diff --git a/design/mvp/Binary.md b/design/mvp/Binary.md
index eab7dc94d..c09789fa4 100644
--- a/design/mvp/Binary.md
+++ b/design/mvp/Binary.md
@@ -145,7 +145,7 @@ core:deftype     ::= rt:<core:rectype>                                    => rt
                    | mt:<core:moduletype>                                 => mt
 core:moduletype  ::= 0x50 md*:vec(<core:moduledecl>)                      => (module md*)
 core:moduledecl  ::= 0x00 i:<core:import>                                 => i
-                   | 0x01 t:<core:type>                                   => t
+                   | 0x01 rt:<core:rectype>                               => (type rt)
                    | 0x02 a:<core:alias>                                  => a
                    | 0x03 e:<core:exportdecl>                             => e
 core:alias       ::= 0x10 0x01 ct:<u32> idx:<u32>                         => (alias outer ct idx (type))
@@ -163,10 +163,15 @@ Notes:
   component core type is `0x00 0x50`; elsewhere, `0x50`). By the v1.0 release of
   this specification, `core:moduletype` will receive a new, non-overlapping
   opcode.
-* Validation of `core:moduledecl` rejects `core:moduletype` definitions
-  and `outer` aliases of `core:moduletype` definitions inside `type`
-  declarators. Thus, as an invariant, when validating a `core:moduletype`, the
-  core type index space will not contain any core module types.
+* The ambiguity above does not arise within a `core:moduletype`: the `type`
+  declarators of `core:moduledecl` contain a `core:rectype` directly, using the
+  same encoding as a Core WebAssembly type section. Thus, within a
+  `core:moduletype`, a non-final `sub` is encoded as `0x50` without a `0x00`
+  prefix, and a `core:moduletype` cannot be nested.
+* Validation of `core:moduledecl` rejects `outer` aliases of
+  `core:moduletype` definitions. Thus, as an invariant, when validating a
+  `core:moduletype`, the core type index space will not contain any core module
+  types.
 * As described in the explainer, each module type is validated with an
   initially-empty type index space.
 * In `core:alias`, the first `0x10` is the opcode for `type` in `core:sort` and
diff --git a/design/mvp/CanonicalABI.md b/design/mvp/CanonicalABI.md
index 92e01e7f3..45523b867 100644
--- a/design/mvp/CanonicalABI.md
+++ b/design/mvp/CanonicalABI.md
@@ -3624,7 +3624,6 @@ validation is performed where `$callee` has type `$ft`:
 * requires options [based on `lift(result)`](#canonopt-validation) if `ft` has a result
 * if `len(flatten_types(ft.param_types())) > max_flat_params`, `memory` is required
 * if `len(flatten_types(ft.result_type())) > max_flat_results`, `memory` is required
-* 🔀 if `async` is specified, `memory` must be present
 
 When instantiating a component instance, the runtime calls `Store.lower` (defined
 above) to capture the `$callee`, `$ft` and `$opts` immediates of `canon lower`
@@ -3946,6 +3945,7 @@ In addition to [general validation of `$opts`](#canonopt-validation) validation
 specifies:
 
 * `$f` is given type `flatten_functype($opts, (func (param $t)?), 'lower')`
+* `$t` must not transitively contain `borrow`
 * `$opts` may only contain `memory` and `string-encoding`
 * [`lift($f.result)` above](#canonopt-validation) defines required options
 
diff --git a/test/async/validate-task-return.wast b/test/async/validate-task-return.wast
new file mode 100644
index 000000000..738a1df3a
--- /dev/null
+++ b/test/async/validate-task-return.wast
@@ -0,0 +1,16 @@
+
+;; the result of `task.return` cannot contain a `borrow`
+(assert_invalid
+  (component
+    (type $r (resource (rep i32)))
+    (core func (canon task.return (result (borrow $r)))))
+  "`task.return` result cannot contain a `borrow` type")
+(assert_invalid
+  (component
+    (type $r (resource (rep i32)))
+    (type $t (tuple u32 (borrow $r)))
+    (core func (canon task.return (result $t))))
+  "`task.return` result cannot contain a `borrow` type")
+(component
+  (type $r (resource (rep i32)))
+  (core func (canon task.return (result (own $r)))))
diff --git a/test/binary/binary.wast b/test/binary/binary.wast
index 3766e0180..65cbb4597 100644
--- a/test/binary/binary.wast
+++ b/test/binary/binary.wast
@@ -943,14 +943,34 @@
   "invalid leading byte (0x0) for outer alias target"
 )
 
+;; Within a core:moduletype, type declarators use the Core WebAssembly
+;; encoding of core:rectype: a bare 0x50 is a non-final `sub` and a nested
+;; core:moduletype can't be encoded.
+(component binary
+  "\00asm" "\0d\00\01\00"                     ;; preamble
+  "\03\09"                                    ;; core type section (9 bytes)
+  "\01"                                       ;; 1 core type
+  "\50\01"                                    ;; core:moduletype, 1 decl
+  "\01\50\00\60\00\00"                        ;; 0x01 type: (sub (func))
+)
+(assert_malformed
+  (component binary
+    "\00asm" "\0d\00\01\00"                   ;; preamble
+    "\03\0a"                                  ;; core type section (10 bytes)
+    "\01"                                     ;; 1 core type
+    "\50\01"                                  ;; core:moduletype, 1 decl
+    "\01\00\50\00\60\00\00"                   ;; 0x01 type: 0x00 is not a core:rectype
+  )
+  "invalid leading byte"
+)
 (assert_malformed
   (component binary
     "\00asm" "\0d\00\01\00"                   ;; preamble
     "\03\0a"                                  ;; core type section (10 bytes)
     "\01"                                     ;; 1 core type
     "\50\02"                                  ;; core:moduletype, 2 decls
-    "\01\50\00"                               ;; 0x01 type: nested core:moduletype
-    "\01\60\00\00"                            ;; 0x01 type: core functype
+    "\01\50\00"                               ;; 0x01 type: non-final sub, no supertypes
+    "\01\60\00\00"                            ;; 0x01 is not a core:comptype
   )
   "invalid leading byte"
 )