bug in auto-integrator

The auto-integrator does not preserve the rule that all subexpressions
of a combination are evaluated before the procedure in the operator
position is applied.  Example:

> ,set load-noisily
will notify when loading modules and files
> ,config
config> (define-structure foo (export foo)
          (open scheme interrupts)
          (optimize auto-integrate)
          (begin
            (define (foo interrupts thunk)
              (set-enabled-interrupts! interrupts)
              (thunk))))
; no values returned
config> (define-structure bar (export bar)
          (open scheme foo interrupts debug-messages)
          (optimize auto-integrate)
          (begin  
            (define (show)
              (debug-message "[interrupts: " (enabled-interrupts) "]"))
            (define (bar)
              (show)
              (foo no-interrupts 
                   (begin (show)                        
                          (lambda ()
                            (show)
                            (set-enabled-interrupts! all-interrupts)))))))
; no values returned
config> ,in bar
[foo
Analyzing... 
Calls will be compiled in line: (foo)
]
[bar
Analyzing... no in-line procedures
]
bar> (bar)
[interrupts: 127]
[interrupts: 0]
[interrupts: 0]
0
bar> 

The output should be

[interrupts: 127]
[interrupts: 127]
[interrupts: 0]

because the first two calls to SHOW happen before control enters FOO.
Disassembling BAR shows that (SET-ENABLED-INTERRUPTS! NO-INTERRUPTS)
happens before the second call to (SHOW), however.