perf(codegen): reduce accumulators earn the packed fast clone's numeric proof — s += arr[i] at node parity (was 5.3×) - #9060

…erryTS#9062

The branch's commit was authored over a tree predating PerryTS#9060/PerryTS#9062 and
committed onto a newer base, so it carried deletions of files its own parent
contains: PerryTS#9060's whole `stable_packed_accumulator.rs` (273 lines) and its
build-cache knob, plus PerryTS#9062's `for_multi_decl_tests.rs`, its
`issue_9052_for_lexical_declarators.rs` integration test, the `Module` field and
its stable-hash entry, and ~40 test-fixture updates. 477 deletions in total.

Replayed the six files that are genuinely this change onto current main
instead: closure.rs, function.rs, helpers.rs, hoisted_callback_calls.rs,
collectors/mod.rs and the fragment. Net diff vs main is now additions only,
with zero deletions.

Also fixes two gate failures of its own:

* PERRY_CALLEE_BINDING_RESOLUTION was unregistered, failing
  `codegen_env_vars_are_build_cache_inputs`. Registered as an INPUT: the two
  settings emit different call sequences, so a cached object from one must not
  serve the other.
* `local_binding_type_audit.py` wants the new `local_type_hint` read
  classified. Recorded as `runtime-validated`: the declared function type only
  narrows which bindings are ATTEMPTED, while
  `js_closure_resolve_arrow_direct_call(handle, arity)` validates identity and
  arity at runtime, so a wrong declared type yields a failed resolution and the
  ordinary dynamic call rather than a wrong callee.

Fragment renumbered 0000 -> 9071.

The branch's commit was authored over a tree predating #9060/#9062 and
committed onto a newer base, so it carried deletions of files its own parent
contains: #9060's whole `stable_packed_accumulator.rs` (273 lines) and its
build-cache knob, plus #9062's `for_multi_decl_tests.rs`, its
`issue_9052_for_lexical_declarators.rs` integration test, the `Module` field and
its stable-hash entry, and ~40 test-fixture updates. 477 deletions in total.

Replayed the six files that are genuinely this change onto current main
instead: closure.rs, function.rs, helpers.rs, hoisted_callback_calls.rs,
collectors/mod.rs and the fragment. Net diff vs main is now additions only,
with zero deletions.

Also fixes two gate failures of its own:

* PERRY_CALLEE_BINDING_RESOLUTION was unregistered, failing
  `codegen_env_vars_are_build_cache_inputs`. Registered as an INPUT: the two
  settings emit different call sequences, so a cached object from one must not
  serve the other.
* `local_binding_type_audit.py` wants the new `local_type_hint` read
  classified. Recorded as `runtime-validated`: the declared function type only
  narrows which bindings are ATTEMPTED, while
  `js_closure_resolve_arrow_direct_call(handle, arity)` validates identity and
  arity at runtime, so a wrong declared type yields a failed resolution and the
  ordinary dynamic call rather than a wrong callee.

Fragment renumbered 0000 -> 9071.

Co-authored-by: Ralph Küpper <ralph@skelpo.com>

…umulator proofs, hazard relaxation

Follow-up to PerryTS#9060/PerryTS#9063/PerryTS#9070: the packed-loop admission residuals behind
the compare-only and reduce shapes.

1. If-conditions were invisible to the stable-packed matcher (PerryTS#9060's
   documented residual): stmt_flags / leading_read_requires_numeric
   matched only Let/Expr/Throw/Return, so `if (arr[i] < 0) count++`
   never admitted — and later reads inside If branches were invisible to
   the replay-safety check. Both now descend; `Compare` joins `Binary`
   as a numeric-consumption context (a wrong hint fails the
   require_numeric guard into the generic loop, never a wrong answer).

2. Numeric accumulators for the plain packed clones (versioned + range):
   `s += a[i]` inside a packed fast clone lowered its `+` through
   js_dynamic_string_or_number_add on EVERY iteration plus two root
   barriers — the by-construction collector runs before clone facts
   exist, so `s` had no proof. The packed fast preheaders now run
   PerryTS#9060's collect_numeric_accumulators with one Number tag test each (a
   non-Number accumulator takes the slow clone before anything ran), and
   the ids ride PackedF64LoopFact.numeric_accumulators, consulted by
   is_numeric_expr — the same mechanism and kill switch as the stable
   clone.

3. Guarded reads are numeric inside clones: has_numeric_index_fact and
   the boxed-fallback hazard predicate now recognize packed
   versioned/range facts and masked-window facts — the clone's read
   either produces a genuine raw double or side-exits BEFORE the value
   is consumed, so there is no boxed edge. This turns `if (a[i] < 0)`
   into a bare fcmp (was js_rel_lt per iteration) and feeds the
   accumulator walk.

4. Versioned-loop READ bodies take the store arm's relaxed eligibility:
   a call-free read body cannot invalidate what the entry guard
   re-proves, so the whole-function materialization hazard (tripped by
   the very `new Array(n).fill()` construction calls that build these
   buffers) no longer blocks versioning — locally-built arrays version
   at all. Same argument, word for word, as the existing store-arm
   comment; the two invalidation tests that pinned the read-side
   conservatism now pin the versioned-behind-guard contract their store
   twin already used.

A stable-tier literal-bound arm was built and WITHDRAWN: plain-array
literal bounds already version through the range loop, and the arm
re-claimed five-field object-write bodies that
nested_same_shape_object_writes deliberately keeps outside any clone.

Isolated (dev box; node 26.5 in parens):
count loop `if (a[i]<0) c++`      4.58 -> 1.60 ns/el (0.62)
literal reduce `i<8192, s+=a[i]`  4.32 -> 4.16       (1.01)
len-bound reduce (local array)     5.30 -> 4.14       (0.99)
The count loop's residual is the per-iteration length IC, which PerryTS#9070's
hoist removes at merge. The reduce rows are now call-free (census: fadd
plus the loop poll only) and latency-bound on the accumulator's GC-root
slot — true parity there needs unboxed accumulator slots in clones,
scoped as the follow-on.

Nine-probe differential vs node byte-identical, incl. a string
accumulator (tag test -> slow clone -> concat), a literal bound past the
array length (guard fail -> undefined += NaN), holey/mixed arrays, and
an accumulator reassigned to a string mid-loop through a branch.
perry-codegen suites 1823/0.

…umulator proofs, hazard relaxation

Follow-up to PerryTS#9060/PerryTS#9063/PerryTS#9070: the packed-loop admission residuals behind
the compare-only and reduce shapes.

1. If-conditions were invisible to the stable-packed matcher (PerryTS#9060's
   documented residual): stmt_flags / leading_read_requires_numeric
   matched only Let/Expr/Throw/Return, so `if (arr[i] < 0) count++`
   never admitted — and later reads inside If branches were invisible to
   the replay-safety check. Both now descend; `Compare` joins `Binary`
   as a numeric-consumption context (a wrong hint fails the
   require_numeric guard into the generic loop, never a wrong answer).

2. Numeric accumulators for the plain packed clones (versioned + range):
   `s += a[i]` inside a packed fast clone lowered its `+` through
   js_dynamic_string_or_number_add on EVERY iteration plus two root
   barriers — the by-construction collector runs before clone facts
   exist, so `s` had no proof. The packed fast preheaders now run
   PerryTS#9060's collect_numeric_accumulators with one Number tag test each (a
   non-Number accumulator takes the slow clone before anything ran), and
   the ids ride PackedF64LoopFact.numeric_accumulators, consulted by
   is_numeric_expr — the same mechanism and kill switch as the stable
   clone.

3. Guarded reads are numeric inside clones: has_numeric_index_fact and
   the boxed-fallback hazard predicate now recognize packed
   versioned/range facts and masked-window facts — the clone's read
   either produces a genuine raw double or side-exits BEFORE the value
   is consumed, so there is no boxed edge. This turns `if (a[i] < 0)`
   into a bare fcmp (was js_rel_lt per iteration) and feeds the
   accumulator walk.

4. Versioned-loop READ bodies take the store arm's relaxed eligibility:
   a call-free read body cannot invalidate what the entry guard
   re-proves, so the whole-function materialization hazard (tripped by
   the very `new Array(n).fill()` construction calls that build these
   buffers) no longer blocks versioning — locally-built arrays version
   at all. Same argument, word for word, as the existing store-arm
   comment; the two invalidation tests that pinned the read-side
   conservatism now pin the versioned-behind-guard contract their store
   twin already used.

A stable-tier literal-bound arm was built and WITHDRAWN: plain-array
literal bounds already version through the range loop, and the arm
re-claimed five-field object-write bodies that
nested_same_shape_object_writes deliberately keeps outside any clone.

Isolated (dev box; node 26.5 in parens):
count loop `if (a[i]<0) c++`      4.58 -> 1.60 ns/el (0.62)
literal reduce `i<8192, s+=a[i]`  4.32 -> 4.16       (1.01)
len-bound reduce (local array)     5.30 -> 4.14       (0.99)
The count loop's residual is the per-iteration length IC, which PerryTS#9070's
hoist removes at merge. The reduce rows are now call-free (census: fadd
plus the loop poll only) and latency-bound on the accumulator's GC-root
slot — true parity there needs unboxed accumulator slots in clones,
scoped as the follow-on.

Nine-probe differential vs node byte-identical, incl. a string
accumulator (tag test -> slow clone -> concat), a literal bound past the
array length (guard fail -> undefined += NaN), holey/mixed arrays, and
an accumulator reassigned to a string mid-loop through a branch.
perry-codegen suites 1823/0.

…umulator proofs, hazard relaxation (#9084)

Follow-up to #9060/#9063/#9070: the packed-loop admission residuals behind
the compare-only and reduce shapes.

1. If-conditions were invisible to the stable-packed matcher (#9060's
   documented residual): stmt_flags / leading_read_requires_numeric
   matched only Let/Expr/Throw/Return, so `if (arr[i] < 0) count++`
   never admitted — and later reads inside If branches were invisible to
   the replay-safety check. Both now descend; `Compare` joins `Binary`
   as a numeric-consumption context (a wrong hint fails the
   require_numeric guard into the generic loop, never a wrong answer).

2. Numeric accumulators for the plain packed clones (versioned + range):
   `s += a[i]` inside a packed fast clone lowered its `+` through
   js_dynamic_string_or_number_add on EVERY iteration plus two root
   barriers — the by-construction collector runs before clone facts
   exist, so `s` had no proof. The packed fast preheaders now run
   #9060's collect_numeric_accumulators with one Number tag test each (a
   non-Number accumulator takes the slow clone before anything ran), and
   the ids ride PackedF64LoopFact.numeric_accumulators, consulted by
   is_numeric_expr — the same mechanism and kill switch as the stable
   clone.

3. Guarded reads are numeric inside clones: has_numeric_index_fact and
   the boxed-fallback hazard predicate now recognize packed
   versioned/range facts and masked-window facts — the clone's read
   either produces a genuine raw double or side-exits BEFORE the value
   is consumed, so there is no boxed edge. This turns `if (a[i] < 0)`
   into a bare fcmp (was js_rel_lt per iteration) and feeds the
   accumulator walk.

4. Versioned-loop READ bodies take the store arm's relaxed eligibility:
   a call-free read body cannot invalidate what the entry guard
   re-proves, so the whole-function materialization hazard (tripped by
   the very `new Array(n).fill()` construction calls that build these
   buffers) no longer blocks versioning — locally-built arrays version
   at all. Same argument, word for word, as the existing store-arm
   comment; the two invalidation tests that pinned the read-side
   conservatism now pin the versioned-behind-guard contract their store
   twin already used.

A stable-tier literal-bound arm was built and WITHDRAWN: plain-array
literal bounds already version through the range loop, and the arm
re-claimed five-field object-write bodies that
nested_same_shape_object_writes deliberately keeps outside any clone.

Isolated (dev box; node 26.5 in parens):
count loop `if (a[i]<0) c++`      4.58 -> 1.60 ns/el (0.62)
literal reduce `i<8192, s+=a[i]`  4.32 -> 4.16       (1.01)
len-bound reduce (local array)     5.30 -> 4.14       (0.99)
The count loop's residual is the per-iteration length IC, which #9070's
hoist removes at merge. The reduce rows are now call-free (census: fadd
plus the loop poll only) and latency-bound on the accumulator's GC-root
slot — true parity there needs unboxed accumulator slots in clones,
scoped as the follow-on.

Nine-probe differential vs node byte-identical, incl. a string
accumulator (tag test -> slow clone -> concat), a literal bound past the
array length (guard fail -> undefined += NaN), holey/mixed arrays, and
an accumulator reassigned to a string mid-loop through a branch.
perry-codegen suites 1823/0.

Co-authored-by: Ralph Küpper <ralph@skelpo.com>