feat(codegen): turn the segment-view lowering on by default - #9912

DRAFT. Gated on two things, neither of which is done:

1. fix(compile): put PERRY_SEGVIEW in the cache identity, and clear the segment-view cursor at loop exit #9910 must land first. It puts PERRY_SEGVIEW into the build-cache
   identity. Flipping the default while the switch is absent from that identity
   would bake the hole into every build rather than every A/B — a cached
   binary could be served for a source compiled under the other setting. fix(compile): put PERRY_SEGVIEW in the cache identity, and clear the segment-view cursor at loop exit #9910
   is also the parent of this branch, so this diff is the one-line flip on top
   of it.
2. A main-vs-default-on rotation on perrymaster. Everything measured so far
   set PERRY_SEGVIEW=1 explicitly. Default-on is a different configuration —
   it is what every compile in the tree does, including ones nobody chose it
   for — and it has not been rotated. Until that row exists this is unmeasured
   in the form it would ship.

The change

One line, plus the doc comment it invalidates:

-pub fn segview_lowering_enabled() -> bool {
-    matches!(std::env::var("PERRY_SEGVIEW"), Ok(v) if !v.is_empty() && v != "0")
+pub fn segview_lowering_enabled() -> bool {
+    !matches!(std::env::var("PERRY_SEGVIEW"), Ok(v) if v == "0")
 }

PERRY_SEGVIEW=0 becomes the opt-out. It stays because a switch that changes
emitted code needs an off position that does not require rebuilding the
compiler; a program whose loops the tier declines pays nothing either way.

Why the default should move, once gated

On claude-code, with #9893's levers, paired against main on a quiet box:
−14 % CPU MIN (5/5 faster), −30…−42 MB peak RSS (5/5), settled RSS flat,
output identical; 4.8–5.3× node from main's 5.6–6.3×. On the probe's region A
— cc's per-.segment()-call shape — 2,262 → 1,554 ns/grapheme against node's
1,323, i.e. 1.17× node. Rows and their provenance are in #9859.

Without #9893's levers the same tier costs +15 % CPU, which is why the
gating on it is not a formality.

The test

Asserts the default through the same environment read the compiler uses: unset
⇒ on, 0 ⇒ off, 1 ⇒ on. Every other segview test calls the rewrite directly,
so a predicate that was accidentally always-false would leave all of them
passing while the tier silently never fired in a real compile — the #9824
shape, and the reason this assertion is worth its three lines.

18 segview tests pass on this branch.

Default-on gate on main 504e180d0 (perrymaster, cc 3300-char reply, 5-round interleaved rotation; paired deltas)

Identity from the artefacts: with PERRY_SEGVIEW unset and no diag, the branch rewrites the same nine sites as the opt-in build (view call sites next/open 20/10 vs 0/0 on main), so the flip does exactly what the env switch did.

400-char turn: default-on alone +0.09…+0.20 s (3/3 slower), with the levers −0.05…−0.11 s (3/3 faster); peak −9…−35 MB either way.

Consequence: this flip must land together with or after #9893. On its own it fails the campaign's CPU rule (+3…+5 % at 3300, +7…+14 % at 400) while buying peak RSS; with the levers it is the I7-view result on the current base. Absolute numbers on this host currently carry a ~35 % shift from a foreign service; the pairs above are interleaved and hold. Raw: combDO.jsonl, idleDO.jsonl.

Rebased onto main (2026-09-07)

The base PRs this branch was stacked on landed on main via merge train #9922, so the branch was rebased onto current main: head 9b9aedda2 → e495a1e24, replay patch-identical (only this branch's own commits remain above main). The measurements above were taken on the pre-rebase head with the same code; CI on this head is the remaining gate.