Luau and core-WASM V2 extensions

The four default V2 Supported profiles share Grid's typed extension contract through its existing native compiled-model runtime. They transport exact values, expose the same reviewed host functions and use fresh guest state for each invocation. Guest syntax, standard libraries and fuel units differ. Supported means a maintained product contract; it does not claim Certified status on unmeasured platforms.

Default and legacy profiles

New Luau, C, Rust and AssemblyScript scaffolds select V2 by default. Existing V1 manifests and locks retain their profile; development, packaging and offline installation do not upgrade them. Use --profile to select V1 explicitly or V2 explicitly when creating a package:

gridctl extension profiles --json
gridctl extension new ./exact-luau --name publisher/exact-luau --language luau
gridctl extension new ./exact-c --name publisher/exact-c --language c
gridctl extension new ./exact-rust --name publisher/exact-rust --language rust
gridctl extension new ./exact-as --name publisher/exact-as --language assemblyscript

Use the installed toolchain and target required by each language guide. The normal development, typed fixture, lock, verification and offline installation commands apply. SDK installation accepts --profile; mismatched language/profile pairs and edited installed SDK files fail unless replacement is explicit. Discovery includes machine-readable capabilities and executable coverage from the central registry. A missing engine or required capability is an error. Native crates.io/vcpkg runners and native-C ABI profiles retain their separate execution contracts.

Exact Luau values

Luau V2 uses immutable grid.i64 values for exact signed integers. Construct large values from decimal strings. Arithmetic is checked; division is integer division. :compare, :tostring and :tonumber are explicit helpers. Conversion to an ordinary number accepts only the safe integer interval [-2^53, 2^53]; values outside that interval are rejected, including larger powers of two.

local maximum = grid.i64("9223372036854775807")
local previous = maximum - grid.i64("1")
local values = grid.array({grid.NULL, previous, grid.NULL}, 3)
assert(#values == 3)
assert(values[3] == grid.NULL)

grid.NULL represents a present blank value. An omitted object field remains absent. grid.array(items, length) preserves every null position and empty arrays, rejects holes and is immutable. V2 temporal values use exact signed integers. grid.u64 preserves unsigned metadata; handle revisions are exact unsigned values. Dense and Frame constructors accept exact unsigned metadata and validate the existing physical shape and buffer contract. Large metadata does not authorize impossible buffers or allocation beyond the invocation budget.

Bytes, complex values, nested objects/arrays, dense buffers and supported fixed, variable and dictionary Frame columns retain the GRDX representation. Handle values can pass through an invocation only when issued by the host; fabricating an ID, revision, kind or fingerprint cannot create authority. Existing depth, rank, field-count and element-count limits still apply.

These are typed extension boundary guarantees. Typed compiled-model locals and Frame edges retain their native carriers. Ordinary workbook cell publication supports its existing cell representations: it rejects bytes, duration, complex values, non-number Dense buffers, Frames, handles, and integers outside the exact ordinary-number range. Both engines fail rather than silently lose precision. Use admitted Frame edges for Frame results; V2 does not add new workbook cell types. V2 also rejects nested temporal, complex or buffer values in JSON-backed ordinary objects because that representation cannot preserve their types. Use typed compiled-model locals for rich-object results. Reviewed host helpers preserve exact integers, field presence and arrays inside JSON-capable objects; unsupported nested semantic types fail before the kernel runs. Frozen V1 object conversions retain their existing compatibility behavior.

C, Rust and AssemblyScript V2 SDKs provide recursive values, exact integer and metadata fields, seed helpers, Frame views and host request builders. Generated typed bindings derive their signatures from the package manifest. AssemblyScript uses a statically reserved, zero-initialized transfer arena in fresh guest memory. It does not allocate and fill that arena on every start. Its direct Frame view accepts both supported GRDX minor versions; canonical Frame messages retain their existing wire minor version.

Shared host functions

Luau keeps grid.call(name, ...), grid.fn(name) and grid.has(name). Core-WASM V2 imports grid:functions::call_v2 and has_v2. The versioned surface is grid:functions@2, independent of GRDX's wire version. Each profile binds its reviewed catalog fingerprint. CLI function discovery includes exclusion reasons.

call_v2(request_ptr, request_len, response_ptr, response_capacity, response_len_ptr) -> status accepts one GRDX object with function and arguments fields. has_v2(name_ptr, name_len) -> status queries that admitted catalog. Function names contain 1–128 ASCII letters, digits, underscores or dots and are normalized to uppercase. Valid-name discovery returns 1 when available and 0 when absent. Both discovery APIs return false/0 for invalid names, including empty, oversized and non-ASCII names. V2 borrows guest name bytes until validation and reserves canonical-name conversion buffers against the invocation allowance. SDK helpers construct the request and support bounded response retrieval. Call status 0 succeeds; a positive failure status retains a host diagnostic that fails the invocation after the guest returns. A short buffer returns -2 and the required length. Identical retries retrieve the retained response without executing again; a changed request fails until retrieval completes. The same rule applies to effect requests. This is an invocation-local transfer guarantee; durable retries and external idempotency retain the coordination layer's existing policies.

Both engines use the canonical native function registry in resident execution and workers. Eligibility requires lossless conversion, bounded allocation/output, accounted cost and cooperative execution. Precision-losing numeric conversion fails. Ambient workbook access, volatile functions, queued operations and arbitrary callbacks remain excluded. Unit and coercion behavior is explicit.

Resource control and admission

Defaults remain 50 million fuel units, five seconds, 64 MiB invocation memory and 16 MiB output. V2 accounts for guest memory and invocation-owned host buffers, including conversion and pending-response storage. Its stricter accounting can reject a workload that passed V1. Compilation/preparation memory is measured separately; these limits are not native compiler heap or process RSS ceilings. Luau reports combined host reservations and guest memory sampled at interrupt and conversion boundaries; that reported high-water mark is not an allocator trace or a measured RSS peak. Wasmtime reservations cover guest linear memory and owned transfer buffers, not every opaque native Store allocation.

One monotonic deadline and sticky terminal control span preparation waits, guest execution, conversions, host functions and capability calls. Wasmtime reconciles guest fuel at host boundaries; Luau charges interrupts in blocks of 1,000 units plus host/conversion work. Recursive wire conversions and large Frame offset/index validation poll the shared control in blocks of 1,024 items. Instruction units are engine-specific. Cancellation, fuel exhaustion or allocator exhaustion prevents publication even when a guest catches an error or resumes a coroutine. External capability implementations must honor the supplied control for prompt interruption.

Package/model admission freezes policy, verified binding and host catalog. Explicit readmission or activation refreshes them. Foreground V2 operations reserve the existing execution pool's admitted memory without recursive waits; the conservative lane admits one operation that can fan out across that pool. Saturation is a retryable admission error. The explicitly launched worker keeps its default concurrency of four, claims available slots and commits independent results as they finish while preserving same-owner ordering and fencing. The worker checks cancellation and lease ownership on its existing tick, and runs the coordination layer's existing expired-lease reaper at most once per second so a standalone restarted worker can reclaim abandoned jobs. No additional timer thread is created.

Durable coordination envelopes, WAL buffers and queue storage are control-plane memory, separate from invocation-owned guest/conversion reservations. Aggregate guest admission is not a hard process RSS bound. Large durable payloads still incur the coordination layer's JSON envelope costs.

Preparation and caching

Verified Luau source becomes host-generated bytecode once per prepared artifact. A bounded engine-owned cache shares immutable trusted prelude bytecode; native custody reserves its full capacity. Wasmtime retains compiled modules. Every call still creates fresh guest state. Preparation is single-flight with at most two concurrent preparations. The LRU defaults to 64 artifacts and 256 MiB accounted retention; oversized artifacts run uncached. Active invocation pins are reported separately and survive eviction. Wasmtime accounts its published native image range plus a conservative metadata allowance of 512 times portable module bytes, 64 KiB fixed metadata and up to two cleared 64 KiB host scratch buffers. This allowance is a retention estimate, not an exact measurement of opaque engine heap memory. Oversized scratch buffers are discarded. Accounting is distinct from measured RSS.

Disabled result caching skips key encoding/hashing. Existing direct Frame paths, admitted dirty slices and window halos remain available with the exact whole-call fallback. Admitted dirty calls reuse the binding verification and share one control across planning, slices and merging. Dense replacement buffers are reserved before allocation. Resident Frame chunks reuse a structurally equal, already validated schema while still checking every physical column/buffer. Mutable guest sessions are a separate follow-on.

Evidence limits

The native reference corpus checks typed results through engines, resident compiled models and worker calls. Actual C/Rust/AssemblyScript guest compilation has separate local Testing receipts. Performance and endurance QA remain independent of product operations. Completed local acceptance evidence, platform certification limits and the Supported/default promotion review of the default/V1 lifecycle, supply chain and additional validation are recorded separately.

The 2026-10-15 macOS closeout records the resumed validation on the available Apple M4 Mac, exact Wasmtime 49.0.3 security fix, matching Core/CLI Luau versions, real V2/V1 authoring lifecycles, physical Frame throughput and an hour of concurrent execution and worker recovery. V2 remains Supported and the default for new extensions; Windows/Linux and packaged-product certification are not inferred from this local scope. Existing portable V1 packages remain compatible. Engine-native AOT caches must be regenerated when the Wasmtime version changes.