[alexcgatea]

Summary

Adds the Rewriter operations needed for code motion and inlining — moving and splicing IR, deep copies, and statement creation at an insertion point — plus a one-level call inliner in kirin-function that runs in linear time.

New operations

Operation	What it does
replace_uses_if, replace_all_uses_except_stmt(s)	replace_all_uses restricted to selected use sites
move_before / move_after	Move a statement next to an anchor in any block body
splice_block_before / splice_block_after	Move a block's statements next to an anchor, redirecting its arguments
splice_cfg_after	Move all blocks of a CFG after an anchor block in another CFG
create(insertion_pt, definition) / insert(insertion_pt, stmt)	Create a statement at an InsertionPoint (Before, After, Terminator, DiGraph, UnGraph), or place a detached one
clone_statement, clone_cfg + IRMap	Detached deep copies with fresh ids, including graph bodies. Results and block arguments are always copied, overwriting their IRMap entries, so a map can be reused, even after an earlier copy is gone
kirin_function::inline_calls	Inline one level of same-stage CallSpecialized calls in a CFG

API changes

• insert_before / insert_after / insert_terminator / insert_node / insert_ungraph_node / insert_ungraph_edge are replaced by create(InsertionPoint, definition). One method, with the insertion point as data. An UnGraph member is a node or an edge statement according to its definition, so UnexpectedEdgeStatement / ExpectedEdgeStatement are removed.
• insert(insertion_pt, stmt) only accepts a detached statement of this Rewriter, such as a clone (NotDetached otherwise). Detached statements and CFGs that are never placed are tombstoned when the Rewriter drops; readers of their values are left with dangling operands, which verify_derived reports and run_pass quarantines.
• A detached producer can be placed after its consumers. When insert places it in a graph, it adds the DiGraph edges and UnGraph wire endpoints to consumers already there.
• create adopts the unowned bodies its definition names (e.g. a cloned CFG), with the same checks as replace_statement.
• drain_events is replaced by into_events(self), so the event log only grows while a Rewriter lives, and positions in it stay valid.
• New CFGInfo::parent() accessor. AnchorInsideMoved is renamed MovedIntoItself.

Walk safety

Moving or splicing the statement being visited breaks pre-order, post-order and BFS walks, which find the next statement through the visited one. walk_mut now checks the Rewriter's event log after each visit (MovedStatement, SplicedBlock, SplicedCfg, compared against a VisitedPlace recorded before the visit) and reports WalkError::VisitedMoved. Reverse BFS orders, which build their order up front, still allow it. A loop driving a cursor by hand records VisitedPlace::of(stage, stmt) and the event-log length before each visit, and calls WalkOrder::check_not_moved_since itself.

Inlining

kirin-python's Walk(Inline(...)) scales as O(n²) (#554): each multi-block inline splits the call's block, and the split walks every statement after the call. In heavily inlined kernels most of the program ends up in one block, so every split costs close to the whole program. Calls are also visited first to last, so the same tail is moved again for every later call. inline_calls is built to stay linear:

• Single-block callee: its statements are copied in front of the call, with no split.
• Multi-block callee: the block is split after the call and the copied CFG is spliced in between. It is entered with a branch passing the call's arguments to the copied entry block's arguments, so a callee whose entry block is a loop header keeps its loop-carried values. Each copied ret becomes a branch to the second half.
• Last-to-first order: each block is walked from its last statement to its first, so a split only moves statements after the call, which no earlier split has moved. Each statement moves at most once, and a run is linear in the body's size plus the size of the copied callees. Only the whole-body inline_calls is public, so no single run can inline in a quadratic order.
• Moving the copied blocks is O(blocks): splice_cfg_after relinks them, with no list removal from the front.
• One level: calls brought in by inlined code are left for another run. Running it on callees before their callers inlines everything with one run per function.
• No recursion: it is the caller's responsibility to ensure there is no recursion, self or mutual, among the calls inlined.
• A language implements FunctionOps<T> (as_call / as_return) to tell the inliner which of its statements are calls and returns; a closure builds its branch op.

Not included

• Recursion detection in the inliner (it's one level, so it always terminates).

[alexcgatea]

Closing to split into 3 smaller PRs: #848, #849, #851