feat(check): infer lambda return type for structural matching

Phase 7 left a known gap: lambdas synth'd to Dynamic, which the
gradual-consistency rule treats as universally assignable. So
`process(fn(x) "hi")` passed a `fn(int) -> bool` slot silently -
exactly the kind of mistake the static check exists to catch, on
exactly the construct (lambdas to map/filter/process callbacks)
that users hit most.

Close the gap by computing a real TypingFnT for every lambda:

  - Params come from l.Typing.Params (unannotated args are nil-
    typed, which IsAssignableFrom already treats as `any`).
  - Block-form bodies populate a per-fn returnStack: every
    `*rl.Return` walked inside the body appends its synth'd value
    type. The stack discipline (push on lambda/fn entry, pop on
    exit) makes nested fn defs naturally isolated - a return
    inside an inner fn never leaks into the outer lambda's slot.
  - Expression-form bodies put the expression directly in Body
    (verified against the converter - no ExprStmt wrapping).
    Synth it as the implicit return.
  - The collected types union via the existing unionTypesForJoin
    pipeline: flatten, drop bottom, subsume, dedupe. Multi-path
    returns of int and str produce `int|str`, not `int, str`.
  - Empty (no returns) is void. Declared annotation, when
    present, takes precedence over inference - matches how typed
    locals work.

walkFnDef also pushes/pops a return frame, even though hoisted-
fn return inference is deferred to a later commit. The push is
cheap and keeps the lambda case correct when a named fn appears
inside the lambda body. Plumbing the actual consume-and-use side
for hoisted fns needs the Tarjan SCC + placeholder return type
machinery the plan calls for, which is its own piece of work.

Caveats explicitly tested by snapshots:

  - Multi-value `return a, b`: takes Values[0]. Tuple/unpacking
    handling deferred.
  - Recursive lambdas bound to a local: the recursive ref still
    synths to Dynamic since SymbolTypes[f] isn't populated during
    the body walk. Inferred return collapses to Dynamic via any-
    like absorption. Sound but lossy.
  - Declared-vs-inferred mismatch on the lambda's own return
    isn't yet diagnosed at the return-statement site - the
    declared annotation wins and the call passes. The LambdaWith-
    DeclaredReturnHonored snapshot pins this behavior and flags
    the follow-on.

The lambda frame stays inherited from the enclosing scope (not
reset like walkFnDef does), preserving the closure narrowing
behavior the snapshot LambdaInheritsEnclosingNarrowing pinned in
Phase 4. The reassignment-after-definition closure check is
still deferred.

Five new snapshot cases in fn_value/structural_match.snap exercise
the matrix: expression-form wrong return, expression-form right
shape, block-form multi-path union, block-form no-return-is-void,
declared-return-honored.

Author: amterp

rts/check/snapshots/fn_value/structural_match.snap

@@ -15,7 +15,7 @@ fn process(callback: fn(int) -> bool):
 process(cb)
 ### STDOUT ###
 # Identifier types
-  x @ 2:12 -> <no-type>
+  x @ 2:12 -> int
   callback @ 5:5 -> fn(int) -> bool
   process @ 7:1 -> fn(fn(int) -> bool)
   cb @ 7:9 -> fn(int) -> bool
@@ -71,7 +71,7 @@ fn process(callback: fn(int) -> bool):
 process(cb)
 ### STDOUT ###
 # Identifier types
-  x @ 2:12 -> <no-type>
+  x @ 2:12 -> str
   callback @ 5:5 -> fn(int) -> bool
   process @ 7:1 -> fn(fn(int) -> bool)
   cb @ 7:9 -> fn(str) -> bool
@@ -127,8 +127,8 @@ fn process(callback: fn(int) -> bool):
 process(cb)
 ### STDOUT ###
 # Identifier types
-  x @ 2:12 -> <no-type>
-  y @ 2:16 -> <no-type>
+  x @ 2:12 -> int
+  y @ 2:16 -> int
   callback @ 5:5 -> fn(int) -> bool
   process @ 7:1 -> fn(fn(int) -> bool)
   cb @ 7:9 -> fn(int, int) -> bool
@@ -158,7 +158,7 @@ fn process(callback):
 process(cb)
 ### STDOUT ###
 # Identifier types
-  x @ 2:12 -> <no-type>
+  x @ 2:12 -> str
   callback @ 5:5 -> dynamic
   process @ 7:1 -> fn(any)
   cb @ 7:9 -> fn(str) -> str
@@ -172,13 +172,12 @@ process(cb)
 # Diagnostics
   (none)
 ### TITLE ###
-LambdaPassedSynthsDynamic
+LambdaExprWrongReturnTypeFires
 ### DESCRIPTION ###
-Lambdas still synth to Dynamic today (deriving a TypingFnT from
-the body is deferred). IsAssignableFrom treats Dynamic as gradually
-compatible with any fn type, so the call passes silently. Known
-caveat: a lambda with the wrong shape won't be caught at the
-static layer yet.
+Expression-form lambda `fn(x) "hi"` infers `fn(any) -> str`. The
+expression body IS the return value, so we synth it directly. The
+mismatch with `fn(int) -> bool` fires - this is the first case the
+old "lambda synths to Dynamic" caveat blocked.
 ### INPUT ###
 fn process(callback: fn(int) -> bool):
     callback(5)
@@ -193,5 +192,110 @@ process(fn(x) "hi")
   callback (param): fn(int) -> bool
   process (fn): fn(fn(int) -> bool)
 
+# Diagnostics
+  [hint] RAD30001 @ 4:9 - Argument type 'fn(any) -> str' is not assignable to expected type 'fn(int) -> bool'
+### TITLE ###
+LambdaExprRightShapeOk
+### DESCRIPTION ###
+Lambda whose inferred return matches the expected signature -
+no diagnostic. `fn(x) x > 0` infers `fn(any) -> bool` and slots
+into `fn(int) -> bool` cleanly (contravariant param: any accepts
+int; covariant return: bool matches bool).
+### INPUT ###
+fn process(callback: fn(int) -> bool):
+    callback(5)
+
+process(fn(x) x > 0)
+### STDOUT ###
+# Identifier types
+  callback @ 2:5 -> fn(int) -> bool
+  process @ 4:1 -> fn(fn(int) -> bool)
+  x @ 4:15 -> dynamic
+
+# Symbol types
+  callback (param): fn(int) -> bool
+  process (fn): fn(fn(int) -> bool)
+  x (param): <no-type>
+
+# Diagnostics
+  (none)
+### TITLE ###
+LambdaBlockMultiPathReturnUnioned
+### DESCRIPTION ###
+A block-form lambda with two return paths gets a union return
+type. With no annotation, inference unions the return arms into
+`int|str`, neither of which is bool - the call fires.
+### INPUT ###
+fn process(callback: fn(int) -> bool):
+    callback(5)
+
+process(fn(x):
+    if x > 0:
+        return 1
+    return "hi"
+)
+### STDOUT ###
+# Identifier types
+  callback @ 2:5 -> fn(int) -> bool
+  process @ 4:1 -> fn(fn(int) -> bool)
+  x @ 5:8 -> dynamic
+
+# Symbol types
+  callback (param): fn(int) -> bool
+  process (fn): fn(fn(int) -> bool)
+  x (param): <no-type>
+
+# Diagnostics
+  [hint] RAD30001 @ 4:9 - Argument type 'fn(any) -> int|str' is not assignable to expected type 'fn(int) -> bool'
+### TITLE ###
+LambdaBlockNoReturnIsVoid
+### DESCRIPTION ###
+A lambda with no `return` statement infers `void` as the return.
+That doesn't match `fn(int) -> bool`, so the slot fires.
+### INPUT ###
+fn process(callback: fn(int) -> bool):
+    callback(5)
+
+process(fn(x):
+    print(x)
+)
+### STDOUT ###
+# Identifier types
+  callback @ 2:5 -> fn(int) -> bool
+  process @ 4:1 -> fn(fn(int) -> bool)
+  print @ 5:5 -> dynamic
+  x @ 5:11 -> dynamic
+
+# Symbol types
+  callback (param): fn(int) -> bool
+  process (fn): fn(fn(int) -> bool)
+  x (param): <no-type>
+
+# Diagnostics
+  [hint] RAD30001 @ 4:9 - Argument type 'fn(any) -> void' is not assignable to expected type 'fn(int) -> bool'
+### TITLE ###
+LambdaWithDeclaredReturnHonored
+### DESCRIPTION ###
+When the user writes a return annotation (`-> bool`) we use it
+verbatim instead of inferring. Here the body returns "hi" (str),
+which doesn't match the declared bool - that's the right place
+for the diagnostic to fire (typed-local-style mismatch on the
+return, not at the call site). Today we don't yet enforce the
+body-vs-declared-return check, so the call still passes - this
+snapshot pins the current behavior and marks the gap.
+### INPUT ###
+fn process(callback: fn(int) -> bool):
+    callback(5)
+
+process(fn(x) -> bool: return "hi")
+### STDOUT ###
+# Identifier types
+  callback @ 2:5 -> fn(int) -> bool
+  process @ 4:1 -> fn(fn(int) -> bool)
+
+# Symbol types
+  callback (param): fn(int) -> bool
+  process (fn): fn(fn(int) -> bool)
+
 # Diagnostics
   (none)

rts/check/snapshots/narrow/lambda.snap

@@ -18,7 +18,7 @@ fn f(x: int?):
   x @ 4:17 -> int
 
 # Symbol types
-  cb (local): dynamic
+  cb (local): fn() -> void
   f (fn): fn(int?)
   x (param): int?
   y (local): int
@@ -47,7 +47,7 @@ fn f(x: int?):
 
 # Symbol types
   a (local): int
-  cb (local): dynamic
+  cb (local): fn() -> void
   f (fn): fn(int?)
   x (param): int?
   z (local): int?

rts/check/type_check.go

@@ -99,6 +99,38 @@ type typeChecker struct {
 	resolved *Resolved
 	info     *TypeInfo
 	frame    *Frame
+	// returnStack collects return-statement value types per
+	// enclosing function/lambda scope. Each entry is the running
+	// list of types observed inside one fn body. Lambdas use it to
+	// synth a proper TypingFnT return type instead of falling back
+	// to Dynamic. Pushed on lambda/fn entry, popped on exit. Stack
+	// depth N means we're inside N nested fn bodies; a return at
+	// depth N belongs to the innermost (top) frame, never the
+	// outer ones - matching the runtime where returns target the
+	// nearest enclosing fn.
+	returnStack [][]rl.TypingT
+}
+
+func (tc *typeChecker) pushReturnFrame() {
+	tc.returnStack = append(tc.returnStack, nil)
+}
+
+func (tc *typeChecker) popReturnFrame() []rl.TypingT {
+	n := len(tc.returnStack)
+	out := tc.returnStack[n-1]
+	tc.returnStack = tc.returnStack[:n-1]
+	return out
+}
+
+// recordReturn appends a return-value type to the innermost fn
+// scope's accumulator. A return outside any fn (which is itself a
+// validation error caught elsewhere) is a no-op here.
+func (tc *typeChecker) recordReturn(t rl.TypingT) {
+	n := len(tc.returnStack)
+	if n == 0 {
+		return
+	}
+	tc.returnStack[n-1] = append(tc.returnStack[n-1], t)
 }
 
 func (tc *typeChecker) walkFile(file *rl.SourceFile) {
@@ -132,6 +164,20 @@ func (tc *typeChecker) walkStmt(n rl.Node) {
 		tc.walkWhileLoop(v)
 	case *rl.FnDef:
 		tc.walkFnDef(v)
+	case *rl.Return:
+		// Synth the return value's type and feed it into the
+		// innermost fn scope's return collector. Only the first
+		// value is observed today (multi-value return is unpacked
+		// at the call site; structural matching of the unpacked
+		// shape is deferred). A bare `return` records void so
+		// "no value" paths still join cleanly.
+		var t rl.TypingT
+		if len(v.Values) > 0 {
+			t = tc.synth(v.Values[0])
+		} else {
+			t = rl.NewVoidType()
+		}
+		tc.recordReturn(t)
 	default:
 		// Generic descent. Later sub-commits replace these with
 		// kind-specific handlers (for loops, switch, return, etc.).
@@ -235,7 +281,16 @@ func (tc *typeChecker) walkFnDef(n *rl.FnDef) {
 		}
 	}
 	tc.frame = NewFrame()
+	// Push a return-collector frame so any `return E` inside the
+	// body lands in this fn'\''s slot, not whatever lambda we may
+	// be nested under at the call site. We don'\''t consume the
+	// collected types here yet - hoisted-fn return inference is a
+	// separate commit gated on SCC handling for mutual recursion.
+	// Pushing now is the cheap half: it keeps lambdas correct when
+	// a named fn is declared inside them.
+	tc.pushReturnFrame()
 	tc.walkStmts(n.Body)
+	_ = tc.popReturnFrame()
 	tc.frame = saved
 }
 
@@ -2078,33 +2133,85 @@ func (tc *typeChecker) addUnaryOpIssue(span rl.Span, op rl.Operator, operand rl.
 // `xs = []` followed by `xs.append(1)` to `List<int>`, but the safe
 // over-approximation lets every existing program type-check today.
 
-// synthLambda walks the lambda'\''s body so identifier-uses inside it
-// get types recorded. The body executes in a child frame of the
-// enclosing one: captured variables retain whatever narrowing the
-// enclosing frame had at the lambda'\''s definition.
+// synthLambda walks the lambda'\''s body and synthesizes a structural
+// TypingFnT. Params come from the grammar annotation (l.Typing.Params,
+// possibly with nil per-param Type for unannotated args - that maps
+// to `any`). The return type is the headline work here:
+//
+//   - Declared annotation (`fn(x) -> int: ...`): use it verbatim.
+//   - Block-form lambda: union the types of every `return E` we
+//     encountered while walking the body. Bare `return` contributes
+//     void. Empty (no returns at all) is void.
+//   - Expression-form lambda: the body is a single ExprStmt and the
+//     expression IS the return value, so we synth it directly and
+//     skip the walk-and-collect dance.
 //
-// Pyright'\''s closure rule says we should only preserve narrowing on
-// captured paths that aren'\''t reassigned later in the enclosing
-// scope (otherwise the lambda might run after the reassignment
-// invalidates the narrowing). We don'\''t implement that lookahead
-// yet: the conservative-but-permissive answer is to forward the
-// enclosing frame. False positives (lambda thinks x is narrowed but
-// x got reassigned before the lambda ran) are possible but rare in
-// practice - users usually invoke lambdas at their definition site
-// or shortly after. When this bites, the right shape is a
-// reassignment-after-definition scan keyed on captured paths.
+// Closure rule deferred: same caveat as walkFnDef. Captured-path
+// narrowings from the enclosing frame are NOT preserved. For a
+// closure-friendly design we'\''d need Pyright'\''s reassignment-
+// after-definition check. Today, the body opens a fresh frame so
+// outer locals appear unnarrowed (read as their base type).
 //
-// The lambda itself synths to Dynamic for now. A proper TypingFnT
-// would require running the body in synth-mode to derive a return
-// type from `return` statements - deferred to the return-type-
-// inference follow-on.
+// Recursion: anonymous lambdas can'\''t self-reference. A named
+// recursive lambda bound to a local (`f = fn(x) f(x-1)`) would synth
+// the recursive `f` to Dynamic because SymbolTypes[f] isn'\''t set
+// during the walk. Sound but lossy - the inferred return would
+// collapse to Dynamic via any-like subsumption rules. Fixing this
+// needs the Tarjan SCC + placeholder return type machinery the plan
+// already describes for hoisted fns.
 func (tc *typeChecker) synthLambda(n *rl.Lambda) rl.TypingT {
 	enclosing := tc.frame
-	for _, stmt := range n.Body {
-		tc.walkStmt(stmt)
+	// Unlike walkFnDef (which resets to a fresh frame because a fn
+	// can be called from anywhere), lambdas inherit the enclosing
+	// frame'\''s narrowings - that'\''s closure semantics. The
+	// reassignment-after-definition lookahead that would invalidate
+	// stale narrowings is still deferred (see docstring).
+	tc.pushReturnFrame()
+
+	// Expression-form lambdas (`fn(x) x + 1`) put the expression
+	// node directly in Body (verified against the converter output -
+	// it does not wrap in ExprStmt). Each body entry is the value to
+	// return; synth it to feed the inferred return type. Block-form
+	// lambdas walk via walkStmts and rely on the `*rl.Return` case
+	// in walkStmt to populate returnStack.
+	if !n.IsBlock {
+		for _, stmt := range n.Body {
+			if stmt == nil {
+				continue
+			}
+			tc.recordReturn(tc.synth(stmt))
+		}
+	} else {
+		tc.walkStmts(n.Body)
 	}
+
+	collected := tc.popReturnFrame()
 	tc.frame = enclosing
-	return tc.record(n, rl.NewDynamicType())
+
+	// Honor an explicit return annotation; otherwise infer.
+	var returnT rl.TypingT
+	if n.Typing != nil && n.Typing.ReturnT != nil {
+		returnT = *n.Typing.ReturnT
+	} else if len(collected) == 0 {
+		returnT = rl.NewVoidType()
+	} else {
+		returnT = unionTypesForJoin(collected)
+	}
+
+	// Construct a fresh TypingFnT so we don'\''t mutate the parsed
+	// l.Typing (other readers - signature display, hover - rely on
+	// the AST being immutable). Params are shared by value; the
+	// caller never writes through ReturnT, so a fresh pointer is
+	// safe.
+	params := []rl.TypingFnParam(nil)
+	if n.Typing != nil {
+		params = n.Typing.Params
+	}
+	fn := &rl.TypingFnT{
+		Params:  params,
+		ReturnT: &returnT,
+	}
+	return tc.record(n, fn)
 }
 
 func (tc *typeChecker) synthLitList(n *rl.LitList) rl.TypingT {