fix(effect): embed Resume<T> scratch in state machine, drop per-perform malloc

cd3184a fixed the j3 stack-lifetime bug by switching the Resume<T>
struct from `Alloca` to `Intrinsic::Malloc(32)`. Correct but unbounded:
every perform-site invocation allocated 32 bytes with no free path.
Long-running programs with hot perform sites would accumulate the
allocations forever.

Reserve a 4-slot region (= 32 bytes, the exact Resume<T> size) at the
end of the state machine. `lower_async_function` now allocates
`num_slots + 4` and returns `resume_scratch_slot` (the base slot
index) in `LowerResult`. `upgrade_resume_struct_at_perform_sites`
takes that slot, computes `r_ptr = sm_ptr + (slot * 8)`, and writes
the four Resume<T> fields there instead of malloc'ing.

The scratch's lifetime matches the state machine's — already heap-
allocated by `generate_sync_entry`'s malloc, never freed today. So no
new free path is needed, and the Resume<T> outlives any out-of-line
capture (j3 still passes — the stashed pointer points into the SM,
valid as long as the SM is alive). Memory cost drops from O(perform-
site invocations) to O(state-machine instantiations).

Known limitation (documented inline): all perform sites in the same
function share this one scratch region. Nested or interleaved performs
with async stashing — host holds k from perform A while perform B's
handler runs — would alias the slot and corrupt the stashed pointer.
Current tests all have a single perform site per function; extending
to N per-perform scratches (one slot region per site) is a future
refinement when multi-perform-with-stash programs land.

Workspace `cargo test --tests` = 1439/0; effect runtime tests all
10/10; clippy + fmt clean.

Author: darmie

crates/passes/krio_adapter/src/abi_emit.rs

@@ -1101,6 +1101,7 @@ pub fn upgrade_resume_struct_at_perform_sites(
     handler_resolution: &std::collections::HashMap<(HirId, InternedString), HirId>,
     poll_fn_id: HirId,
     frame_ptr: HirId,
+    resume_scratch_slot: u32,
 ) {
     // First pass: collect (block_id, inst_idx, metadata) without
     // mutating to avoid borrow conflicts.
@@ -1169,49 +1170,47 @@ pub fn upgrade_resume_struct_at_perform_sites(
         // Mint values + build the new instruction sequence.
         let mut new_insts: Vec<HirInstruction> = Vec::new();
 
-        // r_ptr = malloc(32) — 32-byte heap slot.
+        // r_ptr = sm_ptr + resume_scratch_slot * 8.
         //
-        // Resume<T> structs need to outlive the perform site's stack
-        // frame in the async out-of-line case (phase J.3): the handler
-        // stashes `k` (= this pointer) somewhere reachable from outside
-        // poll_fn, and the host later calls `__zyntax_effect_resume(k, v)`
-        // out-of-line. If `r_ptr` is an Alloca (stack slot), the pointer
-        // is dangling the moment poll_fn returns — every subsequent
-        // dereference reads whatever the runtime stack scribbled over
-        // the old slot.
+        // The Resume<T> struct (4 i64 fields = 32 bytes) lives in a
+        // fixed 4-slot region reserved at the end of the state
+        // machine by `orchestrator::lower_async_function`. Embedding
+        // it in the SM rather than malloc'ing per perform-site
+        // invocation eliminates the per-perform 32-byte leak the
+        // previous `Intrinsic::Malloc(32)` introduced — the scratch's
+        // lifetime matches the SM's (already heap-allocated, never
+        // freed today), so no new free path is needed.
         //
-        // On macOS / Linux x86_64 the stack region below the old rsp
-        // happens to survive long enough for synthetic test harness
-        // paths to read the stale-but-intact Resume struct. On
-        // x86_64-pc-windows-msvc the intervening Rust frames between
-        // poll_fn's return and the out-of-line invocation overwrite
-        // the old slot — typically clearing `next_state` to 0, which
-        // routes the dispatcher's Switch to `default = resume_entries[0]`
-        // (the perform site) instead of the resume entry, producing
-        // wrong results for `phase_j3_async_out_of_line_resume`.
+        // Resume<T> structs must outlive the perform site's stack
+        // frame in the async out-of-line case (phase J.3): the
+        // handler stashes `k` (= this pointer) somewhere reachable
+        // from outside poll_fn, and the host later calls
+        // `__zyntax_effect_resume(k, v)` out-of-line. An Alloca
+        // (stack slot) would dangle the moment poll_fn returns; a
+        // malloc'd buffer works but leaks. The SM-embedded slot
+        // gives us the outlive semantics with no extra allocation.
         //
-        // Heap-allocate to make every perform site's Resume<T> live as
-        // long as someone has a pointer to it. The 32 bytes leak on
-        // every perform (no free hook yet) — bounded by the program's
-        // total perform-site execution count; a future Tier 3 refinement
-        // can refcount or arena-collect.
+        // Limitation: all perform sites in this function share this
+        // one scratch region. Nested or interleaved performs with
+        // async stashing (host holds k from perform A while perform
+        // B's handler runs) would alias the slot and corrupt the
+        // stashed pointer. Current tests all have a single perform
+        // site per function; extending to N per-perform scratches is
+        // a future refinement when multi-perform-with-stash programs
+        // land.
+        let scratch_offset_bytes = (resume_scratch_slot as i64) * 8;
+        let scratch_offset_id = mint_const_i64(&mut function.values, scratch_offset_bytes);
         let r_ptr_id = mint_value(
             &mut function.values,
             HirType::Ptr(Box::new(HirType::U8)),
             HirValueKind::Instruction,
         );
-        let r_size_id = mint_value(
-            &mut function.values,
-            HirType::I64,
-            HirValueKind::Constant(HirConstant::I64(32)),
-        );
-        new_insts.push(HirInstruction::Call {
-            result: Some(r_ptr_id),
-            callee: HirCallable::Intrinsic(Intrinsic::Malloc),
-            args: vec![r_size_id],
-            type_args: vec![],
-            const_args: vec![],
-            is_tail: false,
+        new_insts.push(HirInstruction::Binary {
+            result: r_ptr_id,
+            op: BinaryOp::Add,
+            ty: HirType::I64,
+            left: frame_ptr,
+            right: scratch_offset_id,
         });
 
         // r_poll_fn_ptr = CreateClosure(poll_fn_id) (self-reference).

crates/passes/krio_adapter/src/orchestrator.rs

@@ -96,6 +96,24 @@ pub struct LowerResult {
     /// Used by the entry function to size the malloc. Computed as
     /// `max(captures_slot, state_slot, param_slots) + 1`.
     pub num_slots: u32,
+    /// Base slot index of the 4-slot region reserved at the END of the
+    /// state machine for the Resume<T> struct scratch space. The
+    /// algebraic-effects perform-site lowering writes its 32-byte
+    /// Resume<T> (poll_fn_ptr / state_machine_ptr / result_slot_offset
+    /// / next_state) into `sm_ptr + resume_scratch_slot * 8` rather
+    /// than calling malloc(32) per perform-site invocation. The struct
+    /// lives as long as the state machine does — no per-perform heap
+    /// allocation, no leak.
+    ///
+    /// Limitation: all perform sites in the same function share this
+    /// one scratch region. Nested or interleaved performs with async
+    /// stashing (host holds k from perform A while perform B's
+    /// handler runs) would alias the slot and corrupt the stashed
+    /// pointer. Current tests all have a single perform site per
+    /// function; extending to N per-perform scratches (one per site)
+    /// is a future refinement when multi-perform-with-stash programs
+    /// land.
+    pub resume_scratch_slot: u32,
 }
 
 /// Errors the orchestrator may surface.
@@ -245,7 +263,16 @@ pub fn lower_async_function(
         state_slot,
         after_awaits_slot,
     );
-    let num_slots: u32 = after_performs_slot;
+    // Reserve 4 slots at the end for the Resume<T> struct scratch
+    // space (4 i64 fields: poll_fn_ptr, state_machine_ptr,
+    // result_slot_offset, next_state). Embedding it in the state
+    // machine instead of malloc'ing per perform-site invocation
+    // eliminates the bounded-but-unbounded leak the previous
+    // `Intrinsic::Malloc(32)` introduced — the scratch's lifetime
+    // matches the SM's (already heap-allocated, never freed today),
+    // so no new free path is needed.
+    let resume_scratch_slot: u32 = after_performs_slot;
+    let num_slots: u32 = after_performs_slot + 4;
 
     // F.2 follow-up: the await lowering creates new resume blocks
     // that may now be predecessors of phi blocks (e.g. loop headers
@@ -270,6 +297,7 @@ pub fn lower_async_function(
         param_slots,
         state_slot,
         num_slots,
+        resume_scratch_slot,
     })
 }
 

crates/zyntax_embed/src/runtime.rs

@@ -959,6 +959,7 @@ fn apply_krio_effect_lowering(module: &mut zyntax_compiler::HirModule) -> Runtim
             &handler_resolution,
             new_poll_id,
             post_reshape_frame_ptr,
+            lower_result.resume_scratch_slot,
         );
 
         // Phase 3: SYNC entry wrapper (returns T, not *Promise<T>).