fix: resolve cross-layer review findings (VM soundness, AOT parity, front-end diagnostics, sandbox, spec)

Cross-cutting fixes from a language/VM/JIT/AOT/self-host review.

reg-VM soundness & crashes:
- scalar_regs elision leak: add permanent scalar_poison_regs so a register
  reused (via local(name)) across a scalar and a heap binding is never treated
  as scalar — a heap binding's DeepCopy can no longer be wrongly elided.
- Map/Set heap-key alias leak: deep_copy_value now rebuilds keys from a
  deep-copied value; reclassify MapKeys/SetToList/SortedMapKeys as AliasReturner.
- Return clones instead of moving, so a mut-scalar-param that is also the return
  source survives for mut-writeback (fixes "read uninitialized register" panic).
- mut-place call args (mut c.count / mut c.items) are restored into their
  field/index after the call, matching AOT &mut place semantics.
- Default-features build: add missing #[cfg(feature = "native-jit")] in tier.rs.

AOT (compiled-backend) parity:
- mut class-field args lower through try_write_at (no read-view clone).
- Correct bitwise-vs-comparison precedence table; parenthesize computed
  index-assignment; drop the broken &Managed<T> ABI for retained value-struct
  read params (value semantics + clone-at-store).

Front-end diagnostics:
- RS0038 for empty/multi-scalar char literals (decode_char_token made total).
- Report malformed arms in match EXPRESSIONS; assignment-check closures nested
  in list/struct literals; lex unknown chars to a distinct Unknown token.

Sandbox: String.repeat/pad_* charge mem_budget before allocating; host_call_budget
disarms native tiering.

Self-host: bound scan_char's escape skip; check.rss recovers past malformed items;
lexer.rss/scan.rss emit the Unknown token for parity.

Spec: fix §A.1 keyword/symbol/token lists, §5A assignment rule, and scope the
exec-spec Map-order claim (cross-backend iteration order is unspecified).

Adds regression tests (elision reuse leak, mut-scalar-param return, mut class-field
writeback, RS0038). Verified: lib/differential/static/runtime/soak/jit_cost_model
green + self-host corpus 556x3.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: olwang

crates/rsscript/src/analyzer/assign.rs

@@ -250,9 +250,21 @@ impl<'a> AssignChecker<'a> {
                     self.expr(&entry.value);
                 }
             }
-            Expr::ObjectLiteral { .. }
-            | Expr::ArrayLiteral { .. }
-            | Expr::Ident(..)
+            // Recurse into literal contents: a closure nested in a struct/list
+            // literal (`let fs = [|x| { total = x }]`) must still have its body
+            // assignment-checked, or it could mutate an immutable outer binding
+            // with no diagnostic.
+            Expr::ObjectLiteral { fields, .. } => {
+                for field in fields {
+                    self.expr(&field.value);
+                }
+            }
+            Expr::ArrayLiteral { items, .. } => {
+                for item in items {
+                    self.expr(item);
+                }
+            }
+            Expr::Ident(..)
             | Expr::Number(..)
             | Expr::String(..)
             | Expr::CharLiteral(..)

crates/rsscript/src/analyzer/syntax_support.rs

@@ -462,8 +462,20 @@ impl Analyzer<'_> {
                 self.check_unsupported_syntax_expr(value);
             }
             Expr::Closure { body, .. } => self.check_unsupported_syntax_block(body),
-            Expr::Match { value, arms, .. } => {
+            Expr::Match {
+                value,
+                arms,
+                malformed_arm_spans,
+                ..
+            } => {
                 self.check_unsupported_syntax_expr(value);
+                for span in malformed_arm_spans {
+                    self.unsupported_syntax(
+                        span.clone(),
+                        "malformed match arm",
+                        "Match arms must use `pattern => statement` or `pattern => { ... }`.",
+                    );
+                }
                 for arm in arms {
                     self.check_unsupported_syntax_block(&arm.body);
                 }

crates/rsscript/src/checks/body/semantics.rs

@@ -379,6 +379,28 @@ pub(super) fn check_integer_literal_range(analyzer: &mut Analyzer<'_>, expr: &Hi
     }
 }
 
+/// A `Char` literal denotes exactly one Unicode scalar. Reject `''` (empty) and
+/// `'ab'` (multi-scalar) at the frontend so they never reach lowering (which
+/// would otherwise silently truncate to the first scalar) or the VM/compiled
+/// backend. Well-formed single-scalar literals are left alone.
+pub(super) fn check_char_literal_scalar(analyzer: &mut Analyzer<'_>, expr: &HirExpr) {
+    let HirExpr::Char { value, span } = expr else {
+        return;
+    };
+    let count = crate::text_util::char_literal_scalar_count(value);
+    if count != 1 {
+        analyzer.diagnostics.push(error_cause_manual_fix(
+            code::CHAR_LITERAL_NOT_SINGLE_SCALAR,
+            format!("character literal must contain exactly one character, found {count}."),
+            span.clone(),
+            "invalid character literal",
+            "A `Char` is a single Unicode scalar value; `''` is empty and `'ab'` holds more than one.",
+            "use_single_char_literal",
+            "Put exactly one character between the single quotes, or use a `String` literal (double quotes) for text.",
+        ));
+    }
+}
+
 pub(super) fn check_bool_condition(analyzer: &mut Analyzer<'_>, expr: &HirExpr, construct: &str) {
     let Some(type_name) = hir_expr_type_name(expr) else {
         return;
@@ -482,6 +504,22 @@ pub(super) fn check_match_pattern_matches_type(
     match pattern {
         MatchPattern::Binding { .. } | MatchPattern::Wildcard(_) => {}
         MatchPattern::Literal { value, span } => {
+            if let MatchLiteral::Char(raw) = value {
+                if crate::text_util::char_literal_scalar_count(raw) != 1 {
+                    analyzer.diagnostics.push(error_cause_manual_fix(
+                        code::CHAR_LITERAL_NOT_SINGLE_SCALAR,
+                        format!(
+                            "character literal must contain exactly one character, found {}.",
+                            crate::text_util::char_literal_scalar_count(raw)
+                        ),
+                        span.clone(),
+                        "invalid character literal",
+                        "A `Char` is a single Unicode scalar value; `''` is empty and `'ab'` holds more than one.",
+                        "use_single_char_literal",
+                        "Put exactly one character between the single quotes.",
+                    ));
+                }
+            }
             let literal_type = match value {
                 MatchLiteral::Int(_) => "Int",
                 MatchLiteral::String(_) => "String",
@@ -1150,6 +1188,7 @@ pub(super) fn check_expr_semantics_with_context(
     live_after: &HashSet<String>,
 ) {
     check_integer_literal_range(analyzer, expr);
+    check_char_literal_scalar(analyzer, expr);
     match expr {
         HirExpr::Call {
             callee,

crates/rsscript/src/diagnostic.rs

@@ -41,6 +41,7 @@ pub mod code {
     pub const LOWER_NAME_CONFLICT: &str = "RS0035";
     pub const MESSAGE_PAYLOAD_NOT_TRANSFERABLE: &str = "RS0036";
     pub const VARIANT_PATTERN_ARITY_MISMATCH: &str = "RS0037";
+    pub const CHAR_LITERAL_NOT_SINGLE_SCALAR: &str = "RS0038";
     pub const FEATURE_VIOLATION: &str = "RS0101";
     pub const UNNAMED_ARGUMENT: &str = "RS0201";
     pub const MISSING_DATA_EFFECT: &str = "RS0202";

crates/rsscript/src/hir/lower.rs

@@ -1390,6 +1390,7 @@ fn lower_hir_expr(
             scrutinee_effect,
             arms,
             span,
+            ..
         } => {
             let value_type = infer_hir_expr_type(hir, value, value_types);
             let lowered_value = lower_hir_expr(hir, function_name, value, value_types);

crates/rsscript/src/lexer.rs

@@ -10,6 +10,11 @@ pub enum TokenKind {
     MultilineString(String),
     Keyword(&'static str),
     Symbol(&'static str),
+    /// A source character outside RSScript's lexical inventory. Kept as a token
+    /// (rather than silently mapped to a valid operator) so the parser surfaces it
+    /// as unsupported syntax instead of, e.g., turning a stray `©` into the `?`
+    /// try operator.
+    Unknown(char),
     Eof,
 }
 
@@ -29,6 +34,7 @@ impl Token {
             | TokenKind::InterpolatedString(value)
             | TokenKind::MultilineString(value) => value.clone(),
             TokenKind::Keyword(value) | TokenKind::Symbol(value) => (*value).to_string(),
+            TokenKind::Unknown(ch) => ch.to_string(),
             TokenKind::Eof => "<eof>".to_string(),
         }
     }
@@ -337,7 +343,8 @@ impl Lexer<'_> {
 
     fn push_one(&mut self) {
         let span = self.span(1);
-        let symbol = match self.bump().unwrap() {
+        let ch = self.bump().unwrap();
+        let symbol = match ch {
             ':' => ":",
             ',' => ",",
             '.' => ".",
@@ -363,7 +370,16 @@ impl Lexer<'_> {
             '!' => "!",
             ';' => ";",
             '#' => "#",
-            _ => "?",
+            // Not in the lexical inventory: keep the character verbatim as an
+            // `Unknown` token so the parser reports it, instead of silently
+            // aliasing it to the `?` try operator.
+            _ => {
+                self.tokens.push(Token {
+                    kind: TokenKind::Unknown(ch),
+                    span,
+                });
+                return;
+            }
         };
         self.tokens.push(Token {
             kind: TokenKind::Symbol(symbol),

crates/rsscript/src/reg_vm/exec.rs

@@ -101,6 +101,11 @@ impl RegVm {
         self.limits.step_budget.is_none()
             && self.limits.cancel.is_none()
             && self.limits.mem_budget.is_none()
+            // Native code runs whole-function without routing intrinsic dispatch
+            // through `charge_host_call`, so an armed `host_call_budget` must also
+            // force the interpreter/tier-0 path — otherwise the host-call cap is
+            // silently unenforced once a function tiers up to native.
+            && self.limits.host_call_budget.is_none()
     }
 
     /// Charge one instruction against the step budget. Always increments the
@@ -767,7 +772,16 @@ impl RegVm {
                 );
             }
             RegInstr::Return { src } => {
-                return Ok(PureStep::Return(self.take_reg(base + *src)));
+                // Clone rather than move the return value out of its register. A
+                // `mut` parameter register can be BOTH the return source and a
+                // `mut_writeback` target (`fn f(i: mut Int) -> Int { return i }`):
+                // moving would clear the register, so the writeback that runs after
+                // the frame pops would read an uninitialized slot (panic) or, worse,
+                // write `Unit` back to the caller. Cloning leaves the register live
+                // for `apply_mut_writeback`; the leftover copy is dropped when the
+                // frame window is reused (see `prepare_frame`). The extra clone is a
+                // scalar/`Rc` bump on the interpreter-tier return path only.
+                return Ok(PureStep::Return(self.reg(base + *src).clone()));
             }
             // Anything else is outside the pure subset; the caller handles it.
             _ => return Ok(PureStep::NotPure),

crates/rsscript/src/reg_vm/intrinsics/string.rs

@@ -114,16 +114,21 @@ impl RegVm {
                 Ok(VmValue::Int(value.len() as i64))
             }
             RegIntrinsic::StringPadLeft => {
-                let value = expect_string_ref(intrinsic_arg(&self.stack, base, args, 0)?)?;
                 let width = expect_int_ref(intrinsic_arg(&self.stack, base, args, 1)?)?;
-                let fill = expect_string_ref(intrinsic_arg(&self.stack, base, args, 2)?)?;
-                Ok(VmValue::string(string_pad(value, width, fill, true)))
+                let value = expect_string_ref(intrinsic_arg(&self.stack, base, args, 0)?)?.to_owned();
+                let fill = expect_string_ref(intrinsic_arg(&self.stack, base, args, 2)?)?.to_owned();
+                // Charge the (size-parameterized) result against `mem_budget` BEFORE
+                // allocating, so `pad_*` cannot allocate an arbitrarily large string
+                // in one step and bypass the memory ceiling.
+                self.account_bytes(value.len().max(width.max(0) as usize))?;
+                Ok(VmValue::string(string_pad(&value, width, &fill, true)))
             }
             RegIntrinsic::StringPadRight => {
-                let value = expect_string_ref(intrinsic_arg(&self.stack, base, args, 0)?)?;
                 let width = expect_int_ref(intrinsic_arg(&self.stack, base, args, 1)?)?;
-                let fill = expect_string_ref(intrinsic_arg(&self.stack, base, args, 2)?)?;
-                Ok(VmValue::string(string_pad(value, width, fill, false)))
+                let value = expect_string_ref(intrinsic_arg(&self.stack, base, args, 0)?)?.to_owned();
+                let fill = expect_string_ref(intrinsic_arg(&self.stack, base, args, 2)?)?.to_owned();
+                self.account_bytes(value.len().max(width.max(0) as usize))?;
+                Ok(VmValue::string(string_pad(&value, width, &fill, false)))
             }
             RegIntrinsic::StringParseFloat => {
                 let value = expect_string_ref(intrinsic_arg(&self.stack, base, args, 0)?)?;
@@ -140,8 +145,12 @@ impl RegVm {
                 })
             }
             RegIntrinsic::StringRepeat => {
-                let value = expect_string_ref(intrinsic_arg(&self.stack, base, args, 0)?)?;
                 let count = nonnegative_count(intrinsic_arg(&self.stack, base, args, 1)?)?;
+                let value = expect_string_ref(intrinsic_arg(&self.stack, base, args, 0)?)?.to_owned();
+                // Charge the projected result against `mem_budget` BEFORE allocating,
+                // so `"x".repeat(2_000_000_000)` trips the memory ceiling instead of
+                // eagerly allocating ~2 GB in a single intrinsic step.
+                self.account_bytes(value.len().saturating_mul(count))?;
                 Ok(VmValue::string(value.repeat(count)))
             }
             RegIntrinsic::StringReplace => {