fix: return the max_conns permit on every path, and track the toolchain

max_conns released its permit with a trailing statement after calling the inner app,
so a request that raised — or was cancelled — never gave it back. With a limit of N,
N such requests wedged the limiter shut and everything after them got 503 forever.
It is a `defer` now. discov/maxconns_release_test.mbt drives the middleware with an
app that always raises and asserts the permits come back; with the old code the
second request is refused instead, so the test fails.

Two more places had the same shape and are rewritten the way the compiler's new
fragile_catch_all lint asks: consul_socket closes its socket with `defer` (there is
no fd finalizer, so a cancelled request leaked it), and breaker records its failure
with `errdefer`.

Alongside that, the toolchain: StringBuilder::new() is deprecated across 23 sites,
moon fmt now writes trailing commas in struct literals, and a raising `fn` needs to
be an arrow function. The README's claim of a clean --deny-warn build was false on
the current compiler; fixing the code makes it true again rather than softening it.

The library's own pkg.generated.mbti is now tracked — it is what consumers read and
what makes an interface change visible in review — while the examples' stay out.

Verified on moon 0.1.20260827 / moonc v0.10.11: check clean on all four backends,
147 tests at the root and 157 native.

Signed-off-by: Leo Cheng (heke1228) <chengkelfan@qq.com>

Author: Lfan-ke

.gitignore

@@ -3,3 +3,6 @@
 !.moonignore
 _build/
 target/
+
+# example packages regenerate these; only the library interface is tracked
+examples/*/pkg.generated.mbti

AGENTS.md

@@ -0,0 +1,20 @@
+`moonzero` assembles microservices for MoonBit — config, resilience middleware, service discovery, tracing, and a Prometheus endpoint — in the shape of go-zero. The portable library lives at the root; `discov/` holds the native drivers that need real I/O.
+
+# Working here
+
+- `moon fmt` before anything else. CI runs `moon fmt && git diff --exit-code`, so an unformatted file fails the build on its own.
+- `moon check --target all --deny-warn` is the gate. Warnings are errors, and all four backends (wasm, wasm-gc, js, native) must pass. Run it again after the first round of fixes: a package whose sources do not compile hides the diagnostics in its own test files, so errors surface in waves.
+- `moon test --target all` at the root; `moon test --target native` inside `discov/`.
+- `moon info` regenerates `pkg.generated.mbti`. If that file does not change, your edit is not visible to anyone depending on this package, which usually means the refactor was safe. If it does change, read the diff before committing — that is the public interface moving. The examples regenerate their own, which is why those are gitignored.
+- CI installs the latest moon on every run, so a toolchain that is behind will disagree with it. Upgrade locally rather than pinning.
+
+# Layout
+
+Root is portable and has no async dependency: `config.mbt`, `yaml.mbt`, the resilience middleware (`breaker.mbt`, `maxconns.mbt`, `limits.mbt`, `retry.mbt`), `metrics.mbt`, `tracing.mbt`, `jwt.mbt`, `discovery.mbt`, and the zrpc client. `discov/` is `supported_targets = "native"` and carries the drivers that speak to real etcd, consul and redis over sockets, plus the file-backed registry. Tests sit beside their subject as `*_wbtest.mbt` at the root and `*_test.mbt` under `discov/`; `examples/NN-topic/` are runnable one-file demos.
+
+# Things worth knowing
+
+- Middleware is async — `Middleware` is `(async App) -> async App` — but the root package deliberately does not depend on `moonbitlang/async`, so it cannot host an `async test`. End-to-end middleware tests belong in `discov/`, which already imports async and runs native-only. `maxconns_release_test.mbt` is the pattern to copy.
+- Anything holding a resource across a call into user code must release it with `defer`, not with a trailing statement or a `catch` that re-raises. Both skip cancellation, and the compiler's `fragile_catch_all` lint now says so. `max_conns` leaked a permit exactly this way and wedged the limiter shut at 503.
+- The tests against real etcd, consul and redis are gated on `MOON_ETCD_TEST`, `MOON_CONSUL_TEST` and `MOON_REDIS_TEST`; without them the suite silently skips those. CI sets them and starts the containers.
+- `ConsulHttp` and `RedisConn` are `pub trait`, which in MoonBit is sealed — only this package can implement them. Consumers therefore cannot build a `ConsulClient` or `RedisClient` of their own; the transports in `discov/` are the only implementations.

breaker.mbt

@@ -163,7 +163,7 @@ pub fn breaker(b : Breaker, clock : Clock) -> Middleware {
       match scope {
         Http(_) =>
           if b.allow(clock.now()) {
-            let status : Ref[Int] = { val: 200 }
+            let status : Ref[Int] = { val: 200, }
             let observed : @moonasgi.Send = event => {
               match event {
                 HttpResponseStart(status=s, headers~, trailers~) => {
@@ -179,12 +179,8 @@ pub fn breaker(b : Breaker, clock : Clock) -> Middleware {
                 other => send(other)
               }
             }
-            inner(scope, receive, observed) catch {
-              err => {
-                b.record_failure(clock.now())
-                raise err
-              }
-            }
+            errdefer b.record_failure(clock.now())
+            inner(scope, receive, observed)
             if status.val >= 500 {
               b.record_failure(clock.now())
             } else {

clock.mbt

@@ -33,7 +33,7 @@ pub struct ManualClock {
 ///|
 /// A manual clock starting at `start` milliseconds (default `0`).
 pub fn ManualClock::new(start? : Int64 = 0) -> ManualClock {
-  { ms: start }
+  { ms: start, }
 }
 
 ///|

config.mbt

@@ -75,7 +75,7 @@ fn service_conf_of_object(
     Some(_) => raise ConfigError("log_level must be a JSON string")
     None => def.log_level
   }
-  { name, host, port, timeout_ms, log_level }
+  { name, host, port, timeout_ms, log_level, }
 }
 
 ///|

consul.mbt

@@ -22,7 +22,7 @@ pub struct ConsulResponse {
 ///|
 /// A consul response.
 pub fn ConsulResponse::new(status : Int, body : Bytes) -> ConsulResponse {
-  { status, body }
+  { status, body, }
 }
 
 ///|

consul_discovery_wbtest.mbt

@@ -22,7 +22,7 @@ struct FakeConsul {
 
 ///|
 fn FakeConsul::new() -> FakeConsul {
-  { services: Map([]) }
+  { services: Map([]), }
 }
 
 ///|

crypto_wbtest.mbt

@@ -3,7 +3,7 @@
 /// test vectors.
 fn hex(b : Bytes) -> String {
   let digits = "0123456789abcdef"
-  let sb = StringBuilder::new()
+  let sb = StringBuilder()
   for i = 0; i < b.length(); i = i + 1 {
     let v = b[i].to_int()
     sb.write_char(digits[v >> 4].unsafe_to_char())

discov/consul_socket.mbt

@@ -18,7 +18,7 @@ pub struct ConsulSocket {
 ///|
 /// A transport to the consul agent at `host:port` (default port 8500).
 pub fn ConsulSocket::new(host : String, port? : Int = 8500) -> ConsulSocket {
-  { host, port }
+  { host, port, }
 }
 
 ///|
@@ -40,17 +40,11 @@ pub async fn ConsulSocket::request(
     body,
     content_type~,
   )
-  let response = try {
-    (tcp : &@io.Writer).write(request)
-    let raw = (tcp : &@io.Reader).read_all()
-    let parsed = @moonzero.http1_parse_response(raw.binary())
-    @moonzero.ConsulResponse::new(parsed.status(), parsed.body())
-  } catch {
-    e => {
-      tcp.close()
-      raise e
-    }
-  }
-  tcp.close()
-  response
+  // The socket has to close on every path, cancellation included — there is no fd
+  // finalizer to reclaim it otherwise.
+  defer tcp.close()
+  (tcp : &@io.Writer).write(request)
+  let raw = (tcp : &@io.Reader).read_all()
+  let parsed = @moonzero.http1_parse_response(raw.binary())
+  @moonzero.ConsulResponse::new(parsed.status(), parsed.body())
 }

discov/discov.mbt

@@ -38,7 +38,7 @@ pub struct FileRegistry {
 /// is treated as an empty registry, so a reader can start before the publisher has
 /// written anything and pick the state up on the first `reload`/`watch`.
 pub async fn FileRegistry::load(path : String) -> FileRegistry {
-  { path, reg: read_snapshot(path) }
+  { path, reg: read_snapshot(path), }
 }
 
 ///|