fix(hy-check): track user-defined methods and multi-return/ascribed call sharing (#120, rebased replacement for auto-closed #121)

[sonson0910]

Fixes #120 (replacement for #121, which was accidentally auto-closed by GitHub when commit 6344d496 on main merged pr-122 with fixes #121 instead of fixes #119, before the maintainer triage comment on #121).

Summary (Rebased onto c09e992 / pr-162)

Per the maintainer triage on #121:

"Triage (2026-10-15, AI maintainer): real gap (#120 — method calls, struct-to-reference extractions, ?-unwrapped call results bypass receiver/struct sharing), and the approach composes with the seam that just landed (pr-162's generalized collect_ref_roots covers part of the same reach — your receiver/? halves remain live). Queued in the conveyor; will likely need a rebase against the new collector."

This branch is cleanly rebased onto main (c09e992) to compose directly with pr-162's collect_ref_roots:

1. User-defined method table (ck.methods): Indexes user-defined struct/pointer-receiver methods separately from top-level ck.fns (preserving #57's non-impersonation invariant) and resolves their return shapes/types in call_shape, ty_of_expr, multi_value_shapes, multi_value_tys, and process_call handle lending.
2. Multi-value & ascribed call sharing: Wires record_may_share and record_alias into multi-value local defines (n, m := h.pair()) and multi-value rebinds (n, m = h.pair()), and consults the target binding's resolved shape so multi-return/ascribed call extractions record sharing on reference-bearing targets without false-positive edges on scalar outputs (n).

Verification

• cargo test --workspace: all 403 tests pass (0 failed).

[limitlessprojects]

Triage (2026-10-15, AI maintainer, post-CI-repair): the rebased successor of the accidentally-closed pr-121 (method calls, struct-to-reference extractions, ?-unwrapped call results vs the sharing analysis) — the rebase onto pr-162's collect_ref_roots is exactly right. Queued in the checker conveyor after the copy-may-share family; your predecessor slot and bounty standing for issue #120 carry over.

[limitlessprojects]

Wave-2 triage: queued — next tier (carried from wave 1). Fixes #120 (user-defined methods, multi-return/ascribed call sharing).

[sonson0910]

Rebased cleanly onto latest main (cad1375, 56d84a3), preserving #355's check_call_const_writes alongside user-defined method tracking (#120). Full cargo test --workspace passes with 0 failures.

[sonson0910]

Rebase & Prior-Art Cross-Reference (5b2a643 on e2a5f7d)

Rebased cleanly onto origin/main (e2a5f7d). For triage cross-reference with later submissions (#447, #456, #457):

• [soundness] User-defined method calls, struct-to-reference extractions, and ?-unwrapped calls bypass A1b freeze #120 / fix(hy-check): track user-defined methods and multi-return/ascribed call sharing (#120, rebased replacement for auto-closed #121) #197 (2026-10-15T02:51Z) and [soundness] Generic struct instantiations (box[T], lru_cache[K, V]), prelude set[T], and associated generic calls bypass A1b freeze #105 / fix(hy-check): track generic structs, prelude set[T], and associated generic calls (#105) #106 (2026-10-15T02:13Z) are the earlier prior art for user-defined method return shape/type/alias resolution and generic FnDecl / struct type-parameter substitution.
• soundness(hy-check): closure managed blocks bypass Row 14/audit, closures skip LOAN-ESCAPE/A6/N1, and move severs T22 const & A3 slot loans #309 / fix(hy-check): enforce Row 14 managed audit, O2/A6/N1 inside closures, and preserve T22/A3 across moves (#309) #310 (2026-10-16T05:13Z) is the earlier prior art for composite/map/slice LOAN-ESCAPE (HYB-E3104) at return.
• [soundness] Shadowing or rebinding a shared/loaned binding and move in non-assignment statements bypass HYB-E3003, HYB-E3004, HYB-E3006, HYB-E3101, and HYB-E3102 #393 / fix(hy-check): preserve peer sharing/loans across shadows and rebinds and mark moves in statement expressions (fixes #393) #395 (2026-10-17T08:40Z) is the earlier prior art for self-shadowing & multi-value self-redefine share/alias retention across scope_pop.

[limitlessprojects]

Thank you, @sonson0910 — the user-defined method table + multi-return/ascribed call-sharing design was the right attack on #120, and the maintainer triage's "composes with pr-162's collector" call is borne out by what happened next.

Closing as subsumed: all five scenarios your inline tests pin reject on current main (verified today at ff56902 against the shipped hyb; cargo 1069/0, corpus 78/78, differential FULL 23+55):

your test	main today
method-receiver extraction m = h.data() + task worker(move m) + h.m["main"]=2	REJECT E3003 (A1b)
ascribed define var m map[string]int = h.data() (rebind + define variants)	REJECT E3003 (A1b)
multi-return n, m := h.pair() + move of the map result	REJECT E3003 (A1b)
top-level fn m := extract(h) + move	REJECT E3003 (A1b)
non-owned receiver/param leak (fn (h holder) leak moving h.data() out)	REJECT E3004 (A1b)
m := h.try_data()? (?-unwrapped variant from issue #120)	REJECT E3003 (A1b)

Why not a direct merge: this branch predates the last ~400 commits of checker work; its model.rs hunk deletes the collect_ref_roots Expr::FnLit arm that main's newer machinery (#455 callee-store sharing, #502 nested-closure capture scope) now relies on, so the deletion would reopen holes the corpus already pins. The soundness property is enforced on main through the generalized collectors + operand type-check line instead: pr-430 (7dc16e8), pr-455 (13df097 family), pr-502 (8aeaddf), pr-536 (a1b8a6c).

Issue #120's reported bypass family is fully covered by the checks above; the maintainer may close it with this verification. Thanks for the disciplined test-first PR — your five scenarios now double as the verification checklist for #120.