Merge feat/scoped-views: view name = expr scoped borrowed-region form

Second spec-todo roadmap feature, developed in a git worktree and merged once
fully working (full parity sweep + clippy green).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: olwang

crates/rsscript/src/syntax/parser.rs

@@ -1267,8 +1267,19 @@ fn parse_generic_bound(token: &Token) -> Option<GenericBound> {
 }
 
 fn parse_block(tokens: &[Token], open: usize, close: usize) -> Block {
+    Block {
+        statements: collect_statements(tokens, open + 1, close),
+        span: tokens[open].span.clone(),
+    }
+}
+
+/// Collect statements in `[start, close)`. Handles the scoped-view desugar:
+/// `view name = expr` followed by the rest of the block becomes
+/// `with expr as name { <rest> }`, so a borrowed view's scope ends at the
+/// enclosing block (spec §20.2-1) and it reuses every `with`-lease rule
+/// (no escape / no managed capture) without a separate code path.
+fn collect_statements(tokens: &[Token], mut index: usize, close: usize) -> Vec<Stmt> {
     let mut statements = Vec::new();
-    let mut index = open + 1;
     while index < close {
         if tokens[index].symbol("}") {
             break;
@@ -1281,15 +1292,58 @@ fn parse_block(tokens: &[Token], open: usize, close: usize) -> Block {
             continue;
         }
 
+        if is_view_binding(tokens, index, close) {
+            let span = tokens[index].span.clone();
+            let (binding, resource, after) = parse_view_header(tokens, index, close);
+            // The remaining statements of the block are the view's scope.
+            let body = Block {
+                statements: collect_statements(tokens, after, close),
+                span: span.clone(),
+            };
+            statements.push(Stmt::With(WithStmt {
+                resource: resource.unwrap_or_else(|| Expr::Unknown(span.clone())),
+                binding,
+                body,
+                span,
+            }));
+            break;
+        }
+
         let (statement, next) = parse_stmt(tokens, index, close);
         statements.push(statement);
         index = next.max(index + 1);
     }
+    statements
+}
 
-    Block {
-        statements,
-        span: tokens[open].span.clone(),
-    }
+/// `view <ident> = ...` — a scoped-view binding (distinct from `view` used as an
+/// ordinary identifier, which is never followed by `<ident> =`).
+fn is_view_binding(tokens: &[Token], start: usize, limit: usize) -> bool {
+    tokens[start].is_ident_text("view")
+        && tokens
+            .get(start + 1)
+            .and_then(ident_name)
+            .is_some_and(|name| name != "=")
+        && tokens.get(start + 2).is_some_and(|token| token.symbol("="))
+        && start + 2 < limit
+}
+
+/// Parse the `view <name> = <expr>` header, returning the binding name, the
+/// resource expression, and the index just past the statement.
+fn parse_view_header(
+    tokens: &[Token],
+    start: usize,
+    limit: usize,
+) -> (String, Option<Expr>, usize) {
+    let name = tokens
+        .get(start + 1)
+        .and_then(ident_name)
+        .unwrap_or("")
+        .to_string();
+    let end = statement_end(tokens, start, limit);
+    let equals = (start + 2..end).find(|index| tokens[*index].symbol("="));
+    let resource = equals.and_then(|equals| parse_expr(tokens, equals + 1, end));
+    (name, resource, end)
 }
 
 fn parse_stmt(tokens: &[Token], start: usize, limit: usize) -> (Stmt, usize) {
@@ -1488,7 +1542,10 @@ fn parse_let_stmt(tokens: &[Token], start: usize, limit: usize) -> (Stmt, usize)
     // `let (a, b) = expr` destructures a tuple. The element names are recorded on
     // the binding and expanded into a temporary plus per-element `let`s by the
     // tuple desugar.
-    if tokens.get(name_index).is_some_and(|token| token.symbol("(")) {
+    if tokens
+        .get(name_index)
+        .is_some_and(|token| token.symbol("("))
+    {
         return parse_let_tuple_stmt(tokens, start, kind, name_index, limit);
     }
     let parsed_name = tokens.get(name_index).and_then(ident_name);
@@ -2332,7 +2389,11 @@ fn split_match_pattern_guard(tokens: &[Token], start: usize, end: usize) -> Opti
 /// Parse a pattern head name: a bare identifier (`ADD`) or a module-qualified
 /// dotted name (`ops.ADD`, `a.b.Variant`). Returns the joined name and the token
 /// index just past it.
-fn parse_dotted_pattern_name(tokens: &[Token], start: usize, end: usize) -> Option<(String, usize)> {
+fn parse_dotted_pattern_name(
+    tokens: &[Token],
+    start: usize,
+    end: usize,
+) -> Option<(String, usize)> {
     let mut name = ident_name(tokens.get(start)?)?.to_string();
     let mut index = start + 1;
     while index + 1 < end
@@ -2552,14 +2613,11 @@ fn parse_list_pattern(tokens: &[Token], start: usize, end: usize) -> Option<Matc
 /// where `binding` is `None` for an ignored `..` (or `.._`) and `Some(name)`
 /// for `..name`. Returns `None` (the outer option) when the range is an ordinary
 /// element pattern. `..` may tokenise as one `..` token or two `.` tokens.
-fn parse_list_rest_segment(
-    tokens: &[Token],
-    start: usize,
-    end: usize,
-) -> Option<Option<String>> {
+fn parse_list_rest_segment(tokens: &[Token], start: usize, end: usize) -> Option<Option<String>> {
     let dots_end = if tokens.get(start)?.symbol("..") {
         start + 1
-    } else if tokens.get(start)?.symbol(".") && tokens.get(start + 1).is_some_and(|t| t.symbol(".")) {
+    } else if tokens.get(start)?.symbol(".") && tokens.get(start + 1).is_some_and(|t| t.symbol("."))
+    {
         start + 2
     } else {
         return None;

crates/rsscript/tests/fixtures/fail/scoped-view-escape.rss

@@ -0,0 +1,14 @@
+// expect: RS0702
+// A scoped-view binding (`view name = expr`, spec §20.2-1) desugars to a
+// `with`-lease whose scope ends at the enclosing block, so it cannot escape via
+// return — same rule as any `with` resource.
+features: local
+
+fn bad(data: read Bytes) -> BytesView {
+    view v = Bytes.view(value: read data, start: 0, len: 1)
+    return v
+}
+
+fn main() -> Unit {
+    return Unit
+}

crates/rsscript/tests/vm_eval_parity/data.rs

@@ -195,6 +195,34 @@ fn main() -> Unit {
     );
 }
 
+#[test]
+fn parity_scoped_view_binding() {
+    // The `view name = expr` scoped-view form (spec §20.2-1) desugars to a
+    // `with`-lease whose scope ends at the enclosing block. It must run
+    // identically across backends, including a view derived from another view.
+    let source = r#"
+fn main() -> Unit {
+    let text = "hello world"
+    view v = String.view(value: read text, start: 0, len: 5)
+    Log.write(message: read StringView.to_string(value: read v))
+    view w = StringView.slice(value: read v, start: 1, len: 3)
+    Log.write(message: read String.from_int(value: StringView.len(value: read w)))
+    Log.write(message: read StringView.to_string(value: read w))
+    return Unit
+}
+"#;
+    // The `with`-lease lowering binds the view as `let mut`, which rustc flags as
+    // unused_mut for a read-only view (same benign warning as other `with`
+    // resources); tolerate it — the values + stdout match across backends.
+    common::assert_vm_eval_matches_backend_with_distinct_args_allowing_unused_mut_warning(
+        "parity-scoped-view.rss",
+        "rsscript_parity_scoped_view",
+        source,
+        &[],
+        &[],
+    );
+}
+
 #[test]
 fn parity_char_and_string_chars_intrinsics() {
     let source = r#"

docs/RSScript_v0.7_Spec.md

@@ -5351,7 +5351,10 @@ H. Stream<T> and await-for (async sequences)
      or `Stream` combinators that hide allocation.
 
 I. Scoped views and slices (zero-copy borrowed regions)
-   - now in scope: committed roadmap (§20.2).
+   - implemented (§20.2-1): the borrowed-view types (`StringView`/`BytesView`/
+     `BufferView`, lowered to Rust slices) plus the `view name = expr` form, which
+     desugars to a `with`-lease whose scope ends at the enclosing block, inheriting
+     the no-escape / no-retain / no-cross-await / no-managed-graph rules.
    - for high-performance parsing, HTTP buffers, and binary protocols, RSScript
      needs a "borrowed view" that avoids full-copy semantics:
 

docs/spec-todo.md

@@ -20,13 +20,17 @@ model without reversing a review-first tenet. Ordered by readiness/value.
   bindings loaded. Measured: ~54 ms (VM) vs ~14 s (AOT) for the same program.
   Tested: tier-label unit test + `cli_dev_two_tier.rs` end-to-end.
 
-- [ ] **Scoped views / slices** (zero-copy borrowed regions) (§3.2, §20.1-I, §20.2-1)
-  — _large._ Lexically-scoped borrowed views — `with Buffer.view(...) as bytes { … }`
-  and `view bytes = …` — that cannot be retained, escape scope, cross an `await`, or
-  enter managed graphs. No surface lifetimes (the scope block replaces them). High
-  perf value (parsing, buffers, the tinygrad port; pairs with the parked lazy-`Iter`
-  in `TODO.md`). _Touches:_ parser, the escape/retention checks (`checks/local.rs`),
-  lowering, reg-VM. Must hold VM↔compiled parity.
+- [x] **Scoped views / slices** (zero-copy borrowed regions) (§3.2, §20.1-I, §20.2-1)
+  — _done._ The borrowed-view *types* already existed and ran at parity
+  (`String.view`/`StringView`, `Bytes.view`/`BytesView`, `Buffer.view`/`BufferView`,
+  lowered to Rust slices). Added the spec's dedicated **`view name = expr`** form: a
+  parser-level desugar turns `view v = e; <rest>` into `with e as v { <rest> }`, so
+  the view's scope ends at the enclosing block and it inherits every `with`-lease
+  rule — cannot escape (return), be retained, cross `await`, or enter a managed
+  graph — with **no new borrow analysis and zero changes below the parser** (so
+  VM↔compiled parity is automatic). Verified: `parity_scoped_view_binding` (incl. a
+  view-of-a-view) and the `scoped-view-escape.rss` fail fixture (`RS0702`). The
+  `with Buffer.view(...) as v { … }` form also already works.
 
 - [ ] **Capability objects / explicit dynamic dispatch** (§3.2, §20.1-G, §20.2-2) —
   _large._ Review-visible `capability`-bounded dispatch