own<T> transfer works: the host was freeing the handle before wasmtime read it

The prediction recorded before looking was that the guest was at fault, on the
reasoning that the host writes identical bytes for own and borrow -- kind 21
and a pointer -- so it had no way to differ. That was wrong, and reading the
built component said so: consume takes (own 8) and [constructor]counter returns
(own 8), the same exported type. The component was correct all along.

transfer! called resource_any_delete during lowering. func_call reads the
pointer the argument val holds, so the host freed it before wasmtime read it,
and wasmtime called that "mismatched resource types" -- an error about the
wrong thing entirely, which is why the guest looked guilty. Deletes are now
collected per call and run after it, in the same finally that releases the
in-call flag. One atom per instance suffices because 0014 D forbids concurrent
calls into a store.

So 0016 is complete: a handle is opaque and AutoCloseable, close is
try { drop } finally { delete } and idempotent, lowering an own transfers and
leaves with-open able to exit cleanly over the body's value, lowering into a
borrow leaves the handle live, and the instance closes handles the caller never
destructured before deleting the store their context points into.

cljwit.host now marshals every 0012 row a component can express today. What is
left -- map, list<T,N>, stream/future, error-context -- is not in a shipped
release.

The error text is what made this a bounded question rather than a guess.
Before ok! read wasmtime's message it was "call ... failed".

176 assertions.

Claude-Session: https://claude.ai/code/session_01XF5Hfq4Ca2N2XYEzWQQuHt

Author: chaploud

doc/design/0016-own-handles.md

@@ -1,8 +1,7 @@
 # 0016 — `own<T>` handles, in both directions
 
-**Status:** accepted for A, B and D, which are implemented and tested.
-**C is open** — lowering an `own` is rejected by wasmtime with `mismatched
-resource types` and nobody knows why yet; see the end. · 2026-07-30 · rewritten after an adversarial review built
+**Status:** accepted · 2026-07-30 · A, B, C and D are implemented and tested
+against a guest that really implements a resource · rewritten after an adversarial review built
 the guest this note said it was missing. The file was `0016-resource-handles.md`
 until that review showed `borrow` is not a question this note can ask.
 
@@ -150,32 +149,29 @@ instead of it."
   the result val. Measured true today, and the failure is a silent resource
   leak, so it needs re-checking on upgrade.
 
-## C does not work, and the reason is not yet known
+## What C cost, and what the error was really about
 
-Implemented and measured 2026-07-30. A handle that came from *this instance's
-own* `[constructor]counter`, and that works as a `borrow` across repeated
-`bump` calls, is refused when lowered into an `own` parameter:
+Lowering an `own` failed for a while with
 
 ```
 call local:res/bag@0.1.0#consume: mismatched resource types
 ```
 
-What has been ruled out: **the clone is not the cause** — skipping it entirely
-gives the identical message. What has not been separated is whether the fault
-is in the guest's `[resource-new]` / `[resource-rep]` / `[resource-drop]`
-imports resolving to a different resource type than the one in the exported
-interface, or in what the host writes into the val. A C control that does the
-same round trip would separate them, exactly as it did for `0013`.
-
-The test asserts the failure and its message, so the day this changes a test
-says so rather than a comment going stale. Everything else in this note is
-implemented: lifting an `own`, lowering into a `borrow`, `close` as
-`try { drop } finally { delete }`, and the instance closing what it still
-holds.
-
-**A side effect worth having**: chasing this added wasmtime's own error text to
-every `ok!`. `call … failed` became `call …: mismatched resource types`, which
-is what turned this from a guess into a bounded question.
+for a handle that came from *this instance's own* constructor and worked fine
+as a `borrow`. The prediction recorded before looking was that the guest was at
+fault — the host writes identical bytes for `own` and `borrow`, so it seemed to
+have no way to differ. **That was wrong**, and reading the built component
+showed why: `consume` takes `(own 8)` and `[constructor]counter` returns
+`(own 8)`, the same exported type. The component was correct.
+
+The fault was `transfer!` calling `resource_any_delete` **during lowering**.
+`func_call` reads the pointer the argument val holds, so the host freed it
+before wasmtime read it, and wasmtime reported a type mismatch — an error about
+the wrong thing entirely. Deleting after the call fixes it; `0016` C now says
+so explicitly, because "delete, never drop" was true and still not enough.
+
+**The error text is what made this a bounded question.** Before `ok!` read
+wasmtime's message, this was `call … failed`.
 
 ## Notes for whoever writes the guest
 

doc/status.md

@@ -13,13 +13,10 @@ _Short by design, and printed at every session start — so findings live in
    `close` as `try { drop } finally { delete }`, lowering an `own` transfers,
    the instance closes outstanding handles before deleting its store) and
    `borrow` is out of scope because it **cannot appear in a return position**.
-   **A, B and D are implemented**: lifting an `own`, lowering into a `borrow`,
-   `close` as `try { drop } finally { delete }`, and the instance closing
-   handles the caller never destructured before deleting its store.
-   **C is open** — lowering an `own` is refused with `mismatched resource
-   types` for a handle from this instance's own constructor that works fine as
-   a borrow. The clone is ruled out; a C control would separate guest from
-   host, as it did for `0013`.
+   **Done.** `cljwit.host` marshals every `0012` row that a component can
+   express today. What is left of `0012` is `map`, `list<T,N>`,
+   `stream`/`future` and `error-context`, none of which are in a shipped
+   release.
 2. **Host imports.** `0014` names them as its most-likely-to-fire falsifier,
    WASI requires them, and nothing has touched them. They also invalidate
    `0014` E's argument-buffer reuse, which is safe today only because no guest

src/cljwit/host.clj

@@ -255,7 +255,7 @@
 
 (def ^:private RESOURCE 21)   ; wasmtime_component_val_t's kind for a handle
 
-(deftype Handle [^MemorySegment ptr ^MemorySegment ctx api registry
+(deftype Handle [^MemorySegment ptr ^MemorySegment ctx api registry pending
                  ^AtomicBoolean closed]
   java.lang.AutoCloseable
   (close [this]
@@ -274,11 +274,16 @@
 (defn- transfer!
   "0016 C: lowering an `own` gives the resource to the guest. The host's handle
    is stale immediately — dropping it afterwards is `unknown handle index` —
-   so it is deleted, never dropped."
+   so it is deleted, never dropped.
+
+   **Deleted after the call, not during lowering.** `func_call` reads the
+   pointer the argument val holds, so freeing it while lowering hands wasmtime
+   a dangling `resource_any_t *` — which surfaces as `mismatched resource
+   types`, an error about the wrong thing entirely."
   [^Handle h]
   (when (.compareAndSet ^AtomicBoolean (.-closed h) false true)
     (swap! (.-registry h) disj h)
-    (invoke (:res-delete (.-api h)) (.-ptr h))))
+    (swap! (.-pending h) conj (.-ptr h))))
 
 (defn- live-ptr [^Handle h what]
   (when (.get ^AtomicBoolean (.-closed h))
@@ -447,7 +452,8 @@
       (fn [^MemorySegment seg]
         (let [p ^MemorySegment (.get seg ADDR (long UNION))
               c ^MemorySegment (invoke (:res-clone (:api rt)) p)
-              h (->Handle c (:ctx rt) (:api rt) (:registry rt) (AtomicBoolean. false))]
+              h (->Handle c (:ctx rt) (:api rt) (:registry rt) (:pending rt)
+                          (AtomicBoolean. false))]
           (swap! (:registry rt) conj h)
           h))
       (scalar-lift tree))
@@ -689,7 +695,12 @@
           ;; grow RSS by less than the same number of scalar calls do.
           (let [out (when rlift (rlift res))]
             out))
-        (finally (.set in-call false))))))
+        (finally
+          (let [ps @(:pending rt)]
+            (when (seq ps)
+              (reset! (:pending rt) [])
+              (run! (fn [p] (invoke (:res-delete api) p)) ps)))
+          (.set in-call false))))))
 
 (defn instantiate
   "Instantiates a compiled component. Cheap — tens of microseconds — so a
@@ -713,7 +724,11 @@
         ;; the instance keeps the list and closes what is left before deleting
         ;; the store a handle's context points into.
         registry (atom #{})
-        rt      {:ctx ctx :api api :registry registry}
+        ;; Handles transferred by a call, deleted once the call has read them.
+        ;; One atom per instance is enough because 0014 D forbids concurrent
+        ;; calls into a store.
+        pending  (atom [])
+        rt      {:ctx ctx :api api :registry registry :pending pending}
         item-kind (fn [^MemorySegment it] (bit-and (long (.get it I8 (long 0))) 0xFF))
         ;; Every export, flattened. A function inside an interface is keyed the
         ;; way WIT spells it — "pkg:name/iface@ver#func" — and remembers the

test/cljwit/host_test.clj

@@ -309,18 +309,14 @@
                     (is (= 102 (bump (second cs) 1)))
                     (run! (fn [^java.lang.AutoCloseable c] (.close c)) cs)))
 
-                ;; Last: the trap this provokes poisons the instance, and every
-                ;; later call then fails with "cannot enter component instance"
-                ;; (the note in res.wat).
-                (testing "0016 C — lowering an own does not work yet"
-                  ;; wasmtime answers "mismatched resource types" for a handle
-                  ;; that came from this instance's own constructor and works
-                  ;; fine as a borrow. Whether the fault is the guest's
-                  ;; [resource-*] imports or what the host writes into the val
-                  ;; is unresolved. Asserted so the day it changes a test says
-                  ;; so, rather than a comment going stale.
-                  (let [e (is (thrown? clojure.lang.ExceptionInfo (consume (make 7))))]
-                    (is (re-find #"mismatched resource types" (ex-message e)))))))))
+                (testing "0016 C — lowering an own transfers, and with-open still exits cleanly"
+                  (is (= 7 (with-open [^java.lang.AutoCloseable c (make 7)]
+                             (consume c)))
+                      "close after a transfer must not throw over the body's value")
+                  (let [^java.lang.AutoCloseable c (make 3)]
+                    (is (= 3 (consume c)))
+                    (is (thrown? clojure.lang.ExceptionInfo (bump c 1))
+                        "the handle is stale the moment ownership moves")))))))
         (finally (.delete ^File c))))))
 
 (deftest an-instance-closes-handles-it-still-holds