NFR walks: explicit worklist, not native recursion, over typed bodies (floor stack overflow)

[gunbai-bot]

The required floor's non-fold-residue check (gunbc#12610) walked typed bodies by native recursion on the main thread: typed_collect_wildcard_arms (v1_compiler.cli_run.non_fold_residue) and fac_walk_body_marks (v1_compiler.cli_run) under it. Body depth is corpus-shaped, so this is the unbounded native-stack walk class (gunbc#10610). On gunbc#12526's widened diff scope the floor aborted twice at the same point, right after strict-preparation completed (5,541 modules): thread 'main' has overflowed its stack. It printed no refusal row and no typed cause.

Repair

Both walkers now use an explicit worklist. The thread and its stack size are unchanged; moving the walk onto a bigger-stack thread would only raise the threshold. Nothing else changes: the same nodes are visited, the same facts and marks are produced, and the caller still sorts facts and undetermined_sites.

Receipts (by execution)

• Discriminating control (nfr_typed_tests::deep_body_is_judged_on_a_main_thread_sized_stack): the fixture is a 20,000-term + chain. It is typed on a large-stack thread, then judged by the floor's own call, non_fold_residue_diff_verdict, on an 8 MiB thread (the Linux main-thread size).
  • At head 19e0d49: passes (44 s). All 15 non_fold_residue tests pass; clippy -D warnings is clean.
  • With origin/main's walkers restored and the same test: thread '<unknown>' has overflowed its stack, rc=101.
  • Calibration on the recursive walk: 4,000, 6,000, 8,000 and 12,000 terms complete; 20,000 aborts. The worklist completes at every depth.
• Behaviour preserved, identity-diffed: the real walk (typed_fallback_arm_walk, unfiltered) ran over the entry closure of gunbc#12512's changed .dag files (98 entries → 1,115 sources, 1,113 typed modules), on a 1 GiB thread where base doesn't overflow. The base and head reports are byte-identical, sha256 ebc3062c…, with an empty diff. The report covers 744 facts (site, class, closed, lane), 524 residue sites, 9 undetermined sites and every covered path.
• Caveat: cargo test --lib runs on no CI path (declared drop gunbc.rung_drop rust_unit_tests_off_the_merge_path). The control is enrolled in the unit-test population, but it doesn't block a merge until that lane returns.

Seed standing

This modifies hand-written host Rust in the v1 seed. Under gunbc.v1_maintenance_standing v1_seed_standing, it is admitted by purpose: it serves the required floor, the gate every v2 change lands through. It adds no semantics and no growth surface: two walkers change shape and one test is added.

Coordination

• gunbc#12980 (NFR roster) collides with this PR. Its commit 3734d72 wraps the same two recursions in stacker::maybe_grow, because its floor hit the same overflow. Agreed with its owner: whichever PR lands second takes this PR's worklist versions of both functions and drops the stacker blocks.
• gunbc#12526 waits on this PR.

🤖 Generated with Claude Code