JIT: add optimizing profiles, IR, and tier publication

Parent: #146 Blocks: #429 Related: #132, #133

Introduce the optimizer's architecture-neutral profiling and IR pipeline, distinct from the existing baseline numeric tier. Compilation counters and shell observability must report installed optimizing code, never warmup guesses or compatibility constants.

Acceptance

• Add per-function call/branch/type/value/shape profiles with race-free snapshots; profiles remain advisory and every speculation is guarded.
• Define optimizing IR, control-flow graph, SSA/value representation, canonicalization, and dead-code elimination with deterministic dumps.
• Add a separate optimizing-tier state machine, compile claims, immutable publication, invalidation generations, and real compile counters.
• Lower an initial portable numeric/control subset through the optimizer and preserve interpreter/baseline fallback.
• Add native-off/baseline/optimizer differential tests, publication races, rejection caching, and counter convergence tests.
• Document the supported optimizer subset and keep unsupported functions explicitly below the optimizing tier.

Landed checkpoints

• ec65181: race-free advisory profiles, distinct publication/counter state, deterministic CFG foundation, and fail-closed subset selection.
• 3736fc5: block-argument SSA for locals and operand stacks, loop backedges, effect-aware canonicalization, dead-value elimination, stable dumps, and invalid stack-merge rejection.
• 9cede38: serialized publication/invalidation, generation-stamped claims, cached rejection, race convergence, and install-only 64-bit counters.
• 74fd22d: first executable optimizer artifact for exact primitive-constant SSA returns on supported AArch64 hosts, owner-leased publication/invalidation, optimizer-first dispatch, exact step accounting, and native-off/baseline/optimizer differential evidence.
• 951c5c5: architecture-neutral virtual-register lowering for guarded Number parameters, optimizer-native AArch64 arithmetic/comparisons, pre-accounting side exits, and ordinary direct-call dispatch with exact fallback.
• e3f411a: explicit SSA branch values, portable exact two-way control selection, AArch64 native branch dispatch, equal-path step proof, and fail-closed rejection of asymmetric paths/merges/loops.

Completion boundary

This issue establishes and executes the initial portable numeric/control optimizer subset. General merges/loops and unequal-path accounting require OSR/deoptimization/checkpoint reconstruction and remain under #432; property/array regions, concurrent artifact semantics, backend completion, and PR-249 promotion remain under #132, #133, #433, #434, and #429.

Landed the first optimizer-foundation checkpoint in ec65181.

• per-function entry, branch, backedge, value-kind, and shape observations, with per-entry deltas merged atomically;
• a distinct optimizer publication state/generation/counter model that never reports warmup as installed code;
• deterministic architecture-neutral CFG plans for the initial numeric/control bytecode subset;
• fail-closed rejection for unsupported opcodes and invalid jump targets;
• baseline-native and interpreter entry/result accounting; and
• concise README plus optimizer/baseline documentation that explicitly says plans do not execute yet.

Focused evidence: test-jit 100/100 passed; both VM optimizer-profile and native-entry probes passed 3/3 with zero leaks.

No acceptance box is checked yet: SSA/value IR, canonicalization/DCE, guarded lowering/execution, full publication lifetime safety, and native-off/baseline/optimizer differential evidence still need to land.

Landed the SSA/canonicalization checkpoint in 3736fc5. The optimizer plan now carries deterministic block-argument SSA for function entry, locals, operand stacks, branches, and loop backedges; it canonicalizes safe pure values, eliminates dead values, retains operations that may perform observable coercion, and rejects incompatible stack merges. Focused JIT evidence is 102/102 passing with zero leaks. Acceptance item 2 is now checked; execution/lowering and the remaining publication/profile evidence stay open.

Landed publication hardening in 9cede38. Generation-stamped claims now serialize with invalidation, stale publishers fail without disturbing a newer compiler, rejection is cached, and publish/invalidate races converge while only successful installs increment the 64-bit counter. Focused JIT evidence is 103/103 passing with zero leaks. Profile acceptance is now checked; artifact publication/counter acceptance remains open until an executable optimizer artifact exists.

Landed the first executable optimizer artifact in 74fd22d. One reachable primitive-constant SSA return (numeric arithmetic/comparisons only) now lowers to immutable native code on supported AArch64 hosts, publishes under the context owner lease, runs ahead of baseline once hot, preserves exact bytecode steps, and increments the optimizer counter only after installation. Unsupported live arguments are rejection-cached and continue through baseline/bytecode. Evidence: normal and TSan focused JIT suites both pass 106/106 with zero leaks; native-off/baseline/optimizer and rejection-fallback VM probes each pass 3/3. Acceptance 3, 5, and 6 are checked; portable guarded numeric/control lowering remains open.

Landed guarded parameter execution in 951c5c5.

• optimizer SSA now lowers into an architecture-neutral virtual-register program rather than delegating to baseline bytecode lowering;
• the AArch64 optimizer backend executes guarded Number parameters/constants through arithmetic and relational/equality operations, including canonical NaN handling;
• ordinary direct calls dispatch optimizer artifacts with caller-owned slots;
• every representation guard runs before bytecode-step accounting, and a mismatch retries baseline/bytecode with untouched state;
• differential evidence covers installed-artifact counters, numeric native hits, string-coercion fallback, and identical native/fallback step deltas;
• README and optimizer documentation now describe the guarded straight-line subset.

Focused evidence is green with zero leaks: normal and TSan test-jit are both 108/108, the optimizer full-root filter is 17/17, and the guarded parameter probe passes in normal and TSan modes.

The final acceptance box remains open: control-flow/merge lowering is the next slice.

Completed in e3f411a.

The final control slice adds explicit branch conditions to the architecture-neutral graph and lowers one guarded Boolean split into two terminal SSA results only when both paths have the same exact bytecode-step cost. Both AArch64 native paths, ordinary hot-call dispatch, install-only counters, and native/baseline step convergence are covered; asymmetric paths, merges, loops, remainder, and coercions remain fail-closed.

Final focused evidence: normal and TSan test-jit pass 110/110, and the normal and TSan optimizer full-root filters pass 19/19 with zero leaks. The broader work continues under #146/#432/#433/#434 rather than expanding this completed foundation issue.