Optimizer: execute retained environment references and binding effects natively

Parent: #467; related #465, #466 and #491. Follows #1095. Depends on: #1097 (exact checkpoints after runtime re-entry).

Executed on 2eeae7a: warmed global-name and retained-with binding writers have optimizer artifacts with side exits. A typeof-unresolvable reader and a retained-with call have no optimizer artifact. The admission fixture confirms the remaining opcodes: resolve_binding_ref, load_binding_ref (including WithBaseObject), store_binding_ref and load_var_or_undef.

Controls were executed against Node, direct system JavaScriptCore and zig-js tree/required-VM binaries. Ordinary global writes, typeof absence, strict unresolvable assignment and WithBaseObject call receivers agree. Deletion of a with-object property during RHS evaluation differs between the references: JavaScriptCore and both zig-js modes retain the selected object base and re-create its property; Node redirects this control to the global binding. Native admission must preserve the existing reference behavior rather than resolve a binding again after RHS effects.

Scope: native resolution/load/store/clear of retained References, missing-name typeof reads, named stores and declaration initialization/Annex B eligibility. Preserve exact Environment/Object/static-frame targets, strictness, TDZ and readonly errors, the optional call receiver, and invocation-local storage. Reuse canonical bytecode operations; keep every retained base/value precisely rooted across runtime re-entry and movement. No name-based recognition, frozen environment values, repeated ResolveBinding, missing receiver or callback replay.

Definition of done:

• SSA/native operation metadata covers the complete family, with verifier and allocation-failure qualification and exact effect/exception/root states.
• Entry/region native execution is proved; forced optimizer-off/on controls preserve assignment/RHS order, proxy/unscopables/getter/setter effects, strict/TDZ/readonly errors and call receivers.
• Retained references and invocation-local declaration state survive moving GC, recursion, shared-realm execution, exact budget/termination, and unsuppressed TSan.
• Exact-parent affected corpus, production and appropriate threading/doc gates pass; small conventional implementation/evidence lands on main.

Implementation is in progress. The focused Debug root passed all 13 linked tests. Coverage now includes:

• complete environment-operation metadata and allocation-failure cleanup;
• native entry and loop execution, retained call receivers, proxy/unscopables/RHS ordering, recursive setters and caught exception identity;
• 45 logical-assignment controls matching bytecode results, stored values and exact step counts, plus all four peek-branch modes;
• declaration modes and invocation-local Annex B eligibility;
• four shared-realm workers, actual relocation of retained Reference bases, moving native-loop checkpoints, and exact budget/termination behavior.

The proxy control preserves the separate HasProperty in ECMA-262 Object Environment Record GetBindingValue, even though the reference engines elide that trap in the executed control.

The full optimizer cohort, ReleaseSafe/unsuppressed TSan, exact-parent corpus comparisons and production gates remain pending. No implementation commit has landed yet; the definition of done remains unchecked.

Implemented and pushed to main in 136178ae, on the #1097 checkpoint foundation.

The complete family now has ordered SSA/native effects: missing-name reads, named stores, declaration initialization/Annex B, and retained Reference resolution/load/store/clear. Runtime entry borrows the owning Exec; declarations and references remain invocation-local. WithBaseObject is stored in rooted scratch before any post-callback continuation can exit. Logical-assignment diamonds copy the selected result into the merge and account for their selected path.

Evidence:

• All 225 optimizer tests pass in Debug, ReleaseSafe and unsuppressed TSan; linked TSan instrumentation was verified.
• Retained-writer budget/stop controls: 12/64 mismatches → 0/64. A separate 64-cell getter-produced callable control preserves receiver, getter/method counts, results/errors and exact steps.
• Eight seeded controls agree in optimizer-off/on × serialized/no-GIL configurations. Proxy/unscopables/RHS ordering, recursive setters, caught identity, strict/TDZ/readonly errors and declaration modes/masks pass.
• Actual Reference/result/native-loop relocation and four shared-realm workers pass; generic misses retain the Reference before observable reads.
• Production JIT: 151 pass + one platform skip. VM/concurrency: four cases each. Frontend: 79. Library, relocation inventory, all links in 378 files and checked 51-page build pass.
• Against exact parent ed872e6: 4,582 test262 cases, zero default failures on both sides, identical failing/diverging paths, flips 0 cases. Six existing TCO tree/VM distinctions remain unchanged.
• Threadfuzz: 400 default and 300 broad programs, zero failures.

The extra proxy HasProperty remains backed by Object Environment Record GetBindingValue. The executed JSC and Node controls elide that trap; native admission preserves zig-js's canonical spec-backed sequence.

Hosted CI is queued in run 38040966520. Local validation uses the repository's module/focused gates; the combined cold unit link remains the separate #933 memory-cap constraint. Development timings are not publication evidence or a public throughput claim.