fix(ir): release loop-carried locals whose slot widens to boxed storage after their store was lowered

[mirchaemanuel]

Fixes #534 — with the issue's mechanism hypothesis refuted and the real one found at the IR level.

Root cause (not what the issue guessed)

The leaked value was never the assigned local: diffing --emit-ir of the leaky vs clean programs shows the nested case does emit release-old for $s. The real culprit is the inner loop counter: $k++ lowers through the checked-add path whose result is boxed Mixed (overflow-to-float), which widens the counter's frame slot storage Int→Mixed. But the outer body's $k = 0 re-initialization was lowered earlier, while the slot storage still read Int, so release_stored_local_value() early-returned on the stale type and emitted no release. At runtime every store into the (final) Mixed slot boxes — so each outer iteration's re-init orphaned the previous iteration's box: exactly N_outer − 1 leaks, independent of the inner trip count and of the loop body entirely. Proof: an int-only nested body leaks the identical 999 × 40 B on baseline.

Flags isolation confirmed core lowering (leak unchanged under --ir-opt=off, --regalloc=stack, and both).

The fix: defer the release decision until the slot's final storage type exists

The correct decision needs the slot's final storage type, which only exists after the whole body is lowered. So:

• New deferred EIR op ReleaseLocalSlot (src/ir/instr.rs, validator entry): void, LocalSlot immediate, READS_LOCAL | WRITES_HEAP | REFCOUNT_OP.
• src/ir_lower/context.rs — release_stored_local_value_before_retaining_store(): when the slot storage is already lifetime-tracked, the eager load+release is emitted exactly as before (IR unchanged for every previously-correct case). When it is not, and the store is inside a loop (only there can a later store widen it through a back-edge), the deferred op is emitted instead. Ref-bound locals excluded (they release through the ref-cell owner machinery). All three release-old paths in store_local route through it.
• src/ir/builder.rs + src/ir_lower/function.rs — post-lowering prune rewrites the op to Nop when the slot never widened, so scalar slots stay eligible for DSE/load-forwarding (verified in IR: a never-widened slot's op becomes nop; the widened counter's op survives).
• src/codegen/lower_inst.rs — lower_release_local_slot(): skips ref-cell-pointer/promoted slots (defense in depth with the lowering-side exclusion), then releases the occupant typed by the final storage via the existing null-guarded epilogue cleanup emitters (emit_main_string_cleanup/emit_main_refcounted_cleanup, made pub(super)) — target-aware for ARM64 and x86_64, null-safe on the zero-initialized first iteration.
• src/ir_passes/peephole/load_store.rs: op added to the escaping-slots set (slot memory is read directly).
• One sentence added to docs/internals/memory-model.md.

Balance argument: the deferred op makes the same decision the eager path makes for tracked slots — release the previous occupant of a slot a retaining store is about to overwrite — just at the point where the storage type is finally known. The slot is either zero (prologue-initialized; the helpers skip null) or holds the previous retaining store's owned value.

Evidence (base cf47ee101, macOS arm64; every output equal to PHP 8.4.23 pre/post)

Case	baseline	fixed
nested concat, 1000 outer	999 blocks	clean
single-loop control	clean	clean
nested array-element	999	clean
int-only nested body (the smoking gun)	999	clean
5000 outer (N−1 law)	4,999	clean
edge a: conditional assign in inner loop	999	clean
edge b: value used after inner loop / after both	999	clean
edge c: break/continue inner+outer	950	clean
edge d: init before the loops	999	clean
edge e: inner while + triple nesting	898	clean
edge f: non-refcounted ints	999 (the counter box!)	clean
edge g: by-ref param local	499	clean

Post-fix --ir-opt=off and --regalloc=stack also clean.

Real-world gates (the #516 app):

• CLI harness of the app's syntax highlighter (verbatim class, 20 calls): 124,400 → 76,480 live blocks (−2,396/call, the Refcounted local assigned inside a nested inner loop leaks one reference per outer-loop iteration (N−1 law) #534 component); the residual is proven pre-existing by micro-decomposition (array-of-array element-release class, separately tracked).
• Full app under --web, measured with per-request gc counters on a local merge of fix(codegen): release the inner-container temporary of a chained subscript read #524+fix(ir_lower): release the nullable-access hidden temp after its consuming chained read #531+fix(ir_lower): release owned Mixed sources after string coercion (foreach element leak) #532+this: net leak 6,252 → ~31 blocks/request (−99.5%); the latency ramp that reached 1,233 ms by request 90 on main stays under ~75 ms through request 160. (A separate byte-heavy residual — few large blocks, ~370 KB/request — still exhausts a 64 MB heap around request ~175 without recycling; being tracked in --web: linear per-worker latency ramp is a per-request refcount leak (chained subscript reads on nested arrays); --max-requests recycles miscounted by the crash-loop guard #516.)

Tests

4 new regression tests in tests/codegen/runtime_gc/regressions.rs (concat, array element, int-counter, conditional+triple-nesting-in-function): 0/4 pass on a stashed-src baseline build, 4/4 post-fix. Focused suites, 0 failures: loops 37, while 20, foreach 103, runtime_gc 126, nested 124, strings 225, arrays 337, for 446 — 1,418 passed. Zero warnings in both build profiles; debug-profile IR validator clean on all repros and the harness; asm-comment checker and git diff --check clean.

Notes for the maintainer

• Touches src/ir_lower/context.rs and src/codegen/frame.rs in hunks disjoint from fix(ir_lower): release the nullable-access hidden temp after its consuming chained read #531/fix(ir_lower): release owned Mixed sources after string coercion (foreach element leak) #532/fix(codegen): guard container consumers against the null-container sentinel (chained-read miss segfault) #533/fix(codegen): release the inner-container temporary of a chained subscript read #524; tests/codegen/runtime_gc/regressions.rs will union-conflict with the other pending PRs (all sides append tests — resolution is keep-both; verified compiling and passing on the local merge of all of them).
• The deferred op releases raw frame slots only; ref-bound/static/global and promoted ref-cell slots are excluded at both lowering and codegen. Closure by-ref capture of a loop counter goes through the ref-cell owner path exactly as before.
• CI should confirm linux targets; the codegen reuses existing target-aware helpers, no new target-specific code.