fix(checker): reject provably-uninferable unused Ok/Err/None bindings (RS0034)

A bare `let v = Ok(x)` / `Err(x)` / `None` leaves a type parameter open (the
Result error type, the Result ok type, or the Option value type). The checker
accepted it, the VM ran it, but it failed to lower to valid Rust
(E0282: type annotations needed) — surfacing as a backend RS1101 instead of a
frontend RSScript error, violating the "RSScript owns semantics" contract.

The analyzer is string-based (it leaks literal `E`/`T` placeholders and never
resolves them from usage), so it cannot distinguish the un-lowerable case from a
valid constrained-by-use one — EXCEPT by one sound signal: whether the binding is
ever used. Unused => the placeholder can never be pinned => guaranteed E0282 =>
sound to reject. Used => a later use may pin it (e.g. core-properties'
`let input = Ok(value); match Result.map(input) { Err(e) => <e as String> }`),
so it is left alone. The "not annotated" test is `type_name == value_type_name`
(the HIR sets them equal exactly when the user wrote no annotation).

New RS0034 (+ explanation). Found by the rss-testgen generative differential.
Regression: a fail fixture plus a soundness test asserting it fires on unused
Ok/Err/None and never on Some / annotated / constrained-by-use bindings. The
full suite (1011) stays green — no existing program is newly rejected.

A complete fix (reject only when *no* downstream use pins the param, for used
bindings too) needs real free-type-variable inference, which the string-based
analyzer lacks; that is a tracked follow-up. The remaining used-but-unpinned
cases still fail at the backend with a clean source-mapped RS1101.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: Haofei

TODO.md

@@ -8,141 +8,3 @@ _Every item says **why** — if you can't fill in a why, it doesn't belong here.
 - **Stream / lazy Iter** = the deferred performance path. Blueprint: a lazy iterator is `struct Iter[X] { next: () -> Option<X> }`, combinators wrap the next-closure → lazy fusion, zero intermediates. _Why parked / why noted:_ it's the "Stream for performance" we split off from the eager Pipeline; record the design so it's ready, **with the review-first caveats**: it's mutate-on-read / consume-once (hidden-state hazard), and prefer explicit loops over callback-iteration (even mature lazy-iterator libraries are moving away from it).
 - Keep the `try_` surface **small** (don't generate try_ variants; let pipeline's `FalliblePipeline` cover the common case). _Why:_ error-polymorphism (inferring fallibility from the callback) would collapse the `try_` surface, but RSS pays explicit fallibility with duplication, so the price must stay bounded (Article II).
 - `read` omittable-default decision (§2A.3, recorded); pattern extras (`|`, range, `as`/`@`); **map-pattern via a `get(Self,K)->Option<V>` protocol** (defers protocol-dispatched patterns — much heavier semantics than struct/sum, and the interpreter doesn't need it); shared Iter protocol to collapse ×collections. _Why parked:_ not on the dogfooding critical path; revisit when a real program demands them.
-
-## tinygrad port feedback
-
-These items came from the tinygrad RSScript/modern-c port. They are not abstract
-language wish-list items: each one removes a current source-port workaround or
-manual wrapper.
-
-### Must unblock awkward valid ports
-
-- [ ] **Generated namespace isolation.** Preserve source/module/type/member
-  identity through checking and lowering, then emit globally unique Rust symbols.
-  _Why:_ valid tinygrad names such as `helpers.count`, `device.count`,
-  `helpers.T`, and `tensor.T` currently collide because RSS lowers too many
-  things into one Rust item namespace. The port has to invent names like
-  `helpers_count` and map them back in tooling.
-  _Acceptance:_ two modules can define the same final name; a module-level value,
-  type alias, struct, method, and generated helper with related names cannot
-  collide after Rust lowering; diagnostics report the RSS source symbol, not only
-  the lowered Rust name.
-
-- [ ] **Stable source-qualified symbol identity.** Store and expose a symbol's
-  module path, source qualified name, kind, visibility, and lowered backend name.
-  _Why:_ port tooling should compare `helpers.py::count` to
-  `helpers.rss::count`, not guess from bare names.
-  _Acceptance:_ RSS can emit a checked symbol inventory suitable for portman:
-  `module`, `qualname`, `kind`, `source_span`, `lowered_name`.
-
-- [ ] **Class/static member support.** Model class attributes, associated
-  constants, and static methods directly.
-  _Why:_ tinygrad uses symbols such as `Tensor.train`, `Device.DEFAULT`,
-  `dtypes.float`, `UOp.const`, and `UPat.var` as class/static members. Porting
-  them as free functions or dummy globals loses structure and creates name
-  conflicts.
-  _Acceptance:_ RSS supports declaring and lowering type-associated values and
-  methods without requiring separate global wrappers.
-
-- [ ] **Type aliases and generic aliases without value placeholders.** Add
-  source-visible type alias declarations that do not create value namespace
-  entries unless explicitly requested.
-  _Why:_ Python `TypeVar` and alias-like symbols currently become dummy constants
-  in the port just so coverage tooling can see them.
-  _Acceptance:_ aliases can be generic, can reference imported types, and appear
-  in the symbol inventory as type-level symbols.
-
-- [ ] **Method/property lowering ergonomics.** Provide a simple way to model
-  Python-style getter properties and method-like computed fields.
-  _Why:_ tinygrad has many small property methods where the implementation is
-  simple but the RSS surface needs repetitive wrappers.
-  _Acceptance:_ getter-style members lower predictably, can borrow `self`, and
-  preserve member identity for diagnostics and inventory.
-
-### Reduce manual translation volume
-
-- [ ] **Container operation coverage.** Make common `List`, `Map`, `Set`,
-  `Bytes`, `Buffer`, tuple, and optional operations straightforward and
-  consistently checked.
-  _Why:_ tinygrad code is dense with `len`, `append`, `pop`, indexing, slicing,
-  membership, iteration, and clone/copy patterns. Every missing builtin creates a
-  hand-written helper.
-  _Acceptance:_ supported operations either compile and lower to idiomatic Rust
-  or fail with an error that names the unsupported operation and type.
-
-- [ ] **Clone/copy consistency for builtin value types.** Continue the
-  `List`/`Bytes`/`Buffer` `.clone()` direction and make the checker/lowerer agree
-  exactly on every builtin clone target.
-  _Why:_ the tinygrad port previously hit Rust `E0425` because the checker
-  accepted a builtin clone that lowering emitted as a missing helper.
-  _Acceptance:_ checker-approved builtin clones always lower to valid Rust, and
-  checker-rejected clones state the supported alternatives.
-
-- [ ] **Option/null ergonomics.** Add concise checked forms for option tests,
-  unwrap-with-default, early return on none, and optional field access.
-  _Why:_ tinygrad has many maybe-present values; verbose option plumbing makes
-  direct ports drift away from the source.
-  _Acceptance:_ common option patterns require no custom helpers and preserve
-  ownership/borrow rules clearly.
-
-- [ ] **Pattern matching over variants, options, constants, tuples, and lists.**
-  _Why:_ the UOp/UPat rewrite system is pattern-heavy. Lowering it as nested
-  conditionals would be slow to write and hard to audit.
-  _Acceptance:_ match arms can bind values, match enum/variant tags, constants,
-  tuples, and optional values; exhaustiveness or explicit fallback is checked.
-
-- [ ] **Callable and limited closure support.** Support function values and
-  simple captures well enough for callbacks and rewrite rules.
-  _Why:_ tinygrad uses lambdas/callback-like matchers. Without callable support,
-  the port must manually defunctionalize logic into many structs.
-  _Acceptance:_ RSS can pass named functions and simple closures to higher-order
-  helpers with checked capture ownership.
-
-- [ ] **Default arguments and construction helpers.** Provide a first-class way
-  to express common defaulted constructor/helper parameters.
-  _Why:_ tinygrad APIs use many Python defaults. Manual overload/wrapper sets
-  inflate the port.
-  _Acceptance:_ defaulted parameters lower deterministically and appear in docs
-  or symbol inventory without changing the call ABI unexpectedly.
-
-- [ ] **Tuple and destructuring ergonomics.** Make multiple-return and unpacking
-  patterns concise.
-  _Why:_ tinygrad frequently returns and unpacks grouped values.
-  _Acceptance:_ tuple literals, tuple returns, and local destructuring work with
-  ownership and borrowing tracked normally.
-
-- [ ] **String and bytes utility coverage.** Fill gaps for split/join/search,
-  prefix/suffix checks, formatting, byte conversion, and cheap slicing where
-  supported.
-  _Why:_ device/runtime/autogen and file-path code are string/bytes-heavy.
-  _Acceptance:_ common string/bytes operations compile without local helper
-  shims, or fail with precise unsupported-operation diagnostics.
-
-### Tooling and diagnostics
-
-- [ ] **RSS-to-Rust diagnostic provenance.** Carry source spans and symbol
-  identity into generated Rust and back through compiler errors.
-  _Why:_ when Rust fails, the port currently has to infer which RSS declaration
-  produced the bad item.
-  _Acceptance:_ a Rust backend error reports the RSS file, source span, source
-  symbol, and lowered Rust symbol.
-
-- [ ] **Explicit lowered-name escape hatch.** Add an attribute for rare cases
-  where a declaration needs a pinned backend name.
-  _Why:_ useful during compiler transition and for FFI/autogen boundaries.
-  _Acceptance:_ something like `#[lower_name = "helpers__count"]` is checked for
-  uniqueness and reflected in the symbol inventory.
-
-- [ ] **Generated/internal helper namespace.** Keep compiler-generated helpers
-  separate from user declarations.
-  _Why:_ helper names should never consume source-level names or force a port to
-  avoid otherwise valid identifiers.
-  _Acceptance:_ generated helper names are always compiler-reserved/mangled and
-  never collide with user-visible module/type/member names.
-
-- [ ] **External/FFI declaration ergonomics.** Make copied runtime/autogen and
-  device boundaries easy to declare without large wrapper files.
-  _Why:_ tinygrad runtime/autogen should mostly be copied or bound, not manually
-  reimplemented.
-  _Acceptance:_ external functions/types can be declared compactly, checked, and
-  included in the symbol inventory with provenance.

crates/rsscript/src/checks/body.rs

@@ -53,6 +53,7 @@ pub(crate) fn check(analyzer: &mut Analyzer<'_>) {
             }
             check_resource_pool_bindings(analyzer, body);
             check_local_class_bindings(analyzer, body);
+            check_uninferable_unused_bindings(analyzer, body);
             if let Some(block) = body.block.as_ref() {
                 check_resource_pool_discards(analyzer, block, &mut Vec::new());
                 let bindings: std::collections::HashMap<String, HirBindingKind> = body
@@ -1083,6 +1084,189 @@ fn collect_stmt_uses(statement: &HirStmt, uses: &mut HashSet<String>) {
     }
 }
 
+/// Report `let` bindings whose type cannot be inferred (RS0034).
+///
+/// A bare `Ok(..)`/`Err(..)`/`None` initializer leaves a type parameter open
+/// (`Result`'s error type, `Result`'s ok type, or `Option`'s value type).
+/// RSScript resolves that parameter from how the binding is later *used*; if the
+/// binding is never used, nothing constrains it, the type is genuinely ambiguous,
+/// and the program would not lower to valid Rust (rustc `E0282`). The "never
+/// used" gate is what keeps this sound — a binding used downstream may have its
+/// parameter pinned there (e.g. `let r = Ok(x); ... match Result.map(r) { Err(e)
+/// => use e as String }`), so only the provably-unconstrained (unused) case is
+/// rejected, which never false-positives on constrained-by-use code.
+fn check_uninferable_unused_bindings(
+    analyzer: &mut Analyzer<'_>,
+    body: &crate::hir::HirFunctionBody,
+) {
+    let Some(block) = body.block.as_ref() else {
+        return;
+    };
+    // Every name referenced anywhere in the function, with binding structure
+    // ignored (unlike `collect_block_uses`, which strips locally-bound names to
+    // compute free variables). We need raw references so a binding used only as a
+    // local — `return v`, `f(read v)` — counts as used.
+    let mut uses = HashSet::new();
+    collect_all_referenced_names_block(block, &mut uses);
+    check_uninferable_bindings_in_block(analyzer, block, &uses);
+}
+
+fn collect_all_referenced_names_block(block: &HirBlock, uses: &mut HashSet<String>) {
+    for statement in &block.statements {
+        collect_all_referenced_names_stmt(statement, uses);
+    }
+}
+
+fn collect_all_referenced_names_stmt(statement: &HirStmt, uses: &mut HashSet<String>) {
+    match statement {
+        HirStmt::Let { value, .. } | HirStmt::Return { value, .. } => {
+            if let Some(value) = value {
+                collect_expr_uses(value, uses);
+            }
+        }
+        HirStmt::With { resource, body, .. } => {
+            collect_expr_uses(resource, uses);
+            collect_all_referenced_names_block(body, uses);
+        }
+        HirStmt::If {
+            condition,
+            then_body,
+            else_body,
+            ..
+        } => {
+            collect_expr_uses(condition, uses);
+            collect_all_referenced_names_block(then_body, uses);
+            if let Some(else_body) = else_body {
+                collect_all_referenced_names_block(else_body, uses);
+            }
+        }
+        HirStmt::Loop {
+            condition, body, ..
+        } => {
+            if let Some(condition) = condition {
+                collect_expr_uses(condition, uses);
+            }
+            collect_all_referenced_names_block(body, uses);
+        }
+        HirStmt::For { iterable, body, .. } => {
+            collect_expr_uses(iterable, uses);
+            collect_all_referenced_names_block(body, uses);
+        }
+        HirStmt::Match { value, arms, .. } => {
+            collect_expr_uses(value, uses);
+            for arm in arms {
+                if let Some(guard) = &arm.guard {
+                    collect_expr_uses(guard, uses);
+                }
+                collect_all_referenced_names_block(&arm.body, uses);
+            }
+        }
+        HirStmt::Select { arms, .. } => {
+            for arm in arms {
+                collect_expr_uses(&arm.operation, uses);
+                collect_all_referenced_names_block(&arm.body, uses);
+            }
+        }
+        HirStmt::Expr(expr) => collect_expr_uses(expr, uses),
+        HirStmt::Assign { target, value, .. } => {
+            for read in crate::hir::assign_target_reads(target) {
+                collect_expr_uses(read, uses);
+            }
+            collect_expr_uses(value, uses);
+        }
+        HirStmt::Break(_) | HirStmt::Continue(_) | HirStmt::Unknown(_) => {}
+    }
+}
+
+fn check_uninferable_bindings_in_block(
+    analyzer: &mut Analyzer<'_>,
+    block: &HirBlock,
+    uses: &HashSet<String>,
+) {
+    for statement in &block.statements {
+        check_uninferable_bindings_in_stmt(analyzer, statement, uses);
+    }
+}
+
+fn check_uninferable_bindings_in_stmt(
+    analyzer: &mut Analyzer<'_>,
+    statement: &HirStmt,
+    uses: &HashSet<String>,
+) {
+    match statement {
+        // A bare `Ok`/`Err`/`None` with no user annotation (the HIR sets
+        // `type_name == value_type_name` exactly when the user did not annotate —
+        // an annotation would override `type_name` with a placeholder-free type),
+        // bound to a name that is never used, so nothing pins the open parameter.
+        HirStmt::Let {
+            name,
+            value: Some(value),
+            type_name,
+            value_type_name,
+            span,
+            ..
+        } if type_name == value_type_name
+            && !uses.contains(name)
+            && open_variant_constructor(value) =>
+        {
+            analyzer.diagnostics.push(
+                Diagnostic::error(
+                    code::UNINFERABLE_BINDING_TYPE,
+                    format!("the type of `{name}` cannot be inferred."),
+                    span.clone(),
+                    "uninferable binding type",
+                )
+                .with_cause(
+                    "A bare `Ok(...)`, `Err(...)`, or `None` leaves a type parameter open, and this binding is never used, so nothing can constrain it — the type is ambiguous and would not lower to valid Rust.",
+                )
+                .with_fix(
+                    "annotate_binding_type",
+                    "Add a type annotation (e.g. `let v: Result<Int, String> = ...`) or remove the unused binding.",
+                    "manual",
+                ),
+            );
+        }
+        HirStmt::With { body, .. } | HirStmt::Loop { body, .. } | HirStmt::For { body, .. } => {
+            check_uninferable_bindings_in_block(analyzer, body, uses);
+        }
+        HirStmt::If {
+            then_body,
+            else_body,
+            ..
+        } => {
+            check_uninferable_bindings_in_block(analyzer, then_body, uses);
+            if let Some(else_body) = else_body {
+                check_uninferable_bindings_in_block(analyzer, else_body, uses);
+            }
+        }
+        HirStmt::Match { arms, .. } => {
+            for arm in arms {
+                check_uninferable_bindings_in_block(analyzer, &arm.body, uses);
+            }
+        }
+        HirStmt::Select { arms, .. } => {
+            for arm in arms {
+                check_uninferable_bindings_in_block(analyzer, &arm.body, uses);
+            }
+        }
+        _ => {}
+    }
+}
+
+/// Whether `value` is a bare `Ok(..)`/`Err(..)`/`None` constructor — the
+/// constructors that leave a type parameter unconstrained (`Some(x)` is fully
+/// determined by `x`, so it is excluded).
+fn open_variant_constructor(value: &HirExpr) -> bool {
+    match value {
+        HirExpr::Call {
+            callee: Callee::Name(name),
+            ..
+        } => matches!(name.as_str(), "Ok" | "Err" | "None"),
+        HirExpr::Ident { name, .. } => name == "None",
+        _ => false,
+    }
+}
+
 fn collect_block_uses(block: &HirBlock, uses: &mut HashSet<String>) {
     let mut block_uses = HashSet::new();
     for statement in block.statements.iter().rev() {

crates/rsscript/src/diagnostic.rs

@@ -37,6 +37,7 @@ pub mod code {
     pub const AWAIT_LIVE_LOCAL: &str = "RS0031";
     pub const PROTOCOL_NOT_SATISFIED: &str = "RS0032";
     pub const INTEGER_LITERAL_OUT_OF_RANGE: &str = "RS0033";
+    pub const UNINFERABLE_BINDING_TYPE: &str = "RS0034";
     pub const FEATURE_VIOLATION: &str = "RS0101";
     pub const UNNAMED_ARGUMENT: &str = "RS0201";
     pub const MISSING_DATA_EFFECT: &str = "RS0202";
@@ -354,6 +355,11 @@ static DIAGNOSTIC_EXPLANATIONS: &[DiagnosticExplanation] = &[
         title: "missing parameter type",
         explanation: "Parameters must have explicit types so call effects, freshness, and resource rules can be checked against a stable signature.",
     },
+    DiagnosticExplanation {
+        code: code::UNINFERABLE_BINDING_TYPE,
+        title: "binding type cannot be inferred",
+        explanation: "A `let` binding whose value is a bare `Ok(...)`, `Err(...)`, or `None` leaves a type parameter open (the `Result` error type, the `Result` ok type, or the `Option` value type). RSScript normally resolves that parameter from how the binding is later used; when the binding is never used, nothing can constrain it, so the type is genuinely ambiguous and the program would not lower to valid Rust. The checker reports this in RSScript — instead of letting it surface as a backend `type annotations needed` error — and the fix is to add a type annotation (e.g. `let v: Result<Int, String> = Ok(value)`) or to remove the unused binding.",
+    },
     DiagnosticExplanation {
         code: code::UNKNOWN_EFFECT,
         title: "unknown effect",