JIT: lower guarded property regions into the native tier

Parent: #44 Successor to: #52 Related: #49 Child: #440 (completed)

Goal

Lower general guarded named-property regions into the native frame ABI without recognizing benchmark source or weakening shared-realm semantics.

Acceptance

• Reuse the existing shape/slot inline-cache contract and parallel seqlock validation; never execute a stale slot assumption.
• Preserve accessors, proxies, prototype changes, non-number values, restricted receivers, GC barriers, exact steps, and resumable side exits.
• Add native-on/off differential tests for monomorphic and polymorphic reads/writes, invalidation, shared mutation, and GC checkpoints.
• Save an exact-parent profile showing a material reduction in residual runChunk leaves and no regression in current quick kernels.
• Pass focused JIT, full unit, no-GIL, and suppression-free TSan gates.

Completed implementation

• #440 snapshots immutable four-entry named-property IC state.
• a35ee76/1832e5b inline guarded isolated-AArch64 reads.
• 85e072e/3934dd0 inline guarded existing-slot writes with the narrow GC barrier.
• 8650a29 covers moving GC, invalidation, malformed slots, and shared mutation.
• ba30d4f lowers guarded property effects inside reducible loop regions.
• 75dd7a8/7299b7b/f55cb51 repair and isolate effect-path coverage.

The saved July 21 exact-parent profile attributes 46.2% of property leaves to generated code and records 52.6% fewer runChunk, 69.1% fewer quick-property, and 40.0% fewer numeric-property leaves than the July 16 baseline. The July 22 clean matrix reports zig-js leads of 1.63x direct / 1.64x at eight steady contexts for monomorphic properties and 2.22x / 2.18x for four-shape polymorphic properties.

Verification: 64/64 focused optimizer tests pass normally and under TSan; the complete suite passes 1,404/1,404 with no failures or leaks, including no-GIL shared mutation and moving-GC property-region coverage.

Correctness foundation from #439 landed in 5603c4b/c0a502b: the optimizer can now execute generic named and computed reads through the rooted runtime-operation ABI, including getters, proxies through ordinary VM semantics, object-key coercion, exact exception continuation, and full named/computed method chains. Property names are artifact-owned. This does not yet claim the guarded shape/slot IC or benchmark-speed acceptance items here; it establishes the resumable fallback-correct read path those specialized regions can target. Broad optimizer TSan passes 152/152; benchmark evidence is intentionally unchanged.

Native property lowering advanced in e81430d: named and computed writes now join reads on the generic precisely rooted runtime-operation path. Setters, proxy traps, assignment results, GC barriers, computed-key ordering, and exact thrown continuations are covered; the batched TSan JIT gate passes 155/155.

This is the correctness path, not the shape/slot inline-cache performance acceptance for #132, so the issue remains open. Docs are current at df57bc7. Latest main CI: https://github.com/zig-utils/zig-js/actions/runs/29893229195

ba30d4f adds native loop-region property effects on top of the guarded four-shape cache contract. Exact benchmark-shaped arithmetic now publishes and enters OSR, numeric property reads fail closed before observable work when a value/shape guard misses, writes retain the existing barrier/callback path, and block-local step deltas preserve exact accounting. Optimizer scratch/root tracking is widened to 128 slots; GC relocation now explicitly covers a live root at slot 69, and the benchmark-shaped artifact asserts its high property inputs are present in precise stack maps.

Evidence: 67/67 optimizer JIT tests pass under TSan; the native-on/off benchmark-shaped moving-GC differential and high-slot relocation witness pass under TSan with zero leaks. A fresh exact-parent macOS sample found 1,868/3,986 collapsed leaves (46.9%) in generated MAP_JIT code; residual runChunk fell from 1,539 to 731 and tryQuickPropertyKernel from 1,626 to 444 versus the saved 2026-07-16 profile. I am holding the profile/README acceptance checkbox until the evidence file is generated from this clean pushed commit.

The one full-unit run reached and passed the new property/GC tests, then exposed independently reproducible failures in recently completed #439 tests. #439 is being reopened and repaired before claiming the full-gate checkbox here.

Completed and verified in the implementation/profile batch documented above. Closing with the July 22 evidence at 69c975e and the full 1,404/1,404 suite green.