Inline lowering splice does not restore assert_facts: a body-local assert leaks into a later kernel as assume(false)

The inline splice that emits a user impl Transfer body (src/codegen/lower/tensors.rs) snapshots and restores env, ast_env, allocs and has_returned — but not gen.assert_facts. An assert(...) inside a lowering body pushes a fact that survives the restore, and seam_cert.rs later transports every current-function fact into the next device spawn whose body mentions the same identifier. The fact's body-local name then re-resolves against the caller's binding.

Two observed failure modes (both need --emit-seam-certs, which is off by default — that caps the severity):

• With a same-named host variable in scope, the emitted kernel entry contains arith.cmpi slt, %c1000_i32, %c5_i32 followed by llvm.intr.assume — i.e. assume(false), which downstream optimisation may fold into arbitrary miscompilation of the kernel.
• With the name bound only inside the spawn body, codegen ICEs: Undefined variable: e (expr.rs), because the fact is re-lowered at kernel entry before the body's let.

Why it is this shape

The splice's snapshot list is a hand-maintained enumeration of generator state. A previous review already found it saving two of three maps; this is the same failure one field further along. The durable fix is probably not another field in the list but a scoped guard that saves/restores all per-function generator state as a unit, so adding state later cannot silently escape the splice.

Found by the memalg codegen review (emission pass). Campaign-introduced (the splice is 18af5559).

Start in src/codegen/lower/tensors.rs at the inline splice that emits a user impl Transfer body, then compare its generator-state snapshot with the later use in seam_cert.rs. Reproduce with --emit-seam-certs, including the same-named host variable and spawn-local binding cases. Done means body-local assert facts no longer reach later kernels, avoiding assume(false) and the Undefined variable: e ICE.