lua: skip top-level guard when chunk has no top-level return; loadstring sees user globals

plans/lua-on-sx.md

@@ -82,6 +82,7 @@ Each item: implement → tests → tick box → update progress log.
 
 _Newest first. Agent appends on every commit._
 
+- 2026-04-25: lua: scoreboard iteration — `lua-eval-ast` now SKIPS the top-level guard when the parsed chunk has no top-level `return` (recursive AST walk via `lua-has-top-return?` that descends through control-flow but stops at function-body boundaries). Without the guard, top-level user defines leak to the SX top env, and `loadstring`-captured closures can find them. Verified: `function fat(x)...loadstring("return fat(...)")...end; x=fat(5)` works (was undefined). Most PUC-Rio tests still have top-level returns elsewhere, so they still need the guard. Scoreboard unchanged at 1/16 but unblocks future work.
 - 2026-04-25: lua: scoreboard iteration — math fns now error on bad/missing args (was silently returning 0). New `lua-math-num "name" x` validator wraps `abs`/`ceil`/`floor`/`sqrt`/`exp`/`sin`/`cos`/`tan`/`asin`/`acos`/`atan`/`atan2`/`pow`. errors.lua moves past assert #4 (`pcall(math.sin)` now returns false+err as expected).
 - 2026-04-24: lua: scoreboard iteration — **pattern character sets** `[...]` and `[^...]`. New `lua-pat-set-end`/`lua-pat-set-match` helpers handle ranges (`[a-z]`), classes inside sets (`[%d%a]`), negation (`[^abc]`), and `[]...]`/`[^]...]` (literal `]` as first char). Asserts 6→4, but timeouts 3→7 — many tests now reach loop-heavy code. 387/387 green (+3 charset tests).
 - 2026-04-24: lua: scoreboard iteration — `tonumber(s, base)` for bases 2-36. Validates digit ranges per base, supports leading `+`/`-`, trims whitespace. `math.lua` past assert #21. Asserts 8→6, timeouts 3→4. 384/384 green.