Fix lambda default capture missing enclosing cell

The cell-var pre-pass merged a lambda's default expressions into its body
reference set and then filtered by the lambda's own parameter names. A name
referenced inside a default that coincided with a lambda param (e.g.
`lambda x=(lambda: x): x()`) was dropped, so the enclosing variable was never
promoted to a cell — the owner compiled it as a plain local while the nested
closure expected a cell, crashing with "MakeClosure: expected cell reference
on stack".

Defaults are evaluated in the enclosing scope, so a capture inside them must
resolve against the enclosing variable regardless of the lambda's params. Scan
lambda defaults separately and unconditionally, mirroring the FunctionDef
branch; keep param filtering only for body references.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: samuelcolvin

crates/monty/src/prepare.rs

@@ -2685,23 +2685,34 @@ fn collect_cell_vars_from_expr(
     use crate::expressions::Expr;
     match &expr.expr {
         Expr::LambdaRaw { signature, body, .. } => {
-            // This lambda captures variables from our scope
+            // This lambda's *default* expressions are evaluated in OUR scope at
+            // definition time, not inside the lambda — so any name they
+            // reference that is one of our locals is captured by us, regardless
+            // of the lambda's own params. Crucially the default must NOT be
+            // filtered by the lambda's params: in `lambda x=(lambda: x): x()`
+            // the inner lambda captures the enclosing `x`, not the param `x`,
+            // so filtering would drop the required outer cell. Body references
+            // are filtered below; defaults are not.
+            for default in signature.default_exprs() {
+                let mut default_referenced = AHashSet::new();
+                collect_referenced_names_from_expr(default, &mut default_referenced, interner);
+                for name in &default_referenced {
+                    if our_locals.contains(name) {
+                        cell_vars.insert(name.clone());
+                    }
+                }
+            }
+
             // Find what names are referenced in the lambda body
             let mut referenced = AHashSet::new();
             collect_referenced_names_from_expr(body, &mut referenced, interner);
-            // Also collect from default expressions (evaluated in our scope).
-            for default in signature.default_exprs() {
-                collect_referenced_names_from_expr(default, &mut referenced, interner);
-            }
 
             // Extract param names from signature
             let param_names: Vec<StringId> = signature.param_names().collect();
 
-            // Any name that is:
-            // - Referenced by the lambda
-            // - Not a param of the lambda
-            // - In our locals
-            // becomes a cell_var
+            // A body reference becomes a cell_var if it is not one of the
+            // lambda's own params (which the lambda binds itself) and is one of
+            // our locals.
             for name in &referenced {
                 if !param_names.iter().any(|p| interner.get_str(*p) == name) && our_locals.contains(name) {
                     cell_vars.insert(name.clone());

crates/monty/test_cases/closure__transitive.py

@@ -358,3 +358,37 @@ def inner():
 
 
 assert outer_with_global_mid() == 100, 'global in mid routes inner past the outer local'
+
+
+# === Lambda whose default is a capturing lambda ===
+# The default `(lambda: x)` is evaluated in the enclosing scope, so its `x`
+# captures the enclosing `x` — NOT the outer lambda's same-named param. The
+# cell-var pre-pass must therefore scan lambda defaults without filtering by the
+# lambda's own params, else the enclosing cell is missed (the closure build then
+# fails). `y` reads `x` first to pin that the owner stays consistent with the
+# late-promoted cell.
+def lambda_default_capture():
+    x = 10
+    y = x + 1
+    g = lambda x=(lambda: x): x()
+    return y, g()
+
+
+assert lambda_default_capture() == (11, 10), 'lambda default captures enclosing same-named var'
+
+
+# The same capture works two levels up and survives owner mutation after the
+# inner closure is built (a shared cell, not a snapshot).
+def lambda_default_two_level():
+    v = 1
+
+    def mid():
+        g = lambda x=(lambda: v): x
+        return g()
+
+    inner = mid()
+    v = 42  # mutated after the default closure was created
+    return inner()
+
+
+assert lambda_default_two_level() == 42, 'lambda default capture two levels up sees later mutation'