feat(vcr-ra): spill on register exhaustion — remove the optimized-path hard-fail (#242, VCR-RA-001)

[avrabe]

The hard-fail history

The optimized path (ir_to_arm) hard-failed on register exhaustion: #496 made alloc_i32_scratch / alloc_i64_pair flag pool exhaustion and decline the whole function to the direct selector — the honest fix that replaced the silent R12-borrow miscompile (R12/IP is the encoder's indexed-load scratch, #212). Honest, but it meant any function exceeding the R4-R8 pool never got the optimized path's benefits — the literal VCR-RA-001 "remove the register-exhaustion hard-fail" claim stayed open.

Why exhaustion hard-failed despite existing spill support: the spill machinery in ir_to_arm was dead flag-off — the Const handler could evict-and-spill, but any pressure that triggers eviction also exhausts the (smaller) scratch pool, which set the decline flag and discarded the body. The reload half was also unsound for real pressure (both operands of one op reload into R12; most handlers never reload at all) — all masked by the decline.

Allocation-time Belady spill (flag: SYNTH_SPILL_ON_EXHAUST, default OFF)

A pre-step before each IR instruction (only when the flag is on AND every opcode in the function is modeled):

• (a) reinstate spilled sources — reload each into a pool register (LDR rd, [SP,#slot]), put it back in vreg_to_arm, so get_arm_reg never returns the R12 placeholder;
• (b) free a dest register — if the handler will allocate a fresh scratch and the pool is full, evict the live vreg with the farthest next use (Belady, linear next-use table over the IR; deterministic tie-breaks) via STR victim, [SP,#slot]. Victims always get a store (the function's final result is read by the epilogue, invisible to the linear table); the epilogue reloads a spilled final result straight into R0.

If no victim is evictable (everything pinned), the pre-step falls through and the #496 decline fires exactly as flag-off — the lever degrades to the status quo, never to a miscompile.

Also fixed under the flag (latent, unreachable flag-off because any spill implied a decline): the appended trailing return missed the ADD SP frame epilogue, and Const-handler exhaustion could hand out reserved R9/R10/R11 (globals base / memsize / base-CSE) or clobber R3 — the pre-step pre-frees a pool register for Const dests too, so its allocator never reaches those fallbacks.

Flag choice

A separate flag, not SYNTH_SPILL_REALLOC: that lever is a post-hoc rewrite of already-allocated code (byte-level, same function set), while this one changes which functions take the optimized path — entangling them would make the realloc flip judge a population change. The flip decision later covers both.

i64 scope (honest)

i64 pair exhaustion keeps declining even flag-on. i64 values are two separate vregs with a pair invariant the v1 spill model does not carry (#518 class); spill_on_exhaust_supported also excludes control flow (a back-edge invalidates the linear next-use table), calls, and non-param locals. One unsupported opcode keeps the whole function on the #496 decline.

Red→green

scripts/repro/spill_on_exhaust_242.wat — 10 param-derived i32 values simultaneously live (const-folding can't collapse them), non-commutative fold:

• RED (flag-off): declines; SYNTH_RECOVERY_STATS=1 shows rung=spill (direct selector's ladder produced the code). Pinned by spill_on_exhaust_red_flag_off_declines_to_direct_spill_rung.
• GREEN (flag-on): stays on the optimized path (no recovery rung fires), and spill_on_exhaust_242_differential.py matches wasmtime on all 8 vectors under unicorn (incl. vectors where params force asymmetric sub/xor results).

Unit tests: #496 decline pinned; balance invariant (every LDR [SP,#x] preceded by a STR [SP,#x]); no R12 ships flag-on; Belady first victim is the farthest-next-use register (R8), not LRU's oldest (R4); below the pressure edge the lever is a byte-level no-op; scope classifier pinned.

Flag-off proof (STOP condition)

• 68/68 corpus fixtures byte-identical (full-ELF sha256) vs a main-built (bad0901) binary — both self-contained and --relocatable.
• frozen_codegen_bytes 3/3, const-CSE golden, recovery_stats_242, promotion_exhaustion_fallback_474 all green.
• cargo test -p synth-synthesis -p synth-cli fully green; cargo fmt --check and cargo clippy -p synth-synthesis -p synth-cli --all-targets -- -D warnings clean.

Flag-on validation

• flight_seam_differential.py: seam 0x07FDF307 MATCH.
• const_cse_differential.py: PASS (with the flag on top).
• r12_spill_496_differential.py (control_step + flight_seam_flat, self-contained): PASS both flag states.
• New fixture differential: PASS.
• Corpus: 68/68 compile flag-on (zero failures). Ten corpus functions move off recovery rungs onto the optimized path; execution-checked vs wasmtime under unicorn flag-on: high_pressure_i32, filter_axis (.wat+.wasm), signed_div_const, uxth_fold, const_cse_direct, const_cse — all PASS. Residual: gust_kernel (1 of 5 fns moved) is compile-validated only here — its gust_poll needs a globals-base (R9) harness that fails identically flag-off, so no regression evidence; it's gale's silicon fixture family and the flip gate covers it.

Size (honest)

The newly-optimized fixture is larger on the optimized path today: hp = 216 B flag-on vs 98 B on the direct path (flag-off). The greedy linear allocator never frees dead vregs' registers, so at the pressure edge nearly every op evicts (STR/LDR churn). The win of this PR is removing the hard-fail class and keeping such functions on the optimized path where the downstream levers (range-realloc, const-CSE, spill-realloc forwarding/DCE #569/#576/#579) apply — dead-vreg pool release and slot reuse are the follow-on size levers before any flip.

Found while testing (pre-existing, NOT touched here)

The direct selector's spill rung miscompiles this fixture's shape: mul.w r2,r0,r1 clobbers a live spill candidate and a later ldr r0,[sp,#8] reads a slot never stored (disasm of the flag-off build, both --relocatable and self-contained). Flag-off vectors like hp(1,2) return 0xffffd1ce vs wasmtime's 0x2e37. That's instruction_selector.rs (out of scope per this PR's charter) — will file separately with the fixture as repro.

🤖 Generated with Claude Code

[codecov]

Codecov Report

❌ Patch coverage is 82.48473% with 86 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
crates/synth-synthesis/src/optimizer_bridge.rs	82.48%	86 Missing ⚠️

📢 Thoughts on this report? Let us know!