fix(frontend): resolve selfhost-ledger items SH-016/017/019/024

Four parity-safe frontend fixes surfaced by the self-hosting stress test
(findings in docs/ledgers/rss-selfhost-ledger.md). No backend/lowering/runtime
changes — the 6-backend parity holds by construction.

- SH-017 (correctness bug): a statement beginning with `||` was misparsed as a
  discarded empty-arg closure, so wrapped boolean chains silently dropped their
  continuation. Now a leading-`||` statement emits RS0015 instead of a silent
  wrong result. (parser/stmt.rs)
- SH-016: `'` had no lexer handling and mapped to `?`, cascading a misleading
  RS0013. Now `'…'` lexes as one token and yields a clear "no character-literal
  syntax" RS0015; the RS0013 cascade is gone. (lexer.rs + Program.char_literal_spans
  + analyzer; mirrored in selfhost/lexer.rss for parity)
- SH-024: positional multi-field variant patterns (`V(a, b)`) emitted a
  misleading per-binding RS0026. Now a single targeted RS0037 points to the named
  form `V { a, b }` (positional records are excluded by spec §20.1). (parser + new
  diagnostic code)
- SH-019 (root cause corrected): a `fresh`-returning builder failed RS0601 only
  after a loop/branch — the flow merge dropped MANAGED fresh bindings, keeping only
  exclusive `local` ones (straight-line always compiled). Fixed by keeping managed
  bindings across the merge. (checks/local.rs merge_flow_states + 3 siblings)

Fixtures: fail/{char-literal-unsupported,leading-operator-continuation,
positional-multifield-variant}.rss, pass/fresh-loop-built-list.rss.
Gated: full suite green (CARGO_EXIT=0), self-host parity 550/550 (lexer/parser/
checker), clippy clean on touched files.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: olwang

crates/rsscript/src/analyzer.rs

@@ -208,6 +208,7 @@ fn analyze_program(
         type_alias_params,
         in_task_group: false,
         async_let_names: Vec::new(),
+        char_literal_spans: HashSet::new(),
     };
     analyzer.run();
     let mut diagnostics = analyzer.diagnostics;
@@ -274,6 +275,7 @@ fn analyze_syntax_program(
         type_alias_params: Default::default(),
         in_task_group: false,
         async_let_names: Vec::new(),
+        char_literal_spans: HashSet::new(),
     };
     analyzer.run_syntax_only();
     let mut diagnostics = analyzer.diagnostics;
@@ -309,6 +311,11 @@ pub(crate) struct Analyzer<'a> {
     pub(crate) type_alias_params: std::collections::BTreeMap<String, Vec<String>>,
     in_task_group: bool,
     pub(crate) async_let_names: Vec<String>,
+    /// Spans of folded `'...'` character-literal tokens. These get one targeted
+    /// "no character-literal syntax" diagnostic; the generic `Expr::Unknown`
+    /// walk skips them so the lone `'` operand does not also emit a duplicate
+    /// RS0015.
+    pub(crate) char_literal_spans: HashSet<crate::diagnostic::Span>,
 }
 
 fn collect_task_group_async_lets(

crates/rsscript/src/analyzer/syntax_support.rs

@@ -2,6 +2,19 @@ use super::*;
 
 impl Analyzer<'_> {
     pub(super) fn check_unsupported_syntax(&mut self) {
+        // A `'...'` character-literal attempt lexes to one `Symbol("'")` token.
+        // Report it once with a clear message and remember its span so the
+        // generic `Expr::Unknown` walk below does not emit a duplicate RS0015 for
+        // the same lone `'` operand.
+        let char_literal_spans = self.syntax_program.char_literal_spans.clone();
+        self.char_literal_spans = char_literal_spans.iter().cloned().collect();
+        for span in char_literal_spans {
+            self.unsupported_syntax(
+                span,
+                "character literal",
+                "RSScript has no character-literal syntax. Use a String literal (\"x\") or compare code points with Char.to_code(...).",
+            );
+        }
         for span in self.syntax_program.unknown_top_level_spans.clone() {
             self.unsupported_syntax(
                 span,
@@ -397,6 +410,7 @@ impl Analyzer<'_> {
                     );
                 }
                 for arm in &stmt.arms {
+                    self.check_positional_multifield_pattern(&arm.pattern);
                     self.check_unsupported_syntax_block(&arm.body);
                 }
             }
@@ -465,6 +479,7 @@ impl Analyzer<'_> {
             Expr::Match { value, arms, .. } => {
                 self.check_unsupported_syntax_expr(value);
                 for arm in arms {
+                    self.check_positional_multifield_pattern(&arm.pattern);
                     self.check_unsupported_syntax_block(&arm.body);
                 }
             }
@@ -488,11 +503,18 @@ impl Analyzer<'_> {
             | Expr::Number(_, _)
             | Expr::String(_, _)
             | Expr::MultilineString(_, _) => {}
-            Expr::Unknown(span) => self.unsupported_syntax(
-                span.clone(),
-                "unsupported expression",
-                "This expression is outside the current RSScript parser surface.",
-            ),
+            Expr::Unknown(span) => {
+                // A lone `'` operand from a character-literal attempt already got
+                // the targeted "character literal" diagnostic; do not also emit
+                // the generic unsupported-expression RS0015 for it.
+                if !self.char_literal_spans.contains(span) {
+                    self.unsupported_syntax(
+                        span.clone(),
+                        "unsupported expression",
+                        "This expression is outside the current RSScript parser surface.",
+                    );
+                }
+            }
         }
     }
 
@@ -586,6 +608,67 @@ impl Analyzer<'_> {
         }
     }
 
+    /// Walk a match pattern and emit RS0037 for any positional multi-field
+    /// variant attempt (`Both(a, b)`), descending through nested patterns so a
+    /// deeper `Some(Both(a, b))` is caught too.
+    pub(super) fn check_positional_multifield_pattern(&mut self, pattern: &MatchPattern) {
+        match pattern {
+            MatchPattern::Variant {
+                name,
+                positional_multifield,
+                span,
+                ..
+            } if !positional_multifield.is_empty() => {
+                self.positional_multifield_variant(span.clone(), name, positional_multifield);
+            }
+            MatchPattern::Variant {
+                binding: Some(binding),
+                ..
+            } => self.check_positional_multifield_pattern(binding),
+            MatchPattern::Struct { fields, .. } => {
+                for field in fields {
+                    if let Some(pattern) = &field.pattern {
+                        self.check_positional_multifield_pattern(pattern);
+                    }
+                }
+            }
+            MatchPattern::List { prefix, suffix, .. } => {
+                for pattern in prefix.iter().chain(suffix) {
+                    self.check_positional_multifield_pattern(pattern);
+                }
+            }
+            MatchPattern::Variant { .. }
+            | MatchPattern::Binding { .. }
+            | MatchPattern::Literal { .. }
+            | MatchPattern::Wildcard(_) => {}
+        }
+    }
+
+    fn positional_multifield_variant(
+        &mut self,
+        span: crate::diagnostic::Span,
+        name: &str,
+        fields: &[String],
+    ) {
+        let named = fields.join(", ");
+        self.diagnostics.push(
+            Diagnostic::error(
+                code::POSITIONAL_MULTIFIELD_VARIANT,
+                format!("positional multi-field variant pattern `{name}(...)`."),
+                span,
+                "positional multi-field variant",
+            )
+            .with_cause(format!(
+                "multi-field variant `{name}` must be matched with named fields: `{name} {{ {named} }}`."
+            ))
+            .with_fix(
+                "use_named_variant_fields",
+                format!("Rewrite the pattern as `{name} {{ {named} }}`."),
+                "manual",
+            ),
+        );
+    }
+
     pub(super) fn unsupported_syntax(
         &mut self,
         span: crate::diagnostic::Span,

crates/rsscript/src/checks/body/semantics.rs

@@ -505,6 +505,7 @@ pub(super) fn check_match_pattern_matches_type(
             name,
             binding,
             span,
+            ..
         } if root == "Option" => {
             if !matches!(name.as_str(), "Some" | "None") {
                 push_match_variant_type_mismatch(
@@ -528,6 +529,7 @@ pub(super) fn check_match_pattern_matches_type(
             name,
             binding,
             span,
+            ..
         } if root == "Result" => {
             if !matches!(name.as_str(), "Ok" | "Err") {
                 push_match_variant_type_mismatch(
@@ -556,6 +558,7 @@ pub(super) fn check_match_pattern_matches_type(
             name,
             binding,
             span,
+            ..
         } => {
             let Some((_, fields)) = pattern_sum_variant_fields(analyzer, root, name) else {
                 let allowed = allowed_sum_variant_names(analyzer, root);

crates/rsscript/src/checks/local.rs

@@ -3121,10 +3121,17 @@ fn merge_flow_states(left: &BodyState, right: &BodyState) -> BodyState {
     }
     moved_paths.retain(|path, _| path_root(path).is_some_and(|root| locals.contains(root)));
 
+    // A fresh binding survives the merge when it is clean in both predecessors
+    // and still tracked as either an exclusive `local` or a managed `let`/`let
+    // mut` binding. Keeping managed bindings (not just exclusive locals) lets a
+    // fresh builder pattern that runs inside a loop/branch still return cleanly.
+    // This stays sound: any aliasing invalidation (manage/retain/take/capture)
+    // already removes the binding from the predecessor `clean_locals`
+    // intersection, so an aliased binding can never reach this filter.
     let clean_locals = left
         .clean_locals
         .intersection(&right.clean_locals)
-        .filter(|name| locals.contains(*name))
+        .filter(|name| locals.contains(*name) || managed.contains(*name))
         .cloned()
         .collect::<HashSet<_>>();
     let fresh_returnable_locals = left
@@ -3666,7 +3673,7 @@ pub(crate) fn merge_loop_state(
     state.clean_locals = base
         .clean_locals
         .intersection(&body_state.clean_locals)
-        .filter(|name| base.locals.contains(*name))
+        .filter(|name| base.locals.contains(*name) || base.managed.contains(*name))
         .cloned()
         .collect();
     state.fresh_returnable_locals = base
@@ -3695,7 +3702,7 @@ fn fallthrough_projection(base: &BodyState, branch: &BodyState) -> BodyState {
     let clean_locals = branch
         .clean_locals
         .intersection(&base.clean_locals)
-        .filter(|name| base.locals.contains(*name))
+        .filter(|name| base.locals.contains(*name) || base.managed.contains(*name))
         .cloned()
         .collect::<HashSet<_>>();
     let fresh_returnable_locals = branch
@@ -3734,7 +3741,7 @@ fn merge_fallthrough_states(base: &BodyState, left: &BodyState, right: &BodyStat
     let clean_locals = left
         .clean_locals
         .intersection(&right.clean_locals)
-        .filter(|name| base.locals.contains(*name))
+        .filter(|name| base.locals.contains(*name) || base.managed.contains(*name))
         .cloned()
         .collect::<HashSet<_>>();
     let fresh_returnable_locals = left

crates/rsscript/src/diagnostic.rs

@@ -40,6 +40,7 @@ pub mod code {
     pub const UNINFERABLE_BINDING_TYPE: &str = "RS0034";
     pub const LOWER_NAME_CONFLICT: &str = "RS0035";
     pub const MESSAGE_PAYLOAD_NOT_TRANSFERABLE: &str = "RS0036";
+    pub const POSITIONAL_MULTIFIELD_VARIANT: &str = "RS0037";
     pub const FEATURE_VIOLATION: &str = "RS0101";
     pub const UNNAMED_ARGUMENT: &str = "RS0201";
     pub const MISSING_DATA_EFFECT: &str = "RS0202";
@@ -550,6 +551,11 @@ static DIAGNOSTIC_EXPLANATIONS: &[DiagnosticExplanation] = &[
         title: "unknown binding",
         explanation: "Value identifiers must resolve to a visible parameter, local binding, with-bound resource, or pattern binding before Rust lowering.",
     },
+    DiagnosticExplanation {
+        code: code::POSITIONAL_MULTIFIELD_VARIANT,
+        title: "positional multi-field variant pattern",
+        explanation: "A sum-type variant with two or more fields must be matched with named fields (`V { a, b }`), not a positional payload (`V(a, b)`). RSScript excludes positional records (spec §20.1): only single-payload positional patterns like `Some(v)` or `Circle(r)` and named field patterns like `V { a, b }` are allowed. The parser keeps the attempted binder names so they still resolve inside the arm — avoiding a misleading per-binding `unknown value binding` (RS0026) — and reports this single targeted diagnostic instead.",
+    },
     DiagnosticExplanation {
         code: code::UNKNOWN_PROTOCOL,
         title: "unknown protocol",

crates/rsscript/src/lexer.rs

@@ -76,6 +76,7 @@ impl Lexer<'_> {
                 '"' => self.lex_string(),
                 ch if ch.is_ascii_digit() => self.lex_number(),
                 ch if is_ident_start(ch) => self.lex_ident_or_keyword(),
+                '\'' => self.lex_char_literal(),
                 '-' if self.peek_next() == Some('>') => self.push_two("->"),
                 '=' if self.peek_next() == Some('>') => self.push_two("=>"),
                 ':' | ',' | '.' | '(' | ')' | '{' | '}' | '<' | '>' | '[' | ']' | '?' | '|'
@@ -280,6 +281,39 @@ impl Lexer<'_> {
         });
     }
 
+    /// RSScript has no character-literal syntax. Without a dedicated lexer arm a
+    /// leading `'` would be mapped to `Symbol("?")` by `push_one`, so `'x'` lexed
+    /// to `? x ?` and the trailing `?` produced a misleading RS0013 (try
+    /// operator) cascade. Instead, consume the whole `'...'` run as a single
+    /// `Symbol("'")` token so the analyzer can surface one clear "no
+    /// character-literal syntax" diagnostic. The scan stops at the closing `'`,
+    /// a newline, or EOF (so an unterminated `'` cannot swallow the rest of the
+    /// line).
+    fn lex_char_literal(&mut self) {
+        let start_line = self.line;
+        let start_column = self.column;
+        let token_start = self.index;
+        self.bump();
+        while let Some(ch) = self.peek() {
+            if ch == '\'' || ch == '\n' {
+                break;
+            }
+            self.bump();
+        }
+        if self.peek() == Some('\'') {
+            self.bump();
+        }
+        self.tokens.push(Token {
+            kind: TokenKind::Symbol("'"),
+            span: Span {
+                file: self.file.to_string(),
+                line: start_line,
+                column: start_column,
+                length: self.index.saturating_sub(token_start).max(1),
+            },
+        });
+    }
+
     fn bump_whitespace(&mut self) {
         while self.peek().is_some_and(char::is_whitespace) {
             self.bump();

crates/rsscript/src/package/native.rs

@@ -318,6 +318,7 @@ pub(super) fn native_binding_interface_sources(
                 profile_spans: Vec::new(),
                 unknown_top_level_spans: Vec::new(),
                 malformed_declaration_spans: Vec::new(),
+                char_literal_spans: Vec::new(),
                 protocols: Vec::new(),
                 protocol_impls: Vec::new(),
                 items: selected_items,

crates/rsscript/src/syntax/ast.rs

@@ -39,6 +39,10 @@ pub struct Program {
     pub profile_spans: Vec<Span>,
     pub unknown_top_level_spans: Vec<Span>,
     pub malformed_declaration_spans: Vec<Span>,
+    /// Spans of `'...'` runs the lexer folded into a single `Symbol("'")` token.
+    /// RSScript has no character-literal syntax; the analyzer drains these into a
+    /// clear diagnostic instead of a misleading try-operator cascade.
+    pub char_literal_spans: Vec<Span>,
     pub protocols: Vec<ProtocolDecl>,
     pub protocol_impls: Vec<ProtocolImpl>,
     pub items: Vec<Item>,
@@ -69,6 +73,7 @@ pub fn merge_programs(programs: impl IntoIterator<Item = Program>) -> Program {
     let mut profile_spans = Vec::new();
     let mut unknown_top_level_spans = Vec::new();
     let mut malformed_declaration_spans = Vec::new();
+    let mut char_literal_spans = Vec::new();
     let mut protocols = Vec::new();
     let mut protocol_impls = Vec::new();
     let mut items = Vec::new();
@@ -97,6 +102,7 @@ pub fn merge_programs(programs: impl IntoIterator<Item = Program>) -> Program {
         duplicate_features.extend(program.duplicate_features);
         unknown_top_level_spans.extend(program.unknown_top_level_spans);
         malformed_declaration_spans.extend(program.malformed_declaration_spans);
+        char_literal_spans.extend(program.char_literal_spans);
         if program.feature_spans.len() > 1 {
             feature_spans.extend(program.feature_spans);
         }
@@ -115,6 +121,7 @@ pub fn merge_programs(programs: impl IntoIterator<Item = Program>) -> Program {
         profile_spans,
         unknown_top_level_spans,
         malformed_declaration_spans,
+        char_literal_spans,
         protocols,
         protocol_impls,
         items,
@@ -522,6 +529,14 @@ pub enum MatchPattern {
     Variant {
         name: String,
         binding: Option<Box<MatchPattern>>,
+        /// Non-empty only for a rejected positional multi-field attempt like
+        /// `Both(a, b)`. Positional records are excluded by spec §20.1 (only
+        /// single-payload positional `Some(v)` and named `V { a, b }` are
+        /// allowed). The parser keeps the attempted binder names here so the
+        /// analyzer can emit a targeted "use named fields" diagnostic and so the
+        /// names still register as arm bindings (suppressing a misleading
+        /// per-binding RS0026). `binding` stays `None` in this case.
+        positional_multifield: Vec<String>,
         span: Span,
     },
     Struct {
@@ -564,6 +579,17 @@ impl MatchPattern {
                 binding: Some(binding),
                 ..
             } => binding.binding_names(),
+            // A rejected positional multi-field variant (`Both(a, b)`) still
+            // exposes its attempted binders so the arm body's uses resolve and do
+            // not trigger a misleading per-binding RS0026 on top of the targeted
+            // diagnostic the analyzer emits.
+            Self::Variant {
+                binding: None,
+                positional_multifield,
+                ..
+            } if !positional_multifield.is_empty() => {
+                positional_multifield.iter().map(String::as_str).collect()
+            }
             Self::Struct { fields, .. } => fields
                 .iter()
                 .flat_map(|field| {

crates/rsscript/src/syntax/parser/mod.rs

@@ -184,6 +184,17 @@ impl Parser<'_> {
             }
         }
 
+        // A `'` token is always an error: the lexer only emits `Symbol("'")` for a
+        // `'...'` character-literal attempt, which RSScript does not support. A
+        // flat scan of the token stream collects every such span for the analyzer
+        // to report with one clear message.
+        let char_literal_spans = self
+            .tokens
+            .iter()
+            .filter(|token| token.symbol("'"))
+            .map(|token| token.span.clone())
+            .collect();
+
         Program {
             feature_scopes: vec![FileFeatureScope {
                 file: self.file.to_string(),
@@ -196,6 +207,7 @@ impl Parser<'_> {
             profile_spans,
             unknown_top_level_spans,
             malformed_declaration_spans,
+            char_literal_spans,
             protocols,
             protocol_impls,
             items,