
-            Ok(42)
-        }
-    }
-
-    fn eval(code: &str) -> String {
-        eval_with_setup(
-            || {
-                core_runtime::runtime::register_global_initializer(
-                    crate::dom_exception::DOMException::add_to_global,
-                );
-                core_runtime::runtime::register_global_initializer(
-                    test_error_globals::add_to_global,
-                );
-            },
-            code,
-        )
-    }
-
-    /// Capturing the stack for a new `DOMException` is best-effort: a throwing
-    /// `Error.prototype.stack` accessor leaves the construction intact and no
-    /// exception pending.
-    #[test]
-    fn construction_survives_a_throwing_stack_accessor() {
-        assert_eq!(
-            eval(
-                "Object.defineProperty(Error.prototype, 'stack', { get() { throw 1; }, configurable: true });
-                 const e = new DOMException('m', 'NotFoundError');
-                 e.name + ',' + e.message"
-            ),
-            "NotFoundError,m"
-        );
-    }
-
-    #[test]
-    fn type_error_thrown() {
-        assert_eq!(
-            eval(
-                "try { throwTypeError(); 'no' } catch(e) { (e instanceof TypeError) + ',' + e.message }"
-            ),
-            "true,test type error"
-        );
-    }
-
-    #[test]
-    fn range_error_thrown() {
-        assert_eq!(
-            eval(
-                "try { throwRangeError(); 'no' } catch(e) { (e instanceof RangeError) + ',' + e.message }"
-            ),
-            "true,test range error"
-        );
-    }
-
-    #[test]
-    fn syntax_error_thrown() {
-        assert_eq!(
-            eval(
-                "try { throwSyntaxError(); 'no' } catch(e) { (e instanceof SyntaxError) + ',' + e.message }"
-            ),
-            "true,test syntax error"
-        );
-    }
-
-    #[test]
-    fn string_error_throws_type_error() {
-        // String errors throw TypeError.
-        assert_eq!(
-            eval(
-                "try { throwStringError(); 'no' } catch(e) { (e instanceof TypeError) + ',' + e.message }"
-            ),
-            "true,test string error"
-        );
-    }
-
-    #[test]
-    fn dom_exception_error_thrown() {
-        assert_eq!(
-            eval(
-                "try { throwDomExceptionError(); 'no' } catch(e) { \
-                    (e instanceof DOMException) + ',' + e.name + ',' + e.message }"
-            ),
-            "true,NotFoundError,test dom exception"
-        );
-    }
-
-    #[test]
-    fn success_returns_value() {
-        assert_eq!(eval("noError()"), "42");
-    }
-}
diff --git a/crates/builtins/web-globals/src/encoding/text_decoder.rs b/crates/builtins/web-globals/src/encoding/text_decoder.rs
index 12d40100..e7242a44 100644
--- a/crates/builtins/web-globals/src/encoding/text_decoder.rs
+++ b/crates/builtins/web-globals/src/encoding/text_decoder.rs
@@ -3,7 +3,7 @@
 //! <https://encoding.spec.whatwg.org/#textdecoder>
 
 use core_runtime::{webidl_dictionary, webidl_interface, webidl_methods, webidl_union};
-use js::error::{ExnThrown, RangeError};
+use js::error::{ExnThrown, OutOfMemory, RangeError, ThrowException};
 use js::gc::scope::Scope;
 use js::{ArrayBuffer, ArrayBufferView, JSString};
 
@@ -107,79 +107,73 @@ impl TextDecoder<'_> {
 
         // Step 3: If _input_ is given, then `push` a `copy of` _input_ to `this`'s `I/O queue`.
         //         (We decode directly from _input_'s bytes. Nothing retains them after this call.)
-        // SAFETY: `input` is rooted via the Uint8Array handle and the slice
-        // is only borrowed for the duration of the decode call below, which
-        // is pure CPU work in `encoding_rs` and cannot trigger GC or detach
-        // the underlying buffer.
-        let bytes: &[u8] = match input {
-            Some(ArrayBufferViewOrArrayBuffer::Buffer(input)) => unsafe { input.bytes() },
-            Some(ArrayBufferViewOrArrayBuffer::View(input)) => unsafe { input.bytes() },
-            None => &[],
-        };
-
-        // windows-1252 decodes every byte outside 0x80..=0x9F to the code point of the same
-        // value, and its decoder keeps no state between calls, so such input is its own
-        // Latin-1 output.
-        if encoding == encoding_rs::WINDOWS_1252 && !bytes.iter().any(|b| (0x80..=0x9F).contains(b))
-        {
-            return JSString::from_latin1(scope, bytes);
-        }
-        // A fresh decoder that decodes its whole input at once turns ASCII into the same
-        // characters in every ASCII-compatible encoding.
-        if fresh
-            && last
-            && encoding.is_ascii_compatible()
-            && encoding_rs::Encoding::ascii_valid_up_to(bytes) == bytes.len()
-        {
-            return JSString::from_latin1(scope, bytes);
-        }
-
-        // Step 4: Let _output_ be the `I/O queue` of scalar values « `end-of-queue` ».
-        // Step 5: While true:
-        // Step 5.1: Let _item_ be the result of `reading` from `this`'s `I/O queue`.
-        // Step 5.2: If _item_ is `end-of-queue` and `this`'s `do not flush` is true, then return
-        //           the result of running `serialize I/O queue` with `this` and _output_.
-        // Step 5.3: Otherwise:
-        // Step 5.3.1: Let _result_ be the result of `processing an item` with _item_, `this`'s
-        //             `decoder`, `this`'s `I/O queue`, _output_, and `this`'s `error mode`.
-        // Step 5.3.2: If _result_ is `finished`, then return the result of running `serialize
-        //             I/O queue` with `this` and _output_.
-        // Step 5.3.3: Otherwise, if _result_ is `error`, `throw` a ``TypeError``.
-        //
-        // (One `encoding_rs` call processes every item. `last` is true when `end-of-queue` is
-        // processed rather than returned at step 5.2. The decoder's BOM removal performs
-        // `serialize I/O queue`'s BOM handling. We decode to UTF-16, which SpiderMonkey copies
-        // as is, or narrows to Latin-1 if every code unit fits.)
-        let max_len = decoder
-            .max_utf16_buffer_length(bytes.len())
-            .unwrap_or(bytes.len().saturating_add(1));
-        let mut output = vec![0u16; max_len];
-        if fatal {
-            let (result, _read, written) =
-                decoder.decode_to_utf16_without_replacement(bytes, &mut output, last);
-
-            match result {
-                encoding_rs::DecoderResult::InputEmpty => {
-                    JSString::from_utf16(scope, &output[..written])
-                }
-                encoding_rs::DecoderResult::Malformed(_, _) => Err(js::error::throw_type_error(
-                    scope,
-                    c"The encoded data was not valid.",
-                )),
-                encoding_rs::DecoderResult::OutputFull => {
-                    unreachable!("output buffer was pre-allocated to max size");
-                }
+        let mut decode = |bytes: &[u8]| {
+            // windows-1252 decodes every byte outside 0x80..=0x9F to the code point of the same
+            // value, and its decoder keeps no state between calls, so such input is its own
+            // Latin-1 output.
+            if encoding == encoding_rs::WINDOWS_1252
+                && !bytes.iter().any(|b| (0x80..=0x9F).contains(b))
+            {
+                return Decoded::Latin1(js::typedarray::try_copy(bytes));
+            }
+            // A fresh decoder that decodes its whole input at once turns ASCII into the same
+            // characters in every ASCII-compatible encoding.
+            if fresh
+                && last
+                && encoding.is_ascii_compatible()
+                && encoding_rs::Encoding::ascii_valid_up_to(bytes) == bytes.len()
+            {
+                return Decoded::Latin1(js::typedarray::try_copy(bytes));
             }
-        } else {
-            // Malformed sequences become U+FFFD.
-            let (_result, _read, written, _had_errors) =
-                decoder.decode_to_utf16(bytes, &mut output, last);
 
-            JSString::from_utf16(scope, &output[..written])
+            // Step 4: Let _output_ be the `I/O queue` of scalar values « `end-of-queue` ».
+            // Step 5: While true:
+            // Step 5.1: Let _item_ be the result of `reading` from `this`'s `I/O queue`.
+            // Step 5.2: If _item_ is `end-of-queue` and `this`'s `do not flush` is true, then
+            //           return the result of running `serialize I/O queue` with `this` and
+            //           _output_.
+            // Step 5.3: Otherwise:
+            // Step 5.3.1: Let _result_ be the result of `processing an item` with _item_,
+            //             `this`'s `decoder`, `this`'s `I/O queue`, _output_, and `this`'s `error
+            //             mode`.
+            // Step 5.3.2: If _result_ is `finished`, then return the result of running
+            //             `serialize I/O queue` with `this` and _output_.
+            // Step 5.3.3: Otherwise, if _result_ is `error`, `throw` a ``TypeError``.
+            //
+            // (One `encoding_rs` call processes every item. `last` is true when `end-of-queue`
+            // is processed rather than returned at step 5.2. The decoder's BOM removal performs
+            // `serialize I/O queue`'s BOM handling. We decode to UTF-16, which SpiderMonkey
+            // copies as is, or narrows to Latin-1 if every code unit fits.)
+            Decoded::Utf16(decode_to_utf16(decoder, bytes, last, fatal))
+        };
+        let decoded = match input {
+            Some(ArrayBufferViewOrArrayBuffer::Buffer(input)) => input.with_bytes(decode),
+            Some(ArrayBufferViewOrArrayBuffer::View(input)) => input.with_bytes(decode),
+            None => decode(&[]),
+        };
+        drop(data);
+        match decoded {
+            Decoded::Latin1(Some(chars)) => JSString::from_latin1(scope, &chars),
+            Decoded::Latin1(None) => Err(OutOfMemory.throw(scope)),
+            Decoded::Utf16(output) => {
+                let output = output.map_err(|error| error.throw(scope))?;
+                JSString::from_utf16(scope, &output)
+            }
         }
     }
 }
 
+/// The result of decoding the input of `TextDecoder.decode`.
+enum Decoded {
+    /// A copy of the input, which is its own Latin-1 output. `None` means that allocating the
+    /// copy failed.
+    Latin1(Option<Vec<u8>>),
+    /// The UTF-16 output.
+    Utf16(Result<Vec<u16>, DecodeError>),
+}
+
+/// A new decoder of `encoding`, which removes a byte order mark at the start of its input unless
+/// `ignore_bom` is true.
 fn new_decoder(encoding: &'static encoding_rs::Encoding, ignore_bom: bool) -> encoding_rs::Decoder {
     if ignore_bom {
         encoding.new_decoder_without_bom_handling()
@@ -188,6 +182,61 @@ fn new_decoder(encoding: &'static encoding_rs::Encoding, ignore_bom: bool) -> en
     }
 }
 
+/// Why [`decode_to_utf16`] failed.
+enum DecodeError {
+    /// The input is malformed, in the "fatal" error mode.
+    Malformed,
+    /// The output can't be allocated.
+    OutOfMemory,
+}
+
+impl DecodeError {
+    /// Throw the `TypeError` of malformed input, or report the failed allocation.
+    fn throw(self, scope: &Scope<'_>) -> ExnThrown {
+        match self {
+            DecodeError::Malformed => {
+                js::error::throw_type_error(scope, c"The encoded data was not valid.")
+            }
+            DecodeError::OutOfMemory => OutOfMemory.throw(scope),
+        }
+    }
+}
+
+/// Decode `bytes` with `decoder` to UTF-16. `last` is true for the end of the input, which the
+/// decoder then flushes. With `fatal`, malformed input fails, and otherwise it becomes U+FFFD.
+fn decode_to_utf16(
+    decoder: &mut encoding_rs::Decoder,
+    bytes: &[u8],
+    last: bool,
+    fatal: bool,
+) -> Result<Vec<u16>, DecodeError> {
+    let max_len = decoder
+        .max_utf16_buffer_length(bytes.len())
+        .ok_or(DecodeError::OutOfMemory)?;
+    let mut output = Vec::new();
+    output
+        .try_reserve_exact(max_len)
+        .map_err(|_| DecodeError::OutOfMemory)?;
+    output.resize(max_len, 0);
+    let written = if fatal {
+        let (result, _read, written) =
+            decoder.decode_to_utf16_without_replacement(bytes, &mut output, last);
+        match result {
+            encoding_rs::DecoderResult::InputEmpty => written,
+            encoding_rs::DecoderResult::Malformed(_, _) => return Err(DecodeError::Malformed),
+            encoding_rs::DecoderResult::OutputFull => {
+                unreachable!("output buffer was pre-allocated to max size");
+            }
+        }
+    } else {
+        let (_result, _read, written, _had_errors) =
+            decoder.decode_to_utf16(bytes, &mut output, last);
+        written
+    };
+    output.truncate(written);
+    Ok(output)
+}
+
 #[webidl_union]
 pub enum ArrayBufferViewOrArrayBuffer<'a> {
     View(ArrayBufferView<'a>),
diff --git a/crates/builtins/web-globals/src/encoding/text_encoder.rs b/crates/builtins/web-globals/src/encoding/text_encoder.rs
index 271e4fb0..6ff1a02d 100644
--- a/crates/builtins/web-globals/src/encoding/text_encoder.rs
+++ b/crates/builtins/web-globals/src/encoding/text_encoder.rs
@@ -77,18 +77,17 @@ impl TextEncoder<'_> {
         // encode whole scalar values while they fit, replace unpaired surrogates with U+FFFD as
         // step 5's conversion does, and return _read_ in code units and _written_ in bytes.)
         //
-        // SAFETY: the destination slice is only borrowed for the conversion, which cannot run JS
-        // or trigger a GC.
-        let dest_buf = unsafe { destination.as_mut_slice() };
-        // SAFETY: same as above.
+        // SAFETY: the closure doesn't call into SpiderMonkey.
         let (read, written) = unsafe {
-            source.with_chars(scope, |chars| match chars {
-                StrChars::Latin1(chars) => {
-                    encoding_rs::mem::convert_latin1_to_utf8_partial(chars, dest_buf)
-                }
-                StrChars::TwoByte(chars) => {
-                    encoding_rs::mem::convert_utf16_to_utf8_partial(chars, dest_buf)
-                }
+            source.with_chars(scope, |chars| {
+                destination.with_slice_mut(|dest_buf| match chars {
+                    StrChars::Latin1(chars) => {
+                        encoding_rs::mem::convert_latin1_to_utf8_partial(chars, dest_buf)
+                    }
+                    StrChars::TwoByte(chars) => {
+                        encoding_rs::mem::convert_utf16_to_utf8_partial(chars, dest_buf)
+                    }
+                })
             })
         }?;
 
diff --git a/crates/builtins/web-globals/src/events/algorithms.rs b/crates/builtins/web-globals/src/events/algorithms.rs
index 87643216..9d544246 100644
--- a/crates/builtins/web-globals/src/events/algorithms.rs
+++ b/crates/builtins/web-globals/src/events/algorithms.rs
@@ -24,8 +24,7 @@ use crate::signals::algorithms as signal_algorithms;
 ///
 /// <https://dom.spec.whatwg.org/#event-flatten-more>
 ///
-/// Note: while this *looks* like it should be a WebIDL dictionary, the coercion rules are
-/// slightly different, which is why *flatten-more* is a thing in the spec and this implementation.
+/// Note: this isn't a WebIDL dictionary because flatten-more converts its members differently.
 pub(crate) struct ListenerOptions<'s> {
     pub(crate) capture: bool,
     pub(crate) passive: Option<bool>,
@@ -35,7 +34,6 @@ pub(crate) struct ListenerOptions<'s> {
 
 js::instance_local! {
     /// Monotonic source of event-listener ids.
-    /// Would theoretically overflow after 2^64 listeners, but that's not a realistic concern.
     static NEXT_LISTENER_ID: Cell<u64> = const { Cell::new(0) };
 }
 
@@ -49,9 +47,6 @@ fn next_listener_id() -> u64 {
 
 /// <https://dom.spec.whatwg.org/#concept-flatten-options>
 ///
-/// (Note: while the spec presents this as a WebIDL spec concept, it's entirely
-/// specific to event handling, so this file is indeed the right place for it.)
-///
 /// `options` is converted as the WebIDL union `(EventListenerOptions or boolean)`:
 /// `undefined`, `null` and objects become the dictionary, and any other value is
 /// converted with `ToBoolean`.
@@ -83,7 +78,7 @@ fn options_dictionary<'s>(
     match options {
         None => OptionsArgument::Dictionary(None),
         Some(val) if val.is_null_or_undefined() => OptionsArgument::Dictionary(None),
-        Some(val) => match Object::from_value(scope, *val) {
+        Some(val) => match Object::from_raw_value(scope, val.get()) {
             Ok(obj) => OptionsArgument::Dictionary(Some(obj)),
             Err(_) => OptionsArgument::Boolean(
                 bool::from_jsval(scope, val, ()).expect("ToBoolean cannot fail"),
@@ -96,7 +91,7 @@ fn options_dictionary<'s>(
 fn read_bool_option(
     scope: &Scope<'_>,
     dictionary: Option<&Object<'_>>,
-    name: &std::ffi::CStr,
+    name: &'static std::ffi::CStr,
 ) -> Result<bool, ExnThrown> {
     let Some(dictionary) = dictionary else {
         return Ok(false);
@@ -225,7 +220,10 @@ pub(crate) fn add_an_event_listener(
         .event_listener_list
         .iter()
         .find(|l| {
-            l.event_type == event_type && l.capture == capture && l.callback.eq_stack(&callback)
+            !l.handler
+                && l.event_type == event_type
+                && l.capture == capture
+                && l.callback.eq_stack(&callback)
         })
         .map(|l| l.id);
     let listener_id = match existing_id {
@@ -239,6 +237,7 @@ pub(crate) fn add_an_event_listener(
                 capture,
                 passive,
                 once,
+                handler: false,
             });
             id
         }
@@ -269,10 +268,67 @@ pub(crate) fn remove_an_event_listener(
     //         Listeners have no `removed` flag: dispatch re-locates each listener in the live
     //         list by id, so it skips any listener that is no longer in the list.
     target.event_listener_list.retain(|l| {
-        !(l.event_type == event_type && l.capture == capture && l.callback.eq_stack(callback))
+        l.handler
+            || !(l.event_type == event_type
+                && l.capture == capture
+                && l.callback.eq_stack(callback))
     });
 }
 
+/// <https://html.spec.whatwg.org/multipage/webappapis.html#getting-the-current-value-of-the-event-handler>:
+/// the value of the event handler of `target` for `event_type`, which is the callback of its
+/// listener, or `None` if the handler is null.
+pub(crate) fn event_handler<'s>(
+    scope: &'s Scope<'_>,
+    target: &EventTarget<'_>,
+    event_type: &str,
+) -> Option<Object<'s>> {
+    let data = target.data();
+    data.event_listener_list
+        .iter()
+        .find(|l| l.handler && l.event_type == event_type)
+        .map(|l| l.callback.get(scope))
+}
+
+/// The setter steps of an `EventHandler` IDL attribute of `target` for `event_type`, whose
+/// callback type is `[LegacyTreatNonObjectAsNull]`: an object, callable or not, becomes the
+/// handler, and any other value sets it to null.
+///
+/// A handler set while the handler is null appends its listener to the event listener list
+/// (<https://html.spec.whatwg.org/multipage/webappapis.html#activate-an-event-handler>).
+/// Replacing a handler keeps the listener's place in the list, and setting it to null removes the
+/// listener (<https://html.spec.whatwg.org/multipage/webappapis.html#deactivate-an-event-handler>).
+/// A handler that isn't callable does nothing when an event is dispatched.
+pub(crate) fn set_event_handler(
+    scope: &Scope<'_>,
+    target: &EventTarget<'_>,
+    event_type: &str,
+    value: HandleValue<'_>,
+) {
+    let handler = Object::from_raw_value(scope, value.get()).ok();
+    let mut data = target.data_mut();
+    let list = &mut data.event_listener_list;
+    let position = list
+        .iter()
+        .position(|l| l.handler && l.event_type == event_type);
+    match (handler, position) {
+        (Some(handler), Some(position)) => list[position].callback.set(handler),
+        (Some(handler), None) => list.push(EventListener {
+            id: next_listener_id(),
+            event_type: event_type.to_string(),
+            callback: Heap::from(handler),
+            capture: false,
+            passive: None,
+            once: false,
+            handler: true,
+        }),
+        (None, Some(position)) => {
+            list.remove(position);
+        }
+        (None, None) => {}
+    }
+}
+
 /// Remove the event listener with the given id from an EventTarget.
 ///
 /// This is the concrete action of the abort algorithm registered by
@@ -303,7 +359,8 @@ pub enum ScriptStackState {
 impl ScriptStackState {
     /// [Clean up after running script] step 3: if the JavaScript execution context stack is now
     /// empty, perform a microtask checkpoint. Run after every `call a user object's operation`.
-    /// The checkpoint also reports the promises rejected with no handler, as HTML's does.
+    /// The checkpoint also reports the promises rejected with no handler, as the HTML microtask
+    /// checkpoint does.
     ///
     /// [Clean up after running script]: https://html.spec.whatwg.org/multipage/webappapis.html#clean-up-after-running-script
     pub fn clean_up_after_running_script(self, scope: &Scope<'_>) {
@@ -370,10 +427,9 @@ fn invoke_listeners(
         return;
     }
 
-    // Snapshot the listener list for a specific type to avoid issues with listeners added or
-    // removed during dispatch. We capture only listener `id`s and metadata; the
-    // live list is re-consulted by `id` each iteration, so callbacks are always
-    // fetched fresh and rooted (no stored GC pointers, no rooting gap).
+    // Snapshot the ids and options of the listeners for the event's type, so listeners added
+    // during dispatch don't run. Listeners removed during dispatch are skipped, and each callback
+    // is read from the live list when it runs.
     struct ListenerSnapshot {
         id: u64,
         passive: Option<bool>,
@@ -408,7 +464,11 @@ fn invoke_listeners(
         };
 
         // Root the callback before a `once` removal drops the listener's `Heap`.
-        let callback: Object<'_> = target.data().event_listener_list[pos].callback.get(scope);
+        let (callback, handler) = {
+            let data = target.data();
+            let listener = &data.event_listener_list[pos];
+            (listener.callback.get(scope), listener.handler)
+        };
 
         // If listener's `once` is true, remove it.
         if snap.once {
@@ -420,8 +480,9 @@ fn invoke_listeners(
             event.set_in_passive_listener(true);
         }
 
-        // Call the listener.
-        if call_event_listener(scope, target, callback, event).is_err() {
+        // Call the listener. An event handler that isn't callable does nothing.
+        let call = !handler || callback.is_callable();
+        if call && call_event_listener(scope, target, callback, event).is_err() {
             // Per the spec, exceptions from event listeners are "reported"
             // but do not stop event dispatch.
             js::exception::report_and_clear(scope, "event listener");
diff --git a/crates/builtins/web-globals/src/events/event.rs b/crates/builtins/web-globals/src/events/event.rs
index 7345a222..5fcd64c2 100644
--- a/crates/builtins/web-globals/src/events/event.rs
+++ b/crates/builtins/web-globals/src/events/event.rs
@@ -284,7 +284,7 @@ impl Event {
     }
 
     /// Whether the event's dispatch flag is set (it is currently being
-    /// dispatched). Read by guards like `FetchEvent.respondWith` step 2.
+    /// dispatched).
     pub fn is_dispatching(&self) -> bool {
         self.data().flags.contains(EventFlags::DISPATCH)
     }
diff --git a/crates/builtins/web-globals/src/events/event_target.rs b/crates/builtins/web-globals/src/events/event_target.rs
index f12197a7..b86c7a81 100644
--- a/crates/builtins/web-globals/src/events/event_target.rs
+++ b/crates/builtins/web-globals/src/events/event_target.rs
@@ -26,7 +26,7 @@ use crate::events::event::EventFlags;
 #[derive(core_runtime::Traceable)]
 pub(crate) struct EventListener {
     /// Identity used to re-locate this listener in the live list during
-    /// dispatch (the snapshot stores ids, not pointers — see `algorithms.rs`).
+    /// dispatch.
     #[no_trace]
     pub(crate) id: u64,
     #[no_trace]
@@ -42,6 +42,11 @@ pub(crate) struct EventListener {
     pub(crate) passive: Option<bool>,
     #[no_trace]
     pub(crate) once: bool,
+    /// Whether this is the listener of an event handler, whose `callback` is the handler's value.
+    /// Such a listener is never `once`, `capture` or `passive`, and `addEventListener` and
+    /// `removeEventListener` neither match nor remove it.
+    #[no_trace]
+    pub(crate) handler: bool,
 }
 
 /// Convert an `EventListener?` argument: `None` for `null` and `undefined`, the
@@ -53,7 +58,7 @@ fn event_listener_argument<'s>(
     if callback.is_null_or_undefined() {
         return Ok(None);
     }
-    Object::from_value(scope, *callback)
+    Object::from_raw_value(scope, callback.get())
         .map(Some)
         .map_err(|_| throw_type_error(scope, c"event listener must be an object"))
 }
@@ -181,37 +186,12 @@ impl EventTarget {
             .iter()
             .any(|listener| listener.event_type == event_type)
     }
-}
 
-// Nothing platform-specific in these tests, so skip them on wasm32.
-#[cfg(all(test, not(target_arch = "wasm32")))]
-mod tests {
-    use super::EventTarget;
-    use core_runtime::config::RuntimeConfig;
-    use core_runtime::runtime::{self, Runtime};
-    use js::conversion::FromJSVal;
-
-    /// A `once` listener leaves the event listener list when it runs. JS cannot observe the
-    /// list's length, so this reads it directly.
-    #[test]
-    fn dispatch_removes_once_listeners_from_the_list() {
-        runtime::register_global_initializer(crate::add_to_global);
-        let rt = Runtime::init(&RuntimeConfig::default()).expect("runtime init");
-        let scope = rt.default_global();
-        let value = js::compile::evaluate_with_filename(
-            &scope,
-            "const t = new EventTarget();
-             t.addEventListener('x', () => {});
-             for (let i = 0; i < 3; i++) {
-               t.addEventListener('x', () => {}, { once: true });
-               t.dispatchEvent(new Event('x'));
-             }
-             t",
-            "test.js",
-            1,
-        )
-        .expect("script should evaluate");
-        let target = EventTarget::from_jsval(&scope, value, ()).expect("an EventTarget");
-        assert_eq!(target.data().event_listener_list.len(), 1);
+    /// The number of entries in the event listener list, including an event handler's.
+    ///
+    /// Used in some tests, but not part of the stable public API.
+    #[doc(hidden)]
+    pub fn listener_count(&self) -> usize {
+        self.data().event_listener_list.len()
     }
 }
diff --git a/crates/builtins/web-globals/src/lib.rs b/crates/builtins/web-globals/src/lib.rs
index 24d2e003..0033c2ab 100644
--- a/crates/builtins/web-globals/src/lib.rs
+++ b/crates/builtins/web-globals/src/lib.rs
@@ -5,14 +5,12 @@
 //! ## Globals
 //!
 //! - `btoa` and `atob`: [WHATWG Forgiving Base64] encoding/decoding
-//! - `console`: Basic console logging (`log`, `info`, `debug`, `warn`, `error`)
 //! - `DOMException`: [WebIDL DOMException] interface
 //!
 //! [WHATWG Forgiving Base64]: https://infra.spec.whatwg.org/#forgiving-base64
 //! [WebIDL DOMException]: https://webidl.spec.whatwg.org/#idl-DOMException
 
 pub mod base64;
-// pub mod console;
 pub mod dom_exception;
 pub mod encoding;
 pub mod events;
@@ -23,8 +21,6 @@ mod structured_clone;
 pub mod worker_location;
 
 pub fn add_to_global(scope: &js::prelude::Scope<'_>, global: js::Object<'_>) {
-    // Note: the Rust console builtin isn't currently used: we use the C++ version for now.
-    // console::console_ns::add_to_global(scope, global);
     dom_exception::DOMException::add_to_global(scope, global);
     encoding::add_to_global(scope, global);
     events::add_to_global(scope, global);
diff --git a/crates/builtins/web-globals/src/navigator.rs b/crates/builtins/web-globals/src/navigator.rs
index 07eb5a58..14472de9 100644
--- a/crates/builtins/web-globals/src/navigator.rs
+++ b/crates/builtins/web-globals/src/navigator.rs
@@ -24,8 +24,6 @@ impl Navigator {
 pub fn add_to_global<'s>(scope: &'s Scope<'_>, global: Object<'s>) {
     Navigator::add_to_global(scope, global);
 
-    // SAFETY: `Navigator::add_to_global` registered the class on the
-    // current global immediately above.
     let navigator = js::class::create_instance_with::<NavigatorImpl>(scope, |_| NavigatorImpl {})
         .expect("failed to allocate Navigator singleton");
 
diff --git a/crates/builtins/web-globals/src/performance.rs b/crates/builtins/web-globals/src/performance.rs
index 1bd9e5e4..702e3179 100644
--- a/crates/builtins/web-globals/src/performance.rs
+++ b/crates/builtins/web-globals/src/performance.rs
@@ -21,11 +21,8 @@ struct TimeOriginSnapshot {
     epoch_ms: f64,
 }
 
-/// Held behind a lock rather than in a `OnceLock` because it has to be replaceable: an origin
-/// captured before a Wizer snapshot holds the wall-clock time of the machine that took the
-/// snapshot, which bears no relation to when the resumed instance runs. [`reset_time_origin`]
-/// re-establishes that half on resume. The monotonic half stays as captured, since
-/// [`platform::clock`](platform::clock) already puts a resumed instance's readings past it.
+/// Held behind a lock rather than in a `OnceLock` because [`reset_time_origin`] replaces its
+/// wall-clock half.
 static TIME_ORIGIN: std::sync::RwLock<Option<TimeOriginSnapshot>> = std::sync::RwLock::new(None);
 
 /// The current wall-clock time as an ECMA-262 timestamp (ms since Unix epoch).
@@ -49,8 +46,21 @@ fn elapsed_ms(origin: &TimeOriginSnapshot) -> f64 {
     platform::clock::monotonic_ns().saturating_sub(origin.monotonic_ns) as f64 / 1_000_000.
 }
 
-fn init_time_origin() {
-    let _ = time_origin();
+/// The resolution, in nanoseconds, that [`relative_ms`] coarsens timestamps to: 100
+/// microseconds, the resolution of <https://w3c.github.io/hr-time/#dfn-coarsen-time> without
+/// cross-origin isolated capability.
+const COARSENED_RESOLUTION_NS: u64 = 100_000;
+
+/// The timestamp `ns` nanoseconds after the time origin, in milliseconds. While the web security
+/// restrictions apply (see [`core_runtime::config::web_security_restrictions`]), it is coarsened
+/// to [`COARSENED_RESOLUTION_NS`], rounding down.
+fn relative_ms(ns: u64) -> f64 {
+    let ns = if core_runtime::config::web_security_restrictions() {
+        ns / COARSENED_RESOLUTION_NS * COARSENED_RESOLUTION_NS
+    } else {
+        ns
+    };
+    ns as f64 / 1_000_000.
 }
 
 /// Re-anchor the time origin's wall clock to the instance running now.
@@ -69,6 +79,7 @@ pub fn reset_time_origin() {
     }
 }
 
+/// The time origin, captured on the first call.
 fn time_origin() -> TimeOriginSnapshot {
     if let Some(origin) = *TIME_ORIGIN.read().expect("time origin lock poisoned") {
         return origin;
@@ -85,35 +96,29 @@ pub struct Performance {
     parent: EventTargetImpl,
 }
 
+/// <https://w3c.github.io/hr-time/#dfn-current-high-resolution-time>: the milliseconds since the
+/// time origin, coarsened as [`relative_ms`] describes.
 pub fn now() -> f64 {
-    elapsed_ms(&time_origin())
+    let origin = time_origin().monotonic_ns;
+    relative_ms(platform::clock::monotonic_ns().saturating_sub(origin))
 }
 
 /// [`now`] from [`platform::clock::coarse_monotonic_ns`], for timestamps that don't need the
 /// precise clock, such as `Event.timeStamp`.
 pub fn coarse_now() -> f64 {
-    let origin = time_origin();
-    platform::clock::coarse_monotonic_ns().saturating_sub(origin.monotonic_ns) as f64 / 1_000_000.
+    let origin = time_origin().monotonic_ns;
+    relative_ms(platform::clock::coarse_monotonic_ns().saturating_sub(origin))
 }
 
 #[webidl_methods]
 impl Performance {
     /// <https://www.w3.org/TR/hr-time-3/#now-method>
-    ///
-    /// Return the number of milliseconds since the time origin, as a `double`.
-    ///
-    /// The IDL defines the return as `DOMHighResTimeStamp` which is a
-    /// `double` in JS (64-bit float).
     #[method]
     pub fn now(&self) -> f64 {
         now()
     }
 
     /// <https://www.w3.org/TR/hr-time-3/#timeorigin-attribute>
-    ///
-    /// Return the time origin as an ECMA-262 timestamp (ms since Unix epoch).
-    /// This is a fixed value: the wall-clock time (in ms since Unix epoch)
-    /// at which the runtime's time origin was established.
     #[getter]
     fn time_origin(&self) -> f64 {
         time_origin().epoch_ms
@@ -135,9 +140,8 @@ impl Performance {
 /// Register the `Performance` class on `global` and install the singleton
 /// `performance` instance as a property on it.
 pub fn add_to_global<'s>(scope: &'s Scope<'_>, global: Object<'s>) {
-    // An embedder that snapshots the initialized runtime (Wizer) captures a time origin belonging
-    // to the snapshotting process; it calls `reset_time_origin` on resume to re-establish one.
-    init_time_origin();
+    // The time origin is captured when the first global is set up, not at the first clock read.
+    time_origin();
 
     Performance::add_to_global(scope, global);
 
@@ -151,38 +155,3 @@ pub fn add_to_global<'s>(scope: &'s Scope<'_>, global: Object<'s>) {
         .set_property(scope, c"performance", performance)
         .expect("failed to define globalThis.performance");
 }
-
-#[cfg(test)]
-mod tests {
-    use core_runtime::{runtime, test_util::eval_with_setup};
-
-    fn eval(code: &str) -> String {
-        eval_with_setup(
-            || {
-                runtime::register_global_initializer(super::add_to_global);
-            },
-            code,
-        )
-    }
-
-    #[test]
-    fn performance_to_string_tag() {
-        assert_eq!(
-            eval("Object.prototype.toString.call(performance)"),
-            "[object Performance]"
-        );
-    }
-
-    #[test]
-    fn to_json_returns_object() {
-        assert!(eval(
-            "(() => {
-                const json = performance.toJSON();
-                return typeof json === 'object' &&
-                       typeof json.timeOrigin === 'number';
-            })()"
-        )
-        .parse::<bool>()
-        .unwrap());
-    }
-}
diff --git a/crates/builtins/web-globals/src/signals/abort_signal.rs b/crates/builtins/web-globals/src/signals/abort_signal.rs
index 5b6fb6c9..8d542903 100644
--- a/crates/builtins/web-globals/src/signals/abort_signal.rs
+++ b/crates/builtins/web-globals/src/signals/abort_signal.rs
@@ -8,11 +8,11 @@
 use core_runtime::{webidl_interface, webidl_methods};
 use js::conversion::FromJSVal;
 use js::error::ExnThrown;
-use js::gc::handle::{Heap, OptionHeapExt};
+use js::gc::handle::Heap;
 use js::gc::scope::Scope;
 use js::native::{ExceptionStackBehavior, Value};
 use js::prelude::HandleValue;
-use js::Callable;
+use js::Object;
 
 use super::algorithms;
 use crate::dom_exception::DOMException;
@@ -23,13 +23,8 @@ use crate::events::event_target::{EventTarget, EventTargetImpl};
 ///
 /// <https://dom.spec.whatwg.org/#abortsignal-abort-algorithms>
 ///
-/// The only abort algorithm this runtime registers removes an event listener
-/// added with the signal (per "add an event listener" step 6), so it is stored
-/// concretely as the target plus the listener id rather than as a boxed
-/// closure. A closure capturing a `Heap` could not be traced (it is opaque to
-/// both the GC tracer and crown); keeping the GC pointer in an explicit field
-/// makes it traceable.
-///
+/// Algorithms are stored as data rather than as boxed closures, so that their GC pointers are
+/// traced.
 #[js::must_root]
 pub(crate) enum AbortAlgorithm {
     /// Remove the event listener identified by `listener_id` from `held` (an
@@ -76,11 +71,6 @@ pub struct AbortSignal {
 
     /// <https://dom.spec.whatwg.org/#abortsignal-abort-algorithms>
     pub(crate) abort_algorithms: Vec<AbortAlgorithm>,
-
-    /// The `onabort` event handler attribute.
-    ///
-    /// <https://dom.spec.whatwg.org/#dom-abortsignal-onabort>
-    pub(crate) onabort_handler: Option<Heap<js::function::Callable>>,
 }
 
 #[webidl_methods]
@@ -93,7 +83,6 @@ impl AbortSignal {
             source_signals: Vec::new(),
             dependent_signals: Vec::new(),
             abort_algorithms: Vec::new(),
-            onabort_handler: None,
         }
     }
 
@@ -130,42 +119,14 @@ impl AbortSignal {
     ///
     /// IDL event handler attribute: `attribute EventHandler onabort;`
     #[getter]
-    fn onabort<'r>(&self, scope: &'r Scope<'_>) -> Option<Callable<'r>> {
-        self.data().onabort_handler.get(scope)
+    fn onabort<'r>(&self, scope: &'r Scope<'_>) -> Option<Object<'r>> {
+        event_algorithms::event_handler(scope, self, "abort")
     }
 
     /// <https://dom.spec.whatwg.org/#dom-abortsignal-onabort>
     #[setter]
     fn set_onabort(&self, scope: &Scope<'_>, val: HandleValue<'_>) {
-        // Remove the old handler listener, if any. Root it before taking the
-        // mutable borrow of `self`.
-        let old_callback = self.data().onabort_handler.get(scope);
-        if let Some(func) = old_callback {
-            event_algorithms::remove_an_event_listener(
-                &mut self.data_mut().parent,
-                "abort",
-                &func,
-                false,
-            );
-        }
-
-        // If the new value is a function, store it and add as listener.
-        match Callable::from_jsval(scope, val, ()) {
-            Ok(func) => {
-                // The onabort handler is registered without an abort signal.
-                event_algorithms::add_an_event_listener(
-                    self,
-                    "abort".to_string(),
-                    *func,
-                    false,
-                    None,
-                    false,
-                    None,
-                );
-                self.data_mut().onabort_handler.set(func);
-            }
-            Err(_) => self.data_mut().onabort_handler = None,
-        }
+        event_algorithms::set_event_handler(scope, self, "abort", val);
     }
 
     /// <https://dom.spec.whatwg.org/#dom-abortsignal-abort>
@@ -211,7 +172,7 @@ impl AbortSignal {
         //         "``TimeoutError``" ``DOMException``. For the duration of this timeout, if
         //         _signal_ has any event listeners registered for its ``abort`` event, there must
         //         be a strong reference from _global_ to _signal_.
-        algorithms::schedule_abort_timeout(scope, &signal, milliseconds);
+        algorithms::schedule_abort_timeout(&signal, milliseconds);
 
         // Step 4: Return _signal_.
         Ok(signal)
diff --git a/crates/builtins/web-globals/src/signals/algorithms.rs b/crates/builtins/web-globals/src/signals/algorithms.rs
index 0168aa74..0a5be989 100644
--- a/crates/builtins/web-globals/src/signals/algorithms.rs
+++ b/crates/builtins/web-globals/src/signals/algorithms.rs
@@ -26,13 +26,9 @@ use crate::events::event_target::EventTarget;
 /// To create a dependent abort signal, given a list `signals`, returns a new
 /// `AbortSignal` that is aborted when any of the source signals is aborted.
 ///
-/// The spec keeps the source/dependent links as *weak* references to avoid
-/// keeping signals alive through each other. Here they are ordinary traced
-/// `Heap` fields: because they are traced as object slots rather than held as
-/// independent roots, SpiderMonkey's cycle-collecting GC still reclaims an
-/// unreachable source↔dependent pair. The only difference is `WeakRef`/
-/// `FinalizationRegistry` observability, which is not exercised by the enabled
-/// tests; revisit this if the GC-oriented abort-signal tests get enabled.
+/// The spec's links between source and dependent signals are weak references. Here they are
+/// traced `Heap` fields, which a tracing GC still collects when the linked signals are all
+/// unreachable. A reachable source signal keeps every signal in its `dependent_signals` alive.
 pub fn create_dependent_abort_signal<'r>(
     scope: &'r Scope<'_>,
     signals: &[AbortSignal<'_>],
@@ -330,11 +326,7 @@ impl Task for AbortTimeoutTask {
 ///
 /// Steps 2-3 of the `AbortSignal.timeout()` algorithm: run steps after a
 /// timeout to signal abort with a "TimeoutError" DOMException.
-pub(crate) fn schedule_abort_timeout(
-    _scope: &Scope<'_>,
-    signal: &AbortSignal<'_>,
-    milliseconds: f64,
-) {
+pub(crate) fn schedule_abort_timeout(signal: &AbortSignal<'_>, milliseconds: f64) {
     let delay = Duration::from_millis(milliseconds.max(0.0) as u64);
     let deadline = Instant::now() + delay;
     let task = AbortTimeoutTask {
diff --git a/crates/builtins/web-globals/src/worker_location.rs b/crates/builtins/web-globals/src/worker_location.rs
index e1a0ce3f..1f8d513f 100644
--- a/crates/builtins/web-globals/src/worker_location.rs
+++ b/crates/builtins/web-globals/src/worker_location.rs
@@ -4,9 +4,8 @@
 //!
 //! `WorkerLocation` exposes the runtime's current location URL via
 //! `globalThis.location`. The HTML spec sources this URL from the surrounding
-//! `WorkerGlobalScope`. Starling has no `WorkerGlobalScope`, so a single
-//! process-wide URL — typically read from an incoming HTTP request or configured
-//! via `--init-location` — backs every `WorkerLocation` accessor instead.
+//! `WorkerGlobalScope`. Starling has no `WorkerGlobalScope`, so the URL set with
+//! [`set_init_location`] backs every `WorkerLocation` accessor instead.
 //! If no URL has been configured, every accessor throws a `TypeError`.
 
 use std::cell::RefCell;
@@ -61,8 +60,7 @@ fn with_url<T>(field: &str, f: impl FnOnce(&url::Url) -> T) -> Result<T, TypeErr
 /// The `WorkerLocation` interface.
 ///
 /// `Symbol.toStringTag` is `"Location"` rather than the WebIDL default of
-/// `"WorkerLocation"`, matching the C++ runtime so JS code observes
-/// `Object.prototype.toString.call(location) === "[object Location]"`.
+/// `"WorkerLocation"`.
 ///
 /// Instantiated as a singleton in [`add_to_global`].
 #[webidl_interface(to_string_tag = "Location")]
@@ -162,8 +160,6 @@ impl WorkerLocation {
 pub fn add_to_global<'s>(scope: &'s Scope<'_>, global: Object<'s>) {
     WorkerLocation::add_to_global(scope, global);
 
-    // SAFETY: `WorkerLocation::add_to_global` registered the class on the
-    // current global immediately above.
     let location =
         js::class::create_instance_with::<WorkerLocationImpl>(scope, |_| WorkerLocationImpl {})
             .expect("failed to allocate WorkerLocation singleton");
@@ -172,158 +168,3 @@ pub fn add_to_global<'s>(scope: &'s Scope<'_>, global: Object<'s>) {
         .set_property(scope, c"location", location)
         .expect("failed to define globalThis.location");
 }
-
-// Nothing platform-specific in these tests, so skip them on wasm32.
-#[cfg(all(test, not(target_arch = "wasm32")))]
-mod tests {
-    use core_runtime::{runtime, test_util::eval_with_setup};
-
-    fn eval(code: &str) -> String {
-        eval_with_setup(
-            || {
-                super::clear_init_location();
-                runtime::register_global_initializer(super::add_to_global);
-            },
-            code,
-        )
-    }
-
-    fn eval_with_url(location_url: &str, code: &str) -> String {
-        eval_with_setup(
-            || {
-                super::set_init_location(url::Url::parse(location_url).unwrap());
-                runtime::register_global_initializer(super::add_to_global);
-            },
-            code,
-        )
-    }
-
-    #[test]
-    fn location_exists_on_global() {
-        assert_eq!(
-            eval_with_url("https://example.com/", "typeof location"),
-            "object"
-        );
-    }
-
-    #[test]
-    fn constructor_throws() {
-        // WorkerLocation has no IDL constructor; `new WorkerLocation()` must throw.
-        assert_eq!(
-            eval(
-                "try { new WorkerLocation(); 'no-throw' } \
-                 catch(e) { (e instanceof TypeError) + ',' + e.message }"
-            ),
-            "true,Illegal constructor"
-        );
-    }
-
-    #[test]
-    fn to_string_tag_is_location() {
-        assert_eq!(
-            eval_with_url(
-                "https://example.com/",
-                "Object.prototype.toString.call(location)"
-            ),
-            "[object Location]"
-        );
-    }
-
-    #[test]
-    fn href_returns_serialized_url() {
-        assert_eq!(
-            eval_with_url("https://example.com/path?q=1#frag", "location.href"),
-            "https://example.com/path?q=1#frag"
-        );
-    }
-
-    #[test]
-    fn origin_returns_origin() {
-        assert_eq!(
-            eval_with_url("https://example.com:8443/path", "location.origin"),
-            "https://example.com:8443"
-        );
-    }
-
-    #[test]
-    fn protocol_returns_scheme_with_colon() {
-        assert_eq!(
-            eval_with_url("https://example.com/", "location.protocol"),
-            "https:"
-        );
-    }
-
-    #[test]
-    fn host_and_hostname() {
-        assert_eq!(
-            eval_with_url("https://example.com:8443/", "location.host"),
-            "example.com:8443"
-        );
-        assert_eq!(
-            eval_with_url("https://example.com:8443/", "location.hostname"),
-            "example.com"
-        );
-    }
-
-    #[test]
-    fn port_includes_explicit_only() {
-        assert_eq!(
-            eval_with_url("https://example.com:8443/", "location.port"),
-            "8443"
-        );
-        // Default ports are omitted by the URL parser.
-        assert_eq!(eval_with_url("https://example.com/", "location.port"), "");
-    }
-
-    #[test]
-    fn pathname_search_hash() {
-        assert_eq!(
-            eval_with_url("https://example.com/foo/bar?x=1#frag", "location.pathname"),
-            "/foo/bar"
-        );
-        assert_eq!(
-            eval_with_url("https://example.com/foo/bar?x=1#frag", "location.search"),
-            "?x=1"
-        );
-        assert_eq!(
-            eval_with_url("https://example.com/foo/bar?x=1#frag", "location.hash"),
-            "#frag"
-        );
-    }
-
-    #[test]
-    fn empty_search_and_hash_return_empty_string() {
-        assert_eq!(eval_with_url("https://example.com/", "location.search"), "");
-        assert_eq!(eval_with_url("https://example.com/", "location.hash"), "");
-    }
-
-    #[test]
-    fn to_string_returns_href() {
-        assert_eq!(
-            eval_with_url(
-                "https://example.com/path?q=1",
-                "location.toString() === location.href"
-            ),
-            "true"
-        );
-    }
-
-    #[test]
-    fn unset_location_throws_typeerror() {
-        // With no init-location configured, every accessor throws.
-        assert_eq!(
-            eval(
-                "try { location.href; 'no-throw' } \
-                 catch(e) { (e instanceof TypeError) + ',' + e.message.includes('--init-location') }"
-            ),
-            "true,true"
-        );
-        assert_eq!(
-            eval(
-                "try { location.toString(); 'no-throw' } \
-                 catch(e) { e instanceof TypeError }"
-            ),
-            "true"
-        );
-    }
-}
diff --git a/crates/builtins/web-globals/tests/dom_events.rs b/crates/builtins/web-globals/tests/dom_events.rs
index 8617d7a7..3ec1ea0a 100644
--- a/crates/builtins/web-globals/tests/dom_events.rs
+++ b/crates/builtins/web-globals/tests/dom_events.rs
@@ -4,14 +4,18 @@
 //!
 //! These tests deliberately cover only behavior that the enabled, passing WPT
 //! suite (see `tests/wpt-harness/tests.json`) doesn't exercise. What remains is
-//! coverage for behaviors whose only WPT home is a `.html` test (which this
-//! headless harness cannot run), an idlharness test that is not enabled, or —
-//! in the case of GC interaction — something WPT cannot express at all.
+//! coverage for behaviors whose only WPT home is a `.html` test, which this
+//! headless harness cannot run, and for GC interaction, which WPT cannot
+//! express.
 
 // This file contains nothing platform-specific, so skip it on wasm32.
 #![cfg(not(target_arch = "wasm32"))]
 
+use core_runtime::config::RuntimeConfig;
+use core_runtime::runtime::{self, Runtime};
 use core_runtime::test_util::eval_with_setup;
+use js::conversion::FromJSVal;
+use web_globals::events::EventTarget;
 
 fn setup() {
     core_runtime::runtime::register_global_initializer(|scope, global| {
@@ -31,22 +35,6 @@ fn event_composed_default() {
     assert_eq!(eval("new Event('x').composed"), "false");
 }
 
-#[test]
-fn event_phase_constants() {
-    // Only Event-constants.html asserts the numeric values; the enabled
-    // any.js tests reference Event.NONE without pinning it to 0.
-    assert_eq!(eval("Event.NONE"), "0");
-    assert_eq!(eval("Event.CAPTURING_PHASE"), "1");
-    assert_eq!(eval("Event.AT_TARGET"), "2");
-    assert_eq!(eval("Event.BUBBLING_PHASE"), "3");
-}
-
-#[test]
-fn event_instance_phase_constants() {
-    assert_eq!(eval("new Event('x').NONE"), "0");
-    assert_eq!(eval("new Event('x').AT_TARGET"), "2");
-}
-
 #[test]
 fn event_prevent_default_non_cancelable() {
     // preventDefault on a non-cancelable event has no effect. The passive WPT
@@ -58,59 +46,33 @@ fn event_prevent_default_non_cancelable() {
 }
 
 #[test]
-fn event_stop_propagation() {
+fn event_stop_propagation_and_cancel_bubble() {
     // stopPropagation()/cancelBubble live only in Event-cancelBubble.html.
     assert_eq!(
         eval("var e = new Event('x'); e.stopPropagation(); e.cancelBubble"),
         "true"
     );
-}
-
-#[test]
-fn event_cancel_bubble_setter() {
     assert_eq!(
         eval("var e = new Event('x'); e.cancelBubble = true; e.cancelBubble"),
         "true"
     );
 }
 
-#[test]
-fn event_to_string_tag() {
-    // No idlharness for dom/events is enabled, so the brand check lives here.
-    assert_eq!(
-        eval("Object.prototype.toString.call(new Event('x'))"),
-        "[object Event]"
-    );
-}
-
 // ── Event.initEvent (only Event-initEvent.html otherwise) ──
 
 #[test]
 fn event_init_event() {
     assert_eq!(
-        eval("var e = new Event(''); e.initEvent('click', true, true); e.type"),
-        "click"
-    );
-}
-
-#[test]
-fn event_init_event_bubbles() {
-    assert_eq!(
-        eval("var e = new Event(''); e.initEvent('click', true, false); e.bubbles"),
-        "true"
+        eval(
+            "var e = new Event(''); e.initEvent('click', true, false); \
+             e.type + ',' + e.bubbles + ',' + e.cancelable"
+        ),
+        "click,true,false"
     );
 }
 
 // ── EventTarget ──
 
-#[test]
-fn event_target_to_string_tag() {
-    assert_eq!(
-        eval("Object.prototype.toString.call(new EventTarget())"),
-        "[object EventTarget]"
-    );
-}
-
 #[test]
 fn dispatch_event_at_target_phase() {
     // eventPhase during dispatch is only asserted by Event-dispatch-*.html.
@@ -224,49 +186,56 @@ fn dispatch_redispatch_used_event() {
     );
 }
 
+/// A `once` listener leaves the event listener list when it runs. JS cannot observe the
+/// list's length, so this reads it directly.
+#[test]
+fn dispatch_removes_once_listeners_from_the_list() {
+    runtime::register_global_initializer(web_globals::add_to_global);
+    let rt = Runtime::init(&RuntimeConfig::default()).expect("runtime init");
+    let scope = rt.default_global();
+    let value = js::compile::evaluate_with_filename(
+        &scope,
+        "const t = new EventTarget();
+         t.addEventListener('x', () => {});
+         for (let i = 0; i < 3; i++) {
+           t.addEventListener('x', () => {}, { once: true });
+           t.dispatchEvent(new Event('x'));
+         }
+         t",
+        "test.js",
+        1,
+    )
+    .expect("script should evaluate");
+    let target = EventTarget::from_jsval(&scope, value, ()).expect("an EventTarget");
+    assert_eq!(target.listener_count(), 1);
+}
+
 // ── CustomEvent ──
 //
 // The only enabled WPT touching CustomEvent is one assertion in
 // Event-constructors.any.js (`detail: 54`) plus a subclass dispatch in
 // EventTarget-constructible.any.js. CustomEvent.html is not runnable here, so
-// detail typing, defaults, the brand, and initCustomEvent are covered below.
-
-#[test]
-fn custom_event_construct() {
-    assert_eq!(eval("new CustomEvent('x') instanceof CustomEvent"), "true");
-}
+// detail typing, defaults, and initCustomEvent are covered below.
 
 #[test]
 fn custom_event_extends_event() {
-    assert_eq!(eval("new CustomEvent('x') instanceof Event"), "true");
-}
-
-#[test]
-fn custom_event_detail_default_is_null() {
-    assert_eq!(eval("new CustomEvent('x').detail"), "null");
-}
-
-#[test]
-fn custom_event_detail_string() {
-    assert_eq!(
-        eval("new CustomEvent('x', { detail: 'hello' }).detail"),
-        "hello"
-    );
-}
-
-#[test]
-fn custom_event_detail_object() {
     assert_eq!(
-        eval("JSON.stringify(new CustomEvent('x', { detail: { a: 1 } }).detail)"),
-        r#"{"a":1}"#
+        eval(
+            "var e = new CustomEvent('x'); (e instanceof CustomEvent) + ',' + (e instanceof Event)"
+        ),
+        "true,true"
     );
 }
 
 #[test]
-fn custom_event_to_string_tag() {
+fn custom_event_detail() {
     assert_eq!(
-        eval("Object.prototype.toString.call(new CustomEvent('x'))"),
-        "[object CustomEvent]"
+        eval(
+            "JSON.stringify([new CustomEvent('x').detail, \
+                             new CustomEvent('x', { detail: 'hello' }).detail, \
+                             new CustomEvent('x', { detail: { a: 1 } }).detail])"
+        ),
+        r#"[null,"hello",{"a":1}]"#
     );
 }
 
@@ -284,18 +253,8 @@ fn custom_event_init_custom_event() {
     );
 }
 
-/// Listener identity must survive a compacting GC.
-///
-/// Listeners are compared by the live, barrier-updated pointer of their stored
-/// `Heap<Function>` rather than a cached raw pointer. A full GC promotes the
-/// callback out of the nursery and may compact it, changing its address — so a
-/// cached pointer captured at registration time would go stale. This drives a
-/// real collection *between* listener operations and checks that both
-/// deduplication and removal still match the relocated callback. (With a cached
-/// raw pointer this would observe a count of 4: dedup fails, both listeners
-/// fire twice, and removal matches neither.)
-///
-/// WPT cannot express this: it has no control over garbage collection.
+/// Listener identity survives a compacting GC, which moves the callback between the listener
+/// operations: deduplication and removal still match the relocated callback.
 #[test]
 fn listener_identity_survives_compacting_gc() {
     use core_runtime::config::RuntimeConfig;
@@ -329,14 +288,14 @@ fn listener_identity_survives_compacting_gc() {
 
     // After relocation: a duplicate add must still be recognised (dedup), a
     // dispatch must fire the single listener once, and removal must match the
-    // relocated callback so the final dispatch fires nothing.
+    // relocated callback so the final dispatch doesn't call a listener.
     let val = evaluate_with_filename(
         &scope,
         r#"
         globalThis.t.addEventListener('e', globalThis.handler); // dedup
         globalThis.t.dispatchEvent(new Event('e'));             // fires once
         globalThis.t.removeEventListener('e', globalThis.handler);
-        globalThis.t.dispatchEvent(new Event('e'));             // fires nothing
+        globalThis.t.dispatchEvent(new Event('e'));             // calls no listener
         String(globalThis.count)
         "#,
         "test.js",
@@ -488,7 +447,7 @@ fn add_event_listener_accepts_handle_event_objects() {
     );
 }
 
-/// A non-object callback is a TypeError, while `null` adds nothing.
+/// A non-object callback is a TypeError, while `null` doesn't add a listener.
 #[test]
 fn add_event_listener_rejects_non_object_callbacks() {
     assert_eq!(
diff --git a/crates/builtins/web-globals/tests/dom_signals.rs b/crates/builtins/web-globals/tests/dom_signals.rs
index 371fae14..a8f67927 100644
--- a/crates/builtins/web-globals/tests/dom_signals.rs
+++ b/crates/builtins/web-globals/tests/dom_signals.rs
@@ -9,7 +9,6 @@
 //! `tests/wpt-harness/tests.json`), so that ground is not retread here. What
 //! remains is coverage WPT does not give us in this harness:
 //!
-//! - `Symbol.toStringTag` brands (no idlharness is enabled).
 //! - `onabort` getter identity and the set-to-null path, which `event.any.js`
 //!   does not assert.
 
@@ -51,59 +50,21 @@ fn eval(code: &str) -> String {
     eval_with_setup(setup, code)
 }
 
-// ── Brands / interface shape ──
-
-#[test]
-fn abort_controller_to_string_tag() {
-    assert_eq!(
-        eval("Object.prototype.toString.call(new AbortController())"),
-        "[object AbortController]"
-    );
-}
-
-#[test]
-fn abort_controller_has_signal() {
-    assert_eq!(
-        eval("new AbortController().signal instanceof AbortSignal"),
-        "true"
-    );
-}
-
-#[test]
-fn signal_inherits_event_target() {
-    assert_eq!(
-        eval("new AbortController().signal instanceof EventTarget"),
-        "true"
-    );
-}
-
-#[test]
-fn signal_to_string_tag() {
-    assert_eq!(
-        eval("Object.prototype.toString.call(new AbortController().signal)"),
-        "[object AbortSignal]"
-    );
-}
-
 // ── onabort event handler ──
 
-#[test]
-fn onabort_initially_null() {
-    assert_eq!(eval("new AbortController().signal.onabort"), "null");
-}
-
 #[test]
 fn onabort_getter_returns_handler() {
     assert_eq!(
         eval(
             r#"
             var ac = new AbortController();
+            var initial = ac.signal.onabort;
             var fn = function() {};
             ac.signal.onabort = fn;
-            ac.signal.onabort === fn
+            (initial === null) + "," + (ac.signal.onabort === fn)
             "#
         ),
-        "true"
+        "true,true"
     );
 }
 
@@ -124,6 +85,58 @@ fn onabort_set_null_removes_handler() {
     );
 }
 
+/// `onabort` keeps any object, callable or not, and is null for any other value. A handler that
+/// isn't callable does nothing when the event is dispatched.
+#[test]
+fn onabort_keeps_objects_and_nulls_other_values() {
+    assert_eq!(
+        eval(
+            r#"
+            var ac = new AbortController();
+            var object = {};
+            var results = [];
+            ac.signal.onabort = object;
+            results.push(ac.signal.onabort === object);
+            ac.signal.onabort = 5;
+            results.push(ac.signal.onabort);
+            ac.signal.onabort = object;
+            var called = false;
+            ac.signal.addEventListener("abort", function() { called = true; });
+            ac.abort();
+            results.push(called);
+            results.join()
+            "#
+        ),
+        "true,,true"
+    );
+}
+
+/// Replacing `onabort` keeps its listener's place among the event listeners, and the handler's
+/// listener is separate from a listener of the same function added with `addEventListener`.
+#[test]
+fn onabort_listener_keeps_its_place_and_identity() {
+    assert_eq!(
+        eval(
+            r#"
+            var ac = new AbortController();
+            var order = [];
+            var shared = function() { order.push("shared"); };
+            ac.signal.onabort = function() { order.push("a"); };
+            ac.signal.addEventListener("abort", function() { order.push("b"); });
+            ac.signal.onabort = function() { order.push("c"); };
+            ac.signal.addEventListener("abort", shared);
+            ac.signal.removeEventListener("abort", shared);
+            ac.signal.addEventListener("abort", shared);
+            ac.signal.onabort = shared;
+            ac.signal.removeEventListener("abort", shared);
+            ac.abort();
+            order.join()
+            "#
+        ),
+        "shared,b"
+    );
+}
+
 // ── Abort algorithms
 
 #[test]
@@ -170,11 +183,8 @@ fn throwing_abort_algorithm_still_aborts_dependents() {
 
 #[test]
 fn any_with_huge_array_like_length_throws_not_crashes() {
-    // Regression: a hostile `length` must not be used to pre-size an allocation.
-    // `AbortSignal.any({length: 1e20})` previously fed `u32::MAX` into
-    // `Vec::with_capacity`, attempting a ~34 GB allocation that aborted the
-    // process. Per spec it must throw a `TypeError` (the first element is not an
-    // `AbortSignal`), like every other browser/runtime.
+    // A hostile `length` isn't used to pre-size an allocation. The first element isn't an
+    // `AbortSignal`, so this throws a `TypeError`.
     assert_eq!(
         eval(
             "try { AbortSignal.any({ length: 1e20 }); 'no-throw' } \
diff --git a/crates/builtins/web-globals/tests/encoding.rs b/crates/builtins/web-globals/tests/encoding.rs
index 74ba59d8..d99ce8d4 100644
--- a/crates/builtins/web-globals/tests/encoding.rs
+++ b/crates/builtins/web-globals/tests/encoding.rs
@@ -1,11 +1,11 @@
 // SPDX-License-Identifier: Apache-2.0-WITH-LLVM-exception
 
-//! Integration tests for the Encoding API (TextEncoder, TextDecoder).
+//! A `TextDecoder` check that the enabled WPT `encoding/` tests don't make.
 
 // This file contains nothing platform-specific, so skip it on wasm32.
 #![cfg(not(target_arch = "wasm32"))]
 
-use core_runtime::test_util::{eval_with_setup, throws_with_setup};
+use core_runtime::test_util::eval_with_setup;
 
 fn setup() {
     core_runtime::runtime::register_global_initializer(|scope, global| {
@@ -17,347 +17,6 @@ fn eval(code: &str) -> String {
     eval_with_setup(setup, code)
 }
 
-fn throws(code: &str) -> bool {
-    throws_with_setup(setup, code)
-}
-
-// ── TextEncoder existence ──
-
-#[test]
-fn text_encoder_exists() {
-    assert_eq!(eval("typeof TextEncoder"), "function");
-}
-
-#[test]
-fn text_encoder_construct() {
-    assert_eq!(eval("new TextEncoder() instanceof TextEncoder"), "true");
-}
-
-// ── TextEncoder.encoding ──
-
-#[test]
-fn text_encoder_encoding() {
-    assert_eq!(eval("new TextEncoder().encoding"), "utf-8");
-}
-
-// ── TextEncoder.encode() ──
-
-#[test]
-fn text_encoder_encode_empty() {
-    assert_eq!(eval("new TextEncoder().encode('').length"), "0");
-}
-
-#[test]
-fn text_encoder_encode_ascii() {
-    assert_eq!(
-        eval("Array.from(new TextEncoder().encode('abc')).join(',')"),
-        "97,98,99"
-    );
-}
-
-#[test]
-fn text_encoder_encode_returns_uint8array() {
-    assert_eq!(
-        eval("new TextEncoder().encode('a') instanceof Uint8Array"),
-        "true"
-    );
-}
-
-#[test]
-fn text_encoder_encode_no_args() {
-    // encode() with no arguments encodes empty string
-    assert_eq!(eval("new TextEncoder().encode().length"), "0");
-}
-
-#[test]
-fn text_encoder_encode_multibyte() {
-    // "€" is U+20AC, encoded as [0xE2, 0x82, 0xAC] in UTF-8
-    assert_eq!(
-        eval(r#"Array.from(new TextEncoder().encode('€')).join(',')"#),
-        "226,130,172"
-    );
-}
-
-#[test]
-fn text_encoder_encode_emoji() {
-    // "😀" is U+1F600, encoded as [0xF0, 0x9F, 0x98, 0x80]
-    assert_eq!(
-        eval(r#"Array.from(new TextEncoder().encode('😀')).join(',')"#),
-        "240,159,152,128"
-    );
-}
-
-// ── TextEncoder.encodeInto() ──
-
-#[test]
-fn text_encoder_encode_into_basic() {
-    assert_eq!(
-        eval(
-            r#"
-            const enc = new TextEncoder();
-            const buf = new Uint8Array(10);
-            const result = enc.encodeInto('abc', buf);
-            result.read + ',' + result.written
-        "#
-        ),
-        "3,3"
-    );
-}
-
-#[test]
-fn text_encoder_encode_into_writes_bytes() {
-    assert_eq!(
-        eval(
-            r#"
-            const enc = new TextEncoder();
-            const buf = new Uint8Array(10);
-            enc.encodeInto('abc', buf);
-            buf[0] + ',' + buf[1] + ',' + buf[2]
-        "#
-        ),
-        "97,98,99"
-    );
-}
-
-#[test]
-fn text_encoder_encode_into_truncation() {
-    // Buffer too small to fit all characters
-    assert_eq!(
-        eval(
-            r#"
-            const enc = new TextEncoder();
-            const buf = new Uint8Array(2);
-            const result = enc.encodeInto('abcdef', buf);
-            result.read + ',' + result.written
-        "#
-        ),
-        "2,2"
-    );
-}
-
-#[test]
-fn text_encoder_encode_into_multibyte_truncation() {
-    // "€" needs 3 bytes; buffer of 2 can't fit it
-    assert_eq!(
-        eval(
-            r#"
-            const enc = new TextEncoder();
-            const buf = new Uint8Array(2);
-            const result = enc.encodeInto('€', buf);
-            result.read + ',' + result.written
-        "#
-        ),
-        "0,0"
-    );
-}
-
-#[test]
-fn text_encoder_encode_into_surrogate_pair_count() {
-    // "😀" is U+1F600, takes 4 UTF-8 bytes and 2 UTF-16 code units
-    assert_eq!(
-        eval(
-            r#"
-            const enc = new TextEncoder();
-            const buf = new Uint8Array(10);
-            const result = enc.encodeInto('😀', buf);
-            result.read + ',' + result.written
-        "#
-        ),
-        "2,4"
-    );
-}
-
-// ── TextDecoder existence ──
-
-#[test]
-fn text_decoder_exists() {
-    assert_eq!(eval("typeof TextDecoder"), "function");
-}
-
-#[test]
-fn text_decoder_construct() {
-    assert_eq!(eval("new TextDecoder() instanceof TextDecoder"), "true");
-}
-
-// ── TextDecoder.encoding ──
-
-#[test]
-fn text_decoder_encoding_default() {
-    assert_eq!(eval("new TextDecoder().encoding"), "utf-8");
-}
-
-#[test]
-fn text_decoder_encoding_explicit_utf8() {
-    assert_eq!(eval("new TextDecoder('utf-8').encoding"), "utf-8");
-}
-
-#[test]
-fn text_decoder_encoding_label_normalization() {
-    // "UTF-8" should be normalized to "utf-8"
-    assert_eq!(eval("new TextDecoder('UTF-8').encoding"), "utf-8");
-}
-
-#[test]
-fn text_decoder_encoding_windows_1252() {
-    assert_eq!(
-        eval("new TextDecoder('windows-1252').encoding"),
-        "windows-1252"
-    );
-}
-
-// ── TextDecoder.fatal ──
-
-#[test]
-fn text_decoder_fatal_default() {
-    assert_eq!(eval("new TextDecoder().fatal"), "false");
-}
-
-#[test]
-fn text_decoder_fatal_true() {
-    assert_eq!(
-        eval("new TextDecoder('utf-8', { fatal: true }).fatal"),
-        "true"
-    );
-}
-
-// ── TextDecoder.ignoreBOM ──
-
-#[test]
-fn text_decoder_ignore_bom_default() {
-    assert_eq!(eval("new TextDecoder().ignoreBOM"), "false");
-}
-
-#[test]
-fn text_decoder_ignore_bom_true() {
-    assert_eq!(
-        eval("new TextDecoder('utf-8', { ignoreBOM: true }).ignoreBOM"),
-        "true"
-    );
-}
-
-// ── TextDecoder.decode() ──
-
-#[test]
-fn text_decoder_decode_utf8() {
-    assert_eq!(
-        eval(r#"new TextDecoder().decode(new Uint8Array([97, 98, 99]))"#),
-        "abc"
-    );
-}
-
-#[test]
-fn text_decoder_decode_no_args() {
-    // decode() with no arguments returns empty string
-    assert_eq!(eval("new TextDecoder().decode()"), "");
-}
-
-#[test]
-fn text_decoder_decode_empty_array() {
-    assert_eq!(eval("new TextDecoder().decode(new Uint8Array([]))"), "");
-}
-
-#[test]
-fn text_decoder_decode_multibyte_utf8() {
-    // "€" = [0xE2, 0x82, 0xAC]
-    assert_eq!(
-        eval("new TextDecoder().decode(new Uint8Array([0xE2, 0x82, 0xAC]))"),
-        "€"
-    );
-}
-
-#[test]
-fn text_decoder_decode_emoji() {
-    // "😀" = [0xF0, 0x9F, 0x98, 0x80]
-    assert_eq!(
-        eval("new TextDecoder().decode(new Uint8Array([0xF0, 0x9F, 0x98, 0x80]))"),
-        "😀"
-    );
-}
-
-// ── TextDecoder error handling ──
-
-#[test]
-fn text_decoder_invalid_label_throws() {
-    assert!(throws("new TextDecoder('invalid-encoding')"));
-}
-
-#[test]
-fn text_decoder_replacement_encoding_throws() {
-    // "replacement" is not a valid label for TextDecoder (excluded by spec)
-    assert!(throws("new TextDecoder('replacement')"));
-}
-
-#[test]
-fn text_decoder_fatal_invalid_bytes() {
-    // Invalid UTF-8 sequence with fatal: true should throw
-    assert!(throws(
-        "new TextDecoder('utf-8', { fatal: true }).decode(new Uint8Array([0xFF, 0xFE]))"
-    ));
-}
-
-#[test]
-fn text_decoder_replacement_mode_invalid_bytes() {
-    // Invalid UTF-8 in replacement mode should produce U+FFFD
-    assert_eq!(
-        eval(
-            r#"
-            const decoder = new TextDecoder('utf-8');
-            const result = decoder.decode(new Uint8Array([0xFF]));
-            result === '\uFFFD'
-        "#
-        ),
-        "true"
-    );
-}
-
-// ── TextDecoder streaming ──
-
-#[test]
-fn text_decoder_streaming() {
-    // Multi-byte character split across two decode() calls
-    // "€" = [0xE2, 0x82, 0xAC]
-    assert_eq!(
-        eval(
-            r#"
-            const decoder = new TextDecoder();
-            let result = decoder.decode(new Uint8Array([0xE2, 0x82]), { stream: true });
-            result += decoder.decode(new Uint8Array([0xAC]));
-            result
-        "#
-        ),
-        "€"
-    );
-}
-
-// ── TextDecoder with non-UTF-8 encodings ──
-
-#[test]
-fn text_decoder_windows_1252() {
-    // 0xE9 in windows-1252 is "é"
-    assert_eq!(
-        eval(r#"new TextDecoder('windows-1252').decode(new Uint8Array([0xE9]))"#),
-        "é"
-    );
-}
-
-// ── WebIDL interface compliance ──
-
-#[test]
-fn text_encoder_to_string_tag() {
-    assert_eq!(
-        eval("Object.prototype.toString.call(new TextEncoder())"),
-        "[object TextEncoder]"
-    );
-}
-
-#[test]
-fn text_decoder_to_string_tag() {
-    assert_eq!(
-        eval("Object.prototype.toString.call(new TextDecoder())"),
-        "[object TextDecoder]"
-    );
-}
-
 /// windows-1252 input without bytes in 0x80..=0x9F decodes to the same code points, and input
 /// with them maps those bytes through the encoding's table, including when a streaming decode
 /// alternates between the two.
diff --git a/crates/builtins/web-globals/tests/globals.rs b/crates/builtins/web-globals/tests/globals.rs
new file mode 100644
index 00000000..aeebeef7
--- /dev/null
+++ b/crates/builtins/web-globals/tests/globals.rs
@@ -0,0 +1,280 @@
+// SPDX-License-Identifier: Apache-2.0-WITH-LLVM-exception
+
+//! Integration tests for the globals that have no test file of their own: `location`,
+//! `DOMException` and the errors builtins throw, and `performance`.
+
+// This file contains nothing platform-specific, so skip it on wasm32.
+#![cfg(not(target_arch = "wasm32"))]
+
+mod worker_location {
+    use core_runtime::{runtime, test_util::eval_with_setup};
+    use web_globals::worker_location::{add_to_global, clear_init_location, set_init_location};
+
+    fn eval(code: &str) -> String {
+        eval_with_setup(
+            || {
+                clear_init_location();
+                runtime::register_global_initializer(add_to_global);
+            },
+            code,
+        )
+    }
+
+    fn eval_with_url(location_url: &str, code: &str) -> String {
+        eval_with_setup(
+            || {
+                set_init_location(url::Url::parse(location_url).unwrap());
+                runtime::register_global_initializer(add_to_global);
+            },
+            code,
+        )
+    }
+
+    #[test]
+    fn accessors_serialize_the_url() {
+        assert_eq!(
+            eval_with_url(
+                "https://example.com:8443/foo/bar?x=1#frag",
+                "[location.href, location.origin, location.protocol, location.host,
+                  location.hostname, location.port, location.pathname, location.search,
+                  location.hash, location.toString() === location.href,
+                  Object.prototype.toString.call(location)].join(' ')"
+            ),
+            "https://example.com:8443/foo/bar?x=1#frag https://example.com:8443 https: \
+             example.com:8443 example.com 8443 /foo/bar ?x=1 #frag true [object Location]"
+        );
+    }
+
+    #[test]
+    fn absent_port_search_and_hash_are_empty_strings() {
+        assert_eq!(
+            eval_with_url(
+                "https://example.com/",
+                "[location.port, location.search, location.hash].join(',')"
+            ),
+            ",,"
+        );
+    }
+
+    #[test]
+    fn constructor_throws() {
+        // WorkerLocation has no IDL constructor; `new WorkerLocation()` must throw.
+        assert_eq!(
+            eval(
+                "try { new WorkerLocation(); 'no-throw' } \
+                 catch(e) { (e instanceof TypeError) + ',' + e.message }"
+            ),
+            "true,Illegal constructor"
+        );
+    }
+
+    #[test]
+    fn unset_location_throws_typeerror() {
+        // With no init-location configured, every accessor throws.
+        assert_eq!(
+            eval(
+                "try { location.href; 'no-throw' } \
+                 catch(e) { (e instanceof TypeError) + ',' + e.message.includes('--init-location') }"
+            ),
+            "true,true"
+        );
+        assert_eq!(
+            eval(
+                "try { location.toString(); 'no-throw' } \
+                 catch(e) { e instanceof TypeError }"
+            ),
+            "true"
+        );
+    }
+}
+
+mod dom_exception {
+    use core_runtime::{
+        config::RuntimeConfig,
+        runtime::{self, Runtime},
+    };
+    use web_globals::dom_exception::DOMException;
+
+    #[test]
+    fn rust_new() {
+        runtime::register_global_initializer(DOMException::add_to_global);
+        let rt = Runtime::init(&RuntimeConfig::default()).expect("runtime init");
+        let scope = rt.default_global();
+        let e = DOMException::new(&scope, String::new(), "Error".into()).unwrap();
+        assert_eq!(&*e.name(), "Error");
+        assert_eq!(&*e.message(), "");
+        assert_eq!(e.code(), 0);
+    }
+}
+
+/// Tests for typed error dispatch via `ThrowException` trait.
+///
+/// These tests use `#[jsglobals]` to register functions that return
+/// `Result<T, TypeError>`, `Result<T, RangeError>`, `Result<T, SyntaxError>`,
+/// `Result<T, DOMExceptionError>`, and `Result<T, String>`.
+mod throw_exception {
+    use core_runtime::{jsglobals, test_util::eval_with_setup};
+    use js::error::{RangeError, SyntaxError, TypeError};
+    use web_globals::dom_exception::DOMExceptionError;
+
+    #[jsglobals]
+    mod test_error_globals {
+        use super::*;
+
+        /// Throws a TypeError.
+        pub fn throw_type_error() -> Result<(), TypeError> {
+            Err(TypeError("test type error".into()))
+        }
+
+        /// Throws a RangeError.
+        pub fn throw_range_error() -> Result<(), RangeError> {
+            Err(RangeError("test range error".into()))
+        }
+
+        /// Throws a SyntaxError.
+        pub fn throw_syntax_error() -> Result<(), SyntaxError> {
+            Err(SyntaxError("test syntax error".into()))
+        }
+
+        /// Throws a TypeError from a String error.
+        pub fn throw_string_error() -> Result<(), String> {
+            Err("test string error".into())
+        }
+
+        /// Throws a DOMExceptionError.
+        pub fn throw_dom_exception_error() -> Result<(), DOMExceptionError> {
+            Err(DOMExceptionError::new(
+                "NotFoundError",
+                "test dom exception",
+            ))
+        }
+    }
+
+    fn eval(code: &str) -> String {
+        eval_with_setup(
+            || {
+                core_runtime::runtime::register_global_initializer(
+                    web_globals::dom_exception::DOMException::add_to_global,
+                );
+                core_runtime::runtime::register_global_initializer(
+                    test_error_globals::add_to_global,
+                );
+            },
+            code,
+        )
+    }
+
+    /// Capturing the stack for a new `DOMException` is best-effort: a throwing
+    /// `Error.prototype.stack` accessor leaves the construction intact and no
+    /// exception pending.
+    #[test]
+    fn construction_survives_a_throwing_stack_accessor() {
+        assert_eq!(
+            eval(
+                "Object.defineProperty(Error.prototype, 'stack', { get() { throw 1; }, configurable: true });
+                 const e = new DOMException('m', 'NotFoundError');
+                 e.name + ',' + e.message"
+            ),
+            "NotFoundError,m"
+        );
+    }
+
+    #[test]
+    fn type_error_thrown() {
+        assert_eq!(
+            eval(
+                "try { throwTypeError(); 'no' } catch(e) { (e instanceof TypeError) + ',' + e.message }"
+            ),
+            "true,test type error"
+        );
+    }
+
+    #[test]
+    fn range_error_thrown() {
+        assert_eq!(
+            eval(
+                "try { throwRangeError(); 'no' } catch(e) { (e instanceof RangeError) + ',' + e.message }"
+            ),
+            "true,test range error"
+        );
+    }
+
+    #[test]
+    fn syntax_error_thrown() {
+        assert_eq!(
+            eval(
+                "try { throwSyntaxError(); 'no' } catch(e) { (e instanceof SyntaxError) + ',' + e.message }"
+            ),
+            "true,test syntax error"
+        );
+    }
+
+    #[test]
+    fn string_error_throws_type_error() {
+        // String errors throw TypeError.
+        assert_eq!(
+            eval(
+                "try { throwStringError(); 'no' } catch(e) { (e instanceof TypeError) + ',' + e.message }"
+            ),
+            "true,test string error"
+        );
+    }
+
+    #[test]
+    fn dom_exception_error_thrown() {
+        assert_eq!(
+            eval(
+                "try { throwDomExceptionError(); 'no' } catch(e) { \
+                    (e instanceof DOMException) + ',' + e.name + ',' + e.message }"
+            ),
+            "true,NotFoundError,test dom exception"
+        );
+    }
+}
+
+mod performance {
+    use core_runtime::{runtime, test_util::eval_with_setup};
+
+    /// Whether 20 readings each of `performance.now()` and `new Event('x').timeStamp` are all
+    /// multiples of 100 microseconds, as `"{now},{timeStamp}"`, with the web security
+    /// restrictions set to `restricted`.
+    fn readings_are_coarsened(restricted: bool) -> String {
+        eval_with_setup(
+            || match restricted {
+                true => runtime::register_global_initializer(|scope, global| {
+                    core_runtime::config::set_web_security_restrictions(true);
+                    web_globals::add_to_global(scope, global);
+                }),
+                false => runtime::register_global_initializer(|scope, global| {
+                    core_runtime::config::set_web_security_restrictions(false);
+                    web_globals::add_to_global(scope, global);
+                }),
+            },
+            "(() => {
+                const coarsened = (read) => {
+                    const times = [];
+                    for (let i = 0; i < 20; i++) {
+                        times.push(read());
+                    }
+                    return times.every((t) => Math.abs(t * 10 - Math.round(t * 10)) < 1e-6);
+                };
+                return [
+                    coarsened(() => performance.now()),
+                    coarsened(() => new Event('x').timeStamp),
+                ].join(',');
+            })()",
+        )
+    }
+
+    #[test]
+    fn clocks_are_coarsened_under_web_security_restrictions() {
+        assert_eq!(readings_are_coarsened(true), "true,true");
+    }
+
+    /// Only `performance.now()` is checked: the coarse clock behind `Event.timeStamp` can lag the
+    /// time origin, and a reading that lags it is zero, which is a multiple of 100 microseconds.
+    #[test]
+    fn performance_now_is_precise_without_web_security_restrictions() {
+        assert!(readings_are_coarsened(false).starts_with("false,"));
+    }
+}
diff --git a/crates/builtins/web-globals/tests/structured_clone.rs b/crates/builtins/web-globals/tests/structured_clone.rs
index 16982606..406db36f 100644
--- a/crates/builtins/web-globals/tests/structured_clone.rs
+++ b/crates/builtins/web-globals/tests/structured_clone.rs
@@ -19,253 +19,128 @@ fn throws(code: &str) -> bool {
     throws_with_setup(setup, code)
 }
 
-// ── structuredClone exists ──
-
-#[test]
-fn structured_clone_exists() {
-    assert_eq!(eval("typeof structuredClone"), "function");
-}
-
-#[test]
-fn structured_clone_length_excludes_optional() {
-    // WebIDL `.length` counts required arguments only: the optional `options`
-    // dictionary must not be counted.
-    assert_eq!(eval("structuredClone.length"), "1");
-}
-
-// ── Primitives ──
-
-#[test]
-fn clone_undefined() {
-    assert_eq!(eval("structuredClone(undefined)"), "undefined");
-}
-
-#[test]
-fn clone_null() {
-    assert_eq!(eval("structuredClone(null)"), "null");
-}
-
-#[test]
-fn clone_boolean_true() {
-    assert_eq!(eval("structuredClone(true)"), "true");
-}
-
 #[test]
-fn clone_boolean_false() {
-    assert_eq!(eval("structuredClone(false)"), "false");
-}
-
-#[test]
-fn clone_number() {
-    assert_eq!(eval("structuredClone(42)"), "42");
-}
-
-#[test]
-fn clone_negative_zero() {
-    assert_eq!(eval("Object.is(structuredClone(-0), -0)"), "true");
-}
-
-#[test]
-fn clone_nan() {
-    assert_eq!(eval("Number.isNaN(structuredClone(NaN))"), "true");
-}
-
-#[test]
-fn clone_infinity() {
-    assert_eq!(eval("structuredClone(Infinity)"), "Infinity");
-}
-
-#[test]
-fn clone_string() {
-    assert_eq!(eval("structuredClone('hello')"), "hello");
-}
-
-#[test]
-fn clone_empty_string() {
-    assert_eq!(eval("structuredClone('')"), "");
-}
-
-#[test]
-fn clone_bigint() {
-    assert_eq!(eval("structuredClone(42n).toString()"), "42");
-}
-
-// ── Objects ──
-
-#[test]
-fn clone_plain_object() {
+fn structured_clone_is_a_function_of_one_argument() {
+    // WebIDL `.length` counts required arguments only, so the optional `options` dictionary isn't
+    // counted.
     assert_eq!(
-        eval("JSON.stringify(structuredClone({a: 1, b: 'hello'}))"),
-        r#"{"a":1,"b":"hello"}"#
+        eval("typeof structuredClone + ',' + structuredClone.length"),
+        "function,1"
     );
 }
 
 #[test]
-fn clone_is_deep_copy() {
-    assert_eq!(
-        eval("let o = {a: {b: 1}}; let c = structuredClone(o); o.a.b = 2; c.a.b"),
-        "1"
-    );
-}
-
-#[test]
-fn clone_preserves_identity() {
-    // The clone should be a different object.
-    assert_eq!(eval("let o = {}; structuredClone(o) === o"), "false");
-}
-
-// ── Arrays ──
-
-#[test]
-fn clone_array() {
+fn clone_primitives() {
     assert_eq!(
-        eval("JSON.stringify(structuredClone([1, 2, 3]))"),
-        "[1,2,3]"
-    );
-}
-
-#[test]
-fn clone_nested_array() {
-    assert_eq!(
-        eval("JSON.stringify(structuredClone([[1], [2, [3]]]))"),
-        "[[1],[2,[3]]]"
-    );
-}
-
-// ── Date ──
-
-#[test]
-fn clone_date() {
-    assert_eq!(
-        eval("structuredClone(new Date('2024-01-01T00:00:00Z')).toISOString()"),
-        "2024-01-01T00:00:00.000Z"
-    );
-}
-
-// ── RegExp ──
-
-#[test]
-fn clone_regexp() {
-    assert_eq!(
-        eval("let r = structuredClone(/abc/gi); r.source + ',' + r.flags"),
-        "abc,gi"
+        eval(
+            "[undefined, null, true, false, 42, Infinity, 'hello', '', 42n]
+               .map((v) => String(structuredClone(v)))
+               .concat(Object.is(structuredClone(-0), -0), Number.isNaN(structuredClone(NaN)))
+               .join()"
+        ),
+        "undefined,null,true,false,42,Infinity,hello,,42,true,true"
     );
 }
 
-// ── Map ──
-
 #[test]
-fn clone_map() {
+fn clone_wrapped_primitives() {
     assert_eq!(
         eval(
-            "let m = new Map([['a', 1], ['b', 2]]); \
-             let c = structuredClone(m); \
-             c.get('a') + ',' + c.get('b') + ',' + (c !== m)"
+            "[Object(true), Object(42), Object('hello')]
+               .map((v) => { const c = structuredClone(v); return typeof c + ':' + (c == v.valueOf()); })
+               .join()"
         ),
-        "1,2,true"
+        "object:true,object:true,object:true"
     );
 }
 
-// ── Set ──
-
 #[test]
-fn clone_set() {
+fn clone_objects_and_arrays_deeply() {
     assert_eq!(
         eval(
-            "let s = new Set([1, 2, 3]); \
-             let c = structuredClone(s); \
-             c.has(1) + ',' + c.has(2) + ',' + c.has(3) + ',' + (c !== s)"
+            "let o = {a: {b: 1}, s: 'hello', arr: [[1], [2, [3]]]}; \
+             let c = structuredClone(o); \
+             o.a.b = 2; \
+             [c !== o, c.a.b, c.s, JSON.stringify(c.arr)].join(' ')"
         ),
-        "true,true,true,true"
+        "true 1 hello [[1],[2,[3]]]"
     );
 }
 
-// ── ArrayBuffer ──
-
 #[test]
-fn clone_arraybuffer() {
+fn clone_circular_reference() {
     assert_eq!(
         eval(
-            "let buf = new ArrayBuffer(4); \
-             new Uint8Array(buf).set([1, 2, 3, 4]); \
-             let clone = structuredClone(buf); \
-             let arr = new Uint8Array(clone); \
-             arr[0] + ',' + arr[1] + ',' + arr[2] + ',' + arr[3] + ',' + (clone !== buf)"
+            "let o = {a: 1}; o.self = o; \
+             let c = structuredClone(o); \
+             c.a + ',' + (c.self === c)"
         ),
-        "1,2,3,4,true"
+        "1,true"
     );
 }
 
-// ── TypedArray ──
-
 #[test]
-fn clone_uint8array() {
+fn clone_date_and_regexp() {
     assert_eq!(
         eval(
-            "let a = new Uint8Array([10, 20, 30]); \
-             let c = structuredClone(a); \
-             c[0] + ',' + c[1] + ',' + c[2] + ',' + (c !== a)"
+            "let r = structuredClone(/abc/gi); \
+             structuredClone(new Date('2024-01-01T00:00:00Z')).toISOString() + ',' + \
+             r.source + ',' + r.flags"
         ),
-        "10,20,30,true"
+        "2024-01-01T00:00:00.000Z,abc,gi"
     );
 }
 
-// ── Circular references ──
-
 #[test]
-fn clone_circular_reference() {
+fn clone_map_and_set() {
     assert_eq!(
         eval(
-            "let o = {a: 1}; o.self = o; \
-             let c = structuredClone(o); \
-             c.a + ',' + (c.self === c)"
+            "let m = new Map([['a', 1], ['b', 2]]); \
+             let s = new Set([1, 2, 3]); \
+             let cm = structuredClone(m); \
+             let cs = structuredClone(s); \
+             [cm.get('a'), cm.get('b'), cm !== m, cs.has(1), cs.has(2), cs.has(3), cs !== s].join()"
         ),
-        "1,true"
+        "1,2,true,true,true,true,true"
     );
 }
 
-// ── Error ──
-
 #[test]
-fn clone_error() {
+fn clone_arraybuffer_and_typed_array() {
     assert_eq!(
         eval(
-            "let e = new Error('test'); \
-             let c = structuredClone(e); \
-             (c instanceof Error) + ',' + c.message"
+            "let buf = new ArrayBuffer(4); \
+             new Uint8Array(buf).set([1, 2, 3, 4]); \
+             let clone = structuredClone(buf); \
+             let a = new Uint8Array([10, 20, 30]); \
+             let c = structuredClone(a); \
+             [...new Uint8Array(clone), clone !== buf, ...c, c !== a].join()"
         ),
-        "true,test"
+        "1,2,3,4,true,10,20,30,true"
     );
 }
 
 #[test]
-fn clone_type_error() {
+fn clone_errors() {
     assert_eq!(
         eval(
-            "let e = new TypeError('bad'); \
-             let c = structuredClone(e); \
-             (c instanceof TypeError) + ',' + c.message"
+            "[new Error('test'), new TypeError('bad')] \
+               .map((e) => { const c = structuredClone(e); \
+                             return (c instanceof e.constructor) + ':' + c.message; }) \
+               .join()"
         ),
-        "true,bad"
+        "true:test,true:bad"
     );
 }
 
-// ── Non-cloneable types ──
-
 #[test]
-fn clone_function_throws() {
+fn clone_functions_and_symbols_throws() {
     assert!(throws("structuredClone(function() {})"));
-}
-
-#[test]
-fn clone_symbol_throws() {
     assert!(throws("structuredClone(Symbol('test'))"));
 }
 
-// ── Transfer ──
-
 #[test]
-fn transfer_arraybuffer() {
+fn transfer_arraybuffer_detaches_the_source() {
     assert_eq!(
         eval(
             "let buf = new ArrayBuffer(4); \
@@ -275,10 +150,6 @@ fn transfer_arraybuffer() {
         ),
         "1,0"
     );
-}
-
-#[test]
-fn transfer_detaches_source() {
     assert!(throws(
         "let buf = new ArrayBuffer(4); \
          structuredClone(buf, { transfer: [buf] }); \
@@ -286,59 +157,13 @@ fn transfer_detaches_source() {
     ));
 }
 
-// ── Options edge cases ──
-
-#[test]
-fn options_null_is_ok() {
-    assert_eq!(eval("structuredClone(42, null)"), "42");
-}
-
-#[test]
-fn options_undefined_is_ok() {
-    assert_eq!(eval("structuredClone(42, undefined)"), "42");
-}
-
-#[test]
-fn options_empty_object_is_ok() {
-    assert_eq!(eval("structuredClone(42, {})"), "42");
-}
-
-#[test]
-fn options_empty_transfer_is_ok() {
-    assert_eq!(eval("structuredClone(42, { transfer: [] })"), "42");
-}
-
-// ── Wrapped primitives ──
-
-#[test]
-fn clone_boolean_object() {
-    assert_eq!(
-        eval(
-            "let b = structuredClone(Object(true)); \
-             (typeof b) + ',' + (b == true)"
-        ),
-        "object,true"
-    );
-}
-
-#[test]
-fn clone_number_object() {
-    assert_eq!(
-        eval(
-            "let n = structuredClone(Object(42)); \
-             (typeof n) + ',' + (n == 42)"
-        ),
-        "object,true"
-    );
-}
-
 #[test]
-fn clone_string_object() {
+fn options_can_be_null_undefined_or_empty() {
     assert_eq!(
         eval(
-            "let s = structuredClone(Object('hello')); \
-             (typeof s) + ',' + (s == 'hello')"
+            "[structuredClone(42, null), structuredClone(42, undefined), structuredClone(42, {}), \
+              structuredClone(42, { transfer: [] })].join()"
         ),
-        "object,true"
+        "42,42,42,42"
     );
 }
diff --git a/crates/builtins/web-streams/Cargo.toml b/crates/builtins/web-streams/Cargo.toml
index e0aa2df2..4d8a4b8b 100644
--- a/crates/builtins/web-streams/Cargo.toml
+++ b/crates/builtins/web-streams/Cargo.toml
@@ -7,17 +7,21 @@ authors.workspace = true
 edition.workspace = true
 
 [lib]
-# No unit tests; skip building the (SpiderMonkey-sized) lib test harness binary.
+# No unit tests. This skips building the (SpiderMonkey-sized) lib test harness binary.
 test = false
 
 [dependencies]
 smallvec.workspace = true
 core-runtime.workspace = true
 js.workspace = true
+platform.workspace = true
 web-globals.workspace = true
 
 [dev-dependencies]
 libstarling.workspace = true
 
+[target.'cfg(not(target_arch = "wasm32"))'.dev-dependencies]
+tokio.workspace = true
+
 [lints]
 workspace = true
diff --git a/crates/builtins/web-streams/src/algorithms.rs b/crates/builtins/web-streams/src/algorithms.rs
index 09e38af9..ca28081e 100644
--- a/crates/builtins/web-streams/src/algorithms.rs
+++ b/crates/builtins/web-streams/src/algorithms.rs
@@ -49,7 +49,7 @@ pub(crate) fn pair_parts<'r>(
     scope: &'r Scope<'_>,
     payload: HandleValue<'_>,
 ) -> (HandleValue<'r>, HandleValue<'r>) {
-    let arr = Object::from_value(scope, *payload).expect("payload is an array");
+    let arr = Object::from_raw_value(scope, payload.get()).expect("payload is an array");
     (
         arr.get_element(scope, 0).expect("element 0"),
         arr.get_element(scope, 1).expect("element 1"),
diff --git a/crates/builtins/web-streams/src/lib.rs b/crates/builtins/web-streams/src/lib.rs
index 93cf275a..a0fb19e7 100644
--- a/crates/builtins/web-streams/src/lib.rs
+++ b/crates/builtins/web-streams/src/lib.rs
@@ -31,18 +31,17 @@ pub fn add_to_global(scope: &Scope<'_>, global: Object<'_>) {
     queuing::ByteLengthQueuingStrategy::add_to_global(scope, global);
     queuing::CountQueuingStrategy::add_to_global(scope, global);
 
-    // The tee/pipe/from-iterable algorithms keep their cross-callback state in
-    // internal `#[jsclass]` objects (so the state is GC-traced and reachable
-    // through each callback's payload). They are created via `create_instance_with`,
-    // which needs the prototype registered per-global — but they are not
-    // web-exposed interfaces, so the named constructor that `add_to_global`
-    // installs is deleted from the global afterward (the prototype registry, keyed
-    // by TypeId, is unaffected).
+    // Internal classes holding the state of tee, pipe, from-iterable, read-all-bytes, native
+    // source and native pump operations. Creating instances needs their prototypes registered,
+    // and `hidden` keeps their constructors off the global.
     readable::algorithms::TeeState::add_to_global(scope, global);
     readable::algorithms::ByteTeeState::add_to_global(scope, global);
     readable::algorithms::PipeState::add_to_global(scope, global);
     readable::algorithms::FromIterableState::add_to_global(scope, global);
     readable::read_all_bytes::ReadAllBytesState::add_to_global(scope, global);
+    readable::native_byte_source::NativeByteSource::add_to_global(scope, global);
+    readable::native_pump::NativePump::add_to_global(scope, global);
+    js::iteration::AsyncIteratorRecord::add_to_global(scope, global);
 
     // Chain the async iterator's prototype under `%AsyncIteratorPrototype%` so it
     // inherits `[Symbol.asyncIterator]` (returning `this`).
@@ -70,7 +69,7 @@ pub fn add_to_global(scope: &Scope<'_>, global: Object<'_>) {
     // (auto-allocation and `ReadableStreamBYOBRequest.view`). Resolve those standard
     // constructors now, while no stream state is live, so their lazy
     // first-construction never runs mid-operation with byte-stream objects
-    // reachable — which otherwise trips a GC tracer assertion under moving GC.
+    // reachable. That trips a GC tracer assertion under moving GC.
     for key in [
         js::class_spec::JSProtoKey::JSProto_ArrayBuffer,
         js::class_spec::JSProtoKey::JSProto_Uint8Array,
diff --git a/crates/builtins/web-streams/src/queuing/queue_with_sizes.rs b/crates/builtins/web-streams/src/queuing/queue_with_sizes.rs
index 2ef7c926..8837fd05 100644
--- a/crates/builtins/web-streams/src/queuing/queue_with_sizes.rs
+++ b/crates/builtins/web-streams/src/queuing/queue_with_sizes.rs
@@ -4,13 +4,6 @@
 //! controllers.
 //!
 //! <https://streams.spec.whatwg.org/#queue-with-sizes>
-//!
-//! The spec models these containers as having `[[queue]]` (a list of
-//! "value-with-size" records) and `[[queueTotalSize]]` (a number) internal
-//! slots, and defines the queue operations (`EnqueueValueWithSize`,
-//! `DequeueValue`, `PeekQueueValue`, `ResetQueue`) generically over any such
-//! container. The [`QueueWithSizes`] trait captures that shared shape so the
-//! operations in [`crate::algorithms`] can run against either controller.
 
 use std::collections::VecDeque;
 
diff --git a/crates/builtins/web-streams/src/readable/algorithms.rs b/crates/builtins/web-streams/src/readable/algorithms.rs
index 93d68a9a..162362f7 100644
--- a/crates/builtins/web-streams/src/readable/algorithms.rs
+++ b/crates/builtins/web-streams/src/readable/algorithms.rs
@@ -160,7 +160,7 @@ impl GenericReader for BYOBReader<'_> {
 /// Construct a view over `buffer` and return it as a rooted value, panicking on
 /// failure. Used where the spec performs an infallible `! Construct(...)` (e.g.
 /// the empty view handed to a read-into request's close steps).
-fn construct_view_or_throw<'r>(
+fn construct_view_or_panic<'r>(
     scope: &'r Scope<'_>,
     kind: js::typedarray::ViewKind,
     buffer: js::ArrayBuffer<'_>,
@@ -190,9 +190,7 @@ fn error_controller_with_pending(
     )
 }
 
-/// A native fulfillment reaction that ignores its argument and returns
-/// undefined, used to implement the spec's "react to `p` with a fulfillment
-/// step that returns undefined".
+/// A native reaction that ignores its argument and returns undefined.
 fn return_undefined(
     _scope: &Scope<'_>,
     _args: CallbackArgs<'_>,
@@ -438,9 +436,6 @@ fn tee_closed_rejected(
     Ok(value::undefined())
 }
 
-/// Tee branches are created with the default (constant-1) size algorithm, so
-/// their controllers' `enqueue` can never run the size algorithm and therefore
-/// never throws — matching the spec's `! ReadableStreamDefaultControllerEnqueue`.
 const TEE_ENQUEUE_INFALLIBLE: &str =
     "tee branch enqueue is infallible: branches use the default constant-1 size algorithm";
 
@@ -1064,13 +1059,9 @@ pub(crate) fn readable_stream_pipe_to<'r>(
     if let Some(host_source) = source.native_source(scope) {
         let transform = dest.data().identity_transform.get(scope);
         if let Some(transform) = transform {
-            // Only when this pipe will close the destination behind it. Handing the native source
-            // on says "the whole of what comes out of this transform is that one body", and a sink
-            // that takes it up bypasses the transform entirely — so anything written into the
-            // transform afterwards would go to a readable end nobody reads, stalling its writer and
-            // never reaching the wire. This pipe holds the writer lock until it is done and then
-            // closes the destination, so nothing can follow it; `preventClose` is precisely the
-            // author saying they intend to write more, and disqualifies the claim.
+            // A sink that takes up the native source bypasses the transform, so chunks written
+            // into the transform after this pipe would never be read. Without `preventClose`,
+            // this pipe holds the writer lock until it closes the destination.
             if !prevent_close {
                 transform
                     .data()
@@ -1184,9 +1175,7 @@ pub(crate) fn readable_stream_pipe_to<'r>(
 
 // ---------------------------------------------------------------------------
 // `ReadableStreamPipeTo` propagation reactions, shutdown machinery, and the
-// read-write loop. See `readable_stream_pipe_to` above; the shared state is a
-// `PipeState` (its fields read/written through `state.data()`/`data_mut()`), and
-// every reaction receives the state object as its payload.
+// read-write loop.
 // ---------------------------------------------------------------------------
 
 /// The action a pipe shutdown performs once pending writes finish.
@@ -1336,7 +1325,7 @@ fn pipe_step(scope: &Scope<'_>, state: PipeState<'_>) {
 
     // Backpressure must be enforced: wait until the writer is ready before
     // reading. The reactions are the per-pipe callbacks created in
-    // `PipeState::new`; attaching them directly allocates nothing per loop turn.
+    // `PipeState::new`. Attaching them directly doesn't allocate per loop turn.
     let writer = pipe_writer(scope, state);
     let ready = writer.data().ready_promise.get(scope);
     let fulfilled = state.data().ready_fulfilled_fn.get(scope);
@@ -1369,30 +1358,14 @@ fn pipe_ready_fulfilled(
     Ok(value::undefined())
 }
 
-/// The writer's ready promise rejected (the destination errored). The backward
-/// error-propagation reaction drives shutdown; nothing to do here, but consuming
-/// the rejection keeps it from surfacing as unhandled.
-fn pipe_ready_rejected(
-    _scope: &Scope<'_>,
-    _args: CallbackArgs<'_>,
-    _payload: HandleValue<'_>,
-) -> Result<Value, ExnThrown> {
-    Ok(value::undefined())
-}
-
 /// The pipe read request's chunk steps: park the chunk, count its pending
 /// write, and schedule the deferred write that will write it to the destination
 /// and continue the loop.
 ///
-/// The write and the next read are deliberately deferred by one microtask rather
-/// than run synchronously here. The spec's pipe step 15 is informal about timing
-/// (whatwg/streams#1243), but every browser defers: Gecko's `OnReadFulfilled`
-/// does `Promise.resolve().then(() => { write(chunk); readNext(); })`. Deferring
-/// matters because a chunk can be delivered to these chunk steps synchronously
-/// (e.g. when `enqueue()` fulfils a pending read in the same turn); running the
-/// sink's `write()` synchronously from `enqueue()` is observable and forbidden
-/// (`streams/piping/general-addition.any.js`: "enqueue() must not synchronously
-/// call write algorithm").
+/// The write and the next read are deferred by one microtask. These chunk steps
+/// can run synchronously from `enqueue()`, and running the sink's `write()`
+/// synchronously from `enqueue()` is observable (WPT
+/// `streams/piping/general-addition.any.js`).
 pub(crate) fn pipe_read_request_chunk_steps(
     scope: &Scope<'_>,
     state: PipeState<'_>,
@@ -1405,9 +1378,8 @@ pub(crate) fn pipe_read_request_chunk_steps(
 }
 
 /// Runs one microtask after a chunk reaches the pipe read request: writes the
-/// parked chunk to the destination and continues the loop. Deferring to here is
-/// what keeps `enqueue()` from synchronously invoking the sink's write algorithm
-/// (see `pipe_read_request_chunk_steps`).
+/// parked chunk to the destination and continues the loop (see
+/// `pipe_read_request_chunk_steps`).
 fn pipe_deferred_write(
     scope: &Scope<'_>,
     _args: CallbackArgs<'_>,
@@ -1739,10 +1711,8 @@ fn pipe_finalize(scope: &Scope<'_>, state: PipeState<'_>, error: Option<HandleVa
     support::report_failure(scope, result, "pipeTo");
     let signal = state.data().signal.get(scope);
     if let Some(signal) = signal {
-        // Detach the abort algorithm registered in `PipeState::new`, so a later
-        // abort of a still-live signal does not run it after the pipe has
-        // finished. (Harmless if it did since shutdown is idempotent, but this avoids
-        // keeping the finished pipe reachable from the signal.)
+        // Detach the abort algorithm registered in `PipeState::new`, so the signal
+        // no longer keeps the finished pipe reachable.
         let abort_fn = state.data().abort_algorithm.get(scope);
         if let Some(abort_fn) = abort_fn {
             web_globals::signals::algorithms::remove_abort_algorithm(&signal, &abort_fn);
@@ -1796,7 +1766,6 @@ pub(crate) struct TeeState {
     chunk_microtask_fn: Heap<js::function::Function>,
 }
 
-/// Steps 4-18 of `ReadableStreamDefaultTee` are algorithm.
 #[jsmethods]
 impl TeeState<'_> {
     fn new(
@@ -1825,7 +1794,6 @@ impl TeeState<'_> {
         self.data_mut().stream.set(stream);
         self.data_mut().reader.set(reader);
 
-        // The chunk-steps microtask callback, reused for every chunk.
         let microtask = Function::new_callback(scope, c"", 0, tee_chunk_microtask, self)?;
         self.data_mut().chunk_microtask_fn.set(microtask);
 
@@ -1879,11 +1847,8 @@ pub(crate) struct PipeState {
     /// `pipe_read_request_chunk_steps`).
     pending_chunk: Heap<Value>,
     /// The number of chunks that have been read but whose writes have not yet
-    /// settled. Counted eagerly at the read request's chunk steps; decremented
-    /// by each write's settle reaction (`pipe_write_settled`). Shutdown's "wait
-    /// until every chunk that has been read has been written" is implemented as
-    /// waiting for this count to drain. The count is pipe-internal, so the
-    /// difference from the spec's promise chaining is unobservable.
+    /// settled. Incremented by the read request's chunk steps and decremented
+    /// by each write's settle reaction (`pipe_write_settled`).
     pending_writes: u32,
     /// The loop's reaction callbacks, allocated once in the constructor, so the
     /// steady-state loop allocates no callback objects per chunk.
@@ -1924,11 +1889,12 @@ impl PipeState<'_> {
         self.data_mut().write_settled_fn.set(settled);
         let ready_ok = Function::new_callback(scope, c"", 1, pipe_ready_fulfilled, self)?;
         self.data_mut().ready_fulfilled_fn.set(ready_ok);
-        // The ready-rejection swallower uses no per-pipe state; share one per global.
+        // A rejected ready promise means the destination errored, which the backward
+        // error-propagation reaction handles. The rejection only needs consuming.
         let ready_err = js::class::get_or_init_shared_function(
             scope,
-            pipe_ready_rejected as *const () as usize,
-            |scope| Function::new_callback(scope, c"", 1, pipe_ready_rejected, ()),
+            return_undefined as *const () as usize,
+            |scope| Function::new_callback(scope, c"", 1, return_undefined, ()),
         )?;
         self.data_mut().ready_rejected_fn.set(ready_err);
         self.data_mut().promise.set(Promise::new_pending(scope)?);
@@ -2141,10 +2107,9 @@ pub(crate) fn readable_byte_stream_tee<'r>(
     Ok((branch1, branch2))
 }
 
-/// The shared state backing `ReadableByteStreamTee`. Not exposed to JS
-/// (`hidden`); created internally and reached through each callback's payload.
-/// The `reader` holds whichever reader type (default or BYOB) is currently in
-/// use; it is swapped by `pullWithDefaultReader` / `pullWithBYOBReader`.
+/// The shared state backing `ReadableByteStreamTee`, passed as each callback's
+/// payload. The `reader` holds whichever reader type (default or BYOB) is
+/// currently in use. `pullWithDefaultReader` and `pullWithBYOBReader` swap it.
 #[jsclass(hidden)]
 pub(crate) struct ByteTeeState {
     stream: Heap<ReadableStreamImpl>,
@@ -2164,7 +2129,7 @@ pub(crate) struct ByteTeeState {
     pending_chunk: Heap<Value>,
     pending_for_branch2: bool,
     /// The two chunk-steps microtask callbacks, allocated once in the constructor
-    /// and queued directly on the job queue per chunk, so delivery allocates nothing.
+    /// and queued directly on the job queue per chunk, so delivery doesn't allocate.
     default_microtask_fn: Heap<js::function::Function>,
     byob_microtask_fn: Heap<js::function::Function>,
 }
@@ -2184,7 +2149,6 @@ impl ByteTeeState<'_> {
             .cancel_promise
             .set(Promise::new_pending(scope)?);
 
-        // The chunk-steps microtask callbacks, reused for every chunk.
         let default_mt = Function::new_callback(scope, c"", 0, byte_tee_default_microtask, self)?;
         self.data_mut().default_microtask_fn.set(default_mt);
         let byob_mt = Function::new_callback(scope, c"", 0, byte_tee_byob_microtask, self)?;
@@ -2210,10 +2174,7 @@ impl ByteTeeState<'_> {
 }
 
 // ---------------------------------------------------------------------------
-// `ReadableByteStreamTee` reader switching and callbacks. The shared state is a
-// `ByteTeeState` (above), passed as every callback's payload. Its `reader` holds
-// whichever reader type (default or BYOB) is currently in use; it is swapped by
-// `pullWithDefaultReader` / `pullWithBYOBReader`.
+// `ReadableByteStreamTee` reader switching and callbacks.
 // ---------------------------------------------------------------------------
 
 fn byte_tee_stream<'r>(scope: &'r Scope<'_>, state: ByteTeeState<'_>) -> ReadableStream<'r> {
@@ -2292,7 +2253,7 @@ fn byte_tee_forward_rejected(
     let r = args.get(0);
     // If _thisReader_ is not _reader_ (the current reader), return.
     let this_reader =
-        Object::from_value(scope, *this_reader_v).expect("payload reader is an object");
+        Object::from_raw_value(scope, this_reader_v.get()).expect("payload reader is an object");
     let current = byte_tee_reader(scope, state).as_object();
     if this_reader.as_raw() != current.as_raw() {
         return Ok(value::undefined());
@@ -2493,24 +2454,15 @@ pub(crate) fn byte_tee_default_chunk_steps(
     js::jobs::queue_microtask(scope, &microtask)
 }
 
-/// The chunk enqueued into a byte-tee branch is always a fresh, non-detached,
-/// transferable view (the original read result or a `CloneAsUint8Array` clone),
-/// so `ReadableByteStreamControllerEnqueue` never throws — matching the spec's
-/// `! ReadableByteStreamControllerEnqueue`.
 const BYTE_TEE_ENQUEUE_INFALLIBLE: &str =
     "byte tee branch enqueue is infallible: the chunk is a fresh, transferable view";
 
-/// `ReadableByteStreamTee` closes each branch and responds to its pending
-/// pull-into using the branch's own created descriptor and an aligned
-/// (zero-length) view, so these never throw — matching the spec's
-/// `! ReadableByteStreamControllerClose` / `! …Respond` / `! …RespondWithNewView`.
 const BYTE_TEE_SETTLE_INFALLIBLE: &str =
     "byte tee branch close/respond is infallible: created descriptor, aligned view (spec `!`)";
 
 /// Error both branches with `error`, cancel the underlying source, and resolve
-/// the tee's cancel promise — the byte-tee read-request steps' shared failure
-/// path. It backs the chunk steps' chunk-clone failure, and the close steps'
-/// fallible branch close/respond (see [`byte_tee_default_close_steps`]).
+/// the tee's cancel promise. Called when a chunk clone fails and when a branch
+/// close/respond fails (see [`byte_tee_default_close_steps`]).
 fn byte_tee_error_both_branches_and_cancel(
     scope: &Scope<'_>,
     state: ByteTeeState<'_>,
@@ -2553,14 +2505,22 @@ fn byte_tee_default_microtask(
     // If _canceled1_ is false, perform ! `ReadableByteStreamControllerEnqueue`(branch1, chunk1).
     if !canceled1 {
         let b1 = byte_tee_branch_controller(scope, state, false);
-        readable_byte_stream_controller_enqueue(scope, &b1, byte_tee_view(scope, chunk))
-            .expect(BYTE_TEE_ENQUEUE_INFALLIBLE);
+        readable_byte_stream_controller_enqueue(
+            scope,
+            &b1,
+            EnqueueChunk::View(byte_tee_view(scope, chunk)),
+        )
+        .expect(BYTE_TEE_ENQUEUE_INFALLIBLE);
     }
     // If _canceled2_ is false, perform ! `ReadableByteStreamControllerEnqueue`(branch2, chunk2).
     if !canceled2 {
         let b2 = byte_tee_branch_controller(scope, state, true);
-        readable_byte_stream_controller_enqueue(scope, &b2, byte_tee_view(scope, chunk2))
-            .expect(BYTE_TEE_ENQUEUE_INFALLIBLE);
+        readable_byte_stream_controller_enqueue(
+            scope,
+            &b2,
+            EnqueueChunk::View(byte_tee_view(scope, chunk2)),
+        )
+        .expect(BYTE_TEE_ENQUEUE_INFALLIBLE);
     }
     state.data_mut().reading = false;
     if state.data().read_again_for_branch1 {
@@ -2679,7 +2639,7 @@ fn byte_tee_byob_microtask(
                 readable_byte_stream_controller_enqueue(
                     scope,
                     &oc,
-                    byte_tee_view(scope, cloned_chunk),
+                    EnqueueChunk::View(byte_tee_view(scope, cloned_chunk)),
                 )
                 .expect(BYTE_TEE_ENQUEUE_INFALLIBLE);
             }
@@ -2730,12 +2690,7 @@ pub(crate) fn byte_tee_byob_close_steps(
     } else {
         state.data().canceled2
     };
-    // The branch close/respond steps are infallible in the spec, but a
-    // branch whose pending BYOB pull-into is partially filled below its element
-    // size (reachable when a consumer does a multi-byte-element BYOB read and the
-    // source delivers a non-aligned remainder) makes `…ControllerClose` throw its
-    // "insufficient bytes" `TypeError`. Run them as a fallible unit; on failure,
-    // error both branches and cancel the source rather than aborting.
+    // The branch close/respond steps can throw, as in `byte_tee_default_close_steps`.
     let settle = (|| -> Result<(), ExnThrown> {
         // If _byobCanceled_ is false, perform ! `ReadableByteStreamControllerClose`(byobBranch).
         if !byob_canceled {
@@ -3245,14 +3200,8 @@ pub(crate) fn readable_stream_byob_reader_read(
     min: usize,
     read_into_request: ReadIntoRequest,
 ) {
-    // The read-into request carries a `Heap` — the `read()` promise, or the
-    // byte-tee state — that nothing else traces while this synchronous path
-    // runs. The steps below transfer the view's buffer and construct views,
-    // any of which can move that referent under a compacting GC; an untraced
-    // `Heap` would then be left pointing at freed memory and its settling
-    // (`*_steps` → `Heap::take`) would dereference it. Root it for the duration
-    // so the GC keeps its pointer current, and hand it to each consumer via
-    // `take` (leaving the box empty, which traces to nothing).
+    // The steps below allocate and can move the request's referent, so the request
+    // stays rooted until a consumer `take`s it.
     let mut request = RootedTraceableBox::new(Some(read_into_request));
     // Step 1: Let _stream_ be _reader_.`[[stream]]`.
     // Step 2: Assert: _stream_ is not undefined.
@@ -3332,12 +3281,8 @@ pub(crate) fn readable_stream_default_reader_read(
     reader: DefaultReader<'_>,
     read_request: ReadRequest,
 ) {
-    // The read request carries an untraced `Heap` (the `read()` promise, or the
-    // tee/pipe/async-iterator state). The steps below — `stream`/controller
-    // lookups, `[[PullSteps]]`, queue fills — all allocate and can compact,
-    // which would stale that `Heap`. Root it for the duration and hand it to
-    // each consumer via `take` (see `readable_stream_byob_reader_read` for the
-    // same pattern on the BYOB side).
+    // The steps below allocate and can move the request's referent, so the request
+    // stays rooted until a consumer `take`s it.
     let mut read_request = RootedTraceableBox::new(Some(read_request));
     // Step 1: Let _stream_ be _reader_.`[[stream]]`.
     // Step 2: Assert: _stream_ is not undefined.
@@ -4023,12 +3968,40 @@ fn readable_byte_stream_controller_convert_pull_into_descriptor<'r>(
     )
 }
 
+/// The chunk passed to [`readable_byte_stream_controller_enqueue`].
+#[derive(Clone, Copy)]
+pub(crate) enum EnqueueChunk<'v, 's> {
+    /// A view that JavaScript can hold. Its buffer is transferred.
+    View(js::ArrayBufferView<'v>),
+    /// A buffer created by [`ReadableByteStreamController::enqueue_bytes`], which no JavaScript
+    /// has seen. It is queued without being transferred.
+    Owned(js::ArrayBuffer<'s>),
+}
+
+impl EnqueueChunk<'_, '_> {
+    /// The chunk's length in bytes.
+    pub(crate) fn byte_length(&self) -> usize {
+        match self {
+            EnqueueChunk::View(view) => view.byte_length(),
+            EnqueueChunk::Owned(buffer) => buffer.byte_length(),
+        }
+    }
+
+    /// The length in bytes of the buffer holding the chunk.
+    pub(crate) fn buffer_byte_length(&self, scope: &Scope<'_>) -> Result<usize, ExnThrown> {
+        match self {
+            EnqueueChunk::View(view) => Ok(view.viewed_buffer(scope)?.byte_length()),
+            EnqueueChunk::Owned(buffer) => Ok(buffer.byte_length()),
+        }
+    }
+}
+
 /// <https://streams.spec.whatwg.org/#readable-byte-stream-controller-enqueue>
 /// ByteStreamControllerEnqueue(controller, chunk) performs the following steps:
-pub(crate) fn readable_byte_stream_controller_enqueue(
-    scope: &Scope<'_>,
+pub(crate) fn readable_byte_stream_controller_enqueue<'s>(
+    scope: &'s Scope<'_>,
     controller: &ReadableByteStreamController<'_>,
-    chunk: js::ArrayBufferView<'_>,
+    chunk: EnqueueChunk<'_, 's>,
 ) -> Result<(), ExnThrown> {
     // Step 1: Let _stream_ be _controller_.`[[stream]]`.
     let stream = controller.stream(scope);
@@ -4037,21 +4010,28 @@ pub(crate) fn readable_byte_stream_controller_enqueue(
     if controller.data().close_requested || stream.data().state != ReadableStreamState::Readable {
         return Ok(());
     }
-    // Step 3: Let _buffer_ be _chunk_.[[ViewedArrayBuffer]].
-    let buffer = chunk.viewed_buffer(scope)?;
-    // Step 4: Let _byteOffset_ be _chunk_.[[ByteOffset]].
-    let byte_offset = chunk.byte_offset();
-    // Step 5: Let _byteLength_ be _chunk_.[[ByteLength]].
-    let byte_length = chunk.byte_length();
-    // Step 6: If ! `IsDetachedBuffer`(_buffer_) is true, throw a ``TypeError`` exception.
-    if buffer.is_detached() {
-        return Err(js::error::throw_type_error(
-            scope,
-            c"enqueue() view's buffer is detached",
-        ));
-    }
-    // Step 7: Let _transferredBuffer_ be ? `TransferArrayBuffer`(_buffer_).
-    let transferred_buffer = buffer.transfer(scope)?;
+    let (transferred_buffer, byte_offset, byte_length) = match chunk {
+        EnqueueChunk::View(chunk) => {
+            // Step 3: Let _buffer_ be _chunk_.[[ViewedArrayBuffer]].
+            let buffer = chunk.viewed_buffer(scope)?;
+            // Step 4: Let _byteOffset_ be _chunk_.[[ByteOffset]].
+            let byte_offset = chunk.byte_offset();
+            // Step 5: Let _byteLength_ be _chunk_.[[ByteLength]].
+            let byte_length = chunk.byte_length();
+            // Step 6: If ! `IsDetachedBuffer`(_buffer_) is true, throw a ``TypeError`` exception.
+            if buffer.is_detached() {
+                return Err(js::error::throw_type_error(
+                    scope,
+                    c"enqueue() view's buffer is detached",
+                ));
+            }
+            // Step 7: Let _transferredBuffer_ be ? `TransferArrayBuffer`(_buffer_).
+            (buffer.transfer(scope)?, byte_offset, byte_length)
+        }
+        // Step 7 transfers the buffer, which JavaScript holds, so that it can't change the queued
+        // bytes. No JavaScript holds an owned buffer, so it is queued whole without a transfer.
+        EnqueueChunk::Owned(buffer) => (buffer, 0, buffer.byte_length()),
+    };
     // Step 8: If _controller_.`[[pendingPullIntos]]` is not `empty`, Let _firstPendingPullInto_ be
     //         _controller_.`[[pendingPullIntos]]`[0]. If !
     //         `IsDetachedBuffer`(_firstPendingPullInto_’s `buffer`) is true, throw a
@@ -4312,17 +4292,7 @@ fn copy_data_block_bytes(
     src_start: usize,
     count: usize,
 ) {
-    if count == 0 {
-        return;
-    }
-    // SAFETY: `dest` and `src` are distinct live, non-detached `ArrayBuffer`s
-    // (the descriptor's buffer and a queue entry's buffer); no GC runs during
-    // the memcpy, and the ranges are bounds-checked by the slice indexing.
-    unsafe {
-        let d = dest.bytes_mut();
-        let s = src.bytes();
-        d[dest_start..dest_start + count].copy_from_slice(&s[src_start..src_start + count]);
-    }
+    dest.copy_region_from(dest_start, src, src_start, count);
 }
 
 /// The descriptor's `buffer` slot as a rooted `ArrayBuffer`.
@@ -4771,7 +4741,7 @@ pub(crate) fn readable_byte_stream_controller_pull_into(
         // constructed and the close steps run (both can GC).
         let buffer = descriptor_buffer(scope, pull_into_descriptor.as_ref().unwrap());
         let byte_offset = pull_into_descriptor.as_ref().unwrap().byte_offset;
-        let empty_view = construct_view_or_throw(scope, view_kind, buffer, byte_offset, 0);
+        let empty_view = construct_view_or_panic(scope, view_kind, buffer, byte_offset, 0);
         read_into_request
             .take()
             .unwrap()
@@ -4921,19 +4891,11 @@ pub(crate) fn readable_byte_stream_controller_respond_in_closed_state(
     let stream = controller.stream(scope);
     if readable_stream_has_byob_reader(scope, &stream) {
         // The spec collects all the descriptors into `filledPullIntos` and then
-        // commits them. A descriptor shifted out of `[[pendingPullIntos]]` is no
-        // longer traced by the controller, and `CommitPullIntoDescriptor` runs
-        // steps that can GC (`TransferArrayBuffer`, constructing the view). A
-        // shifted descriptor must therefore stay rooted for the whole commit —
-        // both so its `buffer` survives until it is transferred, and so its
-        // `Heap`'s drop write barrier sees a live pointer — so each is held in a
-        // `RootedTraceableBox` while committed. Capture the count up front, then
-        // shift and commit one descriptor at a time so the remaining descriptors
-        // stay traced in `[[pendingPullIntos]]`. This is not observable: the count
-        // is only reduced by these commits (which fulfill read-into requests via
-        // queued reactions, never synchronous author code), so committing each
-        // descriptor as it is shifted is equivalent to shifting all then
-        // committing all.
+        // commits them. A shifted descriptor is no longer traced by the controller
+        // and committing it can GC, so we shift and commit one descriptor at a time,
+        // each in a `RootedTraceableBox`. Only these commits reduce the count, and
+        // they fulfill read-into requests through queued reactions, so the order is
+        // not observable.
         let num_read_into_requests = readable_stream_get_num_read_into_requests(scope, &stream);
         for _ in 0..num_read_into_requests {
             let descriptor = RootedTraceableBox::new(
diff --git a/crates/builtins/web-streams/src/readable/async_iterator.rs b/crates/builtins/web-streams/src/readable/async_iterator.rs
index 8065b24d..117d45d6 100644
--- a/crates/builtins/web-streams/src/readable/async_iterator.rs
+++ b/crates/builtins/web-streams/src/readable/async_iterator.rs
@@ -26,9 +26,6 @@ use js::prelude::{CallbackArgs, HandleValue};
 use js::{Function, Object, Promise};
 
 /// <https://streams.spec.whatwg.org/#rs-asynciterator>
-///
-/// The prototype's `[[Prototype]]` is set to `%AsyncIteratorPrototype%` at
-/// registration (see `add_to_global`), which supplies `[Symbol.asyncIterator]`.
 // WebIDL §3.7.10: the class string of an asynchronous iterator prototype object
 // is the interface identifier followed by " AsyncIterator" (with a space).
 #[webidl_interface(hidden, to_string_tag = "ReadableStream AsyncIterator")]
@@ -220,8 +217,8 @@ fn run_next_steps<'r>(
     // Step 7: Let _rejectSteps_ be the following steps, given _reason_: (implemented in
     //         `next_rejected`)
     // Step 8: Let _onRejected_ be CreateBuiltinFunction(_rejectSteps_, 1, "", « »).
-    // The unique sentinel the close steps resolve the next-iteration promise
-    // with (recognized by identity in `next_fulfilled`) and the reaction
+    // The unique sentinel with which the close steps resolve the next-iteration
+    // promise (recognized by identity in `next_fulfilled`) and the reaction
     // callbacks are per-iterator; create them on the first `next()` and reuse
     // them for every subsequent chunk.
     if iter.data().next_fulfilled_fn.is_none() {
@@ -397,16 +394,6 @@ fn iter_reader<'r>(
 
 // --- ReadRequest::AsyncIter step bodies (called from `read_request.rs`) -------
 
-/// Chunk steps: resolve `promise` with the raw chunk.
-/// Wrapping in `{ value, done }` happens in `next()`'s fulfill steps.
-pub(crate) fn async_iter_chunk_steps(
-    scope: &Scope<'_>,
-    promise: Promise<'_>,
-    chunk: HandleValue<'_>,
-) -> Result<(), ExnThrown> {
-    promise.resolve(scope, chunk)
-}
-
 /// Close steps: release the reader, then resolve `promise` with the end-of-iteration
 /// sentinel (recognised by `next()`'s fulfill steps).
 pub(crate) fn async_iter_close_steps(
diff --git a/crates/builtins/web-streams/src/readable/byte_stream_controller.rs b/crates/builtins/web-streams/src/readable/byte_stream_controller.rs
index ef90fa4f..00be684d 100644
--- a/crates/builtins/web-streams/src/readable/byte_stream_controller.rs
+++ b/crates/builtins/web-streams/src/readable/byte_stream_controller.rs
@@ -6,6 +6,7 @@ use std::collections::VecDeque;
 
 use crate::readable::ReadableStream;
 
+use super::algorithms::EnqueueChunk;
 use super::byob_request::ReadableStreamBYOBRequest;
 use super::byob_request::ReadableStreamBYOBRequestImpl;
 use super::readable_stream::ReadableStreamImpl;
@@ -22,11 +23,6 @@ use js::prelude::HandleValue;
 /// `ArrayBuffer`.
 ///
 /// <https://streams.spec.whatwg.org/#readable-byte-stream-queue-entry>
-///
-/// `must_root`: holds a `Heap`, so crown rejects holding it by value across an
-/// allocation. It is traced inside the controller's `[[queue]]`; once
-/// `pop_front`'d it must be consumed (extract its buffer, then drop it) before
-/// anything allocates, or kept in a `RootedTraceableBox`.
 #[js::must_root]
 #[derive(Traceable, Default, js::ScopeRoot)]
 pub(crate) struct ByteQueueEntry {
@@ -68,11 +64,6 @@ pub(crate) enum ReaderType {
 /// a view of the requested type.
 ///
 /// <https://streams.spec.whatwg.org/#pull-into-descriptor>
-///
-/// `must_root`: holds a `Heap` (the buffer), so crown rejects holding it by
-/// value across an allocation. It is traced inside the controller's
-/// `[[pendingPullIntos]]`; once moved out it must be consumed immediately or
-/// kept in a `RootedTraceableBox`.
 #[js::must_root]
 #[derive(Traceable)]
 pub(crate) struct PullIntoDescriptor {
@@ -221,9 +212,44 @@ impl ReadableByteStreamController {
         &self,
         scope: &Scope<'_>,
         view: js::ArrayBufferView<'_>,
+    ) -> Result<(), ExnThrown> {
+        self.enqueue_chunk(scope, EnqueueChunk::View(view))
+    }
+
+    /// <https://streams.spec.whatwg.org/#rbs-controller-error>
+    #[method]
+    pub fn error(&self, scope: &Scope<'_>, e: Option<HandleValue<'_>>) -> Result<(), ExnThrown> {
+        // Step 1: Perform ! `ByteStreamControllerError`(`this`, _e_).
+        let e = e.unwrap_or(HandleValue::undefined());
+        super::algorithms::readable_byte_stream_controller_error(scope, self, e);
+        Ok(())
+    }
+
+    pub(crate) fn stream<'r>(&self, scope: &'r Scope<'_>) -> ReadableStream<'r> {
+        self.data().stream.get(scope)
+    }
+}
+
+impl ReadableByteStreamController<'_> {
+    /// Enqueue `bytes` as a chunk, as [`enqueue`](Self::enqueue) does for a `Uint8Array` holding
+    /// them. The chunk's buffer is created from `bytes`, without copying where possible (see
+    /// [`js::ArrayBuffer::from_external`]). No JavaScript has seen it, so it is queued without
+    /// being transferred. Throws a `TypeError` in the cases in which `enqueue` throws one: for
+    /// empty `bytes`, after `close()`, and if the stream isn't readable.
+    pub fn enqueue_bytes(&self, scope: &Scope<'_>, bytes: Vec<u8>) -> Result<(), ExnThrown> {
+        let buffer = js::ArrayBuffer::from_external(scope, bytes)?;
+        self.enqueue_chunk(scope, EnqueueChunk::Owned(buffer))
+    }
+
+    /// The steps of [`enqueue`](Self::enqueue), for a chunk from JavaScript or from
+    /// [`enqueue_bytes`](Self::enqueue_bytes).
+    fn enqueue_chunk<'s>(
+        &self,
+        scope: &'s Scope<'_>,
+        chunk: EnqueueChunk<'_, 's>,
     ) -> Result<(), ExnThrown> {
         // Step 1: If _chunk_.[[ByteLength]] is 0, throw a ``TypeError`` exception.
-        if view.byte_length() == 0 {
+        if chunk.byte_length() == 0 {
             return Err(js::error::throw_type_error(
                 scope,
                 c"enqueue() view has a byte length of 0",
@@ -231,7 +257,7 @@ impl ReadableByteStreamController {
         }
         // Step 2: If _chunk_.[[ViewedArrayBuffer]].[[ByteLength]] is 0, throw a ``TypeError``
         //         exception.
-        if view.viewed_buffer(scope)?.byte_length() == 0 {
+        if chunk.buffer_byte_length(scope)? == 0 {
             return Err(js::error::throw_type_error(
                 scope,
                 c"enqueue() view's buffer has a byte length of 0",
@@ -254,19 +280,6 @@ impl ReadableByteStreamController {
             ));
         }
         // Step 5: Return ? `ByteStreamControllerEnqueue`(`this`, _chunk_).
-        super::algorithms::readable_byte_stream_controller_enqueue(scope, self, view)
-    }
-
-    /// <https://streams.spec.whatwg.org/#rbs-controller-error>
-    #[method]
-    pub fn error(&self, scope: &Scope<'_>, e: Option<HandleValue<'_>>) -> Result<(), ExnThrown> {
-        // Step 1: Perform ! `ByteStreamControllerError`(`this`, _e_).
-        let e = e.unwrap_or(HandleValue::undefined());
-        super::algorithms::readable_byte_stream_controller_error(scope, self, e);
-        Ok(())
-    }
-
-    pub(crate) fn stream<'r>(&self, scope: &'r Scope<'_>) -> ReadableStream<'r> {
-        self.data().stream.get(scope)
+        super::algorithms::readable_byte_stream_controller_enqueue(scope, self, chunk)
     }
 }
diff --git a/crates/builtins/web-streams/src/readable/mod.rs b/crates/builtins/web-streams/src/readable/mod.rs
index c04ded5d..dcfd43cb 100644
--- a/crates/builtins/web-streams/src/readable/mod.rs
+++ b/crates/builtins/web-streams/src/readable/mod.rs
@@ -11,6 +11,8 @@ pub mod byte_stream_controller;
 pub mod default_controller;
 pub mod default_reader;
 pub mod enums;
+pub mod native_byte_source;
+pub mod native_pump;
 pub mod native_read;
 pub mod options;
 pub mod read_all_bytes;
@@ -19,7 +21,6 @@ pub mod readable_stream;
 pub mod underlying_source;
 pub(crate) mod unions;
 
-pub use async_iterator::ReadableStreamAsyncIterator as AsyncIterator;
 pub use byob_reader::BYOBReader;
 pub use byob_request::ReadableStreamBYOBRequest;
 pub use byte_stream_controller::ReadableByteStreamController;
diff --git a/crates/builtins/web-streams/src/readable/native_byte_source.rs b/crates/builtins/web-streams/src/readable/native_byte_source.rs
new file mode 100644
index 00000000..e43c2b38
--- /dev/null
+++ b/crates/builtins/web-streams/src/readable/native_byte_source.rs
@@ -0,0 +1,410 @@
+// SPDX-License-Identifier: Apache-2.0-WITH-LLVM-exception
+
+//! A readable byte stream whose bytes come from a native reader.
+//!
+//! [`NativeByteSource::create_stream`] creates a byte stream that reads from a [`ByteReader`]
+//! when a reader of the stream asks for data. Each read requests at most 64 KiB, or the length of
+//! a pending BYOB request's view. The bytes read are copied into that view if they fit. Otherwise,
+//! they are enqueued as a chunk that uses the read's buffer if at least half of it is used, and a
+//! copy if not. The next read with the same capacity reuses a buffer that wasn't enqueued. The end
+//! of the reader closes the stream, and a failed read errors it with a `TypeError`. Cancelling the
+//! stream drops the reader, along with a read in flight.
+//!
+//! While the stream is piped to an identity `TransformStream` whose readable end has no demand, a
+//! pull waits for demand before reading (see [`ReadableStream::deferred_demand`]). Until a read
+//! starts, [`take_untouched_reader`] can take the reader, so that a native consumer reads from it
+//! directly.
+
+use std::any::Any;
+use std::future::Future;
+use std::pin::Pin;
+
+use core_runtime::{jsclass, jsmethods};
+use js::conversion::FromJSVal;
+use js::error::{ExnThrown, ThrowException, TypeError};
+use js::function::{cast_payload, CallbackArgs};
+use js::gc::handle::{Heap, OptionHeapExt, RootedHeap};
+use js::gc::scope::Scope;
+use js::native::Value;
+use js::prelude::HandleValue;
+use js::promise::{PromiseFuture, PromiseOutcome};
+use js::{value, Function, Promise};
+
+use super::byte_stream_controller::{
+    ReadableByteStreamController, ReadableByteStreamControllerImpl,
+};
+use super::readable_stream::{ReadableStream, ReadableStreamImpl};
+use crate::AlgorithmArg;
+
+/// The maximum number of bytes that one read requests from a [`ByteReader`].
+const READ_BYTES: usize = 64 * 1024;
+
+/// The result of [`ByteReader::read`].
+pub enum ByteRead<R> {
+    /// The reader, and the bytes read, which are never empty.
+    Bytes(R, Vec<u8>),
+    /// The reader has no more bytes.
+    End,
+    /// The read failed. The stream is errored with a `TypeError` with this message.
+    Failed(String),
+}
+
+/// A native source of bytes for [`NativeByteSource`]. The source doesn't trace its reader, so a
+/// reader must not hold GC things.
+pub trait ByteReader: Sized + 'static {
+    /// Read the next bytes. `buf` is empty, and has capacity for the number of bytes wanted. The
+    /// bytes read can be in `buf` or in another allocation, and can be more than wanted.
+    fn read(self, buf: Vec<u8>) -> impl Future<Output = ByteRead<Self>> + 'static;
+}
+
+impl ByteReader for platform::http::IncomingBody {
+    async fn read(mut self, buf: Vec<u8>) -> ByteRead<Self> {
+        match self.read_into(buf).await {
+            Ok(Some(bytes)) => ByteRead::Bytes(self, bytes),
+            Ok(None) => ByteRead::End,
+            Err(error) => ByteRead::Failed(format!("the body could not be read: {error}")),
+        }
+    }
+}
+
+/// A [`ByteReader`] with its type erased.
+trait ErasedReader {
+    fn read(self: Box<Self>, buf: Vec<u8>) -> ErasedRead;
+    fn as_any(&self) -> &dyn Any;
+    fn into_any(self: Box<Self>) -> Box<dyn Any>;
+}
+
+/// A read from an [`ErasedReader`].
+type ErasedRead = Pin<Box<dyn Future<Output = ByteRead<Box<dyn ErasedReader>>>>>;
+
+impl<R: ByteReader> ErasedReader for R {
+    fn read(self: Box<Self>, buf: Vec<u8>) -> ErasedRead {
+        let read = ByteReader::read(*self, buf);
+        Box::pin(async move {
+            match read.await {
+                ByteRead::Bytes(reader, bytes) => {
+                    ByteRead::Bytes(Box::new(reader) as Box<dyn ErasedReader>, bytes)
+                }
+                ByteRead::End => ByteRead::End,
+                ByteRead::Failed(message) => ByteRead::Failed(message),
+            }
+        })
+    }
+
+    fn as_any(&self) -> &dyn Any {
+        self
+    }
+
+    fn into_any(self: Box<Self>) -> Box<dyn Any> {
+        self
+    }
+}
+
+/// The underlying source of a byte stream created by [`NativeByteSource::create_stream`].
+#[jsclass(hidden)]
+pub struct NativeByteSource {
+    /// `None` while a read is in flight, and after the reader ended or failed, the stream was
+    /// cancelled, the source was aborted, or the reader was taken.
+    #[no_trace]
+    reader: Option<Box<dyn ErasedReader>>,
+    /// Whether a read has started.
+    #[no_trace]
+    pulled: bool,
+    /// The promise of the pull whose read is in flight, used to cancel the read.
+    current_pull: Option<Heap<js::promise::Promise>>,
+    /// Whether the stream was cancelled or the source aborted. The bytes of a read that completes
+    /// afterwards are not delivered.
+    #[no_trace]
+    cancelled: bool,
+    /// The buffer of a read whose bytes were copied into JavaScript. The next read with the same
+    /// capacity reuses it.
+    #[no_trace]
+    spare: Option<Vec<u8>>,
+    /// The stream this source reads for, used to look up its deferred demand.
+    stream: Option<Heap<ReadableStreamImpl>>,
+    /// A deferred pull's promise, resolved once its read was delivered, or once the reader was
+    /// taken or dropped.
+    deferred_pull: Option<Heap<js::promise::Promise>>,
+    /// The controller to which a deferred pull delivers.
+    deferred_controller: Option<Heap<ReadableByteStreamControllerImpl>>,
+}
+
+#[jsmethods]
+impl NativeByteSource {
+    fn new(reader: Box<dyn ErasedReader>) -> Self {
+        NativeByteSourceImpl {
+            reader: Some(reader),
+            ..Default::default()
+        }
+    }
+}
+
+/// Whether settling a deferred pull also closes the stream.
+#[derive(Clone, Copy, PartialEq, Eq)]
+enum CloseStream {
+    /// The reader was taken, so the stream ends.
+    Yes,
+    /// The stream is being cancelled or errored by its caller.
+    No,
+}
+
+impl NativeByteSource<'_> {
+    /// Create a byte stream that reads from `reader`, and the stream's source.
+    pub fn create_stream<'r, R: ByteReader>(
+        scope: &'r Scope<'_>,
+        reader: R,
+    ) -> Result<(ReadableStream<'r>, NativeByteSource<'r>), ExnThrown> {
+        let source = NativeByteSource::new(scope, Box::new(reader))?;
+        let pull = AlgorithmArg::native(scope, pull, source)?;
+        let cancel = AlgorithmArg::native(scope, cancel, source)?;
+        let stream = ReadableStream::new_native_bytes(scope, source, pull, cancel)?;
+        source.data_mut().stream = Some(Heap::from(stream));
+        Ok((stream, source))
+    }
+
+    /// Stop reading: drop a read in flight and the reader, and settle a deferred pull without
+    /// closing the stream. The caller errors the stream.
+    pub fn abort(&self, scope: &Scope<'_>) {
+        self.data_mut().cancelled = true;
+        let pull = self.data_mut().current_pull.take_rooted(scope);
+        if let Some(pull) = pull {
+            // Dropping the read's future drops the reader it owns.
+            js::promise::cancel_pending_future(pull);
+        }
+        self.data_mut().reader = None;
+        self.data_mut().spare = None;
+        self.settle_deferred_pull(scope, CloseStream::No);
+    }
+
+    /// Resolve a deferred pull, if there is one, and close the stream if `close` is
+    /// [`CloseStream::Yes`].
+    fn settle_deferred_pull(&self, scope: &Scope<'_>, close: CloseStream) {
+        let Some(pull) = self.data_mut().deferred_pull.take_rooted(scope) else {
+            return;
+        };
+        let controller = self.data_mut().deferred_controller.take_rooted(scope);
+        if let (CloseStream::Yes, Some(controller)) = (close, controller) {
+            let _ = close_stream(scope, controller);
+        }
+        let _ = pull.resolve(scope, HandleValue::undefined());
+    }
+}
+
+/// Take the reader of the [`NativeByteSource`] of `stream` if no read has started and the reader
+/// is an `R`.
+///
+/// `stream` is the source's own stream, or the readable end of an identity `TransformStream` to
+/// which that stream is piped. The source's stream closes right away if a pull is waiting for
+/// demand, and on its next pull otherwise. `stream` is locked and disturbed, since its bytes are
+/// read from the reader directly from now on.
+pub fn take_untouched_reader<R: ByteReader>(
+    scope: &Scope<'_>,
+    stream: &ReadableStream<'_>,
+) -> Option<R> {
+    let source = stream
+        .native_source(scope)?
+        .cast::<NativeByteSource>()
+        .ok()?;
+    if source.data().pulled {
+        return None;
+    }
+    let reader = source.data_mut().reader.take()?;
+    if !reader.as_any().is::<R>() {
+        source.data_mut().reader = Some(reader);
+        return None;
+    }
+    let reader = *reader
+        .into_any()
+        .downcast::<R>()
+        .expect("the reader was checked above");
+    source.settle_deferred_pull(scope, CloseStream::Yes);
+    stream
+        .lock_and_disturb(scope)
+        .expect("an unlocked stream can be locked");
+    Some(reader)
+}
+
+/// Underlying-source `pull`: read the next bytes and deliver them, or close the stream once the
+/// reader ended. A pull while the stream is piped to an identity `TransformStream` without demand
+/// waits for demand.
+fn pull(
+    scope: &Scope<'_>,
+    args: CallbackArgs<'_>,
+    payload: HandleValue<'_>,
+) -> Result<Value, ExnThrown> {
+    let source = cast_payload::<NativeByteSource>(scope, payload);
+    let promise = Promise::new_pending(scope)?;
+    // The read requires an active event loop. A rejected pull errors the stream.
+    if core_runtime::event_loop::reject_without_event_loop(scope, &promise, "reading a stream")? {
+        return Ok(promise.as_value());
+    }
+    let controller = ReadableByteStreamController::from_jsval_throwing(scope, args.get(0), ())?;
+    // A pull waits for demand only while there is a reader to read from. Without one,
+    // `start_read` closes the stream.
+    let stream = source.data().stream.get(scope);
+    let demand = if source.data().reader.is_some() {
+        stream.and_then(|stream| stream.deferred_demand(scope))
+    } else {
+        None
+    };
+    if let Some(demand) = demand {
+        source.data_mut().deferred_pull = Some(Heap::from(promise));
+        source.data_mut().deferred_controller = Some(Heap::from(controller));
+        let resume = Function::new_callback(scope, c"", 0, resume_pull, source)?;
+        demand.add_reactions_ignoring_unhandled_rejection(scope, Some(*resume), None)?;
+        return Ok(promise.as_value());
+    }
+    start_read(scope, source, controller, promise)?;
+    Ok(promise.as_value())
+}
+
+/// Demand arrived for a deferred pull: start the read it deferred.
+fn resume_pull(
+    scope: &Scope<'_>,
+    _args: CallbackArgs<'_>,
+    payload: HandleValue<'_>,
+) -> Result<Value, ExnThrown> {
+    let source = cast_payload::<NativeByteSource>(scope, payload);
+    let controller = source.data_mut().deferred_controller.take_rooted(scope);
+    let pull = source.data_mut().deferred_pull.take_rooted(scope);
+    // The pull was settled while it waited: the reader was taken, or the stream was cancelled
+    // or aborted.
+    let (Some(controller), Some(promise)) = (controller, pull) else {
+        return Ok(value::undefined());
+    };
+    // Demand can arrive where no event loop is active to drive the read.
+    if core_runtime::event_loop::reject_without_event_loop(scope, &promise, "reading a stream")? {
+        return Ok(value::undefined());
+    }
+    start_read(scope, source, controller, promise)?;
+    Ok(value::undefined())
+}
+
+/// Read the next bytes into `controller`'s stream, and resolve `promise` once they were
+/// delivered.
+fn start_read(
+    scope: &Scope<'_>,
+    source: NativeByteSource<'_>,
+    controller: ReadableByteStreamController<'_>,
+    promise: Promise<'_>,
+) -> Result<(), ExnThrown> {
+    source.data_mut().pulled = true;
+    let reader = source.data_mut().reader.take();
+    let Some(reader) = reader else {
+        // The reader ended, or was taken or dropped, so no more bytes will arrive.
+        close_stream(scope, controller)?;
+        promise.resolve(scope, HandleValue::undefined())?;
+        return Ok(());
+    };
+    source.data_mut().current_pull = Some(Heap::from(promise));
+    // A pending BYOB read requests at most its view's length, so that the bytes fit into it.
+    let byob_length = controller
+        .byob_request(scope)
+        .and_then(|request| request.view(scope))
+        .map(|view| view.byte_length());
+    let capacity = byob_length.map_or(READ_BYTES, |length| length.clamp(1, READ_BYTES));
+    let spare = source
+        .data_mut()
+        .spare
+        .take()
+        .filter(|spare| spare.capacity() == capacity);
+    let mut buf = spare.unwrap_or_else(|| Vec::with_capacity(capacity));
+    buf.clear();
+    let controller = RootedHeap::new(controller);
+    let source = RootedHeap::new(source);
+    let future = async move {
+        let read = reader.read(buf).await;
+        PromiseOutcome::Resolve(Box::new(move |scope: &Scope<'_>| {
+            deliver(scope, source.get(scope), controller.get(scope), read)
+                .map(|()| HandleValue::undefined())
+        }))
+    };
+    promise.spawn(PromiseFuture::new(future));
+    Ok(())
+}
+
+/// Deliver the result of a read to `controller`'s stream. A source that was cancelled or aborted
+/// during the read doesn't deliver the bytes, and drops the reader.
+fn deliver(
+    scope: &Scope<'_>,
+    source: NativeByteSource<'_>,
+    controller: ReadableByteStreamController<'_>,
+    read: ByteRead<Box<dyn ErasedReader>>,
+) -> Result<(), ExnThrown> {
+    source.data_mut().current_pull = None;
+    if source.data().cancelled {
+        return Ok(());
+    }
+    match read {
+        ByteRead::Bytes(reader, bytes) => {
+            source.data_mut().reader = Some(reader);
+            let spare = deliver_bytes(scope, controller, bytes)?;
+            source.data_mut().spare = spare;
+            Ok(())
+        }
+        ByteRead::End => {
+            source.data_mut().spare = None;
+            close_stream(scope, controller)
+        }
+        ByteRead::Failed(message) => {
+            source.data_mut().spare = None;
+            let _ = TypeError(message).throw(scope);
+            let reason = js::exception::take_pending(scope).ok_or(ExnThrown)?;
+            controller.error(scope, Some(reason))
+        }
+    }
+}
+
+/// Copy `bytes` into the view of a pending BYOB request of `controller`'s stream if they fit, and
+/// enqueue them as a chunk otherwise. The chunk uses the allocation of `bytes`, unless less than
+/// half of it is used. Returns `bytes` if they were copied, so that another read can reuse the
+/// buffer.
+fn deliver_bytes(
+    scope: &Scope<'_>,
+    controller: ReadableByteStreamController<'_>,
+    bytes: Vec<u8>,
+) -> Result<Option<Vec<u8>>, ExnThrown> {
+    if let Some(request) = controller.byob_request(scope) {
+        if let Some(view) = request.view(scope) {
+            let written = view.with_bytes_mut(|target| {
+                (target.len() >= bytes.len()).then(|| {
+                    target[..bytes.len()].copy_from_slice(&bytes);
+                    bytes.len()
+                })
+            });
+            if let Some(written) = written {
+                request.respond(scope, js::conversion::EnforceRange(written as u64))?;
+                return Ok(Some(bytes));
+            }
+        }
+    }
+    if bytes.len() * 2 >= bytes.capacity() {
+        controller.enqueue_bytes(scope, bytes)?;
+        return Ok(None);
+    }
+    controller.enqueue_bytes(scope, bytes.to_vec())?;
+    Ok(Some(bytes))
+}
+
+/// Close `controller`'s stream. A pending BYOB request is answered with no bytes, which its
+/// reader receives as the end of the stream.
+fn close_stream(
+    scope: &Scope<'_>,
+    controller: ReadableByteStreamController<'_>,
+) -> Result<(), ExnThrown> {
+    controller.close(scope)?;
+    match controller.byob_request(scope) {
+        Some(request) => request.respond(scope, js::conversion::EnforceRange(0)),
+        None => Ok(()),
+    }
+}
+
+/// Underlying-source `cancel`: drop the reader and a read in flight.
+fn cancel(
+    scope: &Scope<'_>,
+    _args: CallbackArgs<'_>,
+    payload: HandleValue<'_>,
+) -> Result<Value, ExnThrown> {
+    cast_payload::<NativeByteSource>(scope, payload).abort(scope);
+    Ok(value::undefined())
+}
diff --git a/crates/builtins/web-streams/src/readable/native_pump.rs b/crates/builtins/web-streams/src/readable/native_pump.rs
new file mode 100644
index 00000000..49d4054c
--- /dev/null
+++ b/crates/builtins/web-streams/src/readable/native_pump.rs
@@ -0,0 +1,503 @@
+// SPDX-License-Identifier: Apache-2.0-WITH-LLVM-exception
+
+//! Pumping a `ReadableStream` into a native sink.
+//!
+//! A [`NativePump`] reads a stream through an internal reader (see
+//! [`native_read`](super::native_read)) and appends each chunk to a [`PumpBatch`]. It writes the
+//! batch to a [`PumpSink`] once a read has to wait, the batch is full, or the stream has ended.
+//! At most one read and one write are outstanding at a time. No read starts while a write is in
+//! flight, but a read that was waiting when the write started can complete during it, and its
+//! chunk goes into the next batch.
+//!
+//! The pump finishes once the stream has ended and every batch is written, or when it is stopped.
+//! It then drops the chunks not yet written and calls [`PumpSink::finish`] with the [`PumpEnd`].
+//! For [`PumpEnd::Failed`], it prints the failure to `stderr`. It cancels the stream unless it
+//! closed, and calls the callback given to [`NativePump::on_finish`].
+
+use std::any::Any;
+use std::collections::TryReserveError;
+use std::future::Future;
+use std::pin::Pin;
+
+use core_runtime::{jsclass, jsmethods};
+use js::error::{ExnThrown, ThrowException, TypeError};
+use js::gc::handle::{Heap, RootedHeap};
+use js::gc::scope::Scope;
+use js::prelude::HandleValue;
+use js::promise::{PromiseFuture, PromiseOutcome};
+use js::{Object, Promise};
+
+use super::default_reader::{DefaultReader, DefaultReaderImpl};
+use super::native_read::{native_reader_cancel, native_reader_read, NativeReadSteps};
+
+/// The number of bytes at which a byte batch is full.
+pub const PUMP_BATCH_BYTES: usize = 64 * 1024;
+
+/// The cancellation reason of a stream whose sink's receiver went away.
+const RECEIVER_DROPPED: &str = "the stream's reader was dropped";
+
+/// How a [`NativePump`] ended.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub enum PumpEnd {
+    /// The stream closed.
+    Closed,
+    /// The stream errored, a chunk was rejected by [`PumpBatch::append`] or [`PumpBatch::check`],
+    /// or the stream couldn't be read. The message describes the failure.
+    Failed(String),
+    /// The pump stopped before the stream ended: the sink's receiver went away, or
+    /// [`NativePump::stop`] was called. The message gives the reason.
+    Stopped(String),
+}
+
+/// The chunks a [`NativePump`] has read but not yet written.
+pub trait PumpBatch: Sized + 'static {
+    /// Append `chunk`. An `Err` ends the pump with [`PumpEnd::Failed`] once the chunks appended
+    /// before it are written.
+    fn append(&mut self, scope: &Scope<'_>, chunk: HandleValue<'_>) -> Result<(), String>;
+
+    /// Check the batch right before it is written. To reject a chunk, truncate the batch before
+    /// it and return an `Err`. The chunks before it are written, and the pump then ends with
+    /// [`PumpEnd::Failed`].
+    fn check(&mut self, _scope: &Scope<'_>) -> Result<(), String> {
+        Ok(())
+    }
+
+    fn is_empty(&self) -> bool;
+
+    /// Whether the batch is written before more chunks are read.
+    fn is_full(&self) -> bool;
+
+    /// Take the batch's chunks, leaving it empty.
+    fn take(&mut self) -> Self;
+}
+
+/// The destination to which a [`NativePump`] writes its batches.
+pub trait PumpSink: Sized + 'static {
+    type Batch: PumpBatch;
+
+    /// Whether the future returned by [`write`](Self::write) is polled once right away if an
+    /// event loop is active. Otherwise its first poll happens in the event loop.
+    const POLL_WRITE_AT_ONCE: bool = false;
+
+    /// Write `batch` if that can complete without waiting. Otherwise returns `batch`, which the
+    /// pump then passes to [`write`](Self::write).
+    fn try_write(&mut self, batch: Self::Batch) -> Result<(), Self::Batch> {
+        Err(batch)
+    }
+
+    /// Write `batch`. The future resolves to the sink once all of `batch` was written, or to
+    /// `None` if the receiver went away. The pump then ends with [`PumpEnd::Stopped`] without
+    /// calling [`finish`](Self::finish).
+    fn write(self, batch: Self::Batch) -> impl Future<Output = Option<Self>> + 'static;
+
+    /// Returns the message of the [`PumpEnd::Failed`] for a stream that errored with `error`.
+    fn describe_source_error(scope: &Scope<'_>, error: HandleValue<'_>) -> String;
+
+    /// End the sink's output. Called once when the pump finishes, after its last write. Not called
+    /// if a write's future resolved to `None`. The default implementation drops the sink.
+    fn finish(self, _scope: &Scope<'_>, _end: &PumpEnd) {}
+}
+
+/// Append `bytes` to `batch`. Growing a non-empty `batch` reserves room up to
+/// [`PUMP_BATCH_BYTES`], so a batch filled by small chunks is copied at most once.
+pub fn append_bytes(batch: &mut Vec<u8>, bytes: &[u8]) -> Result<(), TryReserveError> {
+    if batch.capacity() - batch.len() < bytes.len() {
+        let wanted = if batch.is_empty() {
+            bytes.len()
+        } else {
+            PUMP_BATCH_BYTES.max(batch.len() + bytes.len()) - batch.len()
+        };
+        batch.try_reserve_exact(wanted)?;
+    }
+    batch.extend_from_slice(bytes);
+    Ok(())
+}
+
+/// A write in flight. It resolves to the sink, boxed as `Any`, or to `None` if the receiver went
+/// away.
+type SinkWrite = Pin<Box<dyn Future<Output = Option<Box<dyn Any>>>>>;
+
+/// A sink and its batch, with the sink's type erased.
+trait ErasedSink {
+    fn append(&mut self, scope: &Scope<'_>, chunk: HandleValue<'_>) -> Result<(), String>;
+    fn check(&mut self, scope: &Scope<'_>) -> Result<(), String>;
+    fn is_empty(&self) -> bool;
+    fn is_full(&self) -> bool;
+    fn is_writing(&self) -> bool;
+    /// Write the batch with [`PumpSink::try_write`]. Returns whether it was written.
+    fn try_write(&mut self) -> bool;
+    /// Write the batch with [`PumpSink::write`].
+    fn write(&mut self) -> SinkWrite;
+    fn poll_write_at_once(&self) -> bool;
+    /// Return the sink from a write that completed.
+    fn restore(&mut self, sink: Box<dyn Any>);
+    fn describe_source_error(&self, scope: &Scope<'_>, error: HandleValue<'_>) -> String;
+    /// Drop the chunks not yet written, and call [`PumpSink::finish`] unless a write is in flight.
+    fn finish(&mut self, scope: &Scope<'_>, end: &PumpEnd);
+}
+
+struct SinkSlot<S: PumpSink> {
+    /// `None` while a write is in flight, and after the sink finished.
+    sink: Option<S>,
+    batch: S::Batch,
+}
+
+impl<S: PumpSink> ErasedSink for SinkSlot<S> {
+    fn append(&mut self, scope: &Scope<'_>, chunk: HandleValue<'_>) -> Result<(), String> {
+        self.batch.append(scope, chunk)
+    }
+
+    fn check(&mut self, scope: &Scope<'_>) -> Result<(), String> {
+        self.batch.check(scope)
+    }
+
+    fn is_empty(&self) -> bool {
+        self.batch.is_empty()
+    }
+
+    fn is_full(&self) -> bool {
+        self.batch.is_full()
+    }
+
+    fn is_writing(&self) -> bool {
+        self.sink.is_none()
+    }
+
+    fn try_write(&mut self) -> bool {
+        let sink = self.sink.as_mut().expect("no write is in flight");
+        match sink.try_write(self.batch.take()) {
+            Ok(()) => true,
+            Err(batch) => {
+                self.batch = batch;
+                false
+            }
+        }
+    }
+
+    fn write(&mut self) -> SinkWrite {
+        let sink = self.sink.take().expect("no write is in flight");
+        let write = sink.write(self.batch.take());
+        Box::pin(async move {
+            let sink = write.await?;
+            Some(Box::new(sink) as Box<dyn Any>)
+        })
+    }
+
+    fn poll_write_at_once(&self) -> bool {
+        S::POLL_WRITE_AT_ONCE
+    }
+
+    fn restore(&mut self, sink: Box<dyn Any>) {
+        let sink = sink.downcast::<S>().expect("a write returns its own sink");
+        self.sink = Some(*sink);
+    }
+
+    fn describe_source_error(&self, scope: &Scope<'_>, error: HandleValue<'_>) -> String {
+        S::describe_source_error(scope, error)
+    }
+
+    fn finish(&mut self, scope: &Scope<'_>, end: &PumpEnd) {
+        drop(self.batch.take());
+        if let Some(sink) = self.sink.take() {
+            sink.finish(scope, end);
+        }
+    }
+}
+
+/// The state of a pump from a `ReadableStream` to a [`PumpSink`].
+#[jsclass(hidden)]
+pub struct NativePump {
+    reader: Heap<DefaultReaderImpl>,
+    /// The sink and its batch. `None` only while a sink method runs, so that no borrow of this
+    /// data is held across it.
+    #[no_trace]
+    sink: Option<Box<dyn ErasedSink>>,
+    /// How the pump ends, once the stream ended, a chunk was rejected, or the pump was stopped.
+    #[no_trace]
+    end: Option<PumpEnd>,
+    /// Whether a read request is waiting for a chunk.
+    #[no_trace]
+    reading: bool,
+    /// Whether [`run`] is on the stack.
+    #[no_trace]
+    running: bool,
+    #[no_trace]
+    finished: bool,
+    #[no_trace]
+    on_finish: Option<Box<dyn FnOnce()>>,
+}
+
+#[jsmethods]
+impl NativePump {
+    fn new(reader: DefaultReader, sink: Box<dyn ErasedSink>) -> Self {
+        NativePumpImpl {
+            reader: Heap::from(reader),
+            sink: Some(sink),
+            end: None,
+            reading: false,
+            running: false,
+            finished: false,
+            on_finish: None,
+        }
+    }
+}
+
+impl NativePump<'_> {
+    /// Create a pump that reads with `reader`, a reader from
+    /// [`acquire_native_reader`](super::native_read::acquire_native_reader), and writes to
+    /// `sink`, collecting chunks into `batch`, which must be empty. The pump starts reading once
+    /// [`start`](Self::start) is called.
+    pub fn create<'r, S: PumpSink>(
+        scope: &'r Scope<'_>,
+        reader: DefaultReader<'_>,
+        sink: S,
+        batch: S::Batch,
+    ) -> Result<NativePump<'r>, ExnThrown> {
+        let slot = SinkSlot {
+            sink: Some(sink),
+            batch,
+        };
+        NativePump::new(scope, reader, Box::new(slot))
+    }
+
+    /// Call `f` once the pump has finished.
+    pub fn on_finish(&self, f: impl FnOnce() + 'static) {
+        self.data_mut().on_finish = Some(Box::new(f));
+    }
+
+    /// Start reading the stream.
+    pub fn start(&self, scope: &Scope<'_>) {
+        run(scope, self);
+    }
+
+    /// Finish the pump with [`PumpEnd::Stopped`], giving `reason`. The stream is cancelled with a
+    /// `TypeError` whose message is `reason`, and the chunks not yet written are dropped. A
+    /// pump that has finished is left as it is.
+    pub fn stop(&self, scope: &Scope<'_>, reason: String) {
+        if self.data().finished {
+            return;
+        }
+        self.data_mut().end = Some(PumpEnd::Stopped(reason));
+        finish(scope, self);
+    }
+
+    pub fn is_finished(&self) -> bool {
+        self.data().finished
+    }
+
+    /// Run `f` on the sink, with the sink taken out of this pump's data while `f` runs. Returns
+    /// `None` if the sink is already taken out, by a call further up the stack.
+    fn with_sink<R>(&self, f: impl FnOnce(&mut dyn ErasedSink) -> R) -> Option<R> {
+        let mut sink = self.data_mut().sink.take()?;
+        let result = f(&mut *sink);
+        self.data_mut().sink = Some(sink);
+        Some(result)
+    }
+}
+
+/// The pump's read-request steps. Each records what it received and then calls [`run`], which
+/// does nothing when the step ran from inside it.
+const PUMP_STEPS: NativeReadSteps = NativeReadSteps {
+    chunk: pump_chunk,
+    close: pump_close,
+    error: pump_error,
+};
+
+/// Advance the pump: read chunks into the batch for as long as reads complete synchronously and
+/// the batch isn't full, then write the batch. A batch written synchronously is followed by
+/// more reads.
+fn run(scope: &Scope<'_>, pump: &NativePump<'_>) {
+    if pump.data().running || pump.data().finished {
+        return;
+    }
+    pump.data_mut().running = true;
+    loop {
+        while can_read(pump) {
+            pump.data_mut().reading = true;
+            let reader = pump.data().reader.get(scope);
+            if native_reader_read(scope, reader, PUMP_STEPS, pump.as_object()).is_err() {
+                let message = ExnThrown::capture(scope).to_string();
+                let mut data = pump.data_mut();
+                data.reading = false;
+                data.end = Some(PumpEnd::Failed(message));
+            }
+            if pump.data().reading {
+                break;
+            }
+        }
+        if !flush(scope, pump) {
+            break;
+        }
+    }
+    pump.data_mut().running = false;
+}
+
+/// Whether the pump may issue another read: it hasn't finished, the stream hasn't ended, no read
+/// or write is outstanding, and the batch isn't full.
+fn can_read(pump: &NativePump<'_>) -> bool {
+    let data = pump.data();
+    !data.finished
+        && data.end.is_none()
+        && !data.reading
+        && data
+            .sink
+            .as_ref()
+            .is_some_and(|sink| !sink.is_writing() && !sink.is_full())
+}
+
+/// Write the batch if a read has to wait, the batch is full, or the stream has ended. Finish the
+/// pump once the stream has ended and the batch is written. Returns whether [`run`] should read
+/// on, which is the case if the batch was written synchronously.
+fn flush(scope: &Scope<'_>, pump: &NativePump<'_>) -> bool {
+    if pump.data().finished {
+        return false;
+    }
+    let Some((writing, empty, full)) =
+        pump.with_sink(|sink| (sink.is_writing(), sink.is_empty(), sink.is_full()))
+    else {
+        return false;
+    };
+    if writing {
+        return false;
+    }
+    let ready = full || pump.data().reading || pump.data().end.is_some();
+    if !empty && ready {
+        if let Some(Err(message)) = pump.with_sink(|sink| sink.check(scope)) {
+            pump.data_mut().end = Some(PumpEnd::Failed(message));
+        }
+        // `check` can empty the batch, which then isn't written.
+        if pump.with_sink(|sink| sink.is_empty()) == Some(false) {
+            if pump.with_sink(|sink| sink.try_write()) == Some(true) {
+                return true;
+            }
+            spawn_write(scope, pump);
+            return false;
+        }
+    }
+    if pump.data().end.is_some() && pump.with_sink(|sink| sink.is_empty()) == Some(true) {
+        finish(scope, pump);
+    }
+    false
+}
+
+/// Write the batch with [`PumpSink::write`], and continue the pump once the write completes.
+fn spawn_write(scope: &Scope<'_>, pump: &NativePump<'_>) {
+    let Ok(promise) = Promise::new_pending(scope) else {
+        let message = ExnThrown::capture(scope).to_string();
+        pump.data_mut().end = Some(PumpEnd::Failed(message));
+        finish(scope, pump);
+        return;
+    };
+    let Some((write, poll_now)) = pump.with_sink(|sink| (sink.write(), sink.poll_write_at_once()))
+    else {
+        return;
+    };
+    let pump = RootedHeap::new(*pump);
+    let future = async move {
+        let sink = write.await;
+        PromiseOutcome::Resolve(Box::new(move |scope: &Scope<'_>| {
+            write_done(scope, &pump.get(scope), sink);
+            Ok(HandleValue::undefined())
+        }))
+    };
+    let future = PromiseFuture::new(future);
+    if poll_now && core_runtime::event_loop::has_active_event_loop() {
+        promise.spawn_polled(future);
+    } else {
+        promise.spawn(future);
+    }
+}
+
+/// Continue the pump after a write. `sink` is `None` if the receiver went away.
+fn write_done(scope: &Scope<'_>, pump: &NativePump<'_>, sink: Option<Box<dyn Any>>) {
+    let Some(sink) = sink else {
+        if !pump.data().finished {
+            pump.data_mut().end = Some(PumpEnd::Stopped(RECEIVER_DROPPED.to_string()));
+            finish(scope, pump);
+        }
+        return;
+    };
+    pump.with_sink(|slot| slot.restore(sink));
+    if pump.data().finished {
+        // The pump was stopped during the write.
+        let end = pump.data().end.clone().expect("a finished pump has an end");
+        pump.with_sink(|slot| slot.finish(scope, &end));
+        return;
+    }
+    run(scope, pump);
+}
+
+/// Finish the pump with its `end`: drop the chunks not yet written, finish the sink unless a write
+/// is in flight, print a failure, cancel the stream unless it closed, and call the `on_finish`
+/// callback.
+fn finish(scope: &Scope<'_>, pump: &NativePump<'_>) {
+    let end = {
+        let mut data = pump.data_mut();
+        data.finished = true;
+        data.end.clone().expect("a finishing pump has an end")
+    };
+    pump.with_sink(|sink| sink.finish(scope, &end));
+    if let PumpEnd::Failed(message) = &end {
+        eprintln!("a stream's source ended the stream early: {message}");
+    }
+    if let PumpEnd::Failed(message) | PumpEnd::Stopped(message) = &end {
+        let _ = TypeError(message.clone()).throw(scope);
+        let reason = js::exception::take_pending_or_undefined(scope);
+        let reader = pump.data().reader.get(scope);
+        let cancelled = native_reader_cancel(scope, reader, reason);
+        // The cancellation rejects for a stream that errored, and nothing observes it.
+        let _ = cancelled.set_any_is_handled(scope);
+    }
+    let on_finish = pump.data_mut().on_finish.take();
+    if let Some(on_finish) = on_finish {
+        on_finish();
+    }
+}
+
+fn pump_chunk(
+    scope: &Scope<'_>,
+    payload: Object<'_>,
+    chunk: HandleValue<'_>,
+) -> Result<(), ExnThrown> {
+    let pump = payload
+        .cast::<NativePump>()
+        .expect("payload is a NativePump");
+    pump.data_mut().reading = false;
+    if pump.data().finished {
+        return Ok(());
+    }
+    // A chunk that arrives after the stream ended early isn't written.
+    if pump.data().end.is_none() {
+        if let Some(Err(message)) = pump.with_sink(|sink| sink.append(scope, chunk)) {
+            pump.data_mut().end = Some(PumpEnd::Failed(message));
+        }
+    }
+    run(scope, &pump);
+    Ok(())
+}
+
+fn pump_close(scope: &Scope<'_>, payload: Object<'_>) -> Result<(), ExnThrown> {
+    let pump = payload
+        .cast::<NativePump>()
+        .expect("payload is a NativePump");
+    pump.data_mut().reading = false;
+    pump.data_mut().end.get_or_insert(PumpEnd::Closed);
+    run(scope, &pump);
+    Ok(())
+}
+
+fn pump_error(
+    scope: &Scope<'_>,
+    payload: Object<'_>,
+    error: HandleValue<'_>,
+) -> Result<(), ExnThrown> {
+    let pump = payload
+        .cast::<NativePump>()
+        .expect("payload is a NativePump");
+    pump.data_mut().reading = false;
+    if let Some(message) = pump.with_sink(|sink| sink.describe_source_error(scope, error)) {
+        pump.data_mut().end.get_or_insert(PumpEnd::Failed(message));
+    }
+    run(scope, &pump);
+    Ok(())
+}
diff --git a/crates/builtins/web-streams/src/readable/read_all_bytes.rs b/crates/builtins/web-streams/src/readable/read_all_bytes.rs
index 8f0f0c3e..ad33049e 100644
--- a/crates/builtins/web-streams/src/readable/read_all_bytes.rs
+++ b/crates/builtins/web-streams/src/readable/read_all_bytes.rs
@@ -4,19 +4,9 @@
 //!
 //! <https://streams.spec.whatwg.org/#readablestreamdefaultreader-read-all-bytes>
 //!
-//! Drains a default reader to a single byte sequence using *internal* read
-//! requests, then hands the bytes to a caller-supplied success callback. Fetch's
-//! `fully read a body` is the sole consumer: it acquires an internal reader for a
-//! body's stream and reads all the bytes, converting them to the requested value
-//! (text, JSON, an `ArrayBuffer`, …) in the success callback.
-//!
-//! Reading via internal read requests — rather than the author-facing
-//! `reader.read()` — is what makes this immune to a hijacked `Object.prototype.then`:
-//! the chunk steps receive the chunk directly and accumulate its bytes, never
-//! building an `{ value, done }` iterator-result object nor resolving a promise
-//! with one, so the engine never performs thenable assimilation that would look up
-//! and invoke an author-installed `then`. (The same property is why `pipeTo`
-//! survives that attack.)
+//! Drains a default reader to a single byte sequence using internal read
+//! requests (see [`native_read`](super::native_read) for why), then hands the
+//! bytes to a caller-supplied success callback.
 
 use super::algorithms::{
     acquire_readable_stream_default_reader, readable_stream_default_reader_read,
@@ -27,7 +17,7 @@ use super::readable_stream::ReadableStream;
 use crate::readable::DefaultReader;
 use core_runtime::{jsclass, jsmethods};
 use js::conversion::FromJSVal;
-use js::error::ExnThrown;
+use js::error::{ExnThrown, OutOfMemory, ThrowException};
 use js::function::cast_payload;
 use js::gc::handle::Heap;
 use js::gc::scope::Scope;
@@ -38,9 +28,8 @@ use js::{Function, Promise, Uint8Array};
 
 /// The completion of a read-all-bytes drain (the caller's `successSteps`):
 /// receives the payload value given to [`read_all_bytes`] and the assembled
-/// bytes **by value** — no intermediate JS `Uint8Array` round-trip — and
-/// returns the value the result promise resolves with (or throws to reject
-/// it).
+/// bytes, and returns the value the result promise resolves with (or throws to
+/// reject it).
 pub type ReadAllBytesComplete =
     for<'r> fn(&'r Scope<'r>, HandleValue<'_>, Vec<u8>) -> Result<HandleValue<'r>, ExnThrown>;
 
@@ -62,11 +51,10 @@ pub(crate) struct ReadAllBytesState {
     /// [`read_all_bytes`] right after the state is created (`Option` only
     /// because the callback's payload is the state object, which must exist
     /// first) and queued directly on the job queue per chunk, so the read
-    /// loop allocates nothing per chunk.
+    /// loop doesn't allocate per chunk.
     read_next_fn: Option<Heap<js::function::Function>>,
 }
 
-// Needed to fully initialize the class. Intentionally left blank.
 #[jsmethods]
 impl ReadAllBytesState {
     fn new(
@@ -97,20 +85,9 @@ pub fn read_all_bytes<'r>(
     payload: HandleValue<'_>,
 ) -> Result<Promise<'r>, ExnThrown> {
     let promise = Promise::new_pending(scope)?;
-    // Acquire an *internal* default reader (not the author-facing `getReader()`),
-    // so its read requests deliver chunks to native steps rather than to author
-    // code via promise resolution.
-    //
-    // The reader is deliberately never released (neither close nor error steps do
-    // so): the sole caller is the Fetch "fully read a body" path, which consumes a
-    // body exactly once and must leave the stream locked-and-disturbed so it
-    // cannot be re-read (mirroring `body::readable_stream_consumed`). A future
-    // non-fetch caller that wants the stream reusable afterward must release it
-    // itself.
+    // The reader is never released, so the stream stays locked afterwards.
     let reader = acquire_readable_stream_default_reader(scope, &stream)?;
     let state = ReadAllBytesState::new(scope, reader, promise, on_complete, payload)?;
-    // The deferred-read callback, reused for every chunk. Created here (not in
-    // the closure above) because its payload is the state object.
     let read_next_fn = Function::new_callback(scope, c"", 0, read_next_microtask, state)?;
     state.data_mut().read_next_fn.set(read_next_fn);
     read_next(scope, state);
@@ -142,8 +119,7 @@ fn read_next(scope: &Scope<'_>, state: ReadAllBytesState<'_>) {
 /// synchronously (`readable_stream_default_reader_read`'s pull steps run the
 /// chunk steps on the same stack), so issuing the next read directly from here
 /// recurses once per queued chunk and overflows the stack on a body with many
-/// queued chunks. One flat microtask per chunk keeps the loop iterative, the
-/// same way the tee and pipe read requests defer their per-chunk work.
+/// queued chunks. One flat microtask per chunk keeps the loop iterative.
 pub(crate) fn read_all_bytes_chunk_steps(
     scope: &Scope<'_>,
     state: ReadAllBytesState<'_>,
@@ -157,10 +133,21 @@ pub(crate) fn read_all_bytes_chunk_steps(
         return promise.reject_with_pending(scope);
     };
     // Step 2: Append the bytes represented by chunk to bytes.
-    // SAFETY: the slice is consumed immediately; appending to the Rust-side
-    // accumulator cannot trigger a GC or detach the chunk's buffer.
-    let chunk_bytes = unsafe { array.as_slice() };
-    state.data_mut().bytes.extend_from_slice(chunk_bytes);
+    let mut data = state.data_mut();
+    let bytes = &mut data.bytes;
+    let appended = array.with_slice(|chunk| {
+        let reserved = bytes.try_reserve(chunk.len()).is_ok();
+        if reserved {
+            bytes.extend_from_slice(chunk);
+        }
+        reserved
+    });
+    drop(data);
+    if !appended {
+        OutOfMemory.throw(scope);
+        let promise = state.data().promise.get(scope);
+        return promise.reject_with_pending(scope);
+    }
     // Step 3: Read-loop — deferred one microtask (see above): queue the
     // state's deferred-read callback directly on the job queue.
     let microtask = state
@@ -183,9 +170,9 @@ fn read_next_microtask(
     Ok(value::undefined())
 }
 
-/// The `Consume` read request's close steps: hand the accumulated bytes (by
-/// value — no `Uint8Array` round-trip) to the native success callback, and
-/// resolve the result promise with its return value (or reject if it throws).
+/// The `Consume` read request's close steps: hand the accumulated bytes to the
+/// native success callback, and resolve the result promise with its return
+/// value (or reject if it throws).
 pub(crate) fn read_all_bytes_close_steps(
     scope: &Scope<'_>,
     state: ReadAllBytesState<'_>,
diff --git a/crates/builtins/web-streams/src/readable/read_request.rs b/crates/builtins/web-streams/src/readable/read_request.rs
index 87cce38b..e06d6625 100644
--- a/crates/builtins/web-streams/src/readable/read_request.rs
+++ b/crates/builtins/web-streams/src/readable/read_request.rs
@@ -1,18 +1,9 @@
 // SPDX-License-Identifier: Apache-2.0-WITH-LLVM-exception
 
-//! Read requests.
+//! Read requests and read-into requests, one enum variant per consumer.
 //!
 //! <https://streams.spec.whatwg.org/#read-request>
-//!
-//! A read request is a spec struct bundling three native step-algorithms —
-//! `chunk steps` (given a chunk), `close steps`, and `error steps` (given an
-//! error). Each consumer of a `DefaultReader` (a `read()` call,
-//! `pipeTo`, `tee`, the async iterator) supplies its own. They are modelled as
-//! an enum — one variant per consumer — rather than as JS values, because the
-//! steps are native and the `[[readRequests]]` list must trace whatever rooted
-//! state they hold.
 
-use js::error::ExnThrown;
 use js::gc::handle::Heap;
 use js::gc::scope::Scope;
 use js::iteration::create_iter_result;
@@ -30,14 +21,9 @@ use crate::readable::read_all_bytes::{
     read_all_bytes_chunk_steps, read_all_bytes_close_steps, read_all_bytes_error_steps,
     ReadAllBytesStateImpl,
 };
+use crate::support::report_failure;
 
 /// An entry in a reader's `[[readRequests]]` list.
-///
-/// Marked `#[js::must_root]` because each variant holds a `Heap` (the read
-/// promise, or tee/pipe/iterator state): crown then rejects holding a
-/// `ReadRequest` by value in a plain local across an allocation — the exact
-/// untraced-`Heap`-across-GC hazard — forcing callers to keep it traced
-/// (`RootedTraceableBox`) until they settle it.
 #[js::must_root]
 #[derive(core_runtime::Traceable, js::ScopeRoot)]
 pub(crate) enum ReadRequest {
@@ -100,10 +86,6 @@ pub(crate) enum ReadRequest {
     /// its error steps reject the result promise. The shared state is a
     /// `ReadAllBytesState` (see `crate::readable::read_all_bytes`).
     ///
-    /// Unlike a `Read` request, the chunk never becomes an `{ value, done }`
-    /// object resolved into a promise, so a hijacked `Object.prototype.then`
-    /// cannot intercept it.
-    ///
     /// <https://streams.spec.whatwg.org/#readablestreamdefaultreader-read-all-bytes>
     Consume {
         /// The read-all-bytes state object.
@@ -111,9 +93,7 @@ pub(crate) enum ReadRequest {
     },
     /// An out-of-crate native consumer's read request (see
     /// `crate::readable::native_read`): the steps are plain fn pointers
-    /// receiving the rooted `payload`. Like `Consume`, delivery never builds an
-    /// `{ value, done }` object or resolves a promise, so author code cannot
-    /// observe it.
+    /// receiving the rooted `payload`.
     Native {
         /// The consumer's step functions.
         #[no_trace]
@@ -131,16 +111,15 @@ impl<'s> StackReadRequest<'s> {
                 .and_then(|result| promise.resolve(scope, result)),
             StackReadRequest::Tee { state } => tee_read_request_chunk_steps(scope, state, chunk),
             StackReadRequest::Pipe { state } => pipe_read_request_chunk_steps(scope, state, chunk),
-            StackReadRequest::AsyncIter { promise, .. } => {
-                super::async_iterator::async_iter_chunk_steps(scope, promise, chunk)
-            }
+            // `next()`'s fulfill steps wrap the raw chunk in `{ value, done }`.
+            StackReadRequest::AsyncIter { promise, .. } => promise.resolve(scope, chunk),
             StackReadRequest::ByteTeeDefault { state } => {
                 byte_tee_default_chunk_steps(scope, state, chunk)
             }
             StackReadRequest::Consume { state } => read_all_bytes_chunk_steps(scope, state, chunk),
             StackReadRequest::Native { steps, payload } => (steps.chunk)(scope, payload, chunk),
         };
-        report_failed_steps(scope, result, "read request chunk steps");
+        report_failure(scope, result, "read request chunk steps");
     }
 
     /// Perform the read request's `close steps`.
@@ -170,7 +149,7 @@ impl<'s> StackReadRequest<'s> {
             StackReadRequest::Consume { state } => read_all_bytes_close_steps(scope, state),
             StackReadRequest::Native { steps, payload } => (steps.close)(scope, payload),
         };
-        report_failed_steps(scope, result, "read request close steps");
+        report_failure(scope, result, "read request close steps");
     }
 
     /// Perform the read request's `error steps` given `e`.
@@ -194,7 +173,7 @@ impl<'s> StackReadRequest<'s> {
             StackReadRequest::Consume { state } => read_all_bytes_error_steps(scope, state, e),
             StackReadRequest::Native { steps, payload } => (steps.error)(scope, payload, e),
         };
-        report_failed_steps(scope, result, "read request error steps");
+        report_failure(scope, result, "read request error steps");
     }
 }
 
@@ -205,9 +184,6 @@ impl<'s> StackReadRequest<'s> {
 /// Like [`ReadRequest`] but for `BYOBReader.read(view)`. Its
 /// `chunk`/`close` steps both receive a view (the filled or empty destination),
 /// unlike a default read request whose close step produces `undefined`.
-///
-/// Marked `#[js::must_root]` for the same reason as [`ReadRequest`]: its
-/// variants hold a `Heap`, so crown forbids holding one untraced across a GC.
 #[js::must_root]
 #[derive(core_runtime::Traceable, js::ScopeRoot)]
 pub(crate) enum ReadIntoRequest {
@@ -244,7 +220,7 @@ impl<'s> StackReadIntoRequest<'s> {
                 byte_tee_byob_chunk_steps(scope, state, for_branch2, chunk)
             }
         };
-        report_failed_steps(scope, result, "read-into request chunk steps");
+        report_failure(scope, result, "read-into request chunk steps");
     }
 
     /// Perform the read-into request's `close steps` given `chunk`.
@@ -256,7 +232,7 @@ impl<'s> StackReadIntoRequest<'s> {
                 byte_tee_byob_close_steps(scope, state, for_branch2, chunk)
             }
         };
-        report_failed_steps(scope, result, "read-into request close steps");
+        report_failure(scope, result, "read-into request close steps");
     }
 
     /// Perform the read-into request's `error steps` given `e`.
@@ -271,15 +247,6 @@ impl<'s> StackReadIntoRequest<'s> {
                 Ok(())
             }
         };
-        report_failed_steps(scope, result, "read-into request error steps");
-    }
-}
-
-/// Read request steps have no caller to throw to, so an exception one of them
-/// leaves (from a consumer's native step, or running out of memory) is reported
-/// and cleared.
-fn report_failed_steps(scope: &Scope<'_>, result: Result<(), ExnThrown>, context: &str) {
-    if result.is_err() {
-        js::exception::report_and_clear(scope, context);
+        report_failure(scope, result, "read-into request error steps");
     }
 }
diff --git a/crates/builtins/web-streams/src/readable/readable_stream.rs b/crates/builtins/web-streams/src/readable/readable_stream.rs
index 9b0dae1a..792e85ec 100644
--- a/crates/builtins/web-streams/src/readable/readable_stream.rs
+++ b/crates/builtins/web-streams/src/readable/readable_stream.rs
@@ -199,7 +199,7 @@ impl ReadableStream {
             0.0,
             HandleValue::undefined(),
         )?;
-        if let Ok(source) = js::Object::from_value(scope, underlying_source.get()) {
+        if let Ok(source) = js::Object::from_value(scope, underlying_source) {
             stream.set_native_source(&source);
         }
         Ok(stream)
@@ -220,7 +220,7 @@ impl ReadableStream {
         let underlying_source = underlying_source.to_jsval_throwing(scope)?;
         let stream =
             algorithms::create_readable_byte_stream(scope, AlgorithmArg::None, pull, cancel)?;
-        if let Ok(source) = Object::from_value(scope, underlying_source.get()) {
+        if let Ok(source) = Object::from_value(scope, underlying_source) {
             stream.set_native_source(&source);
         }
         Ok(stream)
@@ -484,20 +484,16 @@ impl ReadableStream {
         self.data().disturbed
     }
 
-    /// Whether the stream is still readable — neither closed nor errored, so
-    /// closing or erroring it would still have an observable effect.
+    /// Whether the stream is still readable: neither closed nor errored.
     pub fn is_readable(&self) -> bool {
         self.data().state == ReadableStreamState::Readable
     }
 
     /// <https://streams.spec.whatwg.org/#readable-stream-cancel>
     /// Cancel the stream with `reason`, running its underlying source's cancel
-    /// steps. This is `ReadableStreamCancel`, the internal algorithm, so — unlike
-    /// the author-facing `cancel()` method — it applies to a locked stream too.
-    /// Callers that hold a reader should prefer
+    /// steps. Unlike the author-facing [`cancel`](Self::cancel) method, this
+    /// applies to a locked stream too. Callers that hold a reader should prefer
     /// [`native_read::native_reader_cancel`](crate::readable::native_read::native_reader_cancel).
-    /// Distinct from the author-facing [`cancel`](Self::cancel) method above,
-    /// which rejects when the stream is locked.
     pub fn cancel_internal<'r>(
         &self,
         scope: &'r Scope<'_>,
@@ -568,18 +564,11 @@ impl ReadableStream {
     /// `None` once that demand has arrived, or if this stream is not piped to such
     /// a transform.
     ///
-    /// This allows native underlying stream sources to hold off on performing an
-    /// actual read operation until a `pull` happens on the pipeline's readable end,
-    /// without deviating from the spec. Instead of immediately performing the
-    /// operation, it can subscribe to this promise and get notified once a `pull`
-    /// happens, or on the next tick if one is already pending.
-    ///
-    /// Why is this needed at all? The fact that a `TransformStream`'s writable side
-    /// has a high-water mark of `1` means that a `pull` is enqueued upon the TS's
-    /// creation. When a `ReadableStream` is later piped to the TS, that `pull` is
-    /// applied to it. Without this kind of mechanism, the source would have no
-    /// choice but to immediately perform the operation, only for the result to be
-    /// parked in the `TransformStream`.
+    /// A native source can wait on this promise instead of reading at once, so it
+    /// reads only when a `pull` happens on the pipeline's readable end. A
+    /// `TransformStream`'s writable side has a high-water mark of `1`, so piping
+    /// into it pulls from the source before anything reads the transform's
+    /// readable end.
     pub fn deferred_demand<'r>(&self, scope: &'r Scope<'_>) -> Option<Promise<'r>> {
         let transform = self.data().piped_to_identity_transform.get(scope)?;
         // Backpressure is set while the readable end holds no demand, and
diff --git a/crates/builtins/web-streams/src/support.rs b/crates/builtins/web-streams/src/support.rs
index 4df25e9d..52db141f 100644
--- a/crates/builtins/web-streams/src/support.rs
+++ b/crates/builtins/web-streams/src/support.rs
@@ -172,18 +172,15 @@ pub(crate) fn invoke_algorithm<'r>(
     }
 }
 
-/// Attach native fulfillment/rejection reactions to `promise`, each carrying a
+/// Attach native fulfillment/rejection reactions to `promise`, each called with a
 /// single payload value (typically the controller or reader the reaction
-/// operates on). Mirrors the spec's "upon fulfillment / upon rejection of
-/// promise" and "react to promise" phrasing.
+/// operates on). Implements the spec's "upon fulfillment / upon rejection of
+/// promise" and "react to promise".
 ///
-/// These are internal reactions: the dependent promise is discarded and never
-/// surfaced to author code, so it must not participate in unhandled-rejection
-/// tracking. A fulfillment-only reaction on a promise that later rejects (e.g.
-/// pipeTo's forward-close reaction on `reader.[[closedPromise]]`) would
-/// otherwise produce a spurious unhandled rejection. Attaching the reaction also
-/// marks `promise` itself handled, which is correct — the stream is consuming
-/// it.
+/// The dependent promise is never exposed to author code, so it is excluded from
+/// unhandled-rejection tracking. Otherwise a fulfillment-only reaction on a
+/// promise that later rejects would report a spurious unhandled rejection.
+/// Attaching the reactions also marks `promise` handled.
 pub(crate) fn react<'r, P: ToJSVal<'r>>(
     scope: &'r Scope<'_>,
     promise: &Promise<'_>,
diff --git a/crates/builtins/web-streams/src/transform/mod.rs b/crates/builtins/web-streams/src/transform/mod.rs
index 5f71dfbb..4fd32db9 100644
--- a/crates/builtins/web-streams/src/transform/mod.rs
+++ b/crates/builtins/web-streams/src/transform/mod.rs
@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: Apache-2.0-WITH-LLVM-exception
 
-//! <https://streams.spec.whatwg.org/#rs-model>
+//! <https://streams.spec.whatwg.org/#ts-model>
 
 pub(crate) mod algorithms;
 
@@ -11,5 +11,5 @@ pub mod transformer;
 
 pub use readable_writable_pair::ReadableWritablePair;
 pub use transform_stream::TransformStream;
-pub use transform_stream_default_controller::TransformStreamDefaultController as ReadableStreamDefaultController;
+pub use transform_stream_default_controller::TransformStreamDefaultController;
 pub use transformer::Transformer;
diff --git a/crates/builtins/web-streams/src/transform/transform_stream.rs b/crates/builtins/web-streams/src/transform/transform_stream.rs
index c3ec18da..8bedbaac 100644
--- a/crates/builtins/web-streams/src/transform/transform_stream.rs
+++ b/crates/builtins/web-streams/src/transform/transform_stream.rs
@@ -141,13 +141,10 @@ impl TransformStream {
             // Step 13: Otherwise, `resolve` _startPromise_ with undefined.
             start_promise.resolve(scope, HandleValue::undefined())?;
         }
-        // Not a spec step: mark an identity transform by linking its writable to its readable,
+        // Not a spec step: mark an identity transform by linking its writable to the transform,
         // so a native byte source piped into the writable can be propagated to the readable
-        // directly. Only a transform that runs no content code per chunk qualifies, so the
-        // shortcut has no content-visible effect: a transformer with any callback
-        // (`transform`/`start`/`flush`/`cancel` — which could enqueue extra chunks, or expect a
-        // cancel hook), or either strategy carrying a `size` function (invoked once per chunk on
-        // the non-shortcut path), disqualifies it.
+        // directly. The shortcut has no content-visible effect only if no content code runs per
+        // chunk, so any transformer callback or strategy `size` function disqualifies it.
         let no_strategy_size = readable_strategy
             .as_ref()
             .and_then(|s| s.size.as_ref())
diff --git a/crates/builtins/web-streams/src/writable/writable_stream.rs b/crates/builtins/web-streams/src/writable/writable_stream.rs
index 8264a89b..dcb51912 100644
--- a/crates/builtins/web-streams/src/writable/writable_stream.rs
+++ b/crates/builtins/web-streams/src/writable/writable_stream.rs
@@ -22,13 +22,6 @@ use js::Promise;
 use web_globals::events::algorithms::ScriptStackState;
 
 /// A traced slot holding a `Promise`.
-///
-/// `must_root`: the slot wraps a `Heap<Promise>`, so crown rejects holding a
-/// `PromiseSlot` by value in a plain local across an allocation — the
-/// untraced-`Heap`-across-GC hazard. While it lives inside a traced container (a
-/// stream's write-request queue or an in-flight/close slot) its `Heap` is traced
-/// normally; once moved out via `take`/`pop_front` it must be consumed
-/// immediately (`into_promise`) or kept in a `RootedTraceableBox`.
 #[js::must_root]
 #[derive(core_runtime::Traceable, Default, js::ScopeRoot)]
 pub(crate) struct PromiseSlot(Heap<js::promise::Promise>);
@@ -50,10 +43,6 @@ impl<'s> StackPromiseSlot<'s> {
 /// A pending abort request.
 ///
 /// <https://streams.spec.whatwg.org/#writablestream-pendingabortrequest>
-///
-/// `must_root`: holds `Heap` fields, so crown rejects holding it by value across
-/// an allocation. It lives in the stream's traced `[[pendingAbortRequest]]`
-/// slot; once moved out it must be consumed immediately or kept rooted.
 #[js::must_root]
 #[derive(core_runtime::Traceable, Default, js::ScopeRoot)]
 pub(crate) struct PendingAbortRequest {
diff --git a/crates/builtins/web-streams/tests/async_iterator.rs b/crates/builtins/web-streams/tests/async_iterator.rs
deleted file mode 100644
index 37da9cee..00000000
--- a/crates/builtins/web-streams/tests/async_iterator.rs
+++ /dev/null
@@ -1,172 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0-WITH-LLVM-exception
-
-//! Keystone integration tests for `ReadableStream` async iteration
-//! (`values()` / `[Symbol.asyncIterator]`): `for await` drains a stream, an
-//! early `break` cancels the source (unless `preventCancel`), and the iterator's
-//! prototype chains to `%AsyncIteratorPrototype%`. Covered far more thoroughly by
-//! `streams/readable-streams/async-iterator.any.js`; this is the fast,
-//! design-validating (and GC-rooting-validating) smoke test.
-
-// This file contains nothing platform-specific, so skip it on wasm32.
-#![cfg(not(target_arch = "wasm32"))]
-
-use core_runtime::runtime::{clear_global_initializers, register_global_initializer};
-use core_runtime::test_util::eval_out_with_setup;
-
-fn run(code: &str) -> String {
-    eval_out_with_setup(
-        || {
-            clear_global_initializers();
-            register_global_initializer(web_streams::add_to_global);
-        },
-        code,
-    )
-}
-
-/// `for await` drains all of the stream's chunks.
-#[test]
-fn for_await_drains_stream() {
-    let out = run(r#"
-        globalThis.__out = "pending";
-        const rs = new ReadableStream({ start(c) { c.enqueue("a"); c.enqueue("b"); c.enqueue("c"); c.close(); } });
-        (async () => {
-            let acc = "";
-            for await (const chunk of rs) acc += chunk;
-            globalThis.__out = acc;
-        })();
-        "#);
-    assert_eq!(out, "abc");
-}
-
-/// A promise chunk is adopted, not yielded as-is: the spec's "get the next
-/// iteration result" resolves its promise with the raw chunk, so a thenable chunk
-/// is unwrapped before the `{ value, done }` result is built. `for await` of a
-/// stream that enqueues `Promise.resolve(5)` yields `5`, not the promise object.
-#[test]
-fn for_await_adopts_thenable_chunk() {
-    let out = run(r#"
-        globalThis.__out = "pending";
-        const rs = new ReadableStream({ start(c) { c.enqueue(Promise.resolve(5)); c.close(); } });
-        (async () => {
-            const vals = [];
-            for await (const x of rs) vals.push(x);
-            globalThis.__out = vals.join(",") + "|" + typeof vals[0];
-        })();
-        "#);
-    assert_eq!(out, "5|number");
-}
-
-/// A rejected-thenable chunk rejects `next()` and finishes the iterator (the
-/// adopted rejection propagates), rather than yielding the rejected promise.
-#[test]
-fn for_await_rejected_thenable_chunk_throws() {
-    let out = run(r#"
-        globalThis.__out = "pending";
-        const rs = new ReadableStream({ start(c) { c.enqueue(Promise.reject(new TypeError("boom"))); c.close(); } });
-        (async () => {
-            try {
-                for await (const x of rs) { globalThis.__out = "yielded:" + x; return; }
-                globalThis.__out = "done-no-throw";
-            } catch (e) { globalThis.__out = "threw:" + e.constructor.name + ":" + e.message; }
-        })();
-        "#);
-    assert_eq!(out, "threw:TypeError:boom");
-}
-
-/// Breaking out of `for await` cancels the source (the stream becomes unlocked).
-#[test]
-fn break_cancels_source() {
-    let out = run(r#"
-        globalThis.__out = "pending";
-        let cancelled = false;
-        const rs = new ReadableStream({
-            start(c) { c.enqueue(1); c.enqueue(2); c.enqueue(3); },
-            cancel() { cancelled = true; },
-        });
-        (async () => {
-            for await (const chunk of rs) { if (chunk === 2) break; }
-            globalThis.__out = "cancelled:" + cancelled + ",locked:" + rs.locked;
-        })();
-        "#);
-    assert_eq!(out, "cancelled:true,locked:false");
-}
-
-/// `values({ preventCancel: true })` leaves the source uncancelled after break.
-#[test]
-fn prevent_cancel_leaves_source_open() {
-    let out = run(r#"
-        globalThis.__out = "pending";
-        let cancelled = false;
-        const rs = new ReadableStream({
-            start(c) { c.enqueue(1); c.enqueue(2); },
-            cancel() { cancelled = true; },
-        });
-        (async () => {
-            for await (const chunk of rs.values({ preventCancel: true })) { break; }
-            globalThis.__out = "cancelled:" + cancelled;
-        })();
-        "#);
-    assert_eq!(out, "cancelled:false");
-}
-
-/// The default async iterator is not a WebIDL interface, so it has no interface
-/// object: `ReadableStreamAsyncIterator` must not leak onto the global, and the
-/// prototype's class string is `"ReadableStream AsyncIterator"` (with a space),
-/// per WebIDL §3.7.10.
-#[test]
-fn async_iterator_has_no_global_and_spaced_string_tag() {
-    let out = run(r#"
-        const leaked = "ReadableStreamAsyncIterator" in globalThis;
-        const tag = Object.prototype.toString.call(new ReadableStream().values());
-        globalThis.__out = `leaked=${leaked},tag=${tag}`;
-        "#);
-    assert_eq!(
-        out,
-        "leaked=false,tag=[object ReadableStream AsyncIterator]"
-    );
-}
-
-/// The iterator's prototype chains to `%AsyncIteratorPrototype%` and exposes only
-/// `next`/`return`.
-#[test]
-fn iterator_prototype_shape() {
-    let out = run(r#"
-        const it = new ReadableStream().values();
-        const proto = Object.getPrototypeOf(it);
-        const AsyncIteratorPrototype = Object.getPrototypeOf(Object.getPrototypeOf(async function* () {}).prototype);
-        const chained = Object.getPrototypeOf(proto) === AsyncIteratorPrototype;
-        const names = Object.getOwnPropertyNames(proto).sort().join(",");
-        const aliased = ReadableStream.prototype[Symbol.asyncIterator] === ReadableStream.prototype.values;
-        globalThis.__out = `${chained},${names},${aliased}`;
-        "#);
-    assert_eq!(out, "true,next,return,true");
-}
-
-/// `next()` clears the ongoing promise when the previous call settles, so a call
-/// made after that runs the next steps directly instead of chaining behind the
-/// settled promise. Both calls then settle after the same number of ticks.
-#[test]
-fn settled_next_does_not_delay_the_following_call() {
-    let out = run(r#"
-        globalThis.__out = "pending";
-        const rs = new ReadableStream({ start(c) { c.enqueue(1); c.enqueue(2); } });
-        const it = rs.values();
-        function ticksUntil(p) {
-            let done = false;
-            p.then(() => { done = true; });
-            return new Promise(resolve => {
-                let n = 0;
-                (function spin() {
-                    if (done) { resolve(n); } else { n++; Promise.resolve().then(spin); }
-                })();
-            });
-        }
-        (async () => {
-            const first = await ticksUntil(it.next());
-            const second = await ticksUntil(it.next());
-            globalThis.__out = `${first},${second}`;
-        })();
-    "#);
-    let (first, second) = out.split_once(',').expect("two tick counts");
-    assert_eq!(first, second, "ticks: {out}");
-}
diff --git a/crates/builtins/web-streams/tests/body.rs b/crates/builtins/web-streams/tests/body.rs
deleted file mode 100644
index 4352e5bf..00000000
--- a/crates/builtins/web-streams/tests/body.rs
+++ /dev/null
@@ -1,81 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0-WITH-LLVM-exception
-
-//! Keystone test for the bytes → `ReadableStream` bridge (`web_streams::body`).
-//!
-//! Fetch (and the File API) create response/request body streams from Rust byte
-//! buffers via `readable_stream_from_bytes`, then hand them to JS as `.body`.
-//! This validates that such a Rust-created stream is a fully functional JS
-//! `ReadableStream`: a reader drains it chunk-by-chunk and observes exactly the
-//! original bytes, then `done`. Runs JS, drains microtasks, reads back a result
-//! stashed on `globalThis`.
-
-// This file contains nothing platform-specific, so skip it on wasm32.
-#![cfg(not(target_arch = "wasm32"))]
-
-use core_runtime::config::RuntimeConfig;
-use core_runtime::runtime::{clear_global_initializers, register_global_initializer, Runtime};
-use core_runtime::test_util::eval_and_read_out;
-use web_streams::readable::ReadableStream;
-
-/// Create a stream from `bytes`, expose it as `globalThis.__stream`, then evaluate
-/// `code`, drain microtasks, and return `String(globalThis.__out)`.
-fn run_with_stream(bytes: &[u8], code: &str) -> String {
-    clear_global_initializers();
-    register_global_initializer(web_streams::add_to_global);
-    let rt = Runtime::init(&RuntimeConfig::default()).expect("runtime init");
-    let scope = rt.default_global();
-    let global = scope.global();
-    let stream = ReadableStream::from_bytes(&scope, bytes).expect("create stream from bytes");
-    global
-        .set_property(&scope, c"__stream", stream)
-        .expect("expose __stream");
-    eval_and_read_out(&scope, code)
-}
-
-/// A non-empty Rust-created stream drains to exactly its original bytes, then
-/// closes. Chunks are `Uint8Array`s (as observed for `Response.body`).
-#[test]
-fn bytes_round_trip_through_js_reader() {
-    let out = run_with_stream(
-        b"hello world",
-        r#"
-        globalThis.__out = "pending";
-        (async () => {
-            const reader = globalThis.__stream.getReader();
-            const bytes = [];
-            let chunkCount = 0;
-            for (;;) {
-                const { value, done } = await reader.read();
-                if (done) break;
-                chunkCount++;
-                if (!(value instanceof Uint8Array)) {
-                    globalThis.__out = "chunk not Uint8Array: " + value;
-                    return;
-                }
-                bytes.push(...value);
-            }
-            globalThis.__out = chunkCount + ":" + bytes.join(",");
-        })();
-        "#,
-    );
-    // "hello world" is 11 bytes, delivered as a single Uint8Array chunk.
-    assert_eq!(out, "1:104,101,108,108,111,32,119,111,114,108,100");
-}
-
-/// An empty Rust-created stream is immediately closed: the first `read()`
-/// resolves to `{ done: true }` with no chunk.
-#[test]
-fn empty_stream_closes_immediately() {
-    let out = run_with_stream(
-        b"",
-        r#"
-        globalThis.__out = "pending";
-        (async () => {
-            const reader = globalThis.__stream.getReader();
-            const { value, done } = await reader.read();
-            globalThis.__out = `done=${done},value=${value}`;
-        })();
-        "#,
-    );
-    assert_eq!(out, "done=true,value=undefined");
-}
diff --git a/crates/builtins/web-streams/tests/native_pump.rs b/crates/builtins/web-streams/tests/native_pump.rs
new file mode 100644
index 00000000..c36274d0
--- /dev/null
+++ b/crates/builtins/web-streams/tests/native_pump.rs
@@ -0,0 +1,230 @@
+// SPDX-License-Identifier: Apache-2.0-WITH-LLVM-exception
+
+//! `NativePump` behavior that its users' tests can't observe: the size of the batches it writes,
+//! what happens to chunks that arrive after [`PumpBatch::check`] rejected one, and when unsent
+//! chunks are released.
+
+#![cfg(not(target_arch = "wasm32"))]
+
+use std::cell::RefCell;
+use std::rc::Rc;
+
+use core_runtime::config::RuntimeConfig;
+use core_runtime::event_loop::{run_microtasks, run_to_completion, with_event_loop, EventLoop};
+use core_runtime::runtime::{clear_global_initializers, register_global_initializer, Runtime};
+use js::conversion::FromJSVal;
+use js::gc::scope::Scope;
+use js::prelude::HandleValue;
+use web_streams::readable::native_pump::{
+    append_bytes, NativePump, PumpBatch, PumpEnd, PumpSink, PUMP_BATCH_BYTES,
+};
+use web_streams::readable::native_read::acquire_native_reader;
+use web_streams::readable::ReadableStream;
+
+#[derive(Default)]
+struct Log {
+    writes: Vec<Vec<u8>>,
+    ends: Vec<PumpEnd>,
+    /// The contents of each non-empty batch that was dropped instead of written.
+    dropped: Vec<Vec<u8>>,
+}
+
+struct Bytes(Vec<u8>, Rc<RefCell<Log>>);
+
+impl Drop for Bytes {
+    fn drop(&mut self) {
+        if !self.0.is_empty() {
+            self.1
+                .borrow_mut()
+                .dropped
+                .push(std::mem::take(&mut self.0));
+        }
+    }
+}
+
+impl PumpBatch for Bytes {
+    fn append(&mut self, scope: &Scope<'_>, chunk: HandleValue<'_>) -> Result<(), String> {
+        let array = js::Uint8Array::from_jsval(scope, chunk, ())
+            .map_err(|_| "not a Uint8Array".to_string())?;
+        array
+            .with_slice(|bytes| append_bytes(&mut self.0, bytes))
+            .map_err(|_| "out of memory".to_string())
+    }
+
+    /// Reject the byte 255.
+    fn check(&mut self, _scope: &Scope<'_>) -> Result<(), String> {
+        match self.0.iter().position(|&byte| byte == 255) {
+            Some(rejected) => {
+                self.0.truncate(rejected);
+                Err("rejected 255".to_string())
+            }
+            None => Ok(()),
+        }
+    }
+
+    fn is_empty(&self) -> bool {
+        self.0.is_empty()
+    }
+
+    fn is_full(&self) -> bool {
+        self.0.len() >= PUMP_BATCH_BYTES
+    }
+
+    fn take(&mut self) -> Self {
+        Bytes(std::mem::take(&mut self.0), Rc::clone(&self.1))
+    }
+}
+
+/// A sink that records each batch it writes and the end it finishes with. If `gone` is set, its
+/// receiver went away, and every write drops its batch.
+struct TestSink {
+    log: Rc<RefCell<Log>>,
+    gone: bool,
+}
+
+impl PumpSink for TestSink {
+    type Batch = Bytes;
+
+    async fn write(self, mut batch: Bytes) -> Option<Self> {
+        if self.gone {
+            return None;
+        }
+        self.log
+            .borrow_mut()
+            .writes
+            .push(std::mem::take(&mut batch.0));
+        Some(self)
+    }
+
+    fn describe_source_error(_scope: &Scope<'_>, _error: HandleValue<'_>) -> String {
+        "the source errored".to_string()
+    }
+
+    fn finish(self, _scope: &Scope<'_>, end: &PumpEnd) {
+        self.log.borrow_mut().ends.push(end.clone());
+    }
+}
+
+/// Evaluate `source`, whose completion value is a `ReadableStream`, pump that stream into a
+/// [`TestSink`] with `gone`, and run the event loop until it has no work left. A `cancel` function
+/// that records its reason in `globalThis.__out` is in scope for `source`. The pump is kept alive
+/// until the function returns, so that collecting it doesn't release its batch. Returns the sink's
+/// log and `String(globalThis.__out)`.
+fn pump(source: &str, gone: bool) -> (Log, String) {
+    clear_global_initializers();
+    register_global_initializer(web_globals::add_to_global);
+    register_global_initializer(web_streams::add_to_global);
+    let rt = Runtime::init(&RuntimeConfig::default()).expect("runtime init");
+    let scope = rt.default_global();
+    let el = EventLoop::new();
+    let log = Rc::new(RefCell::new(Log::default()));
+    let code = format!(
+        r#"globalThis.__out = "not cancelled";
+        function cancel(reason) {{
+            globalThis.__out = reason instanceof TypeError
+                ? "TypeError: " + reason.message
+                : String(reason);
+        }}
+        {source}"#
+    );
+    with_event_loop(&el, |_| {
+        let value = js::compile::evaluate_with_filename(&scope, &code, "test.js", 1)
+            .expect("evaluating the source");
+        let stream = ReadableStream::from_jsval(&scope, value, ()).expect("a ReadableStream");
+        let reader = acquire_native_reader(&scope, &stream).expect("a reader");
+        let sink = TestSink {
+            log: Rc::clone(&log),
+            gone,
+        };
+        let batch = Bytes(Vec::new(), Rc::clone(&log));
+        let pump = NativePump::create(&scope, reader, sink, batch).expect("a pump");
+        scope
+            .global()
+            .set_property(&scope, c"__pump", pump.as_object())
+            .expect("keeping the pump alive");
+        pump.start(&scope);
+        run_microtasks(&scope);
+    });
+    let tokio = tokio::runtime::Builder::new_current_thread()
+        .enable_time()
+        .build()
+        .expect("a tokio runtime");
+    tokio.block_on(async {
+        let raw_cx = unsafe { scope.raw_cx_no_gc() };
+        unsafe { run_to_completion(raw_cx, &el, tokio::time::sleep).await }
+    });
+    run_microtasks(&scope);
+    let out = js::compile::evaluate_with_filename(&scope, "String(globalThis.__out)", "out.js", 1)
+        .expect("reading __out");
+    let out = String::from_jsval(&scope, out, ()).expect("a string");
+    let log = std::mem::take(&mut *log.borrow_mut());
+    (log, out)
+}
+
+#[test]
+fn a_batch_fills_up_and_the_rest_follows() {
+    let (log, out) = pump(
+        &format!(
+            r#"new ReadableStream({{
+            start(c) {{
+                for (let i = 0; i < 3; i++) c.enqueue(new Uint8Array({half}));
+                c.close();
+            }},
+            cancel,
+        }})"#,
+            half = PUMP_BATCH_BYTES / 2,
+        ),
+        false,
+    );
+    let lengths: Vec<usize> = log.writes.iter().map(Vec::len).collect();
+    assert_eq!(lengths, [PUMP_BATCH_BYTES, PUMP_BATCH_BYTES / 2]);
+    assert_eq!(log.ends, [PumpEnd::Closed]);
+    assert_eq!(out, "not cancelled");
+}
+
+#[test]
+fn nothing_after_a_chunk_rejected_by_check_is_written() {
+    // The third read waits, so the batch is checked and written while it is pending. Its chunk
+    // arrives during the write.
+    let (log, out) = pump(
+        r#"let pulled = false;
+        new ReadableStream({
+            start(c) {
+                c.enqueue(new Uint8Array([1]));
+                c.enqueue(new Uint8Array([255]));
+            },
+            pull(c) {
+                if (pulled) return;
+                pulled = true;
+                return Promise.resolve().then(() => c.enqueue(new Uint8Array([2])));
+            },
+            cancel,
+        })"#,
+        false,
+    );
+    assert_eq!(log.writes, [vec![1]]);
+    assert_eq!(log.ends, [PumpEnd::Failed("rejected 255".to_string())]);
+    assert_eq!(out, "TypeError: rejected 255");
+}
+
+#[test]
+fn a_finished_pump_releases_unsent_chunks() {
+    // The second chunk arrives while the first is being written. The write then finds that the
+    // receiver went away, which finishes the pump with the second chunk unsent.
+    let (log, out) = pump(
+        r#"let pulled = false;
+        new ReadableStream({
+            start(c) { c.enqueue(new Uint8Array([1])); },
+            pull(c) {
+                if (pulled) return;
+                pulled = true;
+                return Promise.resolve().then(() => c.enqueue(new Uint8Array([2])));
+            },
+            cancel,
+        })"#,
+        true,
+    );
+    assert!(log.writes.is_empty());
+    assert_eq!(log.dropped, [vec![1], vec![2]]);
+    assert_eq!(out, "TypeError: the stream's reader was dropped");
+}
diff --git a/crates/builtins/web-streams/tests/pipe_to.rs b/crates/builtins/web-streams/tests/pipe_to.rs
deleted file mode 100644
index c7707a02..00000000
--- a/crates/builtins/web-streams/tests/pipe_to.rs
+++ /dev/null
@@ -1,190 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0-WITH-LLVM-exception
-
-//! Keystone integration tests for `ReadableStream.prototype.pipeTo` and
-//! `pipeThrough`: chunks flow from a source to a destination, the result
-//! promise settles, `preventClose` leaves the destination open, source errors
-//! propagate forward (aborting the destination and rejecting the promise), and
-//! `pipeThrough` returns the transform's readable side. Covered far more
-//! thoroughly by `streams/piping/*.any.js`; this is the fast,
-//! design-validating (and GC-rooting-validating) smoke test.
-
-// This file contains nothing platform-specific, so skip it on wasm32.
-#![cfg(not(target_arch = "wasm32"))]
-
-use core_runtime::runtime::{clear_global_initializers, register_global_initializer};
-use core_runtime::test_util::eval_out_with_setup;
-
-fn run(code: &str) -> String {
-    eval_out_with_setup(
-        || {
-            clear_global_initializers();
-            register_global_initializer(web_globals::add_to_global);
-            register_global_initializer(web_streams::add_to_global);
-        },
-        code,
-    )
-}
-
-/// A WritableStream that records written chunks and whether it was closed.
-const RECORDING: &str = r#"
-    function recordingWritable() {
-        const written = [];
-        const state = { closed: false, aborted: false };
-        const ws = new WritableStream({
-            write(chunk) { written.push(chunk); },
-            close() { state.closed = true; },
-            abort(reason) { state.aborted = true; state.abortReason = reason; },
-        });
-        return { ws, written, state };
-    }
-"#;
-
-/// Every chunk flows from the source to the destination, the destination is
-/// closed, and the pipe promise fulfills.
-#[test]
-fn pipes_all_chunks_and_closes_dest() {
-    let out = run(&format!(
-        r#"{RECORDING}
-        globalThis.__out = "pending";
-        const {{ ws, written, state }} = recordingWritable();
-        const rs = new ReadableStream({{ start(c) {{ c.enqueue("a"); c.enqueue("b"); c.enqueue("c"); c.close(); }} }});
-        rs.pipeTo(ws).then(() => {{
-            globalThis.__out = written.join("") + "|closed:" + state.closed;
-        }}, e => {{ globalThis.__out = "rejected:" + e; }});
-        "#
-    ));
-    assert_eq!(out, "abc|closed:true");
-}
-
-/// With `preventClose: true`, the destination is left open after the source
-/// closes (the pipe promise still fulfills).
-#[test]
-fn prevent_close_leaves_dest_open() {
-    let out = run(&format!(
-        r#"{RECORDING}
-        globalThis.__out = "pending";
-        const {{ ws, written, state }} = recordingWritable();
-        const rs = new ReadableStream({{ start(c) {{ c.enqueue("x"); c.close(); }} }});
-        rs.pipeTo(ws, {{ preventClose: true }}).then(() => {{
-            globalThis.__out = written.join("") + "|closed:" + state.closed;
-        }}, e => {{ globalThis.__out = "rejected:" + e; }});
-        "#
-    ));
-    assert_eq!(out, "x|closed:false");
-}
-
-/// A source error propagates forward: the destination is aborted and the pipe
-/// promise rejects with the source's error.
-#[test]
-fn source_error_aborts_dest_and_rejects() {
-    let out = run(&format!(
-        r#"{RECORDING}
-        globalThis.__out = "pending";
-        const {{ ws, written, state }} = recordingWritable();
-        let ctrl;
-        const rs = new ReadableStream({{ start(c) {{ ctrl = c; }} }});
-        const p = rs.pipeTo(ws);
-        ctrl.error(new Error("boom"));
-        p.then(() => {{ globalThis.__out = "fulfilled"; }},
-               e => {{ globalThis.__out = "rejected:" + e.message + "|aborted:" + state.aborted; }});
-        "#
-    ));
-    assert_eq!(out, "rejected:boom|aborted:true");
-}
-
-/// `pipeThrough` returns the transform's readable side, and chunks piped into
-/// the writable side flow through (an identity transform) to it.
-#[test]
-fn pipe_through_identity_transform() {
-    let out = run(&format!(
-        r#"{RECORDING}
-        globalThis.__out = "pending";
-        async function drain(stream) {{
-            const reader = stream.getReader();
-            const acc = [];
-            for (;;) {{
-                const {{ value, done }} = await reader.read();
-                if (done) break;
-                acc.push(value);
-            }}
-            return acc.join("");
-        }}
-        const rs = new ReadableStream({{ start(c) {{ c.enqueue("p"); c.enqueue("q"); c.close(); }} }});
-        const ts = new TransformStream();
-        const readable = rs.pipeThrough(ts);
-        const isReadable = readable instanceof ReadableStream;
-        drain(readable).then(s => {{ globalThis.__out = s + "|" + isReadable; }});
-        "#
-    ));
-    assert_eq!(out, "pq|true");
-}
-
-/// Aborting the pipe's signal mid-flight rejects the pipe promise with the abort
-/// reason, cancels the source, and aborts the destination. This exercises the
-/// abort algorithm, the wait-for-all composite action, and the deferred-shutdown
-/// state slots — the most allocation-heavy path, validated under compacting GC.
-#[test]
-fn abort_signal_rejects_and_cancels_both_sides() {
-    let out = run(&format!(
-        r#"{RECORDING}
-        globalThis.__out = "pending";
-        const {{ ws, written, state }} = recordingWritable();
-        const ac = new AbortController();
-        let cancelled = false;
-        const rs = new ReadableStream({{
-            start(c) {{ c.enqueue("a"); }},
-            cancel() {{ cancelled = true; }},
-        }});
-        const p = rs.pipeTo(ws, {{ signal: ac.signal }});
-        ac.abort(new Error("stop"));
-        p.then(() => {{ globalThis.__out = "fulfilled"; }},
-               e => {{ globalThis.__out = "rejected:" + e.message + "|cancelled:" + cancelled + "|aborted:" + state.aborted; }});
-        "#
-    ));
-    assert_eq!(out, "rejected:stop|cancelled:true|aborted:true");
-}
-
-/// pipeTo's abort handling is a DOM abort algorithm, not an `abort` event
-/// listener: an author `abort` listener registered earlier that calls
-/// `stopImmediatePropagation()` must not suppress the pipe's shutdown. The pipe
-/// still rejects with the abort reason.
-#[test]
-fn abort_signal_not_suppressed_by_stop_immediate_propagation() {
-    let out = run(&format!(
-        r#"{RECORDING}
-        globalThis.__out = "pending";
-        const {{ ws, state }} = recordingWritable();
-        const ac = new AbortController();
-        ac.signal.addEventListener("abort", (e) => {{ e.stopImmediatePropagation(); }});
-        const rs = new ReadableStream({{ start(c) {{ c.enqueue("a"); }} }});
-        const p = rs.pipeTo(ws, {{ signal: ac.signal }});
-        ac.abort(new Error("stop"));
-        p.then(() => {{ globalThis.__out = "fulfilled"; }},
-               e => {{ globalThis.__out = "rejected:" + e.message + "|aborted:" + state.aborted; }});
-        "#
-    ));
-    assert_eq!(out, "rejected:stop|aborted:true");
-}
-
-/// Aborting a pipe runs author code synchronously: the destination controller's
-/// `signal` listeners. A listener that enqueues into the source re-enters the
-/// pipe's pending read request, which must not find the pipe state borrowed.
-#[test]
-fn abort_listener_enqueueing_into_source_does_not_panic() {
-    let out = run(r#"
-        globalThis.__out = "pending";
-        let sourceController;
-        const rs = new ReadableStream({ start(c) { sourceController = c; } });
-        const ws = new WritableStream({
-            start(c) {
-                c.signal.addEventListener("abort", () => sourceController.enqueue("late"));
-            },
-        });
-        const ac = new AbortController();
-        const p = rs.pipeTo(ws, { signal: ac.signal });
-        Promise.resolve().then(() => ac.abort(new Error("stop")));
-        p.then(() => { globalThis.__out = "fulfilled"; },
-               e => { globalThis.__out = "rejected:" + e.message; });
-        "#);
-    assert_eq!(out, "rejected:stop");
-}
diff --git a/crates/builtins/web-streams/tests/readable_byob.rs b/crates/builtins/web-streams/tests/readable_byob.rs
deleted file mode 100644
index 14debebd..00000000
--- a/crates/builtins/web-streams/tests/readable_byob.rs
+++ /dev/null
@@ -1,346 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0-WITH-LLVM-exception
-
-//! Keystone integration tests for the BYOB reader / read-into path: pull-into
-//! descriptors, `byobRequest.respond` / `respondWithNewView`, and
-//! `autoAllocateChunkSize`.
-//!
-//! These exercise the parts the M2 design rests on: a `read(view)` transfers the
-//! caller's buffer into a pull-into descriptor, the source fills it through
-//! `byobRequest.view` and commits with `respond`, and the filled region comes
-//! back as a view of the requested type. Auto-allocation routes a default
-//! `read()` through the same machinery. They run JS, drain microtasks, and read
-//! back a result stashed on `globalThis`.
-//!
-//! WPT `streams/readable-byte-streams/*` covers this far more thoroughly; this is
-//! the fast, design-validating smoke test (and the GC-rooting keystone under
-//! zeal, since pull-into transfers buffers and creates views).
-
-// This file contains nothing platform-specific, so skip it on wasm32.
-#![cfg(not(target_arch = "wasm32"))]
-
-use core_runtime::runtime::{clear_global_initializers, register_global_initializer};
-use core_runtime::test_util::eval_out_with_setup;
-
-/// Evaluate `code`, drain microtasks, and return `String(globalThis.__out)`.
-fn run(code: &str) -> String {
-    eval_out_with_setup(
-        || {
-            clear_global_initializers();
-            register_global_initializer(web_streams::add_to_global);
-        },
-        code,
-    )
-}
-
-/// A BYOB `read(view)`: the source fills the provided view through
-/// `byobRequest.view` and commits with `respond`, and the filled region is
-/// returned as a `Uint8Array`. Exercises the pull-into descriptor, buffer
-/// transfer, and `ReadableByteStreamControllerRespond`.
-#[test]
-fn byob_read_respond() {
-    let out = run(r#"
-        globalThis.__out = "pending";
-        const rs = new ReadableStream({
-            type: "bytes",
-            pull(c) {
-                const v = c.byobRequest.view;
-                v[0] = 11; v[1] = 22; v[2] = 33;
-                c.byobRequest.respond(3);
-            },
-        });
-        rs.getReader({ mode: "byob" }).read(new Uint8Array(3)).then(r => {
-            globalThis.__out = `${r.value.constructor.name},${Array.from(r.value).join("-")},${r.done}`;
-        });
-        "#);
-    assert_eq!(out, "Uint8Array,11-22-33,false");
-}
-
-/// `respondWithNewView`: the source writes into a fresh view over the request's
-/// buffer region and commits it. Exercises
-/// `ReadableByteStreamControllerRespondWithNewView`.
-#[test]
-fn byob_respond_with_new_view() {
-    let out = run(r#"
-        globalThis.__out = "pending";
-        const rs = new ReadableStream({
-            type: "bytes",
-            pull(c) {
-                const req = c.byobRequest;
-                const nv = new Uint8Array(req.view.buffer, req.view.byteOffset, 2);
-                nv[0] = 99; nv[1] = 88;
-                req.respondWithNewView(nv);
-            },
-        });
-        rs.getReader({ mode: "byob" }).read(new Uint8Array(4)).then(r => {
-            globalThis.__out = `${Array.from(r.value).join("-")},len=${r.value.length}`;
-        });
-        "#);
-    assert_eq!(out, "99-88,len=2");
-}
-
-/// `autoAllocateChunkSize`: a default `read()` on a byte stream routes through a
-/// pull-into descriptor with an auto-allocated buffer; the source fills it via
-/// `byobRequest` and the bytes come back as a `Uint8Array`. Exercises PullSteps
-/// step 5 and the read-into-to-default-reader commit.
-#[test]
-fn auto_allocate_default_read() {
-    let out = run(r#"
-        globalThis.__out = "pending";
-        const rs = new ReadableStream({
-            type: "bytes",
-            autoAllocateChunkSize: 16,
-            pull(c) {
-                const v = c.byobRequest.view;
-                v[0] = 7; v[1] = 8;
-                c.byobRequest.respond(2);
-            },
-        });
-        rs.getReader().read().then(r => {
-            globalThis.__out = `${r.value.constructor.name},len=${r.value.length},${r.value[0]}-${r.value[1]}`;
-        });
-        "#);
-    assert_eq!(out, "Uint8Array,len=2,7-8");
-}
-
-/// A typed-array view with `min` honours the element alignment: a `read(view, {
-/// min })` on a `Uint16Array` is fulfilled only once at least `min` elements are
-/// available. Here the source supplies exactly the requested bytes.
-#[test]
-fn byob_read_typed_array_min() {
-    let out = run(r#"
-        globalThis.__out = "pending";
-        const rs = new ReadableStream({
-            type: "bytes",
-            pull(c) {
-                const v = c.byobRequest.view;
-                for (let i = 0; i < v.byteLength; i++) v[i] = i + 1;
-                c.byobRequest.respond(v.byteLength);
-            },
-        });
-        rs.getReader({ mode: "byob" }).read(new Uint16Array(2), { min: 2 }).then(r => {
-            globalThis.__out = `${r.value.constructor.name},len=${r.value.length},${r.value[0]}`;
-        });
-        "#);
-    // Bytes 1,2,3,4 little-endian -> u16 [0x0201, 0x0403] = [513, 1027].
-    assert_eq!(out, "Uint16Array,len=2,513");
-}
-
-/// A BYOB `read()` with no view argument rejects (it does not throw
-/// synchronously): a promise-returning WebIDL operation surfaces an
-/// argument-conversion failure as a rejected promise. This drives the macro's
-/// `ResultPromise` rejection branch (`new_rejected_with_pending_error` with a
-/// live pending exception), so under GC zeal it exercises that path directly.
-#[test]
-fn byob_read_without_view_rejects() {
-    let out = run(r#"
-        globalThis.__out = "pending";
-        const reader = new ReadableStream({ type: "bytes" }).getReader({ mode: "byob" });
-        let threw = false;
-        let p;
-        try { p = reader.read(); } catch (e) { threw = true; }
-        Promise.resolve(p).then(
-            () => { globalThis.__out = `threw=${threw},resolved`; },
-            e => { globalThis.__out = `threw=${threw},rejected:${e.constructor.name}`; },
-        );
-        "#);
-    assert_eq!(out, "threw=false,rejected:TypeError");
-}
-
-/// Teeing a byte stream and reading both branches: `ReadableByteStreamTee`
-/// acquires a default reader, clones each chunk's buffer for the second branch,
-/// and pushes into both branches' byte controllers. This is the
-/// allocation-heavy native-callback + GC-traced-state-object path; the buffer
-/// clone and the dual enqueue make it the byte-tee GC-rooting keystone.
-#[test]
-fn byte_tee_reads_both_branches() {
-    let out = run(r#"
-        globalThis.__out = "pending";
-        const rs = new ReadableStream({
-            type: "bytes",
-            start(c) { c.enqueue(new Uint8Array([5, 6, 7])); },
-        });
-        const [a, b] = rs.tee();
-        Promise.all([a.getReader().read(), b.getReader().read()]).then(([ra, rb]) => {
-            globalThis.__out =
-                `${Array.from(ra.value).join("-")}|${Array.from(rb.value).join("-")}|` +
-                `${ra.value.buffer !== rb.value.buffer}`;
-        });
-        "#);
-    // Both branches see the same bytes, but over distinct (cloned) buffers.
-    assert_eq!(out, "5-6-7|5-6-7|true");
-}
-
-/// Three un-awaited BYOB reads leave three pending pull-into descriptors; a
-/// single `enqueue` fills the head while the other two are still queued. The
-/// fill loop calls `ReadableByteStreamControllerFillHeadPullIntoDescriptor`
-/// after popping the head into a stack local, so the descriptor deque still
-/// holds the two trailing descriptors at that point — a regression test that
-/// fill_head does not assume at most one pending pull-into remains.
-#[test]
-fn byob_multiple_pending_reads_then_enqueue() {
-    let out = run(r#"
-        globalThis.__out = "pending";
-        let controller;
-        const rs = new ReadableStream({
-            type: "bytes",
-            start(c) { controller = c; },
-        });
-        const reader = rs.getReader({ mode: "byob" });
-        const p1 = reader.read(new Uint8Array(10));
-        reader.read(new Uint8Array(10));
-        reader.read(new Uint8Array(10));
-        controller.enqueue(new Uint8Array([1, 2, 3, 4, 5, 6, 7, 8, 9, 10]));
-        p1.then(r => {
-            globalThis.__out = `${r.value.constructor.name},len=${r.value.length},${r.value[0]}-${r.value[9]}`;
-        });
-        "#);
-    // The first read is fulfilled with all 10 bytes; the other two stay pending.
-    assert_eq!(out, "Uint8Array,len=10,1-10");
-}
-
-/// A `Float16Array` BYOB view round-trips with its element kind intact: the
-/// committed chunk comes back as a `Float16Array` (element size 2), not a
-/// `DataView`, and the `min` option is validated against the view's element
-/// length rather than its byte length.
-#[test]
-fn byob_read_float16_view_kind() {
-    let out = run(r#"
-        globalThis.__out = "pending";
-        if (typeof Float16Array === "undefined") {
-            globalThis.__out = "no-float16";
-        } else {
-            const rs = new ReadableStream({
-                type: "bytes",
-                pull(c) {
-                    const v = c.byobRequest.view;
-                    c.byobRequest.respond(v.byteLength);
-                },
-            });
-            // `min` of 3 exceeds the 2-element view; the spec validates against the
-            // element length, so this rejects with a RangeError before any pull.
-            rs.getReader({ mode: "byob" }).read(new Float16Array(2), { min: 3 }).then(
-                r => { globalThis.__out = `resolved:${r.value.constructor.name}`; },
-                e => { globalThis.__out = `rejected:${e.constructor.name}`; },
-            );
-        }
-        "#);
-    assert_eq!(out, "rejected:RangeError");
-}
-
-/// Teeing a byte stream and doing a multi-byte-element BYOB read on a branch can
-/// leave that branch's pending pull-into partially filled (e.g. 3 of 4 bytes for
-/// an `Int32Array`). If the source then closes, the branch's
-/// `ReadableByteStreamControllerClose` hits its "insufficient bytes" `TypeError`.
-/// The spec marks that close `!` (infallible), but the partial fill makes it
-/// reachable, so the branch read must reject with a `TypeError` rather than
-/// aborting the runtime.
-#[test]
-fn byte_tee_branch_partial_fill_close_rejects_not_aborts() {
-    let out = run(r#"
-        globalThis.__out = "pending";
-        let step = 0;
-        const rs = new ReadableStream({
-            type: "bytes",
-            pull(c) {
-                if (step === 0) {
-                    step = 1;
-                    const v = c.byobRequest.view;
-                    v[0] = 1; v[1] = 2; v[2] = 3;
-                    c.byobRequest.respond(3); // 3 of 4 bytes -> branch partial fill
-                } else {
-                    c.close();
-                    c.byobRequest.respond(0);
-                }
-            },
-        });
-        const [b1, b2] = rs.tee();
-        // Draining branch2 to completion discriminates the clean error path from
-        // the (dev-mode-masked) abort: branch2 receives the 3-byte clone, then its
-        // next read must reject (the source closed and the misaligned branch1 close
-        // errored the tee). Aborting at branch1's close instead leaves branch2
-        // unclosed, so that second read would hang forever.
-        async function drainB2() {
-            const r = b2.getReader();
-            let n = 0;
-            try {
-                for (;;) {
-                    const { done } = await r.read();
-                    if (done) return "b2:done@" + n;
-                    n++;
-                }
-            } catch (e) { return "b2:" + e.constructor.name + "@" + n; }
-        }
-        const r1 = b1.getReader({ mode: "byob" }).read(new Int32Array(1)).then(
-            () => "b1:resolved", e => "b1:" + e.constructor.name);
-        Promise.all([r1, drainB2()]).then(([a, b]) => { globalThis.__out = a + "," + b; });
-        "#);
-    assert_eq!(out, "b1:TypeError,b2:TypeError@1");
-}
-
-/// Reading a byte stream's BYOB reader after `close()` resolves with an empty
-/// view and `done: true`.
-#[test]
-fn byob_read_after_close_is_done() {
-    let out = run(r#"
-        globalThis.__out = "pending";
-        const rs = new ReadableStream({
-            type: "bytes",
-            start(c) { c.close(); },
-        });
-        rs.getReader({ mode: "byob" }).read(new Uint8Array(8)).then(r => {
-            globalThis.__out = `${r.value.constructor.name},len=${r.value.length},${r.done}`;
-        });
-        "#);
-    assert_eq!(out, "Uint8Array,len=0,true");
-}
-
-/// `respond(bytesWritten)` is `[EnforceRange] unsigned long long`: a negative
-/// argument throws a `TypeError` at argument conversion, not a `RangeError` from
-/// the length checks (which is what a wrapping conversion produces).
-#[test]
-fn respond_enforce_range_rejects_negative() {
-    let out = run(r#"
-        globalThis.__out = "pending";
-        const rs = new ReadableStream({
-            type: "bytes",
-            pull(c) {
-                try { c.byobRequest.respond(-1); globalThis.__out = "no-throw"; }
-                catch (e) { globalThis.__out = "respond:" + e.constructor.name; }
-            },
-        });
-        rs.getReader({ mode: "byob" }).read(new Uint8Array(4));
-        "#);
-    assert_eq!(out, "respond:TypeError");
-}
-
-/// WebIDL converts arguments left to right: `read(view, options)` must coerce
-/// `view` to an `ArrayBufferView` (rejecting a non-view with a `TypeError`) before
-/// the `options` dictionary is converted, so an author getter on `options.min` is
-/// never invoked when the view is invalid.
-#[test]
-fn byob_read_validates_view_before_options() {
-    let out = run(r#"
-        globalThis.__out = "pending";
-        let getterRan = false;
-        const reader = new ReadableStream({ type: "bytes" }).getReader({ mode: "byob" });
-        reader.read(42, { get min() { getterRan = true; throw new Error("boom"); } }).then(
-            () => { globalThis.__out = "resolved"; },
-            e => { globalThis.__out = `rejected:${e.constructor.name}|getterRan:${getterRan}`; },
-        );
-        "#);
-    assert_eq!(out, "rejected:TypeError|getterRan:false");
-}
-
-/// `autoAllocateChunkSize` is `[EnforceRange] unsigned long long`: a negative
-/// value throws a `TypeError` at construction, rather than wrapping to a huge
-/// positive value and constructing successfully.
-#[test]
-fn auto_allocate_chunk_size_enforce_range() {
-    let out = run(r#"
-        let r;
-        try { new ReadableStream({ type: "bytes", autoAllocateChunkSize: -1 }); r = "no-throw"; }
-        catch (e) { r = e.constructor.name; }
-        globalThis.__out = r;
-        "#);
-    assert_eq!(out, "TypeError");
-}
diff --git a/crates/builtins/web-streams/tests/readable_byte.rs b/crates/builtins/web-streams/tests/readable_byte.rs
deleted file mode 100644
index a73fb70d..00000000
--- a/crates/builtins/web-streams/tests/readable_byte.rs
+++ /dev/null
@@ -1,180 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0-WITH-LLVM-exception
-
-//! Keystone integration tests for the readable byte stream path (default
-//! reader, no auto-allocation).
-//!
-//! These validate the parts the byte controller's design rests on, on a
-//! minimal end-to-end slice: the queue of `ArrayBuffer`-backed entries, buffer
-//! transfer on `enqueue`, constructing a `Uint8Array` view over a transferred
-//! region, the byte controller's own start/pull reactions, and the
-//! default-reader `[[PullSteps]]` dispatch. They run JS, drain the microtask
-//! queue, and read back a result stashed on `globalThis`.
-//!
-//! Behaviour here is covered far more thoroughly by the
-//! `streams/readable-byte-streams` WPT suites; this is the fast,
-//! design-validating smoke test (and the GC-rooting keystone under zeal).
-
-// This file contains nothing platform-specific, so skip it on wasm32.
-#![cfg(not(target_arch = "wasm32"))]
-
-use core_runtime::runtime::{clear_global_initializers, register_global_initializer};
-use core_runtime::test_util::eval_out_with_setup;
-
-/// Evaluate `code`, drain microtasks, and return `String(globalThis.__out)`.
-fn run(code: &str) -> String {
-    eval_out_with_setup(
-        || {
-            clear_global_initializers();
-            register_global_initializer(web_streams::add_to_global);
-        },
-        code,
-    )
-}
-
-/// A byte chunk enqueued during `start` is queued, then delivered to a `read()`
-/// as a fresh `Uint8Array` over the transferred buffer. Exercises the queue,
-/// `TransferArrayBuffer`, the `Uint8Array`-over-region construction, and
-/// `FillReadRequestFromQueue`.
-#[test]
-fn enqueue_in_start_then_read() {
-    let out = run(r#"
-        globalThis.__out = "pending";
-        const rs = new ReadableStream({
-            type: "bytes",
-            start(c) { c.enqueue(new Uint8Array([1, 2, 3])); },
-        });
-        rs.getReader().read().then(r => {
-            globalThis.__out = `${r.value.constructor.name},${Array.from(r.value).join("-")},${r.done}`;
-        });
-        "#);
-    assert_eq!(out, "Uint8Array,1-2-3,false");
-}
-
-/// A `pull`-driven byte source: the read request is queued first, then
-/// satisfied once `start` settles and `CallPullIfNeeded` invokes `pull` (which
-/// enqueues directly into the waiting read request). Exercises the byte pull
-/// reaction and `ProcessReadRequestsUsingQueue`/fulfill-via-`Construct`.
-#[test]
-fn pull_driven_byte_read() {
-    let out = run(r#"
-        globalThis.__out = "pending";
-        let pulls = 0;
-        const rs = new ReadableStream({
-            type: "bytes",
-            pull(c) { pulls++; c.enqueue(new Uint8Array([42])); },
-        });
-        rs.getReader().read().then(r => {
-            globalThis.__out = `${Array.from(r.value).join("-")},pulls=${pulls}`;
-        });
-        "#);
-    assert_eq!(out, "42,pulls=1");
-}
-
-/// Closing after enqueuing drains the queue before delivering `done`. The first
-/// read gets the chunk; the second sees the close.
-#[test]
-fn enqueue_then_close_drains_then_done() {
-    let out = run(r#"
-        globalThis.__out = "pending";
-        const rs = new ReadableStream({
-            type: "bytes",
-            start(c) { c.enqueue(new Uint8Array([9])); c.close(); },
-        });
-        const reader = rs.getReader();
-        reader.read().then(r1 => {
-            const first = `${Array.from(r1.value).join("-")},${r1.done}`;
-            reader.read().then(r2 => {
-                globalThis.__out = `${first}|${r2.value},${r2.done}`;
-            });
-        });
-        "#);
-    assert_eq!(out, "9,false|undefined,true");
-}
-
-/// `cancel()` runs the underlying byte source's cancel algorithm with the
-/// reason, exercising the byte controller's `[[CancelSteps]]`.
-#[test]
-fn cancel_runs_byte_cancel_steps() {
-    let out = run(r#"
-        globalThis.__out = "pending";
-        let reason = null;
-        const rs = new ReadableStream({ type: "bytes", cancel(r) { reason = r; } });
-        rs.cancel("stop").then(() => { globalThis.__out = `cancelled:${reason}`; });
-        "#);
-    assert_eq!(out, "cancelled:stop");
-}
-
-/// `desiredSize` reflects the strategy high-water mark minus the queued bytes,
-/// and `byobRequest` is null with no pending pull-into. Exercises the two
-/// getters and `GetDesiredSize`.
-#[test]
-fn desired_size_and_byob_request_getters() {
-    let out = run(r#"
-        let ds0, dsAfter, br;
-        const rs = new ReadableStream({
-            type: "bytes",
-            start(c) {
-                ds0 = c.desiredSize;
-                c.enqueue(new Uint8Array([1, 2, 3, 4]));
-                dsAfter = c.desiredSize;
-                br = c.byobRequest;
-            },
-        }, { highWaterMark: 10 });
-        globalThis.__out = `${ds0},${dsAfter},${br}`;
-        "#);
-    assert_eq!(out, "10,6,null");
-}
-
-/// Enqueuing a zero-length view or a non-`ArrayBufferView` throws a
-/// `TypeError`; a byte source with a positive `autoAllocateChunkSize`
-/// constructs fine, while `autoAllocateChunkSize: 0` throws a `TypeError`.
-#[test]
-fn enqueue_validation_and_auto_allocate() {
-    let out = run(r#"
-        let zeroThrew = false, nonViewThrew = false, auto16Ok = false, auto0Threw = false;
-        const rs = new ReadableStream({
-            type: "bytes",
-            start(c) {
-                try { c.enqueue(new Uint8Array(0)); } catch (e) { zeroThrew = e instanceof TypeError; }
-                try { c.enqueue([1]); } catch (e) { nonViewThrew = e instanceof TypeError; }
-            },
-        });
-        try { new ReadableStream({ type: "bytes", autoAllocateChunkSize: 16 }); auto16Ok = true; }
-        catch (e) {}
-        try { new ReadableStream({ type: "bytes", autoAllocateChunkSize: 0 }); }
-        catch (e) { auto0Threw = e instanceof TypeError; }
-        globalThis.__out = `${zeroThrew},${nonViewThrew},${auto16Ok},${auto0Threw}`;
-        "#);
-    assert_eq!(out, "true,true,true,true");
-}
-
-/// For a byte stream, a *callable* `size` is rejected with a `RangeError` (a
-/// byte stream's strategy must not have a size function), but a *non-callable*
-/// `size` is rejected earlier with a `TypeError` — the `QueuingStrategySize`
-/// callback conversion fails before the byte-stream RangeError. Not covered by
-/// the enabled WPT (`general.any.js` only exercises callable size functions).
-#[test]
-fn byte_stream_size_function_error_ordering() {
-    let out = run(r#"
-        let callableErr = "none", nonCallableErr = "none";
-        try { new ReadableStream({ type: "bytes" }, { size() { return 1; } }); }
-        catch (e) { callableErr = e.constructor.name; }
-        try { new ReadableStream({ type: "bytes" }, { size: {} }); }
-        catch (e) { nonCallableErr = e.constructor.name; }
-        globalThis.__out = `${callableErr},${nonCallableErr}`;
-        "#);
-    assert_eq!(out, "RangeError,TypeError");
-}
-
-/// A non-callable underlying-source callback throws a `TypeError` at dictionary
-/// conversion, before the byte-stream + size-function `RangeError`.
-#[test]
-fn non_callable_callback_throws_type_error_before_byte_size_check() {
-    let out = run(r#"
-        let err = "none";
-        try { new ReadableStream({ pull: {}, type: "bytes" }, { size: () => 1 }); err = "no-throw"; }
-        catch (e) { err = e.constructor.name; }
-        globalThis.__out = err;
-        "#);
-    assert_eq!(out, "TypeError");
-}
diff --git a/crates/builtins/web-streams/tests/readable_default.rs b/crates/builtins/web-streams/tests/readable_default.rs
deleted file mode 100644
index 8b5e4d30..00000000
--- a/crates/builtins/web-streams/tests/readable_default.rs
+++ /dev/null
@@ -1,182 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0-WITH-LLVM-exception
-
-//! Keystone integration tests for the readable default path.
-//!
-//! These validate the three things the implementation's design rests on, on a
-//! minimal end-to-end slice: native promise reactions created via
-//! `Function::new_callback` (the start/pull reactions), the `this`-binding of
-//! the underlying source's start/pull callbacks, and read-request promise
-//! resolution. They run JS, drain the microtask queue, and read back a result
-//! stashed on `globalThis`.
-//!
-//! Behaviour here is covered far more thoroughly by the `streams/readable-streams`
-//! WPT suites; this is the fast, design-validating smoke test.
-
-// This file contains nothing platform-specific, so skip it on wasm32.
-#![cfg(not(target_arch = "wasm32"))]
-
-use core_runtime::runtime::{clear_global_initializers, register_global_initializer};
-use core_runtime::test_util::eval_out_with_setup;
-
-/// Evaluate `code`, drain microtasks, and return `String(globalThis.__out)`.
-fn run(code: &str) -> String {
-    eval_out_with_setup(
-        || {
-            clear_global_initializers();
-            register_global_initializer(web_streams::add_to_global);
-        },
-        code,
-    )
-}
-
-/// Bound functions are accepted as WebIDL callback-type members: a bound `pull`
-/// and a bound queuing-strategy `size` are both `IsCallable` even though a bound
-/// function is not a `JSFunction`. The dictionary conversion must not reject
-/// them, and they must be invoked with their bound `this`.
-#[test]
-fn bound_function_callbacks() {
-    let out = run(r#"
-        globalThis.__out = "pending";
-        let sizeCalledWith = null;
-        // `start` enqueues before any reader exists, so the chunk goes through the
-        // queue and the strategy `size` is actually invoked (an enqueue that
-        // satisfies a pending read bypasses `size`).
-        const src = { first: 7, start(c) { c.enqueue(this.first); } };
-        const strat = {
-            factor: 3,
-            size(chunk) { sizeCalledWith = chunk; return chunk * this.factor; },
-        };
-        const rs = new ReadableStream(
-            { start: src.start.bind(src) },
-            { size: strat.size.bind(strat), highWaterMark: 100 },
-        );
-        rs.getReader().read().then(r => {
-            globalThis.__out = `${r.value},${r.done},size=${sizeCalledWith}`;
-        });
-        "#);
-    // Bound `start` enqueues this.first (7); bound `size` is invoked with that chunk.
-    assert_eq!(out, "7,false,size=7");
-}
-
-/// A promise-returning operation invoked with a wrong-`this` (the prototype, or
-/// `undefined`) must *reject* with a `TypeError`, not throw synchronously —
-/// WebIDL §3.7.7. This drives the macro's `ResultPromise` brand-check reject
-/// branch (a rejected promise created from the pending brand-check exception), a
-/// distinct path from the argument-error reject branch; under GC zeal it
-/// exercises that branch directly.
-#[test]
-fn cancel_with_wrong_this_rejects() {
-    let out = run(r#"
-        globalThis.__out = "pending";
-        let threw = false;
-        let p;
-        try { p = ReadableStream.prototype.cancel.call(undefined); }
-        catch (e) { threw = true; }
-        Promise.resolve(p).then(
-            () => { globalThis.__out = `threw=${threw},resolved`; },
-            e => { globalThis.__out = `threw=${threw},rejected:${e.constructor.name}`; },
-        );
-        "#);
-    assert_eq!(out, "threw=false,rejected:TypeError");
-}
-
-/// A promise-typed attribute getter (`closed`) invoked with a wrong-`this`
-/// rejects with a `TypeError`, not throws — WebIDL §3.7.7 ("Attributes"). This
-/// drives the accessor trampoline's promise-getter reject branch, distinct from
-/// the operation path; under GC zeal it exercises that branch directly.
-#[test]
-fn closed_getter_with_wrong_this_rejects() {
-    let out = run(r#"
-        globalThis.__out = "pending";
-        const getter = Object.getOwnPropertyDescriptor(
-            ReadableStreamDefaultReader.prototype, "closed").get;
-        let threw = false;
-        let p;
-        try { p = getter.call(undefined); } catch (e) { threw = true; }
-        Promise.resolve(p).then(
-            () => { globalThis.__out = `threw=${threw},resolved`; },
-            e => { globalThis.__out = `threw=${threw},rejected:${e.constructor.name}`; },
-        );
-        "#);
-    assert_eq!(out, "threw=false,rejected:TypeError");
-}
-
-/// A chunk enqueued during `start` is delivered to a `read()`, exercising the
-/// start reaction (native `new_callback`), the `start` callback's `this`
-/// binding, and read-request resolution.
-#[test]
-fn start_enqueue_then_read() {
-    let out = run(r#"
-        globalThis.__out = "pending";
-        const rs = new ReadableStream({ start(c) { c.enqueue("hello"); } });
-        const reader = rs.getReader();
-        reader.read().then(r => { globalThis.__out = `${r.value},${r.done}`; });
-        "#);
-    assert_eq!(out, "hello,false");
-}
-
-/// A `pull`-driven source: the read request is queued first, then satisfied
-/// once `start` settles and `CallPullIfNeeded` invokes `pull` (which enqueues
-/// and closes). Exercises the pull reaction and the `pull` callback's `this`.
-#[test]
-fn pull_then_read_and_close() {
-    let out = run(r#"
-        globalThis.__out = "pending";
-        const rs = new ReadableStream({
-            pull(c) { c.enqueue("p"); c.close(); },
-        });
-        const reader = rs.getReader();
-        reader.read().then(r => { globalThis.__out = `${r.value},${r.done}`; });
-        "#);
-    assert_eq!(out, "p,false");
-}
-
-/// Reading a closed stream resolves with `{ value: undefined, done: true }`.
-#[test]
-fn read_after_close_is_done() {
-    let out = run(r#"
-        globalThis.__out = "pending";
-        const rs = new ReadableStream({ start(c) { c.close(); } });
-        rs.getReader().read().then(r => { globalThis.__out = `${r.value},${r.done}`; });
-        "#);
-    assert_eq!(out, "undefined,true");
-}
-
-/// `locked` reflects reader acquisition, and a second `getReader` throws.
-#[test]
-fn locked_and_double_get_reader() {
-    let out = run(r#"
-        const rs = new ReadableStream();
-        const before = rs.locked;
-        rs.getReader();
-        const after = rs.locked;
-        let threw = false;
-        try { rs.getReader(); } catch (e) { threw = e instanceof TypeError; }
-        globalThis.__out = `${before},${after},${threw}`;
-        "#);
-    assert_eq!(out, "false,true,true");
-}
-
-/// A `read()` result is an ordinary object with *own* `value`/`done` data
-/// properties (the spec's `CreateIterResultObject`), so a hostile accessor
-/// installed on `Object.prototype` cannot intercept or replace them. Building the
-/// result with `[[Set]]` would walk the prototype chain and let the accessor
-/// observe the chunk and prevent the own property from being created.
-#[test]
-fn read_result_has_own_properties_immune_to_proto_accessor() {
-    let out = run(r#"
-        globalThis.__out = "pending";
-        let leaked = "none";
-        Object.defineProperty(Object.prototype, "value", {
-            configurable: true,
-            get() { return "HIJACKED"; },
-            set(v) { leaked = v; },
-        });
-        const rs = new ReadableStream({ start(c) { c.enqueue(42); } });
-        rs.getReader().read().then(r => {
-            globalThis.__out =
-                `own=${Object.hasOwn(r, "value")},value=${r.value},leaked=${leaked}`;
-        });
-        "#);
-    assert_eq!(out, "own=true,value=42,leaked=none");
-}
diff --git a/crates/builtins/web-streams/tests/stream_from.rs b/crates/builtins/web-streams/tests/stream_from.rs
deleted file mode 100644
index 123cb5bf..00000000
--- a/crates/builtins/web-streams/tests/stream_from.rs
+++ /dev/null
@@ -1,111 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0-WITH-LLVM-exception
-
-//! Keystone integration tests for `ReadableStream.from`: a sync iterable (array)
-//! and an async iterable (async generator) both stream their values, and the
-//! returned stream's cancel calls the iterator's `return`. Covered far more
-//! thoroughly by `streams/readable-streams/from.any.js`; this is the fast,
-//! design-validating (and GC-rooting-validating) smoke test for the native
-//! iterator-record callbacks.
-
-// This file contains nothing platform-specific, so skip it on wasm32.
-#![cfg(not(target_arch = "wasm32"))]
-
-use core_runtime::runtime::{clear_global_initializers, register_global_initializer};
-use core_runtime::test_util::eval_out_with_setup;
-
-fn run(code: &str) -> String {
-    eval_out_with_setup(
-        || {
-            clear_global_initializers();
-            register_global_initializer(web_streams::add_to_global);
-        },
-        code,
-    )
-}
-
-const DRAIN: &str = r#"
-    async function drain(stream) {
-        const reader = stream.getReader();
-        const out = [];
-        for (;;) {
-            const { value, done } = await reader.read();
-            if (done) break;
-            out.push(value);
-        }
-        return out.join("");
-    }
-"#;
-
-/// A sync iterable (array) streams its values via the async-from-sync wrapper.
-#[test]
-fn from_sync_array_streams_values() {
-    let out = run(&format!(
-        r#"{DRAIN}
-        globalThis.__out = "pending";
-        const rs = ReadableStream.from(["a", "b", "c"]);
-        drain(rs).then(s => {{ globalThis.__out = s; }});
-        "#
-    ));
-    assert_eq!(out, "abc");
-}
-
-/// An async iterable (async generator) streams its values.
-#[test]
-fn from_async_generator_streams_values() {
-    let out = run(&format!(
-        r#"{DRAIN}
-        globalThis.__out = "pending";
-        async function* gen() {{ yield "x"; yield "y"; yield "z"; }}
-        const rs = ReadableStream.from(gen());
-        drain(rs).then(s => {{ globalThis.__out = s; }});
-        "#
-    ));
-    assert_eq!(out, "xyz");
-}
-
-/// A sync iterable that yields a rejected promise: the async-from-sync wrapper
-/// adopts the rejection and closes the sync iterator (running its `return` /
-/// `finally`) before the stream errors, per AsyncFromSyncIteratorContinuation
-/// with closeOnRejection = true.
-#[test]
-fn from_sync_rejected_value_closes_iterator() {
-    let out = run(r#"
-        globalThis.__out = "pending";
-        let cleaned = false;
-        const it = (function* () {
-            try { yield Promise.reject(new TypeError("boom")); }
-            finally { cleaned = true; }
-        })();
-        ReadableStream.from(it).getReader().read().then(
-            () => { globalThis.__out = "resolved"; },
-            e => { globalThis.__out = `rejected:${e.constructor.name}:${e.message}|cleaned:${cleaned}`; },
-        );
-        "#);
-    assert_eq!(out, "rejected:TypeError:boom|cleaned:true");
-}
-
-/// Cancelling the stream invokes the iterator's `return` method.
-#[test]
-fn from_cancel_calls_return() {
-    let out = run(&format!(
-        r#"{DRAIN}
-        globalThis.__out = "pending";
-        let returned = false;
-        const iterable = {{
-            [Symbol.asyncIterator]() {{
-                let i = 0;
-                return {{
-                    next() {{ return Promise.resolve({{ value: i++, done: false }}); }},
-                    return(v) {{ returned = true; return Promise.resolve({{ value: v, done: true }}); }},
-                }};
-            }}
-        }};
-        const rs = ReadableStream.from(iterable);
-        const reader = rs.getReader();
-        reader.read().then(() => reader.cancel("stop")).then(() => {{
-            globalThis.__out = "returned:" + returned;
-        }});
-        "#
-    ));
-    assert_eq!(out, "returned:true");
-}
diff --git a/crates/builtins/web-streams/tests/streams.rs b/crates/builtins/web-streams/tests/streams.rs
new file mode 100644
index 00000000..bdbbfc9b
--- /dev/null
+++ b/crates/builtins/web-streams/tests/streams.rs
@@ -0,0 +1,593 @@
+// SPDX-License-Identifier: Apache-2.0-WITH-LLVM-exception
+
+//! Stream behavior that the WPT `streams` suites don't check: the Rust-side
+//! `ReadableStream::from_bytes` and `ReadableByteStreamController::enqueue_bytes`
+//! APIs, WebIDL conversion order, chunk adoption by async iteration, isolation
+//! of internal state from `Object.prototype`, and regressions for specific bugs.
+
+// This file contains nothing platform-specific, so skip it on wasm32.
+#![cfg(not(target_arch = "wasm32"))]
+
+use core_runtime::config::RuntimeConfig;
+use core_runtime::runtime::{clear_global_initializers, register_global_initializer, Runtime};
+use core_runtime::test_util::{eval_and_read_out, eval_out_with_setup};
+use js::conversion::FromJSVal;
+use web_streams::readable::{ReadableByteStreamController, ReadableStream};
+
+fn add_globals() {
+    clear_global_initializers();
+    register_global_initializer(web_globals::add_to_global);
+    register_global_initializer(web_streams::add_to_global);
+}
+
+/// Evaluate `code`, drain microtasks, and return `String(globalThis.__out)`.
+fn run(code: &str) -> String {
+    eval_out_with_setup(add_globals, code)
+}
+
+/// Create a stream from `bytes`, expose it as `globalThis.__stream`, then evaluate
+/// `code`, drain microtasks, and return `String(globalThis.__out)`.
+fn run_with_stream(bytes: &[u8], code: &str) -> String {
+    add_globals();
+    let rt = Runtime::init(&RuntimeConfig::default()).expect("runtime init");
+    let scope = rt.default_global();
+    let global = scope.global();
+    let stream = ReadableStream::from_bytes(&scope, bytes).expect("create stream from bytes");
+    global
+        .set_property(&scope, c"__stream", stream)
+        .expect("expose __stream");
+    eval_and_read_out(&scope, code)
+}
+
+/// A stream from `ReadableStream::from_bytes` delivers the bytes as a single
+/// `Uint8Array` chunk, then closes.
+#[test]
+fn from_bytes_round_trips_through_js_reader() {
+    let out = run_with_stream(
+        b"hello world",
+        r#"
+        globalThis.__out = "pending";
+        (async () => {
+            const reader = globalThis.__stream.getReader();
+            const bytes = [];
+            let chunkCount = 0;
+            for (;;) {
+                const { value, done } = await reader.read();
+                if (done) break;
+                chunkCount++;
+                if (!(value instanceof Uint8Array)) {
+                    globalThis.__out = "chunk not Uint8Array: " + value;
+                    return;
+                }
+                bytes.push(...value);
+            }
+            globalThis.__out = chunkCount + ":" + bytes.join(",");
+        })();
+        "#,
+    );
+    assert_eq!(out, "1:104,101,108,108,111,32,119,111,114,108,100");
+}
+
+/// A stream from `ReadableStream::from_bytes` with no bytes is closed without a chunk.
+#[test]
+fn from_bytes_empty_stream_closes_immediately() {
+    let out = run_with_stream(
+        b"",
+        r#"
+        globalThis.__out = "pending";
+        (async () => {
+            const reader = globalThis.__stream.getReader();
+            const { value, done } = await reader.read();
+            globalThis.__out = `done=${done},value=${value}`;
+        })();
+        "#,
+    );
+    assert_eq!(out, "done=true,value=undefined");
+}
+
+/// A non-callable callback member throws a `TypeError` at dictionary conversion,
+/// before each constructor's own `RangeError` checks.
+#[test]
+fn non_callable_callback_throws_before_constructor_checks() {
+    let out = run(r#"
+        function errorName(f) {
+            try { f(); return "no-throw"; } catch (e) { return e.constructor.name; }
+        }
+        globalThis.__out = [
+            errorName(() => new ReadableStream({ pull: {}, type: "bytes" }, { size: () => 1 })),
+            errorName(() => new WritableStream({ write: {}, type: "bytes" })),
+            errorName(() => new TransformStream({ transform: {}, readableType: "bytes" })),
+        ].join(",");
+        "#);
+    assert_eq!(out, "TypeError,TypeError,TypeError");
+}
+
+/// For a byte stream, a callable `size` is rejected with a `RangeError`, but a
+/// non-callable `size` fails the `QueuingStrategySize` conversion first with a
+/// `TypeError`.
+#[test]
+fn byte_stream_size_function_error_ordering() {
+    let out = run(r#"
+        let callableErr = "none", nonCallableErr = "none";
+        try { new ReadableStream({ type: "bytes" }, { size() { return 1; } }); }
+        catch (e) { callableErr = e.constructor.name; }
+        try { new ReadableStream({ type: "bytes" }, { size: {} }); }
+        catch (e) { nonCallableErr = e.constructor.name; }
+        globalThis.__out = `${callableErr},${nonCallableErr}`;
+        "#);
+    assert_eq!(out, "RangeError,TypeError");
+}
+
+/// `autoAllocateChunkSize` is `[EnforceRange] unsigned long long`: a negative
+/// value throws a `TypeError` rather than wrapping to a huge positive value.
+#[test]
+fn auto_allocate_chunk_size_enforce_range() {
+    let out = run(r#"
+        let r;
+        try { new ReadableStream({ type: "bytes", autoAllocateChunkSize: -1 }); r = "no-throw"; }
+        catch (e) { r = e.constructor.name; }
+        globalThis.__out = r;
+        "#);
+    assert_eq!(out, "TypeError");
+}
+
+/// A byte controller's `enqueue` rejects a chunk that is not an `ArrayBufferView`.
+#[test]
+fn byte_enqueue_of_non_view_throws_type_error() {
+    let out = run(r#"
+        let threw = false;
+        new ReadableStream({
+            type: "bytes",
+            start(c) {
+                try { c.enqueue([1]); } catch (e) { threw = e instanceof TypeError; }
+            },
+        });
+        globalThis.__out = String(threw);
+        "#);
+    assert_eq!(out, "true");
+}
+
+/// Bound functions are accepted as WebIDL callback-type members, and are invoked
+/// with their bound `this`.
+#[test]
+fn bound_function_callbacks() {
+    let out = run(r#"
+        globalThis.__out = "pending";
+        let sizeCalledWith = null;
+        // `start` enqueues before any reader exists, so the chunk goes through the
+        // queue and the strategy `size` is actually invoked (an enqueue that
+        // satisfies a pending read bypasses `size`).
+        const src = { first: 7, start(c) { c.enqueue(this.first); } };
+        const strat = {
+            factor: 3,
+            size(chunk) { sizeCalledWith = chunk; return chunk * this.factor; },
+        };
+        const rs = new ReadableStream(
+            { start: src.start.bind(src) },
+            { size: strat.size.bind(strat), highWaterMark: 100 },
+        );
+        rs.getReader().read().then(r => {
+            globalThis.__out = `${r.value},${r.done},size=${sizeCalledWith}`;
+        });
+        "#);
+    assert_eq!(out, "7,false,size=7");
+}
+
+/// A `read()` result has own `value`/`done` data properties, so an accessor on
+/// `Object.prototype` can neither observe nor replace them.
+#[test]
+fn read_result_has_own_properties_immune_to_proto_accessor() {
+    let out = run(r#"
+        globalThis.__out = "pending";
+        let leaked = "none";
+        Object.defineProperty(Object.prototype, "value", {
+            configurable: true,
+            get() { return "HIJACKED"; },
+            set(v) { leaked = v; },
+        });
+        const rs = new ReadableStream({ start(c) { c.enqueue(42); } });
+        rs.getReader().read().then(r => {
+            globalThis.__out =
+                `own=${Object.hasOwn(r, "value")},value=${r.value},leaked=${leaked}`;
+        });
+        "#);
+    assert_eq!(out, "own=true,value=42,leaked=none");
+}
+
+/// Numeric accessors on `Object.prototype` don't reach `tee()`'s internal state.
+#[test]
+fn tee_internal_state_immune_to_proto_numeric_accessor() {
+    // `drain` concatenates into a string rather than an array: the polluted
+    // numeric accessors below would also intercept ordinary `array[0] = …` writes
+    // in author code.
+    let out = run(r#"
+        async function drain(stream) {
+            const reader = stream.getReader();
+            let s = "";
+            for (;;) {
+                const { value, done } = await reader.read();
+                if (done) break;
+                s += value;
+            }
+            return s;
+        }
+        globalThis.__out = "pending";
+        for (const k of ["0", "1"]) {
+            Object.defineProperty(Object.prototype, k, {
+                configurable: true,
+                get() { return "HIJACKED"; },
+                set(_v) {},
+            });
+        }
+        const rs = new ReadableStream({ start(c) { c.enqueue("a"); c.enqueue("b"); c.close(); } });
+        const [b1, b2] = rs.tee();
+        Promise.all([drain(b1), drain(b2)]).then(
+            ([s1, s2]) => { globalThis.__out = s1 + "|" + s2; },
+            e => { globalThis.__out = "rejected:" + e; },
+        );
+        "#);
+    assert_eq!(out, "ab|ab");
+}
+
+/// A sync iterable that yields a rejected promise: the async-from-sync wrapper
+/// closes the sync iterator (running its `finally`) before the stream errors.
+#[test]
+fn from_sync_rejected_value_closes_iterator() {
+    let out = run(r#"
+        globalThis.__out = "pending";
+        let cleaned = false;
+        const it = (function* () {
+            try { yield Promise.reject(new TypeError("boom")); }
+            finally { cleaned = true; }
+        })();
+        ReadableStream.from(it).getReader().read().then(
+            () => { globalThis.__out = "resolved"; },
+            e => { globalThis.__out = `rejected:${e.constructor.name}:${e.message}|cleaned:${cleaned}`; },
+        );
+        "#);
+    assert_eq!(out, "rejected:TypeError:boom|cleaned:true");
+}
+
+/// Async iteration adopts a promise chunk: `for await` yields `5`, not the
+/// promise.
+#[test]
+fn for_await_adopts_thenable_chunk() {
+    let out = run(r#"
+        globalThis.__out = "pending";
+        const rs = new ReadableStream({ start(c) { c.enqueue(Promise.resolve(5)); c.close(); } });
+        (async () => {
+            const vals = [];
+            for await (const x of rs) vals.push(x);
+            globalThis.__out = vals.join(",") + "|" + typeof vals[0];
+        })();
+        "#);
+    assert_eq!(out, "5|number");
+}
+
+/// A rejected promise chunk rejects `next()` instead of being yielded.
+#[test]
+fn for_await_rejected_thenable_chunk_throws() {
+    let out = run(r#"
+        globalThis.__out = "pending";
+        const rs = new ReadableStream({ start(c) { c.enqueue(Promise.reject(new TypeError("boom"))); c.close(); } });
+        (async () => {
+            try {
+                for await (const x of rs) { globalThis.__out = "yielded:" + x; return; }
+                globalThis.__out = "done-no-throw";
+            } catch (e) { globalThis.__out = "threw:" + e.constructor.name + ":" + e.message; }
+        })();
+        "#);
+    assert_eq!(out, "threw:TypeError:boom");
+}
+
+/// The default async iterator has no interface object on the global, and its
+/// class string is `"ReadableStream AsyncIterator"` (with a space), per WebIDL
+/// §3.7.10.
+#[test]
+fn async_iterator_has_no_global_and_spaced_string_tag() {
+    let out = run(r#"
+        const leaked = "ReadableStreamAsyncIterator" in globalThis;
+        const tag = Object.prototype.toString.call(new ReadableStream().values());
+        globalThis.__out = `leaked=${leaked},tag=${tag}`;
+        "#);
+    assert_eq!(
+        out,
+        "leaked=false,tag=[object ReadableStream AsyncIterator]"
+    );
+}
+
+/// `ReadableStream.prototype[Symbol.asyncIterator]` is the `values` function.
+#[test]
+fn async_iterator_method_is_values() {
+    let out = run(r#"
+        globalThis.__out = String(
+            ReadableStream.prototype[Symbol.asyncIterator] === ReadableStream.prototype.values);
+        "#);
+    assert_eq!(out, "true");
+}
+
+/// `next()` clears the ongoing promise when the previous call settles, so a call
+/// made after that runs the next steps directly instead of chaining behind the
+/// settled promise. Both calls then settle after the same number of ticks.
+#[test]
+fn settled_next_does_not_delay_the_following_call() {
+    let out = run(r#"
+        globalThis.__out = "pending";
+        const rs = new ReadableStream({ start(c) { c.enqueue(1); c.enqueue(2); } });
+        const it = rs.values();
+        function ticksUntil(p) {
+            let done = false;
+            p.then(() => { done = true; });
+            return new Promise(resolve => {
+                let n = 0;
+                (function spin() {
+                    if (done) { resolve(n); } else { n++; Promise.resolve().then(spin); }
+                })();
+            });
+        }
+        (async () => {
+            const first = await ticksUntil(it.next());
+            const second = await ticksUntil(it.next());
+            globalThis.__out = `${first},${second}`;
+        })();
+    "#);
+    let (first, second) = out.split_once(',').expect("two tick counts");
+    assert_eq!(first, second, "ticks: {out}");
+}
+
+/// pipeTo's abort handling is a DOM abort algorithm, not an `abort` event
+/// listener: an earlier listener that calls `stopImmediatePropagation()` doesn't
+/// suppress the pipe's shutdown.
+#[test]
+fn abort_signal_not_suppressed_by_stop_immediate_propagation() {
+    let out = run(r#"
+        globalThis.__out = "pending";
+        let aborted = false;
+        const ws = new WritableStream({ abort() { aborted = true; } });
+        const ac = new AbortController();
+        ac.signal.addEventListener("abort", (e) => { e.stopImmediatePropagation(); });
+        const rs = new ReadableStream({ start(c) { c.enqueue("a"); } });
+        const p = rs.pipeTo(ws, { signal: ac.signal });
+        ac.abort(new Error("stop"));
+        p.then(() => { globalThis.__out = "fulfilled"; },
+               e => { globalThis.__out = "rejected:" + e.message + "|aborted:" + aborted; });
+        "#);
+    assert_eq!(out, "rejected:stop|aborted:true");
+}
+
+/// Aborting a pipe runs the destination controller's `signal` listeners
+/// synchronously. A listener that enqueues into the source re-enters the pipe's
+/// pending read request, which must not find the pipe state borrowed.
+#[test]
+fn abort_listener_enqueueing_into_source_does_not_panic() {
+    let out = run(r#"
+        globalThis.__out = "pending";
+        let sourceController;
+        const rs = new ReadableStream({ start(c) { sourceController = c; } });
+        const ws = new WritableStream({
+            start(c) {
+                c.signal.addEventListener("abort", () => sourceController.enqueue("late"));
+            },
+        });
+        const ac = new AbortController();
+        const p = rs.pipeTo(ws, { signal: ac.signal });
+        Promise.resolve().then(() => ac.abort(new Error("stop")));
+        p.then(() => { globalThis.__out = "fulfilled"; },
+               e => { globalThis.__out = "rejected:" + e.message; });
+        "#);
+    assert_eq!(out, "rejected:stop");
+}
+
+/// Three pending BYOB reads, then one `enqueue` that fills the first: filling the
+/// head descriptor works while two more descriptors are still queued.
+#[test]
+fn byob_multiple_pending_reads_then_enqueue() {
+    let out = run(r#"
+        globalThis.__out = "pending";
+        let controller;
+        const rs = new ReadableStream({
+            type: "bytes",
+            start(c) { controller = c; },
+        });
+        const reader = rs.getReader({ mode: "byob" });
+        const p1 = reader.read(new Uint8Array(10));
+        reader.read(new Uint8Array(10));
+        reader.read(new Uint8Array(10));
+        controller.enqueue(new Uint8Array([1, 2, 3, 4, 5, 6, 7, 8, 9, 10]));
+        p1.then(r => {
+            globalThis.__out = `${r.value.constructor.name},len=${r.value.length},${r.value[0]}-${r.value[9]}`;
+        });
+        "#);
+    assert_eq!(out, "Uint8Array,len=10,1-10");
+}
+
+/// The `min` option of a BYOB read into a `Float16Array` is checked against the
+/// view's element length, so `min: 3` on a 2-element view rejects.
+#[test]
+fn byob_read_float16_view_kind() {
+    let out = run(r#"
+        globalThis.__out = "pending";
+        if (typeof Float16Array === "undefined") {
+            globalThis.__out = "no-float16";
+        } else {
+            const rs = new ReadableStream({
+                type: "bytes",
+                pull(c) {
+                    const v = c.byobRequest.view;
+                    c.byobRequest.respond(v.byteLength);
+                },
+            });
+            rs.getReader({ mode: "byob" }).read(new Float16Array(2), { min: 3 }).then(
+                r => { globalThis.__out = `resolved:${r.value.constructor.name}`; },
+                e => { globalThis.__out = `rejected:${e.constructor.name}`; },
+            );
+        }
+        "#);
+    assert_eq!(out, "rejected:RangeError");
+}
+
+/// A BYOB `read(view, { min })` on a `Uint16Array` is fulfilled once `min` elements are
+/// available. Here the source supplies exactly the requested bytes.
+#[test]
+fn byob_read_uint16_view_with_min() {
+    let out = run(r#"
+        globalThis.__out = "pending";
+        const rs = new ReadableStream({
+            type: "bytes",
+            pull(c) {
+                const v = c.byobRequest.view;
+                for (let i = 0; i < v.byteLength; i++) v[i] = i + 1;
+                c.byobRequest.respond(v.byteLength);
+            },
+        });
+        rs.getReader({ mode: "byob" }).read(new Uint16Array(2), { min: 2 }).then(r => {
+            globalThis.__out = `${r.value.constructor.name},len=${r.value.length},${r.value[0]}`;
+        });
+        "#);
+    // Bytes 1,2,3,4 little-endian -> u16 [0x0201, 0x0403] = [513, 1027].
+    assert_eq!(out, "Uint16Array,len=2,513");
+}
+
+/// A teed byte stream whose branch has a partially filled `Int32Array` read when
+/// the source closes: the branch's close throws "insufficient bytes", which the
+/// spec marks infallible. Both branches then reject with a `TypeError` instead of
+/// the runtime aborting.
+#[test]
+fn byte_tee_branch_partial_fill_close_rejects_not_aborts() {
+    let out = run(r#"
+        globalThis.__out = "pending";
+        let step = 0;
+        const rs = new ReadableStream({
+            type: "bytes",
+            pull(c) {
+                if (step === 0) {
+                    step = 1;
+                    const v = c.byobRequest.view;
+                    v[0] = 1; v[1] = 2; v[2] = 3;
+                    c.byobRequest.respond(3); // 3 of 4 bytes -> branch partial fill
+                } else {
+                    c.close();
+                    c.byobRequest.respond(0);
+                }
+            },
+        });
+        const [b1, b2] = rs.tee();
+        // Branch 2 receives the 3-byte clone, then its next read rejects. If the
+        // runtime aborted at branch 1's close, branch 2 would never close and this
+        // read would never settle.
+        async function drainB2() {
+            const r = b2.getReader();
+            let n = 0;
+            try {
+                for (;;) {
+                    const { done } = await r.read();
+                    if (done) return "b2:done@" + n;
+                    n++;
+                }
+            } catch (e) { return "b2:" + e.constructor.name + "@" + n; }
+        }
+        const r1 = b1.getReader({ mode: "byob" }).read(new Int32Array(1)).then(
+            () => "b1:resolved", e => "b1:" + e.constructor.name);
+        Promise.all([r1, drainB2()]).then(([a, b]) => { globalThis.__out = a + "," + b; });
+        "#);
+    assert_eq!(out, "b1:TypeError,b2:TypeError@1");
+}
+
+/// `respond(bytesWritten)` is `[EnforceRange] unsigned long long`: a negative
+/// argument throws a `TypeError` at conversion, not a `RangeError` from the
+/// length checks.
+#[test]
+fn respond_enforce_range_rejects_negative() {
+    let out = run(r#"
+        globalThis.__out = "pending";
+        const rs = new ReadableStream({
+            type: "bytes",
+            pull(c) {
+                try { c.byobRequest.respond(-1); globalThis.__out = "no-throw"; }
+                catch (e) { globalThis.__out = "respond:" + e.constructor.name; }
+            },
+        });
+        rs.getReader({ mode: "byob" }).read(new Uint8Array(4));
+        "#);
+    assert_eq!(out, "respond:TypeError");
+}
+
+/// `read(view, options)` converts `view` before `options`, so an invalid view
+/// rejects without running a getter on `options.min`.
+#[test]
+fn byob_read_validates_view_before_options() {
+    let out = run(r#"
+        globalThis.__out = "pending";
+        let getterRan = false;
+        const reader = new ReadableStream({ type: "bytes" }).getReader({ mode: "byob" });
+        reader.read(42, { get min() { getterRan = true; throw new Error("boom"); } }).then(
+            () => { globalThis.__out = "resolved"; },
+            e => { globalThis.__out = `rejected:${e.constructor.name}|getterRan:${getterRan}`; },
+        );
+        "#);
+    assert_eq!(out, "rejected:TypeError|getterRan:false");
+}
+
+/// A promise-returning operation (`cancel`) and a promise-typed getter (`closed`) called with a
+/// wrong `this` return a promise rejected with a `TypeError` instead of throwing, per WebIDL
+/// §3.7.7. These are the macros' two brand-check rejection branches.
+#[test]
+fn promise_members_reject_a_wrong_this() {
+    let out = run(r#"
+        globalThis.__out = "pending";
+        const closed = Object.getOwnPropertyDescriptor(
+            ReadableStreamDefaultReader.prototype, "closed").get;
+        const outcome = (call) => {
+            let p;
+            try { p = call(); } catch (e) { return Promise.resolve("threw"); }
+            return p.then(() => "resolved", e => `rejected:${e.constructor.name}`);
+        };
+        Promise.all([
+            outcome(() => ReadableStream.prototype.cancel.call(undefined)),
+            outcome(() => closed.call(undefined)),
+        ]).then(results => { globalThis.__out = results.join("|"); });
+        "#);
+    assert_eq!(out, "rejected:TypeError|rejected:TypeError");
+}
+
+/// `enqueue_bytes` hands its `Vec`'s allocation to the reader: the chunk read from the stream holds
+/// the bytes at the address they had in the `Vec`.
+#[test]
+fn enqueue_bytes_hands_its_buffer_to_the_reader() {
+    add_globals();
+    let rt = Runtime::init(&RuntimeConfig::default()).expect("runtime init");
+    let scope = rt.default_global();
+    let controller = js::compile::evaluate_with_filename(
+        &scope,
+        r#"
+        let controller;
+        globalThis.stream = new ReadableStream({ type: "bytes", start(c) { controller = c; } });
+        controller
+        "#,
+        "test.js",
+        1,
+    )
+    .expect("creating the stream");
+    let controller =
+        ReadableByteStreamController::from_jsval(&scope, controller, ()).expect("a controller");
+    let bytes = vec![1u8, 2, 3, 4, 5, 6, 7, 8];
+    let address = bytes.as_ptr() as usize;
+    controller
+        .enqueue_bytes(&scope, bytes)
+        .expect("enqueueing the bytes");
+    let out = eval_and_read_out(
+        &scope,
+        r#"
+        globalThis.__out = "pending";
+        stream.getReader().read().then(({ value }) => {
+            globalThis.chunk = value;
+            globalThis.__out = value.join(",");
+        });
+        "#,
+    );
+    assert_eq!(out, "1,2,3,4,5,6,7,8");
+    let chunk = js::compile::evaluate_with_filename(&scope, "chunk", "chunk.js", 1)
+        .expect("reading the chunk");
+    let chunk = js::Uint8Array::from_jsval(&scope, chunk, ()).expect("a Uint8Array");
+    assert_eq!(chunk.with_slice(|bytes| bytes.as_ptr() as usize), address);
+}
diff --git a/crates/builtins/web-streams/tests/tee_default.rs b/crates/builtins/web-streams/tests/tee_default.rs
deleted file mode 100644
index 027c7491..00000000
--- a/crates/builtins/web-streams/tests/tee_default.rs
+++ /dev/null
@@ -1,140 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0-WITH-LLVM-exception
-
-//! Keystone integration tests for `ReadableStream.tee()`: both branches receive
-//! the source's chunks, branch cancellation is independent, and the source's
-//! error propagates to both branches. Covered far more thoroughly by
-//! `streams/readable-streams/tee.any.js`; this is the fast, design-validating
-//! (and GC-rooting-validating) smoke test.
-
-// This file contains nothing platform-specific, so skip it on wasm32.
-#![cfg(not(target_arch = "wasm32"))]
-
-use core_runtime::runtime::{clear_global_initializers, register_global_initializer};
-use core_runtime::test_util::eval_out_with_setup;
-
-fn run(code: &str) -> String {
-    eval_out_with_setup(
-        || {
-            clear_global_initializers();
-            register_global_initializer(web_streams::add_to_global);
-        },
-        code,
-    )
-}
-
-const DRAIN: &str = r#"
-    async function drain(stream) {
-        const reader = stream.getReader();
-        const out = [];
-        for (;;) {
-            const { value, done } = await reader.read();
-            if (done) break;
-            out.push(value);
-        }
-        return out.join("");
-    }
-"#;
-
-/// Both branches receive all of the source's chunks.
-#[test]
-fn both_branches_receive_chunks() {
-    let out = run(&format!(
-        r#"{DRAIN}
-        globalThis.__out = "pending";
-        const rs = new ReadableStream({{ start(c) {{ c.enqueue("a"); c.enqueue("b"); c.close(); }} }});
-        const [b1, b2] = rs.tee();
-        Promise.all([drain(b1), drain(b2)]).then(([s1, s2]) => {{ globalThis.__out = s1 + "|" + s2; }});
-        "#
-    ));
-    assert_eq!(out, "ab|ab");
-}
-
-/// `tee()` locks the source and returns two readable branches.
-#[test]
-fn tee_locks_and_returns_two_branches() {
-    let out = run(r#"
-        const rs = new ReadableStream();
-        const branches = rs.tee();
-        const locked = rs.locked;
-        const two = branches.length === 2;
-        const both = branches[0] instanceof ReadableStream && branches[1] instanceof ReadableStream;
-        globalThis.__out = `${locked},${two},${both}`;
-        "#);
-    assert_eq!(out, "true,true,true");
-}
-
-/// Cancelling one branch does not stop the other from draining.
-#[test]
-fn cancel_one_branch_other_still_drains() {
-    let out = run(&format!(
-        r#"{DRAIN}
-        globalThis.__out = "pending";
-        const rs = new ReadableStream({{ start(c) {{ c.enqueue("x"); c.enqueue("y"); c.close(); }} }});
-        const [b1, b2] = rs.tee();
-        b1.cancel();
-        drain(b2).then(s => {{ globalThis.__out = s; }});
-        "#
-    ));
-    assert_eq!(out, "xy");
-}
-
-/// `tee()` packs its internal per-chunk reaction state into an object that author
-/// code cannot reach or tamper with. A hostile numeric accessor on
-/// `Object.prototype` must not be able to intercept or corrupt that packed state:
-/// if the internal payload were an ordinary `Object.prototype`-inheriting object
-/// written with `[[Set]]`/read with `[[Get]]`, the accessor would hijack indices
-/// `0`/`1` and the tee microtask would mis-recover its state.
-#[test]
-fn tee_internal_state_immune_to_proto_numeric_accessor() {
-    // `drain` concatenates into a string rather than an array: the polluted
-    // numeric accessors below would also intercept ordinary `array[0] = …` writes
-    // in author code, which is correct JS behaviour and not what we are testing.
-    let out = run(r#"
-        async function drain(stream) {
-            const reader = stream.getReader();
-            let s = "";
-            for (;;) {
-                const { value, done } = await reader.read();
-                if (done) break;
-                s += value;
-            }
-            return s;
-        }
-        globalThis.__out = "pending";
-        for (const k of ["0", "1"]) {
-            Object.defineProperty(Object.prototype, k, {
-                configurable: true,
-                get() { return "HIJACKED"; },
-                set(_v) {},
-            });
-        }
-        const rs = new ReadableStream({ start(c) { c.enqueue("a"); c.enqueue("b"); c.close(); } });
-        const [b1, b2] = rs.tee();
-        Promise.all([drain(b1), drain(b2)]).then(
-            ([s1, s2]) => { globalThis.__out = s1 + "|" + s2; },
-            e => { globalThis.__out = "rejected:" + e; },
-        );
-        "#);
-    assert_eq!(out, "ab|ab");
-}
-
-/// An error in the source propagates to both branches' readers.
-#[test]
-fn source_error_propagates_to_both() {
-    let out = run(&format!(
-        r#"{DRAIN}
-        globalThis.__out = "pending";
-        let ctrl;
-        const rs = new ReadableStream({{ start(c) {{ ctrl = c; }} }});
-        const [b1, b2] = rs.tee();
-        ctrl.error(new Error("boom"));
-        const r1 = b1.getReader();
-        const r2 = b2.getReader();
-        Promise.all([
-            r1.read().then(() => "ok", e => "e1:" + e.message),
-            r2.read().then(() => "ok", e => "e2:" + e.message),
-        ]).then(([a, b]) => {{ globalThis.__out = a + "," + b; }});
-        "#
-    ));
-    assert_eq!(out, "e1:boom,e2:boom");
-}
diff --git a/crates/builtins/web-streams/tests/transform_default.rs b/crates/builtins/web-streams/tests/transform_default.rs
deleted file mode 100644
index fd686563..00000000
--- a/crates/builtins/web-streams/tests/transform_default.rs
+++ /dev/null
@@ -1,113 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0-WITH-LLVM-exception
-
-//! Keystone integration tests for the transform default path: the transform
-//! stream wires its writable side (sink → transform) to its readable side
-//! (source) through the controller, on top of the readable/writable defaults.
-//! `web-globals` is registered because the underlying writable controller
-//! creates an `AbortController`.
-//!
-//! Behaviour is covered far more thoroughly by the `streams/transform-streams`
-//! WPT suites; this is the fast, design-validating smoke test.
-
-// This file contains nothing platform-specific, so skip it on wasm32.
-#![cfg(not(target_arch = "wasm32"))]
-
-use core_runtime::runtime::{clear_global_initializers, register_global_initializer};
-use core_runtime::test_util::eval_out_with_setup;
-
-fn run(code: &str) -> String {
-    eval_out_with_setup(
-        || {
-            clear_global_initializers();
-            register_global_initializer(|scope, global| {
-                web_globals::add_to_global(scope, global);
-                web_streams::add_to_global(scope, global);
-            });
-        },
-        code,
-    )
-}
-
-/// A transformer that uppercases each chunk: written chunks come out transformed
-/// on the readable side.
-#[test]
-fn transform_uppercases_chunks() {
-    let out = run(r#"
-        globalThis.__out = "pending";
-        const ts = new TransformStream({
-            transform(chunk, controller) { controller.enqueue(chunk.toUpperCase()); },
-        });
-        const writer = ts.writable.getWriter();
-        const reader = ts.readable.getReader();
-        writer.write("a");
-        reader.read().then(r => { globalThis.__out = r.value; });
-        "#);
-    assert_eq!(out, "A");
-}
-
-/// The default (identity) transform passes chunks through unchanged.
-#[test]
-fn identity_transform_passes_through() {
-    let out = run(r#"
-        globalThis.__out = "pending";
-        const ts = new TransformStream();
-        const writer = ts.writable.getWriter();
-        const reader = ts.readable.getReader();
-        writer.write("hello");
-        reader.read().then(r => { globalThis.__out = r.value; });
-        "#);
-    assert_eq!(out, "hello");
-}
-
-/// `flush` runs on close and can enqueue a final chunk; closing the writable
-/// closes the readable.
-#[test]
-fn flush_enqueues_and_close_propagates() {
-    let out = run(r#"
-        globalThis.__out = "pending";
-        const ts = new TransformStream({
-            transform(chunk, c) { c.enqueue(chunk); },
-            flush(c) { c.enqueue("end"); },
-        });
-        const writer = ts.writable.getWriter();
-        const reader = ts.readable.getReader();
-        writer.write("x");
-        writer.close();
-        const seen = [];
-        function pump() {
-            return reader.read().then(r => {
-                if (r.done) { globalThis.__out = seen.join(","); return; }
-                seen.push(r.value);
-                return pump();
-            });
-        }
-        pump();
-        "#);
-    assert_eq!(out, "x,end");
-}
-
-/// `readable` and `writable` are the two sides and round-trip object identity.
-#[test]
-fn readable_writable_shape() {
-    let out = run(r#"
-        const ts = new TransformStream();
-        const a = ts.readable instanceof ReadableStream;
-        const b = ts.writable instanceof WritableStream;
-        const c = ts.readable === ts.readable;
-        globalThis.__out = `${a},${b},${c}`;
-        "#);
-    assert_eq!(out, "true,true,true");
-}
-
-/// A non-callable transformer callback throws a `TypeError` at dictionary
-/// conversion, before the step-3 `readableType` `RangeError`.
-#[test]
-fn non_callable_callback_throws_type_error_before_readable_type_check() {
-    let out = run(r#"
-        let err = "none";
-        try { new TransformStream({ transform: {}, readableType: "bytes" }); err = "no-throw"; }
-        catch (e) { err = e.constructor.name; }
-        globalThis.__out = err;
-        "#);
-    assert_eq!(out, "TypeError");
-}
diff --git a/crates/builtins/web-streams/tests/writable_default.rs b/crates/builtins/web-streams/tests/writable_default.rs
deleted file mode 100644
index c2e19638..00000000
--- a/crates/builtins/web-streams/tests/writable_default.rs
+++ /dev/null
@@ -1,119 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0-WITH-LLVM-exception
-
-//! Keystone integration tests for the writable default path: the write/close/
-//! abort state machine, the writer, and the default controller. `web-globals`
-//! is registered alongside `web-streams` because the writable controller
-//! creates an `AbortController` during setup.
-//!
-//! These exercise behaviour covered far more thoroughly by the
-//! `streams/writable-streams` WPT suites; this is the fast, design-validating
-//! smoke test.
-
-// This file contains nothing platform-specific, so skip it on wasm32.
-#![cfg(not(target_arch = "wasm32"))]
-
-use core_runtime::runtime::{clear_global_initializers, register_global_initializer};
-use core_runtime::test_util::eval_out_with_setup;
-
-/// Evaluate `code`, drain microtasks, and return `String(globalThis.__out)`.
-fn run(code: &str) -> String {
-    eval_out_with_setup(
-        || {
-            clear_global_initializers();
-            register_global_initializer(|scope, global| {
-                web_globals::add_to_global(scope, global);
-                web_streams::add_to_global(scope, global);
-            });
-        },
-        code,
-    )
-}
-
-/// Chunks written through a writer reach the sink's `write` algorithm in order,
-/// and the per-write promises settle.
-#[test]
-fn write_chunks_reach_sink() {
-    let out = run(r#"
-        globalThis.__out = "pending";
-        const written = [];
-        const ws = new WritableStream({ write(chunk) { written.push(chunk); } });
-        const w = ws.getWriter();
-        w.write("a").then(() => w.write("b")).then(() => {
-            globalThis.__out = written.join(",");
-        });
-        "#);
-    assert_eq!(out, "a,b");
-}
-
-/// `close()` runs the sink's `close` algorithm and resolves.
-#[test]
-fn close_runs_sink_close() {
-    let out = run(r#"
-        globalThis.__out = "pending";
-        let closed = false;
-        const ws = new WritableStream({ close() { closed = true; } });
-        const w = ws.getWriter();
-        w.write("x");
-        w.close().then(() => { globalThis.__out = "closed:" + closed; });
-        "#);
-    assert_eq!(out, "closed:true");
-}
-
-/// `abort(reason)` runs the sink's `abort` algorithm with the reason and resolves.
-#[test]
-fn abort_runs_sink_abort() {
-    let out = run(r#"
-        globalThis.__out = "pending";
-        let abortReason;
-        const ws = new WritableStream({ abort(r) { abortReason = r; } });
-        const w = ws.getWriter();
-        w.abort("boom").then(() => { globalThis.__out = "aborted:" + abortReason; });
-        "#);
-    assert_eq!(out, "aborted:boom");
-}
-
-/// `locked` reflects writer acquisition, and a second `getWriter` throws.
-#[test]
-fn locked_and_double_get_writer() {
-    let out = run(r#"
-        const ws = new WritableStream();
-        const before = ws.locked;
-        ws.getWriter();
-        const after = ws.locked;
-        let threw = false;
-        try { ws.getWriter(); } catch (e) { threw = e instanceof TypeError; }
-        globalThis.__out = `${before},${after},${threw}`;
-        "#);
-    assert_eq!(out, "false,true,true");
-}
-
-/// A sink whose `write` rejects errors the stream: the write promise rejects and
-/// the writer's `closed` promise rejects.
-#[test]
-fn write_rejection_errors_stream() {
-    let out = run(r#"
-        globalThis.__out = "pending";
-        const ws = new WritableStream({ write() { return Promise.reject(new Error("nope")); } });
-        const w = ws.getWriter();
-        w.write("a").then(
-            () => { globalThis.__out = "unexpected-fulfill"; },
-            (e) => { globalThis.__out = "rejected:" + e.message; },
-        );
-        "#);
-    assert_eq!(out, "rejected:nope");
-}
-
-/// A non-callable callback dictionary member throws a `TypeError` at dictionary
-/// conversion, before the step-3 `type` `RangeError` — WebIDL converts the
-/// `UnderlyingSink` dictionary (validating `write` is callable) before the
-/// constructor checks `type`.
-#[test]
-fn non_callable_callback_throws_type_error_before_type_check() {
-    let out = run(r#"
-        let err = "none";
-        try { new WritableStream({ write: {}, type: "bytes" }); err = "no-throw"; }
-        catch (e) { err = e.constructor.name; }
-        globalThis.__out = err;
-        "#);
-    assert_eq!(out, "TypeError");
-}
diff --git a/crates/builtins/web-url/Cargo.toml b/crates/builtins/web-url/Cargo.toml
index a2800e47..601df603 100644
--- a/crates/builtins/web-url/Cargo.toml
+++ b/crates/builtins/web-url/Cargo.toml
@@ -7,7 +7,7 @@ authors.workspace = true
 edition.workspace = true
 
 [lib]
-# No unit tests; skip building the (SpiderMonkey-sized) lib test harness binary.
+# No unit tests. This skips building the (SpiderMonkey-sized) lib test harness binary.
 test = false
 
 [dependencies]
diff --git a/crates/builtins/web-url/src/lib.rs b/crates/builtins/web-url/src/lib.rs
index 390a80c3..c68e88ef 100644
--- a/crates/builtins/web-url/src/lib.rs
+++ b/crates/builtins/web-url/src/lib.rs
@@ -12,7 +12,12 @@ pub fn add_to_global(scope: &Scope<'_>, global: Object<'_>) {
     url::URL::add_to_global(scope, global);
     url_search_params::URLSearchParams::add_to_global(scope, global);
     url_search_params_iterator::URLSearchParamsIterator::add_to_global(scope, global);
-    url_search_params::install_symbol_iterator(scope);
+    // `URLSearchParams.prototype[Symbol.iterator]` is `entries`.
+    js::class::add_symbol_alias::<url_search_params::URLSearchParamsImpl>(
+        scope,
+        c"entries",
+        js::native::SymbolCode::iterator,
+    );
     js::class::inherit_from_iterator_prototype::<
         url_search_params_iterator::URLSearchParamsIteratorImpl,
     >(scope)
diff --git a/crates/builtins/web-url/src/url_search_params.rs b/crates/builtins/web-url/src/url_search_params.rs
index c6817653..9ca160ea 100644
--- a/crates/builtins/web-url/src/url_search_params.rs
+++ b/crates/builtins/web-url/src/url_search_params.rs
@@ -273,15 +273,6 @@ impl URLSearchParams<'_> {
     }
 }
 
-/// Define `Symbol.iterator` on URLSearchParams.prototype.
-pub fn install_symbol_iterator(scope: &Scope<'_>) {
-    js::class::add_symbol_alias::<URLSearchParamsImpl>(
-        scope,
-        c"entries",
-        js::native::SymbolCode::iterator,
-    );
-}
-
 impl URLSearchParams<'_> {
     /// <https://url.spec.whatwg.org/#concept-urlsearchparams-update>
     pub(crate) fn update(&self, scope: &Scope<'_>) -> Result<(), ExnThrown> {
diff --git a/crates/builtins/web-url/tests/url.rs b/crates/builtins/web-url/tests/url.rs
index 93321969..6ae9e941 100644
--- a/crates/builtins/web-url/tests/url.rs
+++ b/crates/builtins/web-url/tests/url.rs
@@ -3,7 +3,7 @@
 // This file contains nothing platform-specific, so skip it on wasm32.
 #![cfg(not(target_arch = "wasm32"))]
 
-use core_runtime::test_util::{eval_with_setup, throws_with_setup};
+use core_runtime::test_util::eval_with_setup;
 
 fn setup() {
     core_runtime::runtime::register_global_initializer(|scope, global| {
@@ -15,218 +15,22 @@ fn eval(code: &str) -> String {
     eval_with_setup(setup, code)
 }
 
-fn throws(code: &str) -> bool {
-    throws_with_setup(setup, code)
-}
-
-// ── URL constructor ──
-
-#[test]
-fn url_constructor_basic() {
-    assert_eq!(
-        eval("new URL('https://example.com/').href"),
-        "https://example.com/"
-    );
-}
-
-#[test]
-fn url_constructor_with_base() {
-    assert_eq!(
-        eval("new URL('/path', 'https://example.com').href"),
-        "https://example.com/path"
-    );
-}
-
-#[test]
-fn url_constructor_invalid_throws() {
-    assert!(throws("new URL('not a url')"));
-}
-
-#[test]
-fn url_constructor_invalid_base_throws() {
-    assert!(throws("new URL('/path', 'not a url')"));
-}
-
-// ── URL properties ──
-
-#[test]
-fn url_origin() {
-    assert_eq!(
-        eval("new URL('https://example.com:8080/p').origin"),
-        "https://example.com:8080"
-    );
-}
-
-#[test]
-fn url_protocol() {
-    assert_eq!(eval("new URL('https://example.com/').protocol"), "https:");
-}
-
-#[test]
-fn url_username() {
-    assert_eq!(
-        eval("new URL('https://user@example.com/').username"),
-        "user"
-    );
-}
-
-#[test]
-fn url_password() {
-    assert_eq!(
-        eval("new URL('https://user:pass@example.com/').password"),
-        "pass"
-    );
-}
-
-#[test]
-fn url_host_with_port() {
-    assert_eq!(
-        eval("new URL('https://example.com:8080/').host"),
-        "example.com:8080"
-    );
-}
-
-#[test]
-fn url_host_default_port() {
-    assert_eq!(eval("new URL('https://example.com/').host"), "example.com");
-}
-
-#[test]
-fn url_hostname() {
-    assert_eq!(
-        eval("new URL('https://example.com:8080/').hostname"),
-        "example.com"
-    );
-}
-
-#[test]
-fn url_port() {
-    assert_eq!(eval("new URL('https://example.com:8080/').port"), "8080");
-}
-
-#[test]
-fn url_port_default_empty() {
-    assert_eq!(eval("new URL('https://example.com/').port"), "");
-}
-
-#[test]
-fn url_pathname() {
-    assert_eq!(eval("new URL('https://example.com/a/b').pathname"), "/a/b");
-}
-
-#[test]
-fn url_search() {
-    assert_eq!(eval("new URL('https://example.com/?q=1').search"), "?q=1");
-}
-
-#[test]
-fn url_search_empty() {
-    assert_eq!(eval("new URL('https://example.com/').search"), "");
-}
-
-#[test]
-fn url_hash() {
-    assert_eq!(eval("new URL('https://example.com/#frag').hash"), "#frag");
-}
-
-#[test]
-fn url_hash_empty() {
-    assert_eq!(eval("new URL('https://example.com/').hash"), "");
-}
-
-// ── URL setters ──
-
-#[test]
-fn url_set_href() {
-    assert_eq!(
-        eval("let u = new URL('https://a.com/'); u.href = 'https://b.com/path'; u.href"),
-        "https://b.com/path"
-    );
-}
-
-#[test]
-fn url_set_href_invalid_throws() {
-    assert!(throws(
-        "let u = new URL('https://a.com/'); u.href = 'invalid'"
-    ));
-}
-
-#[test]
-fn url_set_protocol() {
-    assert_eq!(
-        eval("let u = new URL('https://a.com/'); u.protocol = 'http:'; u.protocol"),
-        "http:"
-    );
-}
-
-#[test]
-fn url_set_username() {
-    assert_eq!(
-        eval("let u = new URL('https://a.com/'); u.username = 'bob'; u.username"),
-        "bob"
-    );
-}
-
-#[test]
-fn url_set_password() {
-    assert_eq!(
-        eval("let u = new URL('https://a.com/'); u.password = 'secret'; u.password"),
-        "secret"
-    );
-}
-
-#[test]
-fn url_set_host() {
-    assert_eq!(
-        eval("let u = new URL('https://a.com/'); u.host = 'b.com:9090'; u.host"),
-        "b.com:9090"
-    );
-}
-
-#[test]
-fn url_set_hostname() {
-    assert_eq!(
-        eval("let u = new URL('https://a.com/'); u.hostname = 'b.com'; u.hostname"),
-        "b.com"
-    );
-}
-
-#[test]
-fn url_set_port() {
-    assert_eq!(
-        eval("let u = new URL('https://a.com/'); u.port = '3000'; u.port"),
-        "3000"
-    );
-}
+// The WPT `url/` tests cover the rest of `URL` and `URLSearchParams`.
 
 #[test]
-fn url_set_pathname() {
+fn url_search_params_iterator_is_not_a_global() {
     assert_eq!(
-        eval("let u = new URL('https://a.com/old'); u.pathname = '/new'; u.pathname"),
-        "/new"
+        eval("typeof globalThis['URLSearchParams Iterator']"),
+        "undefined"
     );
-}
-
-#[test]
-fn url_set_search() {
     assert_eq!(
-        eval("let u = new URL('https://a.com/'); u.search = '?x=1'; u.search"),
-        "?x=1"
-    );
-}
-
-#[test]
-fn url_set_hash() {
-    assert_eq!(
-        eval("let u = new URL('https://a.com/'); u.hash = '#sec'; u.hash"),
-        "#sec"
+        eval("Object.prototype.toString.call(new URLSearchParams('a=1').entries())"),
+        "[object URLSearchParams Iterator]"
     );
 }
 
-// ── URL methods ──
-
 #[test]
-fn url_to_string() {
+fn url_to_string_returns_the_href() {
     assert_eq!(
         eval("new URL('https://example.com/path?q=1#h').toString()"),
         "https://example.com/path?q=1#h"
@@ -234,209 +38,15 @@ fn url_to_string() {
 }
 
 #[test]
-fn url_to_json() {
-    assert_eq!(
-        eval("new URL('https://example.com/').toJSON()"),
-        "https://example.com/"
-    );
-}
-
-// ── URL.parse ──
-
-#[test]
-fn url_parse_valid() {
+fn url_constructor_rejects_an_invalid_base() {
     assert_eq!(
-        eval("URL.parse('https://example.com/').href"),
-        "https://example.com/"
+        eval("try { new URL('/path', 'not a url'); 'no-throw' } catch (e) { e.constructor.name }"),
+        "TypeError"
     );
 }
 
 #[test]
-fn url_parse_invalid_returns_null() {
-    assert_eq!(eval("URL.parse('not a url')"), "null");
-}
-
-#[test]
-fn url_parse_with_base() {
-    assert_eq!(
-        eval("URL.parse('/path', 'https://example.com').href"),
-        "https://example.com/path"
-    );
-}
-
-// ── URL.canParse ──
-
-#[test]
-fn url_can_parse_valid() {
-    assert_eq!(eval("URL.canParse('https://example.com/')"), "true");
-}
-
-#[test]
-fn url_can_parse_invalid() {
-    assert_eq!(eval("URL.canParse('not a url')"), "false");
-}
-
-// ── URLSearchParams constructor ──
-
-#[test]
-fn usp_construct_empty() {
-    assert_eq!(eval("new URLSearchParams().toString()"), "");
-}
-
-#[test]
-fn usp_construct_from_string() {
-    assert_eq!(eval("new URLSearchParams('a=1&b=2').toString()"), "a=1&b=2");
-}
-
-#[test]
-fn usp_construct_from_string_strips_question_mark() {
-    assert_eq!(eval("new URLSearchParams('?a=1').toString()"), "a=1");
-}
-
-#[test]
-fn usp_construct_from_sequence() {
-    assert_eq!(
-        eval("new URLSearchParams([['a', '1'], ['b', '2']]).toString()"),
-        "a=1&b=2"
-    );
-}
-
-#[test]
-fn usp_construct_from_record() {
-    // Order may vary for records; check both entries exist.
-    assert_eq!(
-        eval("new URLSearchParams({a: '1', b: '2'}).toString()"),
-        "a=1&b=2"
-    );
-}
-
-#[test]
-fn usp_construct_invalid_pair_throws() {
-    assert!(throws("new URLSearchParams([['only_one']])"));
-}
-
-#[test]
-fn usp_construct_from_custom_iterable() {
-    assert_eq!(
-        eval(
-            "let init = { [Symbol.iterator]: function* () { yield ['a', 'b']; yield ['c', 'd']; } };\
-             new URLSearchParams(init).get('a')"
-        ),
-        "b"
-    );
-}
-
-#[test]
-fn usp_construct_record_preserves_null_code_point() {
-    assert_eq!(
-        eval("new URLSearchParams({['a\\0b']: 42}).toString()"),
-        "a%00b=42"
-    );
-}
-
-// ── URLSearchParams methods ──
-
-#[test]
-fn usp_get() {
-    assert_eq!(eval("new URLSearchParams('a=1&b=2').get('a')"), "1");
-}
-
-#[test]
-fn usp_get_missing_returns_null() {
-    assert_eq!(eval("new URLSearchParams('a=1').get('x')"), "null");
-}
-
-#[test]
-fn usp_get_all() {
-    assert_eq!(
-        eval("JSON.stringify(new URLSearchParams('a=1&a=2&b=3').getAll('a'))"),
-        "[\"1\",\"2\"]"
-    );
-}
-
-#[test]
-fn usp_has() {
-    assert_eq!(eval("new URLSearchParams('a=1').has('a')"), "true");
-}
-
-#[test]
-fn usp_has_missing() {
-    assert_eq!(eval("new URLSearchParams('a=1').has('b')"), "false");
-}
-
-#[test]
-fn usp_has_with_value() {
-    assert_eq!(eval("new URLSearchParams('a=1&a=2').has('a', '2')"), "true");
-}
-
-#[test]
-fn usp_append() {
-    assert_eq!(
-        eval("let p = new URLSearchParams('a=1'); p.append('b', '2'); p.toString()"),
-        "a=1&b=2"
-    );
-}
-
-#[test]
-fn usp_delete() {
-    assert_eq!(
-        eval("let p = new URLSearchParams('a=1&b=2&a=3'); p.delete('a'); p.toString()"),
-        "b=2"
-    );
-}
-
-#[test]
-fn usp_delete_with_value() {
-    assert_eq!(
-        eval("let p = new URLSearchParams('a=1&a=2&a=3'); p.delete('a', '2'); p.toString()"),
-        "a=1&a=3"
-    );
-}
-
-#[test]
-fn usp_set() {
-    assert_eq!(
-        eval("let p = new URLSearchParams('a=1&a=2'); p.set('a', '3'); p.toString()"),
-        "a=3"
-    );
-}
-
-#[test]
-fn usp_set_new_key() {
-    assert_eq!(
-        eval("let p = new URLSearchParams(); p.set('x', '1'); p.toString()"),
-        "x=1"
-    );
-}
-
-#[test]
-fn usp_sort() {
-    assert_eq!(
-        eval("let p = new URLSearchParams('c=3&a=1&b=2'); p.sort(); p.toString()"),
-        "a=1&b=2&c=3"
-    );
-}
-
-#[test]
-fn usp_size() {
-    assert_eq!(eval("new URLSearchParams('a=1&b=2&c=3').size"), "3");
-}
-
-#[test]
-fn usp_entries_iterator_method() {
-    assert_eq!(
-        eval(
-            "let p = new URLSearchParams('a=1&b=2'); \
-             let it = p.entries(); \
-             let first = it.next().value; \
-             first[0] + '=' + first[1]"
-        ),
-        "a=1"
-    );
-}
-
-#[test]
-fn usp_keys_and_values_methods() {
+fn url_search_params_keys_and_values() {
     assert_eq!(
         eval(
             "let p = new URLSearchParams('a=1&b=2'); \
@@ -445,124 +55,3 @@ fn usp_keys_and_values_methods() {
         "[[\"a\",\"b\"],[\"1\",\"2\"]]"
     );
 }
-
-// ── URL + URLSearchParams integration ──
-
-#[test]
-fn url_search_params_reflects_url_query() {
-    assert_eq!(
-        eval("new URL('https://example.com/?a=1&b=2').searchParams.get('a')"),
-        "1"
-    );
-}
-
-#[test]
-fn url_search_params_updates_url() {
-    assert_eq!(
-        eval("let u = new URL('https://example.com/'); u.searchParams.append('x', '1'); u.search"),
-        "?x=1"
-    );
-}
-
-#[test]
-fn url_set_search_updates_params() {
-    assert_eq!(
-        eval(
-            "let u = new URL('https://example.com/?old=1'); u.search = '?new=2'; u.searchParams.get('new')"
-        ),
-        "2"
-    );
-}
-
-#[test]
-fn url_set_href_updates_search_params() {
-    assert_eq!(
-        eval(
-            "let u = new URL('https://a.com/?x=1'); u.href = 'https://b.com/?y=2'; u.searchParams.get('y')"
-        ),
-        "2"
-    );
-}
-
-#[test]
-fn usp_for_of_sees_live_updates() {
-    assert_eq!(
-        eval(
-            "let a = new URL('http://a.b/c?a=1&b=2&c=3&d=4');\
-             let seen = [];\
-             for (const i of a.searchParams) {\
-               a.search = 'x=1&y=2&z=3';\
-               seen.push(i[0] + '=' + i[1]);\
-             }\
-             seen.join(',')"
-        ),
-        "a=1,y=2,z=3"
-    );
-}
-
-#[test]
-fn usp_construct_record_normalizes_keys_last_wins() {
-    // WebIDL `record<USVString, USVString>` conversion normalizes keys to USV
-    // and is map-shaped: when two JS keys normalize to the same USVString, the
-    // later entry overwrites the earlier one. Mirrors the WPT test
-    // "Construct with 2 unpaired surrogates (no trailing)".
-    assert_eq!(
-        eval(
-            "let p = new URLSearchParams({'\\uD835x': '1', 'xx': '2', '\\uD83Dx': '3'});\
-             JSON.stringify([...p])"
-        ),
-        "[[\"\u{fffd}x\",\"3\"],[\"xx\",\"2\"]]"
-    );
-}
-
-#[test]
-fn usp_delete_on_opaque_path_preserves_trailing_space_encoding() {
-    assert_eq!(
-        eval(
-            "const url = new URL('data:space    ?test');\
-             url.searchParams.delete('test');\
-             url.pathname"
-        ),
-        "space   %20"
-    );
-    assert_eq!(
-        eval(
-            "const url = new URL('data:space    ?test');\
-             url.searchParams.delete('test');\
-             url.href"
-        ),
-        "data:space   %20"
-    );
-}
-
-#[test]
-fn usp_delete_on_opaque_path_with_fragment_preserves_trailing_space_encoding() {
-    assert_eq!(
-        eval(
-            "const url = new URL('data:space    ?test#test');\
-             url.searchParams.delete('test');\
-             url.pathname"
-        ),
-        "space   %20"
-    );
-    assert_eq!(
-        eval(
-            "const url = new URL('data:space    ?test#test');\
-             url.searchParams.delete('test');\
-             url.href"
-        ),
-        "data:space   %20#test"
-    );
-}
-
-#[test]
-fn url_search_params_iterator_is_not_a_global() {
-    assert_eq!(
-        eval("typeof globalThis['URLSearchParams Iterator']"),
-        "undefined"
-    );
-    assert_eq!(
-        eval("Object.prototype.toString.call(new URLSearchParams('a=1').entries())"),
-        "[object URLSearchParams Iterator]"
-    );
-}
diff --git a/crates/core-runtime/Cargo.toml b/crates/core-runtime/Cargo.toml
index 0de47f8f..f3a911ed 100644
--- a/crates/core-runtime/Cargo.toml
+++ b/crates/core-runtime/Cargo.toml
@@ -13,6 +13,7 @@ profilemozjs = ['js/profilemozjs']
 
 [dependencies]
 clap.workspace = true
+wit-name-mapping.workspace = true
 event-listener.workspace = true
 futures-lite = "2"
 js.workspace = true
@@ -20,6 +21,7 @@ oxc_resolver.workspace = true
 platform.workspace = true
 shlex = "2"
 tempfile = "3"
+url.workspace = true
 
 [lints]
 workspace = true
diff --git a/crates/core-runtime/core b/crates/core-runtime/core
deleted file mode 100644
index 69d79bff..00000000
Binary files a/crates/core-runtime/core and /dev/null differ
diff --git a/crates/core-runtime/src/config.rs b/crates/core-runtime/src/config.rs
index 920ae6b0..cd1bc433 100644
--- a/crates/core-runtime/src/config.rs
+++ b/crates/core-runtime/src/config.rs
@@ -29,11 +29,11 @@ pub struct RuntimeConfig {
     #[arg(short = 'i', long = "initializer-script")]
     pub initializer_script_path: Option<String>,
 
-    /// Enable verbose logging.
+    /// No effect.
     #[arg(short = 'v', long = "verbose")]
     pub verbose: bool,
 
-    /// Enable script debugging via socket connection.
+    /// No effect.
     #[arg(short = 'd', long = "debug")]
     pub debugging: bool,
 
@@ -54,21 +54,22 @@ pub struct RuntimeConfig {
 
     /// Enforce the browser-security Fetch constraints (forbidden
     /// request/response headers and methods, no-CORS safelisting, origin/mode
-    /// enforcement). Defaults to off except in `--wpt-mode`, which needs the
+    /// enforcement), and coarsen the HR-Time clocks, such as `performance.now()`,
+    /// to 100 microseconds. Defaults to off except in `--wpt-mode`, which needs the
     /// browser-observable behavior.
     /// Pass `=true`/`=false` to override either default.
     #[arg(
-        long = "enforce-fetch-restrictions",
+        long = "web-security-restrictions",
         num_args = 0..=1,
         default_missing_value = "true"
     )]
-    pub enforce_fetch_restrictions: Option<bool>,
+    pub web_security_restrictions: Option<bool>,
 
     /// Override the location URL for initialization.
     #[arg(long = "init-location")]
     pub init_location: Option<String>,
 
-    /// Strip this prefix from script paths.
+    /// No effect.
     #[arg(long = "strip-path-prefix")]
     pub path_prefix: Option<String>,
 
@@ -94,9 +95,10 @@ pub struct RuntimeConfig {
     /// Give up on a served request whose `respondWith` has not settled after this many seconds and
     /// answer it with a 500.
     ///
-    /// No limit by default, except in `--wpt-mode`, where it's 120 seconds. `0` means no limit.
-    #[arg(long = "dispatch-timeout", value_name = "SECONDS")]
-    pub dispatch_timeout: Option<u64>,
+    /// No limit by default, except in `--wpt-mode`, where it's 120 seconds. Fractions such as
+    /// `0.25` are accepted. `0` means no limit.
+    #[arg(long = "dispatch-timeout", value_name = "SECONDS", value_parser = parse_seconds)]
+    pub dispatch_timeout: Option<Duration>,
 
     /// Give up on a served request's response body after this many seconds, counted from its
     /// headers going out, and truncate it visibly (no terminating chunk natively, error trailers
@@ -106,16 +108,18 @@ pub struct RuntimeConfig {
     /// body and a peer too slow to accept one alike; on wasm it covers handing the body to the
     /// host, which buffers it, so a slow peer is the host's to bound.
     ///
-    /// No limit by default, except in `--wpt-mode`, where it's 120 seconds. `0` means no limit.
-    #[arg(long = "response-body-timeout", value_name = "SECONDS")]
-    pub response_body_timeout: Option<u64>,
+    /// No limit by default, except in `--wpt-mode`, where it's 120 seconds. Fractions such as
+    /// `0.25` are accepted. `0` means no limit.
+    #[arg(long = "response-body-timeout", value_name = "SECONDS", value_parser = parse_seconds)]
+    pub response_body_timeout: Option<Duration>,
 
     /// Stop waiting for the promises a served request passed to `FetchEvent#waitUntil` after this
     /// many seconds, counted from the response being fully sent.
     ///
-    /// No limit by default, except in `--wpt-mode`, where it's 120 seconds. `0` means no limit.
-    #[arg(long = "waituntil-timeout", value_name = "SECONDS")]
-    pub waituntil_timeout: Option<u64>,
+    /// No limit by default, except in `--wpt-mode`, where it's 120 seconds. Fractions such as
+    /// `0.25` are accepted. `0` means no limit.
+    #[arg(long = "waituntil-timeout", value_name = "SECONDS", value_parser = parse_seconds)]
+    pub waituntil_timeout: Option<Duration>,
 
     /// Bound everything a served request runs, dispatch through `waitUntil` work, by this many
     /// seconds of wall clock, however the per-phase timeouts divide it. Each phase runs under the
@@ -123,9 +127,9 @@ pub struct RuntimeConfig {
     /// is rejected.
     ///
     /// No limit by default (also in `--wpt-mode`, whose per-phase defaults already bound a run).
-    /// `0` means no limit.
-    #[arg(long = "end-to-end-timeout", value_name = "SECONDS")]
-    pub end_to_end_timeout: Option<u64>,
+    /// Fractions such as `0.25` are accepted. `0` means no limit.
+    #[arg(long = "end-to-end-timeout", value_name = "SECONDS", value_parser = parse_seconds)]
+    pub end_to_end_timeout: Option<Duration>,
 
     /// Limits applied for native builds. On Wasm, `wasi:http` enforces equivalents.
     #[cfg(not(target_arch = "wasm32"))]
@@ -146,10 +150,10 @@ impl RuntimeConfig {
     }
 
     /// The effective request-restrictions setting: an explicit
-    /// `--enforce-fetch-restrictions[=bool]` wins, otherwise restrictions are
+    /// `--web-security-restrictions[=bool]` wins, otherwise restrictions are
     /// on in WPT mode and off everywhere else.
-    pub fn enforce_fetch_restrictions(&self) -> bool {
-        self.enforce_fetch_restrictions.unwrap_or(self.wpt_mode)
+    pub fn web_security_restrictions(&self) -> bool {
+        self.web_security_restrictions.unwrap_or(self.wpt_mode)
     }
 
     /// The effective `--dispatch-timeout`, or `None` for no limit.
@@ -178,19 +182,20 @@ impl RuntimeConfig {
     /// mistake under a shorter explicit deadline, and `0` on either side means "no bound of its
     /// own", which the deadline caps as a matter of course.
     pub fn validate_serve_timeouts(&self) -> Result<(), String> {
-        let Some(end_to_end) = self.end_to_end_timeout.filter(|&s| s != 0) else {
+        let Some(end_to_end) = self.end_to_end_timeout.filter(|t| !t.is_zero()) else {
             return Ok(());
         };
-        for (flag, seconds) in [
+        for (flag, timeout) in [
             ("--dispatch-timeout", self.dispatch_timeout),
             ("--response-body-timeout", self.response_body_timeout),
             ("--waituntil-timeout", self.waituntil_timeout),
         ] {
-            if seconds.is_some_and(|s| s != 0 && s > end_to_end) {
+            if let Some(timeout) = timeout.filter(|t| !t.is_zero() && *t > end_to_end) {
                 return Err(format!(
-                    "{flag} {} exceeds --end-to-end-timeout {end_to_end}: a phase cannot run \
-                     longer than the whole request",
-                    seconds.unwrap(),
+                    "{flag} {} exceeds --end-to-end-timeout {}: a phase cannot run longer than \
+                     the whole request",
+                    timeout.as_secs_f64(),
+                    end_to_end.as_secs_f64(),
                 ));
             }
         }
@@ -237,18 +242,6 @@ impl RuntimeConfig {
             Err(_) => Self::try_parse_from(["starling"]),
         }
     }
-
-    /// Parse from stdin (for wizer pre-initialization).
-    /// Reads a single line of arguments from stdin.
-    pub fn from_stdin() -> Result<Self, clap::Error> {
-        let mut input = String::new();
-        if std::io::Read::read_to_string(&mut std::io::stdin(), &mut input).is_err() {
-            return Self::try_parse_from(["starling"]);
-        }
-        let mut config = Self::from_arg_string(input.trim())?;
-        config.pre_initialize = true;
-        Ok(config)
-    }
 }
 
 /// A byte count on the command line, written with a unit (`512MiB`, `64KiB`, `1MB`) or as a plain
@@ -389,39 +382,41 @@ pub struct ServeLimits {
     /// but waiting for a handler that never reads its body does — past it the rest of the body is
     /// drained rather than delivered.
     ///
-    /// `0` means no limit.
+    /// Fractions such as `0.25` are accepted. `0` means no limit.
     #[arg(
         long = "request-read-timeout",
         value_name = "SECONDS",
-        default_value_t = 30
+        value_parser = parse_seconds,
+        default_value = "30"
     )]
-    pub request_read_timeout: u64,
+    pub request_read_timeout: Duration,
 
     /// Close a kept-alive connection that has sat idle for this many seconds without the next
     /// request's first byte. Expiring closes it quietly rather than answering a 408: between
     /// requests, silence is a client that is done with the connection.
     ///
-    /// `0` means no limit.
+    /// Fractions such as `0.25` are accepted. `0` means no limit.
     #[arg(
         long = "keepalive-timeout",
         value_name = "SECONDS",
-        default_value_t = 30
+        value_parser = parse_seconds,
+        default_value = "30"
     )]
-    pub keepalive_timeout: u64,
+    pub keepalive_timeout: Duration,
 }
 
 #[cfg(not(target_arch = "wasm32"))]
 impl ServeLimits {
     /// The effective `--request-read-timeout`, or `None` for no limit.
     pub fn request_read_timeout(&self) -> Option<Duration> {
-        let seconds = self.request_read_timeout;
-        (seconds != 0).then(|| Duration::from_secs(seconds))
+        let timeout = self.request_read_timeout;
+        (!timeout.is_zero()).then_some(timeout)
     }
 
     /// The effective `--keepalive-timeout`, or `None` for no limit.
     pub fn keepalive_timeout(&self) -> Option<Duration> {
-        let seconds = self.keepalive_timeout;
-        (seconds != 0).then(|| Duration::from_secs(seconds))
+        let timeout = self.keepalive_timeout;
+        (!timeout.is_zero()).then_some(timeout)
     }
 
     /// Reject a size or count limit of zero for all limits except `--max-body-drain-bytes`, and a
@@ -475,29 +470,30 @@ impl Default for RuntimeConfig {
 // contexts these policies are usually unwanted, so they're disabled by default.
 
 js::instance_local! {
-    static ENFORCE_REQUEST_RESTRICTIONS: Cell<bool> = const { Cell::new(false) };
+    static WEB_SECURITY_RESTRICTIONS: Cell<bool> = const { Cell::new(false) };
 }
 
-/// Enable or disable enforcement of the browser-security Fetch constraints.
-/// `Runtime::init` sets this from the [`RuntimeConfig`], embedders can override
+/// Enable or disable enforcement of the browser-security Fetch constraints and the coarsening of
+/// the HR-Time clocks. `Runtime::init` sets this from the [`RuntimeConfig`], embedders can override
 /// it at any point after.
-pub fn set_enforce_fetch_restrictions(enabled: bool) {
-    ENFORCE_REQUEST_RESTRICTIONS.with(|cell| cell.set(enabled));
+pub fn set_web_security_restrictions(enabled: bool) {
+    WEB_SECURITY_RESTRICTIONS.with(|cell| cell.set(enabled));
 }
 
-/// Whether the browser-security Fetch constraints are currently enforced.
+/// Whether the browser-security Fetch constraints are currently enforced. While they are, the
+/// HR-Time clocks are coarsened too.
 #[inline]
-pub fn enforce_fetch_restrictions() -> bool {
-    ENFORCE_REQUEST_RESTRICTIONS.with(|cell| cell.get())
+pub fn web_security_restrictions() -> bool {
+    WEB_SECURITY_RESTRICTIONS.with(|cell| cell.get())
 }
 
 /// How long a serve-mode timeout given as `--…-timeout SECONDS` runs for: the value if it was
 /// given, otherwise [`WPT_SERVE_TIMEOUT`] in WPT mode and no limit everywhere else. An explicit
 /// `0` is how a WPT run asks for no limit.
-fn serve_timeout(seconds: Option<u64>, wpt_mode: bool) -> Option<Duration> {
-    match seconds {
-        Some(0) => None,
-        Some(seconds) => Some(Duration::from_secs(seconds)),
+fn serve_timeout(timeout: Option<Duration>, wpt_mode: bool) -> Option<Duration> {
+    match timeout {
+        Some(timeout) if timeout.is_zero() => None,
+        Some(timeout) => Some(timeout),
         None if wpt_mode => Some(WPT_SERVE_TIMEOUT),
         None => None,
     }
@@ -507,6 +503,17 @@ fn serve_timeout(seconds: Option<u64>, wpt_mode: bool) -> Option<Duration> {
 /// is merely slow still reports a result and only a genuinely stuck one is cut off.
 const WPT_SERVE_TIMEOUT: Duration = Duration::from_secs(120);
 
+/// Parse a serve-mode timeout given in seconds, whole (`30`) or fractional (`0.25`). Negative,
+/// non-finite and out-of-range values are refused.
+fn parse_seconds(value: &str) -> Result<Duration, String> {
+    value
+        .trim()
+        .parse::<f64>()
+        .ok()
+        .and_then(|seconds| Duration::try_from_secs_f64(seconds).ok())
+        .ok_or_else(|| format!("{value:?} is not a number of seconds (try 30 or 0.25)"))
+}
+
 /// Split an argument string into individual arguments, respecting quotes.
 fn split_args(s: &str) -> Result<Vec<String>, clap::Error> {
     let mut args = vec!["starling".into()];
@@ -537,30 +544,23 @@ mod tests {
     fn serve_timeouts_default_to_no_limit_outside_wpt_mode() {
         let config = RuntimeConfig::default();
         assert_eq!(config.dispatch_timeout(), None);
+        assert_eq!(config.response_body_timeout(), None);
         assert_eq!(config.waituntil_timeout(), None);
 
         // WPT runs want a stuck test cut off rather than stalling the run.
         let wpt = RuntimeConfig::from_arg_string("--wpt-mode").unwrap();
         assert_eq!(wpt.dispatch_timeout(), Some(WPT_SERVE_TIMEOUT));
+        assert_eq!(wpt.response_body_timeout(), Some(WPT_SERVE_TIMEOUT));
         assert_eq!(wpt.waituntil_timeout(), Some(WPT_SERVE_TIMEOUT));
 
-        // An explicit value wins over either default, and `0` is how to ask for no limit at all.
-        let explicit =
-            RuntimeConfig::from_arg_string("--wpt-mode --dispatch-timeout 5 --waituntil-timeout 0")
-                .unwrap();
+        // An explicit value wins over either default. `0` means no limit at all.
+        let explicit = RuntimeConfig::from_arg_string(
+            "--wpt-mode --dispatch-timeout 5 --response-body-timeout 0 --waituntil-timeout 0",
+        )
+        .unwrap();
         assert_eq!(explicit.dispatch_timeout(), Some(Duration::from_secs(5)));
-        assert_eq!(explicit.waituntil_timeout(), None);
-    }
-
-    #[test]
-    fn response_body_timeout_defaults_like_the_other_phase_timeouts() {
-        // No limit by default; WPT mode wants a stuck body cut off like a stuck dispatch.
-        assert_eq!(RuntimeConfig::default().response_body_timeout(), None);
-        let wpt = RuntimeConfig::from_arg_string("--wpt-mode").unwrap();
-        assert_eq!(wpt.response_body_timeout(), Some(WPT_SERVE_TIMEOUT));
-        let explicit =
-            RuntimeConfig::from_arg_string("--wpt-mode --response-body-timeout 0").unwrap();
         assert_eq!(explicit.response_body_timeout(), None);
+        assert_eq!(explicit.waituntil_timeout(), None);
     }
 
     #[test]
@@ -575,8 +575,8 @@ mod tests {
     }
 
     #[test]
-    fn a_phase_timeout_longer_than_end_to_end_is_a_config_error() {
-        // A phase that could never use its full window is a contradiction worth catching.
+    fn a_phase_timeout_longer_than_end_to_end_is_rejected() {
+        // A phase that could never use its full window is rejected.
         for phase in ["dispatch", "response-body", "waituntil"] {
             let config = RuntimeConfig::from_arg_string(&format!(
                 "--end-to-end-timeout 10 --{phase}-timeout 11"
@@ -588,6 +588,14 @@ mod tests {
                 "error should name the offending flag and the limit, got: {error}"
             );
         }
+        let config =
+            RuntimeConfig::from_arg_string("--end-to-end-timeout 0.25 --response-body-timeout 0.3")
+                .unwrap();
+        let error = config.validate_serve_timeouts().unwrap_err();
+        assert!(
+            error.contains("--response-body-timeout 0.3") && error.contains("0.25"),
+            "{error}"
+        );
     }
 
     #[test]
@@ -621,8 +629,8 @@ mod tests {
         assert_eq!(ByteSize::mib(512).to_string(), "512MiB");
         assert_eq!(ByteSize::kib(64).to_string(), "64KiB");
         assert_eq!(ByteSize::new(0).to_string(), "0B");
-        // A size no unit divides stays in bytes rather than rounding: what `--help` prints has to
-        // parse back to the number it printed.
+        // A size not divisible by any unit stays in bytes rather than rounding: what `--help`
+        // prints has to parse back to the number it printed.
         assert_eq!(ByteSize::new(1000).to_string(), "1000B");
         assert_eq!(ByteSize::new(1025).to_string(), "1025B");
     }
@@ -703,7 +711,41 @@ mod tests {
     }
 
     #[test]
-    fn a_zero_size_or_count_limit_is_a_config_error() {
+    fn serve_timeouts_take_fractional_seconds() {
+        let config = RuntimeConfig::from_arg_string(
+            "--dispatch-timeout 0.15 --response-body-timeout 0.25 --waituntil-timeout 1.5 \
+             --end-to-end-timeout 2 --request-read-timeout 0.5 --keepalive-timeout 0.75",
+        )
+        .unwrap();
+        assert_eq!(config.dispatch_timeout(), Some(Duration::from_millis(150)));
+        assert_eq!(
+            config.response_body_timeout(),
+            Some(Duration::from_millis(250))
+        );
+        assert_eq!(
+            config.waituntil_timeout(),
+            Some(Duration::from_millis(1500))
+        );
+        assert_eq!(config.end_to_end_timeout(), Some(Duration::from_secs(2)));
+        assert_eq!(
+            config.serve_limits.request_read_timeout(),
+            Some(Duration::from_millis(500))
+        );
+        assert_eq!(
+            config.serve_limits.keepalive_timeout(),
+            Some(Duration::from_millis(750))
+        );
+
+        for bad in ["-1", "abc", "nan", "inf", ""] {
+            assert!(
+                RuntimeConfig::from_arg_string(&format!("--dispatch-timeout={bad}")).is_err(),
+                "{bad:?} should not parse"
+            );
+        }
+    }
+
+    #[test]
+    fn a_zero_size_or_count_limit_is_rejected() {
         // Unlike a timeout, a cap of zero is not "no limit" but a server that can accept
         // nothing at all, which is never what was meant.
         for flag in [
@@ -731,7 +773,7 @@ mod tests {
     }
 
     #[test]
-    fn a_request_head_cap_below_the_read_buffer_minimum_is_a_config_error() {
+    fn a_request_head_cap_below_the_read_buffer_minimum_is_rejected() {
         let config = RuntimeConfig::from_arg_string("--max-connection-buffer-size 512").unwrap();
         let error = config.serve_limits.validate().unwrap_err();
         assert!(
@@ -774,47 +816,32 @@ mod tests {
     }
 
     #[test]
-    fn enforce_fetch_restrictions_defaults_off_wpt_on_flag_wins() {
-        assert!(!RuntimeConfig::default().enforce_fetch_restrictions());
+    fn web_security_restrictions_defaults_off_wpt_on_flag_wins() {
+        assert!(!RuntimeConfig::default().web_security_restrictions());
         assert!(RuntimeConfig::from_arg_string("--wpt-mode")
             .unwrap()
-            .enforce_fetch_restrictions());
+            .web_security_restrictions());
         assert!(
-            !RuntimeConfig::from_arg_string("--wpt-mode --enforce-fetch-restrictions=false")
+            !RuntimeConfig::from_arg_string("--wpt-mode --web-security-restrictions=false")
                 .unwrap()
-                .enforce_fetch_restrictions()
+                .web_security_restrictions()
         );
         assert!(
-            RuntimeConfig::from_arg_string("--enforce-fetch-restrictions")
+            RuntimeConfig::from_arg_string("--web-security-restrictions")
                 .unwrap()
-                .enforce_fetch_restrictions()
+                .web_security_restrictions()
         );
     }
 
+    /// The base path is the current directory for `-e`, and otherwise the absolute directory of
+    /// the script.
     #[test]
-    fn base_path_for_eval_is_cwd() {
-        let config = RuntimeConfig::from_arg_string("-e 42").unwrap();
-        assert_eq!(config.base_path(), env::current_dir().unwrap());
-    }
-
-    #[test]
-    fn base_path_for_bare_filename_is_cwd() {
-        let config = RuntimeConfig::from_arg_string("app.js").unwrap();
-        assert_eq!(config.base_path(), env::current_dir().unwrap());
-    }
-
-    #[test]
-    fn base_path_for_absolute_script_is_its_directory() {
-        let config = RuntimeConfig::from_arg_string("/srv/js/app.js").unwrap();
-        assert_eq!(config.base_path(), Path::new("/srv/js"));
-    }
-
-    #[test]
-    fn base_path_for_relative_script_is_absolute() {
-        let config = RuntimeConfig::from_arg_string("sub/dir/app.js").unwrap();
-        assert_eq!(
-            config.base_path(),
-            env::current_dir().unwrap().join("sub/dir")
-        );
+    fn base_path_is_the_script_directory_or_the_current_directory() {
+        let cwd = env::current_dir().unwrap();
+        let base_path = |args| RuntimeConfig::from_arg_string(args).unwrap().base_path();
+        assert_eq!(base_path("-e 42"), cwd);
+        assert_eq!(base_path("app.js"), cwd);
+        assert_eq!(base_path("/srv/js/app.js"), Path::new("/srv/js"));
+        assert_eq!(base_path("sub/dir/app.js"), cwd.join("sub/dir"));
     }
 }
diff --git a/crates/core-runtime/src/diagnostics.rs b/crates/core-runtime/src/diagnostics.rs
new file mode 100644
index 00000000..51cad411
--- /dev/null
+++ b/crates/core-runtime/src/diagnostics.rs
@@ -0,0 +1,53 @@
+// SPDX-License-Identifier: Apache-2.0-WITH-LLVM-exception
+
+//! Messages that are written to stderr at the next microtask checkpoint instead of where they
+//! arise, for code such as finalizers that can't report anything itself.
+
+use std::cell::RefCell;
+
+js::instance_local! {
+    /// The messages [`report_later`] queued, in the order it queued them.
+    static QUEUED: RefCell<Vec<String>> = const { RefCell::new(Vec::new()) };
+}
+
+/// Queue `message` to be written to stderr by the next
+/// [`run_microtasks`](crate::event_loop::run_microtasks). It neither runs JavaScript nor allocates
+/// GC things, so a finalizer can call it. A message queued while the instance is torn down is
+/// dropped. Messages queued after the last checkpoint, such as by finalizers in the final GC, are
+/// written only if a later checkpoint runs in the same instance.
+pub fn report_later(message: String) {
+    let _ = QUEUED.try_with(|queued| queued.borrow_mut().push(message));
+}
+
+/// Write the messages [`report_later`] queued to stderr, each followed by a newline.
+pub(crate) fn report_queued() {
+    for message in take_queued() {
+        eprintln!("{message}");
+    }
+}
+
+fn take_queued() -> Vec<String> {
+    QUEUED.with(RefCell::take)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::config::RuntimeConfig;
+    use crate::event_loop::run_microtasks;
+    use crate::runtime::Runtime;
+
+    #[test]
+    fn queued_messages_are_reported_by_the_next_microtask_checkpoint() {
+        let runtime = Runtime::init(&RuntimeConfig::default()).expect("runtime init");
+        let scope = runtime.default_global();
+        report_later("first".to_string());
+        report_later("second".to_string());
+        assert_eq!(
+            QUEUED.with(|queued| queued.borrow().clone()),
+            ["first", "second"]
+        );
+        run_microtasks(&scope);
+        assert!(take_queued().is_empty());
+    }
+}
diff --git a/crates/core-runtime/src/event_loop.rs b/crates/core-runtime/src/event_loop.rs
index 1f982a6d..7ba787cc 100644
--- a/crates/core-runtime/src/event_loop.rs
+++ b/crates/core-runtime/src/event_loop.rs
@@ -55,7 +55,7 @@ pub mod timer;
 use platform::clock::Instant;
 use std::cell::{Cell, RefCell};
 use std::collections::{BTreeSet, HashMap};
-use std::rc::Rc;
+use std::rc::{Rc, Weak};
 use std::time::Duration;
 
 use event_listener::{Event, EventListener};
@@ -78,7 +78,7 @@ js::instance_local! {
     /// [`with_active_event_loop`].
     ///
     /// The pointee is only ever accessed through shared references, so re-entrant access from JS
-    /// callbacks aliases nothing.
+    /// callbacks doesn't alias a mutable reference.
     static CURRENT_EVENT_LOOP: Cell<Option<*const EventLoop>> = const { Cell::new(None) };
 }
 
@@ -112,33 +112,45 @@ pub fn with_event_loop<R>(event_loop: &EventLoop, f: impl FnOnce(&EventLoop) ->
     f(event_loop)
 }
 
+/// The closure passed to [`without_event_loop`] that returns why no event loop
+/// is active.
+type NoLoopReason = dyn Fn() -> String;
+
 js::instance_local! {
-    /// Why no event loop is active, set by [`without_event_loop`] for the
-    /// duration of its closure.
-    static NO_LOOP_REASON: RefCell<Option<String>> = const { RefCell::new(None) };
+    /// Pointer to the reason closure of the innermost [`without_event_loop`]
+    /// call, set for the duration of its `f`.
+    static NO_LOOP_REASON: Cell<Option<*const NoLoopReason>> = const { Cell::new(None) };
 }
 
-/// Run `f` with no active event loop, and `reason` as the explanation
-/// [`throw_no_event_loop`] gives for work that needs one. The previous state is
-/// restored afterwards.
+/// Run `f` with no active event loop. `reason` returns the explanation that
+/// [`throw_no_event_loop`] gives for work that needs one. It is called only
+/// when that explanation is needed, and can be called more than once. The
+/// previous state is restored afterwards.
 ///
 /// This is mainly useful for running code in sync exports, which mustn't block, and hence
 /// can't perform async operations.
-pub fn without_event_loop<R>(reason: String, f: impl FnOnce() -> R) -> R {
+pub fn without_event_loop<R>(reason: impl Fn() -> String, f: impl FnOnce() -> R) -> R {
     /// Restores the previous active loop and reason.
     struct Restore {
         prev_loop: Option<*const EventLoop>,
-        prev_reason: Option<String>,
+        prev_reason: Option<*const NoLoopReason>,
     }
     impl Drop for Restore {
         fn drop(&mut self) {
             CURRENT_EVENT_LOOP.with(|el| el.set(self.prev_loop));
-            NO_LOOP_REASON.with(|cell| *cell.borrow_mut() = self.prev_reason.take());
+            NO_LOOP_REASON.with(|cell| cell.set(self.prev_reason));
         }
     }
 
+    let reason: &(dyn Fn() -> String + '_) = &reason;
+    // SAFETY: only the lifetime bound changes. `Restore` removes the pointer
+    // before `reason` goes out of scope, so it is only dereferenced while
+    // `reason` is alive.
+    let reason = unsafe {
+        std::mem::transmute::<*const (dyn Fn() -> String + '_), *const NoLoopReason>(reason)
+    };
     let prev_loop = CURRENT_EVENT_LOOP.with(|el| el.replace(None));
-    let prev_reason = NO_LOOP_REASON.with(|cell| cell.borrow_mut().replace(reason));
+    let prev_reason = NO_LOOP_REASON.with(|cell| cell.replace(Some(reason)));
     let _restore = Restore {
         prev_loop,
         prev_reason,
@@ -146,14 +158,23 @@ pub fn without_event_loop<R>(reason: String, f: impl FnOnce() -> R) -> R {
     f()
 }
 
-/// Throw a `TypeError` whose message is that `what` needs an active event loop,
-/// followed by the reason [`without_event_loop`] set, if any.
-pub fn throw_no_event_loop(scope: &Scope<'_>, what: &str) -> ExnThrown {
-    let message = NO_LOOP_REASON.with(|cell| match &*cell.borrow() {
-        Some(reason) => format!("{what} needs an active event loop, and {reason}"),
+/// The message that `what` needs an active event loop, followed by the reason
+/// [`without_event_loop`] set, if any.
+pub fn no_event_loop_message(what: &str) -> String {
+    match NO_LOOP_REASON.with(|cell| cell.get()) {
+        // SAFETY: the pointer is set only while the closure it points to is
+        // alive (see `without_event_loop`).
+        Some(reason) => {
+            let reason = unsafe { (*reason)() };
+            format!("{what} needs an active event loop, and {reason}")
+        }
         None => format!("{what} needs an active event loop"),
-    });
-    js::error::TypeError(message).throw(scope)
+    }
+}
+
+/// Throw a `TypeError` with the [`no_event_loop_message`] for `what`.
+pub fn throw_no_event_loop(scope: &Scope<'_>, what: &str) -> ExnThrown {
+    js::error::TypeError(no_event_loop_message(what)).throw(scope)
 }
 
 /// Reject `promise` with the `TypeError` [`throw_no_event_loop`] throws for
@@ -164,7 +185,7 @@ pub fn reject_without_event_loop(
     promise: &js::Promise<'_>,
     what: &str,
 ) -> Result<bool, ExnThrown> {
-    if with_active_event_loop(|_| ()).is_some() {
+    if has_active_event_loop() {
         return Ok(false);
     }
     throw_no_event_loop(scope, what);
@@ -172,6 +193,11 @@ pub fn reject_without_event_loop(
     Ok(true)
 }
 
+/// Whether an event loop is active.
+pub fn has_active_event_loop() -> bool {
+    CURRENT_EVENT_LOOP.with(|el| el.get().is_some())
+}
+
 /// Run a closure with a reference to the active event loop.
 ///
 /// Returns `None` if no event loop is active (i.e. we're not inside a
@@ -182,7 +208,7 @@ pub fn with_active_event_loop<R>(f: impl FnOnce(&EventLoop) -> R) -> Option<R> {
             // SAFETY: the pointer was installed by `with_event_loop`, whose
             // shared borrow of the loop spans the closure currently on the
             // stack. The loop is alive, and all its state is behind cells,
-            // so shared access from here aliases nothing.
+            // so shared access from here doesn't alias a mutable reference.
             f(unsafe { &*ptr })
         })
     })
@@ -199,24 +225,6 @@ pub fn with_active_event_loop<R>(f: impl FnOnce(&EventLoop) -> R) -> Option<R> {
 #[derive(Clone, Copy, Debug, Eq, Hash, PartialEq)]
 pub struct TaskId(u64);
 
-impl TaskId {
-    /// Create a `TaskId` from a raw `u64` value.
-    ///
-    /// Test-only, since in production code it'd be a footgun.
-    #[cfg(test)]
-    pub fn from_raw(raw: u64) -> Self {
-        Self(raw)
-    }
-
-    /// Returns the raw `u64` value.
-    ///
-    /// Test-only, since in production code it'd be a footgun.
-    #[cfg(test)]
-    pub fn as_raw(self) -> u64 {
-        self.0
-    }
-}
-
 impl std::fmt::Display for TaskId {
     fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
         write!(f, "TaskId({})", self.0)
@@ -248,10 +256,30 @@ pub enum StepOutcome {
     Progressed,
 }
 
-/// A `setTimeout`/`setInterval` timer, keyed by the id JS sees.
-struct JsTimer {
+/// A global's `setTimeout` and `setInterval` timers.
+#[derive(Default)]
+struct GlobalTimers {
+    /// The last timer id the global's `setTimeout` or `setInterval` returned.
+    last_id: Cell<u64>,
+    /// HTML's "map of setTimeout and setInterval IDs": the timer ids JS sees, mapped to the
+    /// loop and task each controls.
+    timers: RefCell<HashMap<u64, GlobalTimer>>,
+}
+
+/// An entry of [`GlobalTimers::timers`].
+struct GlobalTimer {
+    /// The tasks of the loop that holds the timer.
+    tasks: Weak<LoopTasks>,
     /// The task the timer controls. An interval re-queues itself under the same one.
     task: TaskId,
+}
+
+/// A JS timer an [`EventLoop`] holds, keyed by the task it controls.
+struct LoopTimer {
+    /// The timers of the global that created the timer.
+    global: Weak<GlobalTimers>,
+    /// The id JS sees.
+    timer_id: u64,
     /// Where the timer was created, kept for each re-queue of an interval.
     origin: Option<Rc<str>>,
 }
@@ -420,11 +448,35 @@ impl TaskQueue {
 // EventLoop
 // ---------------------------------------------------------------------------
 
-/// Namespace token for the per-global setTimeout/setInterval id counter. Its
-/// address is a process-unique, stable `usize` key for
-/// [`js::class::next_global_counter`], mirroring how shared functions key on
-/// their native pointer.
-static TIMER_ID_COUNTER_KEY: u8 = 0;
+/// The tasks and JS timers of an [`EventLoop`], shared with [`GlobalTimers`] so that a timer can
+/// be cleared while another loop is active.
+struct LoopTasks {
+    /// All live tasks.
+    tasks: RefCell<TaskQueue>,
+    /// The JS timers this loop holds, by the task each controls.
+    js_timers: RefCell<HashMap<TaskId, LoopTimer>>,
+    /// The owning loop's driver notification.
+    notify: Rc<Event>,
+}
+
+impl LoopTasks {
+    /// Remove the JS timer that controls `task` from this loop and from its global's map.
+    fn release_js_timer(&self, task: TaskId) {
+        let removed = self.js_timers.borrow_mut().remove(&task);
+        if let Some(timer) = removed {
+            timer.release();
+        }
+    }
+}
+
+impl LoopTimer {
+    /// Remove the timer from its global's map.
+    fn release(self) {
+        if let Some(global) = self.global.upgrade() {
+            global.timers.borrow_mut().remove(&self.timer_id);
+        }
+    }
+}
 
 /// The event loop task registry.
 ///
@@ -432,9 +484,10 @@ static TIMER_ID_COUNTER_KEY: u8 = 0;
 /// drivers (`native`, `wasi`) call into this struct to advance the
 /// loop.
 ///
-/// The `EventLoop` is stored on the [`Runtime`](crate::runtime::Runtime)
-/// and its [`trace`](EventLoop::trace) method is called during GC to keep
-/// JS references inside tasks alive.
+/// The `EventLoop` is held by an
+/// [`InvocationState`](crate::invocation::InvocationState), and its
+/// [`trace`](EventLoop::trace) method is called during GC to keep JS
+/// references inside tasks alive.
 /// All mutable state lives in cells, so every method takes `&self`: JS
 /// callbacks re-entering through [`with_active_event_loop`] while the driver
 /// is mid-[`step`](Self::step) only ever alias shared references.
@@ -448,11 +501,8 @@ pub struct EventLoop {
     loop_id: u64,
     /// Monotonically increasing counter for generating unique [`TaskId`]s.
     next_id: Cell<u64>,
-    /// All live tasks.
-    tasks: RefCell<TaskQueue>,
-    /// HTML's per-loop "map of setTimeout and setInterval IDs": the timer ids
-    /// JS sees, mapped to the internal task they control.
-    js_timers: RefCell<HashMap<u64, JsTimer>>,
+    /// All live tasks and JS timers.
+    shared: Rc<LoopTasks>,
     /// Scratch buffer for [`step`](Self::step)'s per-batch dispatch list,
     /// reused across steps so the hot path stays allocation-free.
     batch_buf: RefCell<Vec<TaskId>>,
@@ -468,15 +518,16 @@ pub struct EventLoop {
     /// Shared with this loop's [`InterestHandle`]s, whose release
     /// must wake this loop even when it happens during another loop's turn.
     notify: Rc<Event>,
-    /// Sends [`register_pending_send`](Self::register_pending_send) registered,
-    /// for the loop's driver to take, each with the JS call stack that
-    /// registered it, if origins recording was active during registration.
+    /// Sends registered by
+    /// [`register_pending_send`](Self::register_pending_send), for the loop's
+    /// driver to take, each with the JS call stack that registered it, if
+    /// origins recording was active during registration.
     pending_sends: RefCell<Vec<(PendingSend, Option<Rc<str>>)>>,
 }
 
-/// A send, such as a response body's, that the loop's work can feed. The loop's
-/// driver awaits `done` while the loop has work, and calls `abandon` once no more
-/// work is left, after which `done` completes as well.
+/// A send that the loop's work can feed, such as sending a response body. The
+/// loop's driver awaits `done` while the loop has work, and calls `abandon` once
+/// no more work is left, after which `done` completes as well.
 pub struct PendingSend {
     pub done: std::pin::Pin<Box<dyn std::future::Future<Output = ()>>>,
     pub abandon: Box<dyn FnOnce()>,
@@ -490,8 +541,11 @@ impl EventLoop {
         Self {
             loop_id: NEXT_LOOP_ID.fetch_add(1, std::sync::atomic::Ordering::Relaxed),
             next_id: Cell::new(0),
-            tasks: RefCell::new(TaskQueue::default()),
-            js_timers: RefCell::new(HashMap::new()),
+            shared: Rc::new(LoopTasks {
+                tasks: RefCell::new(TaskQueue::default()),
+                js_timers: RefCell::new(HashMap::new()),
+                notify: Rc::clone(&notify),
+            }),
             batch_buf: RefCell::new(Vec::new()),
             stop_requested: Cell::new(false),
             interest: InterestTracker::new(Rc::clone(&notify)),
@@ -507,17 +561,7 @@ impl EventLoop {
     ///
     /// Returns the [`TaskId`] assigned to this task.
     pub fn queue(&self, task: Box<dyn Task>) -> TaskId {
-        let id = self.next_task_id();
-        // Read before `tasks` is borrowed: recording the origin can GC, which traces the loop.
-        let origin = js::stack::current_origin();
-        self.tasks.borrow_mut().insert(TaskEntry {
-            id,
-            task,
-            ready: false,
-            deadline: None,
-            origin,
-        });
-        id
+        self.insert_task(task, false)
     }
 
     /// Queue a task that is immediately ready to run.
@@ -525,17 +569,24 @@ impl EventLoop {
     /// This is a convenience for tasks that don't need to wait for an
     /// external event (e.g. resolved promises, `queueMicrotask` work).
     pub fn queue_ready(&self, task: Box<dyn Task>) -> TaskId {
+        self.insert_task(task, true)
+    }
+
+    /// Queue a task without a deadline, and wake the driver if it is `ready`.
+    fn insert_task(&self, task: Box<dyn Task>, ready: bool) -> TaskId {
         let id = self.next_task_id();
         // Read before `tasks` is borrowed: recording the origin can GC, which traces the loop.
         let origin = js::stack::current_origin();
-        self.tasks.borrow_mut().insert(TaskEntry {
+        self.shared.tasks.borrow_mut().insert(TaskEntry {
             id,
             task,
-            ready: true,
+            ready,
             deadline: None,
             origin,
         });
-        self.notify.notify(1);
+        if ready {
+            self.notify.notify(1);
+        }
         id
     }
 
@@ -559,7 +610,7 @@ impl EventLoop {
         deadline: Instant,
         origin: Option<Rc<str>>,
     ) {
-        self.tasks.borrow_mut().insert(TaskEntry {
+        self.shared.tasks.borrow_mut().insert(TaskEntry {
             id,
             task,
             ready: false,
@@ -575,77 +626,93 @@ impl EventLoop {
     /// in the queue (already run, or currently being executed by the driver)
     /// is left alone.
     pub fn cancel_if_queued(&self, id: TaskId) -> bool {
-        self.tasks.borrow_mut().remove(id).is_some()
+        self.shared.tasks.borrow_mut().remove(id).is_some()
     }
 
-    /// Queue a `setTimeout`/`setInterval` task under a fresh JS timer id.
+    /// Queue a `setTimeout`/`setInterval` task of the scope's global under a fresh JS timer id,
+    /// greater than zero and unique among the global's timers.
     pub fn queue_js_timer(
         &self,
         scope: &Scope<'_>,
         deadline: Instant,
         make_task: impl FnOnce(u64) -> Box<dyn Task>,
     ) -> u64 {
-        let timer_id = self.allocate_js_timer_id(scope);
+        let global = js::class::global_state::<GlobalTimers>(scope);
+        let timer_id = global.last_id.get() + 1;
+        assert!(
+            timer_id < js::conversion::Number::MAX,
+            "JS timer ids wrapped around"
+        );
+        global.last_id.set(timer_id);
         let task = self.next_task_id();
         let origin = js::stack::current_origin();
         self.insert_timer(task, make_task(timer_id), deadline, origin.clone());
-        self.js_timers
-            .borrow_mut()
-            .insert(timer_id, JsTimer { task, origin });
+        global.timers.borrow_mut().insert(
+            timer_id,
+            GlobalTimer {
+                tasks: Rc::downgrade(&self.shared),
+                task,
+            },
+        );
+        self.shared.js_timers.borrow_mut().insert(
+            task,
+            LoopTimer {
+                global: Rc::downgrade(&global),
+                timer_id,
+                origin,
+            },
+        );
         timer_id
     }
 
-    /// Re-queue an interval timer with the same JS timer id and [`TaskId`].
+    /// Re-queue the interval timer that controls the task `id`, under the same JS timer id and
+    /// [`TaskId`].
     ///
     /// If the timer was cleared while its callback ran (via `clearInterval`
-    /// from within the callback), the id no longer maps to this task and the
+    /// from within the callback), this loop no longer holds it, and the
     /// task is silently dropped instead of re-queued.
-    pub fn requeue_js_timer(
-        &self,
-        timer_id: u64,
-        id: TaskId,
-        task: Box<dyn Task>,
-        deadline: Instant,
-    ) {
-        let origin = match self.js_timers.borrow().get(&timer_id) {
-            Some(timer) if timer.task == id => timer.origin.clone(),
-            _ => return,
+    pub fn requeue_js_timer(&self, id: TaskId, task: Box<dyn Task>, deadline: Instant) {
+        let Some(origin) = self
+            .shared
+            .js_timers
+            .borrow()
+            .get(&id)
+            .map(|timer| timer.origin.clone())
+        else {
+            return;
         };
         self.insert_timer(id, task, deadline, origin);
     }
 
-    /// Cancel a JS timer by its `setTimeout`/`setInterval` id.
+    /// Cancel the JS timer of the scope's global with the `setTimeout`/`setInterval` id
+    /// `timer_id`, on the event loop that holds it. The driver of a loop other than this one is
+    /// woken afterwards.
     ///
     /// Invalid IDs are silently ignored per spec.
-    pub fn clear_js_timer(&self, timer_id: u64) {
-        let removed = self.js_timers.borrow_mut().remove(&timer_id);
-        if let Some(timer) = removed {
-            // If the task is still queued, remove it. If it is currently
-            // running (an interval clearing itself from its own callback),
-            // the now-missing map entry suppresses the re-queue instead.
-            self.cancel_if_queued(timer.task);
+    pub fn clear_js_timer(&self, scope: &Scope<'_>, timer_id: u64) {
+        let global = js::class::global_state::<GlobalTimers>(scope);
+        let Some(timer) = global.timers.borrow_mut().remove(&timer_id) else {
+            return;
+        };
+        let Some(tasks) = timer.tasks.upgrade() else {
+            return;
+        };
+        tasks.js_timers.borrow_mut().remove(&timer.task);
+        // If the task is still queued, remove it. If it is currently
+        // running (an interval clearing itself from its own callback),
+        // the now-missing timer suppresses the re-queue instead.
+        tasks.tasks.borrow_mut().remove(timer.task);
+        if !Rc::ptr_eq(&tasks, &self.shared) {
+            tasks.notify.notify(1);
         }
     }
 
-    /// Release a one-shot JS timer's id after it fired.
+    /// Release the id of the one-shot JS timer that controls the task `id`, after it fired.
     ///
     /// Mirrors HTML's "remove global's map of `setTimeout` and `setInterval`
     /// `IDs[id]`" task substep for non-repeating timers.
-    pub fn js_timer_fired(&self, timer_id: u64) {
-        self.js_timers.borrow_mut().remove(&timer_id);
-    }
-
-    /// Allocate the next JS timer id: greater than zero and not currently in
-    /// this loop's timer map.
-    fn allocate_js_timer_id(&self, scope: &Scope<'_>) -> u64 {
-        let key = &TIMER_ID_COUNTER_KEY as *const u8 as usize;
-        let js_timers = self.js_timers.borrow();
-        loop {
-            let id = js::class::next_global_counter(scope, key);
-            if id != 0 && !js_timers.contains_key(&id) {
-                return id;
-            }
-        }
+    pub fn js_timer_fired(&self, id: TaskId) {
+        self.shared.release_js_timer(id);
     }
 
     /// Mark a queued task as ready to run.
@@ -653,7 +720,7 @@ impl EventLoop {
     /// Has no effect if the task ID is not found (the task may have
     /// already been cancelled or run).
     pub fn signal_ready(&self, id: TaskId) {
-        if self.tasks.borrow_mut().mark_ready(id) {
+        if self.shared.tasks.borrow_mut().mark_ready(id) {
             self.notify.notify(1);
         }
     }
@@ -665,7 +732,7 @@ impl EventLoop {
     /// "Next" follows [`step`](Self::step)'s dispatch order: ready non-timer
     /// tasks in allocation order, then expired timers by deadline.
     pub fn pop_ready(&self) -> Option<(TaskId, Box<dyn Task>)> {
-        let mut tasks = self.tasks.borrow_mut();
+        let mut tasks = self.shared.tasks.borrow_mut();
         let &(_, id) = tasks.ready.first()?;
         let entry = tasks.remove(TaskId(id)).expect("ready tasks are live");
         Some((entry.id, entry.task))
@@ -677,7 +744,7 @@ impl EventLoop {
     /// Returns the number of timers that became ready.
     // TODO: consider merging with `time_to_next_timer` and returning the tasks directly.
     pub fn advance_timers(&self) -> usize {
-        self.tasks.borrow_mut().expire_timers(Instant::now())
+        self.shared.tasks.borrow_mut().expire_timers(Instant::now())
     }
 
     /// Returns the duration until the next timer fires, or `None` if
@@ -687,28 +754,28 @@ impl EventLoop {
     /// is already expired and [`advance_timers`](Self::advance_timers)
     /// should be called.
     pub fn time_to_next_timer(&self) -> Option<Duration> {
-        let &(deadline, _) = self.tasks.borrow().timers.first()?;
+        let &(deadline, _) = self.shared.tasks.borrow().timers.first()?;
         Some(deadline.saturating_duration_since(Instant::now()))
     }
 
     /// Returns `true` if there are any tasks (ready or not) in the queue.
     pub fn has_pending(&self) -> bool {
-        !self.tasks.borrow().entries.is_empty()
+        !self.shared.tasks.borrow().entries.is_empty()
     }
 
     /// Returns `true` if at least one task is in the ready state.
     pub fn has_ready(&self) -> bool {
-        !self.tasks.borrow().ready.is_empty()
+        !self.shared.tasks.borrow().ready.is_empty()
     }
 
     /// Returns the number of tasks currently queued (ready or not).
     pub fn len(&self) -> usize {
-        self.tasks.borrow().entries.len()
+        self.shared.tasks.borrow().entries.len()
     }
 
     /// Returns `true` if the event loop has no tasks.
     pub fn is_empty(&self) -> bool {
-        self.tasks.borrow().entries.is_empty()
+        self.shared.tasks.borrow().entries.is_empty()
     }
 
     // -----------------------------------------------------------------------
@@ -803,7 +870,7 @@ impl EventLoop {
     ///
     /// Tasks come first, in the order they were queued, then interest, then futures, then sends.
     pub fn pending_work(&self) -> Vec<PendingWork> {
-        let tasks = self.tasks.borrow();
+        let tasks = self.shared.tasks.borrow();
         let mut entries: Vec<&TaskEntry> = tasks.entries.values().collect();
         entries.sort_unstable_by_key(|entry| entry.id.0);
         let mut work: Vec<PendingWork> = entries
@@ -960,7 +1027,7 @@ unsafe fn settle_completed_futures(
         // SAFETY: guaranteed by this function's caller.
         let scope = unsafe { js::gc::scope::RootScope::from_current_realm(raw_cx) };
         if completed.is_empty() {
-            // A poll that completed nothing can still have run JS, such as the
+            // A poll that didn't complete a future can still have run JS, such as the
             // lowering of a stream nested in a stream element, which queues
             // microtasks.
             if jobs::has_pending_jobs(&scope) {
@@ -1191,14 +1258,21 @@ impl EventLoop {
         // ties broken the same way, which is the order of the ready set. The batch buffer is
         // reused to keep the path allocation-free.
         let mut batch = self.batch_buf.take();
-        batch.extend(self.tasks.borrow().ready.iter().map(|&(_, id)| TaskId(id)));
+        batch.extend(
+            self.shared
+                .tasks
+                .borrow()
+                .ready
+                .iter()
+                .map(|&(_, id)| TaskId(id)),
+        );
         let mut ran_any = false;
         for &id in &batch {
             // Take the task out before running it, ending the borrow: the
             // task's JS can re-enter this loop (setTimeout, clearTimeout)
             // through `with_active_event_loop`. Re-locate by id — an earlier
             // task in the batch may have cancelled this one.
-            let Some(entry) = self.tasks.borrow_mut().remove(id) else {
+            let Some(entry) = self.shared.tasks.borrow_mut().remove(id) else {
                 continue;
             };
             if entry.task.run(scope, id).is_err() {
@@ -1239,7 +1313,7 @@ impl EventLoop {
     /// allocation points, and no `tasks` borrow is held across a call into JS, so the borrow here
     /// cannot conflict.
     pub unsafe fn trace(&self, trc: *mut JSTracer) {
-        for entry in self.tasks.borrow().entries.values() {
+        for entry in self.shared.tasks.borrow().entries.values() {
             entry.task.trace(trc);
         }
     }
@@ -1258,6 +1332,15 @@ impl Default for EventLoop {
     }
 }
 
+impl Drop for EventLoop {
+    fn drop(&mut self) {
+        let timers = std::mem::take(&mut *self.shared.js_timers.borrow_mut());
+        for timer in timers.into_values() {
+            timer.release();
+        }
+    }
+}
+
 // ---------------------------------------------------------------------------
 // Helpers
 // ---------------------------------------------------------------------------
@@ -1270,7 +1353,8 @@ impl Default for EventLoop {
 ///
 /// Any `FinalizationRegistry` cleanup a collection queued runs first, so a
 /// callback's own microtasks are drained in the same turn. A promise rejected
-/// with no handler attached by the end of the drain is reported on stderr.
+/// with no handler attached by the end of the drain is reported on stderr. The
+/// messages [`crate::diagnostics::report_later`] queued are reported last.
 pub fn run_microtasks(scope: &Scope<'_>) {
     debug_assert!(
         !js::exception::is_pending(scope),
@@ -1280,6 +1364,7 @@ pub fn run_microtasks(scope: &Scope<'_>) {
     jobs::run_jobs(scope);
     // Weak-ref set is cleared by run_jobs.
     report_unhandled_rejections(scope);
+    crate::diagnostics::report_queued();
 }
 
 /// Report each promise that was rejected with no handler attached, and still has none, on
diff --git a/crates/core-runtime/src/event_loop/interest.rs b/crates/core-runtime/src/event_loop/interest.rs
index ee98b86c..8f4732b4 100644
--- a/crates/core-runtime/src/event_loop/interest.rs
+++ b/crates/core-runtime/src/event_loop/interest.rs
@@ -145,16 +145,11 @@ mod tests {
         InterestTracker::new(Rc::new(Event::new()))
     }
 
-    #[test]
-    fn starts_at_zero() {
-        let tracker = tracker();
-        assert!(!tracker.has_interest());
-        assert_eq!(tracker.count(), 0);
-    }
-
     #[test]
     fn acquire_and_release() {
         let tracker = tracker();
+        assert_eq!(tracker.count(), 0);
+        assert!(!tracker.has_interest());
         let first = tracker.acquire_handle();
         assert!(tracker.has_interest());
         assert_eq!(tracker.count(), 1);
diff --git a/crates/core-runtime/src/event_loop/timer.rs b/crates/core-runtime/src/event_loop/timer.rs
index 41b41d6c..9b0be7e0 100644
--- a/crates/core-runtime/src/event_loop/timer.rs
+++ b/crates/core-runtime/src/event_loop/timer.rs
@@ -16,8 +16,7 @@ use platform::clock::Instant;
 use std::time::Duration;
 
 use js::error::ExnThrown;
-use js::gc::handle::Heap;
-use js::heap::RootedTraceableBox;
+use js::gc::handle::RootedHeap;
 use js::native::Value;
 use js::prelude::HandleValue;
 
@@ -29,11 +28,11 @@ use super::{with_active_event_loop, Task, TaskId};
 /// a string to evaluate as a classic script when the timer fires.
 enum TimerHandler {
     Function {
-        callback: RootedTraceableBox<Heap<js::function::Callable>>,
+        callback: RootedHeap<js::function::Callable>,
         /// The `setTimeout`/`setInterval` arguments after the timeout, passed
         /// to the callback on every invocation (HTML timer initialization
         /// steps: "invoke handler given arguments").
-        args: Vec<RootedTraceableBox<Heap<Value>>>,
+        args: Vec<RootedHeap<Value>>,
     },
     Code(String),
 }
@@ -77,37 +76,6 @@ pub struct TimerTask {
     timer_id: u64,
 }
 
-impl TimerTask {
-    /// Create a timer task with a function handler and its call arguments.
-    fn function(
-        callback: js::Callable<'_>,
-        args: Vec<RootedTraceableBox<Heap<Value>>>,
-        interval: Option<Duration>,
-        nesting_level: u32,
-        timer_id: u64,
-    ) -> Self {
-        Self {
-            handler: TimerHandler::Function {
-                callback: RootedTraceableBox::new(Heap::from(callback)),
-                args,
-            },
-            interval,
-            nesting_level,
-            timer_id,
-        }
-    }
-
-    /// Create a timer task whose handler is a code string evaluated when it fires.
-    fn code(code: String, interval: Option<Duration>, nesting_level: u32, timer_id: u64) -> Self {
-        Self {
-            handler: TimerHandler::Code(code),
-            interval,
-            nesting_level,
-            timer_id,
-        }
-    }
-}
-
 impl Task for TimerTask {
     fn kind(&self) -> &'static str {
         if self.interval.is_some() {
@@ -146,7 +114,7 @@ impl Task for TimerTask {
         // — even when the handler threw. The spec's task substeps invoke the handler with "report"
         // (the exception is reported, not fatal) and still perform the repeat step, so a transient
         // error must not kill the interval. If the ID was cancelled during the run (via
-        // clearInterval), requeue_timer skips it. The repeat re-enters the timer initialization
+        // clearInterval), requeue_js_timer skips it. The repeat re-enters the timer initialization
         // steps, so the nested-timer clamp applies with this task's nesting level, and the
         // re-queued task is one level deeper.
         if let Some(interval) = interval {
@@ -158,13 +126,13 @@ impl Task for TimerTask {
                 timer_id,
             };
             with_active_event_loop(|el| {
-                el.requeue_js_timer(timer_id, id, Box::new(new_task), Instant::now() + delay);
+                el.requeue_js_timer(id, Box::new(new_task), Instant::now() + delay);
             });
         } else {
             // One-shot: release the timer id, mirroring HTML's "remove
             // global's map of setTimeout and setInterval IDs[id]" substep
             // after the handler ran.
-            with_active_event_loop(|el| el.js_timer_fired(timer_id));
+            with_active_event_loop(|el| el.js_timer_fired(id));
         }
 
         if failed {
@@ -225,15 +193,15 @@ mod timer_globals {
     }
 
     /// <https://html.spec.whatwg.org/#dom-cleartimeout>
-    pub fn clear_timeout(id: Option<u64>) {
+    pub fn clear_timeout(scope: &Scope<'_>, id: Option<u64>) {
         // `remove` `this`'s `map of setTimeout and setInterval IDs`[_id_].
-        super::with_active_event_loop(|el| el.clear_js_timer(id.unwrap_or(0)));
+        super::with_active_event_loop(|el| el.clear_js_timer(scope, id.unwrap_or(0)));
     }
 
     /// <https://html.spec.whatwg.org/#dom-clearinterval>
-    pub fn clear_interval(id: Option<u64>) {
+    pub fn clear_interval(scope: &Scope<'_>, id: Option<u64>) {
         // `remove` `this`'s `map of setTimeout and setInterval IDs`[_id_].
-        super::with_active_event_loop(|el| el.clear_js_timer(id.unwrap_or(0)));
+        super::with_active_event_loop(|el| el.clear_js_timer(scope, id.unwrap_or(0)));
     }
 }
 
@@ -268,31 +236,35 @@ fn timer_initialization_steps(
     // HTML timer initialization steps: "Let arguments be... the rest of the arguments"
     // For the handler form, everything after the timeout is forwarded to the callback on every
     // invocation. For the string form, additional arguments are ignored.
-    let extra_args: Vec<RootedTraceableBox<Heap<Value>>> = match &callable {
+    let extra_args: Vec<RootedHeap<Value>> = match &callable {
         Some(_) => arguments
             .iter()
-            .map(|arg| RootedTraceableBox::new(Heap::from(arg.get())))
+            .map(|arg| RootedHeap::from(arg.get()))
             .collect(),
         None => Vec::new(),
     };
 
     // Queue on the current event loop.
     let timer_id = with_active_event_loop(|el| {
-        el.queue_js_timer(scope, deadline, |timer_id| match callable {
-            Some(callback) => Box::new(TimerTask::function(
-                callback,
-                extra_args,
-                interval,
-                task_nesting,
-                timer_id,
-            )),
-            None => {
+        el.queue_js_timer(scope, deadline, |timer_id| {
+            let handler = match callable {
+                Some(callback) => TimerHandler::Function {
+                    callback: RootedHeap::new(callback),
+                    args: extra_args,
+                },
                 // Not callable: run the handler's string as code. The HTML timer initialization
                 // steps create a new classic script from it each time the timer fires, so the
                 // string is kept rather than a compiled script.
-                let code = code.expect("non-callable handler was converted to a string above");
-                Box::new(TimerTask::code(code, interval, task_nesting, timer_id))
-            }
+                None => TimerHandler::Code(
+                    code.expect("non-callable handler was converted to a string above"),
+                ),
+            };
+            Box::new(TimerTask {
+                handler,
+                interval,
+                nesting_level: task_nesting,
+                timer_id,
+            })
         })
     });
 
diff --git a/crates/core-runtime/src/finalization.rs b/crates/core-runtime/src/finalization.rs
index 859394e2..4e5502fe 100644
--- a/crates/core-runtime/src/finalization.rs
+++ b/crates/core-runtime/src/finalization.rs
@@ -70,8 +70,8 @@ pub fn install(cx: &mut JSContext) {
 /// A callback that throws leaves the remaining ones to run: its exception is
 /// reported and cleared.
 pub fn run_pending(scope: &Scope<'_>) {
-    // Taken one at a time so the undrained functions stay in the traced queue
-    // through any GC a callback triggers.
+    // Take the functions one at a time, so the undrained functions stay in the
+    // traced queue through any GC a callback triggers.
     while let Some(fval) =
         with_pending(|cell| cell.borrow_mut().0.pop_front().map(|h| h.get(scope)))
     {
diff --git a/crates/core-runtime/src/invocation.rs b/crates/core-runtime/src/invocation.rs
index 2b59f6e1..b8f141b5 100644
--- a/crates/core-runtime/src/invocation.rs
+++ b/crates/core-runtime/src/invocation.rs
@@ -8,10 +8,6 @@
 //! libstarling, componentize-js) decides how many invocations run
 //! concurrently and schedules them.
 //!
-//! Note: right now there's no additional metadata, but in the future this
-//! will include things like information about which incoming event started
-//! an invocation.
-//!
 //! [`InvocationRegistry`] tracks all live `InvocationState` instances so
 //! the GC can trace their event loops during garbage collection.
 
@@ -216,12 +212,6 @@ impl Drop for OwnedInvocation {
 mod tests {
     use super::*;
 
-    #[test]
-    fn invocation_state_default() {
-        let state = InvocationState::new();
-        assert!(state.event_loop().is_empty());
-    }
-
     #[test]
     fn registry_register_unregister() {
         let mut registry = InvocationRegistry::new();
diff --git a/crates/core-runtime/src/lib.rs b/crates/core-runtime/src/lib.rs
index db82e154..0c399c44 100644
--- a/crates/core-runtime/src/lib.rs
+++ b/crates/core-runtime/src/lib.rs
@@ -1,6 +1,7 @@
 // SPDX-License-Identifier: Apache-2.0-WITH-LLVM-exception
 
 pub mod config;
+pub mod diagnostics;
 pub mod event_loop;
 pub mod finalization;
 pub mod invocation;
@@ -218,13 +219,14 @@ impl ScriptEvaluation {
     }
 }
 
-/// Initialize the runtime and evaluate the script (the synchronous portion of an
-/// invocation), draining initial microtasks. Returns the runtime and its
-/// invocation, with the invocation unregistered from the GC tracer. It is
-/// registered only for the eval phase here, then unregistered before being moved
-/// out, since the registry holds a raw pointer that the move would invalidate. The
-/// caller re-registers at the final location, drives the loop, then unregisters.
-fn init_and_eval(
+/// Like [`setup`], but always returns the runtime, for serve mode, where the runtime must
+/// outlive the script (which registers `fetch` handlers) so it can handle incoming requests.
+/// Initializes the runtime and evaluates the script, draining initial microtasks. The returned
+/// invocation holds the script's initial event loop, and is unregistered from the GC tracer: the
+/// registry holds a raw pointer that moving the invocation out would invalidate. The caller
+/// re-registers it at its final location, drives it to completion (the script's top-level async)
+/// before serving, then unregisters it and keeps the runtime alive for the accept loop.
+pub fn setup_for_serve(
     config: config::RuntimeConfig,
 ) -> Result<
     (
@@ -299,7 +301,7 @@ pub fn setup(
     )>,
     String,
 > {
-    let (runtime, invocation, evaluation) = init_and_eval(config)?;
+    let (runtime, invocation, evaluation) = setup_for_serve(config)?;
     if !invocation.event_loop().is_alive() {
         let settled = evaluation.settled(&runtime.default_global(), "Script evaluation failed");
         drop(evaluation);
@@ -308,24 +310,6 @@ pub fn setup(
     Ok(Some((runtime, invocation, evaluation)))
 }
 
-/// Like [`setup`], but always returns the runtime — for **serve mode**, where the
-/// runtime must outlive the script (which registers `fetch` handlers) so it can
-/// handle incoming requests. The returned invocation holds the script's initial
-/// event loop; drive it to completion (the script's top-level async) before
-/// serving, then keep the runtime alive for the accept loop.
-pub fn setup_for_serve(
-    config: config::RuntimeConfig,
-) -> Result<
-    (
-        std::rc::Rc<Runtime>,
-        invocation::InvocationState,
-        ScriptEvaluation,
-    ),
-    String,
-> {
-    init_and_eval(config)
-}
-
 #[cfg(test)]
 mod tests {
     use super::config::RuntimeConfig;
@@ -339,7 +323,7 @@ mod tests {
     /// Event-loop driver for tests whose scripts complete synchronously.
     ///
     /// `run` only invokes the driver when the script left async work in the
-    /// event loop, so for these tests being called at all is a failure.
+    /// event loop, so the driver fails these tests if it is called at all.
     fn noop_driver(
         _runtime: std::rc::Rc<runtime::Runtime>,
         _invocation: invocation::InvocationState,
@@ -366,18 +350,6 @@ mod tests {
             .expect("Run failed");
     }
 
-    #[test]
-    fn run_file_module_mode() {
-        let dir = test_tempdir();
-        let script = dir.path().join("test.mjs");
-        std::fs::write(&script, "const x = 1 + 2;\n").unwrap();
-
-        let config = config_from(&["starling", &script.to_string_lossy()]);
-        run(config, noop_driver)
-            .map_err(|e| println!("{e}"))
-            .expect("Run failed");
-    }
-
     #[test]
     fn run_file_legacy_script() {
         let dir = test_tempdir();
@@ -390,23 +362,6 @@ mod tests {
             .expect("Run failed");
     }
 
-    #[test]
-    fn run_file_with_imports() {
-        let dir = test_tempdir();
-        std::fs::write(dir.path().join("helper.js"), "export const V = 10;\n").unwrap();
-        let entry = dir.path().join("main.mjs");
-        std::fs::write(
-            &entry,
-            r#"import { V } from "./helper.js"; globalThis._v = V;"#,
-        )
-        .unwrap();
-
-        let config = config_from(&["starling", &entry.to_string_lossy()]);
-        run(config, noop_driver)
-            .map_err(|e| println!("{e}"))
-            .expect("Run failed");
-    }
-
     #[test]
     fn run_with_initializer_script() {
         let dir = test_tempdir();
diff --git a/crates/core-runtime/src/module.rs b/crates/core-runtime/src/module.rs
index f130b9d6..c4f5122e 100644
--- a/crates/core-runtime/src/module.rs
+++ b/crates/core-runtime/src/module.rs
@@ -18,7 +18,7 @@
 //!    `JS_DefineFunction`
 //!
 //! A module load hook maps specifier strings to compiled module objects
-//! via a thread-local registry.
+//! via the runtime's module registry.
 //!
 //! # Example
 //!
@@ -32,10 +32,8 @@
 //! // Register and use:
 //! let rt = Runtime::init(&config).expect("runtime init");
 //! let scope = rt.default_global();
-//! unsafe {
-//!     register_module::<my_math::js_module>(&scope);
-//!     // JS can now: import { PI, add } from "myMath";
-//! }
+//! register_module::<my_math::js_module>(&scope);
+//! // JS can now: import { PI, add } from "myMath";
 //! ```
 //!
 //! The specifier is the `mod` name camelCased, unless overridden with
@@ -109,7 +107,7 @@ pub trait NativeModule: 'static {
 }
 
 // ============================================================================
-// Module registry (thread-local)
+// Module registry
 // ============================================================================
 
 /// A cached compiled module object, stored in a `Heap` so SpiderMonkey's
@@ -158,6 +156,43 @@ fn base_path<R>(f: impl FnOnce(&RefCell<Option<PathBuf>>) -> R) -> R {
     with_state(|state| f(&state.base_path))
 }
 
+/// The module the registry holds under `key`.
+fn cached_module<'s>(scope: &'s Scope<'_>, key: &str) -> Option<Object<'s>> {
+    registry(|reg| {
+        reg.borrow()
+            .get(key)
+            .map(|entry| entry.module_obj.get(scope))
+    })
+}
+
+/// The module the registry holds under a versioned WIT interface name compatible
+/// with `specifier`'s (see [`wit_name_mapping::same_interface`]), at the highest
+/// version if it holds several. `None` if `specifier` has no version.
+fn compatible_cached_module<'s>(scope: &'s Scope<'_>, specifier: &str) -> Option<Object<'s>> {
+    if !specifier.contains('@') {
+        return None;
+    }
+    registry(|reg| {
+        let reg = reg.borrow();
+        reg.iter()
+            .filter(|(key, _)| wit_name_mapping::same_interface(key, specifier))
+            .max_by_key(|(key, _)| wit_name_mapping::interface_version(key))
+            .map(|(_, entry)| entry.module_obj.get(scope))
+    })
+}
+
+/// Hold `module` in the registry under `key`.
+fn cache_module(key: String, module: Object<'_>) {
+    registry(|reg| {
+        reg.borrow_mut().insert(
+            key,
+            ModuleEntry {
+                module_obj: Heap::from(module),
+            },
+        );
+    });
+}
+
 /// Trace all cached module objects.
 ///
 /// # Safety
@@ -227,7 +262,7 @@ pub fn settled_module_evaluation<'s>(
     eval_result: HandleValue<'s>,
     context: &str,
 ) -> Result<Option<js::Promise<'s>>, String> {
-    let Some(promise) = js::Object::from_value(scope, eval_result.get())
+    let Some(promise) = js::Object::from_value(scope, eval_result)
         .ok()
         .and_then(|object| object.cast::<js::Promise>().ok())
     else {
@@ -316,14 +351,14 @@ unsafe extern "C" fn module_load_hook(
         }
     };
 
-    // 1. Check the module registry for an exact match. The `json:`-prefixed keys
-    // hold JSON modules, which a JavaScript import never gets.
+    // 1. Check the module registry for an exact match, then for a compatible
+    // version of a versioned WIT interface name. The `json:`-prefixed
+    // keys hold JSON modules, which a JavaScript import never gets.
     let cached = match kind {
-        ModuleKind::JavaScript if !specifier.starts_with("json:") => registry(|reg| {
-            reg.borrow()
-                .get(&specifier)
-                .map(|entry| entry.module_obj.get(&scope))
-        }),
+        ModuleKind::JavaScript if !specifier.starts_with("json:") => {
+            cached_module(&scope, &specifier)
+                .or_else(|| compatible_cached_module(&scope, &specifier))
+        }
         ModuleKind::JavaScript | ModuleKind::Json => None,
     };
 
@@ -412,6 +447,17 @@ fn resolve_file_module<'r>(
 ) -> Result<Object<'r>, ModuleLoadError> {
     let base_dir = base_dir
         .ok_or_else(|| format!("Module '{}' not found (no base path configured)", specifier))?;
+    // `oxc_resolver` converts `file:` URLs to paths only when it isn't compiled for wasm32.
+    let file_path;
+    let target = if specifier.starts_with("file:") {
+        file_path = url::Url::parse(specifier)
+            .ok()
+            .and_then(|url| url.to_file_path().ok())
+            .ok_or_else(|| format!("Cannot resolve module '{specifier}': invalid file URL"))?;
+        file_path.to_str().unwrap_or(specifier)
+    } else {
+        specifier
+    };
 
     // Resolve using oxc_resolver
     let resolved_path = resolver(|r| {
@@ -420,7 +466,7 @@ fn resolve_file_module<'r>(
             .as_ref()
             .expect("resolver not initialized — call init_module_loader first");
         resolver
-            .resolve(&base_dir, specifier)
+            .resolve(&base_dir, target)
             .map(|res| res.path().to_path_buf())
             .map_err(|e| format!("Cannot resolve module '{}': {}", specifier, e))
     })?;
@@ -455,11 +501,7 @@ fn resolve_file_module<'r>(
     };
 
     // Check if already compiled under the canonical path
-    let cached = registry(|reg| {
-        reg.borrow()
-            .get(&cache_key)
-            .map(|entry| entry.module_obj.get(scope))
-    });
+    let cached = cached_module(scope, &cache_key);
     if let Some(obj) = cached {
         return Ok(obj);
     }
@@ -496,14 +538,7 @@ fn resolve_file_module<'r>(
         }
     };
 
-    registry(|reg| {
-        reg.borrow_mut().insert(
-            cache_key,
-            ModuleEntry {
-                module_obj: Heap::from(module),
-            },
-        );
-    });
+    cache_module(cache_key, module);
 
     Ok(module)
 }
@@ -528,14 +563,7 @@ pub fn register_entry_module(
     let path_str = js::JSString::from_str(scope, &key).map_err(|_| ExnThrown)?;
     // SAFETY: `module` is a rooted module object, and `path_str` is rooted.
     unsafe { SetModulePrivate(module.as_raw(), &path_str.as_value()) };
-    registry(|reg| {
-        reg.borrow_mut().insert(
-            key.clone(),
-            ModuleEntry {
-                module_obj: Heap::from(module),
-            },
-        );
-    });
+    cache_module(key.clone(), module);
     with_state(|state| *state.entry.borrow_mut() = Some(key));
     Ok(())
 }
@@ -545,14 +573,7 @@ pub fn register_entry_module(
 /// under canonical absolute paths, so only an import whose specifier is `name`
 /// verbatim gets `module`.
 fn record_entry_module(module: Object<'_>, name: &str) {
-    registry(|reg| {
-        reg.borrow_mut().insert(
-            name.to_string(),
-            ModuleEntry {
-                module_obj: Heap::from(module),
-            },
-        );
-    });
+    cache_module(name.to_string(), module);
     with_state(|state| *state.entry.borrow_mut() = Some(name.to_string()));
 }
 
@@ -561,11 +582,7 @@ fn record_entry_module(module: Object<'_>, name: &str) {
 /// namespace is only complete once the module has finished evaluating.
 pub fn entry_namespace<'s>(scope: &'s Scope<'_>) -> Option<Object<'s>> {
     let key = with_state(|state| state.entry.borrow().clone())?;
-    let module = registry(|reg| {
-        reg.borrow()
-            .get(&key)
-            .map(|entry| entry.module_obj.get(scope))
-    })?;
+    let module = cached_module(scope, &key)?;
     js::module::get_namespace(scope, module.handle())
         .ok()
         .and_then(Object::from_handle)
@@ -670,12 +687,12 @@ pub(crate) fn clear_module_state(state: &ModuleState) {
 /// 2. Compiles it as a module via `CompileModule`
 /// 3. Links and evaluates the module
 /// 4. Populates the module environment with native functions and values
-/// 5. Stores the module in the thread-local registry for the load hook
+/// 5. Stores the module in the runtime's module registry for the load hook
 ///
-/// # Safety
+/// # Panics
 ///
-/// - [`init_module_loader`] must have been called first.
-pub unsafe fn register_module<T: NativeModule>(scope: &Scope<'_>) -> bool {
+/// Panics if no runtime is current.
+pub fn register_module<T: NativeModule>(scope: &Scope<'_>) -> bool {
     let declarations = T::declarations();
 
     // 1. Generate JS module source: `export var name1; export var name2; ...`
@@ -703,14 +720,7 @@ pub unsafe fn register_module<T: NativeModule>(scope: &Scope<'_>) -> bool {
     // `export var` source has no imports to resolve.
 
     // 3. Store in registry before loading (load hook must find it)
-    registry(|reg| {
-        reg.borrow_mut().insert(
-            T::NAME.to_string(),
-            ModuleEntry {
-                module_obj: Heap::from(module),
-            },
-        );
-    });
+    cache_module(T::NAME.to_string(), module);
 
     // 4.-6. Link, evaluate, and populate the environment. On any failure,
     // remove the registry entry again so a later import of the module fails
@@ -750,7 +760,7 @@ fn link_evaluate_and_populate<T: NativeModule>(
                 Ok(f) => f,
                 Err(_) => return false,
             };
-            if env.set_property(scope, &c_name, func).is_err() {
+            if env.set_property_by_name(scope, &c_name, func).is_err() {
                 return false;
             }
         }
@@ -792,7 +802,7 @@ fn link_evaluate_and_get_env<'s>(scope: &'s Scope<'_>, module: Object<'_>) -> Op
 ///
 /// This generalizes [`register_module`] for callers that synthesize a module's
 /// exports at runtime rather than from a static [`NativeModule`] type: the
-/// component-model interpreter builds one such module per imported WIT interface,
+/// `wit-bridge` interpreter builds one such module per imported WIT interface,
 /// keyed by the interface's WIT specifier (e.g. `"test:iface/x@0.2.0"`), with
 /// the import functions and resource classes as exports.
 ///
@@ -804,12 +814,10 @@ fn link_evaluate_and_get_env<'s>(scope: &'s Scope<'_>, module: Object<'_>) -> Op
 /// [`register_module`]: a later import then fails to resolve rather than finding
 /// a module whose value exports are undefined.
 ///
-/// # Safety
+/// # Panics
 ///
-/// - [`init_module_loader`] must have been called first.
-/// - `exports`' value handles must be live and rooted for the duration of the
-///   call.
-pub unsafe fn register_synthetic_module(
+/// Panics if no runtime is current.
+pub fn register_synthetic_module(
     scope: &Scope<'_>,
     name: &str,
     exports: &[(&str, HandleValue)],
@@ -834,14 +842,7 @@ pub unsafe fn register_synthetic_module(
 
     // 3. Store in the registry under the owned specifier before linking, so the
     //    load hook finds it.
-    registry(|reg| {
-        reg.borrow_mut().insert(
-            name.to_string(),
-            ModuleEntry {
-                module_obj: Heap::from(module),
-            },
-        );
-    });
+    cache_module(name.to_string(), module);
 
     // 4.-6. Link, evaluate, and populate the environment with the export values.
     // On any failure, remove the registry entry again.
@@ -865,7 +866,7 @@ fn link_evaluate_and_populate_values(
 
     for (export_name, value) in exports {
         let c_name = CString::new(*export_name).map_err(|_| ExnThrown)?;
-        env.set_property(scope, &c_name, *value)?;
+        env.set_property_by_name(scope, &c_name, *value)?;
     }
     Ok(())
 }
@@ -888,14 +889,6 @@ pub unsafe fn evaluate_module<'s>(
     source: &str,
     filename: &str,
 ) -> Result<HandleValue<'s>, ExnThrown> {
-    let c_filename = CString::new(filename).unwrap();
-    let options = js::compile::options(scope, c_filename, 1);
-
-    let mut src = transform_str_to_source_text(source);
-    // SAFETY: `options` and `src` are live locals.
-    let module = unsafe { js::module::compile_module(scope, options.ptr, &mut src) }
-        .map_err(|_| ExnThrown)?;
-
     // If the filename is a path in an existing directory, or a file in the
     // current directory, register the entry as that file's module. Other entries
     // (eval scripts, synthetic filenames) are recorded as the entry only, and
@@ -905,10 +898,42 @@ pub unsafe fn evaluate_module<'s>(
         Some(parent) if !parent.as_os_str().is_empty() => parent.exists(),
         _ => path.is_file(),
     };
-    if is_path {
-        register_entry_module(scope, module, path)?;
-    } else {
-        record_entry_module(module, filename);
+    // SAFETY: the caller guarantees the module loader was initialized.
+    unsafe { evaluate_entry_module(scope, source, filename, is_path.then_some(path)) }
+}
+
+/// Evaluate `source` as the entry module, compiled under `name`, which stack
+/// traces and error messages show for it.
+///
+/// With a `path`, the module is registered as the module of that file (see
+/// [`register_entry_module`]). Without one, it is recorded as the entry under
+/// `name` only, and its relative imports resolve against the loader's base path.
+/// Either way, [`entry_namespace`] reads its namespace afterwards.
+///
+/// # Panics
+///
+/// Panics if `name` contains a NUL character.
+///
+/// # Safety
+///
+/// [`init_module_loader`] must have been called first.
+pub unsafe fn evaluate_entry_module<'s>(
+    scope: &'s Scope<'_>,
+    source: &str,
+    name: &str,
+    path: Option<&Path>,
+) -> Result<HandleValue<'s>, ExnThrown> {
+    let c_name = CString::new(name).expect("module names contain no NUL character");
+    let options = js::compile::options(scope, c_name, 1);
+
+    let mut src = transform_str_to_source_text(source);
+    // SAFETY: `options` and `src` are live locals.
+    let module = unsafe { js::module::compile_module(scope, options.ptr, &mut src) }
+        .map_err(|_| ExnThrown)?;
+
+    match path {
+        Some(path) => register_entry_module(scope, module, path)?,
+        None => record_entry_module(module, name),
     }
 
     js::module::load_requested_modules(scope, module).map_err(|_| ExnThrown)?;
@@ -931,7 +956,7 @@ pub unsafe fn set_module_export<'s, V: ToJSVal<'s> + ?Sized>(
 ) -> bool {
     let c_name = CString::new(name).unwrap();
     let env_obj = js::Object::from_handle(env).expect("module environment object is null");
-    env_obj.set_property(scope, &c_name, value).is_ok()
+    env_obj.set_property_by_name(scope, &c_name, value).is_ok()
 }
 
 #[cfg(test)]
@@ -991,6 +1016,11 @@ mod tests {
         }
     }
 
+    /// The `file:` URL of the absolute `path`.
+    fn file_url(path: &str) -> String {
+        url::Url::from_file_path(path).unwrap().to_string()
+    }
+
     /// Helper: read back a globalThis property as String.
     fn read_global_string(scope: &js::gc::scope::Scope<'_>, expr: &str) -> String {
         let rval = evaluate_with_filename(scope, expr, "test_read.js", 1)
@@ -999,17 +1029,6 @@ mod tests {
         String::from_jsval(scope, rval, ()).expect("string conversion failed")
     }
 
-    #[test]
-    fn evaluate_module_inline() {
-        let rt = test_runtime();
-        let scope = rt.default_global();
-        unsafe {
-            let result = evaluate_module(&scope, "globalThis._moduleTest = 42;", "test_inline.mjs");
-            assert!(result.is_ok());
-            assert_eq!(read_global_f64(&scope, "globalThis._moduleTest"), 42.0);
-        }
-    }
-
     #[test]
     fn evaluate_module_syntax_error_fails() {
         let rt = test_runtime();
@@ -1021,57 +1040,38 @@ mod tests {
     }
 
     #[test]
-    fn resolve_file_import() {
+    fn file_urls_extensionless_paths_and_directories_resolve() {
         let dir = test_tempdir();
-        let module_path = dir.path().join("helper.js");
-        std::fs::write(&module_path, "export const VALUE = 99;\n").unwrap();
+        let helper_path = dir.path().join("helper.js");
+        std::fs::write(&helper_path, "export const VALUE = 7;\n").unwrap();
+        std::fs::write(dir.path().join("utils.js"), "export const RATIO = 2.5;\n").unwrap();
+        let lib = dir.path().join("mylib");
+        std::fs::create_dir(&lib).unwrap();
+        std::fs::write(lib.join("index.js"), "export const HELLO = 'world';\n").unwrap();
 
         let rt = test_runtime();
         rt.reset_module_loader(dir.path().to_path_buf());
         let scope = rt.default_global();
+        let url = file_url(helper_path.to_str().unwrap());
         unsafe {
             let result = evaluate_module(
                 &scope,
-                r#"
-                    import { VALUE } from "./helper.js";
+                &format!(
+                    r#"
+                    import {{ VALUE }} from {url:?};
+                    import {{ RATIO }} from "./utils";
+                    import {{ HELLO }} from "./mylib";
                     globalThis._imported = VALUE;
-                "#,
+                    globalThis._ratio = RATIO;
+                    globalThis._hello = HELLO;
+                "#
+                ),
                 "entry.mjs",
             );
             assert!(result.is_ok(), "module evaluation failed");
-            assert_eq!(read_global_f64(&scope, "globalThis._imported"), 99.0);
-        }
-    }
-
-    #[test]
-    fn resolve_nested_imports() {
-        let dir = test_tempdir();
-
-        // a.js imports from b.js, b.js imports from c.js
-        std::fs::write(dir.path().join("c.js"), "export const BASE = 10;\n").unwrap();
-        std::fs::write(
-            dir.path().join("b.js"),
-            r#"
-                import { BASE } from "./c.js";
-                export const DOUBLED = BASE * 2;
-            "#,
-        )
-        .unwrap();
-
-        let rt = test_runtime();
-        rt.reset_module_loader(dir.path().to_path_buf());
-        let scope = rt.default_global();
-        unsafe {
-            let result = evaluate_module(
-                &scope,
-                r#"
-                    import { DOUBLED } from "./b.js";
-                    globalThis._nested = DOUBLED;
-                "#,
-                &dir.path().join("entry.mjs").to_string_lossy(),
-            );
-            assert!(result.is_ok(), "nested module evaluation failed");
-            assert_eq!(read_global_f64(&scope, "globalThis._nested"), 20.0);
+            assert_eq!(read_global_f64(&scope, "globalThis._imported"), 7.0);
+            assert_eq!(read_global_f64(&scope, "globalThis._ratio"), 2.5);
+            assert_eq!(read_global_string(&scope, "globalThis._hello"), "world");
         }
     }
 
@@ -1207,86 +1207,53 @@ mod tests {
     }
 
     #[test]
-    fn resolve_with_extension_inference() {
-        let dir = test_tempdir();
-        std::fs::write(dir.path().join("utils.js"), "export const RATIO = 2.5;\n").unwrap();
-
+    fn versioned_specifier_resolves_to_a_compatible_version() {
         let rt = test_runtime();
-        rt.reset_module_loader(dir.path().to_path_buf());
         let scope = rt.default_global();
-        unsafe {
-            // Import without .js extension — oxc_resolver should add it
-            let result = evaluate_module(
-                &scope,
-                r#"
-                    import { RATIO } from "./utils";
-                    globalThis._ratio = RATIO;
-                "#,
-                "entry.mjs",
-            );
-            assert!(result.is_ok(), "extension inference failed");
-            assert_eq!(read_global_f64(&scope, "globalThis._ratio"), 2.5);
+        for (name, version) in [
+            ("test:pkg/iface@0.2.3", 3),
+            ("test:pkg/iface@0.2.9", 9),
+            ("test:pkg/major@1.10.0", 10),
+            ("test:pkg/major@1.2.0", 2),
+        ] {
+            let value = scope.root_value(js::value::from_u32(version));
+            register_synthetic_module(&scope, name, &[("version", value)])
+                .expect("registering the module");
         }
-    }
-
-    #[test]
-    fn resolve_index_file() {
-        let dir = test_tempdir();
-        let sub = dir.path().join("mylib");
-        std::fs::create_dir(&sub).unwrap();
-        std::fs::write(sub.join("index.js"), "export const HELLO = 'world';\n").unwrap();
-
-        let rt = test_runtime();
-        rt.reset_module_loader(dir.path().to_path_buf());
-        let scope = rt.default_global();
         unsafe {
-            let result = evaluate_module(
+            evaluate_module(
                 &scope,
-                r#"
-                    import { HELLO } from "./mylib";
-                    globalThis._hello = HELLO;
-                "#,
+                r#"import { version } from "test:pkg/iface@0.2.12";
+                   globalThis._patchVersion = version;"#,
                 "entry.mjs",
-            );
-            assert!(result.is_ok(), "index.js resolution failed");
-            assert_eq!(read_global_string(&scope, "globalThis._hello"), "world");
-        }
-    }
-
-    #[test]
-    fn duplicate_import_uses_cache() {
-        let dir = test_tempdir();
-
-        // A module with a side-effect counter
-        std::fs::write(
-            dir.path().join("counter.js"),
-            r#"
-                if (!globalThis._counter) globalThis._counter = 0;
-                globalThis._counter++;
-                export const dummy = 1;
-            "#,
-        )
-        .unwrap();
-
-        let rt = test_runtime();
-        rt.reset_module_loader(dir.path().to_path_buf());
-        let scope = rt.default_global();
-        unsafe {
-            // Two separate entry modules both import counter.js
-            let r1 = evaluate_module(
+            )
+            .expect("a patch version the registry lacks resolves to a compatible one");
+            assert_eq!(read_global_f64(&scope, "globalThis._patchVersion"), 9.0);
+            evaluate_module(
                 &scope,
-                r#"import { dummy } from "./counter.js";"#,
-                "entry1.mjs",
-            );
-            assert!(r1.is_ok());
-            // Second import of same module should be cached (not re-evaluated)
-            let r2 = evaluate_module(
+                r#"import { version } from "test:pkg/iface@0.2";
+                   globalThis._minorVersion = version;"#,
+                "no-patch.mjs",
+            )
+            .expect("a version without a patch number resolves to a compatible one");
+            assert_eq!(read_global_f64(&scope, "globalThis._minorVersion"), 9.0);
+            evaluate_module(
                 &scope,
-                r#"import { dummy } from "./counter.js";"#,
-                "entry2.mjs",
+                r#"import { version } from "test:pkg/major@1";
+                   globalThis._majorVersion = version;"#,
+                "major.mjs",
+            )
+            .expect("a canonical major version resolves to the highest compatible one");
+            assert_eq!(read_global_f64(&scope, "globalThis._majorVersion"), 10.0);
+            let result = evaluate_module(
+                &scope,
+                r#"import { version } from "test:pkg/iface@0.3.0";"#,
+                "minor.mjs",
+            );
+            assert!(
+                result.is_err(),
+                "a different minor version must not resolve"
             );
-            assert!(r2.is_ok());
-            assert_eq!(read_global_f64(&scope, "globalThis._counter"), 1.0);
         }
     }
 
@@ -1368,30 +1335,6 @@ mod tests {
         }
     }
 
-    #[test]
-    fn json_import_evaluates_to_the_parsed_value() {
-        let dir = test_tempdir();
-        std::fs::write(dir.path().join("data.json"), r#"{ "n": 7, "s": "seven" }"#).unwrap();
-
-        let rt = test_runtime();
-        rt.reset_module_loader(dir.path().to_path_buf());
-        let scope = rt.default_global();
-        unsafe {
-            let result = evaluate_module(
-                &scope,
-                r#"
-                    import data from "./data.json" with { type: "json" };
-                    globalThis._jsonN = data.n;
-                    globalThis._jsonS = data.s;
-                "#,
-                "entry.mjs",
-            );
-            assert!(result.is_ok(), "JSON module import failed");
-            assert_eq!(read_global_f64(&scope, "globalThis._jsonN"), 7.0);
-            assert_eq!(read_global_string(&scope, "globalThis._jsonS"), "seven");
-        }
-    }
-
     #[test]
     fn invalid_json_module_fails_to_load() {
         let dir = test_tempdir();
@@ -1493,7 +1436,7 @@ mod tests {
     fn top_level_await_on_dynamic_import() {
         let dir = test_tempdir();
         std::fs::write(dir.path().join("helper.js"), "export const VALUE = 5;\n").unwrap();
-        std::fs::write(dir.path().join("data.json"), r#"{ "n": 3 }"#).unwrap();
+        std::fs::write(dir.path().join("data.json"), r#"{ "n": 3, "s": "seven" }"#).unwrap();
 
         let rt = test_runtime();
         rt.reset_module_loader(dir.path().to_path_buf());
@@ -1507,6 +1450,7 @@ mod tests {
                     const json = await import("./data.json", { with: { type: "json" } });
                     globalThis._sum = VALUE + json.default.n;
                     globalThis._sameJson = json.default === data;
+                    globalThis._jsonS = data.s;
                 "#,
                 "entry.mjs",
             );
@@ -1517,35 +1461,14 @@ mod tests {
                 read_global_string(&scope, "String(globalThis._sameJson)"),
                 "true"
             );
+            assert_eq!(read_global_string(&scope, "globalThis._jsonS"), "seven");
         }
     }
 
     #[test]
-    fn dynamic_import_of_a_missing_module_rejects() {
-        let dir = test_tempdir();
-
-        let rt = test_runtime();
-        rt.reset_module_loader(dir.path().to_path_buf());
-        let scope = rt.default_global();
-        unsafe {
-            let result = evaluate_module(
-                &scope,
-                r#"
-                    import("./missing.js").catch((e) => { globalThis._error = e.message; });
-                "#,
-                "entry.mjs",
-            );
-            assert!(result.is_ok(), "module evaluation failed");
-            crate::event_loop::run_microtasks(&scope);
-            assert!(read_global_string(&scope, "globalThis._error")
-                .contains("Cannot resolve module './missing.js'"));
-        }
-    }
-
-    #[test]
-    fn dynamic_import_of_a_module_with_a_missing_dependency_rejects() {
+    fn dynamic_imports_of_missing_modules_and_dependencies_reject() {
         let dir = test_tempdir();
-        std::fs::write(dir.path().join("present.js"), "import './missing.js';\n").unwrap();
+        std::fs::write(dir.path().join("present.js"), "import './absent.js';\n").unwrap();
 
         let rt = test_runtime();
         rt.reset_module_loader(dir.path().to_path_buf());
@@ -1554,14 +1477,17 @@ mod tests {
             let result = evaluate_module(
                 &scope,
                 r#"
-                    import("./present.js").catch((e) => { globalThis._error = e.message; });
+                    import("./missing.js").catch((e) => { globalThis._missing = e.message; });
+                    import("./present.js").catch((e) => { globalThis._dependency = e.message; });
                 "#,
                 "entry.mjs",
             );
             assert!(result.is_ok(), "module evaluation failed");
             crate::event_loop::run_microtasks(&scope);
-            assert!(read_global_string(&scope, "globalThis._error")
+            assert!(read_global_string(&scope, "globalThis._missing")
                 .contains("Cannot resolve module './missing.js'"));
+            assert!(read_global_string(&scope, "globalThis._dependency")
+                .contains("Cannot resolve module './absent.js'"));
         }
     }
 }
diff --git a/crates/core-runtime/src/runtime.rs b/crates/core-runtime/src/runtime.rs
index 22651e6b..3046f6e2 100644
--- a/crates/core-runtime/src/runtime.rs
+++ b/crates/core-runtime/src/runtime.rs
@@ -244,7 +244,7 @@ impl Runtime {
     /// Returns `Err` with a description if the configured initializer script can't
     /// be read, throws, or leaves asynchronous work behind.
     pub fn init(config: &RuntimeConfig) -> Result<Rc<Self>, String> {
-        crate::config::set_enforce_fetch_restrictions(config.enforce_fetch_restrictions());
+        crate::config::set_web_security_restrictions(config.web_security_restrictions());
         // SAFETY: no parent runtime is given, which is the only condition.
         let mut mozjs_rt =
             unsafe { MozJSRuntime::create_with_internal_job_queues(engine_handle(), None) };
@@ -479,8 +479,8 @@ impl Drop for Runtime {
         // and their tracer is still registered.
         crate::finalization::clear(&self.finalization);
 
-        // Remove GC tracers (module registry is empty, so the tracer
-        // is a no-op even if called during barrier processing).
+        // Remove GC tracers (the module registry is empty, so the tracer
+        // does nothing even if called during barrier processing).
         // The class registry is owned by the global object and cleaned
         // up by its finalize hook — no explicit clearing needed.
         let self_ptr = self as *const Self as *mut c_void;
diff --git a/crates/core-runtime/src/test_util.rs b/crates/core-runtime/src/test_util.rs
index d25220a7..55342adc 100644
--- a/crates/core-runtime/src/test_util.rs
+++ b/crates/core-runtime/src/test_util.rs
@@ -54,6 +54,11 @@ pub fn eval_and_read_out(scope: &Scope<'_>, code: &str) -> String {
     if js::compile::evaluate_with_filename(scope, code, "test.js", 1).is_err() {
         panic!("evaluation threw: {:?}", ExnThrown::capture(scope));
     }
+    read_out(scope)
+}
+
+/// Drain microtasks and return `String(globalThis.__out)`.
+fn read_out(scope: &Scope<'_>) -> String {
     run_microtasks(scope);
     let out = js::compile::evaluate_with_filename(scope, "globalThis.__out", "out.js", 1)
         .expect("reading __out threw");
@@ -67,3 +72,18 @@ pub fn eval_out_with_setup(setup: impl FnOnce(), code: &str) -> String {
     let scope = rt.default_global();
     eval_and_read_out(&scope, code)
 }
+
+/// Run setup, create a runtime, evaluate `source` as an ES module, drain microtasks, and return
+/// `String(globalThis.__out)`.
+///
+/// Panics if the module throws.
+pub fn eval_module_out_with_setup(setup: impl FnOnce(), source: &str) -> String {
+    setup();
+    let rt = Runtime::init(&RuntimeConfig::default()).expect("runtime init");
+    let scope = rt.default_global();
+    // SAFETY: `Runtime::init` initialized the module loader.
+    if unsafe { crate::module::evaluate_module(&scope, source, "test.mjs") }.is_err() {
+        panic!("module evaluation threw: {:?}", ExnThrown::capture(&scope));
+    }
+    read_out(&scope)
+}
diff --git a/crates/core-runtime/tests/accessor_return_styles.rs b/crates/core-runtime/tests/accessor_return_styles.rs
index beaa68c0..d3f59674 100644
--- a/crates/core-runtime/tests/accessor_return_styles.rs
+++ b/crates/core-runtime/tests/accessor_return_styles.rs
@@ -1,19 +1,15 @@
 // SPDX-License-Identifier: Apache-2.0-WITH-LLVM-exception
 
-//! Accessor return-style codegen regression test.
-//!
-//! A fallible setter whose body returns `Result<T, E>` with a non-unit `T`
-//! (classified `ResultValue`) used to fall into a catch-all arm that ran the
-//! call and discarded the `Result`, silently swallowing the `Err`. The setter
-//! must instead throw the error; its `Ok` value is ignored (a JS setter yields
-//! undefined).
+//! Accessor and method return styles: a fallible setter whose body returns `Result<T, E>` with a
+//! non-unit `T` (classified `ResultValue`) throws the `Err` and ignores the `Ok` value, and a
+//! `Result<Promise, E>` operation or attribute rejects with the `Err`.
 
 // This file contains nothing platform-specific, so skip it on wasm32.
 #![cfg(not(target_arch = "wasm32"))]
 
 use core_runtime::jsclass;
 use core_runtime::jsmethods;
-use core_runtime::test_util::{eval_out_with_setup, eval_with_setup, throws_with_setup};
+use core_runtime::test_util::{eval_out_with_setup, eval_with_setup};
 use js::error::TypeError;
 use js::gc::scope::Scope;
 use js::Promise;
@@ -62,29 +58,15 @@ fn setup() {
 }
 
 #[test]
-fn setter_ok_assigns() {
-    assert_eq!(
-        eval_with_setup(setup, "const c = new Cell(); c.value = 5; c.value"),
-        "5"
-    );
-}
-
-#[test]
-fn setter_err_throws_not_swallowed() {
-    assert!(throws_with_setup(
-        setup,
-        "const c = new Cell(); c.value = -1;"
-    ));
-}
-
-#[test]
-fn setter_err_leaves_value_unchanged() {
+fn fallible_setter_assigns_ok_and_throws_err() {
     assert_eq!(
         eval_with_setup(
             setup,
-            "const c = new Cell(); c.value = 9; try { c.value = -1; } catch (e) {} c.value"
+            "const c = new Cell(); c.value = 9; let threw = false; \
+             try { c.value = -1; } catch (e) { threw = e instanceof TypeError; } \
+             `${c.value} ${threw}`"
         ),
-        "9"
+        "9 true"
     );
 }
 
diff --git a/crates/core-runtime/tests/const_naming.rs b/crates/core-runtime/tests/const_naming.rs
index b4f2fa92..5d63f692 100644
--- a/crates/core-runtime/tests/const_naming.rs
+++ b/crates/core-runtime/tests/const_naming.rs
@@ -1,25 +1,15 @@
 // SPDX-License-Identifier: Apache-2.0-WITH-LLVM-exception
 
-//! Constants keep their declared Rust name in every macro that exposes them.
-//!
-//! Functions are camelCased (`safe_divide` → `safeDivide`), but constants are
-//! not: `PI` stays `PI`. JS spells constants in SCREAMING_CASE too, so the Rust
-//! name is already the right one, and camelCasing it produced names like `pi`
-//! and `maxValue` that matched neither convention.
-//!
-//! `#[jsclass]`/`#[webidl_interface]` constants have always behaved this way
-//! (see `typedef_macros::constant_tests`); these tests pin the same rule for
-//! `#[jsmodule]`, `#[jsglobals]`, `#[jsnamespace]`, and `#[webidl_namespace]`.
+//! Constants keep their declared Rust name in every macro that exposes them, while functions are
+//! camelCased (`safe_divide` → `safeDivide`): `PI` stays `PI`, since JS spells constants in
+//! SCREAMING_CASE too. `typedef_macros` covers the constants of `#[jsclass]` and
+//! `#[webidl_interface]`.
 
 // This file contains nothing platform-specific, so skip it on wasm32.
 #![cfg(not(target_arch = "wasm32"))]
 
-use core_runtime::config::RuntimeConfig;
-use core_runtime::module::evaluate_module;
-use core_runtime::runtime::Runtime;
-use core_runtime::test_util::eval_with_setup;
+use core_runtime::test_util::{eval_module_out_with_setup, eval_with_setup};
 use core_runtime::{jsglobals, jsmodule, jsnamespace, webidl_namespace};
-use js::conversion::FromJSVal;
 
 #[jsmodule]
 mod const_module {
@@ -59,127 +49,12 @@ mod const_webidl_ns {
     }
 }
 
-fn setup() {
-    core_runtime::runtime::register_global_initializer(|scope, global| {
-        const_globals::add_to_global(scope, global);
-        const_ns::add_to_global(scope, global);
-        const_webidl_ns::add_to_global(scope, global);
-        // SAFETY: called during global initialization, before any JS runs.
-        unsafe {
-            const_module::register(scope);
-        }
-    });
-}
-
-fn eval(code: &str) -> String {
-    eval_with_setup(setup, code)
-}
-
-/// Evaluate a module that imports from `const_module` (specifier `constModule`)
-/// and assigns to `globalThis._result`, then read that value back as a string.
-///
-/// `import()` can't be used from `eval_with_setup` — it returns a promise the
-/// helper would stringify as `[object Promise]` — so this drives a static
-/// import through `evaluate_module` the way `starling/examples/native_module.rs`
-/// does.
-fn eval_module(body: &str) -> String {
-    setup();
-    let rt = Runtime::init(&RuntimeConfig::default()).expect("runtime init");
-    let scope = rt.default_global();
-    let source = format!("import * as m from \"constModule\";\nglobalThis._result = {body};");
-    // SAFETY: `scope` outlives the evaluation, and the module registry was
-    // populated by `setup` before any JS ran.
-    unsafe { evaluate_module(&scope, &source, "const_test.mjs") }.expect("module eval failed");
-    let val = js::compile::evaluate_with_filename(&scope, "globalThis._result", "read.js", 1)
-        .expect("readback failed");
-    String::from_jsval(&scope, val, ()).expect("null string")
-}
-
-// ============================================================================
-// #[jsmodule]
-// ============================================================================
-
-#[test]
-fn module_const_keeps_declared_name() {
-    assert_eq!(eval_module("m.PI"), "3.5");
-}
-
-#[test]
-fn module_multiword_const_keeps_declared_name() {
-    assert_eq!(eval_module("m.MAX_VALUE"), "1000");
-}
-
-#[test]
-fn module_camel_cased_const_name_is_absent() {
-    assert_eq!(
-        eval_module("typeof m.pi + ',' + typeof m.maxValue"),
-        "undefined,undefined"
-    );
-}
-
-#[test]
-fn module_function_is_still_camel_cased() {
-    assert_eq!(eval_module("m.safeDivide(10, 4)"), "2.5");
-}
-
-// ============================================================================
-// #[jsglobals]
-// ============================================================================
-
-#[test]
-fn global_const_keeps_declared_name() {
-    assert_eq!(eval("APP_NAME"), "starling");
-}
-
-#[test]
-fn global_multiword_const_keeps_declared_name() {
-    assert_eq!(eval("MAX_RETRIES"), "3");
-}
-
-#[test]
-fn global_camel_cased_const_name_is_absent() {
-    assert_eq!(
-        eval("typeof globalThis.appName + ',' + typeof globalThis.maxRetries"),
-        "undefined,undefined"
-    );
-}
-
-#[test]
-fn global_function_is_still_camel_cased() {
-    assert_eq!(eval("formatName('x')"), "x");
-}
-
-// ============================================================================
-// #[jsnamespace] / #[webidl_namespace] — already correct, pinned against regression
-// ============================================================================
-
-#[test]
-fn namespace_const_keeps_declared_name() {
-    assert_eq!(eval("constNs.MEDIA_ERR"), "4");
-}
-
-#[test]
-fn namespace_function_is_still_camel_cased() {
-    assert_eq!(eval("constNs.identityValue(7)"), "7");
-}
-
-#[test]
-fn webidl_namespace_const_keeps_declared_name() {
-    assert_eq!(eval("ConstWebIDL.HIERARCHY_REQUEST_ERR"), "3");
-}
-
-#[test]
-fn webidl_namespace_function_is_still_camel_cased() {
-    assert_eq!(eval("ConstWebIDL.escapeValue('y')"), "y");
-}
-
 // ============================================================================
 // Derived JS names for the containers themselves
 //
-// A `mod` block's own name is camelCased to derive the JS-visible name it is
-// reached by — the module's import specifier and the namespace's global
-// property — matching how the functions inside it are renamed. An explicit
-// `name = "..."` is always used verbatim.
+// A `mod` block's own name is camelCased to derive the JS-visible name it is reached by: the
+// module's import specifier and the namespace's global property. An explicit `name = "..."` is
+// used verbatim.
 // ============================================================================
 
 #[jsmodule]
@@ -197,46 +72,64 @@ mod multi_word_ns {
     pub const ANSWER: i32 = 5;
 }
 
-fn setup_derived_names() {
+fn setup() {
     core_runtime::runtime::register_global_initializer(|scope, global| {
+        const_globals::add_to_global(scope, global);
+        const_ns::add_to_global(scope, global);
+        const_webidl_ns::add_to_global(scope, global);
         multi_word_ns::add_to_global(scope, global);
-        // SAFETY: called during global initialization, before any JS runs.
-        unsafe {
-            multi_word_module::register(scope);
-            ignored_module_name::register(scope);
-        }
+        const_module::register(scope);
+        multi_word_module::register(scope);
+        ignored_module_name::register(scope);
     });
 }
 
-/// Import from `specifier` and read `ANSWER` back as a string.
-fn eval_import(specifier: &str) -> String {
-    setup_derived_names();
-    let rt = Runtime::init(&RuntimeConfig::default()).expect("runtime init");
-    let scope = rt.default_global();
-    let source = format!("import {{ ANSWER }} from \"{specifier}\";\nglobalThis._result = ANSWER;");
-    // SAFETY: `scope` outlives the evaluation, and the module registry was
-    // populated by `setup_derived_names` before any JS ran.
-    unsafe { evaluate_module(&scope, &source, "specifier_test.mjs") }.expect("module eval failed");
-    let val = js::compile::evaluate_with_filename(&scope, "globalThis._result", "read.js", 1)
-        .expect("readback failed");
-    String::from_jsval(&scope, val, ()).expect("null string")
+#[test]
+fn module_consts_keep_their_declared_name() {
+    assert_eq!(
+        eval_module_out_with_setup(
+            setup,
+            "import * as m from 'constModule';
+             globalThis.__out =
+                 [m.PI, m.MAX_VALUE, typeof m.pi, typeof m.maxValue, m.safeDivide(10, 4)].join();"
+        ),
+        "3.5,1000,undefined,undefined,2.5"
+    );
 }
 
 #[test]
-fn module_specifier_is_camel_cased() {
-    assert_eq!(eval_import("multiWordModule"), "42");
+fn global_consts_keep_their_declared_name() {
+    assert_eq!(
+        eval_with_setup(
+            setup,
+            "[APP_NAME, MAX_RETRIES, typeof globalThis.appName, typeof globalThis.maxRetries,
+              formatName('x')].join()"
+        ),
+        "starling,3,undefined,undefined,x"
+    );
 }
 
 #[test]
-fn explicit_module_name_is_used_verbatim() {
-    assert_eq!(eval_import("explicit_module_name"), "7");
+fn namespace_consts_keep_their_declared_name() {
+    assert_eq!(
+        eval_with_setup(
+            setup,
+            "[constNs.MEDIA_ERR, constNs.identityValue(7), ConstWebIDL.HIERARCHY_REQUEST_ERR,
+              ConstWebIDL.escapeValue('y')].join()"
+        ),
+        "4,7,3,y"
+    );
 }
 
 #[test]
-fn namespace_global_name_is_camel_cased() {
-    setup_derived_names();
+fn container_names_are_camel_cased_unless_explicit() {
     assert_eq!(
-        eval_with_setup(setup_derived_names, "multiWordNs.ANSWER"),
-        "5"
+        eval_module_out_with_setup(
+            setup,
+            "import { ANSWER as a } from 'multiWordModule';
+             import { ANSWER as b } from 'explicit_module_name';
+             globalThis.__out = [a, b, multiWordNs.ANSWER].join();"
+        ),
+        "42,7,5"
     );
 }
diff --git a/crates/core-runtime/tests/event_loop.rs b/crates/core-runtime/tests/event_loop.rs
deleted file mode 100644
index 9aac3573..00000000
--- a/crates/core-runtime/tests/event_loop.rs
+++ /dev/null
@@ -1,884 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0-WITH-LLVM-exception
-
-//! Integration tests for the event loop.
-//!
-//! Tests are grouped in a single test function because `JSEngine` can
-//! only be initialized once per process, and must run with --test-threads=1.
-
-#[cfg(not(target_arch = "wasm32"))]
-use core_runtime::event_loop::run_to_completion;
-use core_runtime::event_loop::timer::install_timer_globals;
-use core_runtime::event_loop::{run_microtasks, with_event_loop, EventLoop, StepOutcome, Task};
-use core_runtime::runtime::Runtime;
-use js::gc::scope::Scope;
-use js::native::JSTracer;
-
-use js::error::ExnThrown;
-use platform::clock::Instant;
-use std::cell::Cell;
-use std::rc::Rc;
-use std::time::Duration;
-
-/// Helper: create a tokio current-thread runtime with timer support and
-/// block on `run_to_completion` using `tokio::time::sleep`.
-#[cfg(not(target_arch = "wasm32"))]
-fn block_on_event_loop(scope: &Scope<'_>, el: &mut EventLoop) {
-    let rt = tokio::runtime::Builder::new_current_thread()
-        .enable_time()
-        .build()
-        .unwrap();
-    rt.block_on(async {
-        // SAFETY: the scope (and its Runtime) must outlive this future.
-        // Since the caller owns both and `block_on` runs synchronously on
-        // the same thread, this is guaranteed.
-        let raw_cx = unsafe { scope.raw_cx_no_gc() };
-        unsafe { run_to_completion(raw_cx, el, tokio::time::sleep).await }
-    });
-}
-
-// ---------------------------------------------------------------------------
-// Custom task for testing
-// ---------------------------------------------------------------------------
-
-/// A simple task that increments a shared counter when run.
-struct CounterTask {
-    counter: Rc<Cell<u32>>,
-    #[allow(dead_code)]
-    label: &'static str,
-}
-
-impl Task for CounterTask {
-    fn kind(&self) -> &'static str {
-        "counter"
-    }
-
-    fn run(
-        self: Box<Self>,
-        _scope: &Scope<'_>,
-        _id: core_runtime::event_loop::TaskId,
-    ) -> Result<(), ExnThrown> {
-        self.counter.set(self.counter.get() + 1);
-        Ok(())
-    }
-
-    fn trace(&self, _trc: *mut JSTracer) {}
-}
-
-// ---------------------------------------------------------------------------
-// Tests
-// ---------------------------------------------------------------------------
-
-#[test]
-fn test_event_loop() {
-    let rt = Runtime::init(&core_runtime::config::RuntimeConfig::default()).expect("runtime init");
-    let scope = rt.default_global();
-
-    // Install timer globals for timer tests.
-    install_timer_globals(&scope, scope.global());
-
-    // ---- Test 1: Basic EventLoop operations ----
-    {
-        let el = EventLoop::new();
-
-        // Empty loop.
-        assert!(el.is_empty());
-        assert!(!el.has_pending());
-        assert!(!el.has_ready());
-        assert_eq!(el.len(), 0);
-
-        // Queue a task.
-        let counter = Rc::new(Cell::new(0u32));
-        let id = el.queue(Box::new(CounterTask {
-            counter: counter.clone(),
-            label: "task1",
-        }));
-
-        assert!(el.has_pending());
-        assert!(!el.has_ready());
-        assert_eq!(el.len(), 1);
-
-        // Not ready yet — pop_ready should return None.
-        assert!(el.pop_ready().is_none());
-
-        // Signal it ready.
-        el.signal_ready(id);
-        assert!(el.has_ready());
-
-        // Pop and run it.
-        let (popped_id, task) = el.pop_ready().unwrap();
-        assert_eq!(popped_id, id);
-        assert_eq!(counter.get(), 0);
-        task.run(&scope, popped_id).unwrap();
-        assert_eq!(counter.get(), 1);
-
-        // Now the loop is empty.
-        assert!(el.is_empty());
-    }
-
-    // ---- Test 2: queue_ready (immediately ready) ----
-    {
-        let el = EventLoop::new();
-        let counter = Rc::new(Cell::new(0u32));
-
-        el.queue_ready(Box::new(CounterTask {
-            counter: counter.clone(),
-            label: "ready1",
-        }));
-
-        assert!(el.has_ready());
-        let (id, task) = el.pop_ready().unwrap();
-        task.run(&scope, id).unwrap();
-        assert_eq!(counter.get(), 1);
-        assert!(el.is_empty());
-    }
-
-    // ---- Test 3: Cancel ----
-    {
-        let el = EventLoop::new();
-        let counter = Rc::new(Cell::new(0u32));
-
-        let id = el.queue_ready(Box::new(CounterTask {
-            counter: counter.clone(),
-            label: "cancelled",
-        }));
-
-        assert!(el.cancel_if_queued(id));
-        assert!(el.is_empty());
-        assert_eq!(counter.get(), 0);
-
-        // Cancel of non-existent ID returns false.
-        assert!(!el.cancel_if_queued(id));
-    }
-
-    // ---- Test 4: Timer tasks ----
-    {
-        let el = EventLoop::new();
-        let counter = Rc::new(Cell::new(0u32));
-
-        // Queue a timer 5ms in the future.
-        let _id = el.queue_timer(
-            Box::new(CounterTask {
-                counter: counter.clone(),
-                label: "timer1",
-            }),
-            Instant::now() + Duration::from_millis(5),
-        );
-
-        assert!(el.has_pending());
-        assert!(!el.has_ready());
-
-        // advance_timers should NOT mark it ready yet.
-        assert_eq!(el.advance_timers(), 0);
-        assert!(!el.has_ready());
-
-        // time_to_next_timer should be Some and > 0.
-        let wait = el.time_to_next_timer();
-        assert!(wait.is_some());
-
-        // Sleep past the deadline.
-        std::thread::sleep(Duration::from_millis(10));
-
-        // Now advance_timers should mark it ready.
-        assert_eq!(el.advance_timers(), 1);
-        assert!(el.has_ready());
-
-        let (id, task) = el.pop_ready().unwrap();
-        task.run(&scope, id).unwrap();
-        assert_eq!(counter.get(), 1);
-    }
-
-    // ---- Test 5: Multiple tasks, ordering ----
-    {
-        let el = EventLoop::new();
-        let counter = Rc::new(Cell::new(0u32));
-
-        let id1 = el.queue_ready(Box::new(CounterTask {
-            counter: counter.clone(),
-            label: "first",
-        }));
-        let id2 = el.queue_ready(Box::new(CounterTask {
-            counter: counter.clone(),
-            label: "second",
-        }));
-        let id3 = el.queue_ready(Box::new(CounterTask {
-            counter: counter.clone(),
-            label: "third",
-        }));
-
-        // Pop and run all three.
-        let mut ids = Vec::new();
-        while let Some((id, task)) = el.pop_ready() {
-            ids.push(id);
-            task.run(&scope, id).unwrap();
-        }
-
-        assert_eq!(counter.get(), 3);
-        assert!(el.is_empty());
-        // All three IDs should be unique.
-        assert!(ids.contains(&id1));
-        assert!(ids.contains(&id2));
-        assert!(ids.contains(&id3));
-    }
-
-    // ---- Test 6: run_to_completion with immediate tasks ----
-    #[cfg(not(target_arch = "wasm32"))]
-    {
-        let counter = Rc::new(Cell::new(0u32));
-        let mut el = EventLoop::new();
-
-        el.queue_ready(Box::new(CounterTask {
-            counter: counter.clone(),
-            label: "native1",
-        }));
-        el.queue_ready(Box::new(CounterTask {
-            counter: counter.clone(),
-            label: "native2",
-        }));
-
-        block_on_event_loop(&scope, &mut el);
-        assert_eq!(counter.get(), 2);
-        assert!(el.is_empty());
-    }
-
-    // ---- Test 7: run_to_completion with timer ----
-    #[cfg(not(target_arch = "wasm32"))]
-    {
-        let counter = Rc::new(Cell::new(0u32));
-        let mut el = EventLoop::new();
-
-        el.queue_timer(
-            Box::new(CounterTask {
-                counter: counter.clone(),
-                label: "delayed",
-            }),
-            Instant::now() + Duration::from_millis(5),
-        );
-
-        block_on_event_loop(&scope, &mut el);
-        assert_eq!(counter.get(), 1);
-        assert!(el.is_empty());
-    }
-
-    // ---- Test 8: setTimeout from JavaScript ----
-    #[cfg(not(target_arch = "wasm32"))]
-    {
-        let mut el = EventLoop::new();
-
-        // Evaluate JS with the event loop thread-local set so setTimeout works.
-        {
-            with_event_loop(&el, |_| {
-                let ok = js::compile::evaluate_with_filename(
-                    &scope,
-                    "globalThis._timerFired = false; setTimeout(function() { globalThis._timerFired = true; }, 1);",
-                    "<test>",
-                    1,
-                );
-                assert!(ok.is_ok(), "setTimeout JS evaluation failed");
-            });
-        }
-
-        // The timer task should be queued.
-        assert!(el.has_pending());
-
-        // Run the event loop to fire the timer.
-        block_on_event_loop(&scope, &mut el);
-
-        // Verify the timer callback ran.
-        let result = js::compile::evaluate_with_filename(
-            &scope,
-            "globalThis._timerFired",
-            "<test-check>",
-            1,
-        );
-        assert!(result.is_ok());
-        let val = result.unwrap();
-        assert!(
-            val.is_boolean() && val.to_boolean(),
-            "setTimeout callback should have fired"
-        );
-    }
-
-    // ---- Test 8a: timer ids are unique per global across concurrent loops ----
-    //
-    // Two event loops driving the same global (the WASIp3 concurrent-invocation
-    // shape) must not hand out colliding `setTimeout` ids: HTML's id namespace
-    // is per-global, so a `clearTimeout` from one invocation must never resolve
-    // to a different invocation's timer.
-    {
-        let el_a = EventLoop::new();
-        let el_b = EventLoop::new();
-
-        with_event_loop(&el_a, |_| {
-            let ok = js::compile::evaluate_with_filename(
-                &scope,
-                "globalThis._idA = setTimeout(function() {}, 100000);",
-                "<test-id-a>",
-                1,
-            );
-            assert!(ok.is_ok(), "setTimeout in loop A failed");
-        });
-        with_event_loop(&el_b, |_| {
-            let ok = js::compile::evaluate_with_filename(
-                &scope,
-                "globalThis._idB = setTimeout(function() {}, 100000);",
-                "<test-id-b>",
-                1,
-            );
-            assert!(ok.is_ok(), "setTimeout in loop B failed");
-        });
-
-        let read_id = |name: &str| -> i32 {
-            let r = js::compile::evaluate_with_filename(&scope, name, "<test-id-read>", 1).unwrap();
-            if r.is_int32() {
-                r.to_int32()
-            } else {
-                r.to_double() as i32
-            }
-        };
-        let id_a = read_id("globalThis._idA");
-        let id_b = read_id("globalThis._idB");
-        assert_ne!(
-            id_a, id_b,
-            "timer ids from concurrent event loops on the same global must be unique"
-        );
-    }
-
-    // ---- Test 8b: setTimeout forwards extra arguments to the callback ----
-    #[cfg(not(target_arch = "wasm32"))]
-    {
-        let mut el = EventLoop::new();
-
-        {
-            with_event_loop(&el, |_| {
-                let ok = js::compile::evaluate_with_filename(
-                    &scope,
-                    "globalThis._timerArgs = null; \
-                     setTimeout(function(a, b, c) { globalThis._timerArgs = [a, b, c].join(','); }, 1, 'x', 42, true);",
-                    "<test-args>",
-                    1,
-                );
-                assert!(ok.is_ok(), "setTimeout-with-args JS evaluation failed");
-            });
-        }
-
-        block_on_event_loop(&scope, &mut el);
-
-        let result = js::compile::evaluate_with_filename(
-            &scope,
-            "globalThis._timerArgs",
-            "<test-args-check>",
-            1,
-        );
-        assert!(result.is_ok());
-        let val = result.unwrap();
-        assert!(val.is_string(), "timer args should have been recorded");
-        let s = js::JSString::from_value(&scope, val)
-            .unwrap()
-            .to_utf8(&scope)
-            .unwrap();
-        assert_eq!(
-            s, "x,42,true",
-            "extra setTimeout arguments must be forwarded"
-        );
-    }
-
-    // ---- Test 8c: handler is converted before the timeout (WebIDL order) ----
-    {
-        let el = EventLoop::new();
-
-        {
-            with_event_loop(&el, |_| {
-                let ok = js::compile::evaluate_with_filename(
-                    &scope,
-                    "globalThis._convOrder = []; \
-                     globalThis._convTid = setTimeout(\
-                       { toString() { globalThis._convOrder.push('handler'); return ''; } }, \
-                       { valueOf() { globalThis._convOrder.push('timeout'); return 1e9; } });",
-                    "<test-conv-order>",
-                    1,
-                );
-                assert!(ok.is_ok(), "setTimeout with converting args failed");
-            });
-        }
-
-        let result = js::compile::evaluate_with_filename(
-            &scope,
-            "globalThis._convOrder.join(',')",
-            "<test-conv-order-check>",
-            1,
-        );
-        let val = result.unwrap();
-        let s = js::JSString::from_value(&scope, val)
-            .unwrap()
-            .to_utf8(&scope)
-            .unwrap();
-        assert_eq!(
-            s, "handler,timeout",
-            "WebIDL requires left-to-right argument conversion"
-        );
-
-        // Drain the queued (far-future) timer so it can't leak into later tests.
-        let cleared = {
-            with_event_loop(&el, |_| {
-                js::compile::evaluate_with_filename(
-                    &scope,
-                    "clearTimeout(globalThis._convTid)",
-                    "<cleanup>",
-                    1,
-                )
-                .is_ok()
-            })
-        };
-        assert!(cleared);
-        assert!(el.is_empty(), "cleanup clearTimeout should empty the loop");
-    }
-
-    // ---- Test 8d: a throwing interval callback keeps repeating ----
-    #[cfg(not(target_arch = "wasm32"))]
-    {
-        let mut el = EventLoop::new();
-
-        {
-            with_event_loop(&el, |_| {
-                let ok = js::compile::evaluate_with_filename(
-                    &scope,
-                    "globalThis._ivTicks = 0; \
-                     globalThis._iv = setInterval(function() { \
-                       globalThis._ivTicks++; \
-                       if (globalThis._ivTicks === 1) { throw new Error('boom'); } \
-                       if (globalThis._ivTicks >= 3) { clearInterval(globalThis._iv); } \
-                     }, 1);",
-                    "<test-throwing-interval>",
-                    1,
-                );
-                assert!(ok.is_ok(), "setInterval JS evaluation failed");
-            });
-        }
-
-        block_on_event_loop(&scope, &mut el);
-
-        let result = js::compile::evaluate_with_filename(
-            &scope,
-            "globalThis._ivTicks",
-            "<test-throwing-interval-check>",
-            1,
-        );
-        let val = result.unwrap();
-        assert!(val.is_int32());
-        assert_eq!(
-            val.to_int32(),
-            3,
-            "a throwing callback must not kill the interval (spec: report + repeat)"
-        );
-    }
-
-    // ---- Test 8e: JS timer ids are spec-shaped; clearing is timer-only ----
-    #[cfg(not(target_arch = "wasm32"))]
-    {
-        let mut el = EventLoop::new();
-        let counter = Rc::new(Cell::new(0));
-
-        // An internal (non-JS) timer task on the same loop: clearTimeout must
-        // not be able to reach it, whatever ids JS throws at it.
-        el.queue_timer(
-            Box::new(CounterTask {
-                counter: Rc::clone(&counter),
-                label: "internal",
-            }),
-            Instant::now(),
-        );
-
-        {
-            with_event_loop(&el, |_| {
-                let ok = js::compile::evaluate_with_filename(
-                    &scope,
-                    "globalThis._t1Fired = false; \
-                     globalThis._tid1 = setTimeout(function() { globalThis._t1Fired = true; }, 1); \
-                     if (globalThis._tid1 <= 0) throw new Error('timer id must be > 0, got ' + globalThis._tid1); \
-                     clearTimeout(globalThis._tid1 + 1); \
-                     globalThis._ivTicks2 = 0; \
-                     globalThis._iv2 = setInterval(function() { \
-                       globalThis._ivTicks2++; \
-                       if (globalThis._ivTicks2 >= 2) clearInterval(globalThis._iv2); \
-                     }, 1); \
-                     clearTimeout(-0.5); clearTimeout(0); clearTimeout(999999); clearTimeout(-7); \
-                     globalThis._t3Fired = false; \
-                     globalThis._tid3 = setTimeout(function() { globalThis._t3Fired = true; }, 1); \
-                     clearTimeout(String(globalThis._tid3));",
-                    "<test-timer-ids>",
-                    1,
-                );
-                assert!(ok.is_ok(), "timer-id JS evaluation failed");
-            });
-        }
-
-        block_on_event_loop(&scope, &mut el);
-
-        assert_eq!(
-            counter.get(),
-            1,
-            "internal tasks must be unreachable from clearTimeout"
-        );
-        let result = js::compile::evaluate_with_filename(
-            &scope,
-            "[globalThis._t1Fired, globalThis._ivTicks2, globalThis._t3Fired].join(',')",
-            "<test-timer-ids-check>",
-            1,
-        );
-        let val = result.unwrap();
-        let s = js::JSString::from_value(&scope, val)
-            .unwrap()
-            .to_utf8(&scope)
-            .unwrap();
-        assert_eq!(
-            s, "true,2,false",
-            "junk clears must be no-ops, a pre-cleared id must not poison a \
-             later interval, and a string id must coerce and clear"
-        );
-    }
-
-    // ---- Test 8f: expired timers fire in deadline order ----
-    #[cfg(not(target_arch = "wasm32"))]
-    {
-        let mut el = EventLoop::new();
-
-        {
-            with_event_loop(&el, |_| {
-                let ok = js::compile::evaluate_with_filename(
-                    &scope,
-                    // `late` is registered last so that its deadline follows the
-                    // others' however long each `setTimeout` call itself takes.
-                    "globalThis._fireOrder = []; \
-                     setTimeout(function() { globalThis._fireOrder.push('early'); }, 10); \
-                     globalThis._goner = setTimeout(function() { globalThis._fireOrder.push('goner'); }, 10); \
-                     setTimeout(function() { globalThis._fireOrder.push('early2'); }, 10); \
-                     setTimeout(function() { globalThis._fireOrder.push('late'); }, 40); \
-                     clearTimeout(globalThis._goner);",
-                    "<test-deadline-order>",
-                    1,
-                );
-                assert!(ok.is_ok(), "deadline-order JS evaluation failed");
-            });
-        }
-
-        // Let every deadline pass before the loop runs, so one advance_timers
-        // call marks them all ready at once — the order must then come from
-        // the deadlines, not from queue positions (which the clearTimeout's
-        // swap_remove perturbed).
-        std::thread::sleep(Duration::from_millis(60));
-        block_on_event_loop(&scope, &mut el);
-
-        let result = js::compile::evaluate_with_filename(
-            &scope,
-            "globalThis._fireOrder.join(',')",
-            "<test-deadline-order-check>",
-            1,
-        );
-        let val = result.unwrap();
-        let s = js::JSString::from_value(&scope, val)
-            .unwrap()
-            .to_utf8(&scope)
-            .unwrap();
-        assert_eq!(
-            s, "early,early2,late",
-            "expired timers must fire in deadline order, ties in scheduling \
-             order, regardless of cancellations"
-        );
-    }
-
-    // ---- Test 8g: interval arguments survive moving GC across re-queues ----
-    // While a task runs it is out of the loop's task list and untraced, so the
-    // re-queued interval must rebuild its argument Heaps from scope roots.
-    // Compacting on every allocation makes a stale Heap fail deterministically.
-    #[cfg(not(target_arch = "wasm32"))]
-    {
-        let mut el = EventLoop::new();
-
-        {
-            with_event_loop(&el, |_| {
-                let ok = js::compile::evaluate_with_filename(
-                    &scope,
-                    "globalThis._gcArgSeen = []; \
-                     globalThis._gcIv = setInterval(function(tag) { \
-                       globalThis._gcArgSeen.push(tag.name); \
-                       if (globalThis._gcArgSeen.length >= 3) clearInterval(globalThis._gcIv); \
-                     }, 1, { name: 'payload' });",
-                    "<test-gc-args>",
-                    1,
-                );
-                assert!(ok.is_ok(), "interval-with-args JS evaluation failed");
-            });
-        }
-        #[cfg(feature = "debugmozjs")]
-        unsafe {
-            js::gc::SetGCZeal(scope.raw_cx_no_gc(), 14, 1)
-        };
-        block_on_event_loop(&scope, &mut el);
-        #[cfg(feature = "debugmozjs")]
-        unsafe {
-            js::gc::SetGCZeal(scope.raw_cx_no_gc(), 0, 0)
-        };
-
-        let result = js::compile::evaluate_with_filename(
-            &scope,
-            "globalThis._gcArgSeen.join(',')",
-            "<test-gc-args-check>",
-            1,
-        );
-        let val = result.unwrap();
-        let s = js::JSString::from_value(&scope, val)
-            .unwrap()
-            .to_utf8(&scope)
-            .unwrap();
-        assert_eq!(
-            s, "payload,payload,payload",
-            "interval arguments must survive compacting GC between re-queues"
-        );
-    }
-
-    // ---- Test 9: clearTimeout cancels a timer ----
-    {
-        let el = EventLoop::new();
-
-        {
-            with_event_loop(&el, |_| {
-                let ok = js::compile::evaluate_with_filename(
-                    &scope,
-                    "globalThis._cleared = true; var tid = setTimeout(function() { globalThis._cleared = false; }, 1); clearTimeout(tid);",
-                    "<test-clear>",
-                    1,
-                );
-                assert!(ok.is_ok());
-            });
-        }
-
-        // After clearTimeout, the event loop should be empty.
-        assert!(el.is_empty(), "clearTimeout should have removed the timer");
-
-        // Verify the callback did NOT run.
-        let result = js::compile::evaluate_with_filename(
-            &scope,
-            "globalThis._cleared",
-            "<test-check-clear>",
-            1,
-        );
-        assert!(result.is_ok());
-        let val = result.unwrap();
-        assert!(
-            val.is_boolean() && val.to_boolean(),
-            "clearTimeout should prevent callback"
-        );
-    }
-
-    // ---- Test 10: setInterval fires multiple times ----
-    #[cfg(not(target_arch = "wasm32"))]
-    {
-        let mut el = EventLoop::new();
-
-        {
-            with_event_loop(&el, |_| {
-                let ok = js::compile::evaluate_with_filename(
-                    &scope,
-                    r#"
-                    globalThis._intervalCount = 0;
-                    globalThis._intervalId = setInterval(function() {
-                        globalThis._intervalCount++;
-                        if (globalThis._intervalCount >= 3) {
-                            clearInterval(globalThis._intervalId);
-                        }
-                    }, 1);
-                    "#,
-                    "<test-interval>",
-                    1,
-                );
-                assert!(ok.is_ok());
-            });
-        }
-
-        assert!(el.has_pending());
-
-        block_on_event_loop(&scope, &mut el);
-
-        // Verify the interval fired exactly 3 times and then stopped.
-        let result = js::compile::evaluate_with_filename(
-            &scope,
-            "globalThis._intervalCount",
-            "<test-check-interval>",
-            1,
-        );
-        assert!(result.is_ok());
-        let val = result.unwrap();
-        let count = if val.is_int32() {
-            val.to_int32()
-        } else {
-            val.to_double() as i32
-        };
-        assert_eq!(count, 3, "setInterval should have fired exactly 3 times");
-    }
-
-    // ---- Test 11: Event loop with microtasks (promise reactions) ----
-    {
-        // Evaluate JS that creates a resolved promise — the .then callback
-        // should run during run_microtasks.
-        let ok = js::compile::evaluate_with_filename(
-            &scope,
-            "globalThis._promiseResult = 0; Promise.resolve(42).then(v => { globalThis._promiseResult = v; });",
-            "<test-promise>",
-            1,
-        );
-        assert!(ok.is_ok());
-
-        // Run microtasks to process the promise.
-        run_microtasks(&scope);
-
-        let result = js::compile::evaluate_with_filename(
-            &scope,
-            "globalThis._promiseResult",
-            "<test-check-promise>",
-            1,
-        );
-        assert!(result.is_ok());
-        let val = result.unwrap();
-        let n = if val.is_int32() {
-            val.to_int32()
-        } else {
-            val.to_double() as i32
-        };
-        assert_eq!(n, 42, "Promise.resolve .then should have run");
-    }
-
-    // ---- Test 12: step() returns Done on empty event loop ----
-    {
-        let el = EventLoop::new();
-        let outcome = el.step(&scope);
-        assert_eq!(outcome, StepOutcome::Done);
-    }
-
-    // ---- Test 13: step() returns Progressed when tasks run ----
-    {
-        let el = EventLoop::new();
-        let counter = Rc::new(Cell::new(0u32));
-
-        el.queue_ready(Box::new(CounterTask {
-            counter: counter.clone(),
-            label: "step-prog",
-        }));
-
-        let outcome = el.step(&scope);
-        assert_eq!(outcome, StepOutcome::Progressed);
-        assert_eq!(counter.get(), 1);
-    }
-
-    // ---- Test 14: step() returns Idle when tasks exist but none ready ----
-    {
-        let el = EventLoop::new();
-        let counter = Rc::new(Cell::new(0u32));
-
-        // Queue a task but don't signal it ready.
-        let _id = el.queue(Box::new(CounterTask {
-            counter: counter.clone(),
-            label: "step-idle",
-        }));
-
-        let outcome = el.step(&scope);
-        assert_eq!(outcome, StepOutcome::Idle);
-        assert_eq!(counter.get(), 0);
-    }
-
-    // ---- Test 15: step() returns Idle with interest but no tasks ----
-    {
-        let el = EventLoop::new();
-
-        let interest = el.acquire_interest_handle();
-        assert!(el.has_interest());
-        assert!(el.is_alive());
-
-        let outcome = el.step(&scope);
-        assert_eq!(outcome, StepOutcome::Idle);
-
-        interest.release();
-        assert!(!el.has_interest());
-
-        let outcome = el.step(&scope);
-        assert_eq!(outcome, StepOutcome::Done);
-    }
-
-    // ---- Test 16: is_alive combines interest and pending ----
-    {
-        let el = EventLoop::new();
-
-        assert!(!el.is_alive());
-
-        // Interest alone keeps it alive.
-        let interest = el.acquire_interest_handle();
-        assert!(el.is_alive());
-        drop(interest);
-        assert!(!el.is_alive());
-
-        // Pending tasks alone keep it alive.
-        let counter = Rc::new(Cell::new(0u32));
-        el.queue(Box::new(CounterTask {
-            counter: counter.clone(),
-            label: "alive-test",
-        }));
-        assert!(el.is_alive());
-    }
-
-    // ---- Test 17: step() runs timer tasks after advance ----
-    {
-        let el = EventLoop::new();
-        let counter = Rc::new(Cell::new(0u32));
-
-        // Queue a timer with deadline in the past.
-        el.queue_timer(
-            Box::new(CounterTask {
-                counter: counter.clone(),
-                label: "step-timer",
-            }),
-            Instant::now(),
-        );
-
-        // step() advances timers internally.
-        let outcome = el.step(&scope);
-        assert_eq!(outcome, StepOutcome::Progressed);
-        assert_eq!(counter.get(), 1);
-        assert!(el.is_empty());
-    }
-
-    // ---- Test 18: run_to_completion respects interest tracking ----
-    #[cfg(not(target_arch = "wasm32"))]
-    {
-        let mut el = EventLoop::new();
-
-        // Acquire interest, queue a task that releases it (by dropping the handle).
-        let interest = el.acquire_interest_handle();
-
-        struct ReleaseInterestTask {
-            interest: Option<core_runtime::event_loop::InterestHandle>,
-        }
-        impl Task for ReleaseInterestTask {
-            fn kind(&self) -> &'static str {
-                "release-interest"
-            }
-            fn run(
-                mut self: Box<Self>,
-                _scope: &Scope<'_>,
-                _id: core_runtime::event_loop::TaskId,
-            ) -> Result<(), ExnThrown> {
-                drop(self.interest.take());
-                Ok(())
-            }
-            fn trace(&self, _trc: *mut JSTracer) {}
-        }
-
-        el.queue_ready(Box::new(ReleaseInterestTask {
-            interest: Some(interest),
-        }));
-
-        // With interest, the native driver should run the task and then
-        // exit once interest drops to zero and no tasks remain.
-        block_on_event_loop(&scope, &mut el);
-        assert!(!el.has_interest());
-        assert!(el.is_empty());
-    }
-}
diff --git a/crates/core-runtime/tests/heap_value.rs b/crates/core-runtime/tests/heap_value.rs
index 631a8465..5318ee91 100644
--- a/crates/core-runtime/tests/heap_value.rs
+++ b/crates/core-runtime/tests/heap_value.rs
@@ -61,7 +61,7 @@ fn heap_value_survives_move_and_compacting_gc() {
     // Read back through a rooted get; the object must still be reachable and
     // carry its marker, proving the barrier tracked any relocation.
     let rooted = heaps[0].get(&scope);
-    let recovered = Object::from_value(&scope, *rooted).expect("still an object");
+    let recovered = Object::from_raw_value(&scope, rooted.get()).expect("still an object");
     let got = recovered.get_property(&scope, c"marker").unwrap();
     assert_eq!(got.to_int32(), 4242);
 }
diff --git a/crates/core-runtime/tests/implicit_ctor.rs b/crates/core-runtime/tests/implicit_ctor.rs
index aa738f66..5f0b2501 100644
--- a/crates/core-runtime/tests/implicit_ctor.rs
+++ b/crates/core-runtime/tests/implicit_ctor.rs
@@ -6,8 +6,8 @@
 //! that is not constructible from JS: `new Foo()` throws a `TypeError`
 //! ("Illegal constructor"). An unannotated constructor-shaped fn — either
 //! `fn any_name() -> Self` or the setup-style `fn new(&self, ...)` — is still
-//! treated as a Rust-side constructor, so `Foo::new(scope, ...)` keeps
-//! working.
+//! treated as a Rust-side constructor, so `Foo::new(scope, ...)` works.
+
 // This file contains nothing platform-specific, so skip it on wasm32.
 #![cfg(not(target_arch = "wasm32"))]
 
@@ -16,7 +16,7 @@ use core_runtime::runtime::Runtime;
 use core_runtime::test_util::eval_with_setup;
 use core_runtime::{jsclass, jsmethods};
 
-/// Old-style Rust constructor (`fn new() -> Self`), no `#[constructor]`.
+/// A class with a Rust constructor (`fn new() -> Self`) and no `#[constructor]`.
 #[jsclass]
 struct RustOnly {
     n: i32,
@@ -153,97 +153,36 @@ fn setup() {
     });
 }
 
-/// `new Foo()` must throw a `TypeError` when no `#[constructor]` is present.
-#[test]
-fn js_construction_throws() {
-    for class in [
-        "RustOnly",
-        "RenamedCtor",
-        "ManyFactories",
-        "RustOnlySetup",
-        "NoCtorAtAll",
-    ] {
-        let result = eval_with_setup(
-            setup,
-            &format!(
-                "try {{ new {class}(); 'no-throw' }} \
-                 catch (e) {{ (e instanceof TypeError) + ':' + e.message }}"
-            ),
-        );
-        assert_eq!(result, "true:Illegal constructor", "for class {class}");
-    }
-}
-
-/// The interface object is still installed and usable (statics, prototype).
+/// `new Foo()` throws a `TypeError` when no `#[constructor]` is present. The interface object is
+/// installed regardless. An extra factory next to a `#[constructor]` is not exposed to JS.
 #[test]
-fn interface_object_still_installed() {
-    let result = eval_with_setup(setup, "NoCtorAtAll.answer()");
-    assert_eq!(result, "42");
-}
-
-/// A class that does declare a `#[constructor]` stays constructible from JS.
-#[test]
-fn explicit_constructor_still_works() {
-    let result = eval_with_setup(setup, "new Constructible(5).n");
-    assert_eq!(result, "5");
+fn only_explicit_constructors_are_js_constructible() {
+    let result = eval_with_setup(
+        setup,
+        "const outcomes = ['RustOnly', 'RenamedCtor', 'ManyFactories', 'RustOnlySetup', 'NoCtorAtAll']
+             .map(name => {
+                 try { new globalThis[name](); return `${name}:no-throw`; }
+                 catch (e) { return `${e instanceof TypeError}:${e.message}`; }
+             });
+         [...new Set(outcomes), NoCtorAtAll.answer(), new Constructible(5).n,
+          new CtorPlusFactory(5).n, typeof CtorPlusFactory.doubled].join()",
+    );
+    assert_eq!(result, "true:Illegal constructor,42,5,5,undefined");
 }
 
-/// `Foo::new(scope)` still works from Rust for the old-style shape.
+/// Every constructor-shaped fn gets a Rust-side factory under its own name.
 #[test]
-fn rust_side_new_works() {
+fn rust_side_factories_construct_instances() {
     setup();
     let rt = Runtime::init(&RuntimeConfig::default()).expect("runtime init");
     let scope = rt.default_global();
     let obj = RustOnly::new(&scope).unwrap();
-    assert_eq!(obj.data().n, 7);
-    assert_eq!(obj.n(), 7);
-}
-
-/// The factory keeps the source fn's name: `fn from_parts` becomes
-/// `Foo::from_parts(scope, …)`, and no `Foo::new` is conjured up.
-#[test]
-fn rust_side_renamed_ctor_works() {
-    setup();
-    let rt = Runtime::init(&RuntimeConfig::default()).expect("runtime init");
-    let scope = rt.default_global();
-    let obj = RenamedCtor::from_parts(&scope, 3).unwrap();
-    assert_eq!(obj.data().n, 3);
-}
-
-/// Every constructor-shaped fn gets a factory under its own name.
-#[test]
-fn rust_side_multiple_factories() {
-    setup();
-    let rt = Runtime::init(&RuntimeConfig::default()).expect("runtime init");
-    let scope = rt.default_global();
+    assert_eq!((obj.data().n, obj.n()), (7, 7));
+    assert_eq!(RenamedCtor::from_parts(&scope, 3).unwrap().data().n, 3);
     assert_eq!(ManyFactories::new(&scope).unwrap().data().n, 0);
     assert_eq!(ManyFactories::from_n(&scope, 6).unwrap().data().n, 6);
     assert_eq!(ManyFactories::doubled(&scope, 6).unwrap().data().n, 12);
-}
-
-/// An extra factory coexists with a JS constructor: `new` is the
-/// `#[constructor]`'s, and the extra is reachable only from Rust.
-#[test]
-fn rust_side_factory_alongside_js_constructor() {
-    let js = eval_with_setup(
-        setup,
-        "new CtorPlusFactory(5).n + ':' + typeof CtorPlusFactory.doubled",
-    );
-    assert_eq!(js, "5:undefined");
-
-    setup();
-    let rt = Runtime::init(&RuntimeConfig::default()).expect("runtime init");
-    let scope = rt.default_global();
     assert_eq!(CtorPlusFactory::new(&scope, 5).unwrap().data().n, 5);
     assert_eq!(CtorPlusFactory::doubled(&scope, 5).unwrap().data().n, 10);
-}
-
-/// `Foo::new(scope, args)` still works from Rust for the setup-style shape.
-#[test]
-fn rust_side_setup_new_works() {
-    setup();
-    let rt = Runtime::init(&RuntimeConfig::default()).expect("runtime init");
-    let scope = rt.default_global();
-    let obj = RustOnlySetup::new(&scope, 11).unwrap();
-    assert_eq!(obj.data().n, 11);
+    assert_eq!(RustOnlySetup::new(&scope, 11).unwrap().data().n, 11);
 }
diff --git a/crates/core-runtime/tests/instance_value_unforgeable.rs b/crates/core-runtime/tests/instance_value_unforgeable.rs
index 50101896..56f2d7f2 100644
--- a/crates/core-runtime/tests/instance_value_unforgeable.rs
+++ b/crates/core-runtime/tests/instance_value_unforgeable.rs
@@ -1,10 +1,8 @@
 // SPDX-License-Identifier: Apache-2.0-WITH-LLVM-exception
 
-//! Regression test: a method returning `Self` (the `InstanceValue` codegen
-//! path) must mint instances that carry `[LegacyUnforgeable]` own accessors,
-//! exactly like the constructor and Rust-side factory paths. The JS-native
-//! trampoline used to skip `install_unforgeable`, so an instance returned from
-//! a JS method call lacked the own accessor entirely.
+//! Instances carry `[LegacyUnforgeable]` own accessors whichever path creates them: the
+//! constructor, a method returning `Self` (the `InstanceValue` codegen path), or a JS or Rust
+//! subclass.
 
 // This file contains nothing platform-specific, so skip it on wasm32.
 #![cfg(not(target_arch = "wasm32"))]
@@ -72,21 +70,9 @@ fn dup_instance_has_unforgeable_own_accessor() {
         eval_with_setup(
             setup,
             "const d = new Widget().dup(); \
-             typeof Object.getOwnPropertyDescriptor(d, 'kind') === 'object'"
+             [typeof Object.getOwnPropertyDescriptor(d, 'kind'), d.kind].join()"
         ),
-        "true"
-    );
-    assert_eq!(eval_with_setup(setup, "new Widget().dup().kind"), "42");
-}
-
-#[test]
-fn unforgeable_accessor_is_not_on_prototype() {
-    assert_eq!(
-        eval_with_setup(
-            setup,
-            "Object.getOwnPropertyDescriptor(Widget.prototype, 'kind') === undefined"
-        ),
-        "true"
+        "object,42"
     );
 }
 
@@ -103,15 +89,17 @@ fn instances_share_one_getter_function() {
     );
 }
 
+/// The accessor is an own property only, not one of the prototype.
 #[test]
-fn unforgeable_accessor_is_enumerable_and_non_configurable() {
+fn unforgeable_accessor_is_an_enumerable_non_configurable_own_property() {
     assert_eq!(
         eval_with_setup(
             setup,
             "const d = Object.getOwnPropertyDescriptor(new Widget(), 'kind'); \
-             [d.enumerable, d.configurable, d.set].join()"
+             [d.enumerable, d.configurable, d.set, \
+              Object.getOwnPropertyDescriptor(Widget.prototype, 'kind')].join()"
         ),
-        "true,false,"
+        "true,false,,"
     );
 }
 
diff --git a/crates/core-runtime/tests/jsglobals_use.rs b/crates/core-runtime/tests/jsglobals_use.rs
index d7387144..f6ec23dd 100644
--- a/crates/core-runtime/tests/jsglobals_use.rs
+++ b/crates/core-runtime/tests/jsglobals_use.rs
@@ -1,10 +1,6 @@
 // SPDX-License-Identifier: Apache-2.0-WITH-LLVM-exception
 
-//! Regression test for `#[jsglobals]` class registration via `pub use`.
-//!
-//! Only `pub use Foo;` (a plain name) was registered; a grouped
-//! `pub use {A, B};` or a renamed `pub use Foo as Bar;` was silently skipped,
-//! so the class was never installed on the global. All forms are now handled.
+//! `#[jsglobals]` registers each class a grouped `pub use {A, B};` names.
 
 // This file contains nothing platform-specific, so skip it on wasm32.
 #![cfg(not(target_arch = "wasm32"))]
@@ -57,8 +53,8 @@ fn setup() {
 
 #[test]
 fn grouped_use_registers_all_classes() {
-    assert_eq!(eval_with_setup(setup, "typeof Alpha"), "function");
-    assert_eq!(eval_with_setup(setup, "typeof Beta"), "function");
-    assert_eq!(eval_with_setup(setup, "new Alpha().tag"), "alpha");
-    assert_eq!(eval_with_setup(setup, "new Beta().tag"), "beta");
+    assert_eq!(
+        eval_with_setup(setup, "[new Alpha().tag, new Beta().tag].join()"),
+        "alpha,beta"
+    );
 }
diff --git a/crates/core-runtime/tests/multi_global_registry.rs b/crates/core-runtime/tests/multi_global_registry.rs
index 8b71251c..68bec7f0 100644
--- a/crates/core-runtime/tests/multi_global_registry.rs
+++ b/crates/core-runtime/tests/multi_global_registry.rs
@@ -70,7 +70,7 @@ fn displaced_global_registry_survives_compacting_gc() {
     let proto_reg = js::class::get_prototype_object_for::<ProbeImpl>(&scope_a)
         .expect("Probe prototype registered in realm A");
     let ctor = scope_a.global().get_property(&scope_a, c"Probe").unwrap();
-    let ctor = js::Object::from_value(&scope_a, *ctor).unwrap();
+    let ctor = js::Object::from_raw_value(&scope_a, ctor.get()).unwrap();
     let proto_js = ctor.get_property(&scope_a, c"prototype").unwrap();
     assert!(proto_js.is_object());
     assert_eq!(
diff --git a/crates/core-runtime/tests/parameterized_types.rs b/crates/core-runtime/tests/parameterized_types.rs
index cd17842f..6b2feae3 100644
--- a/crates/core-runtime/tests/parameterized_types.rs
+++ b/crates/core-runtime/tests/parameterized_types.rs
@@ -6,17 +6,25 @@
 //! - `#[webidl_union]` (union)
 //! - `AsyncSequence` (async iterable)
 
+// This file contains nothing platform-specific, so skip it on wasm32.
+#![cfg(not(target_arch = "wasm32"))]
+
+/// Run [`eval_with_setup`](core_runtime::test_util::eval_with_setup) on `code` with `r(f)`
+/// defined. `r(f)` returns `String(f())`, or `throws:` followed by the constructor name of the
+/// exception `f` threw.
+fn eval_outcomes(setup: impl FnOnce(), code: &str) -> String {
+    let prelude =
+        "const r = f => { try { return String(f()); } catch (e) { return `throws:${e.constructor.name}`; } };";
+    core_runtime::test_util::eval_with_setup(setup, &format!("{prelude}\n{code}"))
+}
+
 // ============================================================================
 // Vec<T> (sequence) tests
 // ============================================================================
 
-// This file contains nothing platform-specific, so skip it on wasm32.
-#![cfg(not(target_arch = "wasm32"))]
-
 mod sequence_tests {
     use core_runtime::jsclass;
     use core_runtime::jsmethods;
-    use core_runtime::test_util::{eval_with_setup, throws_with_setup};
 
     #[jsclass]
     struct SeqAcceptor {}
@@ -57,18 +65,7 @@ mod sequence_tests {
     }
 
     fn eval(code: &str) -> String {
-        eval_with_setup(
-            || {
-                core_runtime::runtime::register_global_initializer(|scope, global| {
-                    SeqAcceptor::add_to_global(scope, global);
-                });
-            },
-            code,
-        )
-    }
-
-    fn throws(code: &str) -> bool {
-        throws_with_setup(
+        super::eval_outcomes(
             || {
                 core_runtime::runtime::register_global_initializer(|scope, global| {
                     SeqAcceptor::add_to_global(scope, global);
@@ -79,62 +76,31 @@ mod sequence_tests {
     }
 
     #[test]
-    fn join_string_array() {
+    fn sequences_convert_from_any_iterable() {
         assert_eq!(
-            eval("new SeqAcceptor().joinStrings(['a', 'b', 'c'])"),
-            "a,b,c"
+            eval(
+                "const s = new SeqAcceptor();
+                 [r(() => s.joinStrings(['a', 'b'])), r(() => s.joinStrings([])),
+                  r(() => s.sumInts([1, 2, 3])), r(() => s.joinStrings(new Set(['x', 'y']))),
+                  r(() => SeqAcceptor.count(['a', 'b'])), r(() => s.joinStrings(42))].join('|')"
+            ),
+            "a,b||6|x,y|2|throws:TypeError"
         );
     }
 
+    /// `null` is a present value, which isn't iterable. Only `undefined` makes the argument
+    /// absent.
     #[test]
-    fn join_empty_array() {
-        assert_eq!(eval("new SeqAcceptor().joinStrings([])"), "");
-    }
-
-    #[test]
-    fn sum_int_array() {
-        assert_eq!(eval("new SeqAcceptor().sumInts([1, 2, 3])"), "6");
-    }
-
-    #[test]
-    fn sum_empty_array() {
-        assert_eq!(eval("new SeqAcceptor().sumInts([])"), "0");
-    }
-
-    #[test]
-    fn optional_seq_present() {
-        assert_eq!(eval("new SeqAcceptor().optionalSeq(['x', 'y'])"), "x,y");
-    }
-
-    #[test]
-    fn optional_seq_null_throws() {
-        // `null` is a present value (not absent); converting it to a sequence throws (not iterable).
-        assert!(throws("new SeqAcceptor().optionalSeq(null)"));
-    }
-
-    #[test]
-    fn optional_seq_undefined() {
-        assert_eq!(eval("new SeqAcceptor().optionalSeq(undefined)"), "none");
-    }
-
-    #[test]
-    fn static_count() {
-        assert_eq!(eval("SeqAcceptor.count(['a', 'b'])"), "2");
-    }
-
-    #[test]
-    fn iterable_protocol() {
-        // Any iterable should work, not just arrays.
+    fn optional_sequences_are_absent_only_for_undefined() {
         assert_eq!(
-            eval("new SeqAcceptor().joinStrings(new Set(['x', 'y']))"),
-            "x,y"
+            eval(
+                "const s = new SeqAcceptor();
+                 [r(() => s.optionalSeq(['x', 'y'])), r(() => s.optionalSeq(undefined)),
+                  r(() => s.optionalSeq(null))].join('|')"
+            ),
+            "x,y|none|throws:TypeError"
         );
     }
-
-    #[test]
-    fn non_iterable_throws() {
-        assert!(throws("new SeqAcceptor().joinStrings(42)"));
-    }
 }
 
 // ============================================================================
@@ -144,7 +110,6 @@ mod sequence_tests {
 mod record_tests {
     use core_runtime::jsclass;
     use core_runtime::jsmethods;
-    use core_runtime::test_util::{eval_with_setup, throws_with_setup};
     use js::Record;
 
     #[jsclass]
@@ -186,18 +151,7 @@ mod record_tests {
     }
 
     fn eval(code: &str) -> String {
-        eval_with_setup(
-            || {
-                core_runtime::runtime::register_global_initializer(|scope, global| {
-                    RecordAcceptor::add_to_global(scope, global);
-                });
-            },
-            code,
-        )
-    }
-
-    fn throws(code: &str) -> bool {
-        throws_with_setup(
+        super::eval_outcomes(
             || {
                 core_runtime::runtime::register_global_initializer(|scope, global| {
                     RecordAcceptor::add_to_global(scope, global);
@@ -207,102 +161,35 @@ mod record_tests {
         )
     }
 
+    /// Every enumerable own key is converted to the key type, integer keys first in ascending
+    /// order, and a symbol key throws. Non-enumerable keys are skipped. `null` is a present value,
+    /// which isn't an object.
     #[test]
-    fn record_keys() {
-        assert_eq!(eval("new RecordAcceptor().keys({a: '1', b: '2'})"), "a,b");
-    }
-
-    #[test]
-    fn record_values() {
-        assert_eq!(
-            eval("new RecordAcceptor().values({x: 'hello', y: 'world'})"),
-            "hello,world"
-        );
-    }
-
-    #[test]
-    fn record_preserves_insertion_order() {
-        assert_eq!(
-            eval("new RecordAcceptor().keys({z: '1', a: '2', m: '3'})"),
-            "z,a,m"
-        );
-    }
-
-    #[test]
-    fn empty_record() {
-        assert_eq!(eval("new RecordAcceptor().keys({})"), "");
-    }
-
-    #[test]
-    fn optional_record_present() {
-        assert_eq!(eval("new RecordAcceptor().optionalRecord({k: 'v'})"), "k");
-    }
-
-    #[test]
-    fn optional_record_null_throws() {
-        // Per WebIDL, only `undefined`/a missing argument makes an optional argument absent; `null`
-        // is a present value, and converting it to a record throws (record conversion requires an
-        // object).
-        assert!(throws("new RecordAcceptor().optionalRecord(null)"));
-    }
-
-    #[test]
-    fn record_roundtrip_non_ascii_keys() {
-        // Keys must survive the JS→Rust→JS round trip; a Latin-1 write of
-        // the UTF-8 key bytes would mojibake the property name.
-        assert_eq!(
-            eval(
-                "const r = new RecordAcceptor().echo({'é🦊': 'vé'}); \
-                 Object.keys(r).join(',') + ':' + r['é🦊']"
-            ),
-            "é🦊:vé"
-        );
-    }
-
-    #[test]
-    fn record_roundtrip_interior_nul_key() {
-        // A NUL is a legal property-name code unit; a C-string write would
-        // fail and surface as a phantom exception.
+    fn records_convert_enumerable_own_keys_in_order() {
         assert_eq!(
             eval(
-                "const r = new RecordAcceptor().echo({'a\\u0000b': 'v'}); \
-                 Object.keys(r).map(k => k.length).join(',') + ':' + r['a\\u0000b']"
+                "const a = new RecordAcceptor();
+                 const sym = {a: '1'}; sym[Symbol('x')] = '2';
+                 const hidden = {a: '1'};
+                 Object.defineProperty(hidden, 'b', {value: '2', enumerable: false});
+                 [r(() => a.keys({z: '1', a: '2', m: '3'})), r(() => a.values({x: 'hi', y: 'yo'})),
+                  r(() => a.keys({})), r(() => a.keys({1: 'a', 0: 'b'})), r(() => a.keys(hidden)),
+                  r(() => a.keys(sym)), r(() => a.keys(42)), r(() => a.optionalRecord({k: 'v'})),
+                  r(() => a.optionalRecord(null))].join('|')"
             ),
-            "3:v"
+            "z,a,m|hi,yo||0,1|a|throws:TypeError|throws:TypeError|k|throws:TypeError"
         );
     }
 
+    /// Non-ASCII and NUL code units in keys survive the round trip through Rust.
     #[test]
-    fn non_object_throws() {
-        assert!(throws("new RecordAcceptor().keys(42)"));
-    }
-
-    #[test]
-    fn symbol_keys_throw() {
-        // Per WebIDL es-record, every enumerable own key — including symbols — is converted to the
-        // key type. Converting a Symbol to a string throws a TypeError, so an enumerable
-        // symbol-keyed property makes the whole conversion throw.
-        assert!(throws(
-            "let o = {a: '1'}; o[Symbol('x')] = '2'; new RecordAcceptor().keys(o)"
-        ));
-    }
-
-    #[test]
-    fn integer_keys_kept() {
-        // Integer-index property keys are own enumerable keys; per WebIDL they are converted to
-        // their string form and kept (the [[OwnPropertyKeys]] order lists them first, in ascending
-        // numeric order), not skipped.
-        assert_eq!(eval("new RecordAcceptor().keys({1: 'a', 0: 'b'})"), "0,1");
-    }
-
-    #[test]
-    fn skips_non_enumerable_keys() {
+    fn record_keys_round_trip() {
         assert_eq!(
             eval(
-                "let o = {a: '1'}; Object.defineProperty(o, 'b', {value: '2', enumerable: false}); \
-                 new RecordAcceptor().keys(o)"
+                "const e = new RecordAcceptor().echo({'é🦊': 'vé', 'a\\u0000b': 'v'}); \
+                 Object.keys(e).map(k => k.length).join(',') + ':' + e['é🦊'] + e['a\\u0000b']"
             ),
-            "a"
+            "3,3:vév"
         );
     }
 }
@@ -314,7 +201,6 @@ mod record_tests {
 mod union_tests {
     use core_runtime::jsclass;
     use core_runtime::jsmethods;
-    use core_runtime::test_util::eval_with_setup;
     use core_runtime::webidl_union;
 
     #[webidl_union]
@@ -396,7 +282,7 @@ mod union_tests {
     }
 
     fn eval(code: &str) -> String {
-        eval_with_setup(
+        super::eval_outcomes(
             || {
                 core_runtime::runtime::register_global_initializer(|scope, global| {
                     UnionAcceptor::add_to_global(scope, global);
@@ -406,86 +292,21 @@ mod union_tests {
         )
     }
 
+    /// A number picks the numeric member and a boolean the boolean member over a string member.
+    /// `null` is a present value, which the string member converts. Without a string member, the
+    /// numeric member is the fallback, and without either, the boolean member is.
     #[test]
-    fn string_or_long_with_number() {
-        assert_eq!(eval("new UnionAcceptor().stringOrLong(42)"), "long:42");
-    }
-
-    #[test]
-    fn string_or_long_with_string() {
-        assert_eq!(
-            eval("new UnionAcceptor().stringOrLong('hello')"),
-            "string:hello"
-        );
-    }
-
-    #[test]
-    fn string_or_bool_with_true() {
-        assert_eq!(eval("new UnionAcceptor().stringOrBool(true)"), "bool:true");
-    }
-
-    #[test]
-    fn string_or_bool_with_string() {
-        assert_eq!(
-            eval("new UnionAcceptor().stringOrBool('test')"),
-            "string:test"
-        );
-    }
-
-    #[test]
-    fn optional_union_null() {
-        // `null` is a present value (not absent); a union with a string member converts null via
-        // that member, yielding "null".
-        assert_eq!(
-            eval("new UnionAcceptor().optionalUnion(null)"),
-            "string:null"
-        );
-    }
-
-    #[test]
-    fn optional_union_undefined() {
-        assert_eq!(eval("new UnionAcceptor().optionalUnion(undefined)"), "none");
-    }
-
-    #[test]
-    fn optional_union_with_value() {
-        assert_eq!(eval("new UnionAcceptor().optionalUnion(99)"), "long:99");
-    }
-
-    #[test]
-    fn number_priority_over_string() {
-        // When a value is a number and union includes both numeric and string,
-        // numeric should take priority per spec.
-        assert_eq!(eval("new UnionAcceptor().stringOrLong(3.14)"), "long:3");
-    }
-
-    #[test]
-    fn boolean_priority_over_string() {
-        // Boolean should take priority over string per spec.
-        assert_eq!(
-            eval("new UnionAcceptor().stringOrBool(false)"),
-            "bool:false"
-        );
-    }
-
-    #[test]
-    fn numeric_fallback_without_string_member() {
-        // BoolOrLong has no string member, so a non-boolean value coerces to the
-        // numeric member via ToNumber (WebIDL §3.2.25 fallback).
-        assert_eq!(eval("new UnionAcceptor().boolOrLong('5')"), "long:5");
-        assert_eq!(eval("new UnionAcceptor().boolOrLong(7)"), "long:7");
-        assert_eq!(eval("new UnionAcceptor().boolOrLong(true)"), "bool:true");
-    }
-
-    #[test]
-    fn boolean_fallback_without_string_or_numeric_member() {
-        // SeqOrBool has neither a string nor a numeric member, so a non-iterable
-        // value coerces to the boolean member via ToBoolean.
-        assert_eq!(eval("new UnionAcceptor().seqOrBool(5)"), "flag:true");
-        assert_eq!(eval("new UnionAcceptor().seqOrBool(0)"), "flag:false");
+    fn unions_pick_the_member_the_value_converts_to() {
         assert_eq!(
-            eval("new UnionAcceptor().seqOrBool(['a', 'b', 'c'])"),
-            "seq:3"
+            eval(
+                "const u = new UnionAcceptor();
+                 [u.stringOrLong(3.14), u.stringOrLong('hello'), u.stringOrBool(false),
+                  u.stringOrBool('test'), u.optionalUnion(null), u.optionalUnion(undefined),
+                  u.optionalUnion(99), u.boolOrLong('5'), u.boolOrLong(true), u.seqOrBool(5),
+                  u.seqOrBool(0), u.seqOrBool(['a', 'b'])].join('|')"
+            ),
+            "long:3|string:hello|bool:false|string:test|string:null|none|long:99|long:5|bool:true|\
+             flag:true|flag:false|seq:2"
         );
     }
 }
@@ -493,7 +314,6 @@ mod union_tests {
 mod union_lifetime_tests {
     use core_runtime::jsclass;
     use core_runtime::jsmethods;
-    use core_runtime::test_util::{eval_with_setup, throws_with_setup};
     use core_runtime::webidl_union;
     use js::ArrayBuffer;
     use js::Object;
@@ -551,18 +371,7 @@ mod union_lifetime_tests {
     }
 
     fn eval(code: &str) -> String {
-        eval_with_setup(
-            || {
-                core_runtime::runtime::register_global_initializer(|scope, global| {
-                    LifetimeUnionAcceptor::add_to_global(scope, global);
-                });
-            },
-            code,
-        )
-    }
-
-    fn throws(code: &str) -> bool {
-        throws_with_setup(
+        super::eval_outcomes(
             || {
                 core_runtime::runtime::register_global_initializer(|scope, global| {
                     LifetimeUnionAcceptor::add_to_global(scope, global);
@@ -572,89 +381,24 @@ mod union_lifetime_tests {
         )
     }
 
+    /// A value that doesn't match the `ArrayBuffer` member falls back to the string member. The
+    /// members are tried in declaration order. A union without a fallback member throws.
     #[test]
-    fn buffer_variant_with_array_buffer() {
-        assert_eq!(
-            eval("new LifetimeUnionAcceptor().bufferOrString(new ArrayBuffer(8))"),
-            "buffer:8"
-        );
-    }
-
-    #[test]
-    fn string_variant_with_string() {
-        assert_eq!(
-            eval("new LifetimeUnionAcceptor().bufferOrString('hello')"),
-            "string:hello"
-        );
-    }
-
-    #[test]
-    fn string_variant_with_number() {
-        // No numeric branch is declared, so the string fallback applies.
-        assert_eq!(
-            eval("new LifetimeUnionAcceptor().bufferOrString(42)"),
-            "string:42"
-        );
-    }
-
-    #[test]
-    fn string_variant_when_object_does_not_match_buffer() {
-        // Plain objects don't satisfy the ArrayBuffer branch and fall through
-        // to the string fallback (after `Object.prototype.toString`).
-        assert_eq!(
-            eval("new LifetimeUnionAcceptor().bufferOrString({})"),
-            "string:[object Object]"
-        );
-    }
-
-    #[test]
-    fn optional_buffer_or_string_null() {
-        // `null` is a present value (not absent); a union with a string member converts null via
-        // that member, yielding "null".
-        assert_eq!(
-            eval("new LifetimeUnionAcceptor().optionalBufferOrString(null)"),
-            "string:null"
-        );
-    }
-
-    #[test]
-    fn optional_buffer_or_string_undefined() {
-        assert_eq!(
-            eval("new LifetimeUnionAcceptor().optionalBufferOrString(undefined)"),
-            "none"
-        );
-    }
-
-    #[test]
-    fn optional_buffer_or_string_with_buffer() {
-        assert_eq!(
-            eval("new LifetimeUnionAcceptor().optionalBufferOrString(new ArrayBuffer(4))"),
-            "buffer:4"
-        );
-    }
-
-    #[test]
-    fn declared_order_picks_buffer_first() {
-        assert_eq!(
-            eval("new LifetimeUnionAcceptor().bufferOrObject(new ArrayBuffer(16))"),
-            "buffer:16"
-        );
-    }
-
-    #[test]
-    fn declared_order_falls_back_to_object() {
+    fn unions_with_rooted_members_convert() {
         assert_eq!(
-            eval("new LifetimeUnionAcceptor().bufferOrObject({a: 1})"),
-            "object"
+            eval(
+                "const u = new LifetimeUnionAcceptor();
+                 [r(() => u.bufferOrString(new ArrayBuffer(8))), r(() => u.bufferOrString(42)),
+                  r(() => u.bufferOrString({})), r(() => u.optionalBufferOrString(null)),
+                  r(() => u.optionalBufferOrString(undefined)),
+                  r(() => u.optionalBufferOrString(new ArrayBuffer(4))),
+                  r(() => u.bufferOrObject(new ArrayBuffer(16))), r(() => u.bufferOrObject({a: 1})),
+                  r(() => u.bufferOrObject('not an object'))].join('|')"
+            ),
+            "buffer:8|string:42|string:[object Object]|string:null|none|buffer:4|buffer:16|object|\
+             throws:TypeError"
         );
     }
-
-    #[test]
-    fn buffer_or_object_throws_on_non_object() {
-        assert!(throws(
-            "new LifetimeUnionAcceptor().bufferOrObject('not an object')"
-        ));
-    }
 }
 
 // ============================================================================
@@ -664,7 +408,6 @@ mod union_lifetime_tests {
 mod union_sequence_record_tests {
     use core_runtime::jsclass;
     use core_runtime::jsmethods;
-    use core_runtime::test_util::{eval_with_setup, throws_with_setup};
     use core_runtime::webidl_union;
     use js::conversion::Record;
 
@@ -712,7 +455,7 @@ mod union_sequence_record_tests {
     }
 
     fn eval(code: &str) -> String {
-        eval_with_setup(
+        super::eval_outcomes(
             || {
                 core_runtime::runtime::register_global_initializer(|scope, global| {
                     SeqRecordAcceptor::add_to_global(scope, global);
@@ -722,72 +465,22 @@ mod union_sequence_record_tests {
         )
     }
 
-    fn throws(code: &str) -> bool {
-        throws_with_setup(
-            || {
-                core_runtime::runtime::register_global_initializer(|scope, global| {
-                    SeqRecordAcceptor::add_to_global(scope, global);
-                });
-            },
-            code,
-        )
-    }
-
-    #[test]
-    fn array_of_pairs_picks_sequence() {
-        assert_eq!(
-            eval("new SeqRecordAcceptor().classify([['a','1'], ['b','2']])"),
-            "pairs:a=1&b=2"
-        );
-    }
-
-    #[test]
-    fn plain_object_picks_record() {
-        assert_eq!(
-            eval("new SeqRecordAcceptor().classify({a:'1', b:'2'})"),
-            "record:a=1&b=2"
-        );
-    }
-
-    #[test]
-    fn string_picks_string() {
-        assert_eq!(
-            eval("new SeqRecordAcceptor().classify('hello')"),
-            "string:hello"
-        );
-    }
-
+    /// An iterable picks the sequence member, and then an element that isn't a sequence, or an
+    /// iterator that throws, makes the conversion throw rather than fall through to the record.
     #[test]
-    fn custom_iterable_picks_sequence() {
-        // A non-Array iterable with @@iterator must still be routed to the
-        // sequence branch.
+    fn sequence_or_record_unions_pick_by_iterability() {
         assert_eq!(
             eval(
-                "let it = { [Symbol.iterator]: function*() { yield ['a','1']; yield ['b','2']; } };\
-                 new SeqRecordAcceptor().classify(it)"
+                "const a = new SeqRecordAcceptor();
+                 const it = { [Symbol.iterator]: function*() { yield ['a','1']; yield ['b','2']; } };
+                 const bad = { [Symbol.iterator]() { return { next() { throw new Error('boom'); } }; } };
+                 [r(() => a.classify([['a','1'], ['b','2']])), r(() => a.classify({a:'1', b:'2'})),
+                  r(() => a.classify('hello')), r(() => a.classify(it)), r(() => a.classify([1, 2])),
+                  r(() => a.classify(bad))].join('|')"
             ),
-            "pairs:a=1&b=2"
+            "pairs:a=1&b=2|record:a=1&b=2|string:hello|pairs:a=1&b=2|throws:TypeError|throws:Error"
         );
     }
-
-    #[test]
-    fn iterable_with_non_iterable_element_throws() {
-        // WebIDL §3.2.25: once @@iterator is detected the sequence branch is
-        // selected; if an element can't be converted to the inner sequence
-        // type, the conversion *throws* — it does not silently fall through
-        // to the record branch.
-        assert!(throws("new SeqRecordAcceptor().classify([1, 2])"));
-    }
-
-    #[test]
-    fn iterable_throwing_iterator_propagates() {
-        // If the iterator throws, the failure propagates as an exception
-        // rather than being silently swallowed.
-        assert!(throws(
-            "let it = { [Symbol.iterator]: function() { return { next() { throw new Error('boom'); } }; } };\
-             new SeqRecordAcceptor().classify(it)"
-        ));
-    }
 }
 
 // ============================================================================
@@ -797,7 +490,6 @@ mod union_sequence_record_tests {
 mod async_sequence_tests {
     use core_runtime::jsclass;
     use core_runtime::jsmethods;
-    use core_runtime::test_util::{eval_with_setup, throws_with_setup};
     use js::AsyncSequence;
 
     #[jsclass]
@@ -827,7 +519,7 @@ mod async_sequence_tests {
     }
 
     fn eval(code: &str) -> String {
-        eval_with_setup(
+        super::eval_outcomes(
             || {
                 core_runtime::runtime::register_global_initializer(|scope, global| {
                     AsyncAcceptor::add_to_global(scope, global);
@@ -837,82 +529,24 @@ mod async_sequence_tests {
         )
     }
 
-    fn throws(code: &str) -> bool {
-        throws_with_setup(
-            || {
-                core_runtime::runtime::register_global_initializer(|scope, global| {
-                    AsyncAcceptor::add_to_global(scope, global);
-                });
-            },
-            code,
-        )
-    }
-
-    #[test]
-    fn sync_iterable_detected() {
-        // Arrays have Symbol.iterator but not Symbol.asyncIterator.
-        assert_eq!(eval("new AsyncAcceptor().isAsync([1, 2, 3])"), "false");
-    }
-
-    #[test]
-    fn async_iterable_detected() {
-        assert_eq!(
-            eval(
-                "let obj = { [Symbol.asyncIterator]() { return { next() { return { done: true } } } } }; \
-                 new AsyncAcceptor().isAsync(obj)"
-            ),
-            "true"
-        );
-    }
-
-    #[test]
-    fn optional_null_throws() {
-        // Per WebIDL, only `undefined`/a missing argument makes an optional argument absent; `null`
-        // is a present value, and converting it to a sequence/async iterable throws (null is not
-        // iterable).
-        assert!(throws("new AsyncAcceptor().optionalAsync(null)"));
-    }
-
-    #[test]
-    fn optional_with_iterable() {
-        assert_eq!(eval("new AsyncAcceptor().optionalAsync([1])"), "sync");
-    }
-
-    #[test]
-    fn non_iterable_throws() {
-        assert!(throws("new AsyncAcceptor().isAsync(42)"));
-    }
-
-    #[test]
-    fn plain_object_throws() {
-        assert!(throws("new AsyncAcceptor().isAsync({})"));
-    }
-
-    #[test]
-    fn throwing_getter_propagates() {
-        // GetMethod: a Get error propagates; it must not be swallowed and
-        // fall back to Symbol.iterator.
-        assert_eq!(
-            eval(
-                "let o = { get [Symbol.asyncIterator]() { throw new Error('trap') }, \
-                           [Symbol.iterator]() { return { next() { return { done: true } } } } }; \
-                 try { new AsyncAcceptor().isAsync(o); 'no throw' } catch (e) { e.message }"
-            ),
-            "trap"
-        );
-    }
-
+    /// A getter of `Symbol.asyncIterator` that throws, and a non-callable `Symbol.asyncIterator`,
+    /// throw rather than fall back to `Symbol.iterator`.
     #[test]
-    fn non_callable_method_throws() {
-        // GetMethod: a present, non-callable method is a TypeError, not a
-        // fallback to Symbol.iterator.
+    fn async_sequences_detect_async_iterables() {
         assert_eq!(
             eval(
-                "let o = { [Symbol.asyncIterator]: 42, \
-                           [Symbol.iterator]() { return { next() { return { done: true } } } } }; \
-                 try { new AsyncAcceptor().isAsync(o); 'no throw' } catch (e) { e.constructor.name }"
+                "const a = new AsyncAcceptor();
+                 const sync = { [Symbol.iterator]() { return { next() { return { done: true } } } } };
+                 const asyncIt = { [Symbol.asyncIterator]() { return { next() { return { done: true } } } } };
+                 const trap = { get [Symbol.asyncIterator]() { throw new RangeError('trap') }, \
+                                [Symbol.iterator]: sync[Symbol.iterator] };
+                 const notCallable = { [Symbol.asyncIterator]: 42, [Symbol.iterator]: sync[Symbol.iterator] };
+                 [r(() => a.isAsync([1, 2])), r(() => a.isAsync(asyncIt)), r(() => a.optionalAsync([1])),
+                  r(() => a.optionalAsync(null)), r(() => a.isAsync(42)), r(() => a.isAsync({})),
+                  r(() => a.isAsync(trap)), r(() => a.isAsync(notCallable))].join('|')"
             ),
-            "TypeError"
+            "false|true|sync|throws:TypeError|throws:TypeError|throws:TypeError|throws:RangeError|\
+             throws:TypeError"
         );
     }
 }
diff --git a/crates/core-runtime/tests/private_data_borrow.rs b/crates/core-runtime/tests/private_data_borrow.rs
index 1089b738..49db59d6 100644
--- a/crates/core-runtime/tests/private_data_borrow.rs
+++ b/crates/core-runtime/tests/private_data_borrow.rs
@@ -50,17 +50,6 @@ fn setup() {
     });
 }
 
-#[test]
-fn distinct_objects_do_not_conflict() {
-    // Each object has its own borrow flag, so borrowing two different objects at
-    // once is fine: `a.n` becomes 1, plus `b.n` (0).
-    let result = eval_with_setup(
-        setup,
-        "let a = new Borrowed(); let b = new Borrowed(); a.combine(b)",
-    );
-    assert_eq!(result, "1");
-}
-
 #[test]
 fn sequential_borrows_are_fine() {
     // Non-overlapping borrows (separate calls) never conflict; the second call
diff --git a/crates/core-runtime/tests/promise_args.rs b/crates/core-runtime/tests/promise_args.rs
index 01b59f31..781d9146 100644
--- a/crates/core-runtime/tests/promise_args.rs
+++ b/crates/core-runtime/tests/promise_args.rs
@@ -102,11 +102,11 @@ impl PromiseArgs {
     ) -> Result<Promise<'r>, ExnThrown> {
         match members.unchecked {
             Some(p) => Ok(p),
-            None => Promise::new_resolved_with_value(scope, js::value::undefined()),
+            None => Promise::new_resolved_with_value(scope, js::prelude::HandleValue::undefined()),
         }
     }
 
-    /// The checked member, likewise — its `Payload` check runs the same way an argument's does.
+    /// The checked member, whose `Payload` check runs the same way as for an argument.
     #[method]
     fn checked_member<'r>(
         &self,
@@ -115,7 +115,7 @@ impl PromiseArgs {
     ) -> Result<Promise<'r>, ExnThrown> {
         match members.checked {
             Some(p) => Ok(p.promise()),
-            None => Promise::new_resolved_with_value(scope, js::value::undefined()),
+            None => Promise::new_resolved_with_value(scope, js::prelude::HandleValue::undefined()),
         }
     }
 
@@ -129,7 +129,7 @@ impl PromiseArgs {
     ) -> Result<Promise<'r>, ExnThrown> {
         match p {
             Some(p) => Ok(p.promise()),
-            None => Promise::new_resolved_with_value(scope, js::value::undefined()),
+            None => Promise::new_resolved_with_value(scope, js::prelude::HandleValue::undefined()),
         }
     }
 }
@@ -156,8 +156,6 @@ fn eval_then_drain(code: &str, probe: &str) -> String {
     String::from_jsval(&scope, value, ()).expect("probe value is not a string")
 }
 
-/// The whole surface in one process: `JSEngine` initializes once per test
-/// binary, so the cases share a run and report through a single log.
 #[test]
 fn promise_arguments_wrap_any_value_and_check_the_type_later() {
     let log = eval_then_drain(
@@ -236,7 +234,7 @@ fn promise_arguments_wrap_any_value_and_check_the_type_later() {
     );
 }
 
-/// A missing required argument is an error at the call, not a value to wrap:
+/// A missing required argument fails at the call rather than being wrapped:
 /// WebIDL counts arguments before it converts any of them. Which *kind* of
 /// error is the ordinary rule for any operation — a promise-returning one
 /// rejects, everything else throws.
diff --git a/crates/core-runtime/tests/raw_ident_name.rs b/crates/core-runtime/tests/raw_ident_name.rs
index 9201d3e9..9270bab2 100644
--- a/crates/core-runtime/tests/raw_ident_name.rs
+++ b/crates/core-runtime/tests/raw_ident_name.rs
@@ -37,14 +37,9 @@ fn setup() {
 }
 
 #[test]
-fn raw_identifier_getter_uses_keyword_name() {
-    assert_eq!(eval_with_setup(setup, "new Node().type"), "element");
-}
-
-#[test]
-fn raw_identifier_method_uses_keyword_name() {
+fn raw_identifiers_use_the_keyword_name() {
     assert_eq!(
-        eval_with_setup(setup, "String(new Node().match('element'))"),
-        "true"
+        eval_with_setup(setup, "`${new Node().type} ${new Node().match('element')}`"),
+        "element true"
     );
 }
diff --git a/crates/core-runtime/tests/rest_args.rs b/crates/core-runtime/tests/rest_args.rs
index e8cb86d1..f2e170f3 100644
--- a/crates/core-runtime/tests/rest_args.rs
+++ b/crates/core-runtime/tests/rest_args.rs
@@ -77,8 +77,7 @@ impl Variadic {
         rest.iter().sum()
     }
 
-    /// A wide integer element type, confirming the fix spans `i8`..`u64` rather
-    /// than `i32` alone. Returned as `f64` so JS sees the exact small sums.
+    /// Typed `i64` variadic. The sum is returned as `f64` so JS sees the exact small sums.
     #[static_method]
     fn sum_longs(rest: RestArgs<i64>) -> f64 {
         rest.iter().sum::<i64>() as f64
@@ -99,179 +98,96 @@ fn throws(code: &str) -> bool {
     throws_with_setup(setup, code)
 }
 
-// ============================================================================
-// Typed numeric collection
-// ============================================================================
-
-#[test]
-fn sum_collects_numbers() {
-    assert_eq!(eval("Variadic.sum(1, 2, 3)"), "6");
-}
-
-#[test]
-fn sum_handles_floats() {
-    assert_eq!(eval("Variadic.sum(1.5, 2.5)"), "4");
-}
-
-#[test]
-fn sum_with_no_args_is_empty() {
-    assert_eq!(eval("Variadic.sum()"), "0");
-}
-
-#[test]
-fn sum_with_single_arg() {
-    assert_eq!(eval("Variadic.sum(42)"), "42");
-}
-
-/// Each element is converted with the lenient `ToNumber`, so a numeric string
-/// and a boolean coerce rather than throwing.
-#[test]
-fn sum_coerces_each_element() {
-    assert_eq!(eval("Variadic.sum(1, '2', true)"), "4");
-}
-
-// ============================================================================
-// Fixed parameter + variadic strings
-// ============================================================================
-
-#[test]
-fn join_collects_after_fixed_param() {
-    assert_eq!(eval("new Variadic().join('-', 'a', 'b', 'c')"), "a-b-c");
-}
-
-#[test]
-fn join_with_empty_rest_is_empty_string() {
-    assert_eq!(eval("new Variadic().join('-')"), "");
-}
-
-#[test]
-fn join_with_single_rest_element() {
-    assert_eq!(eval("new Variadic().join('-', 'solo')"), "solo");
-}
-
-/// The fixed `sep` argument is not collected into the rest; only arguments at
-/// or beyond the rest position are.
-#[test]
-fn join_does_not_swallow_the_separator() {
-    assert_eq!(eval("new Variadic().join(',', '1', '2')"), "1,2");
-}
-
-// ============================================================================
-// len() / is_empty()
-// ============================================================================
-
-#[test]
-fn count_reports_rest_length() {
-    assert_eq!(eval("new Variadic().count('a', 'b', 'c', 'd')"), "4");
-    assert_eq!(eval("new Variadic().count()"), "0");
-}
-
+/// Each element is converted with the lenient `ToNumber`, so a numeric string and a boolean
+/// coerce rather than throwing.
 #[test]
-fn is_empty_rest_reflects_argument_count() {
-    assert_eq!(eval("new Variadic().isEmptyRest()"), "true");
-    assert_eq!(eval("new Variadic().isEmptyRest('x')"), "false");
+fn numeric_rest_args_collect_and_coerce() {
+    assert_eq!(
+        eval("[Variadic.sum(1.5, '2', true), Variadic.sum()].join()"),
+        "4.5,0"
+    );
 }
 
-// ============================================================================
-// Boolean variadic (IntoIterator by value)
-// ============================================================================
-
+/// The fixed `sep` argument is not collected into the rest.
 #[test]
-fn any_true_finds_a_truthy_argument() {
-    assert_eq!(eval("Variadic.anyTrue(false, false, true)"), "true");
+fn rest_args_collect_after_fixed_params() {
+    assert_eq!(
+        eval("const v = new Variadic(); [v.join('-', 'a', 'b'), v.join('-')].join('|')"),
+        "a-b|"
+    );
 }
 
 #[test]
-fn any_true_is_false_when_all_falsy() {
-    assert_eq!(eval("Variadic.anyTrue(false, false)"), "false");
-    assert_eq!(eval("Variadic.anyTrue()"), "false");
+fn rest_args_report_len_and_is_empty() {
+    assert_eq!(
+        eval(
+            "const v = new Variadic(); \
+             [v.count('a', 'b'), v.count(), v.isEmptyRest(), v.isEmptyRest('x')].join()"
+        ),
+        "2,0,true,false"
+    );
 }
 
-/// `ToBoolean` coerces each argument; truthy values count.
+/// `ToBoolean` coerces each argument.
 #[test]
-fn any_true_coerces_arguments() {
-    assert_eq!(eval("Variadic.anyTrue(0, '', 'non-empty')"), "true");
+fn boolean_rest_args_coerce_each_element() {
+    assert_eq!(
+        eval(
+            "[Variadic.anyTrue(0, '', 'x'), Variadic.anyTrue(false, 0), Variadic.anyTrue()].join()"
+        ),
+        "true,false,false"
+    );
 }
 
-// ============================================================================
-// Variadic of class newtypes
-// ============================================================================
-
 #[test]
 fn count_selves_collects_instances() {
     assert_eq!(
-        eval("Variadic.countSelves(new Variadic(), new Variadic())"),
-        "2"
+        eval(
+            "[Variadic.countSelves(new Variadic(), new Variadic()), Variadic.countSelves()].join()"
+        ),
+        "2,0"
     );
-    assert_eq!(eval("Variadic.countSelves()"), "0");
-}
-
-// ============================================================================
-// Integer variadics (ConversionBehavior config)
-// ============================================================================
-
-#[test]
-fn sum_ints_collects_integers() {
-    assert_eq!(eval("Variadic.sumInts(1, 2, 3)"), "6");
-    assert_eq!(eval("Variadic.sumInts()"), "0");
-}
-
-/// Each element runs through `ToInt32`: a non-integer number truncates toward
-/// zero and a numeric string coerces.
-#[test]
-fn sum_ints_applies_to_int32() {
-    assert_eq!(eval("Variadic.sumInts(1, 2.7, '3')"), "6");
-    assert_eq!(eval("Variadic.sumInts(-1.9)"), "-1");
 }
 
-/// `ToInt32` wraps modulo 2^32, so 2^32 maps to 0.
+/// Each integer element runs through `ToInt32`: a non-integer number truncates toward zero, a
+/// numeric string coerces, and 2^32 + 1 wraps to 1.
 #[test]
-fn sum_ints_wraps_modulo_2_32() {
-    assert_eq!(eval("Variadic.sumInts(4294967296)"), "0");
-    assert_eq!(eval("Variadic.sumInts(4294967297)"), "1");
+fn integer_rest_args_convert_with_to_int32() {
+    assert_eq!(
+        eval(
+            "[Variadic.sumInts(1, 2.7, '3'), Variadic.sumInts(-1.9), Variadic.sumInts(4294967297), \
+              Variadic.sumInts(), Variadic.sumLongs(1000, 2000, 3000)].join()"
+        ),
+        "6,-1,1,0,6000"
+    );
 }
 
-#[test]
-fn sum_longs_handles_wide_integers() {
-    assert_eq!(eval("Variadic.sumLongs(1000, 2000, 3000)"), "6000");
-    assert_eq!(eval("Variadic.sumLongs()"), "0");
-}
-
-// ============================================================================
-// .length excludes the rest parameter
-// ============================================================================
-
-/// A function's `.length` counts required (non-`Option`, non-`RestArgs`)
-/// parameters, so the variadic tail never contributes.
+/// A function's `.length` counts required (non-`Option`, non-`RestArgs`) parameters, so the
+/// variadic tail never contributes.
 #[test]
 fn length_ignores_rest_parameter() {
-    // Only the rest param: length 0.
-    assert_eq!(eval("Variadic.sum.length"), "0");
-    assert_eq!(eval("Variadic.anyTrue.length"), "0");
-    assert_eq!(eval("Variadic.prototype.count.length"), "0");
-    // One fixed param ahead of the rest: length 1.
-    assert_eq!(eval("Variadic.prototype.join.length"), "1");
+    assert_eq!(
+        eval(
+            "[Variadic.sum.length, Variadic.anyTrue.length, Variadic.prototype.count.length, \
+              Variadic.prototype.join.length].join()"
+        ),
+        "0,0,0,1"
+    );
 }
 
-// ============================================================================
-// Conversion-error propagation
-// ============================================================================
-
-/// `String::from_jsval` runs `ToString`, which throws on a `Symbol`. The
-/// pending exception propagates out of the collection loop (the `ExnPending`
-/// arm), so the call throws.
+/// `String::from_jsval` runs `ToString`, which throws on a `Symbol`. The pending exception
+/// propagates out of the collection loop (the `ExnPending` arm), so the call throws.
 #[test]
 fn string_rest_throws_on_symbol() {
     assert!(throws("new Variadic().count(Symbol('x'))"));
 }
 
-/// A wrong-typed argument to a class-newtype rest fails the `cast`, producing
-/// a `ConversionError::Failure` that is thrown as a `TypeError` (the
-/// `throw_type_error` arm).
+/// A wrong-typed argument to a class-newtype rest fails the `cast`, producing a
+/// `ConversionError::Failure` that is thrown as a `TypeError`.
 #[test]
 fn class_rest_throws_on_wrong_type() {
-    assert!(throws("Variadic.countSelves({})"));
     assert!(throws("Variadic.countSelves(new Variadic(), 42)"));
+    assert!(throws("Variadic.countSelves({})"));
 }
 
 // ============================================================================
@@ -342,22 +258,18 @@ mod handle_value_tests {
         eval_with_setup(setup, code)
     }
 
+    /// `sumXAfterGc` runs a compacting GC while the handles are live, and reads the freshly
+    /// allocated objects back afterwards.
     #[test]
-    fn collects_raw_values() {
-        assert_eq!(eval("ValueVariadic.countValues(1, 'two', {}, null)"), "4");
-        assert_eq!(eval("ValueVariadic.countValues()"), "0");
-    }
-
-    /// Calling `sumXAfterGc` runs a real compacting GC mid-method while the
-    /// handles are live; the objects are freshly allocated (movable) and read
-    /// back afterwards.
-    #[test]
-    fn handles_survive_compacting_gc() {
+    fn raw_values_are_collected_and_survive_compacting_gc() {
         assert_eq!(
-            eval("ValueVariadic.sumXAfterGc({x: 1}, {x: 2}, {x: 3})"),
-            "6"
+            eval(
+                "[ValueVariadic.countValues(1, 'two', {}, null), ValueVariadic.countValues(), \
+                  ValueVariadic.sumXAfterGc({x: 1}, {x: 2}, {x: 3}), ValueVariadic.sumXAfterGc()]\
+                 .join()"
+            ),
+            "4,0,6,0"
         );
-        assert_eq!(eval("ValueVariadic.sumXAfterGc()"), "0");
     }
 
     /// The same path under GC zeal mode 14 (compact-on-every-GC), which forces
@@ -390,11 +302,6 @@ mod handle_value_tests {
 
 // ============================================================================
 // `RestArgs` on constructors
-//
-// `parse_method_info` has always collected the rest parameter for every method
-// kind, but `gen_constructor_body` dropped it on the floor, so a constructor
-// taking `RestArgs` failed to compile. Constructors now go through the same
-// collection as methods.
 // ============================================================================
 
 mod constructor_tests {
@@ -409,7 +316,6 @@ mod constructor_tests {
     #[jsclass]
     struct Tally {
         total: f64,
-        label: String,
     }
 
     #[jsmethods]
@@ -419,7 +325,6 @@ mod constructor_tests {
         fn construct(rest: RestArgs<f64>) -> Self {
             Self {
                 total: rest.iter().sum(),
-                label: String::new(),
             }
         }
 
@@ -427,11 +332,6 @@ mod constructor_tests {
         fn total(&self) -> f64 {
             self.data().total
         }
-
-        #[getter]
-        fn label(&self) -> String {
-            self.data().label.clone()
-        }
     }
 
     #[jsclass]
@@ -475,24 +375,14 @@ mod constructor_tests {
     }
 
     #[test]
-    fn constructor_collects_variadic_args() {
-        assert_eq!(eval("new Tally(1, 2, 3).total"), "6");
-    }
-
-    #[test]
-    fn constructor_with_no_variadic_args() {
-        assert_eq!(eval("new Tally().total"), "0");
-    }
-
-    #[test]
-    fn constructor_collects_after_fixed_params() {
-        assert_eq!(eval("new Labelled('a', 'x', 'y', 'z').count"), "3");
-        assert_eq!(eval("new Labelled('a', 'x', 'y', 'z').label"), "a");
-    }
-
-    #[test]
-    fn constructor_with_fixed_param_and_empty_tail() {
-        assert_eq!(eval("new Labelled('a').count"), "0");
+    fn constructors_collect_variadic_args() {
+        assert_eq!(
+            eval(
+                "[new Tally(1, 2, 3).total, new Tally().total, new Labelled('a', 'x', 'y').count, \
+                  new Labelled('a', 'x').label, new Labelled('a').count].join()"
+            ),
+            "6,0,2,a,0"
+        );
     }
 }
 
@@ -500,19 +390,13 @@ mod constructor_tests {
 // `RestArgs` on free functions
 //
 // `#[jsmodule]`, `#[jsglobals]`, `#[jsnamespace]`, and `#[webidl_namespace]`
-// share `parse_free_fn_export`/`gen_free_fn_native`, which previously ignored
-// `RestArgs` entirely — the parameter was treated as an ordinary one and
-// failed `FromJSVal`. All four now use the same collection as methods.
+// share `parse_free_fn_export`/`gen_free_fn_native`.
 // ============================================================================
 
 mod free_fn_tests {
-    use core_runtime::config::RuntimeConfig;
-    use core_runtime::module::evaluate_module;
-    use core_runtime::runtime::Runtime;
-    use core_runtime::test_util::eval_with_setup;
+    use core_runtime::test_util::{eval_module_out_with_setup, eval_with_setup};
     use core_runtime::{jsglobals, jsmodule, jsnamespace, webidl_namespace};
     use js::class::RestArgs;
-    use js::conversion::FromJSVal;
 
     #[jsmodule]
     mod rest_module {
@@ -564,10 +448,7 @@ mod free_fn_tests {
             rest_globals::add_to_global(scope, global);
             rest_ns::add_to_global(scope, global);
             rest_webidl_ns::add_to_global(scope, global);
-            // SAFETY: called during global initialization, before any JS runs.
-            unsafe {
-                rest_module::register(scope);
-            }
+            rest_module::register(scope);
         });
     }
 
@@ -575,79 +456,44 @@ mod free_fn_tests {
         eval_with_setup(setup, code)
     }
 
-    fn eval_module(body: &str) -> String {
-        setup();
-        let rt = Runtime::init(&RuntimeConfig::default()).expect("runtime init");
-        let scope = rt.default_global();
-        let source = format!("import * as m from \"restModule\";\nglobalThis._result = {body};");
-        // SAFETY: `scope` outlives the evaluation, and the module registry was
-        // populated by `setup` before any JS ran.
-        unsafe { evaluate_module(&scope, &source, "rest_test.mjs") }.expect("module eval failed");
-        let val = js::compile::evaluate_with_filename(&scope, "globalThis._result", "read.js", 1)
-            .expect("readback failed");
-        String::from_jsval(&scope, val, ()).expect("null string")
-    }
-
-    // --- #[jsmodule] ---
-
     #[test]
-    fn module_fn_collects_variadic_args() {
-        assert_eq!(eval_module("m.sumAll(1, 2, 3)"), "6");
-        assert_eq!(eval_module("m.sumAll()"), "0");
-    }
-
-    #[test]
-    fn module_fn_collects_after_fixed_param() {
-        assert_eq!(eval_module("m.joinAll('-', 'a', 'b', 'c')"), "a-b-c");
-    }
-
-    // --- #[jsglobals] ---
-
-    #[test]
-    fn global_fn_collects_variadic_args() {
-        assert_eq!(eval("globalSum(1, 2, 3, 4)"), "10");
-        assert_eq!(eval("globalSum()"), "0");
-    }
-
-    #[test]
-    fn global_fn_collects_after_fixed_param() {
-        assert_eq!(eval("globalJoin('+', 'x', 'y')"), "x+y");
-    }
-
-    // --- #[jsnamespace] / #[webidl_namespace] ---
-
-    #[test]
-    fn namespace_fn_collects_variadic_args() {
-        assert_eq!(eval("restNs.nsSum(2, 4)"), "6");
-        assert_eq!(eval("restNs.nsSum()"), "0");
-    }
-
-    #[test]
-    fn namespace_fn_with_scope_and_variadic() {
-        assert_eq!(eval("restNs.nsCount('a', 'b', 'c')"), "3");
+    fn module_fns_collect_variadic_args() {
+        assert_eq!(
+            eval_module_out_with_setup(
+                setup,
+                "import * as m from 'restModule';
+                 globalThis.__out = [m.sumAll(1, 2, 3), m.sumAll(), m.joinAll('-', 'a', 'b')].join('|');"
+            ),
+            "6|0|a-b"
+        );
     }
 
     #[test]
-    fn webidl_namespace_fn_collects_variadic_args() {
-        assert_eq!(eval("RestWebIDL.widlSum(1, 2, 3, 4, 5)"), "15");
+    fn global_and_namespace_fns_collect_variadic_args() {
+        assert_eq!(
+            eval(
+                "[globalSum(1, 2), globalSum(), globalJoin('+', 'x', 'y'), restNs.nsSum(2, 4), \
+                  restNs.nsSum(), restNs.nsCount('a', 'b'), RestWebIDL.widlSum(1, 2, 3)].join('|')"
+            ),
+            "3|0|x+y|6|0|2|6"
+        );
     }
 
-    /// A variadic tail is not a declared parameter, so it must not inflate
-    /// `fn.length` — the same rule `length_ignores_rest_parameter` pins for
-    /// methods, checked here because free functions compute `nargs` on a
-    /// different path.
+    /// Free functions compute `nargs` on a different path than methods.
     #[test]
     fn length_ignores_rest_parameter_on_free_fns() {
-        assert_eq!(eval("globalSum.length"), "0");
-        assert_eq!(eval("globalJoin.length"), "1");
-        assert_eq!(eval("restNs.nsSum.length"), "0");
-        assert_eq!(eval("restNs.nsCount.length"), "0");
-        assert_eq!(eval("RestWebIDL.widlSum.length"), "0");
+        assert_eq!(
+            eval(
+                "[globalSum.length, globalJoin.length, restNs.nsSum.length, \
+                  restNs.nsCount.length, RestWebIDL.widlSum.length].join()"
+            ),
+            "0,1,0,0,0"
+        );
     }
 
-    /// The unqualified `RestArgs` in each mod block above is rewritten to the
-    /// fully-qualified path by the macro, exactly as it is for methods — this
-    /// compiles only if that rewrite reaches the free-function paths.
+    /// The macro rewrites the unqualified `RestArgs` in each mod block above to the
+    /// fully-qualified path, so this compiles only if that rewrite reaches the free-function
+    /// paths.
     #[test]
     fn rest_args_type_is_rewritten_in_signatures() {
         assert_eq!(rest_module::sum_all(RestArgs::new(vec![1.0, 2.0])), 3.0);
@@ -720,70 +566,23 @@ mod promise_return_tests {
     }
 
     #[test]
-    fn variadic_promise_op_resolves() {
+    fn bad_arguments_reject_rather_than_throw() {
         assert_eq!(
             run(r#"
-                globalThis.__out = "pending";
-                new Waiter().joinAsync("a", "b").then(v => { globalThis.__out = v; });
-            "#),
-            "a,b"
-        );
-    }
-
-    /// A `Symbol` can't convert to `String`, so collecting the tail fails. That
-    /// must surface as a rejection, not a synchronous throw — matching how a bad
-    /// *fixed* argument to the same operation behaves.
-    #[test]
-    fn bad_variadic_element_rejects_rather_than_throwing() {
-        assert_eq!(
-            run(r#"
-                globalThis.__out = "pending";
-                let threw = false;
-                let p;
-                try { p = new Waiter().joinAsync(Symbol()); } catch (e) { threw = true; }
-                Promise.resolve(p).then(
-                    () => { globalThis.__out = `threw=${threw},resolved`; },
-                    e => { globalThis.__out = `threw=${threw},rejected:${e.constructor.name}`; },
-                );
-            "#),
-            "threw=false,rejected:TypeError"
-        );
-    }
-
-    /// The same, with the tail behind a fixed parameter.
-    #[test]
-    fn bad_variadic_element_after_fixed_param_rejects() {
-        assert_eq!(
-            run(r#"
-                globalThis.__out = "pending";
-                let threw = false;
-                let p;
-                try { p = new Waiter().joinAsyncAfter("-", Symbol()); } catch (e) { threw = true; }
-                Promise.resolve(p).then(
-                    () => { globalThis.__out = `threw=${threw},resolved`; },
-                    e => { globalThis.__out = `threw=${threw},rejected:${e.constructor.name}`; },
-                );
-            "#),
-            "threw=false,rejected:TypeError"
-        );
-    }
-
-    /// The pre-existing behaviour for a bad *fixed* argument, as the baseline
-    /// the variadic tail has to match.
-    #[test]
-    fn bad_fixed_arg_rejects_rather_than_throwing() {
-        assert_eq!(
-            run(r#"
-                globalThis.__out = "pending";
-                let threw = false;
-                let p;
-                try { p = new Waiter().joinAsyncAfter(Symbol()); } catch (e) { threw = true; }
-                Promise.resolve(p).then(
-                    () => { globalThis.__out = `threw=${threw},resolved`; },
-                    e => { globalThis.__out = `threw=${threw},rejected:${e.constructor.name}`; },
-                );
+                const w = new Waiter();
+                const outcome = (call) => {
+                    let p;
+                    try { p = call(); } catch (e) { return `threw:${e.constructor.name}`; }
+                    return p.then(v => `resolved:${v}`, e => `rejected:${e.constructor.name}`);
+                };
+                Promise.all([
+                    outcome(() => w.joinAsync("a", "b")),
+                    outcome(() => w.joinAsync(Symbol())),
+                    outcome(() => w.joinAsyncAfter("-", Symbol())),
+                    outcome(() => w.joinAsyncAfter(Symbol())),
+                ]).then(v => { globalThis.__out = v.join("|"); });
             "#),
-            "threw=false,rejected:TypeError"
+            "resolved:a,b|rejected:TypeError|rejected:TypeError|rejected:TypeError"
         );
     }
 }
diff --git a/crates/core-runtime/tests/runtime/event_loop.rs b/crates/core-runtime/tests/runtime/event_loop.rs
new file mode 100644
index 00000000..4a8f2c84
--- /dev/null
+++ b/crates/core-runtime/tests/runtime/event_loop.rs
@@ -0,0 +1,557 @@
+// SPDX-License-Identifier: Apache-2.0-WITH-LLVM-exception
+
+//! Integration tests for the event loop.
+
+#[cfg(not(target_arch = "wasm32"))]
+use core_runtime::event_loop::run_to_completion;
+use core_runtime::event_loop::timer::install_timer_globals;
+use core_runtime::event_loop::{with_event_loop, EventLoop, StepOutcome, Task};
+use core_runtime::runtime::Runtime;
+use js::gc::scope::Scope;
+
+use js::error::ExnThrown;
+use platform::clock::Instant;
+use std::cell::Cell;
+use std::rc::Rc;
+use std::time::Duration;
+
+/// Evaluate `source`, panicking if it throws.
+fn eval<'s>(scope: &'s Scope<'_>, source: &str) -> js::prelude::HandleValue<'s> {
+    js::compile::evaluate(scope, source).expect("evaluation threw")
+}
+
+/// [`eval`] `source`, and convert the result to a string.
+fn eval_string(scope: &Scope<'_>, source: &str) -> String {
+    let value = eval(scope, source);
+    js::conversion::FromJSVal::from_jsval(scope, value, ()).expect("not a string")
+}
+
+/// Helper: create a tokio current-thread runtime with timer support and
+/// block on `run_to_completion` using `tokio::time::sleep`.
+#[cfg(not(target_arch = "wasm32"))]
+fn block_on_event_loop(scope: &Scope<'_>, el: &mut EventLoop) {
+    let rt = tokio::runtime::Builder::new_current_thread()
+        .enable_time()
+        .build()
+        .unwrap();
+    rt.block_on(async {
+        // SAFETY: the scope (and its Runtime) must outlive this future.
+        // Since the caller owns both and `block_on` runs synchronously on
+        // the same thread, this is guaranteed.
+        let raw_cx = unsafe { scope.raw_cx_no_gc() };
+        unsafe { run_to_completion(raw_cx, el, tokio::time::sleep).await }
+    });
+}
+
+// ---------------------------------------------------------------------------
+// Custom task for testing
+// ---------------------------------------------------------------------------
+
+/// A simple task that increments a shared counter when run.
+struct CounterTask {
+    counter: Rc<Cell<u32>>,
+}
+
+impl Task for CounterTask {
+    fn kind(&self) -> &'static str {
+        "counter"
+    }
+
+    fn run(
+        self: Box<Self>,
+        _scope: &Scope<'_>,
+        _id: core_runtime::event_loop::TaskId,
+    ) -> Result<(), ExnThrown> {
+        self.counter.set(self.counter.get() + 1);
+        Ok(())
+    }
+}
+
+// ---------------------------------------------------------------------------
+// Tests
+// ---------------------------------------------------------------------------
+
+#[test]
+fn test_event_loop() {
+    let rt = Runtime::init(&core_runtime::config::RuntimeConfig::default()).expect("runtime init");
+    let scope = rt.default_global();
+
+    // Install timer globals for timer tests.
+    install_timer_globals(&scope, scope.global());
+
+    // ---- Basic EventLoop operations ----
+    {
+        let el = EventLoop::new();
+
+        // Empty loop.
+        assert!(el.is_empty());
+        assert!(!el.has_pending());
+        assert!(!el.has_ready());
+        assert_eq!(el.len(), 0);
+
+        // Queue a task.
+        let counter = Rc::new(Cell::new(0u32));
+        let id = el.queue(Box::new(CounterTask {
+            counter: counter.clone(),
+        }));
+
+        assert!(el.has_pending());
+        assert!(!el.has_ready());
+        assert_eq!(el.len(), 1);
+
+        // The task isn't ready yet, so `pop_ready` returns `None`.
+        assert!(el.pop_ready().is_none());
+
+        // Signal it ready.
+        el.signal_ready(id);
+        assert!(el.has_ready());
+
+        // Pop and run it.
+        let (popped_id, task) = el.pop_ready().unwrap();
+        assert_eq!(popped_id, id);
+        assert_eq!(counter.get(), 0);
+        task.run(&scope, popped_id).unwrap();
+        assert_eq!(counter.get(), 1);
+
+        // Now the loop is empty.
+        assert!(el.is_empty());
+    }
+
+    // ---- Cancel ----
+    {
+        let el = EventLoop::new();
+        let counter = Rc::new(Cell::new(0u32));
+
+        let id = el.queue_ready(Box::new(CounterTask {
+            counter: counter.clone(),
+        }));
+
+        assert!(el.cancel_if_queued(id));
+        assert!(el.is_empty());
+        assert_eq!(counter.get(), 0);
+
+        // Cancel of non-existent ID returns false.
+        assert!(!el.cancel_if_queued(id));
+    }
+
+    // ---- Timer tasks ----
+    {
+        let el = EventLoop::new();
+        let counter = Rc::new(Cell::new(0u32));
+
+        // Queue a timer 5ms in the future.
+        let _id = el.queue_timer(
+            Box::new(CounterTask {
+                counter: counter.clone(),
+            }),
+            Instant::now() + Duration::from_millis(5),
+        );
+
+        assert!(el.has_pending());
+        assert!(!el.has_ready());
+
+        // advance_timers should NOT mark it ready yet.
+        assert_eq!(el.advance_timers(), 0);
+        assert!(!el.has_ready());
+
+        // time_to_next_timer should be Some and > 0.
+        let wait = el.time_to_next_timer();
+        assert!(wait.is_some());
+
+        // Sleep past the deadline.
+        std::thread::sleep(Duration::from_millis(10));
+
+        // Now advance_timers should mark it ready.
+        assert_eq!(el.advance_timers(), 1);
+        assert!(el.has_ready());
+
+        let (id, task) = el.pop_ready().unwrap();
+        task.run(&scope, id).unwrap();
+        assert_eq!(counter.get(), 1);
+    }
+
+    // ---- timer ids are unique per global across concurrent loops ----
+    //
+    // Two event loops driving the same global (the WASIp3 concurrent-invocation
+    // shape) share the global's id namespace, so their `setTimeout` ids must not
+    // collide.
+    {
+        let el_a = EventLoop::new();
+        let el_b = EventLoop::new();
+
+        let start = || eval(&scope, "setTimeout(function() {}, 100000)").to_number();
+        let id_a = with_event_loop(&el_a, |_| start());
+        let id_b = with_event_loop(&el_b, |_| start());
+        assert_ne!(
+            id_a, id_b,
+            "timer ids from concurrent event loops on the same global must be unique"
+        );
+    }
+
+    // ---- another loop clears a loop's JS timers ----
+    #[cfg(not(target_arch = "wasm32"))]
+    {
+        let owner = EventLoop::new();
+        let other = EventLoop::new();
+        let eval = |source: &str| eval(&scope, source);
+        let start = |source: &str| with_event_loop(&owner, |_| eval(source)).to_number() as u64;
+
+        let interval = start("setInterval(function() {}, 100000)");
+        with_event_loop(&other, |_| eval(&format!("clearInterval({interval})")));
+        assert!(
+            owner.is_empty(),
+            "clearInterval from another loop left the interval queued"
+        );
+
+        let timeout = start("setTimeout(function() {}, 100000)");
+        with_event_loop(&other, |_| eval(&format!("clearTimeout({timeout})")));
+        assert!(
+            owner.is_empty(),
+            "clearTimeout from another loop left the timeout queued"
+        );
+
+        // The loop that holds a timer is woken when another loop clears it: `run_to_completion`
+        // returns rather than waiting for the cleared interval.
+        let interval = start("setInterval(function() {}, 100000)");
+        tokio::runtime::Builder::new_current_thread()
+            .enable_time()
+            .build()
+            .unwrap()
+            .block_on(async {
+                // SAFETY: as in `block_on_event_loop`.
+                let raw_cx = unsafe { scope.raw_cx_no_gc() };
+                let drive = async {
+                    unsafe { run_to_completion(raw_cx, &owner, tokio::time::sleep).await }
+                };
+                let clear = async {
+                    tokio::time::sleep(Duration::from_millis(10)).await;
+                    with_event_loop(&other, |_| eval(&format!("clearInterval({interval})")));
+                };
+                tokio::time::timeout(
+                    Duration::from_secs(10),
+                    futures_lite::future::zip(drive, clear),
+                )
+                .await
+                .expect("the loop that held a cleared interval kept waiting for it");
+            });
+
+        // A timer whose loop ended is ignored.
+        let orphan = start("setTimeout(function() {}, 100000)");
+        drop(owner);
+        with_event_loop(&other, |el| el.clear_js_timer(&scope, orphan));
+        assert!(other.is_empty());
+    }
+
+    // ---- another global's clearTimeout leaves a global's JS timers alone ----
+    {
+        let el = EventLoop::new();
+        let timeout = with_event_loop(&el, |_| {
+            eval(&scope, "setTimeout(function() {}, 100000)").to_number()
+        });
+        let interval = with_event_loop(&el, |_| {
+            eval(&scope, "setInterval(function() {}, 100000)").to_number()
+        });
+        {
+            let other_global = rt.new_global();
+            with_event_loop(&el, |_| {
+                eval(
+                    &other_global,
+                    &format!("clearTimeout({timeout}); clearInterval({interval})"),
+                )
+            });
+        }
+        assert_eq!(el.len(), 2, "another global cleared this global's timers");
+        with_event_loop(&el, |_| {
+            eval(
+                &scope,
+                &format!("clearTimeout({timeout}); clearInterval({interval})"),
+            )
+        });
+        assert!(el.is_empty(), "the creating global's clears were ignored");
+    }
+
+    // ---- setTimeout forwards extra arguments to the callback ----
+    #[cfg(not(target_arch = "wasm32"))]
+    {
+        let mut el = EventLoop::new();
+
+        with_event_loop(&el, |_| {
+            eval(
+                &scope,
+                "globalThis._timerArgs = null; \
+                 setTimeout(function(a, b, c) { globalThis._timerArgs = [a, b, c].join(','); }, 1, 'x', 42, true);",
+            );
+        });
+
+        block_on_event_loop(&scope, &mut el);
+
+        let s = eval_string(&scope, "String(globalThis._timerArgs)");
+        assert_eq!(
+            s, "x,42,true",
+            "extra setTimeout arguments must be forwarded"
+        );
+    }
+
+    // ---- handler is converted before the timeout (WebIDL order) ----
+    {
+        let el = EventLoop::new();
+
+        with_event_loop(&el, |_| {
+            eval(
+                &scope,
+                "globalThis._convOrder = []; \
+                 globalThis._convTid = setTimeout(\
+                   { toString() { globalThis._convOrder.push('handler'); return ''; } }, \
+                   { valueOf() { globalThis._convOrder.push('timeout'); return 1e9; } });",
+            );
+        });
+
+        let s = eval_string(&scope, "globalThis._convOrder.join(',')");
+        assert_eq!(
+            s, "handler,timeout",
+            "WebIDL requires left-to-right argument conversion"
+        );
+
+        // Drain the queued (far-future) timer so it can't leak into later tests.
+        with_event_loop(&el, |_| eval(&scope, "clearTimeout(globalThis._convTid)"));
+        assert!(el.is_empty(), "cleanup clearTimeout should empty the loop");
+    }
+
+    // ---- a throwing interval callback keeps repeating ----
+    #[cfg(not(target_arch = "wasm32"))]
+    {
+        let mut el = EventLoop::new();
+
+        with_event_loop(&el, |_| {
+            eval(
+                &scope,
+                "globalThis._ivTicks = 0; \
+                 globalThis._iv = setInterval(function() { \
+                   globalThis._ivTicks++; \
+                   if (globalThis._ivTicks === 1) { throw new Error('boom'); } \
+                   if (globalThis._ivTicks >= 3) { clearInterval(globalThis._iv); } \
+                 }, 1);",
+            );
+        });
+
+        block_on_event_loop(&scope, &mut el);
+
+        assert_eq!(
+            eval_string(&scope, "String(globalThis._ivTicks)"),
+            "3",
+            "a throwing callback must not kill the interval (spec: report + repeat)"
+        );
+    }
+
+    // ---- JS timer ids are spec-shaped, and clearing reaches only timers ----
+    #[cfg(not(target_arch = "wasm32"))]
+    {
+        let mut el = EventLoop::new();
+        let counter = Rc::new(Cell::new(0));
+
+        // An internal (non-JS) timer task on the same loop: clearTimeout must
+        // not be able to reach it, whatever ids JS throws at it.
+        el.queue_timer(
+            Box::new(CounterTask {
+                counter: Rc::clone(&counter),
+            }),
+            Instant::now(),
+        );
+
+        with_event_loop(&el, |_| {
+            eval(
+                &scope,
+                "globalThis._t1Fired = false; \
+                 globalThis._tid1 = setTimeout(function() { globalThis._t1Fired = true; }, 1); \
+                 if (globalThis._tid1 <= 0) throw new Error('timer id must be > 0, got ' + globalThis._tid1); \
+                 clearTimeout(globalThis._tid1 + 1); \
+                 globalThis._ivTicks2 = 0; \
+                 globalThis._iv2 = setInterval(function() { \
+                   globalThis._ivTicks2++; \
+                   if (globalThis._ivTicks2 >= 2) clearInterval(globalThis._iv2); \
+                 }, 1); \
+                 clearTimeout(-0.5); clearTimeout(0); clearTimeout(999999); clearTimeout(-7); \
+                 globalThis._t3Fired = false; \
+                 globalThis._tid3 = setTimeout(function() { globalThis._t3Fired = true; }, 1); \
+                 clearTimeout(String(globalThis._tid3));",
+            );
+        });
+
+        block_on_event_loop(&scope, &mut el);
+
+        assert_eq!(
+            counter.get(),
+            1,
+            "internal tasks must be unreachable from clearTimeout"
+        );
+        let s = eval_string(
+            &scope,
+            "[globalThis._t1Fired, globalThis._ivTicks2, globalThis._t3Fired].join(',')",
+        );
+        assert_eq!(
+            s, "true,2,false",
+            "junk clears must be no-ops, a pre-cleared id must not poison a \
+             later interval, and a string id must coerce and clear"
+        );
+    }
+
+    // ---- expired timers fire in deadline order ----
+    #[cfg(not(target_arch = "wasm32"))]
+    {
+        let mut el = EventLoop::new();
+
+        with_event_loop(&el, |_| {
+            eval(
+                &scope,
+                // `late` is registered last so that its deadline follows the
+                // others' however long each `setTimeout` call itself takes.
+                "globalThis._fireOrder = []; \
+                 setTimeout(function() { globalThis._fireOrder.push('early'); }, 1); \
+                 globalThis._goner = setTimeout(function() { globalThis._fireOrder.push('goner'); }, 1); \
+                 setTimeout(function() { globalThis._fireOrder.push('early2'); }, 1); \
+                 setTimeout(function() { globalThis._fireOrder.push('late'); }, 2); \
+                 clearTimeout(globalThis._goner);",
+            );
+        });
+
+        // Let every deadline pass before the loop runs, so one `advance_timers`
+        // call marks them all ready at once. The order then comes from the
+        // deadlines, not from queue positions, which the `clearTimeout`'s
+        // `swap_remove` perturbed.
+        std::thread::sleep(Duration::from_millis(10));
+        block_on_event_loop(&scope, &mut el);
+
+        let s = eval_string(&scope, "globalThis._fireOrder.join(',')");
+        assert_eq!(
+            s, "early,early2,late",
+            "expired timers must fire in deadline order, ties in scheduling \
+             order, regardless of cancellations"
+        );
+    }
+
+    // ---- interval arguments survive moving GC across re-queues ----
+    // While a task runs it is out of the loop's task list and untraced, so the
+    // re-queued interval must rebuild its argument Heaps from scope roots.
+    // Compacting on every allocation makes a stale Heap fail deterministically.
+    #[cfg(not(target_arch = "wasm32"))]
+    {
+        let mut el = EventLoop::new();
+
+        with_event_loop(&el, |_| {
+            eval(
+                &scope,
+                "globalThis._gcArgSeen = []; \
+                 globalThis._gcIv = setInterval(function(tag) { \
+                   globalThis._gcArgSeen.push(tag.name); \
+                   if (globalThis._gcArgSeen.length >= 3) clearInterval(globalThis._gcIv); \
+                 }, 1, { name: 'payload' });",
+            );
+        });
+        #[cfg(feature = "debugmozjs")]
+        unsafe {
+            js::gc::SetGCZeal(scope.raw_cx_no_gc(), 14, 1)
+        };
+        block_on_event_loop(&scope, &mut el);
+        #[cfg(feature = "debugmozjs")]
+        unsafe {
+            js::gc::SetGCZeal(scope.raw_cx_no_gc(), 0, 0)
+        };
+
+        let s = eval_string(&scope, "globalThis._gcArgSeen.join(',')");
+        assert_eq!(
+            s, "payload,payload,payload",
+            "interval arguments must survive compacting GC between re-queues"
+        );
+    }
+
+    // ---- step() returns Idle when tasks exist but none ready ----
+    {
+        let el = EventLoop::new();
+        let counter = Rc::new(Cell::new(0u32));
+        assert!(!el.is_alive());
+
+        // Queue a task but don't signal it ready. The pending task keeps the loop alive.
+        let _id = el.queue(Box::new(CounterTask {
+            counter: counter.clone(),
+        }));
+        assert!(el.is_alive());
+
+        let outcome = el.step(&scope);
+        assert_eq!(outcome, StepOutcome::Idle);
+        assert_eq!(counter.get(), 0);
+    }
+
+    // ---- step() returns Idle with interest but no tasks ----
+    {
+        let el = EventLoop::new();
+
+        let interest = el.acquire_interest_handle();
+        assert!(el.has_interest());
+        assert!(el.is_alive());
+
+        let outcome = el.step(&scope);
+        assert_eq!(outcome, StepOutcome::Idle);
+
+        interest.release();
+        assert!(!el.has_interest());
+
+        let outcome = el.step(&scope);
+        assert_eq!(outcome, StepOutcome::Done);
+    }
+
+    // ---- step() runs timer tasks after advance ----
+    {
+        let el = EventLoop::new();
+        let counter = Rc::new(Cell::new(0u32));
+
+        // Queue a timer with deadline in the past.
+        el.queue_timer(
+            Box::new(CounterTask {
+                counter: counter.clone(),
+            }),
+            Instant::now(),
+        );
+
+        // step() advances timers internally.
+        let outcome = el.step(&scope);
+        assert_eq!(outcome, StepOutcome::Progressed);
+        assert_eq!(counter.get(), 1);
+        assert!(el.is_empty());
+    }
+
+    // ---- run_to_completion respects interest tracking ----
+    #[cfg(not(target_arch = "wasm32"))]
+    {
+        let mut el = EventLoop::new();
+
+        // Acquire interest, queue a task that releases it (by dropping the handle).
+        let interest = el.acquire_interest_handle();
+
+        struct ReleaseInterestTask {
+            interest: Option<core_runtime::event_loop::InterestHandle>,
+        }
+        impl Task for ReleaseInterestTask {
+            fn kind(&self) -> &'static str {
+                "release-interest"
+            }
+            fn run(
+                mut self: Box<Self>,
+                _scope: &Scope<'_>,
+                _id: core_runtime::event_loop::TaskId,
+            ) -> Result<(), ExnThrown> {
+                drop(self.interest.take());
+                Ok(())
+            }
+        }
+
+        el.queue_ready(Box::new(ReleaseInterestTask {
+            interest: Some(interest),
+        }));
+
+        // With interest, the native driver should run the task and then
+        // exit once interest drops to zero and no tasks remain.
+        block_on_event_loop(&scope, &mut el);
+        assert!(!el.has_interest());
+        assert!(el.is_empty());
+    }
+}
diff --git a/crates/core-runtime/tests/js_api.rs b/crates/core-runtime/tests/runtime/js_api.rs
similarity index 79%
rename from crates/core-runtime/tests/js_api.rs
rename to crates/core-runtime/tests/runtime/js_api.rs
index caf7b865..95c78034 100644
--- a/crates/core-runtime/tests/js_api.rs
+++ b/crates/core-runtime/tests/runtime/js_api.rs
@@ -1,9 +1,6 @@
 // SPDX-License-Identifier: Apache-2.0-WITH-LLVM-exception
 
 //! Integration tests for the `js` API.
-//!
-//! Tests that need a JS runtime are grouped in a single test because
-//! `JSEngine` can only be initialized once per process.
 
 use core_runtime::config::RuntimeConfig;
 use core_runtime::runtime::Runtime;
@@ -46,27 +43,6 @@ fn test_value_constructors() {
     assert!((v.to_double() - 2.5).abs() < f64::EPSILON);
 }
 
-#[test]
-fn test_value_constructors_extra() {
-    // value:: constructors cover the same ground as the old IntoJSVal impls.
-    let v = value::from_bool(true);
-    assert!(v.is_boolean());
-    assert!(v.to_boolean());
-
-    let v = value::from_i32(42);
-    assert!(v.is_int32());
-    assert_eq!(v.to_int32(), 42);
-
-    let v = value::from_u32(99);
-    assert!(v.is_int32() || v.is_double());
-
-    let v = value::from_f64(2.71);
-    assert!(v.is_double());
-
-    let v = value::undefined();
-    assert!(v.is_undefined());
-}
-
 #[test]
 fn test_jserror_check() {
     assert!(ExnThrown::check(true).is_ok());
@@ -265,17 +241,10 @@ fn test_js_api_with_runtime() {
         assert_eq!(set.size(&scope), 0);
     }
 
-    // --- Array builtins ---
-    {
-        let arr = Array::new(&scope, 3).unwrap();
-        let len = arr.length(&scope).unwrap();
-        assert_eq!(len, 3);
-    }
-
     // --- Date builtins ---
     {
         let rval = js::compile::evaluate(&scope, "new Date(2024, 0, 15)").unwrap();
-        let date_obj = Object::from_value(&scope, rval.get()).unwrap();
+        let date_obj = Object::from_raw_value(&scope, rval.get()).unwrap();
         assert!(Date::is_date(&scope, date_obj.handle()).unwrap());
         let js_date = date_obj.cast::<Date>().unwrap();
         assert!(js_date.is_valid(&scope).unwrap());
@@ -285,7 +254,7 @@ fn test_js_api_with_runtime() {
     {
         let rval = js::compile::evaluate(&scope, "new Promise(function(resolve) { resolve(42) })")
             .unwrap();
-        let promise_obj = Object::from_value(&scope, rval.get()).unwrap();
+        let promise_obj = Object::from_raw_value(&scope, rval.get()).unwrap();
         assert!(Promise::is_promise(promise_obj.handle()));
         let js_promise = promise_obj.cast::<Promise>().unwrap();
         let _id = js_promise.id();
@@ -295,7 +264,7 @@ fn test_js_api_with_runtime() {
         // A pending promise has no result yet (the engine asserts on the
         // access in debug builds).
         let rval = js::compile::evaluate(&scope, "new Promise(function() {})").unwrap();
-        let pending = Object::from_value(&scope, rval.get()).unwrap();
+        let pending = Object::from_raw_value(&scope, rval.get()).unwrap();
         let pending = pending.cast::<Promise>().unwrap();
         assert!(pending.is_pending());
         assert!(pending.result(&scope).is_none());
@@ -687,8 +656,7 @@ fn array_buffer_transfer_moves_the_contents() {
     let moved = source.transfer(&scope).unwrap();
     assert!(source.is_detached());
     assert_eq!(moved.byte_length(), 4);
-    // SAFETY: nothing allocates while the slice is read.
-    assert_eq!(unsafe { moved.bytes() }, &[1, 2, 3, 4]);
+    assert_eq!(moved.with_bytes(<[u8]>::to_vec), [1, 2, 3, 4]);
 
     let empty = js::ArrayBuffer::new(&scope, 0).unwrap();
     let moved_empty = empty.transfer(&scope).unwrap();
@@ -696,6 +664,30 @@ fn array_buffer_transfer_moves_the_contents() {
     assert_eq!(moved_empty.byte_length(), 0);
 }
 
+/// Byte access to a cross-compartment wrapper of an `ArrayBuffer` or a typed array reads the
+/// wrapped object's bytes.
+#[test]
+fn byte_access_reads_through_cross_compartment_wrappers() {
+    let rt = Runtime::init(&RuntimeConfig::default()).expect("runtime init");
+    let scope = rt.default_global();
+    let value = js::compile::evaluate(&scope, "new Uint8Array([1, 2, 3, 4])").unwrap();
+    let array = Object::from_value(&scope, value).unwrap();
+    let value = js::compile::evaluate(&scope, "new Uint8Array([5, 6]).buffer").unwrap();
+    let buffer = Object::from_value(&scope, value).unwrap();
+
+    let other = rt.new_global();
+    let wrapped_array = array.wrap_object(&other).unwrap();
+    let wrapped_buffer = buffer.wrap_object(&other).unwrap();
+    assert_ne!(wrapped_array.as_raw(), array.as_raw());
+    assert_ne!(wrapped_buffer.as_raw(), buffer.as_raw());
+    let array = wrapped_array.cast::<js::Uint8Array>().unwrap();
+    assert_eq!(array.len(), 4);
+    assert_eq!(array.with_slice(<[u8]>::to_vec), [1, 2, 3, 4]);
+    let buffer = wrapped_buffer.cast::<js::ArrayBuffer>().unwrap();
+    assert_eq!(buffer.with_bytes(<[u8]>::to_vec), [5, 6]);
+    assert_eq!(buffer.copy_bytes(&other).unwrap(), [5, 6]);
+}
+
 /// Strings created from Rust text hold the same UTF-16 code units as the text, whether it is
 /// ASCII, Latin-1, other BMP characters, or characters outside the BMP, and whether the
 /// non-ASCII part starts at the beginning or after an ASCII prefix longer than the conversion
@@ -761,3 +753,125 @@ fn strings_convert_to_utf8_from_either_representation() {
         assert_eq!(s.to_utf8(&scope).unwrap(), *expected, "{source}");
     }
 }
+
+/// Calling a value that isn't callable from native code throws a `TypeError` naming the method or
+/// the value's source.
+#[test]
+fn native_calls_of_values_that_are_not_functions_name_them() {
+    let rt = Runtime::init(&RuntimeConfig::default()).expect("runtime init");
+    let scope = rt.default_global();
+    let message = |scope: &js::gc::scope::Scope<'_>| {
+        let error = js::exception::take_pending(scope).expect("a pending exception");
+        let error = Object::from_value(scope, error).expect("an error object");
+        let message = error.get_property(scope, c"message").unwrap();
+        String::from_jsval(scope, message, ()).unwrap()
+    };
+
+    let object = Object::new_plain(&scope).unwrap();
+    let result =
+        js::Function::call_by_name(&scope, object.handle(), c"nope", js::function::EmptyArgs);
+    assert!(result.is_err());
+    assert_eq!(message(&scope), "nope is not a function");
+
+    let five = scope.root_value(value::from_i32(5));
+    let result = js::Function::call(&scope, five, five, js::function::EmptyArgs);
+    assert!(result.is_err());
+    assert_eq!(message(&scope), "5 is not a function");
+
+    let undefined = scope.root_value(value::undefined());
+    let result = js::Function::call(&scope, undefined, undefined, js::function::EmptyArgs);
+    assert!(result.is_err());
+    assert_eq!(message(&scope), "undefined is not a function");
+
+    let value = js::compile::evaluate(&scope, "({ a: [1, 'b'] })").unwrap();
+    let result = js::Function::call_value(&scope, object.handle(), value, js::function::EmptyArgs);
+    assert!(result.is_err());
+    assert_eq!(message(&scope), r#"({a:[1, "b"]}) is not a function"#);
+}
+
+/// Setting and defining a property under a name that isn't interned yet stores the given value
+/// when the GC that interning the name runs moves it.
+#[cfg(feature = "debugmozjs")]
+#[test]
+fn named_property_writes_store_a_value_that_interning_the_name_moves() {
+    let rt = Runtime::init(&RuntimeConfig::default()).expect("runtime init");
+    let scope = rt.default_global();
+    let target = Object::new_plain(&scope).unwrap();
+    let value = Object::new_plain(&scope).unwrap();
+
+    // Zeal mode 14 runs a compacting GC on every allocation, which moves `value`.
+    unsafe { js::gc::SetGCZeal(scope.raw_cx_no_gc(), 14, 1) };
+    let set = target.set_property(&scope, c"setPropertyFreshName", value);
+    let defined = target.define_property(
+        &scope,
+        c"definePropertyFreshName",
+        value,
+        js::class_spec::JSPROP_ENUMERATE as u32,
+    );
+    unsafe { js::gc::SetGCZeal(scope.raw_cx_no_gc(), 0, 0) };
+    set.unwrap();
+    defined.unwrap();
+
+    for name in [c"setPropertyFreshName", c"definePropertyFreshName"] {
+        let stored = target.get_property(&scope, name).unwrap();
+        assert_eq!(stored.to_object(), value.as_raw(), "{name:?}");
+    }
+}
+
+/// `RootedHeap`s keep their referents alive and current across a compacting GC
+/// when other `RootedHeap`s were dropped oldest first or in no particular order
+/// before it, and when new ones took the slots of dropped ones.
+#[test]
+fn rooted_heaps_survive_a_compacting_gc_after_drops_in_any_order() {
+    use js::gc::handle::RootedHeap;
+    use js::gc::{GCOptions, GCReason};
+    use js::native::Value;
+
+    let rt = Runtime::init(&RuntimeConfig::default()).expect("runtime init");
+    let scope = rt.default_global();
+
+    let mut objects: Vec<Option<RootedHeap<js::object::Object>>> = Vec::new();
+    let mut strings: Vec<Option<RootedHeap<Value>>> = Vec::new();
+    let new_roots = |index: i32| {
+        let inner = scope.inner_scope();
+        let object = Object::new(&inner, None).unwrap();
+        let marker = inner.root_value(value::from_i32(index));
+        object.set_property(&inner, c"marker", marker).unwrap();
+        let string = js::JSString::from_str(&inner, &format!("value {index}")).unwrap();
+        (RootedHeap::new(object), RootedHeap::from(string.as_value()))
+    };
+    for index in 0..32 {
+        let (object, string) = new_roots(index);
+        objects.push(Some(object));
+        strings.push(Some(string));
+    }
+    let dropped: Vec<usize> = (0..8).chain((8..32).step_by(3)).collect();
+    for &index in &dropped {
+        objects[index] = None;
+        strings[index] = None;
+    }
+    for index in 32..40 {
+        let (object, string) = new_roots(index);
+        objects.push(Some(object));
+        strings.push(Some(string));
+    }
+
+    js::gc::prepare_for_full_gc(&scope);
+    js::gc::non_incremental_gc(&scope, GCOptions::Shrink, GCReason::API);
+
+    for (index, object) in objects.iter().enumerate() {
+        let Some(object) = object else {
+            assert!(dropped.contains(&index));
+            continue;
+        };
+        let marker = object.get(&scope).get_property(&scope, c"marker").unwrap();
+        assert_eq!(marker.to_int32(), index as i32);
+    }
+    for (index, string) in strings.iter().enumerate() {
+        let Some(string) = string else {
+            continue;
+        };
+        let string = String::from_jsval(&scope, string.get(&scope), ()).unwrap();
+        assert_eq!(string, format!("value {index}"));
+    }
+}
diff --git a/crates/core-runtime/tests/runtime/main.rs b/crates/core-runtime/tests/runtime/main.rs
new file mode 100644
index 00000000..b9d46b25
--- /dev/null
+++ b/crates/core-runtime/tests/runtime/main.rs
@@ -0,0 +1,8 @@
+// SPDX-License-Identifier: Apache-2.0-WITH-LLVM-exception
+
+//! The integration tests that also run on wasm targets. They share one test binary, so a wasm test
+//! run compiles the engine once for all of them.
+
+mod event_loop;
+mod js_api;
+mod snapshot_idle;
diff --git a/crates/core-runtime/tests/snapshot_idle.rs b/crates/core-runtime/tests/runtime/snapshot_idle.rs
similarity index 96%
rename from crates/core-runtime/tests/snapshot_idle.rs
rename to crates/core-runtime/tests/runtime/snapshot_idle.rs
index 5b0fafdb..08c51009 100644
--- a/crates/core-runtime/tests/snapshot_idle.rs
+++ b/crates/core-runtime/tests/runtime/snapshot_idle.rs
@@ -2,9 +2,6 @@
 
 //! `EventLoop::ensure_idle_for_snapshot`, and the origins a runtime configured for a snapshot
 //! records for the work it reports.
-//!
-//! The cases are grouped in a single test function because `JSEngine` can only be initialized
-//! once per process.
 
 use core_runtime::config::RuntimeConfig;
 use core_runtime::event_loop::timer::install_timer_globals;
@@ -31,7 +28,7 @@ fn pending_work_is_reported_with_its_origin() {
     let scope = rt.default_global();
     install_timer_globals(&scope, scope.global());
 
-    // A loop that holds nothing can be snapshotted.
+    // A loop without tasks or futures can be snapshotted.
     assert!(EventLoop::new().ensure_idle_for_snapshot().is_ok());
 
     // A timer is reported with the stack that created it, and clearing it leaves the loop idle.
diff --git a/crates/core-runtime/tests/scope.rs b/crates/core-runtime/tests/scope.rs
index 1205623e..3331c12f 100644
--- a/crates/core-runtime/tests/scope.rs
+++ b/crates/core-runtime/tests/scope.rs
@@ -1,9 +1,6 @@
 // SPDX-License-Identifier: Apache-2.0-WITH-LLVM-exception
 
 //! Integration tests for scope-based rooting (`RootScope`).
-//!
-//! Tests that need a JS runtime are grouped in a single test because
-//! `JSEngine` can only be initialized once per process.
 
 // This file contains nothing platform-specific, so skip it on wasm32.
 #![cfg(not(target_arch = "wasm32"))]
@@ -17,51 +14,6 @@ fn test_scope_rooting() {
     let rt = Runtime::init(&RuntimeConfig::default()).expect("runtime init");
     let scope = rt.default_global();
 
-    // --- Basic rooting ---
-    {
-        // Root a string via the scope.
-        let s = js::JSString::from_str(&scope, "scope test").unwrap();
-        let result = s.to_utf8(&scope).unwrap();
-        assert_eq!(result, "scope test");
-
-        // Root an object via the scope.
-        let obj = js::Object::new(&scope, None).unwrap();
-        assert!(!obj.as_raw().is_null());
-
-        // Root a value via the scope.
-        let val = scope.root_value(value::from_i32(42));
-        assert_eq!(val.get().to_int32(), 42);
-
-        // Global handle works.
-        let g = scope.global();
-        assert!(!g.as_raw().is_null());
-    }
-
-    // --- Inner scope ---
-    {
-        // Root something in the outer scope.
-        let outer_str = js::JSString::from_str(&scope, "outer").unwrap();
-
-        {
-            // Create an inner scope.
-            let inner = scope.inner_scope();
-
-            // Root something in the inner scope.
-            let inner_str = js::JSString::from_str(&inner, "inner").unwrap();
-            let result = inner_str.to_utf8(&inner).unwrap();
-            assert_eq!(result, "inner");
-
-            // Outer values are still accessible via the inner scope.
-            let result = outer_str.to_utf8(&inner).unwrap();
-            assert_eq!(result, "outer");
-        }
-        // Inner scope dropped — values rooted there are released.
-
-        // Outer-scope values are still valid.
-        let result = outer_str.to_utf8(&scope).unwrap();
-        assert_eq!(result, "outer");
-    }
-
     // --- GC survival ---
     {
         // Root some values.
@@ -80,24 +32,17 @@ fn test_scope_rooting() {
         assert_eq!(val.get().to_int32(), 99);
     }
 
-    // --- Evaluate script ---
-    {
-        let rval = js::compile::evaluate(&scope, "1 + 2 + 3").unwrap();
-        assert_eq!(rval.to_int32(), 6);
-    }
-
     // --- Many roots of the same type ---
     {
-        // Root many strings — tests that the arena grows correctly.
+        // Root more strings than one 128-slot page of the root stack holds.
         let mut handles = Vec::new();
-        for i in 0..100 {
+        for i in 0..130 {
             let s = js::JSString::from_str(&scope, &format!("string_{i}")).unwrap();
             handles.push(s);
         }
 
-        // Trigger GC to verify all roots are traced.
-        js::gc::prepare_for_full_gc(&scope);
-        js::gc::maybe_gc(&scope);
+        // Trigger a compacting GC to verify all roots are traced.
+        js::gc::non_incremental_gc(&scope, js::gc::GCOptions::Shrink, js::gc::GCReason::API);
 
         // Verify all strings survived.
         for (i, h) in handles.iter().enumerate() {
@@ -133,37 +78,10 @@ fn test_scope_rooting() {
         assert_eq!(s0.to_utf8(&scope).unwrap(), "level0");
     }
 
-    // --- Parent-scope rooting during inner scope lifetime ---
-    //
-    // This test verifies that rooting on the parent scope while an inner
-    // scope is alive does NOT corrupt the parent's roots. With per-scope
-    // page ownership, the parent and inner scope have disjoint storage,
-    // so dropping the inner scope cannot affect the parent's handles.
-    {
-        let inner = scope.inner_scope();
-
-        // Root on the parent scope while inner scope exists.
-        let parent_str = js::JSString::from_str(&scope, "parent-rooted").unwrap();
-
-        // Root on the inner scope.
-        let _inner_str = js::JSString::from_str(&inner, "inner-rooted").unwrap();
-
-        // Drop the inner scope — only inner-scope roots should be freed.
-        drop(inner);
-
-        // Trigger GC — parent_str must still be traced and survive.
-        js::gc::prepare_for_full_gc(&scope);
-        js::gc::maybe_gc(&scope);
-
-        // parent_str should still be valid.
-        let result = parent_str.to_utf8(&scope).unwrap();
-        assert_eq!(result, "parent-rooted");
-    }
-
     // --- Interleaved parent/inner rooting with GC ---
     //
-    // A more aggressive version: interleave parent and inner allocations,
-    // drop the inner scope, GC, then verify parent handles.
+    // Rooting on the parent scope while an inner scope is alive must not let
+    // dropping the inner scope release the parent's roots.
     {
         let inner = scope.inner_scope();
 
diff --git a/crates/core-runtime/tests/scope_gc_zeal.rs b/crates/core-runtime/tests/scope_gc_zeal.rs
index f1528949..86ee8a45 100644
--- a/crates/core-runtime/tests/scope_gc_zeal.rs
+++ b/crates/core-runtime/tests/scope_gc_zeal.rs
@@ -6,8 +6,7 @@
 //! compaction (which moves objects), generational/nursery collections, and
 //! incremental marking.
 //!
-//! Grouped in a single test because `JSEngine` can only be initialized once
-//! per process. Each section sets its own GC zeal mode.
+//! Each section sets its own GC zeal mode.
 
 // This file contains nothing platform-specific, so skip it on wasm32.
 #![cfg(not(target_arch = "wasm32"))]
@@ -44,12 +43,12 @@ fn test_scope_gc_zeal() {
 
     unsafe {
         // =====================================================================
-        // Verification #5: 1000 scopes in a loop — no heap growth
+        // Verification #5: roots in repeated inner scopes stay valid
         // =====================================================================
         // Pages are reused when cursor rewinds. After the first iteration
         // allocates a page, subsequent iterations should reuse it.
         {
-            for i in 0..1000 {
+            for i in 0..3 {
                 let inner = scope.inner_scope();
                 let s = js::JSString::from_str(&inner, &format!("scope_{i}")).unwrap();
                 let obj = Object::new(&inner, None).unwrap();
@@ -65,39 +64,39 @@ fn test_scope_gc_zeal() {
         }
 
         // =====================================================================
-        // Verification #6: 500 roots across nested scopes + GC
+        // Verification #6: roots across nested scopes + GC
         // =====================================================================
         {
-            // Root 100 strings in the outer scope.
+            // Root 3 strings in the outer scope.
             let mut outer_handles = Vec::new();
-            for i in 0..100 {
+            for i in 0..3 {
                 let s = js::JSString::from_str(&scope, &format!("root_{i}")).unwrap();
                 outer_handles.push((i, s));
             }
 
             {
                 let inner = scope.inner_scope();
-                // Root 200 strings in the inner scope.
+                // Root 130 strings in the inner scope, more than one 128-slot page holds.
                 let mut inner_handles = Vec::new();
-                for i in 100..300 {
+                for i in 3..133 {
                     let s = js::JSString::from_str(&inner, &format!("root_{i}")).unwrap();
                     inner_handles.push((i, s));
                 }
 
                 {
                     let inner2 = inner.inner_scope();
-                    // Root 200 strings in the innermost scope.
+                    // Root 10 strings in the innermost scope.
                     let mut inner2_handles = Vec::new();
-                    for i in 300..500 {
+                    for i in 133..143 {
                         let s = js::JSString::from_str(&inner2, &format!("root_{i}")).unwrap();
                         inner2_handles.push((i, s));
                     }
 
-                    // Trigger GC with all 500 roots live.
+                    // Trigger GC with all 143 roots live.
                     gc::prepare_for_full_gc(&inner2);
                     gc::non_incremental_gc(&inner2, GCOptions::Normal, GCReason::API);
 
-                    // All 500 should survive.
+                    // All 143 should survive.
                     for (i, h) in &outer_handles {
                         let result = h.to_utf8(&inner2).unwrap();
                         assert_eq!(result, format!("root_{i}"));
@@ -111,7 +110,7 @@ fn test_scope_gc_zeal() {
                         assert_eq!(result, format!("root_{i}"));
                     }
                 }
-                // inner2 drops — roots 300-499 released
+                // inner2 drops, releasing roots 133-142.
 
                 // inner + outer roots still valid.
                 for (i, h) in &inner_handles {
@@ -119,9 +118,9 @@ fn test_scope_gc_zeal() {
                     assert_eq!(result, format!("root_{i}"));
                 }
             }
-            // inner drops — roots 100-299 released
+            // inner drops, releasing roots 3-132.
 
-            // Roots 0-99 still valid.
+            // Roots 0-2 still valid.
             for (i, h) in &outer_handles {
                 let result = h.to_utf8(&scope).unwrap();
                 assert_eq!(result, format!("root_{i}"));
@@ -163,7 +162,7 @@ fn test_scope_gc_zeal() {
 
             // Root many values — GC fires on every JS allocation.
             let mut string_handles = Vec::new();
-            for i in 0..50 {
+            for i in 0..5 {
                 let s = js::JSString::from_str(&inner, &format!("alloc_{i}")).unwrap();
                 string_handles.push(s);
             }
@@ -171,10 +170,10 @@ fn test_scope_gc_zeal() {
             // Evaluate JS that allocates heavily.
             let rval = js::compile::evaluate(
                 &inner,
-                "var arr = []; for (var i = 0; i < 100; i++) arr.push({x: i}); arr.length",
+                "var arr = []; for (var i = 0; i < 5; i++) arr.push({x: i}); arr.length",
             )
             .unwrap();
-            assert_eq!(rval.to_int32(), 100);
+            assert_eq!(rval.to_int32(), 5);
 
             // All string roots must survive.
             for (i, h) in string_handles.iter().enumerate() {
@@ -311,7 +310,7 @@ fn test_scope_gc_zeal() {
 
             // Create objects and arrays that may be moved by compaction.
             let mut objects = Vec::new();
-            for i in 0..30 {
+            for i in 0..5 {
                 let obj = Object::new(&inner, None).unwrap();
                 let val = inner.root_value(value::from_i32(i * 10));
                 obj.set_property(&inner, c"val", val).unwrap();
@@ -323,7 +322,7 @@ fn test_scope_gc_zeal() {
 
             // Trigger operations that cause allocations (and thus compacting
             // GCs with zeal mode 14).
-            for i in 0..10 {
+            for i in 0..5 {
                 let s = js::JSString::from_str(&inner, &format!("compact_{i}")).unwrap();
                 let result = s.to_utf8(&inner).unwrap();
                 assert_eq!(result, format!("compact_{i}"));
@@ -436,7 +435,7 @@ fn test_scope_gc_zeal() {
         // =====================================================================
         // GC Zeal #15: Mode 2 loop stress test
         // =====================================================================
-        // 100 iterations: create inner scope, root, trigger GC, drop scope.
+        // 5 iterations: create inner scope, root, trigger GC, drop scope.
         {
             set_zeal(&scope, 2, 1);
 
@@ -444,7 +443,7 @@ fn test_scope_gc_zeal() {
             // all the inner scope churn.
             let outer_str = js::JSString::from_str(&scope, "outer_survivor").unwrap();
 
-            for i in 0..100 {
+            for i in 0..5 {
                 let inner = scope.inner_scope();
 
                 let s = js::JSString::from_str(&inner, &format!("loop_{i}")).unwrap();
@@ -525,7 +524,7 @@ fn scope_roots_survive_nesting_out_of_order_drops_and_page_spans() {
 
     // More roots than fit in one page of the root stack.
     let inner = scope.inner_scope();
-    let values: Vec<_> = (0..300)
+    let values: Vec<_> = (0..130)
         .map(|i| js::JSString::from_str(&inner, &format!("value {i}")).unwrap())
         .collect();
     compact(&inner);
diff --git a/crates/core-runtime/tests/scope_root_enum.rs b/crates/core-runtime/tests/scope_root_enum.rs
index 13b01a99..a28bbde1 100644
--- a/crates/core-runtime/tests/scope_root_enum.rs
+++ b/crates/core-runtime/tests/scope_root_enum.rs
@@ -1,10 +1,7 @@
 // SPDX-License-Identifier: Apache-2.0-WITH-LLVM-exception
 
-//! `#[derive(ScopeRoot)]` must handle a unit enum variant.
-//!
-//! The mirror/pattern builder treated a unit variant as the parenthesized
-//! (tuple) case, emitting `Variant()` patterns that fail to compile against a
-//! unit variant (E0532). A unit variant now carries no field group.
+//! `#[derive(ScopeRoot)]` handles a unit enum variant. A `Variant()` pattern for one fails to
+//! compile (E0532).
 
 // This file contains nothing platform-specific, so skip it on wasm32.
 #![cfg(not(target_arch = "wasm32"))]
diff --git a/crates/core-runtime/tests/traceable_enum.rs b/crates/core-runtime/tests/traceable_enum.rs
index 94a7cf8d..7a81a7ea 100644
--- a/crates/core-runtime/tests/traceable_enum.rs
+++ b/crates/core-runtime/tests/traceable_enum.rs
@@ -1,12 +1,8 @@
 // SPDX-License-Identifier: Apache-2.0-WITH-LLVM-exception
 
-//! `#[derive(Traceable)]` on an enum must trace each variant's GC fields.
-//!
-//! The derive previously panicked on enums (builtins hand-wrote `Trace`
-//! impls). It now generates a `match` that traces each variant's non-`#[no_trace]`
-//! fields. A compacting GC relocates the held object; the `Heap` inside the
-//! variant must be traced so its stored pointer is updated, or a later read
-//! returns a stale/wrong object.
+//! `#[derive(Traceable)]` on an enum traces each variant's non-`#[no_trace]` fields. A compacting
+//! GC relocates the held object, so the `Heap` inside the variant must be traced for its stored
+//! pointer to be updated.
 
 // This file contains nothing platform-specific, so skip it on wasm32.
 #![cfg(not(target_arch = "wasm32"))]
@@ -75,7 +71,7 @@ fn traceable_enum_traces_variant_fields() {
     match &*slot {
         Slot::Held(h) => {
             let rooted = h.get(&scope);
-            let recovered = Object::from_value(&scope, *rooted).expect("still an object");
+            let recovered = Object::from_raw_value(&scope, rooted.get()).expect("still an object");
             let got = recovered.get_property(&scope, c"marker").unwrap();
             assert_eq!(got.to_int32(), 7777);
         }
diff --git a/crates/core-runtime/tests/typedef_macros.rs b/crates/core-runtime/tests/typedef_macros.rs
index 8316bc19..defd1774 100644
--- a/crates/core-runtime/tests/typedef_macros.rs
+++ b/crates/core-runtime/tests/typedef_macros.rs
@@ -1,9 +1,6 @@
 // SPDX-License-Identifier: Apache-2.0-WITH-LLVM-exception
 
-//! Integration tests for the `js` API.
-//!
-//! Tests that need a JS runtime are grouped in a single test because
-//! `JSEngine` can only be initialized once per process.
+//! Tests of the class, namespace and dictionary macros.
 
 // This file contains nothing platform-specific, so skip it on wasm32.
 #![cfg(not(target_arch = "wasm32"))]
@@ -45,59 +42,37 @@ mod js_proto_tests {
     }
 
     #[test]
-    fn inherits_from_error_prototype() {
-        assert_eq!(eval("new CustomError('x') instanceof Error"), "true");
-    }
-
-    #[test]
-    fn is_custom_error_instance() {
-        assert_eq!(eval("new CustomError('x') instanceof CustomError"), "true");
-    }
-
-    #[test]
-    fn prototype_chain() {
-        assert_eq!(
-            eval("Object.getPrototypeOf(CustomError.prototype) === Error.prototype"),
-            "true"
-        );
-    }
-
-    #[test]
-    fn getter_works() {
-        assert_eq!(eval("new CustomError('test detail').detail"), "test detail");
-    }
-
-    #[test]
-    fn not_array_instance() {
-        assert_eq!(eval("new CustomError('x') instanceof Array"), "false");
-    }
-
-    #[test]
-    fn to_string_tag() {
+    fn js_proto_classes_inherit_from_the_builtin_prototype() {
         assert_eq!(
-            eval("Object.prototype.toString.call(new CustomError('x'))"),
-            "[object CustomError]"
+            eval(
+                "const e = new CustomError('d');
+                 [e instanceof CustomError, Object.getPrototypeOf(e) === CustomError.prototype,
+                  Object.getPrototypeOf(CustomError.prototype) === Error.prototype,
+                  e.detail, Object.prototype.toString.call(e),
+                  CustomError.prototype[Symbol.toStringTag]].join()"
+            ),
+            "true,true,true,d,[object CustomError],CustomError"
         );
     }
 
+    /// `#[jsclass]` accessors are non-enumerable. A call of the constructor without `new` throws
+    /// the same `TypeError` as a JS class constructor.
     #[test]
-    fn to_string_tag_on_prototype() {
+    fn jsclass_accessors_are_not_enumerable_and_constructors_require_new() {
         assert_eq!(
-            eval("CustomError.prototype[Symbol.toStringTag]"),
-            "CustomError"
+            eval(
+                "class Plain {}
+                 const error = (f) => {
+                     try { f(); return 'no throw'; } catch (e) { return `${e.constructor.name}: ${e.message}`; }
+                 };
+                 const own = error(() => CustomError('x'));
+                 [Object.getOwnPropertyDescriptor(CustomError.prototype, 'detail').enumerable,
+                  own, own === error(() => Plain())].join('|')"
+            ),
+            "false|TypeError: class constructors must be invoked with 'new'|true"
         );
     }
 
-    #[test]
-    fn has_stack_property() {
-        assert_eq!(eval("typeof new CustomError('x').stack"), "string");
-    }
-
-    #[test]
-    fn stack_is_nonempty() {
-        assert_eq!(eval("new CustomError('x').stack.length > 0"), "true");
-    }
-
     /// The stack is the one at construction, formatted when it is first read.
     #[test]
     fn stack_is_captured_at_construction() {
@@ -113,7 +88,8 @@ mod js_proto_tests {
     }
 
     /// Like `Error.prototype.stack`, `stack` is an accessor on the prototype: instances have no
-    /// own `stack` until one is assigned, and the getter returns `undefined` for other objects.
+    /// own `stack` until one is assigned, and the getter returns `undefined` for other objects and
+    /// throws for primitives.
     #[test]
     fn stack_is_a_prototype_accessor() {
         assert_eq!(
@@ -123,22 +99,13 @@ mod js_proto_tests {
                  const own = Object.getOwnPropertyDescriptor(e, 'stack');
                  e.stack = 'replaced';
                  const after = Object.getOwnPropertyDescriptor(e, 'stack');
+                 let primitive;
+                 try { d.get.call(1); primitive = 'no throw'; } catch (e) { primitive = e.constructor.name; }
                  [typeof d.get, typeof d.set, d.enumerable, d.configurable, own,
                   after.value, after.enumerable, after.writable,
-                  d.get.call(CustomError.prototype), d.get.call({})].join()"
+                  d.get.call(CustomError.prototype), d.get.call({}), primitive].join()"
             ),
-            "function,function,false,true,,replaced,true,true,,"
-        );
-    }
-
-    #[test]
-    fn stack_getter_throws_on_primitives() {
-        assert_eq!(
-            eval(
-                "const get = Object.getOwnPropertyDescriptor(CustomError.prototype, 'stack').get;
-                 try { get.call(1); 'no throw' } catch (e) { e.constructor.name }"
-            ),
-            "TypeError"
+            "function,function,false,true,,replaced,true,true,,,TypeError"
         );
     }
 }
@@ -175,57 +142,34 @@ mod constant_tests {
         )
     }
 
+    /// Constants are read-only, enumerable properties of the constructor only.
     #[test]
-    fn constant_on_constructor() {
-        assert_eq!(eval("StatusCode.OK"), "200");
-    }
-
-    #[test]
-    fn constant_not_found() {
-        assert_eq!(eval("StatusCode.NOT_FOUND"), "404");
-    }
-
-    #[test]
-    fn constant_internal_server_error() {
-        assert_eq!(eval("StatusCode.INTERNAL_SERVER_ERROR"), "500");
-    }
-
-    #[test]
-    fn constant_is_readonly() {
+    fn constants_are_defined_on_the_constructor() {
         assert_eq!(
-            eval("'use strict'; try { StatusCode.OK = 999; 'changed' } catch(e) { 'error' }"),
-            "error"
+            eval(
+                "'use strict';
+                 let assigned;
+                 try { StatusCode.OK = 999; assigned = 'changed'; } catch (e) { assigned = 'error'; }
+                 [StatusCode.OK, StatusCode.NOT_FOUND, StatusCode.INTERNAL_SERVER_ERROR, assigned,
+                  Object.keys(StatusCode).includes('OK'), StatusCode.prototype.OK,
+                  new StatusCode().OK].map(String).join()"
+            ),
+            "200,404,500,error,true,undefined,undefined"
         );
     }
-
-    #[test]
-    fn constant_is_enumerable() {
-        assert_eq!(eval("Object.keys(StatusCode).includes('OK')"), "true");
-    }
-
-    #[test]
-    fn constant_not_on_prototype() {
-        assert_eq!(eval("StatusCode.prototype.OK"), "undefined");
-    }
-
-    #[test]
-    fn constant_not_on_instance() {
-        assert_eq!(eval("new StatusCode().OK"), "undefined");
-    }
 }
 
 /// Tests for `#[webidl_interface]`: auto Symbol.toStringTag and
 /// constants on both constructor AND prototype.
 mod webidl_interface_tests {
-    use core_runtime::jsmethods;
     use core_runtime::test_util::eval_with_setup;
-    use core_runtime::webidl_interface;
+    use core_runtime::{webidl_interface, webidl_methods};
 
-    /// A WebIDL-style interface with constants and methods.
+    /// A WebIDL-style interface with constants and an attribute.
     #[webidl_interface]
     struct MediaError {}
 
-    #[jsmethods]
+    #[webidl_methods]
     impl MediaError {
         pub const MEDIA_ERR_ABORTED: u16 = 1;
         pub const MEDIA_ERR_NETWORK: u16 = 2;
@@ -236,6 +180,11 @@ mod webidl_interface_tests {
         fn construct() -> Self {
             Self {}
         }
+
+        #[getter]
+        fn code(&self) -> u16 {
+            1
+        }
     }
 
     fn eval(code: &str) -> String {
@@ -249,82 +198,38 @@ mod webidl_interface_tests {
         )
     }
 
-    // --- Auto Symbol.toStringTag ---
-
-    #[test]
-    fn auto_to_string_tag() {
-        assert_eq!(
-            eval("Object.prototype.toString.call(new MediaError())"),
-            "[object MediaError]"
-        );
-    }
-
-    #[test]
-    fn to_string_tag_on_prototype() {
-        assert_eq!(
-            eval("MediaError.prototype[Symbol.toStringTag]"),
-            "MediaError"
-        );
-    }
-
-    // --- Constants on constructor ---
-
-    #[test]
-    fn constant_on_constructor() {
-        assert_eq!(eval("MediaError.MEDIA_ERR_ABORTED"), "1");
-    }
-
-    #[test]
-    fn constant_network_on_constructor() {
-        assert_eq!(eval("MediaError.MEDIA_ERR_NETWORK"), "2");
-    }
-
-    // --- Constants on prototype (WebIDL §3.7.3) ---
-
-    #[test]
-    fn constant_on_prototype() {
-        assert_eq!(eval("MediaError.prototype.MEDIA_ERR_ABORTED"), "1");
-    }
-
-    #[test]
-    fn constant_decode_on_prototype() {
-        assert_eq!(eval("MediaError.prototype.MEDIA_ERR_DECODE"), "3");
-    }
-
-    #[test]
-    fn constant_src_not_supported_on_prototype() {
-        assert_eq!(
-            eval("MediaError.prototype.MEDIA_ERR_SRC_NOT_SUPPORTED"),
-            "4"
-        );
-    }
-
-    // --- Constants on instances (inherited via prototype) ---
-
-    #[test]
-    fn constant_on_instance() {
-        assert_eq!(eval("new MediaError().MEDIA_ERR_ABORTED"), "1");
-    }
-
-    // --- Constants are read-only ---
-
+    /// The constants are read-only properties of the constructor and of the prototype (WebIDL
+    /// §3.7.3), so instances inherit them.
     #[test]
-    fn constant_readonly_on_constructor() {
+    fn interfaces_get_a_to_string_tag_and_constants_on_the_prototype() {
         assert_eq!(
             eval(
-                "'use strict'; try { MediaError.MEDIA_ERR_ABORTED = 99; 'changed' } catch(e) { 'error' }"
+                "'use strict';
+                 const assign = (target) => {
+                     try { target.MEDIA_ERR_ABORTED = 99; return 'changed'; } catch (e) { return 'error'; }
+                 };
+                 [Object.prototype.toString.call(new MediaError()),
+                  MediaError.prototype[Symbol.toStringTag], MediaError.MEDIA_ERR_ABORTED,
+                  MediaError.MEDIA_ERR_NETWORK, MediaError.prototype.MEDIA_ERR_DECODE,
+                  MediaError.prototype.MEDIA_ERR_SRC_NOT_SUPPORTED, new MediaError().MEDIA_ERR_ABORTED,
+                  assign(MediaError), assign(MediaError.prototype)].join()"
             ),
-            "error"
+            "[object MediaError],MediaError,1,2,3,4,1,error,error"
         );
     }
 
+    /// Attributes are enumerable (WebIDL §3.7.6), and a call of the constructor without `new`
+    /// throws a `TypeError`.
     #[test]
-    fn constant_readonly_on_prototype() {
+    fn interface_attributes_are_enumerable_and_constructors_require_new() {
         assert_eq!(
             eval(
-                "'use strict'; try { MediaError.prototype.MEDIA_ERR_ABORTED = 99; 'changed' } catch(e) { 'error' }"
+                "let call;
+                 try { MediaError(); call = 'no throw'; } catch (e) { call = e.constructor.name; }
+                 [Object.getOwnPropertyDescriptor(MediaError.prototype, 'code').enumerable,
+                  new MediaError().code, call].join()"
             ),
-            "error"
+            "true,1,TypeError"
         );
     }
 }
@@ -365,55 +270,19 @@ mod jsnamespace_tests {
         )
     }
 
+    /// The namespace is a plain object without a `Symbol.toStringTag`, and a non-enumerable
+    /// property of the global (WebIDL §3.13). Its functions aren't constructors.
     #[test]
-    fn namespace_exists() {
-        assert_eq!(eval("typeof math"), "object");
-    }
-
-    #[test]
-    fn namespace_function_call() {
-        assert_eq!(eval("math.add(2, 3)"), "5");
-    }
-
-    #[test]
-    fn namespace_multiply() {
-        assert_eq!(eval("math.multiply(4, 5)"), "20");
-    }
-
-    #[test]
-    fn namespace_function_with_scope() {
-        assert_eq!(eval("math.greet('World')"), "Hello, World!");
-    }
-
-    #[test]
-    fn namespace_not_constructable() {
+    fn namespaces_are_plain_objects_with_functions() {
         assert_eq!(
-            eval("try { new math.add(); 'ok' } catch(e) { 'error' }"),
-            "error"
-        );
-    }
-
-    #[test]
-    fn namespace_no_to_string_tag() {
-        assert_eq!(
-            eval("Object.prototype.toString.call(math)"),
-            "[object Object]"
-        );
-    }
-
-    #[test]
-    fn namespace_constant_exposed() {
-        // `pub const` items are installed on the namespace object.
-        assert_eq!(eval("math.PI"), "3.5");
-    }
-
-    #[test]
-    fn namespace_object_is_not_enumerable() {
-        // WebIDL §3.13: the namespace object is a non-enumerable property of
-        // the global (installed via define, not [[Set]]).
-        assert_eq!(
-            eval("Object.getOwnPropertyDescriptor(globalThis, 'math').enumerable"),
-            "false"
+            eval(
+                "let constructed;
+                 try { new math.add(); constructed = 'ok'; } catch (e) { constructed = 'error'; }
+                 [typeof math, math.add(2, 3), math.multiply(4, 5), math.greet('World'), math.PI,
+                  constructed, Object.prototype.toString.call(math),
+                  Object.getOwnPropertyDescriptor(globalThis, 'math').enumerable].join()"
+            ),
+            "object,5,20,Hello, World!,3.5,error,[object Object],false"
         );
     }
 }
@@ -442,23 +311,14 @@ mod webidl_namespace_tests {
     }
 
     #[test]
-    fn namespace_exists() {
-        assert_eq!(eval("typeof CSS"), "object");
-    }
-
-    #[test]
-    fn namespace_function_call() {
-        assert_eq!(eval("CSS.escape('hello')"), "hello");
-    }
-
-    #[test]
-    fn auto_to_string_tag() {
-        assert_eq!(eval("Object.prototype.toString.call(CSS)"), "[object CSS]");
-    }
-
-    #[test]
-    fn to_string_tag_on_namespace() {
-        assert_eq!(eval("CSS[Symbol.toStringTag]"), "CSS");
+    fn webidl_namespaces_get_a_to_string_tag() {
+        assert_eq!(
+            eval(
+                "[typeof CSS, CSS.escape('hello'), Object.prototype.toString.call(CSS),
+                  CSS[Symbol.toStringTag]].join()"
+            ),
+            "object,hello,[object CSS],CSS"
+        );
     }
 }
 
@@ -541,48 +401,24 @@ mod setup_style_inheritance {
     }
 
     #[test]
-    fn pet_constructor() {
-        assert_eq!(eval("new Pet('Cat').kind"), "Cat");
-    }
-
-    #[test]
-    fn pet_method() {
-        assert_eq!(eval("new Pet('Some dog').sound()"), "<generic pet sound>");
-    }
-
-    #[test]
-    fn lily_constructor() {
-        assert_eq!(eval("new Lily(5).kind"), "The very cutest");
-    }
-
-    #[test]
-    fn lily_payload() {
-        assert_eq!(eval("new Lily(5).cuteness"), "5");
-    }
-
-    #[test]
-    fn lily_overrides_method() {
-        assert_eq!(eval("new Lily(5).sound()"), "The cutest sound!");
-    }
-
-    #[test]
-    fn lily_instanceof() {
-        assert_eq!(eval("new Lily(5) instanceof Pet"), "true");
-    }
-
-    #[test]
-    fn lily_describe() {
+    fn setup_style_constructors_initialize_subclasses() {
         assert_eq!(
-            eval("new Lily(5).describe()"),
-            "The very cutest Lily, cuteness: 5/5"
+            eval(
+                "const pet = new Pet('Cat');
+                 const lily = new Lily(5);
+                 [pet.kind, pet.sound(), lily.kind, lily.cuteness, lily.sound(), lily instanceof Pet,
+                  lily.describe()].join('|')"
+            ),
+            "Cat|<generic pet sound>|The very cutest|5|The cutest sound!|true|\
+             The very cutest Lily, cuteness: 5/5"
         );
     }
 }
 
 /// Tests for `#[webidl_dictionary]` — WebIDL dictionary conversion.
 mod webidl_dictionary_tests {
-    use core_runtime::test_util::{eval_with_setup, throws_with_setup};
-    use core_runtime::{jsmethods, webidl_dictionary, webidl_interface};
+    use core_runtime::test_util::eval_with_setup;
+    use core_runtime::{webidl_dictionary, webidl_interface, webidl_methods};
     use js::gc::scope::Scope;
     use js::Object;
 
@@ -663,7 +499,7 @@ mod webidl_dictionary_tests {
         members: String,
     }
 
-    #[jsmethods]
+    #[webidl_methods]
     impl Inherited {
         #[constructor]
         fn new(init: &DerivedInit<'_>) -> Self {
@@ -713,8 +549,8 @@ mod webidl_dictionary_tests {
             self.data_mut().members.push('!');
         }
 
-        /// `&str` parameters. A call from JS still has to copy the string out of the engine, so
-        /// this buys nothing there; what it buys is Rust callers, which can pass a borrow.
+        /// `&str` parameters. A call from JS still has to copy the string out of the engine. Rust
+        /// callers can pass a borrow.
         #[method]
         fn label(&self, prefix: &str, suffix: Option<&str>) -> String {
             format!("{prefix}{}{}", self.data().members, suffix.unwrap_or(""))
@@ -740,7 +576,7 @@ mod webidl_dictionary_tests {
         }
     }
 
-    #[jsmethods]
+    #[webidl_methods]
     impl Greeter {
         #[constructor]
         fn new(person: PersonInit, options: Option<GreetingOptions>) -> Self {
@@ -768,7 +604,7 @@ mod webidl_dictionary_tests {
         label: String,
     }
 
-    #[jsmethods]
+    #[webidl_methods]
     impl Config {
         #[constructor]
         fn new(init: ConfigInit) -> Self {
@@ -801,87 +637,62 @@ mod webidl_dictionary_tests {
         eval_with_setup(setup, code)
     }
 
-    fn throws(code: &str) -> bool {
-        throws_with_setup(setup, code)
-    }
-
-    // Required members
-
-    #[test]
-    fn required_members_extracted() {
-        assert_eq!(
-            eval("new Greeter({ name: 'Alice', age: 30 }).greeting"),
-            "Hello, Alice (age 30)."
-        );
-    }
-
-    #[test]
-    fn required_member_missing_throws() {
-        // Missing 'age' should throw.
-        assert!(throws("new Greeter({ name: 'Alice' })"));
-    }
-
+    /// A `null` optional dictionary argument converts like an absent one.
     #[test]
-    fn required_member_all_missing_throws() {
-        assert!(throws("new Greeter({})"));
-    }
-
-    #[test]
-    fn non_object_dict_throws() {
-        assert!(throws("new Greeter(42)"));
-    }
-
-    // Optional members
-
-    #[test]
-    fn optional_members_present() {
+    fn dictionary_members_are_extracted() {
         assert_eq!(
-            eval("new Greeter({ name: 'Bob', age: 25 }, { prefix: 'Hi', excited: true }).greeting"),
-            "Hi, Bob (age 25)!"
+            eval(
+                "[new Greeter({ name: 'Alice', age: 30 }).greeting,
+                  new Greeter({ name: 'Bob', age: 25 }, { prefix: 'Hi', excited: true }).greeting,
+                  new Greeter({ name: 'Dana', age: 18 }, null).greeting].join('|')"
+            ),
+            "Hello, Alice (age 30).|Hi, Bob (age 25)!|Hello, Dana (age 18)."
         );
     }
 
     #[test]
-    fn optional_members_absent() {
+    fn missing_required_members_and_non_objects_throw() {
         assert_eq!(
-            eval("new Greeter({ name: 'Charlie', age: 20 }).greeting"),
-            "Hello, Charlie (age 20)."
+            eval(
+                "[{ name: 'Alice' }, {}, 42].map(init => {
+                     try { new Greeter(init); return 'no throw'; } catch (e) { return e.constructor.name; }
+                 }).join()"
+            ),
+            "TypeError,TypeError,TypeError"
         );
     }
 
+    /// A `null` or `undefined` dictionary converts like an empty one.
     #[test]
-    fn optional_dict_param_null() {
-        // Second param (GreetingOptions) is optional and null → treated as None.
+    fn absent_members_take_their_defaults() {
         assert_eq!(
-            eval("new Greeter({ name: 'Dana', age: 18 }, null).greeting"),
-            "Hello, Dana (age 18)."
+            eval(
+                "[new Config({}).timeout, new Config({ timeout: 42 }).timeout, new Config({}).label,
+                  new Config({ label: 'custom' }).label, new Config(null).timeout,
+                  new Config(undefined).timeout].join()"
+            ),
+            "10,42,default,custom,10,10"
         );
     }
 
-    // Inheritance
-
     #[test]
     fn inherited_members_are_read_through_the_chain() {
         assert_eq!(
             eval(
-                "new Inherited({ top: 'T', base: 'B', middle: 'M', bottom: 'b', extra: {} })
-                    .members"
+                "[new Inherited({ top: 'T', base: 'B', middle: 'M', bottom: 'b', extra: {} }).members,
+                  new Inherited({}).members].join('|')"
             ),
-            "T B M b true"
+            "T B M b true|    false"
         );
     }
 
-    #[test]
-    fn inherited_members_absent_take_their_defaults() {
-        assert_eq!(eval("new Inherited({}).members"), "    false");
-    }
-
     #[test]
     fn inherited_dictionaries_convert_least_derived_first() {
         // Every member is a property get, so an accessor on the source object records the order
-        // the conversion reads them in. WebIDL: the inherited dictionaries first, least derived
-        // first, each one's own members lexicographically. Sorting all five as one flat set would
-        // give `base, bottom, extra, middle, top` — this asserts the chain is walked instead.
+        // in which the conversion reads them. WebIDL: the inherited dictionaries first, least
+        // derived first, each one's own members lexicographically. Sorting all five as one flat
+        // set would give `base, bottom, extra, middle, top`. This asserts the chain is walked
+        // instead.
         assert_eq!(
             eval(
                 r#"
@@ -902,115 +713,37 @@ mod webidl_dictionary_tests {
         );
     }
 
+    /// Operations take dictionaries, `&str` and `&[T]` parameters by reference, plain and in an
+    /// `Option`, and a promise-returning operation takes a dictionary by reference too. A
+    /// non-string argument to a `&str` parameter still coerces.
     #[test]
-    fn dictionaries_can_be_taken_by_reference() {
-        // Both the plain and the `Option` form, and the absent case for the latter.
-        assert_eq!(
-            eval("new Inherited({}).describe({ top: 'T', base: 'B' }, { top: 't', base: 'b' })"),
-            "T/B t/b"
-        );
-        assert_eq!(
-            eval("new Inherited({}).describe({ top: 'T', base: 'B' })"),
-            "T/B"
-        );
-        assert_eq!(
-            eval("new Inherited({}).describe({ top: 'T', base: 'B' }, undefined)"),
-            "T/B"
-        );
-    }
-
-    #[test]
-    fn a_getter_can_lend_a_string_instead_of_copying_it() {
-        // What script sees is an ordinary JS string, identical to the copying getter's.
+    fn parameters_can_be_taken_by_reference() {
         assert_eq!(
             eval(
-                "const i = new Inherited({ top: 'T', base: 'B' });
-                 `${typeof i.borrowedMembers} ${i.borrowedMembers === i.members}`"
+                "const i = new Inherited({ top: 'T' });
+                 [i.describe({ top: 'T', base: 'B' }, { top: 't', base: 'b' }),
+                  i.describe({ top: 'T', base: 'B' }), i.describe({ top: 'T', base: 'B' }, undefined),
+                  i.label('[', ']'), i.label('['), i.label(1, 2), i.tally([1, 2, 3], ['a', 'b']),
+                  i.tally([]), i.describeLater({ top: 'T' }) instanceof Promise].join('|')"
             ),
-            "string true"
-        );
-    }
-
-    #[test]
-    fn methods_can_take_str_by_reference() {
-        // The `Option<&str>` form covers both present and absent, since `as_deref` is what makes
-        // the present case type-check at all.
-        assert_eq!(
-            eval("new Inherited({ top: 'T' }).label('[', ']')"),
-            "[T    false]"
-        );
-        assert_eq!(
-            eval("new Inherited({ top: 'T' }).label('[')"),
-            "[T    false"
+            "T/B t/b|T/B|T/B|[T    false]|[T    false|1T    false2|3 6 2|0 0 0|true"
         );
-        // Conversion is unchanged by the borrow: a non-string argument still coerces.
-        assert_eq!(eval("new Inherited({}).label(1, 2)"), "1    false2");
     }
 
+    /// The lent string is an ordinary JS string, and the shared borrow is released after the
+    /// call: `touch` borrows the data mutably, which panics otherwise.
     #[test]
-    fn methods_can_take_slices_by_reference() {
-        assert_eq!(
-            eval("new Inherited({}).tally([1, 2, 3], ['a', 'b'])"),
-            "3 6 2"
-        );
-        assert_eq!(eval("new Inherited({}).tally([])"), "0 0 0");
-    }
-
-    #[test]
-    fn lending_a_string_gives_the_borrow_back() {
-        // `touch` borrows the data mutably, which panics if the projected guard held its shared
-        // borrow open past the call that lent it.
+    fn a_getter_can_lend_a_string_instead_of_copying_it() {
         assert_eq!(
             eval(
-                "const i = new Inherited({ top: 'T' });
-                 i.borrowedMembers;
+                "const i = new Inherited({ top: 'T', base: 'B' });
+                 const lent = i.borrowedMembers;
                  i.touch();
-                 i.borrowedMembers.endsWith('!')"
+                 [typeof lent, lent === 'T B   false', i.borrowedMembers.endsWith('!')].join()"
             ),
-            "true"
+            "string,true,true"
         );
     }
-
-    #[test]
-    fn a_lent_dictionary_survives_a_promise_returning_call() {
-        // The value is extracted inside the closure that turns a failure into a rejection; the
-        // borrow of it has to reach the call in the same block.
-        assert_eq!(
-            eval("new Inherited({}).describeLater({ top: 'T' }) instanceof Promise"),
-            "true"
-        );
-    }
-
-    // Default values
-
-    #[test]
-    fn default_value_used_when_missing() {
-        assert_eq!(eval("new Config({}).timeout"), "10");
-    }
-
-    #[test]
-    fn default_value_overridden() {
-        assert_eq!(eval("new Config({ timeout: 42 }).timeout"), "42");
-    }
-
-    #[test]
-    fn default_and_optional_combined() {
-        assert_eq!(eval("new Config({}).label"), "default");
-        assert_eq!(eval("new Config({ label: 'custom' }).label"), "custom");
-    }
-
-    // Empty/null/undefined dictionaries
-
-    #[test]
-    fn null_dict_uses_defaults() {
-        // null → all members get their defaults.
-        assert_eq!(eval("new Config(null).timeout"), "10");
-    }
-
-    #[test]
-    fn undefined_dict_uses_defaults() {
-        assert_eq!(eval("new Config(undefined).timeout"), "10");
-    }
 }
 
 /// Tests for Rust-side factory functions: unannotated constructor-shaped fns
@@ -1065,3 +798,88 @@ mod implicit_factory_tests {
         );
     }
 }
+
+/// Tests of class registration.
+mod registration_tests {
+    use core_runtime::config::RuntimeConfig;
+    use core_runtime::runtime::Runtime;
+    use core_runtime::test_util::eval_with_setup;
+    use core_runtime::{jsclass, jsmethods};
+    use js::conversion::ToJSVal;
+
+    #[jsclass]
+    struct Registered {
+        value: i32,
+    }
+
+    #[jsmethods]
+    impl Registered {
+        #[constructor]
+        fn construct() -> Self {
+            Self { value: 1 }
+        }
+    }
+
+    #[test]
+    fn class_constructor_ignores_a_replaced_prototype_constructor() {
+        core_runtime::runtime::register_global_initializer(|scope, global| {
+            Registered::add_to_global(scope, global);
+        });
+        let rt = Runtime::init(&RuntimeConfig::default()).expect("runtime init");
+        let scope = rt.default_global();
+        let original = js::compile::evaluate(
+            &scope,
+            "const original = Registered;
+             Registered.prototype.constructor = function Replaced() {};
+             original",
+        )
+        .expect("the script runs");
+        let ctor = js::class::class_constructor::<RegisteredImpl>(&scope).expect("registered");
+        let ctor = ctor.to_jsval(&scope).expect("an object converts");
+        assert!(js::comparison::same_value(&scope, ctor, original).expect("comparing succeeds"));
+    }
+
+    #[jsclass]
+    struct Visible {}
+
+    #[jsmethods]
+    impl Visible {
+        #[constructor]
+        fn construct() -> Self {
+            Self {}
+        }
+    }
+
+    #[jsclass(hidden, extends = Visible)]
+    struct HiddenChild {
+        parent: VisibleImpl,
+    }
+
+    #[jsmethods]
+    impl HiddenChild {
+        #[constructor]
+        fn construct() -> Self {
+            Self {
+                parent: VisibleImpl::construct(),
+            }
+        }
+    }
+
+    /// Registering a hidden class before its parent defines the parent's constructor on the
+    /// global and leaves the hidden class's constructor off it.
+    #[test]
+    fn a_hidden_class_registered_first_leaves_its_parent_visible() {
+        assert_eq!(
+            eval_with_setup(
+                || {
+                    core_runtime::runtime::register_global_initializer(|scope, global| {
+                        HiddenChild::add_to_global(scope, global);
+                        Visible::add_to_global(scope, global);
+                    });
+                },
+                "[typeof Visible, typeof HiddenChild].join()"
+            ),
+            "function,undefined"
+        );
+    }
+}
diff --git a/crates/js/Cargo.toml b/crates/js/Cargo.toml
index 59575349..c18593dc 100644
--- a/crates/js/Cargo.toml
+++ b/crates/js/Cargo.toml
@@ -34,5 +34,6 @@ mozjs = { git = "https://github.com/tschneidereit/mozjs.git", branch = "main", d
 mozjs_sys = { git = "https://github.com/tschneidereit/mozjs.git", branch = "main" }
 num-traits = "0.2"
 rustc-hash = "2.1"
+slab.workspace = true
 smallvec.workspace = true
 starling-macro.workspace = true
diff --git a/crates/js/src/class.rs b/crates/js/src/class.rs
index a993a732..d839e46f 100644
--- a/crates/js/src/class.rs
+++ b/crates/js/src/class.rs
@@ -311,8 +311,7 @@ impl<T: ClassDef> JSType for T {
 ///
 /// Each element is converted through `FromJSVal`, so a `Promise<'_>` element is
 /// a *brand check*, unlike a `Promise<'_>` parameter, which is the WebIDL
-/// `Promise<T>` conversion that accepts any value (see [`PromiseOf`]). WebIDL
-/// has no variadic promise argument, so nothing needs the other behavior.
+/// `Promise<T>` conversion that accepts any value (see [`PromiseOf`]).
 ///
 /// Note that instead of `HandleValue<'_>`, you can also use `&CallArgs`, which gives you access
 /// to the raw, already rooted, arguments vector and count.
@@ -845,16 +844,12 @@ struct ClassRegistry {
     /// plumbing objects reused across calls (e.g. a resolved promise serving
     /// as a microtask trigger). Traced like prototypes.
     shared_objects: FxHashMap<usize, Box<MozHeap<*mut JSObject>>>,
-    /// Per-global monotonic `u64` counters keyed by an arbitrary `usize`. Used
-    /// where a spec requires ids unique across a whole global rather than per
-    /// call site — e.g. HTML's setTimeout/setInterval ids, which must not
-    /// collide across the concurrent event loops that share one global. Plain
-    /// integers, so no GC tracing.
-    counters: FxHashMap<usize, u64>,
     /// Per-global interned property names keyed by an arbitrary `usize` (by
     /// convention the address of a `static` unique to the call site), so a hot
     /// property name is interned once per global. Traced like prototypes.
     property_atoms: FxHashMap<usize, Box<MozHeap<*mut crate::native::JSString>>>,
+    /// Per-global Rust state that holds no GC things, keyed by its type (see [`global_state`]).
+    state: FxHashMap<TypeId, std::rc::Rc<dyn std::any::Any>>,
     /// Type-erased GC glue for the global's private data,
     /// installed by [`set_global_private`].
     ///
@@ -874,21 +869,12 @@ impl ClassRegistry {
         Self {
             map: FxHashMap::default(),
             shared_objects: FxHashMap::default(),
-            counters: FxHashMap::default(),
             property_atoms: FxHashMap::default(),
+            state: FxHashMap::default(),
             global_private: None,
         }
     }
 
-    /// Return the counter for `key` and advance it by one (wrapping on
-    /// overflow). Counters start at 0.
-    fn bump_counter(&mut self, key: usize) -> u64 {
-        let slot = self.counters.entry(key).or_insert(0);
-        let value = *slot;
-        *slot = slot.wrapping_add(1);
-        value
-    }
-
     fn register(&mut self, type_id: TypeId, proto: *mut JSObject) {
         let entry = self
             .map
@@ -1127,7 +1113,7 @@ unsafe extern "C" fn global_private_trace(trc: *mut JSTracer, global: *mut JSObj
 ///
 /// Must be called on the [`RealmOptions`](crate::engine::RealmOptions) used to
 /// create a [`STARLING_GLOBAL_CLASS`] global, before `JS_NewGlobalObject`. The
-/// op is a no-op until [`set_global_private`] populates the global, so it is
+/// op does nothing until [`set_global_private`] populates the global, so it is
 /// safe to install unconditionally for Starling globals.
 pub fn install_global_private_trace(options: &mut crate::engine::RealmOptions) {
     options.creationOptions_.traceGlobal_ = Some(global_private_trace);
@@ -1167,14 +1153,12 @@ pub(crate) fn inherits_from(concrete_tag: usize, target_tag: usize) -> bool {
     })
 }
 
-// Registry mapping child type tag → parent info.
-// Thread-local because the SpiderMonkey runtime is single-threaded.
 /// Register a child→parent derivation in the inheritance registry, keyed by the
 /// child's runtime `JSClass` tag.
 ///
 /// `accessor`/`accessor_mut` map a pointer to the child's private data onto a
-/// pointer to the embedded parent data, so [`get_private_or_ancestor`] can reach
-/// a `Parent`'s data through a concrete child instance.
+/// pointer to the embedded parent data, so [`borrow`] can reach a `Parent`'s data through a
+/// concrete child instance.
 fn register_parent_info_raw(
     child_tag: usize,
     parent_tag: usize,
@@ -1343,33 +1327,6 @@ fn step_to_parent_mut(info: &InheritanceInfo, ptr: *mut c_void) -> *mut c_void {
     unsafe { (info.accessor_mut)(ptr) }
 }
 
-/// Inheritance-aware immutable private data access.
-///
-/// If the object's concrete type matches T, returns a direct reference.
-/// If the concrete type derives from T (via HasParent chain), walks the
-/// parent accessor chain to find the T reference within the concrete data.
-/// Returns `None` for any other object, and for objects without private data.
-///
-/// # Safety
-///
-/// - `obj` must be a valid JS object.
-/// - The returned reference is only valid as long as the JS object is alive.
-pub unsafe fn get_private_or_ancestor<'a, T: ClassDef>(obj: *mut JSObject) -> Option<&'a T> {
-    private_data_ptr::<T>(obj, step_to_parent).map(|ptr| &*(ptr as *const T))
-}
-
-/// Inheritance-aware mutable private data access.
-///
-/// # Safety
-///
-/// - `obj` must be a valid JS object.
-/// - No other references to the data may exist simultaneously.
-pub unsafe fn get_private_or_ancestor_mut<'a, T: ClassDef>(
-    obj: *mut JSObject,
-) -> Option<&'a mut T> {
-    private_data_ptr::<T>(obj, step_to_parent_mut).map(|ptr| &mut *(ptr as *mut T))
-}
-
 // ============================================================================
 // ClassDef trait
 // ============================================================================
@@ -1410,6 +1367,10 @@ pub trait ClassDef: Sized + Trace + 'static {
     /// Generated by the proc macro as a compile-time C string literal.
     const PROTOTYPE_CALL_ERROR: &'static CStr;
 
+    /// The message of the `TypeError` a call of the constructor without `new` throws.
+    /// `#[jsclass]` overrides it with the message SpiderMonkey throws for a JS class constructor.
+    const CALL_WITHOUT_NEW_ERROR: &'static CStr = c"Constructor must be called with 'new'";
+
     /// Return the `JSClass` descriptor for this type.
     ///
     /// Each `ClassDef` type gets a unique `static JSClass` generated by the
@@ -1491,11 +1452,12 @@ pub trait ClassDef: Sized + Trace + 'static {
     /// Override by using `#[jsclass(extends = ParentType)]`.
     fn register_inheritance() {}
 
-    /// Ensure the parent class is registered on `global` before `Self` is.
+    /// Ensure the parent class is registered on the current global before `Self` is. The
+    /// parent's constructor is defined on the global object unless the parent is hidden.
     ///
     /// Called automatically by [`register_class`] — you never need to call
     /// this directly.  Override by using `#[jsclass(extends = ParentType)]`.
-    fn ensure_parent_registered(_scope: &Scope<'_>, _global: Object<'_>) {}
+    fn ensure_parent_registered(_scope: &Scope<'_>) {}
 
     /// The `Symbol.toStringTag` value for this class (empty = none).
     ///
@@ -1674,17 +1636,19 @@ impl<T: ClassDef> ClassBuilder<T> {
     /// `name` must be a null-terminated C string (use `c"name"`).
     /// `getter` is the getter callback (`JSNative` is `Option<fn>`: pass `None` for write-only).
     /// `setter` is the setter callback (`JSNative` is `Option<fn>`: pass `None` for read-only).
+    /// `flags` are the property attributes, such as `JSPROP_ENUMERATE`.
     pub fn property(
         mut self,
         name: &'static std::ffi::CStr,
         getter: JSNative,
         setter: JSNative,
+        flags: u8,
     ) -> Self {
         self.properties.push(JSPropertySpec {
             name: crate::class_spec::JSPropertySpec_Name {
                 string_: name.as_ptr(),
             },
-            attributes_: crate::class_spec::JSPROP_ENUMERATE,
+            attributes_: flags,
             kind_: crate::class_spec::JSPropertySpec_Kind::NativeAccessor,
             u: crate::class_spec::JSPropertySpec_AccessorsOrValue {
                 accessors: crate::class_spec::JSPropertySpec_AccessorsOrValue_Accessors {
@@ -1773,14 +1737,45 @@ fn spec_tables_for<T: ClassDef>() -> SpecTables {
     })
 }
 
-/// Register a class on the global object, making it available as a constructor.
+/// The registry key of the constructor of class `T`.
+struct ConstructorOf<T>(PhantomData<T>);
+
+/// The constructor of class `T` in the current realm, or a `TypeError` if `T` isn't registered in
+/// it. The constructor is the one [`register_class`] created, whatever the prototype's
+/// `constructor` property holds.
+pub fn class_constructor<'s, T: ClassDef>(scope: &'s Scope<'_>) -> Result<Object<'s>, ExnThrown> {
+    registered_prototype::<T>(scope)?;
+    let ctor = get_prototype::<ConstructorOf<T>>(scope.global())
+        .expect("a registered class has a constructor");
+    // SAFETY: the registry holds live objects, which the global's trace keeps alive.
+    Ok(unsafe { Object::from_raw(scope, ctor) }.expect("the constructor is non-null"))
+}
+
+/// Register class `T` on the current global without defining its constructor on the global
+/// object, and return its prototype. A class registered before keeps whatever global property it
+/// has.
+///
+/// # Safety
+///
+/// The same as for [`register_class`].
+pub unsafe fn register_hidden_class<'s, T: ClassDef>(scope: &'s Scope<'s>) -> Object<'s> {
+    // An unregistered class's constructor is defined on a new object that nothing else
+    // references, so the global's properties stay as they are. Its parent class is registered on
+    // the global by `ensure_parent_registered`.
+    let target = Object::new_plain(scope).expect("creating an object succeeds outside of OOM");
+    // SAFETY: the caller upholds `register_class`'s requirements.
+    unsafe { register_class::<T>(scope, target) }
+}
+
+/// Register a class on the current global, and define its constructor as a property of
+/// `global`, which is the global object unless [`register_hidden_class`] registers the class.
 ///
 /// This creates the class's JSClass, constructor, prototype, and methods,
 /// and stores the prototype for later use with [`create_instance`].
 ///
 /// # Safety
 ///
-/// - `global` must be a global object.
+/// - `global` must be the current global or an ordinary object.
 /// - Must be called within an appropriate realm/compartment.
 ///
 /// # Returns
@@ -1801,7 +1796,7 @@ pub unsafe fn register_class<'s, T: ClassDef>(
     }
 
     // Ensure the parent class is registered before we register ourselves.
-    T::ensure_parent_registered(scope, global);
+    T::ensure_parent_registered(scope);
 
     // The leaked method/property tables, shared across globals.
     let tables = spec_tables_for::<T>();
@@ -1844,7 +1839,8 @@ pub unsafe fn register_class<'s, T: ClassDef>(
     )
     .expect("Constructor was just installed");
 
-    register_prototype::<T>(global, proto.handle().get());
+    register_prototype::<T>(scope.global(), proto.handle().get());
+    register_prototype::<ConstructorOf<T>>(scope.global(), ctor.as_raw());
 
     // Define Symbol.toStringTag if the class specifies one.
     if !T::TO_STRING_TAG.is_empty() {
@@ -1905,7 +1901,7 @@ unsafe extern "C" fn generic_constructor<T: ClassDef>(
     let args = CallArgs::from_vp(vp, argc);
 
     if !args.is_constructing() {
-        crate::error::throw_type_error(&scope, c"Constructor must be called with 'new'");
+        crate::error::throw_type_error(&scope, T::CALL_WITHOUT_NEW_ERROR);
         return false;
     }
 
@@ -2089,8 +2085,8 @@ pub unsafe fn get_arg_with_config<'s, 'v, T: FromJSVal<'s, 'v>>(
 /// Extract a WebIDL `Promise<T>` argument from CallArgs.
 ///
 /// Performs an eager argc check that throws on missing arguments, and then
-/// registers a type check for `T` on the value a promise resolved with the
-/// argument resolves to.
+/// registers a type check for `T` on the value to which a promise resolved
+/// with the argument resolves.
 ///
 /// # Safety
 ///
@@ -2139,54 +2135,14 @@ unsafe fn promise_arg_value<'s>(
     Ok(Handle::from_raw(args.get(index)))
 }
 
-/// Extract a stack newtype argument from CallArgs.
-///
-/// Verifies that the argument is an object with the correct class, roots it,
-/// and wraps it in the stack newtype `T`. Used by generated constructor and
-/// method trampolines for parameters typed as stack newtypes (e.g. `Item<'_>`).
-///
-/// # Safety
-///
-/// - `scope` must be in a valid realm.
-/// - `args` must be from a valid JSNative call.
-#[doc(hidden)]
-pub unsafe fn get_stack_arg<'s, T: StackType<'s>>(
-    scope: &'s Scope<'_>,
-    args: &CallArgs,
-    index: u32,
-) -> Result<T, ExnThrown> {
-    if index >= args.argc_ {
-        return Err(crate::error::throw_type_error(
-            scope,
-            c"Not enough arguments",
-        ));
-    }
-    let val = *args.get(index);
-    if !val.is_object() || !<T::Inner as JSType>::is_instance(val.to_object()) {
-        let msg = CString::new(format!(
-            "argument {} is not an instance of {}",
-            index,
-            T::Inner::NAME,
-        ))
-        .unwrap_or_else(|_| c"argument is not the expected class".into());
-        return Err(crate::error::throw_type_error(scope, &msg));
-    }
-    let obj = val.to_object();
-    let nn = NonNull::new(obj).unwrap();
-    Ok(unsafe { T::from_handle_unchecked(scope.root_object(nn)) })
-}
-
 /// Resolve a WebIDL operation's receiver object from the call's `this`.
 ///
-/// Returns the `this` value as an object, except that — per WebIDL `[Global]`
-/// operation semantics — a null or undefined `this` resolves to the global
-/// object when the global implements `target_tag`. This is what lets a bare,
-/// unqualified `addEventListener('fetch', …)` in a ServiceWorker script reach
-/// the global's own `EventTarget` data: an unqualified sloppy-mode call passes
-/// `this = undefined`, and SpiderMonkey performs no global substitution for
-/// native callees. The substitution is gated on the same inheritance registry
-/// the brand check uses, so for any interface the global does not implement, a
-/// non-object `this` is rejected exactly as before.
+/// Returns the `this` value as an object, except that a null or undefined `this` resolves to the
+/// global object when the global implements `target_tag`, per WebIDL `[Global]` operation
+/// semantics. An unqualified sloppy-mode call, such as `addEventListener('fetch', …)` in a
+/// ServiceWorker script, passes `this = undefined`, and SpiderMonkey performs no global
+/// substitution for native callees. For an interface the global does not implement, a non-object
+/// `this` is rejected.
 ///
 /// # Safety
 ///
@@ -2535,8 +2491,25 @@ pub fn try_create_instance_with<'s, T: ClassDef>(
     init: impl FnOnce(Object<'s>) -> Result<T, ExnThrown>,
 ) -> Result<T::Rooted<'s>, ExnThrown> {
     let proto = registered_prototype::<T>(scope)?;
-    let class = T::class();
-    let obj = Object::new_with_proto(scope, class, proto)?;
+    create_instance_in(scope, proto, init)
+}
+
+/// Like [`create_instance_with`], for an object whose prototype is `proto` instead of `T`'s
+/// registered prototype.
+pub fn create_instance_with_proto<'s, T: ClassDef>(
+    scope: &'s Scope<'_>,
+    proto: Object<'s>,
+    init: impl FnOnce(Object<'s>) -> T,
+) -> Result<T::Rooted<'s>, ExnThrown> {
+    create_instance_in(scope, proto, |obj| Ok(init(obj)))
+}
+
+fn create_instance_in<'s, T: ClassDef>(
+    scope: &'s Scope<'_>,
+    proto: Object<'s>,
+    init: impl FnOnce(Object<'s>) -> Result<T, ExnThrown>,
+) -> Result<T::Rooted<'s>, ExnThrown> {
+    let obj = Object::new_with_proto(scope, T::class(), proto)?;
     T::install_unforgeable(scope, obj)?;
     let data = init(obj)?;
     unsafe {
@@ -2582,9 +2555,38 @@ pub fn get_or_init_shared_object<'s>(
     Ok(obj)
 }
 
+crate::instance_local! {
+    /// The names [`static_property_name`] returned, by their text.
+    static STATIC_PROPERTY_NAMES: RefCell<HashMap<Box<str>, &'static CStr>> =
+        RefCell::new(HashMap::new());
+}
+
+/// Returns `name` as a NUL-terminated string that is never freed, the same one for every call with
+/// the same `name`, for property names known only at runtime that [`get_or_init_property_id`]
+/// interns.
+///
+/// Each distinct `name` is allocated once, so pass only names from a bounded set, such as the
+/// field names of a WIT world.
+///
+/// # Panics
+///
+/// Panics if `name` contains a NUL character.
+pub fn static_property_name(name: &str) -> &'static CStr {
+    if let Some(interned) = STATIC_PROPERTY_NAMES.with(|names| names.borrow().get(name).copied()) {
+        return interned;
+    }
+    let owned = CString::new(name).expect("property names contain no NUL character");
+    let interned: &'static CStr = Box::leak(owned.into_boxed_c_str());
+    STATIC_PROPERTY_NAMES.with(|names| names.borrow_mut().insert(name.into(), interned));
+    interned
+}
+
 /// Return, and create on the first call in a given global, an interned property key for `name`.
 ///
-/// `name` must not be an array index, whose property key is an integer rather than a string.
+/// # Panics
+///
+/// Panics if `name` is an array index, whose property key is an integer rather than a string, or
+/// isn't UTF-8.
 pub fn get_or_init_property_id<'s>(
     scope: &'s Scope<'_>,
     name: &'static CStr,
@@ -2632,34 +2634,22 @@ pub fn get_or_init_shared_function<'s>(
     unsafe { crate::Function::from_raw(scope, obj.as_raw()) }.ok_or(ExnThrown)
 }
 
-/// Read-and-increment a per-global monotonic `u64` counter keyed by `key`.
-///
-/// Returns the counter's current value and advances it (wrapping on overflow);
-/// counters start at 0. The counter lives on the global's [`ClassRegistry`], so
-/// every caller on a given global draws from one sequence — use this for ids a
-/// spec requires to be unique per global rather than per call site, such as
-/// HTML's setTimeout/setInterval ids, which must not collide across the
-/// concurrent event loops that share a single global.
-///
-/// `key` is an arbitrary namespace token; pass the address of a dedicated
-/// `static` to get a process-unique key, mirroring how shared functions key on
-/// their native pointer.
+/// Return the scope's global's `T`, which the first call on the global creates with
+/// `T::default()`.
 ///
-/// Note: the counter is a u64 instead of a u32 because otherwise it'd be possible
-/// (though implausible) for a long-running script to wrap the counter and reuse ids,
-/// which would violate the uniqueness guarantee. We convert the id to a JS value,
-/// which can represent about 53 bits of integer precision, making wrap-around
-/// effectively impossible.
-pub fn next_global_counter(scope: &Scope<'_>, key: usize) -> u64 {
-    // The bump is a HashMap entry plus an integer add — no JS-GC-capable call
-    // in between — so briefly holding the `&mut ClassRegistry` aliases nothing.
+/// The global holds the `T` until it is finalized. `T` must not hold GC things, since the global
+/// doesn't trace it.
+pub fn global_state<T: Default + 'static>(scope: &Scope<'_>) -> std::rc::Rc<T> {
+    // SAFETY: the scope's global is a live StarlingMonkey global. Nothing in between can run JS
+    // or GC, so the `&mut ClassRegistry` isn't aliased.
     let registry = unsafe { get_or_init_class_registry(scope.global().as_raw()) };
-    let counter = registry.bump_counter(key);
-    assert!(
-        counter < crate::conversion::Number::MAX,
-        "counter for key {key} wrapped around"
-    );
-    counter
+    let state = registry
+        .state
+        .entry(TypeId::of::<T>())
+        .or_insert_with(|| std::rc::Rc::new(T::default()));
+    std::rc::Rc::clone(state)
+        .downcast::<T>()
+        .expect("global state is keyed by its type")
 }
 
 // ---------------------------------------------------------------------------
@@ -2810,8 +2800,11 @@ unsafe extern "C" fn error_stack_getter<T: ClassDef>(
         return false;
     }
     let formatted = unsafe { mozjs::jsval::StringValue(&*formatted.get()) };
-    // SAFETY: as above.
-    unsafe { crate::object::set_reserved_slot(obj, ERROR_STACK_SLOT, &formatted) };
+    // SAFETY: as above. `obj` is read again from the rooted `this`, since formatting the stack can
+    // move it.
+    unsafe {
+        crate::object::set_reserved_slot(args.thisv().to_object(), ERROR_STACK_SLOT, &formatted)
+    };
     args.rval().set(formatted);
     true
 }
@@ -2831,7 +2824,7 @@ unsafe extern "C" fn error_stack_setter(cx: *mut RawJSContext, argc: u32, vp: *m
     let obj = Object::from_raw(&scope, this.to_object()).expect("objects are non-null");
     let attrs = crate::class_spec::JSPROP_ENUMERATE as std::ffi::c_uint;
     if obj
-        .define_property(&scope, c"stack", *args.get(0), attrs)
+        .define_property(&scope, c"stack", Handle::from_raw(args.get(0)), attrs)
         .is_err()
     {
         return false;
@@ -2929,7 +2922,7 @@ pub fn define_well_known_symbol_property<'s>(
 
 /// Adds an alias to the property given by `property` under the symbol `symbol` to the
 /// prototype of the builtin class `T`.
-pub fn add_symbol_alias<T: ClassDef>(scope: &Scope, property: &CStr, symbol: SymbolCode) {
+pub fn add_symbol_alias<T: ClassDef>(scope: &Scope, property: &'static CStr, symbol: SymbolCode) {
     let proto = get_prototype_object_for::<T>(scope).expect("prototype not found");
     let values = proto
         .get_property(scope, property)
diff --git a/crates/js/src/compartment.rs b/crates/js/src/compartment.rs
index b8a2f2f1..bfa6d161 100644
--- a/crates/js/src/compartment.rs
+++ b/crates/js/src/compartment.rs
@@ -1,11 +1,6 @@
 // SPDX-License-Identifier: Apache-2.0-WITH-LLVM-exception
 
-//! Cross-compartment wrapper operations.
-//!
-//! SpiderMonkey uses compartments to isolate different security domains.
-//! When an object from one compartment needs to be accessed from another,
-//! a cross-compartment wrapper (CCW) is used. This module provides safe
-//! wrappers for CCW management and compartment queries.
+//! Cross-compartment wrapper management and compartment queries.
 
 use std::ptr::NonNull;
 
@@ -13,19 +8,9 @@ use crate::gc::scope::Scope;
 use mozjs::gc::HandleObject;
 use mozjs::jsapi::{CompartmentFilter, JSClass, JSObject};
 use mozjs::rust::wrappers2;
-use mozjs::rust::MutableHandleObject;
 
 use super::error::ExnThrown;
 
-/// Wrap an object for use in the current compartment.
-///
-/// If the object is already in the current compartment, this is a no-op.
-/// Otherwise, a cross-compartment wrapper is created or reused.
-pub fn wrap_object(scope: &Scope<'_>, objp: MutableHandleObject) -> Result<(), ExnThrown> {
-    let ok = unsafe { wrappers2::JS_WrapObject(scope.cx_mut(), objp) };
-    ExnThrown::check(ok)
-}
-
 /// Refresh existing cross-compartment wrappers to an object.
 pub fn refresh_cross_compartment_wrappers(
     scope: &Scope<'_>,
diff --git a/crates/js/src/compile.rs b/crates/js/src/compile.rs
index e2b991cd..d7123138 100644
--- a/crates/js/src/compile.rs
+++ b/crates/js/src/compile.rs
@@ -84,25 +84,22 @@ fn evaluate_with_options<'s>(
     lineno: u32,
     non_syntactic_scope: bool,
 ) -> Result<HandleValue<'s>, ExnThrown> {
-    let filename_cstr =
-        CString::new(filename).unwrap_or_else(|_| CString::new("<unknown>").unwrap());
-    let options = options(scope, filename_cstr, lineno);
+    let options = options(scope, filename_or_unknown(filename), lineno);
     if non_syntactic_scope {
-        // SAFETY: `options.ptr` is a valid pointer created by `NewCompileOptions`.
-        // We are setting the `nonSyntacticScope` field on the base
-        // `TransitiveCompileOptions` struct, which is safe because the pointer
-        // is valid and we own it exclusively.
+        // SAFETY: `options.ptr` is a valid pointer created by `NewCompileOptions`, owned by
+        // `options`.
         unsafe {
             (*options.ptr)._base.nonSyntacticScope = non_syntactic_scope;
         }
     }
     let mut source = transform_str_to_source_text(script);
-    // SAFETY: we're calling into SpiderMonkey with valid compile options and source.
-    let mut rval = scope.root_value_mut(crate::value::undefined());
-    let ok =
-        unsafe { wrappers2::Evaluate2(scope.cx_mut(), options.ptr, &mut source, rval.reborrow()) };
-    ExnThrown::check(ok)?;
-    Ok(rval.handle())
+    // SAFETY: the options and the source are valid.
+    unsafe { evaluate_utf8_raw(scope, options.ptr, &mut source) }
+}
+
+/// Returns `filename` as a C string, or `<unknown>` if it contains a NUL.
+fn filename_or_unknown(filename: &str) -> CString {
+    CString::new(filename).unwrap_or_else(|_| c"<unknown>".into())
 }
 
 /// Evaluate a UTF-16 script and return its completion value.
@@ -190,14 +187,10 @@ pub fn compile_with_filename<'s>(
     filename: &str,
     lineno: u32,
 ) -> Result<Handle<'s, *mut JSScript>, ExnThrown> {
-    let filename_cstr =
-        CString::new(filename).unwrap_or_else(|_| CString::new("<unknown>").unwrap());
-    let options = options(scope, filename_cstr, lineno);
+    let options = options(scope, filename_or_unknown(filename), lineno);
     let mut source = transform_str_to_source_text(script);
-    let script = unsafe { wrappers2::Compile1(scope.cx_mut(), options.ptr, &mut source) };
-    NonNull::new(script)
-        .map(|p| scope.root_script(p))
-        .ok_or(ExnThrown)
+    // SAFETY: the options and the source are valid.
+    unsafe { compile_raw(scope, options.ptr, &mut source) }
 }
 
 /// Compile a UTF-16 script into a `JSScript` without executing it.
diff --git a/crates/js/src/conversion.rs b/crates/js/src/conversion.rs
index 112859e7..e0752d55 100644
--- a/crates/js/src/conversion.rs
+++ b/crates/js/src/conversion.rs
@@ -50,7 +50,7 @@ use std::{mem, ptr};
 
 use crate::error::{throw_type_error, ExnThrown, ThrowException};
 use crate::gc::handle::Heap;
-use crate::heap::{MozHeap, Trace};
+use crate::heap::Trace;
 use crate::prelude::Scope;
 use crate::value;
 
@@ -132,6 +132,17 @@ impl_num!(f32, 0.0, f32::MIN, f32::MAX);
 impl_num!(f64, 0.0, f64::MIN, f64::MAX);
 
 /// A trait to convert Rust types to `JSVal`s.
+///
+/// Every implementing type is rooted or holds no GC thing, so a function that takes
+/// `impl ToJSVal` may run code that can GC before it converts the value. A raw `Value` doesn't
+/// implement it: root it first, or pass it to a function that takes a raw value, such as
+/// [`Object::from_raw_value`](crate::Object::from_raw_value).
+///
+/// ```compile_fail,E0277
+/// fn store(scope: &js::gc::scope::Scope<'_>, obj: js::Object<'_>, value: js::native::Value) {
+///     obj.set_property(scope, c"name", value).unwrap();
+/// }
+/// ```
 pub trait ToJSVal<'s> {
     /// Convert `self` to a rooted `HandleValue`.
     ///
@@ -283,7 +294,7 @@ where
 
     let rounded = d.signum() * d.abs().floor();
     if D::MIN.cast() <= rounded && rounded <= D::MAX.cast() {
-        Ok(rounded.cast())
+        Ok(As::<D>::cast(rounded))
     } else {
         throw_type_error(scope, c"value out of range in an EnforceRange argument");
         Err(())
@@ -325,7 +336,7 @@ where
     // the correct result. If N is even, plus or minus N is the correct result.
     let to_truncate = if d < 0.0 { d - 0.5 } else { d + 0.5 };
 
-    let mut truncated: D = to_truncate.cast();
+    let mut truncated: D = As::<D>::cast(to_truncate);
 
     if truncated.cast() == to_truncate {
         // It was a tie (since moving away from 0 by 0.5 gave us the exact integer
@@ -362,13 +373,6 @@ impl FromJSVal<'_, '_> for JSVal {
     }
 }
 
-impl<'s> ToJSVal<'s> for JSVal {
-    #[inline]
-    fn to_jsval_raw(&self, _scope: &'_ Scope<'_>) -> Result<JS::Value, ConversionError> {
-        Ok(*self)
-    }
-}
-
 impl<'s> FromJSVal<'s, 's> for HandleValue<'s> {
     type Config = ();
     fn from_jsval(
@@ -392,18 +396,6 @@ impl<'s> ToJSVal<'s> for HandleValue<'s> {
     }
 }
 
-impl<'s> ToJSVal<'s> for MozHeap<JSVal> {
-    #[inline]
-    fn to_jsval(&self, scope: &'s Scope<'_>) -> Result<HandleValue<'s>, ConversionError> {
-        Ok(scope.root_value(self.get()))
-    }
-
-    #[inline]
-    fn to_jsval_raw(&self, _scope: &'_ Scope<'_>) -> Result<JS::Value, ConversionError> {
-        Ok(self.get())
-    }
-}
-
 #[inline]
 fn convert_int_from_jsval<T, M>(
     scope: &Scope<'_>,
@@ -1004,10 +996,8 @@ fn for_of_iterator_slot(scope: &Scope<'_>) -> ForOfIterator {
 
 /// Drive the ES `for...of` protocol over `value`, calling `f` for each element.
 ///
-/// This owns the backing [`ForOfIterator`], so it pins and roots it correctly
-/// for the whole iteration; callers never touch the raw rooting machinery and
-/// cannot observe a half-rooted iterator. SpiderMonkey's array fast path is
-/// preserved, since the engine's own iterator is used.
+/// SpiderMonkey's array fast path applies, since the engine's own iterator is
+/// used.
 ///
 /// Returns `Ok(true)` once iteration completes, or `Ok(false)` if `value` is
 /// not iterable. `f` receives a handle to a value slot that is reused across
diff --git a/crates/js/src/error.rs b/crates/js/src/error.rs
index 10fef11b..f4eebdc9 100644
--- a/crates/js/src/error.rs
+++ b/crates/js/src/error.rs
@@ -39,13 +39,6 @@ use mozjs::rust::Runtime;
 /// This error type carries no data — it simply signals that a SpiderMonkey
 /// operation failed and an exception is pending. Use [`ExnThrown::capture`] to
 /// extract details into a [`CapturedError`].
-///
-/// # Why a unit struct?
-///
-/// Most code only needs to propagate errors with `?`. The heavy lifting of
-/// extracting error messages, filenames, and stack traces is deferred to the
-/// few call sites that actually need it (e.g., error reporters, REPL shells).
-/// This keeps `Result<T, ExnThrown>` zero-cost in the common case.
 #[derive(Debug, Clone, Copy, PartialEq, Eq)]
 pub struct ExnThrown;
 
@@ -452,6 +445,17 @@ pub trait ThrowException {
     fn throw(self, scope: &Scope<'_>) -> ExnThrown;
 }
 
+/// A failed allocation. Throwing it reports out of memory, which no script can catch.
+#[derive(Debug, PartialEq)]
+pub struct OutOfMemory;
+
+impl ThrowException for OutOfMemory {
+    fn throw(self, scope: &Scope<'_>) -> ExnThrown {
+        crate::exception::report_out_of_memory(scope);
+        ExnThrown
+    }
+}
+
 impl ThrowException for String {
     /// Throw a `TypeError` with this string as the message.
     fn throw(self, scope: &Scope<'_>) -> ExnThrown {
diff --git a/crates/js/src/function.rs b/crates/js/src/function.rs
index 4f6543ce..868b45f9 100644
--- a/crates/js/src/function.rs
+++ b/crates/js/src/function.rs
@@ -38,7 +38,7 @@ use std::ffi::CStr;
 use std::os::raw::c_uint;
 use std::ptr::NonNull;
 
-use super::error::{report_error_ascii, ExnThrown};
+use super::error::{report_error_ascii, ExnThrown, ThrowException};
 use crate::builtins::JSType;
 use crate::conversion::ToJSVal;
 use crate::gc::handle::Stack;
@@ -181,13 +181,17 @@ impl<'s> Stack<'s, Function> {
     // Function calling
     // ---------------------------------------------------------------------------
 
-    /// Call a function value with the given `this` object and arguments.
+    /// Call a function value with the given `this` object and arguments. A `fval` that isn't
+    /// callable throws the `TypeError` of [`throw_not_callable`].
     pub fn call_value<'a>(
         scope: &'a Scope<'_>,
         this: HandleObject,
         fval: HandleValue,
         args: &[impl ToJSVal<'a>],
     ) -> Result<HandleValue<'a>, ExnThrown> {
+        if !is_callable(fval) {
+            return Err(throw_not_callable(scope, fval));
+        }
         let mut args_root = ValueArrayRooter::new(args.len());
         let args = args_root.root(scope, args)?;
         let mut rval = scope.root_value_mut(UndefinedValue());
@@ -204,21 +208,32 @@ impl<'s> Stack<'s, Function> {
         Ok(rval.handle())
     }
 
-    /// Call a named method on an object.
+    /// Call a named method on an object. The method is looked up through the global's interned
+    /// key for `name` (see [`get_or_init_property_id`](crate::class::get_or_init_property_id)). A
+    /// property that isn't callable throws a `TypeError` that `name` is not a function. Panics if
+    /// `name` is an array index.
     pub fn call_by_name<'a>(
         scope: &'a Scope<'_>,
         obj: HandleObject,
-        name: &CStr,
+        name: &'static CStr,
         args: &[impl ToJSVal<'a>],
     ) -> Result<HandleValue<'a>, ExnThrown> {
         let mut args_root = ValueArrayRooter::new(args.len());
         let args = args_root.root(scope, args)?;
+        let id = crate::class::get_or_init_property_id(scope, name)?;
+        let mut fval = scope.root_value_mut(UndefinedValue());
+        let ok = unsafe { wrappers2::JS_GetPropertyById(scope.cx_mut(), obj, id, fval.reborrow()) };
+        ExnThrown::check(ok)?;
+        if !is_callable(fval.handle()) {
+            let message = format!("{} is not a function", name.to_string_lossy());
+            return Err(crate::error::TypeError(message).throw(scope));
+        }
         let mut rval = scope.root_value_mut(UndefinedValue());
         let ok = unsafe {
-            wrappers2::JS_CallFunctionName(
+            wrappers2::JS_CallFunctionValue(
                 scope.cx_mut(),
                 obj,
-                name.as_ptr(),
+                fval.handle(),
                 &args.handles(),
                 rval.reborrow(),
             )
@@ -227,25 +242,24 @@ impl<'s> Stack<'s, Function> {
         Ok(rval.handle())
     }
 
-    /// Call a function object with a given `this` value.
+    /// Call a function object with a given `this` value. A `fun` that isn't callable throws the
+    /// `TypeError` of [`throw_not_callable`].
     pub fn call<'a>(
         scope: &'a Scope<'_>,
         this: impl ToJSVal<'a>,
         fun: impl ToJSVal<'a>,
         args: &[impl ToJSVal<'a>],
     ) -> Result<HandleValue<'a>, ExnThrown> {
+        let this = this.to_jsval_throwing(scope)?;
+        let fun = fun.to_jsval_throwing(scope)?;
+        if !is_callable(fun) {
+            return Err(throw_not_callable(scope, fun));
+        }
         let mut args_root = ValueArrayRooter::new(args.len());
         let args = args_root.root(scope, args)?;
         let mut rval = scope.root_value_mut(UndefinedValue());
-        let ok = unsafe {
-            wrappers2::Call(
-                scope.cx_mut(),
-                this.to_jsval_throwing(scope)?,
-                fun.to_jsval_throwing(scope)?,
-                &args.handles(),
-                rval.reborrow(),
-            )
-        };
+        let ok =
+            unsafe { wrappers2::Call(scope.cx_mut(), this, fun, &args.handles(), rval.reborrow()) };
         ExnThrown::check(ok)?;
         Ok(rval.handle())
     }
@@ -256,16 +270,12 @@ impl<'s> Stack<'s, Function> {
         fun: impl ToJSVal<'s>,
         args: &[impl ToJSVal<'s>],
     ) -> Result<Object<'s>, ExnThrown> {
+        let fun = fun.to_jsval_throwing(scope)?;
         let mut args_root = ValueArrayRooter::new(args.len());
         let args = args_root.root(scope, args)?;
         let mut result = scope.root_object_mut(std::ptr::null_mut());
         let ok = unsafe {
-            wrappers2::Construct1(
-                scope.cx_mut(),
-                fun.to_jsval_throwing(scope)?,
-                &args.handles(),
-                result.reborrow(),
-            )
+            wrappers2::Construct1(scope.cx_mut(), fun, &args.handles(), result.reborrow())
         };
         ExnThrown::check(ok)?;
         Object::from_handle(result.handle()).ok_or(ExnThrown)
@@ -278,13 +288,14 @@ impl<'s> Stack<'s, Function> {
         new_target: HandleObject,
         args: &[impl ToJSVal<'s>],
     ) -> Result<Object<'s>, ExnThrown> {
+        let fun = fun.to_jsval_throwing(scope)?;
         let mut args_root = ValueArrayRooter::new(args.len());
         let args = args_root.root(scope, args)?;
         let mut result = scope.root_object_mut(std::ptr::null_mut());
         let ok = unsafe {
             wrappers2::Construct(
                 scope.cx_mut(),
-                fun.to_jsval_throwing(scope)?,
+                fun,
                 new_target,
                 &args.handles(),
                 result.reborrow(),
@@ -352,7 +363,7 @@ impl<'s> Stack<'s, Function> {
     /// function carries `JSFUN_CONSTRUCTOR`, so `new f(...)` runs the callback as
     /// a constructor. A constructor callback whose return value is an object has
     /// that object adopted as the constructed instance; a non-object return yields a freshly
-    /// allocated `this`. The component-model interpreter uses this to synthesize
+    /// allocated `this`. The `wit-bridge` interpreter uses this to synthesize
     /// imported-resource constructors.
     pub fn new_constructor_callback(
         scope: &'s Scope<'_>,
@@ -383,6 +394,7 @@ impl<'s> Stack<'s, Function> {
         cb: Callback,
         payload: impl ToJSVal<'s>,
     ) -> Result<Self, ExnThrown> {
+        let payload = payload.to_jsval_throwing(scope)?;
         let fun = Self::new_with_reserved(scope, Some(callback_trampoline), nargs, flags, name)?;
 
         unsafe {
@@ -390,7 +402,7 @@ impl<'s> Stack<'s, Function> {
                 ReservedSlot::Slot0,
                 mozjs::jsval::PrivateValue(cb as *const std::ffi::c_void),
             );
-            fun.set_reserved(ReservedSlot::Slot1, payload.to_jsval_raw_throwing(scope)?);
+            fun.set_reserved(ReservedSlot::Slot1, payload.get());
         }
 
         Ok(fun)
@@ -569,6 +581,29 @@ impl<'a> CallbackArgs<'a> {
     }
 }
 
+/// Whether `value` is a callable object, as ECMAScript's `IsCallable` tests.
+#[inline]
+pub fn is_callable(value: HandleValue<'_>) -> bool {
+    // SAFETY: `value` is rooted, so an object it holds is live.
+    value.is_object() && unsafe { mozjs::jsapi::JS::IsCallable(value.to_object()) }
+}
+
+/// Throw the `TypeError` for a call of `value`, which isn't callable: `undefined`, or `value`'s
+/// source as `JS_ValueToSource` gives it, followed by `is not a function`.
+pub fn throw_not_callable(scope: &Scope<'_>, value: HandleValue<'_>) -> ExnThrown {
+    let source = if value.is_undefined() {
+        "undefined".to_string()
+    } else {
+        // SAFETY: `value` is rooted.
+        let source = unsafe { wrappers2::JS_ValueToSource(scope.cx_mut(), value) };
+        let Some(source) = NonNull::new(source) else {
+            return ExnThrown;
+        };
+        crate::conversion::jsstr_to_string(scope, source)
+    };
+    crate::error::TypeError(format!("{source} is not a function")).throw(scope)
+}
+
 /// Type-erased callback stored in a helper function's reserved slot.
 pub type Callback = fn(&Scope<'_>, CallbackArgs<'_>, HandleValue) -> Result<Value, ExnThrown>;
 
@@ -577,12 +612,12 @@ pub type Callback = fn(&Scope<'_>, CallbackArgs<'_>, HandleValue) -> Result<Valu
 /// # Panics
 ///
 /// Panics if `payload` is not an instance of `T`. The code that creates a
-/// callback also sets its payload, so a mismatch is a bug in that code.
+/// callback also sets its payload, so a mismatch indicates a bug in that code.
 pub fn cast_payload<'r, T>(scope: &'r Scope<'_>, payload: HandleValue<'_>) -> T
 where
     T: crate::builtins::CastTarget<'r, Output = T>,
 {
-    Object::from_value(scope, *payload)
+    Object::from_raw_value(scope, payload.get())
         .expect("callback payload is an object")
         .cast::<T>()
         .unwrap_or_else(|e| panic!("callback payload: {e}"))
diff --git a/crates/js/src/gc/handle.rs b/crates/js/src/gc/handle.rs
index 29396c88..d58f5588 100644
--- a/crates/js/src/gc/handle.rs
+++ b/crates/js/src/gc/handle.rs
@@ -14,7 +14,7 @@ use crate::conversion::{ConversionError, ToJSVal};
 use crate::gc::scope::Scope;
 use crate::heap::{MozHeap, Trace};
 use crate::native::{JSObject, JSTracer, RawHandle};
-use mozjs::gc::{GCMethods, Handle, RootedTraceableBox};
+use mozjs::gc::{GCMethods, Handle};
 use mozjs_sys::jsval::ObjectValue;
 use std::marker::PhantomData;
 use std::pin::Pin;
@@ -184,7 +184,7 @@ macro_rules! from_jsval_via_cast {
                 val: mozjs::gc::HandleValue<'v>,
                 _option: Self::Config,
             ) -> Result<Self, $crate::conversion::ConversionError> {
-                $crate::Object::from_value(scope, *val)?
+                $crate::Object::from_raw_value(scope, val.get())?
                     .cast::<Self>()
                     .map_err(|_| {
                         $crate::conversion::ConversionError::Failure(std::borrow::Cow::Borrowed(
@@ -546,31 +546,59 @@ impl ToJSVal<'_> for Heap<crate::native::Value> {
     }
 }
 
-/// A GC-rooted boxed handle not tied to any `Scope`'s lifetime.
+/// A GC-rooted boxed reference not tied to any `Scope`'s lifetime: a [`Heap`] that roots itself.
 ///
-/// Use this to store a GC reference in locations that aren't traced themselves.
+/// Use this to store a GC reference in locations that aren't traced themselves. `T` is a
+/// [`JSType`] for an object reference or [`Value`](crate::native::Value) for any JS value, as for
+/// `Heap`. Creating and dropping one takes constant time, whatever order they are dropped in.
 #[crate::allow_unrooted_interior]
-pub struct RootedHeap<T: JSType> {
-    boxed: RootedTraceableBox<MozHeap<*mut JSObject>>,
+pub struct RootedHeap<T: HeapCell> {
+    heap: Pin<Box<MozHeap<T::Cell>>>,
+    /// The slot the heap cell is registered in, or `None` if it was created after the thread's
+    /// state was destroyed.
+    slot: Option<u32>,
     _marker: PhantomData<T>,
 }
 
+#[crate::allow_unrooted]
+impl<T: HeapCell> RootedHeap<T>
+where
+    T::Cell: 'static,
+    MozHeap<T::Cell>: Trace + Default,
+{
+    fn from_cell(cell: T::Cell) -> Self {
+        let heap = Box::pin(MozHeap::default());
+        (*heap).set(cell);
+        let traced: &(dyn Trace + 'static) = &*heap;
+        // SAFETY: the box keeps the cell at this address until `drop` unregisters it.
+        let slot = unsafe { super::rooted::register(NonNull::from(traced)) };
+        RootedHeap {
+            heap,
+            slot,
+            _marker: PhantomData,
+        }
+    }
+}
+
+impl<T: HeapCell> Drop for RootedHeap<T> {
+    fn drop(&mut self) {
+        if let Some(slot) = self.slot {
+            super::rooted::unregister(slot);
+        }
+    }
+}
+
 impl<T: JSType> RootedHeap<T> {
     /// Create a rooted boxed handle for the given stack-rooted object.
     pub fn new<'s>(object: impl Into<Stack<'s, T>>) -> Self {
-        let boxed = RootedTraceableBox::new(MozHeap::default());
-        boxed.set(object.into().handle().get());
-        Self {
-            boxed,
-            _marker: PhantomData,
-        }
+        Self::from_cell(object.into().as_raw())
     }
 
     /// Root the referenced object, returning a stack-rooted handle.
     ///
     /// Returns `T::Rooted<'s>`, the stack-rooted type for `Heap<T>`.
     pub fn get<'s>(&self, scope: &'s Scope<'_>) -> T::Rooted<'s> {
-        let obj = self.boxed.get();
+        let obj = self.heap.get();
         let handle = scope.root_object(NonNull::new(obj).expect("RootedHeap holds an object"));
         T::Rooted::from(Stack {
             handle,
@@ -585,7 +613,32 @@ impl<T: JSType> RootedHeap<T> {
     /// The returned pointer is not rooted. It must not be dereferenced or held across anything
     /// that can GC. Use [`get`](Self::get) for any other use.
     pub unsafe fn as_ptr(&self) -> *mut JSObject {
-        self.boxed.get()
+        self.heap.get()
+    }
+}
+
+#[crate::allow_unrooted]
+impl RootedHeap<crate::native::Value> {
+    /// Root the stored value in `scope`, returning a rooted handle.
+    pub fn get<'s>(&self, scope: &'s Scope<'_>) -> Handle<'s, crate::native::Value> {
+        scope.root_value(self.heap.get())
+    }
+
+    /// The stored value without rooting it.
+    ///
+    /// # Safety
+    ///
+    /// The returned [`Value`](crate::native::Value) is not rooted. The caller must consume it
+    /// before any allocation can trigger a GC, or root it via [`get`](Self::get).
+    pub unsafe fn as_raw(&self) -> crate::native::Value {
+        self.heap.get()
+    }
+}
+
+#[crate::allow_unrooted]
+impl From<crate::native::Value> for RootedHeap<crate::native::Value> {
+    fn from(value: crate::native::Value) -> Self {
+        Self::from_cell(value)
     }
 }
 
diff --git a/crates/js/src/gc/mod.rs b/crates/js/src/gc/mod.rs
index 6c15edb5..4752afde 100644
--- a/crates/js/src/gc/mod.rs
+++ b/crates/js/src/gc/mod.rs
@@ -12,6 +12,7 @@
 
 pub mod handle;
 pub mod pool;
+pub(crate) mod rooted;
 pub mod scope;
 
 use mozjs::context::JSContext;
diff --git a/crates/js/src/gc/pool.rs b/crates/js/src/gc/pool.rs
index 8055c3fa..4bb4e246 100644
--- a/crates/js/src/gc/pool.rs
+++ b/crates/js/src/gc/pool.rs
@@ -154,7 +154,7 @@ impl Drop for ScopeAlloc {
 /// registered in the pool's intrusive linked list of active allocators so that the GC tracer can
 /// discover its slots.
 pub struct PrivatePages {
-    /// The pool this allocator borrows pages from.
+    /// The pool from which this allocator borrows pages.
     pool: *const HandlePool,
 
     /// Current page being allocated into. `None` until the first allocation.
@@ -392,7 +392,7 @@ pub struct HandlePool {
     /// The number of slots in use on the root stack.
     top: Cell<usize>,
 
-    /// One entry per scope, innermost last. Entries of dropped scopes stay until every scope
+    /// One entry per scope, innermost last. Entries of dropped scopes are kept until every scope
     /// created after them has dropped.
     levels: UnsafeCell<Vec<Level>>,
 
@@ -412,7 +412,7 @@ pub struct HandlePool {
     root_tracers: UnsafeCell<Vec<unsafe fn(*mut JSTracer)>>,
 }
 
-/// The most released private allocations the pool keeps.
+/// The maximum number of released private allocations the pool keeps.
 const MAX_FREE_ALLOCS: usize = 32;
 
 /// This module's share of the crate's thread-local state. See [`crate::tls`].
@@ -647,6 +647,9 @@ unsafe impl CustomTrace for HandlePool {
             // values of their tags.
             unsafe { trace_page(trc, page, (top - start).min(PAGE_SIZE)) };
         }
+        // SAFETY: `trc` is valid per this function's contract, and tracing runs with JS execution
+        // paused.
+        unsafe { super::rooted::trace(trc) };
         // SAFETY: Single-threaded access. Registration does not run during tracing.
         for tracer in unsafe { &*self.root_tracers.get() } {
             // SAFETY: `trc` is valid per this function's contract.
diff --git a/crates/js/src/gc/rooted.rs b/crates/js/src/gc/rooted.rs
new file mode 100644
index 00000000..cba5e73b
--- /dev/null
+++ b/crates/js/src/gc/rooted.rs
@@ -0,0 +1,72 @@
+// SPDX-License-Identifier: Apache-2.0-WITH-LLVM-exception
+
+//! The registry of the heap cells [`RootedHeap`](super::handle::RootedHeap)s own, traced as roots
+//! of every collection, minor ones included.
+//!
+//! The cells are kept in a [`Slab`], which reuses the slots of unregistered cells, and each
+//! `RootedHeap` keeps the index of its slot. Registering and unregistering a cell take constant
+//! time whatever order the cells are dropped in, and tracing walks the slots in order.
+
+use std::cell::RefCell;
+use std::ptr::NonNull;
+
+use slab::Slab;
+
+use crate::heap::Trace;
+use crate::native::JSTracer;
+
+/// This module's share of the crate's thread-local state. See [`crate::tls`].
+pub(crate) struct RootedTls {
+    /// The registered cells, by slot.
+    slots: RefCell<Slab<NonNull<dyn Trace>>>,
+}
+
+impl RootedTls {
+    pub(crate) const fn new() -> Self {
+        Self {
+            slots: RefCell::new(Slab::new()),
+        }
+    }
+}
+
+/// Register `cell` to be traced until [`unregister`] is called with the returned slot.
+///
+/// Returns `None` once the thread's state was destroyed, at thread exit on native targets. Nothing
+/// can trace a cell then.
+///
+/// # Safety
+///
+/// `cell` must stay valid, at the same address, until it is unregistered.
+pub(crate) unsafe fn register(cell: NonNull<dyn Trace>) -> Option<u32> {
+    crate::tls::try_with(|tls| {
+        let slot = tls.rooted.slots.borrow_mut().insert(cell);
+        u32::try_from(slot).expect("too many rooted heap cells")
+    })
+}
+
+/// Stop tracing the cell registered in `slot` by [`register`]. Does nothing once the thread's state
+/// was destroyed.
+pub(crate) fn unregister(slot: u32) {
+    let _ = crate::tls::try_with(|tls| {
+        tls.rooted.slots.borrow_mut().try_remove(slot as usize);
+    });
+}
+
+/// Trace every registered cell.
+///
+/// # Safety
+///
+/// `trc` must be a valid `JSTracer`, and this must run from a GC root tracer, with JS execution
+/// paused.
+pub(crate) unsafe fn trace(trc: *mut JSTracer) {
+    crate::tls::with(|tls| {
+        // `as_ptr` bypasses `RefCell` borrow tracking: GC runs with JS execution paused, and
+        // registration never runs JS, so no borrow of the slots is in use.
+        let slots = unsafe { &*tls.rooted.slots.as_ptr() };
+        for (_, cell) in slots.iter() {
+            // SAFETY: a registered cell stays valid until it is unregistered, and `trc` is valid
+            // per this function's contract.
+            unsafe { cell.as_ref().trace(trc) };
+        }
+    });
+}
diff --git a/crates/js/src/gc/scope.rs b/crates/js/src/gc/scope.rs
index 2783cb76..0de4a3ad 100644
--- a/crates/js/src/gc/scope.rs
+++ b/crates/js/src/gc/scope.rs
@@ -96,7 +96,6 @@ pub struct EnteredRealm(());
 /// `'cx` is the lifetime of the parent context or scope.
 ///
 /// [`ScopeAlloc`]: mozjs::gc::pool::ScopeAlloc
-/// [`HandlePool`]: mozjs::gc::pool::HandlePool
 pub struct Scope<'cx> {
     /// Raw pointer to the JSContext, wrapped in `UnsafeCell` for interior
     /// mutability (same rationale as `RootScope`).
diff --git a/crates/js/src/id.rs b/crates/js/src/id.rs
index 2bd7651b..fe3ae454 100644
--- a/crates/js/src/id.rs
+++ b/crates/js/src/id.rs
@@ -57,7 +57,7 @@ pub fn mark_cross_zone_id(scope: &Scope<'_>, id: jsid) {
     unsafe { wrappers2::JS_MarkCrossZoneId(scope.cx(), id) }
 }
 
-/// Convert getter/setter property ids.
+/// Convert to getter property id.
 pub fn to_getter_id(scope: &Scope<'_>, id: Handle<PropertyKey>) -> Result<PropertyKey, ExnThrown> {
     rooted!(in(unsafe { scope.raw_cx_no_gc() }) let mut getter_id = PropertyKey::default());
     let ok = unsafe { wrappers2::ToGetterId(scope.cx_mut(), id, getter_id.handle_mut()) };
diff --git a/crates/js/src/iteration.rs b/crates/js/src/iteration.rs
index 1e13ca01..73e78ebd 100644
--- a/crates/js/src/iteration.rs
+++ b/crates/js/src/iteration.rs
@@ -17,7 +17,7 @@
 //! value on the record and chaining the wrap continuation on the shared
 //! resolved trigger ([`Promise::shared_resolved_undefined`]).
 
-use crate::class::{get_or_init_shared_function, get_prototype_for};
+use crate::class::get_or_init_shared_function;
 use crate::conversion::{FromJSVal, ToJSVal};
 use crate::error::ExnThrown;
 use crate::function::{cast_payload, EmptyArgs};
@@ -64,8 +64,8 @@ pub struct AsyncIteratorRecord {
 impl AsyncIteratorRecord<'_> {
     /// `GetIterator(iterable, async)`: populate the iterator record, falling
     /// back to the sync iterator (wrapped via `afs_next`) when there is no
-    /// `Symbol.asyncIterator` method. Use [`get_async_iterator`], which also
-    /// registers this hidden class on the global.
+    /// `Symbol.asyncIterator` method. Use [`get_async_iterator`]. The global
+    /// must have registered this hidden class with `add_to_global`.
     fn new(&self, scope: &Scope<'_>, iterable: HandleValue<'_>) -> Result<(), ExnThrown> {
         // The method lookups use the boxed value (so primitive iterables such as
         // strings work), but each iterator factory is called with the original
@@ -120,15 +120,12 @@ impl AsyncIteratorRecord<'_> {
 
 /// `GetIterator(iterable, async)` with the `CreateAsyncFromSyncIterator`
 /// fallback: build an [`AsyncIteratorRecord`] for `iterable`, throwing a
-/// `TypeError` when it is not (async or sync) iterable. Registers the hidden
-/// record class on the scope's global on first use.
+/// `TypeError` when it is not (async or sync) iterable. The global must have
+/// registered the hidden record class with `AsyncIteratorRecord::add_to_global`.
 pub fn get_async_iterator<'s>(
     scope: &'s Scope<'_>,
     iterable: HandleValue<'_>,
 ) -> Result<AsyncIteratorRecord<'s>, ExnThrown> {
-    if get_prototype_for::<AsyncIteratorRecordImpl>(scope).is_none() {
-        AsyncIteratorRecord::add_to_global(scope, scope.global());
-    }
     AsyncIteratorRecord::new(scope, iterable)
 }
 
@@ -154,9 +151,9 @@ impl<'s> AsyncIteratorRecord<'s> {
         let return_method = iterator.get_property(scope, c"return")?;
         // If undefined, return a promise resolved with undefined.
         if return_method.is_null_or_undefined() {
-            return Promise::new_resolved_with_value(scope, value::undefined());
+            return Promise::new_resolved_with_value(scope, HandleValue::undefined());
         }
-        if !is_callable(scope, return_method) {
+        if !crate::function::is_callable(return_method) {
             crate::error::throw_type_error(scope, c"iterator return is not callable");
             return Promise::new_rejected_with_pending_error(scope);
         }
@@ -203,12 +200,6 @@ fn return_result_check(
     Ok(value::undefined())
 }
 
-/// Whether `v` is callable, without throwing — the `IsCallable` test for the
-/// `GetMethod`-style method lookups.
-fn is_callable(scope: &Scope<'_>, v: HandleValue<'_>) -> bool {
-    Object::from_value(scope, *v).is_ok_and(|o| o.is_callable())
-}
-
 /// `GetMethod`-style check: undefined/null yields `None`; a non-callable
 /// throws a `TypeError`; a callable is returned.
 pub(crate) fn ensure_is_method<'r>(
@@ -218,7 +209,7 @@ pub(crate) fn ensure_is_method<'r>(
     if v.is_null_or_undefined() {
         return Ok(None);
     }
-    if !is_callable(scope, v) {
+    if !crate::function::is_callable(v) {
         return Err(crate::error::throw_type_error(
             scope,
             c"iterator method is not callable",
@@ -331,11 +322,11 @@ fn afs_value_rejected(
     let record = cast_payload::<AsyncIteratorRecord>(scope, payload);
     let error = args.get(0);
     let sync_iter = record.data().iterator.get(scope);
-    // `IteratorClose`: call the iterator's `return` (a missing `return` is a no-op).
+    // `IteratorClose`: call the iterator's `return` (nothing happens if it is missing).
     // Its outcome is discarded — when the incoming completion is a throw, the
     // original error wins, so a throwing or absent `return` cannot mask it.
     if let Ok(return_method) = sync_iter.get_property(scope, c"return") {
-        if is_callable(scope, return_method) {
+        if crate::function::is_callable(return_method) {
             let _ = Function::call(scope, sync_iter, return_method, EmptyArgs);
         }
     }
@@ -402,6 +393,7 @@ pub fn create_iter_result<'r>(
     done: bool,
 ) -> Result<Object<'r>, ExnThrown> {
     let attrs = crate::class_spec::JSPROP_ENUMERATE as std::ffi::c_uint;
+    let value = value.to_jsval_throwing(scope)?;
     let obj = Object::new_plain(scope)?;
     let value_id = crate::class::get_or_init_property_id(scope, c"value")?;
     obj.define_value_by_id(scope, value_id, value, attrs)?;
@@ -507,7 +499,7 @@ pub fn iter_result_object<'r>(
     scope: &'r Scope<'_>,
     result: HandleValue<'_>,
 ) -> Result<Object<'r>, ExnThrown> {
-    Object::from_value(scope, *result)
+    Object::from_raw_value(scope, result.get())
         .map_err(|_| crate::error::throw_type_error(scope, c"iterator result is not an object"))
 }
 
diff --git a/crates/js/src/jobs.rs b/crates/js/src/jobs.rs
index 6a20c1e4..d460bc8d 100644
--- a/crates/js/src/jobs.rs
+++ b/crates/js/src/jobs.rs
@@ -5,16 +5,6 @@
 //! SpiderMonkey requires a job queue to execute promise continuations and other
 //! microtasks. This module provides wrappers for configuring and draining the
 //! queue.
-//!
-//! # Quick Start
-//!
-//! ```ignore
-//! // Use SpiderMonkey's built-in job queue (simplest option):
-//! jobs::use_internal_job_queues(cx)?;
-//!
-//! // After evaluating JS that creates promises, drain the queue:
-//! jobs::run_jobs(cx);
-//! ```
 
 use std::cell::RefCell;
 
@@ -109,7 +99,7 @@ unsafe extern "C" fn track_rejection(
     _data: *mut std::ffi::c_void,
 ) {
     // SAFETY: the engine calls the tracker with a valid context. A realm is entered whenever a
-    // promise is rejected or gets a handler, and the check covers any other call.
+    // promise is rejected or gets a handler. The check covers any other call.
     if unsafe { mozjs::jsapi::GetCurrentRealmOrNull(cx) }.is_null() {
         return;
     }
diff --git a/crates/js/src/json.rs b/crates/js/src/json.rs
index 5d87503a..5be889f5 100644
--- a/crates/js/src/json.rs
+++ b/crates/js/src/json.rs
@@ -79,7 +79,7 @@ pub fn parse_js_string_with_reviver<'r>(
 ///
 /// [stringify]: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/JSON/stringify
 ///
-/// Returns `None` where `JSON.stringify` returns `undefined`.
+/// Returns `None` if `JSON.stringify` returns `undefined`.
 // TODO: consider turning `replacer` and `space` into enums.
 pub fn stringify(
     scope: &Scope<'_>,
diff --git a/crates/js/src/lib.rs b/crates/js/src/lib.rs
index 9a060f74..78330478 100644
--- a/crates/js/src/lib.rs
+++ b/crates/js/src/lib.rs
@@ -47,7 +47,6 @@
 //! | [`date`] | Date object creation and queries |
 //! | [`compile`] | Script compilation and evaluation |
 //! | [`module`] | ES module compilation, linking, evaluation |
-//! | [`realm`] | Realm context trait, utilities, and built-in prototypes |
 //! | [`gc`] | Garbage collection control |
 //! | [`exception`] | Pending exception management |
 //! | [`class`] | JSClass definition and standard classes |
@@ -154,7 +153,7 @@ pub mod engine {
 /// The monotonic clock the engine reads.
 ///
 /// Only on wasm, where the clock is scoped to the instance and an instance resuming from a Wizer
-/// snapshot has to be given the reading the snapshot ended at.
+/// snapshot has to be given the clock reading at which the snapshot ended.
 #[cfg(target_arch = "wasm32")]
 pub mod clock {
     /// Add `nanoseconds` to every monotonic clock reading the engine takes afterwards.
@@ -222,15 +221,10 @@ pub mod heap {
     pub use mozjs::rust::Trace;
 }
 
-/// Module compilation and source text utilities.
-///
-/// Re-exports of low-level module compilation functions that are not
-/// (yet) wrapped by the higher-level `js::module` API.
+/// Module and source text functions that `js::module` doesn't wrap.
 pub mod module_raw {
-    pub use mozjs::jsapi::{
-        CompileModule1, GetModuleRequestSpecifier, JSRuntime, SetModulePrivate,
-    };
-    pub use mozjs::rust::{transform_str_to_source_text, wrappers2::GetModuleEnvironment};
+    pub use mozjs::jsapi::SetModulePrivate;
+    pub use mozjs::rust::transform_str_to_source_text;
 }
 
 pub use macros::must_root;
diff --git a/crates/js/src/object.rs b/crates/js/src/object.rs
index 28a2a0ec..1a24091e 100644
--- a/crates/js/src/object.rs
+++ b/crates/js/src/object.rs
@@ -121,7 +121,14 @@ impl<'s> Stack<'s, Object> {
         scope: &'s Scope<'_>,
         val: impl ToJSVal<'s>,
     ) -> Result<Self, ConversionError> {
-        let val = val.to_jsval_raw(scope)?;
+        Self::from_raw_value(scope, val.to_jsval_raw(scope)?)
+    }
+
+    /// Root the object `val` holds, or fail if it holds something else.
+    ///
+    /// `val` must be read from a rooted location, such as a handle, right before the call, with
+    /// nothing that can GC in between, or hold no GC thing.
+    pub fn from_raw_value(scope: &'s Scope<'_>, val: Value) -> Result<Self, ConversionError> {
         if val.is_object() {
             // SAFETY: the value holds an object, so the pointer is a non-null JSObject.
             Ok(unsafe { Self::from_raw(scope, val.to_object()) }.unwrap())
@@ -146,9 +153,22 @@ impl<'s> Stack<'s, Object> {
     // Property access
     // -----------------------------------------------------------------------
 
-    /// Get a property by name.
+    /// Get a property by name, through the global's interned key for `name` (see
+    /// [`get_or_init_property_id`](crate::class::get_or_init_property_id)). Panics if `name` is an
+    /// array index.
     #[inline]
     pub fn get_property<'a>(
+        &self,
+        scope: &'a Scope<'_>,
+        name: &'static CStr,
+    ) -> Result<HandleValue<'a>, ExnThrown> {
+        let id = crate::class::get_or_init_property_id(scope, name)?;
+        self.get_property_by_id(scope, id)
+    }
+
+    /// Get a property by a name that isn't `'static`. The name is atomized on each call.
+    #[inline]
+    pub fn get_property_by_name<'a>(
         &self,
         scope: &'a Scope<'_>,
         name: &CStr,
@@ -196,9 +216,23 @@ impl<'s> Stack<'s, Object> {
         Ok(rval.handle())
     }
 
-    /// Set a property by name.
+    /// Set a property by name, through the global's interned key for `name` (see
+    /// [`get_or_init_property_id`](crate::class::get_or_init_property_id)). Panics if `name` is an
+    /// array index.
     #[inline]
     pub fn set_property<'v>(
+        &self,
+        scope: &'v Scope<'_>,
+        name: &'static CStr,
+        value: impl ToJSVal<'v>,
+    ) -> Result<(), ExnThrown> {
+        let id = crate::class::get_or_init_property_id(scope, name)?;
+        self.set_property_by_id(scope, id, value)
+    }
+
+    /// Set a property by a name that isn't `'static`. The name is atomized on each call.
+    #[inline]
+    pub fn set_property_by_name<'v>(
         &self,
         scope: &'v Scope<'_>,
         name: &CStr,
@@ -253,9 +287,19 @@ impl<'s> Stack<'s, Object> {
         ExnThrown::check(ok)
     }
 
-    /// Check whether this object has a property with the given name.
+    /// Check whether this object has a property with the given name, through the global's
+    /// interned key for `name` (see [`get_or_init_property_id`](crate::class::get_or_init_property_id)).
+    /// Panics if `name` is an array index.
+    #[inline]
+    pub fn has_property(&self, scope: &Scope<'_>, name: &'static CStr) -> Result<bool, ExnThrown> {
+        let id = crate::class::get_or_init_property_id(scope, name)?;
+        self.has_property_by_id(scope, id)
+    }
+
+    /// Check whether this object has a property with a name that isn't `'static`. The name is
+    /// atomized on each call.
     #[inline]
-    pub fn has_property(&self, scope: &Scope<'_>, name: &CStr) -> Result<bool, ExnThrown> {
+    pub fn has_property_by_name(&self, scope: &Scope<'_>, name: &CStr) -> Result<bool, ExnThrown> {
         let mut found = false;
         let ok = unsafe {
             wrappers2::JS_HasProperty(scope.cx_mut(), self.handle(), name.as_ptr(), &mut found)
@@ -284,9 +328,27 @@ impl<'s> Stack<'s, Object> {
         Ok(found)
     }
 
-    /// Check whether this object has an own property with the given name.
+    /// Check whether this object has an own property with the given name, through the global's
+    /// interned key for `name` (see [`get_or_init_property_id`](crate::class::get_or_init_property_id)).
+    /// Panics if `name` is an array index.
+    #[inline]
+    pub fn has_own_property(
+        &self,
+        scope: &Scope<'_>,
+        name: &'static CStr,
+    ) -> Result<bool, ExnThrown> {
+        let id = crate::class::get_or_init_property_id(scope, name)?;
+        self.has_own_property_by_id(scope, id)
+    }
+
+    /// Check whether this object has an own property with a name that isn't `'static`. The name
+    /// is atomized on each call.
     #[inline]
-    pub fn has_own_property(&self, scope: &Scope<'_>, name: &CStr) -> Result<bool, ExnThrown> {
+    pub fn has_own_property_by_name(
+        &self,
+        scope: &Scope<'_>,
+        name: &CStr,
+    ) -> Result<bool, ExnThrown> {
         let mut found = false;
         let ok = unsafe {
             wrappers2::JS_HasOwnProperty(scope.cx_mut(), self.handle(), name.as_ptr(), &mut found)
@@ -310,9 +372,23 @@ impl<'s> Stack<'s, Object> {
         Ok(found)
     }
 
-    /// Delete a property by name.
+    /// Delete a property by key.
+    pub fn delete_property_by_id(&self, scope: &Scope<'_>, id: HandleId) -> Result<(), ExnThrown> {
+        let ok = unsafe { wrappers2::JS_DeletePropertyById1(scope.cx_mut(), self.handle(), id) };
+        ExnThrown::check(ok)
+    }
+
+    /// Delete a property by name, through the global's interned key for `name`. Panics if `name`
+    /// is an array index.
     #[inline]
-    pub fn delete_property(&self, scope: &Scope<'_>, name: &CStr) -> Result<(), ExnThrown> {
+    pub fn delete_property(&self, scope: &Scope<'_>, name: &'static CStr) -> Result<(), ExnThrown> {
+        let id = crate::class::get_or_init_property_id(scope, name)?;
+        self.delete_property_by_id(scope, id)
+    }
+
+    /// Delete a property by a name that isn't `'static`. The name is atomized on each call.
+    #[inline]
+    pub fn delete_property_by_name(&self, scope: &Scope<'_>, name: &CStr) -> Result<(), ExnThrown> {
         let ok =
             unsafe { wrappers2::JS_DeleteProperty1(scope.cx_mut(), self.handle(), name.as_ptr()) };
         ExnThrown::check(ok)
@@ -343,9 +419,24 @@ impl<'s> Stack<'s, Object> {
     // Property definition
     // -----------------------------------------------------------------------
 
-    /// Define a property with a JS value and attribute flags.
+    /// Define a property with a JS value and attribute flags, through the global's interned key
+    /// for `name`. Panics if `name` is an array index.
     #[inline]
     pub fn define_property<'v>(
+        &self,
+        scope: &'v Scope<'_>,
+        name: &'static CStr,
+        value: impl ToJSVal<'v>,
+        attrs: c_uint,
+    ) -> Result<(), ExnThrown> {
+        let id = crate::class::get_or_init_property_id(scope, name)?;
+        self.define_value_by_id(scope, id, value, attrs)
+    }
+
+    /// Like [`define_property`](Self::define_property), for a name that isn't
+    /// `'static`. The name is atomized on each call.
+    #[inline]
+    pub fn define_property_by_name<'v>(
         &self,
         scope: &'v Scope<'_>,
         name: &CStr,
@@ -640,21 +731,6 @@ impl<'s> Stack<'s, Object> {
         ExnThrown::check(ok)
     }
 
-    /// Get the property keys of this object.
-    ///
-    /// `flags` controls which properties to include (e.g.,
-    /// `JSITER_OWNONLY`, `JSITER_HIDDEN`).
-    // TODO: this should return a vector of ids instead of taking a MutableHandle outparam.
-    pub fn get_property_keys(
-        &self,
-        scope: &Scope<'_>,
-        flags: c_uint,
-        props: mozjs::jsapi::MutableHandleIdVector,
-    ) -> Result<(), ExnThrown> {
-        let ok = unsafe { wrappers2::GetPropertyKeys(scope.cx_mut(), self.handle(), flags, props) };
-        ExnThrown::check(ok)
-    }
-
     /// Wrap this object for use in the current compartment.
     pub fn wrap_object(&self, scope: &'s Scope<'_>) -> Result<crate::Object<'s>, ExnThrown> {
         let mut wrapped = scope.root_object_mut(self.handle().get());
@@ -684,7 +760,7 @@ impl<'s, 'v> FromJSVal<'s, 'v> for Stack<'s, Object> {
         val: HandleValue<'v>,
         _option: Self::Config,
     ) -> Result<Self, ConversionError> {
-        Self::from_value(scope, *val)
+        Self::from_raw_value(scope, val.get())
     }
 }
 
diff --git a/crates/js/src/prelude.rs b/crates/js/src/prelude.rs
index 23c2aa26..5a1d74b2 100644
--- a/crates/js/src/prelude.rs
+++ b/crates/js/src/prelude.rs
@@ -31,6 +31,3 @@ pub use super::try_catch::TryCatch;
 
 // Re-export the callback args type for closure-based callbacks.
 pub use super::function::CallbackArgs;
-
-// Re-export the runtime / engine types for convenience.
-pub use mozjs::rust::{JSEngine, Runtime};
diff --git a/crates/js/src/promise.rs b/crates/js/src/promise.rs
index 98347bcf..b10694ab 100644
--- a/crates/js/src/promise.rs
+++ b/crates/js/src/promise.rs
@@ -19,7 +19,7 @@ use mozjs::jsapi::{JSObject, PromiseState};
 use mozjs::rust::wrappers2;
 use mozjs::rust::{HandleObject, HandleValue};
 
-use super::error::ExnThrown;
+use super::error::{ExnThrown, OutOfMemory, ThrowException};
 use crate::Object;
 
 /// Marker type for JavaScript `Promise` objects.
@@ -116,7 +116,7 @@ impl<'s> Stack<'s, Promise> {
             scope,
             std::ptr::from_ref(&KEY) as usize,
             |scope| {
-                let p = Self::new_resolved_with_value(scope, crate::value::undefined())?;
+                let p = Self::new_resolved_with_value(scope, HandleValue::undefined())?;
                 Ok(*p)
             },
         )?;
@@ -335,8 +335,7 @@ impl<'s> Stack<'s, Promise> {
         let vector = mozjs::rust::RootedObjectVectorWrapper::new(scope.cx_mut());
         for promise in promises {
             if !vector.append(promise.get()) {
-                crate::exception::report_out_of_memory(scope);
-                return Err(ExnThrown);
+                return Err(OutOfMemory.throw(scope));
             }
         }
         // SAFETY: `vector` is a live, valid ObjectVector for the duration of the call;
@@ -378,8 +377,8 @@ impl<'s> Stack<'s, Promise> {
         pending_futures(|f| f.borrow_mut().push(pending));
     }
 
-    /// [`Promise::spawn`], after polling the future once, now, with a waker that
-    /// does nothing. The work of the future's first poll, such as starting host
+    /// Like [`Promise::spawn`], but polls the future once right away, with a waker
+    /// that does nothing. The work of the future's first poll, such as starting host
     /// I/O, happens before this returns. The event loop's later polls register its
     /// own waker, and settle the promise as for [`Promise::spawn`].
     ///
@@ -445,7 +444,7 @@ impl<'s, T> PromiseOf<'s, T> {
         // microtask; resolving with a thenable defers it to that thenable's resolution.
         let on_fulfilled =
             crate::class::get_or_init_shared_function(scope, check as usize, |scope| {
-                crate::Function::new_callback(scope, c"", 1, check, crate::value::undefined())
+                crate::Function::new_callback(scope, c"", 1, check, HandleValue::undefined())
             })?;
         // A `None` rejection reaction forwards the rejection unchanged, which is what the spec's
         // `onRejectedSteps` amount to for a caller that supplies no rejection steps.
diff --git a/crates/js/src/stack.rs b/crates/js/src/stack.rs
index be24d14c..33b7dc46 100644
--- a/crates/js/src/stack.rs
+++ b/crates/js/src/stack.rs
@@ -29,8 +29,8 @@ use std::rc::Rc;
 use super::error::ExnThrown;
 
 crate::instance_local! {
-    /// The context [`current_origin`] captures stacks on, and null while origins are not being
-    /// recorded.
+    /// The context on which [`current_origin`] captures stacks, and null while origins are not
+    /// being recorded.
     static ORIGIN_CX: Cell<*mut RawJSContext> = const { Cell::new(std::ptr::null_mut()) };
 }
 
@@ -44,14 +44,14 @@ pub unsafe fn record_origins(cx: Option<*mut RawJSContext>) {
     ORIGIN_CX.with(|cell| cell.set(cx.unwrap_or(std::ptr::null_mut())));
 }
 
-/// The current JS call stack, formatted as `Error.prototype.stack` formats one, for describing
+/// The current JS call stack, in the format of `Error.prototype.stack`, for describing
 /// where asynchronous work being created comes from.
 ///
 /// Returns `None` while [`record_origins`] is not recording, when no realm is entered or no
 /// script is running, and when capturing the stack fails. A failed capture's exception is
 /// cleared.
 pub fn current_origin() -> Option<Rc<str>> {
-    // The most frames an origin holds, counted from the call that created the work.
+    // The maximum number of frames an origin holds, counted from the call that created the work.
     const MAX_FRAMES: u32 = 16;
 
     let cx = ORIGIN_CX.with(Cell::get);
diff --git a/crates/js/src/tls.rs b/crates/js/src/tls.rs
index 76a347a7..77fd69da 100644
--- a/crates/js/src/tls.rs
+++ b/crates/js/src/tls.rs
@@ -4,27 +4,25 @@
 //!
 //! Each module that needs thread-local state owns a struct of it here and
 //! reaches it through [`with`]. One key for the crate means one destructor, so
-//! the fields below drop in the order they are declared and anything reasoning
-//! about teardown order has one `js` entry to consider rather than eight.
+//! the fields below drop in the order they are declared.
 //!
 //! Every field keeps its own `RefCell` or `Cell`, so a borrow covers one piece
 //! of state rather than all of it.
 
 use crate::class::ClassTls;
 use crate::gc::pool::PoolTls;
+use crate::gc::rooted::RootedTls;
 use crate::module::ModuleTls;
 use crate::promise::PromiseTls;
 
 /// The whole crate's thread-local state.
-///
-/// The key's destructor drops these fields in declaration order, so ordering
-/// requirements are easy to express and reason about.
 #[crate::allow_unrooted_interior]
 pub(crate) struct JsTls {
     pub(crate) promise: PromiseTls,
     pub(crate) class: ClassTls,
     pub(crate) pool: PoolTls,
     pub(crate) module: ModuleTls,
+    pub(crate) rooted: RootedTls,
 }
 
 crate::instance_local! {
@@ -34,6 +32,7 @@ crate::instance_local! {
             class: ClassTls::new(),
             pool: PoolTls::new(),
             module: ModuleTls::new(),
+            rooted: RootedTls::new(),
         }
     };
 }
@@ -42,3 +41,8 @@ crate::instance_local! {
 pub(crate) fn with<R>(f: impl FnOnce(&JsTls) -> R) -> R {
     JS_TLS.with(f)
 }
+
+/// Run `f` against this thread's state, or return `None` once the thread destroyed it.
+pub(crate) fn try_with<R>(f: impl FnOnce(&JsTls) -> R) -> Option<R> {
+    JS_TLS.try_with(f).ok()
+}
diff --git a/crates/js/src/typedarray.rs b/crates/js/src/typedarray.rs
index cf4b6572..063bbd39 100644
--- a/crates/js/src/typedarray.rs
+++ b/crates/js/src/typedarray.rs
@@ -23,12 +23,23 @@
 //! let buf = ArrayBuffer::new(&scope, 1024)?;
 //! ```
 //!
-//! # Safety
+//! # Byte access
 //!
-//! Methods that hand out raw slices into a buffer's backing store
-//! (`data`, `data_mut`) are `unsafe`: callers must ensure that no GC runs
-//! and the buffer is not detached or transferred while the slice is live.
-//! Use [`copy_bytes`](Stack::copy_bytes) when you want an owned copy.
+//! A buffer's bytes are borrowed only for the duration of a closure: `with_bytes` and
+//! `with_bytes_mut` on the handles, and `with_slice` and `with_slice_mut` on typed arrays. The
+//! closure must be `Send`. A `Scope`, a rooted handle, a `Heap` and a borrow of a class's private
+//! data are not `Send`, so the closure can't capture them, and no GC, JS call or detach can happen
+//! while it runs. The slice can't outlive the closure. Closures that need a fallible copy use
+//! [`try_copy`]. `copy_bytes` returns an owned copy and reports out of memory if allocating it
+//! fails.
+//!
+//! A closure that uses the scope doesn't compile:
+//!
+//! ```compile_fail,E0277
+//! fn latin1<'s>(scope: &'s js::gc::scope::Scope<'_>, view: js::ArrayBufferView<'_>) {
+//!     view.with_bytes(|bytes| js::JSString::from_latin1(scope, bytes).is_ok());
+//! }
+//! ```
 //!
 //! The underlying SpiderMonkey element-type tags
 //! (`mozjs::typedarray::{Uint8, Int32, …}`) and the generic
@@ -51,7 +62,7 @@ use mozjs::typedarray::{
     Uint16, Uint32, Uint8,
 };
 
-use super::error::ExnThrown;
+use super::error::{ExnThrown, OutOfMemory, ThrowException};
 
 // ---------------------------------------------------------------------------
 // ArrayBuffer
@@ -103,6 +114,13 @@ impl JSType for ArrayBuffer {
     fn js_class() -> *const JSClass {
         crate::class::proto_key_to_class(JSProtoKey::JSProto_ArrayBuffer)
     }
+
+    /// Fixed-length and resizable `ArrayBuffer`s have different classes.
+    #[inline]
+    unsafe fn is_instance(obj: *mut JSObject) -> bool {
+        // SAFETY: `obj` is a valid object pointer, per the trait's contract.
+        unsafe { JS::IsArrayBufferObject(obj) }
+    }
 }
 
 impl<'s> Stack<'s, ArrayBuffer> {
@@ -171,8 +189,8 @@ impl<'s> Stack<'s, ArrayBuffer> {
         // External ArrayBuffer contents must be aligned to the engine's `ARRAY_BUFFER_ALIGNMENT`.
         const ARRAY_BUFFER_ALIGNMENT: usize = 8;
         let mut boxed = Box::new(data);
-        // The contents pointer is read off the *boxed* value — the address the free
-        // callback's box will own — never the pre-move one.
+        // The contents pointer is read off the boxed value, never the pre-move one: the free
+        // callback's box owns the boxed address.
         let slice = boxed.as_mut_slice();
         let len = slice.len();
         // An external buffer needs non-null contents; an empty body is a plain empty buffer.
@@ -227,50 +245,66 @@ impl<'s> Stack<'s, ArrayBuffer> {
         unsafe { JS::IsDetachedArrayBufferObject(self.as_raw()) }
     }
 
-    /// Borrow the buffer's backing bytes.
-    ///
-    /// # Safety
-    ///
-    /// No GC may run and the buffer must not be detached or transferred
-    /// while the returned slice is live.
-    pub unsafe fn bytes(self) -> &'s [u8] {
-        let (ptr, len) = array_buffer_length_and_data(self.as_raw());
-        if ptr.is_null() || len == 0 {
-            &[]
-        } else {
-            std::slice::from_raw_parts(ptr, len)
-        }
+    /// Call `f` with the buffer's bytes, which are empty for a detached buffer. See the
+    /// [module docs](self#byte-access).
+    pub fn with_bytes<R>(self, f: impl FnOnce(&[u8]) -> R + Send) -> R {
+        // SAFETY: `self` is a live `ArrayBuffer`, and `f` can't run a GC or detach it.
+        f(unsafe { slice_from_parts(array_buffer_length_and_data(self.as_raw())) })
+    }
+
+    /// Call `f` with the buffer's bytes, mutably. See [`Self::with_bytes`].
+    pub fn with_bytes_mut<R>(self, f: impl FnOnce(&mut [u8]) -> R + Send) -> R {
+        // SAFETY: as in `with_bytes`. No other reference to the bytes exists while `f` runs.
+        f(unsafe { slice_from_parts_mut(array_buffer_length_and_data(self.as_raw())) })
+    }
+
+    /// A copy of the buffer's bytes. Failing to allocate it reports out of memory.
+    pub fn copy_bytes(self, scope: &Scope<'_>) -> Result<Vec<u8>, ExnThrown> {
+        copy_or_report(scope, self.with_bytes(try_copy))
     }
 
-    /// Mutably borrow the buffer's backing bytes.
+    /// Copy `count` bytes from `src` at `src_start` into this buffer at `dest_start`. The buffers
+    /// can be the same buffer, and the ranges can overlap.
     ///
-    /// # Safety
+    /// # Panics
     ///
-    /// No GC may run and the buffer must not be detached or transferred
-    /// while the returned slice is live. Concurrent access via another
-    /// reference is undefined behaviour.
-    #[allow(clippy::mut_from_ref)]
-    pub unsafe fn bytes_mut(self) -> &'s mut [u8] {
-        let (ptr, len) = array_buffer_length_and_data(self.as_raw());
-        if ptr.is_null() || len == 0 {
-            &mut []
-        } else {
-            std::slice::from_raw_parts_mut(ptr, len)
+    /// Panics if either range doesn't lie within its buffer.
+    pub fn copy_region_from(
+        self,
+        dest_start: usize,
+        src: Stack<'_, ArrayBuffer>,
+        src_start: usize,
+        count: usize,
+    ) {
+        // SAFETY: both are live `ArrayBuffer`s, and nothing runs between reading the pointers and
+        // copying.
+        let ((dest, dest_len), (from, src_len)) = unsafe {
+            (
+                array_buffer_length_and_data(self.as_raw()),
+                array_buffer_length_and_data(src.as_raw()),
+            )
+        };
+        assert!(dest_start
+            .checked_add(count)
+            .is_some_and(|end| end <= dest_len));
+        assert!(src_start
+            .checked_add(count)
+            .is_some_and(|end| end <= src_len));
+        if count != 0 {
+            // SAFETY: both ranges lie within their buffers, which are non-empty, so neither
+            // pointer is null. `ptr::copy` allows the ranges to overlap.
+            unsafe { std::ptr::copy(from.add(src_start), dest.add(dest_start), count) };
         }
     }
 
-    /// Copy the buffer's contents into an owned `Vec`.
-    pub fn copy_bytes(self) -> Vec<u8> {
-        unsafe { self.bytes() }.to_vec()
-    }
-
     /// Transfer this buffer's contents into a new `ArrayBuffer`, detaching the
     /// receiver.
     ///
     /// This is the WHATWG abstract operation `TransferArrayBuffer`: the returned
     /// buffer holds the receiver's bytes and the receiver is left detached
-    /// (zero-length). The receiver must not already be detached. The contents are
-    /// moved, not copied.
+    /// (zero-length). The receiver must not already be detached. Contents the
+    /// engine allocated are moved. The engine copies the contents of an external,
+    /// inline or user-owned buffer, such as one created by [`Self::from_external`].
     pub fn transfer(self, scope: &'s Scope<'_>) -> Result<Self, ExnThrown> {
         let length = self.byte_length();
         // A zero-length buffer may have no contents to steal. Hand back a fresh empty buffer
@@ -308,16 +342,7 @@ impl<'s> Stack<'s, ArrayBuffer> {
         length: usize,
     ) -> Result<Self, ExnThrown> {
         let out = Self::new(scope, length)?;
-        if length != 0 {
-            // SAFETY: both buffers are live and non-detached, the source region
-            // is within bounds (caller-validated), and no GC runs between the
-            // two borrows because no allocation happens here.
-            unsafe {
-                let src = self.bytes();
-                let dst = out.bytes_mut();
-                dst.copy_from_slice(&src[byte_offset..byte_offset + length]);
-            }
-        }
+        out.copy_region_from(0, self, byte_offset, length);
         Ok(out)
     }
 }
@@ -507,53 +532,71 @@ impl<'s> Stack<'s, ArrayBufferView> {
         self.byte_length() / self.view_kind().element_size()
     }
 
-    /// Borrow the view's bytes.
+    /// Call `f` with the view's bytes, which are empty for a view of a detached buffer. See the
+    /// [module docs](self#byte-access).
+    pub fn with_bytes<R>(self, f: impl FnOnce(&[u8]) -> R + Send) -> R {
+        // SAFETY: `self` is a live view, and `f` can't run a GC or detach its buffer.
+        f(unsafe { slice_from_parts((self.data_ptr(), self.byte_length())) })
+    }
+
+    /// Call `f` with the view's bytes, mutably. See [`Self::with_bytes`].
+    pub fn with_bytes_mut<R>(self, f: impl FnOnce(&mut [u8]) -> R + Send) -> R {
+        // SAFETY: as in `with_bytes`. No other reference to the bytes exists while `f` runs.
+        f(unsafe { slice_from_parts_mut((self.data_ptr(), self.byte_length())) })
+    }
+
+    /// A copy of the view's bytes. Failing to allocate it reports out of memory.
+    pub fn copy_bytes(self, scope: &Scope<'_>) -> Result<Vec<u8>, ExnThrown> {
+        copy_or_report(scope, self.with_bytes(try_copy))
+    }
+
+    /// Copy `count` bytes from `src` at `src_start` into this view at `dest_start`. The views can
+    /// share a buffer, and the ranges can overlap.
     ///
-    /// # Safety
+    /// # Panics
     ///
-    /// No GC may run and the buffer must not be detached while the
-    /// returned slice is live.
-    pub unsafe fn bytes(self) -> &'s [u8] {
-        let length = self.byte_length();
-        if length == 0 {
-            return &[];
-        }
-        let mut is_shared = false;
-        let nogc = JS::AutoRequireNoGC { _address: 0 };
-        let data = mozjs::jsapi::JS_GetArrayBufferViewData(self.as_raw(), &mut is_shared, &nogc);
-        if data.is_null() {
-            &[]
-        } else {
-            std::slice::from_raw_parts(data as *const u8, length)
+    /// Panics if either range doesn't lie within its view.
+    pub fn copy_region_from(
+        self,
+        dest_start: usize,
+        src: Stack<'_, ArrayBufferView>,
+        src_start: usize,
+        count: usize,
+    ) {
+        let (dest_len, src_len) = (self.byte_length(), src.byte_length());
+        assert!(dest_start
+            .checked_add(count)
+            .is_some_and(|end| end <= dest_len));
+        assert!(src_start
+            .checked_add(count)
+            .is_some_and(|end| end <= src_len));
+        if count != 0 {
+            // SAFETY: both ranges lie within their views, which are non-empty, so neither pointer
+            // is null, and nothing runs between reading the pointers and copying. `ptr::copy`
+            // allows the ranges to overlap.
+            unsafe {
+                std::ptr::copy(
+                    src.data_ptr().add(src_start),
+                    self.data_ptr().add(dest_start),
+                    count,
+                )
+            };
         }
     }
 
-    /// Mutably borrow the view's bytes.
-    ///
-    /// # Safety
-    ///
-    /// No GC may run and the buffer must not be detached while the
-    /// returned slice is live. Concurrent access via another reference is
-    /// undefined behaviour.
-    #[allow(clippy::mut_from_ref)]
-    pub unsafe fn bytes_mut(self) -> &'s mut [u8] {
-        let length = self.byte_length();
-        if length == 0 {
-            return &mut [];
+    /// A pointer to the view's first byte, or a null pointer for an empty view. The pointer is
+    /// valid for `byte_length()` bytes until the next GC or until the buffer is detached.
+    fn data_ptr(self) -> *mut u8 {
+        if self.byte_length() == 0 {
+            return std::ptr::null_mut();
         }
         let mut is_shared = false;
         let nogc = JS::AutoRequireNoGC { _address: 0 };
-        let data = mozjs::jsapi::JS_GetArrayBufferViewData(self.as_raw(), &mut is_shared, &nogc);
-        if data.is_null() {
-            &mut []
-        } else {
-            std::slice::from_raw_parts_mut(data as *mut u8, length)
-        }
-    }
-
-    /// Copy the view's bytes into an owned `Vec`.
-    pub fn copy_bytes(self) -> Vec<u8> {
-        unsafe { self.bytes() }.to_vec()
+        // SAFETY: `self` is a live view. The pointer is only returned.
+        let data = unsafe {
+            mozjs::jsapi::JS_GetArrayBufferViewData(self.as_raw(), &mut is_shared, &nogc)
+        };
+        data as *mut u8
     }
 }
 
@@ -605,26 +648,12 @@ crate::gc::handle::deref_to_object!(ArrayBufferView);
 
 crate::gc::handle::from_jsval_via_cast!(ArrayBufferView, c"Value isn't a typed array or DataView");
 
-/// Copy the bytes held by any `BufferSource` (an `ArrayBuffer`,
-/// `SharedArrayBuffer`, or `ArrayBufferView`) into an owned `Vec`.
-///
-/// Returns `None` if `obj` is none of the above.
-pub fn copy_bytes_if_buffer_source(obj: Object<'_>) -> Option<Vec<u8>> {
-    // SAFETY: All functions called following JSAPI's contract.
-    unsafe {
-        if JS::IsArrayBufferObject(obj.as_raw()) {
-            let (ptr, len) = array_buffer_length_and_data(obj.as_raw());
-            if ptr.is_null() || len == 0 {
-                return Some(Vec::new());
-            }
-            return Some(std::slice::from_raw_parts(ptr, len).to_vec());
-        }
-        if mozjs::jsapi::JS_IsArrayBufferViewObject(obj.as_raw()) {
-            let view: Stack<'_, ArrayBufferView> = Stack::from_handle_unchecked(obj.handle());
-            return Some(view.copy_bytes());
-        }
-    }
-    None
+/// A copy of `bytes`, or `None` if allocating it fails.
+pub fn try_copy(bytes: &[u8]) -> Option<Vec<u8>> {
+    let mut copy = Vec::new();
+    copy.try_reserve_exact(bytes.len()).ok()?;
+    copy.extend_from_slice(bytes);
+    Some(copy)
 }
 
 // ---------------------------------------------------------------------------
@@ -652,7 +681,7 @@ pub trait TypedArrayKind: JSType {
     ///
     /// # Safety
     ///
-    /// `obj` must be a non-null typed array of this kind.
+    /// `obj` must be a non-null typed array of this kind, or a cross-compartment wrapper of one.
     unsafe fn length_and_data(obj: *mut JSObject) -> (*mut Self::Element, usize);
 }
 
@@ -695,36 +724,18 @@ impl<'s, T: TypedArrayKind> Stack<'s, T> {
         unsafe { mozjs::jsapi::JS_GetArrayBufferViewByteLength(self.as_raw()) }
     }
 
-    /// Borrow the typed array's elements.
-    ///
-    /// # Safety
-    ///
-    /// No GC may run and the underlying buffer must not be detached while
-    /// the returned slice is live.
-    pub unsafe fn as_slice(self) -> &'s [T::Element] {
-        let (ptr, len) = T::length_and_data(self.as_raw());
-        if ptr.is_null() || len == 0 {
-            &[]
-        } else {
-            std::slice::from_raw_parts(ptr, len)
-        }
+    /// Call `f` with the typed array's elements, which are empty for a detached buffer. See the
+    /// [module docs](self#byte-access).
+    pub fn with_slice<R>(self, f: impl FnOnce(&[T::Element]) -> R + Send) -> R {
+        // SAFETY: `self` is a live typed array of kind `T`, and `f` can't run a GC or detach its
+        // buffer.
+        f(unsafe { slice_from_parts(T::length_and_data(self.as_raw())) })
     }
 
-    /// Mutably borrow the typed array's elements.
-    ///
-    /// # Safety
-    ///
-    /// No GC may run and the underlying buffer must not be detached while
-    /// the returned slice is live. Concurrent access via another reference
-    /// is undefined behaviour.
-    #[allow(clippy::mut_from_ref)]
-    pub unsafe fn as_mut_slice(self) -> &'s mut [T::Element] {
-        let (ptr, len) = T::length_and_data(self.as_raw());
-        if ptr.is_null() || len == 0 {
-            &mut []
-        } else {
-            std::slice::from_raw_parts_mut(ptr, len)
-        }
+    /// Call `f` with the typed array's elements, mutably. See [`Self::with_slice`].
+    pub fn with_slice_mut<R>(self, f: impl FnOnce(&mut [T::Element]) -> R + Send) -> R {
+        // SAFETY: as in `with_slice`. No other reference to the elements exists while `f` runs.
+        f(unsafe { slice_from_parts_mut(T::length_and_data(self.as_raw())) })
     }
 
     /// View this typed array through the abstract `ArrayBufferView` handle.
@@ -772,6 +783,13 @@ macro_rules! typed_array_marker {
             fn js_class() -> *const JSClass {
                 crate::class::proto_key_to_class(JSProtoKey::$proto)
             }
+
+            /// Views of fixed-length and of resizable buffers have different classes. Both are
+            /// instances.
+            unsafe fn is_instance(obj: *mut JSObject) -> bool {
+                // SAFETY: `obj` is a valid object pointer, per the trait's contract.
+                !unsafe { <$tag as TypedArrayElement>::unwrap_array(obj) }.is_null()
+            }
         }
 
         impl TypedArrayKind for $Marker {
@@ -782,6 +800,9 @@ macro_rules! typed_array_marker {
             }
 
             unsafe fn length_and_data(obj: *mut JSObject) -> (*mut Self::Element, usize) {
+                // `length_and_data` requires an unwrapped typed array.
+                let obj = <$tag as TypedArrayElement>::unwrap_array(obj);
+                debug_assert!(!obj.is_null(), concat!("expected a ", $name));
                 match <$tag as TypedArrayElement>::length_and_data(obj) {
                     Some(data) => (data.as_ptr().cast(), data.len()),
                     None => (std::ptr::null_mut(), 0),
@@ -806,7 +827,7 @@ macro_rules! typed_array_marker {
                 val: HandleValue<'v>,
                 _option: Self::Config,
             ) -> Result<Self, ConversionError> {
-                Object::from_value(scope, *val)?
+                Object::from_raw_value(scope, val.get())?
                     .cast::<Self>()
                     .map_err(|_| {
                         const MSG: &std::ffi::CStr = unsafe {
@@ -840,7 +861,7 @@ typed_array_marker!(Float64Array, "Float64Array", JSProto_Float64Array, Float64)
 /// so the marker is written out against the JSAPI entry points directly.
 // TODO: add element tags to mozjs and remove the need for this.
 macro_rules! bigint_typed_array_marker {
-    ($Marker:ident, $name:literal, $proto:ident, $elem:ty, $new:ident, $data:ident) => {
+    ($Marker:ident, $name:literal, $proto:ident, $elem:ty, $new:ident, $data:ident, $unwrap:ident) => {
         #[doc = concat!("Marker type for JavaScript `", $name, "` objects.")]
         pub struct $Marker;
 
@@ -851,6 +872,13 @@ macro_rules! bigint_typed_array_marker {
             fn js_class() -> *const JSClass {
                 crate::class::proto_key_to_class(JSProtoKey::$proto)
             }
+
+            /// Views of fixed-length and of resizable buffers have different classes. Both are
+            /// instances.
+            unsafe fn is_instance(obj: *mut JSObject) -> bool {
+                // SAFETY: `obj` is a valid object pointer, per the trait's contract.
+                !unsafe { mozjs::jsapi::js::$unwrap(obj) }.is_null()
+            }
         }
 
         impl TypedArrayKind for $Marker {
@@ -891,7 +919,7 @@ macro_rules! bigint_typed_array_marker {
                 val: HandleValue<'v>,
                 _option: Self::Config,
             ) -> Result<Self, ConversionError> {
-                Object::from_value(scope, *val)?
+                Object::from_raw_value(scope, val.get())?
                     .cast::<Self>()
                     .map_err(|_| {
                         const MSG: &std::ffi::CStr = unsafe {
@@ -912,7 +940,8 @@ bigint_typed_array_marker!(
     JSProto_BigInt64Array,
     i64,
     JS_NewBigInt64Array,
-    JS_GetBigInt64ArrayData
+    JS_GetBigInt64ArrayData,
+    UnwrapBigInt64Array
 );
 bigint_typed_array_marker!(
     BigUint64Array,
@@ -920,7 +949,8 @@ bigint_typed_array_marker!(
     JSProto_BigUint64Array,
     u64,
     JS_NewBigUint64Array,
-    JS_GetBigUint64ArrayData
+    JS_GetBigUint64ArrayData,
+    UnwrapBigUint64Array
 );
 
 // ---------------------------------------------------------------------------
@@ -940,9 +970,12 @@ fn root_or_throw<'s, T: JSType>(
 ///
 /// # Safety
 ///
-/// `obj` must be a live `ArrayBuffer` object. The returned pointer is valid
-/// only until the next GC or detach.
+/// `obj` must be a live `ArrayBuffer` object or a cross-compartment wrapper of one. The returned
+/// pointer is valid only until the next GC or detach.
 unsafe fn array_buffer_length_and_data(obj: *mut JSObject) -> (*mut u8, usize) {
+    // `GetArrayBufferLengthAndData` requires an unwrapped buffer.
+    let obj = JS::UnwrapArrayBuffer(obj);
+    debug_assert!(!obj.is_null(), "expected an ArrayBuffer");
     let mut length = 0usize;
     let mut is_shared = false;
     let mut data: *mut u8 = std::ptr::null_mut();
@@ -951,6 +984,39 @@ unsafe fn array_buffer_length_and_data(obj: *mut JSObject) -> (*mut u8, usize) {
     (data, length)
 }
 
+/// The slice of `len` elements at `ptr`, or an empty slice if `ptr` is null or `len` is 0.
+///
+/// # Safety
+///
+/// A non-null `ptr` must be valid for reads of `len` elements for `'a`, and nothing may write to
+/// them for `'a`.
+unsafe fn slice_from_parts<'a, T>((ptr, len): (*mut T, usize)) -> &'a [T] {
+    if ptr.is_null() || len == 0 {
+        &[]
+    } else {
+        std::slice::from_raw_parts(ptr, len)
+    }
+}
+
+/// The mutable slice of `len` elements at `ptr`, or an empty slice if `ptr` is null or `len` is 0.
+///
+/// # Safety
+///
+/// A non-null `ptr` must be valid for reads and writes of `len` elements for `'a`, and nothing else
+/// may access them for `'a`.
+unsafe fn slice_from_parts_mut<'a, T>((ptr, len): (*mut T, usize)) -> &'a mut [T] {
+    if ptr.is_null() || len == 0 {
+        &mut []
+    } else {
+        std::slice::from_raw_parts_mut(ptr, len)
+    }
+}
+
+/// Returns `copy`, or, if it is `None`, an out-of-memory error reported on `scope`.
+fn copy_or_report(scope: &Scope<'_>, copy: Option<Vec<u8>>) -> Result<Vec<u8>, ExnThrown> {
+    copy.ok_or_else(|| OutOfMemory.throw(scope))
+}
+
 /// Get the data pointer of a freshly created (and therefore non-detached,
 /// non-shared) `ArrayBuffer`.
 ///
diff --git a/crates/js/src/webidl_enum.rs b/crates/js/src/webidl_enum.rs
index 273ce09e..c87baabc 100644
--- a/crates/js/src/webidl_enum.rs
+++ b/crates/js/src/webidl_enum.rs
@@ -5,8 +5,7 @@
 
 /// Define a WebIDL enumeration: the Rust enum plus `as_str`, `Display`,
 /// `FromStr`, and the JS value conversions (`FromJSVal`/`ToJSVal`), all
-/// generated from a single `Variant => "string"` list — so the four string
-/// tables cannot drift, and adding a variant is a one-line change.
+/// generated from a single `Variant => "string"` list.
 ///
 /// ```ignore
 /// js::webidl_enum! {
diff --git a/crates/libstarling/Cargo.toml b/crates/libstarling/Cargo.toml
index 1a73b791..ec30be87 100644
--- a/crates/libstarling/Cargo.toml
+++ b/crates/libstarling/Cargo.toml
@@ -7,7 +7,7 @@ authors.workspace = true
 edition.workspace = true
 
 [lib]
-# No unit tests; skip building the (SpiderMonkey-sized) lib test harness binary.
+# No unit tests. This skips building the (SpiderMonkey-sized) lib test harness binary.
 # The integration tests in `tests/` link the lib and are unaffected.
 test = false
 
@@ -46,6 +46,7 @@ wasip3.workspace = true
 [dev-dependencies]
 futures-channel.workspace = true
 serve-test-support.workspace = true
+tempfile = "3"
 
 [lints]
-workspace = true
\ No newline at end of file
+workspace = true
diff --git a/crates/libstarling/src/lib.rs b/crates/libstarling/src/lib.rs
index 3115c7ad..0ab65018 100644
--- a/crates/libstarling/src/lib.rs
+++ b/crates/libstarling/src/lib.rs
@@ -10,6 +10,10 @@ pub mod serve_native;
 /// The per-request dispatch core shared by the serve modes.
 mod serve_common;
 
+/// Exported for `tests/wire_response.rs` only.
+#[doc(hidden)]
+pub use serve_common::{prepare_wire_response, WireResponse};
+
 /// Wasm HTTP serve mode: the body of the `wasi:http/handler` export.
 #[cfg(target_arch = "wasm32")]
 pub mod serve_wasm;
@@ -39,9 +43,9 @@ pub fn register_builtins() {
 
 /// Apply CLI options that take effect before the runtime is initialized: the worker location URL
 /// from `--init-location`, and the WPT test globals from `--wpt-mode`. Shared between the native
-/// and wasm32 entry points, and between the CLI and HTTP ones — a WPT run under `--serve` needs
+/// and wasm32 entry points, and between the CLI and HTTP ones: a WPT run under `--serve` needs
 /// the same globals a command-mode run does.
-fn apply_pre_init_config(config: &config::RuntimeConfig) -> Result<(), String> {
+pub fn apply_pre_init_config(config: &config::RuntimeConfig) -> Result<(), String> {
     if let Some(location) = config.init_location.as_deref() {
         let url = url::Url::parse(location)
             .map_err(|e| format!("Invalid --init-location URL {location:?}: {e}"))?;
@@ -113,7 +117,7 @@ pub async fn run(config: config::RuntimeConfig) -> Result<(), String> {
     let raw_cx = unsafe { scope.raw_cx_no_gc() };
     let el = invocation.event_loop();
 
-    // SAFETY: `raw_cx` is valid for the duration of the await — `scope`
+    // SAFETY: `raw_cx` is valid for the duration of the await. `scope`
     // keeps the `Runtime` alive and the realm entered.
     unsafe {
         evaluation
@@ -158,9 +162,8 @@ fn drive_event_loop_native(
     let el = invocation.event_loop();
 
     tokio_rt.block_on(async {
-        // SAFETY: the scope (and its Runtime) must outlive this future.
-        // Since the caller owns both and `block_on` runs synchronously on
-        // the same thread, this is guaranteed.
+        // SAFETY: the scope (and its Runtime) outlives this future. Since the caller owns both
+        // and `block_on` runs synchronously on the same thread, this is guaranteed.
         let raw_cx = unsafe { scope.raw_cx_no_gc() };
         unsafe {
             evaluation
diff --git a/crates/libstarling/src/serve_common.rs b/crates/libstarling/src/serve_common.rs
index 79d24a42..51e42ffc 100644
--- a/crates/libstarling/src/serve_common.rs
+++ b/crates/libstarling/src/serve_common.rs
@@ -102,7 +102,7 @@ impl RequestClock {
     }
 }
 
-/// Run `work` under `limit`: `Some(output)` if it finished, `None` if `time_limit` was reached
+/// Run `work` under `time_limit`: `Some(output)` if it finished, `None` if the limit was reached
 /// and `work` interrupted as a result.
 pub(crate) async fn with_timeout<S, F, W>(
     sleep: &S,
@@ -159,7 +159,7 @@ pub(crate) async unsafe fn drain_lifetime_work<S, F>(
 /// Map a `Response`'s status to a value the HTTP wire can represent, replacing
 /// anything outside the valid status-code range (e.g. `Response.error()`'s `0`)
 /// with `500`. RFC 9110 status codes are three digits in `100..=599`.
-fn normalize_http_status(status: u16) -> u16 {
+pub(crate) fn normalize_http_status(status: u16) -> u16 {
     if (100..=599).contains(&status) {
         status
     } else {
@@ -215,7 +215,7 @@ pub(crate) fn signal_request_abort(
 
 /// The request's header fields as the list a `Headers` object holds. The fetch spec stores those
 /// as ordered name/value pairs, not as a map, so the fields are flattened back out here.
-fn header_list(headers: &http::HeaderMap) -> Vec<(String, String)> {
+pub(crate) fn header_list(headers: &http::HeaderMap) -> Vec<(String, String)> {
     headers
         .iter()
         .map(|(name, value)| {
@@ -476,9 +476,9 @@ where
             } else if !FetchEvent::has_listener(scope) {
                 // The script never registered a handler at all. The startup paths refuse that
                 // outright where they can (see [`NO_FETCH_LISTENER`]), so reaching here means they
-                // couldn't: a per-request evaluation under `--serve-isolated`, a script still
-                // evaluating when the snapshot was taken, or a host that owns the instance's
-                // lifecycle and leaves the guest no way to decline.
+                // couldn't: a per-request evaluation under `--serve-isolated`, a snapshot of a
+                // script that exports `run` instead, or a host that owns the instance's lifecycle
+                // and leaves the guest no way to decline.
                 eprintln!("serve: {NO_FETCH_LISTENER}; answering with a network error");
             } else {
                 eprintln!(
@@ -548,7 +548,7 @@ pub(crate) fn signal_body_outcome(
 }
 
 /// The `Create Fetch Event and Dispatch` step 17.4.20 abort a body send calls for, as
-/// `(DOMException name, message)`, or `None` where the send needs no abort.
+/// `(DOMException name, message)`, or `None` if the send needs no abort.
 ///
 /// The reason is logged here as well, since the response is already on its way and there is
 /// no status left to report a failed, stalled, or abandoned body with.
@@ -588,11 +588,11 @@ fn abort_for_outcome(outcome: BodySendOutcome) -> Option<(&'static str, &'static
 
 /// A response reduced to what may go on the wire: the header fields that may be sent, the body to
 /// send, and the content length.
-pub(crate) struct WireResponse {
-    pub(crate) status: u16,
-    pub(crate) headers: http::HeaderMap,
-    /// The content to send, empty where the status or the method rules content out.
-    pub(crate) body: platform::http::OutgoingBody,
+pub struct WireResponse {
+    pub status: u16,
+    pub headers: http::HeaderMap,
+    /// The content to send, which is empty if the status or the method rules content out.
+    pub body: platform::http::OutgoingBody,
     /// The response's `Content-Length`. For non-streaming bodies, it's derived from the buffer.
     /// For forwarded incoming bodies, the incoming `Content-Length` header is used. For bodies
     /// backed by a JS `ReadableStream`, the guest-set `Content-Length` header is used, if any.
@@ -605,7 +605,7 @@ pub(crate) struct WireResponse {
     /// connection is closed.
     ///
     /// Always `None` for body-less status responses.
-    pub(crate) declared_length: Option<u64>,
+    pub declared_length: Option<u64>,
 }
 
 /// Whether a status is framed by the status alone: no `Content-Length`, no `Transfer-Encoding`, no
@@ -679,7 +679,7 @@ fn declared_content_length(headers: &[(String, String)]) -> Option<u64> {
 ///
 /// A `HEAD` still declares the length of the body a `GET` would have produced, where that is known
 /// without producing the content. RFC 9110 §9.3.2 allows omitting it otherwise.
-pub(crate) fn prepare_wire_response(
+pub fn prepare_wire_response(
     head_request: bool,
     status: u16,
     headers: Vec<(String, String)>,
@@ -731,185 +731,3 @@ pub(crate) fn prepare_wire_response(
         declared_length,
     }
 }
-
-#[cfg(test)]
-mod wire_response_tests {
-    use super::*;
-    use platform::http::OutgoingBody;
-
-    fn headers(pairs: &[(&str, &str)]) -> Vec<(String, String)> {
-        pairs
-            .iter()
-            .map(|(n, v)| (n.to_string(), v.to_string()))
-            .collect()
-    }
-
-    fn names(response: &WireResponse) -> Vec<String> {
-        response
-            .headers
-            .iter()
-            .map(|(name, _)| name.as_str().to_string())
-            .collect()
-    }
-
-    #[test]
-    fn framing_headers_are_dropped_whoever_set_them() {
-        let response = prepare_wire_response(
-            false,
-            200,
-            headers(&[
-                ("Content-Length", "10000"),
-                ("transfer-encoding", "chunked"),
-                ("CONNECTION", "keep-alive"),
-                ("x-keep", "me"),
-            ]),
-            OutgoingBody::Bytes(bytes::Bytes::from_static(b"short")),
-        );
-        assert_eq!(names(&response), ["x-keep"]);
-    }
-
-    #[test]
-    fn headers_that_could_split_the_response_are_dropped() {
-        let response = prepare_wire_response(
-            false,
-            200,
-            headers(&[
-                ("x-cr", "a\rb"),
-                ("x-lf", "a\nb"),
-                ("x-nul", "a\0b"),
-                ("x-na\rme", "fine"),
-                ("x-keep", "me"),
-            ]),
-            OutgoingBody::Bytes(bytes::Bytes::new()),
-        );
-        assert_eq!(names(&response), ["x-keep"]);
-    }
-
-    /// The body a response sends, for a test that only ever builds in-memory ones.
-    fn content(response: &WireResponse) -> &[u8] {
-        match &response.body {
-            OutgoingBody::Bytes(bytes) => bytes,
-            _ => panic!("the test built an in-memory body"),
-        }
-    }
-
-    #[test]
-    fn a_bodiless_status_has_no_content_even_for_a_get() {
-        for status in [204, 304] {
-            let response = prepare_wire_response(
-                false,
-                status,
-                headers(&[("x-keep", "me")]),
-                OutgoingBody::Bytes(bytes::Bytes::from_static(b"ignored")),
-            );
-            assert!(content(&response).is_empty(), "{status}");
-            assert_eq!(response.declared_length, None, "{status}");
-            assert_eq!(names(&response), ["x-keep"], "{status}");
-        }
-    }
-
-    #[test]
-    fn a_head_request_declares_the_length_it_would_have_sent() {
-        let response = prepare_wire_response(
-            true,
-            200,
-            Vec::new(),
-            OutgoingBody::Bytes(bytes::Bytes::from_static(b"BODYBYTES")),
-        );
-        assert!(content(&response).is_empty());
-        assert_eq!(response.declared_length, Some(9));
-    }
-
-    #[test]
-    fn a_head_request_declares_no_length_it_would_have_to_produce() {
-        // A streamed body's length is only knowable by generating the content.
-        let (_sender, streamed) = platform::http::body_channel();
-        let response = prepare_wire_response(true, 200, Vec::new(), streamed);
-        assert!(content(&response).is_empty());
-        assert_eq!(response.declared_length, None);
-    }
-
-    /// A streamed body has no length until it is produced, so the handler's declaration is the
-    /// only thing that can frame it. The transport then enforces it against the body.
-    #[test]
-    fn a_streamed_body_takes_the_declared_length() {
-        let (_sender, streamed) = platform::http::body_channel();
-        let response =
-            prepare_wire_response(false, 200, headers(&[("content-length", "42")]), streamed);
-        assert_eq!(response.declared_length, Some(42));
-        assert_eq!(names(&response), Vec::<String>::new());
-    }
-
-    /// Content already in memory is measured. A declaration that disagrees with it would frame the
-    /// response as something other than what it sends.
-    #[test]
-    fn an_in_memory_body_is_measured_not_declared() {
-        let response = prepare_wire_response(
-            false,
-            200,
-            headers(&[("content-length", "10000")]),
-            OutgoingBody::Bytes(bytes::Bytes::from_static(b"short")),
-        );
-        assert_eq!(response.declared_length, Some(5));
-        assert_eq!(content(&response), b"short");
-    }
-
-    /// Only an unambiguous `1*DIGIT` frames a response. A `Headers` object joins repeated fields
-    /// into one comma-separated value, which lands here as a value that is not a number.
-    #[test]
-    fn a_declared_length_that_is_not_one_number_is_refused() {
-        for value in ["", "x", "10000, 10000", " 5", "+5", "5.0", "0x5", "-1"] {
-            let (_sender, streamed) = platform::http::body_channel();
-            let response =
-                prepare_wire_response(false, 200, headers(&[("content-length", value)]), streamed);
-            assert_eq!(response.declared_length, None, "{value:?}");
-        }
-    }
-
-    /// RFC 9110 §9.3.2: a `HEAD` may report the length its `GET` would have had.
-    #[test]
-    fn a_head_declares_the_length_it_was_given() {
-        let response = prepare_wire_response(
-            true,
-            200,
-            headers(&[("content-length", "12345")]),
-            OutgoingBody::Bytes(bytes::Bytes::new()),
-        );
-        assert!(content(&response).is_empty());
-        assert_eq!(response.declared_length, Some(12345));
-    }
-
-    /// The status still outranks the declaration, so nothing frames a response that has no
-    /// content.
-    #[test]
-    fn a_bodiless_status_ignores_a_declared_length() {
-        let (_sender, streamed) = platform::http::body_channel();
-        let response =
-            prepare_wire_response(false, 204, headers(&[("content-length", "42")]), streamed);
-        assert_eq!(response.declared_length, None);
-    }
-
-    #[test]
-    fn an_in_memory_body_declares_its_length() {
-        let response = prepare_wire_response(
-            false,
-            200,
-            Vec::new(),
-            OutgoingBody::Bytes(bytes::Bytes::from_static(b"BODYBYTES")),
-        );
-        assert_eq!(content(&response), b"BODYBYTES");
-        assert_eq!(response.declared_length, Some(9));
-    }
-
-    #[test]
-    fn a_bodiless_status_outranks_the_method() {
-        let response = prepare_wire_response(
-            true,
-            204,
-            Vec::new(),
-            OutgoingBody::Bytes(bytes::Bytes::from_static(b"ignored")),
-        );
-        assert!(content(&response).is_empty());
-        assert_eq!(response.declared_length, None);
-    }
-}
diff --git a/crates/libstarling/src/serve_native.rs b/crates/libstarling/src/serve_native.rs
index 56c33daa..68e07157 100644
--- a/crates/libstarling/src/serve_native.rs
+++ b/crates/libstarling/src/serve_native.rs
@@ -54,7 +54,7 @@ enum RequestHandlingMode {
 }
 
 /// Everything a connection needs that outlives the requests it serves: the runtime to dispatch in,
-/// where each request's JS runs, and the time limits each request runs under.
+/// where each request's JS runs, and the time limits under which each request runs.
 struct ServeContext {
     runtime: Rc<Runtime>,
     request_handling_mode: RequestHandlingMode,
@@ -90,25 +90,28 @@ impl ServeContext {
     }
 }
 
-/// Run the serve loop on the given TCP port: evaluate the script (registering handlers), then
-/// accept and dispatch requests until the process is killed.
+/// Bind `127.0.0.1:port`, or a port the system picks when `port` is `0`, and run the serve loop on
+/// it until the process is killed. See [`serve_with_shutdown`].
 pub fn serve(config: RuntimeConfig, port: u16) -> Result<(), String> {
-    serve_with_shutdown(config, port, std::future::pending())
+    let listener = std::net::TcpListener::bind(("127.0.0.1", port))
+        .map_err(|e| format!("Failed to bind 127.0.0.1:{port}: {e}"))?;
+    serve_with_shutdown(config, listener, std::future::pending())
 }
 
-/// Like [`serve`], but stops accepting and returns once `shutdown` resolves (any in-flight requests
-/// are abandoned). Lets a caller (a test, or a future signal handler) shut the server down
-/// gracefully so the runtime drops cleanly.
+/// Run the serve loop on `listener`: print the listener's address on stderr, evaluate the script
+/// (registering handlers), then accept and dispatch requests until `shutdown` resolves. Requests
+/// still in flight at that point are abandoned. A caller that shuts the server down this way, such
+/// as a test, lets the runtime drop cleanly.
 pub fn serve_with_shutdown(
     config: RuntimeConfig,
-    port: u16,
+    listener: std::net::TcpListener,
     shutdown: impl Future<Output = ()>,
 ) -> Result<(), String> {
     config.validate_serve_timeouts()?;
     config.serve_limits.validate()?;
     // Isolated mode has no process-wide content script: the script belongs to each request's own
     // global, and every request evaluates it there. Evaluating it here as well would run it (and
-    // its side effects) one extra time, in a global that goes on to serve nothing, so that mode
+    // its side effects) one extra time, in a global that never serves a request, so that mode
     // only sets up the runtime itself.
     let (runtime, startup) = if config.serve_isolated {
         (Runtime::init(&config)?, None)
@@ -120,7 +123,7 @@ pub fn serve_with_shutdown(
         .enable_all()
         .build()
         .map_err(|e| format!("Failed to create tokio runtime: {e}"))?;
-    tokio_rt.block_on(run_server(runtime, startup, config, port, shutdown))
+    tokio_rt.block_on(run_server(runtime, startup, config, listener, shutdown))
 }
 
 /// One step of the accept loop.
@@ -136,7 +139,7 @@ async fn run_server(
     runtime: Rc<Runtime>,
     startup: Option<(InvocationState, core_runtime::ScriptEvaluation)>,
     config: RuntimeConfig,
-    port: u16,
+    listener: std::net::TcpListener,
     shutdown: impl Future<Output = ()>,
 ) -> Result<(), String> {
     // An isolated request serves from a global of its own, not the default global, but the
@@ -159,10 +162,14 @@ async fn run_server(
         RequestHandlingMode::Shared
     };
 
-    let listener = TcpListener::bind(("127.0.0.1", port))
-        .await
-        .map_err(|e| format!("Failed to bind 127.0.0.1:{port}: {e}"))?;
-    eprintln!("serving on http://127.0.0.1:{port}");
+    let bound = listener
+        .local_addr()
+        .map_err(|e| format!("Failed to read the listener's bound address: {e}"))?;
+    let listener = listener
+        .set_nonblocking(true)
+        .and_then(|()| TcpListener::from_std(listener))
+        .map_err(|e| format!("Failed to listen on {bound}: {e}"))?;
+    eprintln!("serving on http://{bound}");
 
     // Let the script finish evaluating before serving, so a handler registered after a top-level
     // `await` is in place for the first request. Binding first leaves a client that connects
@@ -192,9 +199,10 @@ async fn run_server(
             return Err(crate::serve_common::NO_FETCH_LISTENER.to_string());
         }
     }
-    // Borrowed for the rest of the function. `background` is not touched again, only released and
-    // dropped on the way out. Isolated mode has none of this: with a per-request global entered
-    // for each request, there is no single realm a background loop could be stepped in.
+    // The background loop is borrowed for the rest of the function. `background` is not touched
+    // again, only released and dropped on the way out. Isolated mode has none of this: with a
+    // per-request global entered for each request, there is no single realm a background loop
+    // could be stepped in.
     let background_loop = background
         .as_mut()
         .map(|(invocation, _)| invocation.state().event_loop());
@@ -285,11 +293,17 @@ async fn run_server(
                             // Keep the content script's own loop running alongside serving, so a
                             // `setInterval` it left running actually fires. This arm never yields
                             // a `Step`: it runs for as long as the server does, and its timers
-                            // wake this task when they come due.
+                            // wake this task when they come due. A `setInterval(…, 0)` cannot
+                            // starve the accept loop, since the re-queued timer is clamped to a
+                            // non-zero delay.
                             // TODO: same as in wasm: should reconsider this and abort work not
                             // added to waitUntil.
                             if let Some(event_loop) = background_loop {
-                                run_background_work(raw_cx, event_loop).await;
+                                // SAFETY: `raw_cx` is valid, with the serve loop's realm entered,
+                                // for the server's life.
+                                unsafe {
+                                    run_to_completion(raw_cx, event_loop, tokio::time::sleep).await
+                                };
                             }
                             std::future::pending::<Step>().await
                         },
@@ -324,20 +338,6 @@ async fn run_server(
     }
 }
 
-/// Keep the content script's own event loop running for as long as the server runs: the
-/// `setInterval`s it left behind, and whatever they start.
-///
-/// Never returns while that loop still has work (with a repeating timer it never will), so this
-/// is raced against the accept loop rather than awaited.
-///
-/// Between firings it waits on the next deadline like any idle loop, leaving the thread free to
-/// accept and serve. A `setInterval(…, 0)` cannot starve that: the re-queued timer is clamped to
-/// a non-zero delay, so the loop reports idle rather than finding ready work every step.
-async fn run_background_work(raw_cx: *mut js::native::RawJSContext, event_loop: &EventLoop) {
-    // SAFETY: `raw_cx` is valid, with the serve loop's realm entered, for the server's life.
-    unsafe { run_to_completion(raw_cx, event_loop, tokio::time::sleep).await };
-}
-
 /// A request's event loop, released once all work related to the request is done or abandoned.
 ///
 /// [`EventLoop::cancel_pending_futures`] has to run while the JSContext is alive. The paths that
@@ -419,59 +419,30 @@ async fn serve_connection<'a>(
         builder.header_read_timeout(silence);
     }
 
-    let serving = std::pin::pin!(builder.serve_connection(
+    let mut serving = std::pin::pin!(builder.serve_connection(
         hyper_util::rt::TokioIo::new(stream),
         hyper::service::service_fn(|request| serve_request(&request_context, request)),
     ));
-    if let Err(e) = drive_connection(serving, &mut closed).await {
-        // Ignore clients that disconnect mid-request.
-        if !e.is_incomplete_message() {
-            eprintln!("serve: connection error: {e}");
-        }
-    }
-}
-
-/// Drive hyper's connection future to the connection's close.
-///
-/// An unfinished response body or a request body left unread results in the connection being
-/// closed: it stops taking requests and ends once the one in flight is done.
-async fn drive_connection<C>(
-    mut serving: Pin<&mut C>,
-    closed: &mut futures_channel::mpsc::UnboundedReceiver<()>,
-) -> hyper::Result<()>
-where
-    C: Future<Output = hyper::Result<()>> + GracefulShutdown,
-{
+    // An unfinished response body or a request body left unread results in the connection being
+    // closed: it stops taking requests and ends once the one in flight is done.
     let mut ending = false;
-    std::future::poll_fn(|cx| {
+    let served = std::future::poll_fn(|cx| {
         // Checked before hyper is polled, so a close signal sent by this connection's request
         // work takes effect before hyper can start on a request already sitting in its read buffer.
         if !ending {
             if let Poll::Ready(Some(())) = closed.poll_next_unpin(cx) {
-                serving.as_mut().shut_down_gracefully();
+                serving.as_mut().graceful_shutdown();
                 ending = true;
             }
         }
         serving.as_mut().poll(cx)
     })
-    .await
-}
-
-/// Close a connection once the request in flight completes, rather than immediately.
-trait GracefulShutdown {
-    fn shut_down_gracefully(self: Pin<&mut Self>);
-}
-
-impl<I, S> GracefulShutdown for hyper::server::conn::http1::Connection<I, S>
-where
-    S: hyper::service::HttpService<Incoming>,
-    S::Error: Into<Box<dyn std::error::Error + Send + Sync>>,
-    I: hyper::rt::Read + hyper::rt::Write + Unpin,
-    S::ResBody: Body + 'static,
-    <S::ResBody as Body>::Error: Into<Box<dyn std::error::Error + Send + Sync>>,
-{
-    fn shut_down_gracefully(self: Pin<&mut Self>) {
-        self.graceful_shutdown();
+    .await;
+    if let Err(e) = served {
+        // Ignore clients that disconnect mid-request.
+        if !e.is_incomplete_message() {
+            eprintln!("serve: connection error: {e}");
+        }
     }
 }
 
@@ -993,7 +964,7 @@ type BodyAbort = Rc<std::cell::RefCell<Option<String>>>;
 
 /// The response body hyper writes.
 enum WireBody {
-    /// A body already in memory. Empty where the status or the method leaves no content to send.
+    /// A body already in memory. Empty if the status or the method leaves no content to send.
     Complete(bytes::Bytes),
     /// Chunks the connection's background work feeds in as the handler's body produces them.
     Streamed {
diff --git a/crates/libstarling/src/serve_wasm.rs b/crates/libstarling/src/serve_wasm.rs
index fb8d0875..5018f8c2 100644
--- a/crates/libstarling/src/serve_wasm.rs
+++ b/crates/libstarling/src/serve_wasm.rs
@@ -9,8 +9,8 @@
 //! Requests therefore share one global, and are separated by their event loops rather than their
 //! realms.
 //!
-//! Shares [`serve_native`](crate::serve_native)'s dispatch core and the request/response bridging
-//! in `platform::http`.
+//! Shares the dispatch core in `serve_common` with `serve_native`, and the request/response
+//! bridging in `platform::http`.
 
 #![cfg(target_arch = "wasm32")]
 
@@ -46,8 +46,8 @@ js::instance_local! {
     static STARTUP: RefCell<Startup> = const { RefCell::new(Startup::Done) };
 
     /// Signalled on every [`STARTUP`] transition a waiting request cares about: driven to
-    /// completion, or handed back by a driver that was cancelled. Every write of `Startup` other
-    /// than `Driving` must notify, or a waiter in [`ensure_started`] sleeps through it.
+    /// completion, or handed back by a driver that was cancelled. Every transition out of
+    /// `Driving` must notify, or a waiter in [`ensure_started`] sleeps through it.
     static STARTUP_CHANGED: event_listener::Event = const { event_listener::Event::new() };
 
     /// Set while a Wizer snapshot is being taken, so it is set in the snapshot and the resumed
@@ -70,13 +70,24 @@ enum Startup {
 /// The held reference is never released, so the runtime is never dropped. Nothing here tears an
 /// instance down except thread-local destruction, and `Runtime::drop` reaches thread-locals in the
 /// `js` crate (the scope handle pool among them) that the same destruction may already have run,
-/// which traps. Dropping it would reclaim nothing either, since the instance's memory goes away
-/// whole. `serve_native` runs the real `Drop`.
+/// which traps. Dropping it wouldn't reclaim any memory either, since the instance's memory goes
+/// away whole. `serve_native` runs the real `Drop`.
 fn install_runtime(pair: (Rc<Runtime>, *mut js::native::RawJSContext, ServeTimeouts)) {
     std::mem::forget(Rc::clone(&pair.0));
     RUNTIME.with(|cell| *cell.borrow_mut() = Some(pair));
 }
 
+/// The runtime this instance holds and its context, or `None` if it holds no runtime. A runtime is
+/// installed by [`pre_initialize`] for a `wizer-initialize` snapshot, whose main module has then
+/// finished evaluating, by [`adopt_runtime`], or by the first request the instance serves.
+pub fn installed_runtime() -> Option<(Rc<Runtime>, *mut js::native::RawJSContext)> {
+    RUNTIME.with(|cell| {
+        cell.borrow()
+            .as_ref()
+            .map(|(runtime, raw_cx, _)| (Rc::clone(runtime), *raw_cx))
+    })
+}
+
 /// Get the runtime and its context, creating them on first use: run the content script
 /// (registering `fetch` handlers) and enter the global realm persistently. Synchronous (no
 /// `await`), so concurrent first requests can't race into two runtimes.
@@ -94,8 +105,8 @@ fn runtime() -> Result<(Rc<Runtime>, *mut js::native::RawJSContext, ServeTimeout
     })
 }
 
-/// [`runtime`], creating a runtime configured for a Wizer snapshot if `pre_initialize` is set and
-/// none exists yet.
+/// Like [`runtime`], but creates a runtime configured for a Wizer snapshot if `pre_initialize` is
+/// set and no runtime exists yet.
 fn runtime_for(
     pre_initialize: bool,
 ) -> Result<(Rc<Runtime>, *mut js::native::RawJSContext, ServeTimeouts), String> {
@@ -141,6 +152,210 @@ fn start_runtime(
     Ok(pair)
 }
 
+/// Serve requests against a runtime bootstrapped elsewhere, instead of the one [`runtime`] would
+/// create from `STARLINGMONKEY_CONFIG`. Called by the componentizer's `init` export: it
+/// evaluates the application's modules itself, so by the time a request arrives there is a global
+/// with `fetch` listeners on it and no content script left to run.
+///
+/// `raw_cx` must be a context whose default global's realm is entered for the process lifetime,
+/// and `runtime` must outlive the process's requests. The application's top level must have
+/// finished evaluating and left no work on its event loop. `config` supplies the serve timeouts.
+///
+/// A component that exports `wasi:http/handler` checks its application with
+/// [`select_http_handler`] first.
+pub fn adopt_runtime(
+    runtime: Rc<Runtime>,
+    raw_cx: *mut js::native::RawJSContext,
+    config: &RuntimeConfig,
+) -> Result<(), String> {
+    config.validate_serve_timeouts()?;
+    let timeouts = ServeTimeouts::from_config(config);
+    install_runtime((runtime, raw_cx, timeouts));
+    Ok(())
+}
+
+/// The implementation that serves a componentized application's `wasi:http/handler` export.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum HttpHandler {
+    /// The runtime's builtin, which dispatches each request as a `fetch` event.
+    FetchEvent,
+    /// The application's own export of the interface.
+    Raw,
+}
+
+/// A componentized application's own export of `wasi:http/handler`.
+pub struct RawHttpHandler<'a> {
+    /// The JS paths the main module may provide the interface's `handle` under,
+    /// such as `handler.handle`.
+    pub paths: &'a [String],
+    /// Whether the main module provides `handle`.
+    pub provided: bool,
+}
+
+/// Select the [`HttpHandler`] of a componentized application whose component exports
+/// `wasi:http/handler`, once its top level has finished evaluating.
+///
+/// Fails if the application both provides `raw` and registers a `fetch` listener, or does
+/// neither.
+///
+/// # Safety
+///
+/// `raw_cx` must be a valid context whose default global's realm is entered.
+pub unsafe fn select_http_handler(
+    raw_cx: *mut js::native::RawJSContext,
+    raw: RawHttpHandler<'_>,
+) -> Result<HttpHandler, String> {
+    // SAFETY: guaranteed by the caller.
+    let scope = unsafe { js::gc::scope::RootScope::from_current_realm(raw_cx) };
+    let listener = fetch_event::fetch_event::FetchEvent::has_listener(&scope);
+    let paths = raw
+        .paths
+        .iter()
+        .map(|path| format!("`{path}`"))
+        .collect::<Vec<_>>()
+        .join(" or ");
+    match (raw.provided, listener) {
+        (true, false) => Ok(HttpHandler::Raw),
+        (false, true) => Ok(HttpHandler::FetchEvent),
+        (true, true) => Err(format!(
+            "the application both exports a `wasi:http/handler` implementation as {paths} and \
+             registers a `fetch` listener. The component's `wasi:http/handler` export is served \
+             by exactly one of them, so remove the other."
+        )),
+        (false, false) => Err(format!(
+            "the application neither exports a `wasi:http/handler` implementation as {paths} \
+             nor registers a `fetch` listener, so the component's `wasi:http/handler` export \
+             could not serve any request. Export `handle(request)`, or register a listener \
+             with `addEventListener('fetch', …)`."
+        )),
+    }
+}
+
+/// The `wasi:http/types` interface of the `wasi:http` version the runtime links:
+/// the one its `wasip3` bindings target.
+pub const WASI_HTTP_TYPES: &str = "wasi:http/types@0.3.0";
+
+/// A `Request` with the method, URL, headers and body of the incoming
+/// [`WASI_HTTP_TYPES`] `request` `handle`, which it takes ownership of. The body
+/// is not read until the `Request`'s body is. Throws a `TypeError` for a request
+/// whose fields `http` cannot represent.
+///
+/// # Safety
+///
+/// `handle` must be a live handle of a [`WASI_HTTP_TYPES`] `request` that the
+/// caller owns, and must not be used after this call.
+pub unsafe fn request_from_handle<'s>(
+    scope: &'s js::gc::scope::Scope<'_>,
+    handle: u32,
+) -> Result<web_fetch::request::Request<'s>, js::error::ExnThrown> {
+    // SAFETY: guaranteed by the caller.
+    let request = unsafe { WasiRequest::from_handle(handle) };
+    let (method, url, headers, body) =
+        platform::http::read_incoming_request(request).map_err(|code| {
+            js::error::ThrowException::throw(
+                js::error::TypeError(format!("the request cannot be read: {code:?}")),
+                scope,
+            )
+        })?;
+    let (has_body, content_length) = body_framing(&method, &headers);
+    let controller = web_globals::signals::abort_controller::AbortController::new(scope)?;
+    web_fetch::request::Request::from_incoming(
+        scope,
+        &method,
+        &url,
+        crate::serve_common::header_list(&headers),
+        has_body.then_some(body),
+        content_length,
+        controller.signal(scope),
+    )
+}
+
+/// The handle of a new `wasi:http/types` `response` carrying `value`'s status,
+/// headers and body, if `value` is a `Response`, and `None` otherwise.
+///
+/// Registered as the componentized runtime's adapter for owned `response`
+/// handles, so an application's own `wasi:http/handler` export can return a
+/// `Response`, such as one `fetch` resolved to. The headers and body go through
+/// the same checks as a `fetch` event's response. A body received by `fetch` is
+/// handed to the host without being read. A `Response` whose body was read or is
+/// locked throws a `TypeError`.
+///
+/// The body is sent as a pending send of the active event loop (see
+/// [`core_runtime::event_loop::PendingSend`]), within the `response_body` serve
+/// timeout.
+pub fn response_handle(
+    scope: &js::gc::scope::Scope<'_>,
+    value: js::prelude::HandleValue<'_>,
+) -> Result<Option<u32>, js::error::ExnThrown> {
+    use js::conversion::FromJSVal;
+    use js::error::ThrowException;
+
+    // Checked before the body is taken, which locks it.
+    match response_accepts(scope, value) {
+        Ok(true) => {}
+        Ok(false) => return Ok(None),
+        Err(reason) => return Err(js::error::TypeError(reason).throw(scope)),
+    }
+    let response = web_fetch::response::Response::from_jsval(scope, value, ())
+        .expect("`response_accepts` accepted a `Response`");
+    // Marks the body read, so the same `Response` is not accepted a second time.
+    response.reserve_body_for_sending(scope)?;
+    let headers = response.headers_list(scope);
+    let status = crate::serve_common::normalize_http_status(response.status());
+    let body = response.take_send_body(scope, true);
+    let crate::serve_common::WireResponse {
+        status,
+        mut headers,
+        body,
+        declared_length,
+    } = crate::serve_common::prepare_wire_response(false, status, headers, body);
+    if let Some(length) = declared_length {
+        headers.insert(
+            http::header::CONTENT_LENGTH,
+            http::HeaderValue::from(length),
+        );
+    }
+    let timeout = RUNTIME.with(|cell| {
+        cell.borrow()
+            .as_ref()
+            .and_then(|(_, _, timeouts)| timeouts.response_body)
+    });
+    let (response, body_done, abandon) =
+        platform::http::build_outgoing_response(status, headers, body, timeout, declared_length);
+    // A body read from a `ReadableStream` is fed by JS the event loop runs.
+    let send = core_runtime::event_loop::PendingSend {
+        done: Box::pin(async move {
+            body_done.await;
+        }),
+        abandon: Box::new(move || abandon.abandon()),
+    };
+    core_runtime::event_loop::with_active_event_loop(|el| el.register_pending_send(send))
+        .expect("the event loop checked above is still active");
+    Ok(Some(response.take_handle()))
+}
+
+/// The check of [`response_handle`]: `Ok(true)` for a `Response` it can send,
+/// `Ok(false)` for a value that is not a `Response`, and `Err` with the reason
+/// for a `Response` whose body was read or is locked, or one returned where no
+/// event loop is active to send its body. Takes nothing from `value`.
+pub fn response_accepts(
+    scope: &js::gc::scope::Scope<'_>,
+    value: js::prelude::HandleValue<'_>,
+) -> Result<bool, String> {
+    use js::conversion::FromJSVal;
+
+    let Ok(response) = web_fetch::response::Response::from_jsval(scope, value, ()) else {
+        return Ok(false);
+    };
+    if response.is_body_unusable(scope) {
+        return Err("the Response has an unusable body: it was read, or is locked".to_string());
+    }
+    if core_runtime::event_loop::with_active_event_loop(|_| ()).is_none() {
+        return Err("a Response can only be sent where an event loop sends its body".to_string());
+    }
+    Ok(true)
+}
+
 /// Prepare this instance's state to be captured in a Wizer snapshot. Every caller is a Wizer
 /// entry point, and calls this last.
 ///
@@ -179,13 +394,21 @@ pub fn prepare_for_snapshot() {
 ///
 /// This entails initializing the JS runtime, registering builtins, running the top-level script to
 /// completion, including a top-level `await`, and checking whether the result is a valid snapshot
-/// input state. The script must register a `fetch` listener, and must leave no asynchronous work
-/// behind once its top level has finished.
+/// input state. The script must register a `fetch` listener or have its main module export a `run`
+/// function, and must leave no asynchronous work behind once its top level has finished.
 pub async fn pre_initialize() -> Result<(), String> {
     let (_runtime, raw_cx, _) = runtime_for(true)?;
-    let Startup::Pending(invocation, evaluation) =
-        STARTUP.with(|cell| std::mem::replace(&mut *cell.borrow_mut(), Startup::Driving))
-    else {
+    let pending = STARTUP.with(|cell| {
+        let mut state = cell.borrow_mut();
+        match std::mem::replace(&mut *state, Startup::Driving) {
+            Startup::Pending(invocation, evaluation) => Some((invocation, evaluation)),
+            other => {
+                *state = other;
+                None
+            }
+        }
+    });
+    let Some((invocation, evaluation)) = pending else {
         // Nothing to evaluate: `runtime` was already stood up, so this is a second call.
         prepare_for_snapshot();
         return Ok(());
@@ -195,26 +418,41 @@ pub async fn pre_initialize() -> Result<(), String> {
     // The loop is driven only while the top level is unfinished, so work it merely queued, such
     // as a timer, is refused below rather than run under Wizer.
     if !evaluation.is_finished(&scope) {
-        drive_startup(raw_cx, invocation.state().event_loop(), &evaluation).await;
+        // SAFETY: `runtime` entered the default global's realm for the process lifetime, and keeps
+        // the context alive in an instance-local.
+        unsafe { drive_startup(raw_cx, invocation.state().event_loop(), &evaluation).await };
     }
     evaluation.settled(&scope, "Script evaluation failed")?;
-    // Throw an error instead of creating a snapshot that can't possibly serve requests.
-    if evaluated_without_listener(&scope, &evaluation) {
-        return Err(crate::serve_common::NO_FETCH_LISTENER.to_string());
+    // Throw an error instead of creating a snapshot that can neither serve requests nor run as a
+    // CLI tool.
+    if evaluated_without_listener(&scope, &evaluation) && !exports_run(&scope) {
+        return Err(format!(
+            "{}, and the main module exports no `run` function",
+            crate::serve_common::NO_FETCH_LISTENER
+        ));
     }
-    invocation.state().event_loop().ensure_idle_for_snapshot()?;
-    // Define every standard class the global has not resolved yet, so the snapshot holds them
-    // all and an instance restored from it defines none of them on first use.
-    js::class::enumerate_standard_classes(&scope, scope.global().handle())
-        .map_err(|_| "defining the standard classes failed".to_string())?;
+    finish_for_snapshot(&scope, invocation.state().event_loop())?;
     STARTUP.with(|cell| *cell.borrow_mut() = Startup::Done);
     Ok(())
 }
 
+/// The last checks and setup before a Wizer snapshot of an instance whose content top level has
+/// finished: fail if `event_loop` holds work a snapshot cannot hold, then define every standard
+/// class the global has not resolved yet, so the snapshot holds them all and an instance restored
+/// from it defines none of them on first use. It must run before [`prepare_for_snapshot`].
+pub fn finish_for_snapshot(
+    scope: &js::gc::scope::Scope<'_>,
+    event_loop: &EventLoop,
+) -> Result<(), String> {
+    event_loop.ensure_idle_for_snapshot()?;
+    js::class::enumerate_standard_classes(scope, scope.global().handle())
+        .map_err(|_| "defining the standard classes failed".to_string())
+}
+
 /// Whether the content script has finished evaluating without registering a `fetch` listener, in
 /// which case every request it could ever receive is a 500 (see
 /// [`NO_FETCH_LISTENER`](crate::serve_common::NO_FETCH_LISTENER)). A script still evaluating (a
-/// top-level `await` that never settles) has registered nothing yet and cannot be judged.
+/// top-level `await` that never settles) may still register a listener and cannot be judged.
 fn evaluated_without_listener(
     scope: &js::gc::scope::Scope<'_>,
     evaluation: &core_runtime::ScriptEvaluation,
@@ -222,12 +460,29 @@ fn evaluated_without_listener(
     evaluation.is_finished(scope) && !fetch_event::fetch_event::FetchEvent::has_listener(scope)
 }
 
-/// Some state, such as process time origins, needs fixing up after snapshot resumption.
+/// Whether the main module exports a `run` function, which `wasi:cli/run` calls in an instance
+/// resumed from the snapshot. A `run` getter that throws counts as no `run`.
+fn exports_run(scope: &js::gc::scope::Scope<'_>) -> bool {
+    let Some(namespace) = core_runtime::module::entry_namespace(scope) else {
+        return false;
+    };
+    match namespace.get_property(scope, c"run") {
+        Ok(run) => js::function::is_callable(run),
+        Err(_) => {
+            js::exception::clear(scope);
+            false
+        }
+    }
+}
+
+/// Some state, such as process time origins, needs fixing up after snapshot resumption. Every
+/// export of a resumed instance calls this before running any JS. It does nothing outside a
+/// resumed instance and after the first call.
 ///
-/// The monotonic clock comes first: its offset puts the timestamps the snapshot holds in the
+/// The monotonic clock comes first: its offset puts the timestamps held by the snapshot in the
 /// resumed instance's past, and both the engine's timing and every fixup below read the clock
 /// through it.
-fn fix_up_after_resume() {
+pub fn fix_up_after_resume() {
     if RESUMED_FROM_SNAPSHOT.with(|resumed| resumed.replace(false)) {
         js::clock::advance_monotonic_clock(platform::clock::resume_from_snapshot());
         core_runtime::runtime::run_resume_fixups();
@@ -293,7 +548,9 @@ async fn ensure_started(raw_cx: *mut js::native::RawJSContext) -> Result<(), Sta
                     pending: Some((invocation, evaluation)),
                 };
                 let (invocation, evaluation) = driving.pending.as_mut().expect("just set");
-                drive_startup(raw_cx, invocation.state().event_loop(), evaluation).await;
+                // SAFETY: `runtime` entered the default global's realm for the process
+                // lifetime, and keeps the context alive in an instance-local.
+                unsafe { drive_startup(raw_cx, invocation.state().event_loop(), evaluation).await };
                 // SAFETY: `runtime` entered the default global's realm for the process lifetime.
                 let scope = unsafe { js::gc::scope::RootScope::from_current_realm(raw_cx) };
                 let failed = evaluation.rejection(&scope, "Script evaluation failed");
@@ -331,24 +588,28 @@ async fn ensure_started(raw_cx: *mut js::native::RawJSContext) -> Result<(), Sta
 }
 
 /// Drive the content script's event loop until the script has finished evaluating. Whatever it
-/// started along the way (a timer, an unawaited `fetch`) is left running, on the task
-/// [`keep_startup_loop_running`] spawns.
-async fn drive_startup(
+/// started along the way (a timer, an unawaited `fetch`) stays on `event_loop` for the caller to
+/// keep driving.
+///
+/// # Safety
+///
+/// `raw_cx` must be a context whose default global's realm is entered, and which stays valid for
+/// the duration of the returned future.
+pub async unsafe fn drive_startup(
     raw_cx: *mut js::native::RawJSContext,
     event_loop: &EventLoop,
     evaluation: &core_runtime::ScriptEvaluation,
 ) {
-    // SAFETY: `raw_cx` is valid for the duration of this await, since the runtime outlives the
-    // request.
+    // SAFETY: guaranteed by this function's caller.
     unsafe {
         run_until_evaluated(raw_cx, event_loop, platform::clock::sleep, evaluation).await;
     }
 }
 
 /// Report, once evaluation completes, that the content script registered no `fetch` listener, so
-/// the 500s every request will get have a stated reason. We can't decline to serve
-/// at all, since the host owns the instance's lifecycle. Only applies to non-snapshot configs,
-/// since [`pre_initialize`] refuses to snapshot a script without a listener.
+/// the 500 response sent to every request has a stated reason. We can't decline to serve
+/// at all, since the host owns the instance's lifecycle. In a snapshot, this only applies to a
+/// script that exports `run`, since [`pre_initialize`] refuses one with neither.
 fn report_missing_fetch_listener(
     raw_cx: *mut js::native::RawJSContext,
     evaluation: &core_runtime::ScriptEvaluation,
@@ -523,10 +784,10 @@ async fn dispatch_request(
                     outcome,
                 );
             }
-            // Drained regardless of how the send ended. The writer's `TimedOut` and the limit above
-            // expiring are the same deadline enforced in two places, so on an ordinary body
-            // timeout they expire together and either may be reported first. The request's
-            // `waitUntil` window must not depend on which.
+            // Lifetime work is drained regardless of how the send ended. The writer's `TimedOut`
+            // and the limit above expiring are the same deadline enforced in two places, so on an
+            // ordinary body timeout they expire together and either may be reported first. The
+            // request's `waitUntil` window must not depend on which.
             crate::serve_common::drain_lifetime_work(
                 raw_cx,
                 invocation.state().event_loop(),
@@ -546,7 +807,7 @@ async fn dispatch_request(
 /// `response_body` time limit expires first.
 ///
 /// If the loop runs out of work before the body has been fully sent out, that means it's
-/// effectively abandoned and can't be completed anymore. In that case, [`abandon`] is called,
+/// effectively abandoned and can't be completed anymore. In that case, `abandon` is called,
 /// and must close the transport.
 ///
 /// The timeout here is a backstop: the same limit is applied to `spawn_body_writer`, which reports
@@ -609,9 +870,7 @@ fn body_framing(method: &str, headers: &http::HeaderMap) -> (bool, Option<u64>)
 }
 
 /// A minimal text error response. Its body is written out by a task of its own like any other
-/// response's, and also bounded by a timeout like any other: otherwise a client that doesn't
-/// read the response could stall indefinitely. (At least I think it might: chances are the
-/// host runtime takes care of this.)
+/// response's, and bounded by a timeout like any other.
 // TODO: unify with `status_response` in `serve_native`.
 fn error_response(
     status: u16,
diff --git a/crates/libstarling/tests/body_path.rs b/crates/libstarling/tests/body_path.rs
index d5a36286..4c8fe5f8 100644
--- a/crates/libstarling/tests/body_path.rs
+++ b/crates/libstarling/tests/body_path.rs
@@ -10,7 +10,7 @@
 //! These run in a test binary of their own because they read process-wide counters
 //! (`web_fetch::outgoing_body::paths_taken`), which any other request in flight would perturb. The
 //! counters belong to the process, and this file holds a single test, so the counts always belong
-//! to the request that just ran. The ports below are this binary's own for the same reason.
+//! to the request that just ran.
 
 #![cfg(not(target_arch = "wasm32"))]
 
@@ -20,8 +20,9 @@ use common::{dechunk, request, start_chunked_upstream, start_echo_upstream, star
 use web_fetch::outgoing_body::paths_taken;
 
 /// Serve one request against `handler` and report `(response body, shortcuts, pumps)`.
-fn serve_once(handler: &str, port: u16, path: &str) -> (String, usize, usize) {
-    let handle = start_serve(handler, port);
+fn serve_once(handler: &str, path: &str) -> (String, usize, usize) {
+    let handle = start_serve(handler);
+    let port = handle.port();
     paths_taken::reset();
     let body = request(port, "GET", path, "");
     let (shortcut, pumped) = paths_taken::counts();
@@ -32,7 +33,6 @@ fn serve_once(handler: &str, port: u16, path: &str) -> (String, usize, usize) {
 #[test]
 fn outgoing_bodies_take_the_route_they_should() {
     single_bodies_take_the_route_they_should();
-    many_bodies_through_one_transform_keep_every_byte();
     piping_many_bodies_into_one_transform_keeps_every_byte();
     a_queued_chunk_survives_a_pipe_that_is_still_running();
     a_pipe_that_keeps_the_transform_open_forfeits_the_shortcut();
@@ -49,10 +49,11 @@ fn outgoing_bodies_take_the_route_they_should() {
 /// shows.
 fn a_byte_response_body_leaves_its_owner_holding_nothing() {
     let handler = "addEventListener('fetch', (e) => e.respondWith(new Response('payload')))";
-    let handle = start_serve(handler, 18531);
+    let handle = start_serve(handler);
+    let port = handle.port();
     paths_taken::reset();
 
-    let body = request(18531, "GET", "/", "");
+    let body = request(port, "GET", "/", "");
     let (sole, shared) = paths_taken::byte_counts();
     handle.stop();
 
@@ -77,10 +78,11 @@ fn a_byte_request_body_leaves_no_copy_behind_on_the_request_it_came_from() {
             }})));
         }})"#
     );
-    let handle = start_serve(&handler, 18533);
+    let handle = start_serve(&handler);
+    let port = handle.port();
     paths_taken::reset();
 
-    let body = request(18533, "GET", "/", "");
+    let body = request(port, "GET", "/", "");
     let (sole, shared) = paths_taken::byte_counts();
     handle.stop();
 
@@ -121,13 +123,14 @@ fn a_head_request_cancels_the_body_it_will_not_send() {
             ? source.pipeThrough(new TransformStream(undefined, { highWaterMark: 0 }))
             : source));
     })"#;
-    let handle = start_serve(handler, 18521);
+    let handle = start_serve(handler);
+    let port = handle.port();
     paths_taken::reset();
 
-    let direct = request(18521, "HEAD", "/direct", "");
-    let piped = request(18521, "HEAD", "/piped", "");
+    let direct = request(port, "HEAD", "/direct", "");
+    let piped = request(port, "HEAD", "/piped", "");
     let (shortcut, pumped) = paths_taken::counts();
-    let seen = request(18521, "GET", "/seen", "");
+    let seen = request(port, "GET", "/seen", "");
     handle.stop();
 
     assert_eq!(
@@ -156,10 +159,11 @@ fn a_head_request_still_claims_a_proxied_body() {
     let handler = format!(
         "addEventListener('fetch', (e) => e.respondWith(fetch('http://127.0.0.1:{upstream}/')))"
     );
-    let handle = start_serve(&handler, 18519);
+    let handle = start_serve(&handler);
+    let port = handle.port();
     paths_taken::reset();
 
-    let response = request(18519, "HEAD", "/", "");
+    let response = request(port, "HEAD", "/", "");
     let (shortcut, pumped) = paths_taken::counts();
     handle.stop();
 
@@ -182,10 +186,11 @@ fn a_head_request_still_claims_a_proxied_body() {
             }})());
         }})"#
     );
-    let handle = start_serve(&handler, 18523);
+    let handle = start_serve(&handler);
+    let port = handle.port();
     paths_taken::reset();
 
-    let response = request(18523, "HEAD", "/", "");
+    let response = request(port, "HEAD", "/", "");
     let (shortcut, pumped) = paths_taken::counts();
     handle.stop();
 
@@ -200,9 +205,9 @@ fn a_head_request_still_claims_a_proxied_body() {
 /// A pipe that leaves the transform open (`preventClose`) must not let the body be claimed whole.
 ///
 /// Claiming it hands the wire that one body and bypasses the transform, so whatever is written in
-/// afterwards goes to a readable end nobody reads: the second pipe stalls forever and its bytes are
-/// dropped without a word. Worse, it made the choice of route observable — the same handler
-/// delivered `AAA` when the body was claimed and `AAABBB` when it was pumped.
+/// afterwards goes to a readable end that nothing reads: the second pipe stalls forever and its
+/// bytes are dropped without a word. Worse, it made the choice of route observable: the same
+/// handler delivered `AAA` when the body was claimed and `AAABBB` when it was pumped.
 fn a_pipe_that_keeps_the_transform_open_forfeits_the_shortcut() {
     let first = start_chunked_upstream(&["AAA"]);
     let second = start_chunked_upstream(&["BBB"]);
@@ -227,10 +232,11 @@ fn a_pipe_that_keeps_the_transform_open_forfeits_the_shortcut() {
             }})());
         }})"#
     );
-    let handle = start_serve(&handler, 18517);
+    let handle = start_serve(&handler);
+    let port = handle.port();
     paths_taken::reset();
 
-    let body = request(18517, "GET", "/", "");
+    let body = request(port, "GET", "/", "");
     let (shortcut, pumped) = paths_taken::counts();
 
     assert_eq!(
@@ -280,7 +286,6 @@ fn a_queued_chunk_survives_a_pipe_that_is_still_running() {
                 }})());
             }})"#
         ),
-        18515,
         "/",
     );
 
@@ -306,7 +311,6 @@ fn single_bodies_take_the_route_they_should() {
         &format!(
             "addEventListener('fetch', (e) => e.respondWith(fetch('http://127.0.0.1:{upstream}/')))"
         ),
-        18501,
         "/",
     );
     assert_eq!(dechunk(&body), "one two", "got: {body}");
@@ -328,7 +332,6 @@ fn single_bodies_take_the_route_they_should() {
                 }})());
             }})"#
         ),
-        18503,
         "/",
     );
     assert_eq!(dechunk(&body), "one two", "got: {body}");
@@ -350,7 +353,6 @@ fn single_bodies_take_the_route_they_should() {
                 }})());
             }})"#
         ),
-        18505,
         "/",
     );
     assert_eq!(dechunk(&body), "one two", "got: {body}");
@@ -372,7 +374,6 @@ fn single_bodies_take_the_route_they_should() {
                 start(c) { c.enqueue(new TextEncoder().encode('made up')); c.close(); }
             })));
         })"#,
-        18507,
         "/",
     );
     assert_eq!(dechunk(&body), "made up", "got: {body}");
@@ -405,7 +406,6 @@ fn single_bodies_take_the_route_they_should() {
                 }})());
             }})"#
         ),
-        18509,
         "/",
     );
     assert_eq!(dechunk(&body), "abcd", "got: {body}");
@@ -416,75 +416,20 @@ fn single_bodies_take_the_route_they_should() {
     );
 }
 
-/// Several incoming bodies funnelled through one `TransformStream`, with the handler's own chunks
-/// interleaved between them.
+/// Several upstream bodies fed into one `TransformStream`, with the handler's own chunks written
+/// between them. The response mixes host bytes from two upstreams with bytes JS made up, so it
+/// cannot be handed to the wire whole, and every byte has to arrive in order. Piping into an
+/// identity transform moves a native source to its readable side, so two of them arriving at the
+/// same transform would overwrite each other.
 ///
-/// The response is a mixture — host bytes from two upstreams and bytes JS made up — so it cannot be
-/// handed to the wire whole, and every byte has to survive the trip in order. This is the shape that
-/// would break silently if a native source were carried across the transform and then claimed: the
-/// claim would forward one upstream's host body and drop everything queued alongside it.
-fn many_bodies_through_one_transform_keep_every_byte() {
-    let upstream = start_chunked_upstream(&["AB", "CD"]);
-    let handler = format!(
-        r#"addEventListener('fetch', (event) => {{
-            event.respondWith((async () => {{
-                const encoder = new TextEncoder();
-                const transform = new TransformStream();
-                const writer = transform.writable.getWriter();
-                const response = new Response(transform.readable);
-
-                // Filled after the response is committed: a JS chunk, an upstream body, another JS
-                // chunk, a second upstream body, a last JS chunk.
-                (async () => {{
-                    await writer.write(encoder.encode('<'));
-                    for (const round of [1, 2]) {{
-                        const upstream = await fetch('http://127.0.0.1:{upstream}/?round=' + round);
-                        const reader = upstream.body.getReader();
-                        while (true) {{
-                            const {{ done, value }} = await reader.read();
-                            if (done) break;
-                            await writer.write(value);
-                        }}
-                        await writer.write(encoder.encode('|'));
-                    }}
-                    await writer.write(encoder.encode('>'));
-                    await writer.close();
-                }})();
-
-                return response;
-            }})());
-        }})"#
-    );
-    let handle = start_serve(&handler, 18511);
-    paths_taken::reset();
-
-    let body = request(18511, "GET", "/", "");
-    let (shortcut, pumped) = paths_taken::counts();
-
-    assert_eq!(
-        dechunk(&body),
-        "<ABCD|ABCD|>",
-        "every byte from both upstreams and the handler's own chunks must arrive in order: {body}"
-    );
-    assert_eq!(
-        (shortcut, pumped),
-        (0, 1),
-        "a response mixing several bodies with JS chunks cannot be handed over whole"
-    );
-
-    handle.stop();
-}
-
-/// The same funnel, but the upstream bodies are *piped* in rather than read chunk by chunk — the
-/// route on which an identity transform does carry a native source across, and on which two of them
-/// arriving at the same transform would overwrite each other.
-///
-/// Piping into a writable locks it, so the bodies go in one after another with the transform held
-/// open in between, and the handler's own chunks are written around them.
+/// `/piped` pipes each body in. Piping into a writable locks it, so the bodies go in one after
+/// another with the transform held open in between, and the handler's own chunks are written around
+/// them. `/read` reads each body with a reader and writes its chunks with a writer.
 fn piping_many_bodies_into_one_transform_keeps_every_byte() {
     let upstream = start_chunked_upstream(&["AB", "CD"]);
     let handler = format!(
         r#"addEventListener('fetch', (event) => {{
+            const route = new URL(event.request.url).pathname;
             event.respondWith((async () => {{
                 const encoder = new TextEncoder();
                 const transform = new TransformStream();
@@ -493,18 +438,26 @@ fn piping_many_bodies_into_one_transform_keeps_every_byte() {
                 (async () => {{
                     let writer = transform.writable.getWriter();
                     await writer.write(encoder.encode('<'));
-                    writer.releaseLock();
 
                     for (const round of [1, 2]) {{
                         const upstream = await fetch('http://127.0.0.1:{upstream}/?round=' + round);
-                        // The pipe owns the writable until it finishes; keep it open for the next.
-                        await upstream.body.pipeTo(transform.writable, {{ preventClose: true }});
-                        writer = transform.writable.getWriter();
+                        if (route === '/piped') {{
+                            writer.releaseLock();
+                            // The pipe owns the writable until it finishes. Keep it open for the
+                            // next.
+                            await upstream.body.pipeTo(transform.writable, {{ preventClose: true }});
+                            writer = transform.writable.getWriter();
+                        }} else {{
+                            const reader = upstream.body.getReader();
+                            while (true) {{
+                                const {{ done, value }} = await reader.read();
+                                if (done) break;
+                                await writer.write(value);
+                            }}
+                        }}
                         await writer.write(encoder.encode('|'));
-                        writer.releaseLock();
                     }}
 
-                    writer = transform.writable.getWriter();
                     await writer.write(encoder.encode('>'));
                     await writer.close();
                 }})();
@@ -513,23 +466,26 @@ fn piping_many_bodies_into_one_transform_keeps_every_byte() {
             }})());
         }})"#
     );
-    let handle = start_serve(&handler, 18513);
-    paths_taken::reset();
-
-    let body = request(18513, "GET", "/", "");
-    let (shortcut, pumped) = paths_taken::counts();
-
-    assert_eq!(
-        dechunk(&body),
-        "<ABCD|ABCD|>",
-        "piping two bodies into one transform must not lose either, nor the chunks around them: \
-         {body}"
-    );
-    assert_eq!(
-        (shortcut, pumped),
-        (0, 1),
-        "a transform fed by more than one body cannot be handed to the wire whole"
-    );
+    let handle = start_serve(&handler);
+    let port = handle.port();
+
+    for route in ["/piped", "/read"] {
+        paths_taken::reset();
+        let body = request(port, "GET", route, "");
+        let (shortcut, pumped) = paths_taken::counts();
+
+        assert_eq!(
+            dechunk(&body),
+            "<ABCD|ABCD|>",
+            "{route}: feeding two bodies into one transform must not lose either, nor the chunks \
+             around them: {body}"
+        );
+        assert_eq!(
+            (shortcut, pumped),
+            (0, 1),
+            "{route}: a transform fed by more than one body cannot be handed to the wire whole"
+        );
+    }
 
     handle.stop();
 }
diff --git a/crates/libstarling/tests/common/mod.rs b/crates/libstarling/tests/common/mod.rs
index a04e1652..49cc7b9e 100644
--- a/crates/libstarling/tests/common/mod.rs
+++ b/crates/libstarling/tests/common/mod.rs
@@ -8,7 +8,7 @@
 #![allow(dead_code)]
 
 // The transport helpers and upstream servers are shared with the wasm end-to-end suite through
-// `serve-test-support`. Only the serve starters, which link the engine, remain here.
+// `serve-test-support`. Only the serve starters and their config and script helpers remain here.
 pub use serve_test_support::*;
 
 // `serve-test-support` duplicates `IDLE_TRACE` rather than depend on `core-runtime`. This fails
@@ -25,62 +25,96 @@ const _: () = {
 };
 
 use libstarling::config::RuntimeConfig;
-use std::net::TcpStream;
-use std::time::Duration;
+use std::net::TcpListener;
 
 /// A running serve loop; [`ServeHandle::stop`] shuts it down and joins the thread so the runtime
 /// drops cleanly (a leaked runtime aborts at process teardown with outstanding engine handles).
 pub struct ServeHandle {
+    port: u16,
     shutdown: futures_channel::oneshot::Sender<()>,
     thread: std::thread::JoinHandle<()>,
 }
 
 impl ServeHandle {
+    /// The port the server listens on.
+    pub fn port(&self) -> u16 {
+        self.port
+    }
+
     pub fn stop(self) {
         let _ = self.shutdown.send(());
         let _ = self.thread.join();
     }
 }
 
-/// Start a serve loop with `handler` on `port` in a background thread, and wait until it accepts
-/// connections.
-pub fn start_serve(handler: &str, port: u16) -> ServeHandle {
-    start_serve_with(handler, port, false)
+/// Start a serve loop with `handler` on a port the system picks, in a background thread.
+pub fn start_serve(handler: &str) -> ServeHandle {
+    start_serve_with(handler, false)
 }
 
 /// Like [`start_serve`], but chooses whether each request gets its own global.
-pub fn start_serve_with(handler: &str, port: u16, isolated: bool) -> ServeHandle {
-    start_serve_config(
-        RuntimeConfig {
-            eval_script: Some(handler.to_string()),
-            legacy_script: true,
-            serve: Some(port),
-            serve_isolated: isolated,
-            ..Default::default()
-        },
-        port,
-    )
+pub fn start_serve_with(handler: &str, isolated: bool) -> ServeHandle {
+    start_serve_config(RuntimeConfig {
+        serve_isolated: isolated,
+        ..legacy_script(handler)
+    })
+}
+
+/// A config that runs `handler` as an inline classic script.
+pub fn legacy_script(handler: &str) -> RuntimeConfig {
+    RuntimeConfig {
+        eval_script: Some(handler.to_string()),
+        legacy_script: true,
+        ..Default::default()
+    }
+}
+
+/// Start a serve loop from `config` on a port the system picks, for the cases that need more than
+/// an inline script, such as a module entry point on disk.
+pub fn start_serve_config(config: RuntimeConfig) -> ServeHandle {
+    start_serve_on(bind_local().0, config)
 }
 
-/// Start a serve loop from a fully-specified config — for the cases that need more than an inline
-/// script, such as a module entry point on disk.
-pub fn start_serve_config(config: RuntimeConfig, port: u16) -> ServeHandle {
+/// Start a serve loop from `config` on `listener`, for a handler that needs to know its own port
+/// before the server starts.
+///
+/// The listener is bound before this returns, so a request made right away waits in its backlog
+/// until the script has finished evaluating.
+pub fn start_serve_on(listener: TcpListener, config: RuntimeConfig) -> ServeHandle {
+    let port = listener.local_addr().unwrap().port();
     let (shutdown_tx, shutdown_rx) = futures_channel::oneshot::channel();
     let thread = std::thread::spawn(move || {
         // `run` does this before serving; the test calls `serve` directly, so register here.
+        libstarling::apply_pre_init_config(&config).expect("valid config");
         libstarling::register_builtins();
-        let _ = libstarling::serve_native::serve_with_shutdown(config, port, async {
+        let _ = libstarling::serve_native::serve_with_shutdown(config, listener, async {
             let _ = shutdown_rx.await;
         });
     });
-    for _ in 0..200 {
-        if TcpStream::connect(("127.0.0.1", port)).is_ok() {
-            return ServeHandle {
-                shutdown: shutdown_tx,
-                thread,
-            };
+    ServeHandle {
+        port,
+        shutdown: shutdown_tx,
+        thread,
+    }
+}
+
+/// A temporary directory of content-script files, removed on drop.
+pub struct ScriptDir(tempfile::TempDir);
+
+impl ScriptDir {
+    /// Create a directory holding `files`, given as `(relative path, contents)`.
+    pub fn new(files: &[(&str, &str)]) -> Self {
+        let dir = libstarling::test_util::test_tempdir();
+        for (path, contents) in files {
+            let path = dir.path().join(path);
+            std::fs::create_dir_all(path.parent().unwrap()).unwrap();
+            std::fs::write(path, contents).unwrap();
         }
-        std::thread::sleep(Duration::from_millis(25));
+        ScriptDir(dir)
+    }
+
+    /// The path of `file` in this directory.
+    pub fn path(&self, file: &str) -> String {
+        self.0.path().join(file).to_string_lossy().into_owned()
     }
-    panic!("serve did not start on port {port}");
 }
diff --git a/crates/libstarling/tests/serve.rs b/crates/libstarling/tests/serve.rs
index d4069a74..42b51664 100644
--- a/crates/libstarling/tests/serve.rs
+++ b/crates/libstarling/tests/serve.rs
@@ -2,44 +2,27 @@
 
 //! End-to-end test of native serve mode: a script registers a `fetch` handler,
 //! the runtime serves HTTP requests, and each is dispatched as a `fetch` event
-//! whose `respondWith` reply is sent back. Covers the request body, an async
-//! (promise) response, and concurrent requests on isolated per-request loops.
+//! whose `respondWith` reply is sent back.
 
 #![cfg(not(target_arch = "wasm32"))]
 
 mod common;
 
 use common::{
-    dechunk, raw_request, read_one_response, read_until_eof, request, request_within,
-    start_chunked_upstream, start_echo_upstream, start_endless_upstream, start_serve,
-    start_serve_config, start_serve_with, start_silent_upstream, start_upstream, PATIENCE,
+    bind_local, dechunk, legacy_script, raw_request, read_one_response, read_until_eof, request,
+    request_within, start_chunked_upstream, start_echo_upstream, start_endless_upstream,
+    start_serve, start_serve_config, start_serve_on, start_serve_with, start_silent_upstream,
+    start_upstream, ScriptDir, PATIENCE,
 };
 use libstarling::config::RuntimeConfig;
 use std::io::{Read, Write};
 use std::net::TcpStream;
 use std::time::Duration;
 
-/// How long [`eventually`] keeps asking. Long enough for a loaded machine to reach the response, and
-/// finite so that work which never lands fails its test.
-const SETTLE_PATIENCE: Duration = Duration::from_secs(20);
-
-/// Ask `path` until its response satisfies `settled`, and return the last one.
-///
-/// Work a handler leaves behind runs while the request's loop is drained after the response: a
-/// `waitUntil` promise, a signal's reactions, a stream's cancel. Asking until the outcome is there
-/// takes as long as the work does, rather than a fixed span chosen for the slowest machine.
-///
-/// Only for assertions that wait for something to happen. A request drives the loop it is served
-/// on, so an assertion that something does not happen waits a fixed span instead.
+/// Ask `path` until its response satisfies `settled`, and return the last one. See
+/// [`common::eventually`].
 fn eventually(port: u16, path: &str, settled: impl Fn(&str) -> bool) -> String {
-    let deadline = std::time::Instant::now() + SETTLE_PATIENCE;
-    loop {
-        let answer = request(port, "GET", path, "");
-        if settled(&answer) || std::time::Instant::now() >= deadline {
-            return answer;
-        }
-        std::thread::sleep(Duration::from_millis(20));
-    }
+    common::eventually(|| request(port, "GET", path, ""), settled)
 }
 
 #[test]
@@ -55,22 +38,23 @@ fn serve_dispatches_fetch_events() {
                 new Response(event.request.method + ' ' + url.pathname + ' body=' + body
                     + ' aborted=' + event.request.signal.aborted)));
     })"#;
-    let handle = start_serve(handler, 18137);
+    let handle = start_serve(handler);
+    let port = handle.port();
 
     // A GET (no body) and a POST (with a body) — exercises Request::from_incoming + request.text().
     assert_eq!(
-        request(18137, "GET", "/foo", ""),
+        request(port, "GET", "/foo", ""),
         "GET /foo body= aborted=false"
     );
     assert_eq!(
-        request(18137, "POST", "/submit", "hello world"),
+        request(port, "POST", "/submit", "hello world"),
         "POST /submit body=hello world aborted=false"
     );
 
     // Two concurrent requests: each runs on its own event loop and must get exactly its own
     // response (no cross-request contamination).
-    let a = std::thread::spawn(|| request(18137, "GET", "/a", ""));
-    let b = std::thread::spawn(|| request(18137, "GET", "/b", ""));
+    let a = std::thread::spawn(move || request(port, "GET", "/a", ""));
+    let b = std::thread::spawn(move || request(port, "GET", "/b", ""));
     assert_eq!(a.join().unwrap(), "GET /a body= aborted=false");
     assert_eq!(b.join().unwrap(), "GET /b body= aborted=false");
 
@@ -105,40 +89,19 @@ fn serve_forwards_an_incoming_body_upstream_while_reading_it() {
             }})());
         }})"#
     );
-    let handle = start_serve(&handler, 18209);
+    let handle = start_serve(&handler);
+    let port = handle.port();
 
     assert_eq!(
-        request(18209, "POST", "/", "payload bytes"),
+        request(port, "POST", "/", "payload bytes"),
         "upstream=payload bytes local=payload bytes"
     );
 
     handle.stop();
 }
 
-/// Forwarding an upstream response's body as this response's body — `new Response(upstream.body,
-/// upstream)` — rather than handing back the upstream `Response` whole. The body travels as a
-/// stream the handler has taken apart and rebuilt, and every chunk still has to arrive, in order.
-#[test]
-fn serve_forwards_an_upstream_body_as_a_stream() {
-    let upstream = start_chunked_upstream(&["one ", "two ", "three"]);
-    let handler = format!(
-        r#"addEventListener('fetch', (event) => {{
-            event.respondWith((async () => {{
-                const upstream = await fetch('http://127.0.0.1:{upstream}/');
-                return new Response(upstream.body, upstream);
-            }})());
-        }})"#
-    );
-    let handle = start_serve(&handler, 18197);
-
-    let body = request(18197, "GET", "/", "");
-    assert_eq!(dechunk(&body), "one two three", "got: {body}");
-
-    handle.stop();
-}
-
-/// A handler may respond with a stream it goes on to fill once `respondWith` has been called. That
-/// is the shape every incremental response takes, where the work producing the body outlives the
+/// A handler may respond with a stream it goes on to fill once `respondWith` has been called. Every
+/// incremental response takes that shape, where the work producing the body outlives the
 /// call that promised it. The chunks written afterwards still have to reach the client.
 #[test]
 fn serve_streams_a_body_written_after_respond_with() {
@@ -154,9 +117,10 @@ fn serve_streams_a_body_written_after_respond_with() {
         await writer.write('world');
         await writer.close();
     })"#;
-    let handle = start_serve(handler, 18199);
+    let handle = start_serve(handler);
+    let port = handle.port();
 
-    let body = request(18199, "GET", "/", "");
+    let body = request(port, "GET", "/", "");
     assert_eq!(dechunk(&body), "hello world", "got: {body}");
 
     handle.stop();
@@ -192,9 +156,10 @@ fn serve_concatenates_several_upstream_bodies() {
             }})());
         }})"#
     );
-    let handle = start_serve(&handler, 18201);
+    let handle = start_serve(&handler);
+    let port = handle.port();
 
-    let body = request(18201, "GET", "/", "");
+    let body = request(port, "GET", "/", "");
     assert_eq!(dechunk(&body), "abcdabcdabcd", "got: {body}");
 
     handle.stop();
@@ -202,58 +167,37 @@ fn serve_concatenates_several_upstream_bodies() {
 
 #[test]
 fn serve_proxies_via_fetch() {
-    // The handler proxies each request to an upstream via `fetch` and replies with the result. This
-    // exercises the future-attribution fix: respondWith resolves from a `fetch` future, whose
-    // reaction must release the request loop's interest *on that loop*. Two concurrent proxies must
-    // each get the upstream body, with no cross-request contamination.
+    // The handler proxies each request to an upstream via `fetch` and replies with the result.
+    // respondWith resolves from a `fetch` future, whose reaction must release the request loop's
+    // interest on that loop. Two concurrent proxies must each get the upstream body, with no
+    // cross-request contamination.
     let upstream = start_upstream("UPSTREAM-BODY");
     let handler = format!(
         "addEventListener('fetch', (e) => e.respondWith(fetch('http://127.0.0.1:{upstream}/')))"
     );
-    let handle = start_serve(&handler, 18139);
+    let handle = start_serve(&handler);
+    let port = handle.port();
 
-    assert!(request(18139, "GET", "/", "").contains("UPSTREAM-BODY"));
+    assert!(request(port, "GET", "/", "").contains("UPSTREAM-BODY"));
 
-    let a = std::thread::spawn(|| request(18139, "GET", "/a", ""));
-    let b = std::thread::spawn(|| request(18139, "GET", "/b", ""));
+    let a = std::thread::spawn(move || request(port, "GET", "/a", ""));
+    let b = std::thread::spawn(move || request(port, "GET", "/b", ""));
     assert!(a.join().unwrap().contains("UPSTREAM-BODY"));
     assert!(b.join().unwrap().contains("UPSTREAM-BODY"));
 
     handle.stop();
 }
 
-#[test]
-fn serve_streams_a_readable_stream_response_body() {
-    // respondWith(new Response(stream)) with a chunk already queued: taking the send body must
-    // run on the request's loop with its reaction jobs drained (previously this tripped the
-    // pending-microtask assert under debugmozjs, and hung after the headers in release).
-    let handler = r#"addEventListener('fetch', (event) => {
-        const stream = new ReadableStream({
-            start(c) {
-                c.enqueue(new TextEncoder().encode('streamed '));
-                c.enqueue(new TextEncoder().encode('body'));
-                c.close();
-            }
-        });
-        event.respondWith(new Response(stream));
-    })"#;
-    let handle = start_serve(handler, 18143);
-    let body = request(18143, "GET", "/", "");
-    // The body arrives chunk-framed; de-chunk and assert the exact payload, so a
-    // chunk-framing corruption that merely preserved the substrings would fail.
-    assert_eq!(dechunk(&body), "streamed body", "got: {body}");
-    handle.stop();
-}
-
 #[test]
 fn serve_enforces_request_limits() {
     let handler = r#"addEventListener('fetch', (e) => e.respondWith(new Response('ok')))"#;
-    let handle = start_serve(handler, 18141);
+    let handle = start_serve(handler);
+    let port = handle.port();
 
-    // A Content-Length beyond the body cap is rejected up front — the server must not
-    // allocate it (previously `vec![0; content_length]` was attacker-sized).
+    // A Content-Length beyond the body cap is rejected up front, before anything is allocated
+    // for it.
     let response = raw_request(
-        18141,
+        port,
         b"POST / HTTP/1.1\r\nHost: x\r\nContent-Length: 99999999999\r\nConnection: close\r\n\r\n",
     );
     assert!(response.starts_with("HTTP/1.1 413"), "got: {response}");
@@ -264,18 +208,18 @@ fn serve_enforces_request_limits() {
     let mut huge = Vec::from(&b"GET / HTTP/1.1\r\nHost: x\r\nX-Big: "[..]);
     huge.extend(std::iter::repeat_n(b'a', 1024 * 1024));
     huge.extend_from_slice(b"\r\nConnection: close\r\n\r\n");
-    let response = raw_request(18141, &huge);
+    let response = raw_request(port, &huge);
     assert!(response.starts_with("HTTP/1.1 431"), "got: {response}");
 
     // A malformed Content-Length is a 400, not silently treated as zero.
     let response = raw_request(
-        18141,
+        port,
         b"POST / HTTP/1.1\r\nHost: x\r\nContent-Length: banana\r\nConnection: close\r\n\r\n",
     );
     assert!(response.starts_with("HTTP/1.1 400"), "got: {response}");
 
     // The server survives all of the above and still serves.
-    assert_eq!(request(18141, "GET", "/", ""), "ok");
+    assert_eq!(request(port, "GET", "/", ""), "ok");
 
     handle.stop();
 }
@@ -286,12 +230,13 @@ fn serve_enforces_request_limits() {
 #[test]
 fn serve_rejects_ambiguous_body_framing() {
     let handler = r#"addEventListener('fetch', (e) => e.respondWith(new Response('ok')))"#;
-    let handle = start_serve(handler, 18179);
+    let handle = start_serve(handler);
+    let port = handle.port();
 
     // Two Content-Length headers: a front-end framing by the first and this server framing by the
     // second disagree about where the request ends, so the remainder is read as a second request.
     let response = raw_request(
-        18179,
+        port,
         b"POST / HTTP/1.1\r\nHost: x\r\nContent-Length: 0\r\nContent-Length: 41\r\n\
           Connection: close\r\n\r\n",
     );
@@ -299,33 +244,32 @@ fn serve_rejects_ambiguous_body_framing() {
 
     // The same ambiguity inside one field.
     let response = raw_request(
-        18179,
+        port,
         b"POST / HTTP/1.1\r\nHost: x\r\nContent-Length: 0, 41\r\nConnection: close\r\n\r\n",
     );
     assert!(response.starts_with("HTTP/1.1 400"), "got: {response}");
 
     // Transfer-Encoding with Content-Length: the classic pair, each party picking a different one.
-    // The message is framed by the Transfer-Encoding and the Content-Length is dropped, so what
-    // the other party would have read as a second request is never served (RFC 9112 §6.3).
-    let mut stream = TcpStream::connect(("127.0.0.1", 18179)).unwrap();
-    stream
-        .write_all(
-            b"POST / HTTP/1.1\r\nHost: x\r\nContent-Length: 44\r\nTransfer-Encoding: chunked\r\n\
-              \r\n0\r\n\r\nGET /smuggled HTTP/1.1\r\nHost: x\r\nFoo: ",
-        )
-        .unwrap();
-    let mut carry = Vec::new();
-    let first = read_one_response(&mut stream, &mut carry, PATIENCE).expect("the framed request");
-    assert!(first.starts_with("HTTP/1.1 200"), "got: {first}");
-    assert!(
-        read_one_response(&mut stream, &mut carry, Duration::from_secs(2)).is_none(),
-        "the smuggled request must not be served"
+    // The message is framed by the Transfer-Encoding and the connection is closed after the
+    // response, so the request a Transfer-Encoding framing finds after the chunked body is never
+    // served (RFC 9112 §6.3). A server that kept the connection open would answer it, or leave
+    // `raw_request` waiting for an EOF that never comes.
+    let response = raw_request(
+        port,
+        b"POST / HTTP/1.1\r\nHost: x\r\nContent-Length: 40\r\nTransfer-Encoding: chunked\r\n\
+          \r\n0\r\n\r\nGET /smuggled HTTP/1.1\r\nHost: x\r\n\r\n",
+    );
+    assert!(response.starts_with("HTTP/1.1 200"), "got: {response}");
+    assert_eq!(
+        response.matches("HTTP/1.1 ").count(),
+        1,
+        "the smuggled request must not be served: {response}"
     );
 
-    // A Transfer-Encoding whose final coding is not chunked delimits nothing at all, so there is no
-    // framing to fall back on.
+    // A Transfer-Encoding whose final coding is not chunked doesn't delimit the body, so there is
+    // no framing to fall back on.
     let response = raw_request(
-        18179,
+        port,
         b"POST / HTTP/1.1\r\nHost: x\r\nTransfer-Encoding: chunked, gzip\r\nConnection: close\r\n\r\n",
     );
     assert!(response.starts_with("HTTP/1.1 400"), "got: {response}");
@@ -333,13 +277,13 @@ fn serve_rejects_ambiguous_body_framing() {
     // Repeated Transfer-Encoding fields are one list: `gzip` then `chunked` still ends in chunked,
     // so this one *is* framed and must be served rather than caught by the check above.
     let response = raw_request(
-        18179,
+        port,
         b"POST / HTTP/1.1\r\nHost: x\r\nTransfer-Encoding: gzip\r\nTransfer-Encoding: chunked\r\n\
           Connection: close\r\n\r\n0\r\n\r\n",
     );
     assert!(response.starts_with("HTTP/1.1 200"), "got: {response}");
 
-    assert_eq!(request(18179, "GET", "/", ""), "ok");
+    assert_eq!(request(port, "GET", "/", ""), "ok");
 
     handle.stop();
 }
@@ -350,10 +294,11 @@ fn serve_maps_invalid_status_to_500() {
     // status 0 — must not serialize the protocol-illegal status line
     // `HTTP/1.1 0`; the status is surfaced as a 500.
     let handler = r#"addEventListener('fetch', (e) => e.respondWith(Response.error()))"#;
-    let handle = start_serve(handler, 18151);
+    let handle = start_serve(handler);
+    let port = handle.port();
 
     let response = raw_request(
-        18151,
+        port,
         b"GET / HTTP/1.1\r\nHost: x\r\nConnection: close\r\n\r\n",
     );
     assert!(response.starts_with("HTTP/1.1 500"), "got: {response}");
@@ -368,11 +313,12 @@ fn serve_decodes_a_chunked_request_body() {
     let handler = r#"addEventListener('fetch', (event) => {
         event.respondWith(event.request.text().then((body) => new Response('got:' + body)));
     })"#;
-    let handle = start_serve(handler, 18153);
+    let handle = start_serve(handler);
+    let port = handle.port();
 
     // "hello world" as two chunks: "hello " (0x6) then "world" (0x5).
     let chunked = b"POST / HTTP/1.1\r\nHost: x\r\nTransfer-Encoding: chunked\r\nConnection: close\r\n\r\n6\r\nhello \r\n5\r\nworld\r\n0\r\n\r\n";
-    let response = raw_request(18153, chunked);
+    let response = raw_request(port, chunked);
     assert!(response.contains("got:hello world"), "got: {response}");
 
     // Transfer-Encoding together with Content-Length is a smuggling vector: the message is framed
@@ -380,7 +326,7 @@ fn serve_decodes_a_chunked_request_body() {
     // Content-Length claims. `serve_rejects_ambiguous_body_framing` covers what that leaves on the
     // connection.
     let smuggle = b"POST / HTTP/1.1\r\nHost: x\r\nTransfer-Encoding: chunked\r\nContent-Length: 5\r\nConnection: close\r\n\r\n0\r\n\r\n";
-    let response = raw_request(18153, smuggle);
+    let response = raw_request(port, smuggle);
     assert!(response.contains("got:"), "got: {response}");
     assert!(!response.contains("got:hello"), "got: {response}");
 
@@ -405,11 +351,12 @@ fn client_disconnect_stops_a_streamed_body_pump() {
             }
         })));
     })"#;
-    let handle = start_serve(handler, 18145);
+    let handle = start_serve(handler);
+    let port = handle.port();
 
     // Open the endless stream, read a little, and drop the connection.
     {
-        let mut stream = TcpStream::connect(("127.0.0.1", 18145)).unwrap();
+        let mut stream = TcpStream::connect(("127.0.0.1", port)).unwrap();
         stream
             .write_all(b"GET /stream HTTP/1.1\r\nHost: localhost\r\nConnection: close\r\n\r\n")
             .unwrap();
@@ -426,11 +373,21 @@ fn client_disconnect_stops_a_streamed_body_pump() {
     }
 
     // The pump must come to rest: the pull counter settles instead of growing
-    // while nobody consumes the body.
-    std::thread::sleep(Duration::from_millis(400));
-    let first: u64 = request(18145, "GET", "/pulls", "").parse().unwrap();
-    std::thread::sleep(Duration::from_millis(400));
-    let second: u64 = request(18145, "GET", "/pulls", "").parse().unwrap();
+    // while nobody consumes the body. Wait for two equal readings in a row, then check that the
+    // count stays put.
+    let pulls = || -> u64 { request(port, "GET", "/pulls", "").parse().unwrap() };
+    let deadline = std::time::Instant::now() + common::SETTLE_PATIENCE;
+    let mut first = pulls();
+    loop {
+        std::thread::sleep(Duration::from_millis(50));
+        let next = pulls();
+        if next == first || std::time::Instant::now() >= deadline {
+            break;
+        }
+        first = next;
+    }
+    std::thread::sleep(Duration::from_millis(250));
+    let second = pulls();
     assert_eq!(
         first, second,
         "the body pump must stop after the client disconnects"
@@ -439,15 +396,15 @@ fn client_disconnect_stops_a_streamed_body_pump() {
     handle.stop();
 }
 
-/// Losing the client aborts the request's signal, and nothing more. The abort tells a handler that
-/// the fetch it was serving is over, so it can drop work it was doing *for that client* — an
-/// upstream it passed the signal to, say. It must not touch the event's lifetime work:
-/// `waitUntil` exists for exactly the things that outlive the response, and telemetry a client
-/// never waited for is still telemetry that has to be sent.
+/// Losing the client aborts the request's signal with an `AbortError` (`Create Fetch Event and
+/// Dispatch` step 17.4.20, whose "terminated" here is the response write failing), and nothing
+/// more. The abort tells a handler that the fetch it was serving is over, so it can drop work it
+/// was doing for that client, such as an upstream fetch it passed the signal to. It must not touch
+/// the event's lifetime work: `waitUntil` exists for exactly the things that outlive the response,
+/// and telemetry a client never waited for is still telemetry that has to be sent.
 ///
-/// The lifetime promise here deliberately ignores the signal, which is what separates this from
-/// the abort test further down: that one watches the signal *from* a `waitUntil`, so it would
-/// still pass if the only work that survived a disconnect were work waiting on the abort itself.
+/// The lifetime promise here deliberately ignores the signal, so the test would fail if the only
+/// work that survived a disconnect were work waiting on the abort itself.
 #[test]
 fn a_client_disconnect_does_not_cancel_wait_until_work() {
     let handler = r#"globalThis.state = {};
@@ -457,7 +414,7 @@ fn a_client_disconnect_does_not_cancel_wait_until_work() {
             return;
         }
         event.request.signal.addEventListener('abort', () => {
-            globalThis.state.aborted = true;
+            globalThis.state.aborted = event.request.signal.reason.name;
         });
         // Stands in for telemetry: nothing to do with the client, and deliberately not wired to
         // the request's signal.
@@ -475,12 +432,13 @@ fn a_client_disconnect_does_not_cancel_wait_until_work() {
             }
         })));
     })"#;
-    let handle = start_serve(handler, 18215);
+    let handle = start_serve(handler);
+    let port = handle.port();
 
     // Take the head and the first of the body, then vanish: the next write fails and the request's
     // signal is aborted.
     {
-        let mut stream = TcpStream::connect(("127.0.0.1", 18215)).unwrap();
+        let mut stream = TcpStream::connect(("127.0.0.1", port)).unwrap();
         stream
             .write_all(b"GET /stream HTTP/1.1\r\nHost: x\r\nConnection: close\r\n\r\n")
             .unwrap();
@@ -490,11 +448,11 @@ fn a_client_disconnect_does_not_cancel_wait_until_work() {
     }
 
     // The 300ms lifetime promise settles after the disconnect, and the abort lands before it.
-    let state = eventually(18215, "/check", |state| {
+    let state = eventually(port, "/check", |state| {
         state.contains("\"telemetry\":\"sent\"")
     });
     assert!(
-        state.contains("\"aborted\":true"),
+        state.contains("\"aborted\":\"AbortError\""),
         "losing the client must abort the request's signal: {state}"
     );
     assert!(
@@ -522,10 +480,11 @@ fn wait_until_does_not_delay_the_response() {
             resolve();
         }, 800)));
     })"#;
-    let handle = start_serve(handler, 18147);
+    let handle = start_serve(handler);
+    let port = handle.port();
 
     let started = std::time::Instant::now();
-    assert_eq!(request(18147, "GET", "/", ""), "hi");
+    assert_eq!(request(port, "GET", "/", ""), "hi");
     let elapsed = started.elapsed();
     assert!(
         elapsed < Duration::from_millis(700),
@@ -533,7 +492,7 @@ fn wait_until_does_not_delay_the_response() {
     );
 
     // The waitUntil work still runs to completion after the response.
-    assert_eq!(eventually(18147, "/check", |seen| seen == "true"), "true");
+    assert_eq!(eventually(port, "/check", |seen| seen == "true"), "true");
 
     handle.stop();
 }
@@ -558,9 +517,10 @@ fn serve_streams_an_incoming_request_body() {
             }
         })));
     })"#;
-    let handle = start_serve(handler, 18155);
+    let handle = start_serve(handler);
+    let port = handle.port();
 
-    let mut stream = TcpStream::connect(("127.0.0.1", 18155)).unwrap();
+    let mut stream = TcpStream::connect(("127.0.0.1", port)).unwrap();
     stream
         .set_read_timeout(Some(Duration::from_secs(10)))
         .unwrap();
@@ -611,9 +571,10 @@ fn serve_rejects_a_truncated_request_body() {
             () => new Response('truncated'),
         ));
     })"#;
-    let handle = start_serve(handler, 18157);
+    let handle = start_serve(handler);
+    let port = handle.port();
 
-    let mut stream = TcpStream::connect(("127.0.0.1", 18157)).unwrap();
+    let mut stream = TcpStream::connect(("127.0.0.1", port)).unwrap();
     // Declare ten bytes, send four, then close the sending side.
     stream
         .write_all(
@@ -640,7 +601,8 @@ fn serve_rejects_an_over_budget_trailer_section() {
             () => new Response('rejected'),
         ));
     })"#;
-    let handle = start_serve(handler, 18291);
+    let handle = start_serve(handler);
+    let port = handle.port();
 
     let mut request = Vec::from(
         &b"POST / HTTP/1.1\r\nHost: x\r\nTransfer-Encoding: chunked\r\nConnection: close\r\n\r\n\
@@ -650,12 +612,12 @@ fn serve_rejects_an_over_budget_trailer_section() {
         request.extend_from_slice(format!("X-Trailer-{i}: v\r\n").as_bytes());
     }
     request.extend_from_slice(b"\r\n");
-    let response = raw_request(18291, &request);
+    let response = raw_request(port, &request);
     assert!(response.contains("rejected"), "got: {response}");
 
     // A trailer section within the budget still ends the body cleanly.
     let response = raw_request(
-        18291,
+        port,
         b"POST / HTTP/1.1\r\nHost: x\r\nTransfer-Encoding: chunked\r\nConnection: close\r\n\r\n\
           5\r\nhello\r\n0\r\nX-Trailer: v\r\n\r\n",
     );
@@ -678,10 +640,11 @@ fn a_response_edited_after_it_was_answered_with_goes_out_as_it_was() {
         });
         e.respondWith(response);
     })"#;
-    let handle = start_serve(handler, 18295);
+    let handle = start_serve(handler);
+    let port = handle.port();
 
     let response = raw_request(
-        18295,
+        port,
         b"GET / HTTP/1.1\r\nHost: x\r\nConnection: close\r\n\r\n",
     );
     let head = response.to_lowercase();
@@ -697,17 +660,18 @@ fn a_response_edited_after_it_was_answered_with_goes_out_as_it_was() {
 #[test]
 fn serve_rejects_a_second_host_header() {
     let handler = r#"addEventListener('fetch', (e) => e.respondWith(new Response(new URL(e.request.url).host)))"#;
-    let handle = start_serve(handler, 18293);
+    let handle = start_serve(handler);
+    let port = handle.port();
 
     let response = raw_request(
-        18293,
+        port,
         b"GET / HTTP/1.1\r\nHost: first.example\r\nHost: second.example\r\nConnection: close\r\n\r\n",
     );
     assert!(response.starts_with("HTTP/1.1 400"), "got: {response}");
 
     // One Host still routes as before.
     let response = raw_request(
-        18293,
+        port,
         b"GET / HTTP/1.1\r\nHost: only.example\r\nConnection: close\r\n\r\n",
     );
     assert!(response.contains("only.example"), "got: {response}");
@@ -723,9 +687,10 @@ fn serve_pipes_an_incoming_request_body_to_the_response() {
     let handler = r#"addEventListener('fetch', (event) => {
         event.respondWith(new Response(event.request.body));
     })"#;
-    let handle = start_serve(handler, 18159);
+    let handle = start_serve(handler);
+    let port = handle.port();
 
-    let mut stream = TcpStream::connect(("127.0.0.1", 18159)).unwrap();
+    let mut stream = TcpStream::connect(("127.0.0.1", port)).unwrap();
     stream
         .write_all(b"POST / HTTP/1.1\r\nHost: x\r\nContent-Length: 11\r\nConnection: close\r\n\r\nhello world")
         .unwrap();
@@ -753,17 +718,18 @@ fn serve_caps_a_chunked_request_body_mid_stream() {
         ));
     })"#;
     const CAP: usize = 64 * 1024;
-    let handle = serve_with_limits(handler, 18161, "--max-request-body-bytes 64KiB");
+    let handle = serve_with_limits(handler, "--max-request-body-bytes 64KiB");
+    let port = handle.port();
 
     // Whole, well-formed chunked bodies, terminating chunk included, so the upload never stalls
     // and only the cap can reject one. A stalled upload rejects the handler's read too, and would
     // pass an assertion on the rejection alone.
-    let over = upload_chunked(18161, CAP + 1);
+    let over = upload_chunked(port, CAP + 1);
     assert!(over.contains("too large"), "got: {over}");
 
     // One byte less is delivered whole, so the cap rejected the body above rather than its
     // framing.
-    let under = upload_chunked(18161, CAP);
+    let under = upload_chunked(port, CAP);
     assert!(under.contains(&format!("complete:{CAP}")), "got: {under}");
 
     handle.stop();
@@ -800,9 +766,10 @@ fn serve_caps_a_chunked_framing_line() {
             () => new Response('bad framing'),
         ));
     })"#;
-    let handle = start_serve(handler, 18165);
+    let handle = start_serve(handler);
+    let port = handle.port();
 
-    let mut stream = TcpStream::connect(("127.0.0.1", 18165)).unwrap();
+    let mut stream = TcpStream::connect(("127.0.0.1", port)).unwrap();
     stream
         .write_all(b"POST / HTTP/1.1\r\nHost: x\r\nTransfer-Encoding: chunked\r\nConnection: close\r\n\r\n")
         .unwrap();
@@ -827,10 +794,11 @@ fn serve_clones_an_incoming_request_body() {
         event.respondWith(Promise.all([event.request.text(), copy.text()])
             .then(([a, b]) => new Response(a + '|' + b)));
     })"#;
-    let handle = start_serve(handler, 18163);
+    let handle = start_serve(handler);
+    let port = handle.port();
 
     assert_eq!(
-        request(18163, "POST", "/", "payload"),
+        request(port, "POST", "/", "payload"),
         "payload|payload",
         "both halves of the tee must see the body"
     );
@@ -843,37 +811,27 @@ fn serve_clones_an_incoming_request_body() {
 /// them waits, not just the first.
 #[test]
 fn an_isolated_request_waits_for_the_scripts_top_level_await() {
-    let dir = std::env::temp_dir().join(format!(
-        "starling-serve-isolated-tla-{}",
-        std::process::id()
-    ));
-    std::fs::create_dir_all(&dir).unwrap();
-    std::fs::write(
-        dir.join("entry.mjs"),
+    let dir = ScriptDir::new(&[(
+        "entry.mjs",
         r#"await new Promise((resolve) => setTimeout(resolve, 50));
         addEventListener('fetch', (event) => {
             const url = new URL(event.request.url);
             event.respondWith(new Response('async-handler' + url.pathname));
         });
         "#,
-    )
-    .unwrap();
+    )]);
 
-    let handle = start_serve_config(
-        RuntimeConfig {
-            script_path: dir.join("entry.mjs").to_string_lossy().into_owned(),
-            serve: Some(18167),
-            serve_isolated: true,
-            ..Default::default()
-        },
-        18167,
-    );
+    let handle = start_serve_config(RuntimeConfig {
+        script_path: dir.path("entry.mjs"),
+        serve_isolated: true,
+        ..Default::default()
+    });
+    let port = handle.port();
 
-    assert_eq!(request(18167, "GET", "/a", ""), "async-handler/a");
-    assert_eq!(request(18167, "GET", "/b", ""), "async-handler/b");
+    assert_eq!(request(port, "GET", "/a", ""), "async-handler/a");
+    assert_eq!(request(port, "GET", "/b", ""), "async-handler/b");
 
     handle.stop();
-    let _ = std::fs::remove_dir_all(&dir);
 }
 
 /// `FetchEvent.handled` is one promise for the event's lifetime — a WebIDL promise attribute
@@ -903,17 +861,18 @@ fn fetch_event_handled_reports_the_outcome() {
         }
         // /silent falls through without calling respondWith at all.
     })"#;
-    let handle = start_serve(handler, 18181);
+    let handle = start_serve(handler);
+    let port = handle.port();
 
     // `handled` settles as the request's outcome becomes final, and its reactions run while the
     // loop is drained afterwards, so ask until they have recorded something.
-    let recorded = || eventually(18181, "/check", |state| state != "never settled");
+    let recorded = || eventually(port, "/check", |state| state != "never settled");
     let settled = |path: &str| {
-        request(18181, "GET", path, "");
+        request(port, "GET", path, "");
         recorded()
     };
 
-    assert_eq!(request(18181, "GET", "/responds", ""), "ok");
+    assert_eq!(request(port, "GET", "/responds", ""), "ok");
     assert_eq!(recorded(), "resolved,same=true");
 
     // A respondWith whose promise rejects is a network error, and `handled` reports it as one.
@@ -962,12 +921,13 @@ fn wait_until_throws_once_the_event_is_over() {
             }
         })));
     })"#;
-    let handle = start_serve(handler, 18183);
+    let handle = start_serve(handler);
+    let port = handle.port();
 
-    assert_eq!(dechunk(&request(18183, "GET", "/", "")), "during=allowed");
+    assert_eq!(dechunk(&request(port, "GET", "/", "")), "during=allowed");
     // The timer runs while the request's loop is drained after its response.
     assert_eq!(
-        eventually(18183, "/check", |late| late != "never ran"),
+        eventually(port, "/check", |late| late != "never ran"),
         "InvalidStateError"
     );
 
@@ -1001,11 +961,12 @@ fn wait_until_is_allowed_while_an_earlier_one_is_pending() {
             releaseFirst();
         }, 20);
     })"#;
-    let handle = start_serve(handler, 18185);
+    let handle = start_serve(handler);
+    let port = handle.port();
 
-    assert_eq!(request(18185, "GET", "/", ""), "ok");
+    assert_eq!(request(port, "GET", "/", ""), "ok");
     assert_eq!(
-        eventually(18185, "/check", |second| second != "never ran"),
+        eventually(port, "/check", |second| second != "never ran"),
         "allowed"
     );
 
@@ -1018,10 +979,8 @@ fn wait_until_is_allowed_while_an_earlier_one_is_pending() {
 /// the rest of the module still has to run once it does settle.
 #[test]
 fn a_top_level_await_settled_by_a_request_resumes_the_script() {
-    let dir = std::env::temp_dir().join(format!("starling-serve-tla-{}", std::process::id()));
-    std::fs::create_dir_all(&dir).unwrap();
-    std::fs::write(
-        dir.join("entry.mjs"),
+    let dir = ScriptDir::new(&[(
+        "entry.mjs",
         r#"let release;
         const gate = new Promise((resolve) => { release = resolve; });
         addEventListener('fetch', (event) => {
@@ -1035,28 +994,23 @@ fn a_top_level_await_settled_by_a_request_resumes_the_script() {
         await gate;
         globalThis.resumed = true;
         "#,
-    )
-    .unwrap();
+    )]);
 
-    let handle = start_serve_config(
-        RuntimeConfig {
-            script_path: dir.join("entry.mjs").to_string_lossy().into_owned(),
-            serve: Some(18207),
-            ..Default::default()
-        },
-        18207,
-    );
+    let handle = start_serve_config(RuntimeConfig {
+        script_path: dir.path("entry.mjs"),
+        ..Default::default()
+    });
+    let port = handle.port();
 
     // The server accepts even though the module's evaluation is still suspended.
-    assert_eq!(request(18207, "GET", "/", ""), "released");
+    assert_eq!(request(port, "GET", "/", ""), "released");
     // And once the request settles it, the script picks up where it left off.
     assert_eq!(
-        eventually(18207, "/check", |state| state == "resumed"),
+        eventually(port, "/check", |state| state == "resumed"),
         "resumed"
     );
 
     handle.stop();
-    let _ = std::fs::remove_dir_all(&dir);
 }
 
 /// What the wire's headers look like from JS: a field that arrived in mixed case is found by any
@@ -1086,10 +1040,11 @@ fn serve_exposes_incoming_headers_and_keeps_them_immutable() {
         response.headers.append('another', 'B');
         event.respondWith(response);
     })"#;
-    let handle = start_serve(handler, 18203);
+    let handle = start_serve(handler);
+    let port = handle.port();
 
     let response = raw_request(
-        18203,
+        port,
         b"GET / HTTP/1.1\r\nHost: x\r\neXample-hEader: Header Value\r\nUser-Agent: test-agent\r\n\
           Connection: close\r\n\r\n",
     );
@@ -1137,16 +1092,17 @@ fn a_throwing_handler_is_answered_with_500() {
             event.respondWith(new Response('recovered'));
         }
     })"#;
-    let handle = start_serve(handler, 18205);
+    let handle = start_serve(handler);
+    let port = handle.port();
 
     let response = raw_request(
-        18205,
+        port,
         b"GET /boom HTTP/1.1\r\nHost: x\r\nConnection: close\r\n\r\n",
     );
     assert!(response.starts_with("HTTP/1.1 500"), "got: {response}");
 
     // The throw does not take the dispatch down: a listener after it still gets the event.
-    assert_eq!(request(18205, "GET", "/ok", ""), "recovered");
+    assert_eq!(request(port, "GET", "/ok", ""), "recovered");
 
     handle.stop();
 }
@@ -1168,12 +1124,13 @@ fn an_abandoned_response_body_does_not_hang_the_connection() {
             start(_c) { /* never enqueues, never closes */ }
         })));
     })"#;
-    let handle = start_serve(handler, 18193);
+    let handle = start_serve(handler);
+    let port = handle.port();
 
     // The connection has to close on its own; `request` reads to EOF, so it would hang otherwise.
     let started = std::time::Instant::now();
     let response = raw_request(
-        18193,
+        port,
         b"GET /abandoned HTTP/1.1\r\nHost: x\r\nConnection: close\r\n\r\n",
     );
     let elapsed = started.elapsed();
@@ -1188,7 +1145,7 @@ fn an_abandoned_response_body_does_not_hang_the_connection() {
     );
 
     // And the slot is back: the server still serves.
-    assert_eq!(request(18193, "GET", "/ok", ""), "still serving");
+    assert_eq!(request(port, "GET", "/ok", ""), "still serving");
 
     handle.stop();
 }
@@ -1205,13 +1162,14 @@ fn an_abandoned_response_body_does_not_wedge_an_isolated_server() {
         }
         event.respondWith(new Response(new ReadableStream({ start(_c) {} })));
     })"#;
-    let handle = start_serve_with(handler, 18195, true);
+    let handle = start_serve_with(handler, true);
+    let port = handle.port();
 
     raw_request(
-        18195,
+        port,
         b"GET /abandoned HTTP/1.1\r\nHost: x\r\nConnection: close\r\n\r\n",
     );
-    assert_eq!(request(18195, "GET", "/ok", ""), "still serving");
+    assert_eq!(request(port, "GET", "/ok", ""), "still serving");
 
     handle.stop();
 }
@@ -1232,9 +1190,10 @@ fn a_streamed_response_sends_its_head_before_the_first_chunk() {
         });
         event.respondWith(new Response(stream, { headers: { 'x-marker': 'early' } }));
     })"#;
-    let handle = start_serve(handler, 18187);
+    let handle = start_serve(handler);
+    let port = handle.port();
 
-    let mut stream = TcpStream::connect(("127.0.0.1", 18187)).unwrap();
+    let mut stream = TcpStream::connect(("127.0.0.1", port)).unwrap();
     stream
         .write_all(b"GET / HTTP/1.1\r\nHost: x\r\nConnection: close\r\n\r\n")
         .unwrap();
@@ -1256,26 +1215,10 @@ fn a_streamed_response_sends_its_head_before_the_first_chunk() {
     handle.stop();
 }
 
-/// A script that leaves a repeating timer behind — a background refresh, the ordinary reason to
-/// call `setInterval` at top level — still has to reach the accept loop. Waiting for its startup
-/// loop to *complete* never returns, so the server would bind and then serve nothing.
-#[test]
-fn a_repeating_timer_does_not_prevent_serving() {
-    let handler = r#"setInterval(() => { globalThis.ticks = (globalThis.ticks ?? 0) + 1; }, 20);
-    addEventListener('fetch', (event) => {
-        event.respondWith(new Response('served'));
-    });"#;
-    // `start_serve` fails the test outright if the server never accepts.
-    let handle = start_serve(handler, 18171);
-
-    assert_eq!(request(18171, "GET", "/", ""), "served");
-
-    handle.stop();
-}
-
-/// A `setInterval` in a shared-global script is background work the script expects to keep running
-/// — a cache refresh, a metrics flush — so the server has to keep driving its loop between
-/// requests, not just get past it at startup.
+/// A `setInterval` in a shared-global script is background work that has to keep running, such as a
+/// cache refresh or a metrics flush. The server has to reach the accept loop despite it, and keep
+/// driving the script's loop between requests. Waiting for the startup loop to complete never
+/// returns, so the server would bind and then serve nothing.
 #[test]
 fn a_repeating_timer_keeps_running_between_requests() {
     let handler = r#"globalThis.ticks = 0;
@@ -1283,20 +1226,15 @@ fn a_repeating_timer_keeps_running_between_requests() {
     addEventListener('fetch', (event) => {
         event.respondWith(new Response('ticks=' + globalThis.ticks));
     });"#;
-    let handle = start_serve(handler, 18189);
+    let handle = start_serve(handler);
+    let port = handle.port();
 
     // Nothing has driven the interval yet beyond startup.
-    let first: u32 = request(18189, "GET", "/", "")
-        .strip_prefix("ticks=")
-        .and_then(|n| n.parse().ok())
-        .expect("a tick count");
+    let first = ticks_at(port, "/");
 
     // Idle time with no requests at all: the interval has to fire on its own.
     std::thread::sleep(Duration::from_millis(500));
-    let second: u32 = request(18189, "GET", "/", "")
-        .strip_prefix("ticks=")
-        .and_then(|n| n.parse().ok())
-        .expect("a tick count");
+    let second = ticks_at(port, "/");
 
     assert!(
         second > first,
@@ -1306,6 +1244,35 @@ fn a_repeating_timer_keeps_running_between_requests() {
     handle.stop();
 }
 
+/// The number after `ticks=` in the response to a request for `path` on `port`.
+fn ticks_at(port: u16, path: &str) -> u32 {
+    request(port, "GET", path, "")
+        .strip_prefix("ticks=")
+        .and_then(|n| n.parse().ok())
+        .expect("a tick count")
+}
+
+/// A request handler that clears a `setInterval` the script's top level started stops it, although
+/// the interval runs on the script's event loop rather than the request's.
+#[test]
+fn a_request_clears_a_top_level_interval() {
+    let handler = r#"globalThis.ticks = 0;
+    const interval = setInterval(() => { globalThis.ticks += 1; }, 20);
+    addEventListener('fetch', (event) => {
+        if (event.request.url.endsWith('/clear')) clearInterval(interval);
+        event.respondWith(new Response('ticks=' + globalThis.ticks));
+    });"#;
+    let handle = start_serve(handler);
+    let port = handle.port();
+
+    let cleared = ticks_at(port, "/clear");
+    std::thread::sleep(Duration::from_millis(300));
+    let later = ticks_at(port, "/");
+    assert_eq!(cleared, later, "the cleared interval kept firing");
+
+    handle.stop();
+}
+
 /// A zero-delay `setInterval` is always ready to run again, so driving the script's loop to
 /// completion would pin the thread and the server would never accept anything. It has to keep
 /// serving regardless.
@@ -1316,11 +1283,12 @@ fn a_zero_delay_repeating_timer_does_not_starve_the_server() {
     addEventListener('fetch', (event) => {
         event.respondWith(new Response('ticks=' + globalThis.ticks));
     });"#;
-    let handle = start_serve(handler, 18191);
+    let handle = start_serve(handler);
+    let port = handle.port();
 
     // Three requests in a row: each has to be served while the timer keeps re-arming.
     for _ in 0..3 {
-        let body = request(18191, "GET", "/", "");
+        let body = request(port, "GET", "/", "");
         assert!(body.starts_with("ticks="), "got: {body}");
     }
 
@@ -1335,10 +1303,11 @@ fn a_repeating_timer_does_not_prevent_serving_isolated_requests() {
     addEventListener('fetch', (event) => {
         event.respondWith(new Response('served'));
     });"#;
-    let handle = start_serve_with(handler, 18173, true);
+    let handle = start_serve_with(handler, true);
+    let port = handle.port();
 
-    assert_eq!(request(18173, "GET", "/", ""), "served");
-    assert_eq!(request(18173, "GET", "/", ""), "served");
+    assert_eq!(request(port, "GET", "/", ""), "served");
+    assert_eq!(request(port, "GET", "/", ""), "served");
 
     handle.stop();
 }
@@ -1360,10 +1329,11 @@ fn wait_until_does_not_delay_a_streamed_response() {
         event.respondWith(new Response(stream));
         event.waitUntil(new Promise((resolve) => setTimeout(resolve, 1500)));
     })"#;
-    let handle = start_serve(handler, 18175);
+    let handle = start_serve(handler);
+    let port = handle.port();
 
     let started = std::time::Instant::now();
-    let body = request(18175, "GET", "/", "");
+    let body = request(port, "GET", "/", "");
     let elapsed = started.elapsed();
     assert_eq!(dechunk(&body), "streamed body", "got: {body}");
     assert!(
@@ -1381,37 +1351,32 @@ fn wait_until_does_not_delay_a_streamed_response() {
 /// 500), and the state they hold outlives the request that made it.
 #[test]
 fn isolated_requests_re_evaluate_imported_modules() {
-    let dir = std::env::temp_dir().join(format!("starling-serve-modules-{}", std::process::id()));
-    std::fs::create_dir_all(&dir).unwrap();
-    std::fs::write(dir.join("entry.mjs"), "import './handler.mjs';\n").unwrap();
-    std::fs::write(
-        dir.join("handler.mjs"),
-        r#"let count = 0;
+    let dir = ScriptDir::new(&[
+        ("entry.mjs", "import './handler.mjs';\n"),
+        (
+            "handler.mjs",
+            r#"let count = 0;
         addEventListener('fetch', (event) => {
             count += 1;
             event.respondWith(new Response('count=' + count));
         });
         "#,
-    )
-    .unwrap();
+        ),
+    ]);
 
-    let handle = start_serve_config(
-        RuntimeConfig {
-            script_path: dir.join("entry.mjs").to_string_lossy().into_owned(),
-            serve: Some(18177),
-            serve_isolated: true,
-            ..Default::default()
-        },
-        18177,
-    );
+    let handle = start_serve_config(RuntimeConfig {
+        script_path: dir.path("entry.mjs"),
+        serve_isolated: true,
+        ..Default::default()
+    });
+    let port = handle.port();
 
     // `count=1` twice: the handler is registered afresh for the second request (a cached module
     // would leave it unregistered), and the module's own state starts over with it.
-    assert_eq!(request(18177, "GET", "/", ""), "count=1");
-    assert_eq!(request(18177, "GET", "/", ""), "count=1");
+    assert_eq!(request(port, "GET", "/", ""), "count=1");
+    assert_eq!(request(port, "GET", "/", ""), "count=1");
 
     handle.stop();
-    let _ = std::fs::remove_dir_all(&dir);
 }
 
 /// Each isolated request gets a global of its own: what one request leaves on `globalThis` is not
@@ -1424,128 +1389,38 @@ fn isolated_requests_do_not_share_global_state() {
         globalThis.leaked = 'from-a-previous-request';
         event.respondWith(new Response(perRequest + ',' + seen));
     });"#;
-    let handle = start_serve_with(handler, 18169, true);
+    let handle = start_serve_with(handler, true);
+    let port = handle.port();
 
     // A shared global would serve `fresh,from-a-previous-request` the second time, and would not
     // reach the second request at all, since re-evaluating `const perRequest` would throw.
-    assert_eq!(request(18169, "GET", "/", ""), "fresh,none");
-    assert_eq!(request(18169, "GET", "/", ""), "fresh,none");
-
-    handle.stop();
-}
-
-/// The request's `AbortSignal` fires when the connection is lost mid-response: `Create Fetch Event
-/// and Dispatch` step 17.4.20, whose "terminated" here is the response write failing.
-///
-/// The handler streams forever, so the client can hang up while the write is still going; a second
-/// request reads back what the first one's `waitUntil` observed.
-#[test]
-fn a_lost_connection_aborts_the_request_signal() {
-    let handler = r#"let observed = 'no-request-yet';
-    addEventListener('fetch', (event) => {
-        const path = new URL(event.request.url).pathname;
-        if (path === '/observed') {
-            event.respondWith(new Response(observed));
-            return;
-        }
-        observed = 'not-aborted';
-        // Poll rather than listen, and give up well inside the lifetime timeout, so a signal that
-        // never fires fails the assertion instead of hanging the test for two minutes.
-        event.waitUntil(new Promise((resolve) => {
-            let tries = 0;
-            const check = () => {
-                if (event.request.signal.aborted) {
-                    observed = 'aborted:' + event.request.signal.reason.name;
-                    resolve();
-                } else if (++tries > 300) {
-                    resolve();
-                } else {
-                    setTimeout(check, 10);
-                }
-            };
-            setTimeout(check, 10);
-        }));
-        // A body with no end: whatever the client reads, there is always another write to fail.
-        const chunk = new Uint8Array(64 * 1024);
-        event.respondWith(new Response(new ReadableStream({
-            pull(controller) { controller.enqueue(chunk); },
-        })));
-    });"#;
-    let handle = start_serve(handler, 18211);
-
-    {
-        let mut stream = TcpStream::connect(("127.0.0.1", 18211)).unwrap();
-        stream
-            .write_all(b"GET /stream HTTP/1.1\r\nHost: localhost\r\nConnection: close\r\n\r\n")
-            .unwrap();
-        // Read enough to know the response is flowing, then hang up on it.
-        let mut buf = [0u8; 1024];
-        assert!(
-            stream.read(&mut buf).unwrap() > 0,
-            "the response should start flowing"
-        );
-    }
-
-    // The abort lands while the first request's lifetime work is still being drained, so give that
-    // a moment before asking.
-    std::thread::sleep(Duration::from_millis(500));
-    assert_eq!(request(18211, "GET", "/observed", ""), "aborted:AbortError");
+    assert_eq!(request(port, "GET", "/", ""), "fresh,none");
+    assert_eq!(request(port, "GET", "/", ""), "fresh,none");
 
     handle.stop();
 }
 
-/// Startup waits for the content script to finish evaluating, and for nothing else. A timer the
-/// script leaves behind is not part of that, however long it runs for — waiting on one would keep
-/// the server from responding for exactly as long as the script felt like sleeping.
-#[test]
-fn a_timer_left_at_top_level_does_not_delay_serving() {
-    let handler = r#"setTimeout(() => {}, 60000);
-    addEventListener('fetch', (event) => event.respondWith(new Response('ready')));"#;
-    let handle = start_serve(handler, 18241);
-
-    let started = std::time::Instant::now();
-    assert_eq!(
-        request_within(18241, "/", Duration::from_secs(10)).as_deref(),
-        Some("ready"),
-        "the server should serve without waiting the timer out"
-    );
-    assert!(
-        started.elapsed() < Duration::from_secs(5),
-        "took {:?}",
-        started.elapsed()
-    );
-
-    handle.stop();
-}
-
-/// The other half: the script's *own* completion is waited for, including a top-level `await` that
-/// is itself waiting on a timer. Nothing is registered until that await resolves, so a server that
-/// dispatched before it would response the first request with a 500.
+/// Startup waits for the script's own completion, including a top-level `await` that is itself
+/// waiting on a timer. Nothing is registered until that await resolves, so a server that
+/// dispatched before it would answer the first request with a 500.
 #[test]
 fn startup_waits_for_a_top_level_await_on_a_timer() {
-    let dir = std::env::temp_dir().join(format!("starling-serve-await-{}", std::process::id()));
-    std::fs::create_dir_all(&dir).unwrap();
-    std::fs::write(
-        dir.join("entry.mjs"),
+    let dir = ScriptDir::new(&[(
+        "entry.mjs",
         r#"await new Promise((resolve) => setTimeout(resolve, 400));
         addEventListener('fetch', (event) => event.respondWith(new Response('after-await')));
         "#,
-    )
-    .unwrap();
+    )]);
 
-    let handle = start_serve_config(
-        RuntimeConfig {
-            script_path: dir.join("entry.mjs").to_string_lossy().into_owned(),
-            serve: Some(18243),
-            ..Default::default()
-        },
-        18243,
-    );
+    let handle = start_serve_config(RuntimeConfig {
+        script_path: dir.path("entry.mjs"),
+        ..Default::default()
+    });
+    let port = handle.port();
 
-    assert_eq!(request(18243, "GET", "/", ""), "after-await");
+    assert_eq!(request(port, "GET", "/", ""), "after-await");
 
     handle.stop();
-    let _ = std::fs::remove_dir_all(&dir);
 }
 
 /// Only `waitUntil` extends a fetch event's lifetime. A timer the handler leaves behind is not
@@ -1559,15 +1434,16 @@ fn a_bare_timer_does_not_extend_the_event_lifetime() {
             event.respondWith(new Response(globalThis.ran ?? 'never ran'));
             return;
         }
-        setTimeout(() => { globalThis.ran = 'ran'; }, 300);
+        setTimeout(() => { globalThis.ran = 'ran'; }, 100);
         event.respondWith(new Response('answered'));
     })"#;
-    let handle = start_serve(handler, 18237);
+    let handle = start_serve(handler);
+    let port = handle.port();
 
-    assert_eq!(request(18237, "GET", "/", ""), "answered");
+    assert_eq!(request(port, "GET", "/", ""), "answered");
     // Well past the timer's delay: it went with the request's loop rather than firing.
-    std::thread::sleep(Duration::from_millis(900));
-    assert_eq!(request(18237, "GET", "/check", ""), "never ran");
+    std::thread::sleep(Duration::from_millis(400));
+    assert_eq!(request(port, "GET", "/check", ""), "never ran");
 
     handle.stop();
 }
@@ -1584,13 +1460,14 @@ fn an_unawaited_fetch_does_not_extend_the_event_lifetime() {
             event.respondWith(new Response('answered'));
         }})"#
     );
-    let handle = start_serve_with(&handler, 18239, true);
+    let handle = start_serve_with(&handler, true);
+    let port = handle.port();
 
-    assert_eq!(request(18239, "GET", "/", ""), "answered");
+    assert_eq!(request(port, "GET", "/", ""), "answered");
     // The upstream never responds, so a request that waited for it would hold isolated mode's
     // single slot and leave this one queued behind it for good.
     assert_eq!(
-        request_within(18239, "/", Duration::from_secs(5)).as_deref(),
+        request_within(port, "/", Duration::from_secs(5)).as_deref(),
         Some("answered"),
         "the second request should not queue behind the first's abandoned fetch"
     );
@@ -1616,9 +1493,10 @@ fn an_interval_driven_stream_is_served_to_completion() {
             },
         })));
     })"#;
-    let handle = start_serve(handler, 18229);
+    let handle = start_serve(handler);
+    let port = handle.port();
 
-    let body = request(18229, "GET", "/", "");
+    let body = request(port, "GET", "/", "");
     assert_eq!(dechunk(&body), "tick 1 tick 2 tick 3 tick 4 tick 5 ");
 
     handle.stop();
@@ -1627,27 +1505,43 @@ fn an_interval_driven_stream_is_served_to_completion() {
 /// `--response-body-timeout` truncates a body the handler never finishes: the connection closes
 /// *without* the last-chunk terminator, so the client sees the truncation (RFC 9112 §7.1) instead
 /// of waiting forever on a response that looks like it is still coming.
+///
+/// Truncating the body ends the request's fetch (step 17.4.20 again), which reaches the handler
+/// through `request.signal` as a `TimeoutError`. The phases are independent windows: `waitUntil`
+/// work gets its own full `--waituntil-timeout`, counted from the response being over, not
+/// whatever the body left of it. Here the lifetime work runs for longer than the body's window and
+/// still finishes.
 #[test]
 fn a_response_body_timeout_truncates_a_body_that_never_ends() {
-    let handler = r#"addEventListener('fetch', (event) => {
+    let handler = r#"let aborted = 'not-aborted';
+    let lifetime = 'lifetime-work-did-not-finish';
+    addEventListener('fetch', (event) => {
+        const path = new URL(event.request.url).pathname;
+        if (path === '/observed') {
+            event.respondWith(new Response(aborted + ' ' + lifetime));
+            return;
+        }
+        const signal = event.request.signal;
+        signal.addEventListener('abort', () => { aborted = 'aborted:' + signal.reason.name; });
+        event.waitUntil(new Promise((resolve) => setTimeout(() => {
+            lifetime = 'lifetime-work-finished';
+            resolve();
+        }, 600)));
         event.respondWith(new Response(new ReadableStream({
             start(c) { setInterval(() => c.enqueue(new TextEncoder().encode('tick ')), 50); },
         })));
-    })"#;
-    let handle = start_serve_config(
-        RuntimeConfig {
-            eval_script: Some(handler.to_string()),
-            legacy_script: true,
-            serve: Some(18217),
-            response_body_timeout: Some(1),
-            ..Default::default()
-        },
-        18217,
-    );
-
-    let mut stream = TcpStream::connect(("127.0.0.1", 18217)).unwrap();
+    });"#;
+    let handle = start_serve_config(RuntimeConfig {
+        response_body_timeout: Some(Duration::from_millis(300)),
+        // The bound only has to clear the lifetime work, with room for a loaded machine.
+        waituntil_timeout: Some(Duration::from_secs(20)),
+        ..legacy_script(handler)
+    });
+    let port = handle.port();
+
+    let mut stream = TcpStream::connect(("127.0.0.1", port)).unwrap();
     stream
-        .write_all(b"GET / HTTP/1.1\r\nHost: localhost\r\nConnection: close\r\n\r\n")
+        .write_all(b"GET /stream HTTP/1.1\r\nHost: localhost\r\nConnection: close\r\n\r\n")
         .unwrap();
     let response = read_until_eof(&mut stream, Duration::from_secs(8))
         .expect("the timeout should close the connection, not leave it streaming");
@@ -1661,119 +1555,11 @@ fn a_response_body_timeout_truncates_a_body_that_never_ends() {
         "a cut body must not carry the complete-body terminator, got: {response}"
     );
 
-    handle.stop();
-}
-
-/// Truncating the body ends the request's fetch (step 17.4.20 again), which reaches the handler
-/// through `request.signal`. Its `waitUntil` work still gets its own full window afterwards,
-/// rather than what the truncated body left of one.
-#[test]
-fn a_response_body_timeout_aborts_the_request_signal() {
-    let handler = r#"let observed = 'no-request-yet';
-    addEventListener('fetch', (event) => {
-        const path = new URL(event.request.url).pathname;
-        if (path === '/observed') {
-            event.respondWith(new Response(observed));
-            return;
-        }
-        observed = 'not-aborted';
-        event.waitUntil(new Promise((resolve) => {
-            let tries = 0;
-            const check = () => {
-                if (event.request.signal.aborted) {
-                    observed = 'aborted:' + event.request.signal.reason.name;
-                    resolve();
-                } else if (++tries > 300) {
-                    resolve();
-                } else {
-                    setTimeout(check, 10);
-                }
-            };
-            setTimeout(check, 10);
-        }));
-        event.respondWith(new Response(new ReadableStream({
-            start(c) { setInterval(() => c.enqueue(new TextEncoder().encode('tick ')), 50); },
-        })));
-    });"#;
-    let handle = start_serve_config(
-        RuntimeConfig {
-            eval_script: Some(handler.to_string()),
-            legacy_script: true,
-            serve: Some(18219),
-            response_body_timeout: Some(1),
-            ..Default::default()
-        },
-        18219,
-    );
-
-    {
-        let mut stream = TcpStream::connect(("127.0.0.1", 18219)).unwrap();
-        stream
-            .write_all(b"GET /stream HTTP/1.1\r\nHost: localhost\r\nConnection: close\r\n\r\n")
-            .unwrap();
-        read_until_eof(&mut stream, Duration::from_secs(8))
-            .expect("the timeout should close the connection");
-    }
-
-    // The signal fires while the first request's lifetime work is still being drained, so
-    // truncating the body left that window open for the `waitUntil` promise to observe it in.
-    assert_eq!(
-        eventually(18219, "/observed", |seen| seen.starts_with("aborted:")),
-        "aborted:TimeoutError"
-    );
-
-    handle.stop();
-}
-
-/// The phases are independent windows: `waitUntil` work gets its own full `--waituntil-timeout`
-/// counted from the response being over, not whatever the body left of it. Here the body spends
-/// its entire 1s window and is then truncated, and lifetime work that runs for 2s afterwards still
-/// finishes. That is longer than the body's window and well inside its own.
-#[test]
-fn wait_until_gets_its_own_window_after_the_body_is_truncated() {
-    let handler = r#"let observed = 'no-request-yet';
-    addEventListener('fetch', (event) => {
-        const path = new URL(event.request.url).pathname;
-        if (path === '/observed') {
-            event.respondWith(new Response(observed));
-            return;
-        }
-        observed = 'lifetime-work-did-not-finish';
-        event.waitUntil(new Promise((resolve) => setTimeout(() => {
-            observed = 'lifetime-work-finished';
-            resolve();
-        }, 2000)));
-        event.respondWith(new Response(new ReadableStream({
-            start(c) { setInterval(() => c.enqueue(new TextEncoder().encode('tick ')), 50); },
-        })));
-    });"#;
-    let handle = start_serve_config(
-        RuntimeConfig {
-            eval_script: Some(handler.to_string()),
-            legacy_script: true,
-            serve: Some(18233),
-            response_body_timeout: Some(1),
-            // The bound only has to clear the 2s of lifetime work, with room for a loaded
-            // machine. We're testing that truncating the body left the window intact.
-            waituntil_timeout: Some(20),
-            ..Default::default()
-        },
-        18233,
-    );
-
-    {
-        let mut stream = TcpStream::connect(("127.0.0.1", 18233)).unwrap();
-        stream
-            .write_all(b"GET /stream HTTP/1.1\r\nHost: localhost\r\nConnection: close\r\n\r\n")
-            .unwrap();
-        read_until_eof(&mut stream, Duration::from_secs(8))
-            .expect("the body timeout should close the connection");
-    }
-
-    // The 2s of lifetime work runs inside its own window and finishes there.
     assert_eq!(
-        eventually(18233, "/observed", |seen| seen == "lifetime-work-finished"),
-        "lifetime-work-finished"
+        eventually(port, "/observed", |seen| {
+            seen.starts_with("aborted:") && seen.ends_with("-finished")
+        }),
+        "aborted:TimeoutError lifetime-work-finished"
     );
 
     handle.stop();
@@ -1789,24 +1575,19 @@ fn a_response_body_timeout_truncates_a_response_the_client_will_not_read() {
         "addEventListener('fetch', (event) => \
              event.respondWith(new Response(new Uint8Array({BODY_BYTES}))));"
     );
-    let handle = start_serve_config(
-        RuntimeConfig {
-            eval_script: Some(handler),
-            legacy_script: true,
-            serve: Some(18221),
-            response_body_timeout: Some(1),
-            ..Default::default()
-        },
-        18221,
-    );
+    let handle = start_serve_config(RuntimeConfig {
+        response_body_timeout: Some(Duration::from_millis(250)),
+        ..legacy_script(&handler)
+    });
+    let port = handle.port();
 
-    let mut stream = TcpStream::connect(("127.0.0.1", 18221)).unwrap();
+    let mut stream = TcpStream::connect(("127.0.0.1", port)).unwrap();
     stream
         .write_all(b"GET / HTTP/1.1\r\nHost: localhost\r\nConnection: close\r\n\r\n")
         .unwrap();
     // Read nothing while the timeout runs out, so the socket buffers fill and the server's write
     // parks. Only then start reading: what was buffered arrives, and the connection then ends.
-    std::thread::sleep(Duration::from_secs(3));
+    std::thread::sleep(Duration::from_millis(1000));
     let response = read_until_eof(&mut stream, Duration::from_secs(8))
         .expect("the timeout should close the connection under an unread response");
     assert!(
@@ -1828,18 +1609,13 @@ fn a_response_body_timeout_truncates_an_endless_proxied_body() {
         "addEventListener('fetch', (event) => \
              event.respondWith(fetch('http://127.0.0.1:{upstream}/')));"
     );
-    let handle = start_serve_config(
-        RuntimeConfig {
-            eval_script: Some(handler),
-            legacy_script: true,
-            serve: Some(18235),
-            response_body_timeout: Some(1),
-            ..Default::default()
-        },
-        18235,
-    );
+    let handle = start_serve_config(RuntimeConfig {
+        response_body_timeout: Some(Duration::from_millis(300)),
+        ..legacy_script(&handler)
+    });
+    let port = handle.port();
 
-    let mut stream = TcpStream::connect(("127.0.0.1", 18235)).unwrap();
+    let mut stream = TcpStream::connect(("127.0.0.1", port)).unwrap();
     stream
         .write_all(b"GET / HTTP/1.1\r\nHost: localhost\r\nConnection: close\r\n\r\n")
         .unwrap();
@@ -1867,18 +1643,13 @@ fn an_end_to_end_timeout_truncates_a_streaming_body() {
             start(c) { setInterval(() => c.enqueue(new TextEncoder().encode('tick ')), 50); },
         })));
     })"#;
-    let handle = start_serve_config(
-        RuntimeConfig {
-            eval_script: Some(handler.to_string()),
-            legacy_script: true,
-            serve: Some(18223),
-            end_to_end_timeout: Some(1),
-            ..Default::default()
-        },
-        18223,
-    );
-
-    let mut stream = TcpStream::connect(("127.0.0.1", 18223)).unwrap();
+    let handle = start_serve_config(RuntimeConfig {
+        end_to_end_timeout: Some(Duration::from_millis(300)),
+        ..legacy_script(handler)
+    });
+    let port = handle.port();
+
+    let mut stream = TcpStream::connect(("127.0.0.1", port)).unwrap();
     stream
         .write_all(b"GET / HTTP/1.1\r\nHost: localhost\r\nConnection: close\r\n\r\n")
         .unwrap();
@@ -1897,18 +1668,13 @@ fn an_end_to_end_timeout_truncates_a_streaming_body() {
 #[test]
 fn an_end_to_end_timeout_answers_a_never_settling_dispatch() {
     let handler = "addEventListener('fetch', (e) => e.respondWith(new Promise(() => {})));";
-    let handle = start_serve_config(
-        RuntimeConfig {
-            eval_script: Some(handler.to_string()),
-            legacy_script: true,
-            serve: Some(18225),
-            end_to_end_timeout: Some(1),
-            ..Default::default()
-        },
-        18225,
-    );
-
-    let mut stream = TcpStream::connect(("127.0.0.1", 18225)).unwrap();
+    let handle = start_serve_config(RuntimeConfig {
+        end_to_end_timeout: Some(Duration::from_millis(250)),
+        ..legacy_script(handler)
+    });
+    let port = handle.port();
+
+    let mut stream = TcpStream::connect(("127.0.0.1", port)).unwrap();
     stream
         .write_all(b"GET / HTTP/1.1\r\nHost: localhost\r\nConnection: close\r\n\r\n")
         .unwrap();
@@ -1938,24 +1704,19 @@ fn an_end_to_end_timeout_stops_leftover_lifetime_work() {
         event.waitUntil(new Promise(() => {}));
         event.respondWith(new Response('started'));
     });"#;
-    let handle = start_serve_config(
-        RuntimeConfig {
-            eval_script: Some(handler.to_string()),
-            legacy_script: true,
-            serve: Some(18227),
-            end_to_end_timeout: Some(1),
-            ..Default::default()
-        },
-        18227,
-    );
-
-    assert_eq!(request(18227, "GET", "/", ""), "started");
+    let handle = start_serve_config(RuntimeConfig {
+        end_to_end_timeout: Some(Duration::from_millis(300)),
+        ..legacy_script(handler)
+    });
+    let port = handle.port();
+
+    assert_eq!(request(port, "GET", "/", ""), "started");
     // Well past the deadline, the interval must have stopped: two samples with a gap between
     // them read the same count.
-    std::thread::sleep(Duration::from_millis(2000));
-    let first = request(18227, "GET", "/ticks", "");
-    std::thread::sleep(Duration::from_millis(600));
-    let second = request(18227, "GET", "/ticks", "");
+    std::thread::sleep(Duration::from_millis(700));
+    let first = request(port, "GET", "/ticks", "");
+    std::thread::sleep(Duration::from_millis(300));
+    let second = request(port, "GET", "/ticks", "");
     // A frozen counter only means the deadline stopped the work if the work was running in the
     // first place: an interval that never ticked at all would read the same twice too.
     assert!(
@@ -1972,30 +1733,27 @@ fn an_end_to_end_timeout_stops_leftover_lifetime_work() {
 
 /// In isolated mode the content script runs per request, so its startup is request work too:
 /// `--end-to-end-timeout` bounds a startup that dawdles, sending a 500 rather than making every
-/// request wait it out.
+/// request wait it out. The script awaits a timer before registering its listener, so the 500
+/// cannot come from a script that finished without one.
 #[test]
 fn an_end_to_end_timeout_bounds_isolated_startup() {
-    let handler = r#"setTimeout(() => {
-        addEventListener('fetch', (e) => e.respondWith(new Response('late')));
-    }, 5000);"#;
-    let handle = start_serve_config(
-        RuntimeConfig {
-            eval_script: Some(handler.to_string()),
-            legacy_script: true,
-            serve: Some(18231),
-            serve_isolated: true,
-            end_to_end_timeout: Some(1),
-            ..Default::default()
-        },
-        18231,
-    );
+    let handler = r#"await new Promise((resolve) => setTimeout(resolve, 5000));
+    addEventListener('fetch', (e) => e.respondWith(new Response('late')));"#;
+    let deadline = Duration::from_millis(250);
+    let handle = start_serve_config(RuntimeConfig {
+        eval_script: Some(handler.to_string()),
+        serve_isolated: true,
+        end_to_end_timeout: Some(deadline),
+        ..Default::default()
+    });
+    let port = handle.port();
 
     let started = std::time::Instant::now();
-    assert_eq!(request(18231, "GET", "/", ""), "Internal Server Error");
+    assert_eq!(request(port, "GET", "/", ""), "Internal Server Error");
+    let elapsed = started.elapsed();
     assert!(
-        started.elapsed() < Duration::from_secs(4),
-        "the deadline should cut startup short, not wait for it (took {:?})",
-        started.elapsed()
+        elapsed >= deadline && elapsed < Duration::from_secs(4),
+        "the deadline should cut startup short, not wait for it (took {elapsed:?})"
     );
 
     handle.stop();
@@ -2007,13 +1765,10 @@ fn an_end_to_end_timeout_bounds_isolated_startup() {
 fn a_script_with_no_fetch_listener_refuses_to_serve() {
     libstarling::register_builtins();
     let config = RuntimeConfig {
-        eval_script: Some("globalThis.ready = true;".to_string()),
-        legacy_script: true,
-        serve: Some(18245),
-        ..Default::default()
+        ..legacy_script("globalThis.ready = true;")
     };
-    let error =
-        libstarling::serve_native::serve_with_shutdown(config, 18245, async {}).unwrap_err();
+    let error = libstarling::serve_native::serve_with_shutdown(config, bind_local().0, async {})
+        .unwrap_err();
     assert!(
         error.contains("fetch"),
         "the error should name what is missing, got: {error}"
@@ -2032,11 +1787,10 @@ fn a_late_top_level_rejection_refuses_to_serve() {
              throw new Error('late configuration failure');"
                 .to_string(),
         ),
-        serve: Some(18473),
         ..Default::default()
     };
-    let error =
-        libstarling::serve_native::serve_with_shutdown(config, 18473, async {}).unwrap_err();
+    let error = libstarling::serve_native::serve_with_shutdown(config, bind_local().0, async {})
+        .unwrap_err();
     assert!(error.contains("late configuration failure"), "got: {error}");
 }
 
@@ -2044,75 +1798,45 @@ fn a_late_top_level_rejection_refuses_to_serve() {
 /// listener fails the request whose evaluation it belongs to, which gets a 500.
 #[test]
 fn an_isolated_late_top_level_rejection_fails_the_request() {
-    let handle = start_serve_config(
-        RuntimeConfig {
-            eval_script: Some(
-                "addEventListener('fetch', (event) => event.respondWith(new Response('served')));\n\
+    let handle = start_serve_config(RuntimeConfig {
+        eval_script: Some(
+            "addEventListener('fetch', (event) => event.respondWith(new Response('served')));\n\
                  await new Promise((resolve) => setTimeout(resolve, 10));\n\
                  throw new Error('late configuration failure');"
-                    .to_string(),
-            ),
-            serve: Some(18475),
-            serve_isolated: true,
-            ..Default::default()
-        },
-        18475,
-    );
+                .to_string(),
+        ),
+        serve_isolated: true,
+        ..Default::default()
+    });
+    let port = handle.port();
 
-    assert_eq!(request(18475, "GET", "/", ""), "Internal Server Error");
-    assert_eq!(request(18475, "GET", "/", ""), "Internal Server Error");
+    assert_eq!(request(port, "GET", "/", ""), "Internal Server Error");
+    assert_eq!(request(port, "GET", "/", ""), "Internal Server Error");
 
     handle.stop();
 }
 
-/// A phase timeout longer than `--end-to-end-timeout` is a contradiction the server refuses to
-/// start with, rather than quietly serving with a window the deadline never lets a phase use.
+/// The server refuses to start with a phase timeout longer than `--end-to-end-timeout`, rather
+/// than quietly serving with a window that the deadline never lets a phase use.
 #[test]
 fn a_contradictory_timeout_config_refuses_to_serve() {
     libstarling::register_builtins();
     let config = RuntimeConfig {
-        eval_script: Some("addEventListener('fetch', () => {});".to_string()),
-        legacy_script: true,
-        serve: Some(18341),
-        end_to_end_timeout: Some(5),
-        waituntil_timeout: Some(6),
-        ..Default::default()
+        end_to_end_timeout: Some(Duration::from_secs(5)),
+        waituntil_timeout: Some(Duration::from_secs(6)),
+        ..legacy_script("addEventListener('fetch', () => {});")
     };
-    let error =
-        libstarling::serve_native::serve_with_shutdown(config, 18341, async {}).unwrap_err();
+    let error = libstarling::serve_native::serve_with_shutdown(config, bind_local().0, async {})
+        .unwrap_err();
     assert!(
         error.contains("--waituntil-timeout") && error.contains("--end-to-end-timeout"),
         "got: {error}"
     );
 }
 
-/// `--dispatch-timeout` bounds a `respondWith` that never settles. Without one — the default — the
-/// request would wait for as long as the handler takes, which is why the timeout is opt-in.
-#[test]
-fn a_dispatch_timeout_answers_a_never_settling_respond_with() {
-    let handler = "addEventListener('fetch', (e) => e.respondWith(new Promise(() => {})));";
-    let handle = start_serve_config(
-        RuntimeConfig {
-            eval_script: Some(handler.to_string()),
-            legacy_script: true,
-            serve: Some(18213),
-            dispatch_timeout: Some(1),
-            waituntil_timeout: Some(1),
-            ..Default::default()
-        },
-        18213,
-    );
-
-    let start = std::time::Instant::now();
-    assert_eq!(request(18213, "GET", "/", ""), "Internal Server Error");
-    assert!(
-        start.elapsed() < Duration::from_secs(30),
-        "the timeout should have answered the request, not the test harness"
-    );
-
-    handle.stop();
-}
-
+/// `--dispatch-timeout` bounds a `respondWith` that never settles, answering it with a 500. Without
+/// one, which is the default, the request waits for as long as the handler takes.
+///
 /// Answering a timed-out request has to release its slot too, or one such request costs a slot for
 /// the whole `--waituntil-timeout` window — and with none configured, which is the default, costs
 /// it permanently. `--serve-isolated` gives the server a single slot, so the follow-up request only
@@ -2123,21 +1847,16 @@ fn a_dispatch_timeout_frees_the_slot_it_held() {
         if (new URL(e.request.url).pathname === '/ok') { e.respondWith(new Response('ok')); return; }
         e.respondWith(new Promise(() => {}));
     });"#;
-    let handle = start_serve_config(
-        RuntimeConfig {
-            eval_script: Some(handler.to_string()),
-            legacy_script: true,
-            serve: Some(18289),
-            serve_isolated: true,
-            dispatch_timeout: Some(1),
-            ..Default::default()
-        },
-        18289,
-    );
-
-    assert_eq!(request(18289, "GET", "/hang", ""), "Internal Server Error");
+    let handle = start_serve_config(RuntimeConfig {
+        serve_isolated: true,
+        dispatch_timeout: Some(Duration::from_millis(250)),
+        ..legacy_script(handler)
+    });
+    let port = handle.port();
+
+    assert_eq!(request(port, "GET", "/hang", ""), "Internal Server Error");
     assert_eq!(
-        request_within(18289, "/ok", Duration::from_secs(10)).as_deref(),
+        request_within(port, "/ok", Duration::from_secs(10)).as_deref(),
         Some("ok"),
         "the timed-out request never released the server's only in-flight slot"
     );
@@ -2145,32 +1864,6 @@ fn a_dispatch_timeout_frees_the_slot_it_held() {
     handle.stop();
 }
 
-/// `Response.redirect` on the way out: the status and the `Location` header both have to survive
-/// serialization. WPT `resources/redirect-worker.js` (`sw=gen`) covers the same ground.
-#[test]
-fn serve_delivers_a_redirect_response() {
-    let handler =
-        "addEventListener('fetch', (e) => e.respondWith(Response.redirect('http://example.com/there', 302)));";
-    let handle = start_serve(handler, 18247);
-
-    let response = raw_request(
-        18247,
-        b"GET / HTTP/1.1\r\nHost: x\r\nConnection: close\r\n\r\n",
-    );
-    assert!(
-        response.starts_with("HTTP/1.1 302 "),
-        "expected a 302 status line, got: {response}"
-    );
-    assert!(
-        response
-            .to_lowercase()
-            .contains("location: http://example.com/there"),
-        "the Location header must reach the wire: {response}"
-    );
-
-    handle.stop();
-}
-
 /// Every body source a `Response` can be built from, and the `Content-Type` each implies —
 /// WPT `resources/fetch-event-respond-with-custom-response-worker.js`. `Blob` and `FormData` are
 /// not implemented here, so the list is what this runtime actually has.
@@ -2192,7 +1885,8 @@ fn serve_delivers_every_body_source() {
             event.respondWith(make ? make() : new Response('no such source', { status: 404 }));
         });
     "#;
-    let handle = start_serve(handler, 18249);
+    let handle = start_serve(handler);
+    let port = handle.port();
 
     for (path, expected_body, expected_type) in [
         ("/string", "plain text", "text/plain;charset=UTF-8"),
@@ -2206,7 +1900,7 @@ fn serve_delivers_every_body_source() {
         ("/null", "", ""),
     ] {
         let response = raw_request(
-            18249,
+            port,
             format!("GET {path} HTTP/1.1\r\nHost: x\r\nConnection: close\r\n\r\n").as_bytes(),
         );
         let (head, body) = response
@@ -2239,9 +1933,10 @@ fn a_rejected_wait_until_does_not_break_the_response() {
         event.waitUntil(Promise.reject(new Error('waitUntil failed')));
         event.respondWith(new Response('answered anyway'));
     })"#;
-    let handle = start_serve(handler, 18251);
+    let handle = start_serve(handler);
+    let port = handle.port();
 
-    assert_eq!(request(18251, "GET", "/", ""), "answered anyway");
+    assert_eq!(request(port, "GET", "/", ""), "answered anyway");
 
     handle.stop();
 }
@@ -2264,9 +1959,10 @@ fn serve_streams_an_empty_chunk_without_ending_the_body() {
             },
         })));
     })"#;
-    let handle = start_serve(handler, 18253);
+    let handle = start_serve(handler);
+    let port = handle.port();
 
-    let body = request(18253, "GET", "/", "");
+    let body = request(port, "GET", "/", "");
     assert_eq!(
         dechunk(&body),
         "chunk one chunk two",
@@ -2288,45 +1984,28 @@ fn serve_streams_an_empty_chunk_without_ending_the_body() {
 /// bytes leaves the client waiting for 9995 that never come.
 #[test]
 fn serve_frames_a_response_by_its_body_not_the_handlers_content_length() {
-    let handler = r#"
-        const cases = {
-            // Longer than the body.
-            '/larger': () => new Response('short', { headers: { 'content-length': '10000' } }),
-            // Not a number at all.
-            '/bogus': () => new Response('short', { headers: { 'content-length': 'test' } }),
-            // Two of them, which combine into one comma-joined value.
-            '/duplicate': () => {
-                const headers = new Headers();
-                headers.append('content-length', '10000');
-                headers.append('content-length', '10000');
-                return new Response('short', { headers });
-            },
-        };
-        addEventListener('fetch', (event) => {
-            const make = cases[new URL(event.request.url).pathname];
-            event.respondWith(make());
-        });
-    "#;
-    let handle = start_serve(handler, 18255);
+    let handler = r#"addEventListener('fetch', (event) => {
+        event.respondWith(new Response('short', { headers: { 'content-length': '10000' } }));
+    })"#;
+    let handle = start_serve(handler);
+    let port = handle.port();
 
-    for path in ["/larger", "/bogus", "/duplicate"] {
-        let response = raw_request(
-            18255,
-            format!("GET {path} HTTP/1.1\r\nHost: x\r\nConnection: close\r\n\r\n").as_bytes(),
-        );
-        let (head, body) = response
-            .split_once("\r\n\r\n")
-            .expect("a complete response");
-        assert_eq!(body, "short", "body for {path}: {response}");
-        assert!(
-            head.to_lowercase().contains("content-length: 5"),
-            "the wire length must describe the body, not the handler's header, for {path}: {head}"
-        );
-        assert!(
-            !head.contains("10000") && !head.to_lowercase().contains("content-length: test"),
-            "the handler's own length must not reach the wire for {path}: {head}"
-        );
-    }
+    let response = raw_request(
+        port,
+        b"GET / HTTP/1.1\r\nHost: x\r\nConnection: close\r\n\r\n",
+    );
+    let (head, body) = response
+        .split_once("\r\n\r\n")
+        .expect("a complete response");
+    assert_eq!(body, "short", "got: {response}");
+    assert!(
+        head.to_lowercase().contains("content-length: 5"),
+        "the wire length must describe the body, not the handler's header: {head}"
+    );
+    assert!(
+        !head.contains("10000"),
+        "the handler's own length must not reach the wire: {head}"
+    );
 
     handle.stop();
 }
@@ -2349,9 +2028,6 @@ fn serve_frames_a_streamed_body_by_its_declared_content_length() {
             });
         }
         const cases = {
-            '/exact': () => new Response(stream(['abc', 'de']), {
-                headers: { 'content-length': '5' },
-            }),
             // More content than it declared: the excess never reaches the wire.
             '/longer': () => new Response(stream(['abcde', 'XXXXX']), {
                 headers: { 'content-length': '5' },
@@ -2364,38 +2040,36 @@ fn serve_frames_a_streamed_body_by_its_declared_content_length() {
             '/bogus': () => new Response(stream(['abcde']), {
                 headers: { 'content-length': 'test' },
             }),
-            '/undeclared': () => new Response(stream(['abcde'])),
         };
         addEventListener('fetch', (event) => {
             const make = cases[new URL(event.request.url).pathname];
             event.respondWith(make());
         });
     "#;
-    let handle = start_serve(handler, 18257);
+    let handle = start_serve(handler);
+    let port = handle.port();
 
-    for (path, body) in [("/exact", "abcde"), ("/longer", "abcde")] {
-        let response = raw_request(
-            18257,
-            format!("GET {path} HTTP/1.1\r\nHost: x\r\nConnection: close\r\n\r\n").as_bytes(),
-        );
-        let (head, sent) = response
-            .split_once("\r\n\r\n")
-            .expect("a complete response");
-        assert!(
-            head.to_lowercase().contains("content-length: 5"),
-            "the declared length must frame {path}: {head}"
-        );
-        assert!(
-            !head.to_lowercase().contains("transfer-encoding"),
-            "a declared length leaves nothing for chunked to frame, for {path}: {head}"
-        );
-        assert_eq!(sent, body, "body for {path}: {response}");
-    }
+    let response = raw_request(
+        port,
+        b"GET /longer HTTP/1.1\r\nHost: x\r\nConnection: close\r\n\r\n",
+    );
+    let (head, sent) = response
+        .split_once("\r\n\r\n")
+        .expect("a complete response");
+    assert!(
+        head.to_lowercase().contains("content-length: 5"),
+        "the declared length must frame the response: {head}"
+    );
+    assert!(
+        !head.to_lowercase().contains("transfer-encoding"),
+        "a declared length leaves nothing for chunked to frame: {head}"
+    );
+    assert_eq!(sent, "abcde", "got: {response}");
 
     // The head is framed by the declared length, and the body stops short of it, so the client
     // reads a truncated message rather than a complete-looking one.
     let response = raw_request(
-        18257,
+        port,
         b"GET /shorter HTTP/1.1\r\nHost: x\r\nConnection: close\r\n\r\n",
     );
     let (head, sent) = response
@@ -2410,21 +2084,19 @@ fn serve_frames_a_streamed_body_by_its_declared_content_length() {
         "the body must stop short of the length it declared: {response:?}"
     );
 
-    for path in ["/bogus", "/undeclared"] {
-        let response = raw_request(
-            18257,
-            format!("GET {path} HTTP/1.1\r\nHost: x\r\nConnection: close\r\n\r\n").as_bytes(),
-        );
-        let (head, sent) = response
-            .split_once("\r\n\r\n")
-            .expect("a complete response");
-        assert!(
-            head.to_lowercase().contains("transfer-encoding: chunked"),
-            "with no length to frame by, {path} is chunked: {head}"
-        );
-        assert!(!head.contains("test"), "got: {head}");
-        assert_eq!(dechunk(sent), "abcde", "body for {path}: {response}");
-    }
+    let response = raw_request(
+        port,
+        b"GET /bogus HTTP/1.1\r\nHost: x\r\nConnection: close\r\n\r\n",
+    );
+    let (head, sent) = response
+        .split_once("\r\n\r\n")
+        .expect("a complete response");
+    assert!(
+        head.to_lowercase().contains("transfer-encoding: chunked"),
+        "with no length to frame by, the response is chunked: {head}"
+    );
+    assert!(!head.contains("test"), "got: {head}");
+    assert_eq!(dechunk(sent), "abcde", "got: {response}");
 
     handle.stop();
 }
@@ -2442,10 +2114,11 @@ fn serve_forwards_an_upstreams_content_length() {
             }}));
         }})"#
     );
-    let handle = start_serve(&handler, 18259);
+    let handle = start_serve(&handler);
+    let port = handle.port();
 
     let response = raw_request(
-        18259,
+        port,
         b"GET / HTTP/1.1\r\nHost: x\r\nConnection: close\r\n\r\n",
     );
     let (head, body) = response
@@ -2464,52 +2137,29 @@ fn serve_forwards_an_upstreams_content_length() {
     handle.stop();
 }
 
-/// A header value carrying a null byte is refused where it is built, not on the way out. WPT
-/// `resources/invalid-header-worker.js` expects the *response* to become a network error, which is
-/// how a browser reports it; here `Headers` rejects the value outright, so the handler never gets a
-/// `Response` to respond with. Either way the bytes never reach the wire, which is the point.
-#[test]
-fn a_response_header_value_with_a_null_byte_is_refused() {
-    let handler = r#"addEventListener('fetch', (event) => {
-        let outcome;
-        try {
-            new Response('x', { headers: { 'x-test': 'b\0r' } });
-            outcome = 'constructed';
-        } catch (e) {
-            outcome = e.name;
-        }
-        event.respondWith(new Response(outcome));
-    })"#;
-    let handle = start_serve(handler, 18343);
-
-    assert_eq!(request(18343, "GET", "/", ""), "TypeError");
-
-    handle.stop();
-}
-
 /// A response body that errors after sending bytes: the client gets what was produced, and then the
 /// connection ends *without* the terminating zero-length chunk, so a truncated body cannot be
 /// mistaken for a complete one. WPT `resources/fetch-error-worker.js` asserts the read rejects
 /// rather than hanging; on the wire the missing terminator is what carries that.
 #[test]
 fn a_response_stream_that_errors_mid_flight_leaves_the_body_unterminated() {
-    // The error comes from a timer, and a generous one. A body cannot outlive its request's event
-    // loop going idle, so the stream holds the loop open until it errors rather than waiting for
-    // the client. The delay only has to outlast the pump reaching the wire, which a GC zeal build
-    // makes much slower.
+    // The second `pull()` errors the stream. It only runs once the first chunk has been read out of
+    // the stream's queue, so the error cannot discard that chunk.
     let handler = r#"addEventListener('fetch', (event) => {
         const encoder = new TextEncoder();
+        let pulls = 0;
         event.respondWith(new Response(new ReadableStream({
-            start(c) {
-                c.enqueue(encoder.encode('first-chunk-'));
-                setTimeout(() => c.error(new Error('stream broke')), 1000);
+            pull(c) {
+                if (++pulls === 1) c.enqueue(encoder.encode('first-chunk-'));
+                else c.error(new Error('stream broke'));
             },
         })));
     })"#;
-    let handle = start_serve(handler, 18339);
+    let handle = start_serve(handler);
+    let port = handle.port();
 
     let response = raw_request(
-        18339,
+        port,
         b"GET / HTTP/1.1\r\nHost: x\r\nConnection: close\r\n\r\n",
     );
     let (_, body) = response.split_once("\r\n\r\n").expect("a complete head");
@@ -2539,8 +2189,9 @@ fn serve_streams_many_queued_chunks_in_order() {
             },
         })));
     })"#;
-    let handle = start_serve(handler, 18471);
-    let body = request(18471, "GET", "/", "");
+    let handle = start_serve(handler);
+    let port = handle.port();
+    let body = request(port, "GET", "/", "");
     let expected: String = (0..100)
         .map(|i| format!("{:03}", i).repeat(341) + "|")
         .collect();
@@ -2548,8 +2199,9 @@ fn serve_streams_many_queued_chunks_in_order() {
     handle.stop();
 }
 
-/// Chunks queued ahead of an invalid chunk are written before the body errors, and the body then
-/// ends unterminated.
+/// Chunks queued ahead of a chunk that is not a `Uint8Array` are written before the body errors,
+/// and the body then ends unterminated after a `200` head. WPT
+/// `resources/fetch-event-respond-with-response-body-with-invalid-chunk-worker.js`.
 #[test]
 fn queued_chunks_before_an_invalid_chunk_are_written_before_the_error() {
     let handler = r#"addEventListener('fetch', (event) => {
@@ -2563,47 +2215,19 @@ fn queued_chunks_before_an_invalid_chunk_are_written_before_the_error() {
             },
         })));
     })"#;
-    let handle = start_serve(handler, 18472);
+    let handle = start_serve(handler);
+    let port = handle.port();
     let response = raw_request(
-        18472,
+        port,
         b"GET / HTTP/1.1\r\nHost: x\r\nConnection: close\r\n\r\n",
     );
-    let (_, body) = response.split_once("\r\n\r\n").expect("a complete head");
+    let (head, body) = response.split_once("\r\n\r\n").expect("a complete head");
+    assert!(head.starts_with("HTTP/1.1 200 "), "got: {response}");
     assert!(body.contains("first-second-"), "got: {response}");
     assert!(!body.ends_with("0\r\n\r\n"), "got: {response}");
     handle.stop();
 }
 
-/// The same, for a stream that enqueues something that is not a `Uint8Array`: the body errors
-/// before any byte is written, so the head is already committed and the connection ends
-/// unterminated. WPT
-/// `resources/fetch-event-respond-with-response-body-with-invalid-chunk-worker.js`.
-#[test]
-fn a_response_stream_with_an_invalid_chunk_leaves_the_body_unterminated() {
-    let handler = r#"addEventListener('fetch', (event) => {
-        event.respondWith(new Response(new ReadableStream({
-            start(c) { c.enqueue('a string, not a Uint8Array'); c.close(); },
-        })));
-    })"#;
-    let handle = start_serve(handler, 18261);
-
-    let response = raw_request(
-        18261,
-        b"GET / HTTP/1.1\r\nHost: x\r\nConnection: close\r\n\r\n",
-    );
-    let (head, body) = response.split_once("\r\n\r\n").expect("a complete head");
-    assert!(
-        head.starts_with("HTTP/1.1 200 "),
-        "the head goes out before the first chunk is pulled, so it is still a 200: {response}"
-    );
-    assert!(
-        !body.ends_with("0\r\n\r\n"),
-        "a body that never produced a valid chunk must not be terminated: {response}"
-    );
-
-    handle.stop();
-}
-
 /// An unusual status reaches the client untouched, and the request behind it is dispatched exactly
 /// once — nothing retries it. WPT `fetch-event.https.html` pins this with a 421 (`Misdirected
 /// Request`), the status a client is most tempted to retry elsewhere, and asserts the origin saw
@@ -2624,10 +2248,11 @@ fn serve_delivers_an_unusual_status_without_retrying_it() {
             event.respondWith(new Response('misdirected', { status: 421 }));
         });
     "#;
-    let handle = start_serve(handler, 18263);
+    let handle = start_serve(handler);
+    let port = handle.port();
 
     let response = raw_request(
-        18263,
+        port,
         b"GET / HTTP/1.1\r\nHost: x\r\nConnection: close\r\n\r\n",
     );
     assert!(
@@ -2640,7 +2265,7 @@ fn serve_delivers_an_unusual_status_without_retrying_it() {
     );
 
     assert_eq!(
-        request(18263, "GET", "/count", ""),
+        request(port, "GET", "/count", ""),
         "dispatched 1 times",
         "a 421 must not be retried behind the handler's back"
     );
@@ -2658,7 +2283,8 @@ fn serve_exposes_a_urlencoded_post_to_the_handler() {
             event.request.method + ':' + event.request.headers.get('content-type') + ':' + body,
         )));
     })"#;
-    let handle = start_serve(handler, 18265);
+    let handle = start_serve(handler);
+    let port = handle.port();
 
     let body = "testName1=testValue1&testName2=testValue2";
     let raw = format!(
@@ -2666,7 +2292,7 @@ fn serve_exposes_a_urlencoded_post_to_the_handler() {
          Content-Length: {}\r\nConnection: close\r\n\r\n{body}",
         body.len()
     );
-    let response = raw_request(18265, raw.as_bytes());
+    let response = raw_request(port, raw.as_bytes());
     let (_, got) = response
         .split_once("\r\n\r\n")
         .expect("a complete response");
@@ -2686,10 +2312,8 @@ fn serve_exposes_a_urlencoded_post_to_the_handler() {
 /// that.
 #[test]
 fn a_handler_can_fetch_its_own_server() {
-    // The handler addresses itself, so the port is bound once and interpolated: a renumbering that
-    // updated only `start_serve` would otherwise leave this fetching a dead — or worse, another
-    // test's — port, and fail as something other than the deadlock this is watching for.
-    let port = 18267;
+    // The handler addresses itself, so its port is bound before the handler is written.
+    let (listener, port) = bind_local();
     let handler = format!(
         r#"addEventListener('fetch', (event) => {{
             const path = new URL(event.request.url).pathname;
@@ -2704,7 +2328,7 @@ fn a_handler_can_fetch_its_own_server() {
             );
         }})"#
     );
-    let handle = start_serve(&handler, port);
+    let handle = start_serve_on(listener, legacy_script(&handler));
 
     assert_eq!(
         request_within(port, "/outer", Duration::from_secs(10)).as_deref(),
@@ -2750,12 +2374,13 @@ fn serve_exposes_the_incoming_request_shape() {
             'type=' + event.type,
         ].join('\n')));
     })"#;
-    let handle = start_serve(handler, 18269);
+    let handle = start_serve(handler);
+    let port = handle.port();
 
     // The URL is rebuilt from the request target and the `Host` header — this helper sends
     // `Host: localhost`, with no port, and that is exactly what comes back.
     assert_eq!(
-        request(18269, "GET", "/shape?q=1", ""),
+        request(port, "GET", "/shape?q=1", ""),
         [
             "method=GET",
             "url=http://localhost/shape?q=1",
@@ -2791,10 +2416,11 @@ fn serve_exposes_the_incoming_request_shape() {
 fn serve_answers_a_head_request_without_a_body() {
     let handler =
         "addEventListener('fetch', (e) => e.respondWith(new Response('BODYBYTES', { status: 201 })));";
-    let handle = start_serve(handler, 18271);
+    let handle = start_serve(handler);
+    let port = handle.port();
 
     let response = raw_request(
-        18271,
+        port,
         b"HEAD / HTTP/1.1\r\nHost: x\r\nConnection: close\r\n\r\n",
     );
     let (head, body) = response.split_once("\r\n\r\n").expect("a complete head");
@@ -2829,10 +2455,11 @@ fn a_head_request_does_not_run_the_body_it_will_not_send() {
             },
         })));
     })"#;
-    let handle = start_serve(handler, 18297);
+    let handle = start_serve(handler);
+    let port = handle.port();
 
     let response = raw_request(
-        18297,
+        port,
         b"HEAD / HTTP/1.1\r\nHost: x\r\nConnection: close\r\n\r\n",
     );
     assert!(response.starts_with("HTTP/1.1 200 "), "got: {response}");
@@ -2845,7 +2472,7 @@ fn a_head_request_does_not_run_the_body_it_will_not_send() {
     // The stream is constructed either way, which pulls once to fill its queue; what must not
     // happen is the send pump reading from it on top of that.
     assert_eq!(
-        request(18297, "GET", "/pulls", ""),
+        request(port, "GET", "/pulls", ""),
         "1",
         "the handler's pull() ran for a body the HEAD response never carried"
     );
@@ -2854,57 +2481,32 @@ fn a_head_request_does_not_run_the_body_it_will_not_send() {
 }
 
 /// A `204 No Content` is framed by its status: no `Content-Length`, no `Transfer-Encoding` (RFC
-/// 9110 §8.6, RFC 9112 §6.2). The same holds for `304`.
+/// 9110 §8.6, RFC 9112 §6.2).
 #[test]
 fn a_bodiless_status_has_no_framing_headers() {
     let handler = r#"addEventListener('fetch', (event) => {
-        const status = Number(new URL(event.request.url).pathname.slice(1));
-        event.respondWith(new Response(null, { status }));
+        event.respondWith(new Response(null, { status: 204 }));
     })"#;
-    let handle = start_serve(handler, 18273);
-
-    for status in [204, 304] {
-        let response = raw_request(
-            18273,
-            format!("GET /{status} HTTP/1.1\r\nHost: x\r\nConnection: close\r\n\r\n").as_bytes(),
-        );
-        let head = response
-            .split_once("\r\n\r\n")
-            .map_or(&*response, |(h, _)| h);
-        let head = head.to_lowercase();
-
-        assert!(
-            !head.contains("content-length"),
-            "a {status} must not be framed with Content-Length: {response}"
-        );
-        assert!(
-            !head.contains("transfer-encoding"),
-            "a {status} must not be framed with Transfer-Encoding: {response}"
-        );
-    }
-
-    handle.stop();
-}
-
-/// `respondWith(response)` consumes the response's body, so `bodyUsed` reads true afterwards —
-/// WPT `fetch-event.https.html` (`?used-check`), which reads the flag back on a later request.
-#[test]
-fn respond_with_marks_the_response_body_used() {
-    let handler = r#"
-        globalThis.stored = null;
-        addEventListener('fetch', (event) => {
-            if (new URL(event.request.url).pathname === '/check') {
-                event.respondWith(new Response('bodyUsed: ' + globalThis.stored.bodyUsed));
-                return;
-            }
-            globalThis.stored = new Response('payload');
-            event.respondWith(globalThis.stored);
-        });
-    "#;
-    let handle = start_serve(handler, 18275);
+    let handle = start_serve(handler);
+    let port = handle.port();
 
-    assert_eq!(request(18275, "GET", "/", ""), "payload");
-    assert_eq!(request(18275, "GET", "/check", ""), "bodyUsed: true");
+    let response = raw_request(
+        port,
+        b"GET / HTTP/1.1\r\nHost: x\r\nConnection: close\r\n\r\n",
+    );
+    let head = response
+        .split_once("\r\n\r\n")
+        .map_or(&*response, |(h, _)| h)
+        .to_lowercase();
+    assert!(head.starts_with("http/1.1 204"), "got: {response}");
+    assert!(
+        !head.contains("content-length"),
+        "a 204 must not be framed with Content-Length: {response}"
+    );
+    assert!(
+        !head.contains("transfer-encoding"),
+        "a 204 must not be framed with Transfer-Encoding: {response}"
+    );
 
     handle.stop();
 }
@@ -2912,7 +2514,8 @@ fn respond_with_marks_the_response_body_used() {
 /// Sending a response hands its bytes to the transport rather than copying them, so the `Response`
 /// is left holding none of the buffer. What content sees must not move with them: the body still
 /// reads as one that was read — a consumed stream that cannot be read again — rather than as a body
-/// that was never there.
+/// that was never there. `respondWith` marks it used, so `bodyUsed` reads true, as WPT
+/// `fetch-event.https.html` (`?used-check`) checks.
 #[test]
 fn a_sent_byte_body_reads_as_consumed_rather_than_absent() {
     let handler = r#"
@@ -2920,6 +2523,7 @@ fn a_sent_byte_body_reads_as_consumed_rather_than_absent() {
         addEventListener('fetch', (event) => {
             if (new URL(event.request.url).pathname === '/check') {
                 event.respondWith((async () => {
+                    const used = globalThis.stored.bodyUsed;
                     const body = globalThis.stored.body;
                     let reread;
                     try {
@@ -2928,7 +2532,8 @@ fn a_sent_byte_body_reads_as_consumed_rather_than_absent() {
                     } catch (e) {
                         reread = e.name;
                     }
-                    return new Response('body=' + (body === null ? 'null' : 'stream')
+                    return new Response('bodyUsed=' + used
+                        + ' body=' + (body === null ? 'null' : 'stream')
                         + ' locked=' + (body !== null && body.locked)
                         + ' reread=' + reread);
                 })());
@@ -2938,49 +2543,13 @@ fn a_sent_byte_body_reads_as_consumed_rather_than_absent() {
             event.respondWith(globalThis.stored);
         });
     "#;
-    let handle = start_serve(handler, 18325);
+    let handle = start_serve(handler);
+    let port = handle.port();
 
-    assert_eq!(request(18325, "GET", "/", ""), "payload");
+    assert_eq!(request(port, "GET", "/", ""), "payload");
     assert_eq!(
-        request(18325, "GET", "/check", ""),
-        "body=stream locked=true reread=TypeError"
-    );
-
-    handle.stop();
-}
-
-/// `new Request(input)` takes the input's body over rather than copying it, so the input is left
-/// holding no bytes — while still reading as a body that was read, exactly as after a `text()`.
-///
-/// The taking is the point: the copy that reaches the new request must be the same bytes, so
-/// reading them there has to still produce the payload.
-#[test]
-fn constructing_a_request_from_another_takes_its_bytes_over() {
-    let handler = r#"addEventListener('fetch', (event) => {
-        event.respondWith((async () => {
-            const input = new Request('https://example.com/', {
-                method: 'POST',
-                body: 'payload',
-            });
-            const taken = new Request(input);
-            let reread;
-            try {
-                await input.text();
-                reread = 'ok';
-            } catch (e) {
-                reread = e.name;
-            }
-            return new Response('used=' + input.bodyUsed
-                + ' body=' + (input.body === null ? 'null' : 'stream')
-                + ' reread=' + reread
-                + ' taken=' + await taken.text());
-        })());
-    })"#;
-    let handle = start_serve(handler, 18327);
-
-    assert_eq!(
-        request(18327, "GET", "/", ""),
-        "used=true body=stream reread=TypeError taken=payload"
+        request(port, "GET", "/check", ""),
+        "bodyUsed=true body=stream locked=true reread=TypeError"
     );
 
     handle.stop();
@@ -3004,12 +2573,13 @@ fn responding_with_a_used_stream_backed_response_is_a_network_error() {
             event.respondWith(globalThis.stored);
         });
     "#;
-    let handle = start_serve(handler, 18277);
+    let handle = start_serve(handler);
+    let port = handle.port();
 
-    assert_eq!(dechunk(&request(18277, "GET", "/", "")), "payload");
+    assert_eq!(dechunk(&request(port, "GET", "/", "")), "payload");
 
     let response = raw_request(
-        18277,
+        port,
         b"GET /reuse HTTP/1.1\r\nHost: x\r\nConnection: close\r\n\r\n",
     );
     assert!(
@@ -3031,9 +2601,10 @@ fn responding_with_a_used_stream_backed_response_is_a_network_error() {
 fn a_response_header_value_is_sent_as_bytes_not_utf8() {
     let handler =
         "addEventListener('fetch', (e) => e.respondWith(new Response('x', { headers: { 'x-test': '\u{df}\u{c0}\u{bf}' } })));";
-    let handle = start_serve(handler, 18279);
+    let handle = start_serve(handler);
+    let port = handle.port();
 
-    let mut stream = TcpStream::connect(("127.0.0.1", 18279)).unwrap();
+    let mut stream = TcpStream::connect(("127.0.0.1", port)).unwrap();
     stream
         .write_all(b"GET / HTTP/1.1\r\nHost: x\r\nConnection: close\r\n\r\n")
         .unwrap();
@@ -3085,11 +2656,12 @@ fn respond_with_rejects_the_responses_it_cannot_send() {
                 event.respondWith(new Response('unknown'));
         }
     })"#;
-    let handle = start_serve(handler, 18281);
+    let handle = start_serve(handler);
+    let port = handle.port();
 
     for path in ["/resolve-null", "/reject-bare", "/used-body"] {
         let response = raw_request(
-            18281,
+            port,
             format!("GET {path} HTTP/1.1\r\nHost: x\r\nConnection: close\r\n\r\n").as_bytes(),
         );
         assert!(
@@ -3099,7 +2671,7 @@ fn respond_with_rejects_the_responses_it_cannot_send() {
     }
 
     assert_eq!(
-        request(18281, "GET", "/unused-body", ""),
+        request(port, "GET", "/unused-body", ""),
         "payload",
         "an untouched body must still be sendable"
     );
@@ -3123,15 +2695,16 @@ fn prevent_default_does_not_stop_a_later_listener_responding() {
             }
         });
     "#;
-    let handle = start_serve(handler, 18283);
+    let handle = start_serve(handler);
+    let port = handle.port();
 
     assert_eq!(
-        request(18283, "GET", "/respond", ""),
+        request(port, "GET", "/respond", ""),
         "answered by the second listener"
     );
 
     let cancelled = raw_request(
-        18283,
+        port,
         b"GET /cancel-only HTTP/1.1\r\nHost: x\r\nConnection: close\r\n\r\n",
     );
     assert!(
@@ -3161,10 +2734,11 @@ fn a_client_disconnect_cancels_the_response_stream_in_the_handler() {
             cancel(reason) { globalThis.cancelled = 'cancelled'; },
         })));
     })"#;
-    let handle = start_serve(handler, 18285);
+    let handle = start_serve(handler);
+    let port = handle.port();
 
     {
-        let mut stream = TcpStream::connect(("127.0.0.1", 18285)).unwrap();
+        let mut stream = TcpStream::connect(("127.0.0.1", port)).unwrap();
         stream
             .write_all(b"GET /stream HTTP/1.1\r\nHost: localhost\r\nConnection: close\r\n\r\n")
             .unwrap();
@@ -3182,7 +2756,7 @@ fn a_client_disconnect_cancels_the_response_stream_in_the_handler() {
 
     // The cancel reaches JS while the abandoned request's loop drains.
     assert_eq!(
-        eventually(18285, "/query", |seen| seen == "cancelled"),
+        eventually(port, "/query", |seen| seen == "cancelled"),
         "cancelled",
         "the handler's stream must be cancelled when the client stops reading"
     );
@@ -3224,15 +2798,16 @@ fn wait_until_tracks_the_end_of_the_events_active_window() {
             event.respondWith(new Response('answered'));
         });
     "#;
-    let handle = start_serve(handler, 18287);
+    let handle = start_serve(handler);
+    let port = handle.port();
 
-    assert_eq!(request(18287, "GET", "/immediate", ""), "answered");
-    assert_eq!(request(18287, "GET", "/task", ""), "answered");
+    assert_eq!(request(port, "GET", "/immediate", ""), "answered");
+    assert_eq!(request(port, "GET", "/task", ""), "answered");
     // The lifetime work runs after each response. The log is complete once the last of it is in.
     const LOG: &str =
         "immediate-sync:ok,immediate-extra:ok,task-sync:ok,task-extra:InvalidStateError";
     assert_eq!(
-        eventually(18287, "/log", |log| log == LOG),
+        eventually(port, "/log", |log| log == LOG),
         LOG,
         "the dispatch flag covers the whole checkpoint; after it, the pending count expires one \
          microtask after the promise settles"
@@ -3241,41 +2816,6 @@ fn wait_until_tracks_the_end_of_the_events_active_window() {
     handle.stop();
 }
 
-/// Requests on one connection are served in sequence without closing it. The shared global's
-/// counter proves both hit the same server; the second response proves the connection survived
-/// the first, which therefore must not have promised `Connection: close`.
-#[test]
-fn serve_reuses_a_connection_for_sequential_requests() {
-    let handler = r#"globalThis.n = 0;
-        addEventListener('fetch', (event) => {
-            globalThis.n += 1;
-            const url = new URL(event.request.url);
-            event.respondWith(new Response(url.pathname + ' #' + globalThis.n));
-        })"#;
-    let handle = start_serve(handler, 18301);
-
-    let mut stream = TcpStream::connect(("127.0.0.1", 18301)).unwrap();
-    let mut carry = Vec::new();
-    stream
-        .write_all(b"GET /one HTTP/1.1\r\nHost: x\r\n\r\n")
-        .unwrap();
-    let first = read_one_response(&mut stream, &mut carry, PATIENCE).expect("a first response");
-    assert!(first.contains("/one #1"), "got: {first}");
-    assert!(
-        !first.to_lowercase().contains("connection: close"),
-        "a reusable response must not promise a close; got: {first}"
-    );
-
-    stream
-        .write_all(b"GET /two HTTP/1.1\r\nHost: x\r\n\r\n")
-        .unwrap();
-    let second = read_one_response(&mut stream, &mut carry, PATIENCE)
-        .expect("a second response on the same connection");
-    assert!(second.contains("/two #2"), "got: {second}");
-
-    handle.stop();
-}
-
 /// A request that asks for `Connection: close` gets it: the response repeats the header, and EOF
 /// follows.
 #[test]
@@ -3283,10 +2823,11 @@ fn serve_honors_a_requests_connection_close() {
     let handler = r#"addEventListener('fetch', (event) => {
         event.respondWith(new Response('bye'));
     })"#;
-    let handle = start_serve(handler, 18303);
+    let handle = start_serve(handler);
+    let port = handle.port();
 
     let response = raw_request(
-        18303,
+        port,
         b"GET / HTTP/1.1\r\nHost: x\r\nConnection: close\r\n\r\n",
     );
     assert!(
@@ -3307,9 +2848,10 @@ fn serve_drains_an_unread_body_and_reuses_the_connection() {
             globalThis.n += 1;
             event.respondWith(new Response('ok #' + globalThis.n));
         })"#;
-    let handle = start_serve(handler, 18305);
+    let handle = start_serve(handler);
+    let port = handle.port();
 
-    let mut stream = TcpStream::connect(("127.0.0.1", 18305)).unwrap();
+    let mut stream = TcpStream::connect(("127.0.0.1", port)).unwrap();
     let mut carry = Vec::new();
     stream
         .write_all(b"POST /a HTTP/1.1\r\nHost: x\r\nContent-Length: 11\r\n\r\nhello world")
@@ -3343,58 +2885,6 @@ fn serve_drains_an_unread_body_and_reuses_the_connection() {
     handle.stop();
 }
 
-/// Draining an unread body for reuse is only worth so much: past the drain budget the server
-/// closes the connection instead of reading megabytes no reader asked for. The close surfaces to
-/// client as a failed body write or as EOF where the next response would have been — never as a
-/// served next request.
-#[test]
-fn serve_closes_rather_than_drain_an_oversized_unread_body() {
-    let handler = r#"addEventListener('fetch', (event) => {
-        event.respondWith(new Response('ignored your body'));
-    })"#;
-    // A drain budget far below the upload, and a short read timeout so the wait for a handler
-    // that never reads gives up promptly. The upload has to outgrow all passive buffering (the
-    // incoming-body channel, the body pump's held frame, and hyper's read-ahead, together over
-    // 1 MiB), so that bytes remain for the drain to give up on.
-    const UPLOAD: usize = 4 * 1024 * 1024;
-    let handle = serve_with_limits(
-        handler,
-        18307,
-        "--max-body-drain-bytes 64KiB --request-read-timeout 1",
-    );
-
-    let mut stream = TcpStream::connect(("127.0.0.1", 18307)).unwrap();
-    let mut carry = Vec::new();
-    stream
-        .write_all(
-            format!("POST / HTTP/1.1\r\nHost: x\r\nContent-Length: {UPLOAD}\r\n\r\n").as_bytes(),
-        )
-        .unwrap();
-    let first = read_one_response(&mut stream, &mut carry, PATIENCE).expect("the response");
-    assert!(first.contains("ignored your body"), "got: {first}");
-
-    // Feed the declared body. The server gives up draining partway and closes, so these writes
-    // may start failing at any point; that failure is itself the expected outcome.
-    let chunk = [b'a'; 32 * 1024];
-    let _ = stream.set_write_timeout(Some(Duration::from_secs(5)));
-    let mut wrote_all = true;
-    for _ in 0..(UPLOAD / chunk.len()) {
-        if stream.write_all(&chunk).is_err() {
-            wrote_all = false;
-            break;
-        }
-    }
-    if wrote_all {
-        let _ = stream.write_all(b"GET /after HTTP/1.1\r\nHost: x\r\n\r\n");
-    }
-    assert!(
-        read_one_response(&mut stream, &mut carry, Duration::from_secs(5)).is_none(),
-        "the connection must close rather than serve another request past an oversized drain"
-    );
-
-    handle.stop();
-}
-
 /// Chunked framing is HTTP/1.1: a 1.0 client gets a streamed body as raw bytes delimited by the
 /// close. HTTP/1.0 does not persist by default, so the close needs no announcing.
 #[test]
@@ -3408,9 +2898,10 @@ fn serve_answers_http_1_0_with_a_close_delimited_body() {
         });
         event.respondWith(new Response(stream));
     })"#;
-    let handle = start_serve(handler, 18309);
+    let handle = start_serve(handler);
+    let port = handle.port();
 
-    let response = raw_request(18309, b"GET / HTTP/1.0\r\nHost: x\r\n\r\n");
+    let response = raw_request(port, b"GET / HTTP/1.0\r\nHost: x\r\n\r\n");
     let lower = response.to_lowercase();
     assert!(!lower.contains("connection: keep-alive"), "got: {response}");
     assert!(!lower.contains("transfer-encoding"), "got: {response}");
@@ -3429,9 +2920,10 @@ fn serve_answers_pipelined_requests_in_order() {
             const url = new URL(event.request.url);
             event.respondWith(new Response(url.pathname + ' #' + globalThis.n));
         })"#;
-    let handle = start_serve(handler, 18311);
+    let handle = start_serve(handler);
+    let port = handle.port();
 
-    let mut stream = TcpStream::connect(("127.0.0.1", 18311)).unwrap();
+    let mut stream = TcpStream::connect(("127.0.0.1", port)).unwrap();
     let mut carry = Vec::new();
     stream
         .write_all(b"GET /a HTTP/1.1\r\nHost: x\r\n\r\nGET /b HTTP/1.1\r\nHost: x\r\n\r\n")
@@ -3456,9 +2948,10 @@ fn serve_does_not_hold_the_next_request_behind_waituntil() {
         }
         event.respondWith(new Response(url.pathname));
     })"#;
-    let handle = start_serve(handler, 18313);
+    let handle = start_serve(handler);
+    let port = handle.port();
 
-    let mut stream = TcpStream::connect(("127.0.0.1", 18313)).unwrap();
+    let mut stream = TcpStream::connect(("127.0.0.1", port)).unwrap();
     let mut carry = Vec::new();
     stream
         .write_all(b"GET /lingering HTTP/1.1\r\nHost: x\r\n\r\n")
@@ -3485,9 +2978,10 @@ fn serve_does_not_hold_the_next_request_behind_waituntil() {
 #[test]
 fn serve_reuses_the_connection_after_a_network_error_response() {
     let handler = r#"addEventListener('fetch', () => {})"#;
-    let handle = start_serve(handler, 18315);
+    let handle = start_serve(handler);
+    let port = handle.port();
 
-    let mut stream = TcpStream::connect(("127.0.0.1", 18315)).unwrap();
+    let mut stream = TcpStream::connect(("127.0.0.1", port)).unwrap();
     let mut carry = Vec::new();
     stream
         .write_all(b"GET /a HTTP/1.1\r\nHost: x\r\n\r\n")
@@ -3505,14 +2999,13 @@ fn serve_reuses_the_connection_after_a_network_error_response() {
     handle.stop();
 }
 
-/// Start a server whose limit flags come from `flags`, parsed as the CLI parses them, so these
+/// Start a server whose limit flags come from `flags`, parsed by the CLI's own parser, so these
 /// tests exercise the real flag surface rather than a struct literal beside it.
-fn serve_with_limits(handler: &str, port: u16, flags: &str) -> common::ServeHandle {
+fn serve_with_limits(handler: &str, flags: &str) -> common::ServeHandle {
     let mut config = RuntimeConfig::from_arg_string(flags).expect("the limit flags parse");
     config.eval_script = Some(handler.to_string());
     config.legacy_script = true;
-    config.serve = Some(port);
-    start_serve_config(config, port)
+    start_serve_config(config)
 }
 
 /// The handler these limit tests use. None of them is about what it returns.
@@ -3520,57 +3013,62 @@ const OK_HANDLER: &str = r#"addEventListener('fetch', (e) => e.respondWith(new R
 
 #[test]
 fn a_configured_head_limit_bounds_the_request_head() {
-    let handle = serve_with_limits(OK_HANDLER, 18317, "--max-connection-buffer-size 8KiB");
+    let handle = serve_with_limits(OK_HANDLER, "--max-connection-buffer-size 8KiB");
+    let port = handle.port();
 
     // Well under the default 64 KiB, so only the configured limit can reject this.
     let mut over = Vec::from(&b"GET / HTTP/1.1\r\nHost: x\r\nX-Big: "[..]);
     over.extend(std::iter::repeat_n(b'a', 32 * 1024));
     over.extend_from_slice(b"\r\nConnection: close\r\n\r\n");
-    let response = raw_request(18317, &over);
+    let response = raw_request(port, &over);
     assert!(response.starts_with("HTTP/1.1 431"), "got: {response}");
 
     // A head within the limit is still served.
-    assert_eq!(request(18317, "GET", "/", ""), "ok");
+    assert_eq!(request(port, "GET", "/", ""), "ok");
 
     handle.stop();
 }
 
 #[test]
 fn a_configured_header_count_bounds_the_number_of_fields() {
-    let handle = serve_with_limits(OK_HANDLER, 18319, "--max-request-headers 8");
+    let handle = serve_with_limits(OK_HANDLER, "--max-request-headers 8");
+    let port = handle.port();
 
     let mut over = Vec::from(&b"GET / HTTP/1.1\r\nHost: x\r\n"[..]);
     for n in 0..20 {
         over.extend_from_slice(format!("X-Field-{n}: v\r\n").as_bytes());
     }
     over.extend_from_slice(b"Connection: close\r\n\r\n");
-    let response = raw_request(18319, &over);
+    let response = raw_request(port, &over);
     assert!(response.starts_with("HTTP/1.1 431"), "got: {response}");
 
-    assert_eq!(request(18319, "GET", "/", ""), "ok");
+    assert_eq!(request(port, "GET", "/", ""), "ok");
 
     handle.stop();
 }
 
 #[test]
 fn a_configured_body_limit_refuses_a_larger_declared_upload() {
-    let handle = serve_with_limits(OK_HANDLER, 18321, "--max-request-body-bytes 64");
+    let handle = serve_with_limits(OK_HANDLER, "--max-request-body-bytes 64");
+    let port = handle.port();
 
     let response = raw_request(
-        18321,
+        port,
         b"POST / HTTP/1.1\r\nHost: x\r\nContent-Length: 4096\r\nConnection: close\r\n\r\n",
     );
     assert!(response.starts_with("HTTP/1.1 413"), "got: {response}");
 
     // An upload within the limit is still served.
-    assert_eq!(request(18321, "POST", "/", "small"), "ok");
+    assert_eq!(request(port, "POST", "/", "small"), "ok");
 
     handle.stop();
 }
 
 /// The drain budget sets whether a connection whose request body went unread can be reused: the
 /// same upload against the same handler is reused under a budget that covers it and closed under
-/// one that does not.
+/// one that does not. Past the budget the server closes the connection instead of reading
+/// megabytes not requested by any reader. The close surfaces to the client as a failed body
+/// write or as EOF where the next response would have been, never as a served next request.
 ///
 /// The upload has to outgrow all passive buffering, or the whole body can be absorbed without
 /// any of it reaching the drain, leaving the connection reusable under any budget: the
@@ -3581,29 +3079,28 @@ fn the_drain_budget_sets_whether_an_unread_body_closes_the_connection() {
     // A short read timeout so the wait for the consumer that never reads gives up promptly.
     let generous = serve_with_limits(
         OK_HANDLER,
-        18329,
-        "--max-body-drain-bytes 8MiB --request-read-timeout 1",
+        "--max-body-drain-bytes 8MiB --request-read-timeout 0.25",
     );
     assert!(
-        reuses_after_unread_upload(18329),
+        reuses_after_unread_upload(generous.port()),
         "a budget that covers the unread body must leave the connection usable"
     );
     generous.stop();
 
-    let none = serve_with_limits(
+    let partial = serve_with_limits(
         OK_HANDLER,
-        18331,
-        "--max-body-drain-bytes 0 --request-read-timeout 1",
+        "--max-body-drain-bytes 64KiB --request-read-timeout 0.25",
     );
     assert!(
-        !reuses_after_unread_upload(18331),
-        "a zero budget must close rather than read a body nobody wanted"
+        !reuses_after_unread_upload(partial.port()),
+        "a budget far below the unread body must close rather than read it"
     );
-    none.stop();
+    partial.stop();
 }
 
-/// Upload four megabytes the handler never reads, then report whether the connection went on to
-/// serve another request.
+/// Send the head of a four-megabyte upload, read the response the handler sends without reading
+/// the body, then upload the body and report whether the connection went on to serve another
+/// request.
 fn reuses_after_unread_upload(port: u16) -> bool {
     const UPLOAD: usize = 4 * 1024 * 1024;
     let mut stream = TcpStream::connect(("127.0.0.1", port)).unwrap();
@@ -3613,8 +3110,11 @@ fn reuses_after_unread_upload(port: u16) -> bool {
             format!("POST / HTTP/1.1\r\nHost: x\r\nContent-Length: {UPLOAD}\r\n\r\n").as_bytes(),
         )
         .unwrap();
+    let first = read_one_response(&mut stream, &mut carry, PATIENCE)
+        .expect("a response before the body is sent");
+    assert!(first.starts_with("HTTP/1.1 200"), "got: {first}");
     let _ = stream.set_write_timeout(Some(Duration::from_secs(10)));
-    // The server may stop reading and close partway, which fails these writes — that is the
+    // The server may stop reading and close partway, which fails these writes. That is the
     // outcome under test, not an error.
     let chunk = [b'a'; 32 * 1024];
     for _ in 0..(UPLOAD / chunk.len()) {
@@ -3622,9 +3122,6 @@ fn reuses_after_unread_upload(port: u16) -> bool {
             return false;
         }
     }
-    if read_one_response(&mut stream, &mut carry, PATIENCE).is_none() {
-        return false;
-    }
     if stream
         .write_all(b"GET /again HTTP/1.1\r\nHost: x\r\n\r\n")
         .is_err()
@@ -3636,9 +3133,10 @@ fn reuses_after_unread_upload(port: u16) -> bool {
 
 #[test]
 fn a_configured_keepalive_timeout_closes_an_idle_connection() {
-    let handle = serve_with_limits(OK_HANDLER, 18333, "--keepalive-timeout 1");
+    let handle = serve_with_limits(OK_HANDLER, "--keepalive-timeout 0.25");
+    let port = handle.port();
 
-    let mut stream = TcpStream::connect(("127.0.0.1", 18333)).unwrap();
+    let mut stream = TcpStream::connect(("127.0.0.1", port)).unwrap();
     let mut carry = Vec::new();
     stream
         .write_all(b"GET / HTTP/1.1\r\nHost: x\r\n\r\n")
@@ -3659,9 +3157,10 @@ fn a_configured_keepalive_timeout_closes_an_idle_connection() {
 
 #[test]
 fn a_configured_read_timeout_closes_a_stalled_head() {
-    let handle = serve_with_limits(OK_HANDLER, 18335, "--request-read-timeout 1");
+    let handle = serve_with_limits(OK_HANDLER, "--request-read-timeout 0.25");
+    let port = handle.port();
 
-    let mut stream = TcpStream::connect(("127.0.0.1", 18335)).unwrap();
+    let mut stream = TcpStream::connect(("127.0.0.1", port)).unwrap();
     // A head that never terminates: the client has started a request and then stalled, so the
     // connection is closed rather than held open for a request that may never arrive.
     stream.write_all(b"GET / HTTP/1.1\r\nHost: x\r\n").unwrap();
@@ -3687,20 +3186,21 @@ fn a_configured_connection_limit_serves_one_connection_at_a_time() {
                 event.respondWith(new Promise((resolve) => setTimeout(() => {
                     log.push('slow-done');
                     resolve(new Response('slow'));
-                }, 1000)));
+                }, 400)));
                 return;
             }
             event.respondWith(new Response(log.join(',') || 'nothing'));
         })"#;
-    let handle = serve_with_limits(handler, 18337, "--max-connections 1");
+    let handle = serve_with_limits(handler, "--max-connections 1");
+    let port = handle.port();
 
-    let mut slow = TcpStream::connect(("127.0.0.1", 18337)).unwrap();
+    let mut slow = TcpStream::connect(("127.0.0.1", port)).unwrap();
     slow.write_all(b"GET /slow HTTP/1.1\r\nHost: x\r\nConnection: close\r\n\r\n")
         .unwrap();
     // Let the slow request take the only slot before the second connection asks for one.
-    std::thread::sleep(Duration::from_millis(300));
+    std::thread::sleep(Duration::from_millis(100));
 
-    let mut waiting = TcpStream::connect(("127.0.0.1", 18337)).unwrap();
+    let mut waiting = TcpStream::connect(("127.0.0.1", port)).unwrap();
     waiting
         .write_all(b"GET /observed HTTP/1.1\r\nHost: x\r\nConnection: close\r\n\r\n")
         .unwrap();
@@ -3730,9 +3230,10 @@ fn wait_until_work_does_not_hold_a_connection_slot() {
         event.respondWith(new Response('ok'));
         event.waitUntil(new Promise((resolve) => setTimeout(resolve, 5000)));
     })"#;
-    let handle = serve_with_limits(handler, 18345, "--max-connections 1");
+    let handle = serve_with_limits(handler, "--max-connections 1");
+    let port = handle.port();
 
-    let mut first = TcpStream::connect(("127.0.0.1", 18345)).unwrap();
+    let mut first = TcpStream::connect(("127.0.0.1", port)).unwrap();
     let mut carry = Vec::new();
     first
         .write_all(b"GET / HTTP/1.1\r\nHost: x\r\n\r\n")
@@ -3741,7 +3242,7 @@ fn wait_until_work_does_not_hold_a_connection_slot() {
     drop(first);
 
     let started = std::time::Instant::now();
-    assert_eq!(request(18345, "GET", "/", ""), "ok");
+    assert_eq!(request(port, "GET", "/", ""), "ok");
     let elapsed = started.elapsed();
     assert!(
         elapsed < Duration::from_secs(2),
diff --git a/crates/libstarling/tests/serve_isolation.rs b/crates/libstarling/tests/serve_isolation.rs
deleted file mode 100644
index 43450b4f..00000000
--- a/crates/libstarling/tests/serve_isolation.rs
+++ /dev/null
@@ -1,98 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0-WITH-LLVM-exception
-//! Per-request global isolation (`--serve-isolated`): a fresh global per request carries the
-//! builtins, keeps one request's top-level declarations out of the next one's way, and receives
-//! dispatch through its own listeners.
-
-#![cfg(not(target_arch = "wasm32"))]
-
-use core_runtime::runtime::{clear_global_initializers, Runtime};
-use js::conversion::FromJSVal;
-use js::gc::scope::Scope;
-use web_fetch::request::Request;
-use web_globals::events::algorithms::ScriptStackState;
-
-/// A runtime with the builtins registered, ready for globals to be created from it. Each test
-/// clears the initializers first: they accumulate in a process-wide registry, so a test inheriting
-/// the previous one's would register each builtin twice over.
-fn test_runtime() -> std::rc::Rc<Runtime> {
-    clear_global_initializers();
-    libstarling::register_builtins();
-    Runtime::init(&core_runtime::config::RuntimeConfig::default()).expect("runtime init")
-}
-
-fn eval(scope: &Scope<'_>, src: &str) -> Result<String, String> {
-    match js::compile::evaluate_with_filename(scope, src, "<spike>", 1) {
-        Ok(v) => String::from_jsval(scope, v, ()).map_err(|e| format!("{e:?}")),
-        Err(_) => {
-            let exn = js::error::ExnThrown::capture(scope);
-            Err(format!("{exn}"))
-        }
-    }
-}
-
-#[test]
-fn fresh_globals_are_isolated_and_initialized() {
-    let rt = test_runtime();
-
-    // Two globals, created the way a per-request server would.
-    {
-        let a = rt.new_global();
-        // Builtins are installed on it: the initializers run per global.
-        assert_eq!(
-            eval(&a, "typeof addEventListener + ',' + typeof Response").unwrap(),
-            "function,function",
-            "a fresh global must carry the registered builtins"
-        );
-        // A top-level lexical declaration — the thing that collides across tests today.
-        eval(&a, "const collide = 1; var marker = 'a';").unwrap();
-        assert_eq!(eval(&a, "String(collide)").unwrap(), "1");
-    }
-    {
-        let b = rt.new_global();
-        // The same declaration must not collide, and `var` state must not leak.
-        eval(&b, "const collide = 2;").expect("redeclaration must not collide across globals");
-        assert_eq!(eval(&b, "String(collide)").unwrap(), "2");
-        assert_eq!(
-            eval(&b, "typeof marker").unwrap(),
-            "undefined",
-            "globals must not share var state"
-        );
-    }
-}
-
-#[test]
-fn a_fetch_handler_registered_in_a_fresh_global_receives_dispatch() {
-    let rt = test_runtime();
-
-    let scope = rt.new_global();
-    fetch_event::add_to_global(&scope, scope.global());
-
-    // The content script, as a per-request server would re-evaluate it into this global.
-    eval(
-        &scope,
-        "globalThis.__seen = null;
-         addEventListener('fetch', (e) => { globalThis.__seen = e.request.url; });",
-    )
-    .unwrap();
-
-    let el = core_runtime::event_loop::EventLoop::new();
-    core_runtime::event_loop::with_event_loop(&el, |_| {
-        let request = js::compile::evaluate_with_filename(
-            &scope,
-            "new Request('http://example.com/')",
-            "<r>",
-            1,
-        )
-        .expect("request value");
-        let request = Request::from_jsval(&scope, request, ()).unwrap();
-        fetch_event::fetch_event::FetchEvent::dispatch(&scope, request, ScriptStackState::Empty)
-            .expect("dispatch");
-        js::jobs::run_jobs(&scope);
-    });
-
-    assert_eq!(
-        eval(&scope, "String(globalThis.__seen)").unwrap(),
-        "http://example.com/",
-        "the fresh global's own listener must receive the event"
-    );
-}
diff --git a/crates/libstarling/tests/wire_response.rs b/crates/libstarling/tests/wire_response.rs
new file mode 100644
index 00000000..7f1d1eef
--- /dev/null
+++ b/crates/libstarling/tests/wire_response.rs
@@ -0,0 +1,208 @@
+// SPDX-License-Identifier: Apache-2.0-WITH-LLVM-exception
+
+//! How `prepare_wire_response` reduces a dispatched response to what goes on the wire: which header
+//! fields are dropped, when a status or a `HEAD` request rules out content, and which
+//! `Content-Length` frames the body.
+
+#![cfg(not(target_arch = "wasm32"))]
+
+use libstarling::{prepare_wire_response, WireResponse};
+use platform::http::OutgoingBody;
+
+fn headers(pairs: &[(&str, &str)]) -> Vec<(String, String)> {
+    pairs
+        .iter()
+        .map(|(n, v)| (n.to_string(), v.to_string()))
+        .collect()
+}
+
+fn names(response: &WireResponse) -> Vec<String> {
+    response
+        .headers
+        .iter()
+        .map(|(name, _)| name.as_str().to_string())
+        .collect()
+}
+
+#[test]
+fn framing_headers_from_the_handler_are_dropped() {
+    let response = prepare_wire_response(
+        false,
+        200,
+        headers(&[
+            ("Content-Length", "10000"),
+            ("transfer-encoding", "chunked"),
+            ("CONNECTION", "keep-alive"),
+            ("x-keep", "me"),
+        ]),
+        OutgoingBody::Bytes(bytes::Bytes::from_static(b"short")),
+    );
+    assert_eq!(names(&response), ["x-keep"]);
+}
+
+#[test]
+fn headers_that_could_split_the_response_are_dropped() {
+    let response = prepare_wire_response(
+        false,
+        200,
+        headers(&[
+            ("x-cr", "a\rb"),
+            ("x-lf", "a\nb"),
+            ("x-nul", "a\0b"),
+            ("x-na\rme", "fine"),
+            ("x-keep", "me"),
+        ]),
+        OutgoingBody::Bytes(bytes::Bytes::new()),
+    );
+    assert_eq!(names(&response), ["x-keep"]);
+}
+
+/// Each code unit of a value becomes one byte. A code unit above U+00FF becomes `?`.
+#[test]
+fn header_values_are_isomorphic_encoded() {
+    let response = prepare_wire_response(
+        false,
+        200,
+        headers(&[("x-latin1", "caf\u{e9}"), ("x-wide", "a\u{2603}b")]),
+        OutgoingBody::Bytes(bytes::Bytes::new()),
+    );
+    assert_eq!(response.headers["x-latin1"].as_bytes(), b"caf\xe9");
+    assert_eq!(response.headers["x-wide"].as_bytes(), b"a?b");
+}
+
+/// The body a response sends, for a test that only ever builds in-memory ones.
+fn content(response: &WireResponse) -> &[u8] {
+    match &response.body {
+        OutgoingBody::Bytes(bytes) => bytes,
+        _ => panic!("the test built an in-memory body"),
+    }
+}
+
+/// A `1xx`, `204` or `304` has no content and no declared length, whatever the body, the
+/// handler's `Content-Length` and the method.
+#[test]
+fn a_bodiless_status_has_no_content_or_length() {
+    for status in [103, 204, 304] {
+        for head_request in [false, true] {
+            for streamed in [false, true] {
+                let body = if streamed {
+                    platform::http::body_channel().1
+                } else {
+                    OutgoingBody::Bytes(bytes::Bytes::from_static(b"ignored"))
+                };
+                let response = prepare_wire_response(
+                    head_request,
+                    status,
+                    headers(&[("x-keep", "me"), ("content-length", "7")]),
+                    body,
+                );
+                let case = format!("{status} head={head_request} streamed={streamed}");
+                assert!(content(&response).is_empty(), "{case}");
+                assert_eq!(response.declared_length, None, "{case}");
+                assert_eq!(names(&response), ["x-keep"], "{case}");
+            }
+        }
+    }
+}
+
+#[test]
+fn a_head_request_declares_the_length_it_would_have_sent() {
+    let response = prepare_wire_response(
+        true,
+        200,
+        Vec::new(),
+        OutgoingBody::Bytes(bytes::Bytes::from_static(b"BODYBYTES")),
+    );
+    assert!(content(&response).is_empty());
+    assert_eq!(response.declared_length, Some(9));
+}
+
+#[test]
+fn a_head_request_declares_no_length_it_would_have_to_produce() {
+    // A streamed body's length is only knowable by generating the content.
+    let (_sender, streamed) = platform::http::body_channel();
+    let response = prepare_wire_response(true, 200, Vec::new(), streamed);
+    assert!(content(&response).is_empty());
+    assert_eq!(response.declared_length, None);
+}
+
+/// A streamed body has no length until it is produced, so the handler's declaration is the
+/// only thing that can frame it.
+#[test]
+fn a_streamed_body_takes_the_declared_length() {
+    let (_sender, streamed) = platform::http::body_channel();
+    let response =
+        prepare_wire_response(false, 200, headers(&[("content-length", "42")]), streamed);
+    assert_eq!(response.declared_length, Some(42));
+    assert_eq!(names(&response), Vec::<String>::new());
+}
+
+/// Content already in memory is measured. A declaration that disagrees with it would frame the
+/// response as something other than what it sends.
+#[test]
+fn an_in_memory_body_is_measured_not_declared() {
+    let response = prepare_wire_response(
+        false,
+        200,
+        headers(&[("content-length", "10000")]),
+        OutgoingBody::Bytes(bytes::Bytes::from_static(b"short")),
+    );
+    assert_eq!(response.declared_length, Some(5));
+    assert_eq!(content(&response), b"short");
+}
+
+/// Only an unambiguous `1*DIGIT` that fits a `u64` frames a response. Repeated fields arrive
+/// comma-joined, which is not a number, and two separate fields are refused as well.
+#[test]
+fn a_declared_length_that_is_not_one_number_is_refused() {
+    for value in [
+        "",
+        "x",
+        "10000, 10000",
+        " 5",
+        "+5",
+        "5.0",
+        "0x5",
+        "-1",
+        "18446744073709551616",
+    ] {
+        let (_sender, streamed) = platform::http::body_channel();
+        let response =
+            prepare_wire_response(false, 200, headers(&[("content-length", value)]), streamed);
+        assert_eq!(response.declared_length, None, "{value:?}");
+    }
+    let (_sender, streamed) = platform::http::body_channel();
+    let response = prepare_wire_response(
+        false,
+        200,
+        headers(&[("content-length", "5"), ("Content-Length", "5")]),
+        streamed,
+    );
+    assert_eq!(response.declared_length, None, "two fields");
+}
+
+/// A consumed body doesn't send any bytes, so no length frames it.
+#[test]
+fn a_consumed_body_declares_no_length() {
+    let response = prepare_wire_response(
+        false,
+        200,
+        headers(&[("content-length", "42")]),
+        OutgoingBody::Consumed,
+    );
+    assert_eq!(response.declared_length, None);
+}
+
+/// RFC 9110 §9.3.2: a `HEAD` may report the length its `GET` would have had. The handler's
+/// declaration takes precedence over the length of an in-memory body.
+#[test]
+fn a_head_request_declares_the_length_it_was_given() {
+    let response = prepare_wire_response(
+        true,
+        200,
+        headers(&[("content-length", "12345")]),
+        OutgoingBody::Bytes(bytes::Bytes::from_static(b"BODYBYTES")),
+    );
+    assert!(content(&response).is_empty());
+    assert_eq!(response.declared_length, Some(12345));
+}
diff --git a/crates/platform/Cargo.toml b/crates/platform/Cargo.toml
index 7444791f..199b6135 100644
--- a/crates/platform/Cargo.toml
+++ b/crates/platform/Cargo.toml
@@ -7,14 +7,13 @@ authors.workspace = true
 edition.workspace = true
 
 [lib]
-# No unit tests; skip building the (SpiderMonkey-sized) lib test harness binary.
+# No unit tests. This skips building the (SpiderMonkey-sized) lib test harness binary.
 test = false
 
 [dependencies]
 bytes.workspace = true
 futures-channel.workspace = true
 futures-lite.workspace = true
-url.workspace = true
 
 [target.'cfg(not(target_arch = "wasm32"))'.dependencies]
 libc = "0.2"
@@ -22,6 +21,7 @@ reqwest.workspace = true
 
 [target.'cfg(target_arch = "wasm32")'.dependencies]
 http.workspace = true
+url.workspace = true
 wasip3.workspace = true
 wit-bindgen.workspace = true
 
diff --git a/crates/platform/src/clock.rs b/crates/platform/src/clock.rs
index dc9cf012..c2dd48c1 100644
--- a/crates/platform/src/clock.rs
+++ b/crates/platform/src/clock.rs
@@ -8,10 +8,6 @@
 //! instance's future. [`record_snapshot_reading`] captures the clock as the snapshot is made and
 //! [`resume_from_snapshot`] adds that reading to every reading afterwards, so a resumed instance
 //! continues the timeline the snapshot ended on instead of restarting it.
-//!
-//! SpiderMonkey keeps the same kind of state (GC phase timestamps, the last collection's end) and
-//! reads its own copy of the same host clock, so an embedder passes the value
-//! [`resume_from_snapshot`] returns on to the engine as well.
 
 use std::sync::atomic::{AtomicU64, Ordering};
 
@@ -19,7 +15,7 @@ use std::sync::atomic::{AtomicU64, Ordering};
 static OFFSET_NS: AtomicU64 = AtomicU64::new(0);
 
 /// The reading [`record_snapshot_reading`] took, carried into the snapshot for
-/// [`resume_from_snapshot`] to apply. Zero for an instance that was never snapshotted.
+/// [`resume_from_snapshot`] to apply. Zero for an instance that was never wizened.
 static SNAPSHOT_NS: AtomicU64 = AtomicU64::new(0);
 
 #[cfg(target_arch = "wasm32")]
@@ -86,7 +82,7 @@ pub fn coarse_monotonic_ns() -> u64 {
 
 /// Record where the clock stood as a snapshot was made.
 ///
-/// Must be the last thing an instance being snapshotted does, since a reading taken afterwards
+/// An instance being wizened must call this last, since a reading taken afterwards
 /// would sit past the recorded one and so still be in a resumed instance's future.
 pub fn record_snapshot_reading() {
     SNAPSHOT_NS.store(host_monotonic_ns(), Ordering::Relaxed);
@@ -113,9 +109,8 @@ pub async fn sleep(duration: std::time::Duration) {
 /// A monotonic clock reading, for deadlines that outlive a Wizer snapshot.
 ///
 /// `std::time::Instant` reads the host clock directly, so a deadline taken before a snapshot sits
-/// in the resumed instance's future by however long the snapshotted instance ran. This reads
-/// [`monotonic_ns`] instead, whose offset makes a resumed instance continue the timeline the
-/// snapshot ended on, so such a deadline is already past when the instance resumes.
+/// in the resumed instance's future by however long the wizened instance ran. This reads
+/// [`monotonic_ns`] instead.
 #[derive(Clone, Copy, Debug, PartialEq, Eq, PartialOrd, Ord)]
 pub struct Instant(u64);
 
diff --git a/crates/platform/src/http.rs b/crates/platform/src/http.rs
index 8750fd06..fcbbf83c 100644
--- a/crates/platform/src/http.rs
+++ b/crates/platform/src/http.rs
@@ -5,18 +5,19 @@
 //! `send` returns once the response status and headers are available; the body
 //! is a [`IncomingBody`] read lazily from the host (reqwest on native, the
 //! WASIp3 incoming body stream on wasm). Callers either drain it with
-//! [`IncomingBody::read_all`] or pull it chunk by chunk with
-//! [`IncomingBody::next_chunk`].
+//! [`IncomingBody::read_all`] or read it piece by piece with
+//! [`IncomingBody::read_into`]. Natively, `IncomingBody::next_chunk` also returns
+//! each chunk as it was received.
 //!
 //! This module holds the platform-agnostic parts; the backends live in
 //! [`http_native`](crate::http_native) and [`http_wasm`](crate::http_wasm),
 //! whose platform-specific items are re-exported here.
 
 #[cfg(not(target_arch = "wasm32"))]
-pub use crate::http_native::{incoming_body_channel, IncomingBody, IncomingBodySender};
+pub use crate::http_native::{incoming_body_channel, send, IncomingBody, IncomingBodySender};
 #[cfg(target_arch = "wasm32")]
 pub use crate::http_wasm::{
-    build_outgoing_response, read_incoming_request, AbandonBody, BodyDone, BodySendOutcome,
+    build_outgoing_response, read_incoming_request, send, AbandonBody, BodyDone, BodySendOutcome,
     IncomingBody,
 };
 
@@ -26,11 +27,8 @@ pub struct Request {
     pub method: String,
     /// The absolute request URL.
     pub url: String,
-    /// Header (name, value) pairs, in order.
-    ///
-    /// Values are `ByteString`s: every code unit is ≤ 0xFF and stands for one
-    /// byte on the wire, so they are [`isomorphic_encode`]d rather than
-    /// UTF-8-encoded when sent. See [`isomorphic_encode`] for why.
+    /// Header (name, value) pairs, in order. Values are `ByteString`s, which are
+    /// [`isomorphic_encode`]d when sent.
     pub headers: Vec<(String, String)>,
     /// The request body.
     pub body: OutgoingBody,
@@ -38,7 +36,7 @@ pub struct Request {
 
 /// A body chunk a [`Remaining`] budget can trim.
 pub trait BodyChunk {
-    /// How many bytes the chunk carries.
+    /// The chunk's length in bytes.
     fn byte_len(&self) -> usize;
     /// Shorten the chunk to its first `len` bytes.
     fn truncate_to(&mut self, len: usize);
@@ -68,7 +66,7 @@ impl BodyChunk for Vec<u8> {
 /// A response is framed by the `Content-Length` it declares, so content past that never goes on
 /// the wire, and content short of it leaves the message unfinished.
 ///
-/// `None` where no length was declared.
+/// `None` if no length was declared.
 pub struct Remaining(Option<u64>);
 
 impl Remaining {
@@ -107,16 +105,13 @@ pub type OutgoingBodyReceiver = futures_channel::mpsc::Receiver<Result<Vec<u8>,
 /// from elsewhere (such as a JS `ReadableStream` pumped through a channel), or
 /// a host response body handed straight through.
 pub enum OutgoingBody {
-    /// A complete byte sequence (empty for no body). Refcounted, so replaying
-    /// it across redirects or handing it between layers never copies the bytes.
+    /// A complete byte sequence, empty for no body.
     Bytes(bytes::Bytes),
-    /// Chunks delivered on a bounded channel; a final `Err` aborts the body, and
-    /// the channel closing ends it. Created via [`body_channel`].
+    /// Chunks delivered on a bounded channel. A final `Err` aborts the body, and
+    /// closing the channel ends it. Created via [`body_channel`].
     Stream(OutgoingBodyReceiver),
-    /// A host response body handed straight to the outgoing request. Used for
-    /// incoming bodies that are directly used as outgoing ones, or when
-    /// piped through an identity `TransformStream`. In that case, handling of the
-    /// body is unobservable by JS and can take a shortcut.
+    /// A host body sent unchanged, for an incoming body used directly as an outgoing one or
+    /// piped through an identity `TransformStream`.
     Host(IncomingBody),
     /// No body to send, because none is left or none was ever produced: a stream
     /// body consumed by a previous send (a redirect cannot replay it), or one
@@ -124,9 +119,7 @@ pub enum OutgoingBody {
     Consumed,
 }
 
-/// How many body chunks may sit in a body channel before the producer must wait
-/// — bounds buffering so a fast producer with a slow consumer applies
-/// backpressure rather than buffering the whole body.
+/// How many chunks a body channel holds before the producer waits.
 pub(crate) const BODY_CHANNEL_CAPACITY: usize = 8;
 
 /// The size up to which [`coalesce_queued_chunks`] appends queued chunks.
@@ -160,9 +153,7 @@ pub fn coalesce_queued_chunks(
     None
 }
 
-/// Wait for channel capacity, then enqueue. `futures_channel`'s `Sender` has no
-/// inherent async `send`, so drive `poll_ready` directly (avoids pulling in
-/// `futures-util`'s `SinkExt`). Returns `false` if the receiver was dropped.
+/// Wait for channel capacity, then enqueue `item`. Returns `false` if the receiver was dropped.
 pub(crate) async fn send_on<T>(sender: &mut futures_channel::mpsc::Sender<T>, item: T) -> bool {
     if futures_lite::future::poll_fn(|cx| sender.poll_ready(cx))
         .await
@@ -213,12 +204,9 @@ pub fn body_channel() -> (BodySender, OutgoingBody) {
     (BodySender(sender), OutgoingBody::Stream(receiver))
 }
 
-/// A body that fails as soon as the transport reads it.
-///
-/// For a caller that cannot produce the bytes it promised but is already
-/// committed to sending. The alternative would be sending an empty body, which
-/// the peer cannot tell from a legitimately empty one, so a truncated request
-/// would look successful.
+/// A body that fails as soon as the transport reads it, for a caller that is committed to
+/// sending but cannot produce the bytes. An empty body instead would make the truncated request
+/// look successful.
 pub fn failed_body(message: String) -> OutgoingBody {
     let (mut sender, body) = futures_channel::mpsc::channel(1);
     // The channel is empty and has capacity, so this cannot fail.
@@ -242,13 +230,7 @@ pub struct Response {
 
 /// <https://infra.spec.whatwg.org/#isomorphic-encode>
 ///
-/// Encode a header value to its wire bytes: one byte per code unit.
-///
-/// An HTTP header value is a byte sequence, and the WebIDL `ByteString` a script
-/// supplies maps each code unit one-to-one onto a byte — `"æ"` (U+00E6) is the
-/// single byte 0xE6. Encoding the value as UTF-8 instead would send 0xC3 0xA6,
-/// which is a different header value; a peer echoing it back would return two
-/// code units, and a server matching on it would not match.
+/// Encode a header value to its wire bytes: one byte per code unit, not UTF-8.
 ///
 /// A code unit above 0xFF cannot occur in a `ByteString` and is replaced by `?`
 /// rather than truncated into an unrelated byte.
@@ -261,10 +243,8 @@ pub fn isomorphic_encode(value: &str) -> Vec<u8> {
 
 /// <https://infra.spec.whatwg.org/#isomorphic-decode>
 ///
-/// Decode wire bytes to a header value: one code unit per byte.
-///
-/// The inverse of [`isomorphic_encode`]. This can't fail, since it's not treating
-/// the input as, possibly invalid, UTF-8.
+/// Decode wire bytes to a header value: one code unit per byte. The inverse of
+/// [`isomorphic_encode`].
 pub fn isomorphic_decode(bytes: &[u8]) -> String {
     bytes.iter().map(|&b| char::from(b)).collect()
 }
@@ -281,21 +261,5 @@ impl std::fmt::Display for Error {
 
 impl std::error::Error for Error {}
 
-/// A read-only, refcounted byte sequence from a response body. Derefs to
-/// `&[u8]`. On native it is reqwest's `Bytes` as-is (the body is never copied
-/// into a `Vec` just to be read); on wasm the bytes read from the WASIp3
-/// stream are wrapped without copying.
+/// A read-only, refcounted byte sequence from a body.
 pub type BodyBytes = bytes::Bytes;
-
-/// Send `request` over the host's HTTP transport, returning once the response
-/// status and headers are available.
-pub async fn send(request: Request) -> Result<Response, Error> {
-    #[cfg(not(target_arch = "wasm32"))]
-    {
-        crate::http_native::send(request).await
-    }
-    #[cfg(target_arch = "wasm32")]
-    {
-        crate::http_wasm::send(request).await
-    }
-}
diff --git a/crates/platform/src/http_native.rs b/crates/platform/src/http_native.rs
index 458c4a33..97eb7d80 100644
--- a/crates/platform/src/http_native.rs
+++ b/crates/platform/src/http_native.rs
@@ -10,37 +10,20 @@ use crate::http::{
 };
 
 thread_local! {
-    // Redirects are followed by the fetch layer (so native and wasm behave identically and
-    // per spec), so the client itself must not follow them.
+    // The fetch layer follows redirects, so the client must not.
     //
-    // TODO(keep-alive robustness): idle connection pooling is left enabled (reqwest's
-    // default) for performance, but it has a known robustness gap against non-compliant
-    // servers. hyper applies RFC 7230 §3.3.3 strictly: a body-exempt response (HEAD, 1xx,
-    // 204, 304) has a zero-length body regardless of any `Content-Length`. A server that
-    // nevertheless *sends* a body with such a status, such as WPT `status.py`,
-    // leaves those bytes unread on the socket; hyper treats the message as
-    // complete and returns the connection to the pool. The next request to reuse that
-    // connection reads the stale bytes as a status line and fails with a parse error
-    // (`hyper::Error(Parse(Version))`). hyper auto-retries idempotent methods on a fresh
-    // connection, but a POST is not retried (it may already have been processed), so it
-    // surfaces as a spurious network error. Symptom: the `response-null-body` WPT subtests
-    // for 204/304 fail intermittently (see their FLAKY expectations).
-    //
-    // This cannot be fixed through reqwest: it exposes no connection-eviction or
-    // idle-flush API, and dropping a body-exempt `Response` unread does not close its
-    // connection (hyper considers a length-0 body already complete and pools it anyway).
-    // Instead, fixing this would require building our own pool directly on hyper.
-    // See wasmtime PR #12635 for the related "ignore a connection error that arrives after
-    // the response" technique.
-    // Ideally this is fixed upstream in reqwest/hyper (detect leftover bytes after a
-    // body-exempt response and refuse to pool that connection) rather than by hand-rolling
-    // a client here.
+    // TODO: a server that sends a body with a body-exempt response (HEAD, 1xx, 204, 304) leaves
+    // those bytes unread on a pooled connection, and the next request on it fails to parse its
+    // response. hyper retries idempotent methods but not a POST, which makes the
+    // `response-null-body` WPT subtests for 204 and 304 flaky. reqwest has no API to evict such a
+    // connection, so fixing this needs a pool built on hyper or a fix upstream.
     static CLIENT: reqwest::Client = reqwest::Client::builder()
         .redirect(reqwest::redirect::Policy::none())
         .build()
         .expect("failed to build HTTP client");
 }
 
+/// Send `request` with reqwest, returning once the response status and headers are available.
 pub async fn send(request: Request) -> Result<Response, Error> {
     let client = CLIENT.with(|c| c.clone());
     let method = reqwest::Method::from_bytes(request.method.as_bytes())
@@ -52,11 +35,9 @@ pub async fn send(request: Request) -> Result<Response, Error> {
     match request.body {
         OutgoingBody::Bytes(bytes) if !bytes.is_empty() => builder = builder.body(bytes),
         OutgoingBody::Bytes(_) | OutgoingBody::Consumed => {}
-        // Stream the body chunks (read from the channel) as they arrive.
         OutgoingBody::Stream(receiver) => {
             builder = builder.body(reqwest::Body::wrap_stream(receiver))
         }
-        // Incoming→outgoing shortcut: stream a host body straight through.
         OutgoingBody::Host(host_body) => {
             builder = match host_body.0 {
                 NativeBody::Transport(response) => {
@@ -66,7 +47,7 @@ pub async fn send(request: Request) -> Result<Response, Error> {
             }
         }
     }
-    let response = builder.send().await.map_err(|e| Error(e.to_string()))?;
+    let response = builder.send().await.map_err(|e| transport_error(&e))?;
     let status = response.status().as_u16();
     let headers = response
         .headers()
@@ -85,14 +66,8 @@ pub async fn send(request: Request) -> Result<Response, Error> {
     })
 }
 
-/// The write end of a channel-backed [`IncomingBody`]: the native serve loop's
-/// connection reader sends the request-body chunks it decodes here, and the
-/// handler's `request.body` reads them out. The send awaits channel capacity, so
-/// a client uploading faster than the handler consumes is paced by TCP
-/// backpressure rather than buffered whole. Dropping it ends the body.
-///
-/// Native-only: on wasm an incoming body is already a `wasi:http` stream, which
-/// [`IncomingBody`] wraps directly.
+/// The write end of a channel-backed [`IncomingBody`]. Sends await channel capacity, and
+/// dropping it ends the body.
 pub struct IncomingBodySender(futures_channel::mpsc::Sender<Result<BodyBytes, Error>>);
 
 impl IncomingBodySender {
@@ -126,9 +101,8 @@ pub struct IncomingBody(NativeBody);
 enum NativeBody {
     /// A response from the HTTP client, read straight off its connection.
     Transport(reqwest::Response),
-    /// Chunks delivered on a channel by whoever owns the connection — the serve
-    /// loop reading an incoming request body. A final `Err` aborts the body; the
-    /// channel closing ends it. Created via [`incoming_body_channel`].
+    /// Chunks delivered on a channel created by [`incoming_body_channel`]. A final `Err` aborts
+    /// the body, and closing the channel ends it.
     Channel(futures_channel::mpsc::Receiver<Result<BodyBytes, Error>>),
 }
 
@@ -137,7 +111,7 @@ impl IncomingBody {
     pub async fn read_all(self) -> Result<BodyBytes, Error> {
         match self.0 {
             NativeBody::Transport(response) => {
-                response.bytes().await.map_err(|e| Error(e.to_string()))
+                response.bytes().await.map_err(|e| transport_error(&e))
             }
             NativeBody::Channel(mut receiver) => {
                 let mut buffer = bytes::BytesMut::new();
@@ -149,13 +123,40 @@ impl IncomingBody {
         }
     }
 
+    /// Read the next chunk, or return `Ok(None)` at the end of the body. A chunk is read whole, so
+    /// it can hold more bytes than `buf` has capacity for. It is returned in its own allocation if
+    /// it is the only reference to it, and copied into an allocation of its size otherwise, so
+    /// `buf` is unused. Empty chunks are skipped.
+    pub async fn read_into(&mut self, _buf: Vec<u8>) -> Result<Option<Vec<u8>>, Error> {
+        loop {
+            let Some(chunk) = self.next_chunk().await? else {
+                return Ok(None);
+            };
+            if !chunk.is_empty() {
+                return Ok(Some(Vec::from(chunk)));
+            }
+        }
+    }
+
     /// Read the next chunk, or `Ok(None)` at end of body.
     pub async fn next_chunk(&mut self) -> Result<Option<BodyBytes>, Error> {
         match &mut self.0 {
             NativeBody::Transport(response) => {
-                response.chunk().await.map_err(|e| Error(e.to_string()))
+                response.chunk().await.map_err(|e| transport_error(&e))
             }
             NativeBody::Channel(receiver) => receiver.next().await.transpose(),
         }
     }
 }
+
+/// The transport error for `error`: its message, followed by the messages of its sources.
+fn transport_error(error: &reqwest::Error) -> Error {
+    let mut message = error.to_string();
+    let mut source = std::error::Error::source(error);
+    while let Some(cause) = source {
+        message.push_str(": ");
+        message.push_str(&cause.to_string());
+        source = cause.source();
+    }
+    Error(message)
+}
diff --git a/crates/platform/src/http_wasm.rs b/crates/platform/src/http_wasm.rs
index ad96e4b0..91a1b6ea 100644
--- a/crates/platform/src/http_wasm.rs
+++ b/crates/platform/src/http_wasm.rs
@@ -34,11 +34,8 @@ struct BodyParts {
 /// straight through, trailers and all. A body-less request/response
 /// gets no stream at all.
 ///
-/// Handing a host body over is also handing over the only place its send could be bounded: the
-/// host reads that stream itself, for as long as the peer keeps feeding it, so `body_timeout` does
-/// not reach one. Keeping hold of it would mean copying every chunk of every proxied body through
-/// the guest, which costs far more than it buys — how long a transfer the host is itself pumping
-/// may take is the host's to limit.
+/// The host reads a host body's stream itself, so `body_timeout` doesn't apply to it. Bounding it
+/// would require copying every chunk of a proxied body through the guest.
 fn body_contents(body: OutgoingBody) -> (BodyParts, TrailersWriter) {
     let (trailers_tx, trailers_rx) = wit_future::new(|| Ok(None));
     let (contents, piped_trailers, writer) = match body {
@@ -62,24 +59,21 @@ fn body_contents(body: OutgoingBody) -> (BodyParts, TrailersWriter) {
     )
 }
 
-/// How a body's send ended, reported through [`BodyDone`]. The distinctions
-/// mirror the ones the native transport reads off its own socket write, so the
-/// serve path can raise the same aborts (a spent clock, a lost connection) on
-/// both targets.
+/// How a body's send ended, reported through [`BodyDone`].
 pub enum BodySendOutcome {
     /// Every chunk was handed to the host.
     Sent,
     /// The body ended before the `Content-Length` the response declared for it.
     Truncated,
-    /// The `timeout` given to [`spawn_body_writer`] cut the send.
+    /// The `timeout` given to [`spawn_body_writer`] expired before the send finished.
     TimedOut,
     /// The send failed: the host dropped the stream's read end (the connection
     /// is gone), or a streamed chunk was itself an error.
     Failed(String),
 }
 
-/// Resolves once a body's writer task has ended, with how it ended — or with
-/// `None` for a task cancelled before it could say (instance teardown).
+/// Resolves once a body's writer task has ended, with how it ended, or with `None` if the task
+/// was cancelled first, as at instance teardown.
 pub struct BodyDone(futures_channel::oneshot::Receiver<BodySendOutcome>);
 
 impl std::future::Future for BodyDone {
@@ -94,19 +88,14 @@ impl std::future::Future for BodyDone {
 
 /// Feed the owned body (in-memory, or streamed through the channel) to its
 /// wit stream from a spawned task, then write the trailers: `Ok(None)` on a
-/// clean end, an `ErrorCode` when a streamed chunk errored. The trailers
-/// future is the only abort signal a wit stream's consumer can observe, so
-/// an aborted body must not look like a clean (truncated) one.
+/// clean end, an `ErrorCode` otherwise. The trailers future is the only abort
+/// signal a wit stream's consumer can observe.
 ///
-/// `timeout` bounds the write: a handler that never ends its stream would
-/// otherwise hold the wit stream open for the life of the instance. Running
-/// out is an abort like any other, error trailers and all. It belongs here
-/// rather than with the caller watching the same clock, because only this task
-/// can end the stream.
+/// `timeout` bounds the write, so a handler that never ends its stream doesn't hold the wit
+/// stream open for the life of the instance. Running out aborts the body with error trailers.
 ///
 /// The returned [`BodyDone`] resolves when the send is over, with its
-/// [`BodySendOutcome`]. A caller with no use for that (the request path) just
-/// drops it.
+/// [`BodySendOutcome`].
 fn spawn_body_writer(
     writer_body: Option<(BodyStreamWriter, OutgoingBody)>,
     trailers_tx: TrailersWriter,
@@ -164,16 +153,16 @@ fn spawn_body_writer(
                 Some(message.clone()),
             )),
         };
-        // The outcome goes out before the trailers: a host slow to take them
-        // must not delay the serve path's word that the body phase is over.
+        // The outcome is sent before the trailers, so a host slow to take the trailers doesn't
+        // delay the serve path.
         let _ = done_tx.send(outcome);
         let _ = trailers_tx.write(trailers).await;
     });
     (BodyDone(done_rx), AbandonBody(abandon_tx))
 }
 
-/// A `write_all` that hands back unwritten values hit a dropped read end: the host has torn the
-/// response down, so the connection (or the request) is gone.
+/// The failure of a `write_all` that returned unwritten values because the host dropped the read
+/// end.
 const HOST_STOPPED_READING: &str = "the host stopped reading the response body";
 
 /// How an abandoned body's send is reported.
@@ -191,7 +180,7 @@ fn outcome_at_end(remaining: &crate::http::Remaining) -> BodySendOutcome {
 }
 
 /// Feed a streamed body's chunks to the host as they arrive, until the stream ends, one of them
-/// fails, the declared length is full, or [`AbandonBody`] is signaled.
+/// fails, the declared length was reached, or [`AbandonBody`] is signaled.
 async fn write_stream_body(
     body_tx: &mut BodyStreamWriter,
     receiver: &mut crate::http::OutgoingBodyReceiver,
@@ -210,8 +199,7 @@ async fn write_stream_body(
         match chunk {
             Some(Some(Ok(mut chunk))) => {
                 let error = crate::http::coalesce_queued_chunks(receiver, &mut chunk);
-                // Content past the declared length would leave the host framing a message it has
-                // no room for, so the body ends here instead.
+                // Content past the declared length is dropped, and the body ends.
                 let Some(chunk) = remaining.take(chunk) else {
                     return BodySendOutcome::Sent;
                 };
@@ -229,13 +217,12 @@ async fn write_stream_body(
     }
 }
 
-/// Finish a body whose pump can no longer run, taking only what the channel already holds: those
-/// chunks were put there before the loop ran out, and nothing can add to them now.
+/// Finish a body whose pump can no longer run, sending only the chunks the channel already
+/// holds.
 ///
-/// If they end the body, the response was complete after all and the signal merely arrived a moment
-/// early. If they do not, the handler left a body that will never be finished, and the send is
-/// reported failed — which ends the stream as an abort, so the client sees the truncation rather
-/// than a complete-looking response (RFC 9112 §7.1).
+/// If they end the body, the send succeeded. Otherwise the send is reported failed, which ends
+/// the stream as an abort, so the client sees the truncation rather than a complete-looking
+/// response (RFC 9112 §7.1).
 async fn finish_abandoned_body(
     body_tx: &mut BodyStreamWriter,
     receiver: &mut crate::http::OutgoingBodyReceiver,
@@ -260,11 +247,9 @@ async fn finish_abandoned_body(
     BodySendOutcome::Failed(ABANDONED_BODY.to_string())
 }
 
-/// Tells a streamed body's writer that nothing can produce another chunk: the event loop feeding it
-/// has run out of work, so a writer still waiting on the pump would wait forever. The writer takes
-/// what the channel already holds and then ends the body — see [`finish_abandoned_body`].
-///
-/// Dropping one instead says nothing; a caller that never learns of such a state simply drops it.
+/// Signals a streamed body's writer that the event loop feeding it has run out of work, so no
+/// further chunks will be produced. The writer then sends what the channel already holds and ends
+/// the body, as [`finish_abandoned_body`] describes. Dropping it doesn't signal the writer.
 pub struct AbandonBody(futures_channel::oneshot::Sender<()>);
 
 impl AbandonBody {
@@ -273,12 +258,8 @@ impl AbandonBody {
     }
 }
 
-/// Map a method name onto a `wasi:http` method.
-///
-/// Matched case-sensitively, and anything unrecognized is passed through as
-/// `Other`: Fetch only normalizes the case of `DELETE`, `GET`, `HEAD`,
-/// `OPTIONS`, `POST` and `PUT`, so `fetch(url, { method: "patch" })` must go
-/// on the wire as `patch`.
+/// Map a method name onto a `wasi:http` method, case-sensitively, so `patch` stays `patch`.
+/// Anything unrecognized is passed through as `Other`.
 fn method_of_string(method: &str) -> Method {
     match method {
         "GET" => Method::Get,
@@ -309,6 +290,8 @@ fn string_of_method(method: Method) -> String {
     }
 }
 
+/// Send `request` with the `wasi:http` client, returning once the response status and headers
+/// are available.
 pub async fn send(request: Request) -> Result<Response, Error> {
     let parsed = url::Url::parse(&request.url).map_err(|e| Error(format!("invalid URL: {e}")))?;
     let scheme = match parsed.scheme() {
@@ -386,7 +369,6 @@ pub async fn send(request: Request) -> Result<Response, Error> {
         let _ = transmitted.await;
     });
 
-    // Send the request via the outgoing HTTP client.
     let response = wasip3::http::client::send(wasi_request)
         .await
         .map_err(|e| Error(format!("fetch failed: {e:?}")))?;
@@ -418,7 +400,7 @@ pub async fn send(request: Request) -> Result<Response, Error> {
 
 /// Read an incoming `wasi:http` request into its parts (method, full URL, headers, body).
 ///
-/// Returns `Err` for a field the host accepted that `http` cannot represent.
+/// Returns `Err` for a field that the host accepted but `http` cannot represent.
 pub fn read_incoming_request(
     request: WasiRequest,
 ) -> Result<(String, String, http::HeaderMap, IncomingBody), ErrorCode> {
@@ -459,9 +441,8 @@ pub fn read_incoming_request(
 /// The body is written from a spawned task: an in-memory body inline,
 /// a host body handed straight through, a stream body forwarded chunk by chunk.
 ///
-/// The returned [`BodyDone`] resolves once the body is out of the guest's
-/// hands. That is right away for a host body, which has no writer because the
-/// host drains that stream itself. `body_timeout` bounds the send (see
+/// The returned [`BodyDone`] resolves once every chunk was handed to the host,
+/// which is at once for a host body. `body_timeout` bounds the send (see
 /// [`spawn_body_writer`]).
 ///
 /// `declared_length` is used as the `Content-Length` header, and enforced for guest-produced
@@ -475,12 +456,9 @@ pub fn build_outgoing_response(
 ) -> (WasiResponse, BodyDone, AbandonBody) {
     let fields = Fields::new();
     for (name, value) in &headers {
-        // Appended one at a time rather than converted with `Fields::try_from`, which goes through
-        // the all-or-nothing `Fields::from_list`. The host's rules are stricter than
-        // `prepare_wire_response`'s, since it also reserves the connection-management names it
-        // writes itself, such as `keep-alive`, and a handler is free to set one, as is an upstream
-        // whose response is being proxied. Building the fields entry by entry keeps one refusal
-        // from silently emptying the whole response's headers.
+        // Appended one at a time rather than converted with the all-or-nothing
+        // `Fields::from_list`, so a header the host refuses, such as `keep-alive`, is dropped
+        // without emptying the response's headers.
         if let Err(e) = fields.append(name.as_str(), value.as_bytes()) {
             eprintln!(
                 "serve: dropping the response header `{name}`, which the host refused: {e:?}"
@@ -490,10 +468,8 @@ pub fn build_outgoing_response(
 
     let (body, trailers_tx) = body_contents(body);
     let (response, _result) = WasiResponse::new(fields, body.contents, body.trailers);
-    // The caller has already mapped the status onto the range HTTP allows, but what `wasi:http`
-    // will put on the wire is the host's call and may be narrower still. Leaving a refusal
-    // unhandled would send the response under `Response`'s default status, which is a wrong answer
-    // rather than a failed one, so a refused status degrades to a 500.
+    // The host can refuse a status that HTTP allows. A refused status becomes 500 rather than
+    // `Response`'s default status.
     if response.set_status_code(status).is_err() {
         eprintln!("the host refused status {status}; answering with a 500 instead");
         let _ = response.set_status_code(500);
@@ -504,8 +480,9 @@ pub fn build_outgoing_response(
     (response, body_done, abandon)
 }
 
-/// A body read lazily from the host's incoming `wasi:http` body stream: an HTTP
-/// client response, or an incoming request body on the serve path.
+/// Bytes read lazily from a host stream: the body of an HTTP client response, an
+/// incoming request body on the serve path, or any other `stream<u8>` (see
+/// [`IncomingBody::from_stream`]).
 pub struct IncomingBody {
     stream: BodyStreamReader,
     /// The body's trailers future, taken when the body ends.
@@ -516,6 +493,29 @@ pub struct IncomingBody {
 }
 
 impl IncomingBody {
+    /// The bytes of `stream`, which has no trailers that could report an abort.
+    pub fn from_stream(stream: BodyStreamReader) -> Self {
+        IncomingBody {
+            stream,
+            trailers: None,
+        }
+    }
+
+    /// The stream the bytes are read from. A stream can't hold an error, so if the body has
+    /// trailers, a task awaits them and prints an abort they report to stderr.
+    pub fn into_stream(self) -> BodyStreamReader {
+        if let Some(trailers) = self.trailers {
+            wit_bindgen::spawn_local(async move {
+                if let Err(code) = trailers.await {
+                    eprintln!(
+                        "a stream's source ended the stream early: the body was aborted: {code:?}"
+                    );
+                }
+            });
+        }
+        self.stream
+    }
+
     /// Read the entire body to a byte sequence.
     pub async fn read_all(self) -> Result<BodyBytes, Error> {
         // `collect` consumes the stream, so destructure first and consult the trailers directly
@@ -530,37 +530,34 @@ impl IncomingBody {
         Ok(bytes)
     }
 
-    /// Read the next chunk, or `Ok(None)` at end of body.
-    pub async fn next_chunk(&mut self) -> Result<Option<BodyBytes>, Error> {
+    /// Read the next bytes into `buf`, at most as many as it has capacity for. Returns the bytes
+    /// read, or `Ok(None)` at the end of the body. The bytes are never empty.
+    pub async fn read_into(&mut self, mut buf: Vec<u8>) -> Result<Option<Vec<u8>>, Error> {
         use wasip3::wit_bindgen::rt::async_support::StreamResult;
-        let buffer = Vec::with_capacity(8192);
-        let (status, buffer) = self.stream.read(buffer).await;
-        match status {
-            // Values were transferred, so the stream is still open. Report them — even a
-            // zero-length read, which must *not* fall through to `end_of_body`: the trailers
-            // future only resolves once the stream is closed, so awaiting it here would hang.
-            StreamResult::Complete(_) => Ok(Some(bytes::Bytes::from(buffer))),
-            // The writer dropped its handle: the body has ended. Whether it ended cleanly or
-            // the peer aborted it is only knowable from the trailers.
-            StreamResult::Dropped => {
-                if !buffer.is_empty() {
-                    return Ok(Some(bytes::Bytes::from(buffer)));
-                }
-                self.end_of_body().await.map(|()| None)
+        loop {
+            let (status, read) = self.stream.read(buf).await;
+            buf = read;
+            match status {
+                // The stream is still open after a zero-length read, so it is read again.
+                // Awaiting the trailers here would hang, since they only resolve once the stream
+                // is closed.
+                StreamResult::Complete(0) => {}
+                StreamResult::Complete(_) => return Ok(Some(buf)),
+                // The body has ended. The trailers report whether it ended cleanly.
+                StreamResult::Dropped if !buf.is_empty() => return Ok(Some(buf)),
+                StreamResult::Dropped => return self.end_of_body().await.map(|()| None),
+                // The read was cancelled at teardown. The stream was never reported closed, so
+                // the trailers may never resolve and aren't awaited.
+                StreamResult::Cancelled => return Ok(None),
             }
-            // The read was cancelled, which is a teardown rather than an end of body. The
-            // stream was never reported closed, so the trailers may never resolve — do not
-            // await them.
-            StreamResult::Cancelled => Ok(None),
         }
     }
 
-    /// The body's stream has ended: resolve the trailers future to learn whether
-    /// it ended cleanly or the peer aborted it, surfacing an abort as an error so
-    /// a truncated body is not mistaken for a complete one.
+    /// Await the trailers future of a body whose stream has ended, and return an error if the
+    /// peer aborted the body.
     ///
-    /// Only valid once the stream has been reported closed, per `wasi:http`'s
-    /// `consume-body` docs — the future does not resolve before then.
+    /// Only valid once the stream has been reported closed. The future does not resolve before
+    /// then.
     async fn end_of_body(&mut self) -> Result<(), Error> {
         let Some(trailers) = self.trailers.take() else {
             return Ok(());
diff --git a/crates/platform/src/lib.rs b/crates/platform/src/lib.rs
index e626f505..2515da0f 100644
--- a/crates/platform/src/lib.rs
+++ b/crates/platform/src/lib.rs
@@ -5,11 +5,8 @@
 //!
 //! Builtins call the backend-agnostic APIs here; each capability holds its
 //! platform-agnostic parts in one module and its backends in `<capability>_native`
-//! / `<capability>_wasm` modules, selected with `#[cfg(target_arch)]`. The first
-//! capability is HTTP ([`http`]), used by `fetch`: native uses an async HTTP
-//! client, wasm uses the WASIp3 outgoing-handler. The other is the monotonic
-//! clock ([`clock`]). Future host capabilities (sockets, filesystem, …) follow
-//! the same shape.
+//! / `<capability>_wasm` modules, selected with `#[cfg(target_arch)]`. The capabilities
+//! are HTTP ([`http`]), used by `fetch`, and the monotonic clock ([`clock`]).
 
 pub mod clock;
 pub mod http;
diff --git a/crates/platform/tests/clock.rs b/crates/platform/tests/clock.rs
index deb8e314..0a5a08cd 100644
--- a/crates/platform/tests/clock.rs
+++ b/crates/platform/tests/clock.rs
@@ -23,8 +23,8 @@ fn resuming_advances_the_clock_by_the_recorded_reading() {
         "readings after the resume should sit past the snapshot's"
     );
 
-    // The reading is consumed by the first resume, so a second one is a no-op. Every later call
-    // in a resumed instance takes this path.
+    // The reading is consumed by the first resume, so a second resume does nothing. Every later
+    // call in a resumed instance takes this path.
     assert_eq!(resume_from_snapshot(), 0);
 }
 
diff --git a/crates/serve-test-support/Cargo.toml b/crates/serve-test-support/Cargo.toml
index ad0115e5..1965699a 100644
--- a/crates/serve-test-support/Cargo.toml
+++ b/crates/serve-test-support/Cargo.toml
@@ -12,7 +12,7 @@ edition.workspace = true
 # builds only this crate and the component, not the native engine.
 
 [lib]
-# No unit tests; the integration test in `tests/` links the lib.
+# No unit tests. The integration test in `tests/` links the lib.
 test = false
 
 [lints]
diff --git a/crates/serve-test-support/src/lib.rs b/crates/serve-test-support/src/lib.rs
index 123e15d0..5cbeda17 100644
--- a/crates/serve-test-support/src/lib.rs
+++ b/crates/serve-test-support/src/lib.rs
@@ -17,13 +17,35 @@ use std::time::Duration;
 /// Like [`request`], but gives up after `patience` and returns `None` — for the cases where a
 /// server that fails the test would otherwise leave it hanging rather than failing it.
 pub fn request_within(port: u16, path: &str, patience: Duration) -> Option<String> {
-    let response = full_request_within(port, "GET", path, "", patience)?;
-    Some(
-        response
-            .split_once("\r\n\r\n")
-            .map(|(_, body)| body.to_string())
-            .unwrap_or(response),
-    )
+    full_request_within(port, "GET", path, "", patience).map(body_of)
+}
+
+/// The part of `response` after the header terminator. See [`split_response`].
+fn body_of(response: String) -> String {
+    split_response(&response).1.to_string()
+}
+
+/// The head and the body of `response`, split at the header terminator. A response with no header
+/// terminator is malformed rather than empty. It has no head, and the whole response is its body,
+/// so an assertion on the body cannot pass against nothing at all.
+pub(crate) fn split_response(response: &str) -> (Option<&str>, &str) {
+    match response.split_once("\r\n\r\n") {
+        Some((head, body)) => (Some(head), body),
+        None => (None, response),
+    }
+}
+
+/// The `Content-Length` value in `head`, which must already be lowercase.
+fn content_length(head: &str) -> Option<usize> {
+    head.split("content-length:")
+        .nth(1)
+        .and_then(|rest| rest.split("\r\n").next())
+        .and_then(|value| value.trim().parse().ok())
+}
+
+/// The size on a chunk-size line, with any chunk extension after `;` ignored.
+fn chunk_size(size_line: &str) -> Option<usize> {
+    usize::from_str_radix(size_line.split(';').next()?.trim(), 16).ok()
 }
 
 /// Like [`request_within`], but for any method and body, and returning the whole response — status
@@ -48,14 +70,19 @@ pub fn raw_response_within(
     body: &str,
     patience: Duration,
 ) -> Option<Vec<u8>> {
-    let mut stream = TcpStream::connect(("127.0.0.1", port)).unwrap();
     let req = format!(
         "{method} {path} HTTP/1.1\r\nHost: localhost\r\nContent-Length: {}\r\nConnection: close\r\n\r\n{body}",
         body.len(),
     );
+    send_within(port, req.as_bytes(), patience)
+}
+
+/// Send `raw` on a new connection and read the response to EOF within `patience`.
+fn send_within(port: u16, raw: &[u8], patience: Duration) -> Option<Vec<u8>> {
+    let mut stream = TcpStream::connect(("127.0.0.1", port)).unwrap();
     // A refused request is responded to and its connection closed while this is still writing, so
     // a failed write is part of the outcome rather than an error.
-    let _ = stream.write_all(req.as_bytes());
+    let _ = stream.write_all(raw);
     read_until_eof(&mut stream, patience)
 }
 
@@ -64,32 +91,62 @@ pub fn raw_response_within(
 /// test instead of hanging the run.
 pub const PATIENCE: Duration = Duration::from_secs(30);
 
+/// How long [`eventually`] polls before returning its last result. Finite so that work which never
+/// completes fails its test.
+pub const SETTLE_PATIENCE: Duration = Duration::from_secs(20);
+
+/// Call `poll` every 20 ms until its result satisfies `settled` or [`SETTLE_PATIENCE`] runs out,
+/// and return the last result.
+///
+/// Work a handler leaves behind runs while the request's loop is drained after the response: a
+/// `waitUntil` promise, a signal's reactions, a stream's cancel. Polling until the outcome is there
+/// takes as long as the work does, rather than a fixed span chosen for the slowest machine.
+///
+/// Only for assertions that wait for something to happen. A request drives the loop it is served
+/// on, so an assertion that something does not happen waits a fixed span instead.
+pub fn eventually(mut poll: impl FnMut() -> String, settled: impl Fn(&str) -> bool) -> String {
+    let deadline = std::time::Instant::now() + SETTLE_PATIENCE;
+    loop {
+        let result = poll();
+        if settled(&result) || std::time::Instant::now() >= deadline {
+            return result;
+        }
+        std::thread::sleep(Duration::from_millis(20));
+    }
+}
+
 /// Make one HTTP/1.1 request and return the response body (after the headers).
 pub fn request(port: u16, method: &str, path: &str, body: &str) -> String {
-    let response = full_request_within(port, method, path, body, PATIENCE)
-        .expect("the server answered within the patience");
-    // A response with no header terminator is malformed rather than empty, so it is handed back
-    // whole — an assertion on the body would otherwise pass against nothing at all.
-    response
-        .split_once("\r\n\r\n")
-        .map(|(_, body)| body.to_string())
-        .unwrap_or(response)
+    body_of(
+        full_request_within(port, method, path, body, PATIENCE)
+            .expect("the server answered within the patience"),
+    )
 }
 
-/// A minimal upstream HTTP server (multi-connection) that always replies with `body`.
-pub fn start_upstream(body: &'static str) -> u16 {
+/// A listener on a port the system picks on `127.0.0.1`, and that port.
+pub fn bind_local() -> (TcpListener, u16) {
     let listener = TcpListener::bind("127.0.0.1:0").unwrap();
     let port = listener.local_addr().unwrap().port();
+    (listener, port)
+}
+
+/// A `200` response with `body`, framed by its length, closing the connection.
+fn ok_response(body: &str) -> String {
+    format!(
+        "HTTP/1.1 200 OK\r\nContent-Length: {}\r\nConnection: close\r\n\r\n{body}",
+        body.len(),
+    )
+}
+
+/// A minimal upstream HTTP server (multi-connection) that always replies with `body`.
+pub fn start_upstream(body: &'static str) -> u16 {
+    let (listener, port) = bind_local();
     std::thread::spawn(move || {
         for stream in listener.incoming() {
             let Ok(mut stream) = stream else { continue };
             let mut buf = [0u8; 1024];
             let _ = stream.read(&mut buf);
-            let response = format!(
-                "HTTP/1.1 200 OK\r\nContent-Length: {}\r\nConnection: close\r\n\r\n{body}",
-                body.len(),
-            );
-            let _ = stream.write_all(response.as_bytes());
+            let _ = stream.write_all(ok_response(body).as_bytes());
         }
     });
     port
@@ -98,32 +155,19 @@ pub fn start_upstream(body: &'static str) -> u16 {
 /// An upstream that responds with a chunked body, pausing between chunks, so a handler forwarding it
 /// has to actually stream rather than receive the whole thing at once.
 pub fn start_chunked_upstream(chunks: &'static [&'static str]) -> u16 {
-    let listener = TcpListener::bind("127.0.0.1:0").unwrap();
-    let port = listener.local_addr().unwrap().port();
-    std::thread::spawn(move || {
-        for stream in listener.incoming() {
-            let Ok(mut stream) = stream else { continue };
-            let mut buf = [0u8; 1024];
-            let _ = stream.read(&mut buf);
-            let _ = stream.write_all(
-                b"HTTP/1.1 200 OK\r\nTransfer-Encoding: chunked\r\nConnection: close\r\n\r\n",
-            );
-            for chunk in chunks {
-                let _ = stream.write_all(format!("{:x}\r\n{chunk}\r\n", chunk.len()).as_bytes());
-                let _ = stream.flush();
-                std::thread::sleep(Duration::from_millis(20));
-            }
-            let _ = stream.write_all(b"0\r\n\r\n");
-        }
-    });
-    port
+    start_chunked(chunks, true)
 }
 
 /// An upstream whose chunked response is cut off: it sends `chunks` and then closes the connection
 /// without the terminating chunk, so a handler forwarding it is forwarding a truncation.
 pub fn start_truncated_upstream(chunks: &'static [&'static str]) -> u16 {
-    let listener = TcpListener::bind("127.0.0.1:0").unwrap();
-    let port = listener.local_addr().unwrap().port();
+    start_chunked(chunks, false)
+}
+
+/// An upstream that sends `chunks` as a chunked body, 20 ms apart, and the terminating chunk if
+/// `terminate` is set.
+fn start_chunked(chunks: &'static [&'static str], terminate: bool) -> u16 {
+    let (listener, port) = bind_local();
     std::thread::spawn(move || {
         for stream in listener.incoming() {
             let Ok(mut stream) = stream else { continue };
@@ -137,7 +181,9 @@ pub fn start_truncated_upstream(chunks: &'static [&'static str]) -> u16 {
                 let _ = stream.flush();
                 std::thread::sleep(Duration::from_millis(20));
             }
-            // No terminator: dropping the connection here is the truncation.
+            if terminate {
+                let _ = stream.write_all(b"0\r\n\r\n");
+            }
         }
     });
     port
@@ -146,8 +192,7 @@ pub fn start_truncated_upstream(chunks: &'static [&'static str]) -> u16 {
 /// An upstream that waits `delay` before responding with `body`, so a `fetch` to it is still in
 /// flight while other work — another request, a previous one's drain — runs alongside it.
 pub fn start_slow_upstream(delay: Duration, body: &'static str) -> u16 {
-    let listener = TcpListener::bind("127.0.0.1:0").unwrap();
-    let port = listener.local_addr().unwrap().port();
+    let (listener, port) = bind_local();
     std::thread::spawn(move || {
         for stream in listener.incoming() {
             let Ok(mut stream) = stream else { continue };
@@ -155,13 +200,7 @@ pub fn start_slow_upstream(delay: Duration, body: &'static str) -> u16 {
                 let mut buf = [0u8; 1024];
                 let _ = stream.read(&mut buf);
                 std::thread::sleep(delay);
-                let _ = stream.write_all(
-                    format!(
-                        "HTTP/1.1 200 OK\r\nContent-Length: {}\r\nConnection: close\r\n\r\n{body}",
-                        body.len(),
-                    )
-                    .as_bytes(),
-                );
+                let _ = stream.write_all(ok_response(body).as_bytes());
             });
         }
     });
@@ -172,8 +211,7 @@ pub fn start_slow_upstream(delay: Duration, body: &'static str) -> u16 {
 /// handler proxying it sends a *host* body rather than a JS stream, which the serve timeouts have
 /// to bound just the same.
 pub fn start_endless_upstream(every: Duration) -> u16 {
-    let listener = TcpListener::bind("127.0.0.1:0").unwrap();
-    let port = listener.local_addr().unwrap().port();
+    let (listener, port) = bind_local();
     std::thread::spawn(move || {
         for stream in listener.incoming() {
             let Ok(mut stream) = stream else { continue };
@@ -230,20 +268,11 @@ impl HeldUpstream {
         self.released
             .store(true, std::sync::atomic::Ordering::SeqCst);
     }
-
-    /// Hold again, and forget the arrivals counted so far, so a test that runs its scenario more
-    /// than once gates each run from zero.
-    pub fn rearm(&self) {
-        self.released
-            .store(false, std::sync::atomic::Ordering::SeqCst);
-        while self.arrivals.try_recv().is_ok() {}
-    }
 }
 
 /// Start a [`HeldUpstream`] that responds with `body` once released.
 pub fn start_held_upstream(body: &'static str) -> HeldUpstream {
-    let listener = TcpListener::bind("127.0.0.1:0").unwrap();
-    let port = listener.local_addr().unwrap().port();
+    let (listener, port) = bind_local();
     let (arrived, arrivals) = std::sync::mpsc::channel();
     let released = std::sync::Arc::new(std::sync::atomic::AtomicBool::new(false));
     let flag = released.clone();
@@ -259,13 +288,7 @@ pub fn start_held_upstream(body: &'static str) -> HeldUpstream {
                 while !flag.load(std::sync::atomic::Ordering::SeqCst) {
                     std::thread::sleep(Duration::from_millis(5));
                 }
-                let _ = stream.write_all(
-                    format!(
-                        "HTTP/1.1 200 OK\r\nContent-Length: {}\r\nConnection: close\r\n\r\n{body}",
-                        body.len(),
-                    )
-                    .as_bytes(),
-                );
+                let _ = stream.write_all(ok_response(body).as_bytes());
             });
         }
     });
@@ -276,8 +299,8 @@ pub fn start_held_upstream(body: &'static str) -> HeldUpstream {
     }
 }
 
-/// A proxy that holds each request until released, then forwards it to `target` and copies the
-/// response back.
+/// A proxy that holds each request until released, then forwards it to the port passed to
+/// [`ForwardingGate::release`] and copies the response back.
 ///
 /// For the cases where the guest is the client. A handler fetching its own server sends that
 /// request while it is still running, and a test cannot delay it. Forwarding it from here sets
@@ -285,7 +308,8 @@ pub fn start_held_upstream(body: &'static str) -> HeldUpstream {
 pub struct ForwardingGate {
     port: u16,
     arrivals: std::sync::mpsc::Receiver<()>,
-    released: std::sync::Arc<std::sync::atomic::AtomicBool>,
+    /// The port to forward to, or `0` while requests are held.
+    target: std::sync::Arc<std::sync::atomic::AtomicU16>,
 }
 
 impl ForwardingGate {
@@ -298,25 +322,24 @@ impl ForwardingGate {
         self.arrivals.recv_timeout(patience).is_ok()
     }
 
-    /// Forward everything held, and everything that arrives from here on.
-    pub fn release(&self) {
-        self.released
-            .store(true, std::sync::atomic::Ordering::SeqCst);
+    /// Forward everything held, and everything that arrives from here on, to `target`.
+    pub fn release(&self, target: u16) {
+        self.target
+            .store(target, std::sync::atomic::Ordering::SeqCst);
     }
 }
 
-/// Start a [`ForwardingGate`] in front of `target`.
-pub fn start_forwarding_gate(target: u16) -> ForwardingGate {
-    let listener = TcpListener::bind("127.0.0.1:0").unwrap();
-    let port = listener.local_addr().unwrap().port();
+/// Start a [`ForwardingGate`].
+pub fn start_forwarding_gate() -> ForwardingGate {
+    let (listener, port) = bind_local();
     let (arrived, arrivals) = std::sync::mpsc::channel();
-    let released = std::sync::Arc::new(std::sync::atomic::AtomicBool::new(false));
-    let flag = released.clone();
+    let target = std::sync::Arc::new(std::sync::atomic::AtomicU16::new(0));
+    let released = target.clone();
     std::thread::spawn(move || {
         for stream in listener.incoming() {
             let Ok(mut from) = stream else { continue };
             let arrived = arrived.clone();
-            let flag = flag.clone();
+            let released = released.clone();
             std::thread::spawn(move || {
                 let mut head = Vec::new();
                 let mut buf = [0u8; 1024];
@@ -327,9 +350,12 @@ pub fn start_forwarding_gate(target: u16) -> ForwardingGate {
                     }
                 }
                 let _ = arrived.send(());
-                while !flag.load(std::sync::atomic::Ordering::SeqCst) {
-                    std::thread::sleep(Duration::from_millis(5));
-                }
+                let target = loop {
+                    match released.load(std::sync::atomic::Ordering::SeqCst) {
+                        0 => std::thread::sleep(Duration::from_millis(5)),
+                        target => break target,
+                    }
+                };
                 // Forwarded with `Connection: close`, so the response ends at EOF. The rest of the
                 // request is passed on as it arrived.
                 let text = String::from_utf8_lossy(&head).into_owned();
@@ -355,15 +381,14 @@ pub fn start_forwarding_gate(target: u16) -> ForwardingGate {
     ForwardingGate {
         port,
         arrivals,
-        released,
+        target,
     }
 }
 
 /// An upstream that accepts connections and never responds, holding them open until the process
 /// ends. A `fetch` to it stays in flight for as long as anything is willing to wait for it.
 pub fn start_silent_upstream() -> u16 {
-    let listener = TcpListener::bind("127.0.0.1:0").unwrap();
-    let port = listener.local_addr().unwrap().port();
+    let (listener, port) = bind_local();
     std::thread::spawn(move || {
         let mut held = Vec::new();
         for stream in listener.incoming() {
@@ -378,8 +403,7 @@ pub fn start_silent_upstream() -> u16 {
 /// An upstream that reads a request body, chunked or length-delimited, and responds with it, so a
 /// handler forwarding a body upstream can be checked on what actually arrived there.
 pub fn start_echo_upstream() -> u16 {
-    let listener = TcpListener::bind("127.0.0.1:0").unwrap();
-    let port = listener.local_addr().unwrap().port();
+    let (listener, port) = bind_local();
     std::thread::spawn(move || {
         for stream in listener.incoming() {
             let Ok(mut stream) = stream else { continue };
@@ -399,12 +423,7 @@ pub fn start_echo_upstream() -> u16 {
                 let complete = if chunked {
                     body.ends_with("0\r\n\r\n")
                 } else {
-                    lower
-                        .split("content-length:")
-                        .nth(1)
-                        .and_then(|rest| rest.split("\r\n").next())
-                        .and_then(|value| value.trim().parse::<usize>().ok())
-                        .is_some_and(|length| body.len() >= length)
+                    content_length(&lower).is_some_and(|length| body.len() >= length)
                 };
                 if !complete {
                     continue;
@@ -414,13 +433,7 @@ pub fn start_echo_upstream() -> u16 {
                 } else {
                     body.to_string()
                 };
-                let _ = stream.write_all(
-                    format!(
-                        "HTTP/1.1 200 OK\r\nContent-Length: {}\r\nConnection: close\r\n\r\n{payload}",
-                        payload.len(),
-                    )
-                    .as_bytes(),
-                );
+                let _ = stream.write_all(ok_response(&payload).as_bytes());
                 break;
             }
         }
@@ -436,14 +449,14 @@ pub fn start_echo_upstream() -> u16 {
 pub fn dechunk(body: &str) -> String {
     let is_chunked = body
         .split_once("\r\n")
-        .is_some_and(|(size_line, _)| usize::from_str_radix(size_line.trim(), 16).is_ok());
+        .is_some_and(|(size_line, _)| chunk_size(size_line).is_some());
     if !is_chunked {
         return body.to_string();
     }
     let mut out = String::new();
     let mut rest = body;
     while let Some((size_line, after)) = rest.split_once("\r\n") {
-        let size = usize::from_str_radix(size_line.trim(), 16).unwrap_or(0);
+        let size = chunk_size(size_line).unwrap_or(0);
         if size == 0 {
             break;
         }
@@ -488,22 +501,13 @@ pub fn read_until_eof(stream: &mut TcpStream, patience: Duration) -> Option<Vec<
 /// Like [`raw_request`], but gives up after `patience` and returns `None` — for a server a failing
 /// test would otherwise leave the suite hanging on.
 pub fn raw_request_within(port: u16, raw: &[u8], patience: Duration) -> Option<String> {
-    let mut stream = TcpStream::connect(("127.0.0.1", port)).unwrap();
-    // A refused request is responded to and its connection closed while this is still writing, so
-    // a failed write is part of the outcome rather than an error.
-    let _ = stream.write_all(raw);
-    let response = read_until_eof(&mut stream, patience)?;
+    let response = send_within(port, raw, patience)?;
     Some(String::from_utf8_lossy(&response).into_owned())
 }
 
 /// Send `raw` bytes and return the full response (status line included).
 pub fn raw_request(port: u16, raw: &[u8]) -> String {
-    let mut stream = TcpStream::connect(("127.0.0.1", port)).unwrap();
-    // A refused request is responded to and its connection closed while this is still writing, so
-    // a failed write is part of the outcome rather than an error.
-    let _ = stream.write_all(raw);
-    let response = read_until_eof(&mut stream, PATIENCE).unwrap_or_default();
-    String::from_utf8_lossy(&response).into_owned()
+    raw_request_within(port, raw, PATIENCE).unwrap_or_default()
 }
 
 /// Read exactly one HTTP response off a connection that may stay open — framed by its
@@ -543,12 +547,7 @@ fn response_end(bytes: &[u8]) -> Option<usize> {
     if head.contains("transfer-encoding: chunked") {
         return chunked_end(bytes, head_end);
     }
-    let length = head
-        .split("content-length:")
-        .nth(1)
-        .and_then(|rest| rest.split("\r\n").next())
-        .and_then(|value| value.trim().parse::<usize>().ok())
-        .unwrap_or(0);
+    let length = content_length(&head).unwrap_or(0);
     let end = head_end + length;
     (bytes.len() >= end).then_some(end)
 }
@@ -558,8 +557,7 @@ fn response_end(bytes: &[u8]) -> Option<usize> {
 fn chunked_end(bytes: &[u8], mut pos: usize) -> Option<usize> {
     loop {
         let line_end = find(bytes, pos, b"\r\n")?;
-        let size_hex = std::str::from_utf8(&bytes[pos..line_end]).ok()?;
-        let size = usize::from_str_radix(size_hex.trim().split(';').next()?.trim(), 16).ok()?;
+        let size = chunk_size(std::str::from_utf8(&bytes[pos..line_end]).ok()?)?;
         if size == 0 {
             // The zero-size line, then the final empty line.
             let end = line_end + 4;
diff --git a/crates/serve-test-support/src/wasm_serve.rs b/crates/serve-test-support/src/wasm_serve.rs
index fa85db47..4ada5c5a 100644
--- a/crates/serve-test-support/src/wasm_serve.rs
+++ b/crates/serve-test-support/src/wasm_serve.rs
@@ -8,9 +8,9 @@
 //! left for what happens after a response is gone — `waitUntil` work, request-signal aborts, the
 //! server's own diagnostics — so a test asserts on it with [`WasmServer::wait_for_marker`].
 
-use std::net::TcpListener;
 use std::path::{Path, PathBuf};
 use std::process::{Child, Command, Stdio};
+use std::sync::{Mutex, OnceLock};
 use std::time::{Duration, Instant};
 
 /// The WASI capabilities the component needs: `cli` for `stderr`, the environment its configuration
@@ -64,30 +64,34 @@ pub enum Ready {
 /// suits the common case (a legacy script, no extra configuration, a `/ready` route), so a test
 /// names only what it cares about.
 pub struct Serve {
-    port: u16,
     files: Vec<(String, String)>,
     flags: Vec<String>,
     script: Vec<String>,
     wasmtime_flags: Vec<String>,
     env: Vec<(String, String)>,
     ready: Ready,
-    wizen: bool,
+    wizer_passes: usize,
     no_zeal: bool,
 }
 
+impl Default for Serve {
+    fn default() -> Self {
+        Self::new()
+    }
+}
+
 impl Serve {
-    /// A server on `port`. Ports are assigned per test from 18400 up, since the suite runs its
-    /// cases in parallel.
-    pub fn new(port: u16) -> Self {
+    /// A server on a port the system picks. The port is read back from `wasmtime serve`'s output
+    /// and reported by [`WasmServer::port`].
+    pub fn new() -> Self {
         Self {
-            port,
             files: Vec::new(),
             flags: Vec::new(),
             script: Vec::new(),
             wasmtime_flags: Vec::new(),
             env: Vec::new(),
             ready: Ready::Route,
-            wizen: false,
+            wizer_passes: 0,
             no_zeal: false,
         }
     }
@@ -157,16 +161,17 @@ impl Serve {
     }
 
     /// Snapshot the configured component with `wasmtime wizer` and serve the snapshot: the shape a
-    /// deployed server has, with the engine stood up and the script evaluated at build time.
+    /// deployed server has, with the engine stood up and the script evaluated at build time. Each
+    /// further call snapshots the previous snapshot again, which runs its init export once more.
     pub fn wizen(mut self) -> Self {
-        self.wizen = true;
+        self.wizer_passes += 1;
         self
     }
 
     /// Start the server, or return `None` when the wasm component or `wasmtime` is missing.
     pub fn start(self) -> Option<WasmServer> {
         let component = component()?;
-        let dir = work_dir(self.port);
+        let dir = work_dir();
         for (name, source) in &self.files {
             std::fs::write(dir.join(name), source).unwrap();
         }
@@ -180,32 +185,17 @@ impl Serve {
 
         // Compiled here rather than by the server below, so every server after the first loads a
         // component that is already compiled.
-        let component = if self.wizen {
-            let snapshot = dir.join("snapshot.wasm");
+        let mut component = component;
+        for pass in 1..=self.wizer_passes {
+            let snapshot = dir.join(format!("snapshot-{pass}.wasm"));
             snapshot_with_wizer(&dir, &component, &snapshot, &config, self.no_zeal);
-            snapshot
-        } else {
-            component
-        };
+            component = snapshot;
+        }
         let (component, ahead_of_time) = match precompiled(&component) {
             Some(cwasm) => (cwasm, true),
             None => (component, false),
         };
 
-        // A leaked child from an earlier run would serve every request below, so refuse the port
-        // rather than test whatever is already on it. A child being reaped still holds its port
-        // for a moment, so wait a little before calling it a leak.
-        let deadline = Instant::now() + Duration::from_secs(10);
-        loop {
-            match TcpListener::bind(("127.0.0.1", self.port)) {
-                Ok(listener) => break drop(listener),
-                Err(e) if Instant::now() >= deadline => {
-                    panic!("port {} is still in use ({e})", self.port)
-                }
-                Err(_) => std::thread::sleep(Duration::from_millis(100)),
-            }
-        }
-
         let log = std::fs::File::create(dir.join("serve.log")).unwrap();
         let mut command = Command::new("wasmtime");
         command
@@ -215,7 +205,7 @@ impl Serve {
             .args(ahead_of_time.then_some("--allow-precompiled"))
             .args(["--dir=.::/cwd", "--dir=.", WASI_FLAGS])
             .args(&self.wasmtime_flags)
-            .args(["--addr", &format!("127.0.0.1:{}", self.port)])
+            .args(["--addr", "127.0.0.1:0"])
             .arg(&component)
             .env("STARLINGMONKEY_CONFIG", &config)
             // Read by `WasmServer::await_new_idle`.
@@ -233,16 +223,43 @@ impl Serve {
         let child = command.envs(self.env.iter().cloned()).spawn().unwrap();
 
         let mut server = WasmServer {
-            port: self.port,
+            port: 0,
             child,
             dir,
         };
+        server.port = server.await_bound_port();
         server.await_ready(self.ready);
         Some(server)
     }
 }
 
 impl WasmServer {
+    /// Poll the serve log for the address `wasmtime serve` reports once it has bound its
+    /// listener, and return that address's port. Panics with the log if the child exits first.
+    fn await_bound_port(&mut self) -> u16 {
+        const BOUND: &str = "Serving HTTP on http://";
+        let deadline = Instant::now() + READY_PATIENCE;
+        while Instant::now() < deadline {
+            if let Some(status) = self.child.try_wait().unwrap() {
+                panic!(
+                    "wasmtime serve exited with {status} before listening\n{}",
+                    self.log()
+                );
+            }
+            let log = self.log();
+            let port = log
+                .split_once(BOUND)
+                .and_then(|(_, rest)| rest.split_once('/'))
+                .and_then(|(address, _)| address.rsplit_once(':'))
+                .and_then(|(_, port)| port.parse().ok());
+            if let Some(port) = port {
+                return port;
+            }
+            std::thread::sleep(Duration::from_millis(10));
+        }
+        panic!("wasmtime serve never reported its address\n{}", self.log());
+    }
+
     /// Poll until the server responds, or panic with the serve log. A child that died on a
     /// rejected flag or a runtime that refused its configuration is otherwise a silent hang.
     fn await_ready(&mut self, ready: Ready) {
@@ -255,9 +272,8 @@ impl WasmServer {
                     self.log()
                 );
             }
-            // Probed through a connection of its own: until the server binds, connecting is an
-            // error rather than a slow response, which the request helpers rightly refuse to paper
-            // over.
+            // The server is probed through a separate connection. Until it binds, connecting fails
+            // rather than being slow, and the request helpers don't hide such failures.
             let listening = std::net::TcpStream::connect(("127.0.0.1", self.port)).is_ok();
             if listening && ready == Ready::Listening {
                 return;
@@ -298,12 +314,6 @@ impl WasmServer {
         self.port
     }
 
-    /// The directory the child runs in: where the content script lives and where a test can leave
-    /// a file for it to read.
-    pub fn dir(&self) -> &Path {
-        &self.dir
-    }
-
     /// Everything the server has written to `stdout`/`stderr` so far, the guest's `console.error`
     /// output included.
     pub fn log(&self) -> String {
@@ -354,8 +364,8 @@ impl WasmServer {
         }
     }
 
-    /// The instances the host reports having handed a request to since `from` bytes into the log,
-    /// and the length to read the next batch from.
+    /// The instances to which the host reports having handed a request since `from` bytes into the
+    /// log, and the length from which to read the next batch.
     ///
     /// A serving host hands a request to an instance it counts as free, and raises a fresh one
     /// otherwise. A case whose requests have to meet cannot make it choose, so it reads back what
@@ -419,19 +429,20 @@ impl Drop for WasmServer {
     fn drop(&mut self) {
         let _ = self.child.kill();
         let _ = self.child.wait();
+        if !std::thread::panicking() {
+            let _ = std::fs::remove_dir_all(&self.dir);
+        }
     }
 }
 
 /// A response's message body, with the host's chunked framing decoded. The free-standing form of
 /// [`WasmServer::request`], for the tests that address a server's port from a thread of their own.
 pub fn message_body(response: &str) -> String {
-    let Some((head, body)) = response.split_once("\r\n\r\n") else {
-        return response.to_string();
-    };
-    if head.to_lowercase().contains("transfer-encoding: chunked") {
-        crate::dechunk(body)
-    } else {
-        body.to_string()
+    match crate::split_response(response) {
+        (Some(head), body) if head.to_lowercase().contains("transfer-encoding: chunked") => {
+            crate::dechunk(body)
+        }
+        (_, body) => body.to_string(),
     }
 }
 
@@ -450,17 +461,11 @@ pub fn component() -> Option<PathBuf> {
             "STARLING_WASM_COMPONENT is set, but there is no component at {}",
             component.display()
         );
-    }
-    let have_wasmtime = Command::new("wasmtime")
-        .arg("--version")
-        .stdout(Stdio::null())
-        .stderr(Stdio::null())
-        .status()
-        .is_ok_and(|status| status.success());
-    if let (Some(component), true) = (&configured, have_wasmtime) {
-        // Absolutized: each server runs in a work directory of its own and hands the path to
-        // `wasmtime` from there.
-        return Some(component.canonicalize().unwrap());
+        if wasmtime_version().is_some() {
+            // Absolutized: each server runs in a work directory of its own and hands the path to
+            // `wasmtime` from there.
+            return Some(component.canonicalize().unwrap());
+        }
     }
     NOTED.call_once(|| {
         let missing = if configured.is_some() {
@@ -480,6 +485,21 @@ pub fn component() -> Option<PathBuf> {
     None
 }
 
+/// The output of `wasmtime --version`, or `None` when `wasmtime` is not on PATH. Run once per
+/// process.
+fn wasmtime_version() -> Option<&'static str> {
+    static VERSION: OnceLock<Option<String>> = OnceLock::new();
+    VERSION
+        .get_or_init(|| {
+            let output = Command::new("wasmtime").arg("--version").output().ok()?;
+            output
+                .status
+                .success()
+                .then(|| String::from_utf8_lossy(&output.stdout).trim().to_string())
+        })
+        .as_deref()
+}
+
 /// The component compiled ahead of time, or `None` to serve the `.wasm` and let each server
 /// compile it itself.
 ///
@@ -493,13 +513,9 @@ pub fn component() -> Option<PathBuf> {
 fn precompiled(component: &Path) -> Option<PathBuf> {
     let out = component.with_extension("cwasm");
     let stamp_path = component.with_extension("cwasm.stamp");
-    let version = Command::new("wasmtime").arg("--version").output().ok()?;
+    let version = wasmtime_version()?;
     let modified = std::fs::metadata(component).ok()?.modified().ok()?;
-    let stamp = format!(
-        "{}\n{modified:?}\n{}",
-        String::from_utf8_lossy(&version.stdout).trim(),
-        CODEGEN_FLAGS.join(" "),
-    );
+    let stamp = format!("{version}\n{modified:?}\n{}", CODEGEN_FLAGS.join(" "));
     let current = |stamp: &str| {
         out.is_file() && std::fs::read_to_string(&stamp_path).is_ok_and(|found| found == stamp)
     };
@@ -507,8 +523,8 @@ fn precompiled(component: &Path) -> Option<PathBuf> {
         return Some(out);
     }
 
-    // One process compiles. The rest wait for it rather than each compiling the same artifact.
-    // Whoever creates the lock is the one that compiles.
+    // One process or thread compiles. The rest wait for it rather than each compiling the same
+    // artifact. Whoever creates the lock is the one that compiles.
     let lock = component.with_extension("cwasm.lock");
     match std::fs::OpenOptions::new()
         .write(true)
@@ -516,15 +532,25 @@ fn precompiled(component: &Path) -> Option<PathBuf> {
         .open(&lock)
     {
         Ok(_) => {
+            // Checked again, since a compile may have finished and released the lock between the
+            // check above and taking it.
+            if current(&stamp) {
+                let _ = std::fs::remove_file(&lock);
+                return Some(out);
+            }
             eprintln!("Precompiling the wasm component (once for this build) ...");
+            // Written next to `out` and renamed over it, so a server never loads a partly
+            // written artifact.
+            let partial = component.with_extension("cwasm.partial");
             let result = Command::new("wasmtime")
                 .arg("compile")
                 .args(CODEGEN_FLAGS)
                 .arg(component)
                 .arg("-o")
-                .arg(&out)
+                .arg(&partial)
                 .output();
-            let compiled = result.is_ok_and(|result| result.status.success());
+            let compiled = result.is_ok_and(|result| result.status.success())
+                && std::fs::rename(&partial, &out).is_ok();
             if compiled {
                 let _ = std::fs::write(&stamp_path, &stamp);
             }
@@ -546,16 +572,33 @@ fn precompiled(component: &Path) -> Option<PathBuf> {
     }
 }
 
-/// A clean directory for one server to run in, kept after the run so a failure's serve log and
-/// content script can be looked at.
-fn work_dir(port: u16) -> PathBuf {
-    let dir = std::env::temp_dir().join(format!("starling-serve-wasm/{port}"));
+/// A clean directory for one server to run in.
+///
+/// The directory is named after the current thread, which the test harness names after the test,
+/// and after the process, so concurrent runs of one suite do not share it. A test's second and
+/// later servers get a numbered suffix. [`WasmServer`]'s drop removes the directory unless the
+/// thread is panicking, so a failure's serve log and content script can be looked at.
+fn work_dir() -> PathBuf {
+    static STARTED: Mutex<Vec<String>> = Mutex::new(Vec::new());
+    let thread = std::thread::current();
+    let test = thread.name().unwrap_or("server").replace("::", "-");
+    let mut started = STARTED.lock().unwrap_or_else(|e| e.into_inner());
+    let earlier = started.iter().filter(|name| **name == test).count();
+    started.push(test.clone());
+    drop(started);
+    let process = std::process::id();
+    let name = match earlier {
+        0 => format!("{test}-{process}"),
+        _ => format!("{test}-{process}-{}", earlier + 1),
+    };
+    let dir = std::env::temp_dir().join("starling-serve-wasm").join(name);
     let _ = std::fs::remove_dir_all(&dir);
     std::fs::create_dir_all(&dir).unwrap();
     dir
 }
 
-/// Snapshot `component`, configured with `config`, into `out`.
+/// Snapshot `component`, configured with `config` and run in `dir`, into `out`. With `no_zeal`,
+/// SpiderMonkey runs under its ordinary GC (see [`Serve::without_gc_zeal`]).
 ///
 /// `--keep-init-func` because dropping the init export — wizer's default — leaves the component
 /// referring to a core export that is no longer there, and the snapshot then fails to load at all.
diff --git a/crates/serve-test-support/tests/serve_wasm_e2e.rs b/crates/serve-test-support/tests/serve_wasm_e2e.rs
index 696fe046..9ee77d7f 100644
--- a/crates/serve-test-support/tests/serve_wasm_e2e.rs
+++ b/crates/serve-test-support/tests/serve_wasm_e2e.rs
@@ -16,9 +16,10 @@
 use serve_test_support as common;
 
 use common::read_until_eof;
-use common::wasm_serve::{Ready, Serve};
+use common::wasm_serve::{Ready, Serve, WasmServer};
 use std::io::Write;
 use std::net::TcpStream;
+use std::panic::AssertUnwindSafe;
 use std::time::Duration;
 
 /// Counts the requests one instance has served, so a test can tell whether it is still talking to
@@ -38,7 +39,7 @@ addEventListener('fetch', (event) => {
 /// as they do in the native server's default mode.
 #[test]
 fn sequential_requests_share_one_instance() {
-    let Some(server) = Serve::new(18402)
+    let Some(server) = Serve::new()
         .reusing_one_instance()
         .script(REQUEST_COUNTER)
         .start()
@@ -71,11 +72,11 @@ fn sequential_requests_share_one_instance() {
 }
 
 /// The other side of that contract: reuse is the host's choice, and a host that declines it hands
-/// every request a global of its own — the property the native server offers as `--serve-isolated`
-/// and the WPT serve harness asks `wasmtime serve` for.
+/// every request a global of its own. The native server offers this as `--serve-isolated`, and
+/// the WPT serve harness requests it from `wasmtime serve`.
 #[test]
 fn a_host_that_retires_instances_gives_each_request_a_fresh_global() {
-    let Some(server) = Serve::new(18403)
+    let Some(server) = Serve::new()
         .wasmtime_flags(["--max-instance-reuse-count", "1"])
         .script(REQUEST_COUNTER)
         .start()
@@ -103,11 +104,7 @@ fn a_repeating_timer_keeps_running_between_requests() {
     addEventListener('fetch', (event) => {
         event.respondWith(new Response('ticks=' + globalThis.ticks));
     });"#;
-    let Some(server) = Serve::new(18404)
-        .reusing_one_instance()
-        .script(TICKER)
-        .start()
-    else {
+    let Some(server) = Serve::new().reusing_one_instance().script(TICKER).start() else {
         return;
     };
 
@@ -120,7 +117,7 @@ fn a_repeating_timer_keeps_running_between_requests() {
 
     let first = ticks(&server);
     // Idle time with no requests at all: the interval has to fire on its own.
-    std::thread::sleep(Duration::from_millis(500));
+    std::thread::sleep(Duration::from_millis(200));
     let second = ticks(&server);
     assert!(
         second > first,
@@ -139,7 +136,7 @@ fn an_unawaited_top_level_fetch_does_not_break_the_instance() {
         "fetch('http://127.0.0.1:{upstream}/');
         addEventListener('fetch', (event) => event.respondWith(new Response('served')));"
     );
-    let Some(server) = Serve::new(18405).script(&handler).start() else {
+    let Some(server) = Serve::new().script(&handler).start() else {
         return;
     };
 
@@ -152,7 +149,7 @@ fn an_unawaited_top_level_fetch_does_not_break_the_instance() {
 /// host paths — goes to the log.
 #[test]
 fn a_runtime_that_will_not_start_keeps_its_reasons_off_the_wire() {
-    let Some(server) = Serve::new(18406)
+    let Some(server) = Serve::new()
         .flags(["--legacy-script", "not-a-real-script.js"])
         .ready(Ready::AnyResponse)
         .start()
@@ -180,7 +177,7 @@ fn a_runtime_that_will_not_start_keeps_its_reasons_off_the_wire() {
 /// once.
 #[test]
 fn a_failed_startup_is_not_retried_by_later_requests() {
-    let Some(server) = Serve::new(18461)
+    let Some(server) = Serve::new()
         .reusing_one_instance()
         .script("console.error('startup-ran'); throw new Error('startup failed');")
         .ready(Ready::AnyResponse)
@@ -211,32 +208,6 @@ fn a_failed_startup_is_not_retried_by_later_requests() {
     );
 }
 
-/// A `fetch` whose request has a header the host refuses rejects with a `TypeError` naming
-/// that header. `http2-settings` is allowed by Fetch but refused by `wasi:http`.
-#[test]
-fn a_fetch_with_a_header_the_host_refuses_rejects_naming_it() {
-    let upstream = common::start_upstream("UPSTREAM-BODY");
-    let handler = format!(
-        r#"addEventListener('fetch', (event) => {{
-            if (new URL(event.request.url).pathname === '/ready') {{
-                event.respondWith(new Response('ready'));
-                return;
-            }}
-            event.respondWith(
-                fetch('http://127.0.0.1:{upstream}/', {{ headers: {{ 'http2-settings': 'AAMAAABk' }} }})
-                    .then(() => new Response('sent'), (e) => new Response(e.name + ': ' + e.message))
-            );
-        }});"#
-    );
-    let Some(server) = Serve::new(18462).script(&handler).start() else {
-        return;
-    };
-
-    let body = server.get("/");
-    assert!(body.starts_with("TypeError: "), "{body}");
-    assert!(body.contains("http2-settings"), "{body}");
-}
-
 /// An unusual status is the handler's to choose: it reaches the client as itself, and the host
 /// must not act on it behind the handler's back — a `421` invites a client to retry elsewhere, not
 /// the server to re-dispatch (`serve_delivers_an_unusual_status_without_retrying_it`). That the
@@ -257,11 +228,7 @@ fn serve_delivers_an_unusual_status_without_retrying_it() {
         globalThis.dispatches++;
         event.respondWith(new Response('misdirected', { status: 421 }));
     });"#;
-    let Some(server) = Serve::new(18407)
-        .reusing_one_instance()
-        .script(HANDLER)
-        .start()
-    else {
+    let Some(server) = Serve::new().reusing_one_instance().script(HANDLER).start() else {
         return;
     };
 
@@ -281,26 +248,6 @@ fn serve_delivers_an_unusual_status_without_retrying_it() {
     );
 }
 
-/// A handler returning `Response.error()` — a network-error response with status 0 — must not
-/// serialize the protocol-illegal status line `HTTP/1.1 0`; the status is surfaced as a 500
-/// (`serve_maps_invalid_status_to_500`).
-#[test]
-fn serve_maps_invalid_status_to_500() {
-    const HANDLER: &str = r#"addEventListener('fetch', (event) => {
-        if (new URL(event.request.url).pathname === '/ready') {
-            event.respondWith(new Response('ready'));
-            return;
-        }
-        event.respondWith(Response.error());
-    });"#;
-    let Some(server) = Serve::new(18408).script(HANDLER).start() else {
-        return;
-    };
-
-    let response = server.full_request("GET", "/", "");
-    assert!(response.starts_with("HTTP/1.1 500"), "got: {response}");
-}
-
 /// A script that registers no `fetch` listener can only ever serve 500s. Native refuses to serve
 /// at all (`a_script_with_no_fetch_listener_refuses_to_serve`) and wizer refuses to snapshot it,
 /// but a wasm server cannot decline the host's requests, so it reports the reason once and the
@@ -308,7 +255,7 @@ fn serve_maps_invalid_status_to_500() {
 /// follow each say why too.
 #[test]
 fn a_script_with_no_fetch_listener_reports_itself_and_answers_500s() {
-    let Some(server) = Serve::new(18409)
+    let Some(server) = Serve::new()
         .script("globalThis.ready = true;")
         .ready(Ready::AnyResponse)
         .start()
@@ -334,7 +281,7 @@ fn a_script_with_no_fetch_listener_reports_itself_and_answers_500s() {
 /// rejection is logged once, and every request is answered with a 500.
 #[test]
 fn a_late_top_level_rejection_fails_startup() {
-    let Some(server) = Serve::new(18474)
+    let Some(server) = Serve::new()
         .module(
             "entry.mjs",
             "addEventListener('fetch', (event) => event.respondWith(new Response('served')));
@@ -356,7 +303,7 @@ fn a_late_top_level_rejection_fails_startup() {
         "{}",
         server.log()
     );
-    // Logged when startup fails, not again for each request.
+    // The rejection is logged once when startup fails, and not again for each request.
     let log = server.log();
     assert_eq!(
         log.matches("top-level `await` rejected").count(),
@@ -390,7 +337,7 @@ fn a_reused_instance_shares_its_global_and_starts_up_once() {
         state.count += 1;
         event.respondWith(new Response('ok'));
     });"#;
-    let Some(server) = Serve::new(18410)
+    let Some(server) = Serve::new()
         .reusing_one_instance()
         .file("dep.mjs", "export const state = { count: 0 };")
         .module("entry.mjs", ENTRY)
@@ -446,9 +393,9 @@ fn a_later_request_gets_a_fresh_event_and_signal() {
             start(c) { setInterval(() => c.enqueue(new TextEncoder().encode('tick ')), 50); },
         })));
     });"#;
-    let Some(server) = Serve::new(18411)
+    let Some(server) = Serve::new()
         .reusing_one_instance()
-        .flags(["--response-body-timeout", "1"])
+        .flags(["--response-body-timeout", "0.2"])
         .script(HANDLER)
         .start()
     else {
@@ -491,7 +438,7 @@ fn a_later_request_gets_its_own_response_body_window() {
             })));
             return;
         }
-        // Three chunks over ~900ms: comfortably inside a fresh 3s window, and nowhere near one
+        // Three chunks over ~300ms: comfortably inside a fresh 900ms window, and nowhere near one
         // that a previous request had already spent.
         event.respondWith(new Response(new ReadableStream({
             start(c) {
@@ -502,13 +449,13 @@ fn a_later_request_gets_its_own_response_body_window() {
                         clearInterval(timer);
                         c.close();
                     }
-                }, 300);
+                }, 100);
             },
         })));
     });"#;
-    let Some(server) = Serve::new(18412)
+    let Some(server) = Serve::new()
         .reusing_one_instance()
-        .flags(["--response-body-timeout", "3"])
+        .flags(["--response-body-timeout", "0.9"])
         .script(HANDLER)
         .start()
     else {
@@ -526,7 +473,7 @@ fn a_later_request_gets_its_own_response_body_window() {
 
 /// A handler that proxies `/fetch` from an upstream slow enough to still be in flight while
 /// another request's post-response work finishes, and serves `/lifetime` at once while leaving
-/// two seconds of `waitUntil` work behind it.
+/// 600ms of `waitUntil` work behind it.
 fn overlapping_work_handler(upstream: u16) -> String {
     format!(
         r#"addEventListener('fetch', (event) => {{
@@ -539,7 +486,7 @@ fn overlapping_work_handler(upstream: u16) -> String {
             event.waitUntil(new Promise((resolve) => setTimeout(() => {{
                 console.error('lifetime-done');
                 resolve();
-            }}, 2000)));
+            }}, 600)));
             event.respondWith(new Response('lifetime-started'));
             return;
         }}
@@ -564,8 +511,8 @@ fn overlapping_work_handler(upstream: u16) -> String {
 /// is what keeps the second request's in-flight `fetch` out of it.
 #[test]
 fn post_response_work_does_not_disturb_the_next_request() {
-    let upstream = common::start_slow_upstream(Duration::from_secs(3), "upstream-body");
-    let Some(server) = Serve::new(18413)
+    let upstream = common::start_slow_upstream(Duration::from_millis(1200), "upstream-body");
+    let Some(server) = Serve::new()
         .reusing_one_instance()
         .script(&overlapping_work_handler(upstream))
         .start()
@@ -575,7 +522,7 @@ fn post_response_work_does_not_disturb_the_next_request() {
 
     // Both have to run in one instance for the first request's drain to reach the second.
     let (started, proxied) = met_in_one_instance(&server, || {
-        // Answered at once, with two seconds of lifetime work left running behind it.
+        // This request is answered at once, with 600ms of lifetime work left running behind it.
         let started = server.get("/lifetime");
         // Its own `fetch` outlasts that window, so the first request's drain ends, releasing what
         // its loop still holds, while this one is still waiting on the upstream.
@@ -590,15 +537,15 @@ fn post_response_work_does_not_disturb_the_next_request() {
     );
 }
 
-/// The same overlap with the harsher ending: the first request's response-body clock runs out —
-/// aborting its signal from its drain task, on the realm the second request is running JS in —
-/// while the second is parked mid-dispatch. Each has to see only its own outcome.
+/// The same overlap with the harsher ending: the first request's response-body clock runs out
+/// while the second is parked mid-dispatch, and the first request's drain task aborts its signal
+/// on the realm in which the second is running JS. Each has to see only its own outcome.
 #[test]
 fn a_truncated_response_body_does_not_disturb_a_concurrent_request() {
-    let upstream = common::start_slow_upstream(Duration::from_millis(2500), "upstream-body");
-    let Some(server) = Serve::new(18414)
+    let upstream = common::start_slow_upstream(Duration::from_millis(1000), "upstream-body");
+    let Some(server) = Serve::new()
         .reusing_one_instance()
-        .flags(["--response-body-timeout", "1"])
+        .flags(["--response-body-timeout", "0.3"])
         .script(&overlapping_work_handler(upstream))
         .start()
     else {
@@ -646,7 +593,7 @@ fn instance_of(response: &str) -> &str {
 }
 
 /// Fail unless every response came from the same instance — otherwise the requests never met, and
-/// whatever the test asserts about them not interfering proves nothing.
+/// the test's assertions that they don't interfere are meaningless.
 fn assert_met_in_one_instance(responses: &[&str]) {
     let ids: Vec<&str> = responses.iter().map(|r| instance_of(r)).collect();
     assert!(
@@ -690,6 +637,16 @@ fn met_in_one_instance<T>(
     unreachable!("the loop returns or asserts")
 }
 
+/// Request `path` from `server` until the body is `settled`, and return the last body. See
+/// [`common::eventually`].
+fn eventually(
+    server: &common::wasm_serve::WasmServer,
+    path: &str,
+    settled: impl Fn(&str) -> bool,
+) -> String {
+    common::eventually(|| server.get(path), settled)
+}
+
 /// Wait until a handler has parked on `gate` and the instance has reported an idle event loop, so
 /// the next request meets an instance blocked on I/O rather than one running guest code, which
 /// would be given an instance of its own.
@@ -773,12 +730,12 @@ fn concurrent_requests_in_one_instance_keep_their_own_state() {
     }});"#,
         gate = gate.port()
     );
-    let Some(server) = Serve::new(18415)
+    let Some(server) = Serve::new()
         .reusing_one_instance()
-        // Pinned to the ordinary collector. Every request is sent only once the instance has
-        // reported an idle loop, but under mode 4 the verifier wakes it again between that report
-        // and the request landing, often enough that the host gives the request an instance of its
-        // own.
+        // This server runs with the ordinary collector. Every request is sent only once the
+        // instance has reported an idle loop, but under mode 4 the verifier wakes it again between
+        // that report and the request landing, often enough that the host gives the request an
+        // instance of its own.
         .without_gc_zeal()
         .script(&format!("{INSTANCE_ID}\n{handler}"))
         .start()
@@ -824,6 +781,16 @@ fn concurrent_requests_in_one_instance_keep_their_own_state() {
     assert_met_in_one_instance(&[&slow, &quick, &streamed_body]);
 }
 
+/// How long a request in the interleaving case below may take. Its own patience, since that case
+/// runs its JS with the collector in the way.
+const WORK_PATIENCE: Duration = Duration::from_secs(180);
+
+/// The rounds of await-then-allocate run by each request, and how much each round allocates. The
+/// rounds are enough that every request is still working while the others are. The allocation is
+/// enough to give the collector real work to do in the middle of one request's JS.
+const ROUNDS: usize = 12;
+const PER_ROUND: usize = 1000;
+
 /// The realm-stack worry the `RUNTIME` thread-local is written around: entering the global's realm
 /// per request would mean `JSAutoRealm` scopes dropping out of order under interleaving, restoring
 /// the wrong realm under whichever requests are still in flight. Requests here are deliberately
@@ -833,16 +800,12 @@ fn concurrent_requests_in_one_instance_keep_their_own_state() {
 /// Held to five concurrent requests: past `--max-instance-concurrent-reuse-count`'s default of 16
 /// the host would spread them over instances, and interleaving is the whole point.
 ///
-/// Its own patience, since the GC-stress variant runs the same JS with the collector in the way.
-const WORK_PATIENCE: Duration = Duration::from_secs(180);
-
-/// Rounds of await-then-allocate each request runs, and how much each round allocates. The rounds
-/// are enough that every request is still working while the others are. The allocation is enough
-/// to give the GC-stress variant's collector real work to do in the middle of one request's JS.
-const ROUNDS: usize = 12;
-const PER_ROUND: usize = 1000;
-
-fn interleaved_requests_all_get_their_own_answer(port: u16, zeal: Option<&str>) {
+/// The collector runs constantly (zeal mode 2: collect every N allocations), since a rooting or
+/// realm mistake surfaces when GC lands in the middle of one request's JS while others are parked.
+/// Only a `debugmozjs` component acts on the zeal mode. Against any other component this runs the
+/// same interleaving under the ordinary collector.
+#[test]
+fn deeply_interleaved_requests_keep_the_realm_stack_intact() {
     let gate = common::start_held_upstream("go");
     let handler = format!(
         r#"addEventListener('fetch', (event) => {{
@@ -851,6 +814,10 @@ fn interleaved_requests_all_get_their_own_answer(port: u16, zeal: Option<&str>)
             event.respondWith(new Response('ready'));
             return;
         }}
+        if (url.pathname === '/instance') {{
+            event.respondWith(new Response('instance=' + globalThis.instance));
+            return;
+        }}
         const n = Number(url.searchParams.get('n'));
         event.respondWith((async () => {{
             // Park on the gate before doing anything else. The harness starts the next request
@@ -872,15 +839,16 @@ fn interleaved_requests_all_get_their_own_answer(port: u16, zeal: Option<&str>)
     }});"#,
         gate = gate.port()
     );
-    // `zeal` is this case's collector, not the run's. Twelve rounds of allocate-then-await across
+    // The zeal mode is this case's own, not the run's. Twelve rounds of allocate-then-await across
     // five requests make many event loop turns over a large live heap, and mode 4 (verify
     // pre-barriers) walks that heap at every one, measured at roughly 8 seconds per turn. Mode 2
     // and the ordinary collector both finish the whole workload in about five.
-    let server = Serve::new(port)
+    let Some(server) = Serve::new()
         .reusing_one_instance()
-        .without_gc_zeal()
-        .script(&format!("{INSTANCE_ID}\n{handler}"));
-    let Some(server) = zeal.into_iter().fold(server, Serve::gc_zeal).start() else {
+        .gc_zeal("2,200")
+        .script(&format!("{INSTANCE_ID}\n{handler}"))
+        .start()
+    else {
         return;
     };
 
@@ -921,34 +889,12 @@ fn interleaved_requests_all_get_their_own_answer(port: u16, zeal: Option<&str>)
     assert_met_in_one_instance(&answers.iter().map(String::as_str).collect::<Vec<_>>());
 
     // Still serving after all that, rather than having taken the process down with it.
-    let after = common::full_request_within(port, "GET", "/work?n=9", "", WORK_PATIENCE)
-        .expect("the server must still be serving");
     assert_eq!(
-        common::wasm_serve::message_body(&after),
-        format!(
-            "n=9 allocated={allocated} instance={}",
-            instance_of(&answers[0])
-        )
+        server.get("/instance"),
+        format!("instance={}", instance_of(&answers[0]))
     );
 }
 
-#[test]
-fn deeply_interleaved_requests_keep_the_realm_stack_intact() {
-    interleaved_requests_all_get_their_own_answer(18416, None);
-}
-
-/// The same interleaving with the collector running constantly (zeal mode 2: collect every N
-/// allocations). GC landing in the middle of one request's JS while others are parked is exactly
-/// where a rooting or realm mistake surfaces, and nothing else in this suite arranges it.
-#[test]
-fn deeply_interleaved_requests_survive_gc_stress() {
-    interleaved_requests_all_get_their_own_answer(18417, Some("2,200"));
-}
-
-/// A content script that is still evaluating for a second and a half after the instance starts, so
-/// the requests that arrive meanwhile have to wait it out. Its instance id is drawn before the
-/// `await`, so a request served from a half-evaluated script would still name the instance it ran
-/// in — what marks the script as fully evaluated is the listener, registered after.
 /// A content script whose startup waits on a [`common::HeldUpstream`] rather than on a timer. The
 /// upstream is handed the request the guest made reaching its top-level `await`, which pins
 /// exactly when the instance got there.
@@ -973,7 +919,7 @@ addEventListener('fetch', (event) => {{
 #[test]
 fn concurrent_first_requests_all_wait_out_one_startup() {
     let gate = common::start_held_upstream("go");
-    let Some(server) = Serve::new(18418)
+    let Some(server) = Serve::new()
         .reusing_one_instance()
         // Not `/ready`: a readiness probe would itself be the first request and drive the very
         // startup this test is about.
@@ -1045,7 +991,7 @@ fn concurrent_first_requests_all_wait_out_one_startup() {
 #[test]
 fn a_client_that_leaves_mid_startup_does_not_strand_the_instance() {
     let gate = common::start_held_upstream("go");
-    let Some(server) = Serve::new(18419)
+    let Some(server) = Serve::new()
         .reusing_one_instance()
         .ready(Ready::Listening)
         .module("startup.mjs", &slow_startup(gate.port()))
@@ -1076,28 +1022,39 @@ fn a_client_that_leaves_mid_startup_does_not_strand_the_instance() {
     );
 }
 
-/// A snapshotted instance serves many requests, so the repairs a resumed instance needs — the
-/// monotonic clock's origin above all, anchored to the process the snapshot was taken in — have to
-/// happen exactly once, on the first of them. Running them again on a later request would rebase
-/// the clock under a handler that had already read it, so `performance.now()` is checked for going
-/// forwards across requests rather than merely being plausible on the first. The shared global
-/// carries across requests here exactly as it does without a snapshot.
+/// A wizened instance serves many requests, so the repairs a resumed instance needs have to happen
+/// exactly once, on the first of them. The main one rebases the monotonic clock's origin, which is
+/// anchored to the process the snapshot was taken in. Running them again on a later request would
+/// rebase the clock under a handler that had already read it, so `performance.now()` is checked for
+/// going forwards across requests rather than merely being plausible on the first. The shared
+/// global persists across requests here exactly as it does without a snapshot.
+///
+/// The content script's top-level `await` finishes before the snapshot is taken, so the listener
+/// registered after it is in place for the first request (`test-wizer.sh`'s `awaited.mjs` case,
+/// extended here with the ordering the response reports).
 #[test]
-fn a_snapshotted_instance_keeps_its_clock_and_global_across_requests() {
-    const HANDLER: &str = r#"const atStartup = performance.now();
+fn a_wizened_instance_keeps_its_clock_and_global_across_requests() {
+    // The ordering is recorded in a global and reported in the response rather than through the
+    // usual stderr markers: writing to stdio before the snapshot is taken leaves the resumed
+    // instance with a stale stream handle, and every later write traps.
+    const SCRIPT: &str = r#"globalThis.order = ['evaluating'];
+    const atStartup = performance.now();
+    await new Promise((resolve) => setTimeout(resolve, 300));
+    globalThis.order.push('evaluated');
     globalThis.served = 0;
     addEventListener('fetch', (event) => {
-        if (new URL(event.request.url).pathname === '/ready') {
-            event.respondWith(new Response('ready'));
-            return;
-        }
+        globalThis.order.push('dispatched');
         event.respondWith(new Response('n=' + (++globalThis.served)
-            + ' startup=' + atStartup.toFixed(0) + ' now=' + performance.now().toFixed(0)));
+            + ' startup=' + atStartup.toFixed(0) + ' now=' + performance.now().toFixed(0)
+            + ' order=' + globalThis.order.join(',')));
     });"#;
-    let Some(server) = Serve::new(18420)
+    let Some(server) = Serve::new()
         .reusing_one_instance()
         .wizen()
-        .script(HANDLER)
+        // Not `/ready`: the listener would serve a readiness probe, which would change the
+        // `order` and `n` values this test asserts on.
+        .ready(Ready::Listening)
+        .module("awaited.mjs", SCRIPT)
         .start()
     else {
         return;
@@ -1105,20 +1062,31 @@ fn a_snapshotted_instance_keeps_its_clock_and_global_across_requests() {
 
     let mut previous = 0.0;
     for expected in 1..=3 {
-        // Spaced out so a rebased clock is unmistakable rather than within the few milliseconds
-        // back-to-back requests are apart — and still far inside the pinned idle timeout.
-        std::thread::sleep(Duration::from_millis(300));
+        // The requests are spaced out so a rebased clock is unmistakable rather than within the
+        // few milliseconds between back-to-back requests, and still far inside the pinned idle
+        // timeout.
+        std::thread::sleep(Duration::from_millis(100));
         let body = server.get("/served");
-        let field = |name: &str| -> f64 {
+        let field = |name: &str| -> &str {
             body.split(&format!("{name}="))
                 .nth(1)
                 .and_then(|rest| rest.split(' ').next())
-                .and_then(|value| value.parse().ok())
                 .unwrap_or_else(|| panic!("no {name} in {body:?}"))
         };
+        let number = |name: &str| -> f64 {
+            field(name)
+                .parse()
+                .unwrap_or_else(|_| panic!("{name} is not a number in {body:?}"))
+        };
         assert!(body.starts_with(&format!("n={expected} ")), "{body}");
+        let dispatched = vec!["dispatched"; expected].join(",");
+        assert_eq!(
+            field("order"),
+            format!("evaluating,evaluated,{dispatched}"),
+            "the script must finish evaluating once, before the first dispatch: {body}"
+        );
         // A clock still reading from the snapshot's time origin would be hours out.
-        let (startup, now) = (field("startup"), field("now"));
+        let (startup, now) = (number("startup"), number("now"));
         assert!((0.0..60_000.0).contains(&startup), "{body}");
         assert!((0.0..60_000.0).contains(&now), "{body}");
         assert!(
@@ -1130,173 +1098,19 @@ fn a_snapshotted_instance_keeps_its_clock_and_global_across_requests() {
     }
 }
 
-/// A header value is a byte sequence, not text: Fetch isomorphic-encodes it, so `U+00DF U+00C0
-/// U+00BF` has to leave as `DF C0 BF` rather than as their UTF-8 encodings
-/// (`a_response_header_value_is_sent_as_bytes_not_utf8`). The neighbouring header is there to catch
-/// the *other* way this can go wrong: a header list the host refuses must not take the rest with
-/// it.
-#[test]
-fn a_response_header_value_is_sent_as_bytes_not_utf8() {
-    let handler = "addEventListener('fetch', (event) => {\n\
-        if (new URL(event.request.url).pathname === '/ready') {\n\
-            event.respondWith(new Response('ready'));\n\
-            return;\n\
-        }\n\
-        event.respondWith(new Response('x', { headers: {\n\
-            'x-test': '\u{df}\u{c0}\u{bf}',\n\
-            'x-other': 'kept',\n\
-        } }));\n\
-    });";
-    let Some(server) = Serve::new(18421).script(handler).start() else {
-        return;
-    };
-
-    let raw = common::raw_response_within(server.port(), "GET", "/", "", Duration::from_secs(20))
-        .expect("a complete response");
-    let needle = b"x-test: \xdf\xc0\xbf\r\n";
-    assert!(
-        raw.windows(needle.len()).any(|window| window == needle),
-        "the header must be the three bytes DF C0 BF, got: {:?}",
-        String::from_utf8_lossy(&raw)
-    );
-    assert!(
-        raw.windows(14).any(|window| window == b"x-other: kept\r"),
-        "the other headers must survive: {:?}",
-        String::from_utf8_lossy(&raw)
-    );
-}
-
-/// `wasi:http` refuses the connection-management headers it writes itself, which
-/// `prepare_wire_response` does not filter and a handler — or an upstream whose response is being
-/// proxied — may perfectly well set. Only that header may be lost.
-#[test]
-fn a_response_header_the_host_refuses_does_not_take_the_others_with_it() {
-    const HANDLER: &str = r#"addEventListener('fetch', (event) => {
-        if (new URL(event.request.url).pathname === '/ready') {
-            event.respondWith(new Response('ready'));
-            return;
-        }
-        event.respondWith(new Response('body', { headers: {
-            'x-before': 'kept',
-            'keep-alive': 'timeout=5',
-            'x-after': 'kept',
-        } }));
-    });"#;
-    let Some(server) = Serve::new(18422).script(HANDLER).start() else {
-        return;
-    };
-
-    let response = server.full_request("GET", "/", "");
-    assert!(response.contains("x-before: kept"), "{response}");
-    assert!(response.contains("x-after: kept"), "{response}");
-    assert!(
-        !response.to_lowercase().contains("keep-alive"),
-        "the refused header must not be on the wire: {response}"
-    );
-    assert_eq!(
-        common::wasm_serve::message_body(&response),
-        "body",
-        "{response}"
-    );
-    assert!(
-        server.wait_for_marker(
-            "dropping the response header `keep-alive`",
-            Duration::from_secs(5)
-        ),
-        "{}",
-        server.log()
-    );
-}
-
-/// A header carrying a byte that would split the response never gets as far as the transport:
-/// `Headers` refuses it at construction (`a_response_header_value_with_a_null_byte_is_refused`).
-#[test]
-fn a_response_header_value_with_a_null_byte_is_refused() {
-    const HANDLER: &str = r#"addEventListener('fetch', (event) => {
-        let outcome;
-        try {
-            new Response('x', { headers: { 'x-test': 'b\0r' } });
-            outcome = 'constructed';
-        } catch (e) {
-            outcome = e.name;
-        }
-        event.respondWith(new Response(outcome));
-    });"#;
-    let Some(server) = Serve::new(18424).script(HANDLER).start() else {
-        return;
-    };
-
-    assert_eq!(server.get("/"), "TypeError");
-}
-
-/// What the wire's headers look like from JS: a field that arrived in mixed case is found by any
-/// casing, the incoming set is immutable — it describes what was received, which nothing can change
-/// after the fact — and headers put on the response come back out with `set-cookie` kept as
-/// separate fields while everything else combines
-/// (`serve_exposes_incoming_headers_and_keeps_them_immutable`).
+/// Snapshotting a snapshot runs its init export again, in an instance whose script has already
+/// been evaluated. The instance resumed from that snapshot still serves.
 #[test]
-fn serve_exposes_incoming_headers_and_keeps_them_immutable() {
-    const HANDLER: &str = r#"addEventListener('fetch', (event) => {
-        const incoming = event.request.headers;
-        if (new URL(event.request.url).pathname === '/ready') {
-            event.respondWith(new Response('ready'));
-            return;
-        }
-        let immutable = 'mutable';
-        try {
-            incoming.delete('user-agent');
-        } catch (e) {
-            immutable = e.constructor.name;
-        }
-        const response = new Response('ok', {
-            headers: [
-                ['x-seen', incoming.get('EXAMPLE-HEADER') ?? 'missing'],
-                ['x-agent', incoming.get('User-Agent') ?? 'missing'],
-                ['x-immutable', immutable],
-            ],
-        });
-        response.headers.append('set-cookie', 'A');
-        response.headers.append('set-cookie', 'B');
-        response.headers.append('another', 'A');
-        response.headers.append('another', 'B');
-        event.respondWith(response);
-    });"#;
-    let Some(server) = Serve::new(18423).script(HANDLER).start() else {
+fn a_twice_wizened_instance_serves() {
+    let Some(server) = Serve::new()
+        .wizen()
+        .wizen()
+        .script("addEventListener('fetch', (event) => event.respondWith(new Response('ok')));")
+        .start()
+    else {
         return;
     };
-
-    let response = common::raw_request_within(
-        server.port(),
-        b"GET / HTTP/1.1\r\nHost: x\r\neXample-hEader: Header Value\r\nUser-Agent: test-agent\r\n\
-          Connection: close\r\n\r\n",
-        Duration::from_secs(20),
-    )
-    .expect("a complete response");
-
-    assert!(
-        response.contains("x-seen: Header Value"),
-        "a mixed-case field must be found by any casing: {response}"
-    );
-    assert!(response.contains("x-agent: test-agent"), "got: {response}");
-    assert!(
-        response.contains("x-immutable: TypeError"),
-        "an incoming request's headers must not be mutable: {response}"
-    );
-    // `set-cookie` must stay one field per cookie: combining two cookies into one field changes
-    // what they mean. Other repeats may go out either as separate fields or as one comma list —
-    // RFC 9110 §5.2 makes those equivalent — but both values have to survive.
-    assert_eq!(
-        response.matches("set-cookie: ").count(),
-        2,
-        "each cookie needs a field of its own: {response}"
-    );
-    assert!(response.contains("set-cookie: A"), "got: {response}");
-    assert!(response.contains("set-cookie: B"), "got: {response}");
-    assert!(
-        response.contains("another: A, B")
-            || (response.contains("another: A") && response.contains("another: B")),
-        "both values of a repeated header must reach the client: {response}"
-    );
+    assert_eq!(server.get("/"), "ok");
 }
 
 /// A `ReadableStream` whose `start()` neither enqueues nor closes leaves the pump's read pending in
@@ -1316,11 +1130,7 @@ fn an_abandoned_response_body_does_not_hang_the_request() {
         }
         event.respondWith(new Response('still serving'));
     });"#;
-    let Some(server) = Serve::new(18425)
-        .reusing_one_instance()
-        .script(HANDLER)
-        .start()
-    else {
+    let Some(server) = Serve::new().reusing_one_instance().script(HANDLER).start() else {
         return;
     };
 
@@ -1375,7 +1185,7 @@ fn an_abandoned_body_is_told_apart_from_a_complete_one() {
             },
         })));
     });"#;
-    let Some(server) = Serve::new(18426)
+    let Some(server) = Serve::new()
         .reusing_one_instance()
         .ready(Ready::AnyResponse)
         .script(HANDLER)
@@ -1400,7 +1210,7 @@ fn an_abandoned_body_is_told_apart_from_a_complete_one() {
 
 /// `--dispatch-timeout` bounds a `respondWith` that never settles — without one, the default, the
 /// request would wait for as long as the handler takes
-/// (`a_dispatch_timeout_answers_a_never_settling_respond_with`). Giving up is step 17.4.20's
+/// (`a_dispatch_timeout_frees_the_slot_it_held`). Giving up is step 17.4.20's
 /// "terminated", so the handler is told through its request signal, and the `waitUntil` window is
 /// its own on the 500 path as on any other.
 #[test]
@@ -1418,8 +1228,8 @@ fn a_dispatch_timeout_answers_a_never_settling_respond_with() {
         }, 300)));
         event.respondWith(new Promise(() => {}));
     });"#;
-    let Some(server) = Serve::new(18427)
-        .flags(["--dispatch-timeout", "1", "--waituntil-timeout", "2"])
+    let Some(server) = Serve::new()
+        .flags(["--dispatch-timeout", "0.2", "--waituntil-timeout", "2"])
         .script(HANDLER)
         .start()
     else {
@@ -1460,11 +1270,11 @@ fn a_waituntil_timeout_ends_only_the_work_that_overruns_it() {
         event.waitUntil(new Promise((resolve) => setTimeout(() => {
             console.error('finished:' + label);
             resolve();
-        }, path === '/short' ? 300 : 5000)));
+        }, path === '/short' ? 100 : 1000)));
         event.respondWith(new Response('started'));
     });"#;
-    let Some(server) = Serve::new(18428)
-        .flags(["--waituntil-timeout", "1"])
+    let Some(server) = Serve::new()
+        .flags(["--waituntil-timeout", "0.4"])
         .script(HANDLER)
         .start()
     else {
@@ -1479,8 +1289,9 @@ fn a_waituntil_timeout_ends_only_the_work_that_overruns_it() {
     );
 
     assert_eq!(server.get("/long"), "started");
+    // Past the long work's own second, so an ignored bound shows up as its marker.
     assert!(
-        !server.wait_for_marker("finished:long", Duration::from_secs(4)),
+        !server.wait_for_marker("finished:long", Duration::from_millis(1500)),
         "lifetime work past the window must be cut: {}",
         server.log()
     );
@@ -1518,9 +1329,9 @@ fn an_end_to_end_timeout_bounds_every_phase() {
         event.waitUntil(new Promise(() => {}));
         event.respondWith(new Response('started'));
     });"#;
-    let Some(server) = Serve::new(18429)
+    let Some(server) = Serve::new()
         .reusing_one_instance()
-        .flags(["--end-to-end-timeout", "1"])
+        .flags(["--end-to-end-timeout", "0.3"])
         .script(HANDLER)
         .start()
     else {
@@ -1534,7 +1345,8 @@ fn an_end_to_end_timeout_bounds_every_phase() {
     );
 
     // The 500 has to reach the client in full: its body is measured against the `response_body`
-    // limit alone (`RequestClock::error_body_bound`), since the window that prompted it is spent.
+    // limit alone (`RequestClock::error_body_time_limit`), since the window that prompted it is
+    // spent.
     let never = server.full_request("GET", "/never", "");
     assert!(
         never.starts_with("HTTP/1.1 500"),
@@ -1546,50 +1358,52 @@ fn an_end_to_end_timeout_bounds_every_phase() {
     );
 
     assert_eq!(server.get("/leftover"), "started");
-    // Well past the deadline, the interval must have stopped: two samples with a gap between them
-    // read the same count.
-    std::thread::sleep(Duration::from_millis(2000));
+    // Past the deadline, the interval must have stopped: two samples with a gap between them read
+    // the same count, and that count shows the interval ran before the deadline.
+    std::thread::sleep(Duration::from_millis(600));
     let first = server.get("/ticks");
-    std::thread::sleep(Duration::from_millis(500));
+    std::thread::sleep(Duration::from_millis(300));
     assert_eq!(
         server.get("/ticks"),
         first,
         "the deadline must drop the request's loop, timers and all"
     );
+    assert_ne!(first, "0", "the interval must run until the deadline");
 }
 
 /// Where the end-to-end clock opens differs from native, and deliberately: on wasm it starts after
 /// `ensure_started`, since standing the instance up is the host's business and it bounds that
-/// itself (`serve_wasm.rs`'s `dispatch_request`). So a content script that spends a second and a
-/// half on a top-level `await` does not spend the first request's window. There is no wasm analog
-/// of `an_end_to_end_timeout_bounds_isolated_startup`, and this case replaces it.
+/// itself (`serve_wasm.rs`'s `dispatch_request`). So a content script that spends 800ms on a
+/// top-level `await` does not spend the first request's window. There is no wasm analog of
+/// `an_end_to_end_timeout_bounds_isolated_startup`, and this case replaces it.
 #[test]
 fn a_slow_startup_stays_outside_the_first_requests_end_to_end_window() {
-    const SCRIPT: &str = r#"await new Promise((resolve) => setTimeout(resolve, 1500));
+    const SCRIPT: &str = r#"await new Promise((resolve) => setTimeout(resolve, 800));
     addEventListener('fetch', (event) => {
         event.respondWith(new Promise((resolve) =>
-            setTimeout(() => resolve(new Response('served')), 600)));
+            setTimeout(() => resolve(new Response('served')), 200)));
     });"#;
-    let Some(server) = Serve::new(18430)
+    let Some(server) = Serve::new()
         .ready(Ready::Listening)
-        .flags(["--end-to-end-timeout", "1"])
+        .flags(["--end-to-end-timeout", "0.6"])
         .module("startup.mjs", SCRIPT)
         .start()
     else {
         return;
     };
 
-    // 1.5s of startup plus 600ms of handler, against a 1s window that only the latter is inside.
+    // 800ms of startup plus 200ms of handler, against a 600ms window that only the latter is
+    // inside.
     assert_eq!(server.get("/first"), "served");
 }
 
 /// A configuration that cannot be satisfied — a phase allowed to outlast the whole request — is
 /// refused. The native server refuses to start at all; a wasm one cannot decline the host's
-/// requests, so it responds to each of them with the same bare 500 any unstartable runtime gets, and
-/// reports why in the log.
+/// requests, so it responds to each of them with the same bare 500 returned by any unstartable
+/// runtime, and reports why in the log.
 #[test]
 fn a_contradictory_timeout_config_refuses_to_serve() {
-    let Some(server) = Serve::new(18431)
+    let Some(server) = Serve::new()
         .flags([
             "--end-to-end-timeout",
             "5",
@@ -1623,230 +1437,6 @@ fn a_contradictory_timeout_config_refuses_to_serve() {
     );
 }
 
-/// `wasmtime serve` forwards a `HEAD` to the guest and sends what the guest produced: no body, and
-/// the `Content-Length` a `GET` would have had, which `prepare_wire_response` can supply only for an
-/// in-memory body, since learning a streamed one's length means producing it
-/// (`serve_answers_a_head_request_without_a_body`).
-#[test]
-fn serve_answers_a_head_request_without_a_body() {
-    const HANDLER: &str = r#"addEventListener('fetch', (event) => {
-        if (new URL(event.request.url).pathname === '/ready') {
-            event.respondWith(new Response('ready'));
-            return;
-        }
-        if (new URL(event.request.url).pathname === '/stream') {
-            event.respondWith(new Response(new ReadableStream({
-                start(c) {
-                    c.enqueue(new TextEncoder().encode('BODYBYTES'));
-                    c.close();
-                },
-            })));
-            return;
-        }
-        event.respondWith(new Response('BODYBYTES', { status: 201 }));
-    });"#;
-    let Some(server) = Serve::new(18432).script(HANDLER).start() else {
-        return;
-    };
-
-    let response = server.full_request("HEAD", "/", "");
-    let (head, body) = response.split_once("\r\n\r\n").expect("a complete head");
-    assert!(
-        head.starts_with("HTTP/1.1 201 "),
-        "the head is still the handler's: {response}"
-    );
-    assert_eq!(
-        body, "",
-        "a HEAD response must carry no body, but got: {response}"
-    );
-    assert!(
-        head.to_lowercase().contains("content-length: 9"),
-        "a HEAD must declare the length a GET would have sent: {head}"
-    );
-
-    let streamed = server.full_request("HEAD", "/stream", "");
-    let (head, body) = streamed.split_once("\r\n\r\n").expect("a complete head");
-    assert_eq!(body, "", "got: {streamed}");
-    assert!(
-        !head.to_lowercase().contains("content-length"),
-        "a streamed body's length is only knowable by producing it: {head}"
-    );
-}
-
-/// A `204 No Content` is framed by its status: no `Content-Length`, no `Transfer-Encoding` (RFC
-/// 9110 §8.6, RFC 9112 §6.2). The same holds for `304`
-/// (`a_bodiless_status_has_no_framing_headers`).
-#[test]
-fn a_bodiless_status_has_no_framing_headers() {
-    const HANDLER: &str = r#"addEventListener('fetch', (event) => {
-        const status = Number(new URL(event.request.url).pathname.slice(1));
-        event.respondWith(new Response(null, { status: status || 200 }));
-    });"#;
-    let Some(server) = Serve::new(18433).script(HANDLER).start() else {
-        return;
-    };
-
-    for status in [204, 304] {
-        let response = server.full_request("GET", &format!("/{status}"), "");
-        let head = response
-            .split_once("\r\n\r\n")
-            .map_or(&*response, |(head, _)| head)
-            .to_lowercase();
-        assert!(
-            !head.contains("content-length"),
-            "a {status} must not be framed with Content-Length: {response}"
-        );
-        assert!(
-            !head.contains("transfer-encoding"),
-            "a {status} must not be framed with Transfer-Encoding: {response}"
-        );
-    }
-}
-
-/// A handler's own `Content-Length` never frames content already in memory: `prepare_wire_response`
-/// measures the body instead
-/// (`serve_frames_a_response_by_its_body_not_the_handlers_content_length`). A streamed body has no
-/// length until it is produced, so there the declaration does frame it — see
-/// `a_streamed_body_is_framed_by_its_declared_content_length`.
-///
-/// Where native then writes a `Content-Length` of its own, `wasi:http` picks the framing itself and
-/// chooses chunked — the host writes the framing bytes, which is exactly the division of labour the
-/// `prepare_wire_response` call in `serve_wasm.rs` describes. What the two targets share, and what
-/// this asserts, is that the handler's claim is gone and the body is intact.
-#[test]
-fn a_fixed_length_body_is_framed_by_its_length() {
-    // Native declares the length of an in-memory body rather than chunking it (`serve.rs`,
-    // `serve_delivers_a_response_body`), so the guest declares it here too: the host frames by
-    // what the guest hands it, and with no length that is chunked for every such response.
-    let Some(server) = Serve::new(18436)
-        .script("addEventListener('fetch', (e) => e.respondWith(new Response('BODYBYTES')));")
-        .start()
-    else {
-        return;
-    };
-
-    let response = server.full_request("GET", "/", "");
-    let head = response
-        .split_once("\r\n\r\n")
-        .expect("a complete response")
-        .0
-        .to_lowercase();
-    assert!(head.contains("content-length: 9"), "got: {head}");
-    assert!(!head.contains("transfer-encoding"), "got: {head}");
-    assert_eq!(server.get("/"), "BODYBYTES");
-}
-
-#[test]
-fn serve_frames_a_response_by_its_body_not_the_handlers_content_length() {
-    const HANDLER: &str = r#"const cases = {
-        // Longer than the body.
-        '/larger': () => new Response('short', { headers: { 'content-length': '10000' } }),
-        // Not a number at all.
-        '/bogus': () => new Response('short', { headers: { 'content-length': 'test' } }),
-        // Two of them, which combine into one comma-joined value.
-        '/duplicate': () => {
-            const headers = new Headers();
-            headers.append('content-length', '10000');
-            headers.append('content-length', '10000');
-            return new Response('short', { headers });
-        },
-    };
-    addEventListener('fetch', (event) => {
-        const make = cases[new URL(event.request.url).pathname];
-        event.respondWith(make ? make() : new Response('ready'));
-    });"#;
-    let Some(server) = Serve::new(18434).script(HANDLER).start() else {
-        return;
-    };
-
-    for path in ["/larger", "/bogus", "/duplicate"] {
-        let response = server.full_request("GET", path, "");
-        let head = response
-            .split_once("\r\n\r\n")
-            .expect("a complete response")
-            .0;
-        assert_eq!(server.request("GET", path, ""), "short", "body for {path}");
-        assert!(
-            !head.contains("10000") && !head.to_lowercase().contains("content-length: test"),
-            "the handler's own length must not reach the wire for {path}: {head}"
-        );
-    }
-}
-
-/// A streamed body's length is not knowable before it is produced, so a handler that declares one
-/// frames its own response by it, on this target as on native
-/// (`serve_frames_a_streamed_body_by_its_declared_content_length`). The guest writes the body here,
-/// so it is the guest that holds it to the declared length: content past it is never handed to the
-/// host. A declaration that is not a single `1*DIGIT` is refused and the host frames as it likes.
-#[test]
-fn a_streamed_body_is_framed_by_its_declared_content_length() {
-    const HANDLER: &str = r#"function stream(parts) {
-        return new ReadableStream({
-            start(c) {
-                for (const part of parts) c.enqueue(new TextEncoder().encode(part));
-                c.close();
-            },
-        });
-    }
-    const cases = {
-        '/exact': () => new Response(stream(['abc', 'de']), {
-            headers: { 'content-length': '5' },
-        }),
-        '/longer': () => new Response(stream(['abcde', 'XXXXX']), {
-            headers: { 'content-length': '5' },
-        }),
-        // Less than it declared: the guest ends the body as an abort, so the host cannot present
-        // the truncation as a complete response.
-        '/shorter': () => new Response(stream(['ab']), {
-            headers: { 'content-length': '5' },
-        }),
-        '/bogus': () => new Response(stream(['abcde']), {
-            headers: { 'content-length': 'test' },
-        }),
-    };
-    addEventListener('fetch', (event) => {
-        const make = cases[new URL(event.request.url).pathname];
-        event.respondWith(make ? make() : new Response('ready'));
-    });"#;
-    let Some(server) = Serve::new(18436).script(HANDLER).start() else {
-        return;
-    };
-
-    for path in ["/exact", "/longer"] {
-        let response = server.full_request("GET", path, "");
-        let (head, body) = response
-            .split_once("\r\n\r\n")
-            .expect("a complete response");
-        assert!(
-            head.to_lowercase().contains("content-length: 5"),
-            "the declared length must frame {path}: {head}"
-        );
-        assert!(
-            !head.to_lowercase().contains("transfer-encoding"),
-            "got for {path}: {head}"
-        );
-        assert_eq!(body, "abcde", "body for {path}: {response}");
-    }
-
-    let short = server.full_request("GET", "/shorter", "");
-    let sent = short
-        .split_once("\r\n\r\n")
-        .map(|(_, body)| body)
-        .unwrap_or("");
-    assert!(
-        sent.len() < 5,
-        "the body must stop short of the length it declared: {short:?}"
-    );
-
-    let response = server.full_request("GET", "/bogus", "");
-    let head = response
-        .split_once("\r\n\r\n")
-        .expect("a complete response")
-        .0;
-    assert!(!head.contains("test"), "got: {head}");
-    assert_eq!(server.get("/bogus"), "abcde");
-}
-
 /// A handler responding with a `fetch` response hands the transport an `OutgoingBody::Host`: the
 /// upstream's body stream goes to the host untouched, with no guest writer in between. Two
 /// concurrent proxies must each get the upstream's body, since `respondWith` resolves from a
@@ -1859,11 +1449,7 @@ fn serve_proxies_via_fetch() {
         "addEventListener('fetch', (event) => \
              event.respondWith(fetch('http://127.0.0.1:{upstream}/')));"
     );
-    let Some(server) = Serve::new(18435)
-        .reusing_one_instance()
-        .script(&handler)
-        .start()
-    else {
+    let Some(server) = Serve::new().reusing_one_instance().script(&handler).start() else {
         return;
     };
 
@@ -1876,27 +1462,6 @@ fn serve_proxies_via_fetch() {
     assert!(b.join().unwrap().contains("UPSTREAM-BODY"));
 }
 
-/// The upstream body forwarded as a stream rather than collected first: the handler builds its own
-/// `Response` around `upstream.body`, and the chunks — which the upstream sends with pauses between
-/// them — have to reach the client (`serve_forwards_an_upstream_body_as_a_stream`).
-#[test]
-fn serve_forwards_an_upstream_body_as_a_stream() {
-    let upstream = common::start_chunked_upstream(&["one ", "two ", "three"]);
-    let handler = format!(
-        r#"addEventListener('fetch', (event) => {{
-            event.respondWith((async () => {{
-                const upstream = await fetch('http://127.0.0.1:{upstream}/');
-                return new Response(upstream.body, upstream);
-            }})());
-        }});"#
-    );
-    let Some(server) = Serve::new(18436).script(&handler).start() else {
-        return;
-    };
-
-    assert_eq!(server.get("/"), "one two three");
-}
-
 /// A proxied response body is out of `--response-body-timeout`'s reach, and deliberately: the
 /// handler responded with a `fetch` response, whose body is a host stream the host pumps itself, and
 /// holding onto it to bound it would mean copying every chunk of every proxied body through the
@@ -1912,8 +1477,8 @@ fn a_proxied_body_outlives_the_response_body_timeout() {
         "addEventListener('fetch', (event) => \
              event.respondWith(fetch('http://127.0.0.1:{upstream}/')));"
     );
-    let Some(server) = Serve::new(18437)
-        .flags(["--response-body-timeout", "1"])
+    let Some(server) = Serve::new()
+        .flags(["--response-body-timeout", "0.2"])
         // Every route proxies the endless upstream, so no probe of it could ever come back.
         .ready(Ready::Listening)
         .script(&handler)
@@ -1926,8 +1491,8 @@ fn a_proxied_body_outlives_the_response_body_timeout() {
     stream
         .write_all(b"GET / HTTP/1.1\r\nHost: localhost\r\nConnection: close\r\n\r\n")
         .unwrap();
-    // Several times over the bound, and still streaming.
-    let ended = read_until_eof(&mut stream, Duration::from_secs(5));
+    // Well over the bound, and still streaming.
+    let ended = read_until_eof(&mut stream, Duration::from_millis(500));
     assert!(
         ended.is_none(),
         "the guest must not cut a body the host is pumping: {:?}",
@@ -1935,542 +1500,12 @@ fn a_proxied_body_outlives_the_response_body_timeout() {
     );
 }
 
-/// An upstream that dies mid-body has to reach the client as the truncation it is, not as a body
-/// that ended cleanly a few bytes short: the terminating chunk asserts completeness (RFC 9112
-/// §7.1). The piped trailers carry that, the guest never having seen a byte of the body.
-#[test]
-fn a_dying_upstream_truncates_the_proxied_body() {
-    let upstream = common::start_truncated_upstream(&["one ", "two "]);
-    let handler = format!(
-        "addEventListener('fetch', (event) => \
-             event.respondWith(fetch('http://127.0.0.1:{upstream}/')));"
-    );
-    let Some(server) = Serve::new(18438)
-        .ready(Ready::AnyResponse)
-        .script(&handler)
-        .start()
-    else {
-        return;
-    };
-
-    let response = server.full_request("GET", "/", "");
-    assert!(
-        response.contains("one ") && response.contains("two "),
-        "what the upstream did send must arrive: {response:?}"
-    );
-    assert!(
-        !response.ends_with("0\r\n\r\n"),
-        "a truncated upstream must not be forwarded as a complete body: {response:?}"
-    );
-}
-
-/// A response body that errors after sending bytes: the client gets what was produced, and then
-/// the body ends *without* the terminating chunk, so a truncation cannot be mistaken for a complete
-/// response (`a_response_stream_that_errors_mid_flight_leaves_the_body_unterminated`).
-///
-/// The error comes from a timer, and a generous one: a body cannot outlive its request's event
-/// loop going idle, so the stream has to hold the loop open until it errors rather than wait for
-/// the client to say when. The delay only has to outlast the pump reaching the wire, which a GC
-/// zeal build makes far slower than an ordinary one.
-#[test]
-fn a_response_stream_that_errors_mid_flight_leaves_the_body_unterminated() {
-    const HANDLER: &str = r#"addEventListener('fetch', (event) => {
-        const encoder = new TextEncoder();
-        // A route of its own for the readiness probe. The body below is slow to end, and a probe
-        // waiting for one would not see a response inside its window.
-        if (new URL(event.request.url).pathname === '/ready') {
-            event.respondWith(new Response('ready'));
-            return;
-        }
-        event.respondWith(new Response(new ReadableStream({
-            start(c) {
-                c.enqueue(encoder.encode('first-chunk-'));
-                setTimeout(() => c.error(new Error('stream broke')), 1000);
-            },
-        })));
-    });"#;
-    let Some(server) = Serve::new(18440).script(HANDLER).start() else {
-        return;
-    };
-
-    let errored = server.full_request("GET", "/mid-flight", "");
-    let (_, body) = errored.split_once("\r\n\r\n").expect("a complete head");
-    assert!(
-        body.contains("first-chunk-"),
-        "the bytes produced before the error must still arrive: {errored}"
-    );
-    assert!(
-        !body.ends_with("0\r\n\r\n"),
-        "an errored body must not be terminated as if it were complete: {errored}"
-    );
-}
-
-/// A stream that enqueues something that is not a `Uint8Array` aborts its body before a single byte
-/// is written (WPT
-/// `resources/fetch-event-respond-with-response-body-with-invalid-chunk-worker.js`).
-///
-/// Host-owned divergence: native writes the head itself, so it sends a `200` and then closes
-/// unterminated; `wasmtime serve` has not committed the head by the time the body aborts and sends
-/// nothing at all. Which of the two a client sees is the host's call — see the comment where
-/// `dispatch_request` hands the response over — and what both guarantee is what is asserted here:
-/// the client cannot come away with a response that looks complete.
-#[test]
-fn a_response_stream_with_an_invalid_chunk_is_not_answered_as_a_success() {
-    const HANDLER: &str = r#"addEventListener('fetch', (event) => {
-        if (new URL(event.request.url).pathname === '/ready') {
-            event.respondWith(new Response('ready'));
-            return;
-        }
-        event.respondWith(new Response(new ReadableStream({
-            start(c) {
-                c.enqueue('a string, not a Uint8Array');
-                c.close();
-            },
-        })));
-    });"#;
-    let Some(server) = Serve::new(18445).script(HANDLER).start() else {
-        return;
-    };
-
-    // The control, since the response under test is nothing at all: the same server sends a
-    // normal request, so an empty reply below is the invalid chunk's doing and not a server that
-    // never came up.
-    assert_eq!(server.get("/ready"), "ready");
-
-    let response = server.full_request("GET", "/invalid-chunk", "");
-    assert!(
-        response.is_empty() || !response.ends_with("0\r\n\r\n"),
-        "a body that never produced a valid chunk must reach the client as nothing at all, or as \
-         an unterminated one — never as a complete response: {response:?}"
-    );
-}
-
-/// An empty chunk is a chunk like any other on this side: it neither ends the body nor corrupts the
-/// framing (`serve_streams_an_empty_chunk_without_ending_the_body`). Worth pinning because
-/// `spawn_body_writer`'s dropped-reader check cannot see a drop through one — an empty write leaves
-/// an empty remainder either way, so what happens to it turns on everything except that
-/// check.
-#[test]
-fn serve_streams_an_empty_chunk_without_ending_the_body() {
-    const HANDLER: &str = r#"addEventListener('fetch', (event) => {
-        const encoder = new TextEncoder();
-        event.respondWith(new Response(new ReadableStream({
-            start(c) {
-                c.enqueue(new Uint8Array(0));
-                c.enqueue(encoder.encode('chunk one '));
-                c.enqueue(new Uint8Array(0));
-                c.enqueue(encoder.encode('chunk two'));
-                c.close();
-            },
-        })));
-    });"#;
-    let Some(server) = Serve::new(18441)
-        .ready(Ready::AnyResponse)
-        .script(HANDLER)
-        .start()
-    else {
-        return;
-    };
-
-    assert_eq!(server.get("/"), "chunk one chunk two");
-}
-
-/// A streamed response's head reaches the client when it is ready, not when the first chunk is: a
-/// handler that streams may take a while to produce anything, and the status and headers are what
-/// the client acts on meanwhile (`a_streamed_response_sends_its_head_before_the_first_chunk`).
-#[test]
-fn a_streamed_response_sends_its_head_before_the_first_chunk() {
-    const HANDLER: &str = r#"addEventListener('fetch', (event) => {
-        const stream = new ReadableStream({
-            start(c) {
-                setTimeout(() => {
-                    c.enqueue(new TextEncoder().encode('late'));
-                    c.close();
-                }, 2000);
-            },
-        });
-        event.respondWith(new Response(stream, { headers: { 'x-marker': 'early' } }));
-    });"#;
-    let Some(server) = Serve::new(18442)
-        // Every route takes two seconds to produce anything, so no probe of it could come back
-        // inside the harness's own patience.
-        .ready(Ready::Listening)
-        .script(HANDLER)
-        .start()
-    else {
-        return;
-    };
-
-    let mut stream = TcpStream::connect(("127.0.0.1", server.port())).unwrap();
-    stream
-        .write_all(b"GET / HTTP/1.1\r\nHost: x\r\nConnection: close\r\n\r\n")
-        .unwrap();
-    let started = std::time::Instant::now();
-
-    // Read just enough to have seen the head, and time how long that took.
-    stream
-        .set_read_timeout(Some(Duration::from_secs(10)))
-        .unwrap();
-    let mut buf = [0u8; 256];
-    let read = std::io::Read::read(&mut stream, &mut buf).unwrap();
-    let elapsed = started.elapsed();
-    let head = String::from_utf8_lossy(&buf[..read]).to_string();
-
-    assert!(head.starts_with("HTTP/1.1 200"), "got: {head}");
-    assert!(head.contains("x-marker: early"), "got: {head}");
-    assert!(
-        elapsed < Duration::from_millis(1500),
-        "the head must not wait for the first chunk (took {elapsed:?})"
-    );
-}
-
-/// A body produced by a timer is served to completion: the pump runs on the request's own loop, and
-/// that loop has to keep being driven for as long as the body needs it
-/// (`an_interval_driven_stream_is_served_to_completion`).
-#[test]
-fn an_interval_driven_stream_is_served_to_completion() {
-    const HANDLER: &str = r#"addEventListener('fetch', (event) => {
-        let ticks = 0;
-        event.respondWith(new Response(new ReadableStream({
-            start(c) {
-                const id = setInterval(() => {
-                    c.enqueue(new TextEncoder().encode('tick ' + ++ticks + ' '));
-                    if (ticks === 5) {
-                        clearInterval(id);
-                        c.close();
-                    }
-                }, 50);
-            },
-        })));
-    });"#;
-    let Some(server) = Serve::new(18443)
-        .ready(Ready::AnyResponse)
-        .script(HANDLER)
-        .start()
-    else {
-        return;
-    };
-
-    assert_eq!(server.get("/"), "tick 1 tick 2 tick 3 tick 4 tick 5 ");
-}
-
-/// A streamed response must not be held open by `waitUntil` work either: the body's pump runs on
-/// the request's loop, so the send drives that loop — but only for as long as the body needs it, or
-/// the client waits on an open connection for lifetime work it has no interest in
-/// (`wait_until_does_not_delay_a_streamed_response`).
-#[test]
-fn wait_until_does_not_delay_a_streamed_response() {
-    const HANDLER: &str = r#"addEventListener('fetch', (event) => {
-        const stream = new ReadableStream({
-            start(c) {
-                c.enqueue(new TextEncoder().encode('streamed body'));
-                c.close();
-            },
-        });
-        event.respondWith(new Response(stream));
-        event.waitUntil(new Promise((resolve) => setTimeout(resolve, 4000)));
-    });"#;
-    let Some(server) = Serve::new(18444)
-        .ready(Ready::AnyResponse)
-        .script(HANDLER)
-        .start()
-    else {
-        return;
-    };
-
-    let started = std::time::Instant::now();
-    let body = server.get("/");
-    let elapsed = started.elapsed();
-    assert_eq!(body, "streamed body");
-    assert!(
-        elapsed < Duration::from_secs(3),
-        "a streamed response must not wait for waitUntil work (took {elapsed:?})"
-    );
-}
-
-/// A handler reading `request.body` sees chunks as they arrive, not after the upload ends: the
-/// first chunk's echo has to come back before the rest is even sent
-/// (`serve_streams_an_incoming_request_body`).
-#[test]
-fn serve_streams_an_incoming_request_body() {
-    const HANDLER: &str = r#"addEventListener('fetch', (event) => {
-        if (new URL(event.request.url).pathname === '/ready') {
-            event.respondWith(new Response('ready'));
-            return;
-        }
-        const reader = event.request.body.getReader();
-        event.respondWith(new Response(new ReadableStream({
-            async pull(controller) {
-                const { done, value } = await reader.read();
-                if (done) {
-                    controller.close();
-                    return;
-                }
-                controller.enqueue(value);
-            },
-        })));
-    });"#;
-    let Some(server) = Serve::new(18446).script(HANDLER).start() else {
-        return;
-    };
-
-    let mut stream = TcpStream::connect(("127.0.0.1", server.port())).unwrap();
-    stream
-        .set_read_timeout(Some(Duration::from_secs(20)))
-        .unwrap();
-    stream
-        .write_all(
-            b"POST / HTTP/1.1\r\nHost: x\r\nTransfer-Encoding: chunked\r\nConnection: close\r\n\r\n",
-        )
-        .unwrap();
-
-    /// Read from `stream` until the response body so far contains `expected`.
-    fn read_until(stream: &mut TcpStream, raw: &mut Vec<u8>, expected: &str) -> String {
-        for _ in 0..200 {
-            let body = String::from_utf8_lossy(raw)
-                .split_once("\r\n\r\n")
-                .map(|(_, body)| common::dechunk(body))
-                .unwrap_or_default();
-            if body.contains(expected) {
-                return body;
-            }
-            let mut buf = [0u8; 1024];
-            let read = std::io::Read::read(stream, &mut buf).unwrap();
-            assert_ne!(read, 0, "connection closed while waiting for {expected:?}");
-            raw.extend_from_slice(&buf[..read]);
-        }
-        panic!("never received {expected:?}");
-    }
-
-    let mut raw = Vec::new();
-    // First chunk: the echo must come back before the rest of the request is sent.
-    stream.write_all(b"5\r\nfirst\r\n").unwrap();
-    read_until(&mut stream, &mut raw, "first");
-
-    // Only now send the second chunk and the terminator.
-    stream.write_all(b"6\r\nsecond\r\n0\r\n\r\n").unwrap();
-    let body = read_until(&mut stream, &mut raw, "second");
-    assert_eq!(body, "firstsecond", "got: {body}");
-}
-
-/// Which methods reach the handler with a body. `wasi:http` gives a request with no body the same
-/// empty stream as one whose body is empty, so `body_framing` goes by the method: `GET` gets
-/// `null`, and a `POST` without a body gets an empty stream rather than `null`.
-///
-/// Host-owned divergence: native reads the framing headers the client sent, so a bodyless `POST`
-/// there gets `null`.
-#[test]
-fn a_bodyless_post_still_reaches_the_handler_with_a_body() {
-    const HANDLER: &str = r#"addEventListener('fetch', (event) => {
-        const body = event.request.body;
-        event.respondWith(new Response(body === null ? 'null' : 'stream'));
-    });"#;
-    let Some(server) = Serve::new(18460)
-        .ready(Ready::AnyResponse)
-        .script(HANDLER)
-        .start()
-    else {
-        return;
-    };
-
-    assert_eq!(server.request("GET", "/", ""), "null");
-    assert_eq!(server.request("POST", "/", ""), "stream");
-    assert_eq!(server.request("POST", "/", "payload"), "stream");
-}
-
-/// A chunked upload reaches the handler decoded: the host undoes the framing, and `body_framing`
-/// exposes a body where there is no `Content-Length` to go by, since `wasi:http` does not pass
-/// `Transfer-Encoding` on to the guest (`serve_decodes_a_chunked_request_body`).
-///
-/// Host-owned divergence: native also refuses `Transfer-Encoding` together with `Content-Length`
-/// (RFC 9112 §6.3, a request-smuggling vector) with a 400. On wasm the host parses the request, so
-/// no such ambiguity reaches the guest, as `body_framing`'s own comment records, and refusing it is
-/// the host's business, not something the guest could do differently.
-#[test]
-fn serve_decodes_a_chunked_request_body() {
-    const HANDLER: &str = r#"addEventListener('fetch', (event) => {
-        event.respondWith(event.request.text().then((body) => new Response('got:' + body)));
-    });"#;
-    let Some(server) = Serve::new(18447)
-        .ready(Ready::AnyResponse)
-        .script(HANDLER)
-        .start()
-    else {
-        return;
-    };
-
-    // "hello world" as two chunks: "hello " (0x6) then "world" (0x5).
-    let response = common::raw_request_within(
-        server.port(),
-        b"POST / HTTP/1.1\r\nHost: x\r\nTransfer-Encoding: chunked\r\nConnection: close\r\n\r\n\
-          6\r\nhello \r\n5\r\nworld\r\n0\r\n\r\n",
-        Duration::from_secs(20),
-    )
-    .expect("a complete response");
-    assert!(response.contains("got:hello world"), "got: {response}");
-
-    // Both framings at once, with bytes after the chunked terminator that only the `Content-Length`
-    // reading would take for body: the smuggled request either way is the one that gets two
-    // different response out of two hops. Native refuses it outright with a 400. `wasmtime serve`
-    // resolves it in favour of the chunked framing, which RFC 9112 §6.3 also allows a server to do
-    // — what neither may do is let those bytes through as a body.
-    let smuggle = common::raw_request_within(
-        server.port(),
-        b"POST / HTTP/1.1\r\nHost: x\r\nTransfer-Encoding: chunked\r\nContent-Length: 5\r\n\
-          Connection: close\r\n\r\n0\r\n\r\nSMUGGLED",
-        Duration::from_secs(20),
-    )
-    .unwrap_or_default();
-    assert!(
-        !smuggle.contains("SMUGGLED"),
-        "the second framing's bytes must not reach the handler: {smuggle:?}"
-    );
-    assert!(
-        smuggle.is_empty() || common::wasm_serve::message_body(&smuggle) == "got:",
-        "an ambiguous request is either refused or read one way: {smuggle:?}"
-    );
-}
-
-/// A client that closes mid-body must not present the truncation to the handler as a complete
-/// body: the request's stream errors, so `text()` rejects (`serve_rejects_a_truncated_request_body`).
-/// On wasm that abort arrives through the incoming body's trailers, which is the only channel a
-/// `wasi:http` body has for saying it ended badly rather than early.
-#[test]
-fn serve_rejects_a_truncated_request_body() {
-    const HANDLER: &str = r#"addEventListener('fetch', (event) => {
-        event.respondWith(event.request.text().then(
-            (body) => new Response('complete:' + body),
-            () => new Response('truncated'),
-        ));
-    });"#;
-    let Some(server) = Serve::new(18448)
-        .ready(Ready::AnyResponse)
-        .script(HANDLER)
-        .start()
-    else {
-        return;
-    };
-
-    let mut stream = TcpStream::connect(("127.0.0.1", server.port())).unwrap();
-    // Set before the half-close below, and read by hand rather than through `read_until_eof`:
-    // macOS refuses a read timeout on a socket whose write half is already shut down, and
-    // `read_until_eof` re-sets one each iteration to keep its patience a total.
-    stream
-        .set_read_timeout(Some(Duration::from_secs(20)))
-        .unwrap();
-    // Declare ten bytes, send four, then close the sending side.
-    stream
-        .write_all(
-            b"POST / HTTP/1.1\r\nHost: x\r\nContent-Length: 10\r\nConnection: close\r\n\r\nfour",
-        )
-        .unwrap();
-    stream.shutdown(std::net::Shutdown::Write).unwrap();
-    let mut raw = Vec::new();
-    let mut buf = [0u8; 1024];
-    while let Ok(read) = std::io::Read::read(&mut stream, &mut buf) {
-        if read == 0 {
-            break;
-        }
-        raw.extend_from_slice(&buf[..read]);
-    }
-    let response = String::from_utf8_lossy(&raw).into_owned();
-    assert!(
-        response.contains("truncated"),
-        "a truncated upload must make the handler's read reject: {response:?}"
-    );
-}
-
-/// An incoming request body used directly as the response body is handed to the wire without being
-/// pumped through JS — the incoming-to-outgoing shortcut, which applies because the incoming body
-/// is a host body rather than bytes (`serve_pipes_an_incoming_request_body_to_the_response`).
-#[test]
-fn serve_pipes_an_incoming_request_body_to_the_response() {
-    const HANDLER: &str = r#"addEventListener('fetch', (event) => {
-        event.respondWith(new Response(event.request.body ?? 'no body'));
-    });"#;
-    let Some(server) = Serve::new(18449)
-        .ready(Ready::AnyResponse)
-        .script(HANDLER)
-        .start()
-    else {
-        return;
-    };
-
-    assert_eq!(server.request("POST", "/", "hello world"), "hello world");
-}
-
-/// The same body going two ways at once: forwarded upstream as an outgoing request's body while
-/// the handler reads the other half of the `tee`
-/// (`serve_forwards_an_incoming_body_upstream_while_reading_it`). Both halves have to see the whole
-/// upload, which is travelling from one connection to another while a second reader pulls on it.
-#[test]
-fn serve_forwards_an_incoming_body_upstream_while_reading_it() {
-    let upstream = common::start_echo_upstream();
-    let handler = format!(
-        r#"addEventListener('fetch', (event) => {{
-            event.respondWith((async () => {{
-                const [forward, inspect] = event.request.body.tee();
-                const sent = fetch('http://127.0.0.1:{upstream}/', {{
-                    method: 'POST',
-                    body: forward,
-                    duplex: 'half',
-                }});
-                let seen = '';
-                const reader = inspect.getReader();
-                const decoder = new TextDecoder();
-                while (true) {{
-                    const {{ done, value }} = await reader.read();
-                    if (done) break;
-                    seen += decoder.decode(value, {{ stream: true }});
-                }}
-                const echoed = await (await sent).text();
-                return new Response('upstream=' + echoed + ' local=' + seen);
-            }})());
-        }});"#
-    );
-    let Some(server) = Serve::new(18450)
-        .ready(Ready::AnyResponse)
-        .script(&handler)
-        .start()
-    else {
-        return;
-    };
-
-    assert_eq!(
-        server.request("POST", "/", "payload bytes"),
-        "upstream=payload bytes local=payload bytes"
-    );
-}
-
-/// `clone()` on an incoming request tees its body, and both halves have to see all of it
-/// (`serve_clones_an_incoming_request_body`).
-#[test]
-fn serve_clones_an_incoming_request_body() {
-    const HANDLER: &str = r#"addEventListener('fetch', (event) => {
-        const copy = event.request.clone();
-        event.respondWith(Promise.all([event.request.text(), copy.text()])
-            .then(([a, b]) => new Response(a + '|' + b)));
-    });"#;
-    let Some(server) = Serve::new(18451)
-        .ready(Ready::AnyResponse)
-        .script(HANDLER)
-        .start()
-    else {
-        return;
-    };
-
-    assert_eq!(
-        server.request("POST", "/", "payload"),
-        "payload|payload",
-        "both halves of the tee must see the body"
-    );
-}
-
-/// `respondWith(response)` consumes the response's body, so `bodyUsed` reads true afterwards — and
-/// responding with one whose body is already gone is a network error, refused before the head is
-/// committed since there is no way to report it after (`respond_with_marks_the_response_body_used`,
-/// `responding_with_a_used_stream_backed_response_is_a_network_error`). Both read the flag back on
-/// a later request, which the reused instance is what makes possible.
+/// `respondWith(response)` consumes the response's body, so `bodyUsed` reads true afterwards.
+/// Responding with one whose body is already gone is a network error, refused before the head is
+/// committed since there is no way to report it after
+/// (`a_sent_byte_body_reads_as_consumed_rather_than_absent`,
+/// `responding_with_a_used_stream_backed_response_is_a_network_error`). Both read the flag back on
+/// a later request, which only a reused instance makes possible.
 #[test]
 fn respond_with_marks_the_response_body_used() {
     const HANDLER: &str = r#"globalThis.stored = null;
@@ -2492,7 +1527,7 @@ fn respond_with_marks_the_response_body_used() {
         }));
         event.respondWith(globalThis.stored);
     });"#;
-    let Some(server) = Serve::new(18452)
+    let Some(server) = Serve::new()
         .reusing_one_instance()
         .ready(Ready::AnyResponse)
         .script(HANDLER)
@@ -2526,11 +1561,16 @@ fn fetch_event_handled_reports_the_outcome() {
             globalThis.state = undefined;
             return;
         }
+        if (url.pathname === '/ready') {
+            // Not hooked, so the readiness probe records no outcome for `/check` to read.
+            event.respondWith(new Response('ok'));
+            return;
+        }
         const identical = event.handled === event.handled;
         event.handled.then(
             () => { globalThis.state = 'resolved,same=' + identical; },
             (e) => { globalThis.state = 'rejected:' + e.name + ',same=' + identical; });
-        if (url.pathname === '/responds' || url.pathname === '/ready') {
+        if (url.pathname === '/responds') {
             event.respondWith(new Response('ok'));
         } else if (url.pathname === '/rejects') {
             event.respondWith(Promise.reject(new Error('no response for you')));
@@ -2539,7 +1579,7 @@ fn fetch_event_handled_reports_the_outcome() {
         }
         // /silent falls through without calling respondWith at all.
     });"#;
-    let Some(server) = Serve::new(18453)
+    let Some(server) = Serve::new()
         .reusing_one_instance()
         .ready(Ready::AnyResponse)
         .script(HANDLER)
@@ -2552,14 +1592,7 @@ fn fetch_event_handled_reports_the_outcome() {
     // loop is drained afterwards, so ask until they have recorded something.
     let settled = |path: &str| {
         let _ = server.full_request("GET", path, "");
-        let deadline = std::time::Instant::now() + Duration::from_secs(20);
-        loop {
-            let state = server.get("/check");
-            if state != "never settled" || std::time::Instant::now() >= deadline {
-                return state;
-            }
-            std::thread::sleep(Duration::from_millis(20));
-        }
+        eventually(&server, "/check", |state| state != "never settled")
     };
 
     // Each case reads back what its own request recorded, so every request here has to reach the
@@ -2582,67 +1615,6 @@ fn fetch_event_handled_reports_the_outcome() {
     assert_eq!(outcomes[3], "rejected:NetworkError,same=true");
 }
 
-/// A handler that throws instead of responding gets a 500 rather than a hung connection
-/// or an empty 200, and the throw does not take the dispatch down: a listener after it still gets
-/// the event (`a_throwing_handler_is_answered_with_500`). The same holds for `preventDefault`,
-/// which cancels the event without stopping a later listener from responding — and, on its own,
-/// leaves nothing to respond with (`prevent_default_does_not_stop_a_later_listener_responding`).
-#[test]
-fn a_failing_listener_does_not_stop_a_later_one_responding() {
-    const HANDLER: &str = r#"addEventListener('fetch', (event) => {
-        if (new URL(event.request.url).pathname === '/boom') {
-            throw new Error('handler blew up');
-        }
-        if (new URL(event.request.url).pathname === '/cancel-only') {
-            event.preventDefault();
-        }
-    });
-    addEventListener('fetch', (event) => {
-        const path = new URL(event.request.url).pathname;
-        if (path === '/boom' || path === '/cancel-only') {
-            return;
-        }
-        event.respondWith(new Response(path === '/ready' ? 'ready' : 'recovered'));
-    });"#;
-    let Some(server) = Serve::new(18454).script(HANDLER).start() else {
-        return;
-    };
-
-    assert!(
-        server
-            .full_request("GET", "/boom", "")
-            .starts_with("HTTP/1.1 500"),
-        "a throwing listener is answered with a 500"
-    );
-    assert!(
-        server
-            .full_request("GET", "/cancel-only", "")
-            .starts_with("HTTP/1.1 500 "),
-        "cancelling without responding is a network error"
-    );
-    // Neither takes the dispatch down: a listener after them still gets the event and responds.
-    assert_eq!(server.get("/ok"), "recovered");
-}
-
-/// A `waitUntil` promise that rejects is the handler's business, not the response's
-/// (`a_rejected_wait_until_does_not_break_the_response`).
-#[test]
-fn a_rejected_wait_until_does_not_break_the_response() {
-    const HANDLER: &str = r#"addEventListener('fetch', (event) => {
-        event.waitUntil(Promise.reject(new Error('waitUntil failed')));
-        event.respondWith(new Response('answered anyway'));
-    });"#;
-    let Some(server) = Serve::new(18455)
-        .ready(Ready::AnyResponse)
-        .script(HANDLER)
-        .start()
-    else {
-        return;
-    };
-
-    assert_eq!(server.get("/"), "answered anyway");
-}
-
 /// `waitUntil` may only extend an event that is still `active`. Once the event is over there is
 /// nothing left to extend, since the request has been served, so it throws rather than silently
 /// doing nothing (`wait_until_throws_once_the_event_is_over`). The body left open for a moment
@@ -2672,7 +1644,7 @@ fn wait_until_throws_once_the_event_is_over() {
             },
         })));
     });"#;
-    let Some(server) = Serve::new(18456)
+    let Some(server) = Serve::new()
         .reusing_one_instance()
         .ready(Ready::AnyResponse)
         .script(HANDLER)
@@ -2682,9 +1654,11 @@ fn wait_until_throws_once_the_event_is_over() {
     };
 
     assert_eq!(server.get("/"), "during=allowed");
-    // The timer runs while the request's loop is drained after its response, so give it time.
-    std::thread::sleep(Duration::from_millis(400));
-    assert_eq!(server.get("/check"), "InvalidStateError");
+    // The timer runs while the request's loop is drained after its response.
+    assert_eq!(
+        eventually(&server, "/check", |late| late != "never ran"),
+        "InvalidStateError"
+    );
 }
 
 /// What keeps a request alive past its response is `waitUntil` and nothing else: a bare timer goes
@@ -2699,7 +1673,7 @@ fn nothing_but_wait_until_extends_the_event_lifetime() {
     // outlived the request. The loop is driven while the body goes out, as a streamed body needs,
     // and an upstream that responds inside that window settles without the event's lifetime having
     // been extended.
-    let upstream = common::start_slow_upstream(Duration::from_secs(1), "UPSTREAM-BODY");
+    let upstream = common::start_slow_upstream(Duration::from_millis(300), "UPSTREAM-BODY");
     let handler = format!(
         r#"addEventListener('fetch', (event) => {{
             const path = new URL(event.request.url).pathname;
@@ -2710,12 +1684,12 @@ fn nothing_but_wait_until_extends_the_event_lifetime() {
             setTimeout(() => {{
                 globalThis.ran = 'the timer ran';
                 console.error('leftover-timer-ran');
-            }}, 300);
+            }}, 100);
             fetch('http://127.0.0.1:{upstream}/').then(() => console.error('leftover-fetch-settled'));
             event.respondWith(new Response('answered'));
         }});"#
     );
-    let Some(server) = Serve::new(18457)
+    let Some(server) = Serve::new()
         .reusing_one_instance()
         .ready(Ready::AnyResponse)
         .script(&handler)
@@ -2729,7 +1703,7 @@ fn nothing_but_wait_until_extends_the_event_lifetime() {
         let answered = server.get("/");
         // Well past both the timer's delay and the time the upstream takes to reply: a loop still
         // being driven would have run them by now.
-        std::thread::sleep(Duration::from_millis(1500));
+        std::thread::sleep(Duration::from_millis(800));
         (answered, server.get("/check"))
     });
     assert_eq!(answered, "answered");
@@ -2746,35 +1720,6 @@ fn nothing_but_wait_until_extends_the_event_lifetime() {
     );
 }
 
-/// The first request waits for the content script's top-level `await`, so a handler registered
-/// after one is in place for it — including on a snapshot, where wizer captures the script
-/// mid-evaluation and the resumed instance's first request drives the rest (`test-wizer.sh`'s
-/// `awaited.mjs` case, extended here with the ordering the marker pins).
-#[test]
-fn a_snapshotted_instance_waits_for_the_scripts_top_level_await() {
-    // The ordering is recorded in a global and reported in the response rather than through the
-    // usual stderr markers: writing to stdio before the snapshot is taken leaves the resumed
-    // instance with a stale stream handle, and every later write traps (see the wizer item in
-    // `docs/wasm-serve-parity-todo.md`).
-    const SCRIPT: &str = r#"globalThis.order = ['evaluating'];
-    await new Promise((resolve) => setTimeout(resolve, 300));
-    globalThis.order.push('evaluated');
-    addEventListener('fetch', (event) => {
-        globalThis.order.push('dispatched');
-        event.respondWith(new Response(globalThis.order.join(',')));
-    });"#;
-    let Some(server) = Serve::new(18458)
-        .wizen()
-        .ready(Ready::Listening)
-        .module("awaited.mjs", SCRIPT)
-        .start()
-    else {
-        return;
-    };
-
-    assert_eq!(server.get("/first"), "evaluating,evaluated,dispatched");
-}
-
 /// A handler fetching its own server: guest-out through `wasi:http`'s client, host-in through the
 /// same listener (`a_handler_can_fetch_its_own_server`).
 ///
@@ -2784,10 +1729,10 @@ fn a_snapshotted_instance_waits_for_the_scripts_top_level_await() {
 /// event loop makes it arrive while that instance is blocked on the fetch.
 #[test]
 fn a_handler_can_fetch_its_own_server() {
-    // The handler addresses itself by port rather than by `request.url`'s origin: what the guest
-    // sees there is built from the `Host` header, which carries no port here.
-    const PORT: u16 = 18459;
-    let gate = common::start_forwarding_gate(PORT);
+    // The handler addresses its own server through the gate rather than by `request.url`'s
+    // origin: what the guest sees there is built from the `Host` header, which has no port
+    // here.
+    let gate = common::start_forwarding_gate();
     let handler = format!(
         r#"addEventListener('fetch', (event) => {{
             const path = new URL(event.request.url).pathname;
@@ -2805,7 +1750,7 @@ fn a_handler_can_fetch_its_own_server() {
     // No readiness probe, so `/outer` is the request that stands the instance up and the only
     // instance there is. A probe would leave a second one idle beside it, and the inner request
     // could be handed to either.
-    let Some(server) = Serve::new(PORT)
+    let Some(server) = Serve::new()
         .reusing_one_instance()
         .ready(Ready::Listening)
         .script(&format!("{INSTANCE_ID}\n{handler}"))
@@ -2829,7 +1774,7 @@ fn a_handler_can_fetch_its_own_server() {
             server.log()
         );
         server.await_new_idle(&mut seen, IDLE_PATIENCE);
-        gate.release();
+        gate.release(port);
         common::wasm_serve::message_body(&outer.join().unwrap())
     });
     assert!(
@@ -2851,7 +1796,7 @@ fn a_handler_can_fetch_its_own_server() {
 }
 
 /// How long the two cases below wait for what the guest reports after its response is gone. The
-/// work itself takes two seconds, and the rest is room for a machine running the whole suite.
+/// work itself takes 600ms, and the rest is room for a machine running the whole suite.
 const MARKER_PATIENCE: Duration = Duration::from_secs(60);
 
 /// A handler whose response body never ends, reporting the request signal's abort and its
@@ -2869,28 +1814,33 @@ const ENDLESS_STREAM: &str = r#"addEventListener('fetch', (event) => {
     event.waitUntil(new Promise((resolve) => setTimeout(() => {
         console.error('lifetime-work-finished');
         resolve();
-    }, 2000)));
+    }, 600)));
     event.respondWith(new Response(new ReadableStream({
         start(c) { setInterval(() => c.enqueue(new TextEncoder().encode('tick ')), 50); },
     })));
 });"#;
 
 /// The guest never performs the response write itself, so how a send ending badly reaches the
-/// handler — step 17.4.20's abort, raised from the drain task off the body writer's reported
-/// outcome — exists only against a real host. Here the body burns its 1s window, and the writer's
-/// verdict must come back as a `TimeoutError` on the request's signal, with the `waitUntil` window
-/// still its own: the 2s of lifetime work finishes inside its 4s bound, as on the native path
-/// (`wait_until_gets_its_own_window_after_the_body_is_truncated`).
+/// handler exists only against a real host: step 17.4.20's abort, raised from the drain task from
+/// the body writer's reported outcome. Here the body spends its 200ms window, and the writer's
+/// outcome must reach the request's signal as a `TimeoutError`, with the `waitUntil` window still
+/// its own: the 600ms of lifetime work finishes inside its 20s bound, as on the native path
+/// (`a_response_body_timeout_truncates_a_body_that_never_ends`).
 #[test]
 fn a_spent_response_body_clock_aborts_the_request_signal() {
-    let Some(server) = Serve::new(18400)
+    let Some(server) = Serve::new()
         // The lifetime work runs after the response is gone, past the point the host counts the
         // request as done. Under the default one-second idle timeout the host may drop the
         // instance while that work is still running, and the marker never arrives.
         .reusing_one_instance()
-        // The bound only has to clear the 2s of lifetime work, with room for a loaded machine.
+        // The bound only has to clear the 600ms of lifetime work, with room for a loaded machine.
         // Under test is that truncating the body left the window intact.
-        .flags(["--response-body-timeout", "1", "--waituntil-timeout", "20"])
+        .flags([
+            "--response-body-timeout",
+            "0.2",
+            "--waituntil-timeout",
+            "20",
+        ])
         .script(ENDLESS_STREAM)
         .start()
     else {
@@ -2917,14 +1867,14 @@ fn a_spent_response_body_clock_aborts_the_request_signal() {
 
 /// The other way a send ends badly, with no clock involved: the client walks away mid-stream, the
 /// host drops the body stream's read end, and the writer's verdict must come back as an
-/// `AbortError`. This is the wasm side of `a_lost_connection_aborts_the_request_signal`. Losing
-/// the client leaves the `waitUntil` window intact, as truncating the body does above.
+/// `AbortError`. This is the wasm side of `a_client_disconnect_does_not_cancel_wait_until_work`.
+/// Losing the client leaves the `waitUntil` window intact, as truncating the body does above.
 #[test]
 fn a_client_hanging_up_mid_body_aborts_the_request_signal() {
-    let Some(server) = Serve::new(18401)
+    let Some(server) = Serve::new()
         // The instance has to outlive the response for the same reason as above.
         .reusing_one_instance()
-        // Clears the 2s of lifetime work with room for a loaded machine. See above.
+        // Clears the 600ms of lifetime work with room for a loaded machine. See above.
         .flags(["--waituntil-timeout", "20"])
         .script(ENDLESS_STREAM)
         .start()
@@ -2956,3 +1906,949 @@ fn a_client_hanging_up_mid_body_aborts_the_request_signal() {
         server.log()
     );
 }
+
+/// One case of a server that several cases share: the route it serves and the check that requests
+/// it.
+struct Case {
+    /// The first segment of every path the case requests, which also names the case in a failure.
+    name: &'static str,
+    /// A JS function `(event, rest) => ...` that handles `/<name><rest>`. `rest` is the rest of the
+    /// path: empty, or starting with `/`.
+    route: String,
+    /// Requests the route, and panics if the outcome is wrong.
+    check: fn(&WasmServer),
+}
+
+/// A classic script that serves `/ready`, and hands every other request to the route of the case
+/// that its path's first segment names.
+fn routed_script(cases: &[Case]) -> String {
+    let routes: String = cases
+        .iter()
+        .map(|case| format!("'{}': {},\n", case.name, case.route))
+        .collect();
+    format!(
+        r#"const routes = {{
+{routes}}};
+addEventListener('fetch', (event) => {{
+    const path = new URL(event.request.url).pathname;
+    if (path === '/ready') {{
+        event.respondWith(new Response('ready'));
+        return;
+    }}
+    const name = path.split('/')[1];
+    routes[name](event, path.slice(name.length + 1));
+}});"#
+    )
+}
+
+/// Run every check against `server`, and fail naming every check that panicked, so one failing
+/// case does not hide the others.
+fn check_all(
+    server: &WasmServer,
+    checks: impl IntoIterator<Item = (&'static str, fn(&WasmServer))>,
+) {
+    let mut ran = 0;
+    let mut failed = Vec::new();
+    for (name, check) in checks {
+        ran += 1;
+        if let Err(panic) = std::panic::catch_unwind(AssertUnwindSafe(|| check(server))) {
+            let message = panic
+                .downcast_ref::<String>()
+                .map(String::as_str)
+                .or_else(|| panic.downcast_ref::<&str>().copied())
+                .unwrap_or("<no message>");
+            failed.push(format!("{name}: {message}"));
+        }
+    }
+    assert!(
+        failed.is_empty(),
+        "{} of {ran} cases failed:\n{}",
+        failed.len(),
+        failed.join("\n")
+    );
+}
+
+/// Cases about the response a handler builds and how it reaches the client. None of them depends
+/// on what an earlier request left in the instance, so they share one server with default flags.
+#[test]
+fn response_cases_share_one_server() {
+    let cases = response_cases();
+    let Some(server) = Serve::new().script(&routed_script(&cases)).start() else {
+        return;
+    };
+    check_all(&server, cases.iter().map(|case| (case.name, case.check)));
+}
+
+fn response_cases() -> Vec<Case> {
+    let upstream = common::start_upstream("UPSTREAM-BODY");
+    let chunked_upstream = common::start_chunked_upstream(&["one ", "two ", "three"]);
+    let truncated_upstream = common::start_truncated_upstream(&["one ", "two "]);
+    vec![
+        // `Response.error()` is a network error with status 0, which must not be serialized as the
+        // status line `HTTP/1.1 0`. It is sent as a 500 (`serve_maps_invalid_status_to_500`).
+        Case {
+            name: "invalid-status",
+            route: "(event) => event.respondWith(Response.error())".into(),
+            check: |server| {
+                let response = server.full_request("GET", "/invalid-status", "");
+                assert!(response.starts_with("HTTP/1.1 500"), "got: {response}");
+            },
+        },
+        // Fetch isomorphic-encodes a header value, so `U+00DF U+00C0 U+00BF` is sent as the bytes
+        // `DF C0 BF` rather than as their UTF-8 encodings
+        // (`a_response_header_value_is_sent_as_bytes_not_utf8`). The second header must survive
+        // too, in case the host refuses the header list as a whole.
+        Case {
+            name: "header-bytes",
+            route: r#"(event) => event.respondWith(new Response('x', { headers: {
+                'x-test': 'ßÀ¿',
+                'x-other': 'kept',
+            } }))"#
+                .into(),
+            check: |server| {
+                let raw = common::raw_response_within(
+                    server.port(),
+                    "GET",
+                    "/header-bytes",
+                    "",
+                    Duration::from_secs(20),
+                )
+                .expect("a complete response");
+                let needle = b"x-test: \xdf\xc0\xbf\r\n";
+                assert!(
+                    raw.windows(needle.len()).any(|window| window == needle),
+                    "the header must be the three bytes DF C0 BF, got: {:?}",
+                    String::from_utf8_lossy(&raw)
+                );
+                assert!(
+                    raw.windows(14).any(|window| window == b"x-other: kept\r"),
+                    "the other headers must survive: {:?}",
+                    String::from_utf8_lossy(&raw)
+                );
+            },
+        },
+        // `wasi:http` refuses the connection-management headers it writes itself.
+        // `prepare_wire_response` does not filter them, and a handler, or an upstream whose
+        // response is proxied, may set one. Only that header may be lost.
+        Case {
+            name: "refused-header",
+            route: r#"(event) => event.respondWith(new Response('body', { headers: {
+                'x-before': 'kept',
+                'keep-alive': 'timeout=5',
+                'x-after': 'kept',
+            } }))"#
+                .into(),
+            check: |server| {
+                let response = server.full_request("GET", "/refused-header", "");
+                assert!(response.contains("x-before: kept"), "{response}");
+                assert!(response.contains("x-after: kept"), "{response}");
+                assert!(
+                    !response.to_lowercase().contains("keep-alive"),
+                    "the refused header must not be on the wire: {response}"
+                );
+                assert_eq!(
+                    common::wasm_serve::message_body(&response),
+                    "body",
+                    "{response}"
+                );
+                assert!(
+                    server.wait_for_marker(
+                        "dropping the response header `keep-alive`",
+                        Duration::from_secs(5)
+                    ),
+                    "{}",
+                    server.log()
+                );
+            },
+        },
+        // A field that arrived in mixed case is found by any casing. The incoming headers are
+        // immutable. Headers put on the response keep `set-cookie` as separate fields, while
+        // everything else combines (`serve_exposes_incoming_headers_and_keeps_them_immutable`).
+        Case {
+            name: "incoming-headers",
+            route: r#"(event) => {
+                const incoming = event.request.headers;
+                let immutable = 'mutable';
+                try {
+                    incoming.delete('user-agent');
+                } catch (e) {
+                    immutable = e.constructor.name;
+                }
+                const response = new Response('ok', {
+                    headers: [
+                        ['x-seen', incoming.get('EXAMPLE-HEADER') ?? 'missing'],
+                        ['x-agent', incoming.get('User-Agent') ?? 'missing'],
+                        ['x-immutable', immutable],
+                    ],
+                });
+                response.headers.append('set-cookie', 'A');
+                response.headers.append('set-cookie', 'B');
+                response.headers.append('another', 'A');
+                response.headers.append('another', 'B');
+                event.respondWith(response);
+            }"#
+            .into(),
+            check: |server| {
+                let response = common::raw_request_within(
+                    server.port(),
+                    b"GET /incoming-headers HTTP/1.1\r\nHost: x\r\neXample-hEader: Header Value\r\n\
+                      User-Agent: test-agent\r\nConnection: close\r\n\r\n",
+                    Duration::from_secs(20),
+                )
+                .expect("a complete response");
+                assert!(
+                    response.contains("x-seen: Header Value"),
+                    "a mixed-case field must be found by any casing: {response}"
+                );
+                assert!(response.contains("x-agent: test-agent"), "got: {response}");
+                assert!(
+                    response.contains("x-immutable: TypeError"),
+                    "an incoming request's headers must not be mutable: {response}"
+                );
+                // `set-cookie` must stay one field per cookie, since combining two cookies into
+                // one field changes what they mean. Other repeats may be sent as separate fields
+                // or as one comma list, which RFC 9110 §5.2 makes equivalent, but both values have
+                // to survive.
+                assert_eq!(
+                    response.matches("set-cookie: ").count(),
+                    2,
+                    "each cookie needs a field of its own: {response}"
+                );
+                assert!(response.contains("set-cookie: A"), "got: {response}");
+                assert!(response.contains("set-cookie: B"), "got: {response}");
+                assert!(
+                    response.contains("another: A, B")
+                        || (response.contains("another: A") && response.contains("another: B")),
+                    "both values of a repeated header must reach the client: {response}"
+                );
+            },
+        },
+        // `wasmtime serve` forwards a `HEAD` to the guest and sends what the guest produced: no
+        // body, and the `Content-Length` a `GET` would have had. `prepare_wire_response` can supply
+        // that length only for an in-memory body, since a streamed body's length is known only
+        // once it is produced (`serve_answers_a_head_request_without_a_body`).
+        Case {
+            name: "head",
+            route: r#"(event, rest) => {
+                if (rest === '/stream') {
+                    event.respondWith(new Response(new ReadableStream({
+                        start(c) {
+                            c.enqueue(new TextEncoder().encode('BODYBYTES'));
+                            c.close();
+                        },
+                    })));
+                    return;
+                }
+                event.respondWith(new Response('BODYBYTES', { status: 201 }));
+            }"#
+            .into(),
+            check: |server| {
+                let response = server.full_request("HEAD", "/head", "");
+                let (head, body) = response.split_once("\r\n\r\n").expect("a complete head");
+                assert!(
+                    head.starts_with("HTTP/1.1 201 "),
+                    "the head is still the handler's: {response}"
+                );
+                assert_eq!(
+                    body, "",
+                    "a HEAD response must not include a body, but got: {response}"
+                );
+                assert!(
+                    head.to_lowercase().contains("content-length: 9"),
+                    "a HEAD must declare the length a GET would have sent: {head}"
+                );
+
+                let streamed = server.full_request("HEAD", "/head/stream", "");
+                let (head, body) = streamed.split_once("\r\n\r\n").expect("a complete head");
+                assert_eq!(body, "", "got: {streamed}");
+                assert!(
+                    !head.to_lowercase().contains("content-length"),
+                    "a streamed body's length is only knowable by producing it: {head}"
+                );
+            },
+        },
+        // A `204` or `304` is framed by its status, with no `Content-Length` and no
+        // `Transfer-Encoding` (RFC 9110 §8.6, RFC 9112 §6.2,
+        // `a_bodiless_status_has_no_framing_headers`).
+        Case {
+            name: "bodiless",
+            route: "(event, rest) => \
+                    event.respondWith(new Response(null, { status: Number(rest.slice(1)) }))"
+                .into(),
+            check: |server| {
+                for status in [204, 304] {
+                    let response = server.full_request("GET", &format!("/bodiless/{status}"), "");
+                    let head = response
+                        .split_once("\r\n\r\n")
+                        .map_or(&*response, |(head, _)| head)
+                        .to_lowercase();
+                    assert!(
+                        !head.contains("content-length"),
+                        "a {status} must not be framed with Content-Length: {response}"
+                    );
+                    assert!(
+                        !head.contains("transfer-encoding"),
+                        "a {status} must not be framed with Transfer-Encoding: {response}"
+                    );
+                }
+            },
+        },
+        // A handler's own `Content-Length` never frames content already in memory.
+        // `prepare_wire_response` measures the body instead
+        // (`serve_frames_a_response_by_its_body_not_the_handlers_content_length`).
+        Case {
+            name: "handler-length",
+            route: r#"(event, rest) => {
+                const declared = {
+                    // Longer than the body.
+                    '/larger': ['10000'],
+                    // Not a number at all.
+                    '/bogus': ['test'],
+                    // Two of them, which combine into one comma-joined value.
+                    '/duplicate': ['10000', '10000'],
+                }[rest];
+                const headers = new Headers();
+                for (const value of declared) headers.append('content-length', value);
+                event.respondWith(new Response('short', { headers }));
+            }"#
+            .into(),
+            check: |server| {
+                for path in [
+                    "/handler-length/larger",
+                    "/handler-length/bogus",
+                    "/handler-length/duplicate",
+                ] {
+                    let response = server.full_request("GET", path, "");
+                    let head = response
+                        .split_once("\r\n\r\n")
+                        .expect("a complete response")
+                        .0;
+                    assert_eq!(server.request("GET", path, ""), "short", "body for {path}");
+                    let lower = head.to_lowercase();
+                    assert!(
+                        !lower.contains("10000") && !lower.contains("content-length: test"),
+                        "the handler's own length must not reach the wire for {path}: {head}"
+                    );
+                }
+            },
+        },
+        // The guest declares the length of an in-memory body, as native does
+        // (`serve_frames_a_response_by_its_body_not_the_handlers_content_length`). The host frames
+        // by what the guest hands it, and without a declared length it chunks every such response.
+        Case {
+            name: "fixed-length",
+            route: "(event) => event.respondWith(new Response('BODYBYTES'))".into(),
+            check: |server| {
+                let response = server.full_request("GET", "/fixed-length", "");
+                let head = response
+                    .split_once("\r\n\r\n")
+                    .expect("a complete response")
+                    .0
+                    .to_lowercase();
+                assert!(head.contains("content-length: 9"), "got: {head}");
+                assert!(!head.contains("transfer-encoding"), "got: {head}");
+                assert_eq!(server.get("/fixed-length"), "BODYBYTES");
+            },
+        },
+        // A streamed body's length is not known before it is produced, so a length the handler
+        // declares frames the response, as on native
+        // (`serve_frames_a_streamed_body_by_its_declared_content_length`). The guest writes the
+        // body, so content past the declared length is never handed to the host. A declaration
+        // that is not a single `1*DIGIT` is refused, and the host picks the framing.
+        Case {
+            name: "declared-length",
+            route: r#"(event, rest) => {
+                const [parts, length] = {
+                    '/exact': [['abc', 'de'], '5'],
+                    '/longer': [['abcde', 'XXXXX'], '5'],
+                    // Less than it declared: the guest ends the body as an abort, so the host
+                    // cannot present the truncation as a complete response.
+                    '/shorter': [['ab'], '5'],
+                    '/bogus': [['abcde'], 'test'],
+                }[rest];
+                event.respondWith(new Response(new ReadableStream({
+                    start(c) {
+                        for (const part of parts) c.enqueue(new TextEncoder().encode(part));
+                        c.close();
+                    },
+                }), { headers: { 'content-length': length } }));
+            }"#
+            .into(),
+            check: |server| {
+                for path in ["/declared-length/exact", "/declared-length/longer"] {
+                    let response = server.full_request("GET", path, "");
+                    let (head, body) = response
+                        .split_once("\r\n\r\n")
+                        .expect("a complete response");
+                    assert!(
+                        head.to_lowercase().contains("content-length: 5"),
+                        "the declared length must frame {path}: {head}"
+                    );
+                    assert!(
+                        !head.to_lowercase().contains("transfer-encoding"),
+                        "got for {path}: {head}"
+                    );
+                    assert_eq!(body, "abcde", "body for {path}: {response}");
+                }
+
+                let short = server.full_request("GET", "/declared-length/shorter", "");
+                let sent = short
+                    .split_once("\r\n\r\n")
+                    .map(|(_, body)| body)
+                    .unwrap_or("");
+                assert!(
+                    sent.len() < 5,
+                    "the body must stop short of the length it declared: {short:?}"
+                );
+
+                let response = server.full_request("GET", "/declared-length/bogus", "");
+                let head = response
+                    .split_once("\r\n\r\n")
+                    .expect("a complete response")
+                    .0;
+                assert!(!head.contains("test"), "got: {head}");
+                assert_eq!(server.get("/declared-length/bogus"), "abcde");
+            },
+        },
+        // A body that errors after sending bytes delivers what was produced, and then ends without
+        // the terminating chunk, so the truncation cannot be mistaken for a complete response
+        // (`a_response_stream_that_errors_mid_flight_leaves_the_body_unterminated`).
+        Case {
+            name: "errors-mid-flight",
+            // The error comes from a timer. A body cannot outlive its request's event loop going
+            // idle, so the stream holds the loop open until it errors. The delay only has to
+            // outlast the first chunk reaching the wire: a host that has not flushed a chunk when
+            // the body aborts may discard it.
+            route: r#"(event) => event.respondWith(new Response(new ReadableStream({
+                start(c) {
+                    c.enqueue(new TextEncoder().encode('first-chunk-'));
+                    setTimeout(() => c.error(new Error('stream broke')), 300);
+                },
+            })))"#
+                .into(),
+            check: |server| {
+                let errored = server.full_request("GET", "/errors-mid-flight", "");
+                let (_, body) = errored.split_once("\r\n\r\n").expect("a complete head");
+                assert!(
+                    body.contains("first-chunk-"),
+                    "the bytes produced before the error must still arrive: {errored}"
+                );
+                assert!(
+                    !body.ends_with("0\r\n\r\n"),
+                    "an errored body must not be terminated as if it were complete: {errored}"
+                );
+            },
+        },
+        // A stream that enqueues something other than a `Uint8Array` aborts its body before a byte
+        // is written (WPT
+        // `resources/fetch-event-respond-with-response-body-with-invalid-chunk-worker.js`).
+        //
+        // Host-owned divergence: native sends a `200` head and then closes the body unterminated.
+        // `wasmtime serve` has not committed the head when the body aborts, and sends no response
+        // (see the comment where `dispatch_request` hands the response over). Either way, the
+        // client must not get a response that looks complete.
+        Case {
+            name: "invalid-chunk",
+            route: r#"(event) => event.respondWith(new Response(new ReadableStream({
+                start(c) {
+                    c.enqueue('a string, not a Uint8Array');
+                    c.close();
+                },
+            })))"#
+                .into(),
+            check: |server| {
+                // The control, since the response under test may be empty: an empty reply below is
+                // the invalid chunk's doing, not a server that stopped responding.
+                assert_eq!(server.get("/ready"), "ready");
+                let response = server.full_request("GET", "/invalid-chunk", "");
+                assert!(
+                    response.is_empty() || !response.ends_with("0\r\n\r\n"),
+                    "a body that never produced a valid chunk must reach the client as nothing at \
+                     all, or as an unterminated one, never as a complete response: {response:?}"
+                );
+            },
+        },
+        // An empty chunk neither ends the body nor corrupts the framing
+        // (`serve_streams_an_empty_chunk_without_ending_the_body`). `spawn_body_writer`'s
+        // dropped-reader check does not apply to it, since an empty write leaves an empty
+        // remainder either way.
+        Case {
+            name: "empty-chunk",
+            route: r#"(event) => {
+                const encoder = new TextEncoder();
+                event.respondWith(new Response(new ReadableStream({
+                    start(c) {
+                        c.enqueue(new Uint8Array(0));
+                        c.enqueue(encoder.encode('chunk one '));
+                        c.enqueue(new Uint8Array(0));
+                        c.enqueue(encoder.encode('chunk two'));
+                        c.close();
+                    },
+                })));
+            }"#
+            .into(),
+            check: |server| assert_eq!(server.get("/empty-chunk"), "chunk one chunk two"),
+        },
+        // A body produced by a timer is served to completion. The pump runs on the request's own
+        // loop, which is driven for as long as the body needs it
+        // (`an_interval_driven_stream_is_served_to_completion`).
+        Case {
+            name: "interval-stream",
+            route: r#"(event) => {
+                let ticks = 0;
+                event.respondWith(new Response(new ReadableStream({
+                    start(c) {
+                        const id = setInterval(() => {
+                            c.enqueue(new TextEncoder().encode('tick ' + ++ticks + ' '));
+                            if (ticks === 5) {
+                                clearInterval(id);
+                                c.close();
+                            }
+                        }, 50);
+                    },
+                })));
+            }"#
+            .into(),
+            check: |server| {
+                assert_eq!(
+                    server.get("/interval-stream"),
+                    "tick 1 tick 2 tick 3 tick 4 tick 5 "
+                );
+            },
+        },
+        // An upstream body forwarded as a stream rather than collected first. The handler builds
+        // its own `Response` around `upstream.body`, and the chunks, which the upstream sends with
+        // pauses between them, reach the client (`body_path.rs`'s
+        // `single_bodies_take_the_route_they_should`).
+        Case {
+            name: "upstream-stream",
+            route: format!(
+                "(event) => event.respondWith((async () => {{
+                    const upstream = await fetch('http://127.0.0.1:{chunked_upstream}/');
+                    return new Response(upstream.body, upstream);
+                }})())"
+            ),
+            check: |server| assert_eq!(server.get("/upstream-stream"), "one two three"),
+        },
+        // An upstream that dies mid-body reaches the client as a truncation, not as a body that
+        // ended cleanly a few bytes short, since the terminating chunk asserts completeness (RFC
+        // 9112 §7.1). The guest never sees the body's bytes, and the truncation reaches the client
+        // through the piped trailers.
+        Case {
+            name: "dying-upstream",
+            route: format!(
+                "(event) => event.respondWith(fetch('http://127.0.0.1:{truncated_upstream}/'))"
+            ),
+            check: |server| {
+                let response = server.full_request("GET", "/dying-upstream", "");
+                assert!(
+                    response.contains("one ") && response.contains("two "),
+                    "what the upstream did send must arrive: {response:?}"
+                );
+                assert!(
+                    !response.ends_with("0\r\n\r\n"),
+                    "a truncated upstream must not be forwarded as a complete body: {response:?}"
+                );
+            },
+        },
+        // A `fetch` whose request has a header the host refuses rejects with a `TypeError` naming
+        // that header. `http2-settings` is allowed by Fetch but refused by `wasi:http`.
+        Case {
+            name: "refused-fetch-header",
+            route: format!(
+                "(event) => event.respondWith(
+                    fetch('http://127.0.0.1:{upstream}/', {{
+                        headers: {{ 'http2-settings': 'AAMAAABk' }},
+                    }}).then(
+                        () => new Response('sent'),
+                        (e) => new Response(e.name + ': ' + e.message)))"
+            ),
+            check: |server| {
+                let body = server.get("/refused-fetch-header");
+                assert!(body.starts_with("TypeError: "), "{body}");
+                assert!(body.contains("http2-settings"), "{body}");
+            },
+        },
+        // A streamed response's head is sent when it is ready, not with the first chunk. A handler
+        // that streams may take a while to produce anything, and the client acts on the status and
+        // headers meanwhile (`a_streamed_response_sends_its_head_before_the_first_chunk`).
+        Case {
+            name: "head-first",
+            route: r#"(event) => {
+                const stream = new ReadableStream({
+                    start(c) {
+                        setTimeout(() => {
+                            c.enqueue(new TextEncoder().encode('late'));
+                            c.close();
+                        }, 2000);
+                    },
+                });
+                event.respondWith(new Response(stream, { headers: { 'x-marker': 'early' } }));
+            }"#
+            .into(),
+            check: |server| {
+                let mut stream = TcpStream::connect(("127.0.0.1", server.port())).unwrap();
+                stream
+                    .write_all(b"GET /head-first HTTP/1.1\r\nHost: x\r\nConnection: close\r\n\r\n")
+                    .unwrap();
+                let started = std::time::Instant::now();
+
+                // Read just enough to have seen the head, and time how long that took.
+                stream
+                    .set_read_timeout(Some(Duration::from_secs(10)))
+                    .unwrap();
+                let mut buf = [0u8; 256];
+                let read = std::io::Read::read(&mut stream, &mut buf).unwrap();
+                let elapsed = started.elapsed();
+                let head = String::from_utf8_lossy(&buf[..read]).to_string();
+
+                assert!(head.starts_with("HTTP/1.1 200"), "got: {head}");
+                assert!(head.contains("x-marker: early"), "got: {head}");
+                assert!(
+                    elapsed < Duration::from_millis(1500),
+                    "the head must not wait for the first chunk (took {elapsed:?})"
+                );
+            },
+        },
+        // `waitUntil` work does not hold a streamed response open. The send drives the request's
+        // loop only for as long as the body needs it
+        // (`wait_until_does_not_delay_a_streamed_response`).
+        Case {
+            name: "streamed-wait-until",
+            route: r#"(event) => {
+                const stream = new ReadableStream({
+                    start(c) {
+                        c.enqueue(new TextEncoder().encode('streamed body'));
+                        c.close();
+                    },
+                });
+                event.respondWith(new Response(stream));
+                event.waitUntil(new Promise((resolve) => setTimeout(resolve, 4000)));
+            }"#
+            .into(),
+            check: |server| {
+                let started = std::time::Instant::now();
+                let body = server.get("/streamed-wait-until");
+                let elapsed = started.elapsed();
+                assert_eq!(body, "streamed body");
+                assert!(
+                    elapsed < Duration::from_secs(3),
+                    "a streamed response must not wait for waitUntil work (took {elapsed:?})"
+                );
+            },
+        },
+    ]
+}
+
+/// Cases about the request body a handler reads. None of them depends on what an earlier request
+/// left in the instance, so they share one server with default flags.
+#[test]
+fn request_body_cases_share_one_server() {
+    let cases = request_body_cases();
+    let Some(server) = Serve::new().script(&routed_script(&cases)).start() else {
+        return;
+    };
+    check_all(&server, cases.iter().map(|case| (case.name, case.check)));
+}
+
+fn request_body_cases() -> Vec<Case> {
+    let echo_upstream = common::start_echo_upstream();
+    vec![
+        // A handler reading `request.body` sees chunks as they arrive, not after the upload ends.
+        // The first chunk's echo comes back before the rest is sent
+        // (`serve_streams_an_incoming_request_body`).
+        Case {
+            name: "upload-stream",
+            route: r#"(event) => {
+                const reader = event.request.body.getReader();
+                event.respondWith(new Response(new ReadableStream({
+                    async pull(controller) {
+                        const { done, value } = await reader.read();
+                        if (done) {
+                            controller.close();
+                            return;
+                        }
+                        controller.enqueue(value);
+                    },
+                })));
+            }"#
+            .into(),
+            check: |server| {
+                /// Read from `stream` until the response body so far contains `expected`.
+                fn read_until(stream: &mut TcpStream, raw: &mut Vec<u8>, expected: &str) -> String {
+                    for _ in 0..200 {
+                        let body = String::from_utf8_lossy(raw)
+                            .split_once("\r\n\r\n")
+                            .map(|(_, body)| common::dechunk(body))
+                            .unwrap_or_default();
+                        if body.contains(expected) {
+                            return body;
+                        }
+                        let mut buf = [0u8; 1024];
+                        let read = std::io::Read::read(stream, &mut buf).unwrap();
+                        assert_ne!(read, 0, "connection closed while waiting for {expected:?}");
+                        raw.extend_from_slice(&buf[..read]);
+                    }
+                    panic!("never received {expected:?}");
+                }
+
+                let mut stream = TcpStream::connect(("127.0.0.1", server.port())).unwrap();
+                stream
+                    .set_read_timeout(Some(Duration::from_secs(20)))
+                    .unwrap();
+                stream
+                    .write_all(
+                        b"POST /upload-stream HTTP/1.1\r\nHost: x\r\nTransfer-Encoding: chunked\r\n\
+                          Connection: close\r\n\r\n",
+                    )
+                    .unwrap();
+                let mut raw = Vec::new();
+                // First chunk: the echo must come back before the rest of the request is sent.
+                stream.write_all(b"5\r\nfirst\r\n").unwrap();
+                read_until(&mut stream, &mut raw, "first");
+                // Only now send the second chunk and the terminator.
+                stream.write_all(b"6\r\nsecond\r\n0\r\n\r\n").unwrap();
+                let body = read_until(&mut stream, &mut raw, "second");
+                assert_eq!(body, "firstsecond", "got: {body}");
+            },
+        },
+        // `wasi:http` gives a request with no body the same empty stream as one whose body is
+        // empty, so `body_framing` goes by the method: `GET` gets `null`, and a `POST` without a
+        // body gets an empty stream rather than `null`.
+        //
+        // Host-owned divergence: native reads the framing headers the client sent, so a bodyless
+        // `POST` there gets `null`.
+        Case {
+            name: "bodyless-post",
+            route: "(event) => event.respondWith(\
+                    new Response(event.request.body === null ? 'null' : 'stream'))"
+                .into(),
+            check: |server| {
+                assert_eq!(server.request("GET", "/bodyless-post", ""), "null");
+                assert_eq!(server.request("POST", "/bodyless-post", ""), "stream");
+                assert_eq!(
+                    server.request("POST", "/bodyless-post", "payload"),
+                    "stream"
+                );
+            },
+        },
+        // A chunked upload reaches the handler decoded. The host undoes the framing, and
+        // `body_framing` exposes a body although there is no `Content-Length` to go by, since
+        // `wasi:http` does not pass `Transfer-Encoding` on to the guest
+        // (`serve_decodes_a_chunked_request_body`).
+        //
+        // Host-owned divergence: native also refuses `Transfer-Encoding` together with
+        // `Content-Length` (RFC 9112 §6.3, a request-smuggling vector) with a 400. On wasm the host
+        // parses the request, so refusing it is the host's business.
+        Case {
+            name: "chunked-upload",
+            route: "(event) => event.respondWith(\
+                    event.request.text().then((body) => new Response('got:' + body)))"
+                .into(),
+            check: |server| {
+                // "hello world" as two chunks: "hello " (0x6) then "world" (0x5).
+                let response = common::raw_request_within(
+                    server.port(),
+                    b"POST /chunked-upload HTTP/1.1\r\nHost: x\r\nTransfer-Encoding: chunked\r\n\
+                      Connection: close\r\n\r\n6\r\nhello \r\n5\r\nworld\r\n0\r\n\r\n",
+                    Duration::from_secs(20),
+                )
+                .expect("a complete response");
+                assert!(response.contains("got:hello world"), "got: {response}");
+
+                // Both framings at once, with bytes after the chunked terminator that only the
+                // `Content-Length` reading would take for body. `wasmtime serve` reads the request
+                // as chunked, which RFC 9112 §6.3 allows a server to do. Either way, those bytes
+                // must not reach the handler as a body.
+                let smuggle = common::raw_request_within(
+                    server.port(),
+                    b"POST /chunked-upload HTTP/1.1\r\nHost: x\r\nTransfer-Encoding: chunked\r\n\
+                      Content-Length: 5\r\nConnection: close\r\n\r\n0\r\n\r\nSMUGGLED",
+                    Duration::from_secs(20),
+                )
+                .unwrap_or_default();
+                assert!(
+                    !smuggle.contains("SMUGGLED"),
+                    "the second framing's bytes must not reach the handler: {smuggle:?}"
+                );
+                assert!(
+                    smuggle.is_empty() || common::wasm_serve::message_body(&smuggle) == "got:",
+                    "an ambiguous request is either refused or read one way: {smuggle:?}"
+                );
+            },
+        },
+        // A client that closes mid-body must not present the truncation to the handler as a
+        // complete body. The request's stream errors, so `text()` rejects
+        // (`serve_rejects_a_truncated_request_body`). On wasm the abort arrives through the
+        // incoming body's trailers.
+        Case {
+            name: "truncated-upload",
+            route: r#"(event) => event.respondWith(event.request.text().then(
+                (body) => new Response('complete:' + body),
+                () => new Response('truncated'),
+            ))"#
+            .into(),
+            check: |server| {
+                let mut stream = TcpStream::connect(("127.0.0.1", server.port())).unwrap();
+                // Set before the half-close below, and read by hand rather than through
+                // `read_until_eof`: macOS refuses a read timeout on a socket whose write half is
+                // already shut down, and `read_until_eof` sets one on each iteration to keep its
+                // patience a total.
+                stream
+                    .set_read_timeout(Some(Duration::from_secs(20)))
+                    .unwrap();
+                // Declare ten bytes, send four, then close the sending side.
+                stream
+                    .write_all(
+                        b"POST /truncated-upload HTTP/1.1\r\nHost: x\r\nContent-Length: 10\r\n\
+                          Connection: close\r\n\r\nfour",
+                    )
+                    .unwrap();
+                stream.shutdown(std::net::Shutdown::Write).unwrap();
+                let mut raw = Vec::new();
+                let mut buf = [0u8; 1024];
+                while let Ok(read) = std::io::Read::read(&mut stream, &mut buf) {
+                    if read == 0 {
+                        break;
+                    }
+                    raw.extend_from_slice(&buf[..read]);
+                }
+                let response = String::from_utf8_lossy(&raw).into_owned();
+                assert!(
+                    response.contains("truncated"),
+                    "a truncated upload must make the handler's read reject: {response:?}"
+                );
+            },
+        },
+        // An incoming request body used directly as the response body is handed to the wire
+        // without being pumped through JS, since the incoming body is a host body rather than
+        // bytes (`serve_pipes_an_incoming_request_body_to_the_response`).
+        Case {
+            name: "piped-body",
+            route: "(event) => event.respondWith(new Response(event.request.body ?? 'no body'))"
+                .into(),
+            check: |server| {
+                assert_eq!(
+                    server.request("POST", "/piped-body", "hello world"),
+                    "hello world"
+                );
+            },
+        },
+        // The same body forwarded upstream as an outgoing request's body while the handler reads
+        // the other half of the `tee`. Both halves see the whole upload
+        // (`serve_forwards_an_incoming_body_upstream_while_reading_it`).
+        Case {
+            name: "tee-upstream",
+            route: format!(
+                r#"(event) => event.respondWith((async () => {{
+                    const [forward, inspect] = event.request.body.tee();
+                    const sent = fetch('http://127.0.0.1:{echo_upstream}/', {{
+                        method: 'POST',
+                        body: forward,
+                        duplex: 'half',
+                    }});
+                    let seen = '';
+                    const reader = inspect.getReader();
+                    const decoder = new TextDecoder();
+                    while (true) {{
+                        const {{ done, value }} = await reader.read();
+                        if (done) break;
+                        seen += decoder.decode(value, {{ stream: true }});
+                    }}
+                    const echoed = await (await sent).text();
+                    return new Response('upstream=' + echoed + ' local=' + seen);
+                }})())"#
+            ),
+            check: |server| {
+                assert_eq!(
+                    server.request("POST", "/tee-upstream", "payload bytes"),
+                    "upstream=payload bytes local=payload bytes"
+                );
+            },
+        },
+        // `clone()` on an incoming request tees its body, and both halves see all of it
+        // (`serve_clones_an_incoming_request_body`).
+        Case {
+            name: "cloned-body",
+            route: r#"(event) => {
+                const copy = event.request.clone();
+                event.respondWith(Promise.all([event.request.text(), copy.text()])
+                    .then(([a, b]) => new Response(a + '|' + b)));
+            }"#
+            .into(),
+            check: |server| {
+                assert_eq!(
+                    server.request("POST", "/cloned-body", "payload"),
+                    "payload|payload",
+                    "both halves of the tee must see the body"
+                );
+            },
+        },
+    ]
+}
+
+/// Cases about how the event's listeners and their failures turn into a response, on one server
+/// with two listeners.
+#[test]
+fn listener_cases_share_one_server() {
+    const HANDLER: &str = r#"addEventListener('fetch', (event) => {
+        const path = new URL(event.request.url).pathname;
+        if (path === '/boom' || path === '/throw-then-respond') {
+            throw new Error('handler blew up');
+        }
+        if (path === '/cancel-only' || path === '/cancel-then-respond') {
+            event.preventDefault();
+        }
+    });
+    addEventListener('fetch', (event) => {
+        const path = new URL(event.request.url).pathname;
+        if (path === '/boom' || path === '/cancel-only') {
+            return;
+        }
+        if (path === '/rejected-wait-until') {
+            event.waitUntil(Promise.reject(new Error('waitUntil failed')));
+            event.respondWith(new Response('answered anyway'));
+            return;
+        }
+        event.respondWith(new Response(path === '/ready' ? 'ready' : 'recovered'));
+    });"#;
+    let Some(server) = Serve::new().script(HANDLER).start() else {
+        return;
+    };
+    check_all(
+        &server,
+        [
+            // A handler that throws instead of responding gets a 500, not a hung connection or an
+            // empty 200 (`a_throwing_handler_is_answered_with_500`).
+            ("boom", |server: &WasmServer| {
+                assert!(
+                    server
+                        .full_request("GET", "/boom", "")
+                        .starts_with("HTTP/1.1 500"),
+                    "a throwing listener is answered with a 500"
+                );
+            }),
+            // `preventDefault` cancels the event, and on its own leaves nothing to respond with
+            // (`prevent_default_does_not_stop_a_later_listener_responding`).
+            ("cancel-only", |server: &WasmServer| {
+                assert!(
+                    server
+                        .full_request("GET", "/cancel-only", "")
+                        .starts_with("HTTP/1.1 500 "),
+                    "cancelling without responding is a network error"
+                );
+            }),
+            // Neither a throw nor `preventDefault` takes the dispatch down: a listener after them
+            // still gets the event and responds.
+            ("later-listener", |server: &WasmServer| {
+                assert_eq!(server.get("/throw-then-respond"), "recovered");
+                assert_eq!(server.get("/cancel-then-respond"), "recovered");
+            }),
+            // A `waitUntil` promise that rejects does not affect the response
+            // (`a_rejected_wait_until_does_not_break_the_response`).
+            ("rejected-wait-until", |server: &WasmServer| {
+                assert_eq!(server.get("/rejected-wait-until"), "answered anyway");
+            }),
+        ] as [(&'static str, fn(&WasmServer)); 4],
+    );
+}
diff --git a/crates/starling-macro/src/lib.rs b/crates/starling-macro/src/lib.rs
index 4ca09c17..f6506474 100644
--- a/crates/starling-macro/src/lib.rs
+++ b/crates/starling-macro/src/lib.rs
@@ -18,8 +18,8 @@ use syn::{
 // Attribute option parsing (shared across all macros)
 // ============================================================================
 
-/// Parsed key-value options from attribute arguments.
-/// Used by `#[jsclass]`, `#[jsmethods]`, `#[jsmodule]`, and `#[method]`.
+/// The options of the attribute macros and method markers. [`AttrOpts::reject_all_but`] rejects
+/// the ones an attribute doesn't take.
 #[derive(Default)]
 struct AttrOpts {
     /// Optional name override for the JS class or method. By default, a
@@ -63,31 +63,24 @@ impl Parse for AttrOpts {
         while !input.is_empty() {
             let key: Ident = input.parse()?;
             // Bare flags take no `= value`.
-            if key == "hidden" {
-                opts.hidden = true;
-                if !input.is_empty() {
-                    let _: Token![,] = input.parse()?;
-                }
-                continue;
-            }
-            if key == "unforgeable" {
-                opts.unforgeable = true;
-                if !input.is_empty() {
-                    let _: Token![,] = input.parse()?;
-                }
-                continue;
-            }
-            if input.parse::<Token![=]>().is_err() {
+            let flag = match key.to_string().as_str() {
+                "hidden" => Some(&mut opts.hidden),
+                "unforgeable" => Some(&mut opts.unforgeable),
+                _ => None,
+            };
+            if let Some(flag) = flag {
+                *flag = true;
+            } else if input.parse::<Token![=]>().is_err() {
                 return Err(syn::Error::new(key.span(), "unknown option"));
-            }
-
-            match key.to_string().as_str() {
-                "name" => opts.name = Some(input.parse::<LitStr>()?.value()),
-                "length" => opts.length = Some(input.parse::<LitInt>()?.base10_parse()?),
-                "extends" => opts.extends = Some(input.parse()?),
-                "js_proto" => opts.js_proto = Some(input.parse::<LitStr>()?.value()),
-                "to_string_tag" => opts.to_string_tag = Some(input.parse::<LitStr>()?.value()),
-                _ => return Err(syn::Error::new(key.span(), "unknown option")),
+            } else {
+                match key.to_string().as_str() {
+                    "name" => opts.name = Some(input.parse::<LitStr>()?.value()),
+                    "length" => opts.length = Some(input.parse::<LitInt>()?.base10_parse()?),
+                    "extends" => opts.extends = Some(input.parse()?),
+                    "js_proto" => opts.js_proto = Some(input.parse::<LitStr>()?.value()),
+                    "to_string_tag" => opts.to_string_tag = Some(input.parse::<LitStr>()?.value()),
+                    _ => return Err(syn::Error::new(key.span(), "unknown option")),
+                }
             }
             if !input.is_empty() {
                 let _: Token![,] = input.parse()?;
@@ -108,10 +101,7 @@ impl Parse for AttrOpts {
 /// `#[method(...)]` or `#[getter(...)]`.
 ///
 /// A bare marker (`#[method]`, no parentheses) yields default options.
-/// Malformed arguments — or options that aren't valid in this context (a
-/// typo'd key, `#[getter(length = 2)]`, a class-level option on a method) —
-/// produce a spanned compile error rather than being silently dropped, which
-/// would otherwise register the member under the wrong JS name or `.length`.
+/// Malformed arguments and options not in `allowed` are a compile error.
 fn parse_marker_opts(attr: &syn::Attribute, allowed: &[&str]) -> syn::Result<AttrOpts> {
     let opts = match &attr.meta {
         syn::Meta::Path(_) => return Ok(AttrOpts::default()),
@@ -129,12 +119,6 @@ fn parse_marker_opts(attr: &syn::Attribute, allowed: &[&str]) -> syn::Result<Att
 
 impl AttrOpts {
     /// Reject every option set on this attribute that isn't in `allowed`.
-    ///
-    /// Every attribute parses the same option set, so each one has to turn away
-    /// the ones that mean nothing to it — silently ignoring `#[getter(length =
-    /// 2)]` or `#[webidl_dictionary(hidden)]` would register the member under
-    /// the wrong shape. Listing the fields once here means a new option can't
-    /// be quietly accepted by every attribute that forgot to name it.
     fn reject_all_but(&self, allowed: &[&str], span: impl quote::ToTokens) -> syn::Result<()> {
         let set: [(bool, &str); 7] = [
             (self.name.is_some(), "name"),
@@ -220,8 +204,12 @@ struct ClassConfig {
     /// so that `pub const` items are installed on both constructor and
     /// prototype (per WebIDL §3.7.3).
     constants_on_prototype: bool,
-    /// JS builtins' methods aren't enumerable, but WebIDL interfaces' are, so we have to use different flags for them.
+    /// The property flags of methods and accessors. JS builtins' methods and accessors aren't
+    /// enumerable, but WebIDL interfaces' are, so we have to use different flags for them.
     method_flags: u16,
+    /// The message of the `TypeError` a call of the constructor without `new` throws, if it
+    /// differs from `ClassDef::CALL_WITHOUT_NEW_ERROR`'s default.
+    call_without_new_error: Option<&'static str>,
     /// The attribute this configures, for use in error messages.
     attribute: &'static str,
 }
@@ -233,6 +221,8 @@ impl ClassConfig {
         auto_to_string_tag: false,
         constants_on_prototype: false,
         method_flags: 0,
+        // SpiderMonkey's `JSMSG_CANT_CALL_CLASS_CONSTRUCTOR`.
+        call_without_new_error: Some("class constructors must be invoked with 'new'"),
         attribute: "jsclass",
     };
 
@@ -242,6 +232,7 @@ impl ClassConfig {
         auto_to_string_tag: true,
         constants_on_prototype: true,
         method_flags: 1, // js::class_spec::JSPROP_ENUMERATE
+        call_without_new_error: None,
         attribute: "webidl_interface",
     };
 }
@@ -262,13 +253,10 @@ fn process_class_def(attr: TokenStream, item: TokenStream, config: ClassConfig)
     let class_static = format_ident!("__{}_CLASS", struct_name.to_string().to_uppercase());
     let js_name_cstr_lit = cstr_literal(&js_name);
 
-    // If extends is set, compute the inner parent name and rewrite the parent field type
-    let opts_extends_ident = opts.extends.clone();
     let inner_parent = opts.extends.as_ref().map(|p| format_ident!("{}Impl", p));
 
-    if let Some(ref inner_parent_name) = inner_parent {
+    if let (Some(extends), Some(inner_parent_name)) = (&opts.extends, &inner_parent) {
         // A class embeds its parent's data, so the `parent` field holds the parent's `Impl`.
-        let extends = opts_extends_ident.as_ref().expect("extends is set");
         if let Fields::Named(ref fields) = input.fields {
             if let Err(e) = parent_field(
                 &struct_name,
@@ -319,13 +307,14 @@ fn process_class_def(attr: TokenStream, item: TokenStream, config: ClassConfig)
                 ::js::class::register_parent_info::<Self>();
             }
 
-            fn ensure_parent_registered(
-                scope: &::js::gc::scope::Scope<'_>,
-                global: ::js::Object<'_>,
-            ) {
+            fn ensure_parent_registered(scope: &::js::gc::scope::Scope<'_>) {
+                // SAFETY: `scope.global()` is the current global.
                 unsafe {
-                    // SAFETY: register_class is safe to call if scope and global are valid.
-                    ::js::class::register_class::<#inner_parent_name>(scope, global);
+                    if <#inner_parent_name as ::js::class::ClassDef>::HIDDEN {
+                        ::js::class::register_hidden_class::<#inner_parent_name>(scope);
+                    } else {
+                        ::js::class::register_class::<#inner_parent_name>(scope, scope.global());
+                    }
                 }
             }
         }
@@ -363,16 +352,9 @@ fn process_class_def(attr: TokenStream, item: TokenStream, config: ClassConfig)
     // to the JS class name.
     let effective_tag = opts
         .to_string_tag
-        .as_deref()
-        .or({
-            if config.auto_to_string_tag {
-                Some(js_name.as_str())
-            } else {
-                None
-            }
-        })
-        .map(|t| t.to_owned());
-    let to_string_tag_const = if let Some(ref tag) = effective_tag {
+        .as_ref()
+        .or(config.auto_to_string_tag.then_some(&js_name));
+    let to_string_tag_const = if let Some(tag) = effective_tag {
         quote! {
             const TO_STRING_TAG: &'static str = #tag;
         }
@@ -483,6 +465,13 @@ fn process_class_def(attr: TokenStream, item: TokenStream, config: ClassConfig)
 
     let cast_error_lit = cstr_literal(&format!("Value is not an instance of {}", struct_name));
     let not_type_error_lit = cstr_literal(&format!("'this' is not of type {}", js_name));
+    let no_new_error = match config.call_without_new_error {
+        Some(message) => {
+            let message = cstr_literal(message);
+            quote! { const CALL_WITHOUT_NEW_ERROR: &'static ::core::ffi::CStr = #message; }
+        }
+        None => quote! {},
+    };
     let prototype_call_error_lit = cstr_literal(&format!(
         "\"{}\" getter/method called on prototype or uninitialized object",
         js_name
@@ -543,6 +532,7 @@ fn process_class_def(attr: TokenStream, item: TokenStream, config: ClassConfig)
             const NAME_CSTR: &'static ::core::ffi::CStr = #js_name_cstr_lit;
             const NOT_TYPE_ERROR: &'static ::core::ffi::CStr = #not_type_error_lit;
             const PROTOTYPE_CALL_ERROR: &'static ::core::ffi::CStr = #prototype_call_error_lit;
+            #no_new_error
 
             fn class() -> &'static ::js::class_spec::JSClass {
                 &#class_static
@@ -750,55 +740,55 @@ fn process_class_def(attr: TokenStream, item: TokenStream, config: ClassConfig)
 
     // If extends is specified, append inheritance impls and set Deref target
     // to the parent type. Otherwise, Deref targets Object.
-    let output = if let Some(ref inner_parent_name) = inner_parent {
-        let parent_name = opts_extends_ident.as_ref().unwrap();
-        quote! {
-            #output
+    let output =
+        if let (Some(parent_name), Some(inner_parent_name)) = (&opts.extends, &inner_parent) {
+            quote! {
+                #output
 
-            // Deref: Foo<'s> -> Parent<'s>
-            impl<'s> ::std::ops::Deref for #struct_name<'s> {
-                type Target = #parent_name<'s>;
-                fn deref(&self) -> &Self::Target {
-                    unsafe { ::std::mem::transmute(self) }
+                // Deref: Foo<'s> -> Parent<'s>
+                impl<'s> ::std::ops::Deref for #struct_name<'s> {
+                    type Target = #parent_name<'s>;
+                    fn deref(&self) -> &Self::Target {
+                        unsafe { ::std::mem::transmute(self) }
+                    }
                 }
-            }
 
-            // Deref: FooImpl -> ParentImpl
-            impl ::std::ops::Deref for #inner_name {
-                type Target = #inner_parent_name;
-                fn deref(&self) -> &Self::Target {
-                    &self.parent
+                // Deref: FooImpl -> ParentImpl
+                impl ::std::ops::Deref for #inner_name {
+                    type Target = #inner_parent_name;
+                    fn deref(&self) -> &Self::Target {
+                        &self.parent
+                    }
                 }
-            }
 
-            // Deref: FooImpl -> ParentImpl
-            impl ::std::ops::DerefMut for #inner_name {
-                fn deref_mut(&mut self) -> &mut Self::Target {
-                    &mut self.parent
+                // Deref: FooImpl -> ParentImpl
+                impl ::std::ops::DerefMut for #inner_name {
+                    fn deref_mut(&mut self) -> &mut Self::Target {
+                        &mut self.parent
+                    }
                 }
-            }
 
-            impl ::js::class::HasParent for #inner_name {
-                type Parent = #inner_parent_name;
-                fn as_parent(&self) -> &#inner_parent_name { &self.parent }
-                fn as_parent_mut(&mut self) -> &mut #inner_parent_name { &mut self.parent }
-            }
+                impl ::js::class::HasParent for #inner_name {
+                    type Parent = #inner_parent_name;
+                    fn as_parent(&self) -> &#inner_parent_name { &self.parent }
+                    fn as_parent_mut(&mut self) -> &mut #inner_parent_name { &mut self.parent }
+                }
 
-            impl ::js::class::DerivedFrom<#inner_parent_name> for #inner_name {}
-        }
-    } else {
-        quote! {
-            #output
+                impl ::js::class::DerivedFrom<#inner_parent_name> for #inner_name {}
+            }
+        } else {
+            quote! {
+                #output
 
-            // Deref: Foo<'s> -> Object<'s> (base case, no parent)
-            impl<'s> ::std::ops::Deref for #struct_name<'s> {
-                type Target = ::js::Object<'s>;
-                fn deref(&self) -> &Self::Target {
-                    unsafe { ::std::mem::transmute(self) }
+                // Deref: Foo<'s> -> Object<'s> (base case, no parent)
+                impl<'s> ::std::ops::Deref for #struct_name<'s> {
+                    type Target = ::js::Object<'s>;
+                    fn deref(&self) -> &Self::Target {
+                        unsafe { ::std::mem::transmute(self) }
+                    }
                 }
             }
-        }
-    };
+        };
 
     output.into()
 }
@@ -855,12 +845,84 @@ enum ReturnStyle {
     InstanceValue,
 }
 
+/// The parameters of a callable other than its receiver.
+struct Inputs {
+    /// The parameters converted from JS arguments, excluding the scope, `&CallArgs` and
+    /// `RestArgs` parameters.
+    params: Vec<(Ident, Type)>,
+    /// Whether the callable takes a `&Scope` (or `&mut JSContext`).
+    has_cx: bool,
+    /// Whether the callable takes `&CallArgs` and reads its arguments itself.
+    is_raw: bool,
+    /// The name and element type of the `RestArgs<T>` parameter.
+    rest: Option<(Ident, Type)>,
+}
+
+impl Inputs {
+    /// Classify the parameters `inputs` of a signature. Receivers are skipped. A bare `RestArgs`
+    /// without an element type is skipped too, as [`rewrite_rest_args_in_sig`] rejects it.
+    fn parse<'a>(inputs: impl IntoIterator<Item = &'a FnArg>) -> Self {
+        let mut parsed = Inputs {
+            params: Vec::new(),
+            has_cx: false,
+            is_raw: false,
+            rest: None,
+        };
+        for arg in inputs {
+            let FnArg::Typed(pat_ty) = arg else {
+                continue;
+            };
+            if is_cx_param_type(&pat_ty.ty) {
+                parsed.has_cx = true;
+                continue;
+            }
+            if is_callargs_param_type(&pat_ty.ty) {
+                parsed.is_raw = true;
+                continue;
+            }
+            let Pat::Ident(pat_ident) = pat_ty.pat.as_ref() else {
+                continue;
+            };
+            // A variadic tail is collected from the arguments after the fixed ones, so it stays
+            // out of `params` for the index arithmetic in `gen_rest_setup` to line up.
+            if is_rest_args_type(&pat_ty.ty) {
+                parsed.rest = type_arg(&pat_ty.ty, "RestArgs", 0)
+                    .map(|inner| (pat_ident.ident.clone(), inner.clone()));
+                continue;
+            }
+            parsed
+                .params
+                .push((pat_ident.ident.clone(), (*pat_ty.ty).clone()));
+        }
+        parsed
+    }
+
+    /// The arguments a trampoline passes to the Rust fn after its receiver: `scope` and `args`
+    /// for a raw fn, and otherwise `scope` if the fn takes one, then the converted parameters and
+    /// the variadic tail.
+    fn forwarded_args(
+        &self,
+        scope: proc_macro2::TokenStream,
+        args: proc_macro2::TokenStream,
+    ) -> Vec<proc_macro2::TokenStream> {
+        if self.is_raw {
+            return vec![scope, args];
+        }
+        let names = self.params.iter().map(|(name, _)| name);
+        let names = names.chain(self.rest.as_ref().map(|(name, _)| name));
+        self.has_cx
+            .then_some(scope)
+            .into_iter()
+            .chain(names.map(|name| quote!(#name)))
+            .collect()
+    }
+}
+
 /// Info about a parsed method.
 struct MethodInfo {
     kind: MethodKind,
     fn_item: ImplItemFn,
-    /// Parameter names and types (excluding self/cx/args)
-    params: Vec<(Ident, Type)>,
+    inputs: Inputs,
     /// Number of required arguments: the explicit `length = N` override when
     /// given, otherwise the count of non-`Option` (and non-`RestArgs`) params.
     /// This is both the JS-visible `.length` and the threshold at and beyond
@@ -873,16 +935,6 @@ struct MethodInfo {
     has_self: bool,
     /// Whether the method takes &mut self
     has_mut_self: bool,
-    /// Whether the method takes cx: &mut JSContext
-    has_cx: bool,
-    /// Whether the method has raw cx/args params for low-level access
-    is_raw: bool,
-    /// Whether the method has a variadic rest parameter (last param)
-    has_rest_args: bool,
-    /// Name of the rest parameter, if any
-    rest_arg_name: Option<Ident>,
-    /// Inner type of RestArgs<T>, or None for bare RestArgs (defaults to Value)
-    rest_inner_type: Option<Type>,
 }
 
 /// Attribute macro for an `impl` block that generates JSNative wrappers.
@@ -1035,15 +1087,12 @@ fn process_methods(_attr: TokenStream, item: TokenStream, config: ClassConfig) -
                     continue;
                 }
 
-                let const_name = const_item.ident.to_string();
-                let const_name_bytes = format!("{const_name}\0");
-                let const_name_cstr =
-                    proc_macro2::Literal::byte_string(const_name_bytes.as_bytes());
+                let const_name_cstr = cstr_literal(&const_item.ident.to_string());
                 let const_ident = &const_item.ident;
 
                 constant_builder_calls.push(quote! {
                     .constant(
-                        unsafe { ::std::ffi::CStr::from_bytes_with_nul_unchecked(#const_name_cstr) },
+                        #const_name_cstr,
                         #inner_name::#const_ident as i32,
                     )
                 });
@@ -1237,9 +1286,9 @@ fn process_methods(_attr: TokenStream, item: TokenStream, config: ClassConfig) -
             MethodKind::Constructor if Some(i) == js_ctor_index => {
                 if method.has_self || method.has_mut_self {
                     // Setup-style: constructor runs on the stack newtype after
-                    // allocation. ConstructorRegistrar returns FooImpl::default(),
-                    // and PostInitRegistrar handles arg extraction + calling
-                    // the user's constructor body.
+                    // allocation. ConstructorRegistrar returns FooImpl::default().
+                    // PostInitRegistrar extracts the arguments and calls the
+                    // user's constructor body.
                     setup_ctor_info = Some(i);
                 } else {
                     // Old-style: constructor returns Self directly.
@@ -1325,11 +1374,13 @@ fn process_methods(_attr: TokenStream, item: TokenStream, config: ClassConfig) -
             None => quote! { None },
         };
 
+        let flags = u8::try_from(config.method_flags).expect("accessor flags fit in a `u8`");
         builder_calls.push(quote! {
             .property(
                 #js_name_cstr_lit,
                 #getter,
                 #setter,
+                #flags,
             )
         });
     }
@@ -1507,14 +1558,15 @@ fn process_methods(_attr: TokenStream, item: TokenStream, config: ClassConfig) -
     let post_init_impl = if let Some(idx) = setup_ctor_info {
         let info = &methods[idx];
         let setup_fn_name = setup_fn_ident(&info.fn_item.sig.ident);
-        let arg_extractions =
-            gen_arg_extractions(&info.params, quote!(args), true, quote!(scope), info.nargs);
-        let arg_names: Vec<_> = info.params.iter().map(|(name, _)| quote!(#name)).collect();
-        let call = if info.has_cx {
-            quote! { #type_name::#setup_fn_name(&__typed, scope, #(#arg_names),*) }
-        } else {
-            quote! { #type_name::#setup_fn_name(&__typed, #(#arg_names),*) }
-        };
+        let arg_extractions = gen_arg_extractions(
+            &info.inputs.params,
+            quote!(args),
+            true,
+            quote!(scope),
+            info.nargs,
+        );
+        let args = info.inputs.forwarded_args(quote!(scope), quote!(args));
+        let call = quote! { #type_name::#setup_fn_name(&__typed, #(#args),*) };
         quote! {
             #[allow(clippy::not_unsafe_ptr_arg_deref)]
             impl ::js::class::__PostInitRegistrar<#inner_name> for ::js::class::__PostInitReg<#inner_name> {
@@ -1541,9 +1593,10 @@ fn process_methods(_attr: TokenStream, item: TokenStream, config: ClassConfig) -
         /// If the class is marked as hidden `#[{jsclass,webidl_interface}(hidden)]`, the
         /// constructor isn't installed on the global object, so it is not visible to content.
         pub fn add_to_global<'scope>(scope: &'scope ::js::gc::scope::Scope<'_>, global: ::js::Object<'scope>) {
-            unsafe { ::js::class::register_class::<#inner_name>(scope, global); }
             if <#inner_name as ::js::class::ClassDef>::HIDDEN {
-                global.delete_property(scope, <#inner_name as ::js::class::ClassDef>::NAME_CSTR).expect("delete_property failed");
+                unsafe { ::js::class::register_hidden_class::<#inner_name>(scope); }
+            } else {
+                unsafe { ::js::class::register_class::<#inner_name>(scope, global); }
             }
         }
     };
@@ -1554,7 +1607,7 @@ fn process_methods(_attr: TokenStream, item: TokenStream, config: ClassConfig) -
         let method = &methods[*i];
         if method.has_self || method.has_mut_self {
             ctor_items.push(gen_setup_factory(method, &type_name, &inner_name));
-        } else if !method.is_raw {
+        } else if !method.inputs.is_raw {
             // A raw (`&CallArgs`) constructor is callable only from a JSNative
             // wrapper, so it gets no Rust-side factory.
             ctor_items.push(gen_instance_factory(
@@ -1574,67 +1627,64 @@ fn process_methods(_attr: TokenStream, item: TokenStream, config: ClassConfig) -
     };
 
     // Generate forwarding methods on Foo<'s> for InstanceValue methods
-    // (which stay on FooImpl). All other instance methods are now directly
+    // (which stay on FooImpl). All other instance methods are directly
     // on the newtype via `newtype_items`.
     let mut forwarding_methods: Vec<proc_macro2::TokenStream> = Vec::new();
 
     for method in &methods {
-        match &method.kind {
-            MethodKind::Method { .. }
-                if matches!(method.return_style, ReturnStyle::InstanceValue) =>
-            {
-                if !method.has_self && !method.has_mut_self {
-                    continue;
-                }
-
-                let fn_name = &method.fn_item.sig.ident;
-                let fn_generics = &method.fn_item.sig.generics;
-                let param_decls: Vec<_> = method
-                    .params
-                    .iter()
-                    .map(|(name, ty)| quote! { #name: #ty })
-                    .collect();
-                let param_names: Vec<_> = method
-                    .params
-                    .iter()
-                    .map(|(name, _)| quote! { #name })
-                    .collect();
+        if !matches!(method.kind, MethodKind::Method { .. })
+            || !matches!(method.return_style, ReturnStyle::InstanceValue)
+            || !(method.has_self || method.has_mut_self)
+        {
+            continue;
+        }
+        let fn_name = &method.fn_item.sig.ident;
+        let fn_generics = &method.fn_item.sig.generics;
+        let param_decls: Vec<_> = method
+            .inputs
+            .params
+            .iter()
+            .map(|(name, ty)| quote! { #name: #ty })
+            .collect();
+        let param_names: Vec<_> = method
+            .inputs
+            .params
+            .iter()
+            .map(|(name, _)| quote! { #name })
+            .collect();
 
-                // `data()`/`data_mut()` return borrow guards; reborrow through
-                // them when passing the receiver to the inner method.
-                let (get_inner, inner_arg) = if method.has_mut_self {
-                    (
-                        quote! { let mut inner = self.data_mut(); },
-                        quote! { &mut *inner },
-                    )
-                } else {
-                    (quote! { let inner = self.data(); }, quote! { &*inner })
-                };
+        // `data()`/`data_mut()` return borrow guards. The receiver passed to
+        // the inner method is reborrowed through them.
+        let (get_inner, inner_arg) = if method.has_mut_self {
+            (
+                quote! { let mut inner = self.data_mut(); },
+                quote! { &mut *inner },
+            )
+        } else {
+            (quote! { let inner = self.data(); }, quote! { &*inner })
+        };
 
-                // InstanceValue: always needs a scope to create the JS object.
-                let cx_param = quote! { scope: &'s ::js::gc::scope::Scope<'_>, };
-                let cx_arg = if method.has_cx {
-                    quote! { scope, }
-                } else {
-                    quote! {}
-                };
+        // InstanceValue: always needs a scope to create the JS object.
+        let cx_param = quote! { scope: &'s ::js::gc::scope::Scope<'_>, };
+        let cx_arg = if method.inputs.has_cx {
+            quote! { scope, }
+        } else {
+            quote! {}
+        };
 
-                forwarding_methods.push(quote! {
-                    pub fn #fn_name #fn_generics (&self, #cx_param #(#param_decls),*)
-                        -> ::std::result::Result<#type_name<'s>, ::js::error::ExnThrown>
-                    {
-                        #get_inner
-                        unsafe {
-                            let __typed = ::js::class::create_instance_with::<#inner_name>(scope, |_| {
-                                #inner_name::#fn_name(#inner_arg, #cx_arg #(#param_names),*)
-                            })?;
-                            Ok(__typed)
-                        }
-                    }
-                });
+        forwarding_methods.push(quote! {
+            pub fn #fn_name #fn_generics (&self, #cx_param #(#param_decls),*)
+                -> ::std::result::Result<#type_name<'s>, ::js::error::ExnThrown>
+            {
+                #get_inner
+                unsafe {
+                    let __typed = ::js::class::create_instance_with::<#inner_name>(scope, |_| {
+                        #inner_name::#fn_name(#inner_arg, #cx_arg #(#param_names),*)
+                    })?;
+                    Ok(__typed)
+                }
             }
-            _ => continue,
-        }
+        });
     }
 
     // Generate the UnforgeableRegistrar impl when the interface has
@@ -1646,13 +1696,12 @@ fn process_methods(_attr: TokenStream, item: TokenStream, config: ClassConfig) -
         let installs: Vec<_> = unforgeable_getters
             .iter()
             .map(|(js_name, native_name)| {
-                let name_bytes = format!("{js_name}\0");
-                let name_cstr = proc_macro2::Literal::byte_string(name_bytes.as_bytes());
+                let name_cstr = cstr_literal(js_name);
                 quote! {
                     ::js::class::define_unforgeable_accessor(
                         scope,
                         obj,
-                        unsafe { ::std::ffi::CStr::from_bytes_with_nul_unchecked(#name_cstr) },
+                        #name_cstr,
                         Some(#native_name),
                     )?;
                 }
@@ -1688,12 +1737,6 @@ fn process_methods(_attr: TokenStream, item: TokenStream, config: ClassConfig) -
                 #(#forwarding_methods)*
             }
         }
-    } else if !forwarding_methods.is_empty() {
-        quote! {
-            impl<'s> #type_name<'s> {
-                #(#forwarding_methods)*
-            }
-        }
     } else {
         quote! {}
     };
@@ -1748,62 +1791,21 @@ fn parse_method_info(
 ) -> MethodInfo {
     let method_name = unraw(&fn_item.sig.ident);
 
-    // Determine self receiver
-    let has_self = fn_item
-        .sig
-        .inputs
-        .first()
-        .map(|a| matches!(a, FnArg::Receiver(r) if r.mutability.is_none()))
-        .unwrap_or(false);
-    let has_mut_self = fn_item
-        .sig
-        .inputs
-        .first()
-        .map(|a| matches!(a, FnArg::Receiver(r) if r.mutability.is_some()))
-        .unwrap_or(false);
-
-    // Collect non-self parameters, detecting cx and raw params
-    let mut params = Vec::new();
-    let mut required_args = 0;
-    let mut has_cx = false;
-    let mut is_raw = false;
-    let mut has_rest_args = false;
-    let mut rest_arg_name = None;
-    let mut rest_inner_type = None;
-    let skip_first = if has_self || has_mut_self { 1 } else { 0 };
-
-    for arg in fn_item.sig.inputs.iter().skip(skip_first) {
-        if let FnArg::Typed(pat_ty) = arg {
-            if is_cx_param_type(&pat_ty.ty) {
-                has_cx = true;
-                continue;
-            }
-            if is_callargs_param_type(&pat_ty.ty) {
-                is_raw = true;
-                continue;
-            }
-            // Check for RestArgs marker type
-            if is_rest_args_type(&pat_ty.ty) {
-                if let Pat::Ident(pat_ident) = pat_ty.pat.as_ref() {
-                    has_rest_args = true;
-                    rest_arg_name = Some(pat_ident.ident.clone());
-                    rest_inner_type = extract_rest_args_inner_type(&pat_ty.ty);
-                }
-                continue;
-            }
-            if let Pat::Ident(pat_ident) = pat_ty.pat.as_ref() {
-                params.push((pat_ident.ident.clone(), (*pat_ty.ty).clone()));
-                if !is_option_type(&pat_ty.ty) {
-                    required_args += 1;
-                }
-            }
-        }
-    }
+    let receiver_mutable = match fn_item.sig.inputs.first() {
+        Some(FnArg::Receiver(receiver)) => Some(receiver.mutability.is_some()),
+        _ => None,
+    };
+    let inputs = Inputs::parse(&fn_item.sig.inputs);
+    let required_args = required_arg_count(&inputs.params);
 
     // Determine return style
     let is_constructor = matches!(kind, MethodKind::Constructor);
-    let return_style =
-        classify_return_style(&fn_item.sig.output, Some(type_name), is_constructor, is_raw);
+    let return_style = classify_return_style(
+        &fn_item.sig.output,
+        Some(type_name),
+        is_constructor,
+        inputs.is_raw,
+    );
 
     // Compute JS name: custom name overrides, otherwise default to camelCase.
     // For setters, derive the property name by stripping "set_" prefix.
@@ -1817,34 +1819,21 @@ fn parse_method_info(
     });
 
     match &mut kind {
-        MethodKind::Method { js_name: n } => {
-            *n = js_name;
-        }
-        MethodKind::StaticMethod { js_name: n } => {
-            *n = js_name;
-        }
-        MethodKind::Getter { js_name: n, .. } => {
-            *n = js_name;
-        }
-        MethodKind::Setter { js_name: n } => {
-            *n = js_name;
-        }
-        _ => {}
+        MethodKind::Method { js_name: n }
+        | MethodKind::StaticMethod { js_name: n }
+        | MethodKind::Getter { js_name: n, .. }
+        | MethodKind::Setter { js_name: n } => *n = js_name,
+        MethodKind::Constructor | MethodKind::Destructor => {}
     }
 
     MethodInfo {
         kind,
         fn_item,
-        params,
-        nargs: custom_nargs.unwrap_or(required_args) as u32,
+        inputs,
+        nargs: custom_nargs.map_or(required_args, |n| n as u32),
         return_style,
-        has_self,
-        has_mut_self,
-        has_cx,
-        is_raw,
-        has_rest_args,
-        rest_arg_name,
-        rest_inner_type,
+        has_self: receiver_mutable == Some(false),
+        has_mut_self: receiver_mutable == Some(true),
     }
 }
 
@@ -1870,10 +1859,7 @@ fn is_method_on_newtype(method: &MethodInfo) -> bool {
     // Methods named data/data_mut would conflict with the generated accessors
     // on the newtype.
     let name = method.fn_item.sig.ident.to_string();
-    if matches!(name.as_str(), "data" | "data_mut") {
-        return false;
-    }
-    true
+    !matches!(name.as_str(), "data" | "data_mut")
 }
 
 fn last_segment_is(ty: &Type, name: &str) -> bool {
@@ -1911,51 +1897,17 @@ fn is_rest_args_type(ty: &Type) -> bool {
         || s.contains("::RestArgs<")
 }
 
-/// Extract the inner type from `RestArgs<T>`. Returns `None` for a bare
-/// `RestArgs`.
-fn extract_rest_args_inner_type(ty: &Type) -> Option<Type> {
-    if let Type::Path(type_path) = ty {
-        let last_seg = type_path.path.segments.last()?;
-        let ident = last_seg.ident.to_string();
-        if ident == "RestArgs" {
-            if let syn::PathArguments::AngleBracketed(args) = &last_seg.arguments {
-                if let Some(syn::GenericArgument::Type(inner)) = args.args.first() {
-                    return Some(inner.clone());
-                }
-            }
-        }
-    }
-    None
-}
-
-/// The element type a `RestArgs<T>` collects into.
-///
-/// [`rewrite_rest_args_in_sig`] rejects both a bare `RestArgs` and an owned
-/// `Value` element before any codegen runs, so every callable that reaches this
-/// point declared a usable element type. A `None` here would mean that check was
-/// bypassed, which is a bug in this macro rather than in the user's code.
-/// (Changing the callsites to unwrap the `Option` would create more noise than
-/// it's worth, so an unwrap here it is.)
-fn rest_args_element_type(declared: Option<&Type>) -> Type {
-    declared
-        .cloned()
-        .expect("bare `RestArgs` must be rejected by `rewrite_rest_args_in_sig` before codegen")
-}
-
 /// Rewrite every `RestArgs<T>` parameter in `sig` to the fully-qualified
 /// `::js::class::RestArgs<T>`, and reject the element types that can't work:
 /// a missing one (bare `RestArgs`) and the GC-unsafe owned `Value`.
 ///
-/// Shared by `#[jsmethods]` and by the `mod`-block macros (`#[jsmodule]`,
-/// `#[jsglobals]`, `#[jsnamespace]`, `#[webidl_namespace]`).
-///
 /// Errors are spanned on the name of the function or method whose signature this
 /// is, because the parameter type itself has usually already been replaced by
 /// the time a caller reports one.
 fn rewrite_rest_args_in_sig(sig: &mut syn::Signature, name: &Ident) -> syn::Result<()> {
     let declared = sig.inputs.iter().find_map(|arg| match arg {
         FnArg::Typed(pat_ty) if is_rest_args_type(&pat_ty.ty) => {
-            Some(extract_rest_args_inner_type(&pat_ty.ty))
+            Some(type_arg(&pat_ty.ty, "RestArgs", 0).cloned())
         }
         _ => None,
     });
@@ -2005,34 +1957,23 @@ fn rewrite_rest_args_in_sig(sig: &mut syn::Signature, name: &Ident) -> syn::Resu
     Ok(())
 }
 
-/// Emit the statement that collects a variadic tail into the `RestArgs<T>` bound
-/// to `rest_name`, converting each argument from index `start_idx` onwards with
-/// `FromJSVal`. Returns an empty token stream when the callable doesn't use rest
-/// args.
-///
-/// Takes the same context parameters as [`gen_arg_extractions`], and with the
-/// same meaning: a JSNative trampoline names its argument vector `__args` and
-/// owns its `scope`, while a constructor registrar names it `args` and receives
-/// `scope` by reference; `use_question_mark` picks the early return that
-/// context needs (`Err(ExnThrown)` for the registrar, whose body is a `Result`,
-/// versus `false` for the trampoline, which returns `bool` to SpiderMonkey).
+/// Emit the statement that collects the variadic tail of `inputs` into its `RestArgs<T>`,
+/// converting each argument after the fixed parameters with `FromJSVal`. Returns an empty token
+/// stream when there is no tail. The other parameters are as for [`gen_arg_extractions`].
 fn gen_rest_setup(
-    rest_name: Option<&Ident>,
-    rest_inner_type: Option<&Type>,
-    start_idx: usize,
+    inputs: &Inputs,
     args_expr: &proc_macro2::TokenStream,
     use_question_mark: bool,
     scope_expr: &proc_macro2::TokenStream,
 ) -> proc_macro2::TokenStream {
-    let Some(rest_name) = rest_name else {
+    let Some((rest_name, inner_ty)) = &inputs.rest else {
         return quote! {};
     };
-    let start_idx = start_idx as u32;
-    let inner_ty = rest_args_element_type(rest_inner_type);
+    let start_idx = inputs.params.len() as u32;
     // Integer element types (and integer-element containers) convert with
     // `ConversionBehavior`, everything else uses `()`. Mirrors the config
     // selection in `gen_arg_extractions` for ordinary parameters.
-    let rest_config = if is_integer_type(&inner_ty) || is_int_container_type(&inner_ty) {
+    let rest_config = if is_integer_type(inner_ty) || is_int_container_type(inner_ty) {
         quote! { ::js::conversion::ConversionBehavior::Default }
     } else {
         quote! { () }
@@ -2071,7 +2012,6 @@ fn gen_rest_setup(
     }
 }
 
-/// Walk a `UseTree` to find the leaf `Ident` (e.g., `super::Vec2` → `Vec2`).
 /// Collect the class identifiers a `pub use` brings into scope, for
 /// registration on the global. `use A`, `use path::A`, `use path::A as B`
 /// (registers the alias `B`, which is what's in scope), and `use path::{A, B}`
@@ -2274,86 +2214,58 @@ fn is_integer_type(ty: &Type) -> bool {
     )
 }
 
-/// Whether a type is a primitive WebIDL type whose `null` value should be
-/// converted through the normal path rather than treated as absent.
-/// Detect `Vec<T>` types (WebIDL sequence parameters).
-fn is_vec_type(ty: &Type) -> bool {
-    if let Type::Path(tp) = ty {
-        if let Some(seg) = tp.path.segments.last() {
-            return seg.ident == "Vec"
-                && matches!(seg.arguments, syn::PathArguments::AngleBracketed(_));
-        }
-    }
-    false
-}
-
-/// Extract the inner type from `Vec<T>`.
-fn extract_vec_inner_type(ty: &Type) -> Option<Type> {
-    if let Type::Path(type_path) = ty {
-        let last_seg = type_path.path.segments.last()?;
-        if last_seg.ident == "Vec" {
-            if let syn::PathArguments::AngleBracketed(args) = &last_seg.arguments {
-                if let Some(syn::GenericArgument::Type(inner)) = args.args.first() {
-                    return Some(inner.clone());
-                }
-            }
-        }
-    }
-    None
-}
-
-/// Detect `Record<K, V>` types (WebIDL record parameters).
-fn is_record_type(ty: &Type) -> bool {
-    if let Type::Path(tp) = ty {
-        if let Some(seg) = tp.path.segments.last() {
-            return seg.ident == "Record"
-                && matches!(seg.arguments, syn::PathArguments::AngleBracketed(_));
-        }
+/// The generic arguments of `ty` when its last path segment is `name` with angle-bracketed
+/// arguments.
+fn generic_args<'a>(
+    ty: &'a Type,
+    name: &str,
+) -> Option<&'a syn::punctuated::Punctuated<syn::GenericArgument, Token![,]>> {
+    let Type::Path(tp) = ty else {
+        return None;
+    };
+    let seg = tp.path.segments.last()?;
+    match &seg.arguments {
+        syn::PathArguments::AngleBracketed(args) if seg.ident == name => Some(&args.args),
+        _ => None,
     }
-    false
 }
 
-/// Extract the value type from `Record<K, V>` (the last type argument).
-fn extract_record_inner_type(ty: &Type) -> Option<Type> {
-    if let Type::Path(type_path) = ty {
-        let last_seg = type_path.path.segments.last()?;
-        if last_seg.ident == "Record" {
-            if let syn::PathArguments::AngleBracketed(args) = &last_seg.arguments {
-                return args.args.iter().rev().find_map(|arg| match arg {
-                    syn::GenericArgument::Type(inner) => Some(inner.clone()),
-                    _ => None,
-                });
-            }
-        }
+/// The generic argument at `index` of the `name` type `ty`, if it is a type.
+fn type_arg<'a>(ty: &'a Type, name: &str, index: usize) -> Option<&'a Type> {
+    match generic_args(ty, name)?.iter().nth(index)? {
+        syn::GenericArgument::Type(inner) => Some(inner),
+        _ => None,
     }
-    None
 }
 
-/// Check whether a container type (`Vec<T>` or `Record<T>`) has an integer
+/// Check whether a container type (`Vec<T>` or `Record<K, V>`) has an integer
 /// inner type, requiring `ConversionBehavior` config instead of `()`.
 fn is_int_container_type(ty: &Type) -> bool {
-    if is_vec_type(ty) {
-        extract_vec_inner_type(ty).is_some_and(|inner| is_integer_type(&inner))
-    } else if is_record_type(ty) {
-        extract_record_inner_type(ty).is_some_and(|inner| is_integer_type(&inner))
-    } else {
-        false
-    }
+    let record_value = || {
+        generic_args(ty, "Record")?
+            .iter()
+            .rev()
+            .find_map(|arg| match arg {
+                syn::GenericArgument::Type(inner) => Some(inner),
+                _ => None,
+            })
+    };
+    type_arg(ty, "Vec", 0)
+        .or_else(record_value)
+        .is_some_and(is_integer_type)
 }
 
 /// Detect `Option<T>` types for optional parameter handling.
 fn is_option_type(ty: &Type) -> bool {
-    if let Type::Path(tp) = ty {
-        if let Some(seg) = tp.path.segments.last() {
-            return seg.ident == "Option"
-                && matches!(seg.arguments, syn::PathArguments::AngleBracketed(_));
-        }
-    }
-    false
+    generic_args(ty, "Option").is_some()
+}
+
+/// Extract the inner type from `Option<T>`.
+fn extract_option_inner_type(ty: &Type) -> Option<&Type> {
+    type_arg(ty, "Option", 0)
 }
 
-/// JS-visible `.length` for a free function exported by `#[jsmodule]`,
-/// `#[jsglobals]`, `#[webidl_methods]`, or a namespace: the number of required arguments, i.e.
+/// JS-visible `.length` for a callable: the number of required arguments, i.e.
 /// parameters that aren't `Option<T>`.
 fn required_arg_count(params: &[(Ident, Type)]) -> u32 {
     params.iter().filter(|(_, ty)| !is_option_type(ty)).count() as u32
@@ -2373,55 +2285,17 @@ fn is_any_value_type(ty: &Type) -> bool {
 
 /// Check whether a type is a none-optional `Heap<T>`.
 fn is_bare_heap_type(ty: &Type) -> bool {
-    if let Type::Path(tp) = ty {
-        // Only match single-segment `Heap<T>` (our js::gc::handle::Heap),
-        // not multi-segment paths like `js::gc::handle::MozHeap<Value>` (mozjs Heap).
-        if tp.path.segments.len() == 1 {
-            if let Some(seg) = tp.path.segments.last() {
-                return seg.ident == "Heap"
-                    && matches!(seg.arguments, syn::PathArguments::AngleBracketed(_));
-            }
-        }
-    }
-    false
-}
-
-/// Extract the inner type from `Option<T>`.
-fn extract_option_inner_type(ty: &Type) -> Option<Type> {
-    if let Type::Path(type_path) = ty {
-        let last_seg = type_path.path.segments.last()?;
-        if last_seg.ident == "Option" {
-            if let syn::PathArguments::AngleBracketed(args) = &last_seg.arguments {
-                if let Some(syn::GenericArgument::Type(inner)) = args.args.first() {
-                    return Some(inner.clone());
-                }
-            }
-        }
-    }
-    None
+    // Only match single-segment `Heap<T>` (our js::gc::handle::Heap),
+    // not multi-segment paths like `js::gc::handle::MozHeap<Value>` (mozjs Heap).
+    matches!(ty, Type::Path(tp) if tp.path.segments.len() == 1)
+        && generic_args(ty, "Heap").is_some()
 }
 
-/// Extract the error type `E` from a `Result<T, E>` return type.
-fn extract_result_error_type(output: &ReturnType) -> Option<Type> {
-    if let ReturnType::Type(_, ty) = output {
-        if let Type::Path(tp) = ty.as_ref() {
-            if let Some(seg) = tp.path.segments.last() {
-                if seg.ident == "Result" {
-                    if let syn::PathArguments::AngleBracketed(args) = &seg.arguments {
-                        if let Some(syn::GenericArgument::Type(err_ty)) = args.args.iter().nth(1) {
-                            return Some(err_ty.clone());
-                        }
-                    }
-                }
-            }
-        }
-    }
-    None
+/// Whether a return type is a `Result<T, E>`.
+fn returns_result(output: &ReturnType) -> bool {
+    matches!(output, ReturnType::Type(_, ty) if type_arg(ty, "Result", 1).is_some())
 }
 
-/// Detect stack newtype types like `Item<'_>` or `Item<'s>`.
-///
-/// Stack newtypes are generated by `#[jsclass]` and always carry a single
 /// Check if a type string is exactly `Result < () , ::js::error::ExnThrown >`
 fn is_result_unit_jserror(ty_str: &str) -> bool {
     let normalized: String = ty_str.chars().filter(|c| !c.is_whitespace()).collect();
@@ -2593,7 +2467,7 @@ fn gen_arg_extractions(
             let optional = is_option_type(ty);
             let inner =
                 optional.then(|| extract_option_inner_type(ty).expect("Option<T> has an inner type"));
-            let declared = inner.as_ref().unwrap_or(ty);
+            let declared = inner.unwrap_or(ty);
             let borrow = BorrowedParam::of(declared);
             let convert_ty = borrow.as_ref().map_or(declared, |b| &b.convert_ty);
             let hidden = format_ident!("__arg_owned_{}", idx);
@@ -2720,46 +2594,8 @@ fn gen_typed_arg_getter(
     }
 }
 
-/// The declarations and names of a constructor's parameters, with a trailing
-/// `RestArgs<T>` appended when the constructor is variadic.
-fn ctor_param_lists(
-    info: &MethodInfo,
-) -> (Vec<proc_macro2::TokenStream>, Vec<proc_macro2::TokenStream>) {
-    let mut decls: Vec<_> = info
-        .params
-        .iter()
-        .map(|(name, ty)| quote! { #name: #ty })
-        .collect();
-    let mut names: Vec<_> = info
-        .params
-        .iter()
-        .map(|(name, _)| quote! { #name })
-        .collect();
-    if let Some(rest_name) = info.rest_arg_name.as_ref() {
-        let inner_ty = rest_args_element_type(info.rest_inner_type.as_ref());
-        decls.push(quote! { #rest_name: ::js::class::RestArgs<#inner_ty> });
-        names.push(quote! { #rest_name });
-    }
-    (decls, names)
-}
-
-/// The call to an old-style constructor fn on the inner data struct, which
-/// yields the `FooImpl` value to wrap in a fresh JS object.
-fn ctor_call(
-    info: &MethodInfo,
-    inner_name: &Ident,
-    param_names: &[proc_macro2::TokenStream],
-) -> proc_macro2::TokenStream {
-    let ctor_fn = &info.fn_item.sig.ident;
-    if info.has_cx {
-        quote! { #inner_name::#ctor_fn(scope, #(#param_names),*) }
-    } else {
-        quote! { #inner_name::#ctor_fn(#(#param_names),*) }
-    }
-}
-
-/// The `__ctor_setup_*` name a setup-style constructor's body is moved to on
-/// the stack newtype.
+/// The name of the `__ctor_setup_*` method on the stack newtype that a
+/// setup-style constructor's body is moved into.
 fn setup_fn_ident(ident: &Ident) -> Ident {
     format_ident!("__ctor_setup_{}", unraw(ident))
 }
@@ -2776,33 +2612,20 @@ fn gen_setup_factory(
     let factory_name = &info.fn_item.sig.ident;
     let setup_ident = setup_fn_ident(factory_name);
     let param_decls: Vec<_> = info
+        .inputs
         .params
         .iter()
         .map(|(name, ty)| quote! { #name: #ty })
         .collect();
-    let param_names: Vec<_> = info
-        .params
-        .iter()
-        .map(|(name, _)| quote! { #name })
-        .collect();
+    let args = info.inputs.forwarded_args(quote!(scope), quote!(args));
+    let call = quote! { #type_name::#setup_ident(&__typed, #(#args),*) };
 
     // Always returns Result<Foo<'s>, ExnThrown> because create_instance_with
     // allocates a JS object, which is fallible.
-    let err_ty = extract_result_error_type(&info.fn_item.sig.output);
-    let setup_call = if err_ty.is_some() {
-        if info.has_cx {
-            quote! { #type_name::#setup_ident(&__typed, scope, #(#param_names),*).map_err(|e| {
-                ::js::error::ThrowException::throw(e, scope)
-            })?; }
-        } else {
-            quote! { #type_name::#setup_ident(&__typed, #(#param_names),*).map_err(|e| {
-                ::js::error::ThrowException::throw(e, scope)
-            })?; }
-        }
-    } else if info.has_cx {
-        quote! { #type_name::#setup_ident(&__typed, scope, #(#param_names),*); }
+    let setup_call = if returns_result(&info.fn_item.sig.output) {
+        quote! { #call.map_err(|e| ::js::error::ThrowException::throw(e, scope))?; }
     } else {
-        quote! { #type_name::#setup_ident(&__typed, #(#param_names),*); }
+        quote! { #call; }
     };
 
     // Extract the constructor body and rename it.
@@ -2844,9 +2667,21 @@ fn gen_instance_factory(
     type_name: &Ident,
     inner_name: &Ident,
 ) -> proc_macro2::TokenStream {
-    let (param_decls, param_names) = ctor_param_lists(info);
-    let call = ctor_call(info, inner_name, &param_names);
-    let create = if extract_result_error_type(&info.fn_item.sig.output).is_some() {
+    let param_decls = info
+        .inputs
+        .params
+        .iter()
+        .map(|(name, ty)| quote! { #name: #ty })
+        .chain(
+            info.inputs
+                .rest
+                .iter()
+                .map(|(name, ty)| quote! { #name: ::js::class::RestArgs<#ty> }),
+        );
+    let ctor_fn = &info.fn_item.sig.ident;
+    let args = info.inputs.forwarded_args(quote!(scope), quote!(args));
+    let call = quote! { #inner_name::#ctor_fn(#(#args),*) };
+    let create = if returns_result(&info.fn_item.sig.output) {
         quote! {
             ::js::class::try_create_instance_with::<#inner_name>(scope, |_| {
                 #call.map_err(|e| ::js::error::ThrowException::throw(e, scope))
@@ -2879,31 +2714,16 @@ fn gen_instance_factory(
 /// Generate the constructor body that extracts args and calls the Rust constructor fn.
 fn gen_constructor_body(info: &MethodInfo, type_name: &Ident) -> proc_macro2::TokenStream {
     let ctor_fn = &info.fn_item.sig.ident;
-    let arg_extractions =
-        gen_arg_extractions(&info.params, quote!(args), true, quote!(scope), info.nargs);
-    let mut arg_names: Vec<_> = info.params.iter().map(|(name, _)| quote!(#name)).collect();
-
-    let rest_setup = gen_rest_setup(
-        info.rest_arg_name.as_ref(),
-        info.rest_inner_type.as_ref(),
-        info.params.len(),
-        &quote!(args),
+    let arg_extractions = gen_arg_extractions(
+        &info.inputs.params,
+        quote!(args),
         true,
-        &quote!(scope),
+        quote!(scope),
+        info.nargs,
     );
-    if let Some(rest_name) = info.rest_arg_name.as_ref() {
-        arg_names.push(quote!(#rest_name));
-    }
-
-    // Build the constructor call, passing scope and/or args if the Rust
-    // constructor requested them via `scope: &Scope<'_>` or `args: &CallArgs`.
-    let call = if info.is_raw {
-        quote! { #type_name::#ctor_fn(scope, args) }
-    } else if info.has_cx {
-        quote! { #type_name::#ctor_fn(scope, #(#arg_names),*) }
-    } else {
-        quote! { #type_name::#ctor_fn(#(#arg_names),*) }
-    };
+    let rest_setup = gen_rest_setup(&info.inputs, &quote!(args), true, &quote!(scope));
+    let args = info.inputs.forwarded_args(quote!(scope), quote!(args));
+    let call = quote! { #type_name::#ctor_fn(#(#args),*) };
 
     // Constructors returning `Result<Self, E>` need error conversion:
     // the error is thrown as a JS exception via `ThrowException`.
@@ -2928,11 +2748,6 @@ fn gen_constructor_body(info: &MethodInfo, type_name: &Ident) -> proc_macro2::To
     }
 }
 
-/// Generate a JSNative wrapper function and the corresponding ClassBuilder call.
-///
-/// When `on_newtype` is true, the method lives on the stack newtype `Foo<'s>`.
-/// The wrapper extracts `this` as the rooted newtype and calls the method
-/// via method-call syntax.
 /// Emit the complete JSNative trampoline (`extern "C" fn`) for a callable: a
 /// method, a static method, or a free function exposed by a module, the global,
 /// or a namespace. This is the single place where argument extraction, return-
@@ -2947,9 +2762,7 @@ fn gen_constructor_body(info: &MethodInfo, type_name: &Ident) -> proc_macro2::To
 /// - `this_extraction` runs before the body for receiver-taking callables (empty
 ///   for free functions, and for `ResultPromise` where it moves into the closure).
 /// - `this_in_closure` is the `?`-style receiver extraction for `ResultPromise`.
-/// - `rest_arg` names the variadic tail's parameter and element type, if there is
-///   one. The collection is emitted here rather than by the caller so that it
-///   lands in the same place as the fixed-argument extractions.
+/// - `inputs` are the parameters to convert, including the variadic tail.
 /// - `instance_type` is the class to mint for `InstanceValue`; `None` for free
 ///   functions, which `classify_return_style` never classifies as `InstanceValue`.
 #[allow(clippy::too_many_arguments)]
@@ -2957,23 +2770,16 @@ fn emit_native_fn(
     native_name: &Ident,
     name_str: &str,
     return_style: &ReturnStyle,
-    params: &[(Ident, Type)],
+    inputs: &Inputs,
     nargs: u32,
     call: &proc_macro2::TokenStream,
     this_extraction: &proc_macro2::TokenStream,
     this_in_closure: &proc_macro2::TokenStream,
-    rest_arg: Option<(&Ident, Option<&Type>)>,
     instance_type: Option<&Ident>,
 ) -> proc_macro2::TokenStream {
+    let params = &inputs.params;
     let gen_rest = |use_question_mark: bool| {
-        gen_rest_setup(
-            rest_arg.map(|(name, _)| name),
-            rest_arg.and_then(|(_, ty)| ty),
-            params.len(),
-            &quote!(__args),
-            use_question_mark,
-            &quote!(&scope),
-        )
+        gen_rest_setup(inputs, &quote!(__args), use_question_mark, &quote!(&scope))
     };
 
     // For `ResultPromise` the argument extractions live inside the rejecting
@@ -3124,6 +2930,30 @@ fn emit_native_fn(
     }
 }
 
+/// The call of a member's Rust fn from its trampoline: a method call on `__self` when the member
+/// lives on the stack newtype, and otherwise a call of `type_name`'s associated fn, with `self_arg`
+/// as the first argument when it is given.
+fn member_call(
+    info: &MethodInfo,
+    type_name: &Ident,
+    on_newtype: bool,
+    self_arg: Option<proc_macro2::TokenStream>,
+) -> proc_macro2::TokenStream {
+    let fn_name = &info.fn_item.sig.ident;
+    let args = info.inputs.forwarded_args(quote!(&scope), quote!(&__args));
+    if on_newtype {
+        quote! { __self.#fn_name(#(#args),*) }
+    } else {
+        let args = self_arg.into_iter().chain(args);
+        quote! { #type_name::#fn_name(#(#args),*) }
+    }
+}
+
+/// Generate a JSNative wrapper function and the corresponding ClassBuilder call.
+///
+/// When `on_newtype` is true, the method lives on the stack newtype `Foo<'s>`.
+/// The wrapper extracts `this` as the rooted newtype and calls the method
+/// via method-call syntax.
 fn gen_method_native(
     info: &MethodInfo,
     type_name: &Ident,
@@ -3182,20 +3012,6 @@ fn gen_method_native(
         quote! {}
     };
 
-    let call_args: Vec<_> = info.params.iter().map(|(name, _)| quote!(#name)).collect();
-    let rest_arg = info
-        .rest_arg_name
-        .as_ref()
-        .map(|name| (name, info.rest_inner_type.as_ref()));
-
-    // Build rest arg value for method call
-    let rest_arg_expr: Vec<proc_macro2::TokenStream> = if info.has_rest_args {
-        let rest_name = info.rest_arg_name.as_ref().unwrap();
-        vec![quote! { #rest_name }]
-    } else {
-        vec![]
-    };
-
     // When `this` is the private data (not the newtype), `__self` is a borrow
     // guard; reborrow through it to pass the receiver to the inner method.
     let self_arg = if info.has_mut_self {
@@ -3203,51 +3019,20 @@ fn gen_method_native(
     } else {
         quote! { &*__self }
     };
-    let call = if on_newtype && (info.has_self || info.has_mut_self) {
-        // Method lives on the stack newtype — use method-call syntax.
-        if info.is_raw {
-            quote! { __self.#fn_name(&scope, &__args) }
-        } else if info.has_cx {
-            let all_args: Vec<_> = call_args.iter().chain(rest_arg_expr.iter()).collect();
-            quote! { __self.#fn_name(&scope, #(#all_args),*) }
-        } else {
-            let all_args: Vec<_> = call_args.iter().chain(rest_arg_expr.iter()).collect();
-            quote! { __self.#fn_name(#(#all_args),*) }
-        }
-    } else if info.has_self || info.has_mut_self {
-        if info.is_raw {
-            quote! { #type_name::#fn_name(#self_arg, &scope, &__args) }
-        } else if info.has_cx {
-            let all_args: Vec<_> = call_args.iter().chain(rest_arg_expr.iter()).collect();
-            quote! { #type_name::#fn_name(#self_arg, &scope, #(#all_args),*) }
-        } else {
-            let all_args: Vec<_> = call_args.iter().chain(rest_arg_expr.iter()).collect();
-            quote! { #type_name::#fn_name(#self_arg, #(#all_args),*) }
-        }
-    } else if info.is_raw {
-        quote! { #type_name::#fn_name(&scope, &__args) }
-    } else if info.has_cx {
-        let all_args: Vec<_> = call_args.iter().chain(rest_arg_expr.iter()).collect();
-        quote! { #type_name::#fn_name(&scope, #(#all_args),*) }
-    } else {
-        let all_args: Vec<_> = call_args.iter().chain(rest_arg_expr.iter()).collect();
-        quote! { #type_name::#fn_name(#(#all_args),*) }
-    };
+    let call = member_call(info, type_name, on_newtype, has_this.then_some(self_arg));
     let native_fn = emit_native_fn(
         &native_name,
         &name_str,
         &info.return_style,
-        &info.params,
+        &info.inputs,
         info.nargs,
         &call,
         &this_extraction,
         &this_in_closure,
-        rest_arg,
         Some(type_name),
     );
 
     // Generate: .method(c"jsName", nargs, Some(native_fn), flags)
-    // We need a &'static CStr. Use an unsafe trick with a byte string literal.
     let builder_call = quote! {
         .method(
             #js_name_cstr_lit,
@@ -3333,24 +3118,8 @@ fn gen_accessor_native(
         quote! { &mut *__self }
     };
 
+    let call = member_call(info, type_name, on_newtype, Some(self_arg));
     let body = if is_getter {
-        // Getter: call method, set return value
-        let call = if on_newtype {
-            if info.is_raw {
-                quote! { __self.#fn_name(&scope, &__args) }
-            } else if info.has_cx {
-                quote! { __self.#fn_name(&scope) }
-            } else {
-                quote! { __self.#fn_name() }
-            }
-        } else if info.is_raw {
-            quote! { #type_name::#fn_name(#self_arg, &scope, &__args) }
-        } else if info.has_cx {
-            quote! { #type_name::#fn_name(#self_arg, &scope) }
-        } else {
-            quote! { #type_name::#fn_name(#self_arg) }
-        };
-
         match &info.return_style {
             ReturnStyle::Raw => quote! {
                 match #call {
@@ -3358,11 +3127,6 @@ fn gen_accessor_native(
                     Err(::js::error::ExnThrown) => ::js::exception::check_fn_return(&scope, false, &#name_str),
                 }
             },
-            ReturnStyle::Value => quote! {
-                let __result = #call;
-                let __set_ok = ::js::class::set_return(&scope, &__args, &__result);
-                ::js::exception::check_fn_return(&scope, __set_ok, &#name_str)
-            },
             ReturnStyle::ResultValue => quote! {
                 match #call {
                     Ok(__v) => {
@@ -3406,30 +3170,13 @@ fn gen_accessor_native(
     } else {
         // Setter: extract arg[0], call method
         let arg_extractions = gen_arg_extractions(
-            &info.params,
+            &info.inputs.params,
             quote!(&__args),
             false,
             quote!(&scope),
             info.nargs,
         );
 
-        let call_args: Vec<_> = info.params.iter().map(|(name, _)| quote!(#name)).collect();
-        let call = if on_newtype {
-            if info.is_raw {
-                quote! { __self.#fn_name(&scope, &__args) }
-            } else if info.has_cx {
-                quote! { __self.#fn_name(&scope, #(#call_args),*) }
-            } else {
-                quote! { __self.#fn_name(#(#call_args),*) }
-            }
-        } else if info.is_raw {
-            quote! { #type_name::#fn_name(#self_arg, &scope, &__args) }
-        } else if info.has_cx {
-            quote! { #type_name::#fn_name(#self_arg, &scope, #(#call_args),*) }
-        } else {
-            quote! { #type_name::#fn_name(#self_arg, #(#call_args),*) }
-        };
-
         match &info.return_style {
             ReturnStyle::Raw => quote! {
                 #(#arg_extractions)*
@@ -3705,27 +3452,6 @@ fn trace_variant_arm(
 // #[derive(ScopeRoot)] — scope-rooted mirror for `#[must_root]` aggregates
 // ============================================================================
 
-/// If `ty` is `Heap<INNER>`, returns `INNER`.
-fn heap_inner_ty(ty: &Type) -> Option<&Type> {
-    let Type::Path(tp) = ty else { return None };
-    let seg = tp.path.segments.last()?;
-    if seg.ident != "Heap" {
-        return None;
-    }
-    let syn::PathArguments::AngleBracketed(args) = &seg.arguments else {
-        return None;
-    };
-    match args.args.first()? {
-        syn::GenericArgument::Type(inner) => Some(inner),
-        _ => None,
-    }
-}
-
-/// Whether `ty`'s final path segment is `Value` (the `js::native::Value` JSVal).
-fn is_value_ty(ty: &Type) -> bool {
-    matches!(ty, Type::Path(tp) if tp.path.segments.last().is_some_and(|s| s.ident == "Value"))
-}
-
 /// One field's classification for `#[derive(ScopeRoot)]`.
 struct RootField {
     /// Binding identifier used in destructuring patterns.
@@ -3746,8 +3472,8 @@ fn classify_root_fields(fields: &Fields) -> Vec<RootField> {
         .iter()
         .enumerate()
         .map(|(i, f)| {
-            let (is_heap, is_object_heap, mirror_ty) = match heap_inner_ty(&f.ty) {
-                Some(inner) if is_value_ty(inner) => {
+            let (is_heap, is_object_heap, mirror_ty) = match type_arg(&f.ty, "Heap", 0) {
+                Some(inner) if last_segment_is(inner, "Value") => {
                     (true, false, quote! { ::js::prelude::HandleValue<'s> })
                 }
                 Some(inner) => (
@@ -3798,16 +3524,14 @@ fn build_root_group(
             None => quote! { #ty },
         }
     });
+    // A named field's binding has the field's name, so a plain named field uses the shorthand.
     let fast_args = infos.iter().map(|f| {
         let bind = &f.bind;
-        let expr = if f.is_heap {
-            quote! { #bind.take(scope) }
-        } else {
-            quote! { #bind }
-        };
-        match &f.name {
-            Some(n) => quote! { #n: #expr },
-            None => quote! { #expr },
+        match (&f.name, f.is_heap) {
+            (Some(n), true) => quote! { #n: #bind.take(scope) },
+            (Some(n), false) => quote! { #n },
+            (None, true) => quote! { #bind.take(scope) },
+            (None, false) => quote! { #bind },
         }
     });
     let traced_args = infos.iter().map(|f| {
@@ -3971,51 +3695,13 @@ pub fn derive_scope_root(input: TokenStream) -> TokenStream {
 ///
 /// The function name is camelCased.
 fn parse_free_fn_export(fn_item: &syn::ItemFn) -> ModuleFnExport {
-    let fn_name = &fn_item.sig.ident;
-    let js_name = unraw(fn_name).to_lower_camel_case();
-
-    let mut params: Vec<(Ident, Type)> = Vec::new();
-    let mut has_cx = false;
-    let mut is_raw = false;
-    let mut rest_arg_name = None;
-    let mut rest_inner_type = None;
-    for arg in &fn_item.sig.inputs {
-        if let FnArg::Typed(pat_ty) = arg {
-            if is_cx_param_type(&pat_ty.ty) {
-                has_cx = true;
-                continue;
-            }
-            if is_callargs_param_type(&pat_ty.ty) {
-                is_raw = true;
-                continue;
-            }
-            // A variadic tail is not an ordinary parameter: it is collected from
-            // whatever arguments follow the fixed ones, so it must stay out of
-            // `params` for the index arithmetic in `gen_rest_setup` to line up.
-            if is_rest_args_type(&pat_ty.ty) {
-                if let Pat::Ident(pat_ident) = pat_ty.pat.as_ref() {
-                    rest_arg_name = Some(pat_ident.ident.clone());
-                    rest_inner_type = extract_rest_args_inner_type(&pat_ty.ty);
-                }
-                continue;
-            }
-            if let Pat::Ident(pat_ident) = pat_ty.pat.as_ref() {
-                params.push((pat_ident.ident.clone(), (*pat_ty.ty).clone()));
-            }
-        }
-    }
-
-    let return_style = classify_return_style(&fn_item.sig.output, None, false, is_raw);
-
+    let inputs = Inputs::parse(&fn_item.sig.inputs);
+    let return_style = classify_return_style(&fn_item.sig.output, None, false, inputs.is_raw);
     ModuleFnExport {
-        fn_name: fn_name.clone(),
-        js_name,
-        params,
+        fn_name: fn_item.sig.ident.clone(),
+        js_name: unraw(&fn_item.sig.ident).to_lower_camel_case(),
+        inputs,
         return_style,
-        has_cx,
-        is_raw,
-        rest_arg_name,
-        rest_inner_type,
     }
 }
 
@@ -4053,8 +3739,8 @@ struct ModExports {
 /// export or how its JS name and signature are derived, so they share this
 /// walk.
 ///
-/// `collect_classes` enables the `pub use Foo;` arm, which only `#[jsglobals]`
-/// acts on; elsewhere a `use` is passed through as an ordinary item.
+/// `collect_classes` enables the `pub use Foo;` arm. Without it, a `use` is
+/// passed through as an ordinary item.
 /// `macro_name` is the spelling used in diagnostics, e.g. `"#[jsmodule]"`.
 fn collect_mod_exports(
     input: &syn::ItemMod,
@@ -4120,34 +3806,19 @@ fn gen_free_fn_native(
 ) -> proc_macro2::TokenStream {
     let fn_name = &exp.fn_name;
     let name_str = fn_name.to_string();
-    let mut call_args: Vec<_> = exp.params.iter().map(|(name, _)| quote!(#name)).collect();
-    let rest_arg = exp
-        .rest_arg_name
-        .as_ref()
-        .map(|name| (name, exp.rest_inner_type.as_ref()));
-    if let Some(rest_name) = exp.rest_arg_name.as_ref() {
-        call_args.push(quote!(#rest_name));
-    }
-
-    let call = if exp.is_raw {
-        quote! { #call_path::#fn_name(&scope, &__args) }
-    } else if exp.has_cx {
-        quote! { #call_path::#fn_name(&scope, #(#call_args),*) }
-    } else {
-        quote! { #call_path::#fn_name(#(#call_args),*) }
-    };
+    let args = exp.inputs.forwarded_args(quote!(&scope), quote!(&__args));
+    let call = quote! { #call_path::#fn_name(#(#args),*) };
 
     emit_native_fn(
         native_name,
         &name_str,
         &exp.return_style,
-        &exp.params,
+        &exp.inputs,
         nargs,
         &call,
         // Free functions don't have a receiver, so `this` extraction is empty
         &quote! {},
         &quote! {},
-        rest_arg,
         None,
     )
 }
@@ -4176,7 +3847,7 @@ fn gen_free_fn_native(
 /// }
 ///
 /// // Register:
-/// unsafe { core_runtime::module::register_module::<my_math::js_module>(scope) };
+/// core_runtime::module::register_module::<my_math::js_module>(scope);
 ///
 /// // Call from Rust:
 /// assert_eq!(my_math::add(1.0, my_math::PI), 4.14159);
@@ -4215,7 +3886,7 @@ pub fn jsmodule(attr: TokenStream, item: TokenStream) -> TokenStream {
     for exp in &fn_exports {
         let native_name = format_ident!("__native_module_{}", unraw(&exp.fn_name));
         let js_name = &exp.js_name;
-        let nargs = required_arg_count(&exp.params);
+        let nargs = required_arg_count(&exp.inputs.params);
 
         native_fns.push(gen_free_fn_native(
             exp,
@@ -4246,14 +3917,8 @@ pub fn jsmodule(attr: TokenStream, item: TokenStream) -> TokenStream {
     // Generate the evaluate function that sets constant values
     let mut value_setters: Vec<proc_macro2::TokenStream> = Vec::new();
     for exp in &const_exports {
-        let const_name = &exp.const_name;
         let js_name = &exp.js_name;
-        // For reference-type constants (e.g. `&str`), pass directly.
-        let value_expr = if exp.is_ref_type {
-            quote! { super::#mod_name::#const_name }
-        } else {
-            quote! { &super::#mod_name::#const_name }
-        };
+        let value_expr = exp.value_ref(quote!(super::#mod_name::));
         value_setters.push(quote! {
             if !::core_runtime::module::set_module_export(
                 scope, env, #js_name, #value_expr,
@@ -4295,7 +3960,7 @@ pub fn jsmodule(attr: TokenStream, item: TokenStream) -> TokenStream {
             /// Register this native module so it can be imported from JS.
             ///
             /// Equivalent to `register_module::<js_module>(scope)`.
-            pub unsafe fn register(
+            pub fn register(
                 scope: &::js::gc::scope::Scope<'_>,
             ) -> bool {
                 ::core_runtime::module::register_module::<js_module>(scope)
@@ -4309,14 +3974,8 @@ pub fn jsmodule(attr: TokenStream, item: TokenStream) -> TokenStream {
 struct ModuleFnExport {
     fn_name: Ident,
     js_name: String,
-    params: Vec<(Ident, Type)>,
+    inputs: Inputs,
     return_style: ReturnStyle,
-    has_cx: bool,
-    is_raw: bool,
-    /// The variadic tail's parameter name and `RestArgs<T>` element type, if the
-    /// function declared one.
-    rest_arg_name: Option<Ident>,
-    rest_inner_type: Option<Type>,
 }
 
 struct ModuleConstExport {
@@ -4396,7 +4055,7 @@ pub fn jsglobals(attr: TokenStream, item: TokenStream) -> TokenStream {
     for exp in &fn_exports {
         let native_name = format_ident!("__native_global_{}", unraw(&exp.fn_name));
         let js_name = &exp.js_name;
-        let nargs = required_arg_count(&exp.params);
+        let nargs = required_arg_count(&exp.inputs.params);
 
         native_fns.push(gen_free_fn_native(
             exp,
@@ -4421,16 +4080,8 @@ pub fn jsglobals(attr: TokenStream, item: TokenStream) -> TokenStream {
 
     // Generate install calls for constants
     for exp in &const_exports {
-        let const_name = &exp.const_name;
         let js_name_cstr_lit = cstr_literal(&exp.js_name);
-
-        // For reference-type constants (e.g. `&str`), pass the value directly
-        // since it's already a reference. For value types, add `&`.
-        let value_expr = if exp.is_ref_type {
-            quote! { super::#mod_name::#const_name }
-        } else {
-            quote! { &super::#mod_name::#const_name }
-        };
+        let value_expr = exp.value_ref(quote!(super::#mod_name::));
 
         install_calls.push(quote! {
             global.define_property(
@@ -4568,7 +4219,7 @@ fn process_namespace(opts: AttrOpts, input: syn::ItemMod, config: NamespaceConfi
 
     for exp in &fn_exports {
         let native_name = format_ident!("__native_ns_{}", unraw(&exp.fn_name));
-        let nargs = required_arg_count(&exp.params);
+        let nargs = required_arg_count(&exp.inputs.params);
 
         native_fns.push(gen_free_fn_native(
             exp,
@@ -4594,13 +4245,8 @@ fn process_namespace(opts: AttrOpts, input: syn::ItemMod, config: NamespaceConfi
     // Install constants on the namespace object. Namespace members are
     // enumerable, configurable, writable data properties (WebIDL §3.13).
     for exp in &const_exports {
-        let const_name = &exp.const_name;
         let js_name_cstr_lit = cstr_literal(&exp.js_name);
-        let value_expr = if exp.is_ref_type {
-            quote! { #const_name }
-        } else {
-            quote! { &#const_name }
-        };
+        let value_expr = exp.value_ref(quote!());
         install_calls.push(quote! {
             ns_obj.define_property(
                 scope,
@@ -4620,8 +4266,7 @@ fn process_namespace(opts: AttrOpts, input: syn::ItemMod, config: NamespaceConfi
         quote! {}
     };
 
-    let js_ns_name_bytes = format!("{js_ns_name}\0");
-    let js_ns_name_cstr = proc_macro2::Literal::byte_string(js_ns_name_bytes.as_bytes());
+    let js_ns_name_cstr = cstr_literal(&js_ns_name);
 
     let output = quote! {
         #mod_vis mod #mod_name {
@@ -4648,11 +4293,7 @@ fn process_namespace(opts: AttrOpts, input: syn::ItemMod, config: NamespaceConfi
                 // Install the namespace object on the global as a
                 // non-enumerable, configurable, writable data property (WebIDL
                 // §3.13 — defined, not assigned via [[Set]]).
-                let ns_name = unsafe {
-                    ::std::ffi::CStr::from_bytes_with_nul_unchecked(#js_ns_name_cstr)
-                };
-                let ns_val = unsafe { ::js::value::from_object(ns_obj.as_raw()) };
-                global.define_property(scope, ns_name, &ns_val, 0)
+                global.define_property(scope, #js_ns_name_cstr, ns_obj, 0)
                     .expect("failed to define namespace on global");
             }
         }
@@ -4811,25 +4452,14 @@ pub fn webidl_dictionary(attr: TokenStream, item: TokenStream) -> TokenStream {
             }
         }
 
-        let js_name = js_name_override.unwrap_or_else(|| {
-            let name = ident.to_string();
-            // Strip raw identifier prefix (e.g. `r#type` → `type`).
-            let name = name.strip_prefix("r#").unwrap_or(&name);
-            name.to_lower_camel_case()
-        });
-        let optional = is_option_type(&ty);
-        let inner_ty = if optional {
-            extract_option_inner_type(&ty)
-        } else {
-            None
-        };
+        let js_name = js_name_override.unwrap_or_else(|| unraw(&ident).to_lower_camel_case());
+        let option_inner = extract_option_inner_type(&ty).cloned();
 
         members.push(DictMember {
             ident,
             ty,
-            inner_ty,
+            option_inner,
             js_name,
-            optional,
             default_expr,
         });
     }
@@ -4905,7 +4535,7 @@ pub fn webidl_dictionary(attr: TokenStream, item: TokenStream) -> TokenStream {
                     None
                 } else {
                     Some(
-                        ::js::Object::from_value(scope, *val)
+                        ::js::Object::from_raw_value(scope, val.get())
                             .map_err(|_| ::js::conversion::ConversionError::Failure(
                                 ::std::borrow::Cow::Borrowed(c"dictionary value is not an object"),
                             ))?
@@ -4923,41 +4553,15 @@ pub fn webidl_dictionary(attr: TokenStream, item: TokenStream) -> TokenStream {
         }
     };
     // Strip #[webidl(...)] attributes from the output struct's fields.
-    let mut output_struct = input.clone();
-    if let Fields::Named(ref mut named) = output_struct.fields {
-        for field in &mut named.named {
-            field.attrs.retain(|a| !a.path().is_ident("webidl"));
-        }
+    let mut output_fields = fields.clone();
+    for field in &mut output_fields {
+        field.attrs.retain(|a| !a.path().is_ident("webidl"));
     }
 
-    let cleaned_fields = if let Fields::Named(ref named) = output_struct.fields {
-        let field_tokens: Vec<_> = named
-            .named
-            .iter()
-            .map(|f| {
-                let field_attrs: Vec<_> = f
-                    .attrs
-                    .iter()
-                    .filter(|a| !a.path().is_ident("webidl"))
-                    .collect();
-                let field_vis = &f.vis;
-                let field_ident = &f.ident;
-                let field_ty = &f.ty;
-                quote! {
-                    #(#field_attrs)*
-                    #field_vis #field_ident: #field_ty
-                }
-            })
-            .collect();
-        field_tokens
-    } else {
-        vec![]
-    };
-
     let output = quote! {
         #(#attrs)*
         #vis struct #struct_name #impl_generics #where_clause {
-            #(#cleaned_fields),*
+            #output_fields
         }
 
         #from_jsval_impl
@@ -5028,12 +4632,10 @@ fn parent_field<'a>(
 struct DictMember {
     ident: Ident,
     ty: Type,
-    /// The inner type if this is `Option<T>`.
-    inner_ty: Option<Type>,
+    /// The `T` of an `Option<T>` field, which is an optional member.
+    option_inner: Option<Type>,
     /// The JS property name (camelCase).
     js_name: String,
-    /// Whether this is an `Option<T>` field (optional member).
-    optional: bool,
     /// Default expression, if any (from `#[webidl(default = ...)]`).
     default_expr: Option<syn::Expr>,
 }
@@ -5047,9 +4649,8 @@ fn gen_dict_member_extraction(member: &DictMember) -> proc_macro2::TokenStream {
     // (not `undefined`). The three member kinds differ only in the binding (a
     // type annotation drives `from_jsval` inference for non-optional members),
     // the conversion type, and what an absent property yields.
-    let (binding, conv_ty, absent) = if member.optional {
+    let (binding, conv_ty, absent) = if let Some(inner_ty) = &member.option_inner {
         // Optional member (Option<T>): None when property is missing/undefined.
-        let inner_ty = member.inner_ty.as_ref().unwrap_or(&member.ty);
         (quote! { let #ident }, inner_ty, quote! { None })
     } else if let Some(default_expr) = &member.default_expr {
         // Required member with a default: use the default when missing/undefined.
@@ -5097,7 +4698,7 @@ fn gen_dict_member_extraction(member: &DictMember) -> proc_macro2::TokenStream {
             quote! { ::js::conversion::FromJSVal::from_jsval(scope, __prop, ())? }
         }
     };
-    let convert = if member.optional {
+    let convert = if member.option_inner.is_some() {
         quote! { Some(#core) }
     } else {
         core
@@ -5175,6 +4776,19 @@ pub fn allow_unrooted_interior_in_rc(_attr: TokenStream, item: TokenStream) -> T
     .into()
 }
 
+impl ModuleConstExport {
+    /// A reference to the constant, which `prefix` qualifies: the constant itself for a
+    /// reference-typed constant such as a `&str`, and a borrow of it otherwise.
+    fn value_ref(&self, prefix: proc_macro2::TokenStream) -> proc_macro2::TokenStream {
+        let const_name = &self.const_name;
+        if self.is_ref_type {
+            quote! { #prefix #const_name }
+        } else {
+            quote! { &#prefix #const_name }
+        }
+    }
+}
+
 // ============================================================================
 // WebIDL Union types — `#[webidl_union]`
 // ============================================================================
@@ -5239,7 +4853,7 @@ fn classify_union_variant(ty: &Type) -> UnionCategory {
     if s == "String" {
         return UnionCategory::String;
     }
-    if is_vec_type(ty) {
+    if generic_args(ty, "Vec").is_some() {
         return UnionCategory::Sequence;
     }
     UnionCategory::Object
@@ -5251,6 +4865,7 @@ fn process_webidl_union(input: ItemEnum) -> TokenStream {
     let attrs = &input.attrs;
     let generics = &input.generics;
     let where_clause = &generics.where_clause;
+    let variants = &input.variants;
 
     // Unions whose variants reference scope-rooted types declare a single
     // lifetime parameter. Reject anything beyond one lifetime / type parameter
@@ -5533,18 +5148,6 @@ fn process_webidl_union(input: ItemEnum) -> TokenStream {
         })
         .collect();
 
-    // Rebuild the enum variants for the output.
-    let variant_defs: Vec<_> = input
-        .variants
-        .iter()
-        .map(|v| {
-            let id = &v.ident;
-            let fields = &v.fields;
-            let attrs = &v.attrs;
-            quote! { #(#attrs)* #id #fields }
-        })
-        .collect();
-
     // When the enum carries a lifetime parameter, reuse it as the scope
     // lifetime so variants like `Stack<'a, T>` line up with the trait's `'s`.
     let scope_lt = match &lifetime {
@@ -5559,7 +5162,7 @@ fn process_webidl_union(input: ItemEnum) -> TokenStream {
     let output = quote! {
         #(#attrs)*
         #vis enum #enum_name #generics #where_clause {
-            #(#variant_defs,)*
+            #variants
         }
 
         impl<#scope_lt, 'v> ::js::conversion::FromJSVal<#scope_lt, 'v> for #enum_ty {
@@ -5706,44 +5309,43 @@ mod tests {
 
     #[test]
     fn is_result_promise_type_detects_promise_ok() {
-        let parse = |s: &str| syn::parse_str::<Type>(s).unwrap();
         // The `Ok` type carries a lifetime argument, which the bare-identifier
         // `is_promise_type` rejects — the dedicated check must still match.
-        assert!(is_result_promise_type(&parse(
+        assert!(is_result_promise_type(&parse_ty(
             "Result<Promise<'r>, ExnThrown>"
         )));
-        assert!(is_result_promise_type(&parse(
+        assert!(is_result_promise_type(&parse_ty(
             "Result<js::Promise<'r>, ExnThrown>"
         )));
-        assert!(is_result_promise_type(&parse(
+        assert!(is_result_promise_type(&parse_ty(
             "Result<PromiseFuture, ExnThrown>"
         )));
     }
 
     #[test]
     fn is_result_promise_type_rejects_non_promise() {
-        let parse = |s: &str| syn::parse_str::<Type>(s).unwrap();
-        assert!(!is_result_promise_type(&parse("Result<String, ExnThrown>")));
-        assert!(!is_result_promise_type(&parse("Result<(), ExnThrown>")));
-        assert!(!is_result_promise_type(&parse("Promise<'r>")));
+        assert!(!is_result_promise_type(&parse_ty(
+            "Result<String, ExnThrown>"
+        )));
+        assert!(!is_result_promise_type(&parse_ty("Result<(), ExnThrown>")));
+        assert!(!is_result_promise_type(&parse_ty("Promise<'r>")));
         // A `Promise` nested inside another `Ok` type is not a promise return.
-        assert!(!is_result_promise_type(&parse(
+        assert!(!is_result_promise_type(&parse_ty(
             "Result<Vec<Promise<'r>>, ExnThrown>"
         )));
     }
 
     #[test]
     fn promise_params_match_both_spellings() {
-        let parse = |s: &str| syn::parse_str::<Type>(s).unwrap();
-        assert!(is_unchecked_promise_type(&parse("Promise<'_>")));
-        assert!(is_unchecked_promise_type(&parse("js::Promise<'r>")));
+        assert!(is_unchecked_promise_type(&parse_ty("Promise<'_>")));
+        assert!(is_unchecked_promise_type(&parse_ty("js::Promise<'r>")));
         // A future is a return type, never an argument, so it must not pick up
         // the `Promise<T>` argument conversion the way `is_promise_type` does.
-        assert!(!is_unchecked_promise_type(&parse("PromiseFuture")));
-        assert!(!is_unchecked_promise_type(&parse(
+        assert!(!is_unchecked_promise_type(&parse_ty("PromiseFuture")));
+        assert!(!is_unchecked_promise_type(&parse_ty(
             "PromiseOf<'_, Response<'_>>"
         )));
-        assert!(!is_unchecked_promise_type(&parse("Vec<Promise<'_>>")));
+        assert!(!is_unchecked_promise_type(&parse_ty("Vec<Promise<'_>>")));
     }
 
     #[test]
@@ -5814,17 +5416,16 @@ mod tests {
 
     #[test]
     fn cx_and_callargs_params_match_exactly() {
-        let parse = |s: &str| syn::parse_str::<Type>(s).unwrap();
         // The real context / raw-args parameter spellings are recognized.
-        assert!(is_cx_param_type(&parse("&Scope<'_>")));
-        assert!(is_cx_param_type(&parse("&js::gc::scope::Scope<'_>")));
-        assert!(is_cx_param_type(&parse("&mut JSContext")));
-        assert!(is_callargs_param_type(&parse("&CallArgs")));
+        assert!(is_cx_param_type(&parse_ty("&Scope<'_>")));
+        assert!(is_cx_param_type(&parse_ty("&js::gc::scope::Scope<'_>")));
+        assert!(is_cx_param_type(&parse_ty("&mut JSContext")));
+        assert!(is_callargs_param_type(&parse_ty("&CallArgs")));
         // A user parameter whose type merely contains the substring is not.
-        assert!(!is_cx_param_type(&parse("ScopeOptions")));
-        assert!(!is_cx_param_type(&parse("Telescope")));
-        assert!(!is_cx_param_type(&parse("Vec<ScopeId>")));
-        assert!(!is_callargs_param_type(&parse("MyCallArgs")));
-        assert!(!is_callargs_param_type(&parse("CallArgsView")));
+        assert!(!is_cx_param_type(&parse_ty("ScopeOptions")));
+        assert!(!is_cx_param_type(&parse_ty("Telescope")));
+        assert!(!is_cx_param_type(&parse_ty("Vec<ScopeId>")));
+        assert!(!is_callargs_param_type(&parse_ty("MyCallArgs")));
+        assert!(!is_callargs_param_type(&parse_ty("CallArgsView")));
     }
 }
diff --git a/crates/wit-bridge/Cargo.toml b/crates/wit-bridge/Cargo.toml
new file mode 100644
index 00000000..ed781e8e
--- /dev/null
+++ b/crates/wit-bridge/Cargo.toml
@@ -0,0 +1,35 @@
+[package]
+name = "wit-bridge"
+version.workspace = true
+repository.workspace = true
+license.workspace = true
+authors.workspace = true
+edition.workspace = true
+
+[features]
+debugmozjs = ['js/debugmozjs']
+
+[dependencies]
+wit-name-mapping.workspace = true
+core-runtime.workspace = true
+platform.workspace = true
+slab.workspace = true
+smallvec.workspace = true
+js.workspace = true
+web-streams.workspace = true
+
+# Only the wasm-only modules name `wit-dylib-ffi`. The rev is a `wasm-tools`
+# 1.262.0 commit, matching the `wit-dylib` 0.262 the componentizer uses, so both
+# sides agree on the wit-dylib ABI. `async-runtime` runs async-declared exports
+# on wit-bindgen's executor, the one the wasip3 builtins run on.
+[target.'cfg(target_arch = "wasm32")'.dependencies]
+wit-dylib-ffi = { git = "https://github.com/bytecodealliance/wasm-tools/", rev = "e22db44da4eaf17a0e46ec55b911c7539589a3cc", features = [
+    "async-runtime",
+] }
+# `src/streams.rs` reads and writes streams and futures through wit-bindgen's
+# readers and writers. wit-dylib-ffi depends on the same wit-bindgen version, so
+# the linked component holds one copy.
+wit-bindgen = { workspace = true, features = ["async-spawn"] }
+
+[lints]
+workspace = true
diff --git a/crates/wit-bridge/src/component_error.rs b/crates/wit-bridge/src/component_error.rs
new file mode 100644
index 00000000..d90c2680
--- /dev/null
+++ b/crates/wit-bridge/src/component_error.rs
@@ -0,0 +1,391 @@
+// SPDX-License-Identifier: Apache-2.0-WITH-LLVM-exception
+
+//! The `ComponentError` class, which represents the `err` case of a WIT
+//! `result` in JavaScript.
+//!
+//! A call to an imported function that returns the `err` case of a `result`
+//! throws a `ComponentError`, or rejects with one if the function is async.
+//! The error's `payload` property holds the lifted `err` value. If the `err`
+//! type is a named WIT type other than a resource, the error is an instance of
+//! a subclass of `ComponentError` named after the type (see [`ErrorClass`]).
+//!
+//! An exported function that returns a `result` returns its `err` case by
+//! throwing, or by rejecting if it is async. `err_payload` converts the
+//! thrown value into the `err` value.
+//!
+//! The constructor sets the error's `message` from the payload:
+//!
+//! - A string payload is the message.
+//! - An object with a string `tag` property, such as a lifted variant, gives
+//!   the message `tag: val` if its `val` property is a string, number, BigInt
+//!   or boolean, `tag` if `val` is `undefined`, and `tag (see error.payload)`
+//!   otherwise.
+//! - An `undefined` payload sets no `message`, so `message` is the empty string
+//!   inherited from `Error.prototype`.
+//! - Any other payload gives the message `<payload> (see error.payload)`, with
+//!   the payload converted to a string.
+//!
+//! An error created by `throw_err` for an enum `err` type has the case name
+//! as its message instead.
+//!
+//! `Object.prototype.toString` returns `[object Error]` for an instance.
+
+use std::cell::RefCell;
+use std::collections::HashMap;
+
+use core_runtime::{jsclass, jsmethods};
+
+use js::conversion::FromJSVal;
+use js::error::ExnThrown;
+use js::gc::handle::{Heap, RootedHeap};
+use js::gc::scope::Scope;
+use js::native::Value;
+use js::prelude::HandleValue;
+use js::{Function, Object};
+
+use wit_name_mapping::mangle_resource_name;
+
+use crate::value::{TypeShape, ENUMERATE};
+
+const MESSAGE_FIELD: &std::ffi::CStr = c"message";
+
+#[jsclass(js_proto = "Error", to_string_tag = "Error")]
+pub struct ComponentError {
+    /// The `err` payload of this error, `undefined` until the constructor runs.
+    payload: Heap<Value>,
+}
+
+#[jsmethods]
+impl ComponentError {
+    /// `new ComponentError(value)` stores `value` as the payload and sets
+    /// `message` from it as described in the module documentation.
+    #[constructor]
+    fn new(&self, scope: &Scope<'_>, value: HandleValue<'_>) -> Result<(), ExnThrown> {
+        self.data_mut().payload.set(value.get());
+        let message = match tagged_message(scope, value)? {
+            Some(message) => message,
+            None if value.is_undefined() => return Ok(()),
+            None if value.is_string() => String::from_jsval_throwing(scope, value, ())?,
+            None => format!(
+                "{} (see error.payload)",
+                String::from_jsval_throwing(scope, value, ())?
+            ),
+        };
+
+        // Defining the property instead of assigning it makes it non-enumerable,
+        // like the `message` of a native `Error`.
+        self.define_property(scope, MESSAGE_FIELD, message, 0)?;
+        Ok(())
+    }
+
+    /// The `err` payload of this error.
+    #[getter]
+    fn payload<'r>(&self, scope: &'r Scope<'_>) -> HandleValue<'r> {
+        self.data().payload.get(scope)
+    }
+}
+
+/// Define `ComponentError.prototype.name` as "ComponentError".
+///
+/// Error subclasses use value properties for their `name` instead of getters,
+/// so this matches the behavior of native `Error` subclasses.
+pub(crate) fn name_prototype(scope: &Scope<'_>) {
+    let proto = js::class::get_prototype_object_for::<ComponentErrorImpl>(scope)
+        .expect("`ComponentError` is registered before its prototype is named");
+    // Writable, configurable and not enumerable, as `Error.prototype.name` is.
+    proto
+        .define_property(scope, c"name", "ComponentError", 0)
+        .expect("defining a property of a fresh prototype can only fail due to OOM");
+}
+
+/// Return the message for a payload that is an object with a string `tag`
+/// property, in the format described in the module documentation, or `None`
+/// for any other payload.
+fn tagged_message(scope: &Scope<'_>, value: HandleValue<'_>) -> Result<Option<String>, ExnThrown> {
+    let Ok(obj) = Object::from_value(scope, value) else {
+        return Ok(None);
+    };
+    let tag = obj.get_property(scope, c"tag")?;
+    if !tag.is_string() {
+        return Ok(None);
+    }
+    let tag = String::from_jsval_throwing(scope, tag, ())?;
+    let val = obj.get_property(scope, c"val")?;
+    Ok(Some(
+        if val.is_string() || val.is_number() || val.is_bigint() || val.is_boolean() {
+            format!("{tag}: {}", String::from_jsval_throwing(scope, val, ())?)
+        } else if val.is_undefined() {
+            tag
+        } else {
+            format!("{tag} (see error.payload)")
+        },
+    ))
+}
+
+/// Return the payload of `value` if it is a `ComponentError`, including an
+/// instance of a subclass, or `None` otherwise.
+pub fn component_error_payload<'s>(
+    scope: &'s Scope<'_>,
+    value: HandleValue<'_>,
+) -> Option<HandleValue<'s>> {
+    let err = ComponentError::from_jsval(scope, value, ()).ok()?;
+    // Binding to a local drops the `data()` borrow guard before return.
+    let payload = err.data().payload.get(scope);
+    Some(payload)
+}
+
+/// Convert `reason`, a thrown exception or a rejection reason, into the `err`
+/// value of a `result`. `err_type` is the type of the `result`'s `err` case, or
+/// `None` if that case has no value. No exception may be pending.
+///
+/// If `err_type` is `None`, `undefined` is returned, and `reason` is printed to
+/// stderr with its message and stack. Nothing is printed if `reason` is
+/// `undefined`, or a `ComponentError` whose payload is `undefined`.
+///
+/// Otherwise, the `err` value is:
+///
+/// - the payload, if `reason` is a `ComponentError`, including an instance of a
+///   subclass,
+/// - `reason` itself, if it isn't an `Error` object, without checking it
+///   against `err_type`,
+/// - a value derived from the `message` of an `Error` object (see
+///   `err_from_message`).
+///
+/// Returns `Err` with the reason if an `Error` object can't be converted.
+pub(crate) fn err_payload<'s>(
+    scope: &'s Scope<'_>,
+    reason: HandleValue<'s>,
+    err_type: Option<&TypeShape>,
+) -> Result<HandleValue<'s>, String> {
+    let payload = component_error_payload(scope, reason);
+    let Some(err_type) = err_type else {
+        if !payload.unwrap_or(reason).is_undefined() {
+            report_dropped(scope, reason);
+        }
+        return Ok(HandleValue::undefined());
+    };
+    if let Some(payload) = payload {
+        return Ok(payload);
+    }
+    if !js::exception::is_error_object(scope, reason) {
+        return Ok(reason);
+    }
+    err_from_message(scope, reason, err_type)
+}
+
+/// Print `value`, which was thrown for an `err` case without a value, to stderr
+/// with its message and stack.
+fn report_dropped(scope: &Scope<'_>, value: HandleValue<'_>) {
+    let captured = crate::exports::capture_value(scope, value);
+    eprintln!(
+        "{}",
+        captured
+            .with_context("the `err` case of a `result` has no value, so this error was dropped")
+    );
+}
+
+/// Convert the `Error` object `error` into an `err` value of type `err_type`,
+/// based on its `message` converted to a string:
+///
+/// - For a `string` type, the value is the message.
+/// - For an `enum` type, the value is the index of the case named by the
+///   message.
+/// - For a `variant` type, the value is `{tag: message}`. The case named by the
+///   message must have no value.
+///
+/// Returns `Err` with the reason if `err_type` is any other type, if no case
+/// has that name, or if reading `message` or converting it to a string throws.
+/// The exception is cleared.
+fn err_from_message<'s>(
+    scope: &'s Scope<'_>,
+    error: HandleValue<'s>,
+    err_type: &TypeShape,
+) -> Result<HandleValue<'s>, String> {
+    let thrown = |context: &str| ExnThrown::capture(scope).with_context(context);
+    let error = Object::from_value(scope, error).expect("an `Error` is an object");
+    let message = error
+        .get_property(scope, MESSAGE_FIELD)
+        .map_err(|_| thrown("reading the error's `message` threw"))?;
+    let text = String::from_jsval_throwing(scope, message, ())
+        .map_err(|_| thrown("converting the error's `message` to a string threw"))?;
+    let message = if message.is_string() {
+        message
+    } else {
+        let string = js::JSString::from_str(scope, &text)
+            .map_err(|_| thrown("converting the error's `message` to a string threw"))?;
+        scope.root_value(string.as_value())
+    };
+    match err_type {
+        TypeShape::String => Ok(message),
+        TypeShape::Enum(names) => match names.iter().position(|name| *name == text) {
+            Some(index) => Ok(scope.root_value(js::value::from_u32(index as u32))),
+            None => Err(format!(
+                "the error's message \"{text}\" names no case of the `err` type, which has the \
+                 cases {}",
+                names.join(", ")
+            )),
+        },
+        TypeShape::Variant(cases) => {
+            if !cases
+                .iter()
+                .any(|(name, payload)| payload.is_none() && *name == text)
+            {
+                return Err(format!(
+                    "the error's message \"{text}\" names no case without a value of the `err` \
+                     type"
+                ));
+            }
+            let wrapper =
+                Object::new_plain(scope).map_err(|_| thrown("creating the `err` value threw"))?;
+            wrapper
+                .define_property(scope, c"tag", message, ENUMERATE)
+                .map_err(|_| thrown("creating the `err` value threw"))?;
+            Ok(scope.root_value(wrapper.as_value()))
+        }
+        _ => Err(
+            "an `Error` can only be converted into an `err` value of type `string`, or of \
+                  an enum or variant type. Throw a `ComponentError` holding the `err` value \
+                  instead"
+                .to_string(),
+        ),
+    }
+}
+
+/// A named WIT type, other than a resource, used as the `err` type of a
+/// `result`. Errors with a payload of this type are instances of a subclass of
+/// `ComponentError` whose name is the type's name in UpperCamelCase (see
+/// [`create_error_class`]).
+#[derive(Clone, Debug, PartialEq, Eq, Hash)]
+pub struct ErrorClass {
+    /// The WIT name of the interface defining the type, or `None` for a type
+    /// the world defines.
+    pub interface: Option<String>,
+    /// The type's WIT name.
+    pub name: String,
+    /// The mangled case names in declaration order if the type is an enum, and
+    /// empty otherwise. `throw_err` uses them as error messages.
+    pub enum_cases: Vec<String>,
+}
+
+impl ErrorClass {
+    /// The class's JS name.
+    pub fn js_name(&self) -> String {
+        mangle_resource_name(&self.name)
+    }
+}
+
+js::instance_local! {
+    /// Every class created by [`create_error_class`], keyed by the type it was
+    /// created for. The runtime has a single global, so the classes don't need
+    /// to be keyed by realm.
+    static ERROR_CLASSES: RefCell<HashMap<ErrorClass, RootedHeap<js::object::Object>>> =
+        RefCell::new(HashMap::new());
+}
+
+/// The address of this static is the key under which [`install_class_factory`]
+/// registers the class factory.
+static CLASS_FACTORY_KEY: u8 = 0;
+
+fn class_factory_key() -> usize {
+    std::ptr::from_ref(&CLASS_FACTORY_KEY).addr()
+}
+
+/// The JS source of a function that takes a base class and returns a class
+/// factory. The factory takes a name and returns a subclass of the base class
+/// with that name.
+const CLASS_FACTORY_SOURCE: &str = "(Base) => (name) => ({ [name]: class extends Base {} })[name]";
+
+/// Create the class factory used by [`create_error_class`], with
+/// `ComponentError` as the base class, and register it as a shared object of
+/// the global. Must be called after `ComponentError` is registered.
+pub(crate) fn install_class_factory(scope: &Scope<'_>) -> Result<(), ExnThrown> {
+    let make = js::compile::evaluate(scope, CLASS_FACTORY_SOURCE)?;
+    let base = js::class::class_constructor::<ComponentErrorImpl>(scope)?;
+    let factory = Function::call(scope, HandleValue::undefined(), make, &[base])?;
+    let factory = Object::from_value(scope, factory).map_err(|e| e.throw(scope))?;
+    js::class::get_or_init_shared_object(scope, class_factory_key(), |_| Ok(factory))?;
+    Ok(())
+}
+
+/// Create the subclass of `ComponentError` for `class`, or return the one
+/// created by an earlier call. The subclass's prototype has the class's JS name
+/// as its `name`.
+pub fn create_error_class<'s>(
+    scope: &'s Scope<'_>,
+    class: &ErrorClass,
+) -> Result<Object<'s>, ExnThrown> {
+    let existing = ERROR_CLASSES.with(|cell| cell.borrow().get(class).map(|heap| heap.get(scope)));
+    if let Some(existing) = existing {
+        return Ok(existing);
+    }
+    let factory = js::class::get_or_init_shared_object(scope, class_factory_key(), |_| {
+        panic!("the error class factory is installed when the global is set up")
+    })?;
+    let name = js::JSString::from_str(scope, &class.js_name())?;
+    let created = Function::call(scope, HandleValue::undefined(), factory, &[name])?;
+    let created = Object::from_value(scope, created).map_err(|e| e.throw(scope))?;
+    let proto = created.get_property(scope, c"prototype")?;
+    let proto = Object::from_value(scope, proto).map_err(|e| e.throw(scope))?;
+    // Writable, configurable and not enumerable, as `Error.prototype.name` is.
+    proto.define_property(scope, c"name", name, 0)?;
+    ERROR_CLASSES.with(|cell| {
+        cell.borrow_mut()
+            .insert(class.clone(), RootedHeap::new(created))
+    });
+    Ok(created)
+}
+
+/// Return the subclass created by [`create_error_class`] for `class`.
+///
+/// # Panics
+///
+/// Panics if no class was created for `class`'s type.
+pub fn error_class<'s>(scope: &'s Scope<'_>, class: &ErrorClass) -> Object<'s> {
+    ERROR_CLASSES.with(|cell| {
+        cell.borrow()
+            .get(class)
+            .map(|heap| heap.get(scope))
+            .expect("the error classes of every type in the world are created at init")
+    })
+}
+
+/// Set a new error with the payload `payload` as the pending exception.
+///
+/// The error is an instance of the subclass for `class`, or a `ComponentError`
+/// if `class` is `None`. If `class` is an enum, the error's message is the name
+/// of the case whose index is `payload`. If creating the error throws, that
+/// exception is left pending instead.
+pub(crate) fn throw_err(
+    scope: &Scope<'_>,
+    payload: HandleValue<'_>,
+    class: Option<&ErrorClass>,
+) -> ExnThrown {
+    let error = match class {
+        Some(class) => Function::construct(scope, error_class(scope, class), &[payload]),
+        None => ComponentError::new(scope, payload).map(|error| *error),
+    };
+    let error = error.and_then(|error| {
+        let case = class.and_then(|class| {
+            let index = payload.is_int32().then(|| payload.to_int32())?;
+            class.enum_cases.get(usize::try_from(index).ok()?)
+        });
+        if let Some(case) = case {
+            error.define_property(scope, MESSAGE_FIELD, case.as_str(), 0)?;
+        }
+        Ok(error)
+    });
+    match error {
+        Ok(error) => js::exception::set_pending(
+            scope,
+            scope.root_value(error.as_value()),
+            js::native::ExceptionStackBehavior::Capture,
+        ),
+        Err(exn) => exn,
+    }
+}
+
+/// Drop every error class. See
+/// [`crate::tracing::clear_traced_roots`].
+pub(crate) fn clear_traced_roots() {
+    ERROR_CLASSES.with(|cell| cell.borrow_mut().clear());
+}
diff --git a/crates/wit-bridge/src/exports.rs b/crates/wit-bridge/src/exports.rs
new file mode 100644
index 00000000..3c3750f4
--- /dev/null
+++ b/crates/wit-bridge/src/exports.rs
@@ -0,0 +1,700 @@
+// SPDX-License-Identifier: Apache-2.0-WITH-LLVM-exception
+
+//! Finding and calling the JavaScript implementations of the component's
+//! exports.
+//!
+//! The main module exports an implementation of each item of the world's
+//! exports under one of the names returned by
+//! [`wit_name_mapping::possible_export_names`]. [`ExportTable::build`] finds
+//! the implementation of each export after the main module is evaluated.
+//! [`call_export`] calls an implementation with lifted arguments, and returns
+//! the result for lowering.
+
+use std::cell::RefCell;
+
+use js::conversion::FromJSVal;
+use js::error::{throw_type_error, CapturedError, ExnThrown, ThrowException};
+use js::gc::handle::RootedHeap;
+use js::gc::scope::Scope;
+use js::native::Value;
+use js::prelude::HandleValue;
+use js::{Function, Object};
+
+use std::rc::Rc;
+
+use wit_name_mapping::{item_js_name, mangle_name, mangle_resource_name, FunctionName, Shape};
+
+use crate::value::{to_cstring, TypeShape};
+
+/// The kind of an export's result type, which determines how the result is
+/// handled.
+#[derive(Clone, Debug, PartialEq)]
+pub enum ResultShape {
+    /// No result.
+    None,
+    /// A plain value.
+    Plain,
+    /// A `future`. A promise returned by an async export is lowered as the
+    /// future instead of being awaited, so the call completes before the future
+    /// settles.
+    Future,
+    /// A `result`. `ok` is set if the `ok` case has a value. `err` is the type
+    /// of the `err` case's value, or `None` if that case has no value.
+    Result {
+        ok: bool,
+        err: Option<Rc<TypeShape>>,
+    },
+}
+
+impl ResultShape {
+    /// Return `None` if this isn't a `result`. Otherwise, return the type of the
+    /// `err` case's value, or `Some(None)` if that case has no value.
+    pub fn err(&self) -> Option<Option<&TypeShape>> {
+        match self {
+            ResultShape::Result { err, .. } => Some(err.as_deref()),
+            _ => None,
+        }
+    }
+}
+
+/// Specification for an export that must be resolved during initialization.
+pub struct ExportSpec {
+    /// Name of the WIT interface, or `None` for top-level exports.
+    pub interface: Option<String>,
+    /// Unqualified name of the export within the interface or top-level namespace.
+    pub name: String,
+    /// The shapes in which the main module may export the export's item (see
+    /// [`wit_name_mapping::item_js_name`]), as returned by
+    /// [`wit_name_mapping::possible_export_names`].
+    pub shapes: Vec<Shape>,
+    pub result: ResultShape,
+    /// Whether the main module may leave the export out. Calling an export that
+    /// was left out panics.
+    pub optional: bool,
+}
+
+/// Description of a resolved export.
+struct ExportedFunction {
+    kind: ExportedFunctionKind,
+    /// The callable: the function, the class for a constructor, or the name of
+    /// a method. Undefined for an absent export.
+    function: RootedHeap<Value>,
+    /// The receiver for a plain function (the namespace or interface object) or
+    /// a static (the class). `None` for the other kinds.
+    this: Option<RootedHeap<js::object::Object>>,
+    result: ResultShape,
+}
+
+#[derive(Clone, Copy)]
+enum ExportedFunctionKind {
+    Plain,
+    Method,
+    Static,
+    Constructor,
+    /// An [`optional`](ExportSpec::optional) export the main module left out.
+    Absent,
+}
+
+/// The world's exported functions, including the constructors, methods and
+/// static functions of exported resources, resolved after the main module is
+/// evaluated. The entries are indexed by each function's position in the
+/// wit-dylib export table.
+pub struct ExportTable {
+    entries: Vec<ExportedFunction>,
+}
+
+js::instance_local! {
+    /// The table built by [`install_table`].
+    static EXPORT_TABLE: RefCell<Option<ExportTable>> = const { RefCell::new(None) };
+}
+
+impl ExportTable {
+    /// Resolve each of `specs` against the main module's namespace `ns`.
+    ///
+    /// The main module must export each spec's item in exactly one of the
+    /// spec's shapes. Fails with an error message if an item is exported in more
+    /// than one shape, or if an item that isn't
+    /// [`optional`](ExportSpec::optional) isn't exported. The message for a
+    /// missing item lists the names under which it can be exported.
+    pub fn build(
+        scope: &Scope<'_>,
+        ns: &Object<'_>,
+        specs: impl IntoIterator<Item = ExportSpec>,
+    ) -> Result<ExportTable, String> {
+        let mut entries = Vec::new();
+        for spec in specs {
+            let Some(container) = find_provider(scope, ns, &spec)? else {
+                if !spec.optional {
+                    return Err(missing_export_message(&spec));
+                }
+                entries.push(ExportedFunction {
+                    kind: ExportedFunctionKind::Absent,
+                    function: RootedHeap::from(js::value::undefined()),
+                    this: None,
+                    result: spec.result,
+                });
+                continue;
+            };
+            // The item is there, so a missing member is a missing class member.
+            let resolved =
+                resolve_member(scope, &container, &spec.name).map_err(|error| match error {
+                    ResolveError::Missing(_) => missing_export_message(&spec),
+                    ResolveError::Threw(_) => {
+                        let message = ExnThrown::capture(scope).message.unwrap_or_default();
+                        format!(
+                            "resolving the WIT export `{}` threw: {message}",
+                            wit_name(&spec)
+                        )
+                    }
+                })?;
+            let entry =
+                |kind, function: HandleValue<'_>, this: Option<Object<'_>>| ExportedFunction {
+                    kind,
+                    function: RootedHeap::from(function.get()),
+                    this: this.map(RootedHeap::new),
+                    result: spec.result,
+                };
+            entries.push(match resolved {
+                Resolved::Plain { function, this } => {
+                    entry(ExportedFunctionKind::Plain, function, Some(this))
+                }
+                Resolved::Method { name } => entry(ExportedFunctionKind::Method, name, None),
+                Resolved::Static { function, class } => {
+                    entry(ExportedFunctionKind::Static, function, Some(class))
+                }
+                Resolved::Constructor { class } => {
+                    entry(ExportedFunctionKind::Constructor, class, None)
+                }
+            });
+        }
+        Ok(ExportTable { entries })
+    }
+
+    /// The resolved callable for export `index`, rooted on `scope`.
+    ///
+    /// # Panics
+    ///
+    /// Panics if `index` is past the end of the table, or names an
+    /// [`optional`](ExportSpec::optional) export the main module left out.
+    pub fn resolved<'s>(&self, scope: &'s Scope<'_>, index: usize) -> Resolved<'s> {
+        let entry = &self.entries[index];
+        let function = entry.function.get(scope);
+        let this = || {
+            entry
+                .this
+                .as_ref()
+                .expect("a plain or static export has a receiver")
+                .get(scope)
+        };
+        match entry.kind {
+            ExportedFunctionKind::Plain => Resolved::Plain {
+                function,
+                this: this(),
+            },
+            ExportedFunctionKind::Method => Resolved::Method { name: function },
+            ExportedFunctionKind::Static => Resolved::Static {
+                function,
+                class: this(),
+            },
+            ExportedFunctionKind::Constructor => Resolved::Constructor { class: function },
+            ExportedFunctionKind::Absent => {
+                panic!("export {index} was left out by the main module")
+            }
+        }
+    }
+
+    /// Whether the main module provides export `index`. Only an
+    /// [`optional`](ExportSpec::optional) export can be missing.
+    ///
+    /// # Panics
+    ///
+    /// Panics if `index` is past the end of the table.
+    pub fn provided(&self, index: usize) -> bool {
+        !matches!(self.entries[index].kind, ExportedFunctionKind::Absent)
+    }
+
+    /// The result shape of export `index`.
+    ///
+    /// # Panics
+    ///
+    /// Panics if `index` is past the end of the table.
+    pub fn result(&self, index: usize) -> ResultShape {
+        self.entries[index].result.clone()
+    }
+
+    pub fn len(&self) -> usize {
+        self.entries.len()
+    }
+
+    pub fn is_empty(&self) -> bool {
+        self.entries.is_empty()
+    }
+}
+
+/// Build the table for `specs` and install it for [`with_export_table`].
+///
+/// Returns the error message of [`ExportTable::build`] on failure.
+pub fn install_table(
+    scope: &Scope<'_>,
+    ns: &Object<'_>,
+    specs: impl IntoIterator<Item = ExportSpec>,
+) -> Result<(), String> {
+    let table = ExportTable::build(scope, ns, specs)?;
+    EXPORT_TABLE.with(|cell| *cell.borrow_mut() = Some(table));
+    Ok(())
+}
+
+/// Run `f` with the installed table.
+///
+/// # Panics
+///
+/// Panics if [`install_table`] has not run.
+pub fn with_export_table<R>(f: impl FnOnce(&ExportTable) -> R) -> R {
+    EXPORT_TABLE.with(|cell| {
+        f(cell
+            .borrow()
+            .as_ref()
+            .expect("the export table is installed at init"))
+    })
+}
+
+/// Drop the installed table. See [`crate::tracing::clear_traced_roots`].
+pub(crate) fn clear_traced_roots() {
+    EXPORT_TABLE.with(|cell| *cell.borrow_mut() = None);
+}
+
+/// The WIT name of `spec`'s export, such as `ns:pkg/iface#name`.
+fn wit_name(spec: &ExportSpec) -> String {
+    wit_name_mapping::function_wit_name(spec.interface.as_deref(), &spec.name)
+}
+
+/// Return the object that has `spec`'s item as a property, or `None` if no
+/// shape has it. Fails if more than one shape has the item, or if reading a
+/// property throws.
+fn find_provider<'s>(
+    scope: &'s Scope<'_>,
+    ns: &Object<'s>,
+    spec: &ExportSpec,
+) -> Result<Option<Object<'s>>, String> {
+    let item = item_js_name(&spec.name);
+    let key = to_cstring(&item);
+    let mut found: Option<(&Shape, Object<'s>)> = None;
+    for shape in &spec.shapes {
+        let path = shape.path(&item);
+        let read_failed = |_| {
+            let message = ExnThrown::capture(scope).message.unwrap_or_default();
+            format!(
+                "reading `{path}` for the WIT export `{}` threw: {message}",
+                wit_name(spec)
+            )
+        };
+        let Some(container) = shape_container(scope, ns, shape).map_err(read_failed)? else {
+            continue;
+        };
+        if container
+            .get_property_by_name(scope, &key)
+            .map_err(read_failed)?
+            .is_undefined()
+        {
+            continue;
+        }
+        if let Some((first, _)) = &found {
+            return Err(format!(
+                "the main module provides the WIT export `{}` twice, as `{}` and as `{path}`. \
+                 Export it in one shape only",
+                wit_name(spec),
+                first.path(&item)
+            ));
+        }
+        found = Some((shape, container));
+    }
+    Ok(found.map(|(_, container)| container))
+}
+
+/// Return the object that has the items of `shape` as properties: `ns` for
+/// [`Shape::Bare`], or an object nested in `ns` for the other shapes. Returns
+/// `None` if a nested object is missing or isn't an object.
+fn shape_container<'s>(
+    scope: &'s Scope<'_>,
+    ns: &Object<'s>,
+    shape: &Shape,
+) -> Result<Option<Object<'s>>, ExnThrown> {
+    let member = |object: &Object<'s>, name: &str| -> Result<Option<Object<'s>>, ExnThrown> {
+        let value = object.get_property_by_name(scope, &to_cstring(name))?;
+        Ok(Object::from_value(scope, value).ok())
+    };
+    match shape {
+        Shape::Bare => Ok(Some(*ns)),
+        Shape::Interface(interface) | Shape::Versioned(interface) => member(ns, interface),
+        Shape::Package { package, interface } => match member(ns, package)? {
+            Some(package) => member(&package, interface),
+            None => Ok(None),
+        },
+    }
+}
+
+/// Return the error message for an export that the main module doesn't
+/// provide. It names the missing item, lists the names under which it can be
+/// exported, and gives an example export statement.
+fn missing_export_message(spec: &ExportSpec) -> String {
+    let item = item_js_name(&spec.name);
+    // A description of the missing item and, for a resource, an example class
+    // body.
+    let (member, class_body) = match FunctionName::parse(&spec.name) {
+        FunctionName::Constructor { .. } => (
+            format!("a class `{item}` with a constructor"),
+            Some("constructor(...) { ... }".to_string()),
+        ),
+        FunctionName::Method { name, .. } => {
+            let method = mangle_name(name);
+            (
+                format!("a class `{item}` with a method `{method}`"),
+                Some(format!("{method}(...) {{ ... }}")),
+            )
+        }
+        FunctionName::Static { name, .. } => {
+            let method = mangle_name(name);
+            (
+                format!("a class `{item}` with a static method `{method}`"),
+                Some(format!("static {method}(...) {{ ... }}")),
+            )
+        }
+        FunctionName::Plain(_) => (format!("a function `{item}`"), None),
+    };
+    // The item as a member of an object literal.
+    let in_object = match &class_body {
+        Some(body) => format!("{item}: class {{ {body} }}"),
+        None => format!("{item}(...) {{ ... }}"),
+    };
+    let statement = match spec.shapes.last() {
+        Some(Shape::Package { package, interface }) => {
+            format!("export const {package} = {{ {interface}: {{ {in_object} }} }};")
+        }
+        Some(Shape::Interface(interface)) => {
+            format!("export const {interface} = {{ {in_object} }};")
+        }
+        Some(Shape::Versioned(wit_name)) => {
+            format!("const impl = {{ {in_object} }}; export {{ impl as \"{wit_name}\" }};")
+        }
+        Some(Shape::Bare) | None => match &class_body {
+            Some(body) => format!("export class {item} {{ {body} }}"),
+            None => format!("export function {item}(...) {{ ... }}"),
+        },
+    };
+    let paths: Vec<String> = spec
+        .shapes
+        .iter()
+        .map(|shape| format!("`{}`", shape.path(&item)))
+        .collect();
+    format!(
+        "the main module does not provide {member} for the WIT export `{}`. Export it as {}, \
+         for example: {statement}",
+        wit_name(spec),
+        paths.join(" or ")
+    )
+}
+
+/// A resolved export: the JavaScript function, and the values needed to call
+/// it.
+pub enum Resolved<'s> {
+    /// A plain exported function, invoked with the namespace object as `this`.
+    Plain {
+        function: HandleValue<'s>,
+        this: Object<'s>,
+    },
+    /// An instance method (`[method]R.m`), which `R.prototype` must have. `name`
+    /// is the method's JS name. The method is looked up on the receiver, which
+    /// is the first argument, at each call, so an override in a subclass is
+    /// called.
+    Method { name: HandleValue<'s> },
+    /// A static method (`[static]R.m`), invoked with the constructor as `this`.
+    Static {
+        function: HandleValue<'s>,
+        class: Object<'s>,
+    },
+    /// A resource constructor (`[constructor]R`), invoked via `new`.
+    Constructor { class: HandleValue<'s> },
+}
+
+/// The result of an export call.
+pub enum Outcome<'s> {
+    /// The call returned normally, with the return value.
+    Returned(HandleValue<'s>),
+    /// The call threw or its promise rejected, and the export's result type is
+    /// a `result`. Holds the `err` value converted from the exception.
+    Threw(HandleValue<'s>),
+}
+
+/// The method named `name` on `receiver`, which must be a function.
+fn method_on<'s>(
+    scope: &'s Scope<'_>,
+    receiver: HandleValue<'_>,
+    name: HandleValue<'_>,
+) -> Result<HandleValue<'s>, ExnThrown> {
+    let receiver = Object::from_value(scope, receiver)
+        .map_err(|_| throw_type_error(scope, c"a resource method's receiver is not an object"))?;
+    let id = scope.root_id(js::id::value_to_id(scope, name)?);
+    let method = receiver.get_property_by_id(scope, id)?;
+    if !js::function::is_callable(method) {
+        let name = String::from_jsval_throwing(scope, name, ())?;
+        return Err(js::error::TypeError(format!(
+            "the resource's `{name}` method is not a function"
+        ))
+        .throw(scope));
+    }
+    Ok(method)
+}
+
+/// Resolve the export `name` to a JavaScript function.
+///
+/// `container` is the object that has the export's item as a property: the
+/// main module's namespace, or an object nested in it. `name` is the WIT export
+/// name, which can start with `[constructor]`, `[method]` or `[static]`.
+///
+/// Throws a `TypeError` if the function, class or method is missing. An
+/// exception thrown by a getter is left pending.
+pub fn resolve_export<'s>(
+    scope: &'s Scope<'_>,
+    container: &Object<'s>,
+    name: &str,
+) -> Result<Resolved<'s>, ExnThrown> {
+    resolve_member(scope, container, name).map_err(|error| match error {
+        ResolveError::Missing(message) => throw_type_error(scope, message),
+        ResolveError::Threw(exn) => exn,
+    })
+}
+
+/// Why [`resolve_member`] failed.
+enum ResolveError {
+    /// The export is missing. The string describes what is missing.
+    Missing(&'static std::ffi::CStr),
+    /// Reading the export threw. The exception is pending.
+    Threw(ExnThrown),
+}
+
+impl From<ExnThrown> for ResolveError {
+    fn from(exn: ExnThrown) -> Self {
+        ResolveError::Threw(exn)
+    }
+}
+
+/// Like [`resolve_export`], but reports a missing export instead of throwing.
+fn resolve_member<'s>(
+    scope: &'s Scope<'_>,
+    container: &Object<'s>,
+    name: &str,
+) -> Result<Resolved<'s>, ResolveError> {
+    let container = *container;
+
+    match FunctionName::parse(name) {
+        FunctionName::Constructor { resource } => {
+            let class = lookup_class(scope, &container, resource)?;
+            Ok(Resolved::Constructor { class })
+        }
+        FunctionName::Method { resource, name } => {
+            let class_obj = lookup_class_object(scope, &container, resource)?;
+            let proto = class_obj.get_property(scope, c"prototype")?;
+            let proto_obj = Object::from_value(scope, proto)
+                .map_err(|_| ResolveError::Missing(c"resource class has no prototype object"))?;
+            let member = mangle_name(name);
+            lookup_member(scope, &proto_obj, &member)?;
+            let name = js::JSString::from_str(scope, &member)?;
+            Ok(Resolved::Method {
+                name: scope.root_value(name.as_value()),
+            })
+        }
+        FunctionName::Static { resource, name } => {
+            let class_obj = lookup_class_object(scope, &container, resource)?;
+            let function = lookup_member(scope, &class_obj, &mangle_name(name))?;
+            Ok(Resolved::Static {
+                function,
+                class: class_obj,
+            })
+        }
+        FunctionName::Plain(name) => {
+            let function = lookup_member(scope, &container, &mangle_name(name))?;
+            Ok(Resolved::Plain {
+                function,
+                this: container,
+            })
+        }
+    }
+}
+
+/// Call a resolved export.
+///
+/// `args` are the lifted arguments. For [`Resolved::Method`], `args[0]` is the
+/// receiver, passed as `this`, and `args[1..]` are the method arguments. For
+/// the other variants, `args` are the arguments in order.
+///
+/// If the call throws and `result` is a `result`, the exception is converted
+/// into an `err` value (see `component_error::err_payload`), which is returned
+/// as [`Outcome::Threw`]. Otherwise, `Err` holds the captured exception. If the
+/// exception can't be converted, its message includes the reason.
+///
+/// A returned promise is marked as handled, so that its rejection isn't
+/// reported as unhandled.
+pub fn call_export<'s>(
+    scope: &'s Scope<'_>,
+    resolved: Resolved<'s>,
+    args: &[HandleValue<'s>],
+    result: &ResultShape,
+) -> Result<Outcome<'s>, CapturedError> {
+    let call_result: Result<HandleValue<'s>, ExnThrown> = match resolved {
+        Resolved::Plain { function, this } => Function::call(scope, this, function, args),
+        Resolved::Static { function, class } => Function::call(scope, class, function, args),
+        Resolved::Method { name } => {
+            let this = args.first().copied().unwrap_or(HandleValue::undefined());
+            let rest = args.get(1..).unwrap_or(&[]);
+            method_on(scope, this, name)
+                .and_then(|function| Function::call(scope, this, function, rest))
+        }
+        Resolved::Constructor { class } => {
+            Function::construct(scope, class, args).map(|obj| scope.root_value(obj.as_value()))
+        }
+    };
+
+    match call_result {
+        Ok(value) => {
+            if let Ok(promise) = js::Promise::from_jsval(scope, value, ()) {
+                promise
+                    .set_any_is_handled(scope)
+                    .map_err(|_| ExnThrown::capture(scope))?;
+            }
+            Ok(Outcome::Returned(value))
+        }
+        Err(ExnThrown) => {
+            let pending = js::exception::get_pending(scope);
+            // `err_payload` requires that no exception is pending, so the
+            // exception is captured first. The capture keeps the stack and error
+            // report for a trap.
+            let mut captured = ExnThrown::capture(scope);
+            if let (Some(err), Some(pending)) = (result.err(), pending) {
+                match crate::component_error::err_payload(scope, pending, err) {
+                    Ok(payload) => return Ok(Outcome::Threw(payload)),
+                    Err(why) => {
+                        let message = captured.message.take();
+                        let message = message.as_deref().unwrap_or("JavaScript exception");
+                        captured.message = Some(format!(
+                            "{message} (not converted into an `err` value: {why})"
+                        ));
+                    }
+                }
+            }
+            Err(captured)
+        }
+    }
+}
+
+/// Convert the settled promise returned by an async export into an
+/// [`Outcome`]. A rejection is handled like an exception thrown in
+/// [`call_export`].
+///
+/// Returns `Err` with an error message if the export's result type isn't a
+/// `result`, or if the rejection reason can't be converted into an `err` value.
+/// The message includes the reason's message and stack.
+///
+/// # Panics
+///
+/// Panics if `promise` is pending.
+pub fn settled_promise_outcome<'s>(
+    scope: &'s Scope<'_>,
+    promise: &js::Promise<'s>,
+    result_shape: &ResultShape,
+) -> Result<Outcome<'s>, String> {
+    let result = promise
+        .result(scope)
+        .expect("settled promise has a result value");
+    if !promise.is_rejected() {
+        return Ok(Outcome::Returned(result));
+    }
+    if let Some(err) = result_shape.err() {
+        return match crate::component_error::err_payload(scope, result, err) {
+            Ok(payload) => Ok(Outcome::Threw(payload)),
+            Err(why) => Err(rejection_message(
+                scope,
+                result,
+                &format!(
+                    "async export rejected with a reason that can't be converted into its \
+                     `err` value ({why})"
+                ),
+            )),
+        };
+    }
+    Err(rejection_message(
+        scope,
+        result,
+        "non-`result` async export rejected",
+    ))
+}
+
+/// Formats `context`, followed by the message, location and stack of the rejection `reason`.
+pub(crate) fn rejection_message(
+    scope: &Scope<'_>,
+    reason: HandleValue<'_>,
+    context: &str,
+) -> String {
+    capture_value(scope, reason).with_context(context)
+}
+
+/// Captures `value` as an uncaught exception, with the message and stack that
+/// an uncaught exception reports.
+pub(crate) fn capture_value(scope: &Scope<'_>, value: HandleValue<'_>) -> CapturedError {
+    js::exception::set_pending(
+        scope,
+        value,
+        js::native::ExceptionStackBehavior::DoNotCapture,
+    );
+    ExnThrown::capture(scope)
+}
+
+/// Whether `value` is a settled promise or isn't a promise.
+#[cfg(target_arch = "wasm32")]
+pub(crate) fn promise_is_settled(scope: &Scope<'_>, value: HandleValue<'_>) -> bool {
+    match js::Promise::from_jsval(scope, value, ()) {
+        Ok(promise) => !promise.is_pending(),
+        Err(_) => true,
+    }
+}
+
+/// Look up the class of the resource `ty` on `container`. Fails if the
+/// property is `undefined`.
+fn lookup_class<'s>(
+    scope: &'s Scope<'_>,
+    container: &Object<'s>,
+    ty: &str,
+) -> Result<HandleValue<'s>, ResolveError> {
+    let key = to_cstring(&mangle_resource_name(ty));
+    let value = container.get_property_by_name(scope, &key)?;
+    if value.is_undefined() {
+        return Err(ResolveError::Missing(
+            c"exported resource class is not defined",
+        ));
+    }
+    Ok(value)
+}
+
+/// Like [`lookup_class`], but also fails if the class isn't an object.
+fn lookup_class_object<'s>(
+    scope: &'s Scope<'_>,
+    container: &Object<'s>,
+    ty: &str,
+) -> Result<Object<'s>, ResolveError> {
+    let class = lookup_class(scope, container, ty)?;
+    Object::from_value(scope, class)
+        .map_err(|_| ResolveError::Missing(c"resource class is not an object"))
+}
+
+/// Look up the property `mangled` of `container`. Fails if it is `undefined`.
+fn lookup_member<'s>(
+    scope: &'s Scope<'_>,
+    container: &Object<'s>,
+    mangled: &str,
+) -> Result<HandleValue<'s>, ResolveError> {
+    let key = to_cstring(mangled);
+    let value = container.get_property_by_name(scope, &key)?;
+    if value.is_undefined() {
+        return Err(ResolveError::Missing(c"exported member is not defined"));
+    }
+    Ok(value)
+}
diff --git a/crates/wit-bridge/src/imports.rs b/crates/wit-bridge/src/imports.rs
new file mode 100644
index 00000000..2b4bbaed
--- /dev/null
+++ b/crates/wit-bridge/src/imports.rs
@@ -0,0 +1,766 @@
+// SPDX-License-Identifier: Apache-2.0-WITH-LLVM-exception
+
+//! The ES modules that provide the component's imports to JavaScript, and
+//! calls to the imports.
+//!
+//! The application imports WIT functions and resources from ES modules named
+//! after their WIT interfaces, such as `import { f } from "test:iface/x"`.
+//! [`synthesize_import_modules`] creates these modules from a [`WorldDesc`].
+//!
+//! The import calls are made by an [`ImportInvoker`], which lowers the
+//! arguments, calls the host and lifts the result. [`call_import_from_js`] and
+//! [`call_import_from_js_async`] check the arguments and push them onto a
+//! [`CallStack`] for the invoker, and pop the lifted result off it.
+
+use std::cell::{Cell, RefCell};
+use std::rc::Rc;
+
+use js::error::{throw_type_error, ExnThrown, ThrowException};
+use js::gc::scope::Scope;
+use js::native::Value;
+use js::prelude::HandleValue;
+use js::{Function, Object};
+
+use wit_name_mapping::{mangle_name, mangle_resource_name, FunctionName, WORLD_MODULE_NAME};
+
+use crate::component_error::ErrorClass;
+use crate::stack::CallStack;
+use crate::value::{to_cstring, TypeShape, ENUMERATE};
+
+/// A description of a component's imports. Interfaces and functions have
+/// their WIT names, which [`synthesize_import_modules`] converts to JS names.
+#[derive(Clone, Debug, Default)]
+pub struct WorldDesc {
+    /// One entry per imported interface, plus at most one world-level entry
+    /// (whose [`InterfaceDesc::wit_name`] is `None`) for imports defined
+    /// directly on the world.
+    pub interfaces: Vec<InterfaceDesc>,
+    /// The error classes of types defined by interfaces that the world exports
+    /// but doesn't import. They are created, but no module exports them.
+    pub unexported_error_classes: Vec<ErrorClass>,
+}
+
+/// One imported interface, or the imports defined directly on the world.
+#[derive(Clone, Debug, Default)]
+pub struct InterfaceDesc {
+    /// The interface's WIT name, such as `test:iface/x@0.2.0`, which is the
+    /// specifier of its module. `None` for the imports defined on the world,
+    /// whose module is [`WORLD_MODULE_NAME`].
+    pub wit_name: Option<String>,
+    /// The imported functions of the interface that don't belong to a
+    /// resource.
+    pub functions: Vec<ImportFuncDesc>,
+    /// Imported resource types on this interface.
+    pub resources: Vec<ResourceTypeDesc>,
+    /// The error classes of the types defined by the interface. The module
+    /// exports them.
+    pub error_classes: Vec<ErrorClass>,
+    /// The enum and flags types defined or `use`d by the interface. The module
+    /// exports an object for each.
+    pub enums: Vec<EnumDesc>,
+}
+
+/// An enum or flags type, which its interface's module exports as a frozen
+/// object. The object maps each case's JS name to its value, and each value
+/// back to the name, as a TypeScript numeric enum does.
+#[derive(Clone, Debug)]
+pub struct EnumDesc {
+    /// The name under which the module exports the object: the type's name
+    /// in the interface, upper-camel-cased.
+    pub js_name: String,
+    /// Each case's JS name and value. An enum case's value is its index, and a
+    /// flag's is its bit, as an int32.
+    pub members: Vec<(String, i32)>,
+}
+
+/// One imported function: its index and its WIT signature.
+#[derive(Clone, Debug)]
+pub struct ImportFuncDesc {
+    /// The function's index among all of the component's imported functions.
+    pub index: u32,
+    /// The WIT name, which can start with `[constructor]`, `[method]` or
+    /// `[static]`.
+    pub name: String,
+    /// Parameter types, in declaration order. For a `[method]`, the first
+    /// parameter is the resource's `self` (a `borrow`).
+    pub params: Vec<TypeShape>,
+    /// The result type, or `None` for a function returning nothing.
+    pub result: Option<TypeShape>,
+    /// The error class of the `err` case, if the result type is a `result`
+    /// whose `err` type has its own class.
+    pub err_class: Option<ErrorClass>,
+    /// Whether the function is declared `async` in WIT.
+    pub is_async: bool,
+}
+
+/// One imported resource type and the import functions implementing its
+/// constructor, methods, and statics.
+#[derive(Clone, Debug)]
+pub struct ResourceTypeDesc {
+    /// The resource type's index, or `u32::MAX` if it has none.
+    pub type_idx: u32,
+    /// The WIT resource name (`"my-resource"`), upper-camel-cased to the JS class
+    /// name during synthesis.
+    pub name: String,
+    /// The import implementing `[constructor]name`, if any.
+    pub constructor: Option<ImportFuncDesc>,
+    /// The imports implementing `[method]name.m`, each with the method's JS
+    /// name.
+    pub methods: Vec<(String, ImportFuncDesc)>,
+    /// The imports implementing `[static]name.m`, each with the function's JS
+    /// name.
+    pub statics: Vec<(String, ImportFuncDesc)>,
+}
+
+/// Makes import calls: lowers the arguments, calls the host, and lifts the
+/// result.
+///
+/// The methods receive a stack holding the JS arguments, with the first
+/// argument on top. They must leave exactly one value, the lifted result, on
+/// the stack.
+pub trait ImportInvoker {
+    /// Make a synchronous import call.
+    fn invoke(
+        &self,
+        scope: &Scope<'_>,
+        stack: &mut CallStack,
+        func: &ImportFuncDesc,
+    ) -> Result<(), ExnThrown>;
+
+    /// Whether this invoker implements [`invoke_async`](Self::invoke_async). If
+    /// it doesn't, calling an async import throws a `TypeError`.
+    fn supports_async(&self) -> bool {
+        false
+    }
+
+    /// Make a call to an async import. The returned future resolves to the
+    /// stack, with the lifted result on top.
+    ///
+    /// The default implementation panics.
+    fn invoke_async(
+        &self,
+        stack: CallStack,
+        func: Rc<ImportFuncDesc>,
+    ) -> std::pin::Pin<Box<dyn std::future::Future<Output = CallStack> + 'static>> {
+        let _ = (stack, func);
+        panic!("invoke_async called on an invoker whose supports_async() is false");
+    }
+
+    /// Drop `handle`, a handle of the exported resource type `type_idx` that was
+    /// created to lend a resource to the host for one import call. Called for
+    /// each such handle when the call ends. The default implementation does
+    /// nothing.
+    fn drop_exported_handle(&self, type_idx: u32, handle: u32) {
+        let _ = (type_idx, handle);
+    }
+}
+
+/// The imported functions of the world, and the invoker that calls them.
+struct ImportRegistry {
+    /// Indexed by [`ImportFuncDesc::index`]. A `None` entry has no function.
+    funcs: Vec<Option<Rc<ImportFuncDesc>>>,
+    /// The invoker shared by every import in this world.
+    invoker: Rc<dyn ImportInvoker>,
+}
+
+js::instance_local! {
+    /// The import registry, set by [`synthesize_import_modules`].
+    static IMPORTS: RefCell<Option<ImportRegistry>> = const { RefCell::new(None) };
+
+    /// Whether calling an import throws, set by [`set_imports_unavailable`].
+    static IMPORTS_UNAVAILABLE: Cell<bool> = const { Cell::new(false) };
+}
+
+/// Make every import call throw a `TypeError` while `unavailable` is set.
+/// Imports are unavailable while the application is being initialized, before
+/// the component is wizened.
+pub fn set_imports_unavailable(unavailable: bool) {
+    IMPORTS_UNAVAILABLE.with(|cell| cell.set(unavailable));
+}
+
+/// Throw if imports are unavailable (see [`set_imports_unavailable`]).
+fn check_imports_available(scope: &Scope<'_>, func: &ImportFuncDesc) -> Result<(), ExnThrown> {
+    if !IMPORTS_UNAVAILABLE.with(Cell::get) {
+        return Ok(());
+    }
+    Err(js::error::TypeError(format!(
+        "the import `{}` was called while the application initializes, before the component \
+         is wizened, where imports are unavailable. Call it from an export instead",
+        js_import_name(&func.name)
+    ))
+    .throw(scope))
+}
+
+/// Look up an import and the invoker by the import's index. Throws a
+/// `TypeError` if there is no import with that index.
+fn lookup_import(
+    scope: &Scope<'_>,
+    index: u32,
+) -> Result<(Rc<ImportFuncDesc>, Rc<dyn ImportInvoker>), ExnThrown> {
+    IMPORTS
+        .with(|cell| {
+            let borrow = cell.borrow();
+            let reg = borrow.as_ref()?;
+            let func = reg.funcs.get(index as usize)?.clone()?;
+            Some((func, Rc::clone(&reg.invoker)))
+        })
+        .ok_or_else(|| throw_type_error(scope, c"import function index is not registered"))
+}
+
+/// Call the imported function with the index `index`, with the JS arguments
+/// `args`. For a method, `args[0]` is the receiver.
+///
+/// Returns the lifted result, which isn't rooted, so it must not be held across
+/// an allocation.
+pub fn call_import_from_js(
+    scope: &Scope<'_>,
+    index: u32,
+    args: &[HandleValue<'_>],
+) -> Result<Value, ExnThrown> {
+    let (func, invoker) = lookup_import(scope, index)?;
+    call_import(scope, &func, invoker.as_ref(), args, args.len())
+}
+
+/// Like [`call_import_from_js`], for the import `func`, called with `argc`
+/// arguments. `args` holds the arguments if `argc` equals the import's arity,
+/// and may be empty otherwise.
+fn call_import(
+    scope: &Scope<'_>,
+    func: &ImportFuncDesc,
+    invoker: &dyn ImportInvoker,
+    args: &[HandleValue<'_>],
+    argc: usize,
+) -> Result<Value, ExnThrown> {
+    check_imports_available(scope, func)?;
+    let mut stack = push_import_args(scope, func, args, argc)?;
+
+    // The result is rooted while the borrows are released, which runs JS.
+    let result = invoker
+        .invoke(scope, &mut stack, func)
+        .and_then(|()| {
+            handle_import_result(
+                scope,
+                &mut stack,
+                func.result.as_ref(),
+                func.err_class.as_ref(),
+            )
+        })
+        .map(|value| scope.root_value(value));
+    release_call_borrows(&mut stack, scope, invoker);
+    result.map(|value| value.get())
+}
+
+/// Check `args` against `func`'s parameters, and push their snapshots (see
+/// [`crate::validate::snapshot_arguments`]) onto a new stack, with the first
+/// argument on top.
+///
+/// Throws a `TypeError` naming the import and the argument if `argc` isn't
+/// `func`'s arity, or if an argument can't be lowered to its parameter's type.
+fn push_import_args(
+    scope: &Scope<'_>,
+    func: &ImportFuncDesc,
+    args: &[HandleValue<'_>],
+    argc: usize,
+) -> Result<CallStack, ExnThrown> {
+    let is_method = matches!(FunctionName::parse(&func.name), FunctionName::Method { .. });
+    if argc != func.params.len() {
+        let expected = func.params.len().saturating_sub(usize::from(is_method));
+        return Err(js::error::TypeError(format!(
+            "`{}` takes {expected} argument{}, got {}",
+            js_import_name(&func.name),
+            if expected == 1 { "" } else { "s" },
+            argc.saturating_sub(usize::from(is_method)),
+        ))
+        .throw(scope));
+    }
+    // Each argument is lowered from its snapshot, so a getter that returns
+    // something else on a second read cannot make the lowering trap. The
+    // resource wrappers the snapshots hold are checked after all arguments were
+    // read, so a getter cannot dispose of one between its check and the
+    // lowering.
+    let snapshots = crate::validate::snapshot_arguments(scope, args, &func.params).map_err(
+        |(index, mismatch)| {
+            let what = match (is_method, index) {
+                (true, 0) => format!("the receiver of `{}`", js_import_name(&func.name)),
+                (true, _) => format!("argument {index} of `{}`", js_import_name(&func.name)),
+                (false, _) => {
+                    format!("argument {} of `{}`", index + 1, js_import_name(&func.name))
+                }
+            };
+            js::error::TypeError(mismatch.describe(&what)).throw(scope)
+        },
+    )?;
+    let mut stack = CallStack::new();
+    for snapshot in snapshots.into_iter().rev() {
+        stack.push_shaped(snapshot);
+    }
+    Ok(stack)
+}
+
+/// An import's WIT function name as the guest calls it: `thing.method` for a
+/// resource's method or static function, `new thing` for its constructor, and
+/// the name itself otherwise.
+pub(crate) fn js_import_name(wit_name: &str) -> String {
+    match FunctionName::parse(wit_name) {
+        FunctionName::Constructor { resource } => format!("new {}", mangle_resource_name(resource)),
+        FunctionName::Method { resource, name } | FunctionName::Static { resource, name } => {
+            format!("{}.{}", mangle_resource_name(resource), mangle_name(name))
+        }
+        FunctionName::Plain(name) => mangle_name(name),
+    }
+}
+
+/// Release the exported resources lent to the host as `borrow` arguments of an
+/// import call, after the call's result is lifted.
+///
+/// A pending exception is set aside while the borrows are released, and
+/// restored afterwards. An exception thrown while releasing them is reported
+/// and cleared.
+fn release_call_borrows(stack: &mut CallStack, scope: &Scope<'_>, invoker: &dyn ImportInvoker) {
+    let pending = js::exception::take_pending(scope);
+
+    if crate::resources::release_borrows(stack, scope, &|type_idx, handle| {
+        invoker.drop_exported_handle(type_idx, handle)
+    })
+    .is_err()
+    {
+        js::exception::report_and_clear(scope, "releasing an import call's borrows");
+    }
+
+    if let Some(exn) = pending {
+        js::exception::set_pending(scope, exn, js::native::ExceptionStackBehavior::Capture);
+    }
+}
+
+/// Like [`call_import_from_js`], for an async import. Returns a promise that
+/// settles when the host call completes. The call runs on the event loop that
+/// is active when the import is called.
+///
+/// The promise is rejected with a `TypeError` if no event loop is active, if
+/// imports are unavailable, or if an argument can't be lowered. For the `err`
+/// case of a `result`, it is rejected with the error that
+/// [`call_import_from_js`] throws.
+///
+/// The arguments are lowered before this returns, so JavaScript that runs
+/// afterwards can't change what the host receives.
+pub fn call_import_from_js_async(
+    scope: &Scope<'_>,
+    index: u32,
+    args: &[HandleValue<'_>],
+) -> Result<Value, ExnThrown> {
+    let (func, invoker) = lookup_import(scope, index)?;
+    call_import_async(scope, func, invoker, args, args.len())
+}
+
+/// Like [`call_import_from_js_async`], for the import `func`, called with
+/// `argc` arguments as for [`call_import`].
+fn call_import_async(
+    scope: &Scope<'_>,
+    func: Rc<ImportFuncDesc>,
+    invoker: Rc<dyn ImportInvoker>,
+    args: &[HandleValue<'_>],
+    argc: usize,
+) -> Result<Value, ExnThrown> {
+    use js::promise::{PromiseFuture, PromiseOutcome};
+
+    // The default `invoke_async` panics.
+    if !invoker.supports_async() {
+        return Err(throw_type_error(
+            scope,
+            c"async import dispatched to an invoker that does not support async imports",
+        ));
+    }
+
+    let promise = js::Promise::new_pending(scope)?;
+    // A call that cannot start rejects the promise with the `TypeError`
+    // explaining why, rather than throwing, so a `.catch` on the call's result
+    // handles it.
+    if check_imports_available(scope, &func).is_err() {
+        promise.reject_with_pending(scope)?;
+        return Ok(promise.as_value());
+    }
+    // The call's future requires an event loop.
+    if !core_runtime::event_loop::has_active_event_loop() {
+        let what = format!("the async import `{}`", js_import_name(&func.name));
+        if core_runtime::event_loop::reject_without_event_loop(scope, &promise, &what)? {
+            return Ok(promise.as_value());
+        }
+    }
+    let stack = match push_import_args(scope, &func, args, argc) {
+        Ok(stack) => stack,
+        Err(ExnThrown) => {
+            promise.reject_with_pending(scope)?;
+            return Ok(promise.as_value());
+        }
+    };
+
+    let result_ty = func.result.clone();
+    let err_class = func.err_class.clone();
+    // The closure that settles the promise outlives the future, so it holds its
+    // own reference to the invoker.
+    let releasing_invoker = Rc::clone(&invoker);
+    let future = async move {
+        // The owned stack stays GC-traced across this await through the
+        // live-stacks registry.
+        let mut stack = invoker.invoke_async(stack, func).await;
+        PromiseOutcome::Resolve(Box::new(move |scope: &Scope<'_>| {
+            // `Err` leaves the `err` arm's error, or a `TypeError` for a malformed
+            // result, as the pending exception, which rejects the promise.
+            let result =
+                handle_import_result(scope, &mut stack, result_ty.as_ref(), err_class.as_ref())
+                    .map(|value| scope.root_value(value));
+            release_call_borrows(&mut stack, scope, releasing_invoker.as_ref());
+            result
+        }))
+    };
+
+    // The first poll lowers the arguments and starts the host call. It has to
+    // happen now, while the arguments are as checked by `push_import_args`.
+    // `spawn_polled` roots the promise until the future completes, and runs the
+    // future on the active event loop.
+    promise.spawn_polled(PromiseFuture::new(future));
+
+    Ok(promise.as_value())
+}
+
+/// Pop the lifted result of an import call off the stack, and return the value
+/// that the call returns to JavaScript.
+///
+/// If `result` is `None`, returns `undefined`. If it is a `result`, returns the
+/// `ok` value, or `undefined` if the `ok` case has no value, and throws an
+/// error for the `err` case (see `component_error::throw_err`). Otherwise,
+/// returns the lifted value.
+pub(crate) fn handle_import_result(
+    scope: &Scope<'_>,
+    stack: &mut CallStack,
+    result: Option<&TypeShape>,
+    err_class: Option<&ErrorClass>,
+) -> Result<Value, ExnThrown> {
+    match result {
+        None => Ok(js::value::undefined()),
+        Some(TypeShape::Result(ok, err)) => {
+            let wrapper = pop_result_wrapper(scope, stack)?;
+            match crate::value::tag_index(&wrapper, scope, [c"ok", c"err"].into_iter())? {
+                Some(0) => {
+                    if ok.is_some() {
+                        Ok(wrapper.get_property(scope, c"val")?.get())
+                    } else {
+                        Ok(js::value::undefined())
+                    }
+                }
+                Some(_) => {
+                    let payload = if err.is_some() {
+                        wrapper.get_property(scope, c"val")?
+                    } else {
+                        HandleValue::undefined()
+                    };
+                    Err(crate::component_error::throw_err(scope, payload, err_class))
+                }
+                _ => Err(throw_type_error(
+                    scope,
+                    c"imported result has a tag that is neither \"ok\" nor \"err\"",
+                )),
+            }
+        }
+        Some(_) => Ok(stack.pop_value()),
+    }
+}
+
+/// Pop the top value, rooting it as the `result` wrapper object.
+fn pop_result_wrapper<'s>(
+    scope: &'s Scope<'_>,
+    stack: &mut CallStack,
+) -> Result<Object<'s>, ExnThrown> {
+    Object::from_raw_value(scope, stack.pop_value())
+        .map_err(|_| throw_type_error(scope, c"imported result is not a {tag, val} object"))
+}
+
+/// Create and register an ES module for each entry of
+/// [`WorldDesc::interfaces`], and register `invoker` for calls to the imports.
+///
+/// Each module exports:
+///
+/// - a function for each of [`InterfaceDesc::functions`],
+/// - a class for each of [`InterfaceDesc::resources`], with the resource's
+///   methods and a `[Symbol.dispose]` method on its prototype, and its static
+///   functions on the class,
+/// - the subclass of `ComponentError` for each of
+///   [`InterfaceDesc::error_classes`] (see
+///   [`create_error_class`](crate::component_error::create_error_class)),
+/// - a frozen object for each of [`InterfaceDesc::enums`] (see [`EnumDesc`]).
+///
+/// A module's specifier is [`InterfaceDesc::wit_name`], or
+/// [`WORLD_MODULE_NAME`] for the imports defined on the world. The classes in
+/// [`WorldDesc::unexported_error_classes`] are created, but not exported.
+///
+/// # Panics
+///
+/// Panics if no runtime is current.
+pub fn synthesize_import_modules(
+    scope: &Scope<'_>,
+    world: &WorldDesc,
+    invoker: Rc<dyn ImportInvoker>,
+) -> Result<(), ExnThrown> {
+    // The table covers every import in the world, both freestanding and every
+    // resource constructor, method and static.
+    let mut funcs: Vec<Option<Rc<ImportFuncDesc>>> = Vec::new();
+    let mut record = |func: &ImportFuncDesc| {
+        let idx = func.index as usize;
+        if funcs.len() <= idx {
+            funcs.resize(idx + 1, None);
+        }
+        funcs[idx] = Some(Rc::new(func.clone()));
+    };
+    for iface in &world.interfaces {
+        for func in &iface.functions {
+            record(func);
+        }
+        for res in &iface.resources {
+            if let Some(ctor) = &res.constructor {
+                record(ctor);
+            }
+            for (_, m) in &res.methods {
+                record(m);
+            }
+            for (_, s) in &res.statics {
+                record(s);
+            }
+        }
+    }
+    IMPORTS.with(|cell| *cell.borrow_mut() = Some(ImportRegistry { funcs, invoker }));
+
+    for iface in &world.interfaces {
+        synthesize_interface_module(scope, iface)?;
+    }
+    for class in &world.unexported_error_classes {
+        crate::component_error::create_error_class(scope, class)?;
+    }
+    Ok(())
+}
+
+/// Build and register the synthetic module for one interface, or for the
+/// world-level import group.
+fn synthesize_interface_module(scope: &Scope<'_>, iface: &InterfaceDesc) -> Result<(), ExnThrown> {
+    let mut names: Vec<String> = Vec::new();
+    let mut values: Vec<HandleValue<'_>> = Vec::new();
+
+    for func in &iface.functions {
+        let name = mangle_name(&func.name);
+        let f = synthesize_import_function(scope, &name, func)?;
+        names.push(name);
+        values.push(scope.root_value(f.as_value()));
+    }
+
+    for res in &iface.resources {
+        let class = synthesize_resource_class(scope, res)?;
+        names.push(mangle_resource_name(&res.name));
+        values.push(scope.root_value(class.as_value()));
+    }
+
+    for class in &iface.error_classes {
+        let created = crate::component_error::create_error_class(scope, class)?;
+        names.push(class.js_name());
+        values.push(scope.root_value(created.as_value()));
+    }
+
+    for desc in &iface.enums {
+        let object = enum_object(scope, desc)?;
+        names.push(desc.js_name.clone());
+        values.push(scope.root_value(object.as_value()));
+    }
+
+    let module_name = iface.wit_name.as_deref().unwrap_or(WORLD_MODULE_NAME);
+    let exports: Vec<(&str, HandleValue<'_>)> = names
+        .iter()
+        .map(String::as_str)
+        .zip(values.iter().copied())
+        .collect();
+
+    core_runtime::module::register_synthetic_module(scope, module_name, &exports)
+}
+
+/// Create the frozen object for the enum or flags type `desc`, with a property
+/// for each case holding its value, and a property for each value holding the
+/// case's name.
+fn enum_object<'s>(scope: &'s Scope<'_>, desc: &EnumDesc) -> Result<Object<'s>, ExnThrown> {
+    let object = Object::new_plain(scope)?;
+    for (name, value) in &desc.members {
+        object.define_property_by_name(scope, &to_cstring(name), *value, ENUMERATE)?;
+        object.define_property_by_name(
+            scope,
+            &to_cstring(&value.to_string()),
+            name.as_str(),
+            ENUMERATE,
+        )?;
+    }
+    object.freeze(scope)?;
+    Ok(object)
+}
+
+/// Create the function for the import `func`, which doesn't belong to a
+/// resource. The function's payload is the import's index.
+fn synthesize_import_function<'s>(
+    scope: &'s Scope<'_>,
+    js_name: &str,
+    func: &ImportFuncDesc,
+) -> Result<Function<'s>, ExnThrown> {
+    let c_name = to_cstring(js_name);
+    Function::new_callback(
+        scope,
+        &c_name,
+        func.params.len() as u32,
+        import_callback,
+        func.index,
+    )
+}
+
+/// Create the class for the imported resource `res`, with the methods and
+/// `[Symbol.dispose]` on its prototype, and the static functions on the class.
+///
+/// The constructor returns the wrapper of the `own` handle returned by the
+/// host, which becomes the result of `new`. A method passes `this` as the first
+/// argument of the import call.
+fn synthesize_resource_class<'s>(
+    scope: &'s Scope<'_>,
+    res: &ResourceTypeDesc,
+) -> Result<Object<'s>, ExnThrown> {
+    let class_name = mangle_resource_name(&res.name);
+    let c_class_name = to_cstring(&class_name);
+
+    // Constructing a resource without a WIT constructor throws.
+    let ctor = match &res.constructor {
+        Some(ctor) => Function::new_constructor_callback(
+            scope,
+            &c_class_name,
+            ctor.params.len() as u32,
+            import_callback,
+            ctor.index,
+        )?,
+        None => Function::new_constructor_callback(
+            scope,
+            &c_class_name,
+            0,
+            unconstructable_callback,
+            (),
+        )?,
+    };
+
+    let proto = Object::new_plain(scope)?;
+    for (method_name, m) in &res.methods {
+        let c_method = to_cstring(method_name);
+        let nargs = m.params.len().saturating_sub(1) as u32;
+        let f = Function::new_callback(scope, &c_method, nargs, method_callback, m.index)?;
+        // Non-enumerable, as the methods of a JS `class` are.
+        proto.define_property_by_name(scope, &c_method, f, 0)?;
+    }
+
+    let dispose = crate::resources::dispose_function(scope)?;
+    js::class::define_well_known_symbol_property(
+        scope,
+        proto,
+        js::native::SymbolCode::dispose,
+        dispose,
+    )?;
+
+    let ctor_obj = *ctor;
+
+    for (static_name, s) in &res.statics {
+        let c_static = to_cstring(static_name);
+        let f = Function::new_callback(
+            scope,
+            &c_static,
+            s.params.len() as u32,
+            import_callback,
+            s.index,
+        )?;
+        ctor_obj.define_property_by_name(scope, &c_static, f, 0)?;
+    }
+
+    // `R.prototype === proto` and `proto.constructor === R`.
+    js::class::link_constructor_and_prototype(scope, ctor_obj.handle(), proto.handle())?;
+
+    // Wrappers created by `resources::push_own` and `resources::push_borrow` get
+    // the prototype registered here. A resource without a type index isn't
+    // registered.
+    if res.type_idx != u32::MAX {
+        crate::resources::register_resource_prototype(res.type_idx, &proto);
+    }
+
+    Ok(ctor_obj)
+}
+
+/// Call the import with the index `index` with the callback's arguments,
+/// preceded by `this` if it is `Some`. Returns the result of a synchronous
+/// import, or a promise for the result of an async import.
+fn dispatch_import(
+    scope: &Scope<'_>,
+    index: u32,
+    this: Option<HandleValue<'_>>,
+    args: &js::function::CallbackArgs<'_>,
+) -> Result<Value, ExnThrown> {
+    let (func, invoker) = lookup_import(scope, index)?;
+    let argc = args.len() as usize + usize::from(this.is_some());
+    // `CallbackArgs::get` yields handles the engine keeps rooted for the callback's duration.
+    let collected: smallvec::SmallVec<[HandleValue<'_>; 8]> = if argc == func.params.len() {
+        this.into_iter()
+            .chain((0..args.len()).map(|i| args.get(i)))
+            .collect()
+    } else {
+        smallvec::SmallVec::new()
+    };
+    if func.is_async {
+        call_import_async(scope, func, invoker, &collected, argc)
+    } else {
+        call_import(scope, &func, invoker.as_ref(), &collected, argc)
+    }
+}
+
+/// The callback of an import function that isn't a method.
+fn import_callback(
+    scope: &Scope<'_>,
+    args: js::function::CallbackArgs<'_>,
+    payload: HandleValue<'_>,
+) -> Result<Value, ExnThrown> {
+    let index = payload_index(scope, payload)?;
+    dispatch_import(scope, index, None, &args)
+}
+
+/// The callback of a resource method, which passes `this` as the first
+/// argument.
+fn method_callback(
+    scope: &Scope<'_>,
+    args: js::function::CallbackArgs<'_>,
+    payload: HandleValue<'_>,
+) -> Result<Value, ExnThrown> {
+    let index = payload_index(scope, payload)?;
+    // Unlike the arguments, `this` isn't rooted by the engine.
+    let this = scope.root_value(args.this());
+    dispatch_import(scope, index, Some(this), &args)
+}
+
+/// The constructor of a resource type without a WIT constructor, which always
+/// throws.
+fn unconstructable_callback(
+    scope: &Scope<'_>,
+    _args: js::function::CallbackArgs<'_>,
+    _payload: HandleValue<'_>,
+) -> Result<Value, ExnThrown> {
+    Err(throw_type_error(
+        scope,
+        c"this imported resource type has no constructor",
+    ))
+}
+
+/// Read the import index out of a callback payload value.
+fn payload_index(scope: &Scope<'_>, payload: HandleValue<'_>) -> Result<u32, ExnThrown> {
+    // `from_u32` boxes values past `i32::MAX` as a double, so the index is read
+    // back through the number path for the full `u32` range to round-trip.
+    if payload.get().is_number() {
+        Ok(payload.get().to_number() as u32)
+    } else {
+        Err(throw_type_error(
+            scope,
+            c"import callback payload is not an index",
+        ))
+    }
+}
diff --git a/crates/wit-bridge/src/init.rs b/crates/wit-bridge/src/init.rs
new file mode 100644
index 00000000..5c2c2523
--- /dev/null
+++ b/crates/wit-bridge/src/init.rs
@@ -0,0 +1,335 @@
+// SPDX-License-Identifier: Apache-2.0-WITH-LLVM-exception
+
+//! Starting the runtime and evaluating the application's main module.
+//!
+//! [`initialize_runtime`] creates the process's single SpiderMonkey runtime and
+//! evaluates the application's main ES module. The realm of the default global
+//! stays entered until [`shutdown_runtime`] is called. [`with_scope`] and
+//! [`with_main_scope`] create scopes in it.
+//!
+//! Builtins must be registered with `register_global_initializer` before
+//! [`initialize_runtime`] is called.
+
+use std::cell::{Cell, RefCell};
+use std::mem::ManuallyDrop;
+use std::rc::Rc;
+
+use core_runtime::config::RuntimeConfig;
+use core_runtime::event_loop::with_event_loop;
+use core_runtime::invocation::InvocationState;
+use core_runtime::runtime::Runtime;
+use core_runtime::ScriptEvaluation;
+use js::error::ExnThrown;
+use js::gc::scope::{EnteredRealm, RootScope, Scope};
+use js::native::RawJSContext;
+use js::Object;
+
+js::instance_local! {
+    /// The bootstrap state, set once by [`initialize_runtime`] and taken by
+    /// [`shutdown_runtime`].
+    static BOOTSTRAP: RefCell<Option<Bootstrap>> = const { RefCell::new(None) };
+
+    /// Set by the first [`initialize_runtime`] call, before anything can fail.
+    /// A failed call leaves `BOOTSTRAP` empty, and a second call would abort in
+    /// `JSEngine::init`, which can run only once per process.
+    static INITIALIZE_ATTEMPTED: Cell<bool> = const { Cell::new(false) };
+
+    /// Run at the start of every export call, set by [`set_before_export`].
+    static BEFORE_EXPORT: Cell<Option<fn()>> = const { Cell::new(None) };
+}
+
+/// Run `hook` at the start of every export call, before any JS runs.
+pub fn set_before_export(hook: fn()) {
+    BEFORE_EXPORT.with(|cell| cell.set(Some(hook)));
+}
+
+/// Run the hook set by [`set_before_export`], if any.
+#[cfg(target_arch = "wasm32")]
+pub(crate) fn before_export() {
+    if let Some(hook) = BEFORE_EXPORT.with(Cell::get) {
+        hook();
+    }
+}
+
+/// One-time bootstrap state.
+///
+/// `scope` and `runtime` are dropped only by [`Bootstrap::shut_down`], in that
+/// order. Dropping the runtime while `scope` has its realm entered would call
+/// `DestroyContext` with the realm entered, which SpiderMonkey aborts on.
+struct Bootstrap {
+    /// The scope that entered the default global's realm. Its lifetime is
+    /// extended to `'static`. It borrows `runtime`, which is dropped after it.
+    scope: ManuallyDrop<RootScope<'static, EnteredRealm>>,
+    runtime: ManuallyDrop<Rc<Runtime>>,
+    /// The context whose default global's realm `scope` entered.
+    raw_cx: *mut RawJSContext,
+}
+
+impl Bootstrap {
+    /// Leave the default global's realm and drop the runtime.
+    ///
+    /// # Panics
+    ///
+    /// Panics if a clone of the runtime returned by [`runtime`] is alive.
+    fn shut_down(mut self) {
+        // SAFETY: `self` is consumed, so neither field is used after it is
+        // dropped here.
+        unsafe { ManuallyDrop::drop(&mut self.scope) };
+        // SAFETY: as above.
+        let runtime = unsafe { ManuallyDrop::take(&mut self.runtime) };
+        // The runtime is dropped in its `Rc` allocation, because its GC tracers
+        // are registered with that address.
+        assert_eq!(
+            Rc::strong_count(&runtime),
+            1,
+            "a clone of the component-model runtime is still alive"
+        );
+        drop(runtime);
+    }
+}
+
+/// Initialize the component-model runtime and evaluate the application's main
+/// module.
+///
+/// `config`'s [`base_path`](RuntimeConfig::base_path) is the module loader's
+/// base path. `main` is the source of the main module, compiled under the name
+/// `main_name`. `main_path` is the path of the file `main` was read from, if
+/// any. A module that imports that file gets the main module (see
+/// [`core_runtime::module::register_entry_module`]). `synthesize` creates the
+/// import modules, and is called before the main module is compiled.
+///
+/// If the main module has a top-level `await` that running microtasks doesn't
+/// settle, the module is still being evaluated when this returns. The caller
+/// must then run the event loop of [`Initialized::invocation`] until
+/// [`Initialized::evaluation`] finishes, before resolving exports.
+///
+/// Returns `Err` with an error message if the engine fails to start,
+/// `synthesize` throws, or a module fails to compile, load, link or evaluate.
+/// Must be called at most once per process. A second call returns an error,
+/// even if the first call failed.
+pub fn initialize_runtime(
+    config: &RuntimeConfig,
+    main: &str,
+    main_name: &str,
+    main_path: Option<&str>,
+    synthesize: impl FnOnce(&Scope<'_>) -> Result<(), ExnThrown>,
+) -> Result<Initialized, String> {
+    if INITIALIZE_ATTEMPTED.with(|attempted| attempted.replace(true)) {
+        return Err("component-model runtime already initialized".to_string());
+    }
+
+    let runtime = Runtime::init(config)?;
+
+    // `scope` enters the default global's realm, which stays entered until
+    // `shutdown_runtime` drops `scope`.
+    let scope = runtime.default_global();
+    // SAFETY: the raw context is only stored, and every later read of it goes
+    // through `raw_cx`, which is reachable only once `BOOTSTRAP` is set at
+    // the end of this function. The runtime that owns the context is kept alive
+    // there together with `scope`, so its realm stays entered.
+    let raw_cx = unsafe { scope.raw_cx_no_gc() };
+
+    // The tracer goes in before any value can outlive a collection.
+    crate::tracing::install_tracer();
+
+    // Every failure below drops `runtime`, so the values held by this crate are
+    // dropped first.
+    let fail = |scope: &Scope<'_>, context: &str| -> String {
+        let message = capture_message(scope, context);
+        crate::tracing::clear_traced_roots();
+        message
+    };
+
+    synthesize(&scope).map_err(|_| fail(&scope, "import-module synthesis failed"))?;
+
+    // The main module is evaluated on the event loop of a new invocation, which
+    // the caller can run later. The invocation is registered for tracing during
+    // the evaluation, and unregistered before it is moved to the caller, because
+    // the registry holds its address.
+    let invocation = InvocationState::new();
+    // SAFETY: `invocation` lives at this address until it is unregistered on
+    // every path out below, so the tracer never dereferences a freed or
+    // moved-from slot.
+    unsafe { runtime.register_invocation(&invocation) };
+
+    let eval_result = with_event_loop(invocation.event_loop(), |_| {
+        evaluate_main_module(&scope, main, main_name, main_path)
+    });
+    runtime.unregister_invocation(&invocation);
+    let evaluation = eval_result.inspect_err(|_| crate::tracing::clear_traced_roots())?;
+
+    // SAFETY: `scope` borrows the runtime in the `Rc` allocation, which
+    // `Bootstrap` keeps alive until after it drops `scope`.
+    let scope = unsafe {
+        std::mem::transmute::<RootScope<'_, EnteredRealm>, RootScope<'static, EnteredRealm>>(scope)
+    };
+    let bootstrap = Bootstrap {
+        scope: ManuallyDrop::new(scope),
+        runtime: ManuallyDrop::new(runtime),
+        raw_cx,
+    };
+    BOOTSTRAP.with(|cell| {
+        let previous = cell.borrow_mut().replace(bootstrap);
+        assert!(previous.is_none(), "BOOTSTRAP was empty (checked above)");
+    });
+
+    Ok(Initialized {
+        invocation,
+        evaluation,
+    })
+}
+
+/// The result of [`initialize_runtime`].
+pub struct Initialized {
+    /// The invocation on whose event loop the main module was evaluated.
+    pub invocation: InvocationState,
+    /// The main module's evaluation, which is unfinished while a top-level
+    /// `await` is still pending on `invocation`'s event loop.
+    pub evaluation: ScriptEvaluation,
+}
+
+/// Evaluate `source`, compiled under the name `name`, as the entry module, and
+/// register it as the module of the file at `path`, if any.
+fn evaluate_main_module(
+    scope: &Scope<'_>,
+    source: &str,
+    name: &str,
+    path: Option<&str>,
+) -> Result<ScriptEvaluation, String> {
+    if name.contains('\0') {
+        return Err(format!(
+            "the main module's name `{name}` contains a NUL byte"
+        ));
+    }
+    // SAFETY: `Runtime::init` initialized the module loader.
+    let evaluated = unsafe {
+        core_runtime::module::evaluate_entry_module(
+            scope,
+            source,
+            name,
+            path.map(std::path::Path::new),
+        )
+    }
+    .map_err(|_| capture_message(scope, "main module failed to evaluate"))?;
+
+    if js::exception::is_pending(scope) {
+        return Err(capture_message(
+            scope,
+            "main module threw during evaluation",
+        ));
+    }
+
+    // `ModuleEvaluate` reports a top-level throw by rejecting the promise it
+    // returns and clearing the pending exception, so the check above doesn't see
+    // it. Running microtasks settles the promise unless the module awaits
+    // something that requires the event loop.
+    core_runtime::event_loop::run_microtasks(scope);
+    let pending = core_runtime::module::settled_module_evaluation(
+        scope,
+        evaluated,
+        "main module threw during evaluation",
+    )?;
+
+    Ok(ScriptEvaluation::new(pending))
+}
+
+/// Run `f` with a new scope in the realm of the default global. Values that
+/// must outlive the scope can be kept on a
+/// [`CallStack`](crate::stack::CallStack).
+///
+/// # Panics
+///
+/// Panics if [`initialize_runtime`] has not completed successfully.
+pub fn with_scope<R>(f: impl FnOnce(&Scope<'_>) -> R) -> R {
+    // SAFETY: `raw_cx` is the context whose default-global realm was entered by
+    // `initialize_runtime`. `raw_cx()` panics once `shutdown_runtime` has left
+    // the realm, and until then the runtime that owns the context is kept alive
+    // in `BOOTSTRAP`.
+    let scope = unsafe { RootScope::from_current_realm(raw_cx()) };
+    f(&scope)
+}
+
+/// Like [`with_scope`], but also pass the main module's namespace object to
+/// `f`.
+///
+/// # Panics
+///
+/// Panics if [`initialize_runtime`] has not completed successfully.
+pub fn with_main_scope<R>(f: impl FnOnce(&Scope<'_>, &Object<'_>) -> R) -> R {
+    with_scope(|scope| f(scope, &main_namespace(scope)))
+}
+
+/// The main module's namespace object.
+///
+/// # Panics
+///
+/// Panics if the main module has not been evaluated.
+fn main_namespace<'s>(scope: &'s Scope<'_>) -> Object<'s> {
+    core_runtime::module::entry_namespace(scope).expect("main module not evaluated")
+}
+
+/// Whether [`initialize_runtime`] has completed successfully and
+/// [`shutdown_runtime`] has not been called.
+pub fn is_initialized() -> bool {
+    BOOTSTRAP.with(|cell| cell.borrow().is_some())
+}
+
+/// Drop the JS values held by this crate, leave the default global's realm, and
+/// drop the runtime created by [`initialize_runtime`].
+///
+/// A native program calls this before it exits. While the runtime is alive, the
+/// engine isn't shut down at exit, and on Linux SpiderMonkey then crashes in the
+/// destructor of its helper-thread lock. No scope created by [`with_scope`] may
+/// be alive. Afterwards the functions of this module that require an
+/// initialized runtime panic, and [`initialize_runtime`] returns an error.
+///
+/// # Panics
+///
+/// Panics if [`initialize_runtime`] has not completed successfully, or if a
+/// clone of the runtime returned by [`runtime`] is alive.
+pub fn shutdown_runtime() {
+    let bootstrap = BOOTSTRAP
+        .with(|cell| cell.borrow_mut().take())
+        .expect("component-model runtime not initialized");
+    crate::tracing::clear_traced_roots();
+    bootstrap.shut_down();
+}
+
+/// Return the raw context whose default global's realm stays entered. Code
+/// that can't hold a [`Scope`] across an `await` uses it to create a new scope
+/// after each `await`.
+///
+/// # Panics
+///
+/// Panics if [`initialize_runtime`] has not completed successfully.
+pub fn raw_cx() -> *mut RawJSContext {
+    BOOTSTRAP.with(|cell| {
+        cell.borrow()
+            .as_ref()
+            .expect("component-model runtime not initialized")
+            .raw_cx
+    })
+}
+
+/// Return a reference to the runtime.
+///
+/// # Panics
+///
+/// Panics if [`initialize_runtime`] has not completed successfully.
+pub fn runtime() -> Rc<Runtime> {
+    BOOTSTRAP.with(|cell| {
+        Rc::clone(
+            &cell
+                .borrow()
+                .as_ref()
+                .expect("component-model runtime not initialized")
+                .runtime,
+        )
+    })
+}
+
+/// Return the pending exception, if any, as a `context: error` string, with the
+/// error's source location and stack.
+fn capture_message(scope: &Scope<'_>, context: &str) -> String {
+    ExnThrown::capture(scope).with_context(context)
+}
diff --git a/crates/wit-bridge/src/interpreter.rs b/crates/wit-bridge/src/interpreter.rs
new file mode 100644
index 00000000..5d2e88bc
--- /dev/null
+++ b/crates/wit-bridge/src/interpreter.rs
@@ -0,0 +1,1804 @@
+// SPDX-License-Identifier: Apache-2.0-WITH-LLVM-exception
+
+//! The implementation of `wit_dylib_ffi`'s [`Interpreter`] and [`Call`] traits.
+//!
+//! The `Call` methods call the conversion functions in [`crate::value`], with
+//! [`TypeShape`]s created from the `wit_dylib_ffi` type metadata. This module
+//! compiles only for wasm, because the metadata exists only in the generated
+//! bindings.
+//!
+//! The `Call` methods receive no [`Scope`], so each creates one with
+//! [`init::with_scope`] for its conversion. The values are kept on the
+//! [`CallStack`], which is traced by the GC, so they outlive these scopes.
+//!
+//! The `Call` methods can't report errors, and the generated code calls the
+//! next method regardless of failures, so a conversion error traps. Import
+//! arguments are checked before the call, so that an argument that can't be
+//! lowered throws a `TypeError` instead (see [`crate::validate`]). A trap while
+//! lowering an export's result describes the part of the result that failed.
+
+#![cfg(target_arch = "wasm32")]
+
+use std::alloc::Layout;
+use std::cell::RefCell;
+use std::ffi::CStr;
+use std::rc::Rc;
+
+use crate::component_error::ErrorClass;
+use crate::exports::{ExportSpec, ResultShape};
+
+use js::conversion::FromJSVal;
+use js::error::{throw_type_error, CapturedError, ExnThrown};
+use js::gc::scope::Scope;
+use js::prelude::HandleValue;
+use js::Object;
+
+use wit_dylib_ffi::{
+    Call, Enum, ExportFunction, Flags, Future, Interpreter, List, Map, Record, Resource, Stream,
+    Tuple, Type, Variant, Wit, WitOption, WitResult,
+};
+
+use wit_name_mapping::{mangle_name, mangle_resource_name, FunctionName, InterfaceNames};
+
+use crate::imports::{
+    self, EnumDesc, ImportFuncDesc, ImportInvoker, InterfaceDesc, ResourceTypeDesc, WorldDesc,
+};
+use crate::init;
+use crate::resources::{self, ResourceDesc};
+use crate::stack::CallStack;
+use crate::value::{self, TypeShape, TypeShapeValue};
+
+// ===========================================================================
+// The world's WIT metadata, stashed by `initialize`
+// ===========================================================================
+
+js::instance_local! {
+    /// Set by [`StarlingInterpreter::initialize`]. `Wit` is a `Copy` wrapper over
+    /// a `&'static` FFI struct, so storing it by value is sound.
+    static WIT: RefCell<Option<Wit>> = const { RefCell::new(None) };
+
+    /// The description of the world's imports, built by
+    /// [`StarlingInterpreter::initialize`].
+    static WORLD: RefCell<Option<WorldDesc>> = const { RefCell::new(None) };
+
+    /// Mangled field names per record type index, built on first use.
+    static RECORD_NAMES: RefCell<Vec<Option<Rc<[&'static CStr]>>>> =
+        const { RefCell::new(Vec::new()) };
+
+    /// Mangled case names, paired with whether the case has a payload, per
+    /// variant type index, built on first use.
+    static VARIANT_CASES: RefCell<Vec<Option<Rc<[(&'static CStr, bool)]>>>> =
+        const { RefCell::new(Vec::new()) };
+}
+
+/// Return the world's metadata.
+///
+/// # Panics
+///
+/// Panics if [`StarlingInterpreter::initialize`] hasn't run.
+fn wit() -> Wit {
+    WIT.with(|cell| cell.borrow().expect("wit_dylib_initialize has not run yet"))
+}
+
+pub fn wit_stream(index: usize) -> Stream {
+    wit().stream(index)
+}
+
+pub fn wit_future(index: usize) -> Future {
+    wit().future(index)
+}
+
+/// Return the metadata of the resource type `index`, or `None` if there is no
+/// such type. Use this for indices that come from JS, because a panic in a JS
+/// callback aborts the instance.
+pub fn wit_resource_checked(index: usize) -> Option<Resource> {
+    let wit = wit();
+    let count = wit.iter_resources().len();
+    (index < count).then(|| wit.resource(index))
+}
+
+/// If `value` is a wrapper of the imported resource `resource` of the interface
+/// `interface`, such as `request` of `wasi:http/types@0.3.0`, or of an
+/// interface for which [`wit_name_mapping::same_interface`] returns `true`,
+/// remove its handle and return it. Returns `None` for any other value.
+///
+/// The handle is removed as when the wrapper is lowered as an `own`, so the
+/// wrapper can't be used afterwards.
+pub fn take_imported_handle(
+    scope: &Scope<'_>,
+    value: HandleValue<'_>,
+    interface: &str,
+    resource: &str,
+) -> Result<Option<u32>, ExnThrown> {
+    let Some(wrapper) = resources::imported_wrapper(scope, value) else {
+        return Ok(None);
+    };
+    let type_idx = wrapper.data().type_idx;
+    let Some(ty) = wit_resource_checked(type_idx as usize) else {
+        return Ok(None);
+    };
+    let matches = ty
+        .interface()
+        .is_some_and(|name| wit_name_mapping::same_interface(name, interface));
+    if ty.new().is_some() || !matches || ty.name() != resource {
+        return Ok(None);
+    }
+    resources::unwrap_to_canon(scope, value, type_idx, true).map(Some)
+}
+
+/// The payload type of a `future` type.
+pub struct FuturePayload {
+    /// The type of `T`, or `None` for a `future` without one.
+    pub shape: Option<TypeShape>,
+    /// The error class of the `err` case, if `T` is a `result` whose `err` type
+    /// has one.
+    pub err_class: Option<ErrorClass>,
+    /// Whether `T` contains an owned resource handle.
+    pub owns_resources: bool,
+}
+
+/// The element type of a `stream<T>` type.
+pub struct StreamElement {
+    /// The type of `T`, or `None` for a `stream` without one.
+    pub shape: Option<TypeShape>,
+    /// Whether `T` contains an owned resource handle.
+    pub owns_resources: bool,
+}
+
+js::instance_local! {
+    /// The [`FuturePayload`] of each `future` type index, built on first use.
+    static FUTURE_PAYLOADS: RefCell<Vec<Option<Rc<FuturePayload>>>> =
+        const { RefCell::new(Vec::new()) };
+
+    /// The [`StreamElement`] of each `stream` type index, built on first use.
+    static STREAM_ELEMENTS: RefCell<Vec<Option<Rc<StreamElement>>>> =
+        const { RefCell::new(Vec::new()) };
+}
+
+/// The element type of the `stream<T>` with type index `index`.
+pub fn stream_element(index: u32) -> Rc<StreamElement> {
+    let index = index as usize;
+    STREAM_ELEMENTS.with(|cache| {
+        cached(&mut cache.borrow_mut(), index, || {
+            let shape = wit_stream(index).ty().map(type_shape);
+            let owns_resources = shape.as_ref().is_some_and(TypeShape::contains_own_resource);
+            Rc::new(StreamElement {
+                shape,
+                owns_resources,
+            })
+        })
+    })
+}
+
+/// Return the payload type of the `future` type with index `index`.
+pub fn future_payload(index: u32) -> Rc<FuturePayload> {
+    let index = index as usize;
+    FUTURE_PAYLOADS.with(|cache| {
+        cached(&mut cache.borrow_mut(), index, || {
+            let ty = wit_future(index).ty();
+            let shape = ty.map(type_shape);
+            let owns_resources = shape.as_ref().is_some_and(TypeShape::contains_own_resource);
+            Rc::new(FuturePayload {
+                shape,
+                err_class: err_class_of(ty),
+                owns_resources,
+            })
+        })
+    })
+}
+
+/// Add to `classes` the error classes of the `result` types in `ty` whose `err`
+/// values are lifted as errors: `ty` itself if `direct` is set, and the payload
+/// type of each `future` in `ty`.
+fn collect_err_classes(ty: Type, direct: bool, classes: &mut Vec<ErrorClass>) {
+    if direct {
+        if let Some(class) = err_class_of(Some(ty)) {
+            if !classes.contains(&class) {
+                classes.push(class);
+            }
+        }
+    }
+    match ty {
+        Type::Alias(alias) => collect_err_classes(alias.ty(), direct, classes),
+        Type::Future(future) => {
+            if let Some(payload) = future.ty() {
+                collect_err_classes(payload, true, classes);
+            }
+        }
+        Type::List(list) => collect_err_classes(list.ty(), false, classes),
+        Type::Option(option) => collect_err_classes(option.ty(), false, classes),
+        Type::Result(result) => {
+            for arm in [result.ok(), result.err()].into_iter().flatten() {
+                collect_err_classes(arm, false, classes);
+            }
+        }
+        Type::Tuple(tuple) => {
+            for element in tuple.types() {
+                collect_err_classes(element, false, classes);
+            }
+        }
+        Type::Record(record) => {
+            for (_, field) in record.fields() {
+                collect_err_classes(field, false, classes);
+            }
+        }
+        Type::Variant(variant) => {
+            for payload in variant.cases().filter_map(|(_, payload)| payload) {
+                collect_err_classes(payload, false, classes);
+            }
+        }
+        _ => {}
+    }
+}
+
+/// Return the error class of the `err` case if `ty` is a `result` whose `err`
+/// type has one.
+fn err_class_of(ty: Option<Type>) -> Option<ErrorClass> {
+    let Type::Result(result) = dealias(ty?) else {
+        return None;
+    };
+    let err = result.err()?;
+    let (interface, name) = match err {
+        Type::Alias(alias) => {
+            if matches!(dealias(alias.ty()), Type::Own(_) | Type::Borrow(_)) {
+                return None;
+            }
+            // An interface that the world only exports has no module from which
+            // the application could import the class, so an alias in it uses
+            // the class of the type it refers to.
+            match alias.interface() {
+                Some(interface) if is_export_only(interface) => {
+                    return err_class_of_named(alias.ty());
+                }
+                interface => (interface, alias.name()),
+            }
+        }
+        other => return err_class_of_named(other),
+    };
+    Some(error_class_for(interface, name, err))
+}
+
+/// Return the error class of `err` if it is a named type. Aliases in
+/// interfaces that the world only exports are followed to the type they refer
+/// to.
+fn err_class_of_named(err: Type) -> Option<ErrorClass> {
+    let (interface, name) = match err {
+        Type::Alias(alias) => match alias.interface() {
+            Some(interface) if is_export_only(interface) => {
+                return err_class_of_named(alias.ty());
+            }
+            interface => (interface, alias.name()),
+        },
+        Type::Record(record) => (record.interface(), record.name()),
+        Type::Variant(variant) => (variant.interface(), variant.name()),
+        Type::Enum(e) => (e.interface(), e.name()),
+        Type::Flags(flags) => (flags.interface(), flags.name()),
+        Type::Tuple(tuple) => (tuple.interface(), tuple.name()?),
+        Type::Option(option) => (option.interface(), option.name()?),
+        Type::Result(result) => (result.interface(), result.name()?),
+        Type::List(list) => (list.interface(), list.name()?),
+        _ => return None,
+    };
+    Some(error_class_for(interface, name, err))
+}
+
+/// Whether the world exports the interface named `interface` and does not
+/// import it.
+fn is_export_only(interface: &str) -> bool {
+    let wit = wit();
+    let named = |func_interface: Option<&str>| func_interface == Some(interface);
+    wit.iter_export_funcs().any(|f| named(f.interface()))
+        && !wit.iter_import_funcs().any(|f| named(f.interface()))
+}
+
+/// The [`ErrorClass`] named `name` in `interface`, for the `err` type `err`.
+fn error_class_for(interface: Option<&str>, name: &str, err: Type) -> ErrorClass {
+    let enum_cases = match dealias(err) {
+        Type::Enum(e) => e.names().map(mangle_name).collect(),
+        _ => Vec::new(),
+    };
+    ErrorClass {
+        interface: interface.map(str::to_string),
+        name: name.to_string(),
+        enum_cases,
+    }
+}
+
+/// Return the description of the world's imports, or `None` for a world
+/// without exports, for which [`StarlingInterpreter::initialize`] isn't
+/// called.
+pub fn world_desc_opt() -> Option<WorldDesc> {
+    WORLD.with(|cell| cell.borrow().clone())
+}
+
+/// Resolve every export of the world against the main module's namespace `ns`,
+/// and install the export table (see [`crate::exports::install_table`]). Fails
+/// with an error message if the main module doesn't provide an export.
+///
+/// Each export is looked up under the names returned by
+/// [`wit_name_mapping::possible_export_names`]. If `cli` is set, the main
+/// module must export a `run` function, and no other export can use the name
+/// `run`.
+///
+/// `raw_http_handler` is the name of the exported interface that has the
+/// runtime's own declaration of `wasi:http/handler`. Its functions are looked
+/// up under the names for `wasi:http/handler`, and the main module may leave
+/// them out. Returns whether and where the main module provides them, or `None`
+/// if `raw_http_handler` is `None`.
+///
+/// A world without exports has no metadata, so its table is empty.
+pub fn install_exports(
+    scope: &Scope<'_>,
+    ns: &Object<'_>,
+    cli: bool,
+    raw_http_handler: Option<&str>,
+) -> Result<Option<RawHttpHandlerExport>, String> {
+    RAW_HTTP_HANDLER.with(|cell| *cell.borrow_mut() = raw_http_handler.map(str::to_string));
+    if cli {
+        let callable = match crate::exports::resolve_export(scope, ns, "run") {
+            Ok(crate::exports::Resolved::Plain { function, .. }) => {
+                js::function::is_callable(function)
+            }
+            _ => false,
+        };
+        if !callable {
+            js::exception::clear(scope);
+            return Err(
+                "the main module exports no `run` function, which the component's \
+                 `wasi:cli/run` export calls. Export one, for example: \
+                 export async function run() { ... }"
+                    .to_string(),
+            );
+        }
+    }
+    let Some(wit) = WIT.with(|cell| *cell.borrow()) else {
+        crate::exports::install_table(scope, ns, [])?;
+        return Ok(None);
+    };
+    let items: Vec<wit_name_mapping::Item> = wit
+        .iter_export_funcs()
+        .map(|func| {
+            let names = func.interface().map(|interface| {
+                if Some(interface) == raw_http_handler {
+                    InterfaceNames::of(HTTP_HANDLER_INTERFACE)
+                } else {
+                    InterfaceNames::of(interface)
+                }
+            });
+            (names, wit_name_mapping::item_js_name(func.name()))
+        })
+        .collect();
+    let fixed: &[&str] = if cli { &["run"] } else { &[] };
+    let shapes = wit_name_mapping::possible_export_names(&items, fixed)?;
+    let mut raw_paths = Vec::new();
+    let specs: Vec<ExportSpec> = wit
+        .iter_export_funcs()
+        .zip(items.into_iter().zip(shapes))
+        .map(|(func, ((names, _), shapes))| {
+            let raw = raw_http_handler.is_some() && func.interface() == raw_http_handler;
+            if raw {
+                let item = wit_name_mapping::item_js_name(func.name());
+                raw_paths.extend(shapes.iter().map(|shape| shape.path(&item)));
+            }
+            ExportSpec {
+                interface: names.map(|names| names.wit_name),
+                name: func.name().to_string(),
+                shapes,
+                result: result_shape(func.result()),
+                optional: raw,
+            }
+        })
+        .collect();
+    crate::exports::install_table(scope, ns, specs)?;
+    Ok(raw_http_handler.map(|raw| RawHttpHandlerExport {
+        provided: crate::exports::with_export_table(|table| {
+            wit.iter_export_funcs()
+                .any(|func| func.interface() == Some(raw) && table.provided(func.index()))
+        }),
+        paths: raw_paths,
+    }))
+}
+
+/// Whether and where the main module provides the functions of the runtime's
+/// own `wasi:http/handler` export (see [`install_exports`]).
+pub struct RawHttpHandlerExport {
+    /// Whether the main module provides it.
+    pub provided: bool,
+    /// The names under which the main module may export them, such as
+    /// `handler.handle`.
+    pub paths: Vec<String>,
+}
+
+/// The interface whose export names are used for the runtime's own
+/// `wasi:http/handler` export (see [`install_exports`]).
+const HTTP_HANDLER_INTERFACE: &str = "wasi:http/handler";
+
+/// The [`ResultShape`] of a WIT result type, resolving aliases.
+fn result_shape(ty: Option<Type>) -> ResultShape {
+    let Some(ty) = ty else {
+        return ResultShape::None;
+    };
+    match dealias(ty) {
+        Type::Result(r) => ResultShape::Result {
+            ok: r.ok().is_some(),
+            err: r.err().map(|err| Rc::new(type_shape(err))),
+        },
+        Type::Future(_) => ResultShape::Future,
+        _ => ResultShape::Plain,
+    }
+}
+
+// ===========================================================================
+// The interpreter
+// ===========================================================================
+
+/// The StarlingMonkey component-model interpreter.
+pub struct StarlingInterpreter;
+
+/// The context of one component call.
+///
+/// Export and import calls must use this same type, because the generated
+/// `wit_dylib_*` functions cast the context pointer to
+/// `&mut StarlingInterpreter::CallCx`, and `call_import_sync` casts the
+/// `&mut impl Call` it receives to the same type.
+pub enum CallCx<'a> {
+    /// The stack of an export call.
+    Owned(CallStack),
+    /// The stack of an import call, owned by the caller.
+    Borrowed(&'a mut CallStack),
+}
+
+impl CallCx<'_> {
+    pub(crate) fn stack(&mut self) -> &mut CallStack {
+        match self {
+            CallCx::Owned(stack) => stack,
+            CallCx::Borrowed(stack) => stack,
+        }
+    }
+
+    /// Like `stack`, but by shared reference.
+    fn stack_ref(&self) -> &CallStack {
+        match self {
+            CallCx::Owned(stack) => stack,
+            CallCx::Borrowed(stack) => stack,
+        }
+    }
+}
+
+impl Interpreter for StarlingInterpreter {
+    type CallCx<'a> = CallCx<'a>;
+
+    /// Called by the bindings library's constructors, possibly before the
+    /// runtime's constructors have run, so this must not use SpiderMonkey. The
+    /// runtime is initialized later, by the `init` export.
+    fn initialize(wit: Wit) {
+        // Building the description reads `wit` through `wit()`, so it is stored
+        // first.
+        WIT.with(|cell| *cell.borrow_mut() = Some(wit));
+        resources::set_imported_drop(drop_imported);
+        let world = build_world_desc(wit);
+        WORLD.with(|cell| *cell.borrow_mut() = Some(world));
+    }
+
+    fn export_start<'a>(_wit: Wit, _func: ExportFunction) -> Box<CallCx<'a>> {
+        Box::new(CallCx::Owned(CallStack::new()))
+    }
+
+    /// Call a synchronous export with the lifted arguments on the stack, and
+    /// push the result for lowering.
+    ///
+    /// The export runs without an event loop, so timers and async imports throw
+    /// a `TypeError` naming the export. Microtasks queued by the export run
+    /// before its result is lowered.
+    fn export_call(_wit: Wit, func: ExportFunction, cx: &mut CallCx<'_>) {
+        init::before_export();
+        let index = func.index();
+        let result = crate::exports::with_export_table(|table| table.result(index));
+        let reason = || {
+            format!(
+                "the synchronous export `{}` runs without one. Declare the export `async` in \
+                 WIT to use timers and async imports",
+                wit_function_name(func.interface(), func.name())
+            )
+        };
+
+        init::with_scope(|scope| {
+            // Pop the arguments and call the export. The result is rooted on
+            // `scope`.
+            let outcome = core_runtime::event_loop::without_event_loop(reason, || {
+                let outcome = dispatch_export(scope, index, func.name(), cx.stack(), &result);
+                core_runtime::event_loop::run_microtasks(scope);
+                outcome
+            });
+
+            // Push the result in the form expected by the generated lowering
+            // code: nothing if there is no result, the value for a plain result,
+            // and a `{tag, val}` object for a `result`.
+            push_export_result(cx.stack(), scope, &result, outcome);
+            keep_lowering_source(cx.stack(), &result, index);
+
+            // Borrows are released here, before `export_finish`, because dropping
+            // one calls an import, which post-return forbids.
+            if resources::release_borrows(cx.stack(), scope, &drop_exported_handle).is_err() {
+                trap(scope, "releasing borrows at export end failed")
+            }
+        });
+    }
+
+    /// Call an async export: create an event loop for the call, call the export
+    /// with the lifted arguments on `cx`'s stack, run the loop until the
+    /// returned promise settles, and lower the result with `task-return`.
+    ///
+    /// Each call has its own
+    /// [`OwnedInvocation`](core_runtime::invocation::OwnedInvocation), so that
+    /// the timers, `fetch` calls and async imports of concurrent calls are kept
+    /// apart. The returned promise is kept on the call's stack, because no
+    /// [`Scope`] can be held across an `await`.
+    #[allow(clippy::manual_async_fn)]
+    fn export_call_async(
+        _wit: Wit,
+        func: ExportFunction,
+        cx: Box<CallCx<'static>>,
+    ) -> impl std::future::Future<Output = ()> {
+        async move {
+            init::before_export();
+            let mut cx = cx;
+            let index = func.index();
+            let result = crate::exports::with_export_table(|table| table.result(index));
+
+            let invocation =
+                core_runtime::invocation::OwnedInvocation::new(init::runtime(), Default::default());
+
+            // Phase 1: call the export, and keep its result on the call stack,
+            // which is traced during the awaits below.
+            //
+            // The result isn't necessarily a promise: a plain function returns a
+            // value, and an exception converted into an `err` value is returned
+            // as `Outcome::Threw`. The event loop isn't run for either.
+            let name = func.name();
+            let pending = init::with_scope(|scope| {
+                core_runtime::event_loop::with_event_loop(invocation.state().event_loop(), |_| {
+                    let outcome = dispatch_export(scope, index, name, cx.stack(), &result);
+                    core_runtime::event_loop::run_microtasks(scope);
+                    match outcome {
+                        // For a `future` result, the returned promise is
+                        // lowered as the future, without waiting for it.
+                        crate::exports::Outcome::Returned(v)
+                            if result == crate::exports::ResultShape::Future =>
+                        {
+                            cx.stack().push_value(v.get());
+                            StackTop::Future
+                        }
+                        crate::exports::Outcome::Returned(v) => {
+                            let pending = !crate::exports::promise_is_settled(scope, v);
+                            cx.stack().push_value(v.get());
+                            // The event loop only runs if the value is a
+                            // pending promise.
+                            StackTop::Returned { pending }
+                        }
+                        crate::exports::Outcome::Threw(v) => {
+                            // An exception thrown synchronously and converted
+                            // into an `err` value.
+                            cx.stack().push_value(v.get());
+                            StackTop::Threw
+                        }
+                    }
+                })
+            });
+
+            // Phase 2: run this call's event loop until the promise on top of
+            // the stack settles.
+            if matches!(pending, StackTop::Returned { pending: true }) {
+                let stack = cx.stack_ref();
+                crate::run::drive_until_settled(init::raw_cx(), &invocation, |scope| {
+                    scope.root_value(stack.last())
+                })
+                .await;
+            }
+
+            // Phase 3: convert the value on top of the stack into an `Outcome`,
+            // and push the result in the form expected by the generated lowering
+            // code.
+            init::with_scope(|scope| {
+                let top = scope.root_value(cx.stack().pop_value());
+                let outcome = match pending {
+                    StackTop::Threw => crate::exports::Outcome::Threw(top),
+                    StackTop::Future => crate::exports::Outcome::Returned(top),
+                    StackTop::Returned { .. } => settled_outcome(scope, top, &result, func),
+                };
+                push_export_result(cx.stack(), scope, &result, outcome);
+                keep_lowering_source(cx.stack(), &result, index);
+                // Dropping a borrow calls the `[resource-drop]` import, which is
+                // legal here but would trap after `task-return`.
+                if resources::release_borrows(cx.stack(), scope, &drop_exported_handle).is_err() {
+                    trap(scope, "releasing borrows at async export end failed")
+                }
+            });
+
+            // Lowering a stream or future result starts the pump or write that
+            // fills it on this call's event loop, so the loop is active during
+            // the lowering. Microtasks queued by the lowering, such as the start
+            // of a pump, run before the loop does.
+            core_runtime::event_loop::with_event_loop(invocation.state().event_loop(), |_| {
+                func.call_task_return(&mut *cx);
+                init::with_scope(core_runtime::event_loop::run_microtasks);
+            });
+
+            // The values of a stream or future result are transferred after
+            // `task-return`, on this call's event loop, which runs until the
+            // transfers are done.
+            crate::run::drain_async_work(init::raw_cx(), &invocation).await;
+
+            // Pending timers are dropped with the event loop.
+            drop(invocation);
+        }
+    }
+
+    /// Drop the call context, which frees its deferred allocations. This runs in
+    /// `cabi_post`, where calling imports isn't allowed, so borrows are
+    /// released earlier, in [`export_call`](Self::export_call).
+    fn export_finish(cx: Box<CallCx<'_>>, _func: ExportFunction) {
+        drop(cx);
+    }
+
+    /// Drop the exported resource with the rep `handle`, whose type is `ty` (see
+    /// [`resources::drop_exported`]).
+    fn resource_dtor(ty: Resource, handle: usize) {
+        let rep = handle as u32;
+        let expected = ty.index() as u32;
+        init::with_scope(|scope| {
+            if resources::drop_exported(scope, rep, expected).is_err() {
+                trap(scope, "dropping an exported resource failed")
+            }
+        });
+    }
+}
+
+// ===========================================================================
+// The `Call` implementation
+// ===========================================================================
+
+impl Call for CallCx<'_> {
+    unsafe fn defer_deallocate(&mut self, ptr: *mut u8, layout: Layout) {
+        // SAFETY: forwarded unchanged from the generated caller, which owns the
+        // allocation.
+        unsafe { self.stack().defer_deallocate(ptr, layout) }
+    }
+
+    // --- Lower (pop_*): JS value off the stack -> WIT value ---
+
+    fn pop_u8(&mut self) -> u8 {
+        self.pop(value::pop_u8, "pop_u8")
+    }
+    fn pop_u16(&mut self) -> u16 {
+        self.pop(value::pop_u16, "pop_u16")
+    }
+    fn pop_u32(&mut self) -> u32 {
+        self.pop(value::pop_u32, "pop_u32")
+    }
+    fn pop_u64(&mut self) -> u64 {
+        self.pop(value::pop_u64, "pop_u64")
+    }
+    fn pop_s8(&mut self) -> i8 {
+        self.pop(value::pop_s8, "pop_s8")
+    }
+    fn pop_s16(&mut self) -> i16 {
+        self.pop(value::pop_s16, "pop_s16")
+    }
+    fn pop_s32(&mut self) -> i32 {
+        self.pop(value::pop_s32, "pop_s32")
+    }
+    fn pop_s64(&mut self) -> i64 {
+        self.pop(value::pop_s64, "pop_s64")
+    }
+    fn pop_bool(&mut self) -> bool {
+        self.pop(value::pop_bool, "pop_bool")
+    }
+    fn pop_char(&mut self) -> char {
+        self.pop(value::pop_char, "pop_char")
+    }
+    fn pop_f32(&mut self) -> f32 {
+        self.pop(value::pop_f32, "pop_f32")
+    }
+    fn pop_f64(&mut self) -> f64 {
+        self.pop(value::pop_f64, "pop_f64")
+    }
+
+    fn pop_string(&mut self) -> &str {
+        // The string is stored on the stack, so the returned `&str` stays valid
+        // until the call ends.
+        let owned = self.pop(value::pop_string, "pop_string");
+        self.stack().store_string(owned)
+    }
+
+    fn pop_borrow(&mut self, ty: Resource) -> u32 {
+        with_resource_desc(ty, |desc| {
+            self.pop(|s, sc| resources::pop_borrow(s, sc, desc), "pop_borrow")
+        })
+    }
+    fn pop_own(&mut self, ty: Resource) -> u32 {
+        // For an imported resource type with a registered adapter, values
+        // converted by the adapter are also accepted.
+        let adapter = match ty.new() {
+            None => resources::own_adapter(ty.interface(), ty.name()).map(|(adapter, _)| adapter),
+            Some(_) => None,
+        };
+        if let Some(adapter) = adapter {
+            let adapted = self.pop(
+                |s, sc| {
+                    let value = sc.root_value(s.last());
+                    if resources::imported_wrapper(sc, value).is_some() {
+                        return Ok(None);
+                    }
+                    let handle = adapter(sc, value)?;
+                    if handle.is_some() {
+                        s.pop_value();
+                    }
+                    Ok(handle)
+                },
+                "pop_own",
+            );
+            if let Some(handle) = adapted {
+                return handle;
+            }
+        }
+        with_resource_desc(ty, |desc| {
+            self.pop(|s, sc| resources::pop_own(s, sc, desc), "pop_own")
+        })
+    }
+    fn pop_enum(&mut self, ty: Enum) -> u32 {
+        let cases = ty.names().len() as u32;
+        self.pop(|s, sc| value::pop_enum(s, sc, cases), "pop_enum")
+    }
+    fn pop_flags(&mut self, ty: Flags) -> u32 {
+        let flags = ty.names().len() as u32;
+        self.pop(|s, sc| value::pop_flags(s, sc, flags), "pop_flags")
+    }
+    fn pop_future(&mut self, ty: Future) -> u32 {
+        // Lowering a `future` passes its readable end to the host.
+        let index = ty.index() as u32;
+        self.pop(
+            |s, sc| crate::promises::future_to_handle(sc, sc.root_value(s.pop_value()), index),
+            "pop_future",
+        )
+    }
+    fn pop_stream(&mut self, ty: Stream) -> u32 {
+        // Lowering a `stream` passes its readable end to the host.
+        let index = ty.index() as u32;
+        self.pop(
+            |s, sc| crate::readable::stream_to_handle(sc, sc.root_value(s.pop_value()), index),
+            "pop_stream",
+        )
+    }
+    fn pop_option(&mut self, ty: WitOption) -> u32 {
+        let nested = inner_is_option(ty);
+        let is_some = self.pop(|s, sc| value::pop_option(s, sc, nested), "pop_option");
+        is_some as u32
+    }
+    fn pop_result(&mut self, ty: WitResult) -> u32 {
+        let (ok, err) = (ty.ok().is_some(), ty.err().is_some());
+        self.pop(|s, sc| value::pop_result(s, sc, ok, err), "pop_result")
+    }
+    fn pop_variant(&mut self, ty: Variant) -> u32 {
+        let cases = variant_cases(ty);
+        self.pop(|s, sc| value::pop_variant(s, sc, &cases), "pop_variant")
+    }
+    fn pop_record(&mut self, ty: Record) {
+        let names = record_field_names(ty);
+        self.pop(|s, sc| value::pop_record(s, sc, &names), "pop_record")
+    }
+    fn pop_tuple(&mut self, ty: Tuple) {
+        let len = ty.types().count();
+        self.pop(|s, sc| value::pop_tuple(s, sc, len), "pop_tuple")
+    }
+
+    /// Lower a list of numbers given as a typed array, or as a
+    /// [`TypeShapeValue::NumericList`], into a buffer. Returns `None` for other
+    /// element types and other values, which are lowered with
+    /// [`pop_list`](Self::pop_list) instead.
+    ///
+    /// The returned pointer isn't null, even for an empty list, because a null
+    /// pointer selects `pop_list`. The buffer is freed when the [`CallStack`] is
+    /// dropped.
+    unsafe fn maybe_pop_list(&mut self, ty: List) -> Option<(*const u8, usize)> {
+        let elem = numeric_scalar_shape(ty.ty())?;
+        let stack = self.stack();
+        let is_view = match stack.last_shaped() {
+            Some(shaped) => matches!(shaped, TypeShapeValue::NumericList(_)),
+            None => init::with_scope(|scope| {
+                js::ArrayBufferView::from_jsval(scope, scope.root_value(stack.last()), ()).is_ok()
+            }),
+        };
+        if !is_view {
+            return None;
+        }
+        let (dst, layout, count) = self.pop(
+            |s, sc| value::pop_numeric_list(s, sc, &elem),
+            "maybe_pop_list",
+        );
+        if count > 0 {
+            // SAFETY: `pop_numeric_list` transferred ownership of an allocation
+            // made with the global allocator and exactly this layout.
+            unsafe { self.stack().defer_deallocate(dst, layout) };
+        }
+        Some((dst as *const u8, count))
+    }
+
+    fn pop_list(&mut self, _ty: List) -> usize {
+        self.pop(|s, sc| s.lower_list_begin(sc), "pop_list")
+    }
+    fn pop_list_iter_next(&mut self, _ty: List) {
+        self.pop(|s, sc| s.lower_list_next(sc), "pop_list_iter_next")
+    }
+    fn pop_list_iter(&mut self, _ty: List) {
+        self.stack().lower_list_end();
+    }
+
+    fn pop_map(&mut self, _ty: Map) -> usize {
+        unimplemented!("maps are not yet supported")
+    }
+    fn pop_map_iter_next(&mut self, _ty: Map) {
+        unimplemented!("maps are not yet supported")
+    }
+    fn pop_map_iter(&mut self, _ty: Map) {
+        unimplemented!("maps are not yet supported")
+    }
+
+    // --- Lift (push_*): WIT value -> JS value onto the stack ---
+
+    fn push_bool(&mut self, val: bool) {
+        value::push_bool(self.stack(), val);
+    }
+    fn push_char(&mut self, val: char) {
+        self.push(|s, sc| value::push_char(s, sc, val), "push_char");
+    }
+    fn push_u8(&mut self, val: u8) {
+        value::push_u8(self.stack(), val);
+    }
+    fn push_s8(&mut self, val: i8) {
+        value::push_s8(self.stack(), val);
+    }
+    fn push_u16(&mut self, val: u16) {
+        value::push_u16(self.stack(), val);
+    }
+    fn push_s16(&mut self, val: i16) {
+        value::push_s16(self.stack(), val);
+    }
+    fn push_u32(&mut self, val: u32) {
+        value::push_u32(self.stack(), val);
+    }
+    fn push_s32(&mut self, val: i32) {
+        value::push_s32(self.stack(), val);
+    }
+    fn push_u64(&mut self, val: u64) {
+        self.push(|s, sc| value::push_u64(s, sc, val), "push_u64");
+    }
+    fn push_s64(&mut self, val: i64) {
+        self.push(|s, sc| value::push_s64(s, sc, val), "push_s64");
+    }
+    fn push_f32(&mut self, val: f32) {
+        value::push_f32(self.stack(), val);
+    }
+    fn push_f64(&mut self, val: f64) {
+        value::push_f64(self.stack(), val);
+    }
+    fn push_string(&mut self, val: String) {
+        self.push(|s, sc| value::push_string(s, sc, &val), "push_string");
+    }
+    fn push_record(&mut self, ty: Record) {
+        let names = record_field_names(ty);
+        self.push(|s, sc| value::push_record(s, sc, &names), "push_record");
+    }
+    fn push_tuple(&mut self, ty: Tuple) {
+        let len = ty.types().count();
+        self.push(|s, sc| value::push_tuple(s, sc, len), "push_tuple");
+    }
+    fn push_flags(&mut self, _ty: Flags, bits: u32) {
+        self.push(
+            |s, _sc| {
+                value::push_flags(s, bits);
+                Ok(())
+            },
+            "push_flags",
+        );
+    }
+    fn push_enum(&mut self, ty: Enum, discr: u32) {
+        let cases = ty.names().len() as u32;
+        self.push(|s, sc| value::push_enum(s, sc, cases, discr), "push_enum");
+    }
+    fn push_borrow(&mut self, ty: Resource, handle: u32) {
+        with_resource_desc(ty, |desc| {
+            self.push(
+                |s, sc| resources::push_borrow(s, sc, desc, handle),
+                "push_borrow",
+            )
+        });
+    }
+    fn push_own(&mut self, ty: Resource, handle: u32) {
+        with_resource_desc(ty, |desc| {
+            self.push(|s, sc| resources::push_own(s, sc, desc, handle), "push_own")
+        });
+    }
+    fn push_future(&mut self, ty: Future, handle: u32) {
+        let index = ty.index() as u32;
+        self.push(
+            |s, sc| {
+                s.push_value(crate::promises::future_from_handle(sc, index, handle)?);
+                Ok(())
+            },
+            "push_future",
+        );
+    }
+    fn push_stream(&mut self, ty: Stream, handle: u32) {
+        let index = ty.index() as u32;
+        self.push(
+            |s, sc| {
+                s.push_value(crate::readable::stream_from_handle(sc, index, handle)?);
+                Ok(())
+            },
+            "push_stream",
+        );
+    }
+    fn push_variant(&mut self, ty: Variant, discr: u32) {
+        let cases = variant_cases(ty);
+        self.push(
+            |s, sc| value::push_variant(s, sc, &cases, discr),
+            "push_variant",
+        );
+    }
+    fn push_option(&mut self, ty: WitOption, is_some: bool) {
+        let nested = inner_is_option(ty);
+        self.push(
+            |s, sc| value::push_option(s, sc, nested, is_some),
+            "push_option",
+        );
+    }
+    fn push_result(&mut self, ty: WitResult, is_err: bool) {
+        let (ok, err) = (ty.ok().is_some(), ty.err().is_some());
+        self.push(
+            |s, sc| value::push_result(s, sc, ok, err, is_err),
+            "push_result",
+        );
+    }
+
+    /// Lift a list of numbers as a typed array that takes over the list's
+    /// buffer. Returns `false` for other element types, which are lifted with
+    /// [`push_list`](Self::push_list) and [`list_append`](Self::list_append)
+    /// instead.
+    unsafe fn push_raw_list(&mut self, ty: List, ptr: *mut u8, len: usize) -> bool {
+        let Some(elem) = numeric_scalar_shape(ty.ty()) else {
+            return false;
+        };
+        let Some(layout) = elem.numeric_list_layout(len) else {
+            self.push(
+                |_, sc| {
+                    Err(js::error::throw_range_error(
+                        sc,
+                        c"the list is longer than memory can hold",
+                    ))
+                },
+                "push_raw_list",
+            );
+            return true;
+        };
+        // Returning `true` takes ownership of the allocation: the generated code
+        // skips both its element loop and its trailing `dealloc_bytes`.
+        self.push(
+            // SAFETY: `cabi_realloc`, which made a non-empty list's allocation, and
+            // the global allocator are the same allocator, and `layout` matches
+            // what `dealloc_bytes` would have reconstructed. It holds `len` valid
+            // contiguous elements.
+            |s, sc| unsafe { value::push_numeric_list(s, sc, &elem, ptr, layout, len) },
+            "push_raw_list",
+        );
+        true
+    }
+
+    fn push_list(&mut self, _ty: List, capacity: usize) {
+        self.push(|s, sc| value::push_list_begin(s, sc, capacity), "push_list");
+    }
+    fn list_append(&mut self, _ty: List) {
+        self.push(value::list_append, "list_append");
+    }
+
+    fn push_map(&mut self, _ty: Map, _capacity: usize) {
+        unimplemented!("maps are not yet supported")
+    }
+    fn map_append(&mut self, _ty: Map) {
+        unimplemented!("maps are not yet supported")
+    }
+}
+
+impl CallCx<'_> {
+    /// Run the lowering function `f` in a new scope, and trap if it fails. `what`
+    /// names the operation in the trap message.
+    fn pop<T>(
+        &mut self,
+        f: impl FnOnce(&mut CallStack, &Scope<'_>) -> Result<T, ExnThrown>,
+        what: &str,
+    ) -> T {
+        let stack = self.stack();
+        init::with_scope(|scope| match f(stack, scope) {
+            Ok(v) => v,
+            Err(_) => lowering_failed(stack, scope, what),
+        })
+    }
+
+    /// Run the lifting function `f` in a new scope, and trap if it fails. `what`
+    /// names the operation in the trap message.
+    fn push(
+        &mut self,
+        f: impl FnOnce(&mut CallStack, &Scope<'_>) -> Result<(), ExnThrown>,
+        what: &str,
+    ) {
+        let stack = self.stack();
+        init::with_scope(|scope| {
+            if f(stack, scope).is_err() {
+                trap(scope, what)
+            }
+        });
+    }
+}
+
+// ===========================================================================
+// Import calls
+// ===========================================================================
+
+/// The [`ImportInvoker`] that calls imports with the code generated by
+/// `wit-dylib`.
+pub struct WasmImportInvoker;
+
+impl ImportInvoker for WasmImportInvoker {
+    fn invoke(
+        &self,
+        _scope: &Scope<'_>,
+        stack: &mut CallStack,
+        func: &ImportFuncDesc,
+    ) -> Result<(), ExnThrown> {
+        let w = wit();
+        let import = w.import_func(func.index as usize);
+        let mut cx = CallCx::Borrowed(stack);
+        import.call_import_sync(&mut cx);
+        Ok(())
+    }
+
+    fn supports_async(&self) -> bool {
+        true
+    }
+
+    /// Call an async import on the wit-bindgen executor. The future captures
+    /// only the import's index, so it doesn't borrow `self`.
+    fn invoke_async(
+        &self,
+        stack: CallStack,
+        func: std::rc::Rc<ImportFuncDesc>,
+    ) -> std::pin::Pin<Box<dyn std::future::Future<Output = CallStack> + 'static>> {
+        let index = func.index;
+        Box::pin(async move {
+            let mut cx = CallCx::Owned(stack);
+            let import = wit().import_func(index as usize);
+            import.call_import_async(&mut cx).await;
+            match cx {
+                CallCx::Owned(stack) => stack,
+                CallCx::Borrowed(_) => unreachable!("async import cx is always owned"),
+            }
+        })
+    }
+
+    fn drop_exported_handle(&self, type_idx: u32, handle: u32) {
+        drop_exported_handle(type_idx, handle);
+    }
+}
+
+/// Create the world's import modules (see
+/// [`imports::synthesize_import_modules`]). This is the `synthesize` argument
+/// of [`init::initialize_runtime`].
+pub fn synthesize(scope: &Scope<'_>) -> Result<(), ExnThrown> {
+    // For a world without exports, `StarlingInterpreter::initialize` isn't
+    // called, so there is no world description.
+    let Some(world) = world_desc_opt() else {
+        return Ok(());
+    };
+    imports::synthesize_import_modules(scope, &world, Rc::new(WasmImportInvoker))
+}
+
+// ===========================================================================
+// Dropping imported resources
+// ===========================================================================
+
+/// Drop the canonical handle `handle` of the imported resource type `type_idx`
+/// through the type's wit-dylib `drop`. Throws a `TypeError` if `type_idx` is out
+/// of range.
+fn drop_imported(scope: &Scope<'_>, type_idx: u32, handle: u32) -> Result<(), ExnThrown> {
+    let res = wit_resource_checked(type_idx as usize)
+        .ok_or_else(|| throw_type_error(scope, c"resource type index is out of range"))?;
+    // SAFETY: `resource.drop` traps on a handle that is not in the instance's
+    // table, so any `handle` is sound.
+    unsafe { res.drop()(handle) };
+    Ok(())
+}
+
+// ===========================================================================
+// `wit_dylib_ffi::Type` -> `TypeShape` and `Wit` -> `WorldDesc`
+// ===========================================================================
+
+/// Convert `ty` into a [`TypeShape`], with field, case and flag names converted
+/// to JS names.
+fn type_shape(ty: Type) -> TypeShape {
+    match ty {
+        Type::Bool => TypeShape::Bool,
+        Type::U8 => TypeShape::U8,
+        Type::U16 => TypeShape::U16,
+        Type::U32 => TypeShape::U32,
+        Type::U64 => TypeShape::U64,
+        Type::S8 => TypeShape::S8,
+        Type::S16 => TypeShape::S16,
+        Type::S32 => TypeShape::S32,
+        Type::S64 => TypeShape::S64,
+        Type::F32 => TypeShape::F32,
+        Type::F64 => TypeShape::F64,
+        Type::Char => TypeShape::Char,
+        Type::String => TypeShape::String,
+        Type::List(l) => TypeShape::List(Box::new(type_shape(l.ty()))),
+        Type::Record(r) => TypeShape::Record(
+            r.fields()
+                .map(|(name, ty)| (mangle_name(name), type_shape(ty)))
+                .collect(),
+        ),
+        Type::Tuple(t) => TypeShape::Tuple(t.types().map(type_shape).collect()),
+        Type::Variant(v) => TypeShape::Variant(
+            v.cases()
+                .map(|(name, ty)| (mangle_name(name), ty.map(type_shape)))
+                .collect(),
+        ),
+        Type::Enum(e) => TypeShape::Enum(e.names().map(mangle_name).collect()),
+        Type::Option(o) => TypeShape::Option(Box::new(type_shape(o.ty()))),
+        Type::Result(r) => TypeShape::Result(
+            r.ok().map(|t| Box::new(type_shape(t))),
+            r.err().map(|t| Box::new(type_shape(t))),
+        ),
+        Type::Flags(f) => TypeShape::Flags(f.names().map(mangle_name).collect()),
+        Type::Own(res) => TypeShape::OwnResource {
+            index: res.index() as u32,
+            imported: res.new().is_none(),
+        },
+        Type::Borrow(res) => TypeShape::BorrowResource {
+            index: res.index() as u32,
+            imported: res.new().is_none(),
+        },
+        Type::Alias(a) => type_shape(a.ty()),
+        Type::FixedLengthList(_) => TypeShape::Unsupported("fixed-length list"),
+        Type::Map(_) => TypeShape::Unsupported("map"),
+        Type::Stream(s) => TypeShape::Stream(s.index() as u32),
+        Type::Future(f) => TypeShape::Future(f.index() as u32),
+        Type::ErrorContext => TypeShape::Unsupported("error-context"),
+    }
+}
+
+/// Return the JS names of `r`'s fields in declaration order. The names are
+/// cached per record type.
+fn record_field_names(r: Record) -> Rc<[&'static CStr]> {
+    RECORD_NAMES.with(|cell| {
+        cached(&mut cell.borrow_mut(), r.index(), || {
+            r.fields()
+                .map(|(name, _)| js::class::static_property_name(&mangle_name(name)))
+                .collect()
+        })
+    })
+}
+
+/// Return the JS names of `v`'s cases in declaration order, each with whether
+/// the case has a value. The names are cached per variant type.
+fn variant_cases(v: Variant) -> Rc<[(&'static CStr, bool)]> {
+    VARIANT_CASES.with(|cell| {
+        cached(&mut cell.borrow_mut(), v.index(), || {
+            v.cases()
+                .map(|(name, ty)| {
+                    (
+                        js::class::static_property_name(&mangle_name(name)),
+                        ty.is_some(),
+                    )
+                })
+                .collect()
+        })
+    })
+}
+
+/// Return the entry at `index` of a cache indexed by type index, created with
+/// `build` if it doesn't exist.
+fn cached<T: ?Sized>(
+    entries: &mut Vec<Option<Rc<T>>>,
+    index: usize,
+    build: impl FnOnce() -> Rc<T>,
+) -> Rc<T> {
+    if entries.len() <= index {
+        entries.resize(index + 1, None);
+    }
+    Rc::clone(entries[index].get_or_insert_with(build))
+}
+
+/// Return the [`TypeShape`] of `ty` if it is a number type, following aliases,
+/// or `None` otherwise. Unlike [`type_shape`], this doesn't build the shapes of
+/// other types.
+fn numeric_scalar_shape(ty: Type) -> Option<TypeShape> {
+    let shape = match dealias(ty) {
+        Type::U8 => TypeShape::U8,
+        Type::U16 => TypeShape::U16,
+        Type::U32 => TypeShape::U32,
+        Type::U64 => TypeShape::U64,
+        Type::S8 => TypeShape::S8,
+        Type::S16 => TypeShape::S16,
+        Type::S32 => TypeShape::S32,
+        Type::S64 => TypeShape::S64,
+        Type::F32 => TypeShape::F32,
+        Type::F64 => TypeShape::F64,
+        _ => return None,
+    };
+    debug_assert!(shape.view_kind().is_some());
+    Some(shape)
+}
+
+/// Whether the payload type of `o` is an option, following aliases (see
+/// [`value::push_option`]).
+fn inner_is_option(o: WitOption) -> bool {
+    matches!(dealias(o.ty()), Type::Option(_))
+}
+
+/// Return the type that `ty` refers to, following aliases.
+fn dealias(mut ty: Type) -> Type {
+    while let Type::Alias(alias) = ty {
+        ty = alias.ty();
+    }
+    ty
+}
+
+/// Run `f` with the [`ResourceDesc`] of the resource type `ty`. A type with
+/// `new` and `rep` functions is exported. Any other type is imported.
+fn with_resource_desc<R>(ty: Resource, f: impl FnOnce(&ResourceDesc<'_>) -> R) -> R {
+    let type_idx = ty.index() as u32;
+    match (ty.new(), ty.rep()) {
+        (Some(new), Some(rep)) => {
+            let drop = ty.drop();
+            // SAFETY: `new`, `rep` and `drop` are this type's canonical
+            // `resource.new`, `resource.rep` and `resource.drop`. `resource.new`
+            // takes any rep, and the other two trap on a handle that is not in
+            // the instance's table, so any argument is sound.
+            let new_fn = move |rep_index: u32| unsafe { new(rep_index as usize) };
+            let rep_fn = move |handle: u32| unsafe { rep(handle) as u32 };
+            let drop_fn = move |handle: u32| unsafe { drop(handle) };
+            f(&ResourceDesc::Exported {
+                type_idx,
+                new: &new_fn,
+                rep: &rep_fn,
+                drop: &drop_fn,
+            })
+        }
+        _ => f(&ResourceDesc::Imported { type_idx }),
+    }
+}
+
+/// Drop `handle`, a handle of the exported resource type `type_idx` that was
+/// created to lend a resource to the host (see [`resources::release_borrows`]).
+fn drop_exported_handle(type_idx: u32, handle: u32) {
+    let res = wit().resource(type_idx as usize);
+    // SAFETY: as in `drop_imported`.
+    unsafe { res.drop()(handle) };
+}
+
+/// Build the description of the world's imports from `wit`, without using
+/// SpiderMonkey.
+///
+/// Imports are grouped by interface, with a separate group for the imports
+/// defined on the world. Each interface's functions are sorted into functions
+/// that don't belong to a resource, and the constructors, methods and static
+/// functions of each resource. Only imported resources get a class.
+fn build_world_desc(wit: Wit) -> WorldDesc {
+    use std::collections::{BTreeMap, BTreeSet};
+
+    // The imports of one interface, keyed by the interface's WIT name, or by
+    // `None` for the imports defined on the world.
+    #[derive(Default)]
+    struct Acc {
+        functions: Vec<ImportFuncDesc>,
+        resources: BTreeMap<String, ResAcc>,
+        error_classes: Vec<ErrorClass>,
+        enums: Vec<EnumDesc>,
+    }
+    #[derive(Default)]
+    struct ResAcc {
+        type_idx: Option<u32>,
+        constructor: Option<ImportFuncDesc>,
+        methods: Vec<(String, ImportFuncDesc)>,
+        statics: Vec<(String, ImportFuncDesc)>,
+    }
+
+    // The interfaces in the order in which they are found, so that the modules
+    // are created in a stable order.
+    let mut order: Vec<Option<String>> = Vec::new();
+    let mut ifaces: BTreeMap<Option<String>, Acc> = BTreeMap::new();
+
+    for import in wit.iter_import_funcs() {
+        let iface_key = import.interface().map(str::to_string);
+        if !ifaces.contains_key(&iface_key) {
+            order.push(iface_key.clone());
+        }
+        let acc = ifaces.entry(iface_key).or_default();
+
+        let func = ImportFuncDesc {
+            index: import.index() as u32,
+            name: import.name().to_string(),
+            params: import.params().map(type_shape).collect(),
+            result: import.result().map(type_shape),
+            // `AsyncFilterSet::default()` binds an `async` WIT import as async,
+            // so its `async_impl` function is present.
+            is_async: import.is_async(),
+            err_class: err_class_of(import.result()),
+        };
+        match FunctionName::parse(import.name()) {
+            FunctionName::Constructor { resource } => {
+                let res = acc.resources.entry(resource.to_string()).or_default();
+                // A constructor's result is `own<R>`, giving the resource type index.
+                res.type_idx = res.type_idx.or_else(|| own_type_idx(func.result.as_ref()));
+                res.constructor = Some(func);
+            }
+            FunctionName::Method { resource, name } => {
+                let res = acc.resources.entry(resource.to_string()).or_default();
+                // A method's first parameter is `borrow<R>` or `own<R>`, giving the
+                // type.
+                res.type_idx = res
+                    .type_idx
+                    .or_else(|| handle_type_idx(func.params.first()));
+                res.methods.push((mangle_name(name), func));
+            }
+            FunctionName::Static { resource, name } => {
+                let res = acc.resources.entry(resource.to_string()).or_default();
+                res.statics.push((mangle_name(name), func));
+            }
+            FunctionName::Plain(_) => acc.functions.push(func),
+        }
+    }
+    // An imported resource without a constructor, method or static function
+    // also gets a class, so that its wrappers have `[Symbol.dispose]()` and its
+    // module exports the class. Only exported resources have a `new` function.
+    for resource in wit
+        .iter_resources()
+        .filter(|resource| resource.new().is_none())
+    {
+        let iface_key = resource.interface().map(str::to_string);
+        if !ifaces.contains_key(&iface_key) {
+            order.push(iface_key.clone());
+        }
+        let res = ifaces
+            .entry(iface_key)
+            .or_default()
+            .resources
+            .entry(resource.name().to_string())
+            .or_default();
+        res.type_idx = res.type_idx.or(Some(resource.index() as u32));
+    }
+
+    // Each error class is exported from the module of the interface defining
+    // its type.
+    let mut error_classes = Vec::new();
+    for import in wit.iter_import_funcs() {
+        for param in import.params() {
+            collect_err_classes(param, false, &mut error_classes);
+        }
+        if let Some(result) = import.result() {
+            collect_err_classes(result, true, &mut error_classes);
+        }
+    }
+    for export in wit.iter_export_funcs() {
+        for param in export.params() {
+            collect_err_classes(param, false, &mut error_classes);
+        }
+        if let Some(result) = export.result() {
+            collect_err_classes(result, true, &mut error_classes);
+        }
+    }
+    // A class whose type is defined by an exported interface without a module
+    // isn't exported. Every other class is exported from the module of its
+    // interface, or from the module for the world, which are created even if
+    // they have no functions.
+    let exported: BTreeSet<&str> = wit
+        .iter_export_funcs()
+        .filter_map(|export| export.interface())
+        .collect();
+    let mut unexported_error_classes = Vec::new();
+    for class in error_classes {
+        let key = class.interface.clone();
+        if key.as_deref().is_some_and(|name| exported.contains(name)) && !ifaces.contains_key(&key)
+        {
+            unexported_error_classes.push(class);
+            continue;
+        }
+        if !ifaces.contains_key(&key) {
+            order.push(key.clone());
+        }
+        ifaces.entry(key).or_default().error_classes.push(class);
+    }
+
+    // Each enum and flags type gets an object in the module of the interface
+    // that defines it, and in the module of each interface that `use`s it, under
+    // its name in that interface. Interfaces that the world only exports are
+    // skipped. If an error class has the same name, only the error class is
+    // exported.
+    let mut enums: Vec<(Option<&str>, EnumDesc)> = Vec::new();
+    for e in wit.iter_enums() {
+        enums.extend(enum_desc(e.name(), Type::Enum(e)).map(|desc| (e.interface(), desc)));
+    }
+    for flags in wit.iter_flags() {
+        enums.extend(
+            enum_desc(flags.name(), Type::Flags(flags)).map(|desc| (flags.interface(), desc)),
+        );
+    }
+    for alias in wit.iter_aliases() {
+        enums.extend(enum_desc(alias.name(), alias.ty()).map(|desc| (alias.interface(), desc)));
+    }
+    for (interface, desc) in enums {
+        if interface.is_some_and(is_export_only) {
+            continue;
+        }
+        let key = interface.map(str::to_string);
+        if !ifaces.contains_key(&key) {
+            order.push(key.clone());
+        }
+        let acc = ifaces.entry(key).or_default();
+        let taken = |name: &str| {
+            acc.error_classes
+                .iter()
+                .any(|class| class.js_name() == name)
+                || acc.enums.iter().any(|e| e.js_name == name)
+        };
+        if !taken(&desc.js_name) {
+            acc.enums.push(desc);
+        }
+    }
+
+    let mut interfaces = Vec::new();
+    for key in order {
+        let acc = ifaces.remove(&key).expect("key from discovery order");
+        let resources = acc
+            .resources
+            .into_iter()
+            .map(|(name, res)| ResourceTypeDesc {
+                // A resource missing from the world's resource list gets the
+                // type index `u32::MAX`, which means that it has none.
+                type_idx: res.type_idx.unwrap_or(u32::MAX),
+                name,
+                constructor: res.constructor,
+                methods: res.methods,
+                statics: res.statics,
+            })
+            .collect();
+        interfaces.push(InterfaceDesc {
+            wit_name: key,
+            functions: acc.functions,
+            resources,
+            error_classes: acc.error_classes,
+            enums: acc.enums,
+        });
+    }
+
+    WorldDesc {
+        interfaces,
+        unexported_error_classes,
+    }
+}
+
+/// Return the [`EnumDesc`] named `name` for `ty`, following aliases, or `None`
+/// if `ty` is neither an enum nor a flags type.
+fn enum_desc(name: &str, ty: Type) -> Option<EnumDesc> {
+    let members = match dealias(ty) {
+        Type::Enum(e) => e
+            .names()
+            .enumerate()
+            .map(|(index, case)| (mangle_name(case), index as i32))
+            .collect(),
+        // Flags are lifted as an int32, so bit 31 is negative.
+        Type::Flags(flags) => flags
+            .names()
+            .enumerate()
+            .map(|(bit, flag)| (mangle_name(flag), (1u32 << bit) as i32))
+            .collect(),
+        _ => return None,
+    };
+    Some(EnumDesc {
+        js_name: mangle_resource_name(name),
+        members,
+    })
+}
+
+/// The check of the own adapter that converts values to the imported resource
+/// type `index`, if one is registered (see
+/// [`resources::register_own_adapter`]).
+pub(crate) fn own_adapter_check(index: u32) -> Option<resources::OwnAdapterCheck> {
+    let resource = wit().resource(index as usize);
+    resources::own_adapter(resource.interface(), resource.name()).map(|(_, check)| check)
+}
+
+/// The resource type index of an `own<R>` result, if `ty` is one.
+fn own_type_idx(ty: Option<&TypeShape>) -> Option<u32> {
+    match ty {
+        Some(TypeShape::OwnResource { index, .. }) => Some(*index),
+        _ => None,
+    }
+}
+
+/// The resource type index of an `own<R>`/`borrow<R>` handle parameter.
+fn handle_type_idx(ty: Option<&TypeShape>) -> Option<u32> {
+    match ty {
+        Some(TypeShape::OwnResource { index, .. })
+        | Some(TypeShape::BorrowResource { index, .. }) => Some(*index),
+        _ => None,
+    }
+}
+
+// ===========================================================================
+// Helpers
+// ===========================================================================
+
+/// Trap with an error message made from `what` and the pending exception.
+pub(crate) fn trap(scope: &Scope<'_>, what: &str) -> ! {
+    trap_with(what, ExnThrown::capture(scope))
+}
+
+/// Like [`trap`], with the captured exception `captured`.
+fn trap_with(what: &str, captured: CapturedError) -> ! {
+    match captured.message {
+        Some(_) => trap_message(&format!("{what}: {captured}")),
+        None => trap_message(what),
+    }
+}
+
+/// Print `message` on stderr and trap the component call.
+pub(crate) fn trap_message(message: &str) -> ! {
+    eprintln!("component trapped: {}", message.trim_end());
+    std::arch::wasm32::unreachable()
+}
+
+/// Trap for the failed lowering function `what`, with the pending exception.
+///
+/// If an export's result is being lowered, the trap message instead describes
+/// the part of the result that can't be lowered (see
+/// [`keep_lowering_source`]).
+fn lowering_failed(stack: &CallStack, scope: &Scope<'_>, what: &str) -> ! {
+    let captured = ExnThrown::capture(scope);
+    if let Some((value, index)) = stack.lowering_source(scope) {
+        let func = wit().export_func(index);
+        if let Some(ty) = func.result() {
+            if let Err(mismatch) = crate::validate::check(scope, value, &type_shape(ty)) {
+                let mut message = mismatch.describe(&format!(
+                    "the result of export `{}`",
+                    wit_function_name(func.interface(), func.name())
+                ));
+                // An `async` export's promise is awaited before its result is
+                // lowered, so a promise here is the result of a sync export.
+                if mismatch.path.is_empty() && js::Promise::from_jsval(scope, value, ()).is_ok() {
+                    message.push_str(
+                        ". The function is not `async` in WIT, so it cannot return a promise. \
+                         Declare it `async`, or return the value itself.",
+                    );
+                }
+                trap_message(&message);
+            }
+        }
+    }
+    trap_with(what, captured)
+}
+
+/// Keep the export result on top of `stack` for [`lowering_failed`], unless
+/// the export has no result.
+fn keep_lowering_source(stack: &mut CallStack, result: &ResultShape, index: usize) {
+    if *result != ResultShape::None {
+        stack.set_lowering_source(stack.last(), index);
+    }
+}
+
+/// Return a WIT function's name for messages: `interface#name`, or `name` for a
+/// function defined on the world. The functions of the runtime's own
+/// `wasi:http/handler` export are named `wasi:http/handler#name`.
+fn wit_function_name(interface: Option<&str>, name: &str) -> String {
+    let raw = interface.is_some_and(|interface| {
+        RAW_HTTP_HANDLER.with(|cell| cell.borrow().as_deref() == Some(interface))
+    });
+    let interface = if raw {
+        Some(HTTP_HANDLER_INTERFACE)
+    } else {
+        interface
+    };
+    wit_name_mapping::function_wit_name(interface, name)
+}
+
+/// Return `ty` as it is written in WIT, such as `future<list<string>>`. Named
+/// types are written as their name, without their interface.
+pub(crate) fn wit_type_name(ty: Type) -> String {
+    let named = |name: Option<&str>, spelled: &dyn Fn() -> String| match name {
+        Some(name) => name.to_string(),
+        None => spelled(),
+    };
+    let optional = |base: &str, ty: Option<Type>| match ty {
+        Some(ty) => format!("{base}<{}>", wit_type_name(ty)),
+        None => base.to_string(),
+    };
+    match ty {
+        Type::U8 => "u8".to_string(),
+        Type::U16 => "u16".to_string(),
+        Type::U32 => "u32".to_string(),
+        Type::U64 => "u64".to_string(),
+        Type::S8 => "s8".to_string(),
+        Type::S16 => "s16".to_string(),
+        Type::S32 => "s32".to_string(),
+        Type::S64 => "s64".to_string(),
+        Type::Bool => "bool".to_string(),
+        Type::Char => "char".to_string(),
+        Type::F32 => "f32".to_string(),
+        Type::F64 => "f64".to_string(),
+        Type::String => "string".to_string(),
+        Type::ErrorContext => "error-context".to_string(),
+        Type::Record(record) => record.name().to_string(),
+        Type::Own(resource) => resource.name().to_string(),
+        Type::Borrow(resource) => format!("borrow<{}>", resource.name()),
+        Type::Flags(flags) => flags.name().to_string(),
+        Type::Enum(e) => e.name().to_string(),
+        Type::Variant(variant) => variant.name().to_string(),
+        Type::Alias(alias) => alias.name().to_string(),
+        Type::Tuple(tuple) => named(tuple.name(), &|| {
+            let types: Vec<String> = tuple.types().map(wit_type_name).collect();
+            format!("tuple<{}>", types.join(", "))
+        }),
+        Type::Option(option) => named(option.name(), &|| {
+            format!("option<{}>", wit_type_name(option.ty()))
+        }),
+        Type::Result(result) => named(result.name(), &|| match (result.ok(), result.err()) {
+            (None, None) => "result".to_string(),
+            (Some(ok), None) => format!("result<{}>", wit_type_name(ok)),
+            (None, Some(err)) => format!("result<_, {}>", wit_type_name(err)),
+            (Some(ok), Some(err)) => {
+                format!("result<{}, {}>", wit_type_name(ok), wit_type_name(err))
+            }
+        }),
+        Type::List(list) => named(list.name(), &|| {
+            format!("list<{}>", wit_type_name(list.ty()))
+        }),
+        Type::Map(map) => named(map.name(), &|| {
+            format!(
+                "map<{}, {}>",
+                wit_type_name(map.key_type()),
+                wit_type_name(map.value_type())
+            )
+        }),
+        Type::FixedLengthList(list) => named(list.name(), &|| {
+            format!("list<{}, {}>", wit_type_name(list.ty()), list.len())
+        }),
+        Type::Future(future) => named(future.name(), &|| optional("future", future.ty())),
+        Type::Stream(stream) => named(stream.name(), &|| optional("stream", stream.ty())),
+    }
+}
+
+js::instance_local! {
+    /// The name of the exported interface that has the runtime's own
+    /// declaration of `wasi:http/handler` (see [`install_exports`]).
+    static RAW_HTTP_HANDLER: RefCell<Option<String>> = const { RefCell::new(None) };
+}
+
+/// The kind of value left on top of the call stack by phase 1 of an async
+/// export call.
+enum StackTop {
+    /// The value returned by the export. `pending` is set if it is a pending
+    /// promise.
+    Returned { pending: bool },
+    /// The `err` value converted from an exception thrown synchronously.
+    Threw,
+    /// The value returned for a `future` result, which is lowered as the future
+    /// whether or not it has settled.
+    Future,
+}
+
+/// Pop the lifted arguments off `stack`, and call the export `index` (see
+/// [`crate::exports::call_export`]). Traps if the export throws an exception
+/// that isn't converted into an `err` value. `name` is the export's WIT name,
+/// for the trap message.
+fn dispatch_export<'s>(
+    scope: &'s Scope<'_>,
+    index: usize,
+    name: &str,
+    stack: &mut CallStack,
+    result: &ResultShape,
+) -> crate::exports::Outcome<'s> {
+    // Each argument is rooted when it is popped. The arguments were pushed in
+    // order, so they are popped starting with the last one.
+    let mut args: smallvec::SmallVec<[HandleValue<'_>; 8]> =
+        smallvec::smallvec![HandleValue::undefined(); stack.len()];
+    for arg in args.iter_mut().rev() {
+        *arg = scope.root_value(stack.pop_value());
+    }
+
+    let resolved = crate::exports::with_export_table(|table| table.resolved(scope, index));
+    crate::exports::call_export(scope, resolved, &args, result).unwrap_or_else(|err| {
+        let func = wit().export_func(index);
+        trap_with(
+            &format!(
+                "export `{}` threw",
+                wit_function_name(func.interface(), name)
+            ),
+            err,
+        )
+    })
+}
+
+/// Convert the value returned by the async export `func` into an
+/// [`Outcome`](crate::exports::Outcome). Traps if the value is a pending
+/// promise, or a promise rejected with a reason that can't be converted into an
+/// `err` value.
+///
+/// The event loop also stops when it has no work left, so the promise can
+/// still be pending, such as for `await new Promise(() => {})`.
+fn settled_outcome<'s>(
+    scope: &'s Scope<'_>,
+    value: HandleValue<'s>,
+    result: &ResultShape,
+    func: ExportFunction,
+) -> crate::exports::Outcome<'s> {
+    let name = || wit_function_name(func.interface(), func.name());
+    match js::Promise::from_jsval(scope, value, ()) {
+        Ok(promise) => {
+            if promise.is_pending() {
+                trap(
+                    scope,
+                    &format!(
+                        "the async export `{}` did not settle: the event loop went idle while \
+                         the promise it returned was still pending",
+                        name()
+                    ),
+                )
+            }
+            crate::exports::settled_promise_outcome(scope, &promise, result).unwrap_or_else(
+                |reason| trap(scope, &format!("the async export `{}`: {reason}", name())),
+            )
+        }
+        Err(_) => crate::exports::Outcome::Returned(value),
+    }
+}
+
+/// Push the result of an export in the form expected by the generated lowering
+/// code: nothing if there is no result, the value for a plain result, and a
+/// `{tag, val}` object for a `result`.
+fn push_export_result(
+    stack: &mut CallStack,
+    scope: &Scope<'_>,
+    result: &ResultShape,
+    outcome: crate::exports::Outcome<'_>,
+) {
+    match result {
+        ResultShape::None => {}
+        ResultShape::Result { ok, err } => {
+            let err = err.is_some();
+            let (value, is_err) = match outcome {
+                crate::exports::Outcome::Returned(v) => (v, false),
+                crate::exports::Outcome::Threw(v) => (v, true),
+            };
+            let has_payload = if is_err { err } else { *ok };
+            if has_payload {
+                stack.push_value(value.get());
+            }
+            if value::push_result(stack, scope, *ok, err, is_err).is_err() {
+                trap(scope, "lifting an export result wrapper")
+            }
+        }
+        ResultShape::Plain | ResultShape::Future => match outcome {
+            crate::exports::Outcome::Returned(v) => stack.push_value(v.get()),
+            // Unreachable: `call_export` already returns `Err` for this.
+            crate::exports::Outcome::Threw(_) => trap(scope, "non-result export threw"),
+        },
+    }
+}
+
+mod exports_glue {
+    // `export!` emits `wit_dylib_*` intrinsics that take the opaque call-context
+    // pointer without an `unsafe` marker, so the raw-pointer-deref lint is allowed
+    // here.
+    #![allow(clippy::not_unsafe_ptr_arg_deref)]
+    use super::StarlingInterpreter;
+    wit_dylib_ffi::export!(StarlingInterpreter);
+}
diff --git a/crates/wit-bridge/src/lib.rs b/crates/wit-bridge/src/lib.rs
new file mode 100644
index 00000000..c88d9d3f
--- /dev/null
+++ b/crates/wit-bridge/src/lib.rs
@@ -0,0 +1,67 @@
+// SPDX-License-Identifier: Apache-2.0-WITH-LLVM-exception
+
+//! The bridge between WIT and JavaScript in a component built by
+//! `starling-componentize`.
+//!
+//! The crate calls the application's JavaScript implementations of the
+//! component's exports, and provides the component's imports to JavaScript as
+//! ES modules. Lifting converts a WIT value into a JavaScript value, and
+//! lowering converts a JavaScript value into a WIT value.
+//!
+//! The conversions in [`value`] work on [`TypeShape`], a description of WIT
+//! types that doesn't depend on `wit-dylib-ffi`, so they can be tested
+//! natively. The modules that use `wit-dylib-ffi` compile only for wasm.
+
+pub mod component_error;
+pub mod exports;
+pub mod imports;
+pub mod init;
+#[cfg(target_arch = "wasm32")]
+pub mod interpreter;
+#[cfg(target_arch = "wasm32")]
+pub mod promises;
+#[cfg(target_arch = "wasm32")]
+pub mod readable;
+pub mod resources;
+#[cfg(target_arch = "wasm32")]
+pub mod run;
+pub mod stack;
+#[cfg(target_arch = "wasm32")]
+pub mod streams;
+pub mod tracing;
+pub mod validate;
+pub mod value;
+
+pub use component_error::{
+    component_error_payload, create_error_class, error_class, ComponentError, ErrorClass,
+};
+pub use exports::{
+    call_export, install_table, resolve_export, ExportSpec, ExportTable, Outcome, Resolved,
+    ResultShape,
+};
+pub use imports::{
+    call_import_from_js, call_import_from_js_async, synthesize_import_modules, EnumDesc,
+    ImportFuncDesc, ImportInvoker, InterfaceDesc, ResourceTypeDesc, WorldDesc,
+};
+pub use init::{initialize_runtime, shutdown_runtime, with_main_scope, with_scope, Initialized};
+pub use resources::{ExportedResources, ResourceDesc};
+pub use stack::CallStack;
+pub use tracing::install_tracer;
+pub use value::TypeShape;
+
+/// Install [`ComponentError`] on `global`, and register the internal classes
+/// of the crate: the wrapper class of imported resources and, on wasm, the
+/// classes used to implement `stream` and `future` values.
+pub fn add_to_global(scope: &js::gc::scope::Scope<'_>, global: js::Object<'_>) {
+    ComponentError::add_to_global(scope, global);
+    component_error::name_prototype(scope);
+    component_error::install_class_factory(scope)
+        .expect("creating the error class factory can only fail due to OOM");
+    resources::ImportedResource::add_to_global(scope, global);
+    #[cfg(target_arch = "wasm32")]
+    {
+        readable::IncomingStream::add_to_global(scope, global);
+        promises::FutureWrite::add_to_global(scope, global);
+        promises::FutureRead::add_to_global(scope, global);
+    }
+}
diff --git a/crates/wit-bridge/src/promises.rs b/crates/wit-bridge/src/promises.rs
new file mode 100644
index 00000000..7d03b300
--- /dev/null
+++ b/crates/wit-bridge/src/promises.rs
@@ -0,0 +1,382 @@
+// SPDX-License-Identifier: Apache-2.0-WITH-LLVM-exception
+
+//! `future` values, which are promises in JavaScript.
+//!
+//! A lifted `future` is a `Promise`, and its value is read whether or not
+//! JavaScript uses the promise:
+//!
+//! - The promise for a `future<result<T, E>>` fulfills with the `ok` value, or
+//!   rejects with an error holding the `err` value. The error is an instance of
+//!   `E`'s class if it has one (see [`ErrorClass`](crate::ErrorClass)), and a
+//!   `ComponentError` otherwise.
+//! - The promise for any other `future<T>` fulfills with the value.
+//! - The promise for a `future` without a payload type fulfills with
+//!   `undefined`.
+//!
+//! A lowered `future` can be given as a promise or as any other value, which is
+//! resolved with the same rules as `Promise.resolve`. The value is written once
+//! the promise settles:
+//!
+//! - A fulfillment value is written as the `ok` value of a
+//!   `future<result<T, E>>`, and as the value of any other `future<T>`.
+//! - A rejection reason is written as the `err` value of a
+//!   `future<result<T, E>>` if it can be converted into one (see
+//!   `component_error::err_payload`).
+//!
+//! A trap occurs if a rejection reason can't be written, if a fulfillment value
+//! can't be lowered to `T`, or if a `future` without a payload type is settled
+//! with a value other than `undefined`.
+//!
+//! The write is a pending send of the event loop on which the future was
+//! lowered (see [`core_runtime::event_loop::PendingSend`]). The call that
+//! lowered the future completes once the value is written, or once the loop has
+//! no other work that could settle the promise. A promise that settles later
+//! still writes its value. If the promise is garbage-collected without
+//! settling, the future is never written, and a warning is reported.
+
+#![cfg(target_arch = "wasm32")]
+
+use std::future::{Future, IntoFuture};
+use std::mem::ManuallyDrop;
+use std::pin::Pin;
+use std::task::{Context, Poll};
+
+use core_runtime::{jsclass, jsmethods};
+use js::error::ExnThrown;
+use js::function::{cast_payload, CallbackArgs};
+use js::gc::handle::Heap;
+use js::gc::scope::Scope;
+use js::native::Value;
+use js::prelude::HandleValue;
+use js::promise::{PromiseFuture, PromiseOutcome};
+use js::{Function, Promise};
+use wit_bindgen::rt::async_support::{self, FutureReader, FutureWriteError, FutureWriter};
+use wit_dylib_ffi::Type;
+
+use crate::interpreter::{future_payload, trap, trap_message, wit_future, wit_type_name};
+use crate::stack::CallStack;
+use crate::streams::{
+    future_vtable, spawn_transfer, with_elem_type_future, Elem, ElemType, SendDone,
+};
+use crate::value::TypeShape;
+
+/// Lift the readable end `handle` of a `future<T>` with type index `index` into a
+/// `Promise`, and start reading the value.
+///
+/// If an event loop is active, the read starts immediately and runs on that
+/// loop. Otherwise, the read starts in a microtask, and runs on the loop that
+/// is active when the microtask runs, or on the next loop that polls. This is
+/// the case for the arguments of an export, which are lifted before the call's
+/// event loop is active.
+pub fn future_from_handle(scope: &Scope<'_>, index: u32, handle: u32) -> Result<Value, ExnThrown> {
+    let promise = Promise::new_pending(scope)?;
+    if core_runtime::event_loop::has_active_event_loop() {
+        spawn_read(&promise, index, handle);
+    } else {
+        let state = FutureRead::new(scope, index, handle, promise)?;
+        let start = Function::new_callback(scope, c"", 0, start_read, state)?;
+        js::jobs::queue_microtask(scope, &start)?;
+    }
+    Ok(promise.as_value())
+}
+
+/// The state of a `future` read that starts in a microtask.
+#[jsclass(hidden)]
+pub(crate) struct FutureRead {
+    /// The `future<T>` type index.
+    #[no_trace]
+    index: u32,
+    /// The readable end of the future.
+    #[no_trace]
+    handle: u32,
+    /// The promise the read settles.
+    promise: Heap<js::promise::Promise>,
+}
+
+#[jsmethods]
+impl FutureRead {
+    /// The read of the readable end `handle` of a `future<T>` with type index
+    /// `index`, which settles `promise`.
+    fn new(index: u32, handle: u32, promise: Promise) -> Self {
+        FutureReadImpl {
+            index,
+            handle,
+            promise: Heap::from(promise),
+        }
+    }
+}
+
+/// The microtask that starts a read deferred by [`future_from_handle`].
+fn start_read(
+    scope: &Scope<'_>,
+    _args: CallbackArgs<'_>,
+    payload: HandleValue<'_>,
+) -> Result<Value, ExnThrown> {
+    let state = cast_payload::<FutureRead>(scope, payload);
+    let promise: Promise<'_> = state.data().promise.get(scope);
+    spawn_read(&promise, state.data().index, state.data().handle);
+    Ok(js::value::undefined())
+}
+
+/// Read the value of the `future<T>` with type index `index` from its readable
+/// end `handle`, and settle `promise` with it.
+fn spawn_read(promise: &Promise<'_>, index: u32, handle: u32) {
+    let ty = wit_future(index as usize);
+    let vtable = future_vtable(ty, index);
+    let future = async move {
+        // SAFETY: `handle` is the live readable handle the host handed in, and
+        // `vtable` is this future type's.
+        let reader = unsafe { FutureReader::new(handle, vtable) };
+        // The `lift` runs inside a poll of the read future.
+        let value = with_elem_type_future(ElemType::Future(ty), reader.into_future()).await;
+        PromiseOutcome::Resolve(Box::new(move |scope: &Scope<'_>| {
+            let mut stack = CallStack::new();
+            // SAFETY: read for immediate consumption by `push_value`, which roots
+            // it. `value` is dropped right after.
+            stack.push_value(unsafe { value.get() });
+            drop(value);
+            // For the `err` case, the error is left pending, which rejects the
+            // promise.
+            let payload = future_payload(index);
+            crate::imports::handle_import_result(
+                scope,
+                &mut stack,
+                payload.shape.as_ref(),
+                payload.err_class.as_ref(),
+            )
+            .map(|value| scope.root_value(value))
+        }))
+    };
+    promise.spawn(PromiseFuture::new(future));
+}
+
+/// The state of a lowered `future<T>` waiting for its promise to settle.
+#[jsclass(hidden)]
+pub(crate) struct FutureWrite {
+    /// The `future<T>` type index.
+    #[no_trace]
+    index: u32,
+    /// The future's writable end, until the value is written.
+    ///
+    /// Dropping an unwritten writer writes wit-bindgen's default value, whose
+    /// `elem_lower` runs outside a `with_elem_type` span and leaves the lowered
+    /// value uninitialized. No value is valid for every type, so a writer whose
+    /// promise never settles is never dropped.
+    #[no_trace]
+    writer: Option<ManuallyDrop<FutureWriter<Elem>>>,
+    /// Set once the value is written, which completes the write's pending send.
+    #[no_trace]
+    done: SendDone,
+}
+
+#[jsmethods]
+impl FutureWrite {
+    /// The write of `writer`, the writable end of a `future<T>` with type index
+    /// `index`, which sets `done` once the value is written.
+    fn new(index: u32, writer: ManuallyDrop<FutureWriter<Elem>>, done: SendDone) -> Self {
+        FutureWriteImpl {
+            index,
+            writer: Some(writer),
+            done,
+        }
+    }
+
+    /// Queue a warning if the writer is unwritten when this state is finalized.
+    /// Only the promise's reactions reference this state, so the promise was
+    /// collected without settling.
+    #[destructor]
+    fn warn_if_writer_leaks(&mut self) {
+        if self.writer.is_some() {
+            let ty = wit_type_name(Type::Future(wit_future(self.index as usize)));
+            core_runtime::diagnostics::report_later(format!(
+                "Warning: a promise lowered to a {ty} was garbage-collected without settling, so \
+                 the future's writable end leaks for the instance's lifetime"
+            ));
+        }
+    }
+}
+
+/// Lower `value` to a `future` of the type with index `index`, and return the
+/// readable end. The value is written once `value`, resolved as a promise,
+/// settles.
+pub fn future_to_handle(
+    scope: &Scope<'_>,
+    value: HandleValue<'_>,
+    index: u32,
+) -> Result<u32, ExnThrown> {
+    let promise = Promise::call_original_resolve(scope, value)?;
+    let ty = wit_future(index as usize);
+    let vtable = future_vtable(ty, index);
+    // SAFETY: `vtable` is built from this future type's wit-dylib metadata. The
+    // `default` closure never runs, since an unwritten writer is never dropped
+    // (see `FutureWrite::writer`).
+    let (writer, reader) =
+        unsafe { async_support::future_new(|| Elem::new(js::value::undefined()), vtable) };
+    let rx = reader.take_handle();
+    drop(reader);
+    let done = SendDone::default();
+    // An abandoned write completes the pending send, so the call can finish. It
+    // leaves the writer in place, so the value is still written if the promise
+    // settles later.
+    done.register({
+        let done = done.clone();
+        move || done.set()
+    });
+    let state = FutureWrite::new(scope, index, ManuallyDrop::new(writer), done)?;
+    let on_fulfilled = Function::new_callback(scope, c"", 1, future_fulfilled, state)?;
+    let on_rejected = Function::new_callback(scope, c"", 1, future_rejected, state)?;
+    promise.add_reactions(scope, Some(*on_fulfilled), Some(*on_rejected))?;
+    Ok(rx)
+}
+
+/// The fulfillment reaction, which writes the value.
+fn future_fulfilled(
+    scope: &Scope<'_>,
+    args: CallbackArgs<'_>,
+    payload: HandleValue<'_>,
+) -> Result<Value, ExnThrown> {
+    let state = cast_payload::<FutureWrite>(scope, payload);
+    let value = args.get(0);
+    let index = state.data().index;
+    match &future_payload(index).shape {
+        Some(TypeShape::Result(ok, err)) => {
+            write_result(scope, &state, value, ok.is_some(), err.is_some(), false)
+        }
+        _ => write(scope, &state, value),
+    }
+}
+
+/// The rejection reaction, which writes the reason as the `err` value, or
+/// traps if that isn't possible.
+fn future_rejected(
+    scope: &Scope<'_>,
+    args: CallbackArgs<'_>,
+    payload: HandleValue<'_>,
+) -> Result<Value, ExnThrown> {
+    let state = cast_payload::<FutureWrite>(scope, payload);
+    let reason = args.get(0);
+    let index = state.data().index;
+    let payload = future_payload(index);
+    let Some(TypeShape::Result(ok, err)) = &payload.shape else {
+        let message = crate::exports::capture_value(scope, reason).to_string();
+        trap(
+            scope,
+            &format!("a promise lowered to a future rejected: {message}"),
+        );
+    };
+    let payload = match crate::component_error::err_payload(scope, reason, err.as_deref()) {
+        Ok(payload) => payload,
+        Err(why) => {
+            let message = crate::exports::capture_value(scope, reason).to_string();
+            trap(
+                scope,
+                &format!(
+                    "a promise lowered to a future<result> rejected with a value that can't be \
+                     converted into its error type ({why}): {message}"
+                ),
+            );
+        }
+    };
+    write_result(scope, &state, payload, ok.is_some(), err.is_some(), true)
+}
+
+/// Write `payload` as the `ok` or `err` case of a `future<result<T, E>>`.
+fn write_result(
+    scope: &Scope<'_>,
+    state: &FutureWrite<'_>,
+    payload: HandleValue<'_>,
+    ok_has_payload: bool,
+    err_has_payload: bool,
+    is_err: bool,
+) -> Result<Value, ExnThrown> {
+    let mut stack = CallStack::new();
+    let has_payload = if is_err {
+        err_has_payload
+    } else {
+        ok_has_payload
+    };
+    if has_payload {
+        stack.push_value(payload.get());
+    }
+    crate::value::push_result(&mut stack, scope, ok_has_payload, err_has_payload, is_err)?;
+    let wrapper = scope.root_value(stack.pop_value());
+    write(scope, state, wrapper)
+}
+
+/// Write `value` to the future, and complete the write's pending send once it
+/// is written. Traps if `value` can't be lowered to the future's type. The
+/// snapshot of `value` is lowered (see [`crate::validate::snapshot_payload`]),
+/// so later changes to `value` don't affect what is written.
+fn write(
+    scope: &Scope<'_>,
+    state: &FutureWrite<'_>,
+    value: HandleValue<'_>,
+) -> Result<Value, ExnThrown> {
+    let index = state.data().index;
+    let payload = future_payload(index);
+    let snapshot = match crate::validate::snapshot_payload(scope, value, payload.shape.as_ref()) {
+        Ok(snapshot) => snapshot,
+        Err(mismatch) => {
+            trap_message(&mismatch.describe("the value a promise lowered to a future settled with"))
+        }
+    };
+    // Created before the writer is taken, so a failure leaves the writer in
+    // place and unwritten.
+    let promise = Promise::new_pending(scope)?;
+    let writer = state.data_mut().writer.take();
+    let Some(writer) = writer else {
+        return Ok(js::value::undefined());
+    };
+    let writer = ManuallyDrop::into_inner(writer);
+    let done = state.data().done.clone();
+    let ty = wit_future(index as usize);
+    let write = FinishingWrite {
+        write: Some(Box::pin(writer.write(Elem::payload(snapshot)))),
+        ty,
+    };
+    let future = async move {
+        // If the reader was dropped, the write fails, and the value is dropped
+        // here.
+        let _ = with_elem_type_future(ElemType::Future(ty), write).await;
+        done.set();
+        PromiseOutcome::Resolve(Box::new(|_scope: &Scope<'_>| Ok(HandleValue::undefined())))
+    };
+    // The write's first poll lowers the value. If an event loop is active, the
+    // poll happens now, while the value is as checked by `snapshot_payload`.
+    spawn_transfer(&promise, PromiseFuture::new(future));
+    Ok(js::value::undefined())
+}
+
+/// A future write that continues in a separate task if it is dropped before it
+/// finishes, such as when an event loop drops its pending futures. Dropping the
+/// write itself would cancel it, and dropping the writer returned by the
+/// cancellation would write its default value. The task keeps the current
+/// component task running until the value is read.
+struct FinishingWrite {
+    write: Option<Pin<Box<async_support::FutureWrite<Elem>>>>,
+    ty: wit_dylib_ffi::Future,
+}
+
+impl Future for FinishingWrite {
+    type Output = Result<(), FutureWriteError<Elem>>;
+
+    fn poll(mut self: Pin<&mut Self>, cx: &mut Context<'_>) -> Poll<Self::Output> {
+        let write = self.write.as_mut().expect("polled after it finished");
+        let written = std::task::ready!(write.as_mut().poll(cx));
+        self.write = None;
+        Poll::Ready(written)
+    }
+}
+
+impl Drop for FinishingWrite {
+    fn drop(&mut self) {
+        if let Some(write) = self.write.take() {
+            async_support::spawn_local(with_elem_type_future(
+                ElemType::Future(self.ty),
+                async move {
+                    let _ = write.await;
+                },
+            ));
+        }
+    }
+}
diff --git a/crates/wit-bridge/src/readable.rs b/crates/wit-bridge/src/readable.rs
new file mode 100644
index 00000000..0e3b3be6
--- /dev/null
+++ b/crates/wit-bridge/src/readable.rs
@@ -0,0 +1,521 @@
+// SPDX-License-Identifier: Apache-2.0-WITH-LLVM-exception
+
+//! `stream` values, which are `ReadableStream`s in JavaScript.
+//!
+//! A lifted `stream` is a `ReadableStream` that reads from the stream's
+//! readable end. A `stream<u8>` is a readable byte stream with `Uint8Array`
+//! chunks. Any other `stream<T>` is a default stream with one chunk per
+//! element, and a `stream` without a payload type has an `undefined` chunk per
+//! element. Data is read from the host only when a reader requests it, and
+//! cancelling the stream drops the readable end.
+//!
+//! A lowered `stream` can be given as a `ReadableStream`, or as any other sync
+//! or async iterable object, which is converted with the same rules as
+//! `ReadableStream.from`. A lifted stream that hasn't been read from or locked
+//! is lowered as its readable end. A `stream<u8>` is lowered the same way if it
+//! is the body of a `fetch` response or request, or a lifted `stream<u8>` of
+//! another type. Any other stream is locked, and a pump reads
+//! its chunks and writes them to a new `stream`, whose readable end is passed
+//! to the host. A `stream<u8>` accepts `ArrayBufferView` and `ArrayBuffer`
+//! chunks. Any other `stream<T>` accepts each chunk as one element, and a
+//! `stream` without a payload type accepts `undefined` chunks.
+//!
+//! The pump is a pending send of the event loop on which it was started (see
+//! [`core_runtime::event_loop::PendingSend`]). The call that started it
+//! completes when the source ends, when the host stops reading, or when the
+//! loop has no other work that could make the source produce more chunks. If
+//! the source errors or produces a chunk of the wrong kind, the `stream` ends
+//! early and the error is printed to `stderr`, because a `stream` can't hold an
+//! error. The source is cancelled when a write finds that the host dropped its
+//! reader, which happens when the source produces its next chunk, and when the
+//! loop has no other work that could make it produce more.
+
+#![cfg(target_arch = "wasm32")]
+
+use core_runtime::{jsclass, jsmethods};
+use js::conversion::FromJSVal;
+use js::error::{throw_type_error, ExnThrown};
+use js::function::{cast_payload, CallbackArgs};
+use js::gc::handle::{Heap, OptionHeapExt, RootedHeap};
+use js::gc::scope::Scope;
+use js::native::Value;
+use js::prelude::HandleValue;
+use js::promise::{PromiseFuture, PromiseOutcome};
+use js::{Function, Promise};
+use platform::http::IncomingBody;
+use web_streams::readable::native_byte_source::{take_untouched_reader, NativeByteSource};
+use web_streams::readable::native_pump::{
+    append_bytes, NativePump, PumpBatch, PumpSink, PUMP_BATCH_BYTES,
+};
+use web_streams::readable::native_read::acquire_native_reader;
+use web_streams::readable::{ReadableStream, ReadableStreamDefaultController};
+use web_streams::AlgorithmArg;
+use wit_bindgen::rt::async_support::{StreamReader, StreamResult, StreamWriter};
+
+use crate::interpreter::wit_stream;
+use crate::streams::{
+    elem_is_u8, generic_stream_vtable, u8_stream_vtable, with_elem_type_future, Elem, ElemType,
+    SendDone,
+};
+
+/// The maximum number of elements that one read from a `stream<T>` other than
+/// `stream<u8>` requests from the host, and that the pump collects into one
+/// write.
+const VALUE_CHUNK: usize = 64;
+
+/// The writable end of the `stream` written by a pump.
+pub(crate) enum Writer {
+    Bytes(StreamWriter<u8>),
+    Values(StreamWriter<Elem>),
+}
+
+/// The chunks the pump has read but not yet written.
+pub(crate) enum Batch {
+    Bytes(Vec<u8>),
+    Values(Vec<Elem>),
+}
+
+impl Batch {
+    fn is_empty(&self) -> bool {
+        match self {
+            Batch::Bytes(bytes) => bytes.is_empty(),
+            Batch::Values(values) => values.is_empty(),
+        }
+    }
+
+    fn is_full(&self) -> bool {
+        match self {
+            Batch::Bytes(bytes) => bytes.len() >= PUMP_BATCH_BYTES,
+            Batch::Values(values) => values.len() >= VALUE_CHUNK,
+        }
+    }
+
+    /// Return an empty batch of the same kind.
+    fn empty_like(&self) -> Batch {
+        match self {
+            Batch::Bytes(_) => Batch::Bytes(Vec::new()),
+            Batch::Values(_) => Batch::Values(Vec::new()),
+        }
+    }
+}
+
+/// The underlying source of a lifted `stream<T>`'s `ReadableStream`, for a `T`
+/// other than `u8`.
+#[jsclass(hidden)]
+pub(crate) struct IncomingStream {
+    /// The `stream<T>` type index.
+    #[no_trace]
+    index: u32,
+    /// The readable end. `None` while a read is pending, and after the host
+    /// dropped the writable end, the stream was cancelled, or the readable end
+    /// was passed back to the host.
+    #[no_trace]
+    reader: Option<StreamReader<Elem>>,
+    /// Whether the stream has pulled from the readable end.
+    #[no_trace]
+    pulled: bool,
+    /// The promise of the pull whose read is pending, used to cancel the read.
+    current_pull: Option<Heap<js::promise::Promise>>,
+    /// Whether the stream was cancelled, after which a finished read's reader
+    /// is dropped rather than kept.
+    #[no_trace]
+    cancelled: bool,
+}
+
+#[jsmethods]
+impl IncomingStream {
+    /// The source reading `reader`, the readable end of a `stream<T>` with type
+    /// index `index`.
+    fn new(index: u32, reader: StreamReader<Elem>) -> Self {
+        IncomingStreamImpl {
+            index,
+            reader: Some(reader),
+            ..Default::default()
+        }
+    }
+}
+
+/// Lift the readable end `handle` of a `stream<T>` with type index `index` into a
+/// `ReadableStream`.
+pub fn stream_from_handle(scope: &Scope<'_>, index: u32, handle: u32) -> Result<Value, ExnThrown> {
+    let ty = wit_stream(index as usize);
+    if elem_is_u8(ty.ty()) {
+        let reader = StreamReader::new(handle, u8_stream_vtable(ty, index));
+        let (stream, _) =
+            NativeByteSource::create_stream(scope, IncomingBody::from_stream(reader))?;
+        return Ok(stream.as_value());
+    }
+    let reader = StreamReader::new(handle, generic_stream_vtable(ty, index));
+    let state = IncomingStream::new(scope, index, reader)?;
+    let pull = AlgorithmArg::native(scope, incoming_pull, state)?;
+    let cancel = AlgorithmArg::native(scope, incoming_cancel, state)?;
+    Ok(ReadableStream::new_native(scope, state, pull, cancel)?.as_value())
+}
+
+/// Underlying-source `pull`: read the next elements from the host and enqueue
+/// them, or close the stream once the host dropped its writable end.
+fn incoming_pull(
+    scope: &Scope<'_>,
+    args: CallbackArgs<'_>,
+    payload: HandleValue<'_>,
+) -> Result<Value, ExnThrown> {
+    let state = cast_payload::<IncomingStream>(scope, payload);
+    let controller = ReadableStreamDefaultController::from_jsval_throwing(scope, args.get(0), ())?;
+    let promise = Promise::new_pending(scope)?;
+    // The read requires an active event loop. A rejected pull errors the
+    // stream.
+    if core_runtime::event_loop::reject_without_event_loop(scope, &promise, "reading a stream")? {
+        return Ok(promise.as_value());
+    }
+    state.data_mut().pulled = true;
+    let reader = state.data_mut().reader.take();
+    let Some(mut reader) = reader else {
+        // The readable end is gone, so no more elements will arrive.
+        controller.close(scope)?;
+        promise.resolve(scope, HandleValue::undefined())?;
+        return Ok(promise.as_value());
+    };
+    state.data_mut().current_pull = Some(Heap::from(promise));
+    let index = state.data().index;
+    let controller = RootedHeap::new(controller);
+    let state = RootedHeap::new(state);
+    let future = async move {
+        let ty = wit_stream(index as usize);
+        let mut values = Vec::with_capacity(VALUE_CHUNK);
+        // A read that completes with no elements is repeated, since a pull that
+        // doesn't enqueue a chunk is not followed by another.
+        let status = loop {
+            // The per-element `lift` runs inside a poll of the read future.
+            let read = reader.read(values);
+            let (status, read) = with_elem_type_future(ElemType::Stream(ty), read).await;
+            values = read;
+            if status != StreamResult::Complete(0) {
+                break status;
+            }
+        };
+        PromiseOutcome::Resolve(Box::new(move |scope: &Scope<'_>| {
+            deliver(
+                scope,
+                state.get(scope),
+                controller.get(scope),
+                reader,
+                status,
+                values,
+            )
+            .map(|()| HandleValue::undefined())
+        }))
+    };
+    promise.spawn(PromiseFuture::new(future));
+    Ok(promise.as_value())
+}
+
+/// Enqueue the elements of a pull, and close the stream if the host dropped its
+/// writable end with nothing left to deliver. A stream that was cancelled
+/// during the read doesn't receive the elements, and its reader is dropped.
+fn deliver(
+    scope: &Scope<'_>,
+    state: IncomingStream<'_>,
+    controller: ReadableStreamDefaultController<'_>,
+    reader: StreamReader<Elem>,
+    status: StreamResult,
+    values: Vec<Elem>,
+) -> Result<(), ExnThrown> {
+    state.data_mut().current_pull = None;
+    if state.data().cancelled {
+        return Ok(());
+    }
+    let ended = matches!(status, StreamResult::Dropped) && values.is_empty();
+    if !ended {
+        state.data_mut().reader = Some(reader);
+    }
+    for value in &values {
+        // SAFETY: read for immediate consumption by `root_value`. `values` keeps
+        // every element registered and traced until it drops.
+        let value = scope.root_value(unsafe { value.get() });
+        controller.enqueue(scope, value)?;
+    }
+    if ended {
+        controller.close(scope)?;
+    }
+    Ok(())
+}
+
+/// Underlying-source `cancel`: drop the readable end, and cancel a pending read.
+fn incoming_cancel(
+    scope: &Scope<'_>,
+    _args: CallbackArgs<'_>,
+    payload: HandleValue<'_>,
+) -> Result<Value, ExnThrown> {
+    let state = cast_payload::<IncomingStream>(scope, payload);
+    state.data_mut().cancelled = true;
+    let pull = state.data_mut().current_pull.take_rooted(scope);
+    if let Some(pull) = pull {
+        // Dropping the read's future cancels the read and drops the reader it owns.
+        js::promise::cancel_pending_future(pull);
+    }
+    state.data_mut().reader = None;
+    Ok(js::value::undefined())
+}
+
+/// Return the handle of `stream`'s readable end if `stream` hasn't been read
+/// from or locked, and is one of these:
+///
+/// - a lifted `stream` of the type with index `index`
+/// - if that type is a `stream<u8>`: a lifted `stream<u8>` of any type, the
+///   body of a `fetch` response or request, or the readable end of an identity
+///   `TransformStream` to which one of them is piped
+///
+/// The stream is then locked and disturbed, because its chunks go to the host
+/// directly.
+fn take_untouched_handle(
+    scope: &Scope<'_>,
+    stream: &ReadableStream<'_>,
+    index: u32,
+) -> Option<u32> {
+    if stream.is_locked() || stream.is_disturbed() {
+        return None;
+    }
+    // Every `stream<u8>` type has the same canonical ABI representation, so a
+    // `stream<u8>` of any type, or a `fetch` body, is passed on as it is.
+    if elem_is_u8(wit_stream(index as usize).ty()) {
+        let bytes = take_untouched_reader::<IncomingBody>(scope, stream)?;
+        return Some(bytes.into_stream().take_handle());
+    }
+    let state = stream.native_source(scope)?.cast::<IncomingStream>().ok()?;
+    if state.data().pulled || state.data().index != index {
+        return None;
+    }
+    let reader = state.data_mut().reader.take()?;
+    stream
+        .lock_and_disturb(scope)
+        .expect("an unlocked stream can be locked");
+    Some(reader.take_handle())
+}
+
+/// Lower `value` to the readable end of a `stream<T>` with type index `index`.
+///
+/// Throws a `TypeError` if `value` is neither a `ReadableStream` nor an iterable
+/// object, or is a locked `ReadableStream`.
+pub fn stream_to_handle(
+    scope: &Scope<'_>,
+    value: HandleValue<'_>,
+    index: u32,
+) -> Result<u32, ExnThrown> {
+    let stream = match ReadableStream::from_jsval(scope, value, ()) {
+        Ok(stream) => stream,
+        Err(_) if value.is_object() => ReadableStream::from_iterable(scope, value)?,
+        Err(_) => {
+            return Err(throw_type_error(
+                scope,
+                c"a stream must be a ReadableStream or an iterable object",
+            ))
+        }
+    };
+    if let Some(handle) = take_untouched_handle(scope, &stream, index) {
+        return Ok(handle);
+    }
+    // Locking the stream is the step that can fail, so it runs before the
+    // `stream<T>` is created.
+    let reader = acquire_native_reader(scope, &stream)?;
+
+    let ty = wit_stream(index as usize);
+    // SAFETY: `ty.new()` is the wit-dylib `stream.new` extern for this type. It
+    // returns the writer and reader handle pair with no preconditions.
+    let handles = unsafe { ty.new()() };
+    let tx = (handles >> 32) as u32;
+    let rx = (handles & 0xFFFF_FFFF) as u32;
+    // SAFETY: `tx` is the writable handle just created by `ty.new()`, and each
+    // vtable is this stream type's.
+    let (writer, batch) = unsafe {
+        if elem_is_u8(ty.ty()) {
+            (
+                Writer::Bytes(StreamWriter::new(tx, u8_stream_vtable(ty, index))),
+                Batch::Bytes(Vec::new()),
+            )
+        } else {
+            (
+                Writer::Values(StreamWriter::new(tx, generic_stream_vtable(ty, index))),
+                Batch::Values(Vec::new()),
+            )
+        }
+    };
+    let batch = PumpChunks { index, batch };
+    let pump = match NativePump::create(scope, reader, writer, batch) {
+        Ok(pump) => pump,
+        Err(e) => {
+            // SAFETY: the wit-dylib `drop-readable` extern takes the live handle,
+            // which nothing else owns. The writer was dropped with the failed
+            // factory's arguments.
+            unsafe { ty.drop_readable()(rx) };
+            return Err(e);
+        }
+    };
+    // Once the event loop has no other work left, the pump is stopped: the
+    // stream ends and its source is cancelled.
+    let done = SendDone::default();
+    let stopping = RootedHeap::new(pump);
+    let registered = done.register(move || {
+        crate::init::with_scope(|scope| {
+            let reason = "nothing is left that could make the stream's source produce more";
+            stopping.get(scope).stop(scope, reason.into());
+        })
+    });
+    if registered {
+        pump.on_finish(move || done.set());
+    }
+    // The pump starts from a microtask, so lowering the stream runs none of the
+    // source's JavaScript.
+    let started = Function::new_callback(scope, c"", 0, start_pump, pump)
+        .and_then(|start| js::jobs::queue_microtask(scope, &start));
+    if started.is_err() {
+        let message = describe_pending(scope);
+        pump.stop(scope, message);
+    }
+    Ok(rx)
+}
+
+/// The microtask that starts a pump created by [`stream_to_handle`].
+fn start_pump(
+    scope: &Scope<'_>,
+    _args: CallbackArgs<'_>,
+    payload: HandleValue<'_>,
+) -> Result<Value, ExnThrown> {
+    cast_payload::<NativePump>(scope, payload).start(scope);
+    Ok(js::value::undefined())
+}
+
+/// The chunks a pump has read but not yet written to the `stream<T>` with type
+/// index `index`.
+pub(crate) struct PumpChunks {
+    index: u32,
+    batch: Batch,
+}
+
+impl PumpBatch for PumpChunks {
+    /// Append `chunk`, or fail with the reason the stream ends if it can't be
+    /// written to the `stream`.
+    fn append(&mut self, scope: &Scope<'_>, chunk: HandleValue<'_>) -> Result<(), String> {
+        match &mut self.batch {
+            Batch::Bytes(bytes) => append_chunk_bytes(scope, chunk, bytes).map_err(String::from),
+            Batch::Values(values) => {
+                // The chunk is checked here, where a mismatch ends the stream.
+                // Lowering it during the write would trap instead. The chunk's
+                // snapshot is written, so later changes to the chunk don't
+                // affect what is sent.
+                let element = crate::interpreter::stream_element(self.index);
+                let snapshot =
+                    crate::validate::snapshot_payload(scope, chunk, element.shape.as_ref())
+                        .map_err(|mismatch| mismatch.describe("a chunk"))?;
+                values.push(Elem::payload(snapshot));
+                Ok(())
+            }
+        }
+    }
+
+    /// Lowering the batch traps if it holds a resource wrapper or stream twice,
+    /// or a wrapper that was disposed of after its chunk was read, so the batch
+    /// is checked first. If an element fails the check, the elements before it
+    /// are written, and the stream then ends early.
+    fn check(&mut self, scope: &Scope<'_>) -> Result<(), String> {
+        let Batch::Values(values) = &mut self.batch else {
+            return Ok(());
+        };
+        check_batch(scope, self.index, values).map_err(|(failed, message)| {
+            values.truncate(failed);
+            message
+        })
+    }
+
+    fn is_empty(&self) -> bool {
+        self.batch.is_empty()
+    }
+
+    fn is_full(&self) -> bool {
+        self.batch.is_full()
+    }
+
+    fn take(&mut self) -> Self {
+        let empty = self.batch.empty_like();
+        PumpChunks {
+            index: self.index,
+            batch: std::mem::replace(&mut self.batch, empty),
+        }
+    }
+}
+
+/// Check that `values`, the snapshots of the chunks of the stream with type
+/// index `index`, can be lowered together (see [`crate::validate::check_each`]).
+/// Returns the index of the first element that can't be lowered, and the
+/// reason.
+fn check_batch(scope: &Scope<'_>, index: u32, values: &[Elem]) -> Result<(), (usize, String)> {
+    let element = crate::interpreter::stream_element(index);
+    let Some(shape) = element
+        .shape
+        .as_ref()
+        .filter(|shape| crate::validate::moves_handles(shape))
+    else {
+        return Ok(());
+    };
+    let values = values.iter().map(|value| {
+        value
+            .shaped()
+            .expect("a stream with a payload type writes snapshots")
+    });
+    crate::validate::check_each(scope, values, shape)
+        .map_err(|(failed, mismatch)| (failed, mismatch.describe("a chunk")))
+}
+
+impl PumpSink for Writer {
+    type Batch = PumpChunks;
+
+    /// The write's first poll lowers the batch, so it happens while the batch is
+    /// as checked by [`PumpChunks::check`].
+    const POLL_WRITE_AT_ONCE: bool = true;
+
+    async fn write(self, chunks: PumpChunks) -> Option<Self> {
+        match (self, chunks.batch) {
+            (Writer::Bytes(mut writer), Batch::Bytes(bytes)) => {
+                let leftover = writer.write_all(bytes).await;
+                leftover.is_empty().then_some(Writer::Bytes(writer))
+            }
+            (Writer::Values(mut writer), Batch::Values(values)) => {
+                let ty = wit_stream(chunks.index as usize);
+                // The per-element `lower`, and the `lift` of an unsent tail, run
+                // inside polls of the write future.
+                let write = writer.write_all(values);
+                let leftover = with_elem_type_future(ElemType::Stream(ty), write).await;
+                leftover.is_empty().then_some(Writer::Values(writer))
+            }
+            _ => unreachable!("a pump's batch matches its writer"),
+        }
+    }
+
+    fn describe_source_error(scope: &Scope<'_>, error: HandleValue<'_>) -> String {
+        crate::exports::capture_value(scope, error).to_string()
+    }
+}
+
+/// Append the bytes of a `stream<u8>` chunk to `batch`. Fails with the reason
+/// the stream ends if the chunk is neither an `ArrayBufferView` nor an
+/// `ArrayBuffer`, or if growing `batch` fails.
+fn append_chunk_bytes(
+    scope: &Scope<'_>,
+    chunk: HandleValue<'_>,
+    batch: &mut Vec<u8>,
+) -> Result<(), &'static str> {
+    let append = |bytes: &[u8]| {
+        append_bytes(batch, bytes).map_err(|_| "out of memory while buffering a stream<u8> chunk")
+    };
+    if let Ok(view) = js::ArrayBufferView::from_jsval(scope, chunk, ()) {
+        return view.with_bytes(append);
+    }
+    match js::ArrayBuffer::from_jsval(scope, chunk, ()) {
+        Ok(buffer) => buffer.with_bytes(append),
+        Err(_) => Err("a stream<u8> chunk must be an ArrayBufferView or an ArrayBuffer"),
+    }
+}
+
+/// The message and stack of the pending exception, which is cleared.
+fn describe_pending(scope: &Scope<'_>) -> String {
+    ExnThrown::capture(scope).to_string()
+}
diff --git a/crates/wit-bridge/src/resources.rs b/crates/wit-bridge/src/resources.rs
new file mode 100644
index 00000000..7b97d50a
--- /dev/null
+++ b/crates/wit-bridge/src/resources.rs
@@ -0,0 +1,721 @@
+// SPDX-License-Identifier: Apache-2.0-WITH-LLVM-exception
+
+//! Resource handles: imported wrappers, the exported-resource slab, and
+//! finalization.
+//!
+//! A resource type is either imported or exported:
+//!
+//! - Imported resources are implemented by the host. JavaScript sees a wrapper
+//!   object, an [`ImportedResource`], whose private data holds the resource's
+//!   handle. [`wrap_imported`] creates a wrapper when a handle is lifted, and
+//!   [`unwrap_to_canon`] returns the wrapper's handle when it is lowered.
+//! - Exported resources are implemented by JavaScript objects. Lowering an
+//!   object stores it in the [`ExportedResources`] slab, with the slab index as
+//!   the resource's rep, and creates a handle for it. Each lowering of the same
+//!   object creates another rep and handle. An object is removed from the slab
+//!   by [`drop_exported`] when the host drops the resource, by [`push_own`] when
+//!   the host passes ownership back, and by [`release_borrows`] when a call that
+//!   borrowed it ends.
+//!
+//! Each operation takes a [`ResourceDesc`], which describes the resource type
+//! and holds the functions that create, resolve and drop handles of exported
+//! resources.
+
+use std::cell::{Cell, RefCell};
+
+use core_runtime::{jsclass, jsmethods};
+use js::conversion::FromJSVal;
+use js::error::{throw_type_error, ExnThrown};
+use js::function::{CallbackArgs, EmptyArgs};
+use js::gc::handle::RootedHeap;
+use js::gc::scope::Scope;
+use js::native::Value;
+use js::prelude::HandleValue;
+use js::{Function, Object};
+
+use slab::Slab;
+
+use crate::stack::CallStack;
+
+/// Drops a canonical handle of an imported resource type. The arguments after
+/// the scope are the type index and the handle.
+pub type ImportedDrop = fn(&Scope<'_>, u32, u32) -> Result<(), ExnThrown>;
+
+js::instance_local! {
+    /// The function set by [`set_imported_drop`].
+    static IMPORTED_DROP: Cell<Option<ImportedDrop>> = const { Cell::new(None) };
+
+    /// The type index and handle of every collected wrapper whose handle is not
+    /// dropped yet, queued by the wrapper's finalizer and dropped by the next
+    /// [`release_borrows`].
+    static COLLECTED_HANDLES: RefCell<Vec<(u32, u32)>> = const { RefCell::new(Vec::new()) };
+}
+
+/// Set the function that drops the canonical handle of a wrapper of an imported
+/// resource when the wrapper is disposed of, released at the end of the call it
+/// was lifted for, or collected. Must run before any wrapper is disposed of.
+pub fn set_imported_drop(drop: ImportedDrop) {
+    IMPORTED_DROP.with(|cell| cell.set(Some(drop)));
+}
+
+/// Drop `handle`, which has the imported resource type `type_idx`, through the
+/// function set by [`set_imported_drop`]. Throws a `TypeError` if no function is
+/// set.
+fn drop_imported_handle(scope: &Scope<'_>, type_idx: u32, handle: u32) -> Result<(), ExnThrown> {
+    let drop = IMPORTED_DROP.with(Cell::get).ok_or_else(|| {
+        throw_type_error(scope, c"no drop function is set for imported resources")
+    })?;
+    drop(scope, type_idx, handle)
+}
+
+/// The state of a wrapper of a host-owned resource handle. The wrapper's
+/// prototype is the `prototype` of its resource type's class, or
+/// `ImportedResource.prototype` for a type without a registered class (see
+/// [`register_resource_prototype`]).
+///
+/// If a wrapper is collected while it owns a handle, the handle is dropped by
+/// the next [`release_borrows`].
+#[jsclass(hidden)]
+pub struct ImportedResource {
+    /// The resource type index.
+    #[no_trace]
+    pub(crate) type_idx: u32,
+    /// The canonical handle, or `None` once the wrapper was disposed of, released
+    /// at the end of the call it was lifted for, or moved to the host.
+    #[no_trace]
+    pub(crate) handle: Option<u32>,
+    /// Whether the guest received the handle as a `borrow`.
+    #[no_trace]
+    pub(crate) borrowed: bool,
+    /// The number of import calls the wrapper is lent to that have not returned.
+    /// The handle cannot be dropped or moved while it is not 0.
+    #[no_trace]
+    pub(crate) lends: u32,
+    /// Whether the wrapper was disposed of while lent. The handle is dropped once
+    /// the last lend ends.
+    #[no_trace]
+    pub(crate) dispose_deferred: bool,
+}
+
+#[jsmethods]
+impl ImportedResource {
+    /// A wrapper of `handle`, a handle of the resource type `type_idx` that the
+    /// guest received as a `borrow` if `borrowed`.
+    fn new(type_idx: u32, handle: Option<u32>, borrowed: bool) -> Self {
+        ImportedResourceImpl {
+            type_idx,
+            handle,
+            borrowed,
+            lends: 0,
+            dispose_deferred: false,
+        }
+    }
+
+    /// Queue the handle for [`release_borrows`] to drop, if the wrapper still
+    /// holds one it owns. A collected wrapper is lent to no call, since a lend
+    /// keeps it reachable.
+    #[destructor]
+    fn queue_handle_drop(&mut self) {
+        if let (Some(handle), false) = (self.handle, self.borrowed) {
+            let type_idx = self.type_idx;
+            // Native targets destroy the queue at thread exit, and a wrapper
+            // finalized after that leaves its handle undropped.
+            let _ = COLLECTED_HANDLES.try_with(|cell| cell.borrow_mut().push((type_idx, handle)));
+        }
+    }
+}
+
+/// Converts a value that isn't a wrapper into an `own` handle of an imported
+/// resource type, when the value is lowered as such a handle. Returns `None` if
+/// it doesn't convert the value, which is then lowered as a wrapper.
+pub type OwnAdapter = fn(&Scope<'_>, HandleValue<'_>) -> Result<Option<u32>, ExnThrown>;
+
+/// Checks whether an [`OwnAdapter`] converts a value, without converting it:
+/// `Ok(true)` if it does, `Ok(false)` if the value is not of a kind it converts,
+/// and `Err` with the reason if the value is of that kind but can't be
+/// converted. [`crate::validate`] uses it so that an import call throws a
+/// `TypeError` for a value that the adapter would refuse.
+pub type OwnAdapterCheck = fn(&Scope<'_>, HandleValue<'_>) -> Result<bool, String>;
+
+js::instance_local! {
+    /// The adapters registered by [`register_own_adapter`], each with the
+    /// interface name and the resource name it applies to.
+    static OWN_ADAPTERS: RefCell<Vec<(String, String, OwnAdapter, OwnAdapterCheck)>> =
+        const { RefCell::new(Vec::new()) };
+}
+
+/// Register `adapter` for the imported resource type `resource` of the
+/// interface `interface`, such as `wasi:http/types@0.3.0`, and of every
+/// interface for which [`wit_name_mapping::same_interface`] returns `true`.
+/// `check` must accept exactly the values that `adapter` converts.
+pub fn register_own_adapter(
+    interface: &str,
+    resource: &str,
+    adapter: OwnAdapter,
+    check: OwnAdapterCheck,
+) {
+    OWN_ADAPTERS.with(|cell| {
+        cell.borrow_mut()
+            .push((interface.to_string(), resource.to_string(), adapter, check))
+    });
+}
+
+/// The adapter and its check registered for the imported resource type
+/// `resource` of the interface `interface`, if there is one.
+#[cfg(target_arch = "wasm32")]
+pub(crate) fn own_adapter(
+    interface: Option<&str>,
+    resource: &str,
+) -> Option<(OwnAdapter, OwnAdapterCheck)> {
+    let interface = interface?;
+    OWN_ADAPTERS.with(|cell| {
+        cell.borrow()
+            .iter()
+            .find(|(registered, name, _, _)| {
+                wit_name_mapping::same_interface(registered, interface) && name == resource
+            })
+            .map(|(_, _, adapter, check)| (*adapter, *check))
+    })
+}
+
+/// Returns `value` as a wrapper of an imported resource, or `None` if it is not one.
+pub(crate) fn imported_wrapper<'s>(
+    scope: &'s Scope<'_>,
+    value: HandleValue<'_>,
+) -> Option<ImportedResource<'s>> {
+    ImportedResource::from_jsval(scope, value, ()).ok()
+}
+
+/// Return the handle held by `value`, a wrapper of an imported resource, or
+/// `None` if `value` isn't such a wrapper or holds no handle.
+pub fn imported_handle(scope: &Scope<'_>, value: HandleValue<'_>) -> Option<u32> {
+    let wrapper = imported_wrapper(scope, value)?;
+    let handle = wrapper.data().handle;
+    handle
+}
+
+/// `obj[Symbol.dispose]`, or `None` if it is not a function.
+fn dispose_method<'s>(
+    scope: &'s Scope<'_>,
+    obj: &Object<'_>,
+) -> Result<Option<HandleValue<'s>>, ExnThrown> {
+    let key = scope.root_id(js::symbol::get_well_known_key(
+        scope,
+        js::native::SymbolCode::dispose,
+    ));
+    let value = obj.get_property_by_id(scope, key)?;
+    Ok(js::function::is_callable(value).then_some(value))
+}
+
+/// A resource type, with the functions for handles of exported resource types.
+/// Handles of imported resource types are dropped with the function set by
+/// [`set_imported_drop`].
+pub enum ResourceDesc<'a> {
+    /// An imported resource type.
+    Imported { type_idx: u32 },
+    /// An exported resource type.
+    Exported {
+        /// The resource type index, stored in the slab entry.
+        type_idx: u32,
+        /// `[resource-new]`: create a canonical handle for a slab rep.
+        new: &'a dyn Fn(u32) -> u32,
+        /// `[resource-rep]`: resolve a canonical handle back to its slab rep.
+        rep: &'a dyn Fn(u32) -> u32,
+        /// `[resource-drop]`: release a canonical handle from the guest's table.
+        drop: &'a dyn Fn(u32),
+    },
+}
+
+js::instance_local! {
+    /// The prototype of each imported resource type's class, indexed by type
+    /// index. New wrappers get this prototype.
+    static RESOURCE_PROTOTYPES: RefCell<Vec<Option<RootedHeap<js::object::Object>>>> =
+        const { RefCell::new(Vec::new()) };
+}
+
+/// Record the prototype object for imported resource type `type_idx`, so wrappers
+/// created for that type get it as their prototype. A later registration for the
+/// same index replaces the previous prototype.
+pub fn register_resource_prototype(type_idx: u32, proto: &Object<'_>) {
+    RESOURCE_PROTOTYPES.with(|cell| {
+        let mut protos = cell.borrow_mut();
+        let idx = type_idx as usize;
+        if protos.len() <= idx {
+            protos.resize_with(idx + 1, || None);
+        }
+        protos[idx] = Some(RootedHeap::new(*proto));
+    });
+}
+
+/// The registered prototype for `type_idx`, rooted on `scope`, if any.
+fn resource_prototype<'s>(scope: &'s Scope<'_>, type_idx: u32) -> Option<Object<'s>> {
+    RESOURCE_PROTOTYPES.with(|cell| {
+        cell.borrow()
+            .get(type_idx as usize)
+            .and_then(Option::as_ref)
+            .map(|heap| heap.get(scope))
+    })
+}
+
+/// Create a wrapper of `handle`, a handle of the resource type `type_idx` that
+/// the guest received as a `borrow` if `borrowed`, with `proto` as its
+/// prototype, or the prototype of [`ImportedResource`] if `proto` is `None`.
+fn new_wrapper<'s>(
+    scope: &'s Scope<'_>,
+    proto: Option<Object<'s>>,
+    type_idx: u32,
+    handle: Option<u32>,
+    borrowed: bool,
+) -> Result<ImportedResource<'s>, ExnThrown> {
+    match proto {
+        Some(proto) => js::class::create_instance_with_proto(scope, proto, |_| {
+            ImportedResourceImpl::new(type_idx, handle, borrowed)
+        }),
+        None => ImportedResource::new(scope, type_idx, handle, borrowed),
+    }
+}
+
+/// Create a wrapper of the owned handle `handle` of the imported resource type
+/// `type_idx`, with the prototype `proto`, or the prototype of
+/// [`ImportedResource`] if `proto` is `None`. The handle is dropped if the
+/// wrapper is collected while it holds the handle.
+pub fn wrap_imported<'s>(
+    scope: &'s Scope<'_>,
+    handle: u32,
+    type_idx: u32,
+    proto: Option<Object<'s>>,
+) -> Result<Object<'s>, ExnThrown> {
+    let wrapper = new_wrapper(scope, proto, type_idx, Some(handle), false)?;
+    Ok(*wrapper)
+}
+
+/// Return the handle held by `value`, a wrapper of the imported resource type
+/// `type_idx`. If `owned` is set, the handle is removed from the wrapper, so it
+/// isn't dropped when the wrapper is disposed of or collected.
+///
+/// Throws a `TypeError` if `value` isn't a wrapper of that type, or holds no
+/// handle. If `owned` is set, also throws if the wrapper was received as a
+/// `borrow`, or is lent to an import call that hasn't returned.
+pub fn unwrap_to_canon(
+    scope: &Scope<'_>,
+    value: HandleValue<'_>,
+    type_idx: u32,
+    owned: bool,
+) -> Result<u32, ExnThrown> {
+    if !value.is_object() {
+        return Err(throw_type_error(scope, c"resource value is not an object"));
+    }
+    let wrapper = imported_wrapper(scope, value)
+        .filter(|wrapper| wrapper.data().type_idx == type_idx)
+        .ok_or_else(|| {
+            throw_type_error(
+                scope,
+                c"resource value is not a wrapper of the expected resource type",
+            )
+        })?;
+    let checked = {
+        let data = wrapper.data();
+        match data.handle {
+            None => Err(c"resource wrapper has no live handle (already disposed?)"),
+            Some(_) if owned && data.borrowed => {
+                Err(c"a borrowed resource cannot be passed as an owned one")
+            }
+            Some(_) if owned && (data.lends > 0 || data.dispose_deferred) => {
+                Err(c"the resource is lent to an import call that has not returned")
+            }
+            Some(handle) => Ok(handle),
+        }
+    };
+    let handle = checked.map_err(|message| throw_type_error(scope, message))?;
+    if owned {
+        wrapper.data_mut().handle = None;
+    }
+    Ok(handle)
+}
+
+/// Drop the handle held by `wrapper` with the function set by
+/// [`set_imported_drop`]. Does nothing if `wrapper` holds no handle.
+///
+/// A wrapper lent to an import call that hasn't returned keeps its handle,
+/// which is dropped once the last such call returns.
+fn dispose_wrapper(scope: &Scope<'_>, wrapper: ImportedResource<'_>) -> Result<(), ExnThrown> {
+    let taken = {
+        let mut data = wrapper.data_mut();
+        match data.handle {
+            None => None,
+            Some(_) if data.lends > 0 => {
+                data.dispose_deferred = true;
+                None
+            }
+            Some(handle) => {
+                data.handle = None;
+                Some((data.type_idx, handle))
+            }
+        }
+    };
+    match taken {
+        Some((type_idx, handle)) => drop_imported_handle(scope, type_idx, handle),
+        None => Ok(()),
+    }
+}
+
+/// `[Symbol.dispose]` of every imported resource class: drop the handle the
+/// wrapper `this` holds. Throws a `TypeError` if `this` is not a wrapper.
+fn dispose_callback(
+    scope: &Scope<'_>,
+    args: CallbackArgs<'_>,
+    _payload: HandleValue<'_>,
+) -> Result<Value, ExnThrown> {
+    let this = scope.root_value(args.this());
+    let wrapper = imported_wrapper(scope, this).ok_or_else(|| {
+        throw_type_error(
+            scope,
+            c"dispose was called on an object that is not a resource wrapper",
+        )
+    })?;
+    dispose_wrapper(scope, wrapper)?;
+    Ok(js::value::undefined())
+}
+
+/// The function installed as `[Symbol.dispose]` on the prototype of every
+/// imported resource class.
+pub fn dispose_function<'s>(scope: &'s Scope<'_>) -> Result<Function<'s>, ExnThrown> {
+    js::class::get_or_init_shared_function(scope, dispose_callback as *const () as usize, |scope| {
+        Function::new_callback(scope, c"[Symbol.dispose]", 0, dispose_callback, ())
+    })
+}
+
+/// Move the handle held by `from` to `to`, a wrapper of the same type that
+/// holds no handle. Does nothing if `from` holds no handle.
+#[cfg(target_arch = "wasm32")]
+pub(crate) fn move_handle(from: ImportedResource<'_>, to: ImportedResource<'_>) {
+    let handle = from.data_mut().handle.take();
+    if handle.is_some() {
+        to.data_mut().handle = handle;
+    }
+}
+
+/// Release the borrows recorded on `stack` during a call that has ended. The
+/// handles of collected wrappers (see [`ImportedResource`]) are dropped first.
+///
+/// - An imported resource lifted as a `borrow` is disposed of, so its wrapper
+///   no longer holds the handle. If the wrapper is lent to an import call that
+///   hasn't returned, the handle is dropped when the last such call returns.
+/// - A wrapper lent to the call has its lend count decremented. If it was
+///   disposed of while lent, and this was its last lend, its handle is dropped.
+/// - An exported resource lent to the host is removed from the slab, and its
+///   handle is passed to `drop_exported_handle` with the resource's type index.
+///   The object is removed first, so that its `[Symbol.dispose]` method isn't
+///   called when the handle is dropped.
+///
+/// Every borrow is released even if releasing one throws. The first exception
+/// is rethrown afterwards.
+pub fn release_borrows(
+    stack: &mut CallStack,
+    scope: &Scope<'_>,
+    drop_exported_handle: &dyn Fn(u32, u32),
+) -> Result<(), ExnThrown> {
+    // The first exception is kept and cleared, so that the remaining releases
+    // run without a pending exception.
+    let mut first_exn: Option<HandleValue> = None;
+    let mut keep_first_failure = |result: Result<(), ExnThrown>| {
+        if result.is_err() {
+            match (first_exn, js::exception::take_pending(scope)) {
+                // The first catchable exception, kept rooted in `scope`.
+                (None, Some(exn)) => first_exn = Some(exn),
+                // A later failure, or an uncatchable one such as OOM.
+                _ => js::exception::clear(scope),
+            }
+        }
+    };
+    let collected = COLLECTED_HANDLES.with(|cell| std::mem::take(&mut *cell.borrow_mut()));
+    for (type_idx, handle) in collected {
+        keep_first_failure(drop_imported_handle(scope, type_idx, handle));
+    }
+    // Borrows are popped one at a time, so the remaining ones stay traced
+    // during a GC triggered by a release.
+    while let Some(borrow) = stack.pop_borrow() {
+        let object = borrow.heap().get(scope);
+        let result = match &borrow {
+            crate::stack::Borrow::Imported { .. } => {
+                let wrapper = object
+                    .cast::<ImportedResource>()
+                    .expect("an imported borrow holds a wrapper");
+                dispose_wrapper(scope, wrapper)
+            }
+            crate::stack::Borrow::Lent { .. } => {
+                let wrapper = object
+                    .cast::<ImportedResource>()
+                    .expect("a lent borrow holds a wrapper");
+                let deferred = {
+                    let mut data = wrapper.data_mut();
+                    data.lends = data.lends.saturating_sub(1);
+                    data.lends == 0 && std::mem::take(&mut data.dispose_deferred)
+                };
+                if deferred {
+                    dispose_wrapper(scope, wrapper)
+                } else {
+                    Ok(())
+                }
+            }
+            crate::stack::Borrow::Exported {
+                type_idx,
+                rep,
+                handle,
+                ..
+            } => {
+                with_exported_resources(|slab| slab.remove(scope, *rep));
+                drop_exported_handle(*type_idx, *handle);
+                Ok(())
+            }
+        };
+        keep_first_failure(result);
+    }
+    if let Some(exn) = first_exn {
+        return Err(js::exception::set_pending(
+            scope,
+            exn,
+            js::native::ExceptionStackBehavior::Capture,
+        ));
+    }
+    Ok(())
+}
+
+/// Lift an `own` handle. For an exported resource, the object is removed from
+/// the slab and the handle is dropped. For an imported resource, a new wrapper
+/// is created.
+pub fn push_own(
+    stack: &mut CallStack,
+    scope: &Scope<'_>,
+    desc: &ResourceDesc<'_>,
+    handle: u32,
+) -> Result<(), ExnThrown> {
+    match desc {
+        ResourceDesc::Exported { rep, drop, .. } => {
+            let slab_index = rep(handle);
+            let obj = EXPORTED_RESOURCES
+                .with(|slab| slab.borrow_mut().remove(scope, slab_index))
+                .ok_or_else(|| {
+                    throw_type_error(scope, c"exported resource rep is not in the slab")
+                })?;
+            stack.push_object(&obj);
+            // The host's lower added this handle to the guest's table, and
+            // nothing else releases it. The slab entry is already gone, so the
+            // `resource_dtor` this triggers finds no rep and does nothing.
+            drop(handle);
+        }
+        ResourceDesc::Imported { type_idx } => {
+            let proto = resource_prototype(scope, *type_idx);
+            let wrapper = wrap_imported(scope, handle, *type_idx, proto)?;
+            stack.push_object(&wrapper);
+        }
+    }
+    Ok(())
+}
+
+/// Lift a `borrow` handle. For an exported resource, `handle` is the rep, and
+/// the object in the slab is pushed. For an imported resource, a new wrapper is
+/// created and recorded on `stack`, so that [`release_borrows`] disposes of it
+/// when the call ends.
+pub fn push_borrow(
+    stack: &mut CallStack,
+    scope: &Scope<'_>,
+    desc: &ResourceDesc<'_>,
+    handle: u32,
+) -> Result<(), ExnThrown> {
+    match desc {
+        ResourceDesc::Exported { .. } => {
+            let obj = EXPORTED_RESOURCES
+                .with(|slab| slab.borrow().lookup(handle).map(|h| h.get(scope)))
+                .ok_or_else(|| {
+                    throw_type_error(scope, c"borrowed exported resource is not in the slab")
+                })?;
+            stack.push_object(&obj);
+        }
+        ResourceDesc::Imported { type_idx } => {
+            let proto = resource_prototype(scope, *type_idx);
+            let wrapper = new_wrapper(scope, proto, *type_idx, Some(handle), true)?;
+            stack.push_imported_borrow(&wrapper);
+            stack.push_object(&wrapper);
+        }
+    }
+    Ok(())
+}
+
+/// Lower an `own` handle. For an exported resource, the object is stored in
+/// the slab and a new handle is created for it. For an imported resource, the
+/// handle is removed from the wrapper (see [`unwrap_to_canon`]).
+pub fn pop_own(
+    stack: &mut CallStack,
+    scope: &Scope<'_>,
+    desc: &ResourceDesc<'_>,
+) -> Result<u32, ExnThrown> {
+    let value = scope.root_value(stack.pop_value());
+    match desc {
+        ResourceDesc::Exported { .. } => Ok(lower_exported(scope, desc, value)?.handle),
+        ResourceDesc::Imported { type_idx } => unwrap_to_canon(scope, value, *type_idx, true),
+    }
+}
+
+/// Lower a `borrow` handle. For an exported resource, the object is stored in
+/// the slab and a new handle is created for it. For an imported resource, the
+/// wrapper's handle is used, and the wrapper's lend count is incremented. In
+/// both cases, the borrow is recorded on `stack`, so that [`release_borrows`]
+/// releases it when the call ends.
+pub fn pop_borrow(
+    stack: &mut CallStack,
+    scope: &Scope<'_>,
+    desc: &ResourceDesc<'_>,
+) -> Result<u32, ExnThrown> {
+    let value = scope.root_value(stack.pop_value());
+    match desc {
+        ResourceDesc::Exported { type_idx, .. } => {
+            let lowered = lower_exported(scope, desc, value)?;
+            stack.push_exported_borrow(&lowered.object, *type_idx, lowered.rep, lowered.handle);
+            Ok(lowered.handle)
+        }
+        ResourceDesc::Imported { type_idx } => {
+            let handle = unwrap_to_canon(scope, value, *type_idx, false)?;
+            let wrapper =
+                imported_wrapper(scope, value).expect("unwrap_to_canon accepted a wrapper");
+            wrapper.data_mut().lends += 1;
+            stack.push_lent_wrapper(&wrapper);
+            Ok(handle)
+        }
+    }
+}
+
+/// The objects implementing exported resources, indexed by rep, each with its
+/// resource type index. Freed indices are reused. The objects are rooted.
+#[derive(Default)]
+pub struct ExportedResources {
+    entries: Slab<(RootedHeap<js::object::Object>, u32)>,
+}
+
+impl ExportedResources {
+    /// Insert `obj`, which implements a resource of type `type_idx`, and return
+    /// its rep.
+    pub fn insert(&mut self, obj: &Object<'_>, type_idx: u32) -> u32 {
+        let rep = self.entries.insert((RootedHeap::new(*obj), type_idx));
+        u32::try_from(rep).expect("too many exported resource objects")
+    }
+
+    /// Look up the object at `rep`, or `None` if the slot is free or out of
+    /// range.
+    pub fn lookup(&self, rep: u32) -> Option<&RootedHeap<js::object::Object>> {
+        self.entries.get(rep as usize).map(|(object, _)| object)
+    }
+
+    /// Remove the object at `rep`, freeing the slot, and root it into `scope`.
+    /// Returns `None` if the slot was already free or out of range.
+    pub fn remove<'s>(&mut self, scope: &'s Scope<'_>, rep: u32) -> Option<Object<'s>> {
+        self.remove_with_type(scope, rep).map(|(object, _)| object)
+    }
+
+    /// Like [`remove`](Self::remove), but also returns the type index the
+    /// object was inserted with.
+    fn remove_with_type<'s>(
+        &mut self,
+        scope: &'s Scope<'_>,
+        rep: u32,
+    ) -> Option<(Object<'s>, u32)> {
+        let (object, type_idx) = self.entries.try_remove(rep as usize)?;
+        Some((object.get(scope), type_idx))
+    }
+}
+
+/// Insert `value` into the slab, and return a new handle for it, created with
+/// `desc`'s `new`. Each call creates another rep and handle, even for the same
+/// object.
+///
+/// Throws a `TypeError` if `desc` isn't a [`ResourceDesc::Exported`], or if
+/// `value` isn't an object.
+pub fn exported_resource_to_canon(
+    scope: &Scope<'_>,
+    desc: &ResourceDesc<'_>,
+    value: HandleValue<'_>,
+) -> Result<u32, ExnThrown> {
+    lower_exported(scope, desc, value).map(|lowered| lowered.handle)
+}
+
+/// The outcome of one [`lower_exported`] call.
+struct LoweredExport<'s> {
+    /// The object that was lowered, rooted for the caller.
+    object: Object<'s>,
+    /// The handle passed to the host.
+    handle: u32,
+    /// The object's rep.
+    rep: u32,
+}
+
+/// Like [`exported_resource_to_canon`], but also returns the rooted object and the rep.
+fn lower_exported<'s>(
+    scope: &'s Scope<'_>,
+    desc: &ResourceDesc<'_>,
+    value: HandleValue<'_>,
+) -> Result<LoweredExport<'s>, ExnThrown> {
+    let (type_idx, new) = match desc {
+        ResourceDesc::Exported { type_idx, new, .. } => (*type_idx, *new),
+        ResourceDesc::Imported { .. } => {
+            return Err(throw_type_error(
+                scope,
+                c"exported_resource_to_canon called for an imported resource",
+            ))
+        }
+    };
+
+    let object = Object::from_raw_value(scope, value.get())
+        .map_err(|_| throw_type_error(scope, c"exported resource value is not an object"))?;
+
+    let rep = EXPORTED_RESOURCES.with(|slab| slab.borrow_mut().insert(&object, type_idx));
+    let handle = new(rep);
+
+    Ok(LoweredExport {
+        object,
+        handle,
+        rep,
+    })
+}
+
+js::instance_local! {
+    /// The slab of guest-owned resource objects.
+    static EXPORTED_RESOURCES: RefCell<ExportedResources> =
+        RefCell::new(ExportedResources::default());
+}
+
+/// Run `f` with a mutable borrow of the exported-resource slab.
+pub fn with_exported_resources<R>(f: impl FnOnce(&mut ExportedResources) -> R) -> R {
+    EXPORTED_RESOURCES.with(|slab| f(&mut slab.borrow_mut()))
+}
+
+/// Drop an exported resource that the host has dropped: remove the object with
+/// the rep `rep` from the slab, and call its `[Symbol.dispose]` method if it
+/// has one. Does nothing if there is no object with that rep.
+///
+/// In debug builds, panics if the object's type index isn't
+/// `expected_type_idx`.
+pub fn drop_exported(scope: &Scope<'_>, rep: u32, expected_type_idx: u32) -> Result<(), ExnThrown> {
+    let Some((obj, type_idx)) = with_exported_resources(|slab| slab.remove_with_type(scope, rep))
+    else {
+        // Dropping an unknown rep does nothing. Such a rep comes from a double
+        // drop or from a handle that never entered the slab.
+        return Ok(());
+    };
+
+    debug_assert_eq!(
+        type_idx, expected_type_idx,
+        "resource_dtor type index mismatch"
+    );
+
+    if let Some(dispose) = dispose_method(scope, &obj)? {
+        Function::call(scope, obj, dispose, EmptyArgs)?;
+    }
+    Ok(())
+}
+
+/// Drop the slab and the registered prototypes. See
+/// [`crate::tracing::clear_traced_roots`].
+pub(crate) fn clear_traced_roots() {
+    EXPORTED_RESOURCES.with(|slab| *slab.borrow_mut() = ExportedResources::default());
+    RESOURCE_PROTOTYPES.with(|cell| cell.borrow_mut().clear());
+}
diff --git a/crates/wit-bridge/src/run.rs b/crates/wit-bridge/src/run.rs
new file mode 100644
index 00000000..bd106f35
--- /dev/null
+++ b/crates/wit-bridge/src/run.rs
@@ -0,0 +1,270 @@
+// SPDX-License-Identifier: Apache-2.0-WITH-LLVM-exception
+
+//! Calling the `run` function of a CLI application.
+//!
+//! The runtime's `wasi:cli/run` export calls the `run` function exported by
+//! the application's main module as a bare export. [`run_main_export`] calls it
+//! and runs the event loop until it settles. [`report_run_outcome`] converts the
+//! outcome into the result of `wasi:cli/run.run`.
+
+use core_runtime::event_loop::{run_until, with_event_loop};
+use core_runtime::invocation::OwnedInvocation;
+use js::conversion::FromJSVal;
+use js::gc::handle::RootedHeap;
+use js::gc::scope::Scope;
+use js::native::Value;
+use js::prelude::HandleValue;
+
+use crate::exports::{
+    promise_is_settled, resolve_export, settled_promise_outcome, Outcome, ResultShape,
+};
+use crate::init;
+
+/// The context a failed `run` is reported with, ahead of the error's message,
+/// location and stack.
+const RUN_FAILED: &str = "run() failed";
+
+/// The outcome of calling the application's `run` function.
+pub enum RunOutcome {
+    /// The application exports no `run` function.
+    NoRunExport,
+    /// `run()` settled successfully.
+    Ok,
+    /// `run()` threw, rejected or didn't settle. Holds the error message.
+    Failed(String),
+}
+
+/// Convert `outcome` into the result of `wasi:cli/run.run`, and print the error
+/// message of a failure to stderr. [`RunOutcome::NoRunExport`] is a failure.
+///
+/// The return type matches the result type of `wasi:cli/run.run`, whose cases
+/// have no values.
+#[allow(clippy::result_unit_err)]
+pub fn report_run_outcome(outcome: RunOutcome) -> Result<(), ()> {
+    match outcome {
+        RunOutcome::Ok => Ok(()),
+        RunOutcome::Failed(message) => {
+            eprintln!("{message}");
+            Err(())
+        }
+        RunOutcome::NoRunExport => {
+            eprintln!("this component exports no `run` function and cannot be run as a CLI tool");
+            Err(())
+        }
+    }
+}
+
+/// Whether `event_loop` has pending component-model work, such as a call to an
+/// async import. Timers don't count. Stream and future writes are pending
+/// sends, which aren't checked here.
+pub(crate) fn has_async_work(event_loop: &core_runtime::event_loop::EventLoop) -> bool {
+    event_loop.has_interest() || event_loop.has_active_external_async_tasks()
+}
+
+/// Where [`run_main_export`] finds the application's main module.
+#[derive(Clone, Copy)]
+pub enum MainModule {
+    /// The main module evaluated by
+    /// [`initialize_runtime`](crate::init::initialize_runtime), which must have
+    /// succeeded.
+    Bootstrap,
+    /// The entry module of the runtime with this context (see
+    /// [`core_runtime::module::entry_namespace`]). The realm of the runtime's
+    /// default global must stay entered, and the runtime alive, until the run
+    /// ends.
+    Entry(*mut js::native::RawJSContext),
+}
+
+impl MainModule {
+    /// The context of the runtime the main module belongs to.
+    fn raw_cx(self) -> *mut js::native::RawJSContext {
+        match self {
+            MainModule::Bootstrap => init::raw_cx(),
+            MainModule::Entry(raw_cx) => raw_cx,
+        }
+    }
+
+    /// Run `f` with a scope on the main module's realm and its namespace, or
+    /// `None` if there is no main module.
+    fn with_namespace<R>(
+        self,
+        f: impl FnOnce(&js::gc::scope::Scope<'_>, Option<&js::Object<'_>>) -> R,
+    ) -> R {
+        match self {
+            MainModule::Bootstrap => init::with_scope(|scope| {
+                f(scope, core_runtime::module::entry_namespace(scope).as_ref())
+            }),
+            MainModule::Entry(raw_cx) => {
+                // SAFETY: the realm of `raw_cx`'s default global is entered, and its runtime
+                // alive, as `MainModule::Entry` requires.
+                let scope = unsafe { js::gc::scope::RootScope::from_current_realm(raw_cx) };
+                let ns = core_runtime::module::entry_namespace(&scope);
+                f(&scope, ns.as_ref())
+            }
+        }
+    }
+}
+
+/// Call the `run` function exported by `main` on the event loop of
+/// `invocation`, and run the loop until the returned promise settles. The loop
+/// is then run until the remaining async work is done (see `drain_async_work`).
+///
+/// Returns [`RunOutcome::NoRunExport`] if `main` doesn't export `run`.
+pub async fn run_main_export(invocation: &OwnedInvocation, main: MainModule) -> RunOutcome {
+    // Phase 1: resolve and call `run`, keeping the value it produced rooted
+    // across the awaits below.
+    let phase1 = main.with_namespace(|scope, ns| {
+        let Some(ns) = ns else {
+            return Phase1::NoRunExport;
+        };
+        with_event_loop(invocation.state().event_loop(), |_| {
+            // A missing `run` throws a `TypeError`, which means that there is
+            // no `run` export.
+            let resolved = match resolve_export(scope, ns, "run") {
+                Ok(resolved) => resolved,
+                Err(js::error::ExnThrown) => {
+                    js::exception::clear(scope);
+                    return Phase1::NoRunExport;
+                }
+            };
+
+            // The result of `run` is handled as a plain value, so any exception
+            // fails the run.
+            let outcome =
+                match crate::exports::call_export(scope, resolved, &[], &ResultShape::Plain) {
+                    Ok(outcome) => outcome,
+                    Err(captured) => return Phase1::Failed(captured.with_context(RUN_FAILED)),
+                };
+
+            // Running microtasks can settle the returned promise before the
+            // check below.
+            core_runtime::event_loop::run_microtasks(scope);
+
+            match outcome {
+                Outcome::Returned(value) => Phase1::Returned {
+                    pending: !promise_is_settled(scope, value),
+                    value: RootedHeap::from(value.get()),
+                },
+                // Unreachable for a plain result.
+                Outcome::Threw(_) => Phase1::Failed("run() returned an error".to_string()),
+            }
+        })
+    });
+
+    let value = match phase1 {
+        Phase1::NoRunExport => return RunOutcome::NoRunExport,
+        Phase1::Failed(message) => return RunOutcome::Failed(message),
+        Phase1::Returned { pending, value } => {
+            if pending {
+                // Phase 2: run this call's event loop until `run`'s promise
+                // settles.
+                drive_until_settled(main.raw_cx(), invocation, |scope| value.get(scope)).await;
+            }
+            value
+        }
+    };
+
+    // Phase 3: read the result. `run_until` also returns when the loop goes
+    // idle, so the promise can still be pending.
+    let outcome = main.with_namespace(|scope, _ns| {
+        match js::Promise::from_jsval(scope, value.get(scope), ()).ok() {
+            Some(promise) if promise.is_pending() => RunOutcome::Failed(
+                "run() did not settle: the event loop went idle while the promise it returned \
+                 was still pending"
+                    .to_string(),
+            ),
+            Some(promise) if promise.is_rejected() => {
+                let reason = promise
+                    .result(scope)
+                    .expect("a rejected promise has a reason");
+                RunOutcome::Failed(crate::exports::rejection_message(scope, reason, RUN_FAILED))
+            }
+            Some(promise) => match settled_promise_outcome(scope, &promise, &ResultShape::Plain) {
+                Ok(Outcome::Returned(_)) => RunOutcome::Ok,
+                // Unreachable for a fulfilled promise.
+                Ok(Outcome::Threw(_)) => RunOutcome::Failed("run() returned an error".to_string()),
+                Err(message) => RunOutcome::Failed(message),
+            },
+            // A plain sync `run` returned a non-promise.
+            None => RunOutcome::Ok,
+        }
+    });
+
+    // Phase 4: finish the remaining async work.
+    drain_async_work(main.raw_cx(), invocation).await;
+
+    outcome
+}
+
+/// Run `invocation`'s event loop until the value returned by `value` isn't a
+/// pending promise. `raw_cx` is the context of `invocation`'s runtime, whose
+/// default global's realm must be entered.
+pub(crate) async fn drive_until_settled(
+    raw_cx: *mut js::native::RawJSContext,
+    invocation: &OwnedInvocation,
+    value: impl for<'s> Fn(&'s Scope<'_>) -> HandleValue<'s>,
+) {
+    // SAFETY: `raw_cx`'s default-global realm is entered, as the caller
+    // guarantees, and `invocation`'s `Rc<Runtime>` clone holds the runtime that
+    // owns it alive for the whole await.
+    unsafe {
+        run_until(
+            raw_cx,
+            invocation.state().event_loop(),
+            platform::clock::sleep,
+            |scope| promise_is_settled(scope, value(scope)),
+        )
+        .await;
+    }
+}
+
+/// Run `invocation`'s event loop until its pending sends are finished (see
+/// [`core_runtime::event_loop::finish_pending_sends`]), and [`has_async_work`]
+/// returns `false`. Pending sends include the body of a returned `Response`,
+/// and the writes of streams and futures returned by an export.
+///
+/// Timers aren't waited for, so that a `setInterval` that is never cleared
+/// doesn't prevent the call from completing. Work that waits for a timer is
+/// dropped with `invocation`.
+///
+/// `raw_cx` is the context of `invocation`'s runtime, whose default global's
+/// realm must be entered.
+pub(crate) async fn drain_async_work(
+    raw_cx: *mut js::native::RawJSContext,
+    invocation: &OwnedInvocation,
+) {
+    let event_loop = invocation.state().event_loop();
+    // Running the loop can register more sends, which are then finished as
+    // well.
+    loop {
+        // SAFETY: as in `drive_until_settled`.
+        unsafe {
+            core_runtime::event_loop::finish_pending_sends(
+                raw_cx,
+                event_loop,
+                platform::clock::sleep,
+            )
+            .await;
+            run_until(raw_cx, event_loop, platform::clock::sleep, |_scope| {
+                !has_async_work(event_loop) || event_loop.has_pending_sends()
+            })
+            .await;
+        }
+        if !event_loop.has_pending_sends() {
+            break;
+        }
+    }
+}
+
+/// The result of calling `run` in [`run_main_export`].
+enum Phase1 {
+    /// No `run` export on the namespace.
+    NoRunExport,
+    /// `run` threw. Holds the error message.
+    Failed(String),
+    /// `run` returned `value`, which is a still-pending promise if `pending`.
+    Returned {
+        pending: bool,
+        value: RootedHeap<Value>,
+    },
+}
diff --git a/crates/wit-bridge/src/stack.rs b/crates/wit-bridge/src/stack.rs
new file mode 100644
index 00000000..107786f2
--- /dev/null
+++ b/crates/wit-bridge/src/stack.rs
@@ -0,0 +1,594 @@
+// SPDX-License-Identifier: Apache-2.0-WITH-LLVM-exception
+
+//! The value stack of a component call, and its GC tracing.
+//!
+//! A [`CallStack`] holds the values of one component call: lifted values are
+//! pushed onto it, and values to be lowered are popped off it. Other JS objects
+//! don't reference these values, so the stack is traced as a GC root.
+//!
+//! Values to be lowered can also be pushed as [`TypeShapeValue`]s, which are
+//! held separately (see [`CallStack::push_shaped`]).
+//!
+//! Each `CallStack` points to a heap-allocated interior, whose address is
+//! registered in `LIVE_STACKS`. `trace_stack_values` traces the values of every
+//! registered interior in every collection, including minor ones. Moving a
+//! `CallStack` doesn't move the interior, and the interior's type is private,
+//! so other code can't move it out of its allocation. The interior is held as a
+//! raw pointer instead of a `Box`, so that accesses through the registered
+//! pointer don't invalidate the stack's own pointer. Borrows are held in
+//! [`RootedHeap`]s, which root themselves.
+
+use std::alloc::Layout;
+use std::cell::RefCell;
+use std::collections::HashSet;
+use std::ptr::NonNull;
+
+use js::conversion::FromJSVal;
+use js::gc::handle::RootedHeap;
+use js::gc::scope::Scope;
+use js::gc::trace_value_root;
+use js::native::{JSTracer, Value};
+use js::prelude::HandleValue;
+
+use crate::value::TypeShapeValue;
+
+js::instance_local! {
+    /// Every live [`CallStackInner`] in this runtime, by address. Entries are
+    /// added in [`CallStack::new`] and removed in `CallStackInner::drop`. The
+    /// interiors are heap-allocated and never moved, so a raw pointer remains
+    /// valid for as long as its entry is present.
+    static LIVE_STACKS: RefCell<HashSet<*mut CallStackInner>> =
+        RefCell::new(HashSet::new());
+
+    /// Emptied interiors kept for [`CallStack::new`] to reuse, at most
+    /// [`MAX_FREE_STACKS`]. They are kept in [`LIVE_STACKS`] and hold nothing to trace.
+    static FREE_STACKS: RefCell<FreeStacks> = RefCell::new(FreeStacks(Vec::new()));
+}
+
+/// The emptied interiors in [`FREE_STACKS`], freed when the instance-local is
+/// destroyed, which happens at thread exit on native targets only.
+struct FreeStacks(Vec<NonNull<CallStackInner>>);
+
+impl Drop for FreeStacks {
+    fn drop(&mut self) {
+        for inner in self.0.drain(..) {
+            // SAFETY: each entry came from `CallStack::drop`, which gave up its only pointer to it.
+            unsafe { free_interior(inner) };
+        }
+    }
+}
+
+/// Free an interior allocated by [`CallStack::new`], which removes it from [`LIVE_STACKS`].
+///
+/// # Safety
+///
+/// `inner` must come from [`CallStack::new`]'s `Box::into_raw`, and must not be used again.
+unsafe fn free_interior(inner: NonNull<CallStackInner>) {
+    // SAFETY: guaranteed by the caller.
+    drop(unsafe { Box::from_raw(inner.as_ptr()) });
+}
+
+/// The maximum number of emptied interiors kept in [`FREE_STACKS`].
+const MAX_FREE_STACKS: usize = 16;
+
+/// The maximum capacity, in elements, kept by each vector of an interior in [`FREE_STACKS`].
+const MAX_KEPT_CAPACITY: usize = 64;
+
+/// The mutable interior of a [`CallStack`], private so that external code cannot
+/// move these fields out of the allocation the registry points at.
+#[js::allow_unrooted_interior]
+struct CallStackInner {
+    /// Lifted and to-be-lowered JS values, traced as roots by [`trace_stack_values`]
+    /// in every collection, so they need no write barriers.
+    values: Vec<Value>,
+    /// The values pushed by [`CallStack::push_shaped`]. Their JS values are held
+    /// in `RootedHeap`s, which root themselves.
+    shaped: Vec<TypeShapeValue>,
+    /// The cursor of each list being lowered.
+    iters: Vec<ListCursor>,
+    /// The next index and the element count of each list being lifted. It is
+    /// separate from `iters`, so that a lift nested in a lowering doesn't change
+    /// `iters`.
+    lift_iters: Vec<(usize, usize)>,
+    /// The strings stored by [`CallStack::store_string`].
+    strings: Vec<String>,
+    /// The allocations that are freed when the stack is dropped (see
+    /// [`CallStack::defer_deallocate`]).
+    deferred: Vec<(*mut u8, Layout)>,
+    /// The resource borrows of this call, released by
+    /// `resources::release_borrows` when the call ends.
+    borrows: Vec<Borrow>,
+    /// The result of the export with this index, kept while it is lowered to
+    /// describe a failure to lower it. Traced by [`trace_stack_values`].
+    lowering_source: Option<(Value, usize)>,
+    /// Whether a lift may take back the payload this stack lowers (see
+    /// [`CallStack::set_adoptable`]).
+    adoptable: bool,
+}
+
+/// The position in a list being lowered.
+enum ListCursor {
+    /// The index of the next element of the array on top of the JS values.
+    Js(usize),
+    /// The elements of a [`TypeShapeValue::List`] not yet pushed, in reverse
+    /// order.
+    Shaped(Vec<TypeShapeValue>),
+}
+
+/// One resource borrow recorded for the duration of a call, released by
+/// `resources::release_borrows` when the call ends.
+pub enum Borrow {
+    /// A new wrapper of an imported resource lifted as a `borrow`.
+    Imported {
+        wrapper: RootedHeap<js::object::Object>,
+    },
+    /// A wrapper of an imported resource lowered as a `borrow`. Keeping it
+    /// reachable until the call ends prevents its finalizer from dropping the
+    /// handle during the call.
+    Lent {
+        wrapper: RootedHeap<js::object::Object>,
+    },
+    /// An exported resource lowered as a `borrow`, with a handle created for
+    /// this call.
+    Exported {
+        object: RootedHeap<js::object::Object>,
+        /// The resource type index, which selects the type's `drop`.
+        type_idx: u32,
+        /// The object's rep.
+        rep: u32,
+        /// The handle created for this call.
+        handle: u32,
+    },
+}
+
+impl Borrow {
+    /// The object held by this borrow.
+    pub(crate) fn heap(&self) -> &RootedHeap<js::object::Object> {
+        match self {
+            Borrow::Imported { wrapper } | Borrow::Lent { wrapper } => wrapper,
+            Borrow::Exported { object, .. } => object,
+        }
+    }
+}
+
+/// The value stack of a component call (see the module documentation).
+pub struct CallStack(NonNull<CallStackInner>);
+
+impl CallStack {
+    /// Create a stack, reusing an emptied interior if one is available.
+    pub fn new() -> CallStack {
+        if let Some(inner) = FREE_STACKS.with(|free| free.borrow_mut().0.pop()) {
+            return CallStack(inner);
+        }
+        let inner = Box::new(CallStackInner {
+            values: Vec::new(),
+            shaped: Vec::new(),
+            iters: Vec::new(),
+            lift_iters: Vec::new(),
+            strings: Vec::new(),
+            deferred: Vec::new(),
+            borrows: Vec::new(),
+            lowering_source: None,
+            adoptable: false,
+        });
+        let inner = NonNull::from(Box::leak(inner));
+        LIVE_STACKS.with(|stacks| stacks.borrow_mut().insert(inner.as_ptr()));
+        CallStack(inner)
+    }
+
+    /// The interior, for the duration of a shared borrow of the stack.
+    fn inner(&self) -> &CallStackInner {
+        // SAFETY: the interior lives until `drop`, and the tracers only access it while JS
+        // execution is paused, when no borrow of it is in use.
+        unsafe { self.0.as_ref() }
+    }
+
+    /// The interior, for the duration of a mutable borrow of the stack.
+    fn inner_mut(&mut self) -> &mut CallStackInner {
+        // SAFETY: as for `inner`, and `&mut self` excludes every other borrow through `self`.
+        unsafe { self.0.as_mut() }
+    }
+
+    /// Whether the stack holds strings, deferred allocations or borrows.
+    pub fn holds_lowered_data(&self) -> bool {
+        let inner = self.inner();
+        !inner.strings.is_empty() || !inner.deferred.is_empty() || !inner.borrows.is_empty()
+    }
+
+    /// Push a JavaScript value onto the stack, which roots it.
+    #[js::allow_unrooted]
+    pub fn push_value(&mut self, value: Value) {
+        self.inner_mut().values.push(value);
+    }
+
+    /// Push a JavaScript object onto the stack.
+    pub fn push_object(&mut self, obj: &js::Object<'_>) {
+        self.push_value(obj.as_value());
+    }
+
+    /// Pop the top JavaScript value off the stack. While the stack holds
+    /// [`TypeShapeValue`]s, this pops the top one, which must be a
+    /// [`TypeShapeValue::Js`], and returns its value.
+    ///
+    /// The returned [`Value`] is not rooted: the caller must root or otherwise
+    /// consume it before the next allocation can trigger a GC.
+    ///
+    /// # Panics
+    ///
+    /// Panics if the stack is empty, or if the top [`TypeShapeValue`] is of
+    /// another variant. Both indicate a bug in the calling convention rather
+    /// than untrusted input.
+    #[js::allow_unrooted]
+    pub fn pop_value(&mut self) -> Value {
+        let inner = self.inner_mut();
+        match inner.shaped.pop() {
+            // SAFETY: the value is returned unrooted, as documented.
+            Some(TypeShapeValue::Js(value)) => unsafe { value.as_raw() },
+            Some(_) => panic!("pop_value with a shaped value other than `Js` on top"),
+            None => inner.values.pop().expect("pop from empty CallStack"),
+        }
+    }
+
+    /// The value [`pop_value`](Self::pop_value) would return, without removing
+    /// it.
+    ///
+    /// # Panics
+    ///
+    /// Panics where [`pop_value`](Self::pop_value) would.
+    #[js::allow_unrooted]
+    pub fn last(&self) -> Value {
+        let inner = self.inner();
+        match inner.shaped.last() {
+            // SAFETY: the value is returned unrooted, as `pop_value` returns it.
+            Some(TypeShapeValue::Js(value)) => unsafe { value.as_raw() },
+            Some(_) => panic!("last with a shaped value other than `Js` on top"),
+            None => *inner.values.last().expect("last on empty CallStack"),
+        }
+    }
+
+    /// Push `value` for lowering. While the stack holds [`TypeShapeValue`]s,
+    /// the lowering functions in [`crate::value`] and the list functions of
+    /// this type pop them instead of JS values. A [`TypeShapeValue::Js`] on top
+    /// is lowered from its JS value, which [`pop_value`](Self::pop_value) and
+    /// [`last`](Self::last) return.
+    pub fn push_shaped(&mut self, value: TypeShapeValue) {
+        self.inner_mut().shaped.push(value);
+    }
+
+    /// Pop the top [`TypeShapeValue`]. Returns `None` if there is none, or if
+    /// it is a [`TypeShapeValue::Js`], which is left on the stack.
+    pub fn pop_shaped(&mut self) -> Option<TypeShapeValue> {
+        let shaped = &mut self.inner_mut().shaped;
+        match shaped.last()? {
+            TypeShapeValue::Js(_) => None,
+            _ => shaped.pop(),
+        }
+    }
+
+    /// The value [`pop_shaped`](Self::pop_shaped) would return, without removing
+    /// it.
+    pub fn last_shaped(&self) -> Option<&TypeShapeValue> {
+        match self.inner().shaped.last()? {
+            TypeShapeValue::Js(_) => None,
+            shaped => Some(shaped),
+        }
+    }
+
+    /// Number of values currently on the stack, including [`TypeShapeValue`]s.
+    pub fn len(&self) -> usize {
+        let inner = self.inner();
+        inner.values.len() + inner.shaped.len()
+    }
+
+    /// Whether the stack holds no values and no [`TypeShapeValue`]s.
+    pub fn is_empty(&self) -> bool {
+        self.len() == 0
+    }
+
+    /// Store `s`, and return a reference to it that is valid until the stack is
+    /// dropped. If [`CallStack::set_adoptable`] was called, the string's
+    /// capacity is reduced to its length.
+    pub fn store_string(&mut self, mut s: String) -> &str {
+        let inner = self.inner_mut();
+        if inner.adoptable {
+            s.shrink_to_fit();
+        }
+        inner.strings.push(s);
+        inner.strings.last().expect("just pushed")
+    }
+
+    /// Allow a later lift to take over the memory of the value lowered on this
+    /// stack. That lift takes ownership of the strings, and requires that each
+    /// string's capacity equals its length, so the strings stored after this call
+    /// get such a capacity. See [`CallStack::release_adopted`].
+    pub fn set_adoptable(&mut self) {
+        self.inner_mut().adoptable = true;
+    }
+
+    /// Forget the strings and deferred allocations of a value whose memory was
+    /// taken over by a lift, without freeing them.
+    pub fn release_adopted(&mut self) {
+        let inner = self.inner_mut();
+        for string in inner.strings.drain(..) {
+            std::mem::forget(string);
+        }
+        inner.deferred.clear();
+    }
+
+    /// Defer freeing `ptr` (with `layout`) until this stack drops.
+    ///
+    /// # Safety
+    ///
+    /// `ptr` must have been allocated with the global allocator using exactly
+    /// `layout`, and ownership of it is transferred here: it must not be used or
+    /// freed elsewhere after this call.
+    pub unsafe fn defer_deallocate(&mut self, ptr: *mut u8, layout: Layout) {
+        self.inner_mut().deferred.push((ptr, layout));
+    }
+
+    /// Keep `value`, the result of the export with index `export` that is about
+    /// to be lowered, so a failure to lower it can be described.
+    #[js::allow_unrooted]
+    pub fn set_lowering_source(&mut self, value: Value, export: usize) {
+        self.inner_mut().lowering_source = Some((value, export));
+    }
+
+    /// Return the value kept by [`set_lowering_source`](Self::set_lowering_source),
+    /// rooted on `scope`, and the index of its export.
+    #[js::allow_unrooted]
+    pub fn lowering_source<'s>(&self, scope: &'s Scope<'_>) -> Option<(HandleValue<'s>, usize)> {
+        let (value, export) = self.inner().lowering_source?;
+        Some((scope.root_value(value), export))
+    }
+
+    // --- Per-call borrow tracking ---
+
+    /// Record `wrapper`, created for an imported resource lifted as a `borrow`.
+    /// It is disposed of by `resources::release_borrows` when the call ends.
+    pub fn push_imported_borrow(&mut self, wrapper: &js::Object<'_>) {
+        self.inner_mut().borrows.push(Borrow::Imported {
+            wrapper: RootedHeap::new(*wrapper),
+        });
+    }
+
+    /// Record `wrapper`, a wrapper of an imported resource lowered as a
+    /// `borrow`. It is kept reachable until `resources::release_borrows` runs.
+    pub fn push_lent_wrapper(&mut self, wrapper: &js::Object<'_>) {
+        self.inner_mut().borrows.push(Borrow::Lent {
+            wrapper: RootedHeap::new(*wrapper),
+        });
+    }
+
+    /// Record `object`, an exported resource lowered as a `borrow` with the
+    /// handle `handle`. `resources::release_borrows` removes it from the slab and
+    /// drops the handle when the call ends.
+    pub fn push_exported_borrow(
+        &mut self,
+        object: &js::Object<'_>,
+        type_idx: u32,
+        rep: u32,
+        handle: u32,
+    ) {
+        self.inner_mut().borrows.push(Borrow::Exported {
+            object: RootedHeap::new(*object),
+            type_idx,
+            rep,
+            handle,
+        });
+    }
+
+    /// Pop the most recently recorded borrow, or `None` if none remain.
+    pub fn pop_borrow(&mut self) -> Option<Borrow> {
+        self.inner_mut().borrows.pop()
+    }
+
+    // --- List iterator protocol, matching wit-dylib-ffi's pop_list/next/iter ---
+
+    /// Begin lowering the list on top of the stack, and return its length.
+    ///
+    /// A JS array stays on the stack until
+    /// [`lower_list_end`](Self::lower_list_end). Throws a `TypeError` if the value
+    /// isn't an array. A [`TypeShapeValue::List`] is popped, and its elements are
+    /// kept in the list's cursor.
+    ///
+    /// # Panics
+    ///
+    /// Panics if the top [`TypeShapeValue`] isn't a [`TypeShapeValue::List`].
+    pub fn lower_list_begin(&mut self, scope: &Scope<'_>) -> Result<usize, js::error::ExnThrown> {
+        if let Some(shaped) = self.pop_shaped() {
+            let TypeShapeValue::List(mut elements) = shaped else {
+                panic!("lower_list_begin with a shaped value other than a list on top")
+            };
+            let len = elements.len();
+            elements.reverse();
+            self.inner_mut().iters.push(ListCursor::Shaped(elements));
+            return Ok(len);
+        }
+        let list = self.list_being_lowered(scope)?;
+        let len = list.length(scope)?;
+        self.inner_mut().iters.push(ListCursor::Js(0));
+        Ok(len as usize)
+    }
+
+    /// Push the next element of the list currently being lowered onto the stack.
+    pub fn lower_list_next(&mut self, scope: &Scope<'_>) -> Result<(), js::error::ExnThrown> {
+        let index = match self
+            .inner_mut()
+            .iters
+            .last_mut()
+            .expect("lower_list_next without begin")
+        {
+            ListCursor::Js(index) => *index,
+            ListCursor::Shaped(remaining) => {
+                let next = remaining
+                    .pop()
+                    .expect("lower_list_next past the list's end");
+                self.push_shaped(next);
+                return Ok(());
+            }
+        };
+        let list = self.list_being_lowered(scope)?;
+        let value = list.get_element(scope, index as u32)?;
+        if let Some(ListCursor::Js(next)) = self.inner_mut().iters.last_mut() {
+            *next = index + 1;
+        }
+        self.push_value(value.get());
+        Ok(())
+    }
+
+    /// Finish lowering the current list: pop its cursor, and its array if it is
+    /// a JS array.
+    pub fn lower_list_end(&mut self) {
+        let cursor = self
+            .inner_mut()
+            .iters
+            .pop()
+            .expect("lower_list_end without begin");
+        if let ListCursor::Js(_) = cursor {
+            self.pop_value();
+        }
+    }
+
+    // --- List lifting cursor, matching wit-dylib-ffi's push_list/list_append ---
+
+    /// Begin tracking the next index of a list of `capacity` elements that is
+    /// being lifted. An empty list isn't tracked, because no elements are added
+    /// to it.
+    pub fn lift_list_begin(&mut self, capacity: usize) {
+        if capacity > 0 {
+            self.inner_mut().lift_iters.push((0, capacity));
+        }
+    }
+
+    /// Return the index for the next element of the list being lifted. Tracking
+    /// of the list ends after its last element.
+    ///
+    /// # Panics
+    ///
+    /// Panics if no cursor is open, which indicates a bug in the calling
+    /// convention rather than untrusted input.
+    pub fn lift_list_next(&mut self) -> usize {
+        let lift_iters = &mut self.inner_mut().lift_iters;
+        let (index, capacity) = lift_iters
+            .last_mut()
+            .expect("list_append without push_list");
+        let at = *index;
+        *index += 1;
+        if *index == *capacity {
+            lift_iters.pop();
+        }
+        at
+    }
+
+    /// The array on top of the stack, which is the list currently being lowered.
+    fn list_being_lowered<'s>(
+        &self,
+        scope: &'s Scope<'_>,
+    ) -> Result<js::Array<'s>, js::error::ExnThrown> {
+        js::Array::from_jsval(scope, scope.root_value(self.last()), ())
+            .map_err(|_| js::error::throw_type_error(scope, c"expected a list (array)"))
+    }
+}
+
+impl Default for CallStack {
+    fn default() -> Self {
+        CallStack::new()
+    }
+}
+
+impl CallStackInner {
+    /// Shrink each vector's capacity to at most [`MAX_KEPT_CAPACITY`], so that a
+    /// reused interior doesn't keep the capacity of the largest call that used
+    /// it.
+    fn shrink(&mut self) {
+        self.values.shrink_to(MAX_KEPT_CAPACITY);
+        self.shaped.shrink_to(MAX_KEPT_CAPACITY);
+        self.iters.shrink_to(MAX_KEPT_CAPACITY);
+        self.lift_iters.shrink_to(MAX_KEPT_CAPACITY);
+        self.strings.shrink_to(MAX_KEPT_CAPACITY);
+        self.borrows.shrink_to(MAX_KEPT_CAPACITY);
+        self.deferred.shrink_to(MAX_KEPT_CAPACITY);
+    }
+
+    /// Drop every value and borrow, and free the deferred allocations, leaving the
+    /// vectors empty with their capacity.
+    fn clear(&mut self) {
+        self.values.clear();
+        self.shaped.clear();
+        self.iters.clear();
+        self.lift_iters.clear();
+        self.strings.clear();
+        self.borrows.clear();
+        self.lowering_source = None;
+        self.adoptable = false;
+        for (ptr, layout) in self.deferred.drain(..) {
+            // SAFETY: each entry was registered via `defer_deallocate`, which
+            // transfers ownership of a global-allocator allocation matching
+            // `layout`. Nothing else frees it.
+            unsafe {
+                std::alloc::dealloc(ptr, layout);
+            }
+        }
+    }
+}
+
+impl Drop for CallStack {
+    fn drop(&mut self) {
+        self.inner_mut().clear();
+        let inner = self.0;
+        // On native targets, a stack can drop after the instance-locals are
+        // destroyed at thread exit, so this uses `try_with`.
+        let kept = FREE_STACKS
+            .try_with(|free| {
+                let mut free = free.borrow_mut();
+                let keep = free.0.len() < MAX_FREE_STACKS;
+                if keep {
+                    // SAFETY: `inner` came from `CallStack::new`, and `self` no longer uses it.
+                    unsafe { (*inner.as_ptr()).shrink() };
+                    free.0.push(inner);
+                }
+                keep
+            })
+            .unwrap_or(false);
+        if !kept {
+            // SAFETY: `inner` came from `CallStack::new`, and `self` is not used afterwards.
+            unsafe { free_interior(inner) };
+        }
+    }
+}
+
+impl Drop for CallStackInner {
+    fn drop(&mut self) {
+        // `self` is the interior at exactly the address registered in
+        // `CallStack::new`, and this runs before the allocation is freed.
+        let ptr: *mut CallStackInner = self;
+        let _ = LIVE_STACKS.try_with(|stacks| stacks.borrow_mut().remove(&ptr));
+        self.clear();
+    }
+}
+
+/// Trace every value on every live call stack. Registered with
+/// [`js::gc::add_root_tracer`] by [`crate::tracing::install_tracer`].
+///
+/// # Safety
+///
+/// `trc` must be a valid `JSTracer` provided by SpiderMonkey's GC, and this must
+/// run with JS execution paused.
+pub(crate) unsafe fn trace_stack_values(trc: *mut JSTracer) {
+    // On native targets, a collection can run after the instance-locals are
+    // destroyed at thread exit, so this uses `try_with`.
+    let _ = LIVE_STACKS.try_with(|stacks| {
+        // SAFETY: GC runs with JS execution paused, so no code mutates the registry or the
+        // stacks while they are traced, and every registered interior is alive.
+        unsafe {
+            for &inner in &*stacks.as_ptr() {
+                for value in &mut (*inner).values {
+                    trace_value_root(trc, value);
+                }
+                if let Some((value, _)) = &mut (*inner).lowering_source {
+                    trace_value_root(trc, value);
+                }
+            }
+        }
+    });
+}
diff --git a/crates/wit-bridge/src/streams.rs b/crates/wit-bridge/src/streams.rs
new file mode 100644
index 00000000..20258cc7
--- /dev/null
+++ b/crates/wit-bridge/src/streams.rs
@@ -0,0 +1,585 @@
+// SPDX-License-Identifier: Apache-2.0-WITH-LLVM-exception
+
+//! The vtables and element conversions used to read and write `stream` and
+//! `future` values.
+//!
+//! [`crate::readable`] represents a `stream` as a `ReadableStream`, and
+//! [`crate::promises`] represents a `future` as a `Promise`. Both read and
+//! write with wit-bindgen's `StreamReader`, `StreamWriter`, `FutureReader` and
+//! `FutureWriter`, using the vtables defined here.
+//!
+//! # Vtables
+//!
+//! wit-bindgen's readers and writers are generic over the element type, and use
+//! a `&'static StreamVtable<T>` or `FutureVtable<T>`. The vtable of each stream
+//! and future type is built from the type's wit-dylib metadata on first use,
+//! leaked, and cached by type index.
+//!
+//! A `stream<u8>` uses `Vec<u8>` buffers, whose layout is the canonical ABI's,
+//! so its vtable has no `lift` and `lower`. Every other type uses `Elem` as
+//! its element type, and converts elements with `elem_lift` and `elem_lower`,
+//! which call the metadata's `lift` and `lower` functions. The elements of a
+//! `stream` or `future` without a payload type are lifted as `undefined`, and
+//! lowered to nothing.
+
+#![cfg(target_arch = "wasm32")]
+
+use std::alloc::Layout;
+use std::cell::RefCell;
+use std::collections::HashMap;
+use std::ffi::c_void;
+
+use js::gc::handle::RootedHeap;
+use js::gc::scope::Scope;
+use js::native::Value;
+use js::prelude::HandleValue;
+use js::Object;
+
+use wit_bindgen::rt::async_support::{FutureVtable, StreamVtable};
+use wit_dylib_ffi::{Future as WitFuture, Stream as WitStream, Type};
+
+use crate::init;
+use crate::interpreter::CallCx;
+use crate::resources::{imported_wrapper, ImportedResource};
+use crate::stack::CallStack;
+use crate::value::TypeShapeValue;
+
+/// The element type of the vtables of all types except `stream<u8>`. Its JS
+/// values are rooted, because wit-bindgen's buffers aren't traced.
+pub(crate) enum Elem {
+    /// A lifted element, or an element of a `stream` or `future` without a
+    /// payload type.
+    Js(RootedHeap<Value>),
+    /// An element to be written, converted by
+    /// [`crate::validate::snapshot_payload`].
+    Shaped(TypeShapeValue),
+}
+
+impl Elem {
+    /// Create an element holding `value`, which is rooted immediately.
+    #[js::allow_unrooted]
+    pub(crate) fn new(value: Value) -> Elem {
+        Elem::Js(RootedHeap::from(value))
+    }
+
+    /// Create an element to be written from `payload`, as returned by
+    /// [`crate::validate::snapshot_payload`]. `None` becomes `undefined`.
+    pub(crate) fn payload(payload: Option<TypeShapeValue>) -> Elem {
+        match payload {
+            Some(payload) => Elem::Shaped(payload),
+            None => Elem::new(js::value::undefined()),
+        }
+    }
+
+    /// Return the element's value.
+    ///
+    /// # Safety
+    ///
+    /// The returned [`Value`] is not separately rooted, so the caller must
+    /// consume or root it before the next allocation can trigger a GC.
+    ///
+    /// # Panics
+    ///
+    /// Panics for an [`Elem::Shaped`].
+    pub(crate) unsafe fn get(&self) -> Value {
+        match self {
+            // SAFETY: read for immediate consumption. The value stays rooted, so
+            // no GC can invalidate it before use.
+            Elem::Js(value) => unsafe { value.as_raw() },
+            Elem::Shaped(_) => panic!("Elem::get called for a snapshot"),
+        }
+    }
+
+    /// Return the snapshot of an [`Elem::Shaped`], and `None` for an
+    /// [`Elem::Js`].
+    pub(crate) fn shaped(&self) -> Option<&TypeShapeValue> {
+        match self {
+            Elem::Js(_) => None,
+            Elem::Shaped(shaped) => Some(shaped),
+        }
+    }
+}
+
+/// Drop the wrappers in [`LOWERED_ELEM_ORIGINALS`]. See
+/// [`crate::tracing::clear_traced_roots`].
+pub(crate) fn clear_traced_roots() {
+    LOWERED_ELEM_ORIGINALS.with(|cell| cell.borrow_mut().clear());
+}
+
+js::instance_local! {
+    /// The wrapper of each lowered element that is an imported-resource wrapper,
+    /// keyed by the address of the lowered value. If the element isn't sent and
+    /// is lifted again, its handle is moved back to this wrapper. An entry is
+    /// removed by [`elem_dealloc`] once the element is sent, or by [`elem_lift`]
+    /// when the element is lifted again.
+    static LOWERED_ELEM_ORIGINALS: RefCell<HashMap<*mut u8, RootedHeap<js::object::Object>>> =
+        RefCell::new(HashMap::new());
+}
+
+/// Return `value` if it is an imported-resource wrapper that holds a handle.
+/// Objects implementing exported resources aren't wrappers, and lifting such an
+/// object's handle again returns the same object (see `resources::push_own`).
+fn live_wrapper<'s>(scope: &'s Scope<'_>, value: HandleValue<'_>) -> Option<Object<'s>> {
+    let wrapper = imported_wrapper(scope, value)?;
+    let live = wrapper.data().handle.is_some();
+    live.then_some(*wrapper)
+}
+
+/// Move the handle from `fresh`, a wrapper created by lifting an element again,
+/// to `original`, the wrapper that was lowered. `fresh` is left without a
+/// handle.
+fn hand_handle_back(original: &Object<'_>, fresh: &Object<'_>) {
+    if let (Ok(original), Ok(fresh)) = (
+        original.cast::<ImportedResource>(),
+        fresh.cast::<ImportedResource>(),
+    ) {
+        crate::resources::move_handle(fresh, original);
+    }
+}
+
+js::instance_local! {
+    /// The types of the elements being converted, read by [`elem_lift`] and
+    /// [`elem_lower`], which are plain functions and can't capture them. The
+    /// last entry is the active type. Each nested conversion pushes an entry.
+    static ELEM_TYPE: RefCell<Vec<ElemType>> = const { RefCell::new(Vec::new()) };
+}
+
+/// The wit-dylib metadata of a stream or future type.
+#[derive(Clone, Copy)]
+pub(crate) enum ElemType {
+    Stream(WitStream),
+    Future(WitFuture),
+}
+
+impl ElemType {
+    /// Whether an element of this type contains an owned resource handle.
+    fn owns_resources(&self) -> bool {
+        match self {
+            ElemType::Stream(s) => {
+                crate::interpreter::stream_element(s.index() as u32).owns_resources
+            }
+            ElemType::Future(f) => {
+                crate::interpreter::future_payload(f.index() as u32).owns_resources
+            }
+        }
+    }
+
+    /// Whether this is a `stream<T>` or `future<T>` with a `T`.
+    fn has_payload(&self) -> bool {
+        match self {
+            ElemType::Stream(s) => s.ty().is_some(),
+            ElemType::Future(f) => f.ty().is_some(),
+        }
+    }
+
+    /// Lift one element from the canonical ABI buffer at `ptr` onto `cx`'s stack.
+    /// An element without a payload lifts to `undefined`.
+    ///
+    /// # Safety
+    ///
+    /// `ptr` must point at one initialized canonical-ABI payload of this type.
+    unsafe fn lift(&self, cx: &mut CallCx<'_>, ptr: *mut u8) {
+        match self {
+            _ if !self.has_payload() => cx.stack().push_value(js::value::undefined()),
+            ElemType::Stream(s) => unsafe { s.lift(cx, ptr) },
+            ElemType::Future(f) => unsafe { f.lift(cx, ptr) },
+        }
+    }
+
+    /// Lower one element off `cx`'s stack into the canonical ABI buffer at `ptr`.
+    /// An element without a payload is popped and discarded.
+    ///
+    /// # Safety
+    ///
+    /// `ptr` must point at writable space for one canonical-ABI payload.
+    unsafe fn lower(&self, cx: &mut CallCx<'_>, ptr: *mut u8) {
+        match self {
+            _ if !self.has_payload() => {
+                cx.stack().pop_value();
+            }
+            ElemType::Stream(s) => unsafe { s.lower(cx, ptr) },
+            ElemType::Future(f) => unsafe { f.lower(cx, ptr) },
+        }
+    }
+}
+
+/// Run `f` with `ty` as the active element type. The previous type is restored
+/// afterwards.
+fn with_elem_type<R>(ty: ElemType, f: impl FnOnce() -> R) -> R {
+    ELEM_TYPE.with(|cell| cell.borrow_mut().push(ty));
+    let r = f();
+    ELEM_TYPE.with(|cell| {
+        cell.borrow_mut().pop().expect("element type was pushed");
+    });
+    r
+}
+
+/// A future that sets the active element type during each poll of the wrapped
+/// future, and while the wrapped future is dropped.
+///
+/// wit-bindgen calls the vtable's `lift` and `lower` during the poll that
+/// completes a transfer, so the type must be set during each poll. Setting it
+/// per poll also lets transfers of different element types interleave.
+/// Dropping an unfinished read or write cancels it, which lifts the elements
+/// that weren't sent.
+pub(crate) struct WithElemType<F> {
+    ty: ElemType,
+    future: std::mem::ManuallyDrop<F>,
+}
+
+impl<F: std::future::Future> std::future::Future for WithElemType<F> {
+    type Output = F::Output;
+
+    fn poll(
+        self: std::pin::Pin<&mut Self>,
+        cx: &mut std::task::Context<'_>,
+    ) -> std::task::Poll<F::Output> {
+        // SAFETY: structural pin projection. `ty` is `Copy` and never moved, and
+        // `future` is pinned along with `self`, which is the only way it is ever
+        // accessed.
+        let this = unsafe { self.get_unchecked_mut() };
+        let ty = this.ty;
+        let future = unsafe { std::pin::Pin::new_unchecked(&mut *this.future) };
+        with_elem_type(ty, || future.poll(cx))
+    }
+}
+
+impl<F> Drop for WithElemType<F> {
+    fn drop(&mut self) {
+        let ty = self.ty;
+        // SAFETY: `future` is dropped in place exactly once, here, and never used
+        // again. Dropping in place keeps the pinning guarantee.
+        with_elem_type(ty, || unsafe {
+            std::mem::ManuallyDrop::drop(&mut self.future)
+        });
+    }
+}
+
+/// Wrap `future` so the active element type is installed for each of its polls
+/// and while it is dropped.
+pub(crate) fn with_elem_type_future<F: std::future::Future>(
+    ty: ElemType,
+    future: F,
+) -> WithElemType<F> {
+    WithElemType {
+        ty,
+        future: std::mem::ManuallyDrop::new(future),
+    }
+}
+
+/// Return the active element type, or `None` outside of [`with_elem_type`].
+/// Every read and write runs in a [`WithElemType`], including the drop that
+/// cancels it. A conversion outside of it only happens when wit-bindgen writes
+/// the default value of a `FutureWriter` that is dropped unwritten, which
+/// `promises::FutureWrite` never does.
+fn active_elem_type() -> Option<ElemType> {
+    ELEM_TYPE.with(|cell| cell.borrow().last().copied())
+}
+
+js::instance_local! {
+    /// The stack used to lower each element, keyed by the address of the
+    /// lowered value. A lowered string points into the strings stored on the
+    /// stack, so the stack must outlive the lowered value.
+    ///
+    /// Each entry is removed by exactly one of [`elem_dealloc`], for an element
+    /// that was sent, and [`elem_lift`], for an element that wasn't sent and is
+    /// lifted again.
+    static LOWERED_ELEM_STACKS: RefCell<HashMap<*mut u8, CallStack>> =
+        RefCell::new(HashMap::new());
+}
+
+/// The vtable's `lower` function: lower `value` into the buffer at `dst` with
+/// the metadata's `lower` function. The stack used for lowering is stored in
+/// [`LOWERED_ELEM_STACKS`] if it holds data that the lowered value can point
+/// to.
+///
+/// # Safety
+///
+/// `dst` must point at writable space for one canonical-ABI payload of the
+/// active element type, and a [`with_elem_type`] span must be active.
+unsafe fn elem_lower(value: Elem, dst: *mut u8) {
+    let Some(ty) = active_elem_type() else {
+        // No active type (see `active_elem_type`). The value is dropped and `dst`
+        // left as wit-bindgen allocated it.
+        drop(value);
+        return;
+    };
+    // If the element isn't sent, lifting it again takes over the strings and
+    // lists of this stack.
+    let mut stack = CallStack::new();
+    stack.set_adoptable();
+    match value {
+        // SAFETY: `value.as_raw()` is read for immediate consumption by
+        // `push_value`, which roots it on the stack. `value` is dropped at the
+        // end of this arm, before the lower below can allocate.
+        Elem::Js(value) => stack.push_value(unsafe { value.as_raw() }),
+        Elem::Shaped(shaped) => stack.push_shaped(shaped),
+    }
+    // Lowering an `own` handle of an imported resource removes the handle from
+    // its wrapper. The wrapper is kept, so that the handle can be moved back if
+    // the element isn't sent and is lifted again. Only an element that is itself
+    // a wrapper is kept. A wrapper nested in a record, tuple, option or list is
+    // replaced by a new wrapper when the element is lifted again.
+    if ty.owns_resources() && stack.last_shaped().is_none() {
+        init::with_scope(|scope| {
+            if let Some(original) = live_wrapper(scope, scope.root_value(stack.last())) {
+                LOWERED_ELEM_ORIGINALS
+                    .with(|cell| cell.borrow_mut().insert(dst, RootedHeap::new(original)));
+            }
+        });
+    }
+    {
+        let mut cx = CallCx::Borrowed(&mut stack);
+        // SAFETY: `dst` is a valid canonical-ABI payload slot per the
+        // precondition, and the active element type matches the buffer `dst` points
+        // into.
+        unsafe { ty.lower(&mut cx, dst) };
+    }
+    // A stack holding strings or allocations that the lowered value can point
+    // to is kept until `dealloc_lists` is called for `dst`.
+    if stack.holds_lowered_data() {
+        LOWERED_ELEM_STACKS.with(|cell| cell.borrow_mut().insert(dst, stack));
+    }
+}
+
+/// The vtable's `dealloc_lists` function, called for each element that was
+/// sent. Drops the stack and the wrapper stored by [`elem_lower`] for `dst`.
+///
+/// # Safety
+///
+/// `dst` may be any address. An address without stored entries is ignored.
+unsafe fn elem_dealloc(dst: *mut u8) {
+    drop(LOWERED_ELEM_STACKS.with(|cell| cell.borrow_mut().remove(&dst)));
+    drop(LOWERED_ELEM_ORIGINALS.with(|cell| cell.borrow_mut().remove(&dst)));
+}
+
+/// The vtable's `lift` function: lift the element in the buffer at `src` with
+/// the metadata's `lift` function.
+///
+/// # Safety
+///
+/// `src` must point at one initialized canonical-ABI payload of the active
+/// element type, and a [`with_elem_type`] span must be active.
+unsafe fn elem_lift(src: *mut u8) -> Elem {
+    let Some(ty) = active_elem_type() else {
+        // No active type (see `active_elem_type`).
+        return Elem::new(js::value::undefined());
+    };
+    let mut stack = CallStack::new();
+    {
+        let mut cx = CallCx::Borrowed(&mut stack);
+        // SAFETY: `src` is a valid initialized payload per the precondition, and
+        // the active element type matches the buffer `src` points into. The
+        // metadata `lift` pushes one JS value onto the stack.
+        unsafe { ty.lift(&mut cx, src) };
+    }
+    // `Elem::new` roots the popped value before anything can allocate.
+    let mut elem = Elem::new(stack.pop_value());
+    // If `elem_lower` stored a stack for `src`, the element wasn't sent and is
+    // being lifted again, so `dealloc_lists` won't be called for it. The lift
+    // took ownership of the strings and lists, so the stack releases them
+    // without freeing them.
+    if let Some(mut stack) = LOWERED_ELEM_STACKS.with(|cell| cell.borrow_mut().remove(&src)) {
+        stack.release_adopted();
+    }
+    // Lifting an unsent imported resource creates a new wrapper. The handle is
+    // moved back to the wrapper that was lowered, and the element is replaced
+    // by that wrapper.
+    let original = LOWERED_ELEM_ORIGINALS.with(|cell| cell.borrow_mut().remove(&src));
+    if let Some(original) = original {
+        init::with_scope(|scope| {
+            let original = original.get(scope);
+            // SAFETY: read for immediate consumption while `elem` stays rooted.
+            if let Ok(fresh) = Object::from_raw_value(scope, unsafe { elem.get() }) {
+                hand_handle_back(&original, &fresh);
+            }
+            elem = Elem::new(original.as_value());
+        });
+    }
+    elem
+}
+
+/// Whether a [`PendingSend`](core_runtime::event_loop::PendingSend) for a
+/// stream pump or a future write is done, and the waker of the task waiting
+/// for it.
+#[derive(Clone, Default)]
+pub(crate) struct SendDone(std::rc::Rc<RefCell<(bool, Option<std::task::Waker>)>>);
+
+impl SendDone {
+    /// Mark the send as done, and wake the task waiting for it.
+    pub(crate) fn set(&self) {
+        let waker = {
+            let mut state = self.0.borrow_mut();
+            state.0 = true;
+            state.1.take()
+        };
+        if let Some(waker) = waker {
+            waker.wake();
+        }
+    }
+
+    /// Register a pending send on the active event loop that completes once
+    /// this is set, and calls `abandon` once the loop has no other work left.
+    /// Returns `false` without registering a send if no event loop is active.
+    pub(crate) fn register(&self, abandon: impl FnOnce() + 'static) -> bool {
+        let state = std::rc::Rc::clone(&self.0);
+        let done = std::future::poll_fn(move |cx| {
+            let mut state = state.borrow_mut();
+            if state.0 {
+                std::task::Poll::Ready(())
+            } else {
+                state.1 = Some(cx.waker().clone());
+                std::task::Poll::Pending
+            }
+        });
+        let send = core_runtime::event_loop::PendingSend {
+            done: Box::pin(done),
+            abandon: Box::new(abandon),
+        };
+        core_runtime::event_loop::with_active_event_loop(|el| el.register_pending_send(send))
+            .is_some()
+    }
+}
+
+js::instance_local! {
+    /// The vtable of each `stream<u8>` type, by type index. Each vtable is built
+    /// and leaked on first use, so at most one vtable per type is leaked.
+    static U8_STREAM_VTABLES: RefCell<HashMap<u32, &'static StreamVtable<u8>>> =
+        RefCell::new(HashMap::new());
+
+    /// The vtable of each other stream type, by type index.
+    static GENERIC_STREAM_VTABLES: RefCell<HashMap<u32, &'static StreamVtable<Elem>>> =
+        RefCell::new(HashMap::new());
+
+    /// The vtable of each future type, by type index.
+    static FUTURE_VTABLES: RefCell<HashMap<u32, &'static FutureVtable<Elem>>> =
+        RefCell::new(HashMap::new());
+}
+
+/// Spawn `future`, which transfers the values of a stream or future, to settle
+/// `promise`. If an event loop is active, `future` is polled once immediately
+/// (see [`js::Promise::spawn_polled`]), so the transfer lowers its values right
+/// away. Otherwise, the first poll happens on the next event loop.
+pub(crate) fn spawn_transfer(promise: &js::Promise<'_>, future: js::promise::PromiseFuture) {
+    if core_runtime::event_loop::has_active_event_loop() {
+        promise.spawn_polled(future);
+    } else {
+        promise.spawn(future);
+    }
+}
+
+/// Whether `ty` is `u8`, directly or through aliases.
+pub(crate) fn elem_is_u8(mut ty: Option<Type>) -> bool {
+    while let Some(Type::Alias(alias)) = ty {
+        ty = Some(alias.ty());
+    }
+    matches!(ty, Some(Type::U8))
+}
+
+/// Return the vtable of the `stream<u8>` type `ty`, whose index is `index`.
+/// `lift` and `lower` are `None`, because the canonical ABI layout of a `u8`
+/// buffer is that of a `Vec<u8>`.
+pub(crate) fn u8_stream_vtable(ty: WitStream, index: u32) -> &'static StreamVtable<u8> {
+    U8_STREAM_VTABLES.with(|cell| {
+        *cell.borrow_mut().entry(index).or_insert_with(|| {
+            Box::leak(Box::new(StreamVtable::<u8> {
+                layout: Layout::from_size_align(ty.abi_payload_size(), ty.abi_payload_align())
+                    .expect("valid stream<u8> payload layout"),
+                lower: None,
+                dealloc_lists: None,
+                lift: None,
+                // SAFETY: the two signatures differ only in the pointee type of
+                // the buffer pointer, `c_void` in the wit-dylib metadata and `u8`
+                // in wit-bindgen's vtable, which has the same ABI. A plain `as`
+                // cast cannot change a fn-pointer signature.
+                start_write: unsafe {
+                    std::mem::transmute::<
+                        unsafe extern "C" fn(u32, *const c_void, usize) -> u32,
+                        unsafe extern "C" fn(u32, *const u8, usize) -> u32,
+                    >(ty.write())
+                },
+                // SAFETY: as for `start_write`.
+                start_read: unsafe {
+                    std::mem::transmute::<
+                        unsafe extern "C" fn(u32, *mut c_void, usize) -> u32,
+                        unsafe extern "C" fn(u32, *mut u8, usize) -> u32,
+                    >(ty.read())
+                },
+                cancel_write: ty.cancel_write(),
+                cancel_read: ty.cancel_read(),
+                drop_writable: ty.drop_writable(),
+                drop_readable: ty.drop_readable(),
+                new: ty.new(),
+            }))
+        })
+    })
+}
+
+/// Return the vtable of the stream type `ty`, whose index is `index` and whose
+/// elements aren't `u8`.
+pub(crate) fn generic_stream_vtable(ty: WitStream, index: u32) -> &'static StreamVtable<Elem> {
+    GENERIC_STREAM_VTABLES.with(|cell| {
+        *cell.borrow_mut().entry(index).or_insert_with(|| {
+            Box::leak(Box::new(StreamVtable::<Elem> {
+                layout: Layout::from_size_align(ty.abi_payload_size(), ty.abi_payload_align())
+                    .expect("valid stream payload layout"),
+                lower: Some(elem_lower),
+                dealloc_lists: Some(elem_dealloc),
+                lift: Some(elem_lift),
+                // SAFETY: as for the `stream<u8>` vtable's `start_write`.
+                start_write: unsafe {
+                    std::mem::transmute::<
+                        unsafe extern "C" fn(u32, *const c_void, usize) -> u32,
+                        unsafe extern "C" fn(u32, *const u8, usize) -> u32,
+                    >(ty.write())
+                },
+                // SAFETY: as for `start_write`.
+                start_read: unsafe {
+                    std::mem::transmute::<
+                        unsafe extern "C" fn(u32, *mut c_void, usize) -> u32,
+                        unsafe extern "C" fn(u32, *mut u8, usize) -> u32,
+                    >(ty.read())
+                },
+                cancel_write: ty.cancel_write(),
+                cancel_read: ty.cancel_read(),
+                drop_writable: ty.drop_writable(),
+                drop_readable: ty.drop_readable(),
+                new: ty.new(),
+            }))
+        })
+    })
+}
+
+/// Return the vtable of the future type `ty`, whose index is `index`.
+pub(crate) fn future_vtable(ty: WitFuture, index: u32) -> &'static FutureVtable<Elem> {
+    FUTURE_VTABLES.with(|cell| {
+        *cell.borrow_mut().entry(index).or_insert_with(|| {
+            Box::leak(Box::new(FutureVtable::<Elem> {
+                layout: Layout::from_size_align(ty.abi_payload_size(), ty.abi_payload_align())
+                    .expect("valid future payload layout"),
+                lower: elem_lower,
+                dealloc_lists: elem_dealloc,
+                lift: elem_lift,
+                // SAFETY: as for the `stream<u8>` vtable's `start_write`.
+                start_write: unsafe {
+                    std::mem::transmute::<
+                        unsafe extern "C" fn(u32, *const c_void) -> u32,
+                        unsafe extern "C" fn(u32, *const u8) -> u32,
+                    >(ty.write())
+                },
+                // SAFETY: as for `start_write`.
+                start_read: unsafe {
+                    std::mem::transmute::<
+                        unsafe extern "C" fn(u32, *mut c_void) -> u32,
+                        unsafe extern "C" fn(u32, *mut u8) -> u32,
+                    >(ty.read())
+                },
+                cancel_write: ty.cancel_write(),
+                cancel_read: ty.cancel_read(),
+                drop_writable: ty.drop_writable(),
+                drop_readable: ty.drop_readable(),
+                new: ty.new(),
+            }))
+        })
+    })
+}
diff --git a/crates/wit-bridge/src/tracing.rs b/crates/wit-bridge/src/tracing.rs
new file mode 100644
index 00000000..f090d707
--- /dev/null
+++ b/crates/wit-bridge/src/tracing.rs
@@ -0,0 +1,26 @@
+// SPDX-License-Identifier: Apache-2.0-WITH-LLVM-exception
+
+//! GC rooting for the JS values held by this crate.
+//!
+//! The values on call stacks are traced by `stack::trace_stack_values`, which
+//! is registered by [`install_tracer`]. The crate holds every other value in a
+//! [`RootedHeap`](js::gc::handle::RootedHeap) in instance-local state.
+//!
+//! [`install_tracer`] must run before a call stack can hold a value across a
+//! collection.
+
+/// Register the call-stack value tracer with the current runtime's root
+/// tracers.
+pub fn install_tracer() {
+    js::gc::add_root_tracer(crate::stack::trace_stack_values);
+}
+
+/// Drop every JS value held by this crate in instance-local state. Must be
+/// called before the runtime is dropped.
+pub fn clear_traced_roots() {
+    crate::resources::clear_traced_roots();
+    crate::exports::clear_traced_roots();
+    crate::component_error::clear_traced_roots();
+    #[cfg(target_arch = "wasm32")]
+    crate::streams::clear_traced_roots();
+}
diff --git a/crates/wit-bridge/src/validate.rs b/crates/wit-bridge/src/validate.rs
new file mode 100644
index 00000000..7497563a
--- /dev/null
+++ b/crates/wit-bridge/src/validate.rs
@@ -0,0 +1,902 @@
+// SPDX-License-Identifier: Apache-2.0-WITH-LLVM-exception
+
+//! Checking whether a JavaScript value can be lowered to a WIT type.
+//!
+//! [`check`] checks a value against a [`TypeShape`] and reports the first part
+//! of it that can't be lowered, with the part's path and the reason. Booleans,
+//! numbers, chars, strings, enums and flags are converted with the `pop_*`
+//! functions used for lowering, on a separate [`CallStack`]. Other values are
+//! checked with the same rules that lowering applies. [`snapshot`] also returns
+//! the value converted to a [`TypeShapeValue`].
+//!
+//! Resource handles, streams and futures are checked without lowering them,
+//! because lowering moves them out of JavaScript:
+//!
+//! - A resource must be an object. A wrapper of an imported resource must be of
+//!   the expected type and still hold its handle. A wrapper received as a
+//!   `borrow` can't be lowered as an `own`. A wrapper lowered as an `own` must
+//!   not be lent to an import call that hasn't returned, and must not appear
+//!   anywhere else in the value or in the other arguments of the same call. A
+//!   value that isn't a wrapper is accepted as an `own` if an own adapter
+//!   accepts it, and must not appear anywhere else either.
+//! - A stream must be an unlocked `ReadableStream` that appears nowhere else,
+//!   or an iterable object. A snapshot holds an iterable object as the
+//!   `ReadableStream` created from it.
+//! - A future can be any value.
+//! - Streams and futures require an active event loop.
+//!
+//! Import calls and writes to streams and futures lower snapshots. An import
+//! call throws a `TypeError` for an argument that can't be lowered. Export calls
+//! use [`check`] after lowering a result failed, to report which part failed.
+
+use std::ffi::CStr;
+use std::fmt::{self, Write as _};
+use std::ops::Range;
+
+use js::conversion::FromJSVal;
+use js::error::ExnThrown;
+use js::gc::scope::Scope;
+use js::prelude::HandleValue;
+use js::{Map, Object};
+
+use crate::resources::ImportedResource;
+use crate::stack::CallStack;
+use crate::value::{self, NumericList, TypeShape, TypeShapeValue};
+
+/// The reason a value can't be lowered, and the path to the part that can't
+/// be.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct Mismatch {
+    /// The path from the checked value's root, such as `.items[2].name`. Empty
+    /// for the root itself.
+    pub path: String,
+    /// What the part should have been and what it is, such as
+    /// `expected a u8, got 310`.
+    pub reason: String,
+}
+
+impl Mismatch {
+    /// Formats `what` followed by the path, if there is one, and the reason, such
+    /// as ``argument 1 `.name`: expected a string, got 7``.
+    pub fn describe(&self, what: &str) -> String {
+        if self.path.is_empty() {
+            format!("{what}: {}", self.reason)
+        } else {
+            format!("{what} `{}`: {}", self.path, self.reason)
+        }
+    }
+}
+
+/// Check that `value` can be lowered to `shape`, and return the first part of
+/// it that can't be.
+///
+/// Reading record fields and the tag and value of a variant runs their getters.
+/// An exception thrown by a getter becomes the mismatch's reason and is cleared.
+pub fn check(scope: &Scope<'_>, value: HandleValue<'_>, shape: &TypeShape) -> Result<(), Mismatch> {
+    let mut walker = Walker::new(scope);
+    walk(scope, value, shape, &Path::Root, &mut walker)?;
+    walker.check_wrappers().map_err(|(_, mismatch)| mismatch)
+}
+
+/// Like [`check`], but also return `value` converted for lowering.
+///
+/// Scalars, strings, enums and flags are converted to Rust values, and a numeric
+/// list's typed array to a copy of its elements. Records, tuples, variants,
+/// options, results and other lists hold their converted parts. Resources,
+/// `ReadableStream`s, futures and values of unsupported types are held as
+/// [`TypeShapeValue::Js`]. An iterable object passed as a stream is held as the
+/// `ReadableStream` it is converted to.
+///
+/// Each part of `value` is read once, so its getters and proxy traps run once,
+/// and later changes to `value` don't affect the result.
+pub fn snapshot(
+    scope: &Scope<'_>,
+    value: HandleValue<'_>,
+    shape: &TypeShape,
+) -> Result<TypeShapeValue, Mismatch> {
+    let mut walker = Walker::new(scope);
+    let converted = walk(scope, value, shape, &Path::Root, &mut walker)?;
+    walker.check_wrappers().map_err(|(_, mismatch)| mismatch)?;
+    Ok(converted)
+}
+
+/// Like [`snapshot`], for a value written to a `stream` or `future` whose
+/// payload type is `shape`. If `shape` is `None`, `value` must be `undefined`,
+/// and `None` is returned.
+pub fn snapshot_payload(
+    scope: &Scope<'_>,
+    value: HandleValue<'_>,
+    shape: Option<&TypeShape>,
+) -> Result<Option<TypeShapeValue>, Mismatch> {
+    match shape {
+        Some(shape) => snapshot(scope, value, shape).map(Some),
+        None if value.is_undefined() => Ok(None),
+        None => Err(mismatch(
+            &Path::Root,
+            format!("expected undefined, got {}", describe(scope, value)),
+        )),
+    }
+}
+
+/// Check that `values`, values of `shape` returned by [`snapshot`], can still be
+/// lowered together. Only their [`TypeShapeValue::Js`] parts are checked, with
+/// the same rules as in [`check`]. A resource wrapper lowered as an `own` must
+/// not appear in any other of the values. Returns the index of the first value
+/// that can't be lowered, and the reason.
+pub fn check_each<'v>(
+    scope: &Scope<'_>,
+    values: impl IntoIterator<Item = &'v TypeShapeValue>,
+    shape: &TypeShape,
+) -> Result<(), (usize, Mismatch)> {
+    let mut walker = Walker::new(scope);
+    for (index, value) in values.into_iter().enumerate() {
+        walker.argument = index;
+        check_parts(scope, value, shape, &Path::Root, &mut walker)
+            .map_err(|mismatch| (index, mismatch))?;
+    }
+    walker.check_wrappers()
+}
+
+/// Whether a value of `shape` can contain an `own` handle of an imported
+/// resource or a stream. Lowering the value moves them out of JavaScript.
+pub fn moves_handles(shape: &TypeShape) -> bool {
+    match shape {
+        TypeShape::OwnResource { imported, .. } => *imported,
+        TypeShape::Stream(_) => true,
+        TypeShape::Record(fields) => fields.iter().any(|(_, field)| moves_handles(field)),
+        TypeShape::Tuple(elements) => elements.iter().any(moves_handles),
+        TypeShape::Variant(cases) => cases
+            .iter()
+            .any(|(_, payload)| payload.as_ref().is_some_and(moves_handles)),
+        TypeShape::Option(inner) | TypeShape::List(inner) => moves_handles(inner),
+        TypeShape::Result(ok, err) => {
+            ok.as_deref().is_some_and(moves_handles) || err.as_deref().is_some_and(moves_handles)
+        }
+        _ => false,
+    }
+}
+
+/// Like [`snapshot`], for the arguments `args` of an import call, with
+/// `shapes` holding the parameter types. A resource wrapper lowered as an
+/// `own` must not appear in any other argument. On failure, returns the index
+/// of the argument that can't be lowered, and the reason.
+pub fn snapshot_arguments(
+    scope: &Scope<'_>,
+    args: &[HandleValue<'_>],
+    shapes: &[TypeShape],
+) -> Result<Vec<TypeShapeValue>, (usize, Mismatch)> {
+    let mut walker = Walker::new(scope);
+    let mut converted = Vec::with_capacity(args.len());
+    for (index, (arg, shape)) in args.iter().zip(shapes).enumerate() {
+        walker.argument = index;
+        converted.push(
+            walk(scope, *arg, shape, &Path::Root, &mut walker)
+                .map_err(|mismatch| (index, mismatch))?,
+        );
+    }
+    walker.check_wrappers()?;
+    Ok(converted)
+}
+
+/// The state of a walk over the values of one lowering.
+struct Walker<'s, 'cx> {
+    /// The scope in which the wrappers visited by the walk are rooted.
+    scope: &'s Scope<'cx>,
+    /// The index of the argument being walked.
+    argument: usize,
+    /// Maps each imported resource wrapper visited to its index in `wrappers`, and each other
+    /// object recorded by [`Walker::record_moved`] to `undefined`. Created on
+    /// first use.
+    seen: Option<Map<'s>>,
+    wrappers: Vec<Wrapper<'s>>,
+    /// The paths of the wrappers in `wrappers`, one after the other.
+    paths: String,
+    /// The stack on which the walk checks scalars.
+    stack: CallStack,
+}
+
+/// An imported resource wrapper visited by a walk, the argument and path of its
+/// first use, and whether that use was an `own`.
+struct Wrapper<'s> {
+    object: ImportedResource<'s>,
+    argument: usize,
+    /// The range of [`Walker::paths`] that holds the path.
+    path: Range<usize>,
+    own: bool,
+}
+
+impl<'s, 'cx> Walker<'s, 'cx> {
+    fn new(scope: &'s Scope<'cx>) -> Self {
+        Walker {
+            scope,
+            argument: 0,
+            seen: None,
+            wrappers: Vec::new(),
+            paths: String::new(),
+            stack: CallStack::new(),
+        }
+    }
+
+    /// Convert `value` with the `pop_*` function `pop`, which roots values on
+    /// `scope`.
+    fn scalar<T>(
+        &mut self,
+        scope: &Scope<'_>,
+        value: HandleValue<'_>,
+        path: &Path<'_>,
+        pop: impl FnOnce(&mut CallStack, &Scope<'_>) -> Result<T, ExnThrown>,
+    ) -> Result<T, Mismatch> {
+        self.stack.push_value(value.get());
+        match pop(&mut self.stack, scope) {
+            Ok(converted) => Ok(converted),
+            Err(ExnThrown) => {
+                let reason = ExnThrown::capture(scope)
+                    .message
+                    .unwrap_or_else(|| "the value does not lower".to_string());
+                Err(mismatch(
+                    path,
+                    format!("{reason}, got {}", describe(scope, value)),
+                ))
+            }
+        }
+    }
+
+    /// The map of the objects visited, created on first use.
+    fn seen(&mut self, path: &Path<'_>) -> Result<&Map<'s>, Mismatch> {
+        let scope = self.scope;
+        match self.seen {
+            Some(ref seen) => Ok(seen),
+            None => Ok(self
+                .seen
+                .insert(Map::new(scope).map_err(|_| thrown(scope, path))?)),
+        }
+    }
+
+    /// Record a use at `path` of `object`, a `ReadableStream` or a value
+    /// converted by an own adapter. Reports a mismatch if `object` was already
+    /// recorded. `what` names the kind of value in the mismatch.
+    fn record_moved(
+        &mut self,
+        object: &Object<'_>,
+        path: &Path<'_>,
+        what: &str,
+    ) -> Result<(), Mismatch> {
+        let scope = self.scope;
+        let key = scope.root_value(object.as_value());
+        let seen = self.seen(path)?;
+        if seen.has(scope, key).map_err(|_| thrown(scope, path))? {
+            return Err(mismatch(
+                path,
+                format!("the {what} is used elsewhere in the same call"),
+            ));
+        }
+        seen.insert(scope, key, HandleValue::undefined())
+            .map_err(|_| thrown(scope, path))
+    }
+
+    /// Record a use of the imported resource wrapper `object` at `path`, which
+    /// is an `own` if `own` is set. A mismatch is reported when a wrapper is used
+    /// more than once and one of its uses is an `own`.
+    fn record(
+        &mut self,
+        object: ImportedResource<'_>,
+        own: bool,
+        path: &Path<'_>,
+    ) -> Result<(), Mismatch> {
+        let scope = self.scope;
+        let key = scope.root_value(object.as_value());
+        let next = self.wrappers.len() as i32;
+        let seen = self.seen(path)?;
+        let index = seen.lookup(scope, key).map_err(|_| thrown(scope, path))?;
+        if index.is_int32() {
+            let wrapper = &self.wrappers[index.to_int32() as usize];
+            if own || wrapper.own {
+                return Err(mismatch(
+                    path,
+                    "the resource is used elsewhere in the same call, and an `own` use must be \
+                     its only use"
+                        .to_string(),
+                ));
+            }
+            return Ok(());
+        }
+        seen.insert(scope, key, scope.root_value(js::value::from_i32(next)))
+            .map_err(|_| thrown(scope, path))?;
+        let object = crate::resources::imported_wrapper(scope, key).expect("the key is a wrapper");
+        let start = self.paths.len();
+        let _ = write!(self.paths, "{path}");
+        self.wrappers.push(Wrapper {
+            object,
+            argument: self.argument,
+            path: start..self.paths.len(),
+            own,
+        });
+        Ok(())
+    }
+
+    /// Check that each wrapper recorded by [`Walker::record`] still holds its
+    /// handle, and that no wrapper used as an `own` is lent to an import call. A
+    /// getter that runs later in the walk can dispose of a wrapper or pass it to
+    /// an async import. Returns the argument index and the mismatch of the first
+    /// wrapper that fails.
+    fn check_wrappers(&self) -> Result<(), (usize, Mismatch)> {
+        for wrapper in &self.wrappers {
+            let (handle, lends) = {
+                let data = wrapper.object.data();
+                (data.handle, data.lends)
+            };
+            let reason = if handle.is_none() {
+                DISPOSED
+            } else if wrapper.own && lends > 0 {
+                LENT
+            } else {
+                continue;
+            };
+            let mismatch = Mismatch {
+                path: self.paths[wrapper.path.clone()].to_string(),
+                reason: reason.to_string(),
+            };
+            return Err((wrapper.argument, mismatch));
+        }
+        Ok(())
+    }
+}
+
+/// The reason for a wrapper of an imported resource that lost its handle.
+const DISPOSED: &str = "the resource was disposed of, or moved to the host";
+
+/// The reason for an `own` use of a wrapper lent to an import call.
+const LENT: &str = "the resource is lent to an import call that has not returned";
+
+/// Check `value` against `shape`, and return it converted for lowering (see
+/// [`snapshot`]).
+fn walk(
+    scope: &Scope<'_>,
+    value: HandleValue<'_>,
+    shape: &TypeShape,
+    path: &Path<'_>,
+    walker: &mut Walker<'_, '_>,
+) -> Result<TypeShapeValue, Mismatch> {
+    use TypeShapeValue as V;
+    match shape {
+        TypeShape::Bool => walker
+            .scalar(scope, value, path, value::pop_bool)
+            .map(V::Bool),
+        TypeShape::U8 => walker.scalar(scope, value, path, value::pop_u8).map(V::U8),
+        TypeShape::U16 => walker
+            .scalar(scope, value, path, value::pop_u16)
+            .map(V::U16),
+        TypeShape::U32 => walker
+            .scalar(scope, value, path, value::pop_u32)
+            .map(V::U32),
+        TypeShape::U64 => walker
+            .scalar(scope, value, path, value::pop_u64)
+            .map(V::U64),
+        TypeShape::S8 => walker.scalar(scope, value, path, value::pop_s8).map(V::S8),
+        TypeShape::S16 => walker
+            .scalar(scope, value, path, value::pop_s16)
+            .map(V::S16),
+        TypeShape::S32 => walker
+            .scalar(scope, value, path, value::pop_s32)
+            .map(V::S32),
+        TypeShape::S64 => walker
+            .scalar(scope, value, path, value::pop_s64)
+            .map(V::S64),
+        TypeShape::F32 => walker
+            .scalar(scope, value, path, value::pop_f32)
+            .map(V::F32),
+        TypeShape::F64 => walker
+            .scalar(scope, value, path, value::pop_f64)
+            .map(V::F64),
+        TypeShape::Char => walker
+            .scalar(scope, value, path, value::pop_char)
+            .map(V::Char),
+        TypeShape::String => walker
+            .scalar(scope, value, path, value::pop_string)
+            .map(V::String),
+        TypeShape::Enum(names) => {
+            let count = names.len() as u32;
+            walker
+                .scalar(scope, value, path, |s, sc| value::pop_enum(s, sc, count))
+                .map(V::Enum)
+        }
+        TypeShape::Flags(names) => {
+            let count = names.len() as u32;
+            walker
+                .scalar(scope, value, path, |s, sc| value::pop_flags(s, sc, count))
+                .map(V::Flags)
+        }
+        TypeShape::Record(fields) => {
+            let obj = object(scope, value, path, "a record (object)")?;
+            let mut converted = Vec::with_capacity(fields.len());
+            for (name, field) in fields {
+                let inner = scope.inner_scope();
+                let key = js::class::static_property_name(name);
+                let item = property(&inner, &obj, key, path)?;
+                converted.push(walk(&inner, item, field, &Path::Field(path, name), walker)?);
+            }
+            Ok(V::Record(converted))
+        }
+        TypeShape::Tuple(elements) => {
+            let obj = object(scope, value, path, "a tuple (array)")?;
+            let mut converted = Vec::with_capacity(elements.len());
+            for (index, element) in elements.iter().enumerate() {
+                let inner = scope.inner_scope();
+                let item = obj
+                    .get_element(&inner, index as u32)
+                    .map_err(|_| thrown(&inner, path))?;
+                let path = Path::Element(path, index as u32);
+                converted.push(walk(&inner, item, element, &path, walker)?);
+            }
+            Ok(V::Tuple(converted))
+        }
+        TypeShape::Variant(cases) => {
+            let obj = object(scope, value, path, "a variant (object with a `tag`)")?;
+            let tag = tag(scope, &obj, path)?;
+            let Some(case) = cases.iter().position(|(name, _)| *name == tag) else {
+                let expected = cases
+                    .iter()
+                    .map(|(name, _)| format!("\"{name}\""))
+                    .collect::<Vec<_>>()
+                    .join(", ");
+                return Err(mismatch(
+                    path,
+                    format!("the tag \"{tag}\" is none of the cases {expected}"),
+                ));
+            };
+            let payload = payload(scope, &obj, cases[case].1.as_ref(), path, walker)?;
+            Ok(V::Variant(case as u32, payload))
+        }
+        TypeShape::Option(inner) => {
+            if value.is_undefined() || value.is_null() {
+                return Ok(V::Option(None));
+            }
+            if matches!(**inner, TypeShape::Option(_)) {
+                let obj = object(scope, value, path, "a nested option (object with `val`)")?;
+                let item = property(scope, &obj, c"val", path)?;
+                let converted = walk(scope, item, inner, &Path::Field(path, "val"), walker)?;
+                Ok(V::Option(Some(Box::new(converted))))
+            } else {
+                let converted = walk(scope, value, inner, path, walker)?;
+                Ok(V::Option(Some(Box::new(converted))))
+            }
+        }
+        TypeShape::Result(ok, err) => {
+            let obj = object(scope, value, path, "a result (object with a `tag`)")?;
+            let tag = tag(scope, &obj, path)?;
+            match tag.as_str() {
+                "ok" => Ok(V::Result(Ok(payload(
+                    scope,
+                    &obj,
+                    ok.as_deref(),
+                    path,
+                    walker,
+                )?))),
+                "err" => Ok(V::Result(Err(payload(
+                    scope,
+                    &obj,
+                    err.as_deref(),
+                    path,
+                    walker,
+                )?))),
+                other => Err(mismatch(
+                    path,
+                    format!("the tag \"{other}\" is neither \"ok\" nor \"err\""),
+                )),
+            }
+        }
+        TypeShape::List(element) => {
+            if let Some(kind) = element.view_kind() {
+                if let Ok(view) = js::ArrayBufferView::from_jsval(scope, value, ()) {
+                    let actual = view.view_kind();
+                    if !element.accepts_view_kind(actual) {
+                        return Err(mismatch(
+                            path,
+                            format!("expected {}, got {}", kind.name(), actual.name()),
+                        ));
+                    }
+                    return NumericList::copy(scope, view, element)
+                        .map(V::NumericList)
+                        .map_err(|_| thrown(scope, path));
+                }
+            }
+            let array = js::Array::from_jsval(scope, value, ()).map_err(|_| {
+                mismatch(
+                    path,
+                    format!("expected a list (array), got {}", describe(scope, value)),
+                )
+            })?;
+            let length = array.length(scope).map_err(|_| thrown(scope, path))?;
+            let mut converted = Vec::new();
+            converted.try_reserve_exact(length as usize).map_err(|_| {
+                mismatch(
+                    path,
+                    format!("out of memory while reading a list of {length} elements"),
+                )
+            })?;
+            for index in 0..length {
+                let inner = scope.inner_scope();
+                let item = array
+                    .get_element(&inner, index)
+                    .map_err(|_| thrown(&inner, path))?;
+                let path = Path::Element(path, index);
+                converted.push(walk(&inner, item, element, &path, walker)?);
+            }
+            Ok(V::List(converted))
+        }
+        TypeShape::OwnResource { .. }
+        | TypeShape::BorrowResource { .. }
+        | TypeShape::Stream(_)
+        | TypeShape::Future(_)
+        | TypeShape::Unsupported(_) => Ok(match leaf(scope, value, shape, path, walker)? {
+            Some(converted) => V::js(converted),
+            None => V::js(value),
+        }),
+    }
+}
+
+/// Check `value`, a value of the resource, stream, future or unsupported type
+/// `shape`. Returns the `ReadableStream` that an iterable object passed as a
+/// stream is converted to, and `None` for every other value, which is lowered
+/// itself.
+fn leaf<'s>(
+    scope: &'s Scope<'_>,
+    value: HandleValue<'_>,
+    shape: &TypeShape,
+    path: &Path<'_>,
+    walker: &mut Walker<'_, '_>,
+) -> Result<Option<HandleValue<'s>>, Mismatch> {
+    match shape {
+        TypeShape::OwnResource { index, imported }
+        | TypeShape::BorrowResource { index, imported } => {
+            let obj = object(scope, value, path, "a resource (object)")?;
+            // An object backing an exported resource gets a new handle per use, so
+            // any object lowers as one.
+            if !*imported {
+                return Ok(None);
+            }
+            match crate::resources::imported_wrapper(scope, value) {
+                Some(wrapper) => {
+                    let own = matches!(shape, TypeShape::OwnResource { .. });
+                    let (type_idx, handle, borrowed, lends, dispose_deferred) = {
+                        let data = wrapper.data();
+                        (
+                            data.type_idx,
+                            data.handle,
+                            data.borrowed,
+                            data.lends,
+                            data.dispose_deferred,
+                        )
+                    };
+                    if type_idx != *index {
+                        return Err(mismatch(
+                            path,
+                            "expected a resource of another type".to_string(),
+                        ));
+                    }
+                    // A wrapper loses its handle once disposed of or moved to the
+                    // host.
+                    if handle.is_none() || dispose_deferred {
+                        return Err(mismatch(path, DISPOSED.to_string()));
+                    }
+                    if own && lends > 0 {
+                        return Err(mismatch(path, LENT.to_string()));
+                    }
+                    if own && borrowed {
+                        return Err(mismatch(
+                            path,
+                            "expected an owned resource, got a borrowed one".to_string(),
+                        ));
+                    }
+                    walker.record(wrapper, own, path)?;
+                    Ok(None)
+                }
+                // A value converted by an own adapter is also moved to the host.
+                None => {
+                    let check = match shape {
+                        TypeShape::OwnResource { .. } => adapter_check(*index),
+                        _ => None,
+                    };
+                    match check.map(|check| check(scope, value)) {
+                        Some(Ok(true)) => {
+                            walker.record_moved(&obj, path, "value")?;
+                            Ok(None)
+                        }
+                        Some(Err(reason)) => Err(mismatch(path, reason)),
+                        Some(Ok(false)) | None => Err(mismatch(
+                            path,
+                            format!(
+                                "expected an instance of the imported resource's class, got {}",
+                                describe(scope, value)
+                            ),
+                        )),
+                    }
+                }
+            }
+        }
+        TypeShape::Stream(_) | TypeShape::Future(_)
+            if !core_runtime::event_loop::has_active_event_loop() =>
+        {
+            let what = match shape {
+                TypeShape::Stream(_) => "passing a stream",
+                _ => "passing a future",
+            };
+            Err(mismatch(
+                path,
+                core_runtime::event_loop::no_event_loop_message(what),
+            ))
+        }
+        TypeShape::Stream(_) => {
+            let obj = object(scope, value, path, "a ReadableStream or an iterable object")?;
+            if let Ok(stream) = web_streams::readable::ReadableStream::from_jsval(scope, value, ())
+            {
+                if stream.is_locked() {
+                    return Err(mismatch(path, "the stream is locked".to_string()));
+                }
+                walker.record_moved(&obj, path, "stream")?;
+                return Ok(None);
+            }
+            match web_streams::readable::ReadableStream::from_iterable(scope, value) {
+                Ok(stream) => Ok(Some(scope.root_value(stream.as_value()))),
+                Err(ExnThrown) => {
+                    let reason = js::error::ExnThrown::capture(scope)
+                        .message
+                        .unwrap_or_else(|| "the value is not iterable".to_string());
+                    Err(mismatch(
+                        path,
+                        format!(
+                            "expected a ReadableStream or an iterable object, got {}: {reason}",
+                            describe(scope, value)
+                        ),
+                    ))
+                }
+            }
+        }
+        _ => Ok(None),
+    }
+}
+
+/// The check of the own adapter that converts values to the imported resource
+/// type `index`, if one is registered.
+fn adapter_check(index: u32) -> Option<crate::resources::OwnAdapterCheck> {
+    #[cfg(target_arch = "wasm32")]
+    return crate::interpreter::own_adapter_check(index);
+    #[cfg(not(target_arch = "wasm32"))]
+    {
+        let _ = index;
+        None
+    }
+}
+
+/// Walk the `val` of the variant or result `obj` if `payload` is `Some`, and
+/// return it converted for lowering.
+fn payload(
+    scope: &Scope<'_>,
+    obj: &Object<'_>,
+    payload: Option<&TypeShape>,
+    path: &Path<'_>,
+    walker: &mut Walker<'_, '_>,
+) -> Result<Option<Box<TypeShapeValue>>, Mismatch> {
+    let Some(payload) = payload else {
+        return Ok(None);
+    };
+    let item = property(scope, obj, c"val", path)?;
+    let converted = walk(scope, item, payload, &Path::Field(path, "val"), walker)?;
+    Ok(Some(Box::new(converted)))
+}
+
+/// Check the [`TypeShapeValue::Js`] parts of `value`, a value of `shape`
+/// returned by [`walk`], with the same rules as [`walk`].
+fn check_parts(
+    scope: &Scope<'_>,
+    value: &TypeShapeValue,
+    shape: &TypeShape,
+    path: &Path<'_>,
+    walker: &mut Walker<'_, '_>,
+) -> Result<(), Mismatch> {
+    use TypeShapeValue as V;
+    match (shape, value) {
+        (_, V::Js(js_value)) => {
+            let inner = scope.inner_scope();
+            leaf(&inner, js_value.get(&inner), shape, path, walker).map(|_| ())
+        }
+        (TypeShape::Record(fields), V::Record(values)) => {
+            for ((name, field), value) in fields.iter().zip(values) {
+                check_parts(scope, value, field, &Path::Field(path, name), walker)?;
+            }
+            Ok(())
+        }
+        (TypeShape::Tuple(elements), V::Tuple(values)) => {
+            for (index, (element, value)) in elements.iter().zip(values).enumerate() {
+                check_parts(
+                    scope,
+                    value,
+                    element,
+                    &Path::Element(path, index as u32),
+                    walker,
+                )?;
+            }
+            Ok(())
+        }
+        (TypeShape::List(element), V::List(values)) => {
+            for (index, value) in values.iter().enumerate() {
+                check_parts(
+                    scope,
+                    value,
+                    element,
+                    &Path::Element(path, index as u32),
+                    walker,
+                )?;
+            }
+            Ok(())
+        }
+        (TypeShape::Variant(cases), V::Variant(case, Some(payload))) => {
+            match cases
+                .get(*case as usize)
+                .and_then(|(_, shape)| shape.as_ref())
+            {
+                Some(shape) => {
+                    check_parts(scope, payload, shape, &Path::Field(path, "val"), walker)
+                }
+                None => Ok(()),
+            }
+        }
+        (TypeShape::Option(inner), V::Option(Some(payload))) => {
+            if matches!(**inner, TypeShape::Option(_)) {
+                check_parts(scope, payload, inner, &Path::Field(path, "val"), walker)
+            } else {
+                check_parts(scope, payload, inner, path, walker)
+            }
+        }
+        (TypeShape::Result(ok, err), V::Result(result)) => {
+            let (shape, payload) = match result {
+                Ok(payload) => (ok, payload),
+                Err(payload) => (err, payload),
+            };
+            match (shape.as_deref(), payload) {
+                (Some(shape), Some(payload)) => {
+                    check_parts(scope, payload, shape, &Path::Field(path, "val"), walker)
+                }
+                _ => Ok(()),
+            }
+        }
+        _ => Ok(()),
+    }
+}
+
+/// The path from a walked value's root to one of its parts, as a chain of
+/// segments on the stack. It is formatted only when a mismatch is reported or
+/// a wrapper is recorded.
+#[derive(Clone, Copy)]
+enum Path<'a> {
+    /// The walked value itself, formatted as the empty string.
+    Root,
+    /// The property `name` of the part at the parent path, formatted as
+    /// `.name`.
+    Field(&'a Path<'a>, &'a str),
+    /// The element `index` of the part at the parent path, formatted as
+    /// `[index]`.
+    Element(&'a Path<'a>, u32),
+}
+
+impl fmt::Display for Path<'_> {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        match self {
+            Path::Root => Ok(()),
+            Path::Field(parent, name) => write!(f, "{parent}.{name}"),
+            Path::Element(parent, index) => write!(f, "{parent}[{index}]"),
+        }
+    }
+}
+
+/// Returns `value` as an object, or a mismatch expecting `expected` if it is not one.
+fn object<'s>(
+    scope: &'s Scope<'_>,
+    value: HandleValue<'_>,
+    path: &Path<'_>,
+    expected: &str,
+) -> Result<Object<'s>, Mismatch> {
+    Object::from_raw_value(scope, value.get()).map_err(|_| {
+        mismatch(
+            path,
+            format!("expected {expected}, got {}", describe(scope, value)),
+        )
+    })
+}
+
+/// The property `name` of `obj`.
+fn property<'s>(
+    scope: &'s Scope<'_>,
+    obj: &Object<'_>,
+    name: &'static CStr,
+    path: &Path<'_>,
+) -> Result<HandleValue<'s>, Mismatch> {
+    obj.get_property(scope, name)
+        .map_err(|_| thrown(scope, path))
+}
+
+/// The `tag` property of `obj`, which must be a string.
+fn tag(scope: &Scope<'_>, obj: &Object<'_>, path: &Path<'_>) -> Result<String, Mismatch> {
+    let tag = property(scope, obj, c"tag", path)?;
+    if !tag.is_string() {
+        return Err(mismatch(
+            path,
+            format!("expected a string `tag`, got {}", describe(scope, tag)),
+        ));
+    }
+    String::from_jsval_throwing(scope, tag, ()).map_err(|_| thrown(scope, path))
+}
+
+/// A mismatch at `path` for the exception a getter or conversion left pending,
+/// which is cleared.
+fn thrown(scope: &Scope<'_>, path: &Path<'_>) -> Mismatch {
+    let message = js::error::ExnThrown::capture(scope)
+        .message
+        .unwrap_or_else(|| "reading the value threw".to_string());
+    mismatch(path, format!("reading the value threw: {message}"))
+}
+
+fn mismatch(path: &Path<'_>, reason: String) -> Mismatch {
+    Mismatch {
+        path: path.to_string(),
+        reason,
+    }
+}
+
+/// Return a short description of `value` for a mismatch's reason, without
+/// running JS. Numbers, BigInts, booleans and the first 40 code units of a
+/// string are shown as literals. Other values are described by their kind.
+pub fn describe(scope: &Scope<'_>, value: HandleValue<'_>) -> String {
+    const MAX_STRING: usize = 40;
+    // `ToString` of a primitive runs no JS, and fails only if it cannot allocate.
+    let to_string = |value: HandleValue<'_>| {
+        String::from_jsval(scope, value, ()).map_err(|_| js::exception::clear(scope))
+    };
+    if value.is_undefined() {
+        "undefined".to_string()
+    } else if value.is_null() {
+        "null".to_string()
+    } else if value.is_boolean() || value.is_number() {
+        to_string(value).unwrap_or_else(|()| "a number".to_string())
+    } else if value.is_bigint() {
+        match to_string(value) {
+            Ok(n) => format!("{n}n"),
+            Err(()) => "a BigInt".to_string(),
+        }
+    } else if value.is_string() {
+        let short = js::JSString::from_value(scope, value).and_then(|string| {
+            let truncated = string.len() > MAX_STRING;
+            let string = if truncated {
+                string.substring(scope, 0, MAX_STRING)?
+            } else {
+                string
+            };
+            Ok((string, truncated))
+        });
+        match short.map_err(|_| js::exception::clear(scope)) {
+            Ok((string, truncated)) => match to_string(scope.root_value(string.as_value())) {
+                Ok(text) if truncated => format!("{:?}", text + "…"),
+                Ok(text) => format!("{text:?}"),
+                Err(()) => "a string".to_string(),
+            },
+            Err(()) => "a string".to_string(),
+        }
+    } else if value.is_symbol() {
+        "a symbol".to_string()
+    } else {
+        let mut kind = String::from("an object");
+        if let Ok(obj) = Object::from_raw_value(scope, value.get()) {
+            if obj.cast::<js::Array>().is_ok() {
+                kind = "an array".to_string();
+            } else if let Some(view) = js::ArrayBufferView::from_object(obj) {
+                kind.clear();
+                let _ = write!(kind, "{}", view.view_kind().name());
+            } else if obj.cast::<js::Function>().is_ok() {
+                kind = "a function".to_string();
+            } else if obj.cast::<js::Promise>().is_ok() {
+                kind = "a Promise".to_string();
+            }
+        }
+        kind
+    }
+}
diff --git a/crates/wit-bridge/src/value.rs b/crates/wit-bridge/src/value.rs
new file mode 100644
index 00000000..074aefac
--- /dev/null
+++ b/crates/wit-bridge/src/value.rs
@@ -0,0 +1,1013 @@
+// SPDX-License-Identifier: Apache-2.0-WITH-LLVM-exception
+
+//! Conversion between JavaScript values and WIT values.
+//!
+//! The functions correspond to the methods of `wit_dylib_ffi`'s `Call` trait,
+//! and exchange values through a [`CallStack`]:
+//!
+//! - Lifting functions (`push_*`) convert a WIT value into a JavaScript value
+//!   and push it onto the stack. A record, tuple, variant, option, result or
+//!   list is built from field and element values that earlier `push_*` calls
+//!   pushed.
+//! - Lowering functions (`pop_*`) pop a JavaScript value off the stack and
+//!   convert it into a WIT value. For a record, tuple, variant, option or
+//!   result, they push the field and element values for the `pop_*` calls that
+//!   follow. While the stack holds [`TypeShapeValue`]s, they pop and push those
+//!   instead (see [`CallStack::push_shaped`]).
+
+use std::ffi::{CStr, CString};
+
+use js::conversion::FromJSVal;
+use js::error::{throw_type_error, ExnThrown};
+use js::gc::handle::RootedHeap;
+use js::gc::scope::Scope;
+use js::native::Value;
+use js::prelude::HandleValue;
+
+use crate::stack::CallStack;
+
+/// The structure of a WIT type, as used by the conversion functions.
+///
+/// The names of record fields and of variant, enum and flags cases are the JS
+/// names created by [`mangle_name`](wit_name_mapping::mangle_name).
+#[derive(Clone, Debug, PartialEq)]
+pub enum TypeShape {
+    Bool,
+    U8,
+    U16,
+    U32,
+    U64,
+    S8,
+    S16,
+    S32,
+    S64,
+    F32,
+    F64,
+    Char,
+    String,
+    List(Box<TypeShape>),
+    Record(Vec<(String, TypeShape)>),
+    Tuple(Vec<TypeShape>),
+    /// A `None` payload means the case has no value.
+    Variant(Vec<(String, Option<TypeShape>)>),
+    /// Case names in declaration order. A case is lifted and lowered as its
+    /// index.
+    Enum(Vec<String>),
+    Option(Box<TypeShape>),
+    /// The types of the `ok` and `err` values, or `None` for a case without a
+    /// value.
+    Result(Option<Box<TypeShape>>, Option<Box<TypeShape>>),
+    /// Flag names in declaration order. A flags value is lifted and lowered as a
+    /// bit set.
+    Flags(Vec<String>),
+    /// An owned handle to the resource type `index`. `imported` is set if the
+    /// world imports the resource. A lowered handle to an imported resource must
+    /// be a wrapper of that type, or a value converted by an own adapter (see
+    /// [`crate::resources::register_own_adapter`]).
+    OwnResource {
+        index: u32,
+        imported: bool,
+    },
+    /// A borrowed handle to the resource type `index`. `imported` is set if the
+    /// world imports the resource. A lowered handle to an imported resource must
+    /// be a wrapper of that type.
+    BorrowResource {
+        index: u32,
+        imported: bool,
+    },
+    /// A `stream` of the stream type with this index. Streams aren't converted by
+    /// the functions in this module.
+    Stream(u32),
+    /// A `future` of the future type with this index. Futures aren't converted
+    /// by the functions in this module.
+    Future(u32),
+    /// A type that can't be converted: `map`, a fixed-length list or
+    /// `error-context`. The string names the type in error messages.
+    Unsupported(&'static str),
+}
+
+impl TypeShape {
+    /// Whether a value of this shape contains an owned resource handle. The
+    /// elements of a stream or future it contains are not part of the value.
+    pub fn contains_own_resource(&self) -> bool {
+        match self {
+            TypeShape::OwnResource { .. } => true,
+            TypeShape::List(elem) | TypeShape::Option(elem) => elem.contains_own_resource(),
+            TypeShape::Record(fields) => fields.iter().any(|(_, f)| f.contains_own_resource()),
+            TypeShape::Tuple(elems) => elems.iter().any(TypeShape::contains_own_resource),
+            TypeShape::Variant(cases) => cases
+                .iter()
+                .any(|(_, p)| p.as_ref().is_some_and(TypeShape::contains_own_resource)),
+            TypeShape::Result(ok, err) => [ok, err]
+                .into_iter()
+                .any(|arm| arm.as_deref().is_some_and(TypeShape::contains_own_resource)),
+            _ => false,
+        }
+    }
+
+    /// The typed-array kind of a numeric scalar, or `None` for every other
+    /// shape.
+    ///
+    /// A list of a shape with a kind is lifted and lowered as a typed array of
+    /// that kind. The kind's element size equals the scalar's canonical-ABI size
+    /// and alignment.
+    pub fn view_kind(&self) -> Option<js::typedarray::ViewKind> {
+        use js::typedarray::ViewKind;
+        Some(match self {
+            TypeShape::U8 => ViewKind::Uint8,
+            TypeShape::S8 => ViewKind::Int8,
+            TypeShape::U16 => ViewKind::Uint16,
+            TypeShape::S16 => ViewKind::Int16,
+            TypeShape::U32 => ViewKind::Uint32,
+            TypeShape::S32 => ViewKind::Int32,
+            TypeShape::U64 => ViewKind::BigUint64,
+            TypeShape::S64 => ViewKind::BigInt64,
+            TypeShape::F32 => ViewKind::Float32,
+            TypeShape::F64 => ViewKind::Float64,
+            _ => return None,
+        })
+    }
+
+    /// Whether a typed array of `kind` can be lowered as a list of this shape:
+    /// a typed array of the shape's [`view_kind`](Self::view_kind), or a
+    /// `Uint8ClampedArray` for `u8`.
+    pub fn accepts_view_kind(&self, kind: js::typedarray::ViewKind) -> bool {
+        use js::typedarray::ViewKind;
+        self.view_kind().is_some_and(|expected| {
+            kind == expected || (expected == ViewKind::Uint8 && kind == ViewKind::Uint8Clamped)
+        })
+    }
+
+    /// The canonical-ABI memory layout of a `count`-element list of this numeric
+    /// scalar, or `None` for every other shape and for a list whose size in
+    /// bytes exceeds `isize::MAX`.
+    pub fn numeric_list_layout(&self, count: usize) -> Option<std::alloc::Layout> {
+        let size = self.view_kind()?.element_size();
+        std::alloc::Layout::from_size_align(size.checked_mul(count)?, size).ok()
+    }
+}
+
+/// A value of a [`TypeShape`], read from JavaScript by
+/// [`crate::validate::snapshot`] and converted for lowering. Lowering it runs no
+/// JavaScript, except for the parts held as [`TypeShapeValue::Js`].
+///
+/// Each variant holds a value of the [`TypeShape`] variant with the same name,
+/// except for [`TypeShapeValue::NumericList`] and [`TypeShapeValue::Js`].
+pub enum TypeShapeValue {
+    Bool(bool),
+    U8(u8),
+    U16(u16),
+    U32(u32),
+    U64(u64),
+    S8(i8),
+    S16(i16),
+    S32(i32),
+    S64(i64),
+    F32(f32),
+    F64(f64),
+    Char(char),
+    String(String),
+    /// A list of numbers given as a typed array.
+    NumericList(NumericList),
+    List(Vec<TypeShapeValue>),
+    /// The fields in declaration order.
+    Record(Vec<TypeShapeValue>),
+    Tuple(Vec<TypeShapeValue>),
+    /// The index of the case, and its value if the case has one.
+    Variant(u32, Option<Box<TypeShapeValue>>),
+    /// The index of the case.
+    Enum(u32),
+    /// The bit set.
+    Flags(u32),
+    Option(Option<Box<TypeShapeValue>>),
+    /// The `ok` or `err` case, and its value if the case has one.
+    Result(Result<Option<Box<TypeShapeValue>>, Option<Box<TypeShapeValue>>>),
+    /// A resource, a stream, a future, or a value of a [`TypeShape::Unsupported`]
+    /// type, which is lowered from the JavaScript value.
+    Js(RootedHeap<Value>),
+}
+
+impl TypeShapeValue {
+    /// Returns a [`TypeShapeValue::Js`] holding `value`.
+    pub fn js(value: HandleValue<'_>) -> TypeShapeValue {
+        TypeShapeValue::Js(RootedHeap::from(value.get()))
+    }
+}
+
+/// The elements of a numeric list in the canonical ABI's layout, with the
+/// element count.
+pub struct NumericList {
+    /// `None` for an empty list.
+    buffer: Option<OwnedBuffer>,
+    count: usize,
+}
+
+impl NumericList {
+    /// Copy the elements of `view`, a typed array of a kind that `elem` accepts
+    /// (see [`TypeShape::accepts_view_kind`]).
+    pub fn copy(
+        scope: &Scope<'_>,
+        view: js::ArrayBufferView<'_>,
+        elem: &TypeShape,
+    ) -> Result<NumericList, ExnThrown> {
+        let elem_size = elem
+            .view_kind()
+            .expect("NumericList::copy called for a non-typed-array element")
+            .element_size();
+        // The view's kind matches `elem`, so the byte length is an exact multiple
+        // of the element size.
+        let count = view.byte_length() / elem_size;
+        let layout = elem
+            .numeric_list_layout(count)
+            .expect("element shape has a numeric layout");
+        if count == 0 {
+            return Ok(NumericList {
+                buffer: None,
+                count,
+            });
+        }
+        // SAFETY: `layout` has a non-zero size, since `count > 0`.
+        let Some(ptr) = std::ptr::NonNull::new(unsafe { std::alloc::alloc(layout) }) else {
+            js::exception::report_out_of_memory(scope);
+            return Err(ExnThrown);
+        };
+        // SAFETY: `ptr` is freshly allocated for `layout.size()` bytes, and nothing
+        // else references it.
+        let target = unsafe { std::slice::from_raw_parts_mut(ptr.as_ptr(), layout.size()) };
+        // Allocating cannot run JS or collect, so the view still holds exactly
+        // `layout.size()` bytes.
+        view.with_bytes(|src| target.copy_from_slice(src));
+        Ok(NumericList {
+            buffer: Some(OwnedBuffer { ptr, layout }),
+            count,
+        })
+    }
+
+    /// The elements' bytes.
+    pub fn bytes(&self) -> &[u8] {
+        match &self.buffer {
+            // SAFETY: `ptr` points to `layout.size()` initialized bytes owned by
+            // the buffer.
+            Some(buffer) => unsafe {
+                std::slice::from_raw_parts(buffer.ptr.as_ptr(), buffer.layout.size())
+            },
+            None => &[],
+        }
+    }
+
+    /// Returns the buffer, its layout and the element count, and gives up
+    /// ownership of the buffer. The caller must free it with that layout. For
+    /// an empty list, nothing is allocated and the pointer is dangling but
+    /// aligned for `elem`.
+    fn into_raw(self, elem: &TypeShape) -> (*mut u8, std::alloc::Layout, usize) {
+        match self.buffer {
+            Some(buffer) => {
+                let buffer = std::mem::ManuallyDrop::new(buffer);
+                (buffer.ptr.as_ptr(), buffer.layout, self.count)
+            }
+            None => {
+                let layout = elem
+                    .numeric_list_layout(0)
+                    .expect("element shape has a numeric layout");
+                (layout.align() as *mut u8, layout, 0)
+            }
+        }
+    }
+}
+
+// ===========================================================================
+// Lift: WIT value -> JS value pushed onto the stack
+// ===========================================================================
+
+pub fn push_bool(stack: &mut CallStack, val: bool) {
+    stack.push_value(js::value::from_bool(val));
+}
+
+pub fn push_u8(stack: &mut CallStack, val: u8) {
+    stack.push_value(js::value::from_u32(val as u32));
+}
+
+pub fn push_u16(stack: &mut CallStack, val: u16) {
+    stack.push_value(js::value::from_u32(val as u32));
+}
+
+pub fn push_u32(stack: &mut CallStack, val: u32) {
+    stack.push_value(js::value::from_u32(val));
+}
+
+pub fn push_s8(stack: &mut CallStack, val: i8) {
+    stack.push_value(js::value::from_i32(val as i32));
+}
+
+pub fn push_s16(stack: &mut CallStack, val: i16) {
+    stack.push_value(js::value::from_i32(val as i32));
+}
+
+pub fn push_s32(stack: &mut CallStack, val: i32) {
+    stack.push_value(js::value::from_i32(val));
+}
+
+/// Lift a `u64` as a BigInt.
+pub fn push_u64(stack: &mut CallStack, scope: &Scope<'_>, val: u64) -> Result<(), ExnThrown> {
+    let bi = js::bigint::from_u64(scope, val)?;
+    stack.push_value(js::value::from_bigint(bi));
+    Ok(())
+}
+
+/// Lift an `s64` as a BigInt.
+pub fn push_s64(stack: &mut CallStack, scope: &Scope<'_>, val: i64) -> Result<(), ExnThrown> {
+    let bi = js::bigint::from_i64(scope, val)?;
+    stack.push_value(js::value::from_bigint(bi));
+    Ok(())
+}
+
+/// Lift an `f32` as a JS double. NaNs are canonicalized by `value::from_f64`.
+pub fn push_f32(stack: &mut CallStack, val: f32) {
+    stack.push_value(js::value::from_f64(val as f64));
+}
+
+/// Lift an `f64` as a JS double. NaNs are canonicalized.
+pub fn push_f64(stack: &mut CallStack, val: f64) {
+    stack.push_value(js::value::from_f64(val));
+}
+
+/// Lift a `char` as a one-code-point JS string.
+pub fn push_char(stack: &mut CallStack, scope: &Scope<'_>, val: char) -> Result<(), ExnThrown> {
+    let mut buf = [0u8; 4];
+    let s = js::JSString::from_str(scope, val.encode_utf8(&mut buf))?;
+    stack.push_value(s.as_value());
+    Ok(())
+}
+
+/// Lift a string.
+pub fn push_string(stack: &mut CallStack, scope: &Scope<'_>, val: &str) -> Result<(), ExnThrown> {
+    let s = js::JSString::from_str(scope, val)?;
+    stack.push_value(s.as_value());
+    Ok(())
+}
+
+/// Lift a record. The field values must be on the stack in declaration order,
+/// with the last field on top.
+pub fn push_record(
+    stack: &mut CallStack,
+    scope: &Scope<'_>,
+    field_names: &[&'static CStr],
+) -> Result<(), ExnThrown> {
+    let obj = js::Object::new_plain(scope)?;
+    for name in field_names.iter().rev() {
+        let field = scope.root_value(stack.pop_value());
+        obj.define_property(scope, name, field, ENUMERATE)?;
+    }
+    stack.push_object(&obj);
+    Ok(())
+}
+
+/// Lift a tuple as a JS array. The element values must be on the stack in
+/// order, with the last element on top.
+pub fn push_tuple(stack: &mut CallStack, scope: &Scope<'_>, len: usize) -> Result<(), ExnThrown> {
+    let arr = js::Array::new(scope, len)?;
+    for index in (0..len).rev() {
+        let elem = scope.root_value(stack.pop_value());
+        arr.define_element(scope, index as u32, elem, ENUMERATE)?;
+    }
+    stack.push_object(&arr);
+    Ok(())
+}
+
+/// Lift a variant case as `{tag: name}`, or as `{tag: name, val}` if the case
+/// has a value. The value must be on top of the stack.
+pub fn push_variant(
+    stack: &mut CallStack,
+    scope: &Scope<'_>,
+    cases: &[(&'static CStr, bool)],
+    discriminant: u32,
+) -> Result<(), ExnThrown> {
+    let Some((tag, has_payload)) = cases.get(discriminant as usize) else {
+        return Err(throw_type_error(
+            scope,
+            c"variant discriminant out of range",
+        ));
+    };
+    let obj = js::Object::new_plain(scope)?;
+    set_tag(&obj, scope, tag)?;
+    if *has_payload {
+        let val = scope.root_value(stack.pop_value());
+        obj.define_property(scope, c"val", val, ENUMERATE)?;
+    }
+    stack.push_object(&obj);
+    Ok(())
+}
+
+/// Lift an enum as its case index, which is the value that the `const enum` in
+/// the TypeScript declarations gives that case.
+pub fn push_enum(
+    stack: &mut CallStack,
+    scope: &Scope<'_>,
+    case_count: u32,
+    discriminant: u32,
+) -> Result<(), ExnThrown> {
+    if discriminant >= case_count {
+        return Err(throw_type_error(scope, c"enum discriminant out of range"));
+    }
+    stack.push_value(js::value::from_u32(discriminant));
+    Ok(())
+}
+
+/// Lift an option. `none` is lifted as `undefined`, and `some(x)` as `x`. If
+/// the inner type is also an option, `some(x)` is lifted as `{val: x}` instead,
+/// so that `some(none)` differs from `none`. For `some`, `x` must be on top of
+/// the stack.
+pub fn push_option(
+    stack: &mut CallStack,
+    scope: &Scope<'_>,
+    inner_is_option: bool,
+    is_some: bool,
+) -> Result<(), ExnThrown> {
+    if is_some {
+        if inner_is_option {
+            let obj = js::Object::new_plain(scope)?;
+            let val = scope.root_value(stack.pop_value());
+            obj.define_property(scope, c"val", val, ENUMERATE)?;
+            stack.push_object(&obj);
+        }
+        // Otherwise leave the payload value on the stack as-is.
+    } else {
+        stack.push_value(js::value::undefined());
+    }
+    Ok(())
+}
+
+/// Lift a result as `{tag: "ok"}` or `{tag: "err"}`, with a `val` property if
+/// the case has a value. The value must be on top of the stack.
+pub fn push_result(
+    stack: &mut CallStack,
+    scope: &Scope<'_>,
+    ok_has_payload: bool,
+    err_has_payload: bool,
+    is_err: bool,
+) -> Result<(), ExnThrown> {
+    let obj = js::Object::new_plain(scope)?;
+    let tag = if is_err { c"err" } else { c"ok" };
+    set_tag(&obj, scope, tag)?;
+    let has_payload = if is_err {
+        err_has_payload
+    } else {
+        ok_has_payload
+    };
+    if has_payload {
+        let val = scope.root_value(stack.pop_value());
+        obj.define_property(scope, c"val", val, ENUMERATE)?;
+    }
+    stack.push_object(&obj);
+    Ok(())
+}
+
+/// Lift flags as an int32 bit set, with bit `i` for the `i`th flag in
+/// declaration order. The value equals the bitwise or of the members of the
+/// TypeScript `const enum` for the set flags. A set with bit 31 is negative.
+pub fn push_flags(stack: &mut CallStack, bits: u32) {
+    stack.push_value(js::value::from_i32(bits as i32));
+}
+
+// ===========================================================================
+// Lower: JS value popped off the stack -> WIT value
+// ===========================================================================
+
+/// If a [`TypeShapeValue`] other than [`TypeShapeValue::Js`] is on top of
+/// `stack`, pop it and return its value from the enclosing function. Panics if
+/// it isn't the variant `$variant`.
+macro_rules! return_shaped {
+    ($stack:expr, $variant:ident) => {
+        if let Some(shaped) = $stack.pop_shaped() {
+            return match shaped {
+                TypeShapeValue::$variant(value) => Ok(value),
+                _ => mismatched_shape(stringify!($variant)),
+            };
+        }
+    };
+}
+
+/// Panic for a [`TypeShapeValue`] that isn't of the type being lowered, which
+/// indicates a bug in the calling convention rather than untrusted input.
+fn mismatched_shape(expected: &str) -> ! {
+    panic!("lowering a {expected}, but the shaped value on the stack is of another type")
+}
+
+pub fn pop_bool(stack: &mut CallStack, scope: &Scope<'_>) -> Result<bool, ExnThrown> {
+    return_shaped!(stack, Bool);
+    let v = scope.root_value(stack.pop_value());
+    if v.is_boolean() {
+        Ok(v.to_boolean())
+    } else {
+        Err(throw_type_error(scope, c"expected a boolean"))
+    }
+}
+
+pub fn pop_u8(stack: &mut CallStack, scope: &Scope<'_>) -> Result<u8, ExnThrown> {
+    return_shaped!(stack, U8);
+    pop_int_in_range(stack, scope, c"expected a u8")
+}
+
+pub fn pop_u16(stack: &mut CallStack, scope: &Scope<'_>) -> Result<u16, ExnThrown> {
+    return_shaped!(stack, U16);
+    pop_int_in_range(stack, scope, c"expected a u16")
+}
+
+pub fn pop_u32(stack: &mut CallStack, scope: &Scope<'_>) -> Result<u32, ExnThrown> {
+    return_shaped!(stack, U32);
+    pop_int_in_range(stack, scope, c"expected a u32")
+}
+
+pub fn pop_s8(stack: &mut CallStack, scope: &Scope<'_>) -> Result<i8, ExnThrown> {
+    return_shaped!(stack, S8);
+    pop_int_in_range(stack, scope, c"expected an s8")
+}
+
+pub fn pop_s16(stack: &mut CallStack, scope: &Scope<'_>) -> Result<i16, ExnThrown> {
+    return_shaped!(stack, S16);
+    pop_int_in_range(stack, scope, c"expected an s16")
+}
+
+pub fn pop_s32(stack: &mut CallStack, scope: &Scope<'_>) -> Result<i32, ExnThrown> {
+    return_shaped!(stack, S32);
+    pop_int_in_range(stack, scope, c"expected an s32")
+}
+
+/// Lower a `u64`, which must be a BigInt in `[0, 2^64)`. A number is rejected,
+/// as assigning one to a `BigUint64Array` element is.
+pub fn pop_u64(stack: &mut CallStack, scope: &Scope<'_>) -> Result<u64, ExnThrown> {
+    return_shaped!(stack, U64);
+    let v = scope.root_value(stack.pop_value());
+    if !v.is_bigint() {
+        return Err(throw_type_error(scope, c"expected a u64 (BigInt)"));
+    }
+    let bi = js::bigint::to_bigint(scope, v)?;
+    // `to_uint64` is modulo 2^64, so `-1n` would lower as `u64::MAX` and `2n**64n`
+    // as `0`.
+    js::bigint::fits_u64(bi).ok_or_else(|| throw_type_error(scope, c"u64 BigInt is out of range"))
+}
+
+/// Lower an `s64`, which must be a BigInt in `[-2^63, 2^63)`. A number is
+/// rejected, as assigning one to a `BigInt64Array` element is.
+pub fn pop_s64(stack: &mut CallStack, scope: &Scope<'_>) -> Result<i64, ExnThrown> {
+    return_shaped!(stack, S64);
+    let v = scope.root_value(stack.pop_value());
+    if !v.is_bigint() {
+        return Err(throw_type_error(scope, c"expected an s64 (BigInt)"));
+    }
+    let bi = js::bigint::to_bigint(scope, v)?;
+    // `to_int64` is modulo 2^64, so `2n**63n` would lower as `i64::MIN`.
+    js::bigint::fits_i64(bi).ok_or_else(|| throw_type_error(scope, c"s64 BigInt is out of range"))
+}
+
+pub fn pop_f32(stack: &mut CallStack, scope: &Scope<'_>) -> Result<f32, ExnThrown> {
+    return_shaped!(stack, F32);
+    let v = scope.root_value(stack.pop_value());
+    Ok(pop_number(v, scope, c"expected an f32")? as f32)
+}
+
+pub fn pop_f64(stack: &mut CallStack, scope: &Scope<'_>) -> Result<f64, ExnThrown> {
+    return_shaped!(stack, F64);
+    let v = scope.root_value(stack.pop_value());
+    pop_number(v, scope, c"expected an f64")
+}
+
+/// Lower a `char`: the JS value must be a string holding exactly one Unicode
+/// scalar value.
+///
+/// The scalar value may be a single UTF-16 code unit or a surrogate pair. A
+/// lone surrogate is rejected.
+pub fn pop_char(stack: &mut CallStack, scope: &Scope<'_>) -> Result<char, ExnThrown> {
+    return_shaped!(stack, Char);
+    const NOT_A_CHAR: &std::ffi::CStr = c"expected a char (a string of one Unicode scalar value)";
+    let v = scope.root_value(stack.pop_value());
+    if !v.is_string() {
+        return Err(throw_type_error(scope, NOT_A_CHAR));
+    }
+    let s = js::JSString::from_value(scope, v)?;
+    let units = match s.len() {
+        1 => [s.char_at(scope, 0)?, 0],
+        2 => [s.char_at(scope, 0)?, s.char_at(scope, 1)?],
+        _ => return Err(throw_type_error(scope, NOT_A_CHAR)),
+    };
+    let len = if s.len() == 1 { 1 } else { 2 };
+    let mut decoded = char::decode_utf16(units[..len].iter().copied());
+    match (decoded.next(), decoded.next()) {
+        (Some(Ok(c)), None) => Ok(c),
+        // A lone surrogate, or two code units that are two characters.
+        _ => Err(throw_type_error(scope, NOT_A_CHAR)),
+    }
+}
+
+/// Lower a string into an owned UTF-8 `String`.
+pub fn pop_string(stack: &mut CallStack, scope: &Scope<'_>) -> Result<String, ExnThrown> {
+    return_shaped!(stack, String);
+    let v = scope.root_value(stack.pop_value());
+    if !v.is_string() {
+        return Err(throw_type_error(scope, c"expected a string"));
+    }
+    String::from_jsval_throwing(scope, v, ())
+}
+
+/// Lower a record. The fields are read by name and pushed onto the stack so
+/// that the first field is on top.
+pub fn pop_record(
+    stack: &mut CallStack,
+    scope: &Scope<'_>,
+    field_names: &[&'static CStr],
+) -> Result<(), ExnThrown> {
+    if let Some(shaped) = stack.pop_shaped() {
+        let TypeShapeValue::Record(fields) = shaped else {
+            mismatched_shape("record")
+        };
+        push_shaped_reversed(stack, fields);
+        return Ok(());
+    }
+    let obj = pop_object(stack, scope, c"expected a record (object)")?;
+    for name in field_names.iter().rev() {
+        let field = obj.get_property(scope, name)?;
+        stack.push_value(field.get());
+    }
+    Ok(())
+}
+
+/// Lower a tuple. The elements are read and pushed onto the stack so that the
+/// first element is on top.
+pub fn pop_tuple(stack: &mut CallStack, scope: &Scope<'_>, count: usize) -> Result<(), ExnThrown> {
+    if let Some(shaped) = stack.pop_shaped() {
+        let TypeShapeValue::Tuple(elements) = shaped else {
+            mismatched_shape("tuple")
+        };
+        push_shaped_reversed(stack, elements);
+        return Ok(());
+    }
+    let obj = pop_object(stack, scope, c"expected a tuple (array)")?;
+    for index in 0..count {
+        let elem = obj.get_element(scope, (count - index - 1) as u32)?;
+        stack.push_value(elem.get());
+    }
+    Ok(())
+}
+
+/// Lower a variant `{tag, val}`. Returns the index of the case named by `tag`.
+/// If the case has a value, `val` is pushed onto the stack.
+pub fn pop_variant(
+    stack: &mut CallStack,
+    scope: &Scope<'_>,
+    cases: &[(&'static CStr, bool)],
+) -> Result<u32, ExnThrown> {
+    if let Some(shaped) = stack.pop_shaped() {
+        let TypeShapeValue::Variant(case, payload) = shaped else {
+            mismatched_shape("variant")
+        };
+        if let Some(payload) = payload {
+            stack.push_shaped(*payload);
+        }
+        return Ok(case);
+    }
+    let obj = pop_object(stack, scope, c"expected a variant (object)")?;
+    let discriminant = tag_index(&obj, scope, cases.iter().map(|(name, _)| *name))?
+        .ok_or_else(|| throw_type_error(scope, c"variant tag does not match any case"))?;
+    if cases[discriminant].1 {
+        let val = obj.get_property(scope, c"val")?;
+        stack.push_value(val.get());
+    }
+    Ok(discriminant as u32)
+}
+
+/// Lower an enum value, given as the index of its case. The index must be less
+/// than `case_count`.
+pub fn pop_enum(
+    stack: &mut CallStack,
+    scope: &Scope<'_>,
+    case_count: u32,
+) -> Result<u32, ExnThrown> {
+    return_shaped!(stack, Enum);
+    let index = pop_u32(stack, scope)?;
+    if index < case_count {
+        Ok(index)
+    } else {
+        Err(throw_type_error(
+            scope,
+            c"enum value is not one of the declared cases",
+        ))
+    }
+}
+
+/// Lower an option. Returns `false` for `none`, given as `undefined` or `null`.
+/// Returns `true` for `some`, and leaves the value on the stack. If the inner
+/// type is also an option, the value is given as `{val}`, and `val` is pushed
+/// onto the stack instead.
+pub fn pop_option(
+    stack: &mut CallStack,
+    scope: &Scope<'_>,
+    inner_is_option: bool,
+) -> Result<bool, ExnThrown> {
+    if let Some(shaped) = stack.pop_shaped() {
+        let TypeShapeValue::Option(payload) = shaped else {
+            mismatched_shape("option")
+        };
+        return Ok(match payload {
+            Some(payload) => {
+                stack.push_shaped(*payload);
+                true
+            }
+            None => false,
+        });
+    }
+    if stack.last().is_null_or_undefined() {
+        stack.pop_value();
+        Ok(false)
+    } else if inner_is_option {
+        let obj = pop_object(stack, scope, c"expected a nested option wrapper (object)")?;
+        let val = obj.get_property(scope, c"val")?;
+        stack.push_value(val.get());
+        Ok(true)
+    } else {
+        // Leave the payload value on the stack as-is.
+        Ok(true)
+    }
+}
+
+/// Lower a result `{tag, val}`. Returns 0 for `ok` and 1 for `err`. If the case
+/// has a value, `val` is pushed onto the stack.
+pub fn pop_result(
+    stack: &mut CallStack,
+    scope: &Scope<'_>,
+    ok_has_payload: bool,
+    err_has_payload: bool,
+) -> Result<u32, ExnThrown> {
+    if let Some(shaped) = stack.pop_shaped() {
+        let TypeShapeValue::Result(result) = shaped else {
+            mismatched_shape("result")
+        };
+        let (discriminant, payload) = match result {
+            Ok(payload) => (0, payload),
+            Err(payload) => (1, payload),
+        };
+        if let Some(payload) = payload {
+            stack.push_shaped(*payload);
+        }
+        return Ok(discriminant);
+    }
+    let obj = pop_object(stack, scope, c"expected a result (object)")?;
+    let (discriminant, has_payload) = match tag_index(&obj, scope, [c"ok", c"err"].into_iter())? {
+        Some(0) => (0u32, ok_has_payload),
+        Some(_) => (1u32, err_has_payload),
+        None => {
+            return Err(throw_type_error(
+                scope,
+                c"result tag must be \"ok\" or \"err\"",
+            ))
+        }
+    };
+    if has_payload {
+        let val = obj.get_property(scope, c"val")?;
+        stack.push_value(val.get());
+    }
+    Ok(discriminant)
+}
+
+/// Lower a flags value, given as its bit set, checking that no bit at or above
+/// `flag_count` is set. The set is an int32, such as the result of a bitwise-or
+/// of flags, or a number in the `u32` range. A negative int32 has bit 31 set.
+pub fn pop_flags(
+    stack: &mut CallStack,
+    scope: &Scope<'_>,
+    flag_count: u32,
+) -> Result<u32, ExnThrown> {
+    return_shaped!(stack, Flags);
+    const NOT_FLAGS: &std::ffi::CStr = c"expected a flags value (a number)";
+    let bits = if stack.last().is_int32() {
+        stack.pop_value().to_int32() as u32
+    } else if stack.last().is_number() {
+        pop_int_in_range(stack, scope, NOT_FLAGS)?
+    } else {
+        stack.pop_value();
+        return Err(throw_type_error(scope, NOT_FLAGS));
+    };
+    let declared = if flag_count >= u32::BITS {
+        u32::MAX
+    } else {
+        (1u32 << flag_count) - 1
+    };
+    if bits & !declared == 0 {
+        Ok(bits)
+    } else {
+        Err(throw_type_error(
+            scope,
+            c"flags value has a bit that names no declared flag",
+        ))
+    }
+}
+
+// ===========================================================================
+// Lists
+// ===========================================================================
+
+/// Begin lifting a list that isn't lifted as a typed array, by pushing an array
+/// of length `capacity` onto the stack. `capacity` must be the number of
+/// elements. Each element is lifted and then added with [`list_append`].
+pub fn push_list_begin(
+    stack: &mut CallStack,
+    scope: &Scope<'_>,
+    capacity: usize,
+) -> Result<(), ExnThrown> {
+    let arr = js::Array::new(scope, capacity)?;
+    stack.push_object(&arr);
+    stack.lift_list_begin(capacity);
+    Ok(())
+}
+
+/// Pop the value on top of the stack and add it to the array beneath it, which
+/// was pushed by [`push_list_begin`]. The values are stored at consecutive
+/// indices, starting at 0.
+pub fn list_append(stack: &mut CallStack, scope: &Scope<'_>) -> Result<(), ExnThrown> {
+    let elem = scope.root_value(stack.pop_value());
+    let index = stack.lift_list_next();
+    let arr = js::Object::from_raw_value(scope, stack.last())
+        .map_err(|_| throw_type_error(scope, c"list value is not an object"))?;
+    arr.define_element(scope, index as u32, elem, ENUMERATE)?;
+    Ok(())
+}
+
+/// A non-empty buffer from the global allocator, freed with `layout` when
+/// dropped.
+struct OwnedBuffer {
+    ptr: std::ptr::NonNull<u8>,
+    layout: std::alloc::Layout,
+}
+
+// SAFETY: `OwnedBuffer` exclusively owns its heap allocation.
+unsafe impl js::typedarray::ExternalBytes for OwnedBuffer {
+    fn as_mut_slice(&mut self) -> &mut [u8] {
+        // SAFETY: `ptr` points to `layout.size()` initialized bytes this value owns.
+        unsafe { std::slice::from_raw_parts_mut(self.ptr.as_ptr(), self.layout.size()) }
+    }
+}
+
+impl Drop for OwnedBuffer {
+    fn drop(&mut self) {
+        // SAFETY: `ptr` was allocated by the global allocator with `layout`.
+        unsafe { std::alloc::dealloc(self.ptr.as_ptr(), self.layout) };
+    }
+}
+
+/// Lift a `count`-element numeric list into the matching typed array, adopting
+/// its buffer instead of copying it.
+///
+/// # Safety
+///
+/// With `count > 0`, `data` must be a non-null allocation of the global
+/// allocator made with `layout`, holding `count` valid, contiguous elements of
+/// `elem`'s native type, and ownership of the allocation transfers to this
+/// function. With `count == 0`, `data` and `layout` are not used.
+pub unsafe fn push_numeric_list(
+    stack: &mut CallStack,
+    scope: &Scope<'_>,
+    elem: &TypeShape,
+    data: *mut u8,
+    layout: std::alloc::Layout,
+    count: usize,
+) -> Result<(), ExnThrown> {
+    let kind = elem
+        .view_kind()
+        .expect("push_numeric_list called for a non-typed-array element");
+    let buffer = match std::ptr::NonNull::new(data).filter(|_| count > 0) {
+        Some(ptr) => js::ArrayBuffer::from_external(scope, OwnedBuffer { ptr, layout })?,
+        None => js::ArrayBuffer::new(scope, 0)?,
+    };
+    let array = js::typedarray::construct_view(scope, kind, buffer, 0, count)?;
+    stack.push_value(array.as_value());
+    Ok(())
+}
+
+/// Lower a numeric typed-array list into a freshly allocated canonical-ABI
+/// buffer.
+///
+/// The typed array's element type must match `elem`, except that a
+/// `Uint8ClampedArray` is also accepted for `list<u8>`.
+///
+/// Returns the buffer, its layout and the element count. The caller owns the
+/// buffer and must free it with that layout. For an empty list, nothing is
+/// allocated and the pointer is dangling but aligned.
+pub fn pop_numeric_list(
+    stack: &mut CallStack,
+    scope: &Scope<'_>,
+    elem: &TypeShape,
+) -> Result<(*mut u8, std::alloc::Layout, usize), ExnThrown> {
+    if let Some(shaped) = stack.pop_shaped() {
+        let TypeShapeValue::NumericList(list) = shaped else {
+            mismatched_shape("numeric list")
+        };
+        return Ok(list.into_raw(elem));
+    }
+    let obj = pop_object(stack, scope, c"expected a typed-array list")?;
+    let view = js::ArrayBufferView::from_object(obj)
+        .ok_or_else(|| throw_type_error(scope, c"expected a typed array"))?;
+    if !elem.accepts_view_kind(view.view_kind()) {
+        return Err(throw_type_error(
+            scope,
+            c"typed-array element kind does not match the list element type",
+        ));
+    }
+    Ok(NumericList::copy(scope, view, elem)?.into_raw(elem))
+}
+
+// ===========================================================================
+// Helpers
+// ===========================================================================
+
+/// The attributes of a property created by an object literal.
+pub(crate) const ENUMERATE: std::ffi::c_uint = js::class_spec::JSPROP_ENUMERATE as std::ffi::c_uint;
+
+/// Convert a mangled identifier into a `CString` for use as a property name.
+pub fn to_cstring(s: &str) -> CString {
+    CString::new(s).expect("mangled identifiers contain no interior NUL")
+}
+
+fn set_tag(obj: &js::Object<'_>, scope: &Scope<'_>, tag: &'static CStr) -> Result<(), ExnThrown> {
+    // The tag is the string of a cached property key, so all lifted values with
+    // the same tag share one string.
+    let tag_id = js::class::get_or_init_property_id(scope, tag)?;
+    let tag_value = js::id::id_to_value(scope, *tag_id)?;
+    obj.define_property(scope, c"tag", tag_value, ENUMERATE)
+}
+
+/// The index of the `tag` property's value among `names`, or `None` if it is
+/// not a string or matches none of them.
+pub(crate) fn tag_index<'a>(
+    obj: &js::Object<'_>,
+    scope: &Scope<'_>,
+    names: impl Iterator<Item = &'a CStr>,
+) -> Result<Option<usize>, ExnThrown> {
+    let tag = obj.get_property(scope, c"tag")?;
+    if !tag.is_string() {
+        return Ok(None);
+    }
+    let s = js::JSString::from_value(scope, tag)?;
+    for (index, name) in names.enumerate() {
+        if s.equals_ascii(scope, name)? {
+            return Ok(Some(index));
+        }
+    }
+    Ok(None)
+}
+
+/// Push `values` onto `stack` so that the first one is on top.
+fn push_shaped_reversed(stack: &mut CallStack, values: Vec<TypeShapeValue>) {
+    for value in values.into_iter().rev() {
+        stack.push_shaped(value);
+    }
+}
+
+/// Pop a value expected to be an object, rooting it.
+fn pop_object<'s>(
+    stack: &mut CallStack,
+    scope: &'s Scope<'_>,
+    err: &std::ffi::CStr,
+) -> Result<js::Object<'s>, ExnThrown> {
+    // The popped value is passed directly to `from_raw_value`, which roots it,
+    // so it is never held in an unrooted local.
+    js::Object::from_raw_value(scope, stack.pop_value()).map_err(|_| throw_type_error(scope, err))
+}
+
+/// Extract a number from a value, accepting int32 and double, including NaN and
+/// the infinities.
+fn pop_number(
+    v: HandleValue<'_>,
+    scope: &Scope<'_>,
+    err: &std::ffi::CStr,
+) -> Result<f64, ExnThrown> {
+    if v.is_number() {
+        Ok(v.to_number())
+    } else {
+        Err(throw_type_error(scope, err))
+    }
+}
+
+/// Pop a small-integer value and narrow it into `T`, rejecting out-of-range and
+/// non-integer inputs.
+fn pop_int_in_range<T: TryFrom<i64>>(
+    stack: &mut CallStack,
+    scope: &Scope<'_>,
+    err: &std::ffi::CStr,
+) -> Result<T, ExnThrown> {
+    let v = scope.root_value(stack.pop_value());
+    let n = if v.is_int32() {
+        v.to_int32() as i64
+    } else if v.is_number() {
+        // Reject NaN, infinities and fractional values rather than truncating,
+        // since `3.7 as i64 == 3`, and values outside the `i64` range rather
+        // than saturating. `T::try_from` below rejects values outside `T`.
+        let n = v.to_number();
+        let in_range = (-9223372036854775808.0..9223372036854775808.0).contains(&n);
+        if !(n.is_finite() && n.fract() == 0.0 && in_range) {
+            return Err(throw_type_error(scope, err));
+        }
+        n as i64
+    } else {
+        return Err(throw_type_error(scope, err));
+    };
+    T::try_from(n).map_err(|_| throw_type_error(scope, err))
+}
diff --git a/crates/wit-bridge/tests/exports_native.rs b/crates/wit-bridge/tests/exports_native.rs
new file mode 100644
index 00000000..c5daa4a4
--- /dev/null
+++ b/crates/wit-bridge/tests/exports_native.rs
@@ -0,0 +1,556 @@
+// SPDX-License-Identifier: Apache-2.0-WITH-LLVM-exception
+
+//! Native integration tests for runtime bootstrap and export dispatch.
+//!
+//! These run against the runtime [`initialize_runtime`] sets up. The cases are
+//! grouped in a single test because it can be called only once per process.
+
+use core_runtime::runtime::register_global_initializer;
+use js::gc::scope::Scope;
+use wit_bridge::exports::with_export_table;
+use wit_bridge::{
+    call_export, initialize_runtime, install_table, resolve_export, shutdown_runtime,
+    with_main_scope, ExportSpec, ExportTable, Outcome, Resolved, ResultShape, TypeShape,
+};
+use wit_name_mapping::{mangle_name, InterfaceNames, Shape};
+
+mod shared;
+use shared::{as_number, as_string, force_gc, num};
+
+/// The application's main module. It exports plain functions, an object with
+/// the functions of an interface, and a class implementing a resource, with an
+/// instance method and static methods.
+const MAIN: &str = r#"
+    export function add(a, b) { return a + b; }
+
+    export function boom() { throw new Error("boom from add-side"); }
+
+    // A result-typed export that throws a ComponentError: its `.payload`
+    // becomes the `err` value.
+    export function boomComponent() { throw new ComponentError({ reason: "wit-err" }); }
+
+    // Result-typed exports that throw an `err` value without a ComponentError:
+    // an Error whose message is an enum case, and a plain value.
+    export function boomCase() { throw new Error("notFound"); }
+    export function boomBare() { throw "bare payload"; }
+
+    // Errors whose `message` is read by a getter that throws, and whose
+    // `message` isn't a string.
+    export function boomGetter() {
+        const e = new Error("unused");
+        Object.defineProperty(e, "message", {
+            get() { throw new Error("message getter boom"); },
+        });
+        throw e;
+    }
+    export function boomNumber() {
+        const e = new Error();
+        e.message = 42;
+        throw e;
+    }
+
+    export const myIface = {
+        ping: function() { return "pong"; },
+        doubleIt: function(v) { return v * 2; },
+    };
+
+    export class Counter {
+        constructor(start) { this.value = start; }
+        bump(by) { this.value += by; return this.value; }
+        static origin() { return new Counter(0); }
+        static label() { return "Counter"; }
+    }
+
+    // A class whose method is a getter that throws.
+    export class Flaky {
+        get bump() { throw new Error("getter boom"); }
+    }
+
+    // Items in the package layer, the interface layer and the versioned layer,
+    // and one provided in two shapes.
+    export const demoApp = { api: { greet() { return "package layer"; } } };
+    export const twice = { hello() { return "interface layer"; } };
+    export function hello() { return "bare"; }
+    const v2 = { greet() { return "versioned layer"; } };
+    export { v2 as "demo:app/api@2.0.0" };
+"#;
+
+#[test]
+fn exports_native() {
+    // `ComponentError` must be on the global before the main module evaluates,
+    // exactly as the dylib registers it.
+    register_global_initializer(wit_bridge::add_to_global);
+
+    // This application imports nothing, so synthesis does nothing.
+    initialize_runtime(
+        &core_runtime::config::RuntimeConfig::default(),
+        MAIN,
+        "main.js",
+        None,
+        |_scope| Ok(()),
+    )
+    .expect("runtime bootstrap failed");
+
+    // A GC right after bootstrap, before anything resolves, would expose a
+    // missing root on the stored main-module record as a crash.
+    with_main_scope(|scope, _ns| force_gc(scope));
+
+    resource_constructor_method_and_statics();
+    component_error_becomes_err_when_result_typed();
+    plain_error_traps_for_an_err_type_without_a_message_form();
+    thrown_values_coerce_to_err_payloads();
+    exception_traps_when_not_result_typed();
+    export_table_resolves_every_kind();
+    export_table_finds_the_providing_shape();
+    missing_export_message_names_the_js_export();
+    shutdown_runtime();
+}
+
+/// Read a JS number out of a returned [`Outcome`], accepting int32 and double.
+fn returned_number(outcome: &Outcome) -> f64 {
+    let v = match outcome {
+        Outcome::Returned(v) => v,
+        Outcome::Threw(_) => panic!("expected a returned value, got a thrown one"),
+    };
+    as_number(v.get())
+}
+
+/// Read a UTF-8 string out of a returned [`Outcome`].
+fn returned_string(scope: &Scope<'_>, outcome: &Outcome) -> String {
+    let v = match outcome {
+        // The value is already rooted on the call's scope.
+        Outcome::Returned(v) => *v,
+        Outcome::Threw(_) => panic!("expected a returned value, got a thrown one"),
+    };
+    as_string(scope, v)
+}
+
+/// A resource class resolves its `[constructor]`, `[method]`, and `[static]`
+/// forms, and a method receives the receiver as `args[0]`.
+fn resource_constructor_method_and_statics() {
+    with_main_scope(|scope, ns| {
+        // [constructor]counter → construct with [10] → an object.
+        let ctor = resolve_export(scope, ns, "[constructor]counter")
+            .expect("`[constructor]counter` resolves");
+        assert!(
+            matches!(ctor, wit_bridge::Resolved::Constructor { .. }),
+            "resolves to a constructor"
+        );
+        force_gc(scope);
+        let outcome = call_export(scope, ctor, &[num(scope, 10)], &ResultShape::Plain)
+            .expect("constructor does not trap");
+        let counter = match outcome {
+            // The constructed object is already rooted on the call's scope.
+            Outcome::Returned(v) => v,
+            Outcome::Threw(_) => panic!("constructor threw"),
+        };
+        assert!(counter.is_object(), "construction yields an object");
+        let counter_this = counter;
+
+        // [method]counter.bump → Counter.prototype.bump, receiver as args[0].
+        let bump = resolve_export(scope, ns, "[method]counter.bump")
+            .expect("`[method]counter.bump` resolves");
+        assert!(
+            matches!(bump, wit_bridge::Resolved::Method { .. }),
+            "resolves to a method"
+        );
+        force_gc(scope);
+        let args = [counter_this, num(scope, 5)];
+        let outcome =
+            call_export(scope, bump, &args, &ResultShape::Plain).expect("method does not trap");
+        assert_eq!(returned_number(&outcome), 15.0, "bump(5) on start=10 == 15");
+
+        // [static]counter.origin → a Counter object.
+        let origin = resolve_export(scope, ns, "[static]counter.origin")
+            .expect("`[static]counter.origin` resolves");
+        assert!(
+            matches!(origin, wit_bridge::Resolved::Static { .. }),
+            "resolves to a static method"
+        );
+        let outcome =
+            call_export(scope, origin, &[], &ResultShape::Plain).expect("static does not trap");
+        match outcome {
+            Outcome::Returned(v) => assert!(v.is_object(), "origin() returns a Counter object"),
+            Outcome::Threw(_) => panic!("origin() threw"),
+        }
+
+        // [static]counter.label → "Counter".
+        let label = resolve_export(scope, ns, "[static]counter.label")
+            .expect("`[static]counter.label` resolves");
+        let outcome =
+            call_export(scope, label, &[], &ResultShape::Plain).expect("static does not trap");
+        assert_eq!(returned_string(scope, &outcome), "Counter");
+    });
+}
+
+/// A result-typed export that throws a `ComponentError` returns
+/// `Outcome::Threw` with the error's `payload`, not the error itself.
+fn component_error_becomes_err_when_result_typed() {
+    with_main_scope(|scope, ns| {
+        let boom = resolve_export(scope, ns, "boom-component").expect("`boom-component` resolves");
+        force_gc(scope);
+        let outcome = call_export(scope, boom, &[], &result_with_err(TypeShape::String))
+            .expect("a ComponentError thrown by a result-typed export doesn't trap");
+        match outcome {
+            Outcome::Threw(v) => {
+                // The value is the error's `payload`, `{ reason: "wit-err" }`,
+                // which is already rooted.
+                let obj = js::Object::from_value(scope, v).expect("payload is an object");
+                let reason = obj
+                    .get_property(scope, c"reason")
+                    .expect("payload has reason");
+                assert_eq!(as_string(scope, reason), "wit-err");
+            }
+            Outcome::Returned(_) => panic!("boomComponent() should have thrown"),
+        }
+        assert!(!js::exception::is_pending(scope));
+    });
+}
+
+/// A result-typed export that throws an `Error` that can't be converted into
+/// its `err` type, here a `u32`, traps, which `call_export` reports as `Err`.
+fn plain_error_traps_for_an_err_type_without_a_message_form() {
+    with_main_scope(|scope, ns| {
+        let boom = resolve_export(scope, ns, "boom").expect("`boom` resolves");
+        force_gc(scope);
+        let Err(err) = call_export(scope, boom, &[], &result_with_err(TypeShape::U32)) else {
+            panic!("a non-ComponentError throw traps even for a result-typed export");
+        };
+        let message = err.message.expect("the trap carries a message");
+        assert!(
+            message.contains("boom from add-side")
+                && message.contains("can only be converted into an `err` value of type `string`"),
+            "the trap message includes the thrown text and the reason, got: {message}"
+        );
+        assert!(!js::exception::is_pending(scope));
+    });
+}
+
+/// A `result` with no `ok` payload and an `err` payload of type `err`.
+fn result_with_err(err: TypeShape) -> ResultShape {
+    ResultShape::Result {
+        ok: false,
+        err: Some(std::rc::Rc::new(err)),
+    }
+}
+
+/// An exception thrown by a result-typed export is converted into an `err`
+/// value: an `Error`'s message for a `string` `E`, the index of the case named
+/// by its message for an `enum` `E`, the value itself for a value that isn't an
+/// `Error`, and `undefined` for an `err` case without a value.
+fn thrown_values_coerce_to_err_payloads() {
+    with_main_scope(|scope, ns| {
+        let threw = |name: &str, result: &ResultShape| {
+            let resolved = resolve_export(scope, ns, name).expect("the export resolves");
+            match call_export(scope, resolved, &[], result).expect("the exception is converted") {
+                Outcome::Threw(payload) => payload,
+                Outcome::Returned(_) => panic!("{name}() should have thrown"),
+            }
+        };
+
+        let payload = threw("boom", &result_with_err(TypeShape::String));
+        assert_eq!(as_string(scope, payload), "boom from add-side");
+
+        let cases = TypeShape::Enum(vec!["notFound".to_string(), "denied".to_string()]);
+        let payload = threw("boom-case", &result_with_err(cases));
+        assert_eq!(payload.to_int32(), 0, "`notFound` is the enum's first case");
+
+        let payload = threw("boom-bare", &result_with_err(TypeShape::String));
+        assert_eq!(as_string(scope, payload), "bare payload");
+
+        let no_payload = ResultShape::Result {
+            ok: false,
+            err: None,
+        };
+        let payload = threw("boom", &no_payload);
+        assert!(
+            payload.is_undefined(),
+            "the value of an `err` case without a value is `undefined`"
+        );
+        let payload = threw("boom-component", &no_payload);
+        assert!(
+            payload.is_undefined(),
+            "the payload of a ComponentError is dropped for an `err` case without a value"
+        );
+
+        // A `message` that isn't a string is converted to one.
+        let payload = threw("boom-number", &result_with_err(TypeShape::String));
+        assert!(payload.is_string(), "the `err` value is a string");
+        assert_eq!(as_string(scope, payload), "42");
+        let cases = TypeShape::Variant(vec![("42".to_string(), None)]);
+        let payload = threw("boom-number", &result_with_err(cases));
+        let tag = js::Object::from_value(scope, payload)
+            .expect("the `err` value is an object")
+            .get_property(scope, c"tag")
+            .expect("the `err` value has a tag");
+        assert!(tag.is_string(), "the tag is a string");
+
+        // An `Error` whose message names no case of an `enum` `E` isn't
+        // converted, and the trap message gives the reason.
+        let failed = |name: &str, result: &ResultShape| {
+            let resolved = resolve_export(scope, ns, name).expect("the export resolves");
+            let Err(err) = call_export(scope, resolved, &[], result) else {
+                panic!("{name}() must trap");
+            };
+            assert!(!js::exception::is_pending(scope));
+            err.message.expect("the trap has a message")
+        };
+        let cases = TypeShape::Enum(vec!["denied".to_string()]);
+        let message = failed("boom-case", &result_with_err(cases));
+        assert!(
+            message.contains("notFound")
+                && message.contains("names no case of the `err` type, which has the cases denied"),
+            "{message}"
+        );
+
+        // A `message` getter that throws is reported.
+        let message = failed("boom-getter", &result_with_err(TypeShape::String));
+        assert!(
+            message.contains("reading the error's `message` threw")
+                && message.contains("message getter boom"),
+            "{message}"
+        );
+    });
+}
+
+/// A throwing export whose result type isn't a `result` traps, which
+/// `call_export` reports as `Err` with the thrown message.
+fn exception_traps_when_not_result_typed() {
+    with_main_scope(|scope, ns| {
+        let boom = resolve_export(scope, ns, "boom").expect("`boom` resolves");
+        force_gc(scope);
+        let Err(err) = call_export(scope, boom, &[], &ResultShape::Plain) else {
+            panic!("a non-result export propagates the throw as a trap");
+        };
+        let message = err.message.expect("the trap carries a message");
+        assert!(
+            message.contains("boom from add-side"),
+            "the trap message includes the thrown text, got: {message}"
+        );
+    });
+}
+
+/// An export spec for `name` on `interface`, with a plain result, provided in
+/// the interface layer, or bare for a world-level export.
+fn spec(interface: Option<&str>, name: &str) -> ExportSpec {
+    let shapes = match interface {
+        Some(interface) => vec![Shape::Interface(mangle_name(interface))],
+        None => vec![Shape::Bare],
+    };
+    shaped_spec(interface, name, shapes)
+}
+
+/// An export spec for `name` on `interface`, with a plain result, provided in
+/// one of `shapes`.
+fn shaped_spec(interface: Option<&str>, name: &str, shapes: Vec<Shape>) -> ExportSpec {
+    ExportSpec {
+        interface: interface.map(str::to_string),
+        name: name.to_string(),
+        shapes,
+        result: ResultShape::Plain,
+        optional: false,
+    }
+}
+
+/// Every shape returned by `possible_export_names` for `name` on `interface`,
+/// for a world that exports only that function.
+fn all_shapes(interface: &str, name: &str) -> Vec<Shape> {
+    let item = wit_name_mapping::item_js_name(name);
+    let items = [(Some(InterfaceNames::of(interface)), item)];
+    wit_name_mapping::possible_export_names(&items, &[])
+        .unwrap()
+        .remove(0)
+}
+
+/// `ExportTable::build` finds each export in the one shape that provides it,
+/// and fails for an export two shapes provide.
+fn export_table_finds_the_providing_shape() {
+    with_main_scope(|scope, ns| {
+        let specs = [
+            shaped_spec(
+                Some("demo:app/api"),
+                "greet",
+                all_shapes("demo:app/api", "greet"),
+            ),
+            shaped_spec(
+                Some("demo:app/api@2.0.0"),
+                "greet",
+                vec![Shape::Versioned("demo:app/api@2.0.0".to_string())],
+            ),
+        ];
+        let table = ExportTable::build(scope, ns, specs).expect("every export resolves");
+        for (index, expected) in [(0, "package layer"), (1, "versioned layer")] {
+            let outcome = call_export(
+                scope,
+                table.resolved(scope, index),
+                &[],
+                &ResultShape::Plain,
+            )
+            .expect("`greet` does not trap");
+            assert_eq!(returned_string(scope, &outcome), expected);
+        }
+
+        let err = ExportTable::build(
+            scope,
+            ns,
+            [shaped_spec(
+                Some("demo:app/twice"),
+                "hello",
+                all_shapes("demo:app/twice", "hello"),
+            )],
+        )
+        .err()
+        .expect("an export provided twice fails the build");
+        assert!(
+            err.contains(
+                "provides the WIT export `demo:app/twice#hello` twice, as `twice.hello` and as \
+                 `hello`"
+            ),
+            "{err}"
+        );
+        assert!(!js::exception::is_pending(scope));
+    });
+}
+
+/// `ExportTable::build` resolves a plain export, an interface member, and a
+/// resource's constructor, method and static in order, and `install_table`
+/// makes the same table reachable through `with_export_table`, whose entries
+/// are callable.
+fn export_table_resolves_every_kind() {
+    with_main_scope(|scope, ns| {
+        let specs = [
+            spec(None, "add"),
+            spec(Some("my-iface"), "ping"),
+            spec(None, "[constructor]counter"),
+            spec(None, "[method]counter.bump"),
+            spec(None, "[static]counter.label"),
+        ];
+        let table = ExportTable::build(scope, ns, specs).expect("every export resolves");
+        // A table that is not installed keeps its entries alive across a
+        // compacting GC.
+        js::gc::prepare_for_full_gc(scope);
+        js::gc::non_incremental_gc(scope, js::gc::GCOptions::Shrink, js::gc::GCReason::API);
+        assert_eq!(table.len(), 5);
+        assert!(matches!(table.resolved(scope, 0), Resolved::Plain { .. }));
+        assert!(matches!(table.resolved(scope, 1), Resolved::Plain { .. }));
+        assert!(matches!(
+            table.resolved(scope, 2),
+            Resolved::Constructor { .. }
+        ));
+        assert!(matches!(table.resolved(scope, 3), Resolved::Method { .. }));
+        assert!(matches!(table.resolved(scope, 4), Resolved::Static { .. }));
+        assert_eq!(table.result(0), ResultShape::Plain);
+        assert!(table.provided(0));
+
+        // An optional export the main module leaves out builds as unprovided.
+        let absent = ExportSpec {
+            optional: true,
+            ..spec(None, "not-exported")
+        };
+        let table =
+            ExportTable::build(scope, ns, [absent]).expect("an optional export may be absent");
+        assert!(!table.provided(0));
+
+        let specs = [
+            spec(None, "add"),
+            spec(Some("my-iface"), "double-it"),
+            spec(None, "[static]counter.label"),
+        ];
+        install_table(scope, ns, specs).expect("the table installs");
+        force_gc(scope);
+        with_export_table(|table| {
+            assert_eq!(table.len(), 3);
+            let outcome = call_export(
+                scope,
+                table.resolved(scope, 0),
+                &[num(scope, 20), num(scope, 22)],
+                &ResultShape::Plain,
+            )
+            .expect("`add` does not trap");
+            assert_eq!(returned_number(&outcome), 42.0);
+            let outcome = call_export(
+                scope,
+                table.resolved(scope, 1),
+                &[num(scope, 4)],
+                &ResultShape::Plain,
+            )
+            .expect("`doubleIt` does not trap");
+            assert_eq!(returned_number(&outcome), 8.0);
+            let outcome = call_export(scope, table.resolved(scope, 2), &[], &ResultShape::Plain)
+                .expect("`label` does not trap");
+            assert_eq!(returned_string(scope, &outcome), "Counter");
+        });
+    });
+}
+
+/// A spec whose member is missing makes `ExportTable::build` and
+/// `install_table` fail with a message naming the JS export the main module
+/// must provide and the statement that would define it, and leaves no
+/// exception pending.
+fn missing_export_message_names_the_js_export() {
+    with_main_scope(|scope, ns| {
+        let err = ExportTable::build(scope, ns, [spec(Some("my-iface"), "nope")])
+            .err()
+            .expect("a missing interface member fails the build");
+        assert!(
+            err.contains(
+                "does not provide a function `nope` for the WIT export `my-iface#nope`. Export it \
+                 as `myIface.nope`, for example: export const myIface = { nope(...) { ... } };"
+            ),
+            "{err}"
+        );
+        let shapes = all_shapes("demo:app/api", "nope");
+        let err = ExportTable::build(
+            scope,
+            ns,
+            [shaped_spec(Some("demo:app/api"), "nope", shapes)],
+        )
+        .err()
+        .expect("a missing export fails the build");
+        assert!(
+            err.contains(
+                "Export it as `demoApp.api.nope` or `api.nope` or `nope`, for example: export \
+                 function nope(...) { ... }"
+            ),
+            "{err}"
+        );
+        assert!(!js::exception::is_pending(scope));
+
+        let err = install_table(
+            scope,
+            ns,
+            [spec(None, "add"), spec(None, "[method]counter.gone")],
+        )
+        .expect_err("a missing method fails the install");
+        assert!(
+            err.contains(
+                "does not provide a class `Counter` with a method `gone` for the WIT export \
+                 `[method]counter.gone`. Export it as `Counter`, for example: export class \
+                 Counter { gone(...) { ... } }"
+            ),
+            "{err}"
+        );
+        assert!(!js::exception::is_pending(scope));
+
+        let err = ExportTable::build(scope, ns, [spec(None, "[constructor]missing")])
+            .err()
+            .expect("a missing class fails the build");
+        assert!(
+            err.contains("a class `Missing` with a constructor"),
+            "{err}"
+        );
+        assert!(!js::exception::is_pending(scope));
+
+        // A getter that throws while the export is resolved is reported as the
+        // exception, not as a missing export.
+        let err = ExportTable::build(scope, ns, [spec(None, "[method]flaky.bump")])
+            .err()
+            .expect("a throwing getter fails the build");
+        assert!(
+            err.contains("resolving the WIT export `[method]flaky.bump` threw")
+                && err.contains("getter boom"),
+            "{err}"
+        );
+        assert!(!js::exception::is_pending(scope));
+    });
+}
diff --git a/crates/wit-bridge/tests/imports_native.rs b/crates/wit-bridge/tests/imports_native.rs
new file mode 100644
index 00000000..0421950a
--- /dev/null
+++ b/crates/wit-bridge/tests/imports_native.rs
@@ -0,0 +1,672 @@
+// SPDX-License-Identifier: Apache-2.0-WITH-LLVM-exception
+
+//! Native integration tests for the JavaScript→host import path.
+//!
+//! A main module `import`s from a synthesized interface module, calls the
+//! imported functions and checks the lifted results. A recording
+//! [`ImportInvoker`] replaces the host call, and calls the `value::pop_*` and
+//! `push_*` functions itself.
+//!
+//! The cases are grouped in a single test because `JSEngine` can only be
+//! initialized once per process.
+
+use std::cell::RefCell;
+use std::rc::Rc;
+
+use core_runtime::runtime::register_global_initializer;
+use js::error::ExnThrown;
+use js::gc::scope::Scope;
+use js::Object;
+use wit_bridge::resources;
+use wit_bridge::value::{self, TypeShape};
+use wit_bridge::{
+    initialize_runtime, with_main_scope, CallStack, EnumDesc, ErrorClass, ImportFuncDesc,
+    ImportInvoker, InterfaceDesc, ResourceTypeDesc, WorldDesc,
+};
+
+/// The WIT name of the interface, which is the specifier of its module.
+const IFACE: &str = "test:iface/x";
+
+/// The application's main module. It imports the synthesized function `f` and the
+/// synthesized resource class `R` from the interface module, and exports
+/// functions that call them, which the test calls through `with_main_scope`.
+///
+/// The resource instance is kept in a module-level variable, so that a method
+/// call doesn't need to receive it as an argument.
+const MAIN: &str = r#"
+    import { f, fResult, fEnumErr, fAsync, R, ZeroError, AccessError, Color, Perms }
+        from "test:iface/x";
+
+    // The enum and flags objects, their reverse mappings, and whether they are
+    // frozen.
+    export function enumFacts() {
+        return JSON.stringify([
+            Color.red, Color.green, Color[1], Object.isFrozen(Color),
+            Perms.read | Perms.write, Perms.sticky, Perms[-2147483648],
+            Object.isFrozen(Perms),
+        ]);
+    }
+
+    export function callF() { return f(2, "hi"); }
+
+    // Calling an async import with a sync-only invoker throws a TypeError
+    // instead of panicking. Return the caught error's name.
+    export function callFAsync() {
+        try {
+            fAsync(1);
+            return "no throw";
+        } catch (e) {
+            return "threw:" + e.name;
+        }
+    }
+
+    export function callFResultOk() { return fResult(10); }
+    export function callFResultErr() {
+        try {
+            fResult(0);
+            return "no throw";
+        } catch (e) {
+            // The err arm throws an instance of the `err` type's class, which
+            // extends `ComponentError`, so return its payload.
+            if (!(e instanceof ZeroError) || !(e instanceof ComponentError)) {
+                return "not a ZeroError";
+            }
+            if (e.name !== "ZeroError") {
+                return `named ${e.name}`;
+            }
+            return e.payload;
+        }
+    }
+
+    // An enum `err` payload throws an instance of its type's class, whose message
+    // is the case name.
+    export function callFEnumErr() {
+        try {
+            fEnumErr(0);
+            return "no throw";
+        } catch (e) {
+            return `${e instanceof AccessError} ${e.name} ${e.message} ${e.payload}`;
+        }
+    }
+
+    let inst;
+    export function ctorR(seed) { inst = new R(seed); return inst; }
+    // The wrapper's own and inherited enumerable keys.
+    export function instKeys() {
+        const keys = [];
+        for (const key in inst) keys.push(key);
+        return JSON.stringify([Object.keys(inst), keys, Object.keys(R)]);
+    }
+    export function callM(x) { return inst.m(x); }
+    export function instHasM() { return typeof inst.m === "function"; }
+    export function callS() { return R.s(); }
+"#;
+
+mod shared;
+use shared::{as_number, as_string, force_gc, num};
+
+/// The lowered arguments of all import calls, and the index of the last call.
+#[derive(Debug, Default)]
+struct Recording {
+    /// The import index of the most recent call.
+    last_index: Option<u32>,
+    /// The lowered `u32` arguments seen, in pop (declaration) order.
+    u32_args: Vec<u32>,
+    /// The lowered `string` arguments seen, in pop (declaration) order.
+    string_args: Vec<String>,
+    /// Resource self-handles lowered off a method receiver (`borrow`).
+    self_handles: Vec<u32>,
+}
+
+/// An [`ImportInvoker`] that lowers the arguments with the `value::pop_*`
+/// functions, records them, and lifts a result with the `value::push_*`
+/// functions. It calls the functions for the import's parameter and result
+/// types in the same order as the generated code.
+struct RecordingInvoker {
+    log: Rc<RefCell<Recording>>,
+    /// The handle returned by the resource constructor. A method checks that
+    /// its receiver has this handle.
+    ctor_handle: u32,
+    /// The resource type index of the created wrappers.
+    resource_type_idx: u32,
+}
+
+impl ImportInvoker for RecordingInvoker {
+    fn invoke(
+        &self,
+        scope: &Scope<'_>,
+        stack: &mut CallStack,
+        func: &ImportFuncDesc,
+    ) -> Result<(), ExnThrown> {
+        self.log.borrow_mut().last_index = Some(func.index);
+
+        // The first argument is on top of the stack, so the arguments are popped
+        // in declaration order. The last lowered `u32` is kept, so that the
+        // result of `f-result` can depend on it.
+        let mut last_u32 = 0u32;
+        for shape in &func.params {
+            match shape {
+                TypeShape::U32 => {
+                    let n = value::pop_u32(stack, scope)?;
+                    last_u32 = n;
+                    self.log.borrow_mut().u32_args.push(n);
+                }
+                TypeShape::String => {
+                    let s = value::pop_string(stack, scope)?;
+                    self.log.borrow_mut().string_args.push(s);
+                }
+                TypeShape::BorrowResource { .. } => {
+                    // A method's leading `self`: lower it as a borrow to read the
+                    // receiver's canonical handle.
+                    let desc = wit_bridge::ResourceDesc::Imported {
+                        type_idx: self.resource_type_idx,
+                    };
+                    let handle = resources::pop_borrow(stack, scope, &desc)?;
+                    self.log.borrow_mut().self_handles.push(handle);
+                }
+                other => panic!("recording invoker: unexpected param shape {other:?}"),
+            }
+        }
+
+        // Lift the result the host "returned", per the descriptor's result shape.
+        match func.result.as_ref() {
+            // `f(a, b) -> u32` and `[method]r.m(self, x) -> u32` and
+            // `[static]r.s() -> u32`: return a marker so the JS side can assert
+            // the lifted value.
+            Some(TypeShape::U32) => {
+                value::push_u32(stack, 4242);
+                Ok(())
+            }
+            // `f-enum-err(a) -> result<u32, access-error>`: `err(denied)`.
+            Some(TypeShape::Result(ok, Some(err))) if matches!(**err, TypeShape::Enum(_)) => {
+                value::push_enum(stack, scope, 2, 1)?;
+                value::push_result(stack, scope, ok.is_some(), true, true)
+            }
+            // `f-result(a) -> result<u32, string>`: `ok(a*10)` when `a != 0`, an
+            // `err("zero")` when `a == 0`, branching on the lowered argument.
+            Some(TypeShape::Result(ok, err)) => {
+                if last_u32 == 0 {
+                    value::push_string(stack, scope, "zero")?;
+                    value::push_result(stack, scope, ok.is_some(), err.is_some(), true)
+                } else {
+                    value::push_u32(stack, last_u32.wrapping_mul(10));
+                    value::push_result(stack, scope, ok.is_some(), err.is_some(), false)
+                }
+            }
+            // `[constructor]r -> own<r>`: create an imported wrapper holding the
+            // handle, which becomes the result of `new R(...)`.
+            Some(TypeShape::OwnResource { .. }) => {
+                let desc = wit_bridge::ResourceDesc::Imported {
+                    type_idx: self.resource_type_idx,
+                };
+                resources::push_own(stack, scope, &desc, self.ctor_handle)
+            }
+            other => panic!("recording invoker: unexpected result shape {other:?}"),
+        }
+    }
+}
+
+/// The indices of the imports.
+const IDX_F: u32 = 0;
+const IDX_F_RESULT: u32 = 1;
+const IDX_CTOR: u32 = 2;
+const IDX_METHOD: u32 = 3;
+const IDX_STATIC: u32 = 4;
+const IDX_F_ASYNC: u32 = 5;
+const IDX_F_ENUM_ERR: u32 = 6;
+const RESOURCE_TYPE_IDX: u32 = 7;
+/// The handle returned by the constructor, which a method checks on its
+/// receiver.
+const CTOR_HANDLE: u32 = 0x9000_0000;
+
+/// The class of `f-result`'s `err` arm.
+fn zero_error() -> ErrorClass {
+    ErrorClass {
+        interface: Some(IFACE.to_string()),
+        name: "zero-error".to_string(),
+        enum_cases: Vec::new(),
+    }
+}
+
+/// The class of `f-enum-err`'s `err` arm, an enum.
+fn access_error() -> ErrorClass {
+    ErrorClass {
+        interface: Some(IFACE.to_string()),
+        name: "access-error".to_string(),
+        enum_cases: vec!["notFound".to_string(), "denied".to_string()],
+    }
+}
+
+fn build_world() -> WorldDesc {
+    WorldDesc {
+        interfaces: vec![InterfaceDesc {
+            wit_name: Some(IFACE.to_string()),
+            functions: vec![
+                ImportFuncDesc {
+                    index: IDX_F,
+                    name: "f".to_string(),
+                    params: vec![TypeShape::U32, TypeShape::String],
+                    result: Some(TypeShape::U32),
+                    is_async: false,
+                    err_class: None,
+                },
+                ImportFuncDesc {
+                    index: IDX_F_RESULT,
+                    name: "f-result".to_string(),
+                    params: vec![TypeShape::U32],
+                    result: Some(TypeShape::Result(
+                        Some(Box::new(TypeShape::U32)),
+                        Some(Box::new(TypeShape::String)),
+                    )),
+                    is_async: false,
+                    err_class: Some(zero_error()),
+                },
+                ImportFuncDesc {
+                    index: IDX_F_ENUM_ERR,
+                    name: "f-enum-err".to_string(),
+                    params: vec![TypeShape::U32],
+                    result: Some(TypeShape::Result(
+                        Some(Box::new(TypeShape::U32)),
+                        Some(Box::new(TypeShape::Enum(vec![
+                            "notFound".to_string(),
+                            "denied".to_string(),
+                        ]))),
+                    )),
+                    is_async: false,
+                    err_class: Some(access_error()),
+                },
+                // Paired with the sync recording invoker, to exercise the
+                // `call_import_from_js_async` guard.
+                ImportFuncDesc {
+                    index: IDX_F_ASYNC,
+                    name: "f-async".to_string(),
+                    params: vec![TypeShape::U32],
+                    result: Some(TypeShape::U32),
+                    is_async: true,
+                    err_class: None,
+                },
+            ],
+            error_classes: vec![zero_error(), access_error()],
+            enums: vec![
+                EnumDesc {
+                    js_name: "Color".to_string(),
+                    members: vec![("red".to_string(), 0), ("green".to_string(), 1)],
+                },
+                EnumDesc {
+                    js_name: "Perms".to_string(),
+                    members: vec![
+                        ("read".to_string(), 1),
+                        ("write".to_string(), 2),
+                        ("sticky".to_string(), i32::MIN),
+                    ],
+                },
+            ],
+            resources: vec![ResourceTypeDesc {
+                type_idx: RESOURCE_TYPE_IDX,
+                name: "r".to_string(),
+                constructor: Some(ImportFuncDesc {
+                    index: IDX_CTOR,
+                    name: "[constructor]r".to_string(),
+                    params: vec![TypeShape::U32],
+                    result: Some(TypeShape::OwnResource {
+                        index: RESOURCE_TYPE_IDX,
+                        imported: true,
+                    }),
+                    is_async: false,
+                    err_class: None,
+                }),
+                methods: vec![(
+                    "m".to_string(),
+                    ImportFuncDesc {
+                        index: IDX_METHOD,
+                        name: "[method]r.m".to_string(),
+                        // The leading self is a borrow, followed by the explicit arg.
+                        params: vec![
+                            TypeShape::BorrowResource {
+                                index: RESOURCE_TYPE_IDX,
+                                imported: true,
+                            },
+                            TypeShape::U32,
+                        ],
+                        result: Some(TypeShape::U32),
+                        is_async: false,
+                        err_class: None,
+                    },
+                )],
+                statics: vec![(
+                    "s".to_string(),
+                    ImportFuncDesc {
+                        index: IDX_STATIC,
+                        name: "[static]r.s".to_string(),
+                        params: vec![],
+                        result: Some(TypeShape::U32),
+                        is_async: false,
+                        err_class: None,
+                    },
+                )],
+            }],
+        }],
+        unexported_error_classes: Vec::new(),
+    }
+}
+
+#[test]
+fn imports_native() {
+    register_global_initializer(wit_bridge::add_to_global);
+
+    let log = Rc::new(RefCell::new(Recording::default()));
+    let invoker: Rc<dyn ImportInvoker> = Rc::new(RecordingInvoker {
+        log: Rc::clone(&log),
+        ctor_handle: CTOR_HANDLE,
+        resource_type_idx: RESOURCE_TYPE_IDX,
+    });
+
+    let world = build_world();
+    initialize_runtime(
+        &core_runtime::config::RuntimeConfig::default(),
+        MAIN,
+        "main.js",
+        None,
+        |scope| {
+            // The synthesized resource prototype is allocated under compacting GC
+            // zeal so it lives in a relocatable arena, which
+            // `resource_prototype_registry_survives_relocation` below depends on.
+            #[cfg(feature = "debugmozjs")]
+            // SAFETY: the bootstrap scope wraps a valid context.
+            unsafe {
+                js::gc::SetGCZeal(scope.raw_cx_no_gc(), 14, 1)
+            };
+            let result = wit_bridge::synthesize_import_modules(scope, &world, Rc::clone(&invoker));
+            // Reset before `initialize_runtime` goes on to compile and evaluate
+            // the main module.
+            #[cfg(feature = "debugmozjs")]
+            // SAFETY: same context as above.
+            unsafe {
+                js::gc::SetGCZeal(scope.raw_cx_no_gc(), 0, 0)
+            };
+            result
+        },
+    )
+    .expect("runtime bootstrap failed");
+
+    with_main_scope(|scope, _ns| force_gc(scope));
+
+    freestanding_function_lowers_args_and_lifts_result(&log);
+    result_typed_import_ok_unwraps_to_bare_value();
+    result_typed_import_err_throws_component_error();
+    enum_err_throws_its_case_name();
+    async_import_with_sync_invoker_throws();
+    method_without_receiver_throws();
+    resource_constructor_method_and_static(&log);
+    enums_and_flags_are_frozen_objects();
+    #[cfg(feature = "debugmozjs")]
+    resource_prototype_registry_survives_relocation();
+    wit_bridge::shutdown_runtime();
+}
+
+/// The module exports each [`EnumDesc`] as a frozen object mapping case names
+/// to values and values to case names. A flags member for bit 31 is negative.
+fn enums_and_flags_are_frozen_objects() {
+    with_main_scope(|scope, ns| {
+        force_gc(scope);
+        let result = call_named(scope, ns, c"enumFacts", &[]);
+        assert_eq!(
+            as_string(scope, result),
+            r#"[0,1,"green",true,3,-2147483648,"sticky",true]"#
+        );
+    });
+}
+
+/// Calling an async import with an invoker whose `supports_async()` is `false`
+/// throws a `TypeError` instead of panicking in `invoke_async`.
+fn async_import_with_sync_invoker_throws() {
+    with_main_scope(|scope, ns| {
+        force_gc(scope);
+        let result = call_named(scope, ns, c"callFAsync", &[]);
+        assert_eq!(
+            as_string(scope, result),
+            "threw:TypeError",
+            "an async import on a sync-only invoker throws a TypeError, not a panic"
+        );
+        assert!(!js::exception::is_pending(scope));
+    });
+}
+
+/// A method import called with no arguments, so without its receiver, throws a
+/// `TypeError` counting the arguments without the receiver.
+fn method_without_receiver_throws() {
+    with_main_scope(|scope, _ns| {
+        assert!(wit_bridge::call_import_from_js(scope, IDX_METHOD, &[]).is_err());
+        let message = js::error::ExnThrown::capture(scope).message;
+        assert!(
+            message
+                .as_deref()
+                .is_some_and(|m| m.ends_with("takes 1 argument, got 0")),
+            "{message:?}"
+        );
+    });
+}
+
+/// `f-enum-err(0)` throws an `AccessError` whose message is the name of the
+/// `err` case and whose payload is the case's index.
+fn enum_err_throws_its_case_name() {
+    with_main_scope(|scope, ns| {
+        let result = call_named(scope, ns, c"callFEnumErr", &[]);
+        assert_eq!(as_string(scope, result), "true AccessError denied 1");
+    });
+}
+
+/// Call a named export off the main namespace with the given args, returning the
+/// (unrooted) result value.
+fn call_named<'s>(
+    scope: &'s Scope<'_>,
+    ns: &Object<'s>,
+    name: &std::ffi::CStr,
+    args: &[js::native::Handle<'s, js::native::Value>],
+) -> js::native::Handle<'s, js::native::Value> {
+    let f = ns
+        .get_property_by_name(scope, name)
+        .expect("export resolves");
+    match js::Function::call(scope, ns, f, args) {
+        Ok(v) => v,
+        Err(_) => {
+            let captured = js::error::ExnThrown::capture(scope);
+            panic!(
+                "export {name:?} call trapped: {:?}",
+                captured.message.unwrap_or_default()
+            );
+        }
+    }
+}
+
+/// `f(2, "hi") -> u32`. The import lowers its `u32` and `string` arguments in
+/// declaration order, and JS receives the lifted `u32` result. The recorded
+/// index is `IDX_F`.
+fn freestanding_function_lowers_args_and_lifts_result(log: &Rc<RefCell<Recording>>) {
+    with_main_scope(|scope, ns| {
+        force_gc(scope);
+        let result = call_named(scope, ns, c"callF", &[]);
+        assert_eq!(
+            as_number(result.get()),
+            4242.0,
+            "f's lifted u32 result reaches JS"
+        );
+
+        let rec = log.borrow();
+        assert_eq!(rec.last_index, Some(IDX_F), "callback threaded f's index");
+        assert_eq!(rec.u32_args, vec![2], "f lowered its u32 arg 2");
+        assert_eq!(
+            rec.string_args,
+            vec!["hi".to_string()],
+            "f lowered its string arg \"hi\""
+        );
+    });
+}
+
+/// `f-result(10) -> result<u32, string>` lifted as `ok(100)`.
+/// JS receives `100`, not the `{tag, val}` object.
+fn result_typed_import_ok_unwraps_to_bare_value() {
+    with_main_scope(|scope, ns| {
+        force_gc(scope);
+        let result = call_named(scope, ns, c"callFResultOk", &[]);
+        assert_eq!(
+            as_number(result.get()),
+            100.0,
+            "ok arm unwraps {{tag, val}} to the bare value (10 * 10)"
+        );
+    });
+}
+
+/// `f-result(0)` lifted as `err("zero")`.
+/// The call throws an instance of the `err` type's class, `ZeroError`, which
+/// the module exports and which extends `ComponentError`, with the `err` string
+/// as its `payload`. `callFResultErr` returns `e.payload`.
+fn result_typed_import_err_throws_component_error() {
+    with_main_scope(|scope, ns| {
+        force_gc(scope);
+        let result = call_named(scope, ns, c"callFResultErr", &[]);
+        assert_eq!(
+            as_string(scope, result),
+            "zero",
+            "err arm throws a ZeroError whose .payload is the err string"
+        );
+        // The exception was caught in JS, so nothing is pending.
+        assert!(!js::exception::is_pending(scope));
+    });
+}
+
+/// The synthesized resource class `R`.
+///
+/// - `new R(seed)` calls the constructor import, and returns the wrapper
+///   created by the invoker with `push_own`.
+/// - `R.s()` calls the static import, which is a property of the class.
+/// - `r.m(x)` calls the method import with the receiver as the first argument,
+///   which the invoker lowers as a `borrow`. The receiver's handle is the
+///   handle returned by the constructor.
+fn resource_constructor_method_and_static(log: &Rc<RefCell<Recording>>) {
+    with_main_scope(|scope, ns| {
+        force_gc(scope);
+
+        // new R(99) calls the constructor import and returns its wrapper.
+        let inst = call_named(scope, ns, c"ctorR", &[num(scope, 99)]);
+        assert!(inst.is_object(), "new R(99) yields an object");
+        {
+            let rec = log.borrow();
+            assert_eq!(rec.last_index, Some(IDX_CTOR), "constructor index threaded");
+            // The constructor's only WIT param is its `u32` seed.
+            assert!(
+                rec.u32_args.contains(&99),
+                "constructor lowered its u32 seed 99, saw {:?}",
+                rec.u32_args
+            );
+        }
+        // The wrapper holds the canonical handle the invoker returned.
+        assert_eq!(
+            wit_bridge::resources::imported_handle(scope, inst),
+            Some(CTOR_HANDLE),
+            "minted wrapper carries the constructor's canonical handle"
+        );
+
+        force_gc(scope);
+
+        // R.s(): a static function, which is a property of the class.
+        let s = call_named(scope, ns, c"callS", &[]);
+        assert_eq!(
+            as_number(s.get()),
+            4242.0,
+            "static R.s() lifts its u32 result"
+        );
+        assert_eq!(
+            log.borrow().last_index,
+            Some(IDX_STATIC),
+            "static index threaded"
+        );
+
+        // The instance exposes `m` through `R.prototype`.
+        let has_m = call_named(scope, ns, c"instHasM", &[]);
+        assert!(
+            has_m.is_boolean() && has_m.to_boolean(),
+            "the constructed instance exposes its method `m` via R.prototype"
+        );
+        // Methods and statics are not enumerable, as those of a JS `class` are.
+        let keys = call_named(scope, ns, c"instKeys", &[]);
+        assert_eq!(as_string(scope, keys), "[[],[],[]]");
+
+        force_gc(scope);
+
+        // r.m(5): the receiver is lowered as a `borrow`, followed by the `u32`
+        // argument. The receiver's handle is CTOR_HANDLE.
+        let before = log.borrow().self_handles.len();
+        let m = call_named(scope, ns, c"callM", &[num(scope, 5)]);
+        assert_eq!(
+            as_number(m.get()),
+            4242.0,
+            "method r.m(5) lifts its u32 result"
+        );
+        let rec = log.borrow();
+        assert_eq!(rec.last_index, Some(IDX_METHOD), "method index threaded");
+        assert_eq!(
+            rec.self_handles.get(before).copied(),
+            Some(CTOR_HANDLE),
+            "the method forwarded the receiver's handle as its first lowered arg"
+        );
+        assert!(
+            rec.u32_args.contains(&5),
+            "the method lowered its explicit u32 arg 5, saw {:?}",
+            rec.u32_args
+        );
+    });
+}
+
+/// The imported-resource prototype registry survives a relocating GC: a wrapper
+/// created after a compacting GC has the same prototype as one created before
+/// it.
+#[cfg(feature = "debugmozjs")]
+fn resource_prototype_registry_survives_relocation() {
+    with_main_scope(|scope, ns| {
+        // The instance stays rooted across the relocating GC so its prototype is
+        // the live object that moves.
+        let first = call_named(scope, ns, c"ctorR", &[num(scope, 11)]);
+        let first_obj = Object::from_value(scope, first).expect("first instance is an object");
+
+        // SAFETY: the main scope wraps a valid context.
+        unsafe { js::gc::SetGCZeal(scope.raw_cx_no_gc(), 14, 1) };
+        js::gc::prepare_for_full_gc(scope);
+        js::gc::non_incremental_gc(scope, js::gc::GCOptions::Shrink, js::gc::GCReason::API);
+
+        let second = call_named(scope, ns, c"ctorR", &[num(scope, 22)]);
+        let second_obj = Object::from_value(scope, second).expect("second instance is an object");
+
+        // SAFETY: same context.
+        unsafe { js::gc::SetGCZeal(scope.raw_cx_no_gc(), 0, 0) };
+
+        // The second wrapper's method resolves through the (relocated) prototype.
+        let has_m = call_named(scope, ns, c"instHasM", &[]);
+        assert!(
+            has_m.is_boolean() && has_m.to_boolean(),
+            "the second wrapper exposes `m` via the relocated R.prototype"
+        );
+        let m = call_named(scope, ns, c"callM", &[num(scope, 7)]);
+        assert_eq!(
+            as_number(m.get()),
+            4242.0,
+            "calling a method on the second wrapper works after relocation"
+        );
+
+        // No GC runs between the two reads, so a raw-pointer compare is a valid
+        // identity check.
+        let proto_first = first_obj
+            .get_prototype(scope)
+            .expect("first prototype readable")
+            .expect("first wrapper has a prototype");
+        let proto_second = second_obj
+            .get_prototype(scope)
+            .expect("second prototype readable")
+            .expect("second wrapper has a prototype");
+        assert_eq!(
+            proto_first.as_raw(),
+            proto_second.as_raw(),
+            "both wrappers share R.prototype from the registry"
+        );
+    });
+}
diff --git a/crates/wit-bridge/tests/init_failure.rs b/crates/wit-bridge/tests/init_failure.rs
new file mode 100644
index 00000000..f0e1c3ac
--- /dev/null
+++ b/crates/wit-bridge/tests/init_failure.rs
@@ -0,0 +1,52 @@
+// SPDX-License-Identifier: Apache-2.0-WITH-LLVM-exception
+
+//! A main module that fails at its top level must fail the bootstrap.
+//!
+//! `JS::ModuleEvaluate` reports a top-level throw by rejecting the promise it
+//! returns and clearing the pending exception, so a bootstrap that only checks
+//! for a pending exception reports success and, on the dylib path, snapshots a
+//! broken instance.
+//!
+//! [`initialize_runtime`] may be attempted at most once per process, so this
+//! suite is its own test binary with a single case.
+
+use wit_bridge::initialize_runtime;
+
+const MAIN: &str = r#"
+    export function unreachable() {}
+    throw new Error("top level went wrong");
+"#;
+
+#[test]
+fn main_module_that_throws_fails_the_bootstrap() {
+    let result = initialize_runtime(
+        &core_runtime::config::RuntimeConfig::default(),
+        MAIN,
+        "main.js",
+        None,
+        |_scope| Ok(()),
+    );
+
+    let message = result
+        .err()
+        .expect("a throwing main module must not report success");
+    assert!(
+        message.contains("top level went wrong"),
+        "the failure must name the thrown error, got: {message}"
+    );
+
+    // A second attempt fails rather than re-entering the once-per-process
+    // `JSEngine::init`.
+    let again = initialize_runtime(
+        &core_runtime::config::RuntimeConfig::default(),
+        "export function ok() {}",
+        "main.js",
+        None,
+        |_scope| Ok(()),
+    );
+    assert_eq!(
+        again.err().as_deref(),
+        Some("component-model runtime already initialized"),
+        "a second bootstrap attempt must fail"
+    );
+}
diff --git a/crates/wit-bridge/tests/shared/mod.rs b/crates/wit-bridge/tests/shared/mod.rs
new file mode 100644
index 00000000..c45102ab
--- /dev/null
+++ b/crates/wit-bridge/tests/shared/mod.rs
@@ -0,0 +1,52 @@
+// SPDX-License-Identifier: Apache-2.0-WITH-LLVM-exception
+
+//! Helpers shared by the native `wit-bridge` test binaries.
+
+#![allow(dead_code)]
+
+use js::conversion::{FromJSVal, ToJSVal};
+use js::error::ExnThrown;
+use js::gc::scope::Scope;
+use js::native::Value;
+use js::prelude::HandleValue;
+
+/// Force a full, non-incremental GC so a rooting bug surfaces as a crash under
+/// `debugmozjs` rather than silently passing. Surviving objects are not
+/// necessarily relocated.
+pub fn force_gc(scope: &Scope<'_>) {
+    js::gc::gc(scope, js::gc::GCReason::DEBUG_GC);
+}
+
+/// Build a rooted number value handle for use as a call argument.
+pub fn num<'s>(scope: &'s Scope<'_>, n: i32) -> HandleValue<'s> {
+    n.to_jsval(scope).unwrap()
+}
+
+/// Read a number out of a value (int32 or double).
+pub fn as_number(v: Value) -> f64 {
+    if v.is_int32() {
+        v.to_int32() as f64
+    } else if v.is_double() {
+        v.to_double()
+    } else {
+        panic!("value is not a number");
+    }
+}
+
+/// Convert a value to a Rust `String` via `ToString`.
+pub fn as_string<'s>(scope: &'s Scope<'_>, v: impl ToJSVal<'s>) -> String {
+    let v = v.to_jsval(scope).unwrap();
+    String::from_jsval(scope, v, ()).expect("ToString succeeds")
+}
+
+/// Assert that `result` is `Err` with a `TypeError` pending, and clear it.
+#[track_caller]
+pub fn assert_type_error<T: std::fmt::Debug>(scope: &Scope<'_>, result: Result<T, ExnThrown>) {
+    assert!(result.is_err(), "expected a TypeError, got {result:?}");
+    let exn = js::exception::take_pending(scope).expect("`Err` with no exception pending");
+    let name = js::Object::from_value(scope, exn)
+        .ok()
+        .and_then(|error| error.get_property(scope, c"name").ok())
+        .map(|name| as_string(scope, name));
+    assert_eq!(name.as_deref(), Some("TypeError"));
+}
diff --git a/crates/wit-bridge/tests/sync_native.rs b/crates/wit-bridge/tests/sync_native.rs
new file mode 100644
index 00000000..295246be
--- /dev/null
+++ b/crates/wit-bridge/tests/sync_native.rs
@@ -0,0 +1,2224 @@
+// SPDX-License-Identifier: Apache-2.0-WITH-LLVM-exception
+
+//! Native integration tests for the JS↔WIT value-conversion core.
+//!
+//! These run against a real SpiderMonkey runtime, exercising the conversion
+//! mapping and the GC-traced call stack without any wasm build.
+//!
+//! Most cases use [`WitValue`], a tree of WIT values, which the tests lift and
+//! lower by calling the `push_*` and `pop_*` functions in the same order as the
+//! code generated by `wit-dylib`.
+//!
+//! The cases are grouped in a single test because `JSEngine` can only be
+//! initialized once per process.
+
+use core_runtime::config::RuntimeConfig;
+use core_runtime::runtime::{register_global_initializer, Runtime};
+use js::gc::scope::Scope;
+use js::native::SymbolCode;
+use js::prelude::HandleValue;
+use js::Object;
+use wit_bridge::resources::{self, ResourceDesc};
+use wit_bridge::value::{self, TypeShape};
+use wit_bridge::{install_tracer, CallStack};
+
+mod shared;
+use shared::{as_string, assert_type_error, force_gc};
+
+#[test]
+fn sync_native() {
+    // `ComponentError` must be on the global before the runtime is created.
+    register_global_initializer(wit_bridge::add_to_global);
+
+    let rt = Runtime::init(&RuntimeConfig::default()).expect("runtime init");
+    let scope = rt.default_global();
+    install_tracer();
+    resources::set_imported_drop(record_imported_drop);
+
+    deferred_deallocations_run_on_drop(&scope);
+    primitive_round_trips(&scope);
+    sixty_four_bit_values_are_bigints(&scope);
+    validation_names_the_failing_part(&scope);
+    snapshot_reads_each_part_once(&scope);
+    nan_canonicalization(&scope);
+    char_rejects_multichar(&scope);
+    record_round_trip(&scope);
+    pop_record_stack_order(&scope);
+    push_record_stack_order(&scope);
+    tuple_round_trip(&scope);
+    variant_round_trips(&scope);
+    enum_round_trips(&scope);
+    option_nesting(&scope);
+    result_round_trips(&scope);
+    flags_round_trip(&scope);
+    list_round_trips(&scope);
+    numeric_list_kind_mismatch_throws(&scope);
+    values_that_do_not_lower_throw(&scope);
+    out_of_range_discriminants_throw(&scope);
+    list_that_changes_while_lowered_fails_cleanly(&scope);
+    numeric_list_snapshots_copy_their_elements(&scope);
+
+    // Resources and `ComponentError`.
+    component_error_holds_its_payload(&scope);
+    error_class_extends_component_error(&scope);
+    imported_resource_round_trip(&scope);
+    imported_resource_dispose(&scope);
+    exported_slab_reuses_freed_reps(&scope);
+    exported_resource_to_canon_mints_per_lowering(&scope);
+    exported_resource_reexport_round_trip(&scope);
+    dropping_an_exported_resource_calls_its_dispose(&scope);
+    collecting_an_exported_object_does_not_run_its_dispose(&scope);
+    lent_wrapper_is_kept_for_the_call(&scope);
+    borrow_release_drains_through_throw(&scope);
+    exported_borrow_release(&scope);
+    a_released_imported_borrow_loses_its_handle(&scope);
+    abandoned_wrapper_is_dropped_by_gc(&scope);
+    conflicting_wrapper_uses_fail_validation(&scope);
+    deferred_dispose_runs_when_the_lend_ends(&scope);
+
+    wit_bridge::tracing::clear_traced_roots();
+}
+
+// ===========================================================================
+// CallStack
+// ===========================================================================
+
+/// Dropping a stack frees its deferred deallocations without a double free.
+fn deferred_deallocations_run_on_drop(_scope: &Scope<'_>) {
+    use std::alloc::Layout;
+
+    let mut stack = CallStack::new();
+    for size in [1usize, 64, 4096] {
+        let layout = Layout::from_size_align(size, 8).unwrap();
+        // SAFETY: a non-zero-size layout, and ownership of the allocation is handed
+        // to the stack, which frees it on drop.
+        let ptr = unsafe { std::alloc::alloc(layout) };
+        assert!(!ptr.is_null());
+        unsafe { stack.defer_deallocate(ptr, layout) };
+    }
+    drop(stack);
+}
+
+// ===========================================================================
+// A test-only WIT value tree and a recursive driver over it.
+// ===========================================================================
+
+#[derive(Clone, Debug, PartialEq)]
+enum WitValue {
+    Bool(bool),
+    U8(u8),
+    U16(u16),
+    U32(u32),
+    U64(u64),
+    S8(i8),
+    S16(i16),
+    S32(i32),
+    S64(i64),
+    F32(f32),
+    F64(f64),
+    Char(char),
+    String(String),
+    List(Vec<WitValue>),
+    Record(Vec<(String, WitValue)>),
+    Tuple(Vec<WitValue>),
+    /// (discriminant, optional payload)
+    Variant(u32, Option<Box<WitValue>>),
+    Enum(u32),
+    /// `None` = none; `Some` = some(payload)
+    Option(Option<Box<WitValue>>),
+    /// `Ok`/`Err` with an optional payload
+    Result(Result<Option<Box<WitValue>>, Option<Box<WitValue>>>),
+    Flags(u32),
+}
+
+/// Lift a `WitValue` onto the stack. Child values are lifted first, in the
+/// order expected by the `push_*` function of their parent.
+fn lift(stack: &mut CallStack, scope: &Scope<'_>, shape: &TypeShape, v: &WitValue) {
+    match (shape, v) {
+        (TypeShape::Bool, WitValue::Bool(b)) => value::push_bool(stack, *b),
+        (TypeShape::U8, WitValue::U8(n)) => value::push_u8(stack, *n),
+        (TypeShape::U16, WitValue::U16(n)) => value::push_u16(stack, *n),
+        (TypeShape::U32, WitValue::U32(n)) => value::push_u32(stack, *n),
+        (TypeShape::U64, WitValue::U64(n)) => value::push_u64(stack, scope, *n).unwrap(),
+        (TypeShape::S8, WitValue::S8(n)) => value::push_s8(stack, *n),
+        (TypeShape::S16, WitValue::S16(n)) => value::push_s16(stack, *n),
+        (TypeShape::S32, WitValue::S32(n)) => value::push_s32(stack, *n),
+        (TypeShape::S64, WitValue::S64(n)) => value::push_s64(stack, scope, *n).unwrap(),
+        (TypeShape::F32, WitValue::F32(n)) => value::push_f32(stack, *n),
+        (TypeShape::F64, WitValue::F64(n)) => value::push_f64(stack, *n),
+        (TypeShape::Char, WitValue::Char(c)) => value::push_char(stack, scope, *c).unwrap(),
+        (TypeShape::String, WitValue::String(s)) => value::push_string(stack, scope, s).unwrap(),
+        (TypeShape::List(elem), WitValue::List(items)) => lift_list(stack, scope, elem, items),
+        (TypeShape::Record(fields), WitValue::Record(values)) => {
+            // Fields are lifted in order, so field[0] is deepest.
+            for (name, ty) in fields {
+                let (_, val) = values.iter().find(|(n, _)| n == name).unwrap();
+                lift(stack, scope, ty, val);
+            }
+            value::push_record(stack, scope, &field_names(fields)).unwrap();
+        }
+        (TypeShape::Tuple(types), WitValue::Tuple(items)) => {
+            // Elements are lifted in order, so element[0] is deepest.
+            for (ty, item) in types.iter().zip(items) {
+                lift(stack, scope, ty, item);
+            }
+            value::push_tuple(stack, scope, types.len()).unwrap();
+        }
+        (TypeShape::Variant(cases), WitValue::Variant(disc, payload)) => {
+            if let Some(p) = payload {
+                let ty = cases[*disc as usize].1.as_ref().unwrap();
+                lift(stack, scope, ty, p);
+            }
+            value::push_variant(stack, scope, &case_tags(cases), *disc).unwrap();
+        }
+        (TypeShape::Enum(names), WitValue::Enum(disc)) => {
+            value::push_enum(stack, scope, names.len() as u32, *disc).unwrap();
+        }
+        (TypeShape::Option(inner), WitValue::Option(payload)) => {
+            if let Some(p) = payload {
+                lift(stack, scope, inner, p);
+            }
+            value::push_option(stack, scope, inner_is_option(inner), payload.is_some()).unwrap();
+        }
+        (TypeShape::Result(ok, err), WitValue::Result(r)) => {
+            let (is_err, payload) = match r {
+                Ok(p) => (false, p),
+                Err(p) => (true, p),
+            };
+            if let Some(p) = payload {
+                let ty = if is_err { err } else { ok }.as_ref().unwrap();
+                lift(stack, scope, ty, p);
+            }
+            value::push_result(stack, scope, ok.is_some(), err.is_some(), is_err).unwrap();
+        }
+        (TypeShape::Flags(_), WitValue::Flags(bits)) => {
+            value::push_flags(stack, *bits);
+        }
+        (s, v) => panic!("lift: shape {s:?} does not match value {v:?}"),
+    }
+}
+
+fn lift_list(stack: &mut CallStack, scope: &Scope<'_>, elem: &TypeShape, items: &[WitValue]) {
+    if elem.view_kind().is_some() {
+        lift_numeric_list(stack, scope, elem, items);
+    } else {
+        // Lift the list as the generated code does: push the array, then lift
+        // each element and add it with `list_append`.
+        value::push_list_begin(stack, scope, items.len()).unwrap();
+        for item in items {
+            lift(stack, scope, elem, item);
+            value::list_append(stack, scope).unwrap();
+        }
+    }
+}
+
+/// Lift a numeric list with `push_numeric_list`, passing it a buffer allocated
+/// with the list's layout, which it takes ownership of.
+fn lift_numeric_list(
+    stack: &mut CallStack,
+    scope: &Scope<'_>,
+    elem: &TypeShape,
+    items: &[WitValue],
+) {
+    let bytes: Vec<u8> = items
+        .iter()
+        .flat_map(|item| match item {
+            WitValue::U8(n) => n.to_ne_bytes().to_vec(),
+            WitValue::S8(n) => n.to_ne_bytes().to_vec(),
+            WitValue::U16(n) => n.to_ne_bytes().to_vec(),
+            WitValue::S16(n) => n.to_ne_bytes().to_vec(),
+            WitValue::U32(n) => n.to_ne_bytes().to_vec(),
+            WitValue::S32(n) => n.to_ne_bytes().to_vec(),
+            WitValue::U64(n) => n.to_ne_bytes().to_vec(),
+            WitValue::S64(n) => n.to_ne_bytes().to_vec(),
+            WitValue::F32(n) => n.to_ne_bytes().to_vec(),
+            WitValue::F64(n) => n.to_ne_bytes().to_vec(),
+            other => panic!("lift_numeric_list: {other:?} is not numeric"),
+        })
+        .collect();
+    let layout = elem.numeric_list_layout(items.len()).unwrap();
+    assert_eq!(bytes.len(), layout.size(), "{items:?} are not all {elem:?}");
+    let data = if items.is_empty() {
+        std::ptr::null_mut()
+    } else {
+        // SAFETY: `layout` has a non-zero size.
+        let data = unsafe { std::alloc::alloc(layout) };
+        assert!(!data.is_null());
+        // SAFETY: `data` holds `layout.size()` bytes, which is `bytes.len()`.
+        unsafe { std::ptr::copy_nonoverlapping(bytes.as_ptr(), data, bytes.len()) };
+        data
+    };
+    // SAFETY: a non-empty list's `data` is a global-allocator allocation made with
+    // `layout`, holding `items.len()` elements of `elem`'s type.
+    unsafe { value::push_numeric_list(stack, scope, elem, data, layout, items.len()).unwrap() };
+}
+
+/// Lower the value on top of the stack into a `WitValue`, including the child
+/// values pushed by the `pop_*` functions.
+fn lower(stack: &mut CallStack, scope: &Scope<'_>, shape: &TypeShape) -> WitValue {
+    match shape {
+        TypeShape::Bool => WitValue::Bool(value::pop_bool(stack, scope).unwrap()),
+        TypeShape::U8 => WitValue::U8(value::pop_u8(stack, scope).unwrap()),
+        TypeShape::U16 => WitValue::U16(value::pop_u16(stack, scope).unwrap()),
+        TypeShape::U32 => WitValue::U32(value::pop_u32(stack, scope).unwrap()),
+        TypeShape::U64 => WitValue::U64(value::pop_u64(stack, scope).unwrap()),
+        TypeShape::S8 => WitValue::S8(value::pop_s8(stack, scope).unwrap()),
+        TypeShape::S16 => WitValue::S16(value::pop_s16(stack, scope).unwrap()),
+        TypeShape::S32 => WitValue::S32(value::pop_s32(stack, scope).unwrap()),
+        TypeShape::S64 => WitValue::S64(value::pop_s64(stack, scope).unwrap()),
+        TypeShape::F32 => WitValue::F32(value::pop_f32(stack, scope).unwrap()),
+        TypeShape::F64 => WitValue::F64(value::pop_f64(stack, scope).unwrap()),
+        TypeShape::Char => WitValue::Char(value::pop_char(stack, scope).unwrap()),
+        TypeShape::String => WitValue::String(value::pop_string(stack, scope).unwrap()),
+        TypeShape::List(elem) => lower_list(stack, scope, elem),
+        TypeShape::Record(fields) => {
+            value::pop_record(stack, scope, &field_names(fields)).unwrap();
+            // pop_record pushes fields so field[0] ends up on top, so lower in
+            // declaration order directly (same as tuples).
+            let mut values: Vec<(String, WitValue)> = Vec::with_capacity(fields.len());
+            for (name, ty) in fields {
+                values.push((name.clone(), lower(stack, scope, ty)));
+            }
+            WitValue::Record(values)
+        }
+        TypeShape::Tuple(types) => {
+            value::pop_tuple(stack, scope, types.len()).unwrap();
+            // pop_tuple pushes elements so element[0] ends up on top, so lower in
+            // declaration order directly.
+            let mut values: Vec<WitValue> = Vec::with_capacity(types.len());
+            for ty in types {
+                values.push(lower(stack, scope, ty));
+            }
+            WitValue::Tuple(values)
+        }
+        TypeShape::Variant(cases) => {
+            let disc = value::pop_variant(stack, scope, &case_tags(cases)).unwrap();
+            let payload = cases[disc as usize]
+                .1
+                .as_ref()
+                .map(|ty| Box::new(lower(stack, scope, ty)));
+            WitValue::Variant(disc, payload)
+        }
+        TypeShape::Enum(names) => {
+            WitValue::Enum(value::pop_enum(stack, scope, names.len() as u32).unwrap())
+        }
+        TypeShape::Option(inner) => {
+            if value::pop_option(stack, scope, inner_is_option(inner)).unwrap() {
+                WitValue::Option(Some(Box::new(lower(stack, scope, inner))))
+            } else {
+                WitValue::Option(None)
+            }
+        }
+        TypeShape::Result(ok, err) => {
+            let disc = value::pop_result(stack, scope, ok.is_some(), err.is_some()).unwrap();
+            if disc == 0 {
+                let p = ok.as_ref().map(|ty| Box::new(lower(stack, scope, ty)));
+                WitValue::Result(Ok(p))
+            } else {
+                let p = err.as_ref().map(|ty| Box::new(lower(stack, scope, ty)));
+                WitValue::Result(Err(p))
+            }
+        }
+        TypeShape::Flags(names) => {
+            WitValue::Flags(value::pop_flags(stack, scope, names.len() as u32).unwrap())
+        }
+        TypeShape::OwnResource { .. } | TypeShape::BorrowResource { .. } => {
+            unreachable!("resources are not converted by these tests")
+        }
+        TypeShape::Stream(_) | TypeShape::Future(_) => {
+            unreachable!("streams and futures are converted only on wasm")
+        }
+        TypeShape::Unsupported(what) => unreachable!("{what} is not converted"),
+    }
+}
+
+/// `value::pop_numeric_list` into an owned `Vec<u8>`, freeing the buffer it
+/// returns.
+fn pop_numeric_list_bytes(
+    stack: &mut CallStack,
+    scope: &Scope<'_>,
+    elem: &TypeShape,
+) -> (Vec<u8>, usize) {
+    let (ptr, layout, count) = value::pop_numeric_list(stack, scope, elem).unwrap();
+    if count == 0 {
+        return (Vec::new(), 0);
+    }
+    // SAFETY: `pop_numeric_list` transferred ownership of `layout.size()` bytes
+    // allocated with the global allocator under exactly `layout`.
+    let bytes = unsafe {
+        let bytes = std::slice::from_raw_parts(ptr, layout.size()).to_vec();
+        std::alloc::dealloc(ptr, layout);
+        bytes
+    };
+    (bytes, count)
+}
+
+/// The field names `push_record` and `pop_record` take for a record of `fields`.
+fn field_names(fields: &[(String, TypeShape)]) -> Vec<&'static std::ffi::CStr> {
+    fields
+        .iter()
+        .map(|(name, _)| js::class::static_property_name(name))
+        .collect()
+}
+
+/// The cases `push_variant` and `pop_variant` take for a variant of `cases`.
+fn case_tags(cases: &[(String, Option<TypeShape>)]) -> Vec<(&'static std::ffi::CStr, bool)> {
+    cases
+        .iter()
+        .map(|(name, payload)| (js::class::static_property_name(name), payload.is_some()))
+        .collect()
+}
+
+fn inner_is_option(inner: &TypeShape) -> bool {
+    matches!(inner, TypeShape::Option(_))
+}
+
+fn lower_list(stack: &mut CallStack, scope: &Scope<'_>, elem: &TypeShape) -> WitValue {
+    if elem.view_kind().is_some() {
+        let (bytes, count) = pop_numeric_list_bytes(stack, scope, elem);
+        WitValue::List(numeric_list_from_bytes(elem, &bytes, count))
+    } else {
+        let len = stack.lower_list_begin(scope).unwrap();
+        let mut items = Vec::with_capacity(len);
+        for _ in 0..len {
+            stack.lower_list_next(scope).unwrap();
+            items.push(lower(stack, scope, elem));
+        }
+        stack.lower_list_end();
+        WitValue::List(items)
+    }
+}
+
+/// Pop the top value as an object, which is rooted.
+fn pop_object<'s>(stack: &mut CallStack, scope: &'s Scope<'_>) -> js::Object<'s> {
+    js::Object::from_raw_value(scope, stack.pop_value()).unwrap()
+}
+
+/// Round-trip a value lift→lower and assert it comes back equal. Then lift it
+/// again, and assert that lowering its snapshot gives the same value.
+fn round_trip(scope: &Scope<'_>, shape: &TypeShape, value: &WitValue) {
+    let mut stack = CallStack::new();
+    lift(&mut stack, scope, shape, value);
+    assert_eq!(
+        stack.len(),
+        1,
+        "lift of {value:?} left {} values",
+        stack.len()
+    );
+    // A GC between lift and lower must not disturb the held value.
+    force_gc(scope);
+    let back = lower(&mut stack, scope, shape);
+    assert!(
+        stack.is_empty(),
+        "lower of {value:?} left values on the stack"
+    );
+    assert_eq!(&back, value, "round trip of {value:?} (shape {shape:?})");
+
+    lift(&mut stack, scope, shape, value);
+    let lifted = scope.root_value(stack.pop_value());
+    let snapshot = wit_bridge::validate::snapshot(scope, lifted, shape)
+        .unwrap_or_else(|mismatch| panic!("snapshot of {value:?}: {mismatch:?}"));
+    stack.push_shaped(snapshot);
+    force_gc(scope);
+    let back = lower(&mut stack, scope, shape);
+    assert!(
+        stack.is_empty(),
+        "lower of the snapshot of {value:?} left values on the stack"
+    );
+    assert_eq!(
+        &back, value,
+        "snapshot round trip of {value:?} (shape {shape:?})"
+    );
+}
+
+// ===========================================================================
+// Numeric list bytes -> WitValue helper (test side)
+// ===========================================================================
+
+fn numeric_list_from_bytes(elem: &TypeShape, bytes: &[u8], count: usize) -> Vec<WitValue> {
+    let mut out = Vec::with_capacity(count);
+    for i in 0..count {
+        out.push(match elem {
+            TypeShape::U8 => WitValue::U8(bytes[i]),
+            TypeShape::S8 => WitValue::S8(bytes[i] as i8),
+            TypeShape::U16 => WitValue::U16(u16::from_ne_bytes(
+                bytes[i * 2..i * 2 + 2].try_into().unwrap(),
+            )),
+            TypeShape::S16 => WitValue::S16(i16::from_ne_bytes(
+                bytes[i * 2..i * 2 + 2].try_into().unwrap(),
+            )),
+            TypeShape::U32 => WitValue::U32(u32::from_ne_bytes(
+                bytes[i * 4..i * 4 + 4].try_into().unwrap(),
+            )),
+            TypeShape::S32 => WitValue::S32(i32::from_ne_bytes(
+                bytes[i * 4..i * 4 + 4].try_into().unwrap(),
+            )),
+            TypeShape::U64 => WitValue::U64(u64::from_ne_bytes(
+                bytes[i * 8..i * 8 + 8].try_into().unwrap(),
+            )),
+            TypeShape::S64 => WitValue::S64(i64::from_ne_bytes(
+                bytes[i * 8..i * 8 + 8].try_into().unwrap(),
+            )),
+            TypeShape::F32 => WitValue::F32(f32::from_ne_bytes(
+                bytes[i * 4..i * 4 + 4].try_into().unwrap(),
+            )),
+            TypeShape::F64 => WitValue::F64(f64::from_ne_bytes(
+                bytes[i * 8..i * 8 + 8].try_into().unwrap(),
+            )),
+            _ => unreachable!(),
+        });
+    }
+    out
+}
+
+// ===========================================================================
+// Cases
+// ===========================================================================
+
+fn primitive_round_trips(scope: &Scope<'_>) {
+    round_trip(scope, &TypeShape::Bool, &WitValue::Bool(true));
+    round_trip(scope, &TypeShape::Bool, &WitValue::Bool(false));
+    round_trip(scope, &TypeShape::U8, &WitValue::U8(255));
+    round_trip(scope, &TypeShape::U16, &WitValue::U16(65535));
+    round_trip(scope, &TypeShape::U32, &WitValue::U32(u32::MAX));
+    round_trip(scope, &TypeShape::S8, &WitValue::S8(-128));
+    round_trip(scope, &TypeShape::S16, &WitValue::S16(-32768));
+    round_trip(scope, &TypeShape::S32, &WitValue::S32(i32::MIN));
+    round_trip(scope, &TypeShape::F32, &WitValue::F32(1.5));
+    round_trip(scope, &TypeShape::F64, &WitValue::F64(-1234.5678));
+    round_trip(scope, &TypeShape::Char, &WitValue::Char('A'));
+    round_trip(scope, &TypeShape::Char, &WitValue::Char('🦊'));
+    round_trip(scope, &TypeShape::String, &WitValue::String("hello".into()));
+    round_trip(scope, &TypeShape::String, &WitValue::String(String::new()));
+    round_trip(
+        scope,
+        &TypeShape::String,
+        &WitValue::String("héllo 🦊 café".into()),
+    );
+}
+
+/// 64-bit integers lift as BigInts whatever their magnitude, and round-trip at
+/// both ends of their ranges.
+fn sixty_four_bit_values_are_bigints(scope: &Scope<'_>) {
+    round_trip(scope, &TypeShape::U64, &WitValue::U64(0));
+    round_trip(scope, &TypeShape::U64, &WitValue::U64(42));
+    round_trip(scope, &TypeShape::S64, &WitValue::S64(-42));
+    round_trip(scope, &TypeShape::U64, &WitValue::U64(u64::MAX));
+    round_trip(scope, &TypeShape::U64, &WitValue::U64(1 << 40));
+    round_trip(scope, &TypeShape::S64, &WitValue::S64(i64::MIN));
+    round_trip(scope, &TypeShape::S64, &WitValue::S64(i64::MAX));
+
+    let mut stack = CallStack::new();
+    value::push_u64(&mut stack, scope, 42).unwrap();
+    assert!(stack.last().is_bigint(), "a small u64 lifts as a BigInt");
+    stack.pop_value();
+    value::push_s64(&mut stack, scope, -1).unwrap();
+    assert!(stack.last().is_bigint(), "a small s64 lifts as a BigInt");
+    stack.pop_value();
+}
+
+/// A NaN lifted to JS must come back as a NaN (canonicalized, never trapping).
+fn nan_canonicalization(scope: &Scope<'_>) {
+    let mut stack = CallStack::new();
+    let non_canonical = f64::from_bits(0xFFFF_FFFF_FFFF_FFFF);
+    assert!(non_canonical.is_nan());
+    value::push_f64(&mut stack, non_canonical);
+    assert!(stack.last().is_double() && stack.last().to_double().is_nan());
+    let back = value::pop_f64(&mut stack, scope).unwrap();
+    assert!(back.is_nan());
+
+    value::push_f32(&mut stack, f32::from_bits(0xFFFF_FFFF));
+    let back = value::pop_f32(&mut stack, scope).unwrap();
+    assert!(back.is_nan());
+}
+
+fn char_rejects_multichar(scope: &Scope<'_>) {
+    let mut stack = CallStack::new();
+    // A two-character string is not a valid char.
+    let s = js::JSString::from_str(scope, "ab").unwrap();
+    stack.push_value(s.as_value());
+    let err = value::pop_char(&mut stack, scope);
+    assert_type_error(scope, err);
+
+    // An empty string is not a valid char either.
+    let s = js::JSString::from_str(scope, "").unwrap();
+    stack.push_value(s.as_value());
+    assert_type_error(scope, value::pop_char(&mut stack, scope));
+}
+
+fn record_round_trip(scope: &Scope<'_>) {
+    let shape = TypeShape::Record(vec![
+        ("x".into(), TypeShape::U32),
+        ("y".into(), TypeShape::String),
+        ("z".into(), TypeShape::Bool),
+    ]);
+    let value = WitValue::Record(vec![
+        ("x".into(), WitValue::U32(7)),
+        ("y".into(), WitValue::String("hi".into())),
+        ("z".into(), WitValue::Bool(true)),
+    ]);
+    round_trip(scope, &shape, &value);
+}
+
+/// `pop_record` leaves the first field on top and the last field deepest.
+fn pop_record_stack_order(scope: &Scope<'_>) {
+    let fields = vec![
+        ("a".to_string(), TypeShape::U32),
+        ("b".to_string(), TypeShape::U32),
+        ("c".to_string(), TypeShape::U32),
+    ];
+
+    let mut stack = CallStack::new();
+    let obj = js::compile::evaluate(scope, "({ a: 10, b: 20, c: 30 })").unwrap();
+    let obj = Object::from_value(scope, obj).unwrap();
+    stack.push_object(&obj);
+
+    value::pop_record(&mut stack, scope, &field_names(&fields)).unwrap();
+    assert_eq!(stack.len(), 3, "pop_record must push one value per field");
+
+    // Force a GC across the destructured-but-not-yet-consumed values.
+    force_gc(scope);
+
+    // field[0] = a (10) is on top, then b (20), then c (30) deepest.
+    assert_eq!(
+        stack.pop_value().to_int32(),
+        10,
+        "field[0] (a) must be on top"
+    );
+    assert_eq!(stack.pop_value().to_int32(), 20, "field[1] (b) next");
+    assert_eq!(stack.pop_value().to_int32(), 30, "field[2] (c) deepest");
+    assert!(stack.is_empty());
+}
+
+/// `push_record` reads the first field from the deepest slot and the last field
+/// from the top.
+fn push_record_stack_order(scope: &Scope<'_>) {
+    let fields = vec![
+        ("a".to_string(), TypeShape::U32),
+        ("b".to_string(), TypeShape::U32),
+        ("c".to_string(), TypeShape::U32),
+    ];
+
+    let mut stack = CallStack::new();
+    // Forward lift order: field[0] (a) first and so deepest, field[2] (c) last
+    // and so on top.
+    stack.push_value(js::value::from_u32(10)); // a, deepest
+    stack.push_value(js::value::from_u32(20)); // b
+    stack.push_value(js::value::from_u32(30)); // c, on top
+
+    // Force a GC across the values before the record is assembled.
+    force_gc(scope);
+
+    value::push_record(&mut stack, scope, &field_names(&fields)).unwrap();
+    assert_eq!(
+        stack.len(),
+        1,
+        "push_record leaves exactly the record object"
+    );
+
+    let obj = pop_object(&mut stack, scope);
+    assert_eq!(obj.get_property(scope, c"a").unwrap().get().to_int32(), 10);
+    assert_eq!(obj.get_property(scope, c"b").unwrap().get().to_int32(), 20);
+    assert_eq!(obj.get_property(scope, c"c").unwrap().get().to_int32(), 30);
+    assert!(stack.is_empty());
+}
+
+fn tuple_round_trip(scope: &Scope<'_>) {
+    let shape = TypeShape::Tuple(vec![TypeShape::U8, TypeShape::String, TypeShape::S32]);
+    let value = WitValue::Tuple(vec![
+        WitValue::U8(1),
+        WitValue::String("two".into()),
+        WitValue::S32(-3),
+    ]);
+    round_trip(scope, &shape, &value);
+
+    // Cross-check: element ordering is positional in a JS array.
+    let mut stack = CallStack::new();
+    lift(&mut stack, scope, &shape, &value);
+    let arr = pop_object(&mut stack, scope);
+    assert_eq!(arr.get_element(scope, 0).unwrap().get().to_int32(), 1);
+    assert_eq!(arr.get_element(scope, 2).unwrap().get().to_int32(), -3);
+}
+
+fn variant_round_trips(scope: &Scope<'_>) {
+    let shape = TypeShape::Variant(vec![
+        ("none".into(), None),
+        ("num".into(), Some(TypeShape::U32)),
+        ("text".into(), Some(TypeShape::String)),
+    ]);
+    // Payload-free case.
+    round_trip(scope, &shape, &WitValue::Variant(0, None));
+    // Cases with payloads.
+    round_trip(
+        scope,
+        &shape,
+        &WitValue::Variant(1, Some(Box::new(WitValue::U32(5)))),
+    );
+    round_trip(
+        scope,
+        &shape,
+        &WitValue::Variant(2, Some(Box::new(WitValue::String("x".into())))),
+    );
+}
+
+fn enum_round_trips(scope: &Scope<'_>) {
+    let shape = TypeShape::Enum(vec!["red".into(), "green".into(), "blue".into()]);
+    round_trip(scope, &shape, &WitValue::Enum(0));
+    round_trip(scope, &shape, &WitValue::Enum(2));
+
+    // The JS form is the case index, so a value past the last case fails to
+    // lower rather than naming a case that does not exist.
+    let mut stack = CallStack::new();
+    stack.push_value(js::value::from_u32(3));
+    assert_type_error(scope, value::pop_enum(&mut stack, scope, 3));
+
+    // So does a value of the wrong type.
+    let s = js::JSString::from_str(scope, "purple").unwrap();
+    stack.push_value(s.as_value());
+    assert_type_error(scope, value::pop_enum(&mut stack, scope, 3));
+}
+
+/// `option<option<T>>` distinguishes `some(none)` from `none`.
+fn option_nesting(scope: &Scope<'_>) {
+    let flat = TypeShape::Option(Box::new(TypeShape::U32));
+    round_trip(scope, &flat, &WitValue::Option(None));
+    round_trip(
+        scope,
+        &flat,
+        &WitValue::Option(Some(Box::new(WitValue::U32(8)))),
+    );
+
+    let nested = TypeShape::Option(Box::new(TypeShape::Option(Box::new(TypeShape::U32))));
+    // none, some(none), some(some(x)) must all round-trip distinctly.
+    round_trip(scope, &nested, &WitValue::Option(None));
+    round_trip(
+        scope,
+        &nested,
+        &WitValue::Option(Some(Box::new(WitValue::Option(None)))),
+    );
+    round_trip(
+        scope,
+        &nested,
+        &WitValue::Option(Some(Box::new(WitValue::Option(Some(Box::new(
+            WitValue::U32(9),
+        )))))),
+    );
+
+    // Assert the exact JS shapes the three nested cases produce.
+    // none -> undefined
+    let mut stack = CallStack::new();
+    lift(&mut stack, scope, &nested, &WitValue::Option(None));
+    assert!(stack.last().is_undefined());
+    stack.pop_value();
+    // some(none) -> {val: undefined}
+    lift(
+        &mut stack,
+        scope,
+        &nested,
+        &WitValue::Option(Some(Box::new(WitValue::Option(None)))),
+    );
+    let obj = pop_object(&mut stack, scope);
+    assert!(obj.has_property(scope, c"val").unwrap());
+    assert!(obj
+        .get_property(scope, c"val")
+        .unwrap()
+        .get()
+        .is_undefined());
+    // some(some(9)) -> {val: 9}
+    lift(
+        &mut stack,
+        scope,
+        &nested,
+        &WitValue::Option(Some(Box::new(WitValue::Option(Some(Box::new(
+            WitValue::U32(9),
+        )))))),
+    );
+    let obj = pop_object(&mut stack, scope);
+    assert_eq!(obj.get_property(scope, c"val").unwrap().get().to_int32(), 9);
+}
+
+fn result_round_trips(scope: &Scope<'_>) {
+    // result<u32, string>
+    let both = TypeShape::Result(
+        Some(Box::new(TypeShape::U32)),
+        Some(Box::new(TypeShape::String)),
+    );
+    round_trip(
+        scope,
+        &both,
+        &WitValue::Result(Ok(Some(Box::new(WitValue::U32(1))))),
+    );
+    round_trip(
+        scope,
+        &both,
+        &WitValue::Result(Err(Some(Box::new(WitValue::String("bad".into()))))),
+    );
+
+    // result (no payloads either side)
+    let neither = TypeShape::Result(None, None);
+    round_trip(scope, &neither, &WitValue::Result(Ok(None)));
+    round_trip(scope, &neither, &WitValue::Result(Err(None)));
+
+    // result<_, string> (err payload only)
+    let err_only = TypeShape::Result(None, Some(Box::new(TypeShape::String)));
+    round_trip(scope, &err_only, &WitValue::Result(Ok(None)));
+    round_trip(
+        scope,
+        &err_only,
+        &WitValue::Result(Err(Some(Box::new(WitValue::String("e".into()))))),
+    );
+}
+
+fn flags_round_trip(scope: &Scope<'_>) {
+    let shape = TypeShape::Flags(vec!["a".into(), "b".into(), "c".into()]);
+    round_trip(scope, &shape, &WitValue::Flags(0b101));
+    round_trip(scope, &shape, &WitValue::Flags(0));
+    round_trip(scope, &shape, &WitValue::Flags(0b111));
+
+    // The JS value is the bit set, with one bit per flag in declaration order.
+    let mut stack = CallStack::new();
+    value::push_flags(&mut stack, 0b10);
+    let v = scope.root_value(stack.pop_value());
+    assert_eq!(v.to_int32(), 0b10);
+
+    // A bit at or above the flag count names no flag, so it fails to lower.
+    stack.push_value(js::value::from_u32(0b100));
+    assert_type_error(scope, value::pop_flags(&mut stack, scope, 2));
+
+    // A flag count of 32 leaves no bit without a flag.
+    stack.push_value(js::value::from_u32(u32::MAX));
+    assert_eq!(value::pop_flags(&mut stack, scope, 32).unwrap(), u32::MAX);
+
+    // A set with bit 31 is the negative int32 a bitwise-or produces, both when
+    // it lifts and when it lowers.
+    let high = js::compile::evaluate(scope, "(1 << 31) | 1").unwrap();
+    stack.push_value(high.get());
+    assert_eq!(
+        value::pop_flags(&mut stack, scope, 32).unwrap(),
+        0x8000_0001
+    );
+    value::push_flags(&mut stack, 0x8000_0001);
+    assert_eq!(stack.pop_value().to_int32(), (1 << 31) | 1);
+}
+
+fn list_round_trips(scope: &Scope<'_>) {
+    // list<u8> -> a real Uint8Array.
+    let u8_list = TypeShape::List(Box::new(TypeShape::U8));
+    let value = WitValue::List(vec![WitValue::U8(1), WitValue::U8(2), WitValue::U8(255)]);
+    round_trip(scope, &u8_list, &value);
+    // It lifts as a Uint8Array.
+    let mut stack = CallStack::new();
+    lift(&mut stack, scope, &u8_list, &value);
+    let obj = pop_object(&mut stack, scope);
+    let view = js::ArrayBufferView::from_object(obj).unwrap();
+    assert_eq!(view.view_kind(), js::typedarray::ViewKind::Uint8);
+
+    // list<u64> -> a BigUint64Array, and list<s64> -> a BigInt64Array, with
+    // values past the 32-bit and the safe-integer range.
+    let u64_list = TypeShape::List(Box::new(TypeShape::U64));
+    let value = WitValue::List(vec![
+        WitValue::U64(0),
+        WitValue::U64(u32::MAX as u64 + 1),
+        WitValue::U64((1 << 53) + 1),
+        WitValue::U64(u64::MAX),
+    ]);
+    round_trip(scope, &u64_list, &value);
+    let mut stack = CallStack::new();
+    lift(&mut stack, scope, &u64_list, &value);
+    let obj = pop_object(&mut stack, scope);
+    let view = js::ArrayBufferView::from_object(obj).unwrap();
+    assert_eq!(view.view_kind(), js::typedarray::ViewKind::BigUint64);
+
+    let s64_list = TypeShape::List(Box::new(TypeShape::S64));
+    let value = WitValue::List(vec![
+        WitValue::S64(-1),
+        WitValue::S64(i64::MIN),
+        WitValue::S64(-((1 << 53) + 1)),
+        WitValue::S64(i64::MAX),
+    ]);
+    round_trip(scope, &s64_list, &value);
+    let mut stack = CallStack::new();
+    lift(&mut stack, scope, &s64_list, &value);
+    let obj = pop_object(&mut stack, scope);
+    let view = js::ArrayBufferView::from_object(obj).unwrap();
+    assert_eq!(view.view_kind(), js::typedarray::ViewKind::BigInt64);
+
+    // list<string>
+    let str_list = TypeShape::List(Box::new(TypeShape::String));
+    round_trip(
+        scope,
+        &str_list,
+        &WitValue::List(vec![
+            WitValue::String("a".into()),
+            WitValue::String("bb".into()),
+        ]),
+    );
+
+    // list<list<string>>: a nested generic list, so the lift cursor stack has to
+    // nest too.
+    let nested_str = TypeShape::List(Box::new(TypeShape::List(Box::new(TypeShape::String))));
+    round_trip(
+        scope,
+        &nested_str,
+        &WitValue::List(vec![
+            WitValue::List(vec![WitValue::String("a".into())]),
+            WitValue::List(vec![]),
+            WitValue::List(vec![
+                WitValue::String("b".into()),
+                WitValue::String("c".into()),
+            ]),
+        ]),
+    );
+
+    // list<list<u32>>
+    let nested = TypeShape::List(Box::new(TypeShape::List(Box::new(TypeShape::U32))));
+    round_trip(
+        scope,
+        &nested,
+        &WitValue::List(vec![
+            WitValue::List(vec![WitValue::U32(1), WitValue::U32(2)]),
+            WitValue::List(vec![]),
+            WitValue::List(vec![WitValue::U32(3)]),
+        ]),
+    );
+
+    // list<record>
+    let rec = TypeShape::Record(vec![
+        ("k".into(), TypeShape::U32),
+        ("v".into(), TypeShape::String),
+    ]);
+    let rec_list = TypeShape::List(Box::new(rec));
+    round_trip(
+        scope,
+        &rec_list,
+        &WitValue::List(vec![
+            WitValue::Record(vec![
+                ("k".into(), WitValue::U32(1)),
+                ("v".into(), WitValue::String("one".into())),
+            ]),
+            WitValue::Record(vec![
+                ("k".into(), WitValue::U32(2)),
+                ("v".into(), WitValue::String("two".into())),
+            ]),
+        ]),
+    );
+}
+
+/// Lowering a `list<numeric>` whose typed array is the wrong element kind throws
+/// a TypeError rather than silently reinterpreting the bytes.
+fn numeric_list_kind_mismatch_throws(scope: &Scope<'_>) {
+    // A Uint16Array where list<u8> is expected: reinterpreting its bytes would
+    // ship the wrong canonical data, so it must be rejected.
+    let mut stack = CallStack::new();
+    let arr = js::Uint16Array::with_data(scope, &[1u16, 2, 3]).unwrap();
+    stack.push_value(arr.as_value());
+    assert_type_error(
+        scope,
+        value::pop_numeric_list(&mut stack, scope, &TypeShape::U8),
+    );
+
+    // The matching kind still lowers, with an exact element count.
+    let arr = js::Uint8Array::with_data(scope, &[10u8, 20, 30, 40]).unwrap();
+    stack.push_value(arr.as_value());
+    let (bytes, count) = pop_numeric_list_bytes(&mut stack, scope, &TypeShape::U8);
+    assert_eq!(count, 4);
+    assert_eq!(bytes, vec![10, 20, 30, 40]);
+
+    // Uint8ClampedArray is byte-identical to Uint8Array, so it is accepted for
+    // list<u8>.
+    let arr = js::Uint8ClampedArray::with_data(scope, &[7u8, 8]).unwrap();
+    stack.push_value(arr.as_value());
+    let (bytes, count) = pop_numeric_list_bytes(&mut stack, scope, &TypeShape::U8);
+    assert_eq!(count, 2);
+    assert_eq!(bytes, vec![7, 8]);
+
+    // The two 64-bit integer kinds are distinct: a BigInt64Array where list<u64>
+    // is expected is rejected, as is a Float64Array of the same element width.
+    let arr = js::BigInt64Array::with_data(scope, &[-1i64, 2]).unwrap();
+    stack.push_value(arr.as_value());
+    assert_type_error(
+        scope,
+        value::pop_numeric_list(&mut stack, scope, &TypeShape::U64),
+    );
+    let arr = js::Float64Array::with_data(scope, &[1.5f64]).unwrap();
+    stack.push_value(arr.as_value());
+    assert_type_error(
+        scope,
+        value::pop_numeric_list(&mut stack, scope, &TypeShape::U64),
+    );
+    let arr = js::BigUint64Array::with_data(scope, &[1u64]).unwrap();
+    stack.push_value(arr.as_value());
+    assert_type_error(
+        scope,
+        value::pop_numeric_list(&mut stack, scope, &TypeShape::S64),
+    );
+
+    // The matching kinds lower with their full 64-bit values.
+    let arr = js::BigUint64Array::with_data(scope, &[u64::MAX, 1 << 40]).unwrap();
+    stack.push_value(arr.as_value());
+    let (bytes, count) = pop_numeric_list_bytes(&mut stack, scope, &TypeShape::U64);
+    assert_eq!(count, 2);
+    assert_eq!(
+        numeric_list_from_bytes(&TypeShape::U64, &bytes, count),
+        vec![WitValue::U64(u64::MAX), WitValue::U64(1 << 40)]
+    );
+    let arr = js::BigInt64Array::with_data(scope, &[i64::MIN, -3]).unwrap();
+    stack.push_value(arr.as_value());
+    let (bytes, count) = pop_numeric_list_bytes(&mut stack, scope, &TypeShape::S64);
+    assert_eq!(count, 2);
+    assert_eq!(
+        numeric_list_from_bytes(&TypeShape::S64, &bytes, count),
+        vec![WitValue::S64(i64::MIN), WitValue::S64(-3)]
+    );
+}
+
+/// Lowering a value of the wrong JS type, or out of its type's range, throws a
+/// `TypeError` and returns `Err`.
+fn values_that_do_not_lower_throw(scope: &Scope<'_>) {
+    // A string where a u32 is expected.
+    let mut stack = CallStack::new();
+    let s = js::JSString::from_str(scope, "not a number").unwrap();
+    stack.push_value(s.as_value());
+    assert_type_error(scope, value::pop_u32(&mut stack, scope));
+
+    // A number larger than u32::MAX is rejected rather than silently wrapped:
+    // the lowering path range-checks instead of truncating via `as u32`.
+    stack.push_value(js::value::from_f64(5_000_000_000.0));
+    assert_type_error(scope, value::pop_u32(&mut stack, scope));
+
+    // A negative number lowering to an unsigned width is rejected, not wrapped.
+    stack.push_value(js::value::from_f64(-1.0));
+    assert_type_error(scope, value::pop_u32(&mut stack, scope));
+
+    // A fractional number is rejected, not truncated (3.7 must not become 3).
+    stack.push_value(js::value::from_f64(3.7));
+    assert_type_error(scope, value::pop_u8(&mut stack, scope));
+    // NaN must not lower to 0.
+    stack.push_value(js::value::from_f64(f64::NAN));
+    assert_type_error(scope, value::pop_u8(&mut stack, scope));
+
+    // A 64-bit integer must be a BigInt: a number is rejected, as assigning one
+    // to a `BigUint64Array` element is, whether or not it is integral.
+    for n in [42.0, (1u64 << 40) as f64, 1e30, -1.0, 2.5] {
+        stack.push_value(js::value::from_f64(n));
+        assert_type_error(scope, value::pop_u64(&mut stack, scope));
+        stack.push_value(js::value::from_f64(n));
+        assert_type_error(scope, value::pop_s64(&mut stack, scope));
+    }
+
+    // A number where a record (object) is expected.
+    stack.push_value(js::value::from_i32(5));
+    let fields = vec![("x".to_string(), TypeShape::U32)];
+    assert_type_error(
+        scope,
+        value::pop_record(&mut stack, scope, &field_names(&fields)),
+    );
+
+    // BigInt inputs are range-checked rather than taken modulo 2^64.
+    for (src, shape) in [
+        ("-1n", TypeShape::U64),
+        ("2n ** 64n", TypeShape::U64),
+        ("2n ** 63n", TypeShape::S64),
+        ("-(2n ** 63n) - 1n", TypeShape::S64),
+    ] {
+        let v = js::compile::evaluate(scope, src).unwrap();
+        stack.push_value(v.get());
+        let lowered = match shape {
+            TypeShape::U64 => value::pop_u64(&mut stack, scope).map(|_| ()),
+            _ => value::pop_s64(&mut stack, scope).map(|_| ()),
+        };
+        assert_type_error(scope, lowered);
+    }
+    // An in-range BigInt still lowers, at both ends of each range.
+    for (src, expected) in [("2n ** 64n - 1n", u64::MAX), ("0n", 0)] {
+        let v = js::compile::evaluate(scope, src).unwrap();
+        stack.push_value(v.get());
+        assert_eq!(value::pop_u64(&mut stack, scope).unwrap(), expected);
+    }
+    for (src, expected) in [("2n ** 63n - 1n", i64::MAX), ("-(2n ** 63n)", i64::MIN)] {
+        let v = js::compile::evaluate(scope, src).unwrap();
+        stack.push_value(v.get());
+        assert_eq!(value::pop_s64(&mut stack, scope).unwrap(), expected);
+    }
+
+    // A lone surrogate is not a Unicode scalar value, so it is no `char`.
+    let v = js::compile::evaluate(scope, "'\\uD800'").unwrap();
+    stack.push_value(v.get());
+    assert_type_error(scope, value::pop_char(&mut stack, scope));
+    // A well-formed surrogate pair is one supplementary-plane scalar value.
+    let v = js::compile::evaluate(scope, "'\\u{1F600}'").unwrap();
+    stack.push_value(v.get());
+    assert_eq!(value::pop_char(&mut stack, scope).unwrap(), '\u{1F600}');
+
+    // A non-array object where a list is expected throws rather than tripping an
+    // assertion on `length`'s `undefined`.
+    let v = js::compile::evaluate(scope, "({})").unwrap();
+    stack.push_value(v.get());
+    assert_type_error(scope, stack.lower_list_begin(scope));
+    stack.pop_value();
+
+    // A boolean where a string is expected.
+    stack.push_value(js::value::from_bool(true));
+    assert_type_error(scope, value::pop_string(&mut stack, scope));
+}
+
+/// A variant or enum discriminant from the host past the last case fails to
+/// lift instead of naming a case that does not exist.
+fn out_of_range_discriminants_throw(scope: &Scope<'_>) {
+    let mut stack = CallStack::new();
+    let cases = [(c"a", false), (c"b", true)];
+    assert_type_error(scope, value::push_variant(&mut stack, scope, &cases, 2));
+    assert_type_error(
+        scope,
+        value::push_variant(&mut stack, scope, &cases, u32::MAX),
+    );
+    assert_type_error(scope, value::push_enum(&mut stack, scope, 3, 3));
+    assert!(stack.is_empty());
+}
+
+/// A list whose elements change it while it is lowered, and a proxy of an
+/// array, fail to lower or lower what they hold, without a panic.
+fn list_that_changes_while_lowered_fails_cleanly(scope: &Scope<'_>) {
+    let mut stack = CallStack::new();
+    let list = js::compile::evaluate(
+        scope,
+        "const shrinking = [1, 2, 3];
+         Object.defineProperty(shrinking, 0, { get() { shrinking.length = 1; return 1; } });
+         shrinking",
+    )
+    .unwrap();
+    stack.push_value(list.get());
+    assert_eq!(stack.lower_list_begin(scope).unwrap(), 3);
+    stack.lower_list_next(scope).unwrap();
+    assert_eq!(value::pop_u32(&mut stack, scope).unwrap(), 1);
+    stack.lower_list_next(scope).unwrap();
+    assert_type_error(scope, value::pop_u32(&mut stack, scope));
+    stack.lower_list_end();
+    assert!(stack.is_empty());
+
+    let proxy = js::compile::evaluate(scope, "new Proxy([1, 2], {})").unwrap();
+    stack.push_value(proxy.get());
+    assert_type_error(scope, stack.lower_list_begin(scope));
+
+    let check =
+        wit_bridge::validate::check(scope, proxy, &TypeShape::List(Box::new(TypeShape::U32)));
+    assert!(check.is_err());
+    assert!(!js::exception::is_pending(scope));
+}
+
+/// A numeric list's snapshot holds a copy of the viewed elements, and a list
+/// layout whose size overflows is `None`.
+fn numeric_list_snapshots_copy_their_elements(scope: &Scope<'_>) {
+    use wit_bridge::validate::snapshot;
+    use wit_bridge::value::TypeShapeValue;
+
+    let numeric_bytes = |snapshot: TypeShapeValue| match snapshot {
+        TypeShapeValue::NumericList(list) => list.bytes().to_vec(),
+        _ => panic!("expected a numeric list"),
+    };
+    let bytes = TypeShape::List(Box::new(TypeShape::U8));
+    let clamped = js::compile::evaluate(scope, "new Uint8ClampedArray([1, 255])").unwrap();
+    let copy = snapshot(scope, clamped, &bytes).unwrap();
+    assert_eq!(numeric_bytes(copy), [1, 255]);
+
+    let words = TypeShape::List(Box::new(TypeShape::U16));
+    let offset = js::compile::evaluate(
+        scope,
+        "globalThis.words = new Uint16Array(new Uint16Array([9, 7, 8, 9]).buffer, 2, 2)",
+    )
+    .unwrap();
+    let copy = snapshot(scope, offset, &words).unwrap();
+    js::compile::evaluate(scope, "words[0] = 1").unwrap();
+    let expected: Vec<u8> = [7u16, 8].iter().flat_map(|w| w.to_ne_bytes()).collect();
+    assert_eq!(numeric_bytes(copy), expected);
+
+    let empty = js::compile::evaluate(scope, "new Uint16Array(0)").unwrap();
+    let mut stack = CallStack::new();
+    stack.push_shaped(snapshot(scope, empty, &words).unwrap());
+    let (ptr, layout, count) = value::pop_numeric_list(&mut stack, scope, &TypeShape::U16).unwrap();
+    assert_eq!((count, layout.size(), layout.align()), (0, 0, 2));
+    assert!(!ptr.is_null() && (ptr as usize).is_multiple_of(2));
+
+    assert_eq!(
+        TypeShape::U64
+            .numeric_list_layout(3)
+            .map(|layout| layout.size()),
+        Some(24)
+    );
+    assert!(TypeShape::U64.numeric_list_layout(usize::MAX / 4).is_none());
+}
+
+// ===========================================================================
+// ComponentError and resources
+// ===========================================================================
+
+use std::cell::RefCell;
+
+/// The handle [`record_imported_drop`] throws for.
+const THROWING_HANDLE: u32 = 666;
+
+thread_local! {
+    /// Handles dropped by [`record_imported_drop`] during a test, in call order.
+    static DROPPED: RefCell<Vec<u32>> = const { RefCell::new(Vec::new()) };
+}
+
+/// The drop function of imported resources the suite sets. It records the
+/// handle it drops, and throws for [`THROWING_HANDLE`] instead, to exercise
+/// `release_borrows`' drain past a throwing drop.
+fn record_imported_drop(
+    scope: &Scope<'_>,
+    _type_idx: u32,
+    handle: u32,
+) -> Result<(), js::error::ExnThrown> {
+    if handle == THROWING_HANDLE {
+        return Err(js::error::throw_type_error(scope, c"dispose boom"));
+    }
+    DROPPED.with(|d| d.borrow_mut().push(handle));
+    Ok(())
+}
+
+fn take_dropped() -> Vec<u32> {
+    DROPPED.with(|d| std::mem::take(&mut *d.borrow_mut()))
+}
+
+thread_local! {
+    /// Canonical handles passed to an exported resource type's `[resource-drop]`
+    /// during a test, in call order.
+    static DROPPED_EXPORTED: RefCell<Vec<u32>> = const { RefCell::new(Vec::new()) };
+}
+
+/// The `drop` operation for a test's `ResourceDesc::Exported`.
+fn record_exported_drop(handle: u32) {
+    DROPPED_EXPORTED.with(|d| d.borrow_mut().push(handle));
+}
+
+/// The exported-handle release callback `release_borrows` takes. The type index
+/// is unused.
+fn record_exported_borrow_drop(_type_idx: u32, handle: u32) {
+    record_exported_drop(handle);
+}
+
+fn take_dropped_exported() -> Vec<u32> {
+    DROPPED_EXPORTED.with(|d| std::mem::take(&mut *d.borrow_mut()))
+}
+
+/// Run `release_borrows` for a call that didn't borrow a handle, which drops the
+/// handles of the wrappers collected since the last release.
+fn drop_collected_handles(scope: &Scope<'_>) {
+    resources::release_borrows(&mut CallStack::new(), scope, &record_exported_borrow_drop).unwrap();
+}
+
+/// An imported wrapper the guest abandons has its handle dropped by the next
+/// `release_borrows` once it is collected, and not before.
+fn abandoned_wrapper_is_dropped_by_gc(scope: &Scope<'_>) {
+    take_dropped();
+
+    {
+        // An inner scope, so the wrapper's root slot is released when it ends.
+        // The outer scope holds its slots for the whole test.
+        let inner = scope.inner_scope();
+        let wrapper = resources::wrap_imported(&inner, 4242, 5, None).unwrap();
+        assert_eq!(wrapper_handle(&inner, &wrapper), Some(4242));
+    }
+
+    force_gc(scope);
+    assert_eq!(take_dropped(), Vec::<u32>::new());
+    drop_collected_handles(scope);
+
+    assert_eq!(
+        take_dropped(),
+        vec![4242],
+        "an abandoned imported wrapper must have its handle dropped by the collector"
+    );
+}
+
+/// An imported wrapper lent to the host stays reachable through the call's
+/// stack, however many collections run during the call, and the end of the call
+/// leaves it undisposed.
+fn lent_wrapper_is_kept_for_the_call(scope: &Scope<'_>) {
+    take_dropped();
+    let mut stack = CallStack::new();
+
+    {
+        // An inner scope, so the wrapper's root slot is released when it ends.
+        let inner = scope.inner_scope();
+        let wrapper = resources::wrap_imported(&inner, 4343, 6, None).unwrap();
+        stack.push_object(&wrapper);
+        let desc = ResourceDesc::Imported { type_idx: 6 };
+        assert_eq!(
+            resources::pop_borrow(&mut stack, &inner, &desc).unwrap(),
+            4343
+        );
+    }
+
+    force_gc(scope);
+    drop_collected_handles(scope);
+    assert_eq!(
+        take_dropped(),
+        Vec::<u32>::new(),
+        "a lent wrapper must not be collected during the call"
+    );
+
+    // `release_borrows` roots each object in the scope it is given, so it gets a
+    // scope that ends with it.
+    resources::release_borrows(
+        &mut stack,
+        &scope.inner_scope(),
+        &record_exported_borrow_drop,
+    )
+    .unwrap();
+    assert_eq!(
+        take_dropped(),
+        Vec::<u32>::new(),
+        "ending the lend must not dispose"
+    );
+
+    // Once the call has ended, the wrapper is collectible again.
+    drop(stack);
+    force_gc(scope);
+    drop_collected_handles(scope);
+    assert_eq!(take_dropped(), vec![4343]);
+}
+
+/// The handle the wrapper `obj` holds, or `None` if it holds no handle or is not
+/// a wrapper.
+fn wrapper_handle(scope: &Scope<'_>, obj: &Object<'_>) -> Option<u32> {
+    resources::imported_handle(scope, scope.root_value(obj.as_value()))
+}
+
+/// `ComponentError`: construct from JS, extract its payload, and confirm the
+/// prototype chain (`instanceof Error`).
+fn component_error_holds_its_payload(scope: &Scope<'_>) {
+    // Construct with an object payload.
+    let v = js::compile::evaluate(scope, "new ComponentError({ code: 7 })").unwrap();
+    let payload = wit_bridge::component_error_payload(scope, v).expect("value is a ComponentError");
+    let payload_obj = Object::from_value(scope, payload).unwrap();
+    let code = payload_obj.get_property(scope, c"code").unwrap().get();
+    assert!(code.is_int32() && code.to_int32() == 7);
+
+    // A string payload becomes the message verbatim, while a non-string payload's
+    // message mentions `error.payload`.
+    assert_eq!(
+        eval_string(scope, "new ComponentError('boom').message"),
+        "boom"
+    );
+    assert_eq!(
+        eval_string(scope, "new ComponentError(42).message"),
+        "42 (see error.payload)"
+    );
+    // An `undefined` payload leaves the empty `message` of `Error.prototype`.
+    assert_eq!(
+        eval_string(
+            scope,
+            "(e => `${Object.hasOwn(e, 'message')} ${e}`)(new ComponentError(undefined))"
+        ),
+        "false ComponentError"
+    );
+    assert_eq!(
+        eval_string(
+            scope,
+            "Object.prototype.toString.call(new ComponentError('x'))"
+        ),
+        "[object Error]"
+    );
+
+    // `message` is a non-enumerable own property, as it is on a native `Error`.
+    assert_eq!(
+        eval_string(scope, "Object.keys(new ComponentError('x')).join(',')"),
+        ""
+    );
+    assert_eq!(
+        eval_string(scope, "JSON.stringify(new ComponentError('x'))"),
+        "{}"
+    );
+
+    // Prototype chain and brand.
+    assert_eq!(
+        eval_string(scope, "String(new ComponentError('x') instanceof Error)"),
+        "true"
+    );
+    assert_eq!(
+        eval_string(
+            scope,
+            "String(new ComponentError('x') instanceof ComponentError)"
+        ),
+        "true"
+    );
+    assert_eq!(eval_string(scope, "ComponentError.name"), "ComponentError");
+    assert_eq!(
+        eval_string(scope, "new ComponentError('x').name"),
+        "ComponentError"
+    );
+    assert_eq!(
+        eval_string(scope, "String(new ComponentError('x'))"),
+        "ComponentError: x"
+    );
+
+    // A thrown ComponentError is captured with the stack it was created with.
+    assert!(js::compile::evaluate(
+        scope,
+        "(function thrower() { throw new ComponentError('x'); })()"
+    )
+    .is_err());
+    let captured = js::error::ExnThrown::capture(scope);
+    assert!(
+        captured
+            .stack
+            .as_deref()
+            .is_some_and(|stack| stack.contains("thrower")),
+        "{captured:?}"
+    );
+
+    // A plain object is not a ComponentError.
+    let plain = js::compile::evaluate(scope, "({})").unwrap();
+    assert!(wit_bridge::component_error_payload(scope, plain).is_none());
+    // A plain Error is not a ComponentError either.
+    let err = js::compile::evaluate(scope, "new Error('nope')").unwrap();
+    assert!(wit_bridge::component_error_payload(scope, err).is_none());
+
+    force_gc(scope);
+}
+
+/// An error class extends `ComponentError` after the application replaced
+/// `ComponentError.prototype.constructor`.
+fn error_class_extends_component_error(scope: &Scope<'_>) {
+    js::compile::evaluate(
+        scope,
+        "globalThis.savedConstructor = ComponentError.prototype.constructor; \
+         ComponentError.prototype.constructor = class Other {};",
+    )
+    .unwrap();
+    let class = wit_bridge::ErrorClass {
+        interface: None,
+        name: "late-error".to_string(),
+        enum_cases: Vec::new(),
+    };
+    let created = wit_bridge::create_error_class(scope, &class).unwrap();
+    let check = js::compile::evaluate(
+        scope,
+        "(C) => { \
+             ComponentError.prototype.constructor = globalThis.savedConstructor; \
+             const e = new C('x'); \
+             return `${C.name} ${e instanceof ComponentError} ${e.name}`; \
+         }",
+    )
+    .unwrap();
+    let result = js::Function::call(
+        scope,
+        js::prelude::HandleValue::undefined(),
+        check,
+        &[created],
+    )
+    .unwrap();
+    assert_eq!(as_string(scope, result), "LateError true LateError");
+}
+
+/// An imported owned resource: `wrap_imported` creates a wrapper holding the
+/// handle. `unwrap_to_canon(owned=false)` reads the handle back,
+/// `unwrap_to_canon(owned=true)` takes the handle, and either rejects a wrapper
+/// of another resource type.
+fn imported_resource_round_trip(scope: &Scope<'_>) {
+    let wrapper = resources::wrap_imported(scope, 42, 3, None).unwrap();
+    assert_eq!(wrapper_handle(scope, &wrapper), Some(42));
+
+    // No property a guest defines changes the handle the wrapper lowers to.
+    let define = js::compile::evaluate(
+        scope,
+        "(w) => { w.handle = 7; Object.defineProperty(w, 'type', { value: 4 }); }",
+    )
+    .unwrap();
+    js::Function::call(
+        scope,
+        js::prelude::HandleValue::undefined(),
+        define,
+        &[wrapper],
+    )
+    .unwrap();
+    assert_eq!(wrapper_handle(scope, &wrapper), Some(42));
+
+    force_gc(scope);
+
+    // Borrowed lower: handle read back, wrapper unchanged.
+    let wrapper_v = scope.root_value(wrapper.as_value());
+    let borrowed = resources::unwrap_to_canon(scope, wrapper_v, 3, false).unwrap();
+    assert_eq!(borrowed, 42);
+
+    // A wrapper of another resource type is rejected, and keeps its handle.
+    assert_type_error(
+        scope,
+        resources::unwrap_to_canon(scope, wrapper_v, 4, false),
+    );
+    assert_type_error(scope, resources::unwrap_to_canon(scope, wrapper_v, 4, true));
+    assert_eq!(wrapper_handle(scope, &wrapper), Some(42));
+
+    // A plain object with the wrapper's prototype is not a wrapper.
+    let forged =
+        js::compile::evaluate(scope, "(w) => Object.create(Object.getPrototypeOf(w))").unwrap();
+    let forged = js::Function::call(
+        scope,
+        js::prelude::HandleValue::undefined(),
+        forged,
+        &[wrapper],
+    )
+    .unwrap();
+    assert_type_error(scope, resources::unwrap_to_canon(scope, forged, 3, false));
+
+    // Owned lower of a frozen wrapper: the handle is read back and taken.
+    let freeze = js::compile::evaluate(scope, "Object.freeze").unwrap();
+    js::Function::call(
+        scope,
+        js::prelude::HandleValue::undefined(),
+        freeze,
+        &[wrapper],
+    )
+    .unwrap();
+    let owned = resources::unwrap_to_canon(scope, wrapper_v, 3, true).unwrap();
+    assert_eq!(owned, 42);
+    assert_eq!(wrapper_handle(scope, &wrapper), None);
+
+    // A second owned lower now fails, because the handle is gone, so a
+    // transferred handle cannot be lowered or dropped twice.
+    assert_type_error(scope, resources::unwrap_to_canon(scope, wrapper_v, 3, true));
+
+    force_gc(scope);
+}
+
+/// `[Symbol.dispose]` of the imported resource classes drops a wrapper's handle
+/// once, and does nothing for a wrapper whose handle moved to the host. Called
+/// on an object that is not a wrapper, it throws a `TypeError`.
+fn imported_resource_dispose(scope: &Scope<'_>) {
+    take_dropped();
+    let dispose = resources::dispose_function(scope).unwrap();
+
+    let wrapper = resources::wrap_imported(scope, 99, 1, None).unwrap();
+    js::Function::call(scope, wrapper, dispose, js::function::EmptyArgs).unwrap();
+    assert_eq!(take_dropped(), vec![99]);
+    assert_eq!(wrapper_handle(scope, &wrapper), None);
+    js::Function::call(scope, wrapper, dispose, js::function::EmptyArgs).unwrap();
+    assert!(
+        take_dropped().is_empty(),
+        "a second dispose must do nothing"
+    );
+
+    // After an owned lower takes the handle, dispose does nothing.
+    let moved = resources::wrap_imported(scope, 98, 1, None).unwrap();
+    let moved_v = scope.root_value(moved.as_value());
+    resources::unwrap_to_canon(scope, moved_v, 1, true).unwrap();
+    js::Function::call(scope, moved, dispose, js::function::EmptyArgs).unwrap();
+    assert!(
+        take_dropped().is_empty(),
+        "disposing of a moved wrapper must do nothing"
+    );
+
+    let plain = Object::new_plain(scope).unwrap();
+    assert!(js::Function::call(scope, plain, dispose, js::function::EmptyArgs).is_err());
+    let message = js::error::ExnThrown::capture(scope).message;
+    assert!(
+        message
+            .as_deref()
+            .is_some_and(|m| m.contains("not a resource wrapper")),
+        "{message:?}"
+    );
+
+    force_gc(scope);
+}
+
+/// The exported-resource slab: insert -> rep, lookup round-trips the same
+/// object, remove empties the slot.
+fn exported_slab_reuses_freed_reps(scope: &Scope<'_>) {
+    let a = js::compile::evaluate(scope, "({ tag: 'a' })").unwrap();
+    let a = Object::from_value(scope, a).unwrap();
+    let b = js::compile::evaluate(scope, "({ tag: 'b' })").unwrap();
+    let b = Object::from_value(scope, b).unwrap();
+
+    let (rep_a, rep_b) =
+        resources::with_exported_resources(|slab| (slab.insert(&a, 0), slab.insert(&b, 0)));
+    assert_ne!(rep_a, rep_b);
+
+    force_gc(scope);
+
+    // Lookup returns the same JS object identity.
+    resources::with_exported_resources(|slab| {
+        let looked = slab.lookup(rep_a).unwrap().get(scope);
+        let tag = looked.get_property(scope, c"tag").unwrap();
+        assert_eq!(as_string(scope, tag), "a");
+    });
+
+    // Remove empties the slot, and the freed rep is reused by the next insert.
+    let removed = resources::with_exported_resources(|slab| slab.remove(scope, rep_a));
+    assert!(removed.is_some());
+    resources::with_exported_resources(|slab| assert!(slab.lookup(rep_a).is_none()));
+    let c = js::compile::evaluate(scope, "({ tag: 'c' })").unwrap();
+    let c = Object::from_value(scope, c).unwrap();
+    let rep_c = resources::with_exported_resources(|slab| slab.insert(&c, 0));
+    assert_eq!(rep_c, rep_a, "a freed rep is reused");
+
+    // The slab is shared with the later cases.
+    resources::with_exported_resources(|slab| {
+        slab.remove(scope, rep_b);
+        slab.remove(scope, rep_c);
+    });
+
+    force_gc(scope);
+}
+
+/// Each `exported_resource_to_canon` of the same object inserts it into the
+/// slab again and creates a new handle, and leaves no handle on the object.
+fn exported_resource_to_canon_mints_per_lowering(scope: &Scope<'_>) {
+    use std::cell::Cell;
+
+    let next_handle = Cell::new(1000u32);
+    let new = |_rep: u32| {
+        let h = next_handle.get();
+        next_handle.set(h + 1);
+        h
+    };
+    let rep = |handle: u32| handle - 1000; // inverse of `new`'s rep->handle map
+    let desc = ResourceDesc::Exported {
+        type_idx: 5,
+        new: &new,
+        rep: &rep,
+        drop: &record_exported_drop,
+    };
+
+    let obj_v = js::compile::evaluate(scope, "({ kind: 'exported' })").unwrap();
+    let h1 = resources::exported_resource_to_canon(scope, &desc, obj_v).unwrap();
+    assert_eq!(h1, 1000);
+    let h2 = resources::exported_resource_to_canon(scope, &desc, obj_v).unwrap();
+    assert_eq!(h2, 1001, "a second lowering mints a new handle");
+    let obj = Object::from_value(scope, obj_v).unwrap();
+    assert_eq!(wrapper_handle(scope, &obj), None);
+
+    // Both lowerings' slab entries hold the object, so clean them up.
+    resources::with_exported_resources(|slab| {
+        assert!(slab.remove(scope, rep(h1)).is_some());
+        assert!(slab.remove(scope, rep(h2)).is_some());
+    });
+
+    force_gc(scope);
+}
+
+/// An exported object that is lowered, lifted as an `own`, and lowered again
+/// is inserted into the slab again with a new rep, and a `push_borrow` of that
+/// rep returns the same object.
+fn exported_resource_reexport_round_trip(scope: &Scope<'_>) {
+    use std::cell::Cell;
+
+    // `new` maps a rep to `rep + 8000`, and `rep` maps it back.
+    let new_calls = Cell::new(0u32);
+    let new = |rep: u32| {
+        new_calls.set(new_calls.get() + 1);
+        rep + 8000
+    };
+    let rep = |handle: u32| handle - 8000;
+    let desc = ResourceDesc::Exported {
+        type_idx: 11,
+        new: &new,
+        rep: &rep,
+        drop: &record_exported_drop,
+    };
+
+    let mut stack = CallStack::new();
+
+    // Out (1): lower a fresh JS object, which enters the slab and gets a handle.
+    let obj = js::compile::evaluate(scope, "({ marker: 'reexport' })").unwrap();
+    let obj = Object::from_value(scope, obj).unwrap();
+    stack.push_object(&obj);
+    let handle1 = resources::pop_own(&mut stack, scope, &desc).unwrap();
+    assert_eq!(new_calls.get(), 1, "first crossing mints a handle");
+    assert_eq!(
+        wrapper_handle(scope, &obj),
+        None,
+        "lowering an own transfers the handle out of the guest's table"
+    );
+
+    force_gc(scope);
+
+    // In: lift the handle back owned. The slab entry is removed and the handle
+    // is released back to the guest's table.
+    resources::push_own(&mut stack, scope, &desc, handle1).unwrap();
+    let back = Object::from_raw_value(scope, stack.pop_value()).unwrap();
+    assert_eq!(
+        take_dropped_exported(),
+        vec![handle1],
+        "lifting an own back in must release the handle the host's lower added"
+    );
+    resources::with_exported_resources(|slab| assert!(slab.lookup(rep(handle1)).is_none()));
+
+    force_gc(scope);
+
+    // Out (2): re-export the same object. It re-enters the slab and `new` runs
+    // again. The free list reuses the freed slot, so the fresh rep, and thus the
+    // handle, may equal the first one.
+    let back_v = scope.root_value(back.as_value());
+    let handle2 = resources::exported_resource_to_canon(scope, &desc, back_v).unwrap();
+    assert_eq!(new_calls.get(), 2, "re-export must mint a fresh handle");
+
+    // A `push_borrow` of the fresh rep finds the same object in the slab.
+    resources::push_borrow(&mut stack, scope, &desc, rep(handle2)).unwrap();
+    let borrowed = Object::from_raw_value(scope, stack.pop_value()).unwrap();
+    let marker = borrowed.get_property(scope, c"marker").unwrap();
+    assert_eq!(
+        as_string(scope, marker),
+        "reexport",
+        "re-exported rep resolves back to the original object"
+    );
+
+    // Clean up the slab so later tests start fresh.
+    resources::with_exported_resources(|slab| {
+        slab.remove(scope, rep(handle2));
+    });
+
+    drop(stack);
+    force_gc(scope);
+}
+
+thread_local! {
+    /// The number of calls of the functions `recording_dispose` builds.
+    static DISPOSE_CALLS: RefCell<u32> = const { RefCell::new(0) };
+}
+
+/// A JS function that counts its calls in [`DISPOSE_CALLS`], for an exported
+/// object's `[Symbol.dispose]`.
+fn recording_dispose<'s>(scope: &'s Scope<'_>) -> HandleValue<'s> {
+    let f = js::Function::new_callback(
+        scope,
+        c"recordingDispose",
+        0,
+        |_scope, _args, _payload| {
+            DISPOSE_CALLS.with(|c| *c.borrow_mut() += 1);
+            Ok(js::value::undefined())
+        },
+        (),
+    )
+    .unwrap();
+    scope.root_value(f.as_value())
+}
+
+fn take_dispose_calls() -> u32 {
+    DISPOSE_CALLS.with(|c| std::mem::take(&mut *c.borrow_mut()))
+}
+
+/// `drop_exported` removes the slab entry and calls the object's
+/// `[Symbol.dispose]` once. A second `drop_exported` of the freed rep does
+/// nothing.
+fn dropping_an_exported_resource_calls_its_dispose(scope: &Scope<'_>) {
+    take_dispose_calls();
+
+    let new = |rep: u32| rep + 5000;
+    let rep = |handle: u32| handle - 5000;
+    let desc = ResourceDesc::Exported {
+        type_idx: 13,
+        new: &new,
+        rep: &rep,
+        drop: &record_exported_drop,
+    };
+
+    // Lowering an object with a recording `[Symbol.dispose]` inserts it into
+    // the slab.
+    let obj = js::compile::evaluate(scope, "({ marker: 'drop-hook' })").unwrap();
+    let obj = Object::from_value(scope, obj).unwrap();
+    let hook = recording_dispose(scope);
+    js::class::define_well_known_symbol_property(scope, obj, SymbolCode::dispose, hook).unwrap();
+
+    let mut stack = CallStack::new();
+    stack.push_object(&obj);
+    let handle = resources::pop_own(&mut stack, scope, &desc).unwrap();
+    let resource_rep = rep(handle);
+
+    // The object is in the slab with its recorded type index.
+    resources::with_exported_resources(|slab| assert!(slab.lookup(resource_rep).is_some()));
+
+    force_gc(scope);
+
+    resources::drop_exported(scope, resource_rep, 13).unwrap();
+    assert_eq!(take_dispose_calls(), 1, "`[Symbol.dispose]` is called once");
+    resources::with_exported_resources(|slab| {
+        assert!(
+            slab.lookup(resource_rep).is_none(),
+            "the slab entry is removed on drop"
+        )
+    });
+
+    resources::drop_exported(scope, resource_rep, 13).unwrap();
+    assert_eq!(
+        take_dispose_calls(),
+        0,
+        "a second drop neither calls `[Symbol.dispose]` nor traps"
+    );
+
+    drop(stack);
+    force_gc(scope);
+}
+
+/// Collecting an exported object does not call its `[Symbol.dispose]`. Only
+/// `drop_exported` calls it.
+fn collecting_an_exported_object_does_not_run_its_dispose(scope: &Scope<'_>) {
+    take_dispose_calls();
+
+    let new = |rep: u32| rep + 6000;
+    let rep = |handle: u32| handle - 6000;
+    let desc = ResourceDesc::Exported {
+        type_idx: 17,
+        new: &new,
+        rep: &rep,
+        drop: &record_exported_drop,
+    };
+
+    // Lower an object with a recording `[Symbol.dispose]`, then remove it from
+    // the slab without `drop_exported`. Its roots are in `inner`, so nothing
+    // references it once `inner` ends.
+    {
+        let inner = scope.inner_scope();
+        let obj = js::compile::evaluate(&inner, "({ marker: 'finalizer' })").unwrap();
+        let obj = Object::from_value(&inner, obj).unwrap();
+        let hook = recording_dispose(&inner);
+        js::class::define_well_known_symbol_property(&inner, obj, SymbolCode::dispose, hook)
+            .unwrap();
+        let mut stack = CallStack::new();
+        stack.push_object(&obj);
+        let handle = resources::pop_own(&mut stack, &inner, &desc).unwrap();
+        resources::with_exported_resources(|slab| {
+            slab.remove(&inner, rep(handle));
+        });
+    }
+
+    force_gc(scope);
+    force_gc(scope);
+    core_runtime::event_loop::run_microtasks(scope);
+    drop_collected_handles(scope);
+
+    assert_eq!(
+        take_dispose_calls(),
+        0,
+        "collecting an exported object must not run its `[Symbol.dispose]`"
+    );
+}
+
+/// An exported object lent to the host is removed from the slab when the call
+/// ends.
+///
+/// Lowering it as a `borrow` creates a handle and inserts the object into the
+/// slab, and `release_borrows` drops the handle and removes the object. Each
+/// borrow of the same object creates its own handle.
+fn exported_borrow_release(scope: &Scope<'_>) {
+    use std::cell::Cell;
+
+    take_dropped_exported();
+
+    let new_calls = Cell::new(0u32);
+    let new = |rep: u32| {
+        new_calls.set(new_calls.get() + 1);
+        rep + 9000
+    };
+    let rep = |handle: u32| handle - 9000;
+    let desc = ResourceDesc::Exported {
+        type_idx: 19,
+        new: &new,
+        rep: &rep,
+        drop: &record_exported_drop,
+    };
+
+    let mut stack = CallStack::new();
+
+    let obj = js::compile::evaluate(scope, "({ marker: 'exp-borrow' })").unwrap();
+    let obj = Object::from_value(scope, obj).unwrap();
+
+    // Lower it as a borrow argument, as calling an import with `borrow<r>` does.
+    stack.push_object(&obj);
+    let handle = resources::pop_borrow(&mut stack, scope, &desc).unwrap();
+    assert_eq!(new_calls.get(), 1);
+    resources::with_exported_resources(|slab| assert!(slab.lookup(rep(handle)).is_some()));
+
+    force_gc(scope);
+
+    resources::release_borrows(&mut stack, scope, &record_exported_borrow_drop).unwrap();
+    assert_eq!(take_dropped_exported(), vec![handle]);
+    resources::with_exported_resources(|slab| {
+        assert!(
+            slab.lookup(rep(handle)).is_none(),
+            "the borrow must not pin the object in the slab"
+        )
+    });
+
+    // A second borrow of the same object creates a new handle instead of
+    // reusing the released one.
+    stack.push_object(&obj);
+    let handle2 = resources::pop_borrow(&mut stack, scope, &desc).unwrap();
+    assert_eq!(new_calls.get(), 2);
+    resources::release_borrows(&mut stack, scope, &record_exported_borrow_drop).unwrap();
+    assert_eq!(take_dropped_exported(), vec![handle2]);
+
+    // Lent to two calls at once, as two concurrent async imports do, the object
+    // gets a handle per call, and the end of the first call leaves the second
+    // call's handle and slab entry in place.
+    let mut other = CallStack::new();
+    stack.push_object(&obj);
+    let first = resources::pop_borrow(&mut stack, scope, &desc).unwrap();
+    other.push_object(&obj);
+    let second = resources::pop_borrow(&mut other, scope, &desc).unwrap();
+    assert_ne!(first, second);
+    resources::release_borrows(&mut stack, scope, &record_exported_borrow_drop).unwrap();
+    assert_eq!(take_dropped_exported(), vec![first]);
+    resources::with_exported_resources(|slab| assert!(slab.lookup(rep(second)).is_some()));
+    force_gc(scope);
+    resources::release_borrows(&mut other, scope, &record_exported_borrow_drop).unwrap();
+    assert_eq!(take_dropped_exported(), vec![second]);
+    resources::with_exported_resources(|slab| assert!(slab.lookup(rep(second)).is_none()));
+
+    drop(other);
+    drop(stack);
+    force_gc(scope);
+}
+
+/// Releasing an imported borrow drops its handle and leaves the wrapper without
+/// one, so a wrapper kept by JS can't pass the released handle back to the
+/// host.
+fn a_released_imported_borrow_loses_its_handle(scope: &Scope<'_>) {
+    take_dropped();
+    let mut stack = CallStack::new();
+
+    let desc = ResourceDesc::Imported { type_idx: 0 };
+    resources::push_borrow(&mut stack, scope, &desc, 55).unwrap();
+    let wrapper = Object::from_raw_value(scope, stack.pop_value()).unwrap();
+    assert_eq!(wrapper_handle(scope, &wrapper), Some(55));
+
+    resources::release_borrows(&mut stack, scope, &record_exported_borrow_drop).unwrap();
+    assert_eq!(take_dropped(), vec![55]);
+    assert_eq!(
+        wrapper_handle(scope, &wrapper),
+        None,
+        "a released borrow must not keep the host's handle"
+    );
+
+    // A method call on the kept wrapper now fails instead of passing the
+    // released handle to the host.
+    let wrapper_v = scope.root_value(wrapper.as_value());
+    assert_type_error(
+        scope,
+        resources::unwrap_to_canon(scope, wrapper_v, 0, false),
+    );
+
+    drop(stack);
+    force_gc(scope);
+}
+
+/// An exception thrown while releasing one borrow doesn't stop the release of
+/// the others, and is returned as `Err` with a pending exception.
+fn borrow_release_drains_through_throw(scope: &Scope<'_>) {
+    take_dropped();
+    let mut stack = CallStack::new();
+
+    // Push borrows 10, THROWING_HANDLE, 30. Drain order is LIFO, so the
+    // middle-drained borrow throws on drop.
+    let desc = ResourceDesc::Imported { type_idx: 0 };
+    for handle in [10, THROWING_HANDLE, 30] {
+        resources::push_borrow(&mut stack, scope, &desc, handle).unwrap();
+        stack.pop_value();
+    }
+
+    let result = resources::release_borrows(&mut stack, scope, &record_exported_borrow_drop);
+    assert!(
+        result.is_err(),
+        "a throwing borrow dispose must surface as Err"
+    );
+    assert!(
+        js::exception::is_pending(scope),
+        "the captured exception must be re-raised"
+    );
+    js::exception::clear(scope);
+    // 30 drained first, then THROWING_HANDLE threw, then 10 still drained: the
+    // throw did not abort the loop.
+    assert_eq!(
+        take_dropped(),
+        vec![30, 10],
+        "every non-throwing borrow must still drop"
+    );
+
+    drop(stack);
+    force_gc(scope);
+}
+
+/// A wrapper of an imported resource used twice in one lowering, with an `own`
+/// among its uses, and one used as an `own` while it is lent to an import call,
+/// fail validation.
+fn conflicting_wrapper_uses_fail_validation(scope: &Scope<'_>) {
+    use wit_bridge::validate::check_each;
+
+    let own = TypeShape::OwnResource {
+        index: 7,
+        imported: true,
+    };
+    let borrow = TypeShape::BorrowResource {
+        index: 7,
+        imported: true,
+    };
+    let wrapper = resources::wrap_imported(scope, 70, 7, None).unwrap();
+    let wrapper_v = scope.root_value(wrapper.as_value());
+    let snapshot = |shape: &TypeShape| wit_bridge::validate::snapshot(scope, wrapper_v, shape);
+
+    let borrows = [snapshot(&borrow).unwrap(), snapshot(&borrow).unwrap()];
+    assert!(check_each(scope, &borrows, &borrow).is_ok());
+    let owns = [snapshot(&own).unwrap(), snapshot(&own).unwrap()];
+    let (index, mismatch) = check_each(scope, &owns, &own).unwrap_err();
+    assert_eq!(index, 1);
+    assert!(
+        mismatch
+            .reason
+            .contains("an `own` use must be its only use"),
+        "{}",
+        mismatch.reason
+    );
+
+    let mut stack = CallStack::new();
+    stack.push_object(&wrapper);
+    let desc = ResourceDesc::Imported { type_idx: 7 };
+    assert_eq!(resources::pop_borrow(&mut stack, scope, &desc).unwrap(), 70);
+    let mismatch = wit_bridge::validate::check(scope, wrapper_v, &own).unwrap_err();
+    assert!(mismatch.reason.contains("lent"), "{}", mismatch.reason);
+    assert!(wit_bridge::validate::check(scope, wrapper_v, &borrow).is_ok());
+
+    resources::release_borrows(&mut stack, scope, &record_exported_borrow_drop).unwrap();
+    assert!(wit_bridge::validate::check(scope, wrapper_v, &own).is_ok());
+    // A snapshot holds the wrapper, so moving its handle out afterwards fails
+    // the check of the snapshot.
+    let owned = [snapshot(&own).unwrap()];
+    resources::unwrap_to_canon(scope, wrapper_v, 7, true).unwrap();
+    let (index, mismatch) = check_each(scope, &owned, &own).unwrap_err();
+    assert_eq!(index, 0);
+    assert!(mismatch.reason.contains("disposed"), "{}", mismatch.reason);
+    take_dropped();
+}
+
+/// A wrapper disposed of while lent to an import call, and a borrow released
+/// while lent, keep their handles until the call ends, and the end of the call
+/// drops them.
+fn deferred_dispose_runs_when_the_lend_ends(scope: &Scope<'_>) {
+    take_dropped();
+    let wrapper = resources::wrap_imported(scope, 71, 7, None).unwrap();
+    let mut stack = CallStack::new();
+    stack.push_object(&wrapper);
+    let desc = ResourceDesc::Imported { type_idx: 7 };
+    resources::pop_borrow(&mut stack, scope, &desc).unwrap();
+
+    let dispose = resources::dispose_function(scope).unwrap();
+    js::Function::call(scope, wrapper, dispose, js::function::EmptyArgs).unwrap();
+    assert!(take_dropped().is_empty(), "a lent wrapper keeps its handle");
+    assert_eq!(wrapper_handle(scope, &wrapper), Some(71));
+
+    resources::release_borrows(&mut stack, scope, &record_exported_borrow_drop).unwrap();
+    assert_eq!(take_dropped(), vec![71]);
+    assert_eq!(wrapper_handle(scope, &wrapper), None);
+
+    // A borrow lifted for a call and lent to an import call that outlives it is
+    // dropped once, when the lend ends.
+    let mut call = CallStack::new();
+    resources::push_borrow(&mut call, scope, &desc, 72).unwrap();
+    let borrowed = Object::from_raw_value(scope, call.pop_value()).unwrap();
+    let mut lend = CallStack::new();
+    lend.push_object(&borrowed);
+    resources::pop_borrow(&mut lend, scope, &desc).unwrap();
+    resources::release_borrows(&mut call, scope, &record_exported_borrow_drop).unwrap();
+    assert!(take_dropped().is_empty(), "a lent borrow keeps its handle");
+    resources::release_borrows(&mut lend, scope, &record_exported_borrow_drop).unwrap();
+    assert_eq!(take_dropped(), vec![72]);
+    assert_eq!(wrapper_handle(scope, &borrowed), None);
+
+    drop(call);
+    drop(lend);
+    drop(stack);
+    force_gc(scope);
+}
+
+/// Evaluate `code` and return its string value.
+fn eval_string(scope: &Scope<'_>, code: &str) -> String {
+    let v = js::compile::evaluate(scope, code).unwrap();
+    as_string(scope, v)
+}
+
+/// `validate::check` accepts the values that can be lowered, and reports the
+/// path to the first part that can't be lowered, and the reason.
+fn validation_names_the_failing_part(scope: &Scope<'_>) {
+    use wit_bridge::validate::check;
+
+    let check_src = |src: &str, shape: &TypeShape| {
+        let value = js::compile::evaluate(scope, src).unwrap();
+        check(scope, value, shape).map_err(|m| (m.path, m.reason))
+    };
+    let string = || TypeShape::String;
+    let items = TypeShape::Record(vec![(
+        "items".to_string(),
+        TypeShape::List(Box::new(TypeShape::Record(vec![(
+            "name".to_string(),
+            string(),
+        )]))),
+    )]);
+
+    assert_eq!(check_src("({ items: [{ name: 'a' }] })", &items), Ok(()));
+    let (path, reason) =
+        check_src("({ items: [{ name: 'a' }, { name: 7 }] })", &items).unwrap_err();
+    assert_eq!(path, ".items[1].name");
+    assert!(
+        reason.contains("expected a string") && reason.ends_with("got 7"),
+        "{reason}"
+    );
+
+    let (path, reason) = check_src("300", &TypeShape::U8).unwrap_err();
+    assert_eq!(path, "");
+    assert!(
+        reason.contains("expected a u8") && reason.ends_with("got 300"),
+        "{reason}"
+    );
+
+    let (_, reason) = check_src("5", &TypeShape::U64).unwrap_err();
+    assert!(
+        reason.contains("BigInt") && reason.ends_with("got 5"),
+        "{reason}"
+    );
+    assert_eq!(check_src("5n", &TypeShape::U64), Ok(()));
+
+    // Values are described as JS prints them.
+    for (src, described) in [
+        ("Infinity", "got Infinity"),
+        ("-Infinity", "got -Infinity"),
+        ("1e21", "got 1e+21"),
+        ("2n ** 70n", "got 1180591620717411303424n"),
+        ("'x'.repeat(50)", &format!("got \"{}…\"", "x".repeat(40))),
+    ] {
+        let (_, reason) = check_src(src, &TypeShape::U8).unwrap_err();
+        assert!(reason.ends_with(described), "{src}: {reason}");
+    }
+
+    let bytes = TypeShape::List(Box::new(TypeShape::U8));
+    assert_eq!(check_src("new Uint8Array(2)", &bytes), Ok(()));
+    assert_eq!(check_src("[1, 2]", &bytes), Ok(()));
+    let (_, reason) = check_src("new Int8Array(2)", &bytes).unwrap_err();
+    assert_eq!(reason, "expected Uint8Array, got Int8Array");
+    let (path, _) = check_src("[1, 256]", &bytes).unwrap_err();
+    assert_eq!(path, "[1]");
+
+    let shape = TypeShape::Variant(vec![
+        ("none".to_string(), None),
+        ("some".to_string(), Some(TypeShape::U32)),
+    ]);
+    assert_eq!(check_src("({ tag: 'none' })", &shape), Ok(()));
+    let (path, _) = check_src("({ tag: 'some', val: -1 })", &shape).unwrap_err();
+    assert_eq!(path, ".val");
+    let (_, reason) = check_src("({ tag: 'other' })", &shape).unwrap_err();
+    assert!(
+        reason.contains("\"other\" is none of the cases"),
+        "{reason}"
+    );
+    let (_, reason) = check_src("({ tag: 1 })", &shape).unwrap_err();
+    assert!(reason.contains("expected a string `tag`"), "{reason}");
+
+    let option = TypeShape::Option(Box::new(TypeShape::Char));
+    assert_eq!(check_src("undefined", &option), Ok(()));
+    assert_eq!(check_src("null", &option), Ok(()));
+    assert!(check_src("'ab'", &option).is_err());
+
+    let result = TypeShape::Result(Some(Box::new(string())), None);
+    assert_eq!(check_src("({ tag: 'ok', val: 'x' })", &result), Ok(()));
+    assert_eq!(check_src("({ tag: 'err' })", &result), Ok(()));
+    let (path, _) = check_src("({ tag: 'ok', val: 1 })", &result).unwrap_err();
+    assert_eq!(path, ".val");
+
+    let tuple = TypeShape::Tuple(vec![TypeShape::Bool, string()]);
+    let (path, _) = check_src("[true, false]", &tuple).unwrap_err();
+    assert_eq!(path, "[1]");
+
+    // A getter that throws is reported, and its exception cleared.
+    let record = TypeShape::Record(vec![("x".to_string(), TypeShape::U32)]);
+    let (path, reason) =
+        check_src("({ get x() { throw new Error('nope'); } })", &record).unwrap_err();
+    assert_eq!(path, "");
+    assert!(reason.contains("nope"), "{reason}");
+    assert!(!js::exception::is_pending(scope));
+
+    // The payload of a `stream` or `future` without a payload type is `undefined`.
+    let payload = |src: &str| {
+        let value = js::compile::evaluate(scope, src).unwrap();
+        wit_bridge::validate::snapshot_payload(scope, value, None)
+            .map(|snapshot| snapshot.is_none())
+            .map_err(|m| (m.path, m.reason))
+    };
+    assert_eq!(payload("undefined"), Ok(true));
+    assert_eq!(
+        payload("7"),
+        Err((String::new(), "expected undefined, got 7".to_string()))
+    );
+    assert_eq!(
+        payload("null"),
+        Err((String::new(), "expected undefined, got null".to_string()))
+    );
+    let (_, reason) = payload("({})").unwrap_err();
+    assert_eq!(reason, "expected undefined, got an object");
+    let item = TypeShape::Option(Box::new(TypeShape::U32));
+    assert!(wit_bridge::validate::snapshot_payload(
+        scope,
+        js::compile::evaluate(scope, "'x'").unwrap(),
+        Some(&item)
+    )
+    .is_err());
+}
+
+/// `validate::snapshot` reads each part of a value once, and returns its
+/// converted parts.
+fn snapshot_reads_each_part_once(scope: &Scope<'_>) {
+    use wit_bridge::validate::snapshot;
+    use wit_bridge::value::TypeShapeValue;
+
+    let shape = TypeShape::Record(vec![
+        ("name".to_string(), TypeShape::String),
+        (
+            "counts".to_string(),
+            TypeShape::List(Box::new(TypeShape::U32)),
+        ),
+        (
+            "kind".to_string(),
+            TypeShape::Variant(vec![
+                ("none".to_string(), None),
+                ("some".to_string(), Some(TypeShape::U8)),
+            ]),
+        ),
+    ]);
+    let value = js::compile::evaluate(
+        scope,
+        "globalThis.reads = 0;
+         globalThis.original = {
+           get name() { reads++; return reads === 1 ? 'first' : 7; },
+           counts: new Uint32Array([1, 2]),
+           kind: { tag: 'some', val: 3 },
+         };
+         original",
+    )
+    .unwrap();
+    let converted = snapshot(scope, value, &shape).expect("the value lowers");
+    assert_eq!(eval_string(scope, "String(reads)"), "1");
+    let TypeShapeValue::Record(fields) = converted else {
+        panic!("expected a record");
+    };
+    let [TypeShapeValue::String(name), TypeShapeValue::NumericList(counts), TypeShapeValue::Variant(case, Some(payload))] =
+        &fields[..]
+    else {
+        panic!("expected a string, a numeric list and a variant with a value");
+    };
+    assert_eq!(name, "first");
+    let expected: Vec<u8> = [1u32, 2].iter().flat_map(|n| n.to_ne_bytes()).collect();
+    assert_eq!(counts.bytes(), expected);
+    assert_eq!(*case, 1);
+    assert!(matches!(**payload, TypeShapeValue::U8(3)));
+
+    let bad = js::compile::evaluate(
+        scope,
+        "({ name: 'a', counts: [1], kind: { tag: 'some', val: 300 } })",
+    )
+    .unwrap();
+    let mismatch = snapshot(scope, bad, &shape).map(|_| ()).unwrap_err();
+    assert_eq!(mismatch.path, ".kind.val");
+    assert!(
+        mismatch.reason.contains("expected a u8"),
+        "{}",
+        mismatch.reason
+    );
+}
diff --git a/crates/wit-name-mapping/Cargo.toml b/crates/wit-name-mapping/Cargo.toml
new file mode 100644
index 00000000..09bc951a
--- /dev/null
+++ b/crates/wit-name-mapping/Cargo.toml
@@ -0,0 +1,20 @@
+# SPDX-License-Identifier: Apache-2.0-WITH-LLVM-exception
+
+[package]
+name = "wit-name-mapping"
+version.workspace = true
+repository.workspace = true
+license.workspace = true
+authors.workspace = true
+edition.workspace = true
+
+# Both `wit-bridge` and the separate `componentize` workspace depend on this crate, so it
+# depends on no runtime crate.
+
+[dependencies]
+heck.workspace = true
+semver.workspace = true
+wasmparser.workspace = true
+
+[lints]
+workspace = true
diff --git a/crates/wit-name-mapping/src/lib.rs b/crates/wit-name-mapping/src/lib.rs
new file mode 100644
index 00000000..1ff47a76
--- /dev/null
+++ b/crates/wit-name-mapping/src/lib.rs
@@ -0,0 +1,602 @@
+// SPDX-License-Identifier: Apache-2.0-WITH-LLVM-exception
+
+//! The mapping between WIT names and the JavaScript names of a componentized
+//! application's imports and exports, used by the WIT bridge and the componentizer.
+//!
+//! WIT names are kebab-case. [`mangle_name`] converts a function or member name
+//! to lowerCamelCase, and [`mangle_resource_name`] converts a resource name to
+//! an UpperCamelCase class name.
+//!
+//! The application imports each WIT interface as an ES module. The module's
+//! specifier is the interface's WIT name with its version shortened by
+//! [`module_specifier`], such as `wasi:http/types@0.3`. World-level imported
+//! functions are imported from the module [`WORLD_MODULE_NAME`].
+//!
+//! The application's main module exports a JavaScript implementation of each
+//! function and resource class of the world's exported interfaces.
+//! [`item_js_name`] returns the JS name of the item that implements a WIT
+//! function, and [`FunctionName`] splits a WIT function name into its parts.
+//! Each item can be exported in one of four shapes ([`Shape`]). For the function
+//! `greet` of the interface `test:app/greeter@1.0.0`, the shapes are:
+//!
+//! ```js
+//! // The package layer: the package name `test:app` in lowerCamelCase, then
+//! // the interface name. The version is not part of the name.
+//! export const testApp = { greeter: { greet } };
+//! // The interface layer.
+//! export const greeter = { greet };
+//! // A bare export.
+//! export function greet() {}
+//! // The versioned layer: an export named by the interface's full WIT name.
+//! export { greeterV1 as "test:app/greeter@1.0.0" };
+//! ```
+//!
+//! [`possible_export_names`] computes, for each item, the shapes in which the
+//! main module may export it. A shape is excluded if its name collides with the
+//! name of another export. The main module exports each item in exactly one of
+//! its possible shapes.
+//!
+//! An interface named without a package, such as `local`, has no package
+//! layer. The versioned layer is used only when the world exports two versions
+//! of one interface. Those versions have the same package-layer and
+//! interface-layer names, so each is exported only in the versioned layer. A
+//! world-level exported function is always a bare export.
+
+use std::collections::{HashMap, HashSet};
+
+use heck::{ToLowerCamelCase, ToUpperCamelCase};
+pub use semver::Version;
+use wasmparser::names;
+
+/// The module specifier the world-level imports are provided under.
+pub const WORLD_MODULE_NAME: &str = "external";
+
+/// The characters of a WIT name that a JS identifier cannot contain, which
+/// [`mangle_name`] and [`mangle_resource_name`] replace with `_`.
+const PUNCTUATION: [char; 7] = ['@', ':', '/', '-', '[', ']', '.'];
+
+/// Mangle a WIT identifier into its JavaScript form.
+///
+/// Punctuation that is illegal in a JS identifier is replaced with `_`, then the
+/// result is lower-camel-cased.
+pub fn mangle_name(s: &str) -> String {
+    s.replace(PUNCTUATION, "_").to_lower_camel_case()
+}
+
+/// Mangle a WIT resource-type name into its JavaScript class name.
+///
+/// Resource classes are UpperCamelCase (`resource-type` becomes `ResourceType`),
+/// unlike functions and members, which [`mangle_name`] lower-camel-cases.
+pub fn mangle_resource_name(s: &str) -> String {
+    s.replace(PUNCTUATION, "_").to_upper_camel_case()
+}
+
+/// A WIT function name, such as `greet`, `[constructor]counter`,
+/// `[method]counter.bump` or `[static]counter.origin`, split into its parts.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum FunctionName<'a> {
+    /// A function that doesn't belong to a resource.
+    Plain(&'a str),
+    /// The constructor of `resource`.
+    Constructor { resource: &'a str },
+    /// The method `name` of `resource`.
+    Method { resource: &'a str, name: &'a str },
+    /// The static function `name` of `resource`.
+    Static { resource: &'a str, name: &'a str },
+}
+
+impl<'a> FunctionName<'a> {
+    /// Parse the WIT function name `name`. A name that isn't a valid component
+    /// function name is a [`FunctionName::Plain`].
+    pub fn parse(name: &'a str) -> FunctionName<'a> {
+        let valid = names::ComponentName::new(name, 0)
+            .is_ok_and(|parsed| matches!(parsed.kind(), names::ComponentNameKind::Plain(_)));
+        if !valid {
+            return FunctionName::Plain(name);
+        }
+        let plain = names::PlainName::new(name);
+        match (plain.resource_func, plain.resource()) {
+            (Some(names::ResourceFuncKind::Constructor), Some(resource)) => {
+                FunctionName::Constructor {
+                    resource: resource.as_str(),
+                }
+            }
+            (Some(names::ResourceFuncKind::Method), Some(resource)) => FunctionName::Method {
+                resource: resource.as_str(),
+                name: plain.name().as_str(),
+            },
+            (Some(names::ResourceFuncKind::Static), Some(resource)) => FunctionName::Static {
+                resource: resource.as_str(),
+                name: plain.name().as_str(),
+            },
+            _ => FunctionName::Plain(name),
+        }
+    }
+}
+
+/// Return the JS name of the item that implements the WIT function `function`:
+/// the function's name, or the class name of the resource for a
+/// `[constructor]`, `[method]` or `[static]` function. The main module exports
+/// the item under one of the names returned by [`possible_export_names`].
+pub fn item_js_name(function: &str) -> String {
+    match FunctionName::parse(function) {
+        FunctionName::Plain(name) => mangle_name(name),
+        FunctionName::Constructor { resource }
+        | FunctionName::Method { resource, .. }
+        | FunctionName::Static { resource, .. } => mangle_resource_name(resource),
+    }
+}
+
+/// The JS names of an exported interface.
+#[derive(Clone, Debug, PartialEq, Eq, Hash)]
+pub struct InterfaceNames {
+    /// The interface's WIT name, for messages.
+    pub wit_name: String,
+    /// The package-layer name, or `None` for an interface the world exports
+    /// under a plain name.
+    pub package: Option<String>,
+    /// The interface-layer name.
+    pub interface: String,
+}
+
+impl InterfaceNames {
+    /// The names of the interface the world exports as `wit_name`: either
+    /// `ns:pkg/iface`, optionally followed by `@version`, or a plain name.
+    pub fn of(wit_name: &str) -> InterfaceNames {
+        let unversioned = unversioned(wit_name);
+        let (package, interface) = match unversioned.split_once('/') {
+            Some((package, interface)) => (Some(mangle_name(package)), interface),
+            None => (None, unversioned),
+        };
+        InterfaceNames {
+            wit_name: wit_name.to_string(),
+            package,
+            interface: mangle_name(interface),
+        }
+    }
+}
+
+/// Return the interface name `name`, such as `wasi:http/types@0.3.0`, without
+/// its version.
+pub fn unversioned(name: &str) -> &str {
+    name.split_once('@').map_or(name, |(name, _)| name)
+}
+
+/// Return the name of a WIT function for messages: `interface#function`, or
+/// `function` for a function of the world.
+pub fn function_wit_name(interface: Option<&str>, function: &str) -> String {
+    match interface {
+        Some(interface) => format!("{interface}#{function}"),
+        None => function.to_string(),
+    }
+}
+
+/// Whether the interface names `a` and `b`, such as `wasi:http/types@0.3.0`,
+/// name compatible versions of one interface: their names before the `@` are
+/// equal, and so are their versions' `canonical_version`s, or neither has a
+/// version.
+pub fn same_interface(a: &str, b: &str) -> bool {
+    fn split(name: &str) -> (&str, Option<&str>) {
+        match name.split_once('@') {
+            Some((name, version)) => (name, Some(version)),
+            None => (name, None),
+        }
+    }
+    let ((a_name, a_version), (b_name, b_version)) = (split(a), split(b));
+    a_name == b_name
+        && match (a_version, b_version) {
+            (Some(a), Some(b)) => compatible_versions(a, b),
+            (None, None) => true,
+            _ => false,
+        }
+}
+
+/// Whether the semver versions `a` and `b` have the same
+/// `canonical_version`. A version that doesn't parse is compatible only with
+/// an equal one.
+fn compatible_versions(a: &str, b: &str) -> bool {
+    match (canonical_version(a), canonical_version(b)) {
+        (Some(a), Some(b)) => a == b,
+        _ => a == b,
+    }
+}
+
+/// The canonical version of `version`, as the component model defines it for
+/// interface names, or `None` if `version` is neither a full semver version
+/// nor a canonical version. Compatible versions have the same canonical
+/// version, which is:
+///
+/// - `major`, for a release whose major number isn't 0, such as `1` for
+///   `1.2.3`;
+/// - `0.minor`, for a release whose major number is 0 and whose minor number
+///   isn't, such as `0.3` for `0.3.1`;
+/// - the version without its build metadata otherwise, such as `0.0.1` for
+///   `0.0.1` and `0.3.0-rc.1` for `0.3.0-rc.1+build.1`;
+/// - `version` itself if it is already canonical, such as `0.3`.
+fn canonical_version(version: &str) -> Option<&str> {
+    names::split_canonical_version(version)
+        .map(|(canonical, _)| canonical)
+        .or_else(|| names::is_canonical_version(version).then_some(version))
+}
+
+/// The module specifier under which a guest imports the interface named
+/// `name`: `name` with its version replaced by its `canonical_version`, such
+/// as `wasi:http/types@0.3` for `wasi:http/types@0.3.0`. A name without a
+/// version, or with one that doesn't parse, is returned unchanged. The runtime
+/// resolves the specifier to the interface's module.
+pub fn module_specifier(name: &str) -> std::borrow::Cow<'_, str> {
+    let Some((unversioned, version)) = name.split_once('@') else {
+        return name.into();
+    };
+    match canonical_version(version) {
+        Some(canonical) => format!("{unversioned}@{canonical}").into(),
+        None => name.into(),
+    }
+}
+
+/// The version of the interface name `name`, such as `0.2.12` for
+/// `wasi:cli/run@0.2.12`, or `None` for a name without a version or with one
+/// that isn't a full semver version.
+pub fn interface_version(name: &str) -> Option<Version> {
+    let (_, version) = name.split_once('@')?;
+    Version::parse(version).ok()
+}
+
+/// One shape an item can be provided in.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub enum Shape {
+    /// `package.interface.item`.
+    Package { package: String, interface: String },
+    /// `interface.item`.
+    Interface(String),
+    /// `item`, a member of the main module's namespace.
+    Bare,
+    /// `item` of the export named by an interface's full WIT name.
+    Versioned(String),
+}
+
+impl Shape {
+    /// The JS path of `item` in this shape, such as `nsPkg.iface.item`.
+    pub fn path(&self, item: &str) -> String {
+        match self {
+            Shape::Package { package, interface } => format!("{package}.{interface}.{item}"),
+            Shape::Interface(interface) => format!("{interface}.{item}"),
+            Shape::Bare => item.to_string(),
+            Shape::Versioned(wit_name) => format!("[\"{wit_name}\"].{item}"),
+        }
+    }
+}
+
+/// One exported item: the names of its interface, or `None` for a world-level
+/// function, and its JS name.
+pub type Item = (Option<InterfaceNames>, String);
+
+/// Returns the names under which the main module may export each of `items`.
+///
+/// `items` lists every function and resource class the world exports,
+/// including world-level functions. A possible export name of an item is a
+/// property path in the main module's namespace object where the
+/// implementation of the item may be found, such as `testApp.greeter.greet`
+/// or a bare `greet`. The result has one entry per item, in the order of
+/// `items`. Each entry holds the [`Shape`]s of the item's possible export
+/// names, in the order the shapes are listed on [`Shape`]. [`Shape::path`]
+/// turns a shape into the name. The main module exports each item under
+/// exactly one of its possible names.
+///
+/// A shape is excluded if its name collides with the name of another export,
+/// so the possible names of one item depend on all of `items` and `fixed`:
+///
+/// - A world-level function is always a bare export.
+/// - The package layer is possible for every interface with a package, unless
+///   another version of the interface has the same package-layer and
+///   interface-layer names. Such an interface is exported in the versioned
+///   layer only.
+/// - The interface layer is possible unless another exported interface has the
+///   same interface-layer name, or the name is a package-layer name or the name
+///   of a world-level function or of an entry in `fixed`.
+/// - A bare export is possible unless another item or a world-level function
+///   has the same name, or the name is a package-layer name, a possible
+///   interface-layer name, or an entry in `fixed`.
+///
+/// `fixed` lists the JS names the main module exports for other purposes,
+/// such as a CLI tool's `run`. An item may appear more than once, and gets the
+/// same shapes each time.
+///
+/// Fails when a world-level function or an entry in `fixed` has a
+/// package-layer name.
+pub fn possible_export_names(items: &[Item], fixed: &[&str]) -> Result<Vec<Vec<Shape>>, String> {
+    let mut interfaces: Vec<&InterfaceNames> = Vec::new();
+    let mut interface_items: HashSet<(&InterfaceNames, &str)> = HashSet::new();
+    let mut world_items: HashSet<&str> = fixed.iter().copied().collect();
+    for (interface, name) in items {
+        match interface {
+            Some(interface) => {
+                if !interfaces.contains(&interface) {
+                    interfaces.push(interface);
+                }
+                interface_items.insert((interface, name));
+            }
+            None => {
+                world_items.insert(name);
+            }
+        }
+    }
+
+    let packages: HashSet<&str> = interfaces
+        .iter()
+        .filter_map(|interface| interface.package.as_deref())
+        .collect();
+    if let Some(name) = world_items.iter().find(|name| packages.contains(**name)) {
+        return Err(format!(
+            "the world-level export `{name}` has the same JS name as a package's exports"
+        ));
+    }
+    let mut qualified: HashMap<(&str, &str), usize> = HashMap::new();
+    for interface in &interfaces {
+        if let Some(package) = &interface.package {
+            *qualified
+                .entry((package.as_str(), interface.interface.as_str()))
+                .or_default() += 1;
+        }
+    }
+    let versioned = |interface: &InterfaceNames| {
+        interface
+            .package
+            .as_deref()
+            .is_some_and(|package| qualified[&(package, interface.interface.as_str())] > 1)
+    };
+
+    let mut interface_counts: HashMap<&str, usize> = HashMap::new();
+    for interface in &interfaces {
+        *interface_counts.entry(&interface.interface).or_default() += 1;
+    }
+    let interface_layer = |interface: &InterfaceNames| {
+        let name = interface.interface.as_str();
+        interface_counts[name] == 1 && !packages.contains(name) && !world_items.contains(name)
+    };
+    let interface_layers: HashSet<&str> = interfaces
+        .iter()
+        .filter(|interface| interface_layer(interface))
+        .map(|interface| interface.interface.as_str())
+        .collect();
+
+    let mut item_counts: HashMap<&str, usize> = HashMap::new();
+    for name in interface_items
+        .iter()
+        .map(|(_, name)| *name)
+        .chain(world_items.iter().copied())
+    {
+        *item_counts.entry(name).or_default() += 1;
+    }
+
+    Ok(items
+        .iter()
+        .map(|(interface, name)| {
+            let Some(interface) = interface else {
+                return vec![Shape::Bare];
+            };
+            if versioned(interface) {
+                return vec![Shape::Versioned(interface.wit_name.clone())];
+            }
+            let mut shapes = Vec::new();
+            if let Some(package) = &interface.package {
+                shapes.push(Shape::Package {
+                    package: package.clone(),
+                    interface: interface.interface.clone(),
+                });
+            }
+            if interface_layer(interface) {
+                shapes.push(Shape::Interface(interface.interface.clone()));
+            }
+            let name = name.as_str();
+            if item_counts[name] == 1
+                && !packages.contains(name)
+                && !interface_layers.contains(name)
+            {
+                shapes.push(Shape::Bare);
+            }
+            shapes
+        })
+        .collect())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    /// The JS paths each of `items` is accepted under, for interfaces given by
+    /// WIT name and world-level functions given with `None`.
+    fn paths(items: &[(Option<&str>, &str)], fixed: &[&str]) -> Result<Vec<Vec<String>>, String> {
+        let items: Vec<Item> = items
+            .iter()
+            .map(|(interface, name)| (interface.map(InterfaceNames::of), name.to_string()))
+            .collect();
+        let shapes = possible_export_names(&items, fixed)?;
+        Ok(items
+            .iter()
+            .zip(shapes)
+            .map(|((_, name), shapes)| shapes.iter().map(|shape| shape.path(name)).collect())
+            .collect())
+    }
+
+    fn expect(items: &[(Option<&str>, &str)], fixed: &[&str], expected: &[&[&str]]) {
+        let actual = paths(items, fixed).expect("possible export names");
+        assert_eq!(actual, expected, "for {items:?}");
+    }
+
+    #[test]
+    fn function_names_are_split_into_their_parts() {
+        let cases = [
+            ("greet", FunctionName::Plain("greet")),
+            (
+                "[constructor]counter",
+                FunctionName::Constructor {
+                    resource: "counter",
+                },
+            ),
+            (
+                "[method]http-request.set-body",
+                FunctionName::Method {
+                    resource: "http-request",
+                    name: "set-body",
+                },
+            ),
+            (
+                "[static]counter.origin",
+                FunctionName::Static {
+                    resource: "counter",
+                    name: "origin",
+                },
+            ),
+            // Not valid component names, so they are plain.
+            ("[method]no-dot", FunctionName::Plain("[method]no-dot")),
+            ("notKebab", FunctionName::Plain("notKebab")),
+        ];
+        for (name, expected) in cases {
+            assert_eq!(FunctionName::parse(name), expected, "{name}");
+        }
+    }
+
+    #[test]
+    fn item_js_names_are_the_function_or_the_class() {
+        assert_eq!(item_js_name("do-thing"), "doThing");
+        assert_eq!(item_js_name("[constructor]http-request"), "HttpRequest");
+        assert_eq!(item_js_name("[method]http-request.set-body"), "HttpRequest");
+        assert_eq!(
+            item_js_name("[static]http-request.new-empty"),
+            "HttpRequest"
+        );
+    }
+
+    #[test]
+    fn every_shape_when_names_are_unique() {
+        let api = Some("test:naming/api");
+        expect(
+            &[(api, "greet"), (api, "Counter")],
+            &[],
+            &[
+                &["testNaming.api.greet", "api.greet", "greet"],
+                &["testNaming.api.Counter", "api.Counter", "Counter"],
+            ],
+        );
+    }
+
+    #[test]
+    fn interfaces_sharing_a_name_keep_only_the_package_layer() {
+        expect(
+            &[
+                (Some("test:a/api"), "greet"),
+                (Some("test:b/api@1.0.0"), "greet"),
+            ],
+            &[],
+            &[&["testA.api.greet"], &["testB.api.greet"]],
+        );
+    }
+
+    #[test]
+    fn items_sharing_a_name_lose_the_bare_shape() {
+        let (left, right) = (Some("test:naming/left"), Some("test:naming/right"));
+        expect(
+            &[(left, "greet"), (left, "onlyLeft"), (right, "greet")],
+            &[],
+            &[
+                &["testNaming.left.greet", "left.greet"],
+                &["testNaming.left.onlyLeft", "left.onlyLeft", "onlyLeft"],
+                &["testNaming.right.greet", "right.greet"],
+            ],
+        );
+    }
+
+    #[test]
+    fn a_plain_named_interface_has_no_package_layer() {
+        expect(
+            &[(Some("local"), "greet")],
+            &[],
+            &[&["local.greet", "greet"]],
+        );
+    }
+
+    #[test]
+    fn a_world_level_function_takes_its_name() {
+        let api = Some("test:naming/api");
+        expect(
+            &[(api, "greet"), (api, "Counter"), (None, "greet")],
+            &[],
+            &[
+                &["testNaming.api.greet", "api.greet"],
+                &["testNaming.api.Counter", "api.Counter", "Counter"],
+                &["greet"],
+            ],
+        );
+        expect(
+            &[(api, "greet"), (api, "Counter"), (None, "api")],
+            &[],
+            &[
+                &["testNaming.api.greet", "greet"],
+                &["testNaming.api.Counter", "Counter"],
+                &["api"],
+            ],
+        );
+    }
+
+    #[test]
+    fn no_item_is_bare_under_a_layer_name() {
+        expect(
+            &[(Some("test:naming/same"), "same")],
+            &[],
+            &[&["testNaming.same.same", "same.same"]],
+        );
+        expect(
+            &[(Some("test:naming/pkg-named"), "testNaming")],
+            &[],
+            &[&["testNaming.pkgNamed.testNaming", "pkgNamed.testNaming"]],
+        );
+    }
+
+    #[test]
+    fn fixed_names_are_taken() {
+        let api = Some("test:naming/api");
+        expect(
+            &[(api, "run"), (Some("test:naming/run"), "go")],
+            &["run"],
+            &[
+                &["testNaming.api.run", "api.run"],
+                &["testNaming.run.go", "go"],
+            ],
+        );
+    }
+
+    #[test]
+    fn the_http_handler_has_every_shape() {
+        expect(
+            &[(Some("wasi:http/handler@0.3.0"), "handle")],
+            &[],
+            &[&["wasiHttp.handler.handle", "handler.handle", "handle"]],
+        );
+    }
+
+    #[test]
+    fn versions_of_one_interface_take_the_versioned_layer() {
+        expect(
+            &[
+                (Some("test:v/api@1.0.0"), "greet"),
+                (Some("test:v/api@2.0.0"), "greet"),
+                (Some("test:v/other@1.0.0"), "wave"),
+            ],
+            &[],
+            &[
+                &["[\"test:v/api@1.0.0\"].greet"],
+                &["[\"test:v/api@2.0.0\"].greet"],
+                &["testV.other.wave", "other.wave", "wave"],
+            ],
+        );
+    }
+
+    #[test]
+    fn unrepresentable_worlds_are_rejected() {
+        let world_function = paths(&[(Some("test:v/api"), "greet"), (None, "testV")], &[]);
+        assert!(world_function
+            .unwrap_err()
+            .contains("the world-level export `testV` has the same JS name"));
+    }
+}
diff --git a/crates/wit-name-mapping/tests/interface_versions.rs b/crates/wit-name-mapping/tests/interface_versions.rs
new file mode 100644
index 00000000..1bdd7f7e
--- /dev/null
+++ b/crates/wit-name-mapping/tests/interface_versions.rs
@@ -0,0 +1,53 @@
+// SPDX-License-Identifier: Apache-2.0-WITH-LLVM-exception
+
+//! `same_interface` against `interface_versions.txt`.
+
+// This file contains nothing platform-specific, so skip it on wasm32.
+#![cfg(not(target_arch = "wasm32"))]
+
+#[test]
+fn interface_versions_match_the_table() {
+    for line in include_str!("interface_versions.txt").lines() {
+        if line.is_empty() || line.starts_with('#') {
+            continue;
+        }
+        let [a, b, expected] = line.split(' ').collect::<Vec<_>>()[..] else {
+            panic!("a table line has three fields: {line:?}");
+        };
+        let same = wit_name_mapping::same_interface(a, b);
+        assert_eq!(same, expected == "same", "{a} {b}");
+        assert_eq!(wit_name_mapping::same_interface(b, a), same, "{b} {a}");
+    }
+}
+
+#[test]
+fn interface_versions_order_by_semver() {
+    let version = wit_name_mapping::interface_version;
+    assert!(version("a:b/c@1.2.3") < version("a:b/c@1.10.0"));
+    assert!(version("a:b/c@0.3.0-rc.1") < version("a:b/c@0.3.0"));
+    assert_eq!(version("a:b/c@0.3"), None);
+    assert_eq!(version("a:b/c"), None);
+}
+
+#[test]
+fn module_specifiers_name_the_canonical_version() {
+    for (name, specifier) in [
+        ("wasi:http/types@0.3.0", "wasi:http/types@0.3"),
+        ("wasi:io/poll@0.2.12", "wasi:io/poll@0.2"),
+        ("a:b/c@1.2.3+build.1", "a:b/c@1"),
+        ("a:b/c@0.0.4", "a:b/c@0.0.4"),
+        (
+            "wasi:http/types@0.3.0-rc.1+build.1",
+            "wasi:http/types@0.3.0-rc.1",
+        ),
+        ("wasi:http/types", "wasi:http/types"),
+        ("wasi:http/types@0.3.0.1", "wasi:http/types@0.3.0.1"),
+        ("external", "external"),
+    ] {
+        assert_eq!(wit_name_mapping::module_specifier(name), specifier);
+        assert!(
+            wit_name_mapping::same_interface(specifier, name),
+            "{specifier} {name}"
+        );
+    }
+}
diff --git a/crates/wit-name-mapping/tests/interface_versions.txt b/crates/wit-name-mapping/tests/interface_versions.txt
new file mode 100644
index 00000000..afacc083
--- /dev/null
+++ b/crates/wit-name-mapping/tests/interface_versions.txt
@@ -0,0 +1,35 @@
+# SPDX-License-Identifier: Apache-2.0-WITH-LLVM-exception
+#
+# Pairs of interface names and whether `same_interface` matches them, one per
+# line: the two names, then `same` or `different`.
+wasi:http/types@0.3.0 wasi:http/types@0.3.0 same
+wasi:http/types@0.3.0 wasi:http/types@0.3.7 same
+wasi:http/types@0.3.0 wasi:http/types@0.4.0 different
+wasi:http/types@0.3.0 wasi:http/types@1.3.0 different
+a:b/c@1.2.0 a:b/c@1.3.5 same
+a:b/c@1.2.0 a:b/c@2.2.0 different
+a:b/c@0.0.1 a:b/c@0.0.1+build.1 same
+a:b/c@0.0.1 a:b/c@0.0.2 different
+a:b/c@0.0.1 a:b/c@0.1.0 different
+wasi:http/types@0.3.0 wasi:http/handler@0.3.0 different
+wasi:http/types@0.3.0-rc.1 wasi:http/types@0.3.0-rc.1 same
+wasi:http/types@0.3.0-rc.1+build.1 wasi:http/types@0.3.0-rc.1 same
+wasi:http/types@0.3.0-rc.1 wasi:http/types@0.3.2-rc.1 different
+wasi:http/types@0.3.0-rc.1 wasi:http/types@0.3.0 different
+wasi:http/types@0.3.0-rc.1 wasi:http/types@0.3.0-rc.2 different
+wasi:http/types@0.3.0+build.1 wasi:http/types@0.3.0 same
+wasi:http/types wasi:http/types same
+wasi:http/types wasi:http/types@0.3.0 different
+wasi:http/types@0.3 wasi:http/types@0.3 same
+wasi:http/types@0.3 wasi:http/types@0.3.0 same
+wasi:http/types@0.3 wasi:http/types@0.3.7 same
+wasi:http/types@0.3 wasi:http/types@0.4.0 different
+a:b/c@1 a:b/c@1.2.3 same
+a:b/c@1 a:b/c@2.0.0 different
+a:b/c@1.2 a:b/c@1.2.0 different
+a:b/c@0.0.1 a:b/c@0.0.1 same
+wasi:http/types@0.3-rc.1 wasi:http/types@0.3.0-rc.1 different
+wasi:http/types@0.3.0.1 wasi:http/types@0.3.0.2 different
+logger logger same
+logger other different
+a:b/c a:b/d different
diff --git a/crates/wit-name-mapping/tests/mangle_names.rs b/crates/wit-name-mapping/tests/mangle_names.rs
new file mode 100644
index 00000000..6efc5e44
--- /dev/null
+++ b/crates/wit-name-mapping/tests/mangle_names.rs
@@ -0,0 +1,20 @@
+// SPDX-License-Identifier: Apache-2.0-WITH-LLVM-exception
+
+//! `mangle_name` and `mangle_resource_name` against `mangled_names.txt`.
+
+// This file contains nothing platform-specific, so skip it on wasm32.
+#![cfg(not(target_arch = "wasm32"))]
+
+#[test]
+fn mangled_names_match_the_table() {
+    for line in include_str!("mangled_names.txt").lines() {
+        if line.is_empty() || line.starts_with('#') {
+            continue;
+        }
+        let [wit, member, class] = line.split(' ').collect::<Vec<_>>()[..] else {
+            panic!("a table line has three names: {line:?}");
+        };
+        assert_eq!(wit_name_mapping::mangle_name(wit), member, "{wit}");
+        assert_eq!(wit_name_mapping::mangle_resource_name(wit), class, "{wit}");
+    }
+}
diff --git a/crates/wit-name-mapping/tests/mangled_names.txt b/crates/wit-name-mapping/tests/mangled_names.txt
new file mode 100644
index 00000000..fc94758f
--- /dev/null
+++ b/crates/wit-name-mapping/tests/mangled_names.txt
@@ -0,0 +1,15 @@
+# SPDX-License-Identifier: Apache-2.0-WITH-LLVM-exception
+#
+# WIT names and the JavaScript names `mangle_name` and `mangle_resource_name`
+# give them, one per line: the WIT name, the member name, the class name.
+foo foo Foo
+echo-list-u8 echoListU8 EchoListU8
+a-b-c aBC ABC
+get-static getStatic GetStatic
+resource-type resourceType ResourceType
+host-thing hostThing HostThing
+R r R
+wasi:http/types@0.3.0 wasiHttpTypes030 WasiHttpTypes030
+[method]thing.get methodThingGet MethodThingGet
+[constructor]host-thing constructorHostThing ConstructorHostThing
+x2y x2y X2y
diff --git a/crates/wpt-support/Cargo.toml b/crates/wpt-support/Cargo.toml
index 10f2a4cf..080c8a3d 100644
--- a/crates/wpt-support/Cargo.toml
+++ b/crates/wpt-support/Cargo.toml
@@ -7,7 +7,7 @@ authors.workspace = true
 edition.workspace = true
 
 [lib]
-# No unit tests; skip building the (SpiderMonkey-sized) lib test harness binary.
+# No unit tests. This skips building the (SpiderMonkey-sized) lib test harness binary.
 test = false
 
 [dependencies]
diff --git a/crates/wpt-support/src/lib.rs b/crates/wpt-support/src/lib.rs
index 5fe683c5..0870f2d4 100644
--- a/crates/wpt-support/src/lib.rs
+++ b/crates/wpt-support/src/lib.rs
@@ -14,15 +14,7 @@ use js::native::{Handle, RawJSContext};
 use js::prelude::FromJSVal;
 use js::Object;
 
-/// Install WPT-specific globals on the given global object.
-///
-/// Currently installs:
-/// - `evalScript(source)` — evaluate a script in non-syntactic scope
-/// - `__setLocation(url)` — configure the URL backing `globalThis.location`
-///
-/// # Safety
-///
-/// Must be called with a valid scope and global object.
+/// Install `evalScript`, `__setLocation` and `__wptDone` on `global`.
 pub fn add_to_global(scope: &Scope<'_>, global: Object<'_>) {
     js::Function::define(
         scope,
@@ -59,8 +51,7 @@ pub fn add_to_global(scope: &Scope<'_>, global: Object<'_>) {
 /// top-level `let`/`const` bindings visible to subsequent calls. This is
 /// how the WPT harness loads `META: script=...` dependencies.
 ///
-/// `url` names the script in stack traces and error messages; it is what tells
-/// a failure in a META dependency apart from one in the test itself.
+/// `url` names the script in stack traces and error messages.
 unsafe extern "C" fn eval_script_native(
     raw_cx: *mut RawJSContext,
     argc: u32,
@@ -80,11 +71,8 @@ unsafe extern "C" fn eval_script_native(
             Err(_) => return false,
         };
 
-    // The harness passes the script's URL; fall back to the function's own name when it is absent
-    // (a hand-written `evalScript(source)` call). The argument count is what says "absent": the
-    // conversion is WebIDL's DOMString one, which turns a missing argument into the *string*
-    // "undefined" rather than failing, and traces attributed to a script called "undefined" read
-    // as corrupted rather than as an eval'd script.
+    // Without a `url` argument, the script is named after the function. This checks the argument
+    // count because the DOMString conversion turns a missing argument into the string "undefined".
     let filename = if argc >= 2 {
         match String::from_jsval(&scope, Handle::from_raw(args.get(1)), ()) {
             Ok(filename) => filename,
@@ -101,7 +89,7 @@ unsafe extern "C" fn eval_script_native(
             true
         }
         Err(_) => {
-            println!("Eval failed");
+            eprintln!("Eval failed");
             false
         }
     }
diff --git a/crates/wpt-support/tests/wpt_integration.rs b/crates/wpt-support/tests/wpt_integration.rs
index 16eb88a3..92839ec4 100644
--- a/crates/wpt-support/tests/wpt_integration.rs
+++ b/crates/wpt-support/tests/wpt_integration.rs
@@ -17,15 +17,10 @@ fn eval_wpt(code: &str) -> String {
     )
 }
 
+/// `evalScript` places `let` bindings in a non-syntactic scope, so they are visible to later
+/// `evalScript` calls.
 #[test]
-fn eval_script_basic() {
-    assert_eq!(eval_wpt("evalScript('1 + 2').toString()"), "3");
-}
-
-#[test]
-fn eval_script_shares_bindings() {
-    // evalScript should place `let` bindings in a non-syntactic scope
-    // so they are visible to subsequent evalScript calls.
+fn eval_script_shares_let_bindings() {
     assert_eq!(
         eval_wpt("evalScript('let wptFoo = 42;'); evalScript('wptFoo.toString()')"),
         "42"
@@ -33,32 +28,25 @@ fn eval_script_shares_bindings() {
 }
 
 #[test]
-fn eval_script_available_in_wpt_mode() {
-    // evalScript should be available as a global function.
-    assert_eq!(eval_wpt("typeof evalScript"), "function");
-}
-
-#[test]
-fn set_location_configures_worker_location() {
-    // After __setLocation runs, every WorkerLocation accessor must
-    // report the configured URL's components.
+fn set_location_rejects_an_invalid_url() {
     assert_eq!(
         eval_wpt(
-            "__setLocation('http://web-platform.test:8000/foo/bar.any.js?x=1'); \
-             [location.href, location.origin, location.pathname, location.search].join('|')"
+            "try { __setLocation('not a url'); 'no-throw' } \
+             catch (e) { (e instanceof TypeError) + ',' + e.message.includes('invalid URL') }"
         ),
-        "http://web-platform.test:8000/foo/bar.any.js?x=1|\
-         http://web-platform.test:8000|/foo/bar.any.js|?x=1"
+        "true,true"
     );
 }
 
+/// After `__setLocation` runs, every `WorkerLocation` accessor reports the URL's components.
 #[test]
-fn set_location_rejects_invalid_url() {
+fn set_location_sets_every_location_accessor() {
     assert_eq!(
         eval_wpt(
-            "try { __setLocation('not a url'); 'no-throw' } \
-             catch(e) { (e instanceof TypeError) + ',' + e.message.includes('invalid URL') }"
+            "__setLocation('http://web-platform.test:8000/foo/bar.any.js?x=1'); \
+             [location.href, location.origin, location.pathname, location.search].join('|')"
         ),
-        "true,true"
+        "http://web-platform.test:8000/foo/bar.any.js?x=1|\
+         http://web-platform.test:8000|/foo/bar.any.js|?x=1"
     );
 }
diff --git a/crown/src/common.rs b/crown/src/common.rs
index 71a6a044..262f04a4 100644
--- a/crown/src/common.rs
+++ b/crown/src/common.rs
@@ -11,17 +11,11 @@ use rustc_lint::{LateContext, Lint, LintContext};
 use rustc_middle::ty::{self, GenericArg, TraitRef, Ty, TyCtxt, TypeVisitableExt};
 use rustc_span::hygiene::{ExpnKind, MacroKind};
 use rustc_span::symbol::Symbol;
-use rustc_span::{Span, DUMMY_SP};
+use rustc_span::Span;
 use rustc_trait_selection::traits::query::evaluate_obligation::InferCtxtExt as _;
 use rustc_type_ir::Upcast as _;
 
-/// Emit a lint whose diagnostic is built by a closure.
-///
-/// rustc dropped the closure-based `LintContext::lint` in favour of
-/// `opt_span_lint`, which takes a value implementing the `Diagnostic` trait.
-/// This restores the ergonomic closure form the lint passes were written
-/// against by wrapping the closure in [`DiagDecorator`]. As before, the span is
-/// set inside the closure via `Diag::span`, so no span is passed here.
+/// Emit a lint whose diagnostic `decorate` builds, including its span.
 pub trait LateContextExt {
     fn lint(&self, lint: &'static Lint, decorate: impl FnOnce(&mut Diag<'_, ()>));
 }
@@ -32,9 +26,6 @@ impl<'tcx> LateContextExt for LateContext<'tcx> {
     }
 }
 
-/// check if a DefId's path matches the given absolute type path
-/// usage e.g. with
-/// `match_def_path(cx, id, &["core", "option", "Option"])`
 /// Attribute lookups on [`TyCtxt`].
 pub trait TyCtxtExt {
     /// Whether the item `did` has an attribute whose path is `attrs`.
@@ -50,13 +41,15 @@ impl TyCtxtExt for TyCtxt<'_> {
 /// The item an alias type names: the associated type, opaque type or type alias.
 pub fn alias_def_id(kind: ty::AliasTyKind<'_>) -> DefId {
     match kind {
-        ty::AliasTyKind::Projection { def_id } => def_id.into(),
-        ty::AliasTyKind::Inherent { def_id } => def_id.into(),
-        ty::AliasTyKind::Opaque { def_id } => def_id.into(),
-        ty::AliasTyKind::Free { def_id } => def_id.into(),
+        ty::AliasTyKind::Projection { def_id }
+        | ty::AliasTyKind::Inherent { def_id }
+        | ty::AliasTyKind::Opaque { def_id }
+        | ty::AliasTyKind::Free { def_id } => def_id,
     }
 }
 
+/// Check if a DefId's path matches the given absolute type path, e.g. with
+/// `match_def_path(cx, id, &["core", "option", "Option"])`.
 pub fn match_def_path(cx: &LateContext, def_id: DefId, path: &[Symbol]) -> bool {
     let def_path = cx.tcx.def_path(def_id);
     let krate = &cx.tcx.crate_name(def_path.krate);
@@ -147,66 +140,23 @@ pub fn trait_in_crate<'tcx>(
 Stuff copied from clippy:
 */
 
-/// Checks whether a type implements a trait.
-/// The function returns false in case the type contains an inference variable.
+/// Checks whether a type implements a trait. Panics if the type contains an inference variable.
 ///
 /// See [Common tools for writing lints] for an example how to use this function and other options.
 ///
 /// [Common tools for writing lints]: https://github.com/rust-lang/rust-clippy/blob/master/book/src/development/common_tools_writing_lints.md#checking-if-a-type-implements-a-specific-trait
-pub fn implements_trait<'tcx>(
-    cx: &LateContext<'tcx>,
-    ty: Ty<'tcx>,
-    trait_id: DefId,
-    args: &[GenericArg<'tcx>],
-) -> bool {
-    implements_trait_with_env_from_iter(
-        cx.tcx,
-        cx.typing_env(),
-        ty,
-        trait_id,
-        None,
-        args.iter().map(|&x| Some(x)),
-    )
-}
-
-/// Same as `implements_trait_from_env` but takes the arguments as an iterator.
-pub fn implements_trait_with_env_from_iter<'tcx>(
-    tcx: TyCtxt<'tcx>,
-    typing_env: ty::TypingEnv<'tcx>,
-    ty: Ty<'tcx>,
-    trait_id: DefId,
-    callee_id: Option<DefId>,
-    args: impl IntoIterator<Item = impl Into<Option<GenericArg<'tcx>>>>,
-) -> bool {
+pub fn implements_trait<'tcx>(cx: &LateContext<'tcx>, ty: Ty<'tcx>, trait_id: DefId) -> bool {
+    let tcx = cx.tcx;
     // Clippy shouldn't have infer types
     assert!(!ty.has_infer());
 
-    // If a `callee_id` is passed, then we assert that it is a body owner
-    // through calling `body_owner_kind`, which would panic if the callee
-    // does not have a body.
-    if let Some(callee_id) = callee_id {
-        let _ = tcx.hir_body_owner_kind(callee_id);
-    }
-
     let ty = tcx.erase_and_anonymize_regions(ty);
     if ty.has_escaping_bound_vars() {
         return false;
     }
 
-    let (infcx, param_env) = tcx.infer_ctxt().build_with_typing_env(typing_env);
-    let args = args
-        .into_iter()
-        .map(|arg| {
-            arg.into()
-                .unwrap_or_else(|| infcx.next_ty_var(DUMMY_SP).into())
-        })
-        .collect::<Vec<_>>();
-
-    let trait_ref = TraitRef::new(
-        tcx,
-        trait_id,
-        [GenericArg::from(ty)].into_iter().chain(args),
-    );
+    let (infcx, param_env) = tcx.infer_ctxt().build_with_typing_env(cx.typing_env());
+    let trait_ref = TraitRef::new(tcx, trait_id, [GenericArg::from(ty)]);
 
     debug_assert!(
         matches!(tcx.def_kind(trait_id), DefKind::Trait | DefKind::TraitAlias),
diff --git a/crown/src/trace_in_no_trace.rs b/crown/src/trace_in_no_trace.rs
index e64da592..9b6d92c0 100644
--- a/crown/src/trace_in_no_trace.rs
+++ b/crown/src/trace_in_no_trace.rs
@@ -109,7 +109,7 @@ fn find_jstraceable<'tcx>(cx: &LateContext<'tcx>) -> Option<DefId> {
 
 fn is_jstraceable<'tcx>(cx: &LateContext<'tcx>, ty: ty::Ty<'tcx>) -> bool {
     if let Some(trait_id) = find_jstraceable(cx) {
-        return implements_trait(cx, ty, trait_id, &[]);
+        return implements_trait(cx, ty, trait_id);
     }
     panic!("JSTraceable not found");
 }
@@ -168,11 +168,6 @@ jsmanaged inside on {pos}-th position. Consider removing the wrapper."
 // as these are the only ones that are actually traced
 impl<'tcx> LateLintPass<'tcx> for NotracePass {
     fn check_item(&mut self, cx: &LateContext<'tcx>, item: &'tcx hir::Item) {
-        // TODO: better performance if we limit with lint attr???
-        /*let attrs = cx.tcx.hir().attrs(item.hir_id());
-        if has_lint_attr(&self.symbols, &attrs, self.symbols.must_root) {
-            return;
-        }*/
         if let hir::ItemKind::Struct(_, _, variant_data) = &item.kind {
             for field in variant_data.fields() {
                 let field_type = cx.tcx.type_of(field.def_id);
@@ -182,15 +177,11 @@ impl<'tcx> LateLintPass<'tcx> for NotracePass {
     }
 
     fn check_variant(&mut self, cx: &LateContext, var: &hir::Variant) {
-        #[allow(clippy::single_match)]
-        match var.data {
-            hir::VariantData::Tuple(fields, ..) => {
-                for field in fields {
-                    let field_type = cx.tcx.type_of(field.def_id);
-                    incorrect_no_trace(&self.symbols, cx, field_type.skip_binder(), field.ty.span);
-                }
-            },
-            _ => (), // Struct variants already caught by check_struct_def
+        if let hir::VariantData::Tuple(fields, ..) = var.data {
+            for field in fields {
+                let field_type = cx.tcx.type_of(field.def_id);
+                incorrect_no_trace(&self.symbols, cx, field_type.skip_binder(), field.ty.span);
+            }
         }
     }
 }
diff --git a/crown/src/unrooted_must_root.rs b/crown/src/unrooted_must_root.rs
index d7bd55e2..69c546ec 100644
--- a/crown/src/unrooted_must_root.rs
+++ b/crown/src/unrooted_must_root.rs
@@ -144,6 +144,36 @@ fn is_unrooted_ty<'tcx>(
     // callers pass `false` for return-type checks.
     flag_value: bool,
 ) -> bool {
+    // Structures which are semantically similar to an &ptr.
+    let ref_like: &[&[Symbol]] = &[
+        &[sym::core, sym.cell, sym.Ref],
+        &[sym::core, sym.cell, sym.RefMut],
+        &[sym::core, sym::slice, sym::iter, sym.Iter],
+        &[sym::core, sym::slice, sym::iter, sym.IterMut],
+        &[sym.accountable_refcell, sym.Ref],
+        &[sym.accountable_refcell, sym.RefMut],
+        &[sym.mozjs, sym.gc, sym.root, sym.Handle],
+        &[sym.js, sym.gc, sym.handle, sym.Stack],
+        &[sym.mozjs_sys, sym.generated, sym.root, sym.JS, sym.Handle],
+        &[sym::std, sym.collections, sym.hash, sym.map, sym.Entry],
+        &[
+            sym::std,
+            sym.collections,
+            sym.hash,
+            sym.map,
+            sym.OccupiedEntry,
+        ],
+        &[
+            sym::std,
+            sym.collections,
+            sym.hash,
+            sym.map,
+            sym.VacantEntry,
+        ],
+        &[sym::std, sym.collections, sym.hash, sym.map, sym.Iter],
+        &[sym::std, sym.collections, sym.hash, sym.map, sym.Values],
+        &[sym::std, sym.collections, sym.hash, sym.set, sym.Iter],
+    ];
     let mut ret = false;
     let mut walker = ty.walk();
     while let Some(generic_arg) = walker.next() {
@@ -182,62 +212,10 @@ fn is_unrooted_ty<'tcx>(
                         },
                         _ => true,
                     }
-                } else if match_def_path(cx, did.did(), &[sym::core, sym.cell, sym.Ref])
-                    || match_def_path(cx, did.did(), &[sym::core, sym.cell, sym.RefMut])
-                    || match_def_path(cx, did.did(), &[sym::core, sym::slice, sym::iter, sym.Iter])
-                    || match_def_path(
-                        cx,
-                        did.did(),
-                        &[sym::core, sym::slice, sym::iter, sym.IterMut],
-                    )
-                    || match_def_path(cx, did.did(), &[sym.accountable_refcell, sym.Ref])
-                    || match_def_path(cx, did.did(), &[sym.accountable_refcell, sym.RefMut])
-                    || match_def_path(cx, did.did(), &[sym.mozjs, sym.gc, sym.root, sym.Handle])
-                    || match_def_path(cx, did.did(), &[sym.js, sym.gc, sym.handle, sym.Stack])
-                    || match_def_path(
-                        cx,
-                        did.did(),
-                        &[sym.mozjs_sys, sym.generated, sym.root, sym.JS, sym.Handle],
-                    )
-                    || match_def_path(
-                        cx,
-                        did.did(),
-                        &[sym::std, sym.collections, sym.hash, sym.map, sym.Entry],
-                    )
-                    || match_def_path(
-                        cx,
-                        did.did(),
-                        &[
-                            sym::std,
-                            sym.collections,
-                            sym.hash,
-                            sym.map,
-                            sym.OccupiedEntry,
-                        ],
-                    )
-                    || match_def_path(
-                        cx,
-                        did.did(),
-                        &[
-                            sym::std,
-                            sym.collections,
-                            sym.hash,
-                            sym.map,
-                            sym.VacantEntry,
-                        ],
-                    )
-                    || match_def_path(
-                        cx,
-                        did.did(),
-                        &[sym::std, sym.collections, sym.hash, sym.map, sym.Iter],
-                    )
-                    || match_def_path(
-                        cx,
-                        did.did(),
-                        &[sym::std, sym.collections, sym.hash, sym.set, sym.Iter],
-                    )
+                } else if ref_like
+                    .iter()
+                    .any(|path| match_def_path(cx, did.did(), path))
                 {
-                    // Structures which are semantically similar to an &ptr.
                     false
                 } else if match_def_path(
                     cx,
@@ -348,15 +326,18 @@ impl<'tcx> LateLintPass<'tcx> for UnrootedPass {
     }
 
     /// All enums containing #[js::must_root] types
-    /// must be #[js::must_root] themselves
+    /// must be #[js::must_root] or #[js::allow_unrooted_interior] themselves
     fn check_variant(&mut self, cx: &LateContext, var: &hir::Variant) {
         let parent = cx.tcx.hir_get_parent_item(var.hir_id).def_id;
         let parent_item = cx.tcx.hir_expect_item(parent);
         let sym = &self.symbols;
-        if !cx.tcx.has_attrs_with_path(
-            parent_item.hir_id().expect_owner(),
-            &[sym.crown, sym.unrooted_must_root_lint, sym.must_root],
-        ) {
+        let has_attr = |symbol| {
+            cx.tcx.has_attrs_with_path(
+                parent_item.hir_id().expect_owner(),
+                &[sym.crown, sym.unrooted_must_root_lint, symbol],
+            )
+        };
+        if !has_attr(sym.must_root) && !has_attr(sym.allow_unrooted_interior) {
             // `VariantData::fields()` yields the fields of both tuple-like
             // (`V(Heap<T>)`) and struct-like (`V { f: Heap<T> }`) variants, and
             // is empty for unit variants. Checking every field here closes a gap
@@ -493,14 +474,12 @@ impl<'tcx> LateLintPass<'tcx> for UnrootedPass {
     ) {
         let in_new_function = match kind {
             visit::FnKind::ItemFn(n, _, _) | visit::FnKind::Method(n, _) => {
-                n.as_str() == "new"
-                    || n.as_str().starts_with("new_")
-                    || n.as_str() == "from"
-                    || n.as_str().starts_with("from_")
-                    || n.as_str() == "default"
-                    || n.as_str() == "Wrap"
-                    || n.as_str() == "constructor"
-                    || n.as_str() == "construct"
+                let n = n.as_str();
+                matches!(
+                    n,
+                    "new" | "from" | "default" | "Wrap" | "constructor" | "construct"
+                ) || n.starts_with("new_")
+                    || n.starts_with("from_")
             },
             visit::FnKind::Closure => false,
         };
@@ -562,45 +541,18 @@ struct FnDefVisitor<'a, 'tcx: 'a> {
 }
 
 impl<'a, 'tcx> visit::Visitor<'tcx> for FnDefVisitor<'a, 'tcx> {
-    // TODO: https://github.com/servo/servo/issues/37330
-    /*
-    type NestedFilter = rustc_middle::hir::nested_filter::OnlyBodies;
-
-    fn maybe_tcx(&mut self) -> Self::MaybeTyCtxt {
-        self.cx.tcx
-    }
-    */
-
     fn visit_expr(&mut self, expr: &'tcx hir::Expr) {
         let cx = self.cx;
 
-        let require_rooted = |cx: &LateContext, in_new_function: bool, subexpr: &hir::Expr| {
+        // Trait casts from #[js::must_root] types are not allowed
+        if let ExprKind::Cast(subexpr, _) = expr.kind {
             let ty = cx.typeck_results().expr_ty(subexpr);
-            if is_unrooted_ty(self.symbols, cx, ty, in_new_function, true) {
+            if is_unrooted_ty(self.symbols, cx, ty, self.in_new_function, true) {
                 cx.lint(UNROOTED_MUST_ROOT, |lint| {
                     lint.primary_message(format!("Expression of type {:?} must be rooted.", ty));
                     lint.span(subexpr.span);
                 })
             }
-        };
-
-        match expr.kind {
-            // Trait casts from #[js::must_root] types are not allowed
-            ExprKind::Cast(subexpr, _) => require_rooted(cx, self.in_new_function, subexpr),
-            // This catches assignments... the main point of this would be to catch mutable
-            // references to `JS<T>`.
-            // FIXME: Enable this? Triggers on certain kinds of uses of DomRefCell.
-            // hir::ExprAssign(_, ref rhs) => require_rooted(cx, self.in_new_function, &*rhs),
-            // This catches calls; basically, this enforces the constraint that only constructors
-            // can call other constructors.
-            // FIXME: Enable this? Currently triggers with constructs involving DomRefCell, and
-            // constructs like Vec<JS<T>> and RootedVec<JS<T>>.
-            // hir::ExprCall(..) if !self.in_new_function => {
-            //     require_rooted(cx, self.in_new_function, expr);
-            // }
-            _ => {
-                // TODO(pcwalton): Check generics with a whitelist of allowed generics.
-            },
         }
 
         visit::walk_expr(self, expr);
@@ -661,6 +613,7 @@ symbols! {
     RefMut
     Iter
     IterMut
+    Values
     collections
     hash
     map
diff --git a/crown/tests/run-pass/allowed_interior.rs b/crown/tests/run-pass/allowed_interior.rs
index 15300aaa..5764b3a6 100644
--- a/crown/tests/run-pass/allowed_interior.rs
+++ b/crown/tests/run-pass/allowed_interior.rs
@@ -13,4 +13,10 @@ struct CanBeUnrooted {
     val: MustBeRooted,
 }
 
+#[crown::unrooted_must_root_lint::allow_unrooted_interior]
+enum CanBeUnrootedEnum {
+    Tuple(MustBeRooted),
+    Struct { val: MustBeRooted },
+}
+
 fn main() {}
diff --git a/crown/tests/run-pass/hash_map_values.rs b/crown/tests/run-pass/hash_map_values.rs
new file mode 100644
index 00000000..d38c5221
--- /dev/null
+++ b/crown/tests/run-pass/hash_map_values.rs
@@ -0,0 +1,25 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at https://mozilla.org/MPL/2.0/. */
+//@rustc-env:RUSTC_BOOTSTRAP=1
+
+use std::collections::HashMap;
+
+#[crown::unrooted_must_root_lint::must_root]
+struct Foo(i32);
+
+#[crown::unrooted_must_root_lint::allow_unrooted_interior]
+struct Holder(HashMap<u32, Foo>);
+
+// `HashMap::values` borrows the values, like `HashMap::iter`.
+fn sum(holder: &Holder) -> i32 {
+    let mut total = 0;
+    for foo in holder.0.values() {
+        total += foo.0;
+    }
+    total
+}
+
+fn main() {
+    let _ = sum;
+}
diff --git a/docs/builtin-development.md b/docs/builtin-development.md
new file mode 100644
index 00000000..0c90441c
--- /dev/null
+++ b/docs/builtin-development.md
@@ -0,0 +1,169 @@
+# Developing builtins
+
+This guide is an attempt to capture all the key considerations that must go into adding or making
+changes to StarlingMonkey builtins. It collects the practices that keep builtins consistent, fast
+and correct. GC rooting has a dedicated guide, [`rooting.md`](rooting.md).
+
+## Use what exists
+
+Before writing a helper, cache, wrapper, macro or any other plumbing, check whether the capability
+already exists. Most of what builtins share lives in these places:
+
+- `crates/js/src`: the safe JSAPI layer.
+- `crates/core-runtime/src`: the event loop, timers and the module loader.
+- `crates/starling-macro`: the class and module macros, and the code they generate.
+- `crates/builtins/web-*`: the existing web builtins.
+
+If something close exists, use it, or extend it in place with a parameter or variant. If nothing
+exists, add the new primitive to the shared crate where similar primitives live, not to the
+builtin that first needs it.
+
+What to use for capabilities that builtins often need:
+
+| Capability | Use |
+|---|---|
+| Interned property names | `&'static CStr` names with `get_property`, `set_property`, `define_property`, which intern through `js::class::get_or_init_property_id`. `js::class::static_property_name` makes such a name from a runtime string of a bounded set. The `*_by_name` variants atomize other runtime names on each call. |
+| Symbols | `js::symbol::get_well_known` for well-known symbols, and `new_symbol` rather than `get_symbol_for` unless the spec registers the symbol |
+| Intrinsics (`Object`, `Error`, `Promise`, `RegExp`, …) | `js::class::get_class_object`, never a lookup on the global object |
+| The runtime's own builtins | Direct Rust calls, per-global shared objects (`js::class::get_or_init_shared_object`), or a class's prototype (`js::class::get_prototype_object_for`), never a lookup by name |
+| Per-global Rust state | `js::class::global_state` |
+| Callback state | The value itself as the payload, or a `#[jsclass(hidden)]` instance read with `js::function::cast_payload` |
+| The arguments of a native function as a list | A `RestArgs<T>` parameter |
+| Timers | The `EventLoop` timer methods, such as `queue_timer`, not the global `setTimeout` |
+| Promise reactions whose derived promise is unused | `Promise::add_reactions`, not `then` |
+| Brand checks | Engine predicates (`cast`, `Array::is_array`), not `Symbol.toStringTag` or probe calls |
+| Property descriptors | `Object::get_own_property_descriptor`, not a JS call to `Object.getOwnPropertyDescriptor` |
+| Array contents | `js::Array::{with_contents, length, set_length}` |
+| Iterators | `js::iteration` |
+| UTF-8 and UTF-16 conversion | The `JSString` helpers (`from_str`, `from_latin1`, `from_utf16`, `to_utf8`) |
+
+Do an audit for duplicated functionality before opening a PR, and remove any duplication you find.
+
+## Instance state lives in Rust
+
+All of an instance's state is one Rust struct in slot 0, the private data that `#[jsclass]`
+classes use. Fields are typed, and fields that reference JS values are `Heap<T>`. Two reasons make
+this a hard rule:
+
+- **Performance.** Rust code reaches JS properties through SpiderMonkey's generic lookup path,
+  which has no inline caches.
+- **Safety.** Accessors on a prototype chain, monkeypatched prototypes and re-entrant author code
+  can intercept or corrupt state kept in properties.
+
+That rules out each of these:
+
+- state in JS properties, symbol-keyed properties or JS arrays;
+- hidden objects stored in properties to hold state;
+- WeakMaps or other side tables keyed by the instance;
+- separate reserved slots per kind of state.
+
+## Register classes eagerly
+
+Every class, including internal and hidden ones, is registered when a global is set up. Each
+builtin crate has an `add_to_global` function, which is registered with
+`core_runtime::runtime::register_global_initializer` and runs for each new global. It calls the
+generated `add_to_global` of each of the builtin's classes. For a
+`#[jsclass(hidden)]` class, the generated function registers the class with
+`js::class::register_hidden_class`, which defines no global property.
+
+Registration on first use would run after content code has started. It could observe or overwrite
+globals that content code defined. It would also run on the first request rather than during
+snapshot creation, so its cost wouldn't be covered by the snapshot.
+
+## Borrows and re-entrancy
+
+Never hold a borrow of a class's private data (`data()`, `data_mut()`, `get()`) across a call into
+JavaScript. A call into content code, such as a stream's underlying source or sink algorithm or an
+event listener, can call into the same instance again and panic on the outstanding borrow. Copy the
+values you need into locals, make the call, then borrow again.
+
+A borrow taken in the scrutinee of a `match`, `if let` or `while let` lives until the end of the
+statement, including all of its arms. Bind the value to a local first. Debug builds check borrows
+at runtime: run the affected tests against a debug build after changing code that calls into
+JavaScript.
+
+## Untrusted input
+
+Builtins process input from content code and from the network. Input that makes a builtin abort
+the process takes down every request an instance serves, and no JavaScript `try` can catch it.
+
+- **Bound recursion.** Native code that recurses over a structure from content code, such as
+  nested objects or nested data in a parser, checks its depth or the remaining native stack at
+  every level, and throws an exception once it exceeds the limit. Iterating with an explicit stack
+  is an alternative where the algorithm allows it.
+- **Allocate fallibly.** A buffer whose size comes from JavaScript, from a header, or from decoded
+  data is allocated with `Vec::try_reserve_exact` or another fallible allocation. If the
+  allocation fails, the builtin throws an exception or reports out of memory, either with
+  `js::exception::report_out_of_memory` or by returning `js::error::OutOfMemory` as a method's
+  error. `vec![0; n]`, `Vec::with_capacity`, `resize` and `extend` abort the process when the
+  allocation fails.
+- **Compute sizes with checked arithmetic.** `usize` is 32 bits on wasm32, so a product of two
+  sizes from JavaScript can wrap there and pass a limit check that catches it natively. Use
+  `checked_mul` and `checked_add`, and compare against the limit before allocating.
+- **Apply limits while the work happens.** A limit on output size, such as a stream's chunk size,
+  stops the work as soon as it's reached, not after the whole output exists.
+- **Check a value's type before converting it.** `Value::to_number`, `to_int32`, `to_double`,
+  `to_boolean`, `to_string` and `to_object` assert the value's type and abort on any other. Values
+  from content code go through `from_jsval_throwing` or a type check first, including values
+  returned from content callbacks and read from properties that content code can assign.
+
+## WebAssembly and instance reuse
+
+- **Thread-locals reset on WASIp3.** `thread_local!` storage is reset on every export call while
+  linear memory persists. Builtins use `instance_local!` for per-instance state, never
+  `thread_local!`.
+- **Instances are reused.** A wasm instance serves many requests, concurrently when requests wait
+  on I/O. Nothing may assume a fresh instance per request, and per-instance caches must not grow
+  without bound.
+- **Top-level code runs at snapshot time.** Applications snapshotted with Wizer evaluate their top
+  level during snapshotting, with no lazy deferral. State that can't be snapshotted, such as a host
+  resource, is created when a request needs it.
+
+## Writing tests
+
+- **Don't repeat WPT.** Behavior checked by a WPT test with a passing expectation needs no
+  in-tree test. In-tree tests cover what WPT doesn't reach: Starling-specific APIs, error paths, GC
+  and rooting, and regressions for specific bugs.
+- **Count wasm test binaries.** In each wasm CI job, every test binary that links the engine takes
+  about 10 seconds to compile, however many tests it holds. Gate test files that are pure Rust
+  or only meaningful natively with `#![cfg(not(target_arch = "wasm32"))]`. Add new ungated engine
+  tests to a binary that already runs on wasm. A crate without unit tests worth running on wasm
+  sets `[lib] test = false` and keeps its tests in `tests/`.
+- **Wait for outcomes, not for fixed times.** Poll for an outcome (`serve_test_support::eventually`) instead
+  of sleeping for a fixed time. Serve timeouts accept fractions of a second, so timeout tests
+  configure a few hundred milliseconds rather than whole seconds.
+
+## Verifying changes
+
+Run targeted tests while iterating, and the slow suites once per coarse batch of changes:
+
+- `cargo test --features debugmozjs -p <crate>` for the crates you changed, for example
+  `-p core-runtime` or `-p libstarling --test serve`, and `just test` for the whole workspace.
+- WPT (`just wpt-test`, `just wpt-test-wasm`) when web builtins or the `js` crate change. Record
+  new results with `just wpt-update` and `just wpt-update-wasm`, not by editing expectation files
+  by hand. A subtest whose result varies between runs is marked `FLAKY` in its expectation file,
+  and updates keep that marker. Before calling a failure a regression, run it again and against
+  the previous binary.
+- The componentization suites (`just test-componentize`) when the runtime's component exports,
+  the WIT bridge (`wit-bridge`) or the componentizer change.
+- Crown (`just check-gc`, see [rooting.md](rooting.md#enforcing-proper-rooting-at-the-type-system-level-the-crown-static-analysis-lint))
+  and the GC zeal tests (`just gc-zeal`).
+- `just clippy`, which fails on any warning.
+
+`just check-all` runs the formatting check, clippy, the examples' tests, the componentizer's unit
+tests, crown and the quick GC zeal modes over `js`, `core-runtime`, `wit-bridge` and the
+builtin crates. The other crates' tests need `just test`.
+
+Run heavy jobs one at a time. Wasm builds, componentize runs, harness runs and benchmarks running
+at once exhaust memory, and their timings are meaningless.
+
+For performance work, measure server CPU time per request rather than requests per second alone,
+alternate the old and new binaries, and repeat each measurement. Profile before optimizing.
+
+## Comments and commits
+
+Comments are plain declarative statements about the code they describe. State what the code does
+and what a caller must know, enumerate the cases completely and leave out everything else.
+
+Commits are coarse and grouped by theme, and each one compiles. A commit that fixes shared code
+comes before the commits that build on it.
diff --git a/docs/rooting.md b/docs/rooting.md
index ce6d5732..43e7a442 100644
--- a/docs/rooting.md
+++ b/docs/rooting.md
@@ -1,141 +1,139 @@
 # GC Rooting in StarlingMonkey
 
-This is a practical guide to rooting for people writing builtins. Read the first
-two sections before you write any builtin that touches a JS value; the rest
-explains how it works and how the compiler keeps you honest.
+This is a practical guide to rooting for people writing builtins. Read the first two sections
+before you write a builtin that handles JS values. The rest describes how rooting works, and how
+the `crown` lint and the GC zeal tests check it.
 
 ## Why rooting exists
 
-SpiderMonkey's garbage collector is **moving** and **compacting**: it can
-relocate a live JS object (or string) to a new address at almost any allocation
-point, and it reclaims everything it can't reach. It uses **exact rooting** — it
-only knows about references you have explicitly handed it. A raw `*mut JSObject`
-or a bare `Value` sitting in a Rust local is invisible to the GC: after a
+SpiderMonkey's garbage collector is moving and compacting. It can relocate a live JS object or
+string to a new address at almost any allocation, and it reclaims everything it can't reach. It
+uses exact rooting, so it only traces the references that were explicitly registered with it.
+A raw `*mut JSObject` or a bare `Value` in a Rust local is invisible to the GC, and after a
 collection it may point at a moved or freed cell.
 
-So the one rule everything below serves is:
+Everything below follows from one rule:
 
-> **Never hold a bare JS reference across anything that can allocate.** Hold it
-> in something the GC traces: a rooting scope, or a traced heap slot.
+> Never hold a bare JS reference across anything that can allocate. Hold it in something the GC
+> traces: a rooting scope, or a traced heap slot.
 
-In practice "anything that can allocate" is almost every JS operation: creating
-an object, calling a function, resolving a promise, even rooting another value.
-Assume any `js::*` call can trigger a GC.
+Almost every JS operation can allocate: creating an object, calling a function, resolving a
+promise, and even rooting another value. Assume that any `js::*` call can trigger a GC.
 
-## The four types you'll actually use
+## The four types you'll use
 
 | Type | What it is | Use it for |
 |------|-----------|-----------|
-| `Stack<'s, T>` (and its aliases/newtypes: `Object<'s>`, `Promise<'s>`, `Dog<'s>`) | A JS **object** reference rooted in a scope | Local object handles inside a function |
-| `HandleValue<'s>` (= `Handle<'s, Value>`) | A JS **value** (any JSVal) rooted in a scope | Local value handles inside a function |
-| `Heap<T>` / `Heap<Value>` | A GC-**traced** slot you can store long-term | Fields of a builtin struct that outlive the call |
-| `&Scope<'_>` | The rooting scope itself | Passed into every builtin; the thing you root *with* |
+| `Stack<'s, T>`, and its aliases and newtypes such as `Object<'s>`, `Promise<'s>` and `Dog<'s>` | A JS object reference rooted in a scope | Local object handles inside a function |
+| `HandleValue<'s>` (`Handle<'s, Value>`) | Any JS value, rooted in a scope | Local value handles inside a function |
+| `Heap<T>` and `Heap<Value>` | A traced slot for long-term storage | Fields of a builtin struct that outlive the call |
+| `&Scope<'_>` | The rooting scope | Passed into every builtin, which roots its values in it |
 
-`Stack<'s, T>` and `HandleValue<'s>` are **rooted** — safe to hold across
-allocations for the scope lifetime `'s`. `Heap<T>` is **traced** — safe to store
-in a struct that is itself traced. Bare `*mut JSObject` and `Value` are neither;
-treat them as radioactive and consume them immediately.
+`Stack<'s, T>` and `HandleValue<'s>` are rooted. They stay valid across allocations for the scope
+lifetime `'s`. `Heap<T>` is traced. It stays valid when it is stored in a struct that is itself
+traced. Bare `*mut JSObject` and `Value` are neither, so use them as soon as you have them and
+don't keep them around.
 
-User-defined classes get a newtype `Foo<'s>` that wraps `Stack<'s, FooImpl>` and
-carries the class's methods. `Object<'s>`, `Promise<'s>`, etc. are type aliases
-for `Stack<'s, …>`. They all behave the same way.
+Each user-defined class gets a newtype `Foo<'s>` that wraps `Stack<'s, FooImpl>` and implements
+the class's methods. `Object<'s>`, `Promise<'s>` and the other builtin types are type aliases for
+`Stack<'s, …>`. All of them behave the same way.
 
 ## Writing a builtin: the rules of thumb
 
-A builtin method receives a `&Scope<'_>` (declare a `scope: &Scope<'_>`
-parameter and the macro wires it up). That scope is your rooting context.
+A builtin method that declares a `scope: &Scope<'_>` parameter receives the current scope from the
+macro. That scope is the rooting context for everything the method does.
 
-**Most importantly, use the `#[jsclass]` / `[jsmethods]` and `[webidl_interface]` / `#[webidl_methods]` proc macros wherever possible to create new builtin objects.**
-They encapsulate the most challenging parts of rooting for you, and automate most of type checking and conversion. For WebIDL builtins, there are additional proc macros, including `#[webidl_dictionary]`, etc.
+**Most importantly, use the `#[jsclass]` / `#[jsmethods]` and `#[webidl_interface]` /
+`#[webidl_methods]` proc macros wherever possible to create new builtin objects.** They encapsulate
+the most challenging parts of rooting for you, and automate most type checking and conversion. For
+WebIDL builtins, there are additional proc macros, such as `#[webidl_dictionary]`.
 
-Beyond that, the following rules apply to all code handling JS values and objects:
+Beyond that, the following rules apply to all code handling JS values and objects.
 
-**1. Keep local JS references rooted.** Creating or fetching a JS object/value
-hands you a rooted handle — keep it as that handle, don't unwrap it to a raw
-pointer or bare `Value`:
+### 1. Keep local JS references rooted
+
+Creating or fetching a JS object or value returns a rooted handle. Keep using that handle, and
+don't unwrap it to a raw pointer or a bare `Value`:
 
 ```rust
-let obj = Object::new_plain(scope)?;        // Object<'s> — rooted
-let v   = scope.root_value(some_raw_value);  // HandleValue<'s> — rooted
-obj.set_property(scope, c"x", v)?;           // safe to use across calls
+let obj = Object::new_plain(scope)?;        // Object<'s>, rooted
+let v   = scope.root_value(some_raw_value);  // HandleValue<'s>, rooted
+obj.set_property(scope, c"x", v)?;           // both stay valid across calls
 ```
 
-**2. Store long-lived JS references in `Heap` fields.** A reference that must
-outlive the current call (a field of your class) goes in a `Heap<T>` for object
-references or `Heap<Value>` for arbitrary values:
+### 2. Store long-lived JS references in `Heap` fields
+
+A reference that must outlive the current call, such as a field of your class, goes in a `Heap<T>`
+for an object or a `Heap<Value>` for any value:
 
 ```rust
 #[webidl_interface]
 pub struct MyThing {
     callback: Heap<js::object::Object>,  // a JS object reference
-    detail:   Heap<Value>,               // an arbitrary JS value
+    detail:   Heap<Value>,               // any JS value
     #[no_trace]
-    count:    u32,                        // plain data — not a JS reference
+    count:    u32,                        // plain data, not a JS reference
 }
 ```
 
-Object-bearing fields are traced for you (the class's trace hook walks them).
-Plain non-JS fields get `#[no_trace]` where needed, or have trivial implementations of the `Trace` trait.
+The class's trace hook traces the fields that hold JS references. Fields that hold none are marked
+`#[no_trace]` where needed, or have a trivial implementation of the `Trace` trait.
+
+### 3. Read a field by rooting it
 
-**3. Read a field by rooting it back out.** `Heap::get` roots the stored
-reference into the scope and hands you a rooted handle:
+`Heap::get` roots the stored reference in the scope and returns a rooted handle:
 
 ```rust
-let cb = self.callback.get(scope);   // Function<'s> / Object<'s>
+let cb = self.callback.get(scope);   // Function<'s> or Object<'s>
 let d  = self.detail.get(scope);     // HandleValue<'s>
 // both stay valid across whatever allocates next
 ```
 
-**4. Write a field in place.** `Heap::set` takes the rooted handle (or a bare
-`Stack`) directly — no `Heap::from` round-trip:
+### 4. Write a field in place
+
+`Heap::set` takes a rooted handle directly, without a `Heap::from` round trip:
 
 ```rust
-self.callback.set(new_obj);   // new_obj: Object<'s> / Function<'s>
+self.callback.set(new_obj);   // new_obj: Object<'s> or Function<'s>
 self.detail.set(*some_value); // Heap<Value> takes a Value
 ```
 
-Use `field.set(x)` to update an existing field (an in-place barriered write, no
-allocation). Use `Heap::from(x)` only when *constructing* the struct or filling
-an `Option<Heap<T>>` that was `None`.
-
-That's 90% of it. If you follow these four rules you won't have a rooting bug.
+Use `field.set(x)` to update an existing field. It writes in place through the GC's write barrier
+and doesn't allocate. Use `Heap::from(x)` only when constructing the struct. For an
+`Option<Heap<T>>` field, `OptionHeapExt` provides `get`, `set` and `take_rooted`.
 
 ## How it works under the hood
 
-**Scopes.** A `Scope` owns a bump-allocated page of root slots drawn from a
-process-wide pool. That pool sits on SpiderMonkey's `autoGCRooters` stack for the
-whole runtime lifetime, so during every GC the collector walks all live scope slots and
-**updates** them to the moved locations.
-`scope.root_object(ptr)` / `scope.root_value(val)` write into a slot and return a
-`Handle` borrowing that slot for `'s`. When the scope drops, its page returns to
-the pool. This is why a `Stack<'s, T>` is safe across allocations: the slot it
-borrows is traced and relocated by the GC.
-
-**Heaps.** A `Heap<T>` boxes a SpiderMonkey `Heap` cell (`Pin<Box<…>>`). The box
-keeps the GC **write barrier** registered at a stable address even when you move
-the `Heap` into a `Vec`, an `Option`, or another struct — which is what makes
-`Heap::from(stack)` and storing it anywhere safe. A `Heap` is only traced if
-something traces it: that's the job of the `Trace` impl on the struct that holds
-it. `#[derive(Traceable)]` generates that impl (walking every field except
-`#[no_trace]` ones). Types that can't derive it, such as WebIDL enums, need
-hand-written `unsafe impl Trace` implementations.
-
-**The mapping.** Both `Heap::get` and `Heap::take` return `T::Rooted<'s>` — an
-associated type on `JSType`/`ClassDef` that names the canonical rooted handle
-(`Stack<'s, T>` for builtins, the newtype `Foo<'s>` for user classes). `get` roots
-without consuming the `Heap`, `take` consumes it (drop-before-root) for when
-you've moved the `Heap` out of its traced home into a local.
-
-## Additional rooting helper macros
-
-In addition to the above, there are some proc macros that help manage and/or enforce proper rooting:
-
-### `#[derive(js::ScopeRoot)]` — for "settle once then discard" types
-
-Some `#[must_root]` types are *consume-leaves*: they're pulled out of a traced
-list and settled exactly once (a queued read request, a queue entry, a promise
-slot). For these, `#[derive(js::ScopeRoot)]` generates a scope-rooted mirror and
-a safe `root` method:
+**Scopes.** A `Scope` owns a bump-allocated page of root slots drawn from a process-wide pool. The
+pool is registered on SpiderMonkey's `autoGCRooters` stack for the whole lifetime of the runtime,
+so during every GC the collector visits all live scope slots and updates them to the objects' new
+locations. `scope.root_object(ptr)` and `scope.root_value(val)` write into a slot and return a
+`Handle` that borrows that slot for `'s`. When the scope is dropped, its page returns to the pool.
+A `Stack<'s, T>` is safe across allocations because the GC traces and updates the slot it borrows.
+
+**Heaps.** A `Heap<T>` boxes a SpiderMonkey `Heap` cell (`Pin<Box<…>>`). The box keeps the cell,
+for which the GC write barrier is registered, at a stable address when the `Heap` is moved into a
+`Vec`, an `Option` or another struct. That makes `Heap::from(stack)` safe, and a `Heap` can be
+stored anywhere. A `Heap` is traced only if the struct that holds it traces it in its `Trace`
+implementation. `#[derive(Traceable)]` generates that implementation, which traces every field
+except those marked `#[no_trace]`. Types that can't derive it, such as WebIDL enums, need a
+hand-written `unsafe impl Trace`.
+
+**Rooted types.** `Heap::get` and `Heap::take` both return `T::Rooted<'s>`, an associated type on
+`JSType` and `ClassDef` that names the rooted handle type: `Stack<'s, T>` for builtin types, and
+the newtype `Foo<'s>` for user classes. `get` roots the referent and leaves the `Heap` in place.
+`take` consumes the `Heap`, dropping it before rooting the referent. Use `take` when the `Heap` was
+moved out of its traced location into a local.
+
+## Additional rooting helpers
+
+The following macros and types cover references that don't fit the rules above.
+
+### `#[derive(js::ScopeRoot)]` for types used once and then discarded
+
+Some `#[must_root]` types are taken out of a traced list and used exactly once, such as a queued
+read request, a queue entry or a promise slot. For these, `#[derive(js::ScopeRoot)]` generates a
+mirror type whose fields are rooted in a scope, and a safe `root` method:
 
 ```rust
 #[js::must_root]
@@ -144,84 +142,105 @@ enum ReadRequest {
     Read { promise: Heap<Promise> },
     /* … */
 }
-// generates `StackReadRequest<'s>` (each Heap<T> → its rooted handle) and
-// `ReadRequest::root(self, scope) -> StackReadRequest<'s>`.
+// generates `StackReadRequest<'s>`, with each Heap<T> replaced by its rooted handle,
+// and `ReadRequest::root(self, scope) -> StackReadRequest<'s>`.
 ```
 
-Put the type's step/consume methods on the mirror (`impl StackReadRequest<'s>`),
-where the fields are already rooted and no `allow` is needed, and call them as:
+Put the type's step and consume methods on the mirror (`impl StackReadRequest<'s>`). Its fields
+are already rooted there, and no `allow` attribute is needed. Call them like this:
 
 ```rust
 list.remove(0).root(scope).chunk_steps(scope, chunk)?;
 ```
 
-The `must_root` value is a method-receiver temporary immediately consumed by
-`.root()`, which crown accepts; the result is the non-`must_root` mirror. `root`
-is safe by construction: a single-`Heap` group is rooted with `take` (no
-allocation); a multi-`Heap` group is moved into a `RootedTraceableBox` and each
-field rooted while traced, so rooting one can't stale another.
+Crown accepts the `must_root` value here because it is a temporary method receiver that `.root()`
+consumes immediately. The result is the mirror, which isn't `must_root`. `root` is safe by
+construction. If a variant or struct has a single `Heap<T>` field for an object type, `root` roots
+it with `take`, which doesn't allocate. If it has several `Heap` fields or a `Heap<Value>`, `root`
+first moves the value into a `RootedTraceableBox` and roots each field while the box keeps the
+others traced, so rooting one field can't invalidate another.
 
-Don't reach for this on a type that is mutated and re-queued in place (e.g. a
-pull-into descriptor) — a consume-once transform doesn't fit it; keep it in a
-`RootedTraceableBox` instead.
+Don't use `ScopeRoot` for a type that is mutated and re-queued in place, such as a pull-into
+descriptor. Keep such a value in a `RootedTraceableBox` instead.
 
-### `RootedTraceableBox` — keep `impl Trace` types traced across a GC
+### `RootedHeap` and `RootedTraceableBox`: traced GC references outside a traced container
 
-When you must hold a `Heap`-bearing value *outside* any traced container while
-GC-triggering work runs (you're not consuming it, you're keeping it), wrap it in
-a `RootedTraceableBox`: it self-registers with the tracer for its lifetime, so
-the GC updates its `Heap`s in place.
+To hold one GC reference outside any traced container, such as in a timer's state, use a
+`RootedHeap<T>`, where `T` is an object type or `Value`. It roots itself for its lifetime, and
+creating and dropping one takes constant time. `RootedHeap::new(object)` creates one for an object,
+`RootedHeap::from(value)` creates one for a `Value`, and `.get(scope)` reads it.
 
-### `#[allow_unrooted]` — the last-resort escape hatch you really shouldn't use
+To keep an `impl Trace` value with several `Heap` fields outside any traced container while code
+that can GC runs, without consuming it, wrap it in a `RootedTraceableBox`. The box registers itself
+with the tracer for its lifetime, so the GC updates its `Heap`s in place.
 
-**THIS IS ALMOST CERTAINLY THE WRONG THING TO USE!**
-`#[js::allow_unrooted]` silences crown on one item. It is `#[doc(hidden)]` and
-exists for macro-generated code and a handful of audited boundaries (e.g. a
-function that takes a `#[must_root]` value by value and immediately pushes it
-onto a traced list). If you're writing an open-coded builtin and reaching for it,
-you almost certainly want proper rooting instead: root the value, use
-`ScopeRoot`, or use `RootedTraceableBox`.
+### `#[allow_unrooted]`
+
+Builtin code should almost never use this attribute. `#[js::allow_unrooted]` silences crown on one
+item. It is `#[doc(hidden)]`, and exists for macro-generated code and a few audited boundaries,
+such as a function that takes a `#[must_root]` value by value and immediately pushes it onto a
+traced list. Hand-written builtin code roots the value, uses `ScopeRoot`, or uses
+`RootedTraceableBox` instead.
 
 ## Enforcing proper rooting at the type system level: the `crown` static analysis lint
 
-Rooting bugs are silent in release builds and intermittent under GC, so we don't
-rely on review to catch them. A custom rustc lint, **crown**, enforces the rules
-at compile time (`just crown`, and part of `just check-all`):
+Rooting bugs are silent in release builds and intermittent under GC, so we don't rely on review to
+catch them. A custom rustc lint, crown, enforces the rules at compile time. It's run with
+`just check-gc` and also part of `just check-all`.
+
+- A bare `Value` held in a downstream (builtin) crate is an error, whether it's a parameter, a
+  `let`, `match` or `for` binding, a struct field or a cast. Root it as a `HandleValue`, or store
+  it in a `Heap<Value>` if it's a struct field. A `Value` in return position is allowed, since it's
+  passed straight to the engine.
+- A raw `*mut JSObject` held downstream is an error for the same reason.
+- A type marked `#[must_root]` can't be held by value in a plain local across an allocation. Mark
+  any aggregate that bundles `Heap` fields with it, since such an aggregate must stay traced. Crown
+  then requires callers to keep it traced or consume it immediately.
 
-- A bare **`Value`** held in a downstream (builtin) crate — as a parameter,
-  `let`/`match`/`for` binding, struct field, or cast — is an error. Root it
-  (`HandleValue`) or, if it's a struct field, store a `Heap<Value>`. (`Value` in
-  return position is fine — it's handed straight to the engine.)
-- A raw **`*mut JSObject`** held downstream is an error for the same reason.
-- A type marked **`#[must_root]`** may not be held by value in a plain local
-  across an allocation. Use this on any aggregate that bundles `Heap` fields (so
-  it must stay traced): crown then forces callers to keep it traced or consume it
-  immediately.
+The fix for a crown error is almost always one of these: root the value, move it straight into a
+traced container, or wrap it for as long as you need it.
 
-When crown flags something, the fix is almost always one of: root the value, move
-it straight into a traced container, or wrap it while you need it.
+Crown allows bare `Value`s inside the `js` crate. The types cover the case that matters there: a
+raw `Value` doesn't implement `ToJSVal`, so an API taking `impl ToJSVal` only ever receives a
+rooted value or one that holds no GC thing, and can GC before it converts it. Pass a raw value
+read from a handle to an API that takes one directly, such as `Object::from_raw_value`, with
+nothing that can GC in between.
 
 ## Ensuring proper rooting through dynamic checks
 
-The tools and practices described here cut down on rooting complexity and catch most bugs statically, but they're not 100% foolproof. To further improve rooting correctness, StarlingMonkey CI runs parts of the test suite with dynamic checks enabled that are very highly likely to catch any remaining issues. These checks cause tests to run many (in some cases: hundreds of) times more slowly, so they're not enabled for the entire test suite.
+The tools and practices described here cut down on rooting complexity and catch most bugs
+statically, but they're not 100% foolproof. To further improve rooting correctness, StarlingMonkey
+CI runs parts of the test suite with dynamic checks enabled that are very likely to catch any
+remaining issues. These checks make tests run many times more slowly, in some cases hundreds of
+times, so they're not enabled for the entire test suite.
+
+`just gc-zeal` runs them, and `scripts/test-gc-zeal.sh` lists the zeal modes and arguments:
+
+```bash
+just gc-zeal                      # quick mode, over `js`, `core-runtime`, `wit-bridge` and the builtins
+just gc-zeal full                 # every mode over the same crates, takes several minutes
+just gc-zeal full --shard 1/3     # every third mode, as each of CI's three GC zeal jobs runs them
+just gc-zeal quick -p web-fetch   # one crate's tests
+```
+
+`libstarling` isn't covered, since its serve tests have wall-clock timeouts that GC zeal exceeds.
 
-See the `scripts/test-gc-zeal.sh` script for the different checks, and for details of how to run these checks for your builtins.
+Test GC-sensitive builtins with the debug engine, which `just build` and `just test` enable through
+the `debugmozjs` feature. For a thorough check, also run them under GC zeal: `JS_GC_ZEAL=14,1` runs
+a compacting GC on every allocation, which exposes stale references that release builds hide.
 
 ## Cheat sheet
 
 | You have… | Do this |
 |-----------|---------|
-| A new/fetched JS object | Keep the `Object<'s>` / newtype handle; don't unwrap to a pointer |
-| A JS value to hold locally | `scope.root_value(v)` → `HandleValue<'s>` |
-| A JS reference to store in a field | `Heap<T>` (object) or `Heap<Value>` (any value); trace it |
-| To read a `Heap` field | `field.get(scope)` |
-| To overwrite a `Heap` field | `field.set(x)` |
-| To construct a struct / fill `Option<Heap>` | `Heap::from(x)` |
-| A bundle of `Heap`s settled once | `#[must_root] #[derive(js::ScopeRoot)]`, settle via `.root(scope)` |
-| To hold a `Heap` value across a GC without consuming it | `RootedTraceableBox::new(x)` |
-| A crown error you don't understand | **Root more!** Don't `allow_unrooted`, no matter how tempting it seems |
-
-Always test GC-sensitive builtins with the debug engine (`just build`, which
-enables `debugmozjs`) and, for the thorough check, under GC zeal
-(`JS_GC_ZEAL=14,1` forces a compacting GC on every allocation, surfacing stale
-references that release builds hide).
+| A new or fetched JS object | Keep the `Object<'s>` or newtype handle. Don't unwrap it to a pointer |
+| A JS value to hold locally | `scope.root_value(v)`, which returns a `HandleValue<'s>` |
+| A JS reference to store in a field | `Heap<T>` for an object or `Heap<Value>` for any value, traced by the struct |
+| A `Heap` field to read | `field.get(scope)` |
+| A `Heap` field to overwrite | `field.set(x)` |
+| A struct to construct | `Heap::from(x)` for each `Heap` field |
+| An `Option<Heap<T>>` field | `OptionHeapExt::{get, set, take_rooted}` |
+| A bundle of `Heap`s settled once | `#[must_root] #[derive(js::ScopeRoot)]`, settled through `.root(scope)` |
+| One reference to hold outside a traced container | `RootedHeap::new(x)` |
+| An `impl Trace` value with several `Heap`s to keep across a GC without consuming it | `RootedTraceableBox::new(x)` |
+| A crown error you don't understand | Root the value as described above. Don't use `allow_unrooted` |
diff --git a/justfile b/justfile
index ddb08312..e6f85a25 100644
--- a/justfile
+++ b/justfile
@@ -1,29 +1,24 @@
 # SPDX-License-Identifier: Apache-2.0-WITH-LLVM-exception
-#
-# Starling-NG justfile
-#
-# Usage:
-#   just build           Build the project (debug mode)
-#   just test            Run all Rust tests
-#   just clone-wpt-tests Clone the WPT test suite
-#   just wpt-setup       Add the WPT hosts entries to /etc/hosts
-#   just wpt-test        Run all WPT tests
-#   just wpt-test base64 Run WPT tests matching "base64"
-#   just wpt-update      Run WPT tests and update expectations
-#   just test-wizer      Snapshot the wasm component with wizer and serve it
-#   just fmt             Format all code
-#   just clippy          Run clippy lints
-#   just check           Run fmt check + clippy + tests
 
 # The wasm target the `-wasm` recipes build for. `WASM_TARGET=p3 just test-wasm` retargets them;
-# `p2`, `p3` and full triples are all accepted. The pinned toolchain in `rust-toolchain.toml`
-# ships no wasm32-wasip3 std, so that target builds through the toolchain `STARLING_NIGHTLY` names,
-# `nightly` by default.
-_wasm_target_arg := env_var_or_default("WASM_TARGET", "p2")
-WASM_TARGET := if _wasm_target_arg == "p2" { "wasm32-wasip2" } else if _wasm_target_arg == "p3" { "wasm32-wasip3" } else { _wasm_target_arg }
-NIGHTLY := env_var_or_default("STARLING_NIGHTLY", "nightly")
-_wasm_cargo := if WASM_TARGET == "wasm32-wasip3" { "cargo +" + NIGHTLY } else { "cargo" }
-_wasm_out := "${CARGO_TARGET_DIR:-" + justfile_directory() + "/target}/" + WASM_TARGET
+# `p2`, `p3` and full triples are all accepted. `scripts/wasm-target.sh` maps the names to triples
+# and picks the toolchain.
+WASM_TARGET := `. ./scripts/wasm-target.sh && wasm_target "${WASM_TARGET:-p2}"`
+_wasm_cargo := `. ./scripts/wasm-target.sh && wasm_cargo "$(wasm_target "${WASM_TARGET:-p2}")"`
+
+# The cargo build directory, as a shell expression.
+_target := "${CARGO_TARGET_DIR:-" + justfile_directory() + "/target}"
+_wasm_out := _target + "/" + WASM_TARGET
+
+# The wasm target of the runtime `scripts/build-runtime.sh` builds, which the componentizer embeds
+# and its suites link against. `RUNTIME_TARGET` retargets it, and it defaults to wasm32-wasip3.
+RUNTIME_TARGET := `. ./scripts/wasm-target.sh && wasm_target "${RUNTIME_TARGET:-p3}"`
+_runtime_out := _target + "/" + RUNTIME_TARGET
+
+# Cargo for the `componentize` workspace, which is separate from the runtime's. Run from inside
+# its directory: cargo reads `componentize/.cargo/config.toml`, which points the build directory
+# at the repository's `target/`, only from there.
+_componentize := "cd " + justfile_directory() + "/componentize && cargo"
 
 # Build in debug mode.
 build *TARGET:
@@ -61,7 +56,7 @@ wpt-test *PATTERN:
     @just build
     node tests/wpt-harness/run-wpt.mjs {{PATTERN}}
 
-# Run WPT tests, optionally filtering by pattern.
+# Run WPT tests against the release build, optionally filtering by pattern.
 [group('wpt')]
 wpt-test-release *PATTERN:
     @just build-release
@@ -91,33 +86,54 @@ wpt-update-permissive *PATTERN:
     @just build
     node tests/wpt-harness/run-wpt.mjs --permissive --update-expectations {{PATTERN}}
 
+# Crown is formatted with the runtime workspace's toolchain.
+#
 # Format all code.
 fmt:
     cargo fmt
+    {{_componentize}} fmt --all
+    cargo fmt --manifest-path crown/Cargo.toml
 
-# Check formatting without modifying files.
+# Check formatting without modifying files. ARGS go to the runtime workspace's `cargo fmt`.
 fmt-check *ARGS:
     cargo fmt --check {{ARGS}}
+    {{_componentize}} fmt --all --check
+    cargo fmt --manifest-path crown/Cargo.toml --check
 
-# Run clippy lints.
+# Run clippy lints, failing on any warning. ARGS go to the runtime workspace's `cargo clippy`.
 clippy *ARGS:
-    cargo clippy --features debugmozjs --all-targets {{ARGS}}
+    cargo clippy --features debugmozjs --all-targets {{ARGS}} -- -D warnings
+    {{_componentize}} clippy --workspace --all-targets -- -D warnings
+
+# Run clippy lints for the wasm target (`WASM_TARGET`), failing on any warning. ARGS go to
+# `cargo clippy`.
+clippy-wasm *ARGS:
+    {{_wasm_cargo}} clippy --target {{WASM_TARGET}} --features debugmozjs --workspace \
+        --lib --bins --tests --examples {{ARGS}} -- -D warnings
 
+# Without arguments, it runs the quick zeal modes over `js`, `core-runtime`, `wit-bridge` and
+# the builtin crates. `scripts/test-gc-zeal.sh` documents the arguments.
+#
 # Run GC zeal stress tests.
-# Defaults to quick tests on the `js` and `core-runtime` packages.
-# See `./scripts/test-gc-zeal.sh` for usage info.
 gc-zeal *ARGS:
     ./scripts/test-gc-zeal.sh {{ARGS}}
 
+# It checks every workspace library and example natively, then the runtime and its dependencies
+# for wasm32-wasip2, which includes the code only wasm builds compile. Then it runs crown's own
+# tests.
+#
 # Run crown static GC analysis.
 check-gc:
-    ./scripts/check-crown.sh --workspace --all --examples
+    ./scripts/check-crown.sh --workspace --lib --examples
+    ./scripts/check-crown.sh -p starlingmonkey --target wasm32-wasip2
+    cd crown && RUSTC_BOOTSTRAP=1 cargo test
 
-# Run basic checks: formatting, clippy, tests.
+# Run basic checks: formatting, clippy, tests, and the componentizer's unit tests.
 check:
     just fmt-check --all
     just clippy --all
     just test --examples
+    just test-componentize-unit
 
 # Run most checks: `check` + `check-gc` + `gc-zeal`.
 check-all:
@@ -125,10 +141,10 @@ check-all:
     just check-gc
     just gc-zeal
 
-# Run basic checks: formatting, clippy, tests.
+# Run basic checks: formatting, clippy, and the tests on the wasm target.
 check-wasm:
     just fmt-check --all
-    just clippy --all
+    just clippy-wasm
     just test-wasm --examples
 
 # Build for the wasm target (`WASM_TARGET`, default wasm32-wasip2).
@@ -139,14 +155,17 @@ build-wasm *TARGET:
 build-wasm-release *TARGET:
     {{_wasm_cargo}} build --target {{WASM_TARGET}} --release {{TARGET}}
 
-# Run all Rust tests. A run with no arguments also runs the wasm serve end-to-end suite;
-# arguments (a filter, `--examples`) reach only the cargo tests and leave that suite out.
+# A run with no arguments also runs the wasm serve end-to-end suite. Arguments (a filter,
+# `--examples`) reach only the cargo tests and leave that suite out.
+#
+# Run all Rust tests on the wasm target.
 test-wasm *TARGET:
     {{_wasm_cargo}} test --target {{WASM_TARGET}} --features debugmozjs --workspace {{TARGET}}
     @{{ if TARGET == "" { "just test-serve-wasm" } else { "echo 'Skipped the wasm serve end-to-end suite; run it with: just test-serve-wasm'" } }}
 
-# Run all Rust tests in the `test-release` profile: release optimizations without LTO. A run with
-# no arguments also runs the wasm serve end-to-end suite against the full release build.
+# A run with no arguments also runs the wasm serve end-to-end suite against the release build.
+#
+# Run all Rust tests on the wasm target in the `test-release` profile.
 test-wasm-release *TARGET:
     {{_wasm_cargo}} test --target {{WASM_TARGET}} --profile test-release --workspace {{TARGET}}
     @{{ if TARGET == "" { "just test-serve-wasm-release" } else { "echo 'Skipped the wasm serve end-to-end suite; run it with: just test-serve-wasm-release'" } }}
@@ -155,10 +174,10 @@ test-wasm-release *TARGET:
 test-wizer *ARGS:
     ./scripts/test-wizer.sh {{ARGS}}
 
-# Serve the component under `wasmtime serve` and assert the same observables the native serve
-# suite does, plus the behaviors only a real `wasi:http` host exercises. Builds the component
-# first, so the suite never tests a stale one. Needs wasmtime on PATH; without it the suite
-# skips loudly.
+# The recipe builds the component first. The suite runs it with the wasmtime on PATH, and is
+# skipped if there is none.
+#
+# Run the serve end-to-end suite against the component under `wasmtime serve`.
 test-serve-wasm *ARGS:
     @just build-wasm -p starlingmonkey
     STARLING_WASM_COMPONENT="{{_wasm_out}}/debug/starling.wasm" \
@@ -188,32 +207,123 @@ wpt-update-wasm *PATTERN:
     @just build-wasm
     node tests/wpt-harness/run-wpt.mjs --target=wasm --runtime="{{_wasm_out}}/debug/starling.wasm" --update-expectations {{PATTERN}}
 
-# Run WPT tests through a serve-mode runtime: each test runs inside a `fetch` handler rather than
-# as a one-shot command, which is the shape a deployed server has. Same binary as the command-mode
-# recipes above — the component exports `wasi:cli/run` and `wasi:http/handler` both.
+# Each test runs inside a `fetch` handler rather than as a one-shot command. The server runs each
+# request in its own global (`--serve-isolated`) and one at a time, so tests can't collide through
+# shared global state.
 #
-# The native server runs each request in its own global (`--serve-isolated`) and one at a time, so
-# tests can't collide through shared global state. The wasm server asks its host for the same
-# property with `--max-instance-reuse-count 1`, which it has to: a WASIp3 host reuses an instance
-# for many requests by default.
+# Run WPT tests through a native serve-mode runtime.
 [group('wpt')]
 wpt-test-serve *PATTERN:
     @just build
     node tests/wpt-harness/run-wpt.mjs --mode=serve {{PATTERN}}
 
+# Each test runs inside a `fetch` handler of a Wizer snapshot. The harness passes
+# `--max-instance-reuse-count 1` to `wasmtime serve`, since a WASIp3 host reuses an instance for
+# many requests by default. Drop `--wizen` to skip the snapshot step.
+#
 # Run WPT tests against the wasm binary through a serve-mode runtime, pre-initialized with Wizer.
-# This is the configuration a deployed server has: inside a request handler, against a snapshot
-# whose engine and content script are already stood up. Drop `--wizen` to skip the snapshot step.
 [group('wpt')]
 wpt-test-wasm-serve *PATTERN:
     @just build-wasm
     node tests/wpt-harness/run-wpt.mjs --target=wasm --runtime="{{_wasm_out}}/debug/starling.wasm" --mode=serve --wizen {{PATTERN}}
 
-# Run WPT across every configuration: both targets, each as a command and as a server, from one
-# build per target.
+# Run WPT across every configuration: both targets, each as a command and as a server.
 [group('wpt')]
 wpt-test-all *PATTERN:
     @just wpt-test {{PATTERN}}
     @just wpt-test-wasm {{PATTERN}}
     @just wpt-test-wasm-serve {{PATTERN}}
     @just wpt-test-serve {{PATTERN}}
+
+# Build the runtime component (starling.wasm) that releases ship, in release mode.
+build-runtime:
+    ./scripts/build-runtime.sh
+
+# The componentize suites and `test-runtime` run against this build.
+#
+# Build the runtime component (starling.wasm) in debug mode, with `debugmozjs`.
+build-runtime-debug:
+    ./scripts/build-runtime.sh --debug
+
+# Build the release runtime, then install `starling-componentize` with it embedded.
+install-componentize:
+    ./scripts/build-runtime.sh
+    export STARLING_EMBED_RUNTIME="{{_runtime_out}}/release/starling.wasm" && \
+        {{_componentize}} install --path . --locked
+
+# The componentizer is built from this checkout, and embeds the wasm32-wasip3 runtime
+# `just build-runtime` writes, or none if there is no such build. ARGS are passed through
+# unchanged, and it runs in the directory `just` was invoked from, so relative paths in them
+# resolve there. For example:
+#
+#   just componentize --export-http componentize app.js -o app.wasm
+#   just componentize -w wit -n app types -o app.d.ts
+#
+# Run `starling-componentize` with ARGS.
+[no-cd]
+[positional-arguments]
+componentize *ARGS:
+    @{{_componentize}} build -q --bin starling-componentize
+    @"{{_target}}/debug/starling-componentize" "$@"
+
+# The packages are the one that resolves the binary and the one for this platform, which holds a
+# release build with the release runtime embedded. `componentize/npm/package.mjs` documents the
+# layout, and `.github/workflows/release.yml` builds and publishes every platform's packages.
+# VERSION defaults to the workspace's version, in `Cargo.toml`. The packages' tarballs go to
+# `target/npm/tarballs`.
+#
+# Assemble the npm packages of `starling-componentize` for this platform in `target/npm`.
+npm-componentize VERSION="":
+    ./scripts/build-runtime.sh
+    export STARLING_EMBED_RUNTIME="{{_runtime_out}}/release/starling.wasm" && \
+        {{_componentize}} build --release --locked --bin starling-componentize
+    rm -rf "{{_target}}/npm"
+    node componentize/npm/package.mjs {{ if VERSION == "" { "" } else { "--version " + VERSION } }} \
+        --out "{{_target}}/npm" --pack "{{_target}}/npm/tarballs" \
+        "$(node -p 'process.platform + "-" + process.arch')={{_target}}/release/starling-componentize"
+
+# End-to-end test of the debug runtime component (build, run scripts under wasmtime).
+test-runtime:
+    ./scripts/test-runtime.sh
+
+# Each suite is a test target in `componentize/tests/`, and each file's head comment describes
+# what it covers. `componentize` is a workspace of its own (see its `Cargo.toml`), so its recipes
+# run cargo from its directory rather than with `-p`. ARGS go to `test-componentize-only`.
+#
+# Build the debug runtime, then run every componentization suite against it.
+test-componentize *ARGS:
+    just build-runtime-debug
+    just test-componentize-only {{ARGS}}
+
+# The suites use the runtime build STARLING_RUNTIME names, by default the one
+# `just build-runtime-debug` writes, and this recipe never rebuilds it, so editing a test rebuilds
+# neither the runtime nor SpiderMonkey. A missing runtime build fails the suites with its path.
+# ARGS go to libtest, so `just test-componentize-only echo_stream` runs only the matching tests
+# and componentizes only the `streams` world. `scripts/test-componentize.sh` runs several suites
+# at a time and describes how many.
+#
+# Run the componentization suites against a prebuilt runtime (no runtime build).
+test-componentize-only *ARGS:
+    export STARLING_RUNTIME="${STARLING_RUNTIME:-{{_runtime_out}}/debug/starling.wasm}" && \
+        ./scripts/test-componentize.sh --nocapture {{ARGS}}
+
+# Run the unit tests of the componentizer's workspace. They need no runtime build.
+test-componentize-unit:
+    {{_componentize}} test --workspace --lib
+
+# For a world exporting `wasi:http/handler`, the interface's declarations come from the runtime
+# build STARLING_RUNTIME names, or else from the one the componentizer embeds.
+#
+#   just ts-bindings <wit-path> [<world>]   # print the .d.ts to stdout
+#   just ts-bindings --export-cli           # the built-in cli/run world
+#   just ts-bindings --export-http          # the built-in serve world
+#   just ts-bindings componentize/tests/wit_to_ts/primitives.wit primitives
+#
+# Omitting <world> selects the only world of the last package the WIT path loads.
+#
+# Print the TypeScript declaration (`.d.ts`) of the guest JS module a WIT world expects.
+[no-cd]
+ts-bindings WIT WORLD="":
+    @just --justfile "{{justfile()}}" componentize \
+        {{ if WIT == "--export-cli" { "--export-cli" } else if WIT == "--export-http" { "--export-http" } else { "-w '" + WIT + "'" + if WORLD == "" { "" } else { " -n '" + WORLD + "'" } } }} \
+        types
diff --git a/package-lock.json b/package-lock.json
new file mode 100644
index 00000000..a071d355
--- /dev/null
+++ b/package-lock.json
@@ -0,0 +1,27 @@
+{
+  "name": "starling-ng-dev",
+  "lockfileVersion": 3,
+  "requires": true,
+  "packages": {
+    "": {
+      "name": "starling-ng-dev",
+      "devDependencies": {
+        "typescript": "5.9.3"
+      }
+    },
+    "node_modules/typescript": {
+      "version": "5.9.3",
+      "resolved": "https://registry.npmjs.org/typescript/-/typescript-5.9.3.tgz",
+      "integrity": "sha512-jl1vZzPDinLr9eUt3J/t7V6FgNEw9QjvBPdysz9KfQDD41fQrC2Y4vKQdiaUpFT4bXlb1RHhLpp8wtm6M5TgSw==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "bin": {
+        "tsc": "bin/tsc",
+        "tsserver": "bin/tsserver"
+      },
+      "engines": {
+        "node": ">=14.17"
+      }
+    }
+  }
+}
diff --git a/package.json b/package.json
new file mode 100644
index 00000000..03243103
--- /dev/null
+++ b/package.json
@@ -0,0 +1,8 @@
+{
+  "name": "starling-ng-dev",
+  "private": true,
+  "description": "Development-only TypeScript compiler, which the `wit_to_ts` tests of `componentize` run to type-check the generated .d.ts files, a consumer that imports from them, and the suites' guests.",
+  "devDependencies": {
+    "typescript": "5.9.3"
+  }
+}
diff --git a/rust-toolchain.toml b/rust-toolchain.toml
index 0a005a38..210d0a7b 100644
--- a/rust-toolchain.toml
+++ b/rust-toolchain.toml
@@ -3,9 +3,9 @@ channel = "1.98"
 
 components = [
     "clippy",
-    # For support/crown
+    # For crown
     "llvm-tools",
-    # For support/crown
+    # For crown
     "rustc-dev",
     # For formatting
     "rustfmt",
diff --git a/scripts/build-runtime.sh b/scripts/build-runtime.sh
new file mode 100755
index 00000000..78b30420
--- /dev/null
+++ b/scripts/build-runtime.sh
@@ -0,0 +1,84 @@
+#!/usr/bin/env bash
+# SPDX-License-Identifier: Apache-2.0-WITH-LLVM-exception
+#
+# Build starling.wasm: the StarlingMonkey runtime as a component, with
+# SpiderMonkey, libc and libc++ statically linked in and dead-code eliminated. It
+# runs under `wasmtime run` and `wasmtime serve`, and `starling-componentize`
+# links wit-dylib bindings against its core module. Requires `wasm-tools` on PATH.
+#
+# Usage:
+#   ./scripts/build-runtime.sh          # the release runtime, which releases ship
+#   ./scripts/build-runtime.sh --debug  # a debug build with `debugmozjs`, for the tests
+#
+# The release runtime goes to `target/<target>/release/starling.wasm`, and the debug one to
+# `target/<target>/debug/starling.wasm`. `RUNTIME_TARGET` picks the wasm target: `p2`, `p3`, or
+# a full triple. Defaults to wasm32-wasip3.
+set -euo pipefail
+
+cd "$(dirname "$0")/.."
+. scripts/wasm-target.sh
+
+case "${1:-}" in
+    "") PROFILE=release; PROFILE_ARGS=(--release) ;;
+    --debug) PROFILE=debug; PROFILE_ARGS=(--features debugmozjs) ;;
+    *) echo "usage: $0 [--debug]" >&2; exit 1 ;;
+esac
+
+TARGET="$(wasm_target "${RUNTIME_TARGET:-p3}")"
+read -r -a CARGO <<<"$(wasm_cargo "$TARGET")"
+
+# SpiderMonkey compiles against the WASI SDK sysroot for the target, and `starling/build.rs`
+# inspects its libc. A sysroot for wasm32-wasip3 first ships in wasi-sdk 34, and a build against
+# an older SDK fails deep in the C++ compile, so it is checked here instead.
+export WASI_SDK_PATH="${WASI_SDK_PATH:-/opt/wasi-sdk}"
+if [ "$TARGET" = wasm32-wasip3 ] && [ ! -d "$WASI_SDK_PATH/share/wasi-sysroot/lib/wasm32-wasip3" ]; then
+    echo "wasi-sdk 34+ required for $TARGET: no wasm32-wasip3 sysroot under WASI_SDK_PATH=$WASI_SDK_PATH" >&2
+    echo "Point WASI_SDK_PATH at a wasi-sdk 34 or later, or build for p2 with RUNTIME_TARGET=p2." >&2
+    exit 1
+fi
+
+OUT="$(runtime_path "$TARGET" "$PROFILE")"
+
+# The `starlingmonkey` package's library is the runtime. Its `build.rs` adds the link arguments
+# the componentizer needs: an exported, growable function table, and on wasm32-wasip2 the exported
+# shadow stack pointer, which the wit-dylib bindings module imports from the runtime's core
+# module.
+#
+# `--skip-wit-component` makes the link produce the core module, whose `component-type` sections
+# `preserve-component-type` copies before `wasm-tools component new` turns it into the
+# component. `starling-componentize` links against the complete worlds in those copies.
+"${CARGO[@]}" rustc \
+    -p starlingmonkey \
+    --lib \
+    --target "$TARGET" \
+    "${PROFILE_ARGS[@]}" \
+    -- -C link-arg=--skip-wit-component
+
+# The wasm header's version field: 1 for a core module, 0x1000d for a component.
+wasm_version() {
+    od -An -tx1 -j4 -N4 "$1" | tr -d ' \n'
+}
+
+case "$(wasm_version "$OUT")" in
+    01000000)
+        cp "$OUT" "$OUT.tmp"
+        TMP="$(cd "$(dirname "$OUT")" && pwd)/$(basename "$OUT").tmp"
+        (cd componentize && cargo run -q -p preserve-component-type -- "$TMP")
+        wasm-tools component new "$OUT.tmp" -o "$OUT.tmp"
+        mv "$OUT.tmp" "$OUT"
+        ;;
+    0d000100)
+        # cargo did not relink, so this is the component an earlier run produced, unless a plain
+        # `cargo build` of the same profile replaced it.
+        if ! grep -q 'custom "starling:component-type' <<<"$(wasm-tools objdump "$OUT")"; then
+            echo "$OUT is a component without the preserved worlds: remove it and rerun" >&2
+            exit 1
+        fi
+        ;;
+    *)
+        echo "$OUT is not a wasm module or component" >&2
+        exit 1
+        ;;
+esac
+
+echo "built $OUT ($(du -h "$OUT" | cut -f1))"
diff --git a/scripts/check-crown.sh b/scripts/check-crown.sh
index 37bb9b78..8fd0a48d 100755
--- a/scripts/check-crown.sh
+++ b/scripts/check-crown.sh
@@ -2,31 +2,24 @@
 #
 # Run the crown GC rooting linter on the workspace.
 #
-# Crown is a rustc compiler plugin that statically verifies GC rooting
-# safety — ensuring that GC pointers are always stored in traced containers.
-#
-# This script:
-#   1. Builds the crown binary (from crown/) with rpath baked in
-#   2. Runs `cargo check` with RUSTC_WRAPPER=crown and --features "js/crown"
-#
-# The `crown` Cargo feature propagates through the workspace:
-#   starling → libstarling → core-runtime → js → mozjs → mozjs_sys
-# enabling the `#[must_root]` / `#[allow_unrooted_interior]` annotations
-# on GC-related types.
+# Crown is a rustc compiler plugin that checks that GC pointers are stored in traced containers.
+# This script builds crown from `crown/` and runs `cargo check` with crown as `RUSTC_WRAPPER` and
+# the `js/crown` feature. That feature enables the crown annotations on mozjs's GC types.
 #
 # Usage:
 #   ./scripts/check-crown.sh                # Check the default workspace member (starling)
 #   ./scripts/check-crown.sh -p core-runtime # Check a specific package
 #   ./scripts/check-crown.sh --workspace     # Check the entire workspace
+#   ./scripts/check-crown.sh -p starlingmonkey --target wasm32-wasip2  # Check the wasm-only code
 set -euo pipefail
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 ROOT_DIR="$(cd "$SCRIPT_DIR/.." && pwd)"
 
-# All crown operations run from the crown/ directory so cargo picks up
-# crown/rust-toolchain.toml (which may differ from the workspace toolchain).
+# Crown is built, and its sysroot found, from the crown/ directory so cargo
+# picks up crown/rust-toolchain.toml.
 CROWN_DIR="$ROOT_DIR/crown"
-CROWN_BIN="$CROWN_DIR/target/release/crown"
+CROWN_BIN="${CARGO_TARGET_DIR:-$CROWN_DIR/target}/release/crown"
 CROWN_SYSROOT="$(cd "$CROWN_DIR" && rustc --print sysroot)"
 CROWN_LIB="$CROWN_SYSROOT/lib"
 
diff --git a/scripts/check-init-wit.sh b/scripts/check-init-wit.sh
new file mode 100755
index 00000000..38fc2014
--- /dev/null
+++ b/scripts/check-init-wit.sh
@@ -0,0 +1,69 @@
+#!/usr/bin/env bash
+# SPDX-License-Identifier: Apache-2.0-WITH-LLVM-exception
+#
+# Fail if `starling/wit/init.wit` changed since a release without a version of its package that
+# is not compatible with the release's. `starling-componentize` accepts a runtime whose version of
+# the `init` interface has the same canonical version as its own, so a change to the interface
+# needs a different canonical version. Doc comments are ignored.
+#
+# Usage: scripts/check-init-wit.sh [<revision>]
+#
+# The revision defaults to the latest release tag (`v*`) reachable from HEAD. Without one, there is
+# nothing to compare with, and the check passes. Needs `wasm-tools` on PATH.
+set -euo pipefail
+
+file=starling/wit/init.wit
+base=${1:-}
+if [ -z "$base" ]; then
+    if ! base=$(git describe --tags --abbrev=0 --match 'v[0-9]*' HEAD 2>/dev/null); then
+        echo "No release tag is reachable from HEAD, so there is nothing to compare $file with."
+        exit 0
+    fi
+fi
+
+tmp=$(mktemp -d)
+trap 'rm -rf "$tmp"' EXIT
+if ! git show "$base:$file" > "$tmp/base.wit" 2>/dev/null; then
+    echo "$base has no $file, so there is nothing to compare it with."
+    exit 0
+fi
+wasm-tools component wit --no-docs "$tmp/base.wit" > "$tmp/base.txt"
+wasm-tools component wit --no-docs "$file" > "$tmp/current.txt"
+
+# The package's version, from its `package name@version;` line.
+version() {
+    sed -n 's/^package [^@;]*@\([^;]*\);$/\1/p' "$1"
+}
+# The canonical version of a version, which the componentizer compares: the major number from
+# `1.0.0` on, `0.` and the minor number for a `0.x` version whose minor number isn't 0, and the
+# version without its build metadata for a `0.0.x` version or a pre-release.
+canonical() {
+    local version=${1%%+*}
+    local major=${version%%.*} minor
+    minor=${version#*.}
+    minor=${minor%%.*}
+    if [[ $version == *-* ]]; then
+        echo "$version"
+    elif [[ $major != 0 ]]; then
+        echo "$major"
+    elif [[ $minor != 0 ]]; then
+        echo "0.$minor"
+    else
+        echo "$version"
+    fi
+}
+
+old=$(version "$tmp/base.txt")
+new=$(version "$tmp/current.txt")
+if diff -q <(grep -v '^package ' "$tmp/base.txt") <(grep -v '^package ' "$tmp/current.txt") \
+    > /dev/null; then
+    echo "$file is unchanged since $base, apart from doc comments and its version."
+    exit 0
+fi
+if [ -n "$old" ] && [ "$(canonical "$old")" = "$(canonical "$new")" ]; then
+    echo "$file changed since $base, but its version, $new, has the canonical version" \
+        "$(canonical "$new") of $old there. Give it a version with a different canonical version." >&2
+    diff -u --label "$base" --label "HEAD" "$tmp/base.txt" "$tmp/current.txt" >&2 || true
+    exit 1
+fi
+echo "$file changed since $base, and its version went from ${old:-none} to $new."
diff --git a/scripts/test-componentize.sh b/scripts/test-componentize.sh
new file mode 100755
index 00000000..de8302bd
--- /dev/null
+++ b/scripts/test-componentize.sh
@@ -0,0 +1,100 @@
+#!/usr/bin/env bash
+# SPDX-License-Identifier: Apache-2.0-WITH-LLVM-exception
+#
+# Run the componentization suites of `componentize/tests/`, several test binaries at a time.
+#
+# The script builds every test binary first, then runs `COMPONENTIZE_JOBS` of them at a time. The
+# default is one per 8 GiB of memory, at least one and at most one per CPU. `serve` and
+# `top_level`, which take longest, start first. Each binary runs `RUST_TEST_THREADS` tests at a
+# time, by default twice the number of CPUs divided by the number of jobs, but at most one per GiB
+# of memory divided by the number of jobs, and at least one.
+#
+# Each binary's output goes to a log file. Once the binary exits, the script prints its
+# `test result:` line if it passed, and the whole log if it failed. A binary that exits without a
+# `test result:` line failed too. The script fails if any binary did.
+#
+# The suites use the runtime build `STARLING_RUNTIME` names. The arguments go to every test
+# binary, so `./scripts/test-componentize.sh echo_stream` runs only the matching tests. Needs `jq`
+# on PATH.
+#
+# Usage:
+#   ./scripts/test-componentize.sh [<libtest argument>...]
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+cd "$SCRIPT_DIR/../componentize"
+
+cpus=$(getconf _NPROCESSORS_ONLN)
+if [[ -r /proc/meminfo ]]; then
+    memory_kib=$(awk '/^MemTotal:/ { print $2 }' /proc/meminfo)
+else
+    memory_kib=$(( $(sysctl -n hw.memsize) / 1024 ))
+fi
+jobs=$(( memory_kib / (8 * 1024 * 1024) ))
+(( jobs > cpus )) && jobs=$cpus
+(( jobs < 1 )) && jobs=1
+jobs=${COMPONENTIZE_JOBS:-$jobs}
+threads=$(( 2 * cpus / jobs ))
+memory_threads=$(( memory_kib / (1024 * 1024) / jobs ))
+(( threads > memory_threads )) && threads=$memory_threads
+(( threads < 1 )) && threads=1
+export RUST_TEST_THREADS=${RUST_TEST_THREADS:-$threads}
+
+echo "=== Building the componentization suites"
+binaries=$(cargo test --tests --no-run --message-format=json-render-diagnostics |
+    jq -r 'select(.reason == "compiler-artifact" and .profile.test and .executable != null)
+        | .executable')
+
+# The binaries, `serve` and `top_level` first. A binary's name is its file name without the hash
+# cargo appends.
+ordered=$(printf '%s\n' "$binaries" | awk '{
+    name = $0
+    sub(/.*\//, "", name)
+    sub(/-[0-9a-f]+$/, "", name)
+    print (name == "serve" || name == "top_level" ? 0 : 1) "\t" $0
+}' | sort -s -k1,1 | cut -f2-)
+if [[ -z "$ordered" ]]; then
+    echo "The build produced no test binaries." >&2
+    exit 1
+fi
+count=$(printf '%s\n' "$ordered" | wc -l | tr -d ' ')
+
+LOGS=$(mktemp -d)
+trap 'rm -rf "$LOGS"' EXIT
+export LOGS
+
+# Run the test binary `$1` with the remaining arguments, logging to `$LOGS/<name>.log`. Prints
+# the binary's `test result:` line if it passed, and its log otherwise, in which case it creates
+# `$LOGS/<name>.failed`.
+run_binary() {
+    local binary=$1
+    shift
+    local name
+    name=$(basename "$binary" | sed -E 's/-[0-9a-f]+$//')
+    local log="$LOGS/$name.log"
+    if "$binary" "$@" > "$log" 2>&1 && grep -q '^test result: ' "$log"; then
+        echo "$name: $(grep '^test result: ' "$log" | tail -n 1)"
+    else
+        touch "$LOGS/$name.failed"
+        echo "=== $name failed"
+        cat "$log"
+        echo "=== end of $name"
+    fi
+}
+export -f run_binary
+
+echo "=== Running $count test binaries, $jobs at a time, $RUST_TEST_THREADS tests each"
+# xargs appends the binary after the libtest arguments, and the inner shell moves it to the front.
+# shellcheck disable=SC2016
+printf '%s\n' "$ordered" | tr '\n' '\0' |
+    xargs -0 -n 1 -P "$jobs" bash -c 'run_binary "${@: -1}" "${@:1:$#-1}"' _ "$@"
+
+failed=""
+for marker in "$LOGS"/*.failed; do
+    [[ -e "$marker" ]] && failed="$failed $(basename "$marker" .failed)"
+done
+if [[ -n "$failed" ]]; then
+    echo "Failed test binaries: $failed" >&2
+    exit 1
+fi
+echo "All $count test binaries passed."
diff --git a/scripts/test-gc-zeal.sh b/scripts/test-gc-zeal.sh
index 1623b7fd..2587097f 100755
--- a/scripts/test-gc-zeal.sh
+++ b/scripts/test-gc-zeal.sh
@@ -4,25 +4,17 @@
 #
 # SpiderMonkey's GC zeal is controlled by the JS_GC_ZEAL environment variable:
 #   JS_GC_ZEAL="mode,frequency" or "mode1;mode2,frequency"
-# This script sets that env var as follows.
 #
-# Productive zeal modes:
-#   1  - GC on roots change
-#   2  - GC on every N-th allocation (most aggressive)
-#   4  - Verify pre-barriers
-#   5  - Verify post-barriers
-#   7  - Generational GC stress
-#  10  - Incremental GC (multiple slices)
-#  14  - Compact on every GC
-#  15  - Check heap after GC
-#  18  - Check gray marking
+# Without package arguments, the tests of `js`, `core-runtime`, `wit-bridge` and the builtin
+# crates run. `libstarling` is left out: its serve tests have wall-clock timeouts that GC zeal
+# exceeds.
 #
 # Usage:
-#   ./scripts/test-gc-zeal.sh                             # Defaults: quick zeal, js and core-runtime tests
-#   ./scripts/test-gc-zeal.sh quick -p js -p core-runtime # Same as above
-#   ./scripts/test-gc-zeal.sh full                        # Full set of zeal modes, quite slow indeed
-#   ./scripts/test-gc-zeal.sh "2,1"                       # Specific zeal setting
-#   ./scripts/test-gc-zeal.sh full --workspace --examples # All the modes, all the tests, none of the quickness
+#   ./scripts/test-gc-zeal.sh                     # Quick zeal modes, the default packages
+#   ./scripts/test-gc-zeal.sh full                # Full set of zeal modes, quite slow indeed
+#   ./scripts/test-gc-zeal.sh full --shard 2/3    # Every third mode of the full set, from the second
+#   ./scripts/test-gc-zeal.sh "2,1"               # Specific zeal setting
+#   ./scripts/test-gc-zeal.sh quick -p js         # Quick zeal modes, the `js` tests only
 set -euo pipefail
 
 # Zeal configurations, ordered from fastest to slowest.
@@ -50,6 +42,7 @@ FULL_CONFIGS=(
 # to `cargo test`. The mode is recognized as `--zeal <mode>`, as a bare
 # `quick`/`full`, or as a bare JS_GC_ZEAL string such as "2,1" or "1;2;4,1".
 MODE="quick"
+SHARD=""
 CARGO_ARGS=()
 
 # A zeal string is `mode[;mode...],frequency`. Cargo test filters and flags
@@ -58,6 +51,10 @@ ZEAL_RE='^[0-9]+(;[0-9]+)*,[0-9]+$'
 
 while [[ $# -gt 0 ]]; do
     case "$1" in
+        --shard)
+            SHARD="${2:?--shard requires a value such as 1/3}"
+            shift 2
+            ;;
         --zeal)
             MODE="${2:?--zeal requires a value (quick, full, or a JS_GC_ZEAL string)}"
             shift 2
@@ -77,7 +74,7 @@ while [[ $# -gt 0 ]]; do
     esac
 done
 
-# Select the js and core-runtime packages unless the caller selected packages
+# Select the default packages (see the top of this file) unless the caller selected packages
 # themselves.
 PACKAGE_SELECTED=false
 for arg in ${CARGO_ARGS[@]+"${CARGO_ARGS[@]}"}; do
@@ -90,7 +87,11 @@ for arg in ${CARGO_ARGS[@]+"${CARGO_ARGS[@]}"}; do
 done
 
 if [[ "$PACKAGE_SELECTED" == false ]]; then
-    CARGO_ARGS=(-p js -p core-runtime ${CARGO_ARGS[@]+"${CARGO_ARGS[@]}"})
+    CARGO_ARGS=(
+        -p js -p core-runtime -p wit-bridge
+        -p cpp-builtins -p fetch-event -p web-fetch -p web-globals -p web-streams -p web-url
+        ${CARGO_ARGS[@]+"${CARGO_ARGS[@]}"}
+    )
 fi
 
 # Ensure debugmozjs is enabled for GC zeal testing
@@ -109,17 +110,32 @@ else
     CONFIGS=("$MODE")
 fi
 
+# `--shard I/N` keeps every Nth configuration, starting with the Ith.
+if [[ -n "$SHARD" ]]; then
+    if [[ ! "$SHARD" =~ ^([0-9]+)/([0-9]+)$ ]] ||
+        (( BASH_REMATCH[1] < 1 || BASH_REMATCH[1] > BASH_REMATCH[2] )); then
+        echo "--shard takes I/N with 1 <= I <= N, got '$SHARD'" >&2
+        exit 2
+    fi
+    SHARD_INDEX=${BASH_REMATCH[1]}
+    SHARD_COUNT=${BASH_REMATCH[2]}
+    SHARD_CONFIGS=()
+    for i in "${!CONFIGS[@]}"; do
+        if (( i % SHARD_COUNT == SHARD_INDEX - 1 )); then
+            SHARD_CONFIGS+=("${CONFIGS[$i]}")
+        fi
+    done
+    CONFIGS=(${SHARD_CONFIGS[@]+"${SHARD_CONFIGS[@]}"})
+fi
+
 echo "Running tests with ${#CONFIGS[@]} GC zeal configuration(s)..."
 echo "  cargo test ${CARGO_ARGS[*]}"
 echo ""
 
 for zeal in "${CONFIGS[@]}"; do
-    # printf "  JS_GC_ZEAL=%-25s " "\"$zeal\""
     if JS_GC_ZEAL="$zeal" cargo test "${CARGO_ARGS[@]}"; then
-        # echo "✓ pass"
         PASSED=$((PASSED + 1))
     else
-        # echo "✗ FAIL"
         FAILED=$((FAILED + 1))
         FAILURES+=("$zeal")
     fi
diff --git a/scripts/test-runtime.sh b/scripts/test-runtime.sh
new file mode 100755
index 00000000..746964eb
--- /dev/null
+++ b/scripts/test-runtime.sh
@@ -0,0 +1,49 @@
+#!/usr/bin/env bash
+# SPDX-License-Identifier: Apache-2.0-WITH-LLVM-exception
+#
+# End-to-end test of the runtime component: build the debug starling.wasm and run JS scripts with
+# it under wasmtime: a hello-world that logs before and after a timer, and a top level that
+# rejects after a timer, which fails the run. `RUNTIME_TARGET` picks the target, as for
+# `scripts/build-runtime.sh`.
+set -euo pipefail
+
+cd "$(dirname "$0")/.."
+. scripts/wasm-target.sh
+
+./scripts/build-runtime.sh --debug
+RUNTIME="$(runtime_path "$(wasm_target "${RUNTIME_TARGET:-p3}")" debug)"
+RUNTIME="$(cd "$(dirname "$RUNTIME")" && pwd)/$(basename "$RUNTIME")"
+
+WORK="$(mktemp -d)"
+trap 'rm -rf "$WORK"' EXIT
+cd "$WORK"
+
+cat >hello.js <<'JS'
+console.log("hello from JS");
+setTimeout(() => {
+  console.log("timer fired");
+}, 10);
+JS
+
+cat >late_rejection.js <<'JS'
+await new Promise((resolve) => setTimeout(resolve, 10));
+throw new Error("late top-level failure");
+JS
+
+run_script() {
+    wasmtime run --dir=.::/cwd --dir=. -Shttp=y "$RUNTIME" "$@"
+}
+
+output=$(run_script hello.js)
+echo "$output"
+[[ "$output" == *"hello from JS"* ]] || { echo "FAIL: missing console output"; exit 1; }
+[[ "$output" == *"timer fired"* ]] || { echo "FAIL: missing timer output"; exit 1; }
+[[ "$output" == *"hello from JS"*"timer fired"* ]] || { echo "FAIL: console/timer output out of order"; exit 1; }
+
+if errors=$(run_script late_rejection.js 2>&1 >/dev/null); then
+    echo "FAIL: a late top-level rejection must fail the run"; exit 1
+fi
+echo "$errors"
+[[ "$errors" == *"late top-level failure"* ]] || { echo "FAIL: missing rejection message"; exit 1; }
+
+echo "runtime e2e OK"
diff --git a/scripts/test-wizer.sh b/scripts/test-wizer.sh
index 9f84b9d5..ecc33a32 100755
--- a/scripts/test-wizer.sh
+++ b/scripts/test-wizer.sh
@@ -3,9 +3,7 @@
 # Test the Wizer pre-initialization path end to end.
 #
 # The component exports `wizer-initialize`, which `wasmtime wizer` runs before snapshotting the
-# instance's state. That path has no unit-test seam: it only exists as a component export, run by
-# an external tool, and what it produces is only meaningfully checked by serving it. So this
-# builds the component, snapshots it, and serves the snapshot.
+# instance's state. This script builds the component, snapshots it, and serves the snapshot.
 #
 # Usage:
 #   ./scripts/test-wizer.sh            # build the component, then run every case
@@ -18,18 +16,10 @@
 set -euo pipefail
 
 cd "$(dirname "$0")/.."
+. scripts/wasm-target.sh
 
-case "${WASM_TARGET:-p2}" in
-    p2) TARGET=wasm32-wasip2 ;;
-    p3) TARGET=wasm32-wasip3 ;;
-    *) TARGET="${WASM_TARGET}" ;;
-esac
-# The pinned toolchain ships no wasm32-wasip3 std.
-if [ "$TARGET" = wasm32-wasip3 ]; then
-    CARGO=(cargo "+${STARLING_NIGHTLY:-nightly}")
-else
-    CARGO=(cargo)
-fi
+TARGET="$(wasm_target "${WASM_TARGET:-p2}")"
+read -r -a CARGO <<<"$(wasm_cargo "$TARGET")"
 COMPONENT="${CARGO_TARGET_DIR:-target}/$TARGET/debug/starling.wasm"
 WASI_FLAGS=(-Scli=y,inherit-env=y,http=y)
 
@@ -67,24 +57,24 @@ check() {
 # Snapshot $2 (a config for STARLINGMONKEY_CONFIG) into $1. Prints wizer's own output; returns
 # wizer's exit status.
 #
-# `--keep-init-func` because dropping the init export — wizer's default — leaves the component
-# referring to a core export that is no longer there ("core instance N has no export named
-# `wizer-initialize`"), and the snapshot then fails to load at all.
+# `--keep-init-func` keeps the init export. Wizer drops it by default, which leaves the component
+# referring to a core export that no longer exists ("core instance N has no export named
+# `wizer-initialize`"), and the snapshot then fails to load.
 snapshot() {
     local out="$1" config="$2"
     wasmtime wizer --keep-init-func=true -o "$out" --dir=.::/cwd --dir=. "${WASI_FLAGS[@]}" \
         --env STARLINGMONKEY_CONFIG="$config" "$COMPONENT" 2>&1
 }
 
-# Serve $1 on a free-ish port and GET /; prints the response body, or a marker if it never came.
+# Serve $1 with config $2 on port $3 and GET /. Prints the response body, or a marker if none came.
 serve_and_get() {
-    local component="$1" config="$2" port="$3" path="${4:-/}"
+    local component="$1" config="$2" port="$3"
     STARLINGMONKEY_CONFIG="$config" wasmtime serve --dir=.::/cwd --dir=. "${WASI_FLAGS[@]}" \
         --addr "127.0.0.1:$port" "$component" >"serve-$port.log" 2>&1 &
     local server=$!
     local body="<no response>"
     for _ in $(seq 1 100); do
-        if body="$(curl -sf --max-time 5 "http://127.0.0.1:$port$path" 2>/dev/null)"; then
+        if body="$(curl -sf --max-time 5 "http://127.0.0.1:$port/" 2>/dev/null)"; then
             break
         fi
         body="<no response>"
@@ -97,8 +87,7 @@ serve_and_get() {
 
 echo "# wizer snapshots"
 
-# A snapshot has to produce a component that still loads. It did not always: dropping the init
-# export leaves a dangling reference, and the failure only shows when something tries to run it.
+# A snapshot has to produce a component that still loads.
 cat >handler.js <<'JS'
 addEventListener('fetch', (event) => event.respondWith(new Response('from-snapshot')));
 JS
@@ -123,12 +112,12 @@ await new Promise((resolve) => setTimeout(resolve, 50));
 addEventListener('fetch', (event) => event.respondWith(new Response('after-await')));
 JS
 snapshot snap-awaited.wasm "awaited.mjs" >/dev/null
-check "a top-level await is snapshotted rather than refused" \
+check "a top-level await finishes before the snapshot rather than being refused" \
     "after-await" \
     "$(serve_and_get snap-awaited.wasm "awaited.mjs" 18352)"
 
-# Evaluation having finished by snapshot time is what lets the gate judge this one at all: before,
-# a module that awaited first had registered nothing *yet* and had to be let through.
+# Evaluation has finished by snapshot time, so the gate also refuses a listener-less module that
+# awaits first.
 cat >awaited-no-listener.mjs <<'JS'
 await new Promise((resolve) => setTimeout(resolve, 50));
 globalThis.ready = true;
@@ -168,10 +157,10 @@ check "a snapshot taken after a top-level write can write again" \
     "logged" \
     "$(serve_and_get snap-stdio.wasm "stdio.mjs" 18354)"
 
-# Host I/O still running when evaluation ends is a handle belonging to the snapshotting process,
-# and the snapshot carries memory rather than handles — so it is refused rather than resumed into a
-# dangling reference. The upstream is this same component, answering with a promise that never
-# settles, which leaves the fetch genuinely in flight instead of failing fast.
+# Host I/O still running when evaluation ends uses a handle of the snapshotting process. A snapshot
+# holds memory but no handles, so the snapshot is refused. The upstream is this same component,
+# answering with a promise that never settles, which keeps the fetch in flight instead of failing
+# fast.
 cat >hang.js <<'JS'
 addEventListener('fetch', (event) => event.respondWith(new Promise(() => {})));
 JS
@@ -216,9 +205,9 @@ check "a resumed instance's performance.now() is rebased" \
     "startup=sane now=sane" \
     "$(serve_and_get snap-clock.wasm "--legacy-script clock.js" 18353)"
 
-# Post-`await` startup code is startup code: it runs in the snapshotting process, so it reads that
-# process's clock, and the resumed instance's own reading is rebased. Both are small numbers —
-# what must not happen is either of them carrying the other process's origin.
+# Startup code after an `await` runs in the snapshotting process and reads that process's clock,
+# and the resumed instance's own reading is rebased. Neither reading may use the other process's
+# time origin.
 cat >clock-awaited.mjs <<'JS'
 await new Promise((resolve) => setTimeout(resolve, 50));
 const afterAwait = performance.now();
@@ -233,6 +222,47 @@ check "post-await startup code reads a sane clock on both sides of a snapshot" \
     "afterAwait=sane now=sane" \
     "$(serve_and_get snap-clock-awaited.wasm "clock-awaited.mjs" 18355)"
 
+echo "# CLI tools"
+
+# A snapshot of a main module that exports `run` and registers no `fetch` listener is a CLI tool:
+# `wasi:cli/run` calls `run` in the resumed instance, whose top level ran once, under Wizer.
+cat >tool.mjs <<'JS'
+globalThis.evaluations = (globalThis.evaluations ?? 0) + 1;
+await new Promise((resolve) => setTimeout(resolve, 10));
+export async function run() {
+  await new Promise((resolve) => setTimeout(resolve, 10));
+  console.log('run called after ' + globalThis.evaluations + ' evaluation(s)');
+}
+JS
+snapshot snap-tool.wasm "tool.mjs" >/dev/null
+check "a snapshot's wasi:cli/run calls the main module's run export" \
+    "run called after 1 evaluation(s)" \
+    "$(wasmtime run --dir=. "${WASI_FLAGS[@]}" snap-tool.wasm 2>&1)"
+
+# The same holds for an `-e` module, which has no file.
+snapshot snap-eval-tool.wasm "-e 'export function run() { console.log(\"eval run called\"); }'" >/dev/null
+check "a snapshot of an -e module calls its run export" \
+    "eval run called" \
+    "$(wasmtime run --dir=. "${WASI_FLAGS[@]}" snap-eval-tool.wasm 2>&1)"
+
+# Running such a module as a plain script evaluates its top level and calls no export.
+cat >plain-tool.mjs <<'JS'
+console.log('top level evaluated');
+export function run() {
+  console.log('run called');
+}
+JS
+plain_status=0
+plain_output="$(wasmtime run --dir=. "${WASI_FLAGS[@]}" "$COMPONENT" plain-tool.mjs 2>&1)" || plain_status=$?
+if (( plain_status != 0 )) || [[ "$plain_output" != *"top level evaluated"* || "$plain_output" == *"run called"* ]]; then
+    echo "FAIL - a plain script's run export is not called"
+    echo "         expected exit status 0 and output with only the top level's line"
+    echo "         got exit status $plain_status: $plain_output"
+    failures=$((failures + 1))
+else
+    echo "ok   - a plain script's run export is not called"
+fi
+
 echo
 if (( failures > 0 )); then
     echo "$failures failure(s)"
diff --git a/scripts/wasm-target.sh b/scripts/wasm-target.sh
new file mode 100644
index 00000000..f1add272
--- /dev/null
+++ b/scripts/wasm-target.sh
@@ -0,0 +1,29 @@
+# SPDX-License-Identifier: Apache-2.0-WITH-LLVM-exception
+#
+# Sourced by the scripts and the justfile to name wasm targets and their builds.
+
+# Print the target triple `$1` names: `p2`, `p3`, or a full triple.
+wasm_target() {
+    case "$1" in
+        p2) echo wasm32-wasip2 ;;
+        p3) echo wasm32-wasip3 ;;
+        *) echo "$1" ;;
+    esac
+}
+
+# Print the cargo command that builds for the target triple `$1`. The pinned stable toolchain
+# ships no wasm32-wasip3 std, so that target builds with the beta toolchain `STARLING_BETA` names,
+# `beta` by default.
+wasm_cargo() {
+    if [ "$1" = wasm32-wasip3 ]; then
+        echo "cargo +${STARLING_BETA:-beta}"
+    else
+        echo cargo
+    fi
+}
+
+# Print the path of the runtime component `scripts/build-runtime.sh` builds for the target triple
+# `$1` in the cargo profile directory `$2`, `debug` or `release`.
+runtime_path() {
+    echo "${CARGO_TARGET_DIR:-target}/$1/$2/starling.wasm"
+}
diff --git a/starling/Cargo.toml b/starling/Cargo.toml
index 19d6362e..10d78531 100644
--- a/starling/Cargo.toml
+++ b/starling/Cargo.toml
@@ -40,19 +40,22 @@ core-runtime.workspace = true
 js.workspace = true
 libstarling.workspace = true
 wasip3.workspace = true
-# Pinned to the version `wasip3` itself uses, rather than the workspace's, so the component
-# carries one wit-bindgen. Each version generates its own `run_ctors_once` guard, and
-# `__wrap___wasm_call_ctors` in `lib.rs` collapses those onto one, so the C++ constructors run
-# once. SpiderMonkey's `InitializeUptime` asserts it is called once.
+# The workspace pins `wit-bindgen` to the version `wasip3` uses, so the component contains one
+# wit-bindgen, and so one `run_ctors_once` guard. `__wrap___wasm_call_ctors` in `lib.rs` makes the
+# C++ constructors run once.
 #
 # `inter-task-wakeup` lets one wit task wake another through plain Rust wakers, which the serve
 # path needs: the response-body writer task parks on a Rust channel the request's event-loop
-# drain task feeds (and the drain's body-done signal crosses back the other way). Without it the
-# executor panics the moment such a task is the only thing left to sleep on — any long-lived
-# streamed response (server-sent events, say) hit that.
+# drain task feeds (and the drain's body-done signal crosses back the other way). Without it, the
+# executor panics when such a task is the only one left to wait on, as in a long-lived streamed
+# response such as server-sent events.
 wit-bindgen = { workspace = true, features = ["macros", "inter-task-wakeup"] }
 libc = { version = "0.2", optional = true }
 
+[target.'cfg(target_arch = "wasm32")'.dependencies]
+wit-bridge.workspace = true
+web-fetch.workspace = true
+
 [target.'cfg(not(target_arch = "wasm32"))'.dev-dependencies]
 tempfile = "3"
 
diff --git a/starling/build.rs b/starling/build.rs
index 05b02bd3..317ff748 100644
--- a/starling/build.rs
+++ b/starling/build.rs
@@ -1,11 +1,47 @@
 // SPDX-License-Identifier: Apache-2.0-WITH-LLVM-exception
 
+use std::path::PathBuf;
+
+/// Whether this target's wasi-libc exports `__wasi_init_tp`, which `static_init` in `src/lib.rs`
+/// calls. wasi-sdk 33 exports it and wasi-sdk 34 does not, and a link that references the
+/// missing symbol fails. The WASI SDK is the one `WASI_SDK_PATH` names, or `/opt/wasi-sdk`.
+fn has_wasi_init_tp(target: &str) -> bool {
+    let sdk = std::env::var_os("WASI_SDK_PATH").unwrap_or_else(|| "/opt/wasi-sdk".into());
+    let libc = PathBuf::from(sdk)
+        .join("share/wasi-sysroot/lib")
+        .join(target)
+        .join("libc.a");
+    println!("cargo::rerun-if-changed={}", libc.display());
+    std::fs::read(&libc)
+        .map(|bytes| {
+            bytes
+                .windows(b"__wasi_init_tp".len())
+                .any(|w| w == b"__wasi_init_tp")
+        })
+        .unwrap_or(false)
+}
+
 fn main() {
     println!("cargo::rerun-if-changed=build.rs");
-    // Routes `__wasm_call_ctors` through `__wrap___wasm_call_ctors` in `lib.rs`, so every path
-    // that runs the static constructors shares one guard. Without it they run twice and
-    // SpiderMonkey's `InitializeUptime` aborts.
-    if std::env::var("CARGO_CFG_TARGET_ARCH").as_deref() == Ok("wasm32") {
-        println!("cargo::rustc-link-arg-cdylib=--wrap=__wasm_call_ctors");
+    println!("cargo::rerun-if-env-changed=WASI_SDK_PATH");
+    println!("cargo::rustc-check-cfg=cfg(has_wasi_init_tp)");
+
+    let target = std::env::var("TARGET").unwrap_or_default();
+    if !target.starts_with("wasm32-") {
+        return;
+    }
+    if has_wasi_init_tp(&target) {
+        println!("cargo::rustc-cfg=has_wasi_init_tp");
+    }
+    // Routes `__wasm_call_ctors` through `__wrap___wasm_call_ctors` in `lib.rs`.
+    println!("cargo::rustc-link-arg-cdylib=--wrap=__wasm_call_ctors");
+    // The wit-dylib bindings that `starling-componentize` links against the core module import the
+    // function table from it, which is growable so the bindings' element segment fits, and on
+    // wasm32-wasip2 the shadow stack pointer global. On wasm32-wasip3 the stack pointer lives in
+    // the task context, and no such global exists to export. Memory is exported by default.
+    println!("cargo::rustc-link-arg-cdylib=--export-table");
+    println!("cargo::rustc-link-arg-cdylib=--growable-table");
+    if std::env::var("CARGO_CFG_TARGET_ENV").as_deref() == Ok("p2") {
+        println!("cargo::rustc-link-arg-cdylib=--export=__stack_pointer");
     }
 }
diff --git a/starling/examples/class_methods.rs b/starling/examples/class_methods.rs
index 17b8d794..9130202b 100644
--- a/starling/examples/class_methods.rs
+++ b/starling/examples/class_methods.rs
@@ -2,6 +2,10 @@
 
 //! Demonstrates defining a JS class with methods using `#[jsclass]` and `#[jsmethods]`.
 
+// `showcase` covers what this example shows, so `cargo test --examples` builds it as an empty
+// test harness.
+#![cfg(not(test))]
+
 use js::compile::evaluate_with_filename;
 use js::error::ExnThrown;
 use js::prelude::FromJSVal;
@@ -103,8 +107,3 @@ c.data
 
     println!("All tests passed!");
 }
-
-#[test]
-fn class_methods_proc_example() {
-    main()
-}
diff --git a/starling/examples/globals.rs b/starling/examples/globals.rs
index 95e655ea..027c550b 100644
--- a/starling/examples/globals.rs
+++ b/starling/examples/globals.rs
@@ -5,6 +5,10 @@
 //!
 //! This is useful for APIs like `atob`, `self`, etc.
 
+// `showcase` covers what this example shows, so `cargo test --examples` builds it as an empty
+// test harness.
+#![cfg(not(test))]
+
 use js::compile::evaluate_with_filename;
 use js::prelude::FromJSVal;
 use libstarling::config::RuntimeConfig;
@@ -152,8 +156,3 @@ fn main() {
 
     println!("\nAll jsglobals tests passed!");
 }
-
-#[test]
-fn globals_example() {
-    main()
-}
diff --git a/starling/examples/native_module.rs b/starling/examples/native_module.rs
index d2006a06..aa2cde86 100644
--- a/starling/examples/native_module.rs
+++ b/starling/examples/native_module.rs
@@ -5,6 +5,10 @@
 //! Defines a native module with constants and functions, registers it,
 //! imports from JS, and also calls the functions from Rust.
 
+// `showcase` covers what this example shows, so `cargo test --examples` builds it as an empty
+// test harness.
+#![cfg(not(test))]
+
 use js::compile::evaluate_with_filename;
 use libstarling::config::RuntimeConfig;
 use libstarling::jsmodule;
@@ -47,10 +51,7 @@ fn main() {
     let scope = rt.default_global();
 
     // Register native module using the generated convenience function
-    assert!(
-        unsafe { math_utils::register(&scope) },
-        "Failed to register module"
-    );
+    assert!(math_utils::register(&scope), "Failed to register module");
 
     // ====================================================================
     // Test 1: Call functions from Rust
@@ -202,8 +203,3 @@ fn main() {
 
     println!("\nAll 7 tests passed!");
 }
-
-#[test]
-fn native_module_example() {
-    main()
-}
diff --git a/starling/examples/showcase.rs b/starling/examples/showcase.rs
index 598f6f7a..11bf4d72 100644
--- a/starling/examples/showcase.rs
+++ b/starling/examples/showcase.rs
@@ -306,10 +306,7 @@ fn main() {
     app_globals::add_to_global(&scope, global);
 
     // Register native module.
-    assert!(
-        unsafe { math::register(&scope) },
-        "Failed to register math module"
-    );
+    assert!(math::register(&scope), "Failed to register math module");
 
     // ====================================================================
     // Part A: Rust-side usage of every feature
diff --git a/starling/src/lib.rs b/starling/src/lib.rs
index 03cb6e7c..cb38d318 100644
--- a/starling/src/lib.rs
+++ b/starling/src/lib.rs
@@ -1,12 +1,10 @@
 // SPDX-License-Identifier: Apache-2.0-WITH-LLVM-exception
 
-//! The wasm build of StarlingMonkey: a reactor exporting `wasi:cli/run`,
-//! `wasi:http/handler` and `wizer-initialize`.
-//!
-//! This is a `cdylib` rather than the `starlingmonkey` binary because a bin
-//! links `crt1-command.o`, which exports `wasi:cli/run` itself. On
-//! wasm32-wasip3 that collides with the `export!`s below, and componentization
-//! fails. A `cdylib` links no such startup object.
+//! The wasm build of StarlingMonkey, `starling.wasm`: a component exporting
+//! `wasi:cli/run`, `wasi:http/handler`, `wizer-initialize`, and the
+//! `starling:componentize/init` interface `starling-componentize` calls. The
+//! componentizer links a world's wit-dylib bindings against its core module,
+//! whose `wit_dylib_*` exports `wit_bridge::interpreter` provides.
 
 #![cfg(target_arch = "wasm32")]
 
@@ -90,6 +88,35 @@ pub extern "C" fn __wrap___wasm_call_ctors() {
     unsafe { __real___wasm_call_ctors() };
 }
 
+/// The wasi-libc process setup the `cdylib` link leaves out.
+///
+/// The `cdylib` links without the crt, whose `_initialize` would otherwise run
+/// the static constructors at instantiation time and then again from the
+/// wit-bindgen `run_ctors_once` shim on the first export call. That
+/// `_initialize` also calls `__wasi_init_tp`, which fills in the main thread's
+/// `pthread_self` record (stack bounds and the thread-local base). This
+/// constructor supplies that call instead. It runs first, from
+/// `__wasm_call_ctors`, ahead of SpiderMonkey's own static constructors, which
+/// have the default priority of 65535.
+///
+/// Only compiled when the sysroot exports `__wasi_init_tp`. See `build.rs`.
+#[cfg(has_wasi_init_tp)]
+mod static_init {
+    unsafe extern "C" {
+        fn __wasi_init_tp();
+    }
+
+    extern "C" fn init_tp() {
+        // SAFETY: `__wasi_init_tp` is wasi-libc's main-thread setup, which the
+        // crt calls exactly here, before any constructor or export runs.
+        unsafe { __wasi_init_tp() }
+    }
+
+    #[used]
+    #[unsafe(link_section = ".init_array.00000")]
+    static INIT_TP: extern "C" fn() = init_tp;
+}
+
 /// The wasm component exports both `wasi:cli/run` and `wasi:http/handler`, so one build serves
 /// HTTP and runs as a command. There is no dispatch between them: the host picks which export to
 /// call. `wasmtime run` calls the former, `wasmtime serve` the latter.
@@ -97,24 +124,41 @@ pub extern "C" fn __wrap___wasm_call_ctors() {
 /// The two differ only in where their configuration comes from. The CLI export is handed argv;
 /// the HTTP export is not (`wasmtime serve` passes none), so it reads `STARLINGMONKEY_CONFIG`.
 mod wasm_entry {
-
+    use core_runtime::invocation::{InvocationState, OwnedInvocation};
     use libstarling::config::RuntimeConfig;
+    use wit_bridge::run::{report_run_outcome, run_main_export, MainModule};
 
     struct StarlingCli;
 
     impl wasip3::exports::cli::run::Guest for StarlingCli {
+        /// Call the main module's `run` export in an instance whose top level ran before a
+        /// snapshot: a componentized command, or a script wizened with `wizer-initialize`.
+        /// In any other instance, run the script the arguments name.
         async fn run() -> Result<(), ()> {
-            let config = match RuntimeConfig::from_args(std::env::args()) {
-                Ok(config) => config,
-                Err(e) => {
-                    let _ = e.print();
-                    return Err(());
-                }
+            let snapshot = if wit_bridge::init::is_initialized() {
+                Some((wit_bridge::init::runtime(), MainModule::Bootstrap))
+            } else {
+                libstarling::serve_wasm::installed_runtime()
+                    .map(|(runtime, raw_cx)| (runtime, MainModule::Entry(raw_cx)))
             };
-
-            libstarling::run(config).await.map_err(|e| {
-                eprintln!("{e}");
-            })
+            let Some((runtime, main)) = snapshot else {
+                let config = match RuntimeConfig::from_args(std::env::args()) {
+                    Ok(config) => config,
+                    Err(e) => {
+                        let _ = e.print();
+                        return Err(());
+                    }
+                };
+                return libstarling::run(config).await.map_err(|e| {
+                    eprintln!("{e}");
+                });
+            };
+            // The snapshot's top level left no work behind, since both kinds of snapshot refuse
+            // any, so `run` starts on a fresh loop, after the resume fixups have repaired the
+            // clocks.
+            libstarling::serve_wasm::fix_up_after_resume();
+            let invocation = OwnedInvocation::new(runtime, InvocationState::new());
+            report_run_outcome(run_main_export(&invocation, main).await)
         }
     }
 
@@ -171,3 +215,184 @@ mod wasm_entry {
         export!(Init);
     }
 }
+
+/// The `starling:componentize/init` export, which `starling/wit/init.wit`
+/// declares.
+///
+/// `starling-componentize` links this runtime together with the user's wit-dylib
+/// bindings and calls `init` once, under Wizer, to bootstrap the SpiderMonkey
+/// runtime and evaluate the user's modules. The heap is then wizened, and
+/// every subsequent component call runs against that runtime, through the
+/// `wit_bridge::interpreter` glue this crate pulls in so its `wit_dylib_*`
+/// exports land in the export table.
+///
+/// The generated `run_ctors_once` shim runs the static constructors before the
+/// body, so SpiderMonkey is safe to use here.
+mod init_export {
+    /// A `Request` for `value` if it is a wrapper of a `wasi:http/types`
+    /// `request`, whose handle the `Request` takes. See
+    /// [`web_fetch::request::register_request_input_adapter`].
+    fn request_input<'s>(
+        scope: &'s js::gc::scope::Scope<'_>,
+        value: js::prelude::HandleValue<'_>,
+    ) -> Result<Option<web_fetch::request::Request<'s>>, js::error::ExnThrown> {
+        let handle = wit_bridge::interpreter::take_imported_handle(
+            scope,
+            value,
+            libstarling::serve_wasm::WASI_HTTP_TYPES,
+            "request",
+        )?;
+        handle
+            .map(|handle| {
+                // SAFETY: `take_imported_handle` took `handle`, a live `request`
+                // handle, out of its wrapper, which no longer owns it.
+                unsafe { libstarling::serve_wasm::request_from_handle(scope, handle) }
+            })
+            .transpose()
+    }
+
+    mod bindings {
+        wit_bindgen::generate!({
+            world: "runtime",
+            path: "wit/init.wit",
+            generate_all,
+        });
+
+        use super::Init;
+
+        export!(Init);
+    }
+
+    use core_runtime::invocation::OwnedInvocation;
+    use libstarling::serve_wasm::RawHttpHandler;
+
+    struct Init;
+
+    impl bindings::exports::starling::componentize::init::Guest for Init {
+        /// Bootstrap the runtime and evaluate the application's modules, as
+        /// `init` in `wit/init.wit` describes.
+        async fn init(
+            main: String,
+            main_name: String,
+            main_path: Option<String>,
+            cli: bool,
+            raw_http_handler: Option<String>,
+            init_location: Option<String>,
+        ) -> Result<bool, String> {
+            // Registered before `initialize_runtime` calls `Runtime::init`, which
+            // fires every global initializer on the default global.
+            libstarling::register_builtins();
+            libstarling::runtime::register_global_initializer(wit_bridge::add_to_global);
+            // A `Response` lowers to an owned `wasi:http/types` `response`, so an
+            // application's own `wasi:http/handler` can return one.
+            wit_bridge::resources::register_own_adapter(
+                libstarling::serve_wasm::WASI_HTTP_TYPES,
+                "response",
+                libstarling::serve_wasm::response_handle,
+                libstarling::serve_wasm::response_accepts,
+            );
+            // `fetch` takes a `wasi:http/types` `request`, such as the one an
+            // application's own `wasi:http/handler` receives.
+            web_fetch::request::register_request_input_adapter(request_input);
+
+            let config = core_runtime::config::RuntimeConfig {
+                pre_initialize: true,
+                init_location,
+                ..Default::default()
+            };
+            libstarling::apply_pre_init_config(&config)?;
+            // The host's imports are not linked while the snapshot is taken.
+            wit_bridge::imports::set_imports_unavailable(true);
+            wit_bridge::init::set_before_export(libstarling::serve_wasm::fix_up_after_resume);
+            let initialized = wit_bridge::initialize_runtime(
+                &config,
+                &main,
+                &main_name,
+                main_path.as_deref(),
+                wit_bridge::interpreter::synthesize,
+            )?;
+            let invocation =
+                OwnedInvocation::new(wit_bridge::init::runtime(), initialized.invocation);
+            let raw_cx = wit_bridge::init::raw_cx();
+
+            // A top-level `await` settles only once the loop runs the timers and
+            // I/O it waits on, and the application's exports are in their
+            // temporal dead zone until it does. We drive the loop only while the
+            // top level is unfinished, so work it merely queued, such as a timer,
+            // is refused below rather than run under Wizer.
+            if !wit_bridge::init::with_scope(|scope| initialized.evaluation.is_finished(scope)) {
+                // SAFETY: `initialize_runtime` left the default global's realm
+                // entered for the process, and keeps its runtime alive for the
+                // process.
+                unsafe {
+                    libstarling::serve_wasm::drive_startup(
+                        raw_cx,
+                        invocation.state().event_loop(),
+                        &initialized.evaluation,
+                    )
+                    .await;
+                }
+            }
+            wit_bridge::init::with_scope(|scope| {
+                initialized
+                    .evaluation
+                    .rejection(scope, "main module threw during evaluation")?;
+                if initialized.evaluation.is_finished(scope) {
+                    Ok(())
+                } else {
+                    Err(
+                        "the application's top-level `await` never settled: the event loop \
+                         ran out of work while it was still pending"
+                            .to_string(),
+                    )
+                }
+            })?;
+
+            let raw_export = wit_bridge::init::with_main_scope(|scope, ns| {
+                wit_bridge::interpreter::install_exports(
+                    scope,
+                    ns,
+                    cli,
+                    raw_http_handler.as_deref(),
+                )
+            })?;
+
+            wit_bridge::init::with_scope(|scope| {
+                libstarling::serve_wasm::finish_for_snapshot(scope, invocation.state().event_loop())
+            })?;
+            drop(invocation);
+
+            let http_handler = raw_export
+                .map(|raw| {
+                    // SAFETY: `initialize_runtime` left the default global's realm
+                    // of `raw_cx` entered for the process.
+                    unsafe {
+                        libstarling::serve_wasm::select_http_handler(
+                            raw_cx,
+                            RawHttpHandler {
+                                paths: &raw.paths,
+                                provided: raw.provided,
+                            },
+                        )
+                    }
+                })
+                .transpose()?;
+
+            // Hand the runtime to the serve path, so `wasi:http/handler`
+            // dispatches against this global instead of standing up a second
+            // runtime.
+            libstarling::serve_wasm::adopt_runtime(wit_bridge::init::runtime(), raw_cx, &config)?;
+
+            // The instance is wizened as soon as this returns, so everything
+            // above is state a resumed instance inherits. Last, since this
+            // records the clock reading the resumed instance's own clocks are
+            // advanced past.
+            wit_bridge::imports::set_imports_unavailable(false);
+            libstarling::serve_wasm::prepare_for_snapshot();
+            Ok(matches!(
+                http_handler,
+                Some(libstarling::serve_wasm::HttpHandler::Raw)
+            ))
+        }
+    }
+}
diff --git a/starling/src/main.rs b/starling/src/main.rs
index 673b42c4..e4e8dcc5 100644
--- a/starling/src/main.rs
+++ b/starling/src/main.rs
@@ -31,17 +31,3 @@ fn main() {
 fn main() {
     unreachable!("On wasm targets the `starling` cdylib is the entry point, not this binary");
 }
-
-#[cfg(all(test, not(target_arch = "wasm32")))]
-#[test]
-fn cli_runs() {
-    let config = libstarling::config::RuntimeConfig::from_args(
-        ["starlingmonkey", "-e", "1 + 1"]
-            .iter()
-            .map(|s| s.to_string()),
-    )
-    .unwrap();
-    libstarling::run(config)
-        .map_err(|e| println!("{e}"))
-        .expect("Run failed");
-}
diff --git a/starling/tests/console_output.rs b/starling/tests/console_output.rs
index 0e5103c2..5f312600 100644
--- a/starling/tests/console_output.rs
+++ b/starling/tests/console_output.rs
@@ -18,19 +18,33 @@ fn run_module(source: &str) -> Output {
 }
 
 /// `log`, `info` and `debug` print the bare message on stdout. `warn` and
-/// `error` print it on stderr, prefixed with the level.
+/// `error` print it on stderr, prefixed with the level. `log` returns
+/// `undefined`.
 #[test]
 fn console_levels_write_to_their_streams() {
     let out = run_module(
         "console.log('a', 1); console.info('b'); console.debug('c');\n\
-         console.warn('d'); console.error('e');",
+         console.warn('d'); console.error('e');\n\
+         console.log(String(console.log('f')));",
     );
     assert_eq!(out.status.code(), Some(0));
-    assert_eq!(String::from_utf8_lossy(&out.stdout), "a 1\nb\nc\n");
+    assert_eq!(
+        String::from_utf8_lossy(&out.stdout),
+        "a 1\nb\nc\nf\nundefined\n"
+    );
     assert_eq!(String::from_utf8_lossy(&out.stderr), "Warn: d\nError: e\n");
 }
 
-/// `console.assert` prints nothing when its condition holds, and otherwise prints
+/// Messages are written whole, including NUL characters in them.
+#[test]
+fn console_messages_keep_nul_characters() {
+    let out = run_module("console.log('a\\0b', 'c'); console.error('d\\0e');");
+    assert_eq!(out.status.code(), Some(0));
+    assert_eq!(out.stdout, b"a\0b c\n");
+    assert_eq!(out.stderr, b"Error: d\0e\n");
+}
+
+/// `console.assert` doesn't print anything when its condition holds, and otherwise prints
 /// "Assertion failed" and its data on stderr.
 #[test]
 fn console_assert_reports_failed_assertions() {
@@ -94,3 +108,43 @@ fn top_level_rejection_is_reported_once() {
     assert!(stderr.contains("top level"), "{stderr}");
     assert!(!stderr.contains("Uncaught (in promise)"), "{stderr}");
 }
+
+/// `--serve 0` listens on a port the system picks and prints its address on
+/// stderr, where a client can read it and connect.
+#[test]
+fn serve_on_port_zero_prints_the_bound_address() {
+    use std::io::{BufRead, Read, Write};
+
+    let mut child = Command::new(env!("CARGO_BIN_EXE_starlingmonkey"))
+        .args([
+            "--serve",
+            "0",
+            "--legacy-script",
+            "-e",
+            "addEventListener('fetch', (e) => e.respondWith(new Response('served')))",
+        ])
+        .stdout(std::process::Stdio::null())
+        .stderr(std::process::Stdio::piped())
+        .spawn()
+        .expect("failed to run starling");
+    let stderr = std::io::BufReader::new(child.stderr.take().unwrap());
+    let address = stderr
+        .lines()
+        .map_while(Result::ok)
+        .find_map(|line| Some(line.strip_prefix("serving on http://")?.to_string()))
+        .expect("the server printed its address before closing stderr");
+
+    let mut stream = std::net::TcpStream::connect(&address).unwrap();
+    stream
+        .write_all(b"GET / HTTP/1.1\r\nHost: localhost\r\nConnection: close\r\n\r\n")
+        .unwrap();
+    let mut response = String::new();
+    let read = stream.read_to_string(&mut response);
+    let _ = child.kill();
+    let _ = child.wait();
+    read.unwrap();
+    assert!(
+        response.starts_with("HTTP/1.1 200") && response.ends_with("served"),
+        "{response}"
+    );
+}
diff --git a/starling/tests/exit_status.rs b/starling/tests/exit_status.rs
index c803b263..8b5b499c 100644
--- a/starling/tests/exit_status.rs
+++ b/starling/tests/exit_status.rs
@@ -4,16 +4,22 @@
 
 #![cfg(not(target_arch = "wasm32"))]
 
-use std::process::Command;
+use std::ffi::OsStr;
+use std::process::{Command, Output};
+
+/// Run `starlingmonkey <args>`, and return the process output.
+fn run(args: impl IntoIterator<Item = impl AsRef<OsStr>>) -> Output {
+    Command::new(env!("CARGO_BIN_EXE_starlingmonkey"))
+        .args(args)
+        .output()
+        .expect("failed to run starling")
+}
 
 /// An error before the event loop runs, here an unreadable `-i` initializer
 /// script, exits with code 1 rather than aborting.
 #[test]
 fn initializer_error_exits_with_code_one() {
-    let out = Command::new(env!("CARGO_BIN_EXE_starlingmonkey"))
-        .args(["-i", "/nonexistent/init.js", "/nonexistent/app.js"])
-        .output()
-        .expect("failed to run starling");
+    let out = run(["-i", "/nonexistent/init.js", "/nonexistent/app.js"]);
     assert_eq!(
         out.status.code(),
         Some(1),
@@ -23,9 +29,9 @@ fn initializer_error_exits_with_code_one() {
     );
 }
 
-/// Scheduling APIs work during initializer evaluation, and the initializer's
-/// microtasks drain before the content script runs — but async work left
-/// behind has nothing to drive it and must be a hard error.
+/// Scheduling APIs work during initializer evaluation. The initializer's
+/// microtasks drain before the content script runs. Async work left behind by
+/// the initializer has nothing to drive it, so the run fails.
 #[test]
 fn initializer_event_loop_semantics() {
     let dir = tempfile::tempdir().unwrap();
@@ -43,10 +49,7 @@ fn initializer_event_loop_semantics() {
         "if (globalThis._fromInit !== 'ready') { throw new Error('initializer microtask not drained'); }",
     )
     .unwrap();
-    let out = Command::new(env!("CARGO_BIN_EXE_starlingmonkey"))
-        .args(["-i", &init.to_string_lossy(), &main.to_string_lossy()])
-        .output()
-        .expect("failed to run starling");
+    let out = run([OsStr::new("-i"), init.as_os_str(), main.as_os_str()]);
     assert_eq!(
         out.status.code(),
         Some(0),
@@ -54,14 +57,10 @@ fn initializer_event_loop_semantics() {
         String::from_utf8_lossy(&out.stderr)
     );
 
-    // setTimeout no longer throws "No active event loop" — but a timer left
-    // pending when the initializer ends is an error.
+    // A timer left pending when the initializer ends fails the run.
     let init_timer = dir.path().join("init_timer.js");
     std::fs::write(&init_timer, "setTimeout(() => {}, 1000);").unwrap();
-    let out = Command::new(env!("CARGO_BIN_EXE_starlingmonkey"))
-        .args(["-i", &init_timer.to_string_lossy(), &main.to_string_lossy()])
-        .output()
-        .expect("failed to run starling");
+    let out = run([OsStr::new("-i"), init_timer.as_os_str(), main.as_os_str()]);
     assert_eq!(out.status.code(), Some(1));
     let stderr = String::from_utf8_lossy(&out.stderr);
     assert!(
@@ -76,14 +75,7 @@ fn initializer_event_loop_semantics() {
         "globalThis._fromInit = 'ready'; var t = setTimeout(() => {}, 1000); clearTimeout(t);",
     )
     .unwrap();
-    let out = Command::new(env!("CARGO_BIN_EXE_starlingmonkey"))
-        .args([
-            "-i",
-            &init_cleared.to_string_lossy(),
-            &main.to_string_lossy(),
-        ])
-        .output()
-        .expect("failed to run starling");
+    let out = run([OsStr::new("-i"), init_cleared.as_os_str(), main.as_os_str()]);
     assert_eq!(
         out.status.code(),
         Some(0),
@@ -92,40 +84,27 @@ fn initializer_event_loop_semantics() {
     );
 }
 
-/// A content script that throws reports the error on stderr and exits with 1.
-#[test]
-fn throwing_script_exits_with_code_one() {
-    let out = Command::new(env!("CARGO_BIN_EXE_starlingmonkey"))
-        .args(["-e", "throw new Error('boom')"])
-        .output()
-        .expect("failed to run starling");
-    let stderr = String::from_utf8_lossy(&out.stderr);
-    assert_eq!(out.status.code(), Some(1), "stderr: {stderr}");
-    assert!(stderr.contains("boom"), "stderr: {stderr}");
-    assert!(
-        !String::from_utf8_lossy(&out.stdout).contains("boom"),
-        "the error must not go to stdout"
-    );
-}
-
-/// A top-level throw in a module file reports where it was thrown.
+/// A top-level throw in a module file reports the error and where it was thrown on stderr, and
+/// exits with 1.
 #[test]
-fn top_level_throw_reports_its_location() {
+fn top_level_throw_exits_with_code_one_and_reports_its_location() {
     let dir = tempfile::tempdir().unwrap();
     let main = dir.path().join("main.mjs");
     std::fs::write(&main, "const x = 1;\nthrow new Error('located');").unwrap();
-    let out = Command::new(env!("CARGO_BIN_EXE_starlingmonkey"))
-        .arg(&main)
-        .output()
-        .expect("failed to run starling");
+    let out = run([&main]);
     let stderr = String::from_utf8_lossy(&out.stderr);
     assert_eq!(out.status.code(), Some(1), "stderr: {stderr}");
     assert!(stderr.contains("located"), "stderr: {stderr}");
     assert!(stderr.contains("main.mjs:2:"), "stderr: {stderr}");
+    assert!(
+        !String::from_utf8_lossy(&out.stdout).contains("located"),
+        "the error must not go to stdout"
+    );
 }
 
 /// A top level that rejects once a timer has fired, after evaluation handed off to the event
-/// loop, reports the error and exits with 1.
+/// loop, reports the error and exits with 1. The module file case has no other work. The `-e`
+/// case also checks that the exit does not wait for an interval that keeps the event loop busy.
 #[test]
 fn late_top_level_rejection_exits_with_code_one() {
     let dir = tempfile::tempdir().unwrap();
@@ -136,49 +115,29 @@ fn late_top_level_rejection_exits_with_code_one() {
          throw new Error('late failure');",
     )
     .unwrap();
-    let out = Command::new(env!("CARGO_BIN_EXE_starlingmonkey"))
-        .arg(&main)
-        .output()
-        .expect("failed to run starling");
-    let stderr = String::from_utf8_lossy(&out.stderr);
-    assert_eq!(out.status.code(), Some(1), "stderr: {stderr}");
-    assert!(stderr.contains("late failure"), "stderr: {stderr}");
-}
-
-/// A top level that rejects while an interval keeps the event loop busy reports the error and
-/// exits with 1, without waiting for the interval.
-#[test]
-fn late_rejection_with_work_left_exits_with_code_one() {
-    let dir = tempfile::tempdir().unwrap();
-    let main = dir.path().join("main.mjs");
-    std::fs::write(
-        &main,
+    let from_file = run([&main]);
+    let from_eval = run([
+        "-e",
         "setInterval(() => {}, 5);\n\
          await new Promise((resolve) => setTimeout(resolve, 10));\n\
          throw new Error('late failure');",
-    )
-    .unwrap();
-    let out = Command::new(env!("CARGO_BIN_EXE_starlingmonkey"))
-        .arg(&main)
-        .output()
-        .expect("failed to run starling");
-    let stderr = String::from_utf8_lossy(&out.stderr);
-    assert_eq!(out.status.code(), Some(1), "stderr: {stderr}");
-    assert!(stderr.contains("late failure"), "stderr: {stderr}");
+    ]);
+    for (case, out) in [("module file", from_file), ("-e", from_eval)] {
+        let stderr = String::from_utf8_lossy(&out.stderr);
+        assert_eq!(out.status.code(), Some(1), "{case}: stderr: {stderr}");
+        assert!(stderr.contains("late failure"), "{case}: stderr: {stderr}");
+    }
 }
 
-/// A top-level `await` on a promise nothing settles exits with 1, whether or not the event loop
-/// had other work first.
+/// A top-level `await` on a promise that never settles exits with 1, whether or not the event
+/// loop had other work first.
 #[test]
 fn unsettled_top_level_await_exits_with_code_one() {
     for source in [
         "await new Promise(() => {});",
         "setTimeout(() => {}, 10);\nawait new Promise(() => {});",
     ] {
-        let out = Command::new(env!("CARGO_BIN_EXE_starlingmonkey"))
-            .args(["-e", source])
-            .output()
-            .expect("failed to run starling");
+        let out = run(["-e", source]);
         let stderr = String::from_utf8_lossy(&out.stderr);
         assert_eq!(out.status.code(), Some(1), "{source}: stderr: {stderr}");
         assert!(
@@ -191,16 +150,8 @@ fn unsettled_top_level_await_exits_with_code_one() {
 /// `--help` exits with 0 and an unknown flag with clap's usage-error status 2.
 #[test]
 fn argument_errors_use_clap_exit_statuses() {
-    let help = Command::new(env!("CARGO_BIN_EXE_starlingmonkey"))
-        .arg("--help")
-        .output()
-        .expect("failed to run starling");
-    assert_eq!(help.status.code(), Some(0));
-    let bad = Command::new(env!("CARGO_BIN_EXE_starlingmonkey"))
-        .arg("--no-such-flag")
-        .output()
-        .expect("failed to run starling");
-    assert_eq!(bad.status.code(), Some(2));
+    assert_eq!(run(["--help"]).status.code(), Some(0));
+    assert_eq!(run(["--no-such-flag"]).status.code(), Some(2));
 }
 
 /// A syntax error in an imported file module is reported with its own message
@@ -211,10 +162,7 @@ fn imported_module_syntax_error_keeps_its_location() {
     let main = dir.path().join("main.mjs");
     std::fs::write(&main, "import './bad.mjs';").unwrap();
     std::fs::write(dir.path().join("bad.mjs"), "export const x = ;").unwrap();
-    let out = Command::new(env!("CARGO_BIN_EXE_starlingmonkey"))
-        .arg(&main)
-        .output()
-        .expect("failed to run starling");
+    let out = run([&main]);
     let stderr = String::from_utf8_lossy(&out.stderr);
     assert_eq!(out.status.code(), Some(1), "stderr: {stderr}");
     assert!(stderr.contains("expected expression"), "stderr: {stderr}");
diff --git a/starling/wit/init.wit b/starling/wit/init.wit
new file mode 100644
index 00000000..4dd35a1f
--- /dev/null
+++ b/starling/wit/init.wit
@@ -0,0 +1,43 @@
+/// The interface between the runtime and `starling-componentize`, which calls
+/// `init` under Wizer. Its version changes whenever the interface does, and the
+/// componentizer accepts a runtime whose version of it differs only in the
+/// patch number.
+package starling:componentize@0.1.0;
+
+interface init {
+  /// `main` is the source of the application's main module, and `main-name` is
+  /// the name it is compiled under, which stack traces and error messages show
+  /// for it.
+  ///
+  /// `main-path` is the path of the file `main` was read from, relative to the
+  /// base directory, or `none` for a source from no file there. A module
+  /// importing that file gets the main module.
+  ///
+  /// `cli` is set for a component that exports `wasi:cli/run`, whose main module
+  /// must export a `run` function.
+  ///
+  /// `raw-http-handler` is `none` for a component that does not export
+  /// `wasi:http/handler`. Otherwise it names the export the application implements
+  /// instead of registering a `fetch` listener, and the result is whether that
+  /// export serves requests rather than the runtime's builtin, which dispatches
+  /// each request as a `fetch` event.
+  ///
+  /// `init-location` is the URL `globalThis.location` reflects while the main
+  /// module's top level evaluates, or `none` to leave it unset, which makes
+  /// reading `location` throw.
+  ///
+  /// `init` returns once the main module's top level, including a top-level
+  /// `await`, has finished evaluating.
+  init: async func(
+    main: string,
+    main-name: string,
+    main-path: option<string>,
+    cli: bool,
+    raw-http-handler: option<string>,
+    init-location: option<string>,
+  ) -> result<bool, string>;
+}
+
+world runtime {
+  export init;
+}
diff --git a/tests/wpt-harness/post-harness.js b/tests/wpt-harness/post-harness.js
index b6c60ada..0d617bf3 100644
--- a/tests/wpt-harness/post-harness.js
+++ b/tests/wpt-harness/post-harness.js
@@ -12,12 +12,8 @@
 // Tell testharness.js we'll call done() explicitly when ready.
 setup({ explicit_done: true });
 
-// Register the completion callback that fires after done() is called. This handler serializes the
-// test results as JSON and hands them to `__wptReportResults`, the sink the running mode installed:
-// command mode's (from pre-harness.js) prints them for the runner to read off stdout, serve mode's
-// (from wpt-server.js) delivers them into the response carrying this test. Calling it
-// unconditionally keeps mode knowledge out of here — and makes a missing sink a loud TypeError
-// rather than results quietly going nowhere.
+// After done() is called, pass the results as JSON to `__wptReportResults`, which pre-harness.js
+// or wpt-server.js installs.
 add_completion_callback(function(tests, harness_status, asserts) {
   let results = tests.map(function(t) {
     return {
diff --git a/tests/wpt-harness/pre-harness.js b/tests/wpt-harness/pre-harness.js
index d36b73b2..dd23f960 100644
--- a/tests/wpt-harness/pre-harness.js
+++ b/tests/wpt-harness/pre-harness.js
@@ -21,17 +21,11 @@ globalThis.Window = {
   prototype: {}
 };
 
-// Where a finished test's results go. post-harness.js calls this and nothing else, so the running
-// mode is expressed by which sink is installed rather than by the epilogue sniffing for one.
-//
-// Serve mode (wpt-server.js) installs its own — delivering into the response it is holding open —
-// before evaluating this script, so this only supplies command mode's default.
+// Where post-harness.js passes a finished test's results. Serve mode (wpt-server.js) installs its
+// own before this script runs, so this is command mode's.
 globalThis.__wptReportResults ??= function(json) {
-  // The runner reads this line off stdout.
+  // The runner reads this line from stdout.
   console.log("WPT_RESULTS_JSON:" + json);
-  // Stop the event loop now that the results are out: a finished test may have left a live
-  // setInterval (or other pending timer) running, which would otherwise keep the process alive
-  // until the harness timeout. Serve mode's sink deliberately does not do this — there the
-  // response is still to be sent, and this test's loop is the one carrying that work.
+  // Stop the event loop, since a finished test may have left a timer running.
   if (typeof __wptDone === "function") __wptDone();
 };
diff --git a/tests/wpt-harness/run-wpt.mjs b/tests/wpt-harness/run-wpt.mjs
index 6ccb1055..104f5d09 100644
--- a/tests/wpt-harness/run-wpt.mjs
+++ b/tests/wpt-harness/run-wpt.mjs
@@ -29,14 +29,10 @@
 //   native, restrictions disabled   `permissive_status`  --permissive
 //
 // An override field is written only where that configuration's result differs
-// from the baseline, so the vast majority of subtests — which behave the same
-// everywhere — are still recorded once.
-//
-// The permissive dimension exists because the browser-security Fetch
-// constraints are off by default, except in WPT mode. Without it, the whole
-// suite would only ever cover the configuration that ordinary users do not run.
+// from the baseline. The browser-security Fetch restrictions are off by default
+// outside WPT mode, so `--permissive` covers the configuration users run.
 
-import { execFileSync, spawn, spawnSync } from "child_process";
+import { execFileSync, spawn } from "child_process";
 import {
   existsSync,
   readFileSync,
@@ -56,27 +52,20 @@ function relativePath(p) {
   return new URL(p, import.meta.url).pathname;
 }
 
-// tests.json line prefixes:
-//   "SKIP "      — never run, on any target.
-//   "SLOW "      — skipped when --skip-slow-tests is passed.
-//   "SKIP-WASM " — run on native, skipped on the wasm target. For tests that
-//                  depend on JS APIs the wasm build does not expose (e.g.
-//                  `WebAssembly`, which the SpiderMonkey-in-wasm build omits).
-//   "SKIP-NATIVE " — run on wasm, skipped on the native target. The mirror of
-//                  SKIP-WASM, for tests only the wasm host can run at all.
-//   "NET "       — needs the live WPT server; see NET_PREFIX below.
+// tests.json line prefixes, each optionally followed by a `(comment)`:
+//   "SKIP "        never run, on any target.
+//   "SLOW "        skipped when --skip-slow-tests is passed.
+//   "SKIP-WASM "   run on native, skipped on the wasm target.
+//   "SKIP-NATIVE " run on wasm, skipped on the native target.
+//   "NET "         needs the live WPT server, which the harness starts if no
+//                  server is running.
 //
-// Reach for SKIP-WASM/SKIP-NATIVE only when a test cannot run on that target at
-// all. When it runs but some subtests behave differently — the two HTTP stacks
-// do not have identical capabilities — record that per subtest with
-// `wasm_status` instead (see getExpectedResults), so the subtests that *do*
-// pass stay covered on both targets.
+// SKIP-WASM and SKIP-NATIVE are for tests that cannot run on that target at all.
+// Subtests that behave differently per target get a `wasm_status` instead.
 const SKIP_PREFIX = "SKIP";
 const SLOW_PREFIX = "SLOW";
 const SKIP_WASM_PREFIX = "SKIP-WASM";
 const SKIP_NATIVE_PREFIX = "SKIP-NATIVE";
-// Tests that need the live WPT server (they call `fetch()` over the network).
-// When any selected test is `NET`, the harness ensures `wpt serve` is running.
 const NET_PREFIX = "NET";
 
 const LogLevel = { Quiet: 0, Verbose: 1, VeryVerbose: 2 };
@@ -85,10 +74,9 @@ const config = {
   // Default automatically adjusted to "target/wasm32-wasip2/debug/starling.wasm" for wasm target.
   runtime: "target/debug/starlingmonkey",
   target: "native", // "native" or "wasm"
-  // How the runtime executes each test: "cli" runs it as a one-shot command, "serve" POSTs it to a
-  // long-running server built from the same binary (see wpt-server.js). Serve mode is the
-  // production-shaped configuration: the test runs inside a request handler.
-  mode: "cli", // "cli" or "serve"
+  // "cli" runs each test as a one-shot command, "serve" POSTs it to a long-running server built
+  // from the same binary (see wpt-server.js).
+  mode: "cli",
   servePort: 7877,
   wptRoot: process.env.WPT_ROOT || "deps/wpt",
   tmpDir: "target/tmp/wpt",
@@ -99,30 +87,19 @@ const config = {
     pattern: "",
   },
   skipSlowTests: false,
-  // Run with the browser-security request restrictions disabled (the runtime's
-  // default outside WPT mode), checking `permissive_status` expectation
-  // overrides. See getExpectedResults.
+  // Run with the request restrictions disabled, checking `permissive_status`.
   permissive: false,
-  // How many tests to have in flight at once. Defaults to number of CPUs * 2,
-  // because many tests aren't CPU-bound, and can execute in parallel without
-  // incurring compute contention.
+  // Twice the number of CPUs, since many tests aren't CPU-bound.
   jobs: Math.max(1, cpus().length * 2),
-  // Path to an ahead-of-time compiled runtime, set up for the wasm target
-  // unless --no-precompile is passed. See ensurePrecompiledRuntime.
+  // The ahead-of-time compiled wasm runtime, unless --no-precompile is passed.
   precompiled: null,
   usePrecompiled: true,
-  // Pre-initialize the wasm runtime with Wizer before serving it, so the engine and the content
-  // script are already stood up in the snapshot. This harness retires an instance after every
-  // request, so without this each test pays for the whole runtime again.
+  // The wasm runtime pre-initialized with Wizer, with --wizen in serve mode.
   wizen: false,
   wizened: null,
   logLevel: LogLevel.Quiet,
-  // Per-test timeout for a serial run, scaled by --jobs. This is the outermost of three nested
-  // limits, and has to stay the largest of them or it preempts the ones that can say something
-  // useful: testharness.js times a test out internally at 10s (60s for `META: timeout=long`) and
-  // reports per-subtest TIMEOUT statuses, and serve mode's server backstop
-  // (`WAIT_LIMIT_MS` in wpt-server.js) sits between the two. Reaching *this* one means the
-  // runtime hung with nothing to report, so it is a hard kill.
+  // Per-test timeout for a serial run, scaled by --jobs. It has to stay above testharness.js's own
+  // test timeout and `WAIT_LIMIT_MS` in wpt-server.js, so that those fire first.
   timeout: 30000,
 };
 
@@ -275,12 +252,8 @@ function applyConfig(argv) {
     config.runtime = "target/wasm32-wasip2/debug/starling.wasm";
   }
 
-  // The native server answers one request at a time: `--serve-isolated` (which serveCommand
-  // passes, so each test does get its own global) has every request enter its own realm and hold
-  // it across awaits, which only works serialized. Sending more in flight than it will serve just
-  // queues them inside the server while inflating the per-test budget, which scales with --jobs.
-  // The wasm server needs none of this: `wasmtime serve` is told to retire each instance after a
-  // single request, so its tests are isolated even in flight.
+  // The native server runs each request in its own realm with `--serve-isolated`, which only works
+  // with one request at a time. The wasm server uses one instance per request instead.
   if (config.mode === "serve" && config.target !== "wasm" && config.jobs !== 1) {
     if (config.logLevel > LogLevel.Quiet) {
       console.log("The native serve-mode server is serial; running tests one at a time.");
@@ -288,9 +261,8 @@ function applyConfig(argv) {
     config.jobs = 1;
   }
 
-  // The permissive dimension records one `permissive_status` override per
-  // subtest, with no per-target variant of it, because the fetch code the switch
-  // gates is shared between the targets, so the native run covers both.
+  // The restrictions are implemented in fetch code both targets share, so there is no
+  // per-target `permissive_status`.
   if (config.permissive && config.target === "wasm") {
     console.error("--permissive runs are native-only; drop --target=wasm.");
     return false;
@@ -353,17 +325,6 @@ function getBaseHarness() {
   return cachedBaseHarness;
 }
 
-/**
- * Assemble the complete test script for a given WPT test path.
- *
- * The assembled script:
- * 1. Runs the base harness (pre-harness + testharness.js + post-harness)
- *    in the global scope (via legacy script mode).
- * 2. Uses evalScript() for each META: script= dependency.
- * 3. Uses evalScript() for the test source itself.
- * 4. Calls done() to trigger the completion callback.
- */
-
 // Legacy WPT path aliases. The WPT HTTP server handles some redirects that
 // aren't present when loading files directly from disk.
 const WPT_PATH_ALIASES = {
@@ -374,16 +335,15 @@ const WPT_PATH_ALIASES = {
 // wptserve `{{...}}` template substitution
 // ---------------------------------------------------------------------------
 //
-// The WPT server fills `{{host}}`-style placeholders into any `.sub.` file it
-// serves. This harness loads files from disk, so without doing the same here,
-// scripts like get-host-info.sub.js hand tests literal `{{host}}` strings.
-//
-// The values must describe the server the NET tests talk to. Host and domains
-// are wptserve defaults; the ports come from wpt-server-config.json, which
-// ensureWptServer passes to `wpt serve`.
+// The WPT server fills `{{host}}`-style placeholders into the `.sub.` files it
+// serves. This harness loads files from disk, so it substitutes them itself,
+// with the values of the server the NET tests talk to: wptserve's default hosts,
+// and the ports of wpt-server-config.json, which ensureWptServer passes to
+// `wpt serve`.
 const WPT_HOST = "web-platform.test";
 const WPT_ALT_HOST = "not-web-platform.test";
-const WPT_PORTS = { http: [8000, 8001], https: [8443, 8444] };
+const WPT_SERVER_CONFIG = relativePath("wpt-server-config.json");
+const WPT_PORTS = JSON.parse(readFileSync(WPT_SERVER_CONFIG, "utf-8")).ports;
 
 function isSubstitutedPath(filePath) {
   return path.basename(filePath).includes(".sub.");
@@ -399,11 +359,13 @@ function substituteWptTemplates(source) {
       domain(WPT_ALT_HOST, sub),
     )
     .replace(
-      // Unknown scheme/index (e.g. `{{ports[ws][0]}}`) is left as-is rather
-      // than guessed at: a placeholder that survives is an obvious failure,
-      // a wrong port number a baffling one.
+      // A port the config doesn't list as a number, such as wptserve's "auto", is left as a
+      // placeholder.
       /\{\{ports\[(\w+)\]\[(\d+)\]\}\}/g,
-      (match, scheme, index) => WPT_PORTS[scheme]?.[index]?.toString() ?? match,
+      (match, scheme, index) => {
+        const port = WPT_PORTS[scheme]?.[index];
+        return Number.isInteger(port) ? String(port) : match;
+      },
     );
 }
 
@@ -428,16 +390,13 @@ function assembleTestScript(testPath) {
   script += getBaseHarness();
 
   // If the test uses idl_test(), inject a minimal fetch polyfill that serves
-  // IDL files from the WPT /interfaces/ directory on disk. This avoids
-  // needing a real fetch() implementation or WPT HTTP server.
-  const idlTestMatch = testSource.match(/idl_test\(\s*\[([^\]]*)\]/);
+  // the IDL files of its first two arguments from the WPT /interfaces/ directory.
+  const idlTestMatch = testSource.match(/idl_test\(\s*\[([^\]]*)\](?:\s*,\s*\[([^\]]*)\])?/);
   if (idlTestMatch) {
-    const idlSpecs = idlTestMatch[1]
-      .split(",")
+    const idlSpecs = [idlTestMatch[1], idlTestMatch[2] ?? ""]
+      .flatMap((list) => list.split(","))
       .map((s) => s.trim().replace(/^['"]|['"]$/g, ""))
       .filter(Boolean);
-
-    // Pre-read all referenced IDL files and build a fetch polyfill.
     const idlMap = {};
     for (const spec of idlSpecs) {
       const idlPath = path.join(config.wptRoot, "interfaces", spec + ".idl");
@@ -446,26 +405,6 @@ function assembleTestScript(testPath) {
       }
     }
 
-    // Also check for dependency IDL specs (second argument to idl_test).
-    const depsMatch = testSource.match(
-      /idl_test\(\s*\[[^\]]*\]\s*,\s*\[([^\]]*)\]/,
-    );
-    if (depsMatch) {
-      const depSpecs = depsMatch[1]
-        .split(",")
-        .map((s) => s.trim().replace(/^['"]|['"]$/g, ""))
-        .filter(Boolean);
-      for (const spec of depSpecs) {
-        const idlPath = path.join(config.wptRoot, "interfaces", spec + ".idl");
-        if (existsSync(idlPath)) {
-          idlMap["/interfaces/" + spec + ".idl"] = readFileSync(
-            idlPath,
-            "utf-8",
-          );
-        }
-      }
-    }
-
     if (Object.keys(idlMap).length > 0) {
       script += `// Minimal fetch polyfill for idl_test — serves pre-inlined IDL files.\n`;
       script += `globalThis.__wpt_idl_files = ${JSON.stringify(idlMap)};\n`;
@@ -598,24 +537,10 @@ function readExpectationsFile(testPath) {
   }
 }
 
-// The expectations for the configuration being run, from one file shared by
-// all of them.
-//
-// A subtest is stored as `{"status": "PASS"}` when every configuration agrees,
-// and gains override fields where one does not:
-//
-//     "some subtest": { "status": "PASS", "wasm_status": "FAIL" }
-//     "another":      { "status": "FAIL", "permissive_status": "PASS" }
-//
-// `status` is the native enforced-mode status and the default; `wasm_status`
-// overrides it on the wasm target, and `permissive_status` overrides it when
-// the request restrictions are disabled (`--permissive`). Keeping all of them
-// in one file means a subtest that behaves the same everywhere — the
-// overwhelming majority — is still written once.
-//
-// An entry with no status for this configuration (say, a `wasm_status`-only
-// entry seen on native) is dropped, so the subtest reads as having no
-// expectation rather than as an expectation that can never be met.
+// The expectations for the configuration being run. `wasm_status` overrides
+// `status` on the wasm target, and `permissive_status` with `--permissive`. An
+// entry with no status for this configuration (say, a `wasm_status`-only entry
+// seen on native) is dropped, so the subtest has no expectation.
 function getExpectedResults(testPath) {
   const raw = readExpectationsFile(testPath);
   const expectations = {};
@@ -632,23 +557,18 @@ function getExpectedResults(testPath) {
 }
 
 // Fold this run's results into the stored expectations, touching only the
-// field for the configuration that ran. Running on wasm or permissive must not
-// overwrite the native enforced statuses, and vice versa, so that updating one
-// configuration never silently invents results for another.
+// field for the configuration that ran.
 function mergeExpectations(previous, results) {
   const field = runStatusField();
   const merged = {};
   for (const result of results) {
     const prev = previous[result.name] ?? {};
     const observed = result.status === 0 ? "PASS" : "FAIL";
-    // Preserve a FLAKY marker: it records a deliberate known-intermittent
-    // subtest, not the outcome of any single run.
+    // A FLAKY marker is kept.
     const keep = (stored) => (stored === "FLAKY" ? "FLAKY" : undefined);
 
     const values = { ...prev, [field]: keep(prev[field]) ?? observed };
-    // Only record an override where it actually differs from the baseline, so
-    // the file does not fill up with redundant duplicates. (After a baseline
-    // run this also drops overrides the new baseline has caught up with.)
+    // An override is recorded only where it differs from the baseline.
     for (const override of [WASM_STATUS, PERMISSIVE_STATUS]) {
       if (values[override] !== undefined && values[override] === values.status) {
         delete values[override];
@@ -660,8 +580,7 @@ function mergeExpectations(previous, results) {
     }
     merged[result.name] = entry;
   }
-  // Carry over what the *other* configurations recorded for subtests this run
-  // did not observe, dropping only this run's own stale field.
+  // Subtests this run did not observe keep the other configurations' fields.
   for (const [name, prev] of Object.entries(previous)) {
     if (merged[name]) continue;
     const entry = {};
@@ -675,37 +594,20 @@ function mergeExpectations(previous, results) {
   return merged;
 }
 
-// Codegen options passed to both `wasmtime compile` and `wasmtime run`; a
-// precompiled artifact is only loadable by a runtime configured the same way.
+// Codegen options passed to both `wasmtime compile` and `wasmtime run`, since a
+// precompiled artifact only loads in a runtime configured the same way.
 //
-// Native unwind information is off because registering and — far worse —
-// deregistering it dominates every wasm test. A sample of the wasmtime process
-// during a trivial run puts essentially all of the ~1.1s of host time in
-// `CodeMemory::drop` calling `__deregister_frame`, whose macOS implementation
-// walks the registered frames linearly; with a module this size that is
-// quadratic and swamps everything else. The runtime module is ~120MB with a
-// correspondingly huge function count, so it hits this hard: dropping the
-// unwind tables takes a wasm test from ~1.4s to ~0.35s.
-//
-// What it costs: native profilers and debuggers can no longer unwind through
-// wasm frames. Guest-level diagnostics are unaffected — JS exceptions and their
-// stacks come from SpiderMonkey, and wasm traps from wasmtime's own frame
-// information — so error reporting in the harness is unchanged.
+// Native unwind information is off because deregistering it on macOS is
+// quadratic in the function count: with it, a wasm test took ~1.4s instead of
+// ~0.35s. Native profilers and debuggers then can't unwind through wasm frames.
 const WASMTIME_CODEGEN_FLAGS = ["-C", "native-unwind-info=n"];
 
 // The WASI capabilities the runtime needs: environment (its configuration arrives there in serve
 // mode), and the network/HTTP stack the `fetch` tests exercise.
-const WASI_FLAGS = "inherit-env=y,inherit-network=y,http=y,tcp=y,udp=y,p3=y";
+const WASI_FLAGS = "inherit-env=y,inherit-network=y,http=y,tcp=y,udp=y";
 
-// Pre-initialize the wasm runtime with Wizer, baking the serve-mode WPT harness and its
-// configuration into the snapshot.
-//
-// This is the configuration a deployed server has: the engine is initialized and the content
-// script evaluated at build time, so serving a request does neither. It matters most exactly here,
-// because this harness retires each instance after one request (see `serveCommand`).
-//
-// Rebuilt whenever the runtime or the baked configuration changes, on the same stamp scheme the
-// precompiled artifact uses.
+// Pre-initialize the wasm runtime with Wizer, with the serve-mode WPT harness and its
+// configuration in the snapshot. Rebuilt whenever the runtime or the configuration changes.
 function ensureWizenedRuntime() {
   if (config.target !== "wasm" || config.mode !== "serve" || !config.wizen) return null;
 
@@ -729,10 +631,8 @@ function ensureWizenedRuntime() {
       [
         "wizer",
         `-S${WASI_FLAGS},cli=y`,
-        "-Wcomponent-model-async=y",
-        // The component's `wizer-initialize` export is declared by a world of its own, so the
-        // component type still names it after the snapshot. Dropping the core function (the
-        // default) would leave that declaration dangling and the component unloadable.
+        // The component type still declares `wizer-initialize` after the snapshot, so dropping the
+        // core function would make the component unloadable.
         "--keep-init-func=true",
         "--dir=.::/",
         "--env",
@@ -746,22 +646,14 @@ function ensureWizenedRuntime() {
     writeFileSync(stamp, want);
     return output;
   } catch (e) {
-    console.warn(`  Wizening failed, serving the un-snapshotted runtime: ${e.message}`);
+    console.warn(`  Wizening failed, serving the un-wizened runtime: ${e.message}`);
     return null;
   }
 }
 
-// Compile the wasm runtime ahead of time, once, and run the tests against the
-// result.
-//
-// Roughly a fifth of each wasm test's wall clock is wasmtime compiling the
-// runtime module — it is ~120 MB, and the compilation is not cached between
-// processes, so every test paid for it again. Compiling once up front and
-// passing `--allow-precompiled` moves that cost from per-test to per-run.
-//
-// The artifact is tied to both the runtime build and the wasmtime version, so
-// it is rebuilt whenever either is newer than it. On any failure we fall back
-// to running the module directly rather than failing the run.
+// Compile the wasm runtime ahead of time, once per runtime build and wasmtime
+// version, and run the tests against the result. On failure, the tests run the
+// module directly.
 function ensurePrecompiledRuntime() {
   if (config.target !== "wasm" || !config.usePrecompiled) return null;
 
@@ -791,8 +683,6 @@ function ensurePrecompiledRuntime() {
       [
         "compile",
         ...WASMTIME_CODEGEN_FLAGS,
-        "-W",
-        "component-model-async=y",
         runtime,
         "-o",
         output,
@@ -807,9 +697,8 @@ function ensurePrecompiledRuntime() {
   }
 }
 
-/// Spawn `command`, collecting stdout/stderr, with the same timeout and
-/// output-cap semantics `spawnSync` gave us — but without blocking the loop, so
-/// several tests can be in flight at once.
+/// Spawn `command`, collecting stdout and stderr, and kill it after `timeout` ms
+/// or once stdout exceeds `maxBuffer` bytes.
 function spawnCollecting(command, args, { timeout, maxBuffer }) {
   return new Promise((resolve) => {
     let child;
@@ -819,11 +708,7 @@ function spawnCollecting(command, args, { timeout, maxBuffer }) {
       resolve({ error: e, stdout: "", stderr: "" });
       return;
     }
-    // Collect raw chunks and decode once at the end. Decoding each chunk as it
-    // arrives corrupts any multi-byte UTF-8 sequence that straddles a chunk
-    // boundary, turning it into replacement characters — which shows up as a
-    // subtest whose name no longer matches its expectation, and only
-    // intermittently, since where the boundaries fall depends on timing.
+    // Decoded once at the end, since a chunk can end inside a UTF-8 sequence.
     const stdoutChunks = [];
     const stderrChunks = [];
     let stdoutBytes = 0;
@@ -868,21 +753,14 @@ function runScriptPath(testPath) {
   );
 }
 
-/// The runtime flags that carry the run's restriction dimension. Every mode that starts a runtime
-/// has to pass these: expectation lookup switches to `permissive_status` on `--permissive`, so a
-/// mode that silently kept the restrictions on would check permissive expectations against a
-/// restricted runtime — and `--update-expectations` would then write those results into the
-/// `permissive_status` fields, corrupting them for the runs that do disable the restrictions.
+/// The runtime flags for `--permissive`, which every mode that starts a runtime passes.
 function restrictionFlags() {
-  return config.permissive ? ["--enforce-fetch-restrictions=false"] : [];
+  return config.permissive ? ["--web-security-restrictions=false"] : [];
 }
 
-// Build the command that runs `scriptFile` as a one-shot command: the runtime binary directly on
-// native, and the same component under `wasmtime run` on wasm — the component exports
-// `wasi:cli/run` alongside `wasi:http/handler`, so this is the very binary serve mode uses.
-//
-// `optimized` selects the flags a measured run uses (ahead-of-time compiled runtime, no native
-// unwind information); `reproLine` turns it off so the command it prints stays runnable by hand.
+// Build the command that runs `scriptFile` as a one-shot command: the runtime binary on native,
+// and the component under `wasmtime run` on wasm. `optimized` adds the precompiled runtime and the
+// codegen flags, which `reproLine` leaves out.
 function testCommand(scriptFile, { optimized = true } = {}) {
   const runtimeArgs = [
     "--legacy-script",
@@ -907,7 +785,6 @@ function testCommand(scriptFile, { optimized = true } = {}) {
       "--dir=.",
       "--dir=/tmp",
       `-S${WASI_FLAGS}`,
-      "-Wcomponent-model-async=y",
       precompiled ?? config.runtime,
       ...runtimeArgs.slice(0, -1),
       wasiPath,
@@ -918,18 +795,8 @@ function testCommand(scriptFile, { optimized = true } = {}) {
 async function runSingleTest(testPath) {
   const script = assembleTestScript(testPath);
 
-  // Write the assembled script to a temp file of its own.
-  //
-  // The name carries the target and the test, which is what keeps tests in flight within a run
-  // — and a wasm suite alongside a native spot-check — from overwriting each other's script
-  // between the write and the spawn and reporting one test's results under another's name.
-  //
-  // These files are deliberately left behind, so the "To reproduce" command printed for a
-  // failure stays runnable. Naming them by target and test alone bounds that to one file per
-  // test per target, which the directory can carry indefinitely. The name used to carry the
-  // pid as well, isolating concurrent runs of the same target; that made the directory grow
-  // without limit for a case where both runs write the same bytes anyway — the script is a
-  // pure function of the test path and the WPT checkout.
+  // The script file is named by target and test, so concurrent tests and runs of the other target
+  // don't overwrite it. It is left behind for the "To reproduce" command.
   mkdirSync(config.tmpDir, { recursive: true });
   const tmpFile = runScriptPath(testPath);
   writeFileSync(tmpFile, script);
@@ -942,17 +809,12 @@ async function runSingleTest(testPath) {
   try {
 
     const result = await spawnCollecting(command, args, {
-      // A test's wall clock includes time spent waiting for a core, so with N
-      // tests in flight the budget has to grow with N or the slowest legitimate
-      // tests start timing out purely from contention. `--timeout` is therefore
-      // the budget for a serial run; the limit scales from there. The point of
-      // the timeout is to catch a hang, which no amount of contention explains.
+      // A test's wall clock includes waiting for a core, so the budget grows with --jobs.
       timeout: config.timeout * Math.max(1, config.jobs),
       maxBuffer: 10 * 1024 * 1024,
     });
 
-    const stdout = result.stdout || "";
-    const stderr = result.stderr || "";
+    const { stdout, stderr } = result;
 
     if (result.error) {
       return { error: result.error, stdout, stderr };
@@ -964,10 +826,8 @@ async function runSingleTest(testPath) {
       return { error: new Error(reason), stdout, stderr };
     }
 
-    // Parse results from stdout — look for the WPT_RESULTS_JSON marker.
     const marker = "WPT_RESULTS_JSON:";
-    const lines = stdout.split("\n");
-    for (const line of lines) {
+    for (const line of stdout.split("\n")) {
       if (line.startsWith(marker)) {
         return { results: JSON.parse(line.slice(marker.length)), stdout, stderr };
       }
@@ -980,13 +840,8 @@ async function runSingleTest(testPath) {
 }
 
 // Run `testPaths` with up to `config.jobs` in flight, handing each result to
-// `report` strictly in test order.
-//
-// Ordering matters more than it looks: `report` prints, accumulates the totals
-// and rewrites expectation files, so letting it run in completion order would
-// make both the output and `--update-expectations` depend on which test
-// happened to finish first. Only the spawning is concurrent; everything that
-// has an effect stays sequential and deterministic.
+// `report` in test order, so the output and the expectation updates don't
+// depend on which test finished first.
 async function runTestsConcurrently(testPaths, report) {
   const jobs = Math.max(1, config.jobs);
   const outcomes = new Array(testPaths.length);
@@ -1003,9 +858,7 @@ async function runTestsConcurrently(testPaths, report) {
         outcomes[index] = { ...outcome, duration: Date.now() - started };
       })();
       running.add(task);
-      task.finally(
-        () => running.delete(task),
-      );
+      task.finally(() => running.delete(task));
     }
 
     if (outcomes[nextToReport] === undefined) {
@@ -1038,12 +891,8 @@ function pad(v, n) {
 // Serve mode (`--mode=serve`): one runtime server, one request per test
 // ---------------------------------------------------------------------------
 //
-// The runtime runs `wpt-server.js` as its content script, which registers a `fetch` handler that
-// evaluates the assembled test script a request carries and answers with its results. Nothing
-// here is WPT-specific on the runtime side: it is the ordinary serve path, which is the point —
-// this exercises the tests inside a request handler, the configuration that ships.
-//
-// The same component provides command mode's `wasi:cli/run`, so both modes run the one binary.
+// The runtime runs `wpt-server.js` as its content script, whose `fetch` handler evaluates the
+// assembled test script in the request body and responds with its results.
 
 const SERVE_HOST = "127.0.0.1";
 let serveUrl = null;
@@ -1064,9 +913,7 @@ function serveCommand() {
         "--serve",
         String(config.servePort),
         "--wpt-mode",
-        // Each request in its own global, so one test's top-level declarations are not still
-        // there for the next. Without it tests collide and the run is simply wrong; the wasm
-        // server asks its host for the same property with `--max-instance-reuse-count` below.
+        // Each request in its own global, so tests don't see each other's declarations.
         "--serve-isolated",
         "--legacy-script",
         ...restrictionFlags(),
@@ -1075,12 +922,8 @@ function serveCommand() {
       ready: /serving on (http:\/\/[\d.]+:\d+)/,
     };
   }
-  // `wasmtime serve` passes the guest no arguments, so the runtime's configuration goes through
-  // the environment — except on a wizened runtime, which already holds an initialized engine with
-  // the harness evaluated, and so needs neither the configuration nor the script.
-  //
-  // No `restrictionFlags()` here: `--permissive` runs are native-only (applyConfig rejects the
-  // combination), and a wizened runtime takes no configuration at all to carry them in.
+  // `wasmtime serve` passes the guest no arguments, so the configuration goes through the
+  // environment, unless the wizened runtime already has it. `--permissive` is native-only.
   const precompiled = config.precompiled;
   const wizened = config.wizened !== null;
   return {
@@ -1093,16 +936,14 @@ function serveCommand() {
       "--dir=.",
       "--dir=/tmp",
       `-S${WASI_FLAGS},cli=y`,
-      "-Wcomponent-model-async=y",
       ...(wizened
         ? []
         : [
             "--env",
             `STARLINGMONKEY_CONFIG=--wpt-mode --legacy-script ${guestServerScript()}`,
           ]),
-      // One request per instance, so each test gets a fresh global — what a fresh process gives
-      // command mode. WASIp3 components default to 128 requests per instance, so this is load
-      // bearing, and it holds under concurrency: an instance is retired after its one request.
+      // One request per instance, so each test gets a fresh global. WASIp3 components default to
+      // 128 requests per instance.
       "--max-instance-reuse-count",
       "1",
       "--addr",
@@ -1126,8 +967,7 @@ function startServer() {
       () => reject(new Error(`serve-mode runtime did not start within 60s. Output:\n${output}`)),
       60000,
     );
-    // The readiness line goes to stderr for both runtimes; watch stdout too, so a runtime that
-    // logs it elsewhere still starts rather than hanging until the timeout.
+    // Both runtimes print the readiness line to stderr. stdout is watched too.
     const watch = (chunk) => {
       output += chunk.toString();
       const match = output.match(ready);
@@ -1215,10 +1055,8 @@ function isWptPortReachable(port) {
 }
 
 /**
- * Every HTTP port in `WPT_PORTS` must answer, not just the first: those are the
- * ports `substituteWptTemplates` bakes into `.sub.` tests, and a server missing
- * one still serves everything else. Short-circuits, so the usual case costs a
- * single probe.
+ * Whether a server responds on every HTTP port in `WPT_PORTS`, since `.sub.`
+ * tests use all of them.
  */
 function isWptServerReachable() {
   return WPT_PORTS.http.every(port => isWptPortReachable(port));
@@ -1243,16 +1081,13 @@ async function ensureWptServer() {
     return;
   }
 
-  // An external server holding the first port but not the rest is reported rather
-  // than used: it cannot be replaced (the port is taken) and its failures are
-  // indistinguishable from test regressions — `.sub.` tests substituting an
-  // unserved port fail with a bare connection error.
+  // An external server on the first port that doesn't serve the others fails the run.
   if (isWptPortReachable(WPT_PORTS.http[0])) {
     const missing = unreachableWptPorts();
     console.error(
       `A WPT server is running on ${WPT_HOST}:${WPT_PORTS.http[0]} but is not serving ` +
         `port(s) ${missing.join(", ")}, which '.sub.' tests are substituted to use.\n` +
-        `It was most likely started without '--config ${relativePath("wpt-server-config.json")}', ` +
+        `It was most likely started without '--config ${WPT_SERVER_CONFIG}', ` +
         `which pins the ports; without it wptserve picks the second HTTP port at random.\n` +
         `Stop it (e.g. 'pkill -f \"wpt serve\"') and re-run, to let this harness start its own.`,
     );
@@ -1262,12 +1097,10 @@ async function ensureWptServer() {
   if (config.logLevel > LogLevel.Quiet) {
     console.info(`Starting WPT server (cmd: ${config.wptRoot}/wpt serve)...`);
   }
-  // The config pins every port so that substituteWptTemplates' static table
-  // matches the running server; the default config picks the second HTTP port
-  // at random ("auto").
+  // The config pins every port, which wptserve's default config doesn't.
   managedWptServer = spawn(
     path.join(config.wptRoot, "wpt"),
-    ["serve", "--config", relativePath("wpt-server-config.json")],
+    ["serve", "--config", WPT_SERVER_CONFIG],
     {
       detached: true,
     },
@@ -1293,10 +1126,7 @@ async function ensureWptServer() {
       }
       return;
     }
-    let resolve;
-    let promise = new Promise((r) => (resolve = r));
-    setTimeout(() => {resolve();}, 1000);
-    await promise;
+    await new Promise((resolve) => setTimeout(resolve, 1000));
   }
   const missing = unreachableWptPorts();
   stopWptServer();
@@ -1396,8 +1226,7 @@ async function run() {
         if (config.logLevel > LogLevel.Quiet) {
           lines.push(runtimeOutputBlocks(stdout, stderr));
         } else if (stdout || stderr) {
-          // Show the tail rather than the head: WPT_RESULTS_JSON would be at the
-          // end on success, and crash diagnostics from stderr are appended last.
+          // The tail, which has the crash diagnostics from stderr.
           const output = stdout + (stderr ? "\n--- stderr ---\n" + stderr : "");
           const limit = 30;
           const outputLines = output.trim().split("\n");
@@ -1442,9 +1271,7 @@ async function run() {
         stats.pass++;
       }
 
-      // A FLAKY expectation marks a known-intermittent subtest (e.g. one that
-      // depends on connection-reuse timing against a non-compliant server):
-      // both outcomes are tolerated, so neither is reported as unexpected.
+      // A FLAKY subtest's result is not compared.
       if (expectation && expectation.status === "FLAKY") {
         continue;
       }
@@ -1487,8 +1314,7 @@ async function run() {
       if (config.tests.updateExpectations) {
         const expectPath = expectationsPath(testPath);
         lines.push(`  Writing expectations to ${expectPath}`);
-        // Merge against the file as stored, not against `expectations` (which has
-        // already been narrowed to this target), so the other target's statuses survive.
+        // Merged with the file as stored, so the other configurations' statuses stay.
         const newExpectations = mergeExpectations(
           readExpectationsFile(testPath),
           results,
@@ -1509,18 +1335,12 @@ async function run() {
     emit();
   });
 
-  // Stop a server this run started, explicitly rather than from the "exit"
-  // handler: its open stdout/stderr pipes hold the event loop open, so node
-  // never begins exiting on its own and the handler never runs. (The failure
-  // paths below force the issue with process.exit, but a fully green run
-  // would hang here.)
+  // The servers' open pipes keep the event loop alive, so they are stopped here
+  // rather than only from the "exit" handler.
   stopWptServer();
   stopServer();
 
-  // Report the suite's wall-clock time, not the sum of the per-test durations:
-  // with tests running concurrently that sum exceeds the elapsed time, and it
-  // grows as concurrency rises because each test's own duration absorbs the
-  // contention. The per-test figures above stay as measured.
+  // The suite's wall-clock time, since concurrent tests' durations overlap.
   totalStats.duration = Date.now() - suiteStart;
   console.log(
     `\n${"Done. Stats:".padEnd(pathLength)} ${formatStats(totalStats)}`,
@@ -1542,9 +1362,7 @@ async function run() {
 
 run();
 
-/// The full output the runtime produced, as fenced blocks per stream. Printed
-/// for unexpected results when the log level asks for it, so a CI log carries
-/// enough to diagnose a result that doesn't reproduce locally.
+/// The full output the runtime produced, as fenced blocks per stream.
 function runtimeOutputBlocks(stdout, stderr) {
   const block = (name, contents) =>
     `StarlingMonkey ${name}:\n=====\n${contents ? stripTrailingNewline(contents) + "\n" : ""}=====`;
@@ -1556,9 +1374,6 @@ function reproLine(testPath) {
     // Needs a serve-mode runtime running; `just wpt-test-*-serve` starts one.
     return `  To reproduce, run $ curl --data-binary @${runScriptPath(testPath)} ${serveUrl ?? `http://${SERVE_HOST}:${config.servePort}`}`;
   }
-  // Name the script the run actually used. Its name is stable across runs, so it
-  // stays valid in a command someone runs later; it used to carry a pid, which is
-  // why this once had to copy it to a stable name of its own first.
   const { command, args } = testCommand(runScriptPath(testPath), {
     optimized: false,
   });
diff --git a/tests/wpt-harness/wpt-server.js b/tests/wpt-harness/wpt-server.js
index 24fc9ce7..3b2a6394 100644
--- a/tests/wpt-harness/wpt-server.js
+++ b/tests/wpt-harness/wpt-server.js
@@ -1,19 +1,11 @@
 // SPDX-License-Identifier: Apache-2.0-WITH-LLVM-exception
 //
 // The serve-mode WPT runner: the content script the runtime runs under `--serve --wpt-mode`.
+// Each request's body is one assembled test script (harness and test), which this evaluates, and
+// the response is the JSON results.
 //
-// Each request carries one assembled test script (harness + test) in its body; this evaluates it
-// and answers with the JSON results. That puts the tests through the configuration that matters
-// most — running inside a request handler, and on wasm against a wizened component — rather than
-// through a one-shot command.
-//
-// There is no host-side WPT entry point: this is an ordinary `fetch` handler, so the same binary
-// and the same code path serve it as serve any other request.
-//
-// Everything lives inside this IIFE because the tests are evaluated into *this* global. A bare
-// top-level declaration here would be a global that a test can collide with — and testharness.js
-// really does collide: it exposes a global `timeout()` that forces the harness to time out. A
-// local `timeout` here shadowed by that one silently timed out every async test.
+// Everything is inside this IIFE because the tests are evaluated into this global, and
+// top-level declarations here would collide with theirs, such as testharness.js's `timeout()`.
 (() => {
   addEventListener("fetch", (event) => {
     event.respondWith(runTest(event.request));
@@ -21,26 +13,16 @@
 
   const TIMED_OUT = Symbol("timed out");
 
-  /// Bound the wait for a test that never reports, as the middle of three nested limits:
-  /// testharness.js times a normal test out internally at 10s and reports per-subtest TIMEOUT
-  /// statuses, and the runner's own per-test budget (`config.timeout`, 30s serial) is the outer
-  /// kill. Sitting between them, this backstop only fires for a test that testharness itself could
-  /// not finish — reporting it as a server error, and releasing the slot, before the runner gives
-  /// up on the request. Undercutting testharness's 10s would instead turn every slow-but-reporting
-  /// test into a 500 that command mode records real results for.
+  /// The wait for a test's results. It is longer than testharness.js's own 10s test timeout, and
+  /// shorter than the runner's per-test timeout.
   const WAIT_LIMIT_MS = 20000;
 
   /// Evaluate one assembled test script and resolve with its results.
   async function runTest(request) {
     const script = await request.text();
 
-    // One test at a time per global. testharness.js keeps its state (the test list, the completion
-    // callbacks) on the global, as does the results hook below, so two tests running concurrently
-    // in one global would interleave into nonsense — each delivering the other's results.
-    //
-    // Hosts that hand every request a fresh instance never reach this: their globals are unshared.
-    // Where the global *is* shared (the native server), the runner sends tests one at a time. This
-    // guard makes a violation of that a clear error rather than a silent hang.
+    // testharness.js and the results hook below keep their state on the global, so only one test
+    // can run in it at a time.
     if (globalThis.__wptRunning) {
       return errorResponse(
         new Error(
@@ -51,14 +33,8 @@
     }
     globalThis.__wptRunning = true;
 
-    // post-harness.js hands the results to `__wptReportResults` from the testharness completion
-    // callback. Install this mode's sink before evaluating: a synchronous test completes during
-    // `evalScript` below, so the hook has to already be there — and pre-harness.js only falls back
-    // to command mode's sink when it finds none.
-    //
-    // Resolving the pending response is all it does. Stopping the event loop, which command mode's
-    // sink does here, would end the very work that produces that response; this mode stops the loop
-    // in the `finally` below instead, once the response exists.
+    // post-harness.js passes the results to `__wptReportResults`. It is installed before
+    // evaluating, since a synchronous test completes during `evalScript`.
     let deliver;
     const results = new Promise((resolve) => {
       deliver = resolve;
@@ -68,8 +44,7 @@
     try {
       try {
         // `evalScript` (a --wpt-mode global) evaluates in non-syntactic scope, so the script's
-        // top-level `let`/`const` are visible to the `evalScript` calls it makes for its own META
-        // dependencies — the semantics `<script>` tags have, which the harness relies on.
+        // top-level `let`/`const` are visible to the `evalScript` calls of its META dependencies.
         evalScript(script, "wpt-test");
       } catch (e) {
         // A top-level throw means the harness never reached `done()`, so `results` never settles.
@@ -79,10 +54,7 @@
       // An async test finishes after `evalScript` returns, so wait for the completion callback.
       const limit = waitLimit();
       const json = await Promise.race([results, limit.reached]);
-      // Cancel the limit once the test has reported. Left running it keeps this request's event
-      // loop alive for the rest of its wait — which the runtime dutifully drains after the
-      // response, holding the request's slot and, on a server handling one request at a time,
-      // stalling the next one for exactly that long.
+      // A pending limit would keep this request's event loop alive after the response.
       limit.cancel();
       if (json === TIMED_OUT) {
         return errorResponse(new Error("the test did not complete"));
@@ -91,21 +63,14 @@
         headers: { "content-type": "application/json" },
       });
     } finally {
-      // Always give the slot back. A test that never completes would otherwise hold it for the
-      // rest of the run, turning one hung test into a 503 for every test after it.
       globalThis.__wptRunning = false;
-      // Stop this request's event loop, now that its response is built. A finished WPT test may
-      // have left a live `setInterval` behind (`timers/clearinterval-from-callback` does), which
-      // keeps the loop alive indefinitely — the runtime drains it after responding, so the request
-      // never finishes and a server handling one at a time never accepts another. Command mode
-      // calls this from the completion callback for the same reason; here it has to wait until the
-      // response exists, since stopping the loop ends the work that produces it.
+      // Stop this request's event loop, now that its response is built. A finished test may have
+      // left a timer running, such as `timers/clearinterval-from-callback`'s `setInterval`.
       if (typeof __wptDone === "function") __wptDone();
     }
   }
 
-  /// The wait limit as a promise plus the means to call it off, so a test that reported in time
-  /// leaves nothing pending behind it.
+  /// A promise that resolves to `TIMED_OUT` after `WAIT_LIMIT_MS`, and the function that cancels it.
   function waitLimit() {
     let id;
     const reached = new Promise((resolve) => {
@@ -114,12 +79,9 @@
     return { reached, cancel: () => clearTimeout(id) };
   }
 
-  /// A test that threw before reporting results is a 500, matching what the command-mode runner
-  /// does with a runtime that exits without printing the results marker. Answering 200 with no
-  /// results would otherwise read as a zero-subtest pass.
+  /// A 500 response for a test that didn't report its results.
   function errorResponse(e) {
-    // A SpiderMonkey `stack` carries only frames, so report the message separately or a thrown
-    // SyntaxError arrives as an anonymous traceback.
+    // A SpiderMonkey `stack` has only the frames, so the name and message come first.
     let message;
     try {
       message = e instanceof Error ? `${e.name}: ${e.message}\n${e.stack}` : String(e);