VM: build a fast no-JIT execution tier for restricted hosts

Parent: #459 Depends on: #465, #461 Related: #466, #481, #500

Goal

Build a genuinely fast no-JIT execution tier for platforms, deployments, and security policies that cannot publish executable memory.

Current boundary

The tree-walker is the semantic baseline and the VM primarily provides suspend/resume, deep recursion, proper tail calls, and native-tier substrate. Existing quick kernels accelerate selected shapes, but there is no declared broad no-JIT performance contract. #465 makes correct code bytecode-eligible; this issue makes that bytecode competitive without executable mappings.

Scope

• Establish interpreter/VM attribution for every #460 workload with native tiers forcibly disabled.
• Implement general adaptive quickening, typed/specialized bytecodes, superinstructions, inline caches, threaded or otherwise efficient dispatch supported by Zig, activation/frame reuse, and narrow runtime helpers.
• Specialize property/index/call/arithmetic/control/allocation paths from runtime observations with exact versioned guards and dequickening.
• Preserve debugger/statement hooks, step/watchdog accounting, exceptions/finally, async/generator suspension, proper tail calls, moving GC roots, invalidation, OOM, and no-GIL synchronization.
• Bound quickened metadata/code growth and reset it safely on invalidation, realm teardown, memory pressure, or changed assumptions.
• Publish no-JIT cold/warm, code/metadata memory, latency, and 1/8-context evidence independently from JIT results.

No-workaround rules

• No source/function/benchmark recognizer, giant semantic-shape kernel, computed-result cache, disabled checks/hooks/GC, unsafe direct object storage, or fallback to a native executable mapping.
• A quick path must be a general bytecode/runtime specialization with exact miss and dequickening behavior.

Acceptance

• A machine-readable bytecode/quickening coverage and rejection inventory names every specialization and remaining dispatch family.
• Forced tree-walker/VM and quickening-off/on differentials match result, exception, effects, steps, jobs, debugger behavior, OOM, termination, and teardown.
• Moving GC, no-GIL, TSan, test262, PR-249, generators/async, threadfuzz, and fault gates pass with JIT unavailable.
• #461 profiles prove dispatch/runtime reductions across predeclared #460 rows with bounded metadata/RSS.
• No-JIT performance and memory are published for every declared restricted platform; fallback is not counted as a native-tier success.

Foundation

Existing VM quickening and activation-stack work live in src/vm.zig; current architectural boundary is documented in docs/architecture.md and docs/advanced/execution-tiers.md.

Quickening inventory child #659 is complete in eabd80b2, with dependency classification in faa25a83. The generated inventory distinguishes 5 general adaptive, 2 bounded structural, and 9 legacy narrow families, while keeping six broad dispatch families explicitly unsupported. Source/test anchors, guards, misses, lifetime, no-GIL synchronization, debugger boundaries, tags/plans/metadata/counters, release compatibility, benchmark validation, docs, links, and the dependency audit all pass. This establishes the no-JIT coverage baseline without counting tree-walker fallback or benchmark-shaped kernels as broad quickening; flips 0 Test262 cases.

No-JIT VM capability leaf #704 landed in feat(compiler): lower nullish coalescing expressions (#704). General ?? no longer forces an interpreter fallback: program/plain/generator/async admissions share the existing nullish peek opcode with exact short-circuit and abrupt ordering. Full units, focused TSan/frontend, and 24-case exact Test262 accounting pass with zero regressions.

No-JIT VM leaf #705 landed in 8fe68869: member logical assignments now execute natively in plain/generator/async bytecode with one-shot base/key/ToPropertyKey and exact short-circuit/write semantics. The safe top-level boundary is explicit in #706 because program chunks still lack activation-local scratch. Full units, TSan, frontend, and 78-case exact corpus accounting pass without regressions.

Expanded proven VM coverage via feat(compiler): lower member compound assignments (#707). All 12 ordinary member compound operators now lower for plain/generator/async functions while preserving one-shot reference resolution, Number/BigInt/coercion semantics, strict write failures, recursion, and key/RHS suspension. Forced tree-walker vs required-bytecode matched; Test262 compound-assignment remained 0/454 failures before and after with byte-identical diagnostics; full units were clean.

Expanded the no-JIT VM surface in #708 / 1f925020: member prefix/postfix updates now lower across plain/generator/async bytecode without a new opcode, tree-walker callback, or shared scratch. The same change corrected VM to_numeric so postfix string operands return the required Number. TSan member witnesses passed 3/3 and the full suite passed 1,808/1 skip with no failures or leaks.

#709 / ee0e0520 expands the fast no-JIT surface for computed and super tagged templates using existing get_index, super_get*, template_object, and receiver-aware call/tail-call operations. TSan passed 7/7 and no stack/runtime primitive or fallback callback was added.

Landed child #710 in e818a068: strict tail-position named/computed super calls are bytecode-eligible through tail_call_with_this, with exact receiver/order/suspension witnesses. Relevant Test262 stayed 102/102 with 0 flips/regressions; full units passed 1,814 / 1 skipped / 0 failed / 0 leaked.

Opened #711 to remove compiler-only admission barriers around the VM’s existing spread call/construct operations, including computed member receiver preservation. It is scoped to existing opcodes and exact tier differentials; tail spread remains a separate missing-op boundary.

Related #711 landed in d1c8251b — feat(compiler): lower spread calls and constructors (#711): ordinary program/plain/generator/async spread calls and constructors now use the existing variadic bytecode family with exact receiver and evaluation ordering. Exact call/new/super Test262 remained 245/245 with byte-identical diagnostics and 0 regressions.

Optional-chain bytecode eligibility is now tracked in #712. It is scoped to compile-owned branch patching over existing nullish/member/call operations, with no program scratch or stacks/queues/jobs runtime changes.

The optional-chain admission lane tracked in #712 landed on main in ef067c10. It uses existing nullish jumps and call/property operations only; full units are green and exact optional-chaining Test262 remains 38/38 with zero regressions.

Opened #713 to add owned bytecode deletion operations and compiler lowering for member/optional/value delete, preserving Proxy/attribute/strict semantics without activation scratch or tree-walker callbacks.

No-JIT progress: #713 landed in 7a1932cf. Owned delete bytecodes now keep property/value deletion on exact VM execution, including optional short-circuit, strict failure, Proxy/Symbol behavior, suspension, and moving-GC relocation. Full units were 1,822 pass / 1 established skip / 0 fail.

Child #714 landed on main in ffeedf57. The compiler/VM now owns load_import_meta; unsupported native tiers reject once and retain exact VM execution. Declaring-module identity is proven across host entry, parameter defaults, generator/async suspension, confirmed nursery relocation, concurrent first use, and OOM retry. Full units: 1,826 pass / 1 established skip / 0 fail / 0 leak; Test262 import-meta remains 22/22.

Child #719 landed in 2388fd77 — feat(compiler): lower proper tail spread calls (#719). Strict ordinary spread calls now retain terminal activation replacement across direct, member, optional, parenthesized-optional, and super forms with precise native roots. Full units were 1,844 passed / 1 skipped / 0 failed or leaked; focused TSan was 4/4; exact-parent call/optional/super/return Test262 stayed byte-identical at 240/240 with 0 regressions.

Opened #725 for the next causal no-JIT admission gap: replace the generator-only enum_keys + user-visible Array iterator lowering with an owned for-in enumerator shared by program/plain/generator/async tiers. The child explicitly owns deleted-key rechecks and forbids Array iterator/IteratorClose observability; it does not touch stacks, queues, jobs, Promise, or Worker lifecycle.

#725 landed in 44371d94: the compiler now lowers for-in through private operand-stack enumeration state instead of the user-modifiable Array iterator protocol. Program member/pattern intermediates use #706 scratch; return/throw/outer labels clean state through completion-aware bytecode. Test262 remained 115/115 and full units passed 1,850 + 1 skip.

Restricted-host VM progress: #726 landed in 525aa677. Plain functions and methods with array/object destructuring assignments now stay in bytecode across frame, upvalue, global, member, and super targets; object-rest exits retain exact roots and no hidden tree-walker bind_pattern executes inside the admitted chunk. Full units and focused TSan are green, with exact assignment/dstr Test262 unchanged at 368/368. #498 remains open for the broader fast no-JIT tier.

Progress: #728 is complete in feat(compiler): lower strict arguments objects (#728). Compiler and VM admission now distinguish exact arguments ownership from direct eval, lower strict unmapped arguments into precise frame slots, and reject both baseline and optimizing native entry until activation inputs are modeled. Final units were 1,856 pass / 1 skip / 0 fail / 0 leak; exact relevant Test262 remained 1,323 -> 1,323 with 0 regressions.

Opened #729 as the next bounded no-JIT admission leaf after #728. It owns sloppy simple-parameter arguments mapping into VM frames, including bidirectional aliases, duplicate formals, descriptor severing, precise escaped-slot tracing, and native-tier rejection until exact support exists. No stacks/queues/jobs surface is in scope.

26b8c248 completes the sloppy mapped-arguments portion tracked by #729: dedicated mapped local/upvalue bytecodes preserve bidirectional aliases and escaped-frame ownership while ordinary local opcodes stay branch-free. Full normal and TSan unit gates pass.

The named-rest compiler/VM barrier is complete in #735: cadfab9b plus OOM restoration (742cbb8e) and shared immutable-chunk no-GIL/TSan (48e2ab0f) witnesses. Exact relevant Test262 accounting stayed 2,319 → 2,319 with zero regressions.

Compiler/VM coverage advanced via #736 in e2ba5ac3: eligible array/object formals now lower into precise frame bindings, with exact activation metadata, unmapped non-simple arguments, activation-elision guards, deterministic OOM recovery, and shared-chunk no-GIL/TSan coverage. Exact relevant Test262 remains 5,023 → 5,023 with zero regressions.

Restricted-host VM coverage advanced again via #738 in d95aaf63: exact primitive literal defaults now carry immutable indices, unmapped arguments, ordered frame entry, malformed-metadata validation, BigInt OOM recovery, and shared-chunk no-GIL/TSan proof. Relevant Test262 remained 10,296 → 10,296 with zero regressions.

Parameter-frame coverage advanced in #739 via feat(compiler): lower closed default expressions (#739). The VM now evaluates recursively closed primitive defaults at call entry with short-circuiting, throws/OOM, GC roots, malformed-layout guards, and no-GIL/TSan behavior covered.

Restricted-host VM coverage advanced in #740 via feat(compiler): lower invocation defaults (#740). Invocation-context leaves reuse the no-JIT parameter prologue with OOM, GC, debugger/native guards, and shared no-GIL/TSan behavior preserved.

The no-JIT VM now handles exact earlier-formal default references through #741 and feat(compiler): lower earlier parameter defaults (#741), reusing frame slots and the ordered entry prologue with shared no-GIL/TSan parity.

Follow-on compiler slice #742 landed on main in 54c54afe. It composes the proven primitive (#739), invocation-context (#740), and earlier-parameter (#741) leaves through the existing safe unary/binary/logical/conditional/sequence grammar, with byte-identical Test262 results (10296 -> 10296) and full normal/TSan/no-GIL/OOM validation.

Follow-on compiler slice #743 landed on main in 1b7e8e58. It extends #742's proven parameter-safe grammar to non-optional public named/computed property reads while reusing canonical guarded VM [[Get]] execution. Test262 stayed byte-identical (10296 -> 10296); full normal/TSan/no-GIL/OOM and 400-iteration default/TSan threadfuzz gates passed.

Follow-on compiler slice #744 landed on main in 402e805a. It extends #743's proven parameter-safe value/property grammar to non-optional, non-spread value and member calls while reusing canonical receiver-aware VM execution. Test262 stayed byte-identical (10296 -> 10296); full normal/TSan/no-GIL/OOM and default/TSan threadfuzz gates passed.

#745 landed on main as feat(compiler): lower parameter construction defaults (#745). It extends the fail-closed plain-function grammar from #744 to recursively safe non-spread construction using canonical new_call, with exact Test262 accounting (10,296 -> 10,296; 0 flips), full units, no-GIL/TSan, OOM, and fuzz coverage. The next constructor-specific compiler boundary discovered by this work is tracked in #746.

The base-class instance-initializer slice #747 landed on main in d9d480d0. Required bytecode now owns the complete pre-parameter public/private/auto-accessor field prefix, computed Symbol/string keys, lexical field context, GC/OOM unwind, and shared no-GIL execution with no interpreter callback or hidden fallback.

Evidence: 8,426 → 8,426 relevant Test262 class cases with 0 failures/0 flips; full units 1,891 pass, 1 skip, 0 fail/leak; frontend 25/25; threadfuzz 400/0 normal and TSan. The remaining constructor boundary is derived super()/uninitialized-this activation semantics in #746.

Prerequisite milestone #746 is now complete through #747 and #748. Base and derived constructors execute with complete no-JIT VM semantics, while afb9ce2c also applies derived completion at native/OSR exits without disabling tier eligibility. The 8,426-case class corpus, no-GIL TSan witness, full units, and threadfuzz are clean. Broader quickening/performance work remains tracked here.

#771 advanced in c82295c2: the no-JIT VM now has the live slot-binding/GC infrastructure needed for direct eval without snapshots or interpreter callback. The feature remains causally unadmitted pending complete materialization and verification.

Related direct-eval activation work advanced in f525dd46: compiler scope plans can now be materialized lazily over exact live VM frames with moving-GC roots and failure-atomic publication. #771 remains admission-closed pending opcode/context completion.

Restricted-host VM work advanced via #771 in 03f7bc58: ordinary activation eval calls now have non-AST bytecode opcodes for fixed/spread/tail forms and exact live-slot access. Admission remains closed until the full eval environment contract is complete.

Direct-eval VM progress: 1761996e preserves sloppy eval declarations across calls via a retained activation Environment and gives GC an atomic trace/relocation edge. Parsing/early errors and non-string eval remain allocation-free. Focused normal 3/3 and TSan 2/2 pass; admission is still fail-closed for unresolved activation contexts.

Direct-eval VM progress: 9e9462a8 converges nested/re-entrant defining-frame Environment caches through atomic publication with precise barriers and relocation-safe candidate roots. Focused normal and TSan checks each pass 2/2 with no leaks; broad admission remains fail-closed.

Related #771 landed parse-phase classification in 4f792e14 and ordinary simple-frame direct-eval admission in a74f2029. Required bytecode now exposes exact live parameters/locals/lexicals and mapped arguments through activation plans; nested/reentrant frames and persistent sloppy declarations agree with the forced tree walker. Incomplete parameter, method/constructor, and runtime-Environment cases remain causally rejected. Focused compiler probes pass 4/4 and direct-eval units pass 16/16 in normal and TSan modes; #771 remains open for the broader matrix and full gates.

The escaping activation/GC portion related to #771 landed in c422cf78: eval-created closures retain live VM activation bindings across return and forced moving compaction, while ShadowRealm wrapper/realm side roots are now precisely traced and relocated. Direct-eval focused tests are 18/18 in normal and TSan builds.

The fast no-JIT VM gained another correctness-preserving eligibility slice in commit 1f594e7b (#776): body-only direct eval in default-parameter functions now uses distinct parameter/body activation records and an exact defining-frame probe, with no hidden interpreter fallback. Full units are green (1,961 passed, 1 skipped); focused normal/TSan, moving-GC, and deterministic OOM witnesses pass. No performance claim is made.

Direct-eval activation coverage advanced in commit f49add08. Parameter eval now materializes a failure-atomic live activation record before initializer bytecode; escaping closures, moving GC, recursion, injected OOM, TSan, and a four-worker no-GIL witness all preserve exact per-activation identity. The full unit suite is green and threadfuzz completed 400 programs with 0 failures.

Commit 04913596 closes #776 and adds exact VM entry semantics for mixed/default/destructuring rest parameters. The six ordinary scope-param-rest-elem required-bytecode witnesses pass, targeted TSan/shared no-GIL is green, and full units report 1,967 passed / 1 skipped / 0 failed / 0 leaked. The optimizer rejects the new activation-owned tail opcode until a native frame descriptor can carry it; no performance claim is made.

The first acceptance item is complete through #659 and its drift gate. The current source-derived inventory names 17 guarded families (6 general adaptive, 2 bounded structural, 9 legacy narrow), and explicitly records the five broad property/index/call/control/allocation dispatch families that remain unsupported. It binds those entries to the current plan/tag/Chunk/candidate/counter sets and fails closed on identity, anchor, state, or classification drift.

This updates only the parent checklist; the remaining #498 correctness, conformance, attribution, and publication requirements stay open.

A concrete part of the remaining index-dispatch work is complete in #1045 / 63866b8b: VM computed access now quickens primitive Number keys on TypedArrays without allocating a property-key string or entering generic [[Get]]. The inventory still leaves TypedArray writes, arguments objects, sparse/holey arrays, prototype-indexed properties, and dynamic coercion/exotic cases explicitly unsupported.

The primitive-Number TypedArray set_index gap is complete in #1046 / 52614c1e. It reuses the canonical RHS coercion and post-coercion buffer revalidation path, including resize/grow/detach and BigInt behavior. The remaining index-dispatch inventory now names sparse/holey Arrays, prototype-indexed properties, arguments objects, and string/Symbol/object key paths explicitly.

#1047 is complete in 360c1ea. Primitive numeric reads and stores on direct mapped and unmapped arguments objects now use guarded VM paths while preserving live parameter aliases, delete/redefinition severance, accessors, attributes, generic key coercion, and no-GIL restriction ownership.

The source-derived inventory remains 17 guarded entries and 5 unsupported families. Remaining index-dispatch work is sparse/holey arrays, prototype-indexed properties, and string/Symbol/object key paths with their observable proxy/accessor semantics.

Three general indexed-opcode leaves are complete:

• #1048 / 3d1de164: present dense reads remain quick on holey arrays while holes and inherited values stay generic.
• #1049 / 552fec15: primitive numeric sparse own-data reads use a coherent named-descriptor snapshot.
• #1050 / dcdeab40: existing writable sparse own-data stores use an exact synchronized replacement; dense stores tolerate unrelated sparse data.

All three match Node edge matrices and pass focused normal/unsuppressed TSan coverage. The source-derived inventory remains 17 guarded families and 5 unsupported families. Remaining index-dispatch work is sparse property creation, prototype-indexed properties, and string/Symbol/object key paths with observable proxy/accessor semantics.

#1051 is complete in 7046af6: canonical primitive String indices now use the guarded Array and arguments-object read/store paths, including dense, holey, sparse, mapped, and unmapped cases.

The focused normal and unsuppressed TSan matrix passed 2/2, the quickening inventory remains internally consistent at 17 guarded and 5 unsupported families, all 19 aggregate validators passed, and the generated docs passed 51-page/378-link validation.

The remaining indexed-property boundaries are sparse property creation, prototype-indexed properties, and generic non-canonical String, Symbol, object ToPropertyKey, Proxy, and accessor cases.

#1052 is complete in ebdbf6a. VM set_index now quickens guarded dense Array creation for append, hole fill, and bounded gap growth with primitive Number and canonical String keys.

The path reuses the existing prototype-aware mutation gate, now checks restriction ownership across the receiver and prototype chain, and keeps distant sparse creation and every observable descriptor/Proxy/coercion case on ordinary [[Set]]. The Node matrix passed 13/13; focused normal and unsuppressed TSan coverage is green; all 19 aggregate validators and the 51-page/378-link docs gates pass.

The remaining indexed-property work is distant sparse property creation, prototype-indexed reads/updates that can be safely cached, and generic non-canonical String, Symbol, object ToPropertyKey, Proxy, and accessor cases.

#1053 is complete in 14ec355. Distant primitive Number and canonical String Array indices now have an exact create-only VM path, including multiple sparse keys and correct Array length publication.

The helper uses one indexed/property/element transaction after receiver/prototype ownership checks and refuses existing properties, descriptors, nearby dense indices, observable coercion, Proxies, and published JIT shape dependencies. The sparse-array suite passes 8/8 in both normal and unsuppressed TSan builds; the Node oracle matrix passes 11/11; all 19 aggregate validators and the 51-page/378-link docs gates pass.

The remaining indexed-property work is prototype-indexed reads/updates that can be safely cached and generic non-canonical String, Symbol, object ToPropertyKey, Proxy, and accessor cases.

#1054 is complete in 10bb4e3. Primitive Number and canonical String reads can now load exact dense or sparse named data from the direct Array prototype through coherent receiver/prototype indexed snapshots.

Receiver-owned data retains precedence; accessors, Proxies, exotics, deeper chains, observable keys, and restriction failures stay generic. The Node oracle passes 10/10, focused normal and unsuppressed TSan coverage passes 3/3, all 19 aggregate validators pass, and the docs gates remain 51 pages / 378 links.

The remaining indexed-property boundary is inherited writes plus prototype accessors, Proxies, and deeper chains, along with generic non-canonical String, Symbol, and object ToPropertyKey cases.

The indexed quickening boundary advanced in #1057 / 22305c8: primitive canonical numeric String keys now use the direct TypedArray Get/Set path, including exact -0, invalid-index, RHS-coercion, BigInt, and resizable/detached-buffer behavior. Nine focused tests pass normally and under unsuppressed TSan, including four actual no-GIL workers.

Review and execution also identified and fixed three correctness gaps:

• #1055 / 4cd0601: descending sparse creation preserves the existing Array length.
• #1056 / 9bbd36e: collection backing elements stay private, and mapped arguments prototypes read live parameter cells.
• #1058 / 9eb494e: rounded decimal TypedArray names such as 9007199254740993 remain ordinary properties without RHS numeric coercion.

The local pinned Test262 corpus is initialized again. Before/after evidence is now available for these semantic boundaries: #1056 has 861 passing corpus cases plus 587 tree/VM agreements; the TypedArray work has 240 passing internals cases plus 240 tree/VM agreements. All measured before/after runs have zero failures/divergences and zero flips.

The broad #498 acceptance remains open; inherited indexed writes, deeper/exotic prototype paths, and generic observable key cases remain separate work.

Two inherited-property correctness boundaries are complete:

• #1059: TypedArray ancestors resolve canonical numeric Get/HasProperty themselves, including valid data, invalid-index termination, primitive receivers, and restriction ownership. Direct/inherited/primitive/VM reads share IntegerIndexedElementGet. The 297-case targeted corpus and 240-case tree/VM witness remain byte-identical with zero failures/divergences.
• #1060: primitive indexed misses now use the rooted canonical property algorithm. The duplicate walker and primitive/wrapper constructor fallback are removed, receiver identity and absent-vs-undefined slot presence are preserved, and actual GC/throw recovery is pinned. All 1,789 targeted primitive builtin cases remain byte-identical with zero failures.

These repair canonical fallback semantics; they do not promote the remaining broad quickening families or make a throughput claim. General inherited indexed writes, deeper/exotic adaptive paths, and observable key specialization remain open here.

Closed #1069 in 8473c06: String exotic ancestors now disqualify indexed creation, intrinsic append, and vector exposure fast paths, preserving readonly virtual UTF-16 characters. Numeric/String strict and sloppy writes plus push now match Node in both tiers. Focused normal and unsuppressed TSan tests pass, including four actual no-GIL workers. All 3,109 targeted corpus and paired tree/VM cases are byte-identical before/after, with zero failures or divergences. #1070 tracks the separately executed indexOf/lastIndexOf virtual-character miss; its large-length scan guard is also under audit. This is correctness evidence, not a throughput claim.

Closed #1071 in 3c139f9 and #1070 in 9928b46. Borrowed Array methods now read live mapped-arguments cells; searches share String-aware prototype classification and retain sparse skipping only for proven plain Array data. Getter mutations, inherited virtual characters, and long inherited lookups now match Node. Search native loops poll stop/watchdog requests between complete lookups. Focused normal, unsuppressed TSan, and ReleaseSafe tests pass, including actual no-GIL workers. The 3,344-case Array/arguments before/after corpus and VM outputs are identical; the final rebased head also preserves all 429 search cases against its actual parent. Full hosted CI remains pending. No throughput claim is made.

Closed #1072 in d36f9a5: ordinary indexed prototype data reads now use the guarded opcode path at arbitrary ancestor depth. The executed depth witness moves from 0/4 fast-path hits to 4/4 while retaining value 42; no timing or throughput claim is attached. Normal, unsuppressed TSan, and ReleaseSafe focused tests pass 9/9, including actual no-GIL workers and mutation/exotic/GC/restriction witnesses. All 3,355 targeted corpus and tree/VM cases remain byte-identical with zero failures/divergences. The generated inventory and 51-page docs build pass; broad accessor, Proxy, exotic, inherited-write, and no-JIT performance acceptance remain open.

Closed #1073 in 87bbc09: primitive numeric/canonical String Array own creation now uses exact-key prototype permission, including ordinary inherited writable data. The nearest descriptor stops the proof; readonly/accessor/exotic cases remain canonical. Existing bulk append/vector gates retain their separate range proof. Dispatch attribution improves from dense 0/2 + sparse 0/2 to 2/2 each, with unchanged own/prototype values. Normal, unsuppressed TSan, and ReleaseSafe checks pass, including actual no-GIL workers and deep restriction ownership. The 3,584 affected corpus/VM cases retain identical passing outputs; inventory and docs gates pass. This is coverage evidence, not timing or throughput evidence.

Closed #1074 in 7cbe01e: removed both exact recurrence body recognizers and their computed result/step table, cached Chunk metadata, specialized executors, and counters. The general VM preserves result 21, 774 logical steps, all 67 profiler returns, rebinding, observable effects, GC, restrictions, stop/budget checkpoints, OOM recovery, and actual no-GIL calls. Focused normal/TSan/ReleaseSafe gates pass. The 1,316-case corpus remains passing; paired results retain the same three existing TCO divergences, with no new failures. The live inventory now lists 15 guarded families and honestly retains seven other legacy families for removal/migration. Historical recurrence performance evidence is marked as history; no new throughput claim is made. Full CI is pending.

c061420f removes the legacy exact four-property counted-loop kernel (#1076), including its recognizer, executor, plan table, and metric. General opcode caches and bounded per-assignment traces remain.

Both synchronization modes retain result 28,093,728 and 379 logical steps. Focused normal/ReleaseSafe/unsuppressed TSan checks cover actual no-GIL workers, Proxy/GC order, source hooks, budgets, stop checkpoints, and allocation failures. Exact before/after outcomes match across 4,367 affected test262 cases: 0 diagnostic failures, 0 flips, and the same five pre-existing tail-call tree/VM differences.

The generated inventory now has 14 guarded families and 6 remaining legacy families: packed-array sum, packed-array push, polymorphic property loops, fixed-shape allocation loops, numeric call loops, and reusable immediate closures. Their labels remain explicit. Inventory and docs gates pass; historical performance artifacts are preserved. The broader adaptive-dispatch and no-JIT performance contract remains open.

3ffad54f removes the legacy packed-array sum body kernel and compile-time candidate hint (#1077). General indexed, length, and intrinsic-push opcode paths remain.

The removal fixes an executed aliasing bug: when counter and accumulator share a binding, the batch returned 3 where Node and the tree walker return 5. Ordinary VM execution now returns 5 in isolated and shared contexts. The standard witness retains 36 and 316 steps in both synchronization modes.

Focused normal/ReleaseSafe/unsuppressed TSan checks pass for actual no-GIL workers, aliasing, observable indexed effects, source hooks, checkpoints, and demonstrable quiescent Array relocation followed by warmed execution. Allocation-failure and retained array fast-path checks pass. Exact before/after outcomes match across 3,552 affected corpus cases: 0 diagnostic failures, 0 flips, and the same five pre-existing tail-call differences.

The generated inventory now has 13 guarded families and 5 remaining legacy families: packed-array push, polymorphic property loops, fixed-shape allocation loops, numeric call loops, and reusable immediate closures. Their labels remain explicit. Inventory/docs gates pass, historical performance artifacts remain intact, and the broader no-JIT performance contract stays open.

a6a984e7 removes the legacy packed-array push body kernel, numeric-expression decoder/specialization, and candidate hint (#1078). General intrinsic-push and indexed opcode paths remain.

The standard witness retains 36 and 316 steps in both synchronization modes; the expression witness retains 806. Normal/ReleaseSafe/unsuppressed TSan checks pass for actual no-GIL workers, ordered method/argument/receiver effects, overrides, partial effects, live bindings, demonstrable Array relocation with warmed append, source hooks, and checkpoints. Allocation-failure and retained fast-path checks pass. The effects oracle matches Node and both execution modes on both binaries.

Exact before/after outcomes match across 3,745 Array/loop/arithmetic corpus cases: 0 diagnostic failures, 0 flips, and the same five pre-existing tail-call differences. Inventory/docs gates pass.

The inventory now has 12 guarded families and 4 remaining legacy families: polymorphic property loops, fixed-shape allocation loops, numeric call loops, and reusable immediate closures. Their labels remain explicit, historical performance evidence remains intact, and the broader no-JIT contract stays open.

7decd4fc removes the legacy polymorphic property loop body kernel and candidate hint (#1079), retaining general polymorphic inline caches and indexed operations. The descriptor-lifecycle bug exposed by its live-property witness landed separately in #1080.

Both synchronization modes preserve the measured ordinary 2,498 / 1,287-step and accessor 1,602,498 / 1,485-step witnesses. Normal/ReleaseSafe/unsuppressed TSan checks pass for actual no-GIL workers, live property/receiver/coercion effects, partial exceptions, demonstrable selector Array/object relocation, source hooks, and checkpoints. Allocation-failure and general four-shape cache checks pass.

Exact before/after outcomes match across 7,518 Object/Array/assignment/loop/arithmetic corpus cases: 0 diagnostic failures, 0 flips, and the same five pre-existing tail-call differences. Inventory/docs gates pass.

The generated inventory now has 11 guarded families and 3 remaining legacy families: fixed-shape allocation loops, numeric call loops, and reusable immediate closures. Their labels remain explicit. Historical performance evidence is unchanged; the broader adaptive-dispatch/no-JIT contract remains open.

60ad2657 removes the legacy fixed-shape allocation body kernel and the last array-loop plan/candidate machinery (#1081). General literal/index/property operations and independently used allocation reserves/literal descriptors remain.

Ordinary execution preserves 1,456 / 5,944 steps in both modes, checkpoint/budget/stop accounting, and Node-confirmed effects. Normal/ReleaseSafe/unsuppressed TSan groups pass for literal/index effects, explicit Array/child relocation followed by warmed allocation, 96 source-hook events, required-bytecode nursery child roots, restrictions, and actual no-GIL workers. Allocation-failure checks pass.

Exact before/after outcomes match across 8,688 affected Object/Array/literal/assignment/loop/arithmetic cases: 0 diagnostic failures, 0 flips, and the same five pre-existing tail-call differences. Inventory/docs gates pass.

The generated inventory now has 10 guarded families and 2 remaining legacy families: numeric call loops and reusable immediate closures. Their labels remain explicit. Historical performance evidence is unchanged; the broader adaptive-dispatch/no-JIT contract remains open.

b64cc348 retires the final two legacy families: exact numeric call loops and connected immediate-closure reuse (#1082). General bounded leaves, arguments calls, native direct calls, guards, and safe activation reuse remain; closure creation is ordinary and fresh.

The baseline remains 23,190,741,181 / 31,563 steps, with forced no-JIT isolated/shared execution matching the result. Normal/ReleaseSafe/unsuppressed TSan semantic groups pass 8/8 for actual no-GIL workers, live binding/receiver effects, fresh identities, partial exceptions, Function/receiver relocation, source hooks, and checkpoints. Both non-capturing and escaped-closure allocation-failure contracts are pinned without changing frame-reuse ownership.

Exact before/after outcomes match across 2,655 call/function/loop/assignment/arithmetic cases: 0 diagnostic failures, 0 flips, and the same eight pre-existing tail-call differences. Inventory/docs gates pass.

The live inventory now contains 8 guarded general/bounded families, zero legacy families, and zero structural-candidate flags. Reintroducing a legacy implementation or classification fails closed. This achieves the retirement milestone; broad adaptive-dispatch coverage, full forced-no-JIT differentials, metadata/memory policy, and published performance remain open under this issue. Historical benchmark artifacts remain unchanged.

Two follow-ups are complete: #1083 (c2c7061b) repairs formal parameters shadowing arguments in the bounded leaf shortcut; #1084 (ee6ae904) replaces the retired allocation kernel's stale GC fixture with explicit ordinary tree/VM root coverage.

The leaf guard retains measured positive hits and declines shadowed bindings. Debug, ReleaseSafe, unsuppressed TSan, actual no-GIL, GC, exact-step, hook, and termination checks pass. The 1,579 affected upstream outcomes are unchanged, including the same three pre-existing proper-tail-call divergences. Ordinary allocation identity/field checks and explicit moving-activation/native precise-checkpoint gates pass in all three build modes.

Hosted integration remains pending, and #933's local combined-unit memory cap remains unchanged. These correctness repairs do not complete broad no-JIT quickening or establish current performance leadership.