`collapse_up` produces a dangling successor for patterns nested past 63 levels

[zharinov]

Summary

A query whose pattern nests deeper than the 63-level Up cap makes collapse_up remove an absorbed Up instruction that is still referenced elsewhere, leaving a dangling successor (malformed IR).

Reproduction

~63+ levels of named-node nesting. Rooted example (63 nested arrays):

q = '(array)'
for _ in range(62):
    q = '(array ' + q + ')'
print(f'Q = (program (expression_statement {q}))')

cargo run -p plotnik -- dump -q "<that query>" -l javascript

Actual vs expected

• ≤ 62 levels: compiles fine.
• ≥ 63 levels: panics, right where the merged Up chain reaches MAX_UP_LEVEL (63) and the merge stops:

[verify] pass `collapse_up` produced malformed IR:
dangling successor Label(7) referenced by Label(133)

Expected: the pattern compiles; the Up chain splits into multiple Up(≤63) instructions with references intact, and the query executes (ascending the full depth across the chain).

In release builds the verify net is compiled out, so the dangling reference instead flows into emit (corrupt layout / "label not in layout"-class failure) rather than this clean panic.

Likely area (hypothesis)

collapse_up removes an absorbed instruction only when its predecessor count is 1 (collapse_up.rs:82-86), but predecessor_count tallies successor edges only (collapse_up.rs:30-35). A label still reachable through a non-successor edge — a Call target/return, a Trampoline return, or a back-edge from a retry/search instruction — is not counted, so it can be removed while a live reference survives. The dangling label sits at the 63-cap merge boundary and is referenced by a much later instruction, consistent with a back-/non-successor edge.

Notes

• Pre-existing, not introduced by the in-flight verify-net work: the Up(1)-chain merge path exits at current_level < MAX_UP_LEVEL before the cap/refuse line, and the predecessor-counting logic is unchanged. The verify net only surfaces it as a clean, early panic at the offending pass.
• Related:
  • IR passes don't preserve successor order, and collapse_prefix has soundness holes #421
  • fix(compiler): IR pass soundness — successor order and scope balance #454