Host-defined resources work: the destructor returns an error, not void

  bb spike-hres
  run(42) = 42   dropped: [[1 42]]   table now: {}

A guest mints a host resource, reads it back through a borrow, and drops it;
the host's destructor fires with the right rep. Every wasi:io interface has
this shape.

The bug was one line of a typedef:

  typedef wasmtime_error_t *(*wasmtime_component_resource_destructor_t)(
      void *, wasmtime_context_t *, uint32_t);

I declared the upcall void. wasmtime then read a garbage register as an error
pointer and crashed walking its source chain -- *after* the destructor had
already run correctly, which is why every probe printed success and the crash
looked like it was about ownership of the `any`. Two predictions were falsified
on the way there, both about ownership: removing the mint-side host_delete
changed nothing, and a null destructor is not allowed at all.

My earlier survey printed exactly the line that names the return type and I
read only the parameters, because the return type was on the line above and my
grep window cut it. That is the third time today the same shape has cost
something -- reading a truncated view and treating it as the whole -- after two
greps whose [a-z_] class silently excluded digits.

definterface also needs the return type spelled: a ^void method against a
Void/TYPE MethodType fails findVirtual outright, which is the friendly version
of the same mistake.

So every shape S1's stop condition names has now been reached at least once.
What is left is the cljwit.host API for host resources: a resource is a type,
not a function, so the iface#func map has nowhere to put it.

Claude-Session: https://claude.ai/code/session_01XF5Hfq4Ca2N2XYEzWQQuHt

Author: chaploud

bb.edn

@@ -127,6 +127,16 @@
                                (run "cc" "-O2" "-shared" "-fPIC" "-o" so "dev/spike/noop7.c")
                                (run "clojure" "-M:dev" "-m" "cljwit.spike.ffm-shape")))}
 
+  spike-hres {:doc "Can the host define a resource the guest imports? See 0017 F."
+              :task (do (babashka.fs/create-dirs "target")
+                        (run "wasm-tools" "parse" "dev/resources/hres.wat" "-o" "target/hres.core.wasm")
+                        (run "wasm-tools" "component" "embed" "dev/resources/hres.wit"
+                             "target/hres.core.wasm" "-o" "target/hres.embed.wasm")
+                        (run "wasm-tools" "component" "new" "target/hres.embed.wasm"
+                             "-o" "target/hres.component.wasm")
+                        (run "clojure" "-M:dev" "-m" "cljwit.spike.host-resource"
+                             "target/hres.component.wasm"))}
+
   spike-import {:doc "Can a Wasm guest call back into Clojure? See 0014's falsifier."
                 :task (do (babashka.fs/create-dirs "target")
                           (run "wasm-tools" "parse" "dev/resources/imp.wat" "-o" "target/imp.core.wasm")

dev/cljwit/spike/host_resource.clj

@@ -6,27 +6,15 @@
    `iface#func` cannot express a resource, and minting one needs a second
    upcall shape — a destructor `void (*)(void *, wasmtime_context_t *, u32)`.
 
-   **This does not work yet, and is committed for how far it gets.** Run it
-   with
+   The premise check, not the feature:
 
-       clojure -M:dev -m cljwit.spike.host-resource target/hres.component.wasm
+       bb spike-hres
 
-   and the JVM crashes inside libwasmtime's `error::source`. It is deliberately
-   *not* a `bb` task, because a task that aborts the JVM is worse than none.
-
-   What is narrowed, by printing from inside each upcall:
-
-     * `add_resource`, both `add_func`s and `instantiate` all succeed.
-     * `mint` runs; `host_to_any` returns no error.
-     * `peek` runs; `any_to_host` returns no error and the rep comes back.
-     * the destructor upcall runs, with the right rep.
-     * the crash is *inside* `wasmtime_component_func_call`, after the
-       destructor and before it returns.
-
-   So every piece works and the composition does not. The leading suspect is
-   ownership of the `any` that `host_to_any` produces: this code writes it into
-   the result val and also deletes the `host_t` it came from, and nothing here
-   has established which of those wasmtime expects."
+   The one thing that is not guessable: **the destructor returns
+   `wasmtime_error_t *`, not `void`.** Declaring it void makes wasmtime read a
+   garbage register as an error pointer and crash walking its source chain,
+   after the destructor has already run correctly. A null destructor is not
+   allowed either -- wasmtime calls it."
   (:require [clojure.java.io :as io])
   (:import [java.lang.foreign Arena Linker SymbolLookup MemorySegment
             FunctionDescriptor ValueLayout]
@@ -52,8 +40,11 @@
          ^java.lang.foreign.MemorySegment res ^long nres]))
 
 (definterface Dtor
-  (^void call [^java.lang.foreign.MemorySegment data ^java.lang.foreign.MemorySegment ctx
-               ^int rep]))
+  ;; Returns wasmtime_error_t*, not void. Declaring it void makes wasmtime read
+  ;; a garbage register as an error pointer and crash walking it.
+  (^java.lang.foreign.MemorySegment
+   call [^java.lang.foreign.MemorySegment data ^java.lang.foreign.MemorySegment ctx
+         ^int rep]))
 
 (defn -main [& _args]
   (let [linker (Linker/nativeLinker)
@@ -143,7 +134,7 @@
                    (call [_ _d _cx rep]
                      (swap! dropped conj [rep (get @table rep)])
                      (swap! table dissoc rep)
-                     nil))
+                     MemorySegment/NULL))
 
             bs (.readAllBytes (io/input-stream (or (first *command-line-args*)
                                                    "target/hres.component.wasm")))
@@ -165,9 +156,9 @@
                    (call (fx "wasmtime_component_linker_instance_add_resource" ADDR ADDR ADDR I64 ADDR ADDR ADDR ADDR)
                          li (cstr "token") (long 5) rty
                          (upcall dtor Dtor
-                                 (MethodType/methodType Void/TYPE ^"[Ljava.lang.Class;"
+                                 (MethodType/methodType MemorySegment ^"[Ljava.lang.Class;"
                                                         (into-array Class [MemorySegment MemorySegment Integer/TYPE]))
-                                 (FunctionDescriptor/ofVoid (into-array java.lang.foreign.MemoryLayout [ADDR ADDR I32])))
+                                 (FunctionDescriptor/of ADDR (into-array java.lang.foreign.MemoryLayout [ADDR ADDR I32])))
                          MemorySegment/NULL MemorySegment/NULL))
             addf (fx "wasmtime_component_linker_instance_add_func" ADDR ADDR ADDR I64 ADDR ADDR ADDR)
             _ (ok! "add mint" (call addf li (cstr "mint") (long 4)

doc/design/0017-host-imports.md

@@ -169,20 +169,25 @@ shape, and handles minted per call. `resource_host_to_any` is how one becomes
 a val — and it panics outside a call scope, which is the landmine already
 recorded above.
 
-**Tried, 2026-07-30, and it does not work yet.**
-`dev/cljwit/spike/host_resource.clj` drives
-`dev/resources/hres.{wit,wat}` — a guest that mints a host resource, reads it
-through a `borrow`, and drops it. Every individual piece succeeds:
-`add_resource`, both `add_func`s and `instantiate`; `mint` with
-`host_to_any` returning no error; `peek` with `any_to_host` returning the right
-rep; and the destructor upcall firing with that rep. **The crash is inside
-`wasmtime_component_func_call` itself, after the destructor and before it
-returns**, in `error::source`.
-
-Leading suspect: ownership of the `any` that `host_to_any` produces. The spike
-writes it into the result val *and* deletes the `host_t` it came from, and
-nothing has established which of those wasmtime expects. The spike is not a
-`bb` task, because a task that aborts the JVM is worse than none.
+**It works** (`bb spike-hres`): a guest mints a host resource, reads it through
+a `borrow`, and drops it, and the host's destructor fires with the right rep.
+
+The one thing that is not guessable, and that cost a JVM crash to find: **the
+destructor returns `wasmtime_error_t *`, not `void`** —
+
+```c
+typedef wasmtime_error_t *(*wasmtime_component_resource_destructor_t)(
+    void *, wasmtime_context_t *, uint32_t);
+```
+
+Declaring it `void` in the FFM upcall makes wasmtime read a garbage register as
+an error pointer and crash walking its source chain, **after** the destructor
+has already run correctly — so every printed probe says the callback works. A
+null destructor is not allowed either; wasmtime calls it.
+
+`definterface` also needs the return type spelled: a `^void` method against a
+`Void/TYPE` `MethodType` fails `findVirtual` outright, which is the *friendly*
+version of the same mistake.
 
 ## Alternatives rejected