mir/vm: SSA pin+PHI + short-circuit; user-defined method calls → functions; entry single-pred PHIs; compare-operand pin; VM BoxCall fallback to InstanceBox methods; docs: update CURRENT_TASK (plan + acceptance)

- Lower And/Or to branch+PHI (RHS not evaluated)
- Always slotify compare operands (dominance safety)
- Insert single-predecessor PHIs at then/else/short-circuit entries
- pin_to_slot now logs (NYASH_PIN_TRACE) and participates in PHI
- Rewrite user-defined instance method calls to Box.method/Arity (builder)
- VM fallback: BoxCall on InstanceBox dispatches to lowered functions with 'me'+args
- Keep plugin/BoxCall path for core boxes (String/Array/Map)
- Add env-gated pre-pin for if/loop (NYASH_MIR_PREPIN)
- CURRENT_TASK: add SSA/userbox plan, debug steps, acceptance criteria

src/backend/mir_interpreter/handlers/boxes.rs

@@ -481,6 +481,23 @@ impl MirInterpreter {
                 ))),
             }
         } else {
+            // Dynamic fallback for user-defined InstanceBox: dispatch to lowered function "Class.method/Arity"
+            if let Some(inst) = recv_box.as_any().downcast_ref::<crate::instance_v2::InstanceBox>() {
+                let class_name = inst.class_name.clone();
+                let arity = args.len(); // function name arity excludes 'me'
+                let fname = format!("{}.{}{}", class_name, method, format!("/{}", arity));
+                if let Some(func) = self.functions.get(&fname).cloned() {
+                    let mut argv: Vec<VMValue> = Vec::with_capacity(arity + 1);
+                    // Pass receiver as first arg ('me')
+                    argv.push(recv.clone());
+                    for a in args {
+                        argv.push(self.reg_load(*a)?);
+                    }
+                    let ret = self.exec_function_inner(&func, Some(&argv))?;
+                    if let Some(d) = dst { self.regs.insert(d, ret); }
+                    return Ok(());
+                }
+            }
             Err(VMError::InvalidInstruction(format!(
                 "BoxCall unsupported on {}.{}",
                 recv_box.type_name(),