wasm-gui: Root-1 course-correction — typed-func-refs is WRONG; fix = fpcast arity tuning + marshallers

A deep feasibility research agent (read the toolchain + V8 runtime) proved the user-named "typed-function-references"
does NOT fix the ~13.4s GObject cascade: call_ref type-checks exactly like call_indirect, so a GObject UB cast
mismatch still traps -- typed-func-refs/GC cannot run the mismatched calls faster. The real cost is binaryen
fpcast-emu uniform max-arity padding + per-call trampoline, not the call opcode. V8-here runs GC-wasm fine (V8 130
default-on), so not blocked, just the wrong layer. Also corrected: no max-func-params@128 in-repo; link-xapp.sh:24
uses BARE --fpcast-emu (binaryen default arity).

REAL Root-1 fix (cheapest-first): (1) QUICK WIN hours/one-line -- --pass-arg=max-func-params@<measured-true-max>
(padding scales with arity; GObject closures 1-4 ptr args); (2) days -- force per-signature C marshallers to kill
g_cclosure_marshal_generic then drop/scope --fpcast-emu; (3) weeks -- per-arity trampoline tables. Spec Root-1 item
+ PERF-FINDINGS.md + status-log T69 updated. Also captured: #2 in-place pwrite caveat is real (RootFileSystem uses
the default VirtualFileSystem::pwrite read_file-clone via self.overlay; fix needs dispatch-chain forwarding).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: NathanFlurry

experiments/wasm-gui/M8-STATUS-LOG.md

@@ -282,3 +282,4 @@
 2026-06-26T67 (gmodule CONSOLIDATED -- one shim, duplication removed): thunar-sbr now loads through the EXISTING shared toolchain/gmodule-shim.c + a generated table (gmodule-plugins-thunar.gen.c from build-thunar.sh), the SAME mechanism the xfce4-panel plugins use. The table's references to the 3 entry points pull the SBR from its archive + keep it past --gc-sections, so the keep-shim/symwrap/sentinel were unnecessary -- DELETED (gmodule-static-shim.c, thunar-sbr-symwrap.c, thunar-sbr-keep.c). The one shared-shim change is additive (accept a path if the name is registered for xfce_panel_module_init/construct OR thunar_extension_initialize; the per-binary table makes these mutually exclusive -> no panel regression, verified: shim compiles, panel table has 0 thunar entries). Re-verified thunar bulk-rename renamers load via the shared shim (xu5-thunar-sbr-consolidated.png). Full panel rebuild-verify kicked off. One gmodule mechanism for both plugin families.
 2026-06-26T67b (panel regression-verify PASSED): full xfce4-panel rebuild with the shared gmodule-shim.c additive change -> fresh 54MB binary, exit 0, 0 undefined symbols, 0 thunar refs leaking into the panel link. The consolidation is fully verified: thunar-sbr renamers load via the shared shim AND the panel is unaffected. gmodule chapter closed.
 2026-06-26T68 (thunar-sbr renamers FUNCTIONAL, not just rendered): XTEST-injected "RENAMED_" into the bulk-rename Text field (button 1 + focus + type, POST_INJECT_DELAY 40s, proven --timeout 120) -> the New Name column LIVE-PREVIEWS RENAMED_vacation-001.jpg / RENAMED_vacation-002.jpg / RENAMED_notes.txt and the Apply button enables. Proof: ~/tmp/gui-progress/2026-06-26T17/xu5-thunar-sbr-functional.png. So the gmodule-loaded thunar-sbr plugin RUNS its rename logic, not just draws the dialog -- a functional capstone to the gmodule consolidation (T65-67). (FB-capture note: the first attempt at --timeout 175 emptied the FB; the proven --timeout 120 captured it -- a harness timing detail, not a guest issue.)
+2026-06-26T69 (PERF PIVOT — Root-1 course-corrected by feasibility research): the user-named "typed-function-references" is the WRONG fix for the ~13.4s GObject cascade. A deep research agent (read toolchain+V8) proved call_ref type-checks exactly like call_indirect (the GObject cast mismatch still traps), so typed-func-refs/GC do NOT remove the cost — the cost is binaryen fpcast-emu's UNIFORM max-arity padding + per-call trampoline. V8-here runs GC-wasm fine (V8 130 default-on), so not blocked, just the wrong layer. CORRECTION: no max-func-params@128 exists in-repo; link-xapp.sh:24 uses BARE --fpcast-emu (binaryen default arity). REAL FIX cheapest-first: (1) QUICK WIN hours/one-line — --pass-arg=max-func-params@<measured-true-max> (padding scales with arity; GObject closures 1-4 ptr args); (2) days — force per-signature C marshallers to kill g_cclosure_marshal_generic, then drop/scope --fpcast-emu; (3) weeks — per-arity trampoline tables. Captured in PERF-FINDINGS.md. Also (concrete win #2 in-place pwrite): the analysis caveat is REAL — RootFileSystem uses the DEFAULT VirtualFileSystem::pwrite (vfs.rs:335, read_file full-clone + write_file) via self.overlay (root_fs.rs:307/323); a MemoryFileSystem-only override would be dead — the fix needs pwrite forwarding down the dispatch chain (RootFileSystem→overlay→inner) + an in-place inner impl.

experiments/wasm-gui/PERF-FINDINGS.md

@@ -58,7 +58,7 @@ real near-term native wins are the autonomous findings here; the big structural
 
 ## Relation to the B roadmap
 
-- **Root-1 (typed-function-references)** — confirmed: the ~13.4s GObject CSS cascade is indirect-call density
+- **Root-1 (fpcast arity tuning + per-signature marshallers)** — the ~13.4s GObject CSS cascade is fpcast-emu uniform-arity padding (NOT the call opcode; typed-func-refs was disproven — see the Root-1 CORRECTION below). Biggest single-guest win. KEEP, start here.
   under `--fpcast-emu`. Biggest single-guest win. KEEP, start here.
 - **Root-2 (thread-safe kernel + multiplex)** — the parallelism wall. KEEP.
 - **T1 (postMessage→SAB)** — DEMOTED for native (see above). The serialization wins on native are #5/#6/#9.
@@ -71,3 +71,33 @@ Grab the cheap autonomous framebuffer/throughput wins (#2 pwrite, #6 iov, #1 tim
 **Root-1** investigation; they're quick, measurable, and hit the desktop hot path — then **Root-2** for the
 multi-guest parallelism. T1's SAB-ring work is reframed as in-process clone/base64 elimination (#5/#9), not a
 postMessage replacement, and only the browser executor benefits from a request-side ring.
+
+## ★★ Root-1 CORRECTION (2026-06-26): typed-function-references is the WRONG fix
+
+A deep feasibility agent (read the toolchain + V8 runtime) found the named approach does not work:
+- **`call_ref` type-checks exactly like `call_indirect`** — a GObject cast mismatch still traps. Typed
+  function references / wasm-GC do NOT remove the mismatched-signature cost; they just move it. There is no wasm
+  typing feature that lets one call site dispatch to genuinely-different runtime signatures without per-signature
+  adaptation (true in MVP and GC).
+- **The real cost is fpcast-emu's UNIFORM max-arity padding + per-call trampoline**, not the call opcode.
+  binaryen's `FuncCastEmulation` pads EVERY indirect-callable function + EVERY call site to one wide uniform
+  signature (all params → i64, fixed arity), so every GObject closure/marshal/vfunc call shuffles the full padded
+  arity. Cost ≈ (#indirect-calls) × (arity coercions + extra dispatch). GObject is almost all indirect calls.
+- **V8-here CAN run GC-wasm** (V8 130, GC + typed-func-refs default-on, no flags set — `isolate.rs:102-109`), so
+  the approach is not blocked by the runtime; it's just aimed at the wrong layer. NOT the fix.
+- **Correction to the prior framing:** there is NO `max-func-params@128` tuning anywhere in-repo. `link-xapp.sh:24`
+  uses BARE `--fpcast-emu` → binaryen's DEFAULT arity. So we're paying the default padding on every call.
+
+### The ACTUAL Root-1 fix (cheapest-first)
+1. **QUICK WIN (hours, one line):** `--fpcast-emu --pass-arg=max-func-params@<measured-true-max>` at
+   `link-xapp.sh:24`. The padding cost scales with the fixed arity; GObject closures are mostly 1–4 pointer args,
+   so lowering from binaryen's default to the measured true max should remove a large fraction of the ~12s.
+   **Risk:** a genuinely-indirect function with more params than N breaks → MEASURE the true max, keep an
+   app-still-runs assertion. Highest value-per-effort; do FIRST.
+2. **ROOT CAUSE (days):** kill the generic-marshaller path. The UB-cast traffic is GObject's *generic* marshaller
+   (`g_cclosure_marshal_generic`, libffi-style arbitrary-signature). Force per-signature C marshallers
+   (`g_cclosure_marshal_VOID__*`) for the signals `show_all` exercises → correctly-typed `call_indirect`, no
+   emulation → drop/scope `--fpcast-emu` narrowly. Biggest structural win.
+3. (weeks) per-arity trampoline tables (custom binaryen). Only if 1+2 insufficient.
+
+So Root-1's roadmap entry becomes "fpcast arity tuning + per-signature marshallers", NOT typed-function-references.

experiments/wasm-gui/XUBUNTU-SPEC.md

@@ -25,9 +25,14 @@ needed**. (Still do the security work correctly: write the hostile-input securit
 kernel validates all guest-written ring data — and treat the concurrency refactor with TCB-grade care. The
 never-self-approve list — D-Bus-to-host, host-fd, GPU, host-network — is unchanged and still needs sign-off.)
 Start with Root-1:
-1. **Root-1 — typed-function-references.** Replace `--fpcast-emu` for GObject's mismatched-signature function
-   pointers. Cuts the ~13s GObject construction cascade (the per-guest compute root); speeds every guest AND
-   relieves Root-2. No new attack surface. *(Start here.)*
+1. **Root-1 — fpcast arity tuning + per-signature marshallers** *(was "typed-function-references" — feasibility
+   research proved that WRONG: `call_ref` type-checks like `call_indirect`, so it can't run GObject's UB casts any
+   faster; the real cost is binaryen fpcast-emu's uniform max-arity padding, not the opcode. See `PERF-FINDINGS.md`)*.
+   The ~13s GObject cascade is fpcast-emu padding every indirect call to one wide uniform arity. **Quick win
+   (hours):** `link-xapp.sh:24` uses BARE `--fpcast-emu` (binaryen default arity) — add
+   `--pass-arg=max-func-params@<measured-true-max>` (GObject closures are 1–4 ptr args). **Root cause (days):**
+   force per-signature C marshallers to kill `g_cclosure_marshal_generic`, then drop/scope `--fpcast-emu`. Speeds
+   every guest AND relieves Root-2. No new attack surface. *(Start here.)*
 2. **T1 — in-process serialization elimination** *(was "SAB ring transport"; DEMOTED/REFRAMED by the ultracode
    analysis — see `PERF-FINDINGS.md`)*. **postMessage is BROWSER-ONLY**; the native production path (what the
    desktop runs on) is fully in-process (V8 isolate ↔ Rust kernel share one address space) — **no postMessage, no