fix(borrow): propagate ref-binding through reborrow indirection (Refs #177)

Pre-fix, `let r2 = r1` and `r2 = r1` (where `r1` is itself a ref-binder
rather than a fresh `&p`) silently skipped recording `r2`'s ref-graph
entry — both `record_ref_binding` and `StmtAssign` resolved the RHS via
`ref_target`, which only matches direct `&place`/`&mut place`.  Without
the binding, the indirection chain `r2 = r1 = &local` slipped past
`returned_borrow`'s lookup in `state.ref_bindings`, so `return r2`
escaped without erroring.  This is the "Reborrow through indirection"
item in the deferred-items comment at lib/borrow.ml:1483.

Fix is three coupled pieces:

  1. `record_ref_binding` delegates to `returned_borrow` (which already
     handled both `&p` and binder lookup for the return-escape path);
     `returned_borrow` is moved above `record_ref_binding` to make the
     dependency satisfiable in OCaml's top-down order.
  2. `StmtAssign` pre_release + post-rebind use `returned_borrow` for
     the same reason.  A self-assignment guard (`r = r`) prevents the
     no-op case from unbinding `r` and leaving it unprotected.
  3. `expire_dead_ref_bindings` gates `end_borrow` on a multi-binder
     liveness check: a borrow whose `b_id` is still referenced by any
     live entry in `still_live` MUST NOT be ended when the first
     binder dies.  Without this gate, sharing the borrow object across
     binders creates a soundness hole — the borrow is ended at the
     first binder's last use, leaving the second binder unprotected
     and the underlying place silently writable.

Four new e2e tests pin the fix:

  - `borrow_reborrow_indir_ok.affine` — `let r2 = r1; *r1; *r2` (Ok).
  - `borrow_reborrow_indir_escape.affine` — `return r2` where
    `r2 = r1 = &local` now correctly errors `BorrowOutlivesOwner`.
  - `borrow_reborrow_indir_nll_alias.affine` — `r1` dies, `r2` alive;
    `x = 5` must error `MoveWhileBorrowed` (multi-binder gate).
  - `borrow_reborrow_indir_assign.affine` — `r2 = r1` rebinds and
    releases `r2`'s old loan; the later `y = 10` succeeds.

327 prior tests + 4 new = 331/331 green.  Slice A/B/C anti-regressions
preserved.  Comment at lib/borrow.ml:1483 left in place — the
indirection item description still applies as historical context for
the merged fix.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: hyperpolymath

lib/borrow.ml

@@ -494,34 +494,13 @@ and expr_to_place (symbols : Symbol.t) (expr : expr) : place option =
     expr_to_place symbols e
   | _ -> None
 
-(** Record a borrow-graph edge for [let <pat> = &p] (or [&mut p]).
-
-    Call *after* the value expression has been checked, so the borrow it
-    created is already on [state.borrows]. Binds the let-bound symbol to
-    that borrow so block-exit validation can detect a reference outliving
-    a block-local owner. CORE-01 / #177. *)
-let record_ref_binding (state : state) (symbols : Symbol.t)
-    (pat : pattern) (value : expr) : unit =
-  match pat with
-  | PatVar id ->
-    begin match ref_target symbols value with
-    | Some target ->
-      begin match
-        List.find_opt (fun b -> places_overlap b.b_place target) state.borrows,
-        lookup_symbol_by_name symbols id.name
-      with
-      | Some b, Some sym ->
-        state.ref_bindings <- (sym.Symbol.sym_id, b) :: state.ref_bindings
-      | _ -> ()
-      end
-    | None -> ()
-    end
-  | _ -> ()
-
-(** The borrow a *returned* expression denotes, if any: either a direct
-    [&place] / [&mut place], or a reference binder [r] (from [let r = &p])
-    looked up in the live borrow-graph. Returning a *value* (incl. [*r]) is
-    not a borrow and yields [None]. CORE-01 pt2 / #177 (return-escape). *)
+(** The borrow a reference-bearing expression denotes, if any: either a
+    direct [&place] / [&mut place], or a reference binder [r] (from
+    [let r = &p]) looked up in the live ref-graph.  Returning a *value*
+    (incl. [*r]) is not a borrow and yields [None].  Originally added
+    for return-escape (CORE-01 pt2 / #177); also the resolver used by
+    [record_ref_binding] and [StmtAssign] to handle reborrow through
+    indirection (CORE-01 pt3 / #177 deferred-items). *)
 let returned_borrow (state : state) (symbols : Symbol.t)
     (e : expr) : borrow option =
   let rec peel = function ExprSpan (x, _) -> peel x | x -> x in
@@ -541,6 +520,29 @@ let returned_borrow (state : state) (symbols : Symbol.t)
         | None -> None)
      | _ -> None)
 
+(** Record a borrow-graph edge for [let <pat> = rhs] where [rhs] is a
+    reference-bearing expression — either a direct [&p] / [&mut p] or
+    another ref-binder.  Indirection (e.g. [let r2 = r1]) propagates
+    [r1]'s bound borrow to [r2], so escape + NLL analyses see [r2]
+    through the same target. CORE-01 / #177 deferred-items.
+
+    Call *after* the value expression has been checked, so the borrow
+    it created (for the direct case) is already on [state.borrows]. *)
+let record_ref_binding (state : state) (symbols : Symbol.t)
+    (pat : pattern) (value : expr) : unit =
+  match pat with
+  | PatVar id ->
+    begin match returned_borrow state symbols value with
+    | Some b ->
+      begin match lookup_symbol_by_name symbols id.name with
+      | Some sym ->
+        state.ref_bindings <- (sym.Symbol.sym_id, b) :: state.ref_bindings
+      | None -> ()
+      end
+    | None -> ()
+    end
+  | _ -> ()
+
 (** Return-escape (CORE-01 pt2 / #177): a [return e] (or fn-tail) whose
     value is a reference rooted at a *callee-owned* binding — a function
     local or a by-value/[own] parameter — dangles once the callee frame is
@@ -1212,7 +1214,14 @@ and check_block (ctx : context) (state : state) (symbols : Symbol.t) (blk : bloc
         (not (is_outer_binding sym)) && last_use_of sym <= stmt_idx
       ) state.ref_bindings
     in
-    List.iter (fun (_sym, b) -> end_borrow state b) dying;
+    (* A borrow shared by multiple binders (via reborrow-through-
+       indirection, #177 deferred-items) must outlive every binder
+       that aliases it.  Only end the borrow if no live binder still
+       references the same [b_id]. *)
+    List.iter (fun (_sym, b) ->
+      if not (List.exists (fun (_s, b') -> b'.b_id = b.b_id) still_live) then
+        end_borrow state b
+    ) dying;
     state.ref_bindings <- still_live
   in
   let* () =
@@ -1317,37 +1326,50 @@ and check_stmt (ctx : context) (state : state) (symbols : Symbol.t) (stmt : stmt
         | None ->
           (* Slice B (CORE-01 pt3 / #177): flow-sensitive escape via
              `outer = &y`.  If LHS is a ref-binder symbol that already
-             holds a borrow and RHS is a fresh `&y`/`&mut y` reference,
-             the assignment *replaces* the held borrow.  We pre-release
+             holds a borrow and RHS resolves to a borrow (a direct
+             `&y`/`&mut y` OR another ref-binder via [returned_borrow]
+             — the indirection path of #177 deferred-items), the
+             assignment *replaces* the held borrow.  We pre-release
              the old held borrow before checking the RHS so the same-
              target reborrow case (`r = &mut x` while `r` already holds
              `&mut x`) does not trip [ConflictingBorrow] on the
              about-to-be-replaced exclusive borrow; we then re-bind the
-             ref-graph entry to the freshly-created borrow.  Mirrors
+             ref-graph entry to the borrow the RHS denotes.  Mirrors
              [record_ref_binding]'s let-graph contract for the
              assignment path so the NLL last-use + return-escape
              analyses see the *current* referent after re-assignment,
-             not the stale original. *)
+             not the stale original.  A self-assignment `r = r` is
+             treated as a no-op: it preserves [r]'s existing binding
+             rather than unbinding-then-failing-to-rebind. *)
           let pre_release =
-            match root_var place, ref_target symbols rhs with
-            | Some binder_sym, Some _
+            match root_var place with
+            | Some binder_sym
               when List.mem_assoc binder_sym state.ref_bindings ->
-              let old_borrow = List.assoc binder_sym state.ref_bindings in
-              end_borrow state old_borrow;
-              state.ref_bindings <-
-                List.filter (fun (s, _) -> s <> binder_sym) state.ref_bindings;
-              Some binder_sym
+              let rhs_is_self =
+                let rec peel = function ExprSpan (x, _) -> peel x | x -> x in
+                match peel rhs with
+                | ExprVar id ->
+                  (match lookup_symbol_by_name symbols id.name with
+                   | Some sym -> sym.Symbol.sym_id = binder_sym
+                   | None -> false)
+                | _ -> false
+              in
+              if rhs_is_self then None
+              else (match returned_borrow state symbols rhs with
+                | Some _ ->
+                  let old_borrow = List.assoc binder_sym state.ref_bindings in
+                  end_borrow state old_borrow;
+                  state.ref_bindings <-
+                    List.filter (fun (s, _) -> s <> binder_sym) state.ref_bindings;
+                  Some binder_sym
+                | None -> None)
             | _ -> None
           in
           let* () = check_expr ctx state symbols rhs in
-          (match pre_release, ref_target symbols rhs with
-           | Some binder_sym, Some new_target ->
-             (match List.find_opt (fun b ->
-                      places_overlap b.b_place new_target) state.borrows with
-              | Some new_b ->
-                state.ref_bindings <-
-                  (binder_sym, new_b) :: state.ref_bindings
-              | None -> ())
+          (match pre_release, returned_borrow state symbols rhs with
+           | Some binder_sym, Some new_b ->
+             state.ref_bindings <-
+               (binder_sym, new_b) :: state.ref_bindings
            | _ -> ());
           Ok ()
         end

test/e2e/fixtures/borrow_reborrow_indir_assign.affine

@@ -0,0 +1,26 @@
+// SPDX-License-Identifier: MPL-2.0
+// Copyright (c) 2026 Jonathan D.A. Jewell
+//
+// CORE-01 pt3 / #177 deferred-items: reborrow through indirection,
+// assignment leg.  Pre-fix, `r2 = r1` (RHS is a ref-binder, not a
+// direct `&y`) did not release `r2`'s prior borrow on `y` nor rebind
+// `r2` to `r1`'s borrow — so the later `y = 10` would be rejected
+// MoveWhileBorrowed because `r2`'s stale borrow on `y` was still
+// live.  Post-fix, `returned_borrow` resolves `r1` to its bound
+// borrow, the pre-release path releases `r2`'s old borrow on `y`,
+// and `r2` is rebound to share `r1`'s borrow on `x`.  `y = 10` then
+// succeeds because nothing borrows `y` anymore.  Expected: Ok.
+
+module BorrowReborrowIndirAssign;
+
+fn read_int(x: Int) -> Int = 0;
+
+fn assign_indir_ok() -> Int {
+  let mut x = 1;
+  let mut y = 2;
+  let r1 = &x;
+  let mut r2 = &y;
+  r2 = r1;
+  y = 10;
+  read_int(*r2) + y
+}

test/e2e/fixtures/borrow_reborrow_indir_escape.affine

@@ -0,0 +1,19 @@
+// SPDX-License-Identifier: MPL-2.0
+// Copyright (c) 2026 Jonathan D.A. Jewell
+//
+// CORE-01 pt3 / #177 deferred-items: reborrow through indirection,
+// return-escape leg.  Pre-fix, `let r2 = r1` did not propagate `r1`'s
+// ref-binding, so `returned_borrow` for `return r2` resolved through
+// `state.ref_bindings` and silently returned `None` — the escape was
+// missed.  Post-fix, `r2` inherits `r1`'s borrow on the function-local
+// `x`, and the return-escape check sees `root_var = x` is
+// block-local and errors.  Expected: BorrowOutlivesOwner.
+
+module BorrowReborrowIndirEscape;
+
+fn esc_via_indir() -> ref Int {
+  let x = 5;
+  let r1 = &x;
+  let r2 = r1;
+  return r2;
+}

test/e2e/fixtures/borrow_reborrow_indir_nll_alias.affine

@@ -0,0 +1,22 @@
+// SPDX-License-Identifier: MPL-2.0
+// Copyright (c) 2026 Jonathan D.A. Jewell
+//
+// CORE-01 pt3 / #177 deferred-items: NLL safety for shared borrows.
+// When `let r2 = r1` propagates `r1`'s binding to `r2`, the
+// underlying borrow on `x` is now aliased by two binders.  When `r1`
+// dies (last use at `let z = *r1`), `expire_dead_ref_bindings` must
+// NOT end the borrow — `r2` is still alive and references the same
+// `b_id`.  Hence `x = 5` (after `r1`'s death) must still be rejected
+// `MoveWhileBorrowed`, protecting the subsequent `*r2` read.
+// Expected: Error MoveWhileBorrowed.
+
+module BorrowReborrowIndirNllAlias;
+
+fn nll_aliased() -> Int {
+  let mut x = 1;
+  let r1 = &x;
+  let r2 = r1;
+  let z = *r1;
+  x = 5;
+  *r2 + z
+}

test/e2e/fixtures/borrow_reborrow_indir_ok.affine

@@ -0,0 +1,19 @@
+// SPDX-License-Identifier: MPL-2.0
+// Copyright (c) 2026 Jonathan D.A. Jewell
+//
+// CORE-01 pt3 / #177 deferred-items: reborrow through indirection.
+// `let r2 = r1` where `r1` is itself a ref-binder must propagate
+// `r1`'s bound borrow to `r2` (rather than leaving `r2` unbound).
+// Both binders share the same borrow on `x`; dereferencing either
+// is sound. Expected: Ok.
+
+module BorrowReborrowIndirOk;
+
+fn read_int(x: Int) -> Int = 0;
+
+fn indir_ok() -> Int {
+  let x = 1;
+  let r1 = &x;
+  let r2 = r1;
+  read_int(*r1) + read_int(*r2)
+}

test/test_e2e.ml

@@ -4415,6 +4415,56 @@ let test_slice_c_body_move_persists () =
                    the catch-arm merge — `read_int(y)` after a moved `y` \
                    was silently accepted"
 
+(* CORE-01 pt3 / #177 deferred-items: reborrow through indirection.
+   `let r2 = r1` (RHS is another ref-binder) must propagate `r1`'s
+   bound borrow to `r2`; symmetrically for the assignment path
+   `r2 = r1`.  Aliased borrows must outlive every binder referencing
+   them — the multi-binder gate in [expire_dead_ref_bindings].
+   Four tests: positive let, negative return-escape, NLL anti-
+   regression for the alias-keeps-alive case, and positive assign. *)
+let test_borrow_reborrow_indir_ok () =
+  match borrow_result (fixture "borrow_reborrow_indir_ok.affine") with
+  | Ok () -> ()
+  | Error e ->
+    Alcotest.fail ("reborrow-indir (let): `let r2 = r1; *r1; *r2` \
+                    spuriously rejected — propagation failed or \
+                    multi-binder gate over-expired: "
+                   ^ Borrow.format_borrow_error e)
+
+let test_borrow_reborrow_indir_escape () =
+  match borrow_result (fixture "borrow_reborrow_indir_escape.affine") with
+  | Error (Borrow.BorrowOutlivesOwner _) -> ()
+  | Error e ->
+    Alcotest.fail ("reborrow-indir return-escape: expected \
+                    BorrowOutlivesOwner on `return r2` where r2 = r1 = \
+                    &local, got: " ^ Borrow.format_borrow_error e)
+  | Ok () ->
+    Alcotest.fail "reborrow-indir regressed: return-escape was silently \
+                   accepted — `let r2 = r1` did not propagate the binding \
+                   so `returned_borrow` missed the escape"
+
+let test_borrow_reborrow_indir_nll_alias () =
+  match borrow_result (fixture "borrow_reborrow_indir_nll_alias.affine") with
+  | Error (Borrow.MoveWhileBorrowed _) -> ()
+  | Error e ->
+    Alcotest.fail ("reborrow-indir NLL aliasing: expected \
+                    MoveWhileBorrowed on `x = 5` after r1 dies (r2 still \
+                    aliases the same borrow), got: "
+                   ^ Borrow.format_borrow_error e)
+  | Ok () ->
+    Alcotest.fail "reborrow-indir multi-binder gate failed: a shared \
+                   borrow was ended when its first binder died, leaving \
+                   the second binder unprotected — `x = 5` slipped through"
+
+let test_borrow_reborrow_indir_assign () =
+  match borrow_result (fixture "borrow_reborrow_indir_assign.affine") with
+  | Ok () -> ()
+  | Error e ->
+    Alcotest.fail ("reborrow-indir (assign): `r2 = r1` did not release \
+                    r2's old borrow on y / did not rebind r2 to r1's \
+                    borrow — `y = 10` spuriously rejected: "
+                   ^ Borrow.format_borrow_error e)
+
 let borrow_tests = [
   Alcotest.test_case "BorrowOutlivesOwner: &local escapes its block"
     `Quick test_borrow_outlives_owner;
@@ -4450,6 +4500,14 @@ let borrow_tests = [
     `Quick test_slice_c_catch_arm_isolation;
   Alcotest.test_case "Slice C anti-regression: body's move persists past try (#177 pt3 Slice C)"
     `Quick test_slice_c_body_move_persists;
+  Alcotest.test_case "reborrow-indir: `let r2 = r1; *r1; *r2` is Ok (#177)"
+    `Quick test_borrow_reborrow_indir_ok;
+  Alcotest.test_case "reborrow-indir: return-escape via r2 = r1 = &local (#177)"
+    `Quick test_borrow_reborrow_indir_escape;
+  Alcotest.test_case "reborrow-indir NLL alias: shared borrow outlives first binder (#177)"
+    `Quick test_borrow_reborrow_indir_nll_alias;
+  Alcotest.test_case "reborrow-indir: `r2 = r1` rebinds + releases r2's old borrow (#177)"
+    `Quick test_borrow_reborrow_indir_assign;
 ]
 
 (* ============================================================================