[Plan C Task 81] Fix DONE-path try_pop entry_depth respect

[boldfield]

Summary

Closes 4 architectural composition gaps for std/choose.sigil's all_choices / first_choice runtime-N dischargers, plus a runtime trampoline fix that fell out during diagnosis. Together these unblock natural Sudoku-shape body composition (solve(board, cell) recursive structure with branched-tail Cps-call leaves to itself + perform Choose.fail() leaves on constraint violations).

What's pinned

1. Runtime — DONE-path try_pop respects entry_depth (runtime/src/handlers.rs:1881)

Trampoline's DONE-path try_pop previously ignored outer_post_arm_k_entry_depth, so a nested sigil_run_loop (inside sigil_continuation_invoke's Phase 1, when an outer chain step had pushed an entry) consumed entries belonging to the OUTER run_loop. The first inner DONE pop succeeded (removed outer's entry, leaving the slot null), and the next inner invoke's DONE pop dereferenced a null fn_ptr → SIGSEGV. Fix caps try_pop at entry_depth. Mirrors the symmetric DISCHARGED-path drain discipline (Layer 3c, PR #39 review §5).

2. ANF-tolerant chain classifier (compiler/src/codegen.rs)

Both is_simple_chained_let_yield_then_pure_tail_body and is_let_yield_prefix_then_branched_cps_tail_body now accept Stmt::Let with pure RHS interspersed AFTER the last perform/call yield. ANF-elaborated bodies like let a = perform; let b = perform; let _0 = a == 1; let _1 = b == 1; if _0 && _1 { ... } now classify (yield_count counted, tail-prefix lets folded into the FINAL synth-cont's preamble). collect_chained_synth_cont_captures walks tail-prefix lets so helper params referenced only in lifted intermediates flow through the closure record. TailPrefixLet struct + tail_prefix_lets: Vec<TailPrefixLet> field on ChainStepRole::Final.

3. Nested-If branched-tail classifier+emit (compiler/src/codegen.rs)

New BranchedCpsLeaf::Nested variant + recursive classify_branched_cps_tail_branch_expr accepting nested Expr::If / Expr::Match (if-desugar shape) when both sub-branches recursively classify. FINAL synth-cont emit's branched-tail dispatch refactored from a 2-element for loop to a while let Some(work.pop()) loop. When the popped leaf_kind is Nested, the loop calls detect_pattern_c_dispatch on the nested tail, lowers the nested cond, brifs into 2 fresh blocks, and enqueues each sub-branch. Termination: each iteration either emits a leaf (return_/jump terminates the block) or pushes 2 strictly-smaller sub-trees. New leaf_is_cps_eligible helper used at both classifier and detect-dispatch sites.

4. Arm-body Block stmts threading (compiler/src/codegen.rs)

classify_branched_cps_tail_branch now accepts arm-body Blocks whose stmts are all pure Stmt::Let. detect_pattern_c_dispatch returns 7-tuple (cond, then_stmts, then_leaf, else_stmts, else_leaf, then_kind, else_kind); per-branch extract_leaf returns both stmts and leaf. Work-stack item structure carries &[Stmt] per branch; the iteration lowers each arm-body stmt's RHS via lower_expr and binds into env before dispatching the leaf. Cross-fn perform composition (e.g., pick_outer → pick_inner(p) via Cps-call branched-tail leaf) now works end-to-end through first_choice.

Test coverage

6 new e2e tests under compiler/tests/e2e.rs (all std_choose_*):

• std_choose_two_chained_let_yields_pure_tail_inline_single_shot — inline single-shot k(0) baseline (sanity check that 2-chained-let-yield codegen itself works for inline handlers; passes pre-fix and post-fix).
• std_choose_all_choices_two_sequential_performs_pure_tail — all_choices over chained-let-yield + pure tail (was SIGSEGV pre-fix; passes post-fix with output 4 = 2*2 branches). Pins the runtime entry_depth fix.
• std_choose_all_choices_two_perform_then_two_pure_lets_pure_tail — pure-tail variant's hand-written multi-prefix lets (per review item Plan A1 code-review fixes: 6 issues from the post-review audit #1; pins symmetric ANF-tolerance independent of branched-tail).
• std_choose_first_choice_two_sequential_performs_anf_intermediates — if a == 1 && b == 1 { 99 } else { perform fail } shape with ANF-lifted _0 = a == 1, _1 = b == 1 tail-prefix intermediates.
• std_choose_first_choice_two_sequential_performs_nested_if_tail — if a == 1 { if b == 1 { 99 } else { perform fail } } else { perform fail } nested-If shape; pins single-fn nested-If composition.
• std_choose_first_choice_multi_perform_site_recursive_branched — cross-fn pick_outer → pick_inner(p) via branched-tail Cps-call leaf with ANF-lifted _0 = x * 10 inside arm body Block; mirrors Sudoku's natural solve recursive shape.

Plan C Task 81 status

PLAN_C_PROGRESS.md Task 81 documents the in-progress state. The 9×9 std.choose-based Sudoku demo is now expressible end-to-end via the natural solve(board, cell) recursive shape; shipping examples/sudoku.sigil 9×9 is the next concrete step.

The 4×4 binary-Branch Sudoku from Plan D's smoke gate continues to ship in examples/sudoku.sigil.

Test plan

• 156 runtime tests green
• 15 std_choose e2e tests green (was 9, now 15 with the 6 new tests)
• 292/293 e2e tests green (only pre-existing macOS perf-floor failure remains)
• cargo fmt --all clean

🤖 Generated with Claude Code

[boldfield]

Review

Solid PR. Runtime fix is correct and well-reasoned, the codegen extensions hang together, and test coverage for the interesting branched-tail/cross-fn cases is good. A few items below — nothing blocking, mostly polish + one small coverage gap.

Correctness — runtime fix (handlers.rs:1881–1898)

The fix is right. Capping try_pop at outer_post_arm_k_entry_depth makes the DONE-path symmetric with the DISCHARGED-path drain at lines 1814–1847 and with the outer_post_arm_k_depth_snapshot discipline already documented in continuation.rs:236–243. The debug_assert at 1920–1928 still holds (== entry_depth on the DONE terminal; the pop loop drains down to entry_depth, then the gate prevents the underrun that previously deref'd a null fn_ptr).

Behavioral delta against the old code is null when current_depth ∈ {< entry_depth, == entry_depth} (try_pop would have either returned None or been benign), and corrects the bug when current_depth == entry_depth and the slot at entry_depth - 1 is a real outer entry (the segfault case in the PR description).

Correctness — codegen classifier extensions (codegen.rs:22637–22723, 22788+)

Both is_simple_chained_let_yield_then_pure_tail_body and is_let_yield_prefix_then_branched_cps_tail_body correctly:

• accept Stmt::Let with pure RHS only AFTER yield_count > 0
• reject pure-then-yield via seen_pure_after_yield
• reject all-pure bodies via if yield_count == 0 { return None }
• return yield_count (= chain_length) instead of body.stmts.len() so the + chain_length + 1 < MAX_CLOSURE_ENV_SLOTS cap remains accurate (tail_prefix_lets don't go in the closure record)

collect_chained_synth_cont_captures walks tail-prefix lets BEFORE inserting their names into bound, so a later prefix-let can reference an earlier one without re-capturing. Correct.

Correctness — Pattern C work-stack (codegen.rs:13000–13048, ~13150+)

Termination is fine — each iteration emits a leaf (terminating the block) or pushes 2 strictly-smaller sub-trees from detect_pattern_c_dispatch. BranchedCpsLeaf::Nested is only produced for Expr::If / 2-arm-BoolLit Expr::Match, both of which detect_pattern_c_dispatch handles, so the unreachable!("classifier accepted Nested but detect_pattern_c_dispatch returned None") should be unreachable.

The classifier↔detect symmetry on Match patterns now matches (both filter to 2 arms with Pattern::BoolLit and a0 != a1); the older asymmetry would have classified as Nested but blown up at emit.

Issues

1. Coverage gap — pure-tail variant's tail-prefix-let path has no e2e test (minor).

The branched-tail variant (is_let_yield_prefix_then_branched_cps_tail_body) is exercised by tests #3 (ANF intermediates), #4 (nested-If), #5 (cross-fn arm-body Block stmts). The pure-tail variant's new pure-trailing-let acceptance — the change at is_simple_chained_let_yield_then_pure_tail_body:22709 — has no direct test. Add something like:

fn body() -> Int ![Choose] {
  let a: Int = perform Choose.choose(2);
  let b: Int = perform Choose.choose(2);
  let s: Int = a + b;        // forces seen_pure_after_yield path
  let s2: Int = s + 1;       // forces multi-prefix-let
  s2
}
let r = all_choices(body);   // expect length 4

If ANF doesn't actually lift a + b into a separate let on a real run, hand-write the let so the path is forced. Without this, the symmetric extension is implicitly tested only via the branched-tail emit.

2. Doc rot — detect_pattern_c_dispatch comment is stale (minor).

codegen.rs:23018 still says Returns Some((cond, then_leaf, else_leaf, then_kind, else_kind)) but the signature now returns 7 elements (with then_stmts / else_stmts). Update the docstring so future readers don't get tripped up.

3. tail_prefix_lets widening for non-Int kinds is misleadingly named (style).

At codegen.rs:13014–13046, let widened = match tpl.kind { ... } only actually widens for Int (uextend to I64). Bool/Byte/Unit/Char/String/Closure/User just re-bind raw_v to a widened name. The comment "Sigil's lower_expr returns I8 for Bool/Byte/Unit/Char" is an unverified invariant. Either:

• rename widened → env_value / drop the local entirely for the no-op kinds, or
• add debug_assert_eq!(lowerer.builder.func.dfg.value_type(raw_v), types::I8) for those kinds so a future lower_expr change that breaks the invariant fails loudly instead of silently bit-mismatching at use sites.

4. PR description is out of sync (minor).

Summary says "2 new e2e tests"; the diff has 5 (std_choose_two_chained_let_yields_pure_tail_inline_single_shot, std_choose_all_choices_two_sequential_performs_pure_tail, std_choose_first_choice_two_sequential_performs_anf_intermediates, std_choose_first_choice_two_sequential_performs_nested_if_tail, std_choose_first_choice_multi_perform_site_recursive_branched). Same for the "What's pinned" section — it lists 2 but the codegen-side ANF/Nested/Block-stmts work that the PLAN_C_PROGRESS update describes is actually here. Easy to update; helps reviewers.

5. Pre-yield pure-let limitation worth a one-line note (very minor).

Both classifiers reject let x = pure; let y = perform .... Reasonable scope cut, but worth a one-line // Pure lets BEFORE the first yield rejected here; would need a pre-yield env-prep emit phase near the catch-all in is_let_yield_prefix_then_branched_cps_tail_body (the comment exists in the pure-tail variant but not the branched one). Useful breadcrumb for whoever hits it next.

Things that look fine

• Closure-record sizing: captures.len() + chain_length + 1 < MAX_CLOSURE_ENV_SLOTS is right; tail_prefix_lets are recomputed at FINAL emit from values already in env, not stored in the closure record.
• tail_prefix_lets.clone() in the Final-role construction at codegen.rs:8229 happens once per chain (only step == chain_length - 1), not per step. Fine.
• leaf_is_cps_eligible correctly excludes Pure so the all-pure-leaves case falls through to expr_is_pure instead of producing a stuck Nested.