Flux Borrow Checker (FBC) — Complete Reference

Source file: fbc.py Copyright: 2026 Karac V. Thweatt Role: Static pointer safety analysis for the Flux programming language.

Table of Contents

1. Overview
2. Architecture
3. Getting Started
4. Analysis Passes
5. The Call Graph (CallGraph)
6. The Borrow Checker (BorrowChecker)
7. Allocation Site Tracking
8. Variable Declaration Analysis
9. Assignment Analysis
10. Expression Walking
11. Statement Walking
12. Thread Safety Analysis
13. Heap Leak Analysis
14. Site Resolution
15. Source Line Remapping
16. Companion Modules
17. Helper Functions
18. File Parsing
19. CLI Reference
20. Exit Codes
21. Integrating FBC Programmatically
22. Limitations and Design Notes

1. Overview

The Flux Borrow Checker (fbc.py) is a standalone static analysis tool that performs pointer safety checks on Flux (.fx) source files. It is not part of the compiler's hot path — it is run separately, either by a developer or in CI, to catch memory safety bugs before they reach runtime.

What it checks (by default):

• Pointer aliasing violations — two mutable pointers aliasing the same memory site simultaneously.
• Scope escapes — a pointer to a stack-allocated variable outliving the scope that owns the stack frame.

Optional checks (via flags):

• Thread safety (--threads) — a pointer captured into a spawned thread while also accessible from the spawning scope.
• Heap leaks (--leaks) — an fmalloc allocation that has no matching ffree before the end of the function scope.

What it does NOT check:

• Data races on non-pointer types.

What it needs to work:

• No changes to your source program
• No lifetime annotation
• Simply add --borrowcheck to the command line (blocking)
• Use --borrowcheck-warn for non-blocking checks

2. Architecture

 CLI args
    │
    ▼
collect_fx_files()
    │  one or more .fx paths
    ▼
parse_file()  ──────────────────────────────────────────────────────────┐
    │  FXPreprocessor → FluxLexer → FluxParser → fast.Program           │
    │                                                                   │
    ▼                                                              line_map[]
CallGraph.collect()
    │  walks fast.Program, indexes FunctionDef nodes by mangled name
    ▼
BorrowChecker.run()
    │  starts from entry point (default: FRTStartup)
    │
    ├── _check_function()   ← called recursively via call graph
    │       │
    │       ├── AliasMap.push_scope()      ← scope stack frame
    │       ├── _walk_block() / _walk_stmt() / _walk_expr()
    │       │       │
    │       │       ├── AliasMap.declare_ptr()    ← new pointer variable
    │       │       ├── AliasMap.assign_ptr()     ← pointer reassignment
    │       │       ├── AliasMap.record_malloc()  ← fmalloc site
    │       │       ├── AliasMap.record_free()    ← ffree site
    │       │       └── AliasMap.check_thread_escape() / check_use_after_escape()
    │       │
    │       ├── AliasMap.check_heap_leaks()  (if --leaks)
    │       └── AliasMap.pop_scope()
    │
    └── violations[]  ─── line remapping ──► print_violations() / print_summary()

Core components:

3. Getting Started

Installation requirements

fbc.py must be run from the project root alongside fxc.py. It discovers the compiler modules automatically:

<project_root>/
  fbc.py
  fxc.py
  src/compiler/       ← preferred location
    fparser.py
    flexer.py
    fpreprocess.py
    fmacros.py
    fast.py
    ftypesys.py
  fbc_alias.py        ← required companion
  fbc_report.py       ← required companion

The path search order is src/compiler/, then compiler/, then the project root itself.

Basic usage

python fbc.py <file_or_directory> [options]

Check a single file:

python fbc.py src/main.fx

Check all .fx files in a directory:

python fbc.py src/

Full analysis with all checks:

python fbc.py src/ --threads --leaks

CI mode (JSON output, fail on violation):

python fbc.py src/ --json
echo "Exit: $?"

Treat violations as warnings (never exit 1):

python fbc.py src/ --warn

4. Analysis Passes

The FBC makes a single forward pass through the call graph starting from the entry point. The pass is interprocedural in both reachability and alias identity: argument sites from the caller are propagated into the callee's parameter slots, so alias checking operates on real site identities across call boundaries.

Pass ordering:

1. Parse -- all .fx files are preprocessed and parsed into ASTs.
2. Collect -- the call graph is built by indexing all FunctionDef nodes.
3. Check -- BorrowChecker.run() starts at the entry point and recursively visits every reachable function. Each function may be analysed multiple times if it is called with different argument site combinations (call contexts); it is only re-analysed when a new distinct context is seen.
4. Report -- accumulated violations are line-remapped and printed.

Each function analysis follows this sequence:

1. Push a new scope frame onto AliasMap.
2. Register all pointer parameters: if the caller supplied a resolved site for a parameter, use that site; otherwise fall back to the opaque param:<func>:<name> site.
3. Walk the function body statement by statement.
4. On scope exit, optionally check for heap leaks.
5. Pop the scope frame.
6. Remap merged line numbers to original source locations and collect violations.

Call-context sensitivity -- a call context is a tuple of site strings, one per pointer parameter of the callee in declaration order, derived from the argument expressions at the call site using the caller's current alias state. The callee is re-entered only when a new distinct context tuple is seen. This bounds the analysis: the number of distinct sites is finite and each context tuple is bounded by the callee's pointer-parameter count.

5. The Call Graph (CallGraph)

class CallGraph:
    funcs:       dict[str, FunctionDef]          # mangled name -> FunctionDef
    short_names: dict[str, str]                  # short name -> mangled name (unique only)
    overloads:   dict[str, list]                 # base name -> [mangled names]
    visited_main:   dict[str, set[tuple]]        # func_name -> set of call-context tuples analysed (main context)
    visited_thread: dict[str, set[tuple]]        # func_name -> set of call-context tuples analysed (thread context)

is_visited(name, ctx, thread) returns True if the (name, ctx) pair has already been analysed in the given context. mark_visited(name, ctx, thread) records it. The .visited property returns the set of function names that have been entered in at least one context (for backward compatibility).

CallGraph.collect(program: fast.Program)

Walks the top-level fast.Program and registers every non-prototype FunctionDef. After collection, it builds two auxiliary indexes:

Short name index (short_names) — maps the last segment of a mangled name (after the final __) to the full mangled name, but only when that short name is unambiguous (appears exactly once).

Overload index (overloads) — maps the base name (everything before the first all-digit arity segment in the mangled name) to a list of all mangled variants. For example, a function mangled as main__0__ret_intE1 has base main.

Name mangling scheme

FBC uses the same name mangling as the Flux compiler:

Call resolution

When BorrowChecker encounters a FunctionCall node, it resolves the callee in this order:

1. Exact match in cg.funcs.
2. Short name lookup in cg.short_names (for unambiguous single-match functions).
3. Overload lookup in cg.overloads (all overloads of that base name are checked).

If none resolve (extern, intrinsic, or library call), the call is silently skipped for traversal purposes (no violation is generated for the call itself).

Collected node types

6. The Borrow Checker (BorrowChecker)

class BorrowChecker:
    def __init__(
        self,
        call_graph:    CallGraph,
        entry:         str,
        check_threads: bool = False,
        check_leaks:   bool = False,
        line_map:      list = None,
    ): ...

Public attributes after run():

BorrowChecker.run()

Entry point for analysis. Looks up self.entry in cg.funcs and calls _check_function(). If the entry point is not found (commonly because its body is inside an unresolved #ifdef), it falls back to checking all functions in the call graph.

BorrowChecker._check_function(func, thread_context, call_ctx)

Analyses one function. Guards against re-entry via (func.name, call_ctx) in the appropriate visited table. Steps:

1. Mark (func.name, call_ctx) as visited.
2. Switch AliasMap.func_name to this function's name.
3. Push a new scope frame.
4. Register pointer parameters: if the caller supplied a resolved site at the corresponding positional index in call_ctx, use that site; otherwise use the opaque param:<func>:<name> fallback.
5. Walk the function body with _walk_block().
6. Optionally check heap leaks (unless this function is a recognised allocator wrapper).
7. Pop the scope frame.
8. Remap and collect all violations accumulated in AliasMap.

Allocator wrapper detection (_func_returns_allocation)

A function is considered an allocator wrapper — meaning that fmalloc calls inside it transfer ownership to the caller and do not count as leaks — if:

• Its name is fmalloc or ffree.
• Its body is a single return fmalloc(...) statement (optionally wrapped in a cast).
• Its body is a single return someAllocFunc(...) where the function name contains malloc or alloc.

When a function is identified as an allocator wrapper, alias.heap_sites is simply cleared rather than checked.

7. Allocation Site Tracking

The FBC identifies memory by site strings — stable identifiers for where a particular allocation or variable lives. Sites are the core identity used by AliasMap to detect when two pointers refer to the same memory.

Site formats

8. Variable Declaration Analysis

_on_var_decl(node: fast.VariableDeclaration) handles VarDecl statements.

For every variable, a stack:<func>:<var>@<line> site is registered in the current scope frame's var_sites and owned_sites so that @varName (address-of) expressions can later be resolved to this site.

If the variable is a pointer type (determined by _is_pointer_type(node.type_spec)), the declaration additionally:

1. Calls _resolve_site() on the initial value expression to determine what the pointer points to.
2. Calls AliasMap.declare_ptr() with the resolved target site.

The is_stack_owner flag is always False for pointer declarations — the pointer variable itself is on the stack, but ownership of the pointed-to memory is tracked separately by the site.

The initial value expression is always walked for side effects regardless of whether the variable is a pointer.

9. Assignment Analysis

_on_assign(node: fast.Assignment) handles assignment statements where the target is an Identifier.

1. Walks the right-hand side expression for side effects.
2. Looks up whether the target identifier is a known pointer in the current AliasMap.
3. If it is, resolves the new site from the right-hand side and calls AliasMap.assign_ptr() to update the pointer's tracked site.

Non-identifier assignment targets (e.g. arr[i] = x, obj.field = y) are not tracked for pointer aliasing, though their subexpressions are walked.

The same logic is also applied inside _walk_expr when an Assignment appears as an expression (e.g. inside a for update clause).

10. Expression Walking

_walk_expr(node) traverses an expression tree for side effects. It does not return a value; its job is to:

• Trigger AliasMap.record_malloc() for fmalloc calls (when --leaks is active).
• Trigger AliasMap.record_free() for ffree calls (when --leaks is active).
• Detect thread spawns and mark pointer arguments as thread-escaped (when --threads is active).
• Check uses of identifiers against thread-escaped sites (when --threads is active).
• Recursively walk into the call graph for FunctionCall nodes.
• Recurse into all sub-expressions.

Expression node handling

11. Statement Walking

_walk_stmt(node) dispatches on the AST statement type. The full set of handled statement kinds:

Scope management

Every block construct (if, while, for, switch, try, and explicit { } blocks) pushes a new scope frame via AliasMap.push_scope() and pops it via AliasMap.pop_scope(check_leaks=...) on exit. This ensures that stack-site ownership is correctly attributed to the innermost enclosing scope.

12. Thread Safety Analysis

Enabled with --threads. The thread safety analysis is a heuristic that tracks pointer arguments passed to thread spawn functions.

What counts as a thread spawn

Any FunctionCall or MethodCall whose name (case-insensitive) contains the substring spawn or thread is treated as a thread spawn site. This covers common patterns including thread_create, pthread_create, CreateThread, and any user-defined wrappers.

Internal spawn implementation functions (thread_create, thread_create_stack, pthread_create, CreateThread) are excluded from the escape check — violations are not reported for pointer uses inside these functions.

Escape detection

When a thread spawn is detected:

1. Each argument is unwrapped through casts, AddressOf, and single-argument function calls (via _unwrap_ptr_ident) to find the underlying identifier.
2. AliasMap.check_thread_escape() is called for each resolved name.
3. After the spawn point, any use of the same pointer variable (dereference, array access, assignment target, or bare identifier) triggers AliasMap.check_use_after_escape().

Use-after-escape checking

Anywhere an Identifier is encountered in expression walking (and --threads is active and the current function is not a spawn implementation), _check_ident_escape() is called. This delegates to AliasMap.check_use_after_escape(), which records a violation if the identifier's site was marked as thread-escaped.

13. Heap Leak Analysis

Enabled with --leaks. Tracks fmalloc/ffree pairs within function scope.

fmalloc tracking

When _walk_expr encounters a FunctionCall named fmalloc, it calls:

alias.record_malloc(site, file, line)

where site = "heap:<func>:<line>".

ffree tracking

When _walk_expr encounters a FunctionCall named ffree, _resolve_ffree_arg() is called on the first argument to determine which heap site is being freed. The argument is unwrapped through the following patterns:

After resolution, alias.record_free(freed_site) is called to mark that site as freed.

Leak reporting

At the end of a function, if --leaks is active and the function is not an allocator wrapper, AliasMap.check_heap_leaks() is called. This reports any fmalloc site that has no corresponding ffree site in the current function scope as a heap leak violation.

Allocations that are returned from the function transfer ownership to the caller — the allocator wrapper heuristic prevents false positives for fmalloc-wrapping functions.

14. Site Resolution

_resolve_site(expr, var_name, file, line) -> str determines what allocation site an expression refers to. It is called when a pointer variable is declared or reassigned, to know what the pointer points to.

The resolution rules, in order:

The derived: prefix distinguishes a cast or arithmetic derivative from its original so that two differently-derived pointers to the same base do not spuriously alias each other.

15. Source Line Remapping

Because FXPreprocessor merges all #included files into a single source string before lexing, all AST node line numbers refer to lines in this merged stream — not to lines in the original files.

BorrowChecker._remap(merged_line) -> (filename, original_line) converts a merged line number back to the original file and line using the line_map list produced by the preprocessor:

line_map[merged_line - 1] == (original_filename, original_1based_line)

After _check_function() completes, all violations collected from AliasMap have their .file and .line updated via _remap. Detail strings in the format "... at <unknown>:N" are also remapped — the N after the final colon is extracted, remapped, and substituted back.

If no line_map is available (e.g. when running FBC programmatically without a preprocessor), line numbers are left as-is.

16. Companion Modules

fbc.py depends on two companion modules that must be present alongside it.

fbc_alias.py — Pointer tracking and violation detection

This module contains three classes: PtrInfo, ScopeFrame, and AliasMap, plus the Violation data class. It is the core of the analysis engine; fbc.py delegates all pointer state mutations and violation detection to AliasMap.

PtrInfo

@dataclass
class PtrInfo:
    var_name:    str   # the Flux variable name
    site:        str   # allocation site identity string
    mutable:     bool  # whether this is a mutable view of the site
    scope_depth: int   # depth of the scope frame where this pointer was declared
    func_name:   str   # name of the enclosing function
    file:        str   # source file at declaration
    line:        int   # source line at declaration

One PtrInfo is created for every live pointer variable. The scope_depth is used during pop_scope() to remove dead pointers from surviving frames.

Violation

@dataclass
class Violation:
    kind:    str        # see violation kinds table below
    message: str        # human-readable one-line summary
    file:    str        # source file (remapped from merged line by BorrowChecker)
    line:    int        # source line (remapped)
    detail:  list[str]  # zero or more extra context lines

Violation.format() returns a multi-line string suitable for printing:

[FBC] mutable_alias
  src/main.fx:42  mutable alias violation on site 'heap:foo:17'
  'p' -> heap:foo:17 (mutable) at src/main.fx:42
  'q' -> heap:foo:17 (mutable) at src/main.fx:38

Violation kinds:

ScopeFrame

class ScopeFrame:
    depth:       int              # nesting depth (0 = outermost function scope)
    func_name:   str
    ptrs:        dict[str, PtrInfo]   # var_name → PtrInfo for pointers in this frame
    owned_sites: set[str]             # stack sites created in this scope
    var_sites:   dict[str, str]       # var_name → site for ALL stack vars (for address-of)

ScopeFrame is not used directly by fbc.py — it is internal to AliasMap. Each scope-introducing construct (block, if-branch, loop body, try/catch body) gets its own frame.

Key methods (called only by AliasMap):

• declare_stack_site(var_name, site, line, file) — adds site to owned_sites.
• add_ptr(info) — registers a PtrInfo in ptrs.
• remove_ptr(var_name) — removes a pointer from ptrs.
• all_ptrs() — returns all PtrInfo values as a list.

AliasMap

class AliasMap:
    frames:                list[ScopeFrame]
    violations:            list[Violation]
    func_name:             str                         # current function (set by BorrowChecker)
    file:                  str                         # current file hint
    heap_sites:            dict[str, tuple[str, int]]  # site → (file, line) of fmalloc
    thread_escaped_sites:  dict[str, tuple[str, int]]  # site → (spawn_file, spawn_line)

AliasMap never raises exceptions. All detected problems are appended to violations and the walk continues. BorrowChecker drains violations after each function.

Scope management:

push_scope() appends a new ScopeFrame at the current depth.

pop_scope(check_leaks=False) removes the top frame and then:

1. Calls _check_escape_after_pop() — walks all surviving frames and reports a scope_escape violation for any pointer whose site is in the now-dead frame's owned_sites.
2. Removes from surviving frames any PtrInfo whose scope_depth equals the depth of the frame that just exited (those variables are now out of scope everywhere).

Pointer registration:

declare_ptr(var_name, site, mutable, file, line, is_stack_owner=False)

Registers a new pointer in the current (top) frame. If is_stack_owner=True, also calls frame.declare_stack_site() so the frame knows it owns that stack memory. Immediately calls _check_mutable_alias().

assign_ptr(var_name, site, mutable, file, line)

Updates an existing pointer's site in whichever frame it lives. If the variable is not yet known, delegates to declare_ptr(). Calls _check_mutable_alias() after the update.

_find_ptr(var_name) -> Optional[PtrInfo]

Searches frames top-down (innermost first) for the named variable. Returns the first match or None.

Aliasing detection:

_check_mutable_alias(new_ptr) is called every time a pointer is declared or reassigned. It scans all live pointers across all frames:

• Skips the same variable.
• Skips if sites differ.
• Skips if the site is "unknown" or starts with "derived:".
• If two pointers share the same site and at least one is mutable, appends a mutable_alias violation with a two-line detail block naming both pointers, their sites, mutability, and source locations.

Scope escape detection:

_check_escape_after_pop(dead_sites, dead_frame) iterates all surviving frames after a scope exits. For any PtrInfo whose site is in dead_sites, a scope_escape violation is appended.

Heap tracking:

record_malloc(site, file, line) — adds the site to heap_sites.

record_free(site) — removes the site from heap_sites (no error if absent, since ffree argument resolution may return a site FBC didn't see allocated in this function).

check_heap_leaks() — appends a heap_leak violation for every remaining entry in heap_sites, then clears it.

Thread safety:

check_thread_escape(ptr_var, file, line) — two-phase check:

1. Phase 1 (spawn-time alias check): scans all live pointers. If any live pointer (other than ptr_var itself) shares the same site, and either is mutable, appends a thread_escape violation.
2. Phase 2 (mark for future access checks): if the pointer is mutable and its site is not "unknown" or "derived:...", records the site in thread_escaped_sites with the spawn location. Only sites with resolvable, non-derived identities are marked — this prevents cascading false positives from untracked pointers.

check_use_after_escape(ptr_var, file, line) — looks up ptr_var in AliasMap. If the pointer's site is in thread_escaped_sites, appends a thread_race violation, unless the current line is the same as the spawn line (the spawn call itself is exempt).

fbc_report.py — Output formatting

Constants

COLORS = {
    'red':    '\033[91m',
    'yellow': '\033[93m',
    'cyan':   '\033[96m',
    'dim':    '\033[2m',
    'bold':   '\033[1m',
    'reset':  '\033[0m',
}

KIND_COLOR = {
    'mutable_alias':   'red',
    'scope_escape':    'red',
    'use_after_scope': 'red',
    'thread_escape':   'yellow',
    'thread_race':     'red',
    'heap_leak':       'yellow',
}

The internal _c(key, text, use_color) helper applies an ANSI colour if use_color=True, otherwise returns text unchanged.

print_violations(violations, mode, use_color, json_out, file=sys.stderr)

Prints all violations. When the list is empty, returns immediately without printing anything.

Human-readable mode (json_out=False): for each violation, prints:

[FBC error] mutable_alias
  src/main.fx:42  mutable alias violation on site 'heap:foo:17'
  'p' -> heap:foo:17 (mutable) at src/main.fx:42
  'q' -> heap:foo:17 (mutable) at src/main.fx:38

Line 1 uses bold for [FBC error] or [FBC warning] and colours the kind string via KIND_COLOR. Line 2 uses cyan for the file:line location. Detail lines are dimmed. A blank line separates each violation.

JSON mode (json_out=True): emits a JSON array to stdout (not stderr). Each element is an object:

[
  {
    "kind":    "mutable_alias",
    "message": "mutable alias violation on site 'heap:foo:17'",
    "file":    "src/main.fx",
    "line":    42,
    "detail":  [
      "'p' -> heap:foo:17 (mutable) at src/main.fx:42",
      "'q' -> heap:foo:17 (mutable) at src/main.fx:38"
    ],
    "level":   "error"
  }
]

level is "error" or "warning" according to the mode argument.

print_summary(violations, files_checked, funcs_checked, use_color, json_out, file=sys.stdout)

Prints a single summary line to stdout after all violations.

No violations:

[FBC] OK -- 3 file(s), 47 function(s) checked, no violations found.

OK is printed in cyan.

With violations:

[FBC] 2 violation(s) -- 3 file(s), 47 function(s) checked
  heap_leak: 1, mutable_alias: 1

The violation count is in red. The second line lists each kind and its count, sorted alphabetically.

In --json mode, print_summary returns immediately without printing anything (the JSON array from print_violations is the sole machine-readable output).

17. Helper Functions

18. File Parsing

parse_file(path: str) -> (fast.Program, line_map)

Parses a single .fx file through the full compiler front-end pipeline:

1. FXPreprocessor — expands #include, #def, #ifdef, etc., producing a merged source string and a line_map.
2. FluxLexer — tokenises the merged source.
3. FluxParser — parses tokens into a fast.Program AST.

build_compiler_macros() is called before preprocessing to populate platform detection macros (equivalent to what the compiler itself uses).

collect_fx_files(path: str) -> list[str]

If path is a file, returns [path]. If it is a directory, recursively finds all *.fx files with rglob and returns them sorted.

19. CLI Reference

python fbc.py <target> [options]

Positional argument

Options

Output

By default, violations are written to stderr and the summary is written to stderr. The --json flag writes to stdout.

Informational lines (file count, function count) are written to stdout in normal mode and suppressed in --json mode.

20. Exit Codes

21. Integrating FBC Programmatically

import sys
from pathlib import Path

# Add compiler module path
sys.path.insert(0, 'src/compiler')

from fbc import CallGraph, BorrowChecker, parse_file, collect_fx_files

# Parse files
fx_files = collect_fx_files('src/')
programs, line_maps = [], []
for fx in fx_files:
    prog, line_map = parse_file(fx)
    programs.append((fx, prog))
    line_maps.append(line_map)

# Build call graph
cg = CallGraph()
for fx, prog in programs:
    cg.collect(prog)

# Run checker
checker = BorrowChecker(
    call_graph=cg,
    entry='FRTStartup',
    check_threads=True,
    check_leaks=True,
    line_map=line_maps[0] if line_maps else [],
)
checker.run()

# Inspect results
for v in checker.violations:
    print(f"[{v.kind}] {v.file}:{v.line}: {v.message}")
    for detail in v.detail:
        print(f"  {detail}")

print(f"Checked {checker.funcs_checked} functions, "
      f"{len(checker.violations)} violation(s).")

Key integration points

• checker.violations — list of Violation objects with .kind, .message, .file, .line, .detail.
• checker.funcs_checked — number of function bodies that were analysed.
• cg.funcs — full dict of all collected FunctionDef nodes, keyed by mangled name.
• cg.visited — set of function names that were reached during analysis.

You can inject a custom entry point or run the checker multiple times against different entry points by resetting cg.visited between runs:

cg.visited.clear()
checker2 = BorrowChecker(cg, entry='test_main', check_leaks=True)
checker2.run()

22. Limitations and Design Notes

Conservative pointer classification

All pointer parameters are treated as mutable (mutable=True). This is conservative — it may produce more aliasing violation candidates than necessary for parameters that are logically immutable, but prevents missed violations.

Derived sites

Cast and pointer-arithmetic expressions produce "derived:<base_site>" sites rather than sharing the base site. Two derived pointers from the same base are thus treated as distinct — this is intentional to prevent false aliasing reports for common C-style patterns like char<em> p = (char</em>)buf; char<em> q = (char</em>)buf + offset;.

Thread spawn heuristic

The thread spawn detector is heuristic-based (substring match on function name). It will not catch thread spawns through function pointers or through wrappers with non-obvious names. It will also trigger on non-spawn functions that happen to contain thread in their name (e.g. get_thread_id). The exclusion of known spawn implementation functions (thread_create, etc.) mitigates some false positives.

Single merged line map

When multiple .fx files are parsed, each goes through its own preprocessor and produces its own line_map. The FBC currently only uses the line_map from the first file. For multi-file projects where the second or later file's violations need accurate line remapping, the host should concatenate or merge the line maps appropriately before constructing BorrowChecker.

Cycle prevention

The cg.visited set prevents infinite recursion on recursive or mutually recursive functions. Each function is analysed at most once per BorrowChecker run, regardless of how many call sites reach it.