Document rvalue-match divergent return unwind gap and add cgen regression tests.

Add match-arm outer-return drop test, confirm bare C return omits owned unwind on diverging rvalue arms, and note both paths in bug-hotspots.

Author: Cod-e-Codes

.cursor/skills/finding-ion-bugs/references/bug-hotspots.md

@@ -13,7 +13,7 @@ CLI errors use `TypeCheckError` Debug form (`UseAfterMove { ... }`). LSP reforma
 ## Codegen (`src/cgen/`)
 
 - Drop order and `ion_drop_*` for moved fields
-- **Return unwind**: statement `return` uses `scope_emit_return_unwind` in `generate_stmt` (`if`/`while`/`loop`/statement `match`/`unsafe`). Rvalue `match` diverging arms use `emit_match_arm_result_from_stmts`, which emits bare C `return` without unwind; tc only (`test_match_arm_divergent_rvalue.ion`). Open: owned bindings live at a diverging rvalue arm may leak; unconfirmed.
+- **Return unwind**: statement `return` uses `scope_emit_return_unwind` in `generate_stmt` (`if`/`while`/`loop`/statement `match`/`unsafe`). Rvalue `match` diverging arms use `emit_match_arm_result_from_stmts`, which emits bare C `return` without unwind; confirmed by `rvalue_match_divergent_return_omits_owned_unwind` (tc rejects the shape in `test_match_arm_divergent_rvalue.ion`).
 - `Box`, `Vec`, `String` layout vs `runtime/ion_runtime.h`
 - Single-file merge (`merge_modules`) vs `--mode multi` divergences
 - `extern "C"` calls only inside `unsafe` blocks in source; cgen must not strip guards

src/cgen/mod.rs

@@ -3795,8 +3795,10 @@ impl Codegen {
     /// Statement-level `return` goes through `generate_stmt` and `scope_emit_return_unwind`
     /// before `goto epilogue`. This path emits a bare C `return` for diverging arms and does
     /// not run owned-value unwind. Type-check coverage only: `test_match_arm_divergent_rvalue.ion`.
-    /// Open question: if a diverging arm can leave live owned bindings (channel, String, etc.)
-    /// in scope, this may leak; not confirmed and not the statement-return unwind bug.
+    /// Open question resolved for this lowering path: diverging arms emit bare C `return`
+    /// without owned-value unwind (`rvalue_match_divergent_return_omits_owned_unwind`).
+    /// Ion tc rejects mixed diverging/value rvalue arms for user programs
+    /// (`test_match_arm_divergent_rvalue.ion`).
     fn emit_match_arm_result_from_stmts(
         &mut self,
         stmts: &[IRStmt],
@@ -5290,6 +5292,68 @@ fn main() -> int {
         );
     }
 
+    /// Documents a known cgen gap: `emit_match_arm_result_from_stmts` emits bare `return`
+    /// without `scope_emit_return_unwind`. Ion tc rejects this shape for user programs
+    /// (`test_match_arm_divergent_rvalue.ion`); this test lowers the IR anyway.
+    #[test]
+    fn rvalue_match_divergent_return_omits_owned_unwind() {
+        let src = r#"enum E {
+    A(int);
+    B(int);
+}
+
+fn main() -> int {
+    let (tx, rx): (Sender<int>, Receiver<int>) = channel<int>();
+    let mut rx_mut: Receiver<int> = rx;
+    let s: String = "hi";
+    let e: E = E::A(0);
+    let n: int = match e {
+        E::A(_) => {
+            return 1;
+        },
+        E::B(v) => {
+            v;
+        },
+    };
+    return n;
+}"#;
+        let tokens = crate::lexer::Lexer::new(src).tokenize().unwrap();
+        let program = crate::parser::Parser::new(tokens).parse().unwrap();
+        let ir = crate::ir::IRBuilder::build(&program);
+        let mut cg = Codegen::new();
+        let c = cg.generate(&ir, "test.ion");
+        let divergent_arm = c
+            .split("case 0:")
+            .nth(1)
+            .and_then(|tail| tail.split("break;").next())
+            .unwrap_or("");
+        assert!(
+            divergent_arm.contains("return 1;"),
+            "expected bare C return in divergent rvalue arm in:\n{c}"
+        );
+        assert!(
+            !divergent_arm.contains("ion_channel_handle_drop"),
+            "rvalue divergent arm omits channel unwind (known gap) in:\n{c}"
+        );
+        assert!(
+            !divergent_arm.contains("ion_string_free"),
+            "rvalue divergent arm omits String drop (known gap) in:\n{c}"
+        );
+        let after_match_return = c
+            .split("ret_val = n;")
+            .nth(1)
+            .and_then(|tail| tail.split("goto epilogue;").next())
+            .unwrap_or("");
+        assert!(
+            after_match_return.contains("ion_channel_handle_drop(tx.channel)"),
+            "statement return after rvalue match should still unwind in:\n{c}"
+        );
+        assert!(
+            after_match_return.contains("ion_string_free(s)"),
+            "statement return after rvalue match should still drop String in:\n{c}"
+        );
+    }
+
     #[test]
     fn underscore_binding_silenced_once() {
         let src = r#"extern "C" {