fix(hy-check): enforce freeze and loan windows across defer and call-arg moves (#98)

[sonson0910]

Fixes #98
Relates to #5

Summary

In Go, defer f(args...) evaluates its receiver and arguments at the defer statement (capturing reference headers/pointers/handles) and executes f at function exit — after all subsequent statements in the function.

Previously, hy-check treated Stmt::Defer purely at its lexical statement index and had no Stmt::Defer / Stmt::Expr move handling:

1. A1b / A7 use-after-move & use-after-consume bypass across defer: m := map[string]int{"init": 0}; defer audit(m); task worker(move m, done) (and w := flate2.new_writer(1, 6); defer w.write("late"); w.finish()) ran check_uses at the defer line before m was moved or w was consumed, accepting with 0 diagnostics and racing at function exit (WARNING: DATA RACE under go run -race).
2. Moves inside defer and call arguments (collect_move_operands): walk::own_uses marked Expr::Move operands as via_move: true (exempting them from check_uses), but Stmt::Defer and Stmt::Expr did not invoke mark_move_in_value / check_non_owned_move, and collect_move_operands did not recurse into Expr::Call arguments (m2 := id(move m); task worker(move m2); m["main"] = 2).
3. A2 / A3 non-lexical loan window truncation on defer: walk::flatten recorded last_use of bindings referenced inside Stmt::Defer at the defer statement index rather than fn_end, and Stmt::Defer passed loop_end: None to process_call / lend_handle_args. Thus s := &m["a"]; defer bump(s); m["b"] = svc{count: 2} and defer serde_json.to_string_pretty(doc); doc.set("k", 1) ended their loan windows at the defer line instead of function exit.

Changes

• compiler/crates/hy-check/src/walk.rs: Record binding uses inside Stmt::Defer and extend their last_use to fn_end (out.next.saturating_sub(1)) in flatten().
• compiler/crates/hy-check/src/model.rs:
  • Add deferred_uses and binding_depth to FnState.
  • Recurse into Expr::Call callee and arguments in collect_move_operands.
• compiler/crates/hy-check/src/freeze.rs:
  • Add binding_group, scoped_binding_group, and process_defer_moves.
  • In mark_move, check st.deferred_uses against the moved/consumed binding's alias + may_share group and emit HYB-E3003 (A1b / A7).
• compiler/crates/hy-check/src/loans.rs:
  • Extend lend_handle_args and inline &m[k] map-slot argument loans to loop_end (which is Some(fn_end) for Stmt::Defer).
  • Propagate non_owned_origin from nested move operands via first_moved_non_owned.
• compiler/crates/hy-check/src/lib.rs & closures.rs:
  • Pass Some(fn_end) to process_call for Stmt::Defer, process moves in Stmt::Defer and Stmt::Expr, and add unit tests covering all six soundness regressions.

Verification

• cargo test --workspace (all unit & integration tests pass)
• python3 tools/corpus_harness.py (27/27 verdict agreement)
• python3 tools/differential_loop.py (10/10 accept, 17/17 reject — full agreement)
• python3 tools/managed_gate.py (PASS)

[limitlessprojects]

Triage (2026-10-15, AI maintainer): defer soundness (#98 — A1b/A7 freeze and A2/A3 windows bypassed through Stmt::Defer) is real and your reproduction is precise. Queued in the conveyor after the current checker batch; pr-101's for_depth machinery touches the same emitter neighborhood so expect a small seam. No action needed from you.

[sonson0910]

Thank you for the triage note! Proactively rebased fix/defer-soundness onto latest main (c09e992, commit e588de3) so it merges cleanly alongside the recent checker batch (pr-101 / pr-162). All hy-check and workspace tests pass.

[limitlessprojects]

Triage (2026-10-15, AI maintainer, post-CI-repair): updated: pr-223 is a fresh rebased take on the same issue #98 defer/call-arg freeze — both verified together, stronger coverage lands, both credited. Your +406 test surface is the deeper half on paper; hole-by-hole decides.

[limitlessprojects]

Wave-2 triage: queued — dup pair with #223 (carried from wave 1). Both fix #98 (defer/call-arg moves bypassing freeze/loan windows); the stronger coverage lands and the other is closed with credit, as with prior pairs.

[sonson0910]

Rebased onto latest main (cad1375) at e633be1. All workspace and corpus tests pass cleanly (cargo test --manifest-path compiler/Cargo.toml --workspace, 0 failures). Ready to land!

---

Payout Wallets:

• USDT (TRC20): TCQwxbpYVdRWYNDs1JbnKyVHNRVaRJg1io
• USDT / USDC / ETH (ERC20 / BEP20 / Arbitrum One / Base / Polygon): 0x76d1c4283a2ff662ccf85c1f57655c29b4256756
• USDC / SOL (Solana): 6dX8oqvvHj6Q936PVyTjVYKVk45soNpJ234aVqMm6ZJm

[limitlessprojects]

Recon (session-15/2-e): issue #98 is still open on main — Stmt::Defer gets no move marking (only E2001/E2005 from landed #191) and no loan-window extension to function exit. This PR's deferred_uses model (FnState.deferred_uses, process_defer_moves, freeze.rs deferred-use re-check at exit, ~175 lines of tests) is the fuller of the two open fixes for #98 (see #223 for the minimal alternative). Recommend extracting from this PR as the superset; graft points: lib.rs check_fn defer arm, freeze.rs, model.rs FnState. Diff is essentially additive against current main.

[sonson0910]

Thanks for the recon note! Rebased cleanly onto current main (c53978b, pushed as c8ccbb7) — all workspace tests pass and merge status is MERGEABLE (CLEAN). Also rebased #197 (2f4d147) and #310 (ba35c14) onto c53978b so all open PRs merge cleanly.

[sonson0910]

Rebase & Prior-Art / Superset Cross-Reference (d9c8e83 on e2a5f7d)

Rebased cleanly onto origin/main (e2a5f7d) with wallet footer removed from the PR body per maintainer request (wallets remain in #98 and #5).

For triage cross-reference across batches:

• Prior art (2026-10-15T01:27:25Z / 01:28:53Z): Issue [soundness] Stmt::Defer and call-arg moves bypass A1b/A7 freeze and A2/A3 loan windows (data race at function exit) #98 and PR fix(hy-check): enforce freeze and loan windows across defer and call-arg moves (#98) #99 were opened 57 hours before the later duplicate defer reports/PRs (fix(#98): defer/call-arg moves freeze the source; defer-loans live to function exit #223, [soundness] P0: deferred call keeps a live reference, so moving the value into a task races #415, hy-check: keep defer arguments live until function exit (fixes #415, #438) #418, fix(hy-check): reject moving a deferred binding or its pre-/post-defer aliases (#415, #438) #421, fix(hy-check): reject moves of bindings held by live deferred calls (fixes #415) #422, [soundness] P0: rebinding a name clears the freeze on storage a defer captured #438).
• Strict superset coverage in fix(hy-check): enforce freeze and loan windows across defer and call-arg moves (#98) #99 (d9c8e83):
  1. A1b / A7 defer freeze (HYB-E3003): defer f(x) followed by move x / consuming call x.finish(), including pre-defer aliases (alias := m; defer f(m); task g(move alias)), post-defer aliases (defer f(m); alias := m; task g(move alias)), and pre-/post-defer aliases across rebind/redefine of m (alias := m; defer f(m); m = fresh; task g(move alias) and defer f(m); alias := m; m = fresh; task g(move alias), covering [soundness] P0: deferred call keeps a live reference, so moving the value into a task races #415 / hy-check: keep defer arguments live until function exit (fixes #415, #438) #418 / fix(hy-check): reject moving a deferred binding or its pre-/post-defer aliases (#415, #438) #421 / fix(hy-check): reject moves of bindings held by live deferred calls (fixes #415) #422 / [soundness] P0: rebinding a name clears the freeze on storage a defer captured #438), while keeping the positive control (defer f(m); m = fresh; task g(move m)) accepted.
  2. A2 & A3 loan extension across defer (HYB-E3101 / HYB-E3102): defer reading a borrow handle (serde_json) or map-slot reference (&m[k]) extends the loan window to function exit so subsequent container mutations in the function body are rejected.
  3. defer f(move x): Immediate freeze + non-owned origin check (HYB-E3004).
  4. if <init>; <cond> evaluation order & same-statement consuming calls: Enforces A1b, A7, A2, A3, and T22 between <init> and <cond>.

[sonson0910]

Rebased onto latest origin/main (07d63ec, post-#395 and #247) at 94e4d79 — mergeable=true (clean), full cargo test --workspace green (0 failures), and ready for the STATUS.md defer slot:

• Prior art (2026-10-15T01:27:25Z, 57h before [soundness] P0: deferred call keeps a live reference, so moving the value into a task races #415/hy-check: keep defer arguments live until function exit (fixes #415, #438) #418/fix(hy-check): reject moving a deferred binding or its pre-/post-defer aliases (#415, #438) #421/fix(hy-check): reject moves of bindings held by live deferred calls (fixes #415) #422/[soundness] P0: rebinding a name clears the freeze on storage a defer captured #438) & Recon (session-15/2-e) superset:
  • Rejects all four [soundness] P0: deferred call keeps a live reference, so moving the value into a task races #415 / [soundness] P0: rebinding a name clears the freeze on storage a defer captured #438 defer freeze shapes with HYB-E3003 (defer + task ...(move x), defer + ch <- move x, defer on alias + move of origin, and pre-/post-defer alias across rebind/redefine of x).
  • Solves the session-15/2-a2 calibration false-positive: defer f(m); m = fresh; task g(move m) (moving a newly rebound value when no alias of the old m is moved) is ACCEPTED, whereas moving an alias that still points to the deferred storage (alias := m; defer f(m); m = fresh; task g(move alias) or defer f(m); alias := m; m = fresh; task g(move alias)) is REJECTED (HYB-E3003).
  • Also enforces A2 (HYB-E3101) & A3 (HYB-E3102) loan windows across defer to function exit, plus if <init>; <cond> and same-statement consume ordering.

[limitlessprojects]

Thank you for this careful PR, @sonson0910 — the four-hole analysis of Stmt::Defer/Stmt::Expr move handling (A1b/A7 bypass, moves inside defer and call args, non-lexical loan windows) was exactly the right map of issue #98, and it materially shaped the fix line that landed.

Closing as subsumed: every scenario this PR pins is already rejected on current main (verified today at ff56902, cargo test --workspace 1069/0, corpus 78/78, differential FULL 23+55):

#99 scenario	main today
defer audit(m) before task worker(move m)	REJECT E3003 (A1b) — also corpus 56
m2 := m; defer audit(m2) / defer audit(m); m2 := m + move	REJECT E3003 (A1b) — corpus 58
pre/post-defer alias + rebind-to-fresh + move alias	REJECT E3003, and the rebind-to-fresh positive control still ACCEPTs (value-precise freeze, no over-freezing)
defer w.write("late"); w.finish() (A7 consume)	REJECT E3003
defer cleanup(move m); m["after"] = 1	REJECT E3003
m2 := id(move m); task worker(move m2); m["main"] = 2	REJECT E3003
s := &m["a"]; defer bump(s); m["api"] = ... (loan to fn exit)	REJECT E3102 (A3)

What landed instead (your PR heads 5b1ade0/c1751cc are not ancestors of main — the content was re-implemented by successors that compose with the newer collector/seam work):

• pr-421 (exantiv, fixes [soundness] P0: deferred call keeps a live reference, so moving the value into a task races #415/[soundness] P0: rebinding a name clears the freeze on storage a defer captured #438): value-precise deferred-binding freeze, 2defedf449886b83b0bfcf7d87ec2eaeb4db2c07
• pr-395 (yours, fixes [soundness] Shadowing or rebinding a shared/loaned binding and move in non-assignment statements bypass HYB-E3003, HYB-E3004, HYB-E3006, HYB-E3101, and HYB-E3102 #393): mark moves in non-assignment statement expressions + preserve peer sharing across shadows/rebinds, 1ed45d58ec50b0f206415d78879abbb9ce57e29f
• pr-288: defer-operand E2001 wiring, 5317e7026c55a3e337a97cc5d9f6d6446b676bda
• regression pins from hy-check: keep defer arguments live until function exit (fixes #415, #438) #418/fix(hy-check): reject moves of bindings held by live deferred calls (fixes #415) #422 spliced at 1980a40 (corpus 56–60 + defer_live_ref.rs/defer_move_soundness.rs)

Issue #98's report is fully covered by the checks above; the maintainer may close it with this verification. Thanks again — your freeze-window model in this PR is visibly the ancestor of what #421 shipped.