perf(reg-vm): elide DeepCopy of read List<Char> params (SH-022) — 5100x -> 45.6x

Root cause (corrected): a read List<Char> param got an eager prologue DeepCopy
that the elision pass KEPT, because the taint pass propagated through ListGet to
the extracted Char and the Char.* intrinsics were classified Keep — so every
per-char lexer helper call deep-copied the whole char list = O(n^2). Measured:
helper-per-char O(n^2) (4x/doubling) vs inline O(n); AOT ~1ms (borrows).

Fix: classify the 12 pure scalar Char.* intrinsics as PureFreshReader in
deepcopy_intrinsic_class (they take Char/Int by value, return fresh scalar/Bool/
String, never mutate/store/alias — verified in intrinsics/char.rs). The existing
elision pass then drops the redundant copy → O(n^2)->O(n). One match arm, VM-only,
no new intrinsic/spec/AOT change. This is the perf-refactor Phase-2 elision 'v2
classifier' follow-up (v1 was sound-but-no-win: intrinsic reads forced keep).

Result (lexer_perf_corpus, release): rss lexer/VM 79.5s -> 732ms (~108x speedup);
vs native lex() 5100x -> 45.6x. Parity-safe (elision removes a provably-redundant
copy; native treats DeepCopyElided==DeepCopy; AOT borrows). Full suite + differential
+ compiled-parity green; added regression guard deepcopy_elision_fires_for_char_list_read_param.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: olwang

crates/rsscript/src/reg_vm/model.rs

@@ -2292,7 +2292,26 @@ fn deepcopy_intrinsic_class(intrinsic: RegIntrinsic) -> IntrinsicTaintClass {
         // Deque
         | RegIntrinsic::DequeIsEmpty
         | RegIntrinsic::DequeLen
-        | RegIntrinsic::DequeNew => PureFreshReader,
+        | RegIntrinsic::DequeNew
+        // Char — pure scalar readers: each takes `Char`/`Int` by value and returns
+        // a fresh `Int`/`Bool`/`Char`/`String`; none borrow_mut, store into
+        // streams/channels/resources, or alias an arg (verified in
+        // `intrinsics/char.rs`). Classifying them PureFreshReader lets the elision
+        // pass drop a redundant `read List<Char>` prologue DeepCopy when the only
+        // keep-forcing use of a `ListGet`-extracted `Char` is one of these — the
+        // SH-022 O(n^2) fix (a `read List<Char>` param was deep-copied per call).
+        | RegIntrinsic::CharToCode
+        | RegIntrinsic::CharFromCode
+        | RegIntrinsic::CharToString
+        | RegIntrinsic::CharToLower
+        | RegIntrinsic::CharToUpper
+        | RegIntrinsic::CharIsDigit
+        | RegIntrinsic::CharIsAlpha
+        | RegIntrinsic::CharIsAlphanumeric
+        | RegIntrinsic::CharIsLower
+        | RegIntrinsic::CharIsUpper
+        | RegIntrinsic::CharIsWhitespace
+        | RegIntrinsic::CharCompare => PureFreshReader,
 
         // ---- AliasReturner: result shares an arg's inner `Rc`; propagate taint arg→dst. ----
         // List

crates/rsscript/src/reg_vm/tests.rs

@@ -658,6 +658,57 @@ fn main() -> Unit {
         assert_eq!(output.stdout, "12\n");
     }
 
+    /// SH-022 regression: a `read List<Char>` param whose only keep-forcing use is
+    /// a pure scalar `Char.*` intrinsic (here `Char.to_code` on a `ListGet`-extracted
+    /// element) must have its prologue `DeepCopy` ELIDED. Before the `Char.*`
+    /// intrinsics were classified `PureFreshReader`, `Char.to_code(c)` pinned the
+    /// copy, so every per-char lexer helper call deep-copied the whole char list —
+    /// a genuine O(n^2) that made the self-hosted lexer ~5000x slower than native.
+    #[test]
+    fn deepcopy_elision_fires_for_char_list_read_param() {
+        let source = r#"
+fn scan(chars: read List<Char>, i: Int) -> Int {
+    let c = List.get<Char>(list: read chars, index: i)
+    return Char.to_code(value: read c)
+}
+
+fn main() -> Unit {
+    let chars = String.chars(value: read "abc")
+    Log.write(message: read String.from_int(value: scan(chars: read chars, i: 1)))
+    return Unit
+}
+"#;
+        let executable =
+            reg_vm_compile_source("deepcopy-elision-char.rss", source).expect("lowering succeeds");
+
+        let scan_id = executable.unit.function_ids["scan"];
+        let scan = executable.unit.functions[scan_id].as_ref();
+        let elided = scan
+            .code
+            .iter()
+            .filter(|instr| matches!(instr, RegInstr::DeepCopyElided { .. }))
+            .count();
+        let eager = scan
+            .code
+            .iter()
+            .filter(|instr| matches!(instr, RegInstr::DeepCopy { .. }))
+            .count();
+        if crate::reg_vm::model::elide_deepcopy_enabled_for_test() {
+            assert!(
+                elided >= 1 && eager == 0,
+                "elision ON: `read List<Char>` param whose only use is ListGet + \
+                 Char.to_code must be elided, got {elided} elided / {eager} eager: {:#?}",
+                scan.code,
+            );
+        }
+
+        // Elision must not change behavior: scan("abc"[1]) == code of 'b' == 98.
+        let output = executable
+            .eval_main_with_args(Vec::<String>::new())
+            .expect("program should still run");
+        assert_eq!(output.stdout, "98\n");
+    }
+
     #[test]
     fn jit_runs_scalar_self_recursion_on_flat_executor() {
         let source = r#"

docs/ledgers/rss-selfhost-ledger.md

@@ -605,7 +605,7 @@ gap is VM value-representation / intrinsic-dispatch cost (the next big lever).
 - **Tests:** `crate::selfhost_parity::parser_parity_corpus`.
 - **Status:** decided.
 
-### SH-022 — self-hosted lexer is ~5100× slower on the VM; cost is per-char intrinsic/collection dispatch, NOT string building
+### SH-022 — self-hosted lexer was ~5100× slower on the VM: O(n²) DeepCopy of a `read List<Char>` param per helper call (FIXED → 45.6×)
 
 - **Tool:** self-hosted lexer (`selfhost/lexer.rss`) run on the reg-VM vs native
   `crate::lexer::lex`, over the whole 545-file corpus (712 KB).
@@ -619,36 +619,45 @@ gap is VM value-representation / intrinsic-dispatch cost (the next big lever).
   `String.concat` (O(n²)) to `StringBuilder` (O(n)). **No measurable change**
   (5140× → 5195×, within noise), parity still 544/544. So string-building is NOT
   the bottleneck (most tokens are short, so the quadratic term never dominates).
-- **Backend:** vm (also relevant to tier-0/native — this code is intrinsic-bound,
-  not native-eligible, cf. SH-001/SH-004).
-- **Root cause:** the main loop is O(n) (single `String.chars` + one pass), but does
-  ~6 intrinsic dispatches PER CHARACTER — `List.get` on a `List<Char>` (VmValue
-  boxing + refcount) plus `Char.to_code`/`is_whitespace`/`is_digit`/… and the
-  `code_at` peeks (c1,c2). The dominant cost is the VM's per-op value-representation
-  + intrinsic-dispatch overhead over ~712 K chars, exactly the lever flagged by
-  SH-001/SH-004/SH-011 and the parked perf roadmap. This is the first REAL-workload
-  profile that is unambiguously VM-dispatch-bound.
-- **Classification:** VM (value representation + intrinsic dispatch) + stdlib
-  (no char-cursor / native String-iteration intrinsic; `String.chars → List<Char>`
-  forces per-char boxed access).
-- **Decision:** the real lever is cheaper per-char access, NOT string building:
-  e.g. a native string byte/char cursor intrinsic (iterate without materializing a
-  boxed `List<Char>`), and lower per-intrinsic dispatch overhead. Feeds
-  [[perf-refactor-roadmap]] / [[jit-collection-perf-measurement]] with real-workload
-  evidence (the trigger that work was waiting for).
-- **Measured vs. extrapolated (be honest):** only two things here are *measured* —
-  (a) the VM-vs-native table above, and (b) the `String.concat`→`StringBuilder`
-  control. The VM-vs-**AOT** split is **NOT measured**: SH-006 measured AOT ~144×
-  faster than the VM on comparable tool code, which *would* put an AOT-compiled
-  self-hosted lexer near ~0.5 s (~30× native Rust), but this lexer has not actually
-  been run under AOT. That AOT number is the piece that would separate *fixable VM
-  per-op overhead* from the *inherent per-char intrinsic count* (which AOT also
-  pays) — worth measuring as a follow-up (needs a file-reading lexer variant so a
-  700 KB input isn't passed via `argv`).
+- **Backend:** vm.
+- **ROOT CAUSE (CORRECTED 2026-07-01 — earlier "per-char dispatch" was WRONG):** a
+  genuine **O(n²)**. Every lexer helper takes `chars: read List<Char>`; a `read`
+  non-Copy param gets an eager prologue `DeepCopy`. The DeepCopy-elision pass
+  *should* drop that copy (the list is never mutated), but it was KEPT: the taint
+  pass propagates through `ListGet` to the extracted scalar `Char`, and the
+  `Char.*` intrinsics were classified `Keep`, so `Char.to_code(c)` pinned the copy.
+  Result: every per-char helper call (`code_at`, `slice`, `scan_*` — called O(n)
+  times) deep-copied the whole O(n) char list ⇒ **O(n²)**. Measured attribution:
+  a helper taking `read List<Char>` per char is O(n²) (10k→588ms, 20k→2319ms,
+  40k→9127ms, 80k→37099ms, ~4×/doubling); the same work inlined (no per-call copy)
+  is flat O(n) (~15–20ms). `RSS_VM_ELIDE_DEEPCOPY=0` vs on = identical (the copy was
+  kept either way). AOT of the same source = ~1ms (borrows `read` params). So
+  ~9000× of the gap was VM-specific redundant DeepCopy — NOT dispatch, NOT boxing
+  (dispatch measured ~60ns/char), NOT string building (the StringBuilder control
+  correctly ruled that out; its "so it's dispatch" inference was the mistake).
+- **Classification:** VM (DeepCopy-elision classifier) — exactly the
+  [[perf-refactor-phase2-deepcopy-elision]] "v2 classifier" follow-up (v1 was
+  sound-but-no-win because "intrinsic reads force keep").
+- **FIX (landed):** classify the 12 pure scalar `Char.*` intrinsics
+  (`CharToCode`, `CharFromCode`, `CharToString`, `CharToLower`, `CharToUpper`,
+  `CharIsDigit`, `CharIsAlpha`, `CharIsAlphanumeric`, `CharIsLower`, `CharIsUpper`,
+  `CharIsWhitespace`, `CharCompare`) as `PureFreshReader` in
+  `deepcopy_intrinsic_class` (`reg_vm/model.rs`) — they take `Char`/`Int` by value
+  and return a fresh scalar/Bool/String, never mutate/store/alias (verified in
+  `intrinsics/char.rs`). The existing elision pass then proves the `read List<Char>`
+  copy redundant and drops it → O(n²)→O(n). ONE match arm; VM-only; no new
+  intrinsic, no spec, no AOT/native change. Parity-safe: elision only removes a
+  provably-redundant copy (native treats `DeepCopyElided` == `DeepCopy`; AOT borrows).
+- **RESULT (measured, release, `lexer_perf_corpus`, 556 files / 724 KB):** rss
+  lexer/VM **79.5 s → 732.7 ms** (~**108× speedup**); slowdown vs native
+  `lex()` **5100× → 45.6×**. The ~46× residual is the real VM per-op tax over native
+  Rust (AOT would remove most of it); cutting that further = the parked
+  [[perf-refactor-roadmap]] collection-rep work, not this bounded fix.
 - **Tests / bench:** `crate::selfhost_parity::lexer_perf_corpus`
-  (`--release -- --ignored`).
-- **Status:** open (VM/stdlib lever identified; feeds perf roadmap; AOT split
-  still to be measured).
+  (`--release -- --ignored`); `reg_vm::tests::…::deepcopy_elision_fires_for_char_list_read_param`
+  (regression guard). Full differential + compiled-parity green (elision soundness).
+- **Status:** fixed (O(n²) removed; residual ~46× is the general VM per-op tax,
+  tracked by the parked perf roadmap).
 
 ### SH-023 — self-hosted checker reaches RS0005 parity at declaration level; the merged callable namespace is the load-bearing rule