✓
Passing This code compiles and runs correctly.
Code
// RECOVERY EXACTNESS — the accumulator applies each inverse exactly once.
//
// Cordis Theorem 7 (soundness invariant phi(gamma) = gamma_0): recovery
// returns the context to its initial state. The corollary the bridge must
// honor: a handle EXPLICITLY discharged during a turn is not released again
// at hang-up. Double-release is a doubled inverse — the very thing the
// accumulator exists to prevent.
//
// Scenario: open a.txt (held), open b.txt (held), explicitly close a.txt.
// Then hang up. Only b.txt may be released by the bridge. If a.txt is
// released again, `close-file() ran for 'a.txt'` prints twice — red.
import std/io
import std/bridge
import std/runtime
tor open { path: string } -> string<opened!>
proc open|zig {
const std = @import("std");
std.debug.print("open({s})\n", .{path});
return path;
}
tor close-file { handle: string<!opened> }
proc close-file|zig {
const std = @import("std");
std.debug.print("close-file() ran for '{s}'\n", .{handle});
}
std/runtime:register(scope: "files") {
open(10)
close-file(1)
}
tor run-turn { br: *std/bridge:Bridge<session>, source: string, label: string }
run-turn = std/bridge:run(br, source)
| unhandled-branch _ |> std/io:print.ln(" UNHANDLED (unexpected)")
| result r |> std/io:print.ln(" {{ label:s }}: held={{ r.handles:d }}")
| defined d |> std/io:print.ln(" {{ label:s }}: DEFINED {{ d:s }}")
| error runerr |> std/bridge:error-decode(e: runerr)
| event-denied ev |> std/io:print.ln(" {{ label:s }}: DENIED {{ ev:s }}")
| dispatch-error e |> std/io:print.ln(" {{ label:s }}: DISPATCH {{ e.message:s }}")
| parse-error e |> std/io:print.ln(" {{ label:s }}: PARSE {{ e.message:s }}")
| exhausted _ |> std/io:print.ln(" {{ label:s }}: EXHAUSTED")
| validation-error _ |> std/io:print.ln(" {{ label:s }}: VALIDATION")
| shape-error _ |> std/io:print.ln(" {{ label:s }}: SHAPE")
| scope-not-found _ |> std/io:print.ln(" {{ label:s }}: NO SCOPE")
| residue _ |> std/io:print.ln("FAIL: residue outcome")
[with]std/bridge:create(id: "exactness", scope: "files"): br
|> std/io:print.ln("--- bridge open")
|> run-turn(br, source: "open(path: \"a.txt\")", label: "open a")
|> run-turn(br, source: "open(path: \"b.txt\")", label: "open b")
|> run-turn(br, source: "close-file(handle: \"a.txt\")", label: "close a")
|> std/io:print.ln("--- hang up; only b.txt may be released")
|> std/bridge:close(br)
|> std/io:print.ln("--- done")
Supporting Files
NoCsProcBody
Actual · Zig
✓ pass--- bridge open
open(a.txt)
open a: held=1
open(b.txt)
open b: held=2
close-file() ran for 'a.txt'
close a: held=1
--- hang up; only b.txt may be released
close-file() ran for 'b.txt'
[BRIDGE] Invoked 'close-file' for handle 'b.txt' [main:opened]
--- done
Actual · JavaScript
✗ error[KORU047]Actual · C#
✗ NoCsProcBodyExpected output
✓ Zig✗ JavaScript✗ C#--- bridge open
open(a.txt)
open a: held=1
open(b.txt)
open b: held=2
close-file() ran for 'a.txt'
close a: held=1
--- hang up; only b.txt may be released
close-file() ran for 'b.txt'
[BRIDGE] Invoked 'close-file' for handle 'b.txt' [main:opened]
--- done
Emitted Zig source
// Access compiler flags via the per-user compiler_env module
const CompilerEnv = @import("compiler_env").CompilerEnv;
pub const panic = if (@import("builtin").mode == .Debug)
@import("std").debug.FullPanic(@import("std").debug.defaultPanic)
else
@import("std").debug.simple_panic;
const __koru_bare = struct {
extern fn posix_memalign(memptr: *?*anyopaque, alignment: usize, size: usize) c_int;
extern fn free(ptr: ?*anyopaque) void;
fn bareAlloc(_: *anyopaque, len: usize, alignment: @import("std").mem.Alignment, _: usize) ?[*]u8 {
var p: ?*anyopaque = null;
const a = @max(alignment.toByteUnits(), @sizeOf(usize));
if (posix_memalign(&p, a, len) != 0) return null;
return @ptrCast(p);
}
fn bareResize(_: *anyopaque, _: []u8, _: @import("std").mem.Alignment, _: usize, _: usize) bool { return false; }
fn bareRemap(_: *anyopaque, _: []u8, _: @import("std").mem.Alignment, _: usize, _: usize) ?[*]u8 { return null; }
fn bareFree(_: *anyopaque, memory: []u8, _: @import("std").mem.Alignment, _: usize) void { free(@ptrCast(memory.ptr)); }
const vtable = @import("std").mem.Allocator.VTable{ .alloc = bareAlloc, .resize = bareResize, .remap = bareRemap, .free = bareFree };
const allocator = @import("std").mem.Allocator{ .ptr = undefined, .vtable = &vtable };
};
const __koru_backing = if (@import("builtin").link_libc) @import("std").heap.c_allocator else if (@import("builtin").os.tag == .freestanding and !@import("builtin").cpu.arch.isWasm()) __koru_bare.allocator else @import("std").heap.page_allocator;
var __koru_leak_count: @import("std").atomic.Value(usize) = .init(0);
var __koru_par_tasks: @import("std").atomic.Value(usize) = .init(0);
const __koru_par_CAP: usize = 128;
threadlocal var __koru_par_depth: usize = 0;
const __koru_par_DEPTH_CAP: usize = 7;
var __koru_par_pool: @import("std").Thread.Pool = undefined;
var __koru_par_pool_ready: bool = false;
var __koru_par_pool_mtx: @import("std").Thread.Mutex = .{};
fn __koru_par_pool_ensure() *@import("std").Thread.Pool {
__koru_par_pool_mtx.lock();
defer __koru_par_pool_mtx.unlock();
if (!__koru_par_pool_ready) {
@import("std").Thread.Pool.init(&__koru_par_pool, .{ .allocator = @import("std").heap.smp_allocator }) catch @panic("koru: thread pool init failed");
__koru_par_pool_ready = true;
}
return &__koru_par_pool;
}
fn __koru_alloc(ctx: *anyopaque, len: usize, alignment: @import("std").mem.Alignment, ret_addr: usize) ?[*]u8 {
_ = ctx;
const r = __koru_backing.rawAlloc(len, alignment, ret_addr);
if (comptime @import("builtin").mode == .Debug) {
if (r != null) _ = __koru_leak_count.fetchAdd(1, .monotonic);
}
return r;
}
fn __koru_resize(ctx: *anyopaque, memory: []u8, alignment: @import("std").mem.Alignment, new_len: usize, ret_addr: usize) bool {
_ = ctx;
return __koru_backing.rawResize(memory, alignment, new_len, ret_addr);
}
fn __koru_remap(ctx: *anyopaque, memory: []u8, alignment: @import("std").mem.Alignment, new_len: usize, ret_addr: usize) ?[*]u8 {
_ = ctx;
return __koru_backing.rawRemap(memory, alignment, new_len, ret_addr);
}
fn __koru_free(ctx: *anyopaque, memory: []u8, alignment: @import("std").mem.Alignment, ret_addr: usize) void {
_ = ctx;
__koru_backing.rawFree(memory, alignment, ret_addr);
if (comptime @import("builtin").mode == .Debug) {
_ = __koru_leak_count.fetchSub(1, .monotonic);
}
}
const __koru_vtable = @import("std").mem.Allocator.VTable{ .alloc = __koru_alloc, .resize = __koru_resize, .remap = __koru_remap, .free = __koru_free };
pub fn koru_allocator() @import("std").mem.Allocator {
return .{ .ptr = undefined, .vtable = &__koru_vtable };
}
pub inline fn __koru_intcast(comptime T: type, x: anytype) T {
if (comptime (@import("builtin").mode == .Debug or @import("builtin").mode == .ReleaseSafe))
return @as(T, @intCast(x));
const dst = @typeInfo(T);
const src = @typeInfo(@TypeOf(x));
if (comptime (dst == .int and src == .int and dst.int.bits == src.int.bits and dst.int.signedness != src.int.signedness))
return @as(T, @bitCast(x));
return @as(T, @intCast(x));
}
fn __KoruPadI(comptime T: type) type {
const V = switch (@typeInfo(T)) { .comptime_int => i64, .comptime_float => f64, else => T };
return struct {
v: V,
width: usize,
pub fn format(self: @This(), w: *@import("std").Io.Writer) @import("std").Io.Writer.Error!void {
const rendered = @import("std").fmt.count("{d}", .{self.v});
const pad = self.width -| rendered;
for (0..pad) |_| try w.writeByte(' ');
try w.print("{d}", .{self.v});
}
};
}
pub fn __koru_pad_i(width: usize, value: anytype) __KoruPadI(@TypeOf(value)) {
return .{ .v = value, .width = width };
}
pub fn koru_leak_check() void {
if (comptime @import("builtin").mode != .Debug) return;
if (__koru_leak_count.load(.acquire) == 0) return;
if (comptime @import("builtin").target.os.tag == .freestanding) {
if (comptime @import("builtin").cpu.arch == .wasm32 or @import("builtin").cpu.arch == .wasm64) {
@panic("KORU LEAK CHECK FAILED: the produced program leaked");
} else {
const __klc = struct { extern var stdout: ?*anyopaque; extern fn fputs(__s: [*:0]const u8, __st: ?*anyopaque) c_int; };
var __lb: [128]u8 = undefined;
const __lm = "KORU LEAK CHECK FAILED: allocations still outstanding at end of run: ";
@memcpy(__lb[0..__lm.len], __lm);
var __ln: usize = __lm.len;
var __lv = __koru_leak_count.load(.acquire);
var __ld: [20]u8 = undefined;
var __lk: usize = 0;
while (__lv > 0) : (__lk += 1) { __ld[__lk] = @intCast('0' + __lv % 10); __lv /= 10; }
for (0..__lk) |__li| { __lb[__ln] = __ld[__lk - 1 - __li]; __ln += 1; }
__lb[__ln] = '\n'; __ln += 1; __lb[__ln] = 0;
_ = __klc.fputs(@as([*:0]const u8, @ptrCast(&__lb)), __klc.stdout);
@trap();
}
} else {
@import("std").debug.print("KORU LEAK CHECK FAILED: the produced program leaked (trace above)\n", .{});
@import("std").process.exit(1);
}
}
pub const main_module = struct {
pub const open_event = struct {
pub const Input = struct {
path: []const u8,
};
pub const Output = []const u8;
pub fn handler(__koru_event_input: @This().Input) @This().Output {
// >>> PROC: open [tests/regression/400_RUNTIME_FEATURES/440_RESOURCE_BRIDGE/440_013_recovery_exactness/input.k:19]
const path = __koru_event_input.path;
_ = &path;
_ = &__koru_event_input;
const std = @import("std");
std.debug.print("open({s})\n", .{path});
return path;
}
};
pub const close_file_event = struct {
pub const Input = struct {
handle: []const u8,
};
pub const Output = void;
pub fn handler(__koru_event_input: @This().Input) @This().Output {
// >>> PROC: close_file [tests/regression/400_RUNTIME_FEATURES/440_RESOURCE_BRIDGE/440_013_recovery_exactness/input.k:26]
const handle = __koru_event_input.handle;
_ = &handle;
_ = &__koru_event_input;
const std = @import("std");
std.debug.print("close-file() ran for '{s}'\n", .{handle});
}
};
// __KORU_RUNTIME_REGISTRY_HELPERS__
const __koru_dispatcher_std = @import("std");
const __koru_dispatcher_ast = @import("ast");
pub const Path = __koru_dispatcher_ast.DottedPath;
pub const Arg = __koru_dispatcher_ast.Arg;
pub const Invocation = __koru_dispatcher_ast.Invocation;
pub const DispatchResult = koru_std.koru_runtime.DispatchResult;
const __koru_ScopeEvent = koru_std.koru_runtime.ScopeEvent;
const __koru_ScopeDescriptor = koru_std.koru_runtime.ScopeDescriptor;
const __koru_ScopeManifest = koru_std.koru_runtime.ScopeManifest;
const __koru_ManifestEvent = koru_std.koru_runtime.ManifestEvent;
const __koru_ManifestArg = koru_std.koru_runtime.ManifestArg;
const __koru_ManifestCreate = koru_std.koru_runtime.ManifestCreate;
const __koru_ManifestDischarge = koru_std.koru_runtime.ManifestDischarge;
const __koru_ManifestBranch = koru_std.koru_runtime.ManifestBranch;
const __koru_ManifestBranchField = koru_std.koru_runtime.ManifestBranchField;
const __koru_FieldValue = koru_std.koru_runtime.FieldValue;
const __koru_NamedField = koru_std.koru_runtime.NamedField;
fn __koru_getArg(__koru_args: []const __koru_dispatcher_ast.Arg, __koru_n: []const u8) ?[]const u8 {
for (__koru_args) |__koru_arg| {
if (__koru_dispatcher_std.mem.eql(u8, __koru_arg.name, __koru_n)) {
var __koru_v = __koru_arg.value;
if (__koru_v.len >= 2 and __koru_v[0] == '"' and __koru_v[__koru_v.len-1] == '"') __koru_v = __koru_v[1..__koru_v.len-1];
return __koru_v;
}
}
return null;
}
fn __koru_buildInput(comptime __koru_T: type, __koru_args: []const __koru_dispatcher_ast.Arg) !__koru_T {
var __koru_input: __koru_T = undefined;
inline for (__koru_dispatcher_std.meta.fields(__koru_T)) |__koru_field| {
const __koru_raw = __koru_getArg(__koru_args, __koru_field.name) orelse "";
const __koru_F = __koru_field.type;
if (__koru_F == bool) {
@field(__koru_input, __koru_field.name) = __koru_dispatcher_std.mem.eql(u8, __koru_raw, "true") or __koru_dispatcher_std.mem.eql(u8, __koru_raw, "1");
} else switch (@typeInfo(__koru_F)) {
.int => {
@field(__koru_input, __koru_field.name) = __koru_dispatcher_std.fmt.parseInt(__koru_F, __koru_raw, 10) catch {
koru_std.koru_interpreter.setDispatchDetail(__koru_dispatcher_std.fmt.allocPrint(__koru_dispatcher_std.heap.page_allocator, "field '{s}' expected " ++ @typeName(__koru_F) ++ ", got '{s}'", .{ __koru_field.name, __koru_raw }) catch @panic("dispatch: OOM"));
return error.InvalidArgument;
};
},
.float => {
@field(__koru_input, __koru_field.name) = __koru_dispatcher_std.fmt.parseFloat(__koru_F, __koru_raw) catch {
koru_std.koru_interpreter.setDispatchDetail(__koru_dispatcher_std.fmt.allocPrint(__koru_dispatcher_std.heap.page_allocator, "field '{s}' expected " ++ @typeName(__koru_F) ++ ", got '{s}'", .{ __koru_field.name, __koru_raw }) catch @panic("dispatch: OOM"));
return error.InvalidArgument;
};
},
.pointer => |__koru_ptr_info| {
if (__koru_ptr_info.size == .slice and __koru_ptr_info.child == u8) {
@field(__koru_input, __koru_field.name) = __koru_raw;
} else {
@field(__koru_input, __koru_field.name) = koru_std.koru_interpreter.resolveDispatchResource(__koru_F, __koru_raw) orelse {
koru_std.koru_interpreter.setDispatchDetail(__koru_dispatcher_std.fmt.allocPrint(__koru_dispatcher_std.heap.page_allocator, "field '{s}' names a resource token this pool does not hold — got '{s}'", .{ __koru_field.name, __koru_raw }) catch @panic("dispatch: OOM"));
return error.InvalidArgument;
};
}
},
else => {
@field(__koru_input, __koru_field.name) = __koru_dispatcher_std.mem.zeroes(__koru_F);
},
}
}
return __koru_input;
}
fn __koru_own(comptime __koru_T: type, __koru_s: []const __koru_T) []const __koru_T {
const __koru_a = __koru_dispatcher_std.heap.page_allocator;
if (__koru_T == u8) return __koru_a.dupe(u8, __koru_s) catch @panic("dispatch: OOM owning result");
const __koru_out = __koru_a.alloc(__koru_T, __koru_s.len) catch @panic("dispatch: OOM owning result");
for (__koru_s, 0..) |__koru_e, __koru_i| __koru_out[__koru_i] = __koru_a.dupe(u8, __koru_e) catch @panic("dispatch: OOM owning result");
return __koru_out;
}
fn dispatch_files_open(__koru_inv: *const __koru_dispatcher_ast.Invocation, __koru_out: *koru_std.koru_runtime.DispatchResult) !void {
const __koru_Input = main_module.open_event.Input;
const __koru_Handler = main_module.open_event;
const __koru_ReturnType = @typeInfo(@TypeOf(__koru_Handler.handler)).@"fn".return_type.?;
if (__koru_ReturnType == void) {
// Void event - just call and return empty __koru_branch
__koru_Handler.handler(try __koru_buildInput(__koru_Input, __koru_inv.args));
__koru_out.* = .{ .branch = "", .fields = &.{} };
return;
}
if (@typeInfo(__koru_ReturnType) != .@"union") {
// Single-return tor (`-> __koru_T`): the value BINDS, it does not select a
// __koru_branch. Reported as the empty __koru_branch with the value on __type_ref,
// the same channel identity branches use for bare payloads.
const __koru_v = __koru_Handler.handler(try __koru_buildInput(__koru_Input, __koru_inv.args));
const __koru_V = @TypeOf(__koru_v);
const __koru_SR = struct { threadlocal var buf: [1]__koru_NamedField = undefined; };
var __koru_n: usize = 0;
if (__koru_V == bool) {
__koru_SR.buf[0] = .{ .name = "__type_ref", .value = __koru_FieldValue{ .bool_val = __koru_v } };
__koru_n = 1;
} else if (@typeInfo(__koru_V) == .int) {
__koru_SR.buf[0] = .{ .name = "__type_ref", .value = __koru_FieldValue{ .int_val = @as(i64, @intCast(__koru_v)) } };
__koru_n = 1;
} else if (@typeInfo(__koru_V) == .float) {
__koru_SR.buf[0] = .{ .name = "__type_ref", .value = __koru_FieldValue{ .float_val = @as(f64, @floatCast(__koru_v)) } };
__koru_n = 1;
} else if (@typeInfo(__koru_V) == .pointer) {
const __koru_ptr_info = @typeInfo(__koru_V).pointer;
if (__koru_ptr_info.size == .slice and __koru_ptr_info.child == u8) {
__koru_SR.buf[0] = .{ .name = "__type_ref", .value = __koru_FieldValue{ .string_val = __koru_own(u8, __koru_v) } };
__koru_n = 1;
} else if (__koru_ptr_info.size == .slice and __koru_ptr_info.child == []const u8) {
__koru_SR.buf[0] = .{ .name = "__type_ref", .value = __koru_FieldValue{ .string_array = __koru_own([]const u8, __koru_v) } };
__koru_n = 1;
} else {
__koru_SR.buf[0] = .{ .name = "__type_ref", .value = __koru_FieldValue{ .string_val = koru_std.koru_interpreter.registerDispatchResource(@typeName(__koru_ptr_info.child), __koru_v) } };
__koru_n = 1;
}
}
__koru_out.* = .{ .branch = "", .fields = __koru_SR.buf[0..__koru_n] };
return;
}
// Branched event - extract __koru_branch and fields
const __koru_r = __koru_Handler.handler(try __koru_buildInput(__koru_Input, __koru_inv.args));
const __koru_S = struct { threadlocal var buf: [16]__koru_NamedField = undefined; };
const __koru_branch = @tagName(__koru_r);
const __koru_field_count = switch (__koru_r) { inline else => |__koru_p| blk: {
const __koru_P = @TypeOf(__koru_p);
// Identity branches have bare types, not structs
if (@typeInfo(__koru_P) != .@"struct") {
// Identity __koru_branch - create synthetic __type_ref __koru_field
if (__koru_P == bool) {
__koru_S.buf[0] = .{ .name = "__type_ref", .value = __koru_FieldValue{ .bool_val = __koru_p } };
} else if (@typeInfo(__koru_P) == .int) {
__koru_S.buf[0] = .{ .name = "__type_ref", .value = __koru_FieldValue{ .int_val = @as(i64, @intCast(__koru_p)) } };
} else if (@typeInfo(__koru_P) == .float) {
__koru_S.buf[0] = .{ .name = "__type_ref", .value = __koru_FieldValue{ .float_val = @as(f64, @floatCast(__koru_p)) } };
} else if (@typeInfo(__koru_P) == .pointer) {
const __koru_ptr_info = @typeInfo(__koru_P).pointer;
if (__koru_ptr_info.size == .slice and __koru_ptr_info.child == u8) {
__koru_S.buf[0] = .{ .name = "__type_ref", .value = __koru_FieldValue{ .string_val = __koru_own(u8, __koru_p) } };
} else if (__koru_ptr_info.size == .slice and __koru_ptr_info.child == []const u8) {
__koru_S.buf[0] = .{ .name = "__type_ref", .value = __koru_FieldValue{ .string_array = __koru_own([]const u8, __koru_p) } };
} else {
__koru_S.buf[0] = .{ .name = "__type_ref", .value = __koru_FieldValue{ .string_val = koru_std.koru_interpreter.registerDispatchResource(@typeName(__koru_ptr_info.child), __koru_p) } };
}
} else {
break :blk @as(usize, 0);
}
break :blk @as(usize, 1);
}
// Compound __koru_branch - iterate over struct fields
const __koru_payload_fields = __koru_dispatcher_std.meta.fields(__koru_P);
comptime var __koru_count: usize = 0;
inline for (__koru_payload_fields) |__koru_field| {
const __koru_T = __koru_field.type;
if (__koru_T == bool) {
__koru_S.buf[__koru_count] = .{ .name = __koru_field.name, .value = __koru_FieldValue{ .bool_val = @field(__koru_p, __koru_field.name) } };
__koru_count += 1;
} else switch (@typeInfo(__koru_T)) {
.int => {
__koru_S.buf[__koru_count] = .{ .name = __koru_field.name, .value = __koru_FieldValue{ .int_val = @as(i64, @intCast(@field(__koru_p, __koru_field.name))) } };
__koru_count += 1;
},
.float => {
__koru_S.buf[__koru_count] = .{ .name = __koru_field.name, .value = __koru_FieldValue{ .float_val = @as(f64, @floatCast(@field(__koru_p, __koru_field.name))) } };
__koru_count += 1;
},
.pointer => |__koru_ptr_info| {
if (__koru_ptr_info.size == .slice and __koru_ptr_info.child == u8) {
__koru_S.buf[__koru_count] = .{ .name = __koru_field.name, .value = __koru_FieldValue{ .string_val = __koru_own(u8, @field(__koru_p, __koru_field.name)) } };
__koru_count += 1;
} else if (__koru_ptr_info.size == .slice and __koru_ptr_info.child == []const u8) {
__koru_S.buf[__koru_count] = .{ .name = __koru_field.name, .value = __koru_FieldValue{ .string_array = __koru_own([]const u8, @field(__koru_p, __koru_field.name)) } };
__koru_count += 1;
} else if (__koru_ptr_info.size == .one) {
__koru_S.buf[__koru_count] = .{ .name = __koru_field.name, .value = __koru_FieldValue{ .string_val = koru_std.koru_interpreter.registerDispatchResource(@typeName(__koru_ptr_info.child), @field(__koru_p, __koru_field.name)) } };
__koru_count += 1;
}
},
else => {},
}
... [truncated - 420KB total]Flows
flow ~register click a branch to expand · @labels scroll to their anchor
register (scope: "files", source: open(10)
close-file(1))
subflow ~run-turn click a branch to expand · @labels scroll to their anchor
run (br, source)
flow ~create click a branch to expand · @labels scroll to their anchor
create (id: "exactness", scope: "files")
Test Configuration
MUST_RUN JS_REFUSES LANGUAGES: zig js cs
JS must refuse with:
error[KORU047]