[zidirahim617-del]

Fixes #123.

The gap

T22 deep immutability (paid #37's fix) fires HYB-E3006 on direct writes — but three paths never reach it:

form	on main
element write / rebind / delete inside a closure body	ACCEPT, 0 diagnostics
write through a copy of a const (alias := cells, let copy = cells)	ACCEPT, 0 diagnostics
delete(const_map, k) anywhere	ACCEPT, 0 diagnostics

Root causes:

1. walk::flatten/own_uses/own_calls all skip Expr::FnLit bodies (the A5 perimeter), so process_assign — the only E3006 site — never runs inside closures (method/fn bodies are walked: the c4/r2 controls reject).
2. const_write_root only tested the place's own root binding (lookup_binding(..).filter(immutable)), never the alias/share parent behind a copy.
3. delete() routes through check_delete_conflict (A3) only — no const check anywhere.

Race proof (issue #123, same shape as #37's evidence): a program whose both writers are closure-bodied (task worker() + main, each writing cells[0] inside its own FnLit) — hyb check: OK (0 diagnostics); emitted var cells = []int{0} under go run -race: WARNING: DATA RACE / Found 1 data race(s), exit 66. Nothing crosses the spawn site — A1c/A5 never see it.

The fix

• check_fn scans every FnLit reachable from the body (new own_fnlits/expr_fnlits walkers in walk.rs) at fn end with the completed env: assign-target roots and delete() first args resolving to an immutable binding emit HYB-E3006 at the write span. Each closure level carries only its own params/body-locals as the shadow set, so a shadowing fresh binding/param stays writable.
• const_write_root follows alias parents and may-share peers to the immutable root — the diagnostic names the const, not the copy.
• process_call routes delete(root, …) through the same root check (T22: a delete mutates the collection like an index write).

The diagnostic emitter is factored into emit_const_write_error so both sites emit byte-identical messages/notes (the corpus first-error rule is unchanged).

Verification

• hy-check tests: 317/0 workspace-wide; const_write 20/20 (10 new: 6 reject pins — closure write/rebind/fn-local capture/copy/let-copy/delete — + 4 accept guards — closure-local shadow, closure-param shadow, plain-local writes, plus the untouched [soundness] File-level const slice is mutable and reachable from every task: index writes accepted, races with 0 diagnostics #37 accepts)
• corpus: 30/30 — new row 30-const-closure-alias-write-reject (EXPECTED-VERDICT: REJECT IMMUT), VERDICTS.md row 30, parse_all count 30, README 30/30
• differential: FULL (accept 10/10, reject 20/20)
• issue [soundness] E3006 misses closure bodies and shallow aliases: const element writes/rebinds accepted (0 diagnostics), dual-closure program races at runtime - follow-up gap in #37's fix #123 probe set: c1–c9 + r3 all reject; corpus27 keeps exactly its 2 errors (no duplicate emission); shadow-accept controls pass

Stacked

Targets main; the diff carries the two predecessor commits until they merge (same as #117):

• depends on fix(hy-check): freeze closure bindings with their captured bindings (Fixes #109) #110 (closure-capture freeze, fixes [soundness] Closure capture keeps writing a value that was move-sent — accepted write/write data race (captures missing from freeze machinery) #109)
• depends on fix(hy-check): A3 events cross frames, share-peers, and closure call sites (Fixes #111, stacked on #110) #117 (A3 interproc window, fixes [soundness] Map insert/delete inside a live slot-loan window is missed when it crosses a callee frame, a shallow alias, or a closure body — accepted with 0 diagnostics (direct twins reject HYB-E3102), and a deleted loaned key silently resurrects at runtime #111)

Report first as #123 (no open issue covered E3006/closure/const since #37), then fixed here — report + fix in one flow, same as #109/#111.

[zidirahim617-del]

Hi! Following up now that all four submissions are merged — thank you for the review pass.

Merged this cycle:

• fix(tools): differential reject-side requires first-error tier0 rule match (fixes #95) #102 (fixes Fix differential reject-side false agreement on the wrong rule #95) — differential reject-side requires first-error tier0 rule match
• fix(hy-check): freeze closure bindings with their captured bindings (Fixes #109) #110 (fixes [soundness] Closure capture keeps writing a value that was move-sent — accepted write/write data race (captures missing from freeze machinery) #109) — closure-capture move freeze (race proof in the issue)
• fix(hy-check): A3 events cross frames, share-peers, and closure call sites (Fixes #111, stacked on #110) #117 (fixes [soundness] Map insert/delete inside a live slot-loan window is missed when it crosses a callee frame, a shallow alias, or a closure body — accepted with 0 diagnostics (direct twins reject HYB-E3102), and a deleted loaned key silently resurrects at runtime #111) — A3 events across frames / share-peers / closure call sites (wrong-result proof: len after = 2)
• fix(hy-check): E3006 reaches closure bodies, const copies, and delete (fixes #123, stacked on #110/#117) #126 (fixes [soundness] E3006 misses closure bodies and shallow aliases: const element writes/rebinds accepted (0 diagnostics), dual-closure program races at runtime - follow-up gap in #37's fix #123) — E3006 reaches closure bodies, const copies, and delete (dual-closure race proof)

Each one is report + fix in one flow, with full verification at its tip (workspace 317/0, corpus 30/30, differential loop FULL — accept 10/10, reject 20/20).

Following up on BOUNTY.md: could you confirm these four are registered for the current $500 cycle, and let us know when/how winners are announced?

Re: the payment channel question still open on #26 — USDT (BEP-20/ERC-20) or Binance P2P works best from our region (Algeria); bank transfer is difficult. Happy with whatever channel you support.

If anything needs adjusting for triage or ranking, we are glad to help.

[zidirahim617-del]

Formal payout request — cycle 2026-10 (cycle 1 of the $500 ladder)

Hi! This is the formal request for cycle registration and payment, per BOUNTY.md. Everything below is merged, CI-green, and reproducible.

Soundness bugs reported, reproduced, and merged (4/4):

#	Issue	PR	What it closed	Status
1	#95	#102	Differential harness ran first-error tier-0 rule (checker disagreed with itself on identical programs)	merged
2	#109	#110	Closure captures missing from move-freeze (frozen value's captured copy stayed writable — alias write accepted)	merged
3	#111	#117	A3 &m[k] events crossing callee frames, share-peers, and closure call sites (map-slot loan window leak)	merged
4	#123	#126	E3006 missing closure bodies, const copies, and delete (const-write + alias + delete paths; dual-closure race proven)	merged

Why these qualify under the ladder contract:

• Reproduced — each has a minimized .hy program + expected diagnostic, checked in the corpus (rows now part of the 42-row checker-corpus) and via corpus_harness / differential_loop tooling.
• Soundness class — all four are "checker accepted a program that breaks the ownership guarantee" (alias writes through frozen consts, map-slot loan escapes, closure-body escapes). Not ergonomics, not performance.
• Merged by the maintainer into main with tests, VERDICTS.md registry rows, and CI green on every linked commit.
• Not duplicates — each addressed a distinct frame of the analysis (captures / A3 events / E3006 scan); the maintainer's merge notes confirm each landed as its own seam fix.

Request:

1. Register this cycle's submissions in the release notes / cycle record (BOUNTY.md: "Winners are announced in release notes and the Hall of Fame").
2. Pay out per the ladder (1st $75, 2nd $60, 3rd $50, 4th $45 — total $230 for the four soundness bugs, maintainer's final say on placement as always).
3. Confirm the payout method — I can receive USDT (BEP-20 / ERC-20) or Binance P2P (I'm in Algeria; any major method works). Just let me know which is convenient and I'll provide the address/details.

No rush on my side — whenever the cycle closes. Thank you for running this program; the Wildcard submission (#193) is my next piece of work while waiting.

— @zidirahim617-del

[zidirahim617-del]

Update — 2 more fixes ready before this cycle closes

Adding two more merged-bound soundness fixes to the same cycle registration request:

Issue	PR	The hole
#92	#220	field/index stores (h.m = m) recorded no may-share; bridge rebind escaped the clique → E3003/O5.2 miss. Fixed with may-share on non-Ident targets + clique closure in share_clear. Corpus rows 43/44.
#98	#223	Stmt::Defer + call-arg moves bypassed A1b/A7 freeze and A2/A3 loan windows — binding stayed writable after its storage left (go -race caught it, checker said OK(0)). Defer loans now live to function exit.

Both are CI-green, corpus 44/44, differential reject-side 31/31. This brings the cycle's soundness landings to 6. Happy to fold them into the same payout request — just say the word and I will re-post the consolidated table.

Separately: could a maintainer/owner apply the wildcard + 💎 Bounty labels to #193? The wildcard.yml template did not auto-apply them, so it is currently invisible to the 48h triage filter, and the first review window opens 2026-11-01. It answers MOONSHOT.md solicitation prompt #2.