type lowering (#5466) regressed per-iteration loop captures: every closure returns iteration 0's value (bisected to ce0117a60)

[proggeramlug]

Bisected from the #5917 behavioral matrix (test_edge_closures, and by shared root very likely test_edge_interfaces): the classic per-iteration loop capture returns the FIRST iteration's value from every closure.

Repro (12 lines)

const fns: Array<() => number> = [];
for (let i = 0; i < 5; i++) {
    const captured = i;
    fns.push(() => captured);
}
console.log(fns[0](), fns[1](), fns[2](), fns[3](), fns[4]());

node: 0 1 2 3 4 — perry (main, v0.5.1238): 0 0 0 0 0.

Bisect

git bisect run over v0.5.1150..main with a perry-dev build + the repro (PERRY_NO_AUTO_OPTIMIZE=1): first bad = ce0117a — feat(codegen+runtime): representation-aware type lowering + native-ABI material evidence gate (#5466). Eight good/bad datapoints on each side, deterministic output both ways.

PERRY_TYPED_FEEDBACK=0 does NOT change the result, so it's the static representation lowering rather than feedback-driven specialization.

Mechanism hypothesis (unverified): captured is const-initialized from the typed loop var i (i32 representation). The per-iteration capture materialization appears to snapshot the representation-lowered slot in a way that reuses one cell or re-reads iteration 0's value — all five closures return 0 (not the last value 4, so it is not a shared-mutable-binding bug; it looks like capture-at-creation reading a stale/constant lowered slot).

Also from the same matrix triage (#5917): test_generic_class regressed at the same window with TypeError: (string).getValue is not a function — previously attributed to #5466 by symptom; this bisect strengthens that attribution. test_edge_interfaces (run-exit 1, missing 42/hello/world/{a:1,b:2} block) should be re-checked once this is fixed — likely the same root.

[proggeramlug]

Audit fable-audit-perry-2.md (2026-07-06) surfaced two more confirmed loop-capture shapes in this cluster (with #5869), noting them here rather than filing near-duplicates:

(1) A plain closure that writes its captured loop variable mutates a private copy (split cell). #6054's array-box desugar covers class captures only; a plain closure's mutable capture of a loop-head binding is not boxed, so the write never propagates to the loop control or sibling closures:

const g = [];
for (let j = 0; j < 3; j++) { const w = () => { j += 10; }; const r = () => j; w(); g.push(r()); }
console.log(g.join(","));   // node: 10   perry: 0,1,2

Read-only capture of the loop var is correct (for(let i…) fns.push(()=>i) → 0,1,2 ✓); only the write-through path splits.

(2) Per-iteration let collapse inside async/generator state machines. collect_hoisted_vars (crates/perry-transform/src/generator/break_continue.rs:347-387) hoists every Let into one per-call box (generator/lower.rs:512-525), so loop closures created inside an async/generator loop that captures the loop let all share the final value:

for (const item of items) { cbs.push(() => item); await tick(); }   // all cbs see the last item

Both point at the same root as this issue and #5869: no per-iteration environment for captured lexical loop bindings outside the constant-bound unroller. A general fix (per-iteration re-box / copy-in-copy-out for captured loop-head lexicals) would subsume all three.

[proggeramlug]

Verified fixed on current main: per-iteration loop captures return their own iteration's value. Both for (let i...) fns.push(() => i) → 0,1,2,3,4 and the const captured = i / let k = j*10 shapes match node --experimental-strip-types byte-for-byte. Closing as resolved (the #5466 type-lowering regression bisected to ce0117a no longer reproduces).