From 4d89a557857789bfdde23397fad6438b0c52e38e Mon Sep 17 00:00:00 2001
From: Felix Sausmikat <50841330+Felix-El@users.noreply.github.com>
Date: Tue, 21 Apr 2026 01:31:25 +0200
Subject: [PATCH 1/4] Add bounded lists (list<T, ..N>) via opcode 0x6c

Cherry-picked the essence of cpetig's commit d2874eba526cdba442a9a4125b213b01df7b371c
from https://github.com/cpetig/component-model/tree/bounded-lists, adapted to
the current codebase (ptr_type/opts threading, updated class names).

Bounded strings are intentionally excluded.

Co-authored-by: Christof Petig <christof.petig@arcor.de>
---
 design/mvp/Binary.md                    | 147 ++++++++++++------------
 design/mvp/canonical-abi/definitions.py |  78 ++++++++++---
 design/mvp/canonical-abi/run_tests.py   |  10 ++
 3 files changed, 143 insertions(+), 92 deletions(-)

diff --git a/design/mvp/Binary.md b/design/mvp/Binary.md
index 508f870f..569d166d 100644
--- a/design/mvp/Binary.md
+++ b/design/mvp/Binary.md
@@ -87,12 +87,12 @@ sort                ::= 0x00 cs:<core:sort>                                => co
                       | 0x03                                               => type
                       | 0x04                                               => component
                       | 0x05                                               => instance
-inlineexport        ::= na:<nameattributes> si:<sortidx>                   => (export na si)
+inlineexport        ::= n:<exportname'> si:<sortidx>                       => (export n si)
 ```
 Notes:
 * Reused Core binary rules: [`core:name`], (variable-length encoded) [`core:u32`]
 * The `core:sort` values are chosen to match the discriminant opcodes of
-  [`core:externtype`].
+  [`core:importdesc`].
 * `type` is added to `core:sort` in anticipation of the [type-imports] proposal. Until that
   proposal, core modules won't be able to actually import or export types, however, the
   `type` sort is allowed as part of outer aliases (below).
@@ -101,8 +101,8 @@ Notes:
   for aliases (below).
 * Validation of `core:instantiatearg` initially only allows the `instance`
   sort, but would be extended to accept other sorts as core wasm is extended.
-* Validation of `instantiate` requires each `<externname>` in `c` to match a
-  `name` in a `with` argument (using plain string equality) and for the types to
+* Validation of `instantiate` requires each `<importname>` in `c` to match a
+  `name` in a `with` argument (compared as strings) and for the types to
   match.
 * When validating `instantiate`, after each individual type-import is supplied
   via `with`, the actual type supplied is immediately substituted for all uses
@@ -116,23 +116,24 @@ Notes:
 
 (See [Alias Definitions](Explainer.md#alias-definitions) in the explainer.)
 ```ebnf
-alias ::= s:<sort> 0x00 i:<instanceidx> n:<name>           => (alias export i n (s))
-        | s:<sort> 0x01 i:<core:instanceidx> n:<core:name> => (alias core export i n (s))
-        | s:<sort> 0x02 ct:<u32> idx:<u32>                 => (alias outer ct idx (s))  (if s in outeraliassort)
+alias       ::= s:<sort> t:<aliastarget>                => (alias t (s))
+aliastarget ::= 0x00 i:<instanceidx> n:<name>           => export i n
+              | 0x01 i:<core:instanceidx> n:<core:name> => core export i n
+              | 0x02 ct:<u32> idx:<u32>                 => outer ct idx
 ```
 Notes:
 * Reused Core binary rules: (variable-length encoded) [`core:u32`]
-* For (`core`) `export` aliases, `i` is validated to refer to a (core) instance
-  in the (core) instance index space that exports `n` with the specified `sort`.
-* For `outer` aliases:
-  * `ct` is validated to be *less than or equal to* the number of enclosing
-    "scopes" (where a "scope" is one of: a `component` definition, a `component`
-    type, an `instance` type)
-  * `i` is validated to be a valid index in the `s` index space of the target
-    scope (counting outward, starting with `0` referring to the current scope)
-  * if `ct` is greater than 0 and crosses a component (as opposed to type)
-    boundary and `s` is `type`, the target type may not transitively refer to a
-    resource type.
+* For `export` aliases, `i` is validated to refer to an instance in the
+  instance index space that exports `n` with the specified `sort`.
+* For `outer` aliases, `ct` is validated to be *less or equal than* the number
+  of enclosing `component`s and `type`s and `i` is validated to be a valid index
+  in the `sort` index space of the targeted `component`/`type` (counting
+  outward, starting with `0` referring to the current `component`/`type`).
+* For `outer` aliases, validation restricts the `sort` to one of `type`,
+  `module` or `component`.
+* For `outer` aliases that reach across a `component` boundary (as opposed to
+  a `type` boundary), validation additionally requires that any outer-aliased
+  `type` does not transitively refer to a `resource` type.
 
 
 ## Type Definitions
@@ -148,12 +149,13 @@ core:moduledecl  ::= 0x00 i:<core:import>                                 => i
                    | 0x01 t:<core:type>                                   => t
                    | 0x02 a:<core:alias>                                  => a
                    | 0x03 e:<core:exportdecl>                             => e
-core:alias       ::= 0x10 0x01 ct:<u32> idx:<u32>                         => (alias outer ct idx (type))
+core:alias       ::= s:<core:sort> t:<core:aliastarget>                   => (alias t (s))
+core:aliastarget ::= 0x01 ct:<u32> idx:<u32>                              => outer ct idx
 core:importdecl  ::= i:<core:import>                                      => i
-core:exportdecl  ::= n:<core:name> t:<core:externtype>                    => (export n t)
+core:exportdecl  ::= n:<core:name> d:<core:importdesc>                    => (export n d)
 ```
 Notes:
-* Reused Core binary rules: [`core:import`], [`core:externtype`],
+* Reused Core binary rules: [`core:import`], [`core:importdesc`],
   [`core:rectype`]
 * Unfortunately, the `core:deftype` rule results in an encoding ambiguity: the
   `0x50` opcode is used by both `core:moduletype` and a non-final
@@ -169,9 +171,8 @@ Notes:
   core type index space will not contain any core module types.
 * As described in the explainer, each module type is validated with an
   initially-empty type index space.
-* In `core:alias`, the first `0x10` is the opcode for `type` in `core:sort` and
-  `0x01` is an opcode to distinguish `outer` aliases from potential future
-  `export` aliases.
+* `alias` declarators currently only allow `outer` `type` aliases but
+  would add `export` aliases when core wasm adds type exports.
 
 ```ebnf
 type          ::= dt:<deftype>                            => (type dt)
@@ -200,8 +201,8 @@ defvaltype    ::= pvt:<primvaltype>                       => pvt
                 | 0x70 t:<valtype>                        => (list t)
                 | 0x67 t:<valtype> len:<u32>              => (list t len)  (if len > 0) 🔧
                 | 0x6f t*:vec(<valtype>)                  => (tuple t+)    (if |t*| > 0)
-                | 0x6e l*:vec(<labellit>)                 => (flags l+)    (if 0 < |l*| <= 32)
-                | 0x6d l*:vec(<labellit>)                 => (enum l+)     (if |l*| > 0)
+                | 0x6e l*:vec(<label'>)                   => (flags l+)    (if 0 < |l*| <= 32)
+                | 0x6d l*:vec(<label'>)                   => (enum l+)     (if |l*| > 0)
                 | 0x6b t:<valtype>                        => (option t)
                 | 0x6a t?:<valtype>? u?:<valtype>?        => (result t? (error u)?)
                 | 0x69 i:<typeidx>                        => (own i)
@@ -209,9 +210,9 @@ defvaltype    ::= pvt:<primvaltype>                       => pvt
                 | 0x66 t?:<valtype>?                      => (stream t?) 🔀
                 | 0x65 t?:<valtype>?                      => (future t?) 🔀
                 | 0x63 k:<valtype> v:<valtype>            => (map k v) (if k is in <keytype>) 🗺️
-labelvaltype  ::= l:<labellit> t:<valtype>                => l t
-case          ::= l:<labellit> t?:<valtype>? 0x00         => (case l t?)
-labellit      ::= len:<u32> l:<label>                     => "l"  (if len = |l|)
+labelvaltype  ::= l:<label'> t:<valtype>                  => l t
+case          ::= l:<label'> t?:<valtype>? 0x00           => (case l t?)
+label'        ::= len:<u32> l:<label>                     => l    (if len = |l|)
 <T>?          ::= 0x00                                    =>
                 | 0x01 t:<T>                              => t
 valtype       ::= i:<typeidx>                             => i
@@ -230,9 +231,9 @@ instancedecl  ::= 0x00 t:<core:type>                      => t
                 | 0x01 t:<type>                           => t
                 | 0x02 a:<alias>                          => a
                 | 0x04 ed:<exportdecl>                    => ed
-importdecl    ::= na:<nameattributes> et:<externtype>     => (import na et)
-exportdecl    ::= na:<nameattributes> et:<externtype>     => (export na et)
-externtype    ::= 0x00 0x11 i:<core:typeidx>              => (core module (type i))
+importdecl    ::= in:<importname'> ed:<externdesc>        => (import in ed)
+exportdecl    ::= en:<exportname'> ed:<externdesc>        => (export en ed)
+externdesc    ::= 0x00 0x11 i:<core:typeidx>              => (core module (type i))
                 | 0x01 i:<typeidx>                        => (func (type i))
                 | 0x02 b:<valuebound>                     => (value b) 🪙
                 | 0x03 b:<typebound>                      => (type b)
@@ -259,13 +260,11 @@ Notes:
   [TODO](Concurrency.md#TODO).
 * Validation of `resourcetype` requires the destructor (if present) to have
   type `[i32] -> []`.
-* In addition to the validation rules for `alias` *definitions* mentioned above,
-  validation of `alias` *declarators* also requires:
-  * `export` aliases only alias the `instance` and `type` sorts
-  * `outer` aliases only alias the `core type` and `type` sorts
+* Validation of `instancedecl` (currently) only allows the `type` and
+  `instance` sorts in `alias` declarators.
 * As described in the explainer, each component and instance type is validated
-  with an initially-empty type index space. (Outer aliases can be used to pull
-  in type definitions from containing `component` and `type` scopes.)
+  with an initially-empty type index space. Outer aliases can be used to pull
+  in type definitions from containing components.
 * `exportdecl` introduces a new type index that can be used by subsequent type
   definitions. In the `(eq i)` case, the new type index is effectively an alias
   to type `i`. In the `(sub resource)` case, the new type index refers to a
@@ -273,15 +272,13 @@ Notes:
   index spaces. (Note: *subsequent* aliases can introduce new type indices
   equivalent to this fresh type.)
 * Validation rejects `resourcetype` type definitions inside `componenttype` and
-  `instancetype`. Thus, handle types inside a `componenttype` can only refer
+  `instancettype`. Thus, handle types inside a `componenttype` can only refer
   to resource types that are imported or exported.
-* `<label>` is defined as part of the
-   [text format](Explainer.md#import-and-export-definitions).
 * All parameter labels, result labels, record field labels, variant case
   labels, flag labels, enum case labels, component import names, component
   export names, instance import names and instance export names must be
   [strongly-unique] in their containing scope.
-* Validation of `externtype` requires the various `typeidx` type constructors
+* Validation of `externdesc` requires the various `typeidx` type constructors
   to match the preceding `sort`.
 * (The `0x00` immediate of `case` may be reinterpreted in the future as the
   `none` case of an optional immediate.)
@@ -305,6 +302,7 @@ canon    ::= 0x00 0x00 f:<core:funcidx> opts:<opts> ft:<typeidx> => (canon lift
            | 0x05                                                => (canon task.cancel (core func)) 🔀
            | 0x0a v:<valtype> i:<u32>                            => (canon context.get v i (core func)) 🔀
            | 0x0b v:<valtype> i:<u32>                            => (canon context.set v i (core func)) 🔀
+           | 0x0c cancel?:<cancel?>                              => (canon thread.yield cancel? (core func)) 🔀
            | 0x06 async?:<async?>                                => (canon subtask.cancel async? (core func)) 🔀
            | 0x0d                                                => (canon subtask.drop (core func)) 🔀
            | 0x0e t:<typeidx>                                    => (canon stream.new t (core func)) 🔀
@@ -331,13 +329,10 @@ canon    ::= 0x00 0x00 f:<core:funcidx> opts:<opts> ft:<typeidx> => (canon lift
            | 0x23                                                => (canon waitable.join (core func)) 🔀
            | 0x26                                                => (canon thread.index (core func)) 🧵
            | 0x27 ft:<typeidx> tbl:<core:tableidx>               => (canon thread.new-indirect ft tbl (core func)) 🧵
-           | 0x28                                                => (canon thread.resume-later (core func)) 🧵
+           | 0x28 cancel?:<cancel?>                              => (canon thread.switch-to cancel? (core func)) 🧵
            | 0x29 cancel?:<cancel?>                              => (canon thread.suspend cancel? (core func)) 🧵
-           | 0x0c cancel?:<cancel?>                              => (canon thread.yield cancel? (core func)) 🔀
-           | 0x2a cancel?:<cancel?>                              => (canon thread.suspend-then-resume cancel? (core func)) 🧵
-           | 0x2b cancel?:<cancel?>                              => (canon thread.yield-then-resume cancel? (core func)) 🧵
-           | 0x2c cancel?:<cancel?>                              => (canon thread.suspend-then-promote cancel? (core func)) 🧵
-           | 0x2d cancel?:<cancel?>                              => (canon thread.yield-then-promote cancel? (core func)) 🧵
+           | 0x2a                                                => (canon thread.resume-later (core func)) 🧵
+           | 0x2b cancel?:<cancel?>                              => (canon thread.yield-to cancel? (core func)) 🧵
            | 0x40 shared?:<sh?> ft:<typeidx>                     => (canon thread.spawn-ref shared? ft (core func)) 🧵②
            | 0x41 shared?:<sh?> ft:<typeidx> tbl:<core:tableidx> => (canon thread.spawn-indirect shared? ft tbl (core func)) 🧵②
            | 0x42 shared?:<sh?>                                  => (canon thread.available-parallelism shared? (core func)) 🧵②
@@ -394,14 +389,16 @@ flags are set.
 (See [Import and Export Definitions](Explainer.md#import-and-export-definitions)
 in the explainer.)
 ```ebnf
-import         ::= na:<nameattributes> et:<externtype>                  => (import na et)
-export         ::= na:<nameattributes> si:<sortidx> et?:<externtype>?   => (export na si et?)
-nameattributes ::= 0x00 len:<u32> en:<externname>                       => "en"                 (if len = |en|)
-                 | 0x01 len:<u32> en:<externname>                       => "en"                 (if len = |en|)
-                 | 0x02 len:<u32> en:<externname> a*:vec(<attribute>)   => "en" a*              (if len = |en|) 🏷️/🔗
-attribute      ::= 0x00 len:<u32> in:<interfacename>                    => (implements "in")    (if len = |in|) 🏷️
-                 | 0x01 len:<u32> vs:<semversuffix>                     => (versionsuffix "vs") (if len = |vs|) 🔗
-                 | 0x02 n:<name>                                        => (external-id n) 🏷️
+import         ::= in:<importname'> ed:<externdesc>                     => (import in ed)
+export         ::= en:<exportname'> si:<sortidx> ed?:<externdesc>?      => (export en si ed?)
+importname'    ::= 0x00 len:<u32> in:<importname>                       => in      (if len = |in|)
+                 | 0x01 len:<u32> in:<importname>                       => in      (if len = |in|)
+                 | 0x02 len:<u32> in:<importname> opts:vec(<nameopt>)   => in opts (if len = |in|) 🏷️/🔗
+exportname'    ::= 0x00 len:<u32> in:<exportname>                       => in      (if len = |in|)
+                 | 0x01 len:<u32> in:<exportname>                       => in      (if len = |in|)
+                 | 0x02 len:<u32> in:<importname> opts:vec(<nameopt>)   => in opts (if len = |in|) 🏷️/🔗
+nameopt        ::= 0x00 len:<u32> n:<interfacename>                     => (implements i) 🏷️
+                 | 0x01 len:<u32> vs:<semversuffix>                     => (versionsuffix vs) 🔗
 ```
 
 Notes:
@@ -409,30 +406,25 @@ Notes:
   definition and can be used by all subsequent definitions just like an alias.
 * Validation requires that all resource types transitively used in the type of an
   export are introduced by a preceding `importdecl` or `exportdecl`.
-* Validation requires any exported `sortidx` to have a valid `externtype`
+* Validation requires any exported `sortidx` to have a valid `externdesc`
   (which disallows core sorts other than `core module`). When the optional
-  `externtype` immediate is present, validation requires it to be a supertype
-  of the inferred `externtype` of the `sortidx`.
-* `<externname>`, `<interfacename>` and `<semversuffix>` are defined as part of
-  the [text format](Explainer.md#import-and-export-definitions).
-* The redundant `0x00`/`0x01` cases of `nameattributes` will
-  [be cleaned up for a 1.0 release](#binary-format-warts-to-fix-in-a-10-release).
-* The `externname`s of all imports in a given component or component-type must
-  be [strongly-unique]; attributes are ignored.
-* The `externname`s of all exports in a given component, instance, component-
-  type or instance-type must be [strongly-unique]; attributes are ignored.
+  `externdesc` immediate is present, validation requires it to be a supertype
+  of the inferred `externdesc` of the `sortidx`.
+* `<importname>` and `<exportname>` refer to the productions defined in the
+  [text format](Explainer.md#import-and-export-definitions).
+* `<importname'>` and `<exportname'>` will [be cleaned up for a 1.0
+  release](##binary-format-warts-to-fix-in-a-10-release).
+* The `<importname>`s of a component must all be [strongly-unique]. Separately,
+  the `<exportname>`s of a component must also all be [strongly-unique].
 * Validation requires that `[constructor]`, `[method]` and `[static]` annotated
   `plainname`s only occur on `func` imports or exports and that the first label
   of a `[constructor]`, `[method]` or `[static]` matches the `plainname` of a
   preceding `resource` import or export, respectively, in the same scope
   (component, component type or instance type).
 * 🏷️ Validation requires that `implements`-annotated imports or exports are
-  `instance`-typed and have a `plainname` name.
-* 🏷️/🔗 Validation requires that a `vec(<attribute>)` contains each kind of
-  `attribute` at most once.
-* 🏷️/🔗 Even though `componenttype` and `instancetype` structurally contain a
-  `vec(<attribute>)`, this list is entirely ignored when validating the types
-  of components and instances.
+  `instance`-typed.
+* 🏷️ Validation requires that `implements`-annotated imports or exports have a
+  `<plainname>` name.
 * Validation of `[constructor]` names requires a `func` type whose result type
   is either `(own $R)` or `(result (own $R) E?)` where `$R` is a resource type
   labeled `r`.
@@ -443,6 +435,8 @@ Notes:
   the `versionsuffix` results in a `valid semver` as defined by
   [https://semver.org](https://semver.org/). A `versionsuffix` is otherwise
   ignored for validation except to improve diagnostic messages.
+* `<integrity-metadata>` is as defined by the
+  [SRI](https://www.w3.org/TR/SRI/#dfn-integrity-metadata) spec.
 
 ## 🪙 Value Definitions
 
@@ -534,9 +528,12 @@ named once.
 ## Binary Format Warts to Fix in a 1.0 Release
 
 * The opcodes (for types, canon built-ins, etc) should be re-sorted
+* The two `depname` cases should be merged into one (`dep=<...>`)
 * The two `list` type codes should be merged into one with an optional immediate
   and similarly for `func`.
-* The redundant `0x00` and `0x01` opcodes of `nameattributes` will be merged.
+* The `0x00` and `0x01` variant of `importname'` and `exportname'` will be
+  removed. Any remaining variant(s) will be renumbered or the prefix byte will
+  be removed or repurposed.
 * Most built-ins should have a `<canonopt>*` immediate instead of an ad hoc
   subset of `canonopt`s.
 * Add optional `shared` immediate to all canonical definitions (explicitly or
@@ -559,7 +556,7 @@ named once.
 [`core:version`]: https://webassembly.github.io/spec/core/binary/modules.html#binary-version
 [`core:name`]: https://webassembly.github.io/spec/core/binary/values.html#binary-name
 [`core:import`]: https://webassembly.github.io/spec/core/binary/modules.html#binary-import
-[`core:externtype`]: https://webassembly.github.io/spec/core/binary/types.html#binary-externtype
+[`core:importdesc`]: https://webassembly.github.io/spec/core/binary/modules.html#binary-importdesc
 [`core:functype`]: https://webassembly.github.io/spec/core/binary/types.html#binary-functype
 [`core:rectype]: https://webassembly.github.io/gc/core/binary/types.html#recursive-types
 
diff --git a/design/mvp/canonical-abi/definitions.py b/design/mvp/canonical-abi/definitions.py
index c20aa908..19b331dd 100644
--- a/design/mvp/canonical-abi/definitions.py
+++ b/design/mvp/canonical-abi/definitions.py
@@ -123,6 +123,7 @@ class ErrorContextType(ValType): pass
 class ListType(ValType):
   t: ValType
   l: Optional[int] = None
+  var: Optional[bool] = False
 
 @dataclass
 class FieldType:
@@ -1219,15 +1220,17 @@ def alignment(t, ptr_type):
     case CharType()                  : return 4
     case StringType()                : return ptr_size(ptr_type)
     case ErrorContextType()          : return 4
-    case ListType(t, l)              : return alignment_list(t, l, ptr_type)
+    case ListType(t, l, var)          : return alignment_list(t, l, var, ptr_type)
     case RecordType(fields)          : return alignment_record(fields, ptr_type)
     case VariantType(cases)          : return alignment_variant(cases, ptr_type)
     case FlagsType(labels)           : return alignment_flags(labels)
     case OwnType() | BorrowType()    : return 4
     case StreamType() | FutureType() : return 4
 
-def alignment_list(elem_type, maybe_length, ptr_type):
+def alignment_list(elem_type, maybe_length, maybe_variable, ptr_type):
   if maybe_length is not None:
+    if maybe_variable:
+      return max(alignment(varint_type(maybe_length), ptr_type), alignment(elem_type, ptr_type))
     return alignment(elem_type, ptr_type)
   return ptr_size(ptr_type)
 
@@ -1242,8 +1245,11 @@ def alignment_variant(cases, ptr_type):
 
 def discriminant_type(cases):
   n = len(cases)
-  assert(0 < n < (1 << 32))
-  match math.ceil(math.log2(n)/8):
+  return varint_type(n)
+
+def varint_type(maxval):
+  assert(0 < maxval < (1 << 32))
+  match math.ceil(math.log2(maxval)/8):
     case 0: return U8Type()
     case 1: return U8Type()
     case 2: return U16Type()
@@ -1277,15 +1283,19 @@ def elem_size(t, ptr_type):
     case CharType()                  : return 4
     case StringType()                : return 2 * ptr_size(ptr_type)
     case ErrorContextType()          : return 4
-    case ListType(t, l)              : return elem_size_list(t, l, ptr_type)
+    case ListType(t, l, var)          : return elem_size_list(t, l, var, ptr_type)
     case RecordType(fields)          : return elem_size_record(fields, ptr_type)
     case VariantType(cases)          : return elem_size_variant(cases, ptr_type)
     case FlagsType(labels)           : return elem_size_flags(labels)
     case OwnType() | BorrowType()    : return 4
     case StreamType() | FutureType() : return 4
 
-def elem_size_list(elem_type, maybe_length, ptr_type):
+def elem_size_list(elem_type, maybe_length, maybe_variable, ptr_type):
   if maybe_length is not None:
+    if maybe_variable:
+      s = elem_size(varint_type(maybe_length), ptr_type)
+      s = align_to(s, alignment(elem_type, ptr_type))
+      return s + maybe_length * elem_size(elem_type, ptr_type)
     return maybe_length * elem_size(elem_type, ptr_type)
   return 2 * ptr_size(ptr_type)
 
@@ -1337,7 +1347,7 @@ def load(cx, ptr, t):
     case CharType()         : return convert_i32_to_char(cx, load_int(cx, ptr, 4))
     case StringType()       : return load_string(cx, ptr)
     case ErrorContextType() : return lift_error_context(cx, load_int(cx, ptr, 4))
-    case ListType(t, l)     : return load_list(cx, ptr, t, l)
+    case ListType(t, l, var): return load_list(cx, ptr, t, l, var)
     case RecordType(fields) : return load_record(cx, ptr, fields)
     case VariantType(cases) : return load_variant(cx, ptr, cases)
     case FlagsType(labels)  : return load_flags(cx, ptr, labels)
@@ -1439,8 +1449,15 @@ def lift_error_context(cx, i):
 MAX_LIST_BYTE_LENGTH = (1 << 28) - 1
 assert(REALLOC_I32_MAX > 2 * MAX_LIST_BYTE_LENGTH)
 
-def load_list(cx, ptr, elem_type, maybe_length):
+def load_list(cx, ptr, elem_type, maybe_length, maybe_variable=False):
   if maybe_length is not None:
+    if maybe_variable:
+      lentype = varint_type(maybe_length)
+      actual_length = load_int(cx, ptr, elem_size(lentype, cx.opts.memory.ptr_type()))
+      trap_if(actual_length > maybe_length)
+      ptr += elem_size(lentype, cx.opts.memory.ptr_type())
+      ptr = align_to(ptr, alignment(elem_type, cx.opts.memory.ptr_type()))
+      return load_list_from_valid_range(cx, ptr, actual_length, elem_type)
     return load_list_from_valid_range(cx, ptr, maybe_length, elem_type)
   begin = load_int(cx, ptr, cx.opts.memory.ptr_size())
   length = load_int(cx, ptr + cx.opts.memory.ptr_size(), cx.opts.memory.ptr_size())
@@ -1539,7 +1556,7 @@ def store(cx, v, t, ptr):
     case CharType()         : store_int(cx, char_to_i32(v), ptr, 4)
     case StringType()       : store_string(cx, v, ptr)
     case ErrorContextType() : store_int(cx, lower_error_context(cx, v), ptr, 4)
-    case ListType(t, l)     : store_list(cx, v, ptr, t, l)
+    case ListType(t, l, var): store_list(cx, v, ptr, t, l, var)
     case RecordType(fields) : store_record(cx, v, ptr, fields)
     case VariantType(cases) : store_variant(cx, v, ptr, cases)
     case FlagsType(labels)  : store_flags(cx, v, ptr, labels)
@@ -1740,8 +1757,16 @@ def store_probably_utf16_to_latin1_or_utf16(cx, src, src_code_units):
 def lower_error_context(cx, v):
   return cx.inst.handles.add(v)
 
-def store_list(cx, v, ptr, elem_type, maybe_length):
+def store_list(cx, v, ptr, elem_type, maybe_length, maybe_variable=False):
   if maybe_length is not None:
+    if maybe_variable:
+      assert(len(v) <= maybe_length)
+      lentype = varint_type(maybe_length)
+      store_int(cx, len(v), ptr, elem_size(lentype, cx.opts.memory.ptr_type()))
+      ptr += elem_size(lentype, cx.opts.memory.ptr_type())
+      ptr = align_to(ptr, alignment(elem_type, cx.opts.memory.ptr_type()))
+      store_list_into_valid_range(cx, v, ptr, elem_type)
+      return
     assert(maybe_length == len(v))
     store_list_into_valid_range(cx, v, ptr, elem_type)
     return
@@ -1869,15 +1894,17 @@ def flatten_type(t, opts):
     case CharType()                       : return ['i32']
     case StringType()                     : return [opts.memory.ptr_type(), opts.memory.ptr_type()]
     case ErrorContextType()               : return ['i32']
-    case ListType(t, l)                   : return flatten_list(t, l, opts)
+    case ListType(t, l, var)              : return flatten_list(t, l, var, opts)
     case RecordType(fields)               : return flatten_record(fields, opts)
     case VariantType(cases)               : return flatten_variant(cases, opts)
     case FlagsType(labels)                : return ['i32']
     case OwnType() | BorrowType()         : return ['i32']
     case StreamType() | FutureType()      : return ['i32']
 
-def flatten_list(elem_type, maybe_length, opts):
+def flatten_list(elem_type, maybe_length, maybe_variable, opts):
   if maybe_length is not None:
+    if maybe_variable:
+      return flatten_type(varint_type(maybe_length), opts) + flatten_type(elem_type, opts) * maybe_length
     return flatten_type(elem_type, opts) * maybe_length
   return [opts.memory.ptr_type(), opts.memory.ptr_type()]
 
@@ -1943,7 +1970,7 @@ def lift_flat(cx, vi, t):
     case CharType()         : return convert_i32_to_char(cx, vi.next('i32'))
     case StringType()       : return lift_flat_string(cx, vi)
     case ErrorContextType() : return lift_error_context(cx, vi.next('i32'))
-    case ListType(t, l)     : return lift_flat_list(cx, vi, t, l)
+    case ListType(t, l, var): return lift_flat_list(cx, vi, t, l, var)
     case RecordType(fields) : return lift_flat_record(cx, vi, fields)
     case VariantType(cases) : return lift_flat_variant(cx, vi, cases)
     case FlagsType(labels)  : return lift_flat_flags(vi, labels)
@@ -1970,11 +1997,19 @@ def lift_flat_string(cx, vi):
   packed_length = vi.next(cx.opts.memory.ptr_type())
   return load_string_from_range(cx, ptr, packed_length)
 
-def lift_flat_list(cx, vi, elem_type, maybe_length):
+def lift_flat_list(cx, vi, elem_type, maybe_length, maybe_variable=False):
   if maybe_length is not None:
+    actual_len = maybe_length
+    if maybe_variable:
+      lentype = varint_type(maybe_length)
+      actual_len = lift_flat(cx, vi, lentype)
     a = []
-    for i in range(maybe_length):
+    for i in range(actual_len):
       a.append(lift_flat(cx, vi, elem_type))
+    if maybe_variable:
+      for i in range(maybe_length - actual_len):
+        for ft in flatten_type(elem_type, cx.opts):
+          vi.next(ft)
     return a
   ptr = vi.next(cx.opts.memory.ptr_type())
   length = vi.next(cx.opts.memory.ptr_type())
@@ -2037,7 +2072,7 @@ def lower_flat(cx, v, t):
     case CharType()         : return [char_to_i32(v)]
     case StringType()       : return lower_flat_string(cx, v)
     case ErrorContextType() : return [lower_error_context(cx, v)]
-    case ListType(t, l)     : return lower_flat_list(cx, v, t, l)
+    case ListType(t, l, var): return lower_flat_list(cx, v, t, l, var)
     case RecordType(fields) : return lower_flat_record(cx, v, fields)
     case VariantType(cases) : return lower_flat_variant(cx, v, cases)
     case FlagsType(labels)  : return lower_flat_flags(v, labels)
@@ -2055,8 +2090,17 @@ def lower_flat_string(cx, v):
   ptr, packed_length = store_string_into_range(cx, v)
   return [ptr, packed_length]
 
-def lower_flat_list(cx, v, elem_type, maybe_length):
+def lower_flat_list(cx, v, elem_type, maybe_length, maybe_variable=False):
   if maybe_length is not None:
+    if maybe_variable:
+      assert(len(v) <= maybe_length)
+      flat = lower_flat(cx, len(v), varint_type(maybe_length))
+      for e in v:
+        flat += lower_flat(cx, e, elem_type)
+      for i in range(maybe_length - len(v)):
+        for ft in flatten_type(elem_type, cx.opts):
+          flat.append(0)
+      return flat
     assert(maybe_length == len(v))
     flat = []
     for e in v:
diff --git a/design/mvp/canonical-abi/run_tests.py b/design/mvp/canonical-abi/run_tests.py
index 4b2e91b4..2cf5c646 100644
--- a/design/mvp/canonical-abi/run_tests.py
+++ b/design/mvp/canonical-abi/run_tests.py
@@ -150,6 +150,12 @@ def test_name():
 test(TupleType([TupleType([U8Type(),U8Type()]),U8Type()]), [1,2,3], {'0':{'0':1,'1':2},'1':3})
 test(ListType(U8Type(),3), [1,2,3], [1,2,3])
 test(ListType(ListType(U8Type(),2),3), [1,2,3,4,5,6], [[1,2],[3,4],[5,6]])
+# bounded (variable-length up to max) list tests
+test(ListType(U8Type(),3,True), [3, 1,2,3], [1,2,3])
+test(ListType(U8Type(),3,True), [2, 1,2,0], [1,2])
+test(ListType(U8Type(),3,True), [0, 0,0,0], [])
+test(ListType(U32Type(),2,True), [2, 10,20], [10,20])
+test(ListType(U32Type(),2,True), [1, 10,0], [10])
 # Empty flags types are not permitted yet.
 #t = FlagsType([])
 #test(t, [], {})
@@ -342,6 +348,10 @@ def test_heap(t, expect, args, byte_array, addr_type='i32'):
           [1,2, 3,4])
 test_heap(ListType(ListType(U32Type(),2)), [[1,2],[3,4]], [0,2],
           [1,0,0,0,2,0,0,0, 3,0,0,0,4,0,0,0])
+# bounded list heap tests
+# layout: [length_u8, elem0, ..., elemN-1, unused_slots...]
+test_heap(ListType(ListType(U8Type(),3,True)), [[1,2],[3]], [0,2],
+          [2, 1,2,0,  1, 3,0,0])
 test_heap(ListType(ListType(U32Type(),2)), None, [1,2],
           [0, 1,0,0,0,2,0,0,0, 3,0,0,0,4,0,0,0])
 test_heap(ListType(TupleType([U8Type(),U8Type(),U16Type(),U32Type()])),

From 1a18fbb530c076abbe23e2b4315dc28827e76e9d Mon Sep 17 00:00:00 2001
From: Felix Sausmikat <50841330+Felix-El@users.noreply.github.com>
Date: Tue, 21 Apr 2026 01:32:22 +0200
Subject: [PATCH 2/4] Bounded List: additional traps and tests

- Add trap_if(actual_len > maybe_length) to lift_flat_list, mirroring
  the existing trap in load_list's heap path
- Add over-length trap tests for both flat and heap lifting
- Add alignment test for bounded list of U32 (verifies 3-byte padding
  after U8 length prefix)
---
 design/mvp/canonical-abi/definitions.py | 1 +
 design/mvp/canonical-abi/run_tests.py   | 9 +++++++++
 2 files changed, 10 insertions(+)

diff --git a/design/mvp/canonical-abi/definitions.py b/design/mvp/canonical-abi/definitions.py
index 19b331dd..7a8f0c28 100644
--- a/design/mvp/canonical-abi/definitions.py
+++ b/design/mvp/canonical-abi/definitions.py
@@ -2003,6 +2003,7 @@ def lift_flat_list(cx, vi, elem_type, maybe_length, maybe_variable=False):
     if maybe_variable:
       lentype = varint_type(maybe_length)
       actual_len = lift_flat(cx, vi, lentype)
+      trap_if(actual_len > maybe_length)
     a = []
     for i in range(actual_len):
       a.append(lift_flat(cx, vi, elem_type))
diff --git a/design/mvp/canonical-abi/run_tests.py b/design/mvp/canonical-abi/run_tests.py
index 2cf5c646..86f70bea 100644
--- a/design/mvp/canonical-abi/run_tests.py
+++ b/design/mvp/canonical-abi/run_tests.py
@@ -156,6 +156,8 @@ def test_name():
 test(ListType(U8Type(),3,True), [0, 0,0,0], [])
 test(ListType(U32Type(),2,True), [2, 10,20], [10,20])
 test(ListType(U32Type(),2,True), [1, 10,0], [10])
+# actual_len > max_len must trap (flat)
+test(ListType(U8Type(),3,True), [4, 1,2,3], None)
 # Empty flags types are not permitted yet.
 #t = FlagsType([])
 #test(t, [], {})
@@ -352,6 +354,13 @@ def test_heap(t, expect, args, byte_array, addr_type='i32'):
 # layout: [length_u8, elem0, ..., elemN-1, unused_slots...]
 test_heap(ListType(ListType(U8Type(),3,True)), [[1,2],[3]], [0,2],
           [2, 1,2,0,  1, 3,0,0])
+# actual_len > max_len must trap (heap)
+test_heap(ListType(ListType(U8Type(),3,True)), None, [0,1],
+          [4, 1,2,3])
+# alignment: U32 elements require 3 padding bytes after the U8 length prefix
+# layout per element: [length_u8, pad, pad, pad, elem0_u32, elem1_u32, unused_u32] = 16 bytes
+test_heap(ListType(ListType(U32Type(),3,True)), [[10,20]], [0,1],
+          [2, 0xff,0xff,0xff,  10,0,0,0, 20,0,0,0, 0,0,0,0])
 test_heap(ListType(ListType(U32Type(),2)), None, [1,2],
           [0, 1,0,0,0,2,0,0,0, 3,0,0,0,4,0,0,0])
 test_heap(ListType(TupleType([U8Type(),U8Type(),U16Type(),U32Type()])),

From 3ab9900a11b85a2f565e153fdb7f85d0a1eb877f Mon Sep 17 00:00:00 2001
From: Felix Sausmikat <50841330+Felix-El@users.noreply.github.com>
Date: Wed, 22 Apr 2026 09:15:14 +0200
Subject: [PATCH 3/4] Bounded List: review fixes

- fix memory bounds checking
- improve integration with existing list load/store code
- fix indentation
- avoid default argument
- more readable load/store recipe
---
 design/mvp/canonical-abi/definitions.py | 66 +++++++++++++------------
 1 file changed, 35 insertions(+), 31 deletions(-)

diff --git a/design/mvp/canonical-abi/definitions.py b/design/mvp/canonical-abi/definitions.py
index 7a8f0c28..e0d9c114 100644
--- a/design/mvp/canonical-abi/definitions.py
+++ b/design/mvp/canonical-abi/definitions.py
@@ -1220,7 +1220,7 @@ def alignment(t, ptr_type):
     case CharType()                  : return 4
     case StringType()                : return ptr_size(ptr_type)
     case ErrorContextType()          : return 4
-    case ListType(t, l, var)          : return alignment_list(t, l, var, ptr_type)
+    case ListType(t, l, var)         : return alignment_list(t, l, var, ptr_type)
     case RecordType(fields)          : return alignment_record(fields, ptr_type)
     case VariantType(cases)          : return alignment_variant(cases, ptr_type)
     case FlagsType(labels)           : return alignment_flags(labels)
@@ -1283,7 +1283,7 @@ def elem_size(t, ptr_type):
     case CharType()                  : return 4
     case StringType()                : return 2 * ptr_size(ptr_type)
     case ErrorContextType()          : return 4
-    case ListType(t, l, var)          : return elem_size_list(t, l, var, ptr_type)
+    case ListType(t, l, var)         : return elem_size_list(t, l, var, ptr_type)
     case RecordType(fields)          : return elem_size_record(fields, ptr_type)
     case VariantType(cases)          : return elem_size_variant(cases, ptr_type)
     case FlagsType(labels)           : return elem_size_flags(labels)
@@ -1449,7 +1449,7 @@ def lift_error_context(cx, i):
 MAX_LIST_BYTE_LENGTH = (1 << 28) - 1
 assert(REALLOC_I32_MAX > 2 * MAX_LIST_BYTE_LENGTH)
 
-def load_list(cx, ptr, elem_type, maybe_length, maybe_variable=False):
+def load_list(cx, ptr, elem_type, maybe_length, maybe_variable):
   if maybe_length is not None:
     if maybe_variable:
       lentype = varint_type(maybe_length)
@@ -1457,8 +1457,9 @@ def load_list(cx, ptr, elem_type, maybe_length, maybe_variable=False):
       trap_if(actual_length > maybe_length)
       ptr += elem_size(lentype, cx.opts.memory.ptr_type())
       ptr = align_to(ptr, alignment(elem_type, cx.opts.memory.ptr_type()))
-      return load_list_from_valid_range(cx, ptr, actual_length, elem_type)
-    return load_list_from_valid_range(cx, ptr, maybe_length, elem_type)
+    else:
+      actual_length = maybe_length
+    return load_list_from_range(cx, ptr, actual_length, elem_type)
   begin = load_int(cx, ptr, cx.opts.memory.ptr_size())
   length = load_int(cx, ptr + cx.opts.memory.ptr_size(), cx.opts.memory.ptr_size())
   return load_list_from_range(cx, begin, length, elem_type)
@@ -1757,7 +1758,7 @@ def store_probably_utf16_to_latin1_or_utf16(cx, src, src_code_units):
 def lower_error_context(cx, v):
   return cx.inst.handles.add(v)
 
-def store_list(cx, v, ptr, elem_type, maybe_length, maybe_variable=False):
+def store_list(cx, v, ptr, elem_type, maybe_length, maybe_variable):
   if maybe_length is not None:
     if maybe_variable:
       assert(len(v) <= maybe_length)
@@ -1765,19 +1766,21 @@ def store_list(cx, v, ptr, elem_type, maybe_length, maybe_variable=False):
       store_int(cx, len(v), ptr, elem_size(lentype, cx.opts.memory.ptr_type()))
       ptr += elem_size(lentype, cx.opts.memory.ptr_type())
       ptr = align_to(ptr, alignment(elem_type, cx.opts.memory.ptr_type()))
-      store_list_into_valid_range(cx, v, ptr, elem_type)
-      return
-    assert(maybe_length == len(v))
-    store_list_into_valid_range(cx, v, ptr, elem_type)
-    return
-  begin, length = store_list_into_range(cx, v, elem_type)
-  store_int(cx, begin, ptr, cx.opts.memory.ptr_size())
-  store_int(cx, length, ptr + cx.opts.memory.ptr_size(), cx.opts.memory.ptr_size())
+    else:
+      assert(len(v) == maybe_length)
+    store_ptr = ptr
+  else:
+    store_ptr = None
+  begin, length = store_list_into_range(cx, v, elem_type, store_ptr)
+  if maybe_length is None:
+    store_int(cx, begin, ptr, cx.opts.memory.ptr_size())
+    store_int(cx, length, ptr + cx.opts.memory.ptr_size(), cx.opts.memory.ptr_size())
 
-def store_list_into_range(cx, v, elem_type):
+def store_list_into_range(cx, v, elem_type, ptr):
   byte_length = len(v) * elem_size(elem_type, cx.opts.memory.ptr_type())
-  assert(byte_length <= REALLOC_I32_MAX)
-  ptr = cx.opts.realloc(0, 0, alignment(elem_type, cx.opts.memory.ptr_type()), byte_length)
+  if ptr is None:
+    assert(byte_length <= REALLOC_I32_MAX)
+    ptr = cx.opts.realloc(0, 0, alignment(elem_type, cx.opts.memory.ptr_type()), byte_length)
   trap_if(ptr != align_to(ptr, alignment(elem_type, cx.opts.memory.ptr_type())))
   trap_if(ptr + byte_length > len(cx.opts.memory))
   store_list_into_valid_range(cx, v, ptr, elem_type)
@@ -1997,13 +2000,14 @@ def lift_flat_string(cx, vi):
   packed_length = vi.next(cx.opts.memory.ptr_type())
   return load_string_from_range(cx, ptr, packed_length)
 
-def lift_flat_list(cx, vi, elem_type, maybe_length, maybe_variable=False):
+def lift_flat_list(cx, vi, elem_type, maybe_length, maybe_variable):
   if maybe_length is not None:
-    actual_len = maybe_length
     if maybe_variable:
       lentype = varint_type(maybe_length)
       actual_len = lift_flat(cx, vi, lentype)
       trap_if(actual_len > maybe_length)
+    else:
+      actual_len = maybe_length
     a = []
     for i in range(actual_len):
       a.append(lift_flat(cx, vi, elem_type))
@@ -2091,24 +2095,24 @@ def lower_flat_string(cx, v):
   ptr, packed_length = store_string_into_range(cx, v)
   return [ptr, packed_length]
 
-def lower_flat_list(cx, v, elem_type, maybe_length, maybe_variable=False):
+def lower_flat_list(cx, v, elem_type, maybe_length, maybe_variable):
   if maybe_length is not None:
+    flat = []
     if maybe_variable:
       assert(len(v) <= maybe_length)
-      flat = lower_flat(cx, len(v), varint_type(maybe_length))
-      for e in v:
-        flat += lower_flat(cx, e, elem_type)
-      for i in range(maybe_length - len(v)):
-        for ft in flatten_type(elem_type, cx.opts):
-          flat.append(0)
-      return flat
-    assert(maybe_length == len(v))
-    flat = []
+      flat += lower_flat(cx, len(v), varint_type(maybe_length))
+    else:
+      assert(maybe_length == len(v))
     for e in v:
       flat += lower_flat(cx, e, elem_type)
+    if maybe_variable:
+      for _ in range(maybe_length - len(v)):
+        for _ in flatten_type(elem_type, cx.opts):
+          flat.append(0)
     return flat
-  (ptr, length) = store_list_into_range(cx, v, elem_type)
-  return [ptr, length]
+  else:
+    (ptr, length) = store_list_into_range(cx, v, elem_type, None)
+    return [ptr, length]
 
 def lower_flat_record(cx, v, fields):
   flat = []

From 1fb578ef9626380211e8c0b14360350c1fe31175 Mon Sep 17 00:00:00 2001
From: Felix Sausmikat <50841330+Felix-El@users.noreply.github.com>
Date: Sat, 18 Jul 2026 00:49:56 +0200
Subject: [PATCH 4/4] Flat ABI for fixed and bounded length lists

Replace the expanded-element flat representation with a pointer-based
one for direct fixed and bounded length lists. Add contains_direct_list
and type_has_direct_list_result helpers to detect when result types
contain such lists, forcing memory-based returns. Update test expectations
and add new roundtrip tests for the pointer-based flat ABI.
---
 design/mvp/canonical-abi/definitions.py | 187 +++++++++++-------------
 design/mvp/canonical-abi/run_tests.py   |  87 +++++++----
 2 files changed, 151 insertions(+), 123 deletions(-)

diff --git a/design/mvp/canonical-abi/definitions.py b/design/mvp/canonical-abi/definitions.py
index e0d9c114..b19c4940 100644
--- a/design/mvp/canonical-abi/definitions.py
+++ b/design/mvp/canonical-abi/definitions.py
@@ -1205,6 +1205,19 @@ def contains(t, p):
     case _:
       assert(False)
 
+def contains_direct_list(t):
+  dt = despecialize(t)
+  if isinstance(dt, ListType) and dt.l is not None:
+    return True
+  if isinstance(dt, RecordType):
+    return any(contains_direct_list(f.t) for f in dt.fields)
+  if isinstance(dt, VariantType):
+    return any(contains_direct_list(c.t) for c in dt.cases if c.t is not None)
+  return False
+
+def type_has_direct_list_result(ts):
+  return any(contains_direct_list(t) for t in ts)
+
 
 ## Alignment
 
@@ -1228,11 +1241,11 @@ def alignment(t, ptr_type):
     case StreamType() | FutureType() : return 4
 
 def alignment_list(elem_type, maybe_length, maybe_variable, ptr_type):
-  if maybe_length is not None:
-    if maybe_variable:
-      return max(alignment(varint_type(maybe_length), ptr_type), alignment(elem_type, ptr_type))
-    return alignment(elem_type, ptr_type)
-  return ptr_size(ptr_type)
+  if maybe_length is None:
+    return ptr_size(ptr_type)
+  if maybe_variable:
+    return max(alignment(varint_type(maybe_length), ptr_type), alignment(elem_type, ptr_type))
+  return alignment(elem_type, ptr_type)
 
 def alignment_record(fields, ptr_type):
   a = 1
@@ -1244,8 +1257,7 @@ def alignment_variant(cases, ptr_type):
   return max(alignment(discriminant_type(cases), ptr_type), max_case_alignment(cases, ptr_type))
 
 def discriminant_type(cases):
-  n = len(cases)
-  return varint_type(n)
+  return varint_type(len(cases))
 
 def varint_type(maxval):
   assert(0 < maxval < (1 << 32))
@@ -1291,13 +1303,13 @@ def elem_size(t, ptr_type):
     case StreamType() | FutureType() : return 4
 
 def elem_size_list(elem_type, maybe_length, maybe_variable, ptr_type):
-  if maybe_length is not None:
-    if maybe_variable:
-      s = elem_size(varint_type(maybe_length), ptr_type)
-      s = align_to(s, alignment(elem_type, ptr_type))
-      return s + maybe_length * elem_size(elem_type, ptr_type)
-    return maybe_length * elem_size(elem_type, ptr_type)
-  return 2 * ptr_size(ptr_type)
+  if maybe_length is None:
+    return 2 * ptr_size(ptr_type)
+  if maybe_variable:
+    s = elem_size(varint_type(maybe_length), ptr_type)
+    s = align_to(s, alignment(elem_type, ptr_type))
+    return s + maybe_length * elem_size(elem_type, ptr_type)
+  return maybe_length * elem_size(elem_type, ptr_type)
 
 def elem_size_record(fields, ptr_type):
   s = 0
@@ -1450,18 +1462,19 @@ def lift_error_context(cx, i):
 assert(REALLOC_I32_MAX > 2 * MAX_LIST_BYTE_LENGTH)
 
 def load_list(cx, ptr, elem_type, maybe_length, maybe_variable):
-  if maybe_length is not None:
+  if maybe_length is None:
+    begin = load_int(cx, ptr, cx.opts.memory.ptr_size())
+    length = load_int(cx, ptr + cx.opts.memory.ptr_size(), cx.opts.memory.ptr_size())
+  else:
     if maybe_variable:
       lentype = varint_type(maybe_length)
-      actual_length = load_int(cx, ptr, elem_size(lentype, cx.opts.memory.ptr_type()))
-      trap_if(actual_length > maybe_length)
-      ptr += elem_size(lentype, cx.opts.memory.ptr_type())
-      ptr = align_to(ptr, alignment(elem_type, cx.opts.memory.ptr_type()))
+      length = load_int(cx, ptr, elem_size(lentype, cx.opts.memory.ptr_type()))
+      trap_if(length > maybe_length)
+      begin = ptr + elem_size(lentype, cx.opts.memory.ptr_type())
+      begin = align_to(begin, alignment(elem_type, cx.opts.memory.ptr_type()))
     else:
-      actual_length = maybe_length
-    return load_list_from_range(cx, ptr, actual_length, elem_type)
-  begin = load_int(cx, ptr, cx.opts.memory.ptr_size())
-  length = load_int(cx, ptr + cx.opts.memory.ptr_size(), cx.opts.memory.ptr_size())
+      begin = ptr
+      length = maybe_length
   return load_list_from_range(cx, begin, length, elem_type)
 
 def load_list_from_range(cx, ptr, length, elem_type):
@@ -1759,28 +1772,25 @@ def lower_error_context(cx, v):
   return cx.inst.handles.add(v)
 
 def store_list(cx, v, ptr, elem_type, maybe_length, maybe_variable):
-  if maybe_length is not None:
-    if maybe_variable:
-      assert(len(v) <= maybe_length)
-      lentype = varint_type(maybe_length)
-      store_int(cx, len(v), ptr, elem_size(lentype, cx.opts.memory.ptr_type()))
-      ptr += elem_size(lentype, cx.opts.memory.ptr_type())
-      ptr = align_to(ptr, alignment(elem_type, cx.opts.memory.ptr_type()))
-    else:
-      assert(len(v) == maybe_length)
-    store_ptr = ptr
-  else:
-    store_ptr = None
-  begin, length = store_list_into_range(cx, v, elem_type, store_ptr)
   if maybe_length is None:
+    begin, length = store_list_into_range(cx, v, elem_type)
     store_int(cx, begin, ptr, cx.opts.memory.ptr_size())
     store_int(cx, length, ptr + cx.opts.memory.ptr_size(), cx.opts.memory.ptr_size())
+    return
+  assert(len(v) <= maybe_length if maybe_variable else len(v) == maybe_length)
+  if maybe_variable:
+    lentype = varint_type(maybe_length)
+    store_int(cx, len(v), ptr, elem_size(lentype, cx.opts.memory.ptr_type()))
+    begin = ptr + elem_size(lentype, cx.opts.memory.ptr_type())
+    begin = align_to(begin, alignment(elem_type, cx.opts.memory.ptr_type()))
+  else:
+    begin = ptr
+  store_list_into_valid_range(cx, v, begin, elem_type)
 
-def store_list_into_range(cx, v, elem_type, ptr):
+def store_list_into_range(cx, v, elem_type):
   byte_length = len(v) * elem_size(elem_type, cx.opts.memory.ptr_type())
-  if ptr is None:
-    assert(byte_length <= REALLOC_I32_MAX)
-    ptr = cx.opts.realloc(0, 0, alignment(elem_type, cx.opts.memory.ptr_type()), byte_length)
+  assert(byte_length <= REALLOC_I32_MAX)
+  ptr = cx.opts.realloc(0, 0, alignment(elem_type, cx.opts.memory.ptr_type()), byte_length)
   trap_if(ptr != align_to(ptr, alignment(elem_type, cx.opts.memory.ptr_type())))
   trap_if(ptr + byte_length > len(cx.opts.memory))
   store_list_into_valid_range(cx, v, ptr, elem_type)
@@ -1855,33 +1865,31 @@ def lower_future(cx, v, t):
 def flatten_functype(opts, ft, context):
   flat_params = flatten_types(ft.param_types(), opts)
   flat_results = flatten_types(ft.result_type(), opts)
-  if not opts.async_:
-    if len(flat_params) > MAX_FLAT_PARAMS:
-      flat_params = [opts.memory.ptr_type()]
-    if len(flat_results) > MAX_FLAT_RESULTS:
-      match context:
-        case 'lift':
-          flat_results = [opts.memory.ptr_type()]
-        case 'lower':
-          flat_params += [opts.memory.ptr_type()]
-          flat_results = []
-    return CoreFuncType(flat_params, flat_results)
-  else:
+  if opts.async_:
     match context:
       case 'lift':
         if len(flat_params) > MAX_FLAT_PARAMS:
           flat_params = [opts.memory.ptr_type()]
-        if opts.callback:
-          flat_results = ['i32']
-        else:
-          flat_results = []
+        flat_results = ['i32'] if opts.callback else []
       case 'lower':
         if len(flat_params) > MAX_FLAT_ASYNC_PARAMS:
           flat_params = [opts.memory.ptr_type()]
         if len(flat_results) > 0:
           flat_params += [opts.memory.ptr_type()]
         flat_results = ['i32']
-    return CoreFuncType(flat_params, flat_results)
+  else:
+    use_memory_param = len(flat_params) > MAX_FLAT_PARAMS
+    use_memory_result = len(flat_results) > MAX_FLAT_RESULTS or type_has_direct_list_result(ft.result_type())
+    if use_memory_param:
+      flat_params = [opts.memory.ptr_type()]
+    if use_memory_result:
+      match context:
+        case 'lift':
+          flat_results = [opts.memory.ptr_type()]
+        case 'lower':
+          flat_params += [opts.memory.ptr_type()]
+          flat_results = []
+  return CoreFuncType(flat_params, flat_results)
 
 def flatten_types(ts, opts):
   return [ft for t in ts for ft in flatten_type(t, opts)]
@@ -1905,11 +1913,9 @@ def flatten_type(t, opts):
     case StreamType() | FutureType()      : return ['i32']
 
 def flatten_list(elem_type, maybe_length, maybe_variable, opts):
-  if maybe_length is not None:
-    if maybe_variable:
-      return flatten_type(varint_type(maybe_length), opts) + flatten_type(elem_type, opts) * maybe_length
-    return flatten_type(elem_type, opts) * maybe_length
-  return [opts.memory.ptr_type(), opts.memory.ptr_type()]
+  if maybe_length is None or maybe_variable:
+    return [opts.memory.ptr_type(), opts.memory.ptr_type()]
+  return [opts.memory.ptr_type()]
 
 def flatten_record(fields, opts):
   flat = []
@@ -2001,24 +2007,14 @@ def lift_flat_string(cx, vi):
   return load_string_from_range(cx, ptr, packed_length)
 
 def lift_flat_list(cx, vi, elem_type, maybe_length, maybe_variable):
-  if maybe_length is not None:
-    if maybe_variable:
-      lentype = varint_type(maybe_length)
-      actual_len = lift_flat(cx, vi, lentype)
-      trap_if(actual_len > maybe_length)
-    else:
-      actual_len = maybe_length
-    a = []
-    for i in range(actual_len):
-      a.append(lift_flat(cx, vi, elem_type))
-    if maybe_variable:
-      for i in range(maybe_length - actual_len):
-        for ft in flatten_type(elem_type, cx.opts):
-          vi.next(ft)
-    return a
-  ptr = vi.next(cx.opts.memory.ptr_type())
-  length = vi.next(cx.opts.memory.ptr_type())
-  return load_list_from_range(cx, ptr, length, elem_type)
+  if maybe_length is None:
+    ptr = vi.next(cx.opts.memory.ptr_type())
+    n = vi.next(cx.opts.memory.ptr_type())
+  else:
+    ptr = vi.next(cx.opts.memory.ptr_type())
+    n = vi.next(cx.opts.memory.ptr_type()) if maybe_variable else maybe_length
+    trap_if(maybe_variable and n > maybe_length)
+  return load_list_from_range(cx, ptr, n, elem_type)
 
 def lift_flat_record(cx, vi, fields):
   record = {}
@@ -2096,23 +2092,16 @@ def lower_flat_string(cx, v):
   return [ptr, packed_length]
 
 def lower_flat_list(cx, v, elem_type, maybe_length, maybe_variable):
-  if maybe_length is not None:
-    flat = []
-    if maybe_variable:
-      assert(len(v) <= maybe_length)
-      flat += lower_flat(cx, len(v), varint_type(maybe_length))
-    else:
-      assert(maybe_length == len(v))
-    for e in v:
-      flat += lower_flat(cx, e, elem_type)
-    if maybe_variable:
-      for _ in range(maybe_length - len(v)):
-        for _ in flatten_type(elem_type, cx.opts):
-          flat.append(0)
-    return flat
-  else:
-    (ptr, length) = store_list_into_range(cx, v, elem_type, None)
+  if maybe_length is None:
+    (ptr, length) = store_list_into_range(cx, v, elem_type)
     return [ptr, length]
+  assert(len(v) <= maybe_length if maybe_variable else len(v) == maybe_length)
+  byte_length = len(v) * elem_size(elem_type, cx.opts.memory.ptr_type())
+  ptr = cx.opts.realloc(0, 0, alignment(elem_type, cx.opts.memory.ptr_type()), byte_length)
+  trap_if(ptr != align_to(ptr, alignment(elem_type, cx.opts.memory.ptr_type())))
+  trap_if(ptr + byte_length > len(cx.opts.memory))
+  store_list_into_valid_range(cx, v, ptr, elem_type)
+  return [ptr, len(v)] if maybe_variable else [ptr]
 
 def lower_flat_record(cx, v, fields):
   flat = []
@@ -2149,7 +2138,7 @@ def lower_flat_flags(v, labels):
 
 def lift_flat_values(cx, max_flat, vi, ts):
   flat_types = flatten_types(ts, cx.opts)
-  if len(flat_types) > max_flat:
+  if len(flat_types) > max_flat or type_has_direct_list_result(ts):
     ptr = vi.next(cx.opts.memory.ptr_type())
     tuple_type = TupleType(ts)
     trap_if(ptr != align_to(ptr, alignment(tuple_type, cx.opts.memory.ptr_type())))
@@ -2161,7 +2150,9 @@ def lift_flat_values(cx, max_flat, vi, ts):
 def lower_flat_values(cx, max_flat, vs, ts, out_param = None):
   cx.inst.may_leave = False
   flat_types = flatten_types(ts, cx.opts)
-  if len(flat_types) > max_flat:
+  direct_list_retarea = out_param is not None and type_has_direct_list_result(ts)
+  use_memory = len(flat_types) > max_flat or direct_list_retarea
+  if use_memory:
     tuple_type = TupleType(ts)
     tuple_value = {str(i): v for i,v in enumerate(vs)}
     if out_param is None:
diff --git a/design/mvp/canonical-abi/run_tests.py b/design/mvp/canonical-abi/run_tests.py
index 86f70bea..4ba407ed 100644
--- a/design/mvp/canonical-abi/run_tests.py
+++ b/design/mvp/canonical-abi/run_tests.py
@@ -148,16 +148,10 @@ def test_name():
      [1,2,3],
      {'x':1,'y':2,'z':3})
 test(TupleType([TupleType([U8Type(),U8Type()]),U8Type()]), [1,2,3], {'0':{'0':1,'1':2},'1':3})
-test(ListType(U8Type(),3), [1,2,3], [1,2,3])
-test(ListType(ListType(U8Type(),2),3), [1,2,3,4,5,6], [[1,2],[3,4],[5,6]])
-# bounded (variable-length up to max) list tests
-test(ListType(U8Type(),3,True), [3, 1,2,3], [1,2,3])
-test(ListType(U8Type(),3,True), [2, 1,2,0], [1,2])
-test(ListType(U8Type(),3,True), [0, 0,0,0], [])
-test(ListType(U32Type(),2,True), [2, 10,20], [10,20])
-test(ListType(U32Type(),2,True), [1, 10,0], [10])
-# actual_len > max_len must trap (flat)
-test(ListType(U8Type(),3,True), [4, 1,2,3], None)
+h = Heap([1,2,3])
+test(ListType(U8Type(),3), [0], [1,2,3], cx=mk_cx(MemInst(h.memory, 'i32')))
+h = Heap([1,2,3,4,5,6])
+test(ListType(ListType(U8Type(),2),3), [0], [[1,2],[3,4],[5,6]], cx=mk_cx(MemInst(h.memory, 'i32')))
 # Empty flags types are not permitted yet.
 #t = FlagsType([])
 #test(t, [], {})
@@ -295,6 +289,26 @@ def test_heap(t, expect, args, byte_array, addr_type='i32'):
   cx = mk_cx(MemInst(heap.memory, addr_type))
   test(t, args, expect, cx)
 
+test_heap(ListType(U8Type(),3,True), [1,2,3], [0,3], [1,2,3])
+test_heap(ListType(U8Type(),3,True), [1,2], [0,2], [1,2])
+test_heap(ListType(U8Type(),3,True), [], [0,0], [])
+test_heap(ListType(U8Type(),3,True), None, [0,4], [1,2,3])
+test_heap(ListType(U32Type(),2,True), [10,20], [0,2], [10,0,0,0, 20,0,0,0])
+test_heap(ListType(U32Type(),2,True), [10], [0,1], [10,0,0,0])
+test_heap(ListType(ListType(U8Type(),3,True)), [[1,2],[3]], [0,2],
+          [2, 1,2,0,  1, 3,0,0])
+test_heap(ListType(ListType(U8Type(),3,True)), None, [0,1],
+          [4, 1,2,3])
+test_heap(ListType(ListType(U32Type(),3,True)), [[10,20]], [0,1],
+          [2, 0xff,0xff,0xff,  10,0,0,0, 20,0,0,0, 0,0,0,0])
+test_heap(ListType(ListType(U16Type(),3,True)), [[10,20],[30]], [0,2],
+          [0x02,0xff,10,0,20,0,0,0, 0x01,0xff,30,0,0,0,0,0])
+test_heap(ListType(ListType(U64Type(),2,True)), [[10]], [0,1],
+          [0x01,0,0,0,0,0,0,0, 10,0,0,0,0,0,0,0, 0,0,0,0,0,0,0,0])
+test_heap(ListType(ListType(U8Type(),3,True),2,True), [[1,2,3],[1,2]], [0,2],
+          [0x03,1,2,3, 0x02,1,2,0])
+test_heap(ListType(ListType(U16Type(),3,True),2,True), [[10,20],[30]], [0,2],
+          [0x02,0xff,10,0,20,0,0,0, 0x01,0xff,30,0,0,0,0,0])
 # Empty record types are not permitted yet.
 #test_heap(ListType(RecordType([])), [{},{},{}], [0,3], [])
 test_heap(ListType(BoolType()), [True,False,True], [0,3], [1,0,1])
@@ -350,17 +364,6 @@ def test_heap(t, expect, args, byte_array, addr_type='i32'):
           [1,2, 3,4])
 test_heap(ListType(ListType(U32Type(),2)), [[1,2],[3,4]], [0,2],
           [1,0,0,0,2,0,0,0, 3,0,0,0,4,0,0,0])
-# bounded list heap tests
-# layout: [length_u8, elem0, ..., elemN-1, unused_slots...]
-test_heap(ListType(ListType(U8Type(),3,True)), [[1,2],[3]], [0,2],
-          [2, 1,2,0,  1, 3,0,0])
-# actual_len > max_len must trap (heap)
-test_heap(ListType(ListType(U8Type(),3,True)), None, [0,1],
-          [4, 1,2,3])
-# alignment: U32 elements require 3 padding bytes after the U8 length prefix
-# layout per element: [length_u8, pad, pad, pad, elem0_u32, elem1_u32, unused_u32] = 16 bytes
-test_heap(ListType(ListType(U32Type(),3,True)), [[10,20]], [0,1],
-          [2, 0xff,0xff,0xff,  10,0,0,0, 20,0,0,0, 0,0,0,0])
 test_heap(ListType(ListType(U32Type(),2)), None, [1,2],
           [0, 1,0,0,0,2,0,0,0, 3,0,0,0,4,0,0,0])
 test_heap(ListType(TupleType([U8Type(),U8Type(),U16Type(),U32Type()])),
@@ -418,12 +421,14 @@ def test_flatten(t, params, results, addr_type='i32'):
   if len(params) > definitions.MAX_FLAT_PARAMS:
     expect.params = [addr_type]
 
-  if len(results) > definitions.MAX_FLAT_RESULTS:
+  use_memory_result = (len(results) > definitions.MAX_FLAT_RESULTS or
+                       type_has_direct_list_result(t.result_type()))
+  if use_memory_result:
     expect.results = [addr_type]
   got = flatten_functype(opts, t, 'lift')
   assert(got == expect)
 
-  if len(results) > definitions.MAX_FLAT_RESULTS:
+  if use_memory_result:
     expect.params += [addr_type]
     expect.results = []
   got = flatten_functype(opts, t, 'lower')
@@ -439,6 +444,16 @@ def test_flatten(t, params, results, addr_type='i32'):
 test_flatten(FuncType([U8Type() for _ in range(17)],[]), ['i32' for _ in range(17)], [], addr_type='i64')
 test_flatten(FuncType([U8Type() for _ in range(17)],[TupleType([U8Type(),U8Type()])]), ['i32' for _ in range(17)], ['i32','i32'])
 test_flatten(FuncType([U8Type() for _ in range(17)],[TupleType([U8Type(),U8Type()])]), ['i32' for _ in range(17)], ['i32','i32'], addr_type='i64')
+test_flatten(FuncType([], [ListType(U8Type(), 5)]), [], ['i32'])
+test_flatten(FuncType([U8Type()], [ListType(U32Type(), 3)]), ['i32'], ['i32'])
+test_flatten(FuncType([], [RecordType([FieldType('x', ListType(U8Type(), 4))])]), [], ['i32'])
+test_flatten(FuncType([], [VariantType([CaseType('a', ListType(U8Type(), 3))])]), [], ['i32'])
+test_flatten(FuncType([], [ListType(U8Type(), 5, True)]), [], ['i32', 'i32'])
+test_flatten(FuncType([ListType(U8Type(), 5)], []), ['i32'], [])
+test_flatten(FuncType([ListType(U8Type(), 5, True)], []), ['i32', 'i32'], [])
+test_flatten(FuncType([ListType(U8Type(), 5), ListType(U32Type(), 3)], []), ['i32', 'i32'], [])
+test_flatten(FuncType([], [U8Type(), ListType(U8Type(), 5)]), [], ['i32'])
+test_flatten(FuncType([], [U8Type(), ListType(U8Type(), 5, True)]), [], ['i32'])
 
 
 def test_roundtrips():
@@ -449,13 +464,25 @@ def test_roundtrip(t, v, addr_type='i32'):
     store = Store()
 
     ft = FuncType([t],[t])
-    def callee(x):
-      return x
 
     callee_heap = Heap(1000)
     callee_opts = mk_opts(MemInst(callee_heap.memory, addr_type), 'utf8', callee_heap.realloc)
     callee_inst = ComponentInstance(store)
 
+    if type_has_direct_list_result(ft.result_type()):
+      def callee(flat_args):
+        cx = LiftLowerContext(callee_opts, callee_inst)
+        vi = CoreValueIter(flat_args)
+        vals = [lift_flat(cx, vi, t) for t in ft.param_types()]
+        tuple_type = TupleType(ft.result_type())
+        tuple_value = {str(i): vals[i] for i in range(len(vals))}
+        ptr = callee_heap.realloc(0, 0, alignment(tuple_type, addr_type), elem_size(tuple_type, addr_type))
+        definitions.store(cx, tuple_value, tuple_type, ptr)
+        return [ptr]
+    else:
+      def callee(flat_args):
+        return flat_args
+
     got = None
     def on_start():
       return [v]
@@ -481,6 +508,16 @@ def on_resolve(result):
                                            U32Type(),U32Type(),U32Type(),U32Type(),
                                            StringType()]))]),
                   {'x': mk_tup(1,2,3,4, 5,6,7,8, 9,10,11,12, 13,14,15,16, mk_str("wat"))}),
+    (ListType(U8Type(),5), [1,2,3,4,5]),
+    (ListType(U32Type(),4), [10,20,30,40]),
+    (ListType(ListType(U8Type(),2),3), [[1,2],[3,4],[5,6]]),
+    (ListType(StringType(),2), [mk_str("hello"), mk_str("world")]),
+    (ListType(U8Type(),3,True), [1,2,3]),
+    (ListType(U8Type(),3,True), [1,2]),
+    (ListType(U8Type(),3,True), []),
+    (ListType(U32Type(),2,True), [10,20]),
+    (ListType(ListType(U8Type(),3,True),2), [[1,2],[3]]),
+    (ListType(StringType(),3,True), [mk_str("hello"), mk_str("world")]),
   ]
   for addr_type in ['i32', 'i64']:
     for t, v in cases: