Back-merge riina #11 — structured WASM control flow for selagi/ulang

[ib823]

A fourth riina commit that landed while #81 was in flight. My earlier "the fork is closed" was premature — this is the correction.

ib823/riina main is now f20e7ba8a, not c83f0e0c9. I caught it because the mirror-safety check I ran before considering a force-push showed proof's loops_differential.rs was 250 lines smaller than riina's, which had no business being true after #81. That traced to a commit that did not exist when I first surveyed the divergence.

Had I trusted the earlier survey and run the normal sync path, this commit would have been destroyed.

What it does

The WASM backend refused every loop. emit_structured knew only forward if/else regions, so a back edge had no structure to map onto — it failed closed (REQ-78) rather than emit the one-shot shape that loops were introduced to fix. So after #8 made loops work in the interpreter and C, WASM still could not compile one.

It now emits a block wrapping a loop, condition re-tested inside the loop so it observes the body's writes, br_if to leave, br 0 for the back edge and lanjut, br 1 for putus. Depths come from a frame stack, so nesting and loop control from inside an if arm resolve to the right label.

Back edges are found by dominance over reachable blocks, not block order — and the commit is explicit that both halves are load-bearing: the lowerer allocates a loop's exit block before the body it follows, so putus branches to a lower index than the block it leaves. Index order would read that as a back edge and invent loops that are not there. Dominators are Cooper/Harvey/Kennedy; the set-of-dominators fixpoint was written first and measured 1.8× the cost of all other WASM emission on a ~2,400-block function.

It also fixes a second WASM-only silent wrong answer it uncovered: the lowerer typed every + result Int unless an operand was in the numeric tower, so string concatenation came out Ty::Int. WASM dispatches cetak/cetakln on the static type — its values are untagged, unlike C's runtime tags — so every cetakln("x=" + ke_teks(x)) sent a pointer through the integer path.

Verification

Cherry-picked cleanly onto main (no conflicts). The check that matters is three-backend agreement on a program exercising both fixes — a loop, a mutable local, and a string concatenation in the printed value:

biar ubah i = 0;
selagi i < 5 { cetakln("i=" + ke_teks(i)); i = i + 1; }

backend	output
interpreter	i=0 i=1 i=2 i=3 i=4
C	i=0 i=1 i=2 i=3 i=4
WASM (wasmtime)	i=0 i=1 i=2 i=3 i=4

Byte-identical. Before #11 the WASM column would have been a build refusal; before the concat fix it would have printed a pointer.

• 3322 Rust tests, 0 failed (+4)
• corpus holds at 97/172
• clippy clean; audit-docs.sh 0 discrepancies, 0 warnings

The mirror is still not safe to force-push

riina/main is a moving target — it gained a commit during a single session's work. Until the mirror direction is settled, sync-public.sh should still only be run with --reconcile, and any future mirror push should be preceded by the same content check that caught this one rather than by a remembered survey.

---

Generated by Claude Code