JIT: add optimizing profiles, IR, and tier publication

[chrisbbreuer]

Parent: #146
Blocks: #429
Related: #132, #133

Introduce the optimizer's architecture-neutral profiling and IR pipeline, distinct from the existing baseline numeric tier. Compilation counters and shell observability must report installed optimizing code, never warmup guesses or compatibility constants.

Acceptance

• Add per-function call/branch/type/value/shape profiles with race-free snapshots; profiles remain advisory and every speculation is guarded.
• Define optimizing IR, control-flow graph, SSA/value representation, canonicalization, and dead-code elimination with deterministic dumps.
• Add a separate optimizing-tier state machine, compile claims, immutable publication, invalidation generations, and real compile counters.
• Lower an initial portable numeric/control subset through the optimizer and preserve interpreter/baseline fallback.
• Add native-off/baseline/optimizer differential tests, publication races, rejection caching, and counter convergence tests.
• Document the supported optimizer subset and keep unsupported functions explicitly below the optimizing tier.

Landed checkpoints

• ec65181: race-free advisory profiles, distinct publication/counter state, deterministic CFG foundation, and fail-closed subset selection.
• 3736fc5: block-argument SSA for locals and operand stacks, loop backedges, effect-aware canonicalization, dead-value elimination, stable dumps, and invalid stack-merge rejection.
• 9cede38: serialized publication/invalidation, generation-stamped claims, cached rejection, race convergence, and install-only 64-bit counters.
• 74fd22d: first executable optimizer artifact for exact primitive-constant SSA returns on supported AArch64 hosts, owner-leased publication/invalidation, optimizer-first dispatch, exact step accounting, and native-off/baseline/optimizer differential evidence.
• 951c5c5: architecture-neutral virtual-register lowering for guarded Number parameters, optimizer-native AArch64 arithmetic/comparisons, pre-accounting side exits, and ordinary direct-call dispatch with exact fallback.
• e3f411a: explicit SSA branch values, portable exact two-way control selection, AArch64 native branch dispatch, equal-path step proof, and fail-closed rejection of asymmetric paths/merges/loops.

Completion boundary

This issue establishes and executes the initial portable numeric/control optimizer subset. General merges/loops and unequal-path accounting require OSR/deoptimization/checkpoint reconstruction and remain under #432; property/array regions, concurrent artifact semantics, backend completion, and PR-249 promotion remain under #132, #133, #433, #434, and #429.

[chrisbbreuer]

Landed the first optimizer-foundation checkpoint in ec65181.

• per-function entry, branch, backedge, value-kind, and shape observations, with per-entry deltas merged atomically;
• a distinct optimizer publication state/generation/counter model that never reports warmup as installed code;
• deterministic architecture-neutral CFG plans for the initial numeric/control bytecode subset;
• fail-closed rejection for unsupported opcodes and invalid jump targets;
• baseline-native and interpreter entry/result accounting; and
• concise README plus optimizer/baseline documentation that explicitly says plans do not execute yet.

Focused evidence: test-jit 100/100 passed; both VM optimizer-profile and native-entry probes passed 3/3 with zero leaks.

No acceptance box is checked yet: SSA/value IR, canonicalization/DCE, guarded lowering/execution, full publication lifetime safety, and native-off/baseline/optimizer differential evidence still need to land.

[chrisbbreuer]

Landed the SSA/canonicalization checkpoint in 3736fc5. The optimizer plan now carries deterministic block-argument SSA for function entry, locals, operand stacks, branches, and loop backedges; it canonicalizes safe pure values, eliminates dead values, retains operations that may perform observable coercion, and rejects incompatible stack merges. Focused JIT evidence is 102/102 passing with zero leaks. Acceptance item 2 is now checked; execution/lowering and the remaining publication/profile evidence stay open.

[chrisbbreuer]

Landed publication hardening in 9cede38. Generation-stamped claims now serialize with invalidation, stale publishers fail without disturbing a newer compiler, rejection is cached, and publish/invalidate races converge while only successful installs increment the 64-bit counter. Focused JIT evidence is 103/103 passing with zero leaks. Profile acceptance is now checked; artifact publication/counter acceptance remains open until an executable optimizer artifact exists.

[chrisbbreuer]

Landed the first executable optimizer artifact in 74fd22d. One reachable primitive-constant SSA return (numeric arithmetic/comparisons only) now lowers to immutable native code on supported AArch64 hosts, publishes under the context owner lease, runs ahead of baseline once hot, preserves exact bytecode steps, and increments the optimizer counter only after installation. Unsupported live arguments are rejection-cached and continue through baseline/bytecode. Evidence: normal and TSan focused JIT suites both pass 106/106 with zero leaks; native-off/baseline/optimizer and rejection-fallback VM probes each pass 3/3. Acceptance 3, 5, and 6 are checked; portable guarded numeric/control lowering remains open.