fix(parser): review followups — loop recovery, sharper comment, carve-out test

Review followups on PR #1709:
- Replace the tail-recursing recovery with a loop drain. On adversarial
  input like `& & & g` the previous form emitted one diagnostic per `&`
  and recursed N times; the loop drains the operator run and retries
  once, producing exactly one diagnostic. Guards against infinite
  retry on non-operator bad tokens via an `advanced` flag — the
  reviewer's bare-while suggestion would have looped forever on
  inputs like `END_VAR` directly.
- Sharpen the recovery comment: `to_operator()` also matches
  unary-eligible operators (`-`, `+`, `NOT`), but those don't reach
  this fallback because the prefix-operator parser handles them
  earlier in the cascade.
- Add `consecutive_bad_operators_emit_a_single_diagnostic` to lock
  the N→1 reduction.
- Add `empty_parameter_assignment_carve_out_still_fires` to anchor
  the positive complement of the narrowed `foo(p := )` carve-out.

Verified during followup that no `.st` file under tests/lit,
tests/integration, or libs relied on the previously-tolerated
`&<ident>` shape.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: ghaith

src/parser/expressions_parser.rs

@@ -339,14 +339,27 @@ fn parse_atomic_leaf_expression(lexer: &mut ParseSession<'_>) -> Option<AstNode>
                     lexer.slice(),
                     lexer.location(),
                 ));
-                // If the bad token is a binary-only operator misused as a
-                // prefix (e.g. `&y`, `MOD y`), consume it and retry the leaf
-                // so the recovered AST captures the operand the user wrote.
-                // For non-operator tokens (e.g. END_CASE, END_VAR), leave the
-                // token in the stream so outer parsers can use it for
-                // synchronization.
-                if to_operator(&lexer.token).is_some() {
+                // If the bad token has any operator interpretation, drain
+                // any consecutive operator tokens and retry the leaf so the
+                // recovered AST captures the operand the user wrote. In
+                // practice this fires for *binary-only* operators misused
+                // as a prefix (e.g. `&y`, `MOD y`); unary-eligible
+                // operators (`-`, `+`, `NOT`) also match `to_operator()`
+                // but normally never reach this fallback because the
+                // prefix-operator parser higher in the cascade handles
+                // them first. Looping (rather than tail-recursing per
+                // token) emits one diagnostic per run instead of N, and
+                // keeps the recovery cost flat on adversarial input like
+                // `& & & g`. For non-operator tokens (e.g. `END_CASE`,
+                // `END_VAR`), leave the token in the stream so outer
+                // parsers can synchronise on it — the `advanced` guard
+                // prevents an infinite retry loop in that case.
+                let mut advanced = false;
+                while to_operator(&lexer.token).is_some() {
                     lexer.advance();
+                    advanced = true;
+                }
+                if advanced {
                     return parse_atomic_leaf_expression(lexer);
                 }
                 None

src/parser/tests/expressions_parser_tests.rs

@@ -1113,6 +1113,91 @@ fn amp_as_unary_prefix_in_assignment_recovers() {
     "#);
 }
 
+#[test]
+fn consecutive_bad_operators_emit_a_single_diagnostic() {
+    // `& & & g` previously emitted one diagnostic per `&` and recursed N
+    // times. The loop drains the run and retries once, so adversarial input
+    // produces exactly one diagnostic and one recovered identifier.
+    let src = "
+        PROGRAM prg
+            VAR x : DINT; g : DINT; END_VAR
+            x := & & & g;
+        END_PROGRAM
+        ";
+    let (unit, diagnostics) = parse_buffered(src);
+    assert_snapshot!(diagnostics, @r"
+    error[E007]: Unexpected token: expected expression but found &
+      ┌─ <internal>:4:18
+      │
+    4 │             x := & & & g;
+      │                  ^ Unexpected token: expected expression but found &
+    ");
+    assert_debug_snapshot!(unit.implementations[0].statements, @r#"
+    [
+        Assignment {
+            left: ReferenceExpr {
+                kind: Member(
+                    Identifier {
+                        name: "x",
+                    },
+                ),
+                base: None,
+            },
+            right: ReferenceExpr {
+                kind: Member(
+                    Identifier {
+                        name: "g",
+                    },
+                ),
+                base: None,
+            },
+        },
+    ]
+    "#);
+}
+
+#[test]
+fn empty_parameter_assignment_carve_out_still_fires() {
+    // The narrowed `foo(p := )` recovery must keep firing when the next token
+    // is `)` or `,` — the carve-out is the deliberate complement of the bad-
+    // token recovery above. Verifies that tightening the predicate to
+    // `KeywordParensClose | KeywordComma` didn't break the positive path.
+    let src = "
+        FUNCTION foo : DINT VAR_INPUT p : DINT; q : DINT; END_VAR foo := p; END_FUNCTION
+        PROGRAM main
+            foo(p := );
+            foo(p := , q := 1);
+        END_PROGRAM
+        ";
+    let (unit, diagnostics) = parse_buffered(src);
+    assert!(diagnostics.is_empty(), "expected no parse diagnostics, got:\n{diagnostics}");
+
+    let main = unit.implementations.iter().find(|i| i.name == "main").unwrap();
+    // Both calls should land an Assignment with right == EmptyStatement.
+    for stmt in &main.statements {
+        let AstStatement::CallStatement(call) = &stmt.stmt else {
+            panic!("expected CallStatement, got {:?}", stmt);
+        };
+        let Some(params) = call.parameters.as_deref() else {
+            panic!("expected parameters on call, got {:?}", call);
+        };
+        // walk into the first Assignment we find and check its RHS
+        let first_assignment = match &params.stmt {
+            AstStatement::Assignment(a) => a,
+            AstStatement::ExpressionList(list) => match &list[0].stmt {
+                AstStatement::Assignment(a) => a,
+                other => panic!("expected Assignment in list head, got {:?}", other),
+            },
+            other => panic!("expected Assignment or ExpressionList, got {:?}", other),
+        };
+        assert!(
+            matches!(first_assignment.right.stmt, AstStatement::EmptyStatement(..)),
+            "expected RHS to be EmptyStatement, got {:?}",
+            first_assignment.right.stmt
+        );
+    }
+}
+
 #[test]
 fn binary_only_operator_as_prefix_recovers() {
     // Generality witness — recovery is not specific to `&`.