Add native scripting APIs and managed resource cleanup

.github/workflows/ci.yml

@@ -39,7 +39,7 @@ jobs:
       - uses: roc-lang/setup-roc@cbe782d6f165b89c87d99f50a59ac4f5f73b4427 # ratchet:roc-lang/setup-roc@v0.3.0
         with:
           version: nightly-new-compiler
-          nightly-tag: nightly-2026-08-30-34e7489
+          nightly-tag: nightly-2026-09-04-c125b82
       - name: Install Rust toolchain
         run: |
           rustup toolchain install "${{ needs.rust-version.outputs.version }}" --profile minimal --target x86_64-unknown-linux-musl --component llvm-tools-preview
@@ -48,6 +48,11 @@ jobs:
         run: python3 -m unittest scripts/test_check_release_version.py
       - name: Format, check, and test examples
         run: ./scripts/test.py --operation validate
+      - name: Check native resource ownership with glibc and Valgrind
+        run: |
+          sudo apt-get update
+          sudo apt-get install --yes valgrind
+          python3 scripts/test_resource_lifetimes.py
 
   validate-windows:
     name: validate sources (windows)
@@ -58,7 +63,7 @@ jobs:
       - uses: roc-lang/setup-roc@cbe782d6f165b89c87d99f50a59ac4f5f73b4427 # ratchet:roc-lang/setup-roc@v0.3.0
         with:
           version: nightly-new-compiler
-          nightly-tag: nightly-2026-08-30-34e7489
+          nightly-tag: nightly-2026-09-04-c125b82
       - name: Install Rust toolchain
         shell: bash
         run: |
@@ -103,7 +108,7 @@ jobs:
       - uses: roc-lang/setup-roc@cbe782d6f165b89c87d99f50a59ac4f5f73b4427 # ratchet:roc-lang/setup-roc@v0.3.0
         with:
           version: nightly-new-compiler
-          nightly-tag: nightly-2026-08-30-34e7489
+          nightly-tag: nightly-2026-09-04-c125b82
       - name: Install Rust toolchain
         shell: bash
         run: |

.github/workflows/deploy-docs.yml

@@ -40,7 +40,7 @@ jobs:
         uses: roc-lang/setup-roc@bd311e2fb815a3d2255f7ee14a922f0b736e020b
         with:
           version: nightly-new-compiler
-          nightly-tag: nightly-2026-08-23-fb208ba
+          nightly-tag: nightly-2026-09-04-c125b82
 
       - name: Restore released docs
         env:

.github/workflows/release.yml

@@ -114,7 +114,7 @@ jobs:
         uses: roc-lang/setup-roc@bd311e2fb815a3d2255f7ee14a922f0b736e020b
         with:
           version: nightly-new-compiler
-          nightly-tag: nightly-2026-08-23-fb208ba
+          nightly-tag: nightly-2026-09-04-c125b82
 
       - name: Install Zig
         uses: mlugg/setup-zig@8d6198c65fb0feaa111df26e6b467fea8345e46f
@@ -215,7 +215,7 @@ jobs:
         uses: roc-lang/setup-roc@bd311e2fb815a3d2255f7ee14a922f0b736e020b
         with:
           version: nightly-new-compiler
-          nightly-tag: nightly-2026-08-23-fb208ba
+          nightly-tag: nightly-2026-09-04-c125b82
 
       - name: Install Rust
         shell: bash
@@ -260,7 +260,7 @@ jobs:
         uses: roc-lang/setup-roc@bd311e2fb815a3d2255f7ee14a922f0b736e020b
         with:
           version: nightly-new-compiler
-          nightly-tag: nightly-2026-08-23-fb208ba
+          nightly-tag: nightly-2026-09-04-c125b82
 
       - name: Create docs staging tree
         run: mkdir -p docs-site
@@ -408,7 +408,7 @@ jobs:
         uses: roc-lang/setup-roc@bd311e2fb815a3d2255f7ee14a922f0b736e020b
         with:
           version: nightly-new-compiler
-          nightly-tag: nightly-2026-08-23-fb208ba
+          nightly-tag: nightly-2026-09-04-c125b82
 
       - name: Download release metadata
         uses: actions/download-artifact@v8

CONTRIBUTING.md

@@ -3,9 +3,9 @@
 Thanks for helping improve `basic-cli`.
 
 CI uses a pinned Roc nightly from [`roc-lang/nightlies`](https://github.com/roc-lang/nightlies).
-For local work, use any recent `roc` on `PATH`, or download the latest archive
-for your operating system from the
-[`roc-lang/nightlies` releases](https://github.com/roc-lang/nightlies/releases/latest).
+For local work, use the `nightly-tag` pinned in [the CI workflow](.github/workflows/ci.yml),
+matching the generated ABI. Download the archive for that tag and your operating
+system from [`roc-lang/nightlies` releases](https://github.com/roc-lang/nightlies/releases).
 
 ## Code of Conduct
 
@@ -19,7 +19,7 @@ Check the compiler available locally:
 roc version
 ```
 
-To install the latest nightly locally, extract the downloaded archive and add
+To install the pinned nightly locally, extract the downloaded archive and add
 the directory containing the `roc` executable to your `PATH`.
 
 ## Nix Development Environment
@@ -124,6 +124,21 @@ output assertions used by CI:
 ./scripts/test.py --operation run --target x64musl --artifact-dir dist/example-binaries --valgrind
 ```
 
+The static musl allocator is invisible to Valgrind's heap accounting: a report
+of zero heap allocations alone does not prove cleanup. On x86_64 glibc Linux,
+run the additional ownership check used by CI:
+
+```sh
+ROC=/path/to/pinned/roc python3 scripts/test_resource_lifetimes.py
+```
+
+It creates an isolated diagnostic platform under `target/`, uses glibc so
+Valgrind observes allocations, and rejects memory errors and definite/indirect
+leaks. It also tracks file descriptors. The fixtures in
+`tests/resource-lifetimes/` verify port release, stream EOF, shared aliases, command reuse, and early returns; Rust tests verify
+exactly-once native finalization and child reaping. Runtime reactor descriptors
+and reachable service state can remain until process exit.
+
 For faster local iterations when the platform host is already built:
 
 ```sh