feat(vcr-ra): i64 pair-spill on exhaustion — VCR-RA-001 acceptance criterion closes (#242) (#325)

The last hard-fail named by the v0.11.40 acceptance review: a high-pressure
i64 module now compiles with no hard-fail.

ROOT CAUSE (differs from the review's reading): the pair allocator
(alloc_consecutive_pair) has ALWAYS spilled register-resident stack values —
pair-aware, both halves into one 8-byte slot (#171). The remaining
"no consecutive pair of free registers for i64" Err fires only when the
operand stack holds nothing register-resident and the blockers are the
PINNED PARAM HOME REGISTERS (#193 `reserved`, up to r0-r3) plus the popped
operand pairs (`extra_avoid`, up to 4 regs) — 8 of the 9-register pool, no
pair left, and no amount of stack spilling can free a param home register.

FIX (same structural-bit-identity pattern as #320): a third retry mode,
`set_param_backing_on_exhaustion`, forces the proven #204 `param_slots`
frame-backing for call-free functions — params spill to frame slots at entry
and reload on read, so `reserved` empties and a free consecutive pair always
exists after stack spilling (extra_avoid is at most two adjacent pairs among
nine registers; pigeonhole over the free segments). The backend's
select_direct ladder: pass 1 default → pass 2 spill-only (#320, on the
single-reg Err) → pass 3 spill+param-backing (on the pair Err). Functions
that compile on an earlier pass are selected by exactly yesterday's code.
Loop bound unchanged: each spill_deepest_reg iteration converts one
StackVal::Reg to Spilled. Honest remaining bound: the i64 spill-slot pool
("spill-slot pool exhausted"), deliberately NOT retried.

EVIDENCE
- scripts/repro/high_pressure_i64.wat: 4 simultaneously-live i64 consts +
  4 pinned i32 params. On main: skipped with the exact pair Err. On this
  branch: compiles; high_pressure_i64_differential.py (unicorn vs wasmtime,
  i64 result in r0:r1, large/negative vectors) 6/6 ORACLE PASS.
- Bit-identity vs origin/main (cortex-m4, per differential headers):
  control_step 8248…32f6, div_const cada…45ede, flight_seam_flat 03ce…8579,
  high_pressure_i32 355c…e6c2 — all pairwise sha256-identical; all three
  frozen differentials ORACLE PASS on the branch.
- Tests: 5 new (pair victim spill, single victims, pinned-blockers Err
  preserved verbatim, spilled-pair reload on pop, end-to-end 3-pass ladder);
  synth-synthesis 382 lib tests green; workspace 1468 passed / 0 failed.

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

Author: avrabe

crates/synth-backend/src/arm_backend.rs

@@ -160,57 +160,72 @@ fn compile_wasm_to_arm(
     // unmodified default, so every function that compiles today is selected by
     // exactly the code that compiled it yesterday (bit-identity is structural,
     // not behavioural).
-    let select_direct_attempt =
-        |spill_on_exhaustion: bool| -> Result<Vec<ArmInstruction>, synth_core::Error> {
-            let db = RuleDatabase::with_standard_rules();
-            let mut selector =
-                InstructionSelector::with_bounds_check(db.rules().to_vec(), bounds_config);
-            selector.set_target(config.target.fpu, &config.target.triple);
-            if config.num_imports > 0 {
-                selector.set_num_imports(config.num_imports);
-            }
-            // #195: plumb the callee argument-count tables so the direct selector can
-            // marshal call arguments into R0–R3 per AAPCS.
-            selector.set_func_arg_counts(
-                config.func_arg_counts.clone(),
-                config.type_arg_counts.clone(),
-            );
-            // #197: in relocatable host-link mode, emit direct `func_N` BLs for
-            // imports (rewritten to the wasm field name by build_relocatable_elf)
-            // instead of `__meld_dispatch_import`.
-            selector.set_relocatable(config.relocatable);
-            // #237: native-pointer ABI — wasm statics become __synth_wasm_data-relative.
-            selector.set_native_pointer_abi(config.native_pointer_abi, config.linear_memory_bytes);
-            // #311: i64 call results are register PAIRS — tag them.
-            selector.set_result_types(config.func_ret_i64.clone(), config.type_ret_i64.clone());
-            // Stack-pointer promotion is meaningful only under the native-pointer ABI;
-            // gating here keeps every non-native compile (all frozen fixtures) on the
-            // legacy R9 globals-table path, bit-identical.
-            if config.native_pointer_abi
-                && let Some((sp_idx, sp_init)) = config.stack_pointer_global
-            {
-                selector.set_native_pointer_stack(sp_idx, sp_init);
-            }
-            selector.set_spill_on_exhaustion(spill_on_exhaustion);
-            selector.select_with_stack(wasm_ops, num_params)
-        };
+    let select_direct_attempt = |spill_on_exhaustion: bool,
+                                 param_backing_on_exhaustion: bool|
+     -> Result<Vec<ArmInstruction>, synth_core::Error> {
+        let db = RuleDatabase::with_standard_rules();
+        let mut selector =
+            InstructionSelector::with_bounds_check(db.rules().to_vec(), bounds_config);
+        selector.set_target(config.target.fpu, &config.target.triple);
+        if config.num_imports > 0 {
+            selector.set_num_imports(config.num_imports);
+        }
+        // #195: plumb the callee argument-count tables so the direct selector can
+        // marshal call arguments into R0–R3 per AAPCS.
+        selector.set_func_arg_counts(
+            config.func_arg_counts.clone(),
+            config.type_arg_counts.clone(),
+        );
+        // #197: in relocatable host-link mode, emit direct `func_N` BLs for
+        // imports (rewritten to the wasm field name by build_relocatable_elf)
+        // instead of `__meld_dispatch_import`.
+        selector.set_relocatable(config.relocatable);
+        // #237: native-pointer ABI — wasm statics become __synth_wasm_data-relative.
+        selector.set_native_pointer_abi(config.native_pointer_abi, config.linear_memory_bytes);
+        // #311: i64 call results are register PAIRS — tag them.
+        selector.set_result_types(config.func_ret_i64.clone(), config.type_ret_i64.clone());
+        // Stack-pointer promotion is meaningful only under the native-pointer ABI;
+        // gating here keeps every non-native compile (all frozen fixtures) on the
+        // legacy R9 globals-table path, bit-identical.
+        if config.native_pointer_abi
+            && let Some((sp_idx, sp_init)) = config.stack_pointer_global
+        {
+            selector.set_native_pointer_stack(sp_idx, sp_init);
+        }
+        selector.set_spill_on_exhaustion(spill_on_exhaustion);
+        selector.set_param_backing_on_exhaustion(param_backing_on_exhaustion);
+        selector.select_with_stack(wasm_ops, num_params)
+    };
     let select_direct = || -> Result<Vec<ArmInstruction>, String> {
-        match select_direct_attempt(false) {
-            Ok(instrs) => Ok(instrs),
-            // VCR-RA-001 step 3b-lite (#242): the i32 register-exhaustion
-            // hard-fail is recoverable — retry once with spill-on-exhaustion,
-            // which reserves the spill area and spills the deepest stack value
-            // when the pool is full. Only functions that FAILED the first pass
-            // ever reach this, so existing output is untouched by construction.
-            Err(e)
-                if e.to_string()
-                    .contains("all allocatable registers are live on the stack") =>
-            {
-                select_direct_attempt(true)
-                    .map_err(|e| format!("instruction selection failed: {}", e))
-            }
-            Err(e) => Err(format!("instruction selection failed: {}", e)),
+        // The two recoverable exhaustion classes. NOT retried: the i64
+        // spill-slot-pool Err ("spill-slot pool exhausted") — the honest
+        // remaining bound of the 3b-lite allocator.
+        const SINGLE_EXHAUSTION: &str = "all allocatable registers are live on the stack";
+        const PAIR_EXHAUSTION: &str = "no consecutive pair of free registers for i64";
+        let mut attempt = select_direct_attempt(false, false);
+        // VCR-RA-001 step 3b-lite (#242): the i32 register-exhaustion
+        // hard-fail is recoverable — retry with spill-on-exhaustion, which
+        // reserves the spill area and spills the deepest stack value when the
+        // pool is full. Only functions that FAILED the first pass ever reach
+        // this, so existing output is untouched by construction.
+        if let Err(e) = &attempt
+            && e.to_string().contains(SINGLE_EXHAUSTION)
+        {
+            attempt = select_direct_attempt(true, false);
+        }
+        // VCR-RA-001 acceptance increment (#242): the i64 consecutive-PAIR
+        // exhaustion is recoverable too — but not by stack spilling (the pair
+        // allocator already spills stack values, #171): the blockers are the
+        // pinned param home registers. The final retry frame-backs the params
+        // (#204 machinery) so they stop pinning R0-R3, with spill-on-exhaustion
+        // kept on for the single-register pressure the reloads add. Reached
+        // only by functions that failed every earlier pass.
+        if let Err(e) = &attempt
+            && e.to_string().contains(PAIR_EXHAUSTION)
+        {
+            attempt = select_direct_attempt(true, true);
         }
+        attempt.map_err(|e| format!("instruction selection failed: {}", e))
     };
 
     // Instruction selection: optimized or direct.