@@ -39,6 +39,7 @@
     (local.set $v (i32.load (call $rep (local.get $h))))
     (call $drop (local.get $h))
     (local.get $v))
+  (func (export "local:res/bag@0.1.0#boom") (result i32) (unreachable))
   (func (export "local:res/bag@0.1.0#make-two") (param $start i32) (result i32)
     (local $a i32) (local $b i32) (local $l i32)
     (local.set $a (call $alloc (i32.const 4)))
 
@@ -11,6 +11,10 @@ interface bag {
   }
   /// Takes the resource: ownership transfers to the guest.
   consume: func(c: counter) -> u32;
+  /// Traps. A trapped instance cannot be entered again, so every later
+  /// [resource-drop] fails — which is how a handle's `close` comes to throw
+  /// during the instance's own teardown.
+  boom: func() -> u32;
   /// Handles the caller never destructured — `0016` D.
   make-two: func(start: u32) -> list<counter>;
 }
 
@@ -0,0 +1,123 @@
+# 0017 — Host imports: letting a component call Clojure
+
+**Status:** proposed · 2026-07-30 · the mechanism is verified (`bb
+spike-import`); this is the API over it, and no code exists
+
+## The question
+
+`cljwit.host` can call a component. It cannot yet be called *by* one, which
+means it refuses every component that imports anything — including all of WASI.
+`0014` named this its most-likely-to-fire falsifier.
+
+What is settled, measured 2026-07-30:
+
+- **An FFM upcall stub reaches Clojure from inside a component call.** `bb
+  spike-import`: `run(20) = 41`, the host saw `[20]`. Pure Clojure, bound to a
+  `reify` — no bytecode generation and no C shim, the same answer `0011`
+  reached for the outbound direction.
+- **A component's imports reflect exactly like its exports** — interface,
+  parameter names, types, result — through
+  `wasmtime_component_type_import_count`/`_nth`.
+- **A host callback cannot re-enter the instance that is executing**: `wasm
+  trap: cannot enter component instance`. `0014` D and E survive.
+- **`wasmtime_component_linker_add_wasip2` supplies all of WASI 0.2 in one
+  call**, so hand-writing `wasi:cli` is not the price of entry.
+- **`wasmtime_error_new(const char *)` exists**, so a Clojure exception has
+  somewhere to go.
+
+## The decision
+
+### A. Imports are supplied at `instantiate`, keyed by the same names as exports
+
+```clojure
+(host/instantiate art {:imports {"local:imp/host@0.1.0#twice" (fn [v] (* 2 v))}})
+```
+
+The identity is the exact WIT name, `iface#func`, exactly as `0014` B decided
+for exports. One naming rule for both directions.
+
+### B. The host reflects what the component needs and refuses a mismatch, both ways
+
+A missing import throws at `instantiate`, **naming it**. wasmtime's own message
+is `function implementation is missing` with no name, which is a worse version
+of the `nil`-on-typo failure `0014` already rejected.
+
+An import supplied but not needed throws too. A typo silently ignored is the
+same failure wearing the other hat.
+
+### C. Marshalling is the same compiled lift and lower, run in the opposite direction
+
+An import's parameters are *lifted* into Clojure and its result *lowered* back
+— the mirror of an export. `lift-fn` and `lower-fn` already compile from a
+reflected type tree; nothing new is needed but the direction.
+
+### D. A Clojure exception becomes a `wasmtime_error_t *`, and never unwinds into native frames
+
+The callback catches `Throwable`, converts it with `wasmtime_error_new`, and
+returns it. A JVM exception propagating through a native frame is undefined
+behaviour, and this project has already lost a JVM to a non-unwinding panic
+(`0012`'s surrogate `char`).
+
+### E. WASI is a flag, not a map
+
+```clojure
+(host/instantiate art {:wasi true})
+```
+
+calls `add_wasip2`. Supplying a hundred functions by hand to run `wasi:cli` is
+not an API, and the C API already refuses to make you.
+
+## Why
+
+**A, because two naming rules would be one too many.** `0014` B paid for the
+exact-WIT-string identity with measurements about keywords; imports do not get
+to relitigate it.
+
+**B, because instantiation is the only moment the host knows both sides.** It
+has the component's requirements from reflection and the user's map in hand. A
+mismatch discovered later is discovered by wasmtime, in a message with no name
+in it.
+
+**D, because the failure mode is the worst one available.** Every other error
+in this library is an `ex-info`. An exception crossing into wasmtime's frames
+is a crash with no stack trace, and the cost of preventing it is a `try`.
+
+## Alternatives rejected
+
+- **Imports on the artifact rather than the instance.** The linker is
+  engine-scoped, so this would be possible — and it would make every instance
+  share one set of host functions, which is wrong the moment two requests want
+  different state. `0014` C put per-request state on the instance.
+- **A separate `link` step** between `compile` and `instantiate`. Honest about
+  where the linker lives, and a fourth lifetime for something that has no
+  independent lifetime: nothing can use a linker except to instantiate.
+- **Letting a missing import fail lazily**, at the first call. Cheaper to
+  implement and it moves the error away from the mistake.
+- **Requiring an explicit `wasi:cli` map even when `add_wasip2` exists.**
+  Consistent, and unusable.
+- **Passing the raw `wasmtime_component_val_t` to the Clojure function.**
+  Fastest, and it makes every import a chance to corrupt memory.
+
+## What would falsify this
+
+- **An import that is not a function.** A component may import a *type* or a
+  *resource*; `wasmtime_component_item_t` has kinds for both. A: the map is
+  keyed by function name and has nowhere to put them.
+- **The upcall stub's lifetime.** It is bound to an `Arena`, and it must
+  outlive every call. If the instance's arena is the wrong scope — say the stub
+  must outlive the *linker* rather than the instance — A is in the wrong place.
+- **`add_wasip2` needing a WASI context on the store.**
+  `wasmtime_context_set_wasi` exists and takes a config; whether `add_wasip2`
+  works without one, and what E should do about the config, is unverified.
+- **Whether a returned error surfaces to the outer caller as an error rather
+  than a trap that poisons the instance.** D assumes it does. Unmeasured.
+- **The cost.** An upcall is not free and nothing here has been timed. If a
+  guest calls a host import in a loop, the number that matters is per-upcall,
+  and `0013`'s discipline applies: predict, then measure.
+
+## Resources
+
+- `dev/resources/imp.{wit,wat}` and `bb spike-import` — the mechanism.
+- `0014` — the naming rule, the lifetimes, and the concurrency check this
+  inherits.
+- `0016` — the other direction of the same marshalling.
@@ -594,9 +594,20 @@
       (when (.compareAndSet closed false true)
         ;; Before the store goes: a handle that outlives it holds a dangling
         ;; context, which is the one real use-after-free in this row (0016 D).
-        (run! (fn [^java.lang.AutoCloseable h] (.close h)) @registry)
-        (invoke (:store-delete (.-api ^Engine (.-engine artifact))) store)
-        (.close arena)))
+        ;;
+        ;; A handle's `drop` can throw — a guest that trapped leaves the
+        ;; instance unable to be entered, so every drop then fails. Letting
+        ;; that escape here would skip `store_delete` and `arena.close`
+        ;; entirely, and the retry would be a silent no-op because `closed` is
+        ;; already set: the same shape as the bug this ordering was written to
+        ;; fix, one level down. Teardown always completes; the first failure is
+        ;; rethrown after it.
+        (let [errs (reduce (fn [acc ^java.lang.AutoCloseable h]
+                             (try (.close h) acc (catch Throwable t (conj acc t))))
+                           [] @registry)]
+          (invoke (:store-delete (.-api ^Engine (.-engine artifact))) store)
+          (.close arena)
+          (when-let [t (first errs)] (throw t)))))
     nil)
   clojure.lang.ILookup
   (valAt [this k] (.valAt ^clojure.lang.ILookup this k ::none))
 
@@ -267,7 +267,8 @@
                 (is (= #{"local:res/bag@0.1.0#[constructor]counter"
                          "local:res/bag@0.1.0#[method]counter.bump"
                          "local:res/bag@0.1.0#consume"
-                         "local:res/bag@0.1.0#make-two"}
+                         "local:res/bag@0.1.0#make-two"
+                         "local:res/bag@0.1.0#boom"}
                        (set (host/exports i)))))
 
               (testing "own and borrow are distinct in the reflected type, not a runtime check"
@@ -338,3 +339,34 @@
               (is (= "#cljwit/resource[closed]" (str leaked))
                   "the instance closed it on the way out"))))
         (finally (.delete ^File f))))))
+
+(deftest teardown-completes-even-when-a-handle-refuses-to-close
+  ;; A trapped instance cannot be entered again, so every [resource-drop] then
+  ;; fails. If that escapes `Instance/close`, `store_delete` and `arena.close`
+  ;; never run and the retry is a silent no-op, because `closed` is already
+  ;; set — the same shape as the bug the close ordering was written to fix, one
+  ;; level down. Found by an adversarial review of `0017`, not by this suite.
+  ;;
+  ;; **This test does not distinguish the fix.** Fault injection: reverting to
+  ;; the plain `run!` leaves it green, because both versions throw and both
+  ;; leave `closed` set. What differs is whether `store_delete` and
+  ;; `arena.close` ran, and that is not observable from Clojure without adding
+  ;; API for a test. What it does pin is the contract — close reports the drop
+  ;; rather than swallowing it, and the instance ends closed rather than stuck
+  ;; half-torn-down.
+  (if-not lib
+    (println "CLJWIT_WASMTIME_LIB unset — skipping teardown test")
+    (let [f (build-component! "res")]
+      (try
+        (with-open [e (host/engine)]
+          (with-open [a (host/compile e (io/file f))]
+            (let [i (host/instantiate a)]
+              ((i "local:res/bag@0.1.0#make-two") 1)
+              (is (thrown? clojure.lang.ExceptionInfo ((i "local:res/bag@0.1.0#boom")))
+                  "the guest traps, which poisons the instance")
+              (let [t (is (thrown? clojure.lang.ExceptionInfo (.close ^java.lang.AutoCloseable i)))]
+                (is (re-find #"cannot enter component instance" (ex-message t))
+                    "close reports the drop that failed rather than swallowing it"))
+              (is (nil? (.close ^java.lang.AutoCloseable i))
+                  "and the instance is closed afterwards, not stuck half-torn-down"))))
+        (finally (.delete ^File f))))))
Original file line number	Diff line number	Diff line change
`@@ -11,6 +11,10 @@ interface bag {`
`11`	`11`	`}`
`12`	`12`	`/// Takes the resource: ownership transfers to the guest.`
`13`	`13`	`consume: func(c: counter) -> u32;`
	`14`	`+ /// Traps. A trapped instance cannot be entered again, so every later`
	`15`	+ /// [resource-drop] fails — which is how a handle's `close` comes to throw
	`16`	`+ /// during the instance's own teardown.`
	`17`	`+ boom: func() -> u32;`
`14`	`18`	/// Handles the caller never destructured — `0016` D.
`15`	`19`	`make-two: func(start: u32) -> list<counter>;`
`16`	`20`	`}`