fix(codegen): support nested patterns inside tuple patterns (WASM)

[hyperpolymath]

Item 3a of the batch — the WASM tuple-pattern half of #607.

Bug

The core-Wasm pattern compiler rejected any tuple sub-pattern that wasn't a bare variable/wildcard:

Codegen.UnsupportedFeature "Only variable and wildcard patterns supported in tuple patterns"

That's the gap stdlib/option.affine and result.affine hit (after #138/#604 got them past the constructor-linking gap).

Fix

gen_pattern's PatTuple case now recurses per element: load element i into a temp local, match it against sub-pattern i, and I32And the per-element test bools. This is stack-safe because every gen_pattern result is one-bool-net with net-zero binds (see PatVar/PatLit/PatCon); binds register through the threaded ctx, exactly like constructor-argument patterns. Literals, constructors, and nested tuples now work as tuple sub-patterns.

Verified (under node)

match (a,b) { (0,y)=>y, (x,0)=>x+100, (x,y)=>x+y }
  classify(0,5)=5  ✓   classify(7,0)=107 ✓   classify(3,4)=7 ✓   (correct arm + binding)

• option.affine / result.affine now compile past the tuple-pattern gap (they next hit a separate panic-builtin gap in the Wasm backend — tracked in Codegen follow-ups surfaced by the #138 / standalone-CI work #607, not this PR).
• dune test 461 green; adds a Wasm nested-tuple regression test.

Addresses the tuple-pattern item in #607 (the panic builtin and the mixed-representation match remain).

🤖 Generated with Claude Code

https://claude.ai/code/session_01Lz7pRcec2Z3tVtaAhvB3M8

---

Generated by Claude Code

[github-actions]

🔍 Hypatia Security Scan

Findings: 43 issues detected

Severity	Count
🔴 Critical	2
🟠 High	25
🟡 Medium	16

⚠️ Action Required: Critical security issues found!

View findings

[
  {
    "reason": "Action denoland/setup-deno@v2 needs attention",
    "type": "unpinned_action",
    "file": "publish-jsr.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in scorecard-enforcer.yml",
    "type": "scorecard_publish_with_run_step",
    "file": "scorecard-enforcer.yml",
    "action": "split_scorecard_publish_job",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Issue in instant-sync.yml",
    "type": "secret_action_without_presence_gate",
    "file": "instant-sync.yml",
    "action": "peter-evans/repository-dispatch",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Shell execution -- validate input before passing to shell (1 occurrences, CWE-78)",
    "type": "js_exec_sync",
    "file": "/home/runner/work/affinescript/affinescript/packages/affinescript-cli/mod.js",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "high"
  },
  {
    "reason": "Shell execution -- validate input before passing to shell (2 occurrences, CWE-78)",
    "type": "js_exec_sync",
    "file": "/home/runner/work/affinescript/affinescript/packages/affine-vscode/mod.js",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "high"
  },
  {
    "reason": "Shell execution -- validate input before passing to shell (1 occurrences, CWE-78)",
    "type": "js_exec_sync",
    "file": "/home/runner/work/affinescript/affinescript/affinescript-vite/src/affine-plugin-improved.js",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "high"
  },
  {
    "reason": "expect() in hot path (32 occurrences, CWE-754)",
    "type": "expect_in_hot_path",
    "file": "/home/runner/work/affinescript/affinescript/affinescriptiser/src/codegen/wasm_gen.rs",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "medium"
  },
  {
    "reason": "expect() in hot path (29 occurrences, CWE-754)",
    "type": "expect_in_hot_path",
    "file": "/home/runner/work/affinescript/affinescript/affinescriptiser/src/codegen/affine_gen.rs",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "medium"
  },
  {
    "reason": "unsafe block -- requires SAFETY comment (2 occurrences, CWE-676)",
    "type": "unsafe_block",
    "file": "/home/runner/work/affinescript/affinescript/runtime/src/panic.rs",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "medium"
  },
  {
    "reason": "unsafe block -- requires SAFETY comment (1 occurrences, CWE-676)",
    "type": "unsafe_block",
    "file": "/home/runner/work/affinescript/affinescript/runtime/src/alloc.rs",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "medium"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence