ctrlflow-1: break/continue/return legal in expression position (FB-015)

[vpisarev]

What

break, continue and return (with a value or bare) may now appear as the
value of a match arm or if branch — exactly the way throw already does:

val r = [:: for e <- xs { match e { | 0 => continue | x => x } }]   // filter
val keep = if w == "STOP" { break } else { tagged }
fun first_pos(xs: int list): int { for x <- xs { match x { | v when v>0 => return v | _ => {} } }; -1 }
for i <- 0:n { if done(i) { return } else {} }                       // bare return, same-line

All of these previously failed — | _ => continue with a type error, bare
return before }/| with a misleading unexpected token '}'. This is
additive (accepts strictly more programs) and unblocks the imperative-fold
reform, where match e { | A(x) => acc += x | _ => continue } is the natural
fold-body idiom.

Why it was two different bugs

The brief framed both as "parser limitations"; they weren't:

Symptom	Real stage	Fix
jump as arm/branch value	typecheck	Ast.fx get_exp_ctx: ExpBreak/Continue/Return carry pseudo-type TypErr (like ExpThrow) instead of TypVoid — unifies with any sibling without binding it
bare return before } / |	lexer	Lexer.fx: a return whose next significant char is } ) ] , | is bare

throw is the template: it already flows through all four passes as TypErr.
Mirroring that for the three jump nodes is the whole change — ~20 lines of
source, zero backend change.

Zero backend change — verified

break/continue/return/throw already lower uniformly to void/err K-nodes routed
through the block cleanup chain in C_gen_code.fx; tail dispatch is
position-agnostic. Consequences, all checked:

• Bootstrap regen touched only Ast.c + Lexer.c — no other module's C
  changed ⇒ existing programs' K-form is byte-identical.
• -pr-resolve census byte-identical (351 sites) — resolution-neutral.
• Legality unchanged, targeted messages (cannot use 'break' outside of loop, return-type mismatch for bare-return-in-non-void). break/continue
  in @parallel/fold stay rejected in both statement and expression
  position (no widening).

Leak oracle

Ref-counted locals live at the jump must be freed by the cleanup chain.
Machine-checked, not eyeballed:

• Whole suite + a stress with 1000×1000 double locals live at a deep
  return/break/continue — clean under ASAN_OPTIONS=detect_leaks=1 at
  O0 and O3.
• Confirmed at the C level: jump → block label → FX_FREE_ARR(&big) →
  FX_CHECK_*. K-form shows the matrices survive DCE (read into the branch
  condition).

Tests

• test/test_ctrlflow.fx — 10 directed cases: {break, continue, bare return, return value} × {match arm, if branch, both branches jump, nested break→innermost, comprehension/loop body} with ref-counted temps live at the
  jump, values asserted.
• test/negative/216–219 — targeted diagnostics replacing unexpected token '}'.
• Full ladder green: test_all 147, fxtest all (unit + negative + ir + cfold
  • corpus O0/O3), determinism, sanitize, fixpoint.

Ride-along

• FB-018 (separate commit): Array.diag(d) used size(a) before a is
  defined → size(d); locked by matrix.diag_from_vector.
• Doc note: functional style is the compiler's house style (the scan_ resolver
  stays idiomatic recursion — an imperative rewrite would be micro-slower and no
  clearer).

Details: docs/ctrlflow1_report.md.