fix: bind an if let payload and a for variable inside a lambda body (#994)

The capture walk grew its bound set for `bind` statements and a lambda's own
parameters and for nothing else, so a name any other construct introduces read
as free and went into the closure's environment. The lambda then emitted a
load of a name the enclosing frame has no local for:

    f := fn() -> Int:
        if let v = maybe():
            return v
        return 0

    unknown load source 'v' in main

`for x in xs` inside a lambda failed the same way on `x`, which the block
comment above `ir_capture_find_free_vars` already named alongside the `if let`
payload. `if_let`, `while_let` and `for_stmt` are now walked the way `lambda`
already was: the subject and the iterable under the outer bound set, the body
under a set that carries the pattern's names (or the loop variable and index).
An `if let`'s else block stays under the outer set, since the payload is not in
scope there.

That exposed the second half. `ir_emit_let_bindings` decided the
release-of-previous on an rc payload by asking whether the name is in
`ir_untracked_rc_binds`, which is the ENCLOSING function's list — the payload
name was in the enclosing frame's tracked set, so the release was emitted, and
now that the payload no longer comes from a capture slot the lambda had no `v`
to load. It asks the positive question `ir_emit_bind_stmt` already asks
instead: emit the release only for a name this frame tracks. The two agree
everywhere the prepass saw the name, and where it did not the new answer is
the safe one.

Verified by output, against the same body written as a named function:
tests/cases/test_if_let_in_lambda.pith prints five lambda arms beside five
named ones over four rounds, and every pair agrees. All of it failed to
compile before the change.

tests/leaks/leak_lambda_if_let.pith gates the shell: four lambda `if let`
arms over call subjects with by-value payloads, flat at 2.70 mb -> 2.70 mb
across 200k and 800k rounds.

Still open, and separate: a lambda body never runs the rc prologue, so it
tracks no locals and releases none of them — a heap payload the binding takes
a count on is stranded, and so is a bound optional local's shell. That is not
specific to `if let`; a plain `s := "x"` in a lambda leaks the same way.
tests/pending/if_let_frame_ownership.pith measures it beside the generic-body
twin and the named-function controls that already pass.

Author: kacy

self-host/bootstrap/ir_driver.ir

@@ -54,6 +54,33 @@ fn ir_find_free_vars_walk(idx: Int, bound: List[String], free: List[String], blo
             if cn.kind == "body" or cn.kind == "block":
                 updated_free = ir_find_free_vars_walk(child, inner_bound, updated_free, blocked_names, locals)
         return updated_free
+    # an `if let` / `while let` payload is bound by the construct itself, for
+    # its body only — the same relationship a lambda's parameters have to the
+    # lambda body above. the subject is walked under the OUTER set, since the
+    # payload name means nothing yet while it is evaluated, and so is an
+    # `if let`'s else block, where the payload is not in scope at all.
+    if node.kind == "if_let" or node.kind == "while_let":
+        if node.children.len() < 3:
+            return ir_walk_children(idx, bound, free, blocked_names, locals)
+        body_bound := ir_copy_names(bound)
+        ir_collect_pattern_names(node.children[0], body_bound)
+        mut let_free := ir_find_free_vars_walk(node.children[1], bound, free, blocked_names, locals)
+        let_free = ir_find_free_vars_walk(node.children[2], body_bound, let_free, blocked_names, locals)
+        if node.children.len() > 3:
+            let_free = ir_find_free_vars_walk(node.children[3], bound, let_free, blocked_names, locals)
+        return let_free
+    # a `for` loop binds its variable (and its optional index) for the body on
+    # the same terms. the loop variable lives in the loop's own slot rather
+    # than a frame local, so capturing it emitted a load of a name neither
+    # frame has.
+    if node.kind == "for_stmt" and node.children.len() >= 2:
+        loop_bound := ir_copy_names(bound)
+        for child in node.children:
+            cn := get_node(child)
+            if cn.kind == "loop_var" or cn.kind == "loop_index":
+                loop_bound.push(cn.value)
+        mut for_free := ir_find_free_vars_walk(node.children[0], bound, free, blocked_names, locals)
+        return ir_find_free_vars_walk(node.children[1], loop_bound, for_free, blocked_names, locals)
     if node.kind == "body" or node.kind == "block":
         mut scoped_bound := ir_copy_names(bound)
         mut updated_free := ir_copy_names(free)
@@ -65,11 +92,26 @@ fn ir_find_free_vars_walk(idx: Int, bound: List[String], free: List[String], blo
                 if bind_name.len() > 0 and not ir_list_contains(scoped_bound, bind_name):
                     scoped_bound.push(bind_name)
         return updated_free
+    return ir_walk_children(idx, bound, free, blocked_names, locals)
+
+fn ir_walk_children(idx: Int, bound: List[String], free: List[String], blocked_names: Map[String, Bool], locals: Map[String, Int]) -> List[String]:
     mut updated_free := ir_copy_names(free)
-    for child in node.children:
+    for child in get_node(idx).children:
         updated_free = ir_find_free_vars_walk(child, bound, updated_free, blocked_names, locals)
     return updated_free
 
+# every name a pattern binds, appended to `names`: the bare `pat_binding`
+# an `if let` unwraps an optional with, and the ones nested inside a tuple
+# or variant pattern. the literal and wildcard patterns bind nothing.
+fn ir_collect_pattern_names(idx: Int, names: List[String]):
+    node := get_node(idx)
+    if node.kind == "pat_binding":
+        if not ir_list_contains(names, node.value):
+            names.push(node.value)
+        return
+    for child in node.children:
+        ir_collect_pattern_names(child, names)
+
 # the names a lambda body has to capture from the scope around it: every
 # identifier under `idx` that nothing inside it declares. the emitter
 # calls this with the lambda's parameters as `bound` and uses the result
@@ -84,12 +126,14 @@ fn ir_find_free_vars_walk(idx: Int, bound: List[String], free: List[String], blo
 # an unknown name that is not blocked and is not a known function is
 # captured on the assumption that it is a local.
 #
-# only `bind` statements and lambda parameters add to the bound set as
-# the walk descends, and a bind counts only after its own initializer is
-# walked (`x := x` captures the outer x). names introduced any other way
-# are NOT bound: a `for` loop variable and an `if let` payload are seen
-# as free and captured, which emits a load of a name the enclosing frame
-# does not have and the ir consumer rejects with "unknown load source".
+# the bound set grows as the walk descends, for each name the construct
+# that introduces it puts in scope: a `bind` statement for the rest of its
+# block (and only after its own initializer is walked, so `x := x` captures
+# the outer x), a lambda's parameters for the lambda body, an `if let` or
+# `while let` payload for that body alone, and a `for` loop's variable and
+# index for the loop body. a name introduced by one of the last three used
+# to read as free and be captured, which emitted a load of a name neither
+# frame has and the ir consumer rejected with "unknown load source".
 # `self` is captured under that name like an ordinary variable.
 pub fn ir_capture_find_free_vars(idx: Int, bound: List[String], blocked_names: Map[String, Bool], locals: Map[String, Int]) -> List[String]:
     return ir_find_free_vars_walk(idx, bound, [], blocked_names, locals)

self-host/ir_capture.pith

@@ -8781,14 +8781,19 @@ fn ir_emit_let_bindings(pat_idx: Int, subj_r: Int, subj_idx: Int):
                 # transfer) releases what the binding holds. the
                 # release-of-previous mirrors ir_bind_owned_rc_payload — zero
                 # on first reach, a stale payload when a loop rebinds the
-                # name — and an untracked name skips it, keeping the retain
-                # as a bounded leak in the safe direction.
+                # name — and a name this frame does not track skips it,
+                # keeping the retain as a bounded leak in the safe direction.
+                # the tracked test is the positive one ir_emit_bind_stmt asks,
+                # not the untracked list: that list is the ENCLOSING
+                # function's, and a lambda body — which is its own frame and
+                # tracks nothing — read it and emitted a load of a name the
+                # lambda has no slot for.
                 # a tuple payload (an inner optional shell) is skipped on
                 # the same terms the prepass poisons it: its count belongs to
                 # its owner and the binding is an uncounted view.
                 rc_kind := ir_rc_kind(inner_kind)
                 if rc_kind.len() > 0 and rc_kind != "tuple":
-                    if not ir_untracked_rc_binds.contains(pat.value):
+                    if ir_rc_local_kind(pat.value).len() > 0:
                         old_r := ir_reg()
                         ir_emit("load " + old_r.to_string() + " " + pat.value)
                         ir_rc_release_reg(old_r, rc_kind)

self-host/ir_emitter_core.pith

@@ -0,0 +1,108 @@
+# an `if let` inside a lambda body did not compile: the capture walk treated
+# the payload name as a free variable, so the closure loaded it out of an
+# environment slot the enclosing frame has no local for and the ir consumer
+# rejected it with "unknown load source". a `for` loop variable inside a
+# lambda failed the same way, and for the same reason — the walk bound only
+# `bind` statements and the lambda's own parameters.
+#
+# every lambda arm here prints beside the same body written as a named
+# function. the pair is the test: a payload pulled from the wrong storage
+# cannot answer the same as the named twin.
+
+fn maybe_int(i: Int) -> Int?:
+    if i % 3 == 0:
+        return none
+    return i + 1
+
+fn maybe_str(i: Int) -> String?:
+    if i % 3 == 0:
+        return none
+    return "s" + i.to_string()
+
+fn maybe_pair(i: Int) -> (Int, String)?:
+    if i % 3 == 0:
+        return none
+    return (i, "p" + i.to_string())
+
+fn named_int(i: Int) -> Int:
+    if let v = maybe_int(i):
+        return v
+    return 0
+
+fn named_str(i: Int) -> String:
+    if let v = maybe_str(i):
+        return "some:" + v
+    return "none"
+
+fn named_pair(i: Int) -> String:
+    if let v = maybe_pair(i):
+        return "some:" + v.1
+    return "none"
+
+fn named_sum(limit: Int) -> Int:
+    mut total := 0
+    for x in 0..limit:
+        total = total + x
+    return total
+
+fn named_drain(start: Int) -> String:
+    mut k: Int? := start
+    mut acc := ""
+    while let v = k:
+        acc = acc + v.to_string()
+        if v <= 1:
+            k = none
+        else:
+            k = v - 1
+    return acc
+
+fn main():
+    lam_int := fn(i: Int) -> Int:
+        if let v = maybe_int(i):
+            return v
+        return 0
+
+    lam_str := fn(i: Int) -> String:
+        if let v = maybe_str(i):
+            return "some:" + v
+        return "none"
+
+    lam_pair := fn(i: Int) -> String:
+        if let v = maybe_pair(i):
+            return "some:" + v.1
+        return "none"
+
+    lam_sum := fn(limit: Int) -> Int:
+        mut total := 0
+        for x in 0..limit:
+            total = total + x
+        return total
+
+    lam_drain := fn(start: Int) -> String:
+        mut k: Int? := start
+        mut acc := ""
+        while let v = k:
+            acc = acc + v.to_string()
+            if v <= 1:
+                k = none
+            else:
+                k = v - 1
+        return acc
+
+    # the payload name shadows a live local of the enclosing frame: the
+    # lambda binds its own storage and leaves the outer name alone
+    v := "outer"
+    lam_shadow := fn(i: Int) -> String:
+        if let v = maybe_str(i):
+            return "inner:" + v
+        return "inner:none"
+
+    mut i := 0
+    while i < 4:
+        print("int   " + named_int(i).to_string() + " " + lam_int(i).to_string())
+        print("str   " + named_str(i) + " " + lam_str(i))
+        print("pair  " + named_pair(i) + " " + lam_pair(i))
+        print("shad  " + lam_shadow(i) + " " + v)
+        i = i + 1
+    print("sum   " + named_sum(5).to_string() + " " + lam_sum(5).to_string())
+    print("drain " + named_drain(3) + " " + lam_drain(3))

tests/cases/test_if_let_in_lambda.pith

@@ -0,0 +1,18 @@
+int   0 0
+str   none none
+pair  none none
+shad  inner:none outer
+int   2 2
+str   some:s1 some:s1
+pair  some:p1 some:p1
+shad  inner:s1 outer
+int   3 3
+str   some:s2 some:s2
+pair  some:p2 some:p2
+shad  inner:s2 outer
+int   0 0
+str   none none
+pair  none none
+shad  inner:none outer
+sum   10 10
+drain 321 321

tests/expected/test_if_let_in_lambda.txt

@@ -0,0 +1,76 @@
+# an `if let` inside a lambda body did not compile at all: the capture walk
+# read the payload name as free, so the lambda loaded it from an environment
+# slot the enclosing frame has no local for. the payload is bound by the
+# `if let` itself now and stays inside the lambda's own frame.
+#
+# what this measures is the shell, not the payload. every subject is a call,
+# which mints a shell the consumer owns and releases at the merge, and every
+# payload is a by-value kind, which strands nothing — so anything this grows
+# by is the two-slot shell itself, the half of the ownership a heap-payload
+# arm would hide.
+#
+# the arms that cannot be here, and why: a heap payload strands its count,
+# because a lambda body runs no rc prologue at all and so tracks and releases
+# no locals; a bound-local subject strands its shell for the same reason; and
+# a `return` out of the then-block jumps past the merge where the owned shell
+# is released. tests/pending/if_let_frame_ownership.pith measures those three
+# and the generic-body twin of the middle one.
+import leakprobe as probe
+
+fn count_of(i: Int) -> Int?:
+    if i % 7 == 6:
+        return none
+    return i
+
+fn flag_of(i: Int) -> Bool?:
+    if i % 3 == 2:
+        return none
+    return i % 2 == 0
+
+fn main():
+    n := probe.rounds()
+
+    # the taken path and the none path both reach the merge, so the shell is
+    # released exactly once on either
+    taken := fn(i: Int) -> Int:
+        mut m := 0
+        if let v = count_of(i):
+            m = v - i
+        return m
+
+    # the else arm releases its own shell on the path that skipped the body
+    with_else := fn(i: Int) -> Int:
+        mut m := 0
+        if let v = count_of(i):
+            m = v - i
+        else:
+            m = 1
+        return m
+
+    # two shells live at once; the inner one is released before the outer
+    nested := fn(i: Int) -> Int:
+        mut m := 0
+        if let a = count_of(i):
+            if let b = flag_of(i):
+                if b:
+                    m = a - i
+        return m
+
+    # a payload name that shadows a live local of the enclosing frame binds
+    # the lambda's own storage and must not touch the outer name's count
+    outer := 41
+    shadow := fn(i: Int) -> Int:
+        mut m := 0
+        if let outer = count_of(i):
+            m = outer - i
+        return m
+
+    mut i := 0
+    mut total := 0
+    while i < n:
+        total = total + taken(i) + with_else(i) + nested(i) + shadow(i)
+        i = i + 1
+    kb := probe.peak_kb()
+    if total < 0 or outer < 0:
+        print("unreachable")
+    print("{kb}")