The bug: array_map / array_mapi always emit a per-iteration "$gc_sp
-= 4" after each call_indirect when the element type is heap-pointer-
like (b_needs_unwind path).  But _compile_lifted_closure only emitted
the matching gc_shadow_push of the return value when the closure body
itself allocated (ctx.needs_alloc=True).

A closure body like fn(@Bool -> @string) { render_cell(@Bool.0) }
where render_cell returns String literals (data segment, no heap
alloc) had needs_alloc=False, so its epilogue emitted no push -- but
the array_map loop popped anyway, dropping $gc_sp BELOW the
surrounding function's prologue baseline.  Subsequent shadow-stack
pushes overwrote slots holding still-live roots, so the next GC mark
phase missed those roots and swept their referents -- manifested as
silent string corruption (Conway's Life rendering -- the original
issue's symptom: U+FFFD bytes interleaved with valid output) or
call_indirect out-of-bounds table access trap at smaller scales.

Fix: lift the return-value push out of the if-ctx.needs_alloc branch
in _compile_lifted_closure.  Always push when the return type is a
heap pointer (i32_pair or i32 ADT).  No gc_sp save/restore needed in
the non-allocating branch -- nothing to clean up -- just intercept
the return to publish the root.

Diagnostic: added VERA_EAGER_GC=1 environment variable that prepends
call $gc_collect to every $alloc invocation.  Surfaced the rooting
imbalance on the very first iteration rather than only at scale,
which was the diagnostic that cracked the investigation.  Permanent
debug knob now -- documented in new top-level ENVIRONMENT.md catalogue.

Validation:
- 4 new tests in TestClosureReturnShadowPushBalance cover positive
  regression, eager-GC behavioural (flat array_map and recursive
  Life-shape), and structural WAT assertion of the return-value push
- Original life_full_program.vera at 12x30 x 200 generations: exit 0,
  zero U+FFFD corruption (was 6,320 U+FFFD pre-fix)
- Full test suite: 3,737 passed, 14 skipped (no regressions)
- All 86 conformance programs pass, all 33 examples pass

Documentation:
- New ENVIRONMENT.md centralises the eight VERA_* environment variables
  (provider keys, runtime overrides, dev knobs) -- previously scattered
  across README, AGENTS, TESTING, CONTRIBUTING, SKILL, CLAUDE.
  Cross-linked from each.
- KNOWN_ISSUES.md, ROADMAP.md, HISTORY.md updated to reflect #593
  closure rather than carrying the open-bug entry.

Closes #593

Co-Authored-By: Claude <noreply@anthropic.invalid>

CI lint job runs `uv lock --check` which requires the lockfile to
match `pyproject.toml`.  The version bump in the previous commit
invalidated it.

Co-Authored-By: Claude <noreply@anthropic.invalid>

The site landing page's status block had drifted to '81-program
conformance suite and 32 worked examples' while the live counts were
86 and 33.  Static HTML, no automated check on it, so it had been
silently stale for several releases.

Updates the numbers to 86 / 33 and extends scripts/check_doc_counts.py
with a new section 13 that pins both counts via regex against the live
conformance manifest and examples directory — same approach as the
existing checks for TESTING.md, README.md, ROADMAP.md, etc.

Co-Authored-By: Claude <noreply@anthropic.invalid>

Mechanical fixes (review-comment-analyzer findings):
- Drop file:line citations in closures.py + test docstrings; replace
  with symbol references (calls_arrays.py is 2,472 lines and changes
  routinely; line ranges would shift within 2-3 releases).
- Fix _emit_alloc docstring: "prepend to body" -> "first instruction
  after local declarations" (WAT requires locals at the top so the
  call $gc_collect goes after them, not at the very start).
- Trim TestClosureReturnShadowPushBalance class docstring's "three
  layers" claim to match the actual four test layers.
- Tighten redundant per-test docstrings that re-explained the bug
  story already covered in the class docstring.
- Lowercase VERA_EAGER_GC env-var comparison so True/YES/On/etc. are
  also accepted.

New tests (review-pr-test-analyzer findings):
- test_lifted_closure_emits_return_root_push_for_non_allocating_adt_return:
  structural assertion for the i32-ADT branch of the fix at
  closures.py:421-425.  Pre-fix this branch was completely untested;
  exercised here via a non-allocating identity closure over a Box ADT
  through array_map.
- test_array_mapi_non_allocating_closure_emits_balanced_push: pin
  _translate_array_mapi's pop site independently of array_map's so
  a future refactor that touches one but not both is caught.
- test_vera_eager_gc_injects_gc_collect_into_alloc_body: pin the
  eager-GC diagnostic mechanism itself.  Without this, a silent
  regression in the env-var-reading code would degenerate the
  eager-GC behavioural tests to the non-eager case (still passing,
  but no longer pinning the rooting balance).
- test_vera_eager_gc_accepts_case_insensitive_truthy_values
  (parametrized over 1, true, TRUE, Yes, On, "true "): pin the
  case-insensitive allowlist behaviour.

Suite: 3,746 passed (up from 3,737, +9 from new tests), 14 skipped.
Doc counts and version sync are clean.

Co-Authored-By: Claude <noreply@anthropic.invalid>

1. HISTORY.md "137 tagged releases" -> 138 (line 315): the v0.0.138
   row was added but the rollup footer count still said 137.

2. ROADMAP.md stabilisation-gate sentence: "order #5 starts when
   #1-#4 are closed" -> "order #4 starts when #1-#3 are closed".
   The earlier deletion of the #593 row (now closed) shifted the
   stabilisation tier to three items; the agent-integration tier
   numbering is also renumbered 5/6/7 -> 4/5/6 to match.

3. New test: test_eager_gc_array_mapi_with_non_allocating_string_closure
   mirrors the existing array_map String eager-GC test for the
   array_mapi unwind path with a fn(@Bool, @nat -> @string) closure
   returning pick(@Bool.0).  The existing array_mapi ADT test
   (test_array_mapi_non_allocating_closure_emits_balanced_push)
   covered the i32 branch; this new test covers the i32-pair branch.

4. Tighten the structural #593 predicate.  Pre-fix it accepted any
   "global.set $gc_sp" + absent "call $alloc"; CodeRabbit observed
   that a bare "global.set $gc_sp" could in principle be a stack-
   restore rather than a push.  In practice the prologue's
   gc_sp_save/restore is gated on ctx.needs_alloc and the regex
   already excludes call $alloc, so a non-allocating body cannot
   contain a restore -- but the literal predicate was weaker than
   the intent.  Adds _has_gc_shadow_push helper that anchors on the
   canonical "i32.const 4 / i32.add / global.set $gc_sp" SP-increment
   sequence emitted by gc_shadow_push (vera/wasm/helpers.py).  Used
   by both the i32-pair and i32-ADT structural tests; a non-push
   artefact in the body can no longer satisfy the assertion.

Plus: HISTORY.md tooling section gains a v0.0.138 row for
VERA_EAGER_GC alongside the existing tooling milestones (cross-
linked to ENVIRONMENT.md, which already has the full reference
section for it).

Suite: 3,747 passed (+1 from new array_mapi String test), 14 skipped.

Co-Authored-By: Claude <noreply@anthropic.invalid>

CodeRabbit on #598 caught that line 190's "Via pytest (parametrized
-- 425 tests)" disagrees with the table at line 79 (which correctly
says 430) and with pytest --collect-only (which reports 430 tests
collected for tests/test_conformance.py).

This is the same fix CodeRabbit flagged on PR #594 just before that
PR merged.  It was applied via the Edit tool at the time but landed
in a local stash rather than the branch (the merge happened before
the push) so the fix was effectively lost.  Stash dropped as part
of this commit.

scripts/check_doc_counts.py confirms documentation counts are
consistent post-fix; the canonical 430 = 86 conformance programs *
5 check phases (parse/check/verify/run/format-idempotency).

Co-Authored-By: Claude <noreply@anthropic.invalid>