Merge PR #3892: hy-check(loans) extend outer A2/A3 loan windows across loops and track move-wrapped aliases (fixes #3891)

Author: Burapa-J. Two leak paths let an outlived loan look dead:
loop-carried loans were compared against a raw stmt index (l.last) that
precedes the loop, so an in-loop conflicting access escaped A2/A3; and
alias extension parsed `q := move p` as non-Ident (Expr::Move) and
returned early, so p's slot-loan window was never extended to q.

loans.rs:
- check_a2_conflict + map-slot conflict find: idx <= effective_loan_last(st, l)
  (loop-extended window) instead of raw l.last
- alias source resolution: unwrap Paren AND Move wrappers in a loop
  before the Ident check (move-wrapped aliases now tracked)
- diagnostic note reports eff_last (the real non-lexical window end)

Verification (merged main, 3-stage battery):
- cargo test --workspace: exit 0, 488 suites, 3126 passed, 0 failed
- addr_of_loan standalone: 8/8 (new loop-carried O8/A2 + move-alias
  fixtures all reject with HYB-E3102/E3101 as specified)
- integration files: 479 on disk (extends existing suite, no new file)
- corpus harness: 135/135 verdict agreement, tripwire not fired
- differential loop FULL: 45/45 accept-side, 90/90 reject-side
- trial merge clean (2 files), no in-merge fixture fixups

CREDIT: @Burapa-J

Author: Z User

compiler/crates/hy-check/src/loans.rs

@@ -423,11 +423,12 @@ impl<'a> Checker<'a> {
     /// borrow-mode loan on the same handle (or an alias / may-share peer).
     fn check_a2_conflict(&mut self, st: &FnState, cr: &CallRef, root: &str, idx: usize) {
         let conflict = st.loans.iter().find(|l| {
+            let eff_last = self.effective_loan_last(st, l);
             matches!(
                 &l.target,
                 LoanTarget::Handle { handle } if a3_paths_conflict(st, handle, root)
             ) && l.created <= idx
-                && idx <= l.last
+                && idx <= eff_last
         });
         let Some(loan) = conflict else { return };
         let msg = format!("mutating call on `{}` while a borrow loan is live", root);
@@ -538,7 +539,11 @@ impl<'a> Checker<'a> {
         val: &Expr,
         idx: usize,
     ) {
-        let Expr::Ident { name: src, .. } = unwrap_parens(val) else {
+        let mut cur = val;
+        while let Expr::Paren { inner: e, .. } | Expr::Move { operand: e, .. } = cur {
+            cur = e;
+        }
+        let Expr::Ident { name: src, .. } = cur else {
             return;
         };
         let alias_last = st.last_use.get(alias_name).copied().unwrap_or(idx).max(idx);
@@ -617,15 +622,17 @@ impl<'a> Checker<'a> {
         what: &str,
     ) {
         let Some(loan) = st.loans.iter().find(|l| {
+            let eff_last = self.effective_loan_last(st, l);
             matches!(&l.target, LoanTarget::MapSlot { binding, path: p, key: k }
                 if owner != Some(binding.as_str())
                     && a3_paths_conflict(st, p, path)
                     && !matches!((k.as_deref(), key), (Some(a), Some(b)) if a != b))
                 && l.created <= idx
-                && idx <= l.last
+                && idx <= eff_last
         }) else {
             return;
         };
+        let eff_last = self.effective_loan_last(st, loan);
         let LoanTarget::MapSlot { binding, .. } = &loan.target else {
             unreachable!("filtered above");
         };
@@ -636,7 +643,7 @@ impl<'a> Checker<'a> {
         let notes = vec![
             format!(
                 "{} ({}:{}) is a unique loan on a slot of `{}`, live from creation to its last use (O8, non-lexical window ending at statement {})",
-                loan.desc, self.path, loan.span.start, path, loan.last
+                loan.desc, self.path, loan.span.start, path, eff_last
             ),
             format!(
                 "the loan lowers to copy-out / store-back, so this access and `{}` would silently overwrite each other — finish using `{}` first, or mutate the slot only through `{}`",

compiler/crates/hy-check/tests/addr_of_loan.rs

@@ -96,3 +96,53 @@ fn addr_of_plain_local_is_not_affected() {
         r.diagnostics
     );
 }
+
+#[test]
+fn loop_carried_o8_slot_alias_a2_handle_loan_and_move_alias_reject() {
+    // 1. O8 slot loan created before a loop and used before a second slot loan / field store inside the loop body.
+    let r_o8_loop = check(
+        "struct node { v int }\n\
+         fn main() {\n\
+             m := map[string]node{\"k\": node{v: 1}}\n\
+             p := &m[\"k\"]\n\
+             for i in 0..2 {\n\
+                 _ = i\n\
+                 p.v = 2\n\
+                 q := &m[\"k\"]\n\
+                 q.v = 3\n\
+             }\n\
+         }\n",
+    );
+    assert_eq!(r_o8_loop.verdict, Verdict::Reject, "got {:?}", r_o8_loop.diagnostics);
+    assert!(codes(&r_o8_loop).iter().any(|c| c == "HYB-E3102"));
+
+    // 2. A2 handle borrow loan created before a loop and read before a mutating handle call inside the loop body.
+    let r_a2_loop = check(
+        "import \"rust/serde_json\"\n\
+         fn main() {\n\
+             doc := serde_json.parse(`{}`)?\n\
+             items := doc.array(\"items\")?\n\
+             for i in 0..2 {\n\
+                 _ = i\n\
+                 fmt.println(items.len())\n\
+                 doc.set(\"k\", 1)?\n\
+             }\n\
+         }\n",
+    );
+    assert_eq!(r_a2_loop.verdict, Verdict::Reject, "got {:?}", r_a2_loop.diagnostics);
+    assert!(codes(&r_a2_loop).iter().any(|c| c == "HYB-E3101"));
+
+    // 3. `q := move p` extends `p`'s slot-loan window to `q`'s last use so an intervening map insert is rejected.
+    let r_move_alias = check(
+        "struct node { v int }\n\
+         fn main() {\n\
+             m := map[string]node{\"k\": node{v: 1}}\n\
+             p := &m[\"k\"]\n\
+             q := move p\n\
+             m[\"x\"] = node{v: 2}\n\
+             q.v = 3\n\
+         }\n",
+    );
+    assert_eq!(r_move_alias.verdict, Verdict::Reject, "got {:?}", r_move_alias.diagnostics);
+    assert!(codes(&r_move_alias).iter().any(|c| c == "HYB-E3102"));
+}