✓
Passing This code compiles and runs correctly.
Code
// PINS: a BORROWED obligation that the flow never discharges explicitly is
// auto-discharged, and a pipeline continuation after the borrow does not change
// that. Compiles, runs, prints `n=0`.
//
// `make` mints <owned!> on h0. `touch` BORROWS it (bare <owned>: no consume, no
// re-issue — the obligation stays with the caller). `dispose` is the ONLY
// consumer of <!owned>. The flow borrows h0, continues to `report`, and never
// disposes anything.
//
// The emitted program disposes it anyway. From output_emitted.zig:
//
// _ = main_module.dispose_event.handler(.{ .h = h0 });
//
// inserted by auto-discharge at the terminator. That is the designed behaviour:
// a whole-value obligation whose state has EXACTLY ONE unattended disposer is
// discharged for you, silently. Zero or several candidates is what raises
// KORU030 (`... has multiple discharge options: a, b. Discharge explicitly.`).
//
// ---------------------------------------------------------------------------
// WHAT THIS FILE USED TO CLAIM, AND WHY IT WAS WRONG — corrected 2026-08-06
// ---------------------------------------------------------------------------
// It was a MUST_ERROR pinning `CONTAINS was not discharged`, on the reasoning
// that h0 "is NEVER disposed, so it leaks" and that the checker SHOULD reject
// it. It does not reject it, and it is right not to: nothing leaks. The old note
// also asserted that removing the trailing `|> report(n: 0)` makes KORU030 fire,
// making the continuation the trigger. In the spelling below, both forms
// auto-insert `dispose` — verified by compiling each and reading the artifact —
// so the continuation is not a trigger either.
//
// Two separate things had gone wrong, and the second hid the first:
//
// 1. The PREMISE was a non-bug. A silent compiler was read as an absent check
// when it was a completed one. Nobody read the emitted program, which names
// the disposal on the line above.
// 2. The SPELLING went illegal underneath it. The original declared
// `tor make {} | ok *Handle<owned!>` — a single continuation branch
// carrying a payload — which a later ruling refuses outright:
// `error[PARSE003]: single continuation branch 'ok' carrying a payload is a
// one-variant tag union — declare the single output as a bare return
// instead`. So the test was RED as `frontend`, dying before it reached the
// checker its EXPECT named. It had not been testing its own subject for
// however long that ruling has been in force.
//
// Respelled to a bare return, flipped MUST_ERROR -> MUST_RUN, and kept rather
// than deleted: the behaviour is worth a regression, and a pin that spent time
// asserting a non-bug is worth the record. Sibling correction, same root cause
// and same day: koru-libs `unikraft/alloc/tests/autodischarge_covers_later_arms.kz`,
// where the identical "the compiler does not enforce this" claim was withdrawn.
//
// If auto-discharge is ever narrowed so this program must dispose explicitly,
// this test goes red and that is the correct signal — the fix then is to add the
// explicit `dispose`, not to restore the old expectation.
//
// Grounding:
// bare <owned> borrow as input — 330_073_label_fold_borrow_outer_own
// <owned!> issue / <!owned> consume — koru_std/list.kz directionality
// auto-discharge with one candidate — 335_021_instance_no_explicit_free
// the multiple-candidates refusal — the KORU030 text quoted above
const std = @import("std");
const Handle = struct { n: i32 };
~tor make {} -> *Handle<owned!>
~proc make|zig {
const h = std.heap.page_allocator.create(Handle) catch unreachable;
h.* = .{ .n = 0 };
return h;
}
// BORROW: bare <owned>, no consume — the obligation stays with the caller.
~tor touch { h: *Handle<owned> }
~proc touch|zig { h.n += 1; }
~tor report { n: i32 }
~proc report|zig { std.debug.print("n={}\n", .{n}); }
// Discharge — the ONLY consumer of <!owned>, which is what makes it electable.
~tor dispose { h: *Handle<!owned> }
~proc dispose|zig { std.heap.page_allocator.destroy(h); }
// h0 is borrowed by `touch`, the pipeline CONTINUES to `report`, and nothing
// disposes it explicitly. Auto-discharge inserts `dispose` at the terminator.
~make(): h0 |> touch(h: h0) |> report(n: 0)
Supporting Files
using static KoruHost;
static class KoruHost {
public class Handle {
public int n;
}
}
~proc make|cs {
return new Handle();
}
~proc touch|cs { h.n += 1; }
~proc report|cs { global::System.Console.WriteLine("n=" + n); }
~proc dispose|cs { }
Actual
n=0
Expected output
✓ Zig✓ C#n=0
Emitted Zig source
// Access compiler flags via the per-user compiler_env module
const CompilerEnv = @import("compiler_env").CompilerEnv;
pub const panic = if (@import("builtin").mode == .Debug)
@import("std").debug.FullPanic(@import("std").debug.defaultPanic)
else
@import("std").debug.simple_panic;
const __koru_bare = struct {
extern fn posix_memalign(memptr: *?*anyopaque, alignment: usize, size: usize) c_int;
extern fn free(ptr: ?*anyopaque) void;
fn bareAlloc(_: *anyopaque, len: usize, alignment: @import("std").mem.Alignment, _: usize) ?[*]u8 {
var p: ?*anyopaque = null;
const a = @max(alignment.toByteUnits(), @sizeOf(usize));
if (posix_memalign(&p, a, len) != 0) return null;
return @ptrCast(p);
}
fn bareResize(_: *anyopaque, _: []u8, _: @import("std").mem.Alignment, _: usize, _: usize) bool { return false; }
fn bareRemap(_: *anyopaque, _: []u8, _: @import("std").mem.Alignment, _: usize, _: usize) ?[*]u8 { return null; }
fn bareFree(_: *anyopaque, memory: []u8, _: @import("std").mem.Alignment, _: usize) void { free(@ptrCast(memory.ptr)); }
const vtable = @import("std").mem.Allocator.VTable{ .alloc = bareAlloc, .resize = bareResize, .remap = bareRemap, .free = bareFree };
const allocator = @import("std").mem.Allocator{ .ptr = undefined, .vtable = &vtable };
};
const __koru_backing = if (@import("builtin").link_libc) @import("std").heap.c_allocator else if (@import("builtin").os.tag == .freestanding and !@import("builtin").cpu.arch.isWasm()) __koru_bare.allocator else @import("std").heap.page_allocator;
var __koru_leak_count: @import("std").atomic.Value(usize) = .init(0);
fn __koru_alloc(ctx: *anyopaque, len: usize, alignment: @import("std").mem.Alignment, ret_addr: usize) ?[*]u8 {
_ = ctx;
const r = __koru_backing.rawAlloc(len, alignment, ret_addr);
if (comptime @import("builtin").mode == .Debug) {
if (r != null) _ = __koru_leak_count.fetchAdd(1, .monotonic);
}
return r;
}
fn __koru_resize(ctx: *anyopaque, memory: []u8, alignment: @import("std").mem.Alignment, new_len: usize, ret_addr: usize) bool {
_ = ctx;
return __koru_backing.rawResize(memory, alignment, new_len, ret_addr);
}
fn __koru_remap(ctx: *anyopaque, memory: []u8, alignment: @import("std").mem.Alignment, new_len: usize, ret_addr: usize) ?[*]u8 {
_ = ctx;
return __koru_backing.rawRemap(memory, alignment, new_len, ret_addr);
}
fn __koru_free(ctx: *anyopaque, memory: []u8, alignment: @import("std").mem.Alignment, ret_addr: usize) void {
_ = ctx;
__koru_backing.rawFree(memory, alignment, ret_addr);
if (comptime @import("builtin").mode == .Debug) {
_ = __koru_leak_count.fetchSub(1, .monotonic);
}
}
const __koru_vtable = @import("std").mem.Allocator.VTable{ .alloc = __koru_alloc, .resize = __koru_resize, .remap = __koru_remap, .free = __koru_free };
pub fn koru_allocator() @import("std").mem.Allocator {
return .{ .ptr = undefined, .vtable = &__koru_vtable };
}
pub inline fn __koru_intcast(comptime T: type, x: anytype) T {
if (comptime (@import("builtin").mode == .Debug or @import("builtin").mode == .ReleaseSafe))
return @as(T, @intCast(x));
const dst = @typeInfo(T);
const src = @typeInfo(@TypeOf(x));
if (comptime (dst == .int and src == .int and dst.int.bits == src.int.bits and dst.int.signedness != src.int.signedness))
return @as(T, @bitCast(x));
return @as(T, @intCast(x));
}
pub fn koru_leak_check() void {
if (comptime @import("builtin").mode != .Debug) return;
if (__koru_leak_count.load(.acquire) == 0) return;
if (comptime @import("builtin").target.os.tag == .freestanding) {
if (comptime @import("builtin").cpu.arch == .wasm32 or @import("builtin").cpu.arch == .wasm64) {
@panic("KORU LEAK CHECK FAILED: the produced program leaked");
} else {
const __klc = struct { extern var stdout: ?*anyopaque; extern fn fputs(__s: [*:0]const u8, __st: ?*anyopaque) c_int; };
var __lb: [128]u8 = undefined;
const __lm = "KORU LEAK CHECK FAILED: allocations still outstanding at end of run: ";
@memcpy(__lb[0..__lm.len], __lm);
var __ln: usize = __lm.len;
var __lv = __koru_leak_count.load(.acquire);
var __ld: [20]u8 = undefined;
var __lk: usize = 0;
while (__lv > 0) : (__lk += 1) { __ld[__lk] = @intCast('0' + __lv % 10); __lv /= 10; }
for (0..__lk) |__li| { __lb[__ln] = __ld[__lk - 1 - __li]; __ln += 1; }
__lb[__ln] = '\n'; __ln += 1; __lb[__ln] = 0;
_ = __klc.fputs(@as([*:0]const u8, @ptrCast(&__lb)), __klc.stdout);
@trap();
}
} else {
@import("std").debug.print("KORU LEAK CHECK FAILED: the produced program leaked (trace above)\n", .{});
@import("std").process.exit(1);
}
}
pub const main_module = struct {
const std = @import("std");
const Handle = struct { n: i32 };
pub const make_event = struct {
pub const Input = struct {
};
pub const Output = *Handle;
pub fn handler(__koru_event_input: @This().Input) @This().Output {
// >>> PROC: make [tests/regression/300_ADVANCED_FEATURES/335_OBLIGATION_STRESS/335_046_continuation_after_borrow_auto_discharges/input.kz:64]
_ = &__koru_event_input;
const h = std.heap.page_allocator.create(Handle) catch unreachable;
h.* = .{ .n = 0 };
return h;
}
};
pub const touch_event = struct {
pub const Input = struct {
h: *Handle,
};
pub const Output = void;
pub fn handler(__koru_event_input: @This().Input) @This().Output {
// >>> PROC: touch [tests/regression/300_ADVANCED_FEATURES/335_OBLIGATION_STRESS/335_046_continuation_after_borrow_auto_discharges/input.kz:72]
const h = __koru_event_input.h;
_ = &h;
_ = &__koru_event_input;
h.n += 1;
}
};
pub const report_event = struct {
pub const Input = struct {
n: i32,
};
pub const Output = void;
pub inline fn handler(__koru_event_input: @This().Input) @This().Output {
return __koru_handler_impl(__koru_event_input.n);
}
fn __koru_handler_impl(__koru_p_0: i32) @This().Output {
const __koru_event_input: @This().Input = .{ .n = __koru_p_0 };
// >>> PROC: report [tests/regression/300_ADVANCED_FEATURES/335_OBLIGATION_STRESS/335_046_continuation_after_borrow_auto_discharges/input.kz:75]
const n = __koru_event_input.n;
_ = &n;
_ = &__koru_event_input;
std.debug.print("n={}\n", .{n});
}
};
pub const dispose_event = struct {
pub const Input = struct {
h: *Handle,
};
pub const Output = void;
pub fn handler(__koru_event_input: @This().Input) @This().Output {
// >>> PROC: dispose [tests/regression/300_ADVANCED_FEATURES/335_OBLIGATION_STRESS/335_046_continuation_after_borrow_auto_discharges/input.kz:79]
const h = __koru_event_input.h;
_ = &h;
_ = &__koru_event_input;
std.heap.page_allocator.destroy(h);
}
};
// >>> FLOW: tests/regression/300_ADVANCED_FEATURES/335_OBLIGATION_STRESS/335_046_continuation_after_borrow_auto_discharges/input.kz:83 ~input:make()
pub fn flow0() void {
const h0 = main_module.make_event.handler(.{ });
const result_1 = main_module.touch_event.handler(.{ .h = h0 });
_ = &result_1;
const result_2 = main_module.report_event.handler(.{ .n = 0 });
_ = &result_2;
_ = main_module.dispose_event.handler(.{ .h = h0 });
}
pub fn koru_start_flow() void {
const result_0 = koru_koru.start_event.handler(.{ });
const result_0_done = result_0.done;
_ = &result_0_done;
}
pub fn koru_end_flow() void {
const result_0 = koru_koru.end_event.handler(.{ });
const result_0_done = result_0.done;
_ = &result_0_done;
}
};
pub const koru_koru = struct {
pub const start_event = struct {
pub const Input = struct {
};
pub const Output = union(enum(u8)) {
done: struct {
},
};
pub fn handler(__koru_event_input: @This().Input) @This().Output {
_ = &__koru_event_input;
return .{ .done = .{} };
}
};
pub const end_event = struct {
pub const Input = struct {
};
pub const Output = union(enum(u8)) {
done: struct {
},
};
pub fn handler(__koru_event_input: @This().Input) @This().Output {
_ = &__koru_event_input;
return .{ .done = .{} };
}
};
};
pub fn main() void {
main_module.koru_start_flow();
main_module.flow0();
main_module.koru_end_flow();
if (comptime @import("builtin").mode == .Debug) koru_leak_check();
}
test {
@import("std").testing.refAllDeclsRecursive(@This());
}
Emitted C# source
using static KoruHost;
static class KoruHost {
public class Handle {
public int n;
}
}
static class main_module {
public static void __koru_stdout_write(object s) => global::System.Console.Out.Write(s);
public static void __koru_stderr_write(object s) => global::System.Console.Error.Write(s);
// The mutable handle carrier — `*String`-style resources are
// `new __KoruBox { data = … }` because C# anonymous types are
// read-only: `s.data = …` (std/string append/clear, handle
// mutation generally) needs a settable member. `object`, not
// `dynamic`: the field is storage — every `x.data` read reaches
// it through a dynamic-typed handle (`*T` Input fields, the
// `dynamic` borrow locals below), so the member itself only
// needs to hold the value, and `object` keeps the DLR out of
// the store/load path.
public class __KoruBox { public object data; }
// Textification for `{{ … }}` operands: C# bool ToStrings as
// `True` where Koru prints `true`, and the operand's static type
// is unknown at this boundary — a `(x) is bool` inline test would
// be a compile error on statically-typed operands instead. Generic
// on purpose: `dynamic` boxed every value-type operand — measured
// ~1s/10M elements on 012_threat_scanner — while T specializes to
// the operand's own ToString() with no box.
public static string __koru_str<T>(T v) => v is bool b ? (b ? "true" : "false") : v?.ToString();
public static class make_event {
public struct Input {
}
public static dynamic handler(Input __koru_input) {
return new Handle();
return default;
}
}
public static class touch_event {
public struct Input {
public dynamic h;
}
public static object handler(Input __koru_input) {
var h = __koru_input.h;
h.n += 1;
return default;
}
}
public static class report_event {
public struct Input {
public int n;
}
public static object handler(Input __koru_input) {
var n = __koru_input.n;
global::System.Console.WriteLine("n=" + n);
return default;
}
}
public static class dispose_event {
public struct Input {
public dynamic h;
}
public static object handler(Input __koru_input) {
var h = __koru_input.h;
return default;
}
}
public static class koru_start_event {
public struct Input {
}
public struct Output {
public string tag;
public object done;
}
public static Output handler(Input __koru_input) => new Output { tag = "done" };
}
public static class koru_end_event {
public struct Input {
}
public struct Output {
public string tag;
public object done;
}
public static Output handler(Input __koru_input) => new Output { tag = "done" };
}
public static void flow0() {
var h0 = main_module.make_event.handler(new make_event.Input { });
{
var __koru_p_h = h0;
__koru_p_h.n += 1;
}
{
var __koru_p_n = (int)(0);
global::System.Console.WriteLine("n=" + __koru_p_n);
}
{
var __koru_p_h = h0;
}
}
public static void flow1() {
main_module.koru_start_event.handler(new koru_start_event.Input { });
}
public static void flow2() {
main_module.koru_end_event.handler(new koru_end_event.Input { });
}
}
static class Program {
static void Main() {
main_module.flow1();
main_module.flow0();
main_module.flow2();
}
}
Flows
flow ~make click a branch to expand · @labels scroll to their anchor
make
Test Configuration
MUST_RUN LANGUAGES: zig cs