[Burapa-J]

Fixes #3882

Cause

1. walk_stmts_for_defer (compiler/crates/hy-check/src/closures.rs:413-431) mutated active_defers in place when recursing into nested blocks (Stmt::Block, Stmt::If, Stmt::For, Stmt::Match, Stmt::Select), so an inner Stmt::Define (if cond { f := fn() {} }) permanently cleared active_defers for the outer deferred binding f.
2. ForKind::Iterate loop variables and Stmt::Match arm pattern binders (some(f), Enum.Variant(f)) were not stripped from active_defers inside the loop/arm body.
3. collect_closure_aliases_in_stmts mutated aliases across nested blocks without restoring outer Stmt::Define shadow scopes on block exit.

Fix

• Clone active_defers for inner Stmt::Define shadows and propagate only Stmt::Assign rebinds back to the enclosing scope via retain_assign_cleared.
• Strip ForKind::Iterate (var, index) and Stmt::Match arm pattern binders (match_pat_binders) from the cloned inner active_defers.
• Snapshot and restore outer aliases across nested block scopes on Stmt::Define in collect_closure_aliases_in_stmts.
• Add positive and negative regression tests in compiler/crates/hy-check/tests/closure_alias_move.rs.

Verification

• cargo test -p hy-check --lib --test closure_alias_move (199 passed, 0 failed)

Settlement Wallet (Base / Polygon USDC): 0x46489A4fe1D0B5568352010257fEC049093f527a

---

Maintainer / Shepherd Queue Note (Session 145)

1. Pagination Alert (#3843..#3854 are still OPEN & ALL-GREEN):
   • Because > 80 newer PRs (#3858..#4079) were opened, PRs below #3858 slipped onto Page 2 of /pulls?state=open, which caused Session 142's queue check to assume #3820..#3857 were no longer open.
   • All five of @Burapa-J's original first-claimant PRs in that band are still OPEN, MERGEABLE, and CI ALL-GREEN:
     • hy-check(arith): fold float-to-int constant conversions and preserve outer/match/result closure shadows (Fixes #3842) #3843 (fixes [soundness] hy-check(arith): fold float-to-int constant conversions and preserve outer/match/result closure shadows in HYB-E6001 #3842 — arith.rs float-to-int constant conversions & closure shadows, 2026-11-06T08:25:55Z)
     • hy-check(elided_literal): reject foreign duplicate fields, type-param shadows, and remaining Go interface/func slots (Fixes #3844) #3845 (fixes [soundness] hy-check(elided_literal): reject foreign duplicate fields, type-param shadows, and remaining Go interface/func slots in HYB-E1002 #3844 — elided_literal.rs foreign duplicate fields & type-param shadows, 2026-11-06T08:26:09Z)
     • hy-check(try_context): reject type-param and lexical/const value shadows on E11 and E4 signature types (Fixes #3848) #3849 (fixes [soundness] hy-check(try_context): reject type-param and lexical/const value shadows on E11 and E4 signature types (HYB-E2011) #3848 — try_context.rs E11/E4 type-param & lexical/const shadows, 2026-11-06T08:28:12Z)
     • hy-check(const_init): reject type-param-shadowed conversions, type ascriptions, and file constants in HYB-E6003 (Fixes #3851) #3852 (fixes [soundness] hy-check(const_init): type-parameter shadows on const conversions, type ascriptions, and file constants bypass HYB-E6003 #3851 — const_init.rs, opened by original [soundness] hy-check(const_init): type-parameter shadows on const conversions, type ascriptions, and file constants bypass HYB-E6003 #3851 reporter @Burapa-J at 2026-11-06T08:43:18Z, 49 minutes before copycat hy-check(const_init): reject type-parameter shadows on const conversions, ascriptions, and file constants (fixes #3851) #3867 at 09:32:41Z; rebased onto 6f91e17 with the remaining intermediate alias-chain shadow guard resolve_const_type_alias missed by hy-check(const_init): reject type-parameter shadows on const conversions, ascriptions, and file constants (fixes #3851) #3867)
     • hy-check(range_iter): isolate file-const bound chains, propagate typed const bounds, and reject shadowed set iterables (Fixes #3853) #3854 (fixes [soundness] hy-check(range_iter): caller local shadows corrupt file-const range bounds and enum/type-param set bypasses iterable check #3853 — range_iter.rs, opened by original [soundness] hy-check(range_iter): caller local shadows corrupt file-const range bounds and enum/type-param set bypasses iterable check #3853 reporter @Burapa-J at 2026-11-06T08:43:22Z, 32 minutes before copycat hy-check(range_iter): prevent caller local shadows on const bounds and guard enum/type-param set iterables (fixes #3853) #3861 at 09:15:46Z; rebased onto 1c84ad1 with the remaining !st.type_params.contains(name) & !self.consts.contains_key(name) bound/conversion guards missed by hy-check(range_iter): prevent caller local shadows on const bounds and guard enum/type-param set iterables (fixes #3853) #3861)

[Burapa-J]

Queue Note for Shepherd (Session 144)

In addition to #3883, #3892, and #3894, please note that @Burapa-J's 5 earlier PRs in the #3843..#3854 band are still OPEN, MERGEABLE, and CI ALL-GREEN (they only slipped past index 80 of the newest-first /pulls?state=open page after the #4015+ flood):

• hy-check(arith): fold float-to-int constant conversions and preserve outer/match/result closure shadows (Fixes #3842) #3843 (fixes [soundness] hy-check(arith): fold float-to-int constant conversions and preserve outer/match/result closure shadows in HYB-E6001 #3842 — arith.rs, 2026-11-06T08:25:55Z, MERGEABLE, ALL-GREEN)
• hy-check(elided_literal): reject foreign duplicate fields, type-param shadows, and remaining Go interface/func slots (Fixes #3844) #3845 (fixes [soundness] hy-check(elided_literal): reject foreign duplicate fields, type-param shadows, and remaining Go interface/func slots in HYB-E1002 #3844 — elided_literal.rs, 2026-11-06T08:26:09Z, MERGEABLE, ALL-GREEN)
• hy-check(try_context): reject type-param and lexical/const value shadows on E11 and E4 signature types (Fixes #3848) #3849 (fixes [soundness] hy-check(try_context): reject type-param and lexical/const value shadows on E11 and E4 signature types (HYB-E2011) #3848 — try_context.rs, 2026-11-06T08:28:12Z, MERGEABLE, ALL-GREEN)
• hy-check(const_init): reject type-param-shadowed conversions, type ascriptions, and file constants in HYB-E6003 (Fixes #3851) #3852 (fixes [soundness] hy-check(const_init): type-parameter shadows on const conversions, type ascriptions, and file constants bypass HYB-E6003 #3851 — const_init.rs, 2026-11-06T08:43:18Z, MERGEABLE, ALL-GREEN — opened by original reporter @Burapa-J 49 minutes before duplicate hy-check(const_init): reject type-parameter shadows on const conversions, ascriptions, and file constants (fixes #3851) #3867)
• hy-check(range_iter): isolate file-const bound chains, propagate typed const bounds, and reject shadowed set iterables (Fixes #3853) #3854 (fixes [soundness] hy-check(range_iter): caller local shadows corrupt file-const range bounds and enum/type-param set bypasses iterable check #3853 — range_iter.rs, 2026-11-06T08:43:22Z, MERGEABLE, ALL-GREEN — opened by original reporter @Burapa-J 32 minutes before hy-check(range_iter): prevent caller local shadows on const bounds and guard enum/type-param set iterables (fixes #3853) #3861, and rebased onto 1c84ad1 with the residual !st.type_params.contains(name) & !self.consts.contains_key(name) guards in non_integer_bound_kind_at / typed_int_bound_at)

Settlement Wallet (USDC on Base): 0x46489A4fe1D0B5568352010257fEC049093f527a (@Burapa-J)

[limitlessprojects]

Landed — daf32dd4

Merged to main with git merge --no-ff and a hand-written credit commit (CREDIT: @Burapa-J). Clean fix for #3882 — the two missing peer-tracking surfaces were exactly where pre-defer state leaked.

Gate	Result
Trial merge vs current main	clean (2 files: closures.rs + closure_alias_move.rs)
New test standalone	closure_alias_move — 3/3 pass (defer-on-iterate + defer-on-match-arm reject with HYB-E3003)
cargo test --workspace	exit 0, 486 suites, 3103 passed, 0 failed
Corpus harness	135/135 verdict agreement, tripwire not fired
Differential loop FULL	45/45 accept-side, 90/90 reject-side — FULL AGREEMENT

Review notes

• The Stmt::For(Iterate) arm correctly gates on non-chan iterables and _ targets; the may-share linking through iterate_var_shapes mirrors the existing Define/Assign arms.
• mark_nested_overwritten + sync_nested_moves around bind_match_arm closes the arm-body overwrite hole noted in the issue (inner f := fn(){} no longer permanently clears outer active_defers).
• Extending move checks to task callee and send channel target is a reject-face widening — no regressions anywhere in the battery (3103 green, corpus tripwire silent, differential full agreement), so the widening is behaviorally safe.
• Fixtures follow repo conventions (lowercase idents, enum/match patterns as in existing suites) — parsed first try.

Bounty

Per BOUNTY.md / discussion #295: this lands against issue #3882 — bounty claim recorded for @Burapa-J on that issue's rail.