From c4a509c37ed0d5eb983d222a6206df71b4be4118 Mon Sep 17 00:00:00 2001
From: Luke Wagner <mail@lukewagner.name>
Date: Tue, 30 May 2023 19:00:38 -0500
Subject: [PATCH 1/2] Switch to a single 'rc' handle type (for now)

---
 design/mvp/Binary.md                    |  16 +-
 design/mvp/CanonicalABI.md              | 305 +++++++++++-------------
 design/mvp/Explainer.md                 | 180 +++++++-------
 design/mvp/Subtyping.md                 |   2 +-
 design/mvp/WIT.md                       |  94 ++++++--
 design/mvp/canonical-abi/definitions.py | 165 ++++++-------
 design/mvp/canonical-abi/run_tests.py   |  94 ++++----
 7 files changed, 426 insertions(+), 430 deletions(-)

diff --git a/design/mvp/Binary.md b/design/mvp/Binary.md
index fcef649c..00ebfd25 100644
--- a/design/mvp/Binary.md
+++ b/design/mvp/Binary.md
@@ -114,9 +114,9 @@ Notes:
   import or export, respectively, in the same scope (component, component type
   or instance type).
 * Validation of `[constructor]` names requires that the `func` returns a
-  `(result (own $R))`, where `$R` is the resource labeled `r`.
+  `(result (rc $R))`, where `$R` is the resource labeled `r`.
 * Validation of `[method]` names requires the first parameter of the function
-  to be `(param "self" (borrow $R))`, where `$R` is the resource labeled `r`.
+  to be `(param "self" (rc $R))`, where `$R` is the resource labeled `r`.
 * Validation of `[method]` and `[static]` names ensures that all field names
   are disjoint.
 
@@ -203,8 +203,7 @@ defvaltype    ::= pvt:<primvaltype>                       => pvt
                 | 0x6c t*:vec(<valtype>)                  => (union t*)
                 | 0x6b t:<valtype>                        => (option t)
                 | 0x6a t?:<valtype>? u?:<valtype>?        => (result t? (error u)?)
-                | 0x69 i:<typeidx>                        => (own i)
-                | 0x68 i:<typeidx>                        => (borrow i)
+                | 0x69 i:<typeidx>                        => (rc i)
 labelvaltype  ::= l:<label> t:<valtype>                   => l t
 case          ::= l:<label> t?:<valtype>? r?:<u32>?       => (case l t? (refines case-label[r])?)
 <T>?          ::= 0x00                                    =>
@@ -240,12 +239,7 @@ Notes:
   with type opcodes starting at SLEB128(-1) (`0x7f`) and going down,
   reserving the nonnegative SLEB128s for type indices.
 * Validation of `valtype` requires the `typeidx` to refer to a `defvaltype`.
-* Validation of `own` and `borrow` requires the `typeidx` to refer to a
-  resource type.
-* Validation only allows `borrow` to be used inside the `param` of a `functype`.
-  (This is likely to change in a future PR, converting `functype` into a
-  compound type constructor analogous to `moduletype` and `componenttype` and
-  using scoping to enforce this constraint instead.)
+* Validation of `rc` requires that `typeidx` refer to a resource type.
 * Validation of `resourcetype` requires the destructor (if present) to have
   type `[i32] -> []`.
 * Validation of `instancedecl` (currently) only allows the `type` and
@@ -281,7 +275,7 @@ Notes:
 canon    ::= 0x00 0x00 f:<core:funcidx> opts:<opts> ft:<typeidx> => (canon lift f opts type-index-space[ft])
            | 0x01 0x00 f:<funcidx> opts:<opts>                   => (canon lower f opts (core func))
            | 0x02 t:<typeidx>                                    => (canon resource.new t (core func))
-           | 0x03 t:<valtype>                                    => (canon resource.drop t (core func))
+           | 0x03 t:<typeidx>                                    => (canon resource.drop t (core func))
            | 0x04 t:<typeidx>                                    => (canon resource.rep t (core func))
 opts     ::= opt*:vec(<canonopt>)                                => opt*
 canonopt ::= 0x00                                                => string-encoding=utf8
diff --git a/design/mvp/CanonicalABI.md b/design/mvp/CanonicalABI.md
index 3bbe1ae3..30857f58 100644
--- a/design/mvp/CanonicalABI.md
+++ b/design/mvp/CanonicalABI.md
@@ -104,7 +104,7 @@ def alignment(t):
     case Record(fields)     : return alignment_record(fields)
     case Variant(cases)     : return alignment_variant(cases)
     case Flags(labels)      : return alignment_flags(labels)
-    case Own(_) | Borrow(_) : return 4
+    case Rc()               : return 4
 ```
 
 Record alignment is tuple alignment, with the definitions split for reuse below:
@@ -176,7 +176,7 @@ def size(t):
     case Record(fields)     : return size_record(fields)
     case Variant(cases)     : return size_variant(cases)
     case Flags(labels)      : return size_flags(labels)
-    case Own(_) | Borrow(_) : return 4
+    case Rc()               : return 4
 
 def size_record(fields):
   s = 0
@@ -218,26 +218,16 @@ definitions via the `cx` parameter:
 class Context:
   opts: CanonicalOptions
   inst: ComponentInstance
-  lenders: [Handle]
-  borrow_count: int
 
   def __init__(self, opts, inst):
     self.opts = opts
     self.inst = inst
-    self.lenders = []
-    self.borrow_count = 0
 ```
 One `Context` is created for each call for both the caller and callee. Thus, a
 cross-component call will create 2 `Context` objects for the call, while a
 component-to-host or host-to-component call will create a single `Context` for
 the wasm caller or callee, resp.
 
-The `lenders` and `borrow_count` fields will be used below for dynamically
-enforcing the rules of borrow handles. The one thing to mention here is that
-the `lenders` list usually has a fixed size (in all cases except when a
-function signature has `borrow`s in `list`s) and thus can be stored inline in
-the native stack frame.
-
 The `opts` field represents the [`canonopt`] values supplied to
 currently-executing `canon lift` or `canon lower`:
 ```python
@@ -272,54 +262,86 @@ The `ResourceType` class represents a resource type that has been defined by
 the specific component instance pointed to by `impl` with a particular
 function closure as the `dtor`.
 ```python
-@dataclass
-class ResourceType(Type):
+class ResourceType:
   impl: ComponentInstance
   dtor: Optional[Callable[[int],None]]
 ```
+`ResourceType` Python object identity is assumed to reflect static type
+equality: one `ResourceType` object is created for each local `resource` type
+definition and each `sub resource` import and each locally-aliased `sub resource`
+export. Moreover, `ResourceType` objects are component-instance-local: when a
+handle to a resource is passed across a component boundary, the handle's
+`ResourceType` is not carried across the boundary in any way.
 
-The `Handle` class and its subclasses represent handle values referring to
-resources. The `rep` field of `Handle` stores the representation value
-(currently fixed to `i32`) pass to `resource.new` for the resource that this
-handle refers to.
+The `Resource` class represents a runtime instance of a resource that has
+been created by the host or `resource.new`.
 ```python
-@dataclass
-class Handle:
+class Resource:
   rep: int
-  lend_count: int
+  ct: int
+
+  def __init__(self, rep):
+    self.rep = rep
+    self.ct = 0
+
+  def inc(self):
+    self.ct += 1
+
+  def dec(self, inst, rt):
+    assert(self.ct > 0)
+    self.ct -= 1
+    if self.ct != 0:
+      return;
+    trap_if(inst is not rt.impl and not rt.impl.may_enter)
+    if rt.dtor:
+      rt.dtor(self.rep)
+```
+The `rep` field stores the `i32` representation passed to `resource.new` and
+can only be accessed via `resource.rep` from the component that defined the
+resource's type (the `rep` of a host-created resource isn't visible to wasm and
+thus can be anything the host wants). Currently, `rep` values are not mutable
+and thus an optimizing implementation can transparently "inline" the `rep`
+field into handles.
+
+The `inc` and `dec` methods of `Resource` maintain the number of handles
+referring to this resource. The `trap_if` inside `dec` prevents unexpected
+reentrance via a parent component (which can both supply the imports and call
+the exports of a child component, thereby allowing the parent to call a child
+component's resource destructor during an import call made by the child).
+
+The `HandleElem` class represents an element of the `HandleTable` class (shown
+next).
+```python
+class HandleElem:
+  res: Resource
+  dup_count: int
 
-@dataclass
-class OwnHandle(Handle):
-  pass
+  def __init__(self, res):
+    self.res = res
+    self.dup_count = 0
+```
+The `dup_count` field is maintained below to store the number of duplicate
+handles that have been lowered to this same `HandleElem`.
 
-@dataclass
-class BorrowHandle(Handle):
-  cx: Optional[Context]
-```
-The `lend_count` field maintains a count of the outstanding handles that were
-lent from this handle (by calls to `borrow`-taking functions). This count is
-used below to dynamically enforce the invariant that a handle cannot be
-dropped while it has currently lent out a `borrow`.
-
-The `BorrowHandle` class additionally stores the `Context` of the call that
-created this borrow for the purposes of `borrow_count` bookkeeping below.
-Until async is added to the Component Model, because of the non-reentrancy
-of components, there is at most one callee `Context` alive for a given
-component and thus the `cx` field of `BorrowHandle` can be optimized away.
-
-`HandleTable` (singular) encapsulates a single mutable, growable array
-of handles that all share the same `ResourceType`. Defining `HandleTable` in
-chunks, we start with the fields and `add` method:
+`HandleTable` (singular) encapsulates a mutable, growable array of handles that
+all share the same `ResourceType`. Defining `HandleTable` in chunks, we start
+with the fields and `add` method:
 ```python
 class HandleTable:
-  array: [Optional[Handle]]
+  array: [Optional[HandleElem]]
   free: [int]
+  deduped: MutableMapping[Resource, int]
 
   def __init__(self):
     self.array = []
     self.free = []
+    self.deduped = {}
 
-  def add(self, h, t):
+  def add(self, h):
+    if h.res in self.deduped:
+      i = self.deduped[h.res]
+      self.array[i].dup_count += 1
+      return i
     if self.free:
       i = self.free.pop()
       assert(self.array[i] is None)
@@ -327,21 +349,25 @@ class HandleTable:
     else:
       i = len(self.array)
       self.array.append(h)
-    match t:
-      case Borrow():
-        h.cx.borrow_count += 1
+    self.deduped[h.res] = i
+    h.res.inc()
     return i
 ```
-The `HandleTable` class maintains a dense array of handles that can contain
-holes created by the `transfer_or_drop` method (defined below). These holes are
-kept in a separate Python list here, but an optimizing implementation could
-instead store the free list in the free elements of `array`. When adding a new
-handle, `HandleTable` first consults the `free` list, which is popped LIFO to
-better detect use-after-free bugs in the guest code.
-
-The `get` method is used by other `HandleTable` methods and canonical
-definitions below and uses dynamic guards to catch out-of-bounds and
-use-after-free:
+When adding a new handle, `HandleTable` first consults the `deduped` dictionary
+to see if an `rc` handle for the given resource already exists, incrementing
+the `dup_count` count to track the duplicate if so. An optimizing
+implementation can avoid using an actual dictionary implementation in the
+common case by storing the index value on the resource itself (keyed by the
+client component instance), taking advantage of the AOT knowledge of the fixed
+set of client component instances.
+
+If there is no duplicate, the `free` list is consulted next to attempt to fill
+in an existing hole. `HandleTable` maintains a dense array of handles that can
+contain holes created by the `drop` method (defined below). These holes are
+stored in a separate Python list here, but an optimizing implementation could
+instead weave the free list inline through the free elements of `array`.
+
+The `get` method uses dynamic guards to catch out-of-bounds and use-after-free:
 ```python
   def get(self, i):
     trap_if(i >= len(self.array))
@@ -349,30 +375,23 @@ use-after-free:
     return self.array[i]
 ```
 
-The last method of `HandleTable`, `transfer_or_drop`, is used to transfer or
-drop a handle out of the handle table. `transfer_or_drop` adds the removed
-handle to the `free` list for later recycling by `add` (above).
+The last method of `HandleTable` is used to `drop` a handle from the table.
 ```python
-  def transfer_or_drop(self, i, t, drop):
+  def drop(self, inst, rt, i):
     h = self.get(i)
-    trap_if(h.lend_count != 0)
-    match t:
-      case Own():
-        trap_if(not isinstance(h, OwnHandle))
-        if drop and t.rt.dtor:
-          trap_if(not t.rt.impl.may_enter)
-          t.rt.dtor(h.rep)
-      case Borrow():
-        trap_if(not isinstance(h, BorrowHandle))
-        h.cx.borrow_count -= 1
+    if h.dup_count > 0:
+      h.dup_count -= 1
+      return
     self.array[i] = None
     self.free.append(i)
-    return h
+    del self.deduped[h.res]
+    h.res.dec(inst, rt)
 ```
-The `lend_count` guard ensures that no dangling borrows are created when
-destroying a resource. The bookkeeping performed for borrowed handles records
-the fulfillment of the obligation of the borrower to drop the handle before the
-end of the call.
+If the `dup_count` field (incremented by the `add` method above) is greater
+than zero, it is decremented without removing the handle from the table. The
+net result of this accounting in `add` and `drop` is that an `rc` handle must
+be `resource.drop`ed exactly once for every handle lowered into the component
+instance (whether or not it is deduplicated).
 
 Finally, we can define `HandleTables` (plural) as simply a wrapper around
 a mutable mapping from `ResourceType` to `HandleTable`:
@@ -384,27 +403,25 @@ class HandleTables:
     self.rt_to_table = dict()
 
   def table(self, rt):
-    if id(rt) not in self.rt_to_table:
-      self.rt_to_table[id(rt)] = HandleTable()
-    return self.rt_to_table[id(rt)]
+    if rt not in self.rt_to_table:
+      self.rt_to_table[rt] = HandleTable()
+    return self.rt_to_table[rt]
 
-  def add(self, h, t):
-    return self.table(t.rt).add(h, t)
-  def get(self, i, rt):
+  def add(self, rt, h):
+    return self.table(rt).add(h)
+  def get(self, rt, i):
     return self.table(rt).get(i)
-  def transfer(self, i, t):
-    return self.table(t.rt).transfer_or_drop(i, t, drop = False)
-  def drop(self, i, t):
-    self.table(t.rt).transfer_or_drop(i, t, drop = True)
+  def drop(self, inst, rt, i):
+    self.table(rt).drop(inst, rt, i)
 ```
 While this Python code performs a dynamic hash-table lookup on each handle
-table access, as we'll see below, the `rt` parameter is always statically
-known such that a normal implementation can statically enumerate all
-`HandleTable` objects at compile time and then route the calls to `add`,
-`get` and `transfer_or_drop` to the correct `HandleTable` at the callsite. The
-net result is that each component instance will contain one handle table per
-resource type used by the component, with each compiled adapter function
-accessing the correct handle table as-if it were a global variable.
+table access, as we'll see below, the `rt` parameter is always statically known
+such that a normal implementation can statically enumerate all `HandleTable`
+objects at compile time and then route the calls to `add`, `get` and `drop` to
+the correct `HandleTable` at the callsite. The net result is that each
+component instance will contain one handle table per resource type used by the
+component, with each compiled adapter function accessing the correct handle
+table as-if it were a global variable.
 
 
 ### Loading
@@ -435,8 +452,7 @@ def load(cx, ptr, t):
     case Record(fields) : return load_record(cx, ptr, fields)
     case Variant(cases) : return load_variant(cx, ptr, cases)
     case Flags(labels)  : return load_flags(cx, ptr, labels)
-    case Own()          : return lift_own(cx, load_int(opts, ptr, 4), t)
-    case Borrow()       : return lift_borrow(cx, load_int(opts, ptr, 4), t)
+    case Rc()           : return lift_handle(cx, load_int(opts, ptr, 4), t)
 ```
 
 Integers are loaded directly from memory, with their high-order bit interpreted
@@ -613,27 +629,12 @@ def unpack_flags_from_int(i, labels):
   return record
 ```
 
-Next, `own` handles are lifted by extracting the `OwnHandle` from the current
-instance's handle table. This ensures that `own` handles are always uniquely
-referenced.
-```python
-def lift_own(cx, i, t):
-  return cx.inst.handles.transfer(i, t)
-```
-Note that `t` refers to an `own` type and thus `HandleTable.transfer` will, as
-shown above, ensure that the handle at index `i` is an `OwnHandle`.
-
-Lastly, `borrow` handles are lifted by handing out a `BorrowHandle` storing the
-same representation value as the lent handle. By incrementing `lend_count`,
-`lift_own` ensures that the lent handle will not be dropped before the end of
-the call (see the matching decrement in `canon_lower`) which transitively
-ensures that the lent resource will not be destroyed.
+Lastly, handles are lifted by loading the resource out of the appropriate
+`HandleTable` after performing the safety checks shown in the `get` method
+above.
 ```python
-def lift_borrow(cx, i, t):
-  h = cx.inst.handles.get(i, t.rt)
-  h.lend_count += 1
-  cx.lenders.append(h)
-  return BorrowHandle(h.rep, 0, None)
+def lift_handle(cx, i, t):
+  return cx.inst.handles.get(t.rt, i).res
 ```
 
 
@@ -664,8 +665,7 @@ def store(cx, v, t, ptr):
     case Record(fields) : store_record(cx, v, ptr, fields)
     case Variant(cases) : store_variant(cx, v, ptr, cases)
     case Flags(labels)  : store_flags(cx, v, ptr, labels)
-    case Own()          : store_int(cx, lower_own(opts, v, t), ptr, 4)
-    case Borrow()       : store_int(cx, lower_borrow(opts, v, t), ptr, 4)
+    case Rc()           : store_int(cx, lower_handle(opts, v, t), ptr, 4)
 ```
 
 Integers are stored directly into memory. Because the input domain is exactly
@@ -975,25 +975,15 @@ def pack_flags_into_int(v, labels):
   return i
 ```
 
-Finally, `own` and `borrow` handles are lowered by inserting them into the
-current component instance's `HandleTable`:
+Finally, `rc` handles are lowered by inserting a handle pointing to the
+given resource into the `HandleTable` of the appropriate resource type:
 ```python
-def lower_own(cx, h, t):
-  assert(isinstance(h, OwnHandle))
-  return cx.inst.handles.add(h, t)
-
-def lower_borrow(cx, h, t):
-  assert(isinstance(h, BorrowHandle))
-  if cx.inst is t.rt.impl:
-    return h.rep
-  h.cx = cx
-  return cx.inst.handles.add(h, t)
+def lower_handle(cx, res, ht):
+  assert(isinstance(res, Resource))
+  return cx.inst.handles.add(ht.rt, HandleElem(res))
 ```
-The special case in `lower_borrow` is an optimization, recognizing that, when
-a borrowed handle is passed to the component that implemented the resource
-type, the only thing the borrowed handle is good for is calling
-`resource.rep`, so lowering might as well avoid the overhead of creating an
-intermediate borrow handle.
+The `add` method (defined above) performs deduplication and reference-counting
+of the resource.
 
 
 ### Flattening
@@ -1063,7 +1053,7 @@ def flatten_type(t):
     case Record(fields)       : return flatten_record(fields)
     case Variant(cases)       : return flatten_variant(cases)
     case Flags(labels)        : return ['i32'] * num_i32_flags(labels)
-    case Own(_) | Borrow(_)   : return ['i32']
+    case Rc()                 : return ['i32']
 ```
 
 Record flattening simply flattens each field in sequence.
@@ -1143,8 +1133,7 @@ def lift_flat(cx, vi, t):
     case Record(fields) : return lift_flat_record(cx, vi, fields)
     case Variant(cases) : return lift_flat_variant(cx, vi, cases)
     case Flags(labels)  : return lift_flat_flags(vi, labels)
-    case Own()          : return lift_own(cx, vi.next('i32'), t)
-    case Borrow()       : return lift_borrow(cx, vi.next('i32'), t)
+    case Rc()           : return lift_handle(cx, vi.next('i32'), t)
 ```
 
 Integers are lifted from core `i32` or `i64` values using the signedness of the
@@ -1267,8 +1256,7 @@ def lower_flat(cx, v, t):
     case Record(fields) : return lower_flat_record(cx, v, fields)
     case Variant(cases) : return lower_flat_variant(cx, v, cases)
     case Flags(labels)  : return lower_flat_flags(v, labels)
-    case Own()          : return [Value('i32', lower_own(cx, v, t))]
-    case Borrow()       : return [Value('i32', lower_borrow(cx, v, t))]
+    case Rc()           : return [Value('i32', lower_handle(cx, v, t))]
 ```
 
 Since component-level values are assumed in-range and, as previously stated,
@@ -1444,7 +1432,6 @@ def canon_lift(opts, inst, callee, ft, args):
   def post_return():
     if opts.post_return is not None:
       opts.post_return(flat_results)
-    trap_if(cx.borrow_count != 0)
 
   return (results, post_return)
 ```
@@ -1497,9 +1484,6 @@ def canon_lower(opts, inst, callee, calling_import, ft, flat_args):
 
   post_return()
 
-  for h in cx.lenders:
-    h.lend_count -= 1
-
   if calling_import:
     inst.may_enter = True
 
@@ -1553,10 +1537,10 @@ the AOT compiler as requiring an intermediate copy to implement the above
 
 For a canonical definition:
 ```
-(canon resource.new $t (core func $f))
+(canon resource.new $rt (core func $f))
 ```
 validation specifies:
-* `$t` must refer to locally-defined (not imported) resource type `$rt`
+* `$rt` must refer to a locally-defined (not imported) resource type
 * `$f` is given type `(func (param $rt.rep) (result i32))`, where `$rt.rep` is
   currently fixed to be `i32`.
 
@@ -1564,49 +1548,44 @@ Calling `$f` invokes the following function, which creates a resource object
 and adds it into the current instance's handle table:
 ```python
 def canon_resource_new(inst, rt, rep):
-  h = OwnHandle(rep, 0)
-  return inst.handles.add(h, Own(rt))
+  res = Resource(rep)
+  return inst.handles.add(rt, HandleElem(res))
 ```
 
 ### `canon resource.drop`
 
 For a canonical definition:
 ```
-(canon resource.drop $t (core func $f))
+(canon resource.drop $rt (core func $f))
 ```
 validation specifies:
-* `$t` must refer to a handle type `(own $rt)` or `(borrow $rt)`
+* `$rt` must refer to a resource type
 * `$f` is given type `(func (param i32))`
 
-Calling `$f` invokes the following function, which removes a handle guarded to
-be of type `$t` from the handle table and then, for an `own` handle, calls the
-optional destructor.
+Calling `$f` invokes the following function:
 ```python
-def canon_resource_drop(inst, t, i):
-  inst.handles.drop(i, t)
+def canon_resource_drop(inst, rt, i):
+  inst.handles.drop(inst, rt, i)
 ```
-The `may_enter` guard ensures the non-reentrance [component invariant], since
-a destructor call is analogous to a call to an export.
+Note that `resource.drop` may or may not remove the handle at index `i` from
+the handle table, depending on the handle's `dup_count`.
 
 ### `canon resource.rep`
 
 For a canonical definition:
 ```
-(canon resource.rep $t (core func $f))
+(canon resource.rep $rt (core func $f))
 ```
 validation specifies:
-* `$t` must refer to a locally-defined (not imported) resource type `$rt`
+* `$rt` must refer to a locally-defined (not imported) resource type
 * `$f` is given type `(func (param i32) (result $rt.rep))`, where `$rt.rep` is
   currently fixed to be `i32`.
 
 Calling `$f` invokes the following function, which extracts the core
-representation of the indexed handle after checking that the resource type
-matches. Note that the "locally-defined" requirement above ensures that only
-the component instance defining a resource can access its representation.
+representation of the resource pointed to by the indexed handle:
 ```python
 def canon_resource_rep(inst, rt, i):
-  h = inst.handles.get(i, rt)
-  return h.rep
+  return inst.handles.get(rt, i).res.rep
 ```
 
 
diff --git a/design/mvp/Explainer.md b/design/mvp/Explainer.md
index 7f34e428..809f96ed 100644
--- a/design/mvp/Explainer.md
+++ b/design/mvp/Explainer.md
@@ -495,8 +495,7 @@ defvaltype    ::= bool
                 | (union <valtype>+)
                 | (option <valtype>)
                 | (result <valtype>? (error <valtype>)?)
-                | (own <typeidx>)
-                | (borrow <typeidx>)
+                | (rc <typeidx>)
 valtype       ::= <typeidx>
                 | <defvaltype>
 resourcetype  ::= (resource (rep i32) (dtor <funcidx>)?)
@@ -540,8 +539,7 @@ sets of abstract values:
 | `record`                  | heterogeneous [tuples] of named values |
 | `variant`                 | heterogeneous [tagged unions] of named values |
 | `list`                    | homogeneous, variable-length [sequences] of values |
-| `own`                     | a unique, opaque address of a resource that will be destroyed when this value is dropped |
-| `borrow`                  | an opaque address of a resource that must be dropped before the current export call returns |
+| `rc`                      | a unique, opaque address of a resource that will be destroyed when the last handle is dropped |
 
 How these abstract values are produced and consumed from Core WebAssembly
 values and linear memory is configured by the component via *canonical lifting
@@ -559,19 +557,22 @@ value so that:
    assumptions that NaN payload bits are preserved by the other side (since
    they often aren't).
 
-The `own` and `borrow` value types are both *handle types*. Handles logically
-contain the opaque address of a resource and avoid copying the resource when
-passed across component boundaries. By way of metaphor to operating systems,
-handles are analogous to file descriptors, which are stored in a table and may
-only be used indirectly by untrusted user-mode processes via their integer
-index in the table. In the Component Model, handles are lifted-from and
-lowered-into `i32` values that index an encapsulated per-component-instance
-*handle table* that is maintained by the canonical function definitions
-described [below](#canonical-definitions). The uniqueness and dropping
-conditions mentioned above are enforced at runtime by the Component Model
-through these canonical definitions. The `typeidx` immediate of a handle type
-must refer to a `resource` type (described below) that statically classifies
-the particular kinds of resources the handle can point to.
+The `rc` value type is a *handle type*, where `rc` stands for "reference
+counted". (In the future, other handle types are expected to be added.) Handles
+logically contain the address of a resource and avoid copying the resource when
+the handle is passed across a component boundary. By way of metaphor to
+operating systems, handles are analogous to file descriptors, which are stored
+in a table and may only be used indirectly by untrusted user-mode processes via
+their integer index in the table. In the Component Model, handles are
+lifted-from and lowered-into `i32` values that index an encapsulated
+per-component-instance *handle table* that is maintained by the canonical
+function definitions described [below](#canonical-definitions). Handles are
+deduplicated upon lowering such that two `rc` handles containing the same
+resource address are given the same `i32` handle index. Thus, an `i32` handle
+index can be used as a component-local identity for purposes of equality and
+hashing. The `typeidx` immediate of a handle type must refer to a `resource`
+type (described below) that statically classifies the particular kinds of
+resources the handle can point to.
 
 The [subtyping] between all these types is described in a separate
 [subtyping explainer](Subtyping.md). Of note here, though: the optional
@@ -611,14 +612,14 @@ wrapping it in any containing record/object/struct.
 The `resource` type constructor creates a fresh type for each instance of the
 containing component (with "freshness" and its interaction with general
 type-checking described in more detail [below](#type-checking)). Resource types
-can be referred to by handle types (such as `own` and `borrow`) as well as the
-canonical built-ins described [below](#canonical-built-ins). The `rep`
-immediate of a `resource` type specifies its *core representation type*, which
-is currently fixed to `i32`, but will be relaxed in the future (to at least
-include `i64`, but also potentially other types). When the last handle to a
-resource is dropped, the resource's `dtor` function will be called (if
-present), allowing the implementing component to perform clean-up like freeing
-linear memory allocations.
+can be referred to by `rc` handle types as well as the canonical built-ins
+described [below](#canonical-built-ins). The `rep` immediate of a `resource`
+type specifies its *core representation type*, which is currently fixed to
+`i32`, but will be relaxed in the future (to at least include `i64`, but also
+potentially other types). When the last handle to a resource is dropped, the
+resource's `dtor` function will be called (if present), allowing the
+implementing component to perform clean-up like freeing linear memory
+allocations.
 
 The `instance` type constructor describes a list of named, typed definitions
 that can be imported or exported by a component. Informally, instance types
@@ -688,7 +689,7 @@ declarators to be used by subsequent declarators in the type:
       ;; ...
     ))
     (alias export $fs "file" (type $file))
-    (export "fancy-op" (func (param "f" (borrow $file))))
+    (export "fancy-op" (func (param "f" (rc $file))))
   ))
 )
 ```
@@ -712,10 +713,10 @@ definitions:
     (export "g2" (func (type $G)))
     (export "h" (func (result $U)))
     (import "T" (type $T (sub resource)))
-    (import "i" (func (param "x" (list (own $T)))))
+    (import "i" (func (param "x" (list (rc $T)))))
     (export $T' "T2" (type (eq $T)))
     (export $U' "U" (type (sub resource)))
-    (export "j" (func (param "x" (borrow $T')) (result (own $U'))))
+    (export "j" (func (param "x" (rc $T')) (result (rc $U'))))
   ))
 )
 ```
@@ -831,41 +832,33 @@ the following component:
   (import "T1" (type $T1 (sub resource)))
   (import "T2" (type $T2 (sub resource)))
   (import "T3" (type $T3 (eq $T2)))
-  (type $ListT1 (list (own $T1)))
-  (type $ListT2 (list (own $T2)))
-  (type $ListT3 (list (own $T3)))
+  (type $ListT1 (list (rc $T1)))
+  (type $ListT2 (list (rc $T2)))
+  (type $ListT3 (list (rc $T3)))
 )
 ```
 the types `$T2` and `$T3` are equal to each other but not to `$T1`. By the
 above transitive structural equality rules, the types `$List2` and `$List3` are
 equal to each other but not to `$List1`.
 
-Handle types (`own` and `borrow`) are structural types (like `list`) but, since
+Handle types (e.g., `(rc $R)`) are structural types (like `list`) but, since
 they refer to resource types, transitively "inherit" the freshness of abstract
 resource types. For example, in the following component:
 ```wasm
 (component
   (import "T" (type $T (sub resource)))
   (import "U" (type $U (sub resource)))
-  (type $Own1 (own $T))
-  (type $Own2 (own $T))
-  (type $Own3 (own $U))
-  (type $ListOwn1 (list $Own1))
-  (type $ListOwn2 (list $Own2))
-  (type $ListOwn3 (list $Own3))
-  (type $Borrow1 (borrow $T))
-  (type $Borrow2 (borrow $T))
-  (type $Borrow3 (borrow $U))
-  (type $ListBorrow1 (list $Borrow1))
-  (type $ListBorrow2 (list $Borrow2))
-  (type $ListBorrow3 (list $Borrow3))
+  (type $Rc1 (rc $T))
+  (type $Rc2 (rc $T))
+  (type $Rc3 (rc $U))
+  (type $ListRc1 (list $Rc1))
+  (type $ListRc2 (list $Rc2))
+  (type $ListRc3 (list $Rc3))
 )
 ```
-the types `$Own1` and `$Own2` are equal to each other but not to `$Own3` or
-any of the `$Borrow*`.  Similarly, `$Borrow1` and `$Borrow2` are equal to
-each other but not `$Borrow3`. Transitively, the types `$ListOwn1` and
-`$ListOwn2` are equal to each other but not `$ListOwn3` or any of the
-`$ListBorrow*`. These type-checking rules for type imports mirror the
+the types `$Rc1` and `$Rc2` are equal to each other but not to `$Rc3`.
+Transitively, the types `$ListRc1` and `$ListRc2` are equal to each other but
+not `$ListRc3`. These type-checking rules for type imports mirror the
 *introduction* rule of [universal types]  (∀T).
 
 The above examples all show abstract types in terms of *imports*, but the same
@@ -903,8 +896,8 @@ For example, in the following example component:
 (component
   (type $R1 (resource (rep i32)))
   (type $R2 (resource (rep i32)))
-  (func $f1 (result (own $R1)) (canon lift ...))
-  (func $f2 (param (own $R2)) (canon lift ...))
+  (func $f1 (result (rc $R1)) (canon lift ...))
+  (func $f2 (param (rc $R2)) (canon lift ...))
 )
 ```
 the types `$R1` and `$R2` are unequal and thus the return type of `$f1`
@@ -980,11 +973,11 @@ When supplying a resource type (imported *or* defined) to a type import via
 (component $P
   (import "C1" (component $C1
     (import "T" (type $T (sub resource)))
-    (export "foo" (func (param (own $T))))
+    (export "foo" (func (param (rc $T))))
   ))
   (import "C2" (component $C2
     (import "T" (type $T (sub resource)))
-    (import "foo" (func (param (own $T))))
+    (import "foo" (func (param (rc $T))))
   ))
   (type $R (resource (rep i32)))
   (instance $c1 (instantiate $C1 (with "T" (type $R))))
@@ -1189,37 +1182,38 @@ async is added to the proposal, [tasks][Future and Stream Types]).
 ```
 canon ::= ...
         | (canon resource.new <typeidx> (core func <id>?))
-        | (canon resource.drop <valtype> (core func <id>?))
+        | (canon resource.drop <typeidx> (core func <id>?))
         | (canon resource.rep <typeidx> (core func <id>?))
 ```
 The `resource.new` built-in requires that the given `typeidx` refers to a
 `resource` `deftype` (a resource defined within this component). The parameters
 of `resource.new` are the value types from the `(rep <valtype>)` immediate of
 the resource type. The return value of `resource.new` is an `i32` index
-referring to an `own` handle in the current component instance's handle table.
-Because resource type representations are currently fixed to be `i32`, the core
-function signature of `resource.new` is currently always `[i32] -> [i32]`.
+referring to an `(rc $R)` handle in the current component instance's handle
+table for `$R`. Because resource type representations are currently fixed to be
+`i32`, the core function signature of `resource.new` is currently always
+`[i32] -> [i32]`.
 
 The `resource.drop` built-in has core function signature `[i32] -> []` and
-drops the handle at the given index from the handle table. The `valtype`
-immediate must either be an `own` or `borrow` handle type. If `own`, the
-resource type's `dtor` function is called synchronously, if present.
-
-In-between `resource.new` and `resource.drop`, `own` handles can be passed
-between components via import and export calls using `own` and `borrow` handle
-types in parameters and results. The Canonical ABI specifies that `own` handles
-are *transferred* from the producer component instance's handle table into the
-consumer component instance's handle table. In contrast, `borrow` handles are
-*copied* into the callee component instance's handle table, but with runtime
-(trapping) guards to ensure that the callee calls `resource.drop` on the
-borrowed handle before the end of the call and that the owner of the resource
-does not destroy the resource for the duration of the call.
-
-Lastly, given the `i32` index of an `own` or `borrow` handle, the component
-that defined a resource type (and only that component) can call the
-`resource.rep` built-in to access the `rep` value. (In the future a
-`resource.set` could potentially be added, if needed.) Because of the fixed
-`(rep i32)`, the core signature of `resource.rep` is `[i32] -> [i32]`.
+drops the handle at the given index from the handle table. If this is the last
+`rc` handle for a given resource, that resource's `dtor` function is called
+synchronously, passing it the resource's `rep`.
+
+In-between `resource.new` and `resource.drop`, `rc` handles can be passed
+between components via import and export calls via parameters and results. The
+Canonical ABI specifies that `rc` handles are copied from one component
+instance's handle table into another's. If the receiving component instance
+already contains an `rc` handle for the same resource, the existing `rc`
+handle's index is returned and a duplicate-count is incremented *on the
+handle*. When `resource.drop` is called on a handle with a duplicate-count
+greater than zero, the count is decremented instead of removing the handle from
+the handle table. This allows each lowered handle to be managed and dropped
+separately, without worrying whether the handle was de-duplicated or not.
+
+Lastly, given the `i32` index of an `rc` handle, the component that defined a
+resource type (and only that component) can call the `resource.rep` built-in to
+access the `rep` value. Because of the fixed `(rep i32)`, the core signature of
+`resource.rep` is `[i32] -> [i32]`.
 
 As an example, the following component imports the `resource.new` built-in,
 allowing it to create and return new resources to its client:
@@ -1241,7 +1235,7 @@ allowing it to create and return new resources to its client:
     (with "canon" (instance (export "R_new" (func $R_new))))
   ))
   (export $R' "r" (type $R))
-  (func (export "make-r") (param ...) (result (own $R'))
+  (func (export "make-r") (param ...) (result (rc $R'))
     (canon lift (core func $main "make_R"))
   )
 )
@@ -1338,12 +1332,12 @@ For example, in the following component:
   (import "R1" (type $R1 (sub resource)))
   (type $R2 (resource (rep i32)))
   (export $R2' "R2" (type $R2))
-  (func $f1 (result (own $R1)) (canon lift ...))
-  (func $f2 (result (own $R2)) (canon lift ...))
-  (func $f2' (result (own $R2')) (canon lift ...))
+  (func $f1 (result (rc $R1)) (canon lift ...))
+  (func $f2 (result (rc $R2)) (canon lift ...))
+  (func $f2' (result (rc $R2')) (canon lift ...))
   (export "f1" (func $f1))
   ;; (export "f2" (func $f2)) -- invalid
-  (export "f2" (func $f2) (func (result (own $R2'))))
+  (export "f2" (func $f2) (func (result (rc $R2'))))
   (export "f2" (func $f2'))
 )
 ```
@@ -1662,7 +1656,7 @@ At a high level, the additional coercions would be:
 | `option` | same as [`T?`] | same as [`T?`] |
 | `union` | same as [`union`] | same as [`union`] |
 | `result` | same as `variant`, but coerce a top-level `error` return value to a thrown exception | same as `variant`, but coerce uncaught exceptions to top-level `error` return values |
-| `own`, `borrow` | see below | see below |
+| `rc` | see below | see below |
 
 Notes:
 * Function parameter names are ignored since JavaScript doesn't have named
@@ -1681,19 +1675,16 @@ Notes:
   the JS API of the unspecialized `variant` (e.g.,
   `(variant (case "some" (option u32)) (case "none"))`, despecializing only
   the problematic outer `option`).
-* When coercing `ToWebAssemblyValue`, `own` and `borrow` handle types would
-  dynamically guard that the incoming JS value's dynamic type was compatible
-  with the imported resource type referenced by the handle type. For example,
-  if a component contains `(import "Object" (type $Object (sub resource)))` and
-  is instantiated with the JS `Object` constructor, then `(own $Object)` and
-  `(borrow $Object)` could accept JS `object` values.
-* When coercing `ToJSValue`, handle values would be wrapped with JS objects
+* When coercing `ToWebAssemblyValue`, `rc` handle types would dynamically guard
+  that the incoming JS value's dynamic type was compatible with the imported
+  resource type referenced by the handle type. For example, if a component
+  contains `(import "Object" (type $Object (sub resource)))` and is
+  instantiated with the JS `Object` constructor, then `(rc $Object)` could
+  accept JS `object` values.
+* When coercing `ToJSValue`, `rc handle values would be wrapped with JS objects
   that are instances of the handles' resource type's exported constructor
-  (described above). For `own` handles, a [`FinalizationRegistry`] would be
-  used to drop the `own` handle (thereby calling the resource destructor) when
-  its wrapper object was unreachable from JS. For `borrow` handles, the wrapper
-  object would become dynamically invalid (throwing on any access) at the end
-  of the export call.
+  (described above). A [`FinalizationRegistry`] would be used to drop the
+  handle when the wrapper object became unreachable from JS.
 * The forthcoming addition of [future and stream types] would allow `Promise`
   and `ReadableStream` values to be passed directly to and from components
   without requiring handles or callbacks.
@@ -1779,6 +1770,7 @@ For some use-case-focused, worked examples, see:
 
 The following features are needed to address the [MVP Use Cases](../high-level/UseCases.md)
 and will be added over the coming months to complete the MVP proposal:
+* add additional handle types with better contractual invariants than `rc` (including exclusive ownership)
 * concurrency support ([slides][Future And Stream Types])
 * optional imports, definitions and exports (subsuming
   [WASI Optional Imports](https://github.com/WebAssembly/WASI/blob/main/legacy/optional-imports.md)
diff --git a/design/mvp/Subtyping.md b/design/mvp/Subtyping.md
index 2dd22b44..8bd218e1 100644
--- a/design/mvp/Subtyping.md
+++ b/design/mvp/Subtyping.md
@@ -17,7 +17,7 @@ But roughly speaking:
 | `option`                  | `T <: (option T)` |
 | `expected`                | `T <: (expected T _)` |
 | `union`                   | `T <: (union ... T ...)` |
-| `own`, `borrow`           | none (although resource subtyping may be introduced in the future which would imply handle subtyping) |
+| `rc`                      | none (although resource subtyping may be introduced in the future which would imply handle subtyping) |
 | `func`                    | parameter names must match in order; contravariant parameter subtyping; superfluous parameters can be ignored in the subtype; `option` parameters can be ignored in the supertype; covariant result subtyping |
 | `component`               | all imports in the subtype must be present in the supertype with matching types; all exports in the supertype must be present in the subtype; the `URL` is treated as the complete name, when present, ignoring the `name` field |
 
diff --git a/design/mvp/WIT.md b/design/mvp/WIT.md
index e5b276f7..a0b599f2 100644
--- a/design/mvp/WIT.md
+++ b/design/mvp/WIT.md
@@ -900,6 +900,62 @@ union-cases ::= ty
               | ty ',' union-cases?
 ```
 
+### Item: `resource`
+
+A `resource` statement defines a new abstract type for a *resource*, which is
+an entity with a lifetime that can only be passed around indirectly via [handle
+values](#handles). Resource types are used in interfaces to describe things
+that can't or shouldn't be copied by value.
+
+For example, the following Wit defines a resource type and a function that
+takes and returns a handle (`rc<blob>`) to resources of this type:
+```wit
+resource blob
+transform: func(rc<blob>) -> rc<blob>
+```
+
+As syntactic sugar, resource statements can also declare any number of
+*methods*, which are functions that implicitly takes a `self` handle parameter.
+A resource statement can also contain any number of *static functions*, which
+do not have an implicit `self` parameter but are meant to be lexically nested
+in the scope of the resource type. Lastly, a resource statement can contain at
+most one *constructor* function, which is syntactic sugar for a function
+returning a handle of the containing resource type.
+
+For example, the following resource definition:
+```wit
+resource blob {
+    constructor(init: list<u8>)
+    write: func(bytes: list<u8>)
+    read: func(n: u32) -> list<u8>
+    merge: static func(lhs: rc<blob>, rhs: rc<blob>) -> rc<blob>
+}
+```
+desugars into:
+```wit
+resource blob
+%[constructor]blob: func(self: rc<blob>, bytes: list<u8>)
+%[method]blob.write: func(self: rc<blob>, bytes: list<u8>)
+%[method]blob.read: func(self: rc<blob>, n: u32) -> list<u8>
+%[static]blob.merge: func(lhs: rc<blob>, rhs: rc<blob>) -> rc<blob>
+```
+These `%`-prefixed [`name`s](Explainer.md) embed the resource type name so that
+bindings generators can generate idiomatic syntax for the target language or
+(for languages like C) fall back to an appropriately-prefixed free function
+name.
+
+Specifically, the syntax for a `resource` definition is:
+```ebnf
+resource-item ::= 'resource' id resource-methods?
+
+resource-methods ::= '{' resource-method* '}'
+
+resource-method ::= func-item
+                  | id ':' 'static' func-type
+                  | 'constructor' param-list
+```
+
+
 ## Types
 
 As mentioned previously the intention of `wit` is to allow defining types
@@ -971,37 +1027,25 @@ through a `use` statement or they can be defined locally.
 
 ## Handles
 
-There are two types of handles in Wit: "owned" handles and "borrowed" handles.
-Owned handles represent the passing of unique ownership of a resource between
-two components. When the owner of an owned handle drops that handle, the
-resource is destroyed. In contrast, a borrowed handle represents a temporary
-loan of a handle from the caller to the callee for the duration of the call.
-
 The syntax for handles is:
 ```ebnf
-handle ::= id
-         | 'borrow' '<' id '>'
+handle ::= 'rc' '<' id '>'
 ```
+(Other handle types are expected to be added in the future.)
 
-The `id` case denotes an owned handle, where `id` is the name of a preceding
-`resource` item. Thus, the "default" way that resources are passed between
-components is via transfer of unique ownership.
+`rc` stands for a non-exclusive, reference-counted handle that keeps the
+pointed-to resource alive until the last handle is dropped. In languages with
+garbage collection or [RAII] idioms, bindings generators would automatically
+take care of dropping the `rc` handle using finalizers or destructors.
 
-The resource method syntax defined above is syntactic sugar that expands into
-separate function items that take a first parameter named `self` of type
-`borrow`. For example, the compound definition:
-```
-resource file {
-    read: func(n: u32) -> list<u8>
-}
-```
-is expanded into:
-```
-resource file
-%[method]file.read: func(self: borrow<file>, n: u32) -> list<u8>
+For example:
+```wit
+resource region
+merge: func(first: rc<region>, second: rc<region>) -> rc<region>
 ```
-where `%[method]file.read` is the desugared name of a method according to the
-Component Model's definition of [`name`](Explainer.md).
+
+
+[RAII]: https://en.wikipedia.org/wiki/Resource_acquisition_is_initialization
 
 
 ## Identifiers
diff --git a/design/mvp/canonical-abi/definitions.py b/design/mvp/canonical-abi/definitions.py
index dee5487c..09dafa40 100644
--- a/design/mvp/canonical-abi/definitions.py
+++ b/design/mvp/canonical-abi/definitions.py
@@ -160,11 +160,7 @@ class Flags(ValType):
   labels: [str]
 
 @dataclass
-class Own(ValType):
-  rt: ResourceType
-
-@dataclass
-class Borrow(ValType):
+class Rc(ValType):
   rt: ResourceType
 
 ### Despecialization
@@ -194,7 +190,7 @@ def alignment(t):
     case Record(fields)     : return alignment_record(fields)
     case Variant(cases)     : return alignment_variant(cases)
     case Flags(labels)      : return alignment_flags(labels)
-    case Own(_) | Borrow(_) : return 4
+    case Rc()               : return 4
 
 #
 
@@ -249,7 +245,7 @@ def size(t):
     case Record(fields)     : return size_record(fields)
     case Variant(cases)     : return size_variant(cases)
     case Flags(labels)      : return size_flags(labels)
-    case Own(_) | Borrow(_) : return 4
+    case Rc()               : return 4
 
 def size_record(fields):
   s = 0
@@ -286,14 +282,10 @@ def num_i32_flags(labels):
 class Context:
   opts: CanonicalOptions
   inst: ComponentInstance
-  lenders: [Handle]
-  borrow_count: int
 
   def __init__(self, opts, inst):
     self.opts = opts
     self.inst = inst
-    self.lenders = []
-    self.borrow_count = 0
 
 #
 
@@ -317,37 +309,57 @@ def __init__(self):
 
 #
 
-@dataclass
-class ResourceType(Type):
+class ResourceType:
   impl: ComponentInstance
   dtor: Optional[Callable[[int],None]]
 
 #
 
-@dataclass
-class Handle:
+class Resource:
   rep: int
-  lend_count: int
+  ct: int
 
-@dataclass
-class OwnHandle(Handle):
-  pass
+  def __init__(self, rep):
+    self.rep = rep
+    self.ct = 0
 
-@dataclass
-class BorrowHandle(Handle):
-  cx: Optional[Context]
+  def inc(self):
+    self.ct += 1
+
+  def dec(self, inst, rt):
+    assert(self.ct > 0)
+    self.ct -= 1
+    if self.ct != 0:
+      return;
+    trap_if(inst is not rt.impl and not rt.impl.may_enter)
+    if rt.dtor:
+      rt.dtor(self.rep)
 
 #
 
+class HandleElem:
+  res: Resource
+  dup_count: int
+
+  def __init__(self, res):
+    self.res = res
+    self.dup_count = 0
+
 class HandleTable:
-  array: [Optional[Handle]]
+  array: [Optional[HandleElem]]
   free: [int]
+  deduped: MutableMapping[Resource, int]
 
   def __init__(self):
     self.array = []
     self.free = []
+    self.deduped = {}
 
-  def add(self, h, t):
+  def add(self, h):
+    if h.res in self.deduped:
+      i = self.deduped[h.res]
+      self.array[i].dup_count += 1
+      return i
     if self.free:
       i = self.free.pop()
       assert(self.array[i] is None)
@@ -355,9 +367,8 @@ def add(self, h, t):
     else:
       i = len(self.array)
       self.array.append(h)
-    match t:
-      case Borrow():
-        h.cx.borrow_count += 1
+    self.deduped[h.res] = i
+    h.res.inc()
     return i
 
 #
@@ -369,21 +380,15 @@ def get(self, i):
 
 #
 
-  def transfer_or_drop(self, i, t, drop):
+  def drop(self, inst, rt, i):
     h = self.get(i)
-    trap_if(h.lend_count != 0)
-    match t:
-      case Own():
-        trap_if(not isinstance(h, OwnHandle))
-        if drop and t.rt.dtor:
-          trap_if(not t.rt.impl.may_enter)
-          t.rt.dtor(h.rep)
-      case Borrow():
-        trap_if(not isinstance(h, BorrowHandle))
-        h.cx.borrow_count -= 1
+    if h.dup_count > 0:
+      h.dup_count -= 1
+      return
     self.array[i] = None
     self.free.append(i)
-    return h
+    del self.deduped[h.res]
+    h.res.dec(inst, rt)
 
 #
 
@@ -394,18 +399,16 @@ def __init__(self):
     self.rt_to_table = dict()
 
   def table(self, rt):
-    if id(rt) not in self.rt_to_table:
-      self.rt_to_table[id(rt)] = HandleTable()
-    return self.rt_to_table[id(rt)]
+    if rt not in self.rt_to_table:
+      self.rt_to_table[rt] = HandleTable()
+    return self.rt_to_table[rt]
 
-  def add(self, h, t):
-    return self.table(t.rt).add(h, t)
-  def get(self, i, rt):
+  def add(self, rt, h):
+    return self.table(rt).add(h)
+  def get(self, rt, i):
     return self.table(rt).get(i)
-  def transfer(self, i, t):
-    return self.table(t.rt).transfer_or_drop(i, t, drop = False)
-  def drop(self, i, t):
-    self.table(t.rt).transfer_or_drop(i, t, drop = True)
+  def drop(self, inst, rt, i):
+    self.table(rt).drop(inst, rt, i)
 
 ### Loading
 
@@ -430,8 +433,7 @@ def load(cx, ptr, t):
     case Record(fields) : return load_record(cx, ptr, fields)
     case Variant(cases) : return load_variant(cx, ptr, cases)
     case Flags(labels)  : return load_flags(cx, ptr, labels)
-    case Own()          : return lift_own(cx, load_int(opts, ptr, 4), t)
-    case Borrow()       : return lift_borrow(cx, load_int(opts, ptr, 4), t)
+    case Rc()           : return lift_handle(cx, load_int(opts, ptr, 4), t)
 
 #
 
@@ -575,16 +577,8 @@ def unpack_flags_from_int(i, labels):
 
 #
 
-def lift_own(cx, i, t):
-  return cx.inst.handles.transfer(i, t)
-
-#
-
-def lift_borrow(cx, i, t):
-  h = cx.inst.handles.get(i, t.rt)
-  h.lend_count += 1
-  cx.lenders.append(h)
-  return BorrowHandle(h.rep, 0, None)
+def lift_handle(cx, i, t):
+  return cx.inst.handles.get(t.rt, i).res
 
 ### Storing
 
@@ -609,8 +603,7 @@ def store(cx, v, t, ptr):
     case Record(fields) : store_record(cx, v, ptr, fields)
     case Variant(cases) : store_variant(cx, v, ptr, cases)
     case Flags(labels)  : store_flags(cx, v, ptr, labels)
-    case Own()          : store_int(cx, lower_own(opts, v, t), ptr, 4)
-    case Borrow()       : store_int(cx, lower_borrow(opts, v, t), ptr, 4)
+    case Rc()           : store_int(cx, lower_handle(opts, v, t), ptr, 4)
 
 #
 
@@ -847,16 +840,9 @@ def pack_flags_into_int(v, labels):
 
 #
 
-def lower_own(cx, h, t):
-  assert(isinstance(h, OwnHandle))
-  return cx.inst.handles.add(h, t)
-
-def lower_borrow(cx, h, t):
-  assert(isinstance(h, BorrowHandle))
-  if cx.inst is t.rt.impl:
-    return h.rep
-  h.cx = cx
-  return cx.inst.handles.add(h, t)
+def lower_handle(cx, res, ht):
+  assert(isinstance(res, Resource))
+  return cx.inst.handles.add(ht.rt, HandleElem(res))
 
 ### Flattening
 
@@ -897,7 +883,7 @@ def flatten_type(t):
     case Record(fields)       : return flatten_record(fields)
     case Variant(cases)       : return flatten_variant(cases)
     case Flags(labels)        : return ['i32'] * num_i32_flags(labels)
-    case Own(_) | Borrow(_)   : return ['i32']
+    case Rc()                 : return ['i32']
 
 #
 
@@ -961,8 +947,7 @@ def lift_flat(cx, vi, t):
     case Record(fields) : return lift_flat_record(cx, vi, fields)
     case Variant(cases) : return lift_flat_variant(cx, vi, cases)
     case Flags(labels)  : return lift_flat_flags(vi, labels)
-    case Own()          : return lift_own(cx, vi.next('i32'), t)
-    case Borrow()       : return lift_borrow(cx, vi.next('i32'), t)
+    case Rc()           : return lift_handle(cx, vi.next('i32'), t)
 
 #
 
@@ -1060,8 +1045,7 @@ def lower_flat(cx, v, t):
     case Record(fields) : return lower_flat_record(cx, v, fields)
     case Variant(cases) : return lower_flat_variant(cx, v, cases)
     case Flags(labels)  : return lower_flat_flags(v, labels)
-    case Own()          : return [Value('i32', lower_own(cx, v, t))]
-    case Borrow()       : return [Value('i32', lower_borrow(cx, v, t))]
+    case Rc()           : return [Value('i32', lower_handle(cx, v, t))]
 
 #
 
@@ -1156,7 +1140,7 @@ def lower_values(cx, max_flat, vs, ts, out_param = None):
       flat_vals += lower_flat(cx, vs[i], ts[i])
     return flat_vals
 
-### `lift`
+### `canon lift`
 
 def canon_lift(opts, inst, callee, ft, args):
   cx = Context(opts, inst)
@@ -1177,11 +1161,10 @@ def canon_lift(opts, inst, callee, ft, args):
   def post_return():
     if opts.post_return is not None:
       opts.post_return(flat_results)
-    trap_if(cx.borrow_count != 0)
 
   return (results, post_return)
 
-### `lower`
+### `canon lower`
 
 def canon_lower(opts, inst, callee, calling_import, ft, flat_args):
   cx = Context(opts, inst)
@@ -1202,27 +1185,23 @@ def canon_lower(opts, inst, callee, calling_import, ft, flat_args):
 
   post_return()
 
-  for h in cx.lenders:
-    h.lend_count -= 1
-
   if calling_import:
     inst.may_enter = True
 
   return flat_results
 
-### `resource.new`
+### `canon resource.new`
 
 def canon_resource_new(inst, rt, rep):
-  h = OwnHandle(rep, 0)
-  return inst.handles.add(h, Own(rt))
+  res = Resource(rep)
+  return inst.handles.add(rt, HandleElem(res))
 
-### `resource.drop`
+### `canon resource.drop`
 
-def canon_resource_drop(inst, t, i):
-  inst.handles.drop(i, t)
+def canon_resource_drop(inst, rt, i):
+  inst.handles.drop(inst, rt, i)
 
-### `resource.rep`
+### `canon resource.rep`
 
 def canon_resource_rep(inst, rt, i):
-  h = inst.handles.get(i, rt)
-  return h.rep
+  return inst.handles.get(rt, i).res.rep
diff --git a/design/mvp/canonical-abi/run_tests.py b/design/mvp/canonical-abi/run_tests.py
index b484cc18..4d87cd80 100644
--- a/design/mvp/canonical-abi/run_tests.py
+++ b/design/mvp/canonical-abi/run_tests.py
@@ -44,6 +44,12 @@ def mk_cx(memory = bytearray(), encoding = 'utf8', realloc = None, post_return =
   opts = mk_opts(memory, encoding, realloc, post_return)
   return Context(opts, ComponentInstance())
 
+def mk_rt(impl, dtor):
+  rt = ResourceType()
+  rt.impl = impl
+  rt.dtor = dtor
+  return rt
+
 def mk_str(s):
   return (s, 'utf8', len(s.encode('utf-8')))
 
@@ -384,92 +390,94 @@ def dtor(x):
     nonlocal dtor_value
     dtor_value = x
 
-  rt = ResourceType(ComponentInstance(), dtor) # usable in imports and exports
+  rt = mk_rt(ComponentInstance(), dtor)
 
   inst = ComponentInstance()
-  rt2 = ResourceType(inst, dtor) # only usable in exports
   opts = mk_opts()
 
   def host_import(args):
     assert(len(args) == 2)
     assert(args[0].rep == 42)
-    assert(args[1].rep == 44)
-    return ([OwnHandle(45, 0)], lambda:())
+    assert(args[1].rep == 43)
+    return ([Resource(44), args[1]], lambda:())
 
   def core_wasm(args):
     nonlocal dtor_value
 
-    assert(len(args) == 4)
+    assert(len(args) == 3)
     assert(args[0].t == 'i32' and args[0].v == 0)
     assert(args[1].t == 'i32' and args[1].v == 1)
-    assert(args[2].t == 'i32' and args[2].v == 2)
-    assert(args[3].t == 'i32' and args[3].v == 13)
+    assert(args[2].t == 'i32' and args[2].v == 0)
+    assert(len(inst.handles.table(rt).array) == 2)
     assert(canon_resource_rep(inst, rt, 0) == 42)
     assert(canon_resource_rep(inst, rt, 1) == 43)
-    assert(canon_resource_rep(inst, rt, 2) == 44)
 
     host_ft = FuncType([
-      Borrow(rt),
-      Borrow(rt)
+      Rc(rt),
+      Rc(rt)
     ],[
-      Own(rt)
+      Rc(rt),
+      Rc(rt)
     ])
     args = [
       Value('i32',0),
-      Value('i32',2)
+      Value('i32',1)
     ]
     results = canon_lower(opts, inst, host_import, True, host_ft, args)
-    assert(len(results) == 1)
-    assert(results[0].t == 'i32' and results[0].v == 3)
-    assert(canon_resource_rep(inst, rt, 3) == 45)
+    assert(len(results) == 2)
+    assert(results[0].t == 'i32' and results[0].v == 2)
+    assert(results[1].t == 'i32' and results[1].v == 1)
+    assert(len(inst.handles.table(rt).array) == 3)
+    assert(canon_resource_rep(inst, rt, 2) == 44)
+    assert(canon_resource_rep(inst, rt, 1) == 43)
 
     dtor_value = None
-    canon_resource_drop(inst, Own(rt), 0)
+    canon_resource_drop(inst, rt, 0)
+    assert(dtor_value is None)
+    assert(len(inst.handles.table(rt).free) == 0)
+    assert(inst.handles.table(rt).array[0] is not None)
+    canon_resource_drop(inst, rt, 0)
     assert(dtor_value == 42)
-    assert(len(inst.handles.table(rt).array) == 4)
-    assert(inst.handles.table(rt).array[0] is None)
     assert(len(inst.handles.table(rt).free) == 1)
+    assert(inst.handles.table(rt).array[0] is None)
 
-    h = canon_resource_new(inst, rt, 46)
+    h = canon_resource_new(inst, rt, 45)
     assert(h == 0)
-    assert(len(inst.handles.table(rt).array) == 4)
+    assert(len(inst.handles.table(rt).array) == 3)
     assert(inst.handles.table(rt).array[0] is not None)
     assert(len(inst.handles.table(rt).free) == 0)
 
     dtor_value = None
-    canon_resource_drop(inst, Borrow(rt), 2)
-    assert(dtor_value is None)
-    assert(len(inst.handles.table(rt).array) == 4)
-    assert(inst.handles.table(rt).array[2] is None)
+    canon_resource_drop(inst, rt, 0)
+    assert(dtor_value == 45)
+    assert(len(inst.handles.table(rt).array) == 3)
+    assert(inst.handles.table(rt).array[0] is None)
     assert(len(inst.handles.table(rt).free) == 1)
 
-    return [Value('i32', 0), Value('i32', 1), Value('i32', 3)]
+    return [Value('i32', 1), Value('i32', 2)]
 
   ft = FuncType([
-    Own(rt),
-    Own(rt),
-    Borrow(rt),
-    Borrow(rt2)
+    Rc(rt),
+    Rc(rt),
+    Rc(rt),
   ],[
-    Own(rt),
-    Own(rt),
-    Own(rt)
+    Rc(rt),
+    Rc(rt)
   ])
+  r1 = Resource(42)
+  r2 = Resource(43)
   args = [
-    OwnHandle(42, 0),
-    OwnHandle(43, 0),
-    BorrowHandle(44, 0, None),
-    BorrowHandle(13, 0, None)
+    r1,
+    r2,
+    r1
   ]
   got,post_return = canon_lift(opts, inst, core_wasm, ft, args)
 
-  assert(len(got) == 3)
-  assert(got[0].rep == 46)
-  assert(got[1].rep == 43)
-  assert(got[2].rep == 45)
-  assert(len(inst.handles.table(rt).array) == 4)
-  assert(all(inst.handles.table(rt).array[i] is None for i in range(3)))
-  assert(len(inst.handles.table(rt).free) == 4)
+  assert(len(got) == 2)
+  assert(got[0].rep == 43)
+  assert(got[1].rep == 44)
+  assert(len(inst.handles.table(rt).array) == 3)
+  assert(len(inst.handles.table(rt).free) == 1)
   definitions.MAX_FLAT_RESULTS = before
 
 test_handles()

From 915d56c462c0417470e60236c401e476ab96801b Mon Sep 17 00:00:00 2001
From: Luke Wagner <mail@lukewagner.name>
Date: Mon, 5 Jun 2023 22:40:55 -0700
Subject: [PATCH 2/2] Remove out-of-place sentence

---
 design/mvp/CanonicalABI.md | 2 --
 1 file changed, 2 deletions(-)

diff --git a/design/mvp/CanonicalABI.md b/design/mvp/CanonicalABI.md
index 30857f58..4fbd1c50 100644
--- a/design/mvp/CanonicalABI.md
+++ b/design/mvp/CanonicalABI.md
@@ -982,8 +982,6 @@ def lower_handle(cx, res, ht):
   assert(isinstance(res, Resource))
   return cx.inst.handles.add(ht.rt, HandleElem(res))
 ```
-The `add` method (defined above) performs deduplication and reference-counting
-of the resource.
 
 
 ### Flattening