JSON.parse: reuse cached immutable shape-edge state for private object writes

Parent: #473

Measured problem

After #1007, JSON.parse constructs unpublished ordinary objects through Object.setOwnUnpublished. Repeated records reuse immutable Shape transitions, but each write still walks lookupState(name) before probing the transition cache. For a cached addition edge, that parent-chain proof is redundant: the immutable edge already proves the key is absent/deleted and names the resulting slot.

Executed exact-parent ReleaseFast/real-GC screen against pushed f3639ef2 (three alternating pairs, exact frozen checksums):

• representative_json: 0.9883x retired instructions;
• representative_json_variant: 0.9822x retired instructions;
• depth-4096 stringify control: 0.9993x instructions;
• shallow-4096 stringify control: 1.0006x instructions.

The ordinary unique-shape fanout path is source-identical to the parent and was checked separately because its randomized shape topology makes three samples noisy. Across 21 alternating pairs it measured 1.0013x median retired instructions (1.25% / 1.35% RSD), 0.9929x median wall time, and exact checksums.

Scope

• Add a Shape write plan that reuses a cached immutable addition/deletion edge before parent-chain lookup.
• Admit it only from the unpublished/private object-write path used by JSON.parse.
• Preserve the existing public/generic setOwnUnlocked implementation byte-for-byte.
• Preserve immediate delete/re-add undo, stable slots, property order, indexed-property flags, allocation failure behavior, and the locked racing-publication recheck.

Acceptance

• Seven alternating exact-parent pairs retain the JSON gains with exact checksums and neutral stringify/fanout controls.
• JSON test262 is 165/165 and the same 165 files agree in required-VM mode.
• Focused Shape/value tests cover cached additions, cached deletions, and existing-value writes.
• Real-GC OOM/deep-input tests pass.
• Value-layer and no-GIL JSON.parse TSan witnesses pass.
• Commit lands directly on main with evidence linked here and in #473.

Landed directly on main in b2c9982f.

The unpublished JSON object-write path now probes the immutable Shape edge before walking parent state. Cached additions carry their resulting Shape and exact target slot; cached deletion edges prove the property is already present. Cache misses retain the writer lock and racing-publication recheck. The ordinary/public setOwnUnlocked implementation has a zero-line diff from the parent.

Final corrected seven-pair ReleaseFast/real-GC evidence against exact pushed parent f3639ef2:

Instruction RSD is 0.41–0.55% on the two target rows, and every sample stayed at macOS thermal state 0. Raw per-invocation files are preserved locally under /private/tmp/zig-js-json-prod.83FAYc/pairs-1008-corrected-final-7.

Qualification:

• 124/124 real-GC value/Shape tests in Debug;
• 124/124 value/Shape tests under ThreadSanitizer;
• 33/33 real-GC JSON unit/OOM/GC tests;
• 165/165 JSON test262;
• 165/165 tree/required-VM agreement;
• exact four-thread shared no-GIL JSON.parse TSan witness (2/2 linked tests);
• 50,000-level array/object nesting throws the expected catchable RangeError in both tiers, while a 96-level valid value succeeds;
• guarded link peak 2.04 GB, below the 3 GB host limit.

During review, the new exact-slot test caught an immediate delete/re-add case where the returned parent Shape's latest slot differs from the deleted slot. The landed plan therefore carries the target slot separately; no workaround or input-specific assumption remains.