Harden the rc-elision measurement with tests, fix a loop soundness bug

Add tests pinning both directions of the movability classification: a last-use
call-argument move, a value used again (not a move), an aliasing move, a
field-store escape, and a borrowed element load. Writing the loop test caught a
real unsoundness: the linear last-use marked a loop-carried variable's in-loop
use as a move, when it is live across the back-edge. Fix it with a loop-aware
rule, extracting loop_ranges from loop_depths: a use inside a loop is a move only
if the variable is also defined inside that same loop (a per-iteration temporary),
never carried in from outside. Conservative by construction, so it under-counts
rather than ever over-counting.

Record the follow-ups in PROFILING.md: the liveness is a first cut (full dataflow
for nested loops, branches, and cross-block moves is the non-trivial next step),
more elision categories to find (return moves, orphan-temp direct frees,
retain/release cancellation, struct-field moves), the counts being static rather
than runtime-weighted, and that the transform reuses the dormant moved flag.

Author: Axmouth

plans/PROFILING.md

@@ -85,6 +85,46 @@ is the allocation and reference-count work these counts expose, not raw dispatch
   instruction fusion cuts dispatch on the roughly 3,865 instructions. The allocation and RC traffic
   is the larger, more concrete target of the two.
 
+## Reference-count elision measurement
+
+`--rc-report` runs a read-only analysis over the typed IR and classifies each emitted retain, so the
+elision opportunity is measured before any elision is built. It changes no codegen. Retains fall into
+movable categories (an aliasing copy, a call argument, a spawn argument) and kept categories (a
+borrowed element load, a store into an aggregate, which are genuine shared references). A movable
+retain is one where the source's last real use is the retain site, so passing it is a move rather
+than a copy, and it pairs with the moved-from variable's drop, so eliding one elides both.
+
+The move test is loop-aware and conservative, since the whole point is to be safe: a variable carried
+into a loop from outside is live across the back-edge, so its last linear use inside the loop is not a
+move. The rule requires that for every loop enclosing a use, the variable is also defined inside that
+loop, which keeps per-iteration temporaries movable while rejecting loop-carried variables. The
+direction is always safe by construction: when the analysis cannot prove a move, it keeps the retain.
+Tests pin both directions (a last-use move, a value used again, a loop-carried variable, an aliasing
+move, a field-store escape, a borrowed load).
+
+First result on the http hello server: call-arg retains dominate (72 of the 97 movable-category
+retains) and 55 are movable, so the calling-convention retain (the caller retains, the callee drops)
+is the large lever and most arguments are moves.
+
+### Follow-ups (non-trivial, revisit before building the elision)
+
+- **The liveness is a first cut.** The loop rule is sound but coarse. A full version wants proper
+  dataflow liveness: nested loops, `break`/`continue`, conditionals and merge points, multiple
+  reaching definitions, and cross-block moves. The current rule is intentionally conservative, so it
+  under-counts rather than ever over-counting, but the real elision transform needs the stronger
+  analysis to catch the cases it currently rejects.
+- **Find more elision categories.** Beyond the three movable categories there are more: a value
+  returned moves ownership out of the function (its drop is elidable), a uniquely-owned orphan
+  temporary's drop can become a direct free rather than a decrement-and-check, a retain and release
+  that cancel within a block regardless of category, and a struct construction that moves its fields
+  in rather than retaining them. Each is its own rule to measure and prove.
+- **The counts are static, not runtime-weighted.** They count retain sites in the code, not their
+  execution frequency, so they show the shape of the opportunity rather than the exact runtime total.
+  Weighting by the per-request hot path would bridge to the runtime `vm-counters` number.
+- **Then build the transform.** The mechanism is already present: the dormant `moved` flag, which the
+  drop emitter already respects. The elision sets it for proven moves and skips the paired retain,
+  keyed on the same decision the measurement makes.
+
 ## Where this sits
 
 At about 15.8k realistic and 25k raw single-core, an interpreted register VM running a user-space

solid-snake-compiler/src/bytecode_gen.rs

@@ -373,7 +373,10 @@ fn position_in(order: &[usize], v: usize) -> usize {
 /// target label sits earlier in the stream, spanning `[label, jump]`. A statement's depth is how
 /// many such spans contain it, so nested loops read as deeper. Used to weight accesses when choosing
 /// spill victims.
-fn loop_depths(ir: &[TypedIRInstruction]) -> Vec<usize> {
+/// The instruction ranges of loops, as `(header index, back-jump index)` for each back-edge (a jump
+/// to an earlier label). An index inside such a range can re-execute, so a variable read there may be
+/// read again on a later iteration, which is what makes a linear last-use unsound as a move signal.
+fn loop_ranges(ir: &[TypedIRInstruction]) -> Vec<(usize, usize)> {
     let mut label_index: HashMap<String, usize> = HashMap::new();
     for (i, instr) in ir.iter().enumerate() {
         if let TypedIRStmt::Label(name) = &instr.kind {
@@ -397,7 +400,11 @@ fn loop_depths(ir: &[TypedIRInstruction]) -> Vec<usize> {
             }
         }
     }
+    back_edges
+}
 
+fn loop_depths(ir: &[TypedIRInstruction]) -> Vec<usize> {
+    let back_edges = loop_ranges(ir);
     (0..ir.len())
         .map(|idx| {
             back_edges
@@ -574,8 +581,35 @@ fn for_each_stmt_read(stmt: &TypedIRStmt, f: &mut impl FnMut(usize)) {
 /// in `lower_body`/`lower_expr_to_bytecode_stage_one`.
 pub fn analyze_rc_elision(ir: &[TypedIRInstruction]) -> RcElisionReport {
     let last = last_real_use(ir);
+    let loops = loop_ranges(ir);
+    // Every index at which each variable is defined (written), used to tell a per-iteration
+    // temporary from a loop-carried variable.
+    let mut defs: HashMap<usize, Vec<usize>> = HashMap::new();
+    for (i, instr) in ir.iter().enumerate() {
+        if let Some(v) = stmt_def_var(&instr.kind) {
+            defs.entry(v).or_default().push(i);
+        }
+    }
     let mut r = RcElisionReport::default();
-    let is_movable = |v: usize, i: usize| last.get(&v) == Some(&i);
+    // A retain is a move only if the source's last real use is here and, for every loop enclosing
+    // this use, the source is also defined inside that loop at or before the use. A variable carried
+    // in from outside a loop is live across the back-edge, so its last linear use is not a move.
+    let is_movable = |v: usize, i: usize| -> bool {
+        if last.get(&v) != Some(&i) {
+            return false;
+        }
+        for &(start, end) in &loops {
+            if start <= i && i <= end {
+                let defined_in_loop = defs
+                    .get(&v)
+                    .is_some_and(|ds| ds.iter().any(|&d| start <= d && d <= i));
+                if !defined_in_loop {
+                    return false;
+                }
+            }
+        }
+        true
+    };
     for (i, instr) in ir.iter().enumerate() {
         match &instr.kind {
             // Aliasing `q = p` retains the copied reference.
@@ -1791,6 +1825,98 @@ mod codegen_tests {
         analyze_ast_with_opts(&ast, AnalysisOptions::default())
     }
 
+    /// Compile `src`, then run the reference-count elision analysis on one function's IR. Function
+    /// names are mangled by parameter types, so a bare name matches its mangled form. Use "main" for
+    /// the top-level body.
+    fn rc_report_for(src: &str, fn_name: &str) -> super::RcElisionReport {
+        let ctx = analyze_source(src);
+        assert!(!ctx.errors().is_fatal(), "compile errors: {:?}", ctx.errors());
+        if fn_name == "main" {
+            return super::analyze_rc_elision(&ctx.main_function().body);
+        }
+        let mangled = format!("{fn_name}$");
+        let func = ctx
+            .functions()
+            .iter()
+            .find(|f| f.name == fn_name || f.name.starts_with(&mangled))
+            .unwrap_or_else(|| panic!("no function named {fn_name}"));
+        super::analyze_rc_elision(&func.body)
+    }
+
+    const RC_SINK: &str = "def sink(s: String) -> Int:\n    return len(s)\n\n";
+
+    #[test]
+    fn rc_call_arg_last_use_is_movable() {
+        // `x`'s only use is the call, so passing it is a move: the retain is elidable.
+        let r = rc_report_for(
+            &format!("{RC_SINK}def caller() -> Int:\n    let x = \"ab\"\n    return sink(x)\n"),
+            "caller",
+        );
+        assert_eq!(r.call_arg_total, 1, "one reference argument");
+        assert_eq!(r.call_arg_movable, 1, "its last use is the call, so movable");
+    }
+
+    #[test]
+    fn rc_value_used_after_is_not_movable() {
+        // `x` is passed twice, so the first pass is not a move (it is still live), only the last.
+        let r = rc_report_for(
+            &format!("{RC_SINK}def twice() -> Int:\n    let x = \"ab\"\n    let a = sink(x)\n    let b = sink(x)\n    return a + b\n"),
+            "twice",
+        );
+        assert_eq!(r.call_arg_total, 2, "two reference arguments");
+        assert_eq!(r.call_arg_movable, 1, "only the last use is a move");
+    }
+
+    #[test]
+    fn rc_loop_carried_is_not_movable() {
+        // `x` is read every iteration, so it is live across the back-edge: its last linear use inside
+        // the loop is NOT a move. A linear last-use analysis would wrongly mark it movable.
+        let r = rc_report_for(
+            &format!("{RC_SINK}def loopy() -> Int:\n    let x = \"ab\"\n    let total = 0\n    let i = 0\n    while i < 2:\n        total = total + sink(x)\n        i = i + 1\n    return total\n"),
+            "loopy",
+        );
+        assert_eq!(r.call_arg_total, 1, "one reference argument, in the loop");
+        assert_eq!(
+            r.call_arg_movable, 0,
+            "a loop-carried variable is live across iterations, so it must not be counted movable"
+        );
+    }
+
+    #[test]
+    fn rc_aliasing_last_use_is_movable() {
+        // `let b = a` with `a` dead afterward is a move of the reference into `b`. `a` is a parameter
+        // so it is not a folded constant (a literal aliasing would fold away and emit no retain).
+        let r = rc_report_for(
+            "def f(a: String) -> Int:\n    let b = a\n    return len(b)\n",
+            "f",
+        );
+        assert_eq!(r.alias_total, 1, "one aliasing copy");
+        assert_eq!(r.alias_movable, 1, "the source is dead after, so it is a move");
+    }
+
+    #[test]
+    fn rc_field_store_is_kept_not_movable() {
+        // Storing a reference into a struct field makes the struct share it, an escape that stays
+        // counted rather than becoming a move.
+        let r = rc_report_for(
+            "type Box:\n    v: String\n\ndef setit(b: Box, s: String):\n    b.v = s\n",
+            "setit",
+        );
+        assert_eq!(r.aggregate_store_kept, 1, "the field store is a kept escape");
+        assert_eq!(r.call_arg_movable, 0, "no movable call argument here");
+    }
+
+    #[test]
+    fn rc_indexed_load_is_kept() {
+        // A loaded element is a borrowed reference into a live collection, a genuine new reference
+        // that stays counted.
+        let r = rc_report_for(
+            "def geti(arr: Array[String]) -> Int:\n    let x = arr[0]\n    return len(x)\n",
+            "geti",
+        );
+        assert_eq!(r.indexed_load_kept, 1, "the element load is a kept borrow");
+    }
+
     #[test]
     fn fallible_parse_int_returns_result() {
         // The fallible-builtin convention: __parse_int sets a status that the prelude parse_int