Parent: #473
Measured problem
The production representative_json invocation at current main takes 2,216,853 conservative-interior ownership bucket locks out of 4,615,990 total slab-lock acquisitions. Most scanned machine words are ordinary non-heap values, but classifyConservativeInterior currently probes every size class before it can reject them.
Candidate
Maintain a monotonic, ever-issued slab-address envelope in GcCellBacking. A coherent lock-free read can reject an address outside that envelope before any bucket lock. The envelope intentionally never shrinks when tail chunks are trimmed: stale inclusion only falls back to the exact existing lookup, while stale exclusion would be unsafe.
A ReleaseFast prototype preserves the exact checksum, cell/allocation counts, and collection counts while moving:
- conservative-interior locks: 2,216,853 → 11,277 (-99.5%)
- ownership locks: 2,233,415 → 27,839 (-98.8%)
- total slab locks: 4,615,990 → 2,410,414 (-47.8%)
A three-pair exact-parent screen is positive on the sustained rows:
representative_json: 0.9931x instructions, 0.9688x CPU, 0.9700x wall- anti-specialization variant: 0.9982x instructions, 0.9717x CPU
- escaped strings: 0.9962x instructions, 0.9804x CPU
- shallow stringify: 1.0001x instructions, 0.9737x CPU
- reviver/depth controls remain near instruction parity; the 1-job cold controls remain checksum controls below the timing floor
Definition of done
- Prove coherent concurrent expansion and no false-negative rejection; chunk trimming may only leave a conservative superset.
- Pin the zero-bucket-lock rejection path and the in-range exact fallback in focused tests, including TSan.
- Preserve JSON test262 results and required VM/tree agreement.
- Preserve deep-input, OOM, no-GIL, and GC relocation/ownership behavior.
- Record seven interleaved exact-parent samples with identical checksums and no hidden control regression.
- Land as one conventional commit on
main, close this issue with raw evidence, and update #473.