Runtime: skip impossible debugger location probes

Parent: #479 Related: #496, #501

Problem

Every tree-walker eval entry probes the Context-wide debugger statement-location registry, including expression nodes and the synthetic Program node that the parser never publishes as statement locations. The current-main one-lane representative_temporal_availability attribution records 5,994 cache misses and 10,822 hits during configuration; a fresh five-second cold profile samples Interpreter.debugStatementLocation and serviceDebugStatement even though no debugger is attached.

The parser publishes locations only for nodes returned by parseStatement. Negative expression lookups therefore cannot produce debugger metadata, but they occupy and churn the bounded 64-entry interpreter-local cache and repeatedly reach the registry.

Scope

• Prove and encode the exact AST tags that can be parser-published statement roots.
• Preserve host statement hooks at every existing evaluator checkpoint.
• Skip only impossible debugger-location lookups; keep debugger, profiler, stack-trace, late-attach, VM checkpoint, and explicit debugStatementLocation semantics exact.
• Mirror any shared evaluator/VM boundary needed for tier parity.
• Add focused positive/negative, cache-counter, late debugger, and TSan coverage.
• Measure current main against its exact parent with existing cold/attribution rows.

Acceptance

• Impossible expression/Program probes do not query or perturb the debugger registry/cache.
• Every parser-published statement tag still resolves its exact script/line/column, including debugger;, nested control flow, declarations, modules, and empty statements.
• Host hooks keep their current invocation contract.
• C/private debugger late attachment, stepping, exception locations, and warmed-function behavior remain green.
• Exact attribution proves fewer registry probes; paired timing and full unit/test262 evidence are reported without overstating neutral results.
• No AST widening, disabled debugger capability, input-specific shortcut, or unbounded cache.

#607 is complete on main via 506d8950.

The parser now owns an explicit closed predicate for AST tags that can enter the statement-location registry. Tree-walker evaluation gates only the registry lookup on that predicate. Host checkpoints still execute for every prior evaluator entry; direct location queries, real statement locations, late attach/reattach, stepping, exceptions, stack locations, module statements, debugger statements, and VM checkpoints are unchanged.

Exact attribution on representative_temporal_availability:

• cumulative location-cache misses: 5,994 -> 354 (-94.1%)
• cumulative hits: 10,822 -> 1,914
• GC cells/backing allocations: 8,082 / 19,682 -> identical
• property-lock acquisitions: 28,368 -> identical
• Shape requests/hits/misses: 4,784 / 3,353 / 1,431 -> identical
• work/checksum: identical

Matched five-second cold samples reduce the debugStatementLocation top-of-stack leaf 54 -> 8. The repository exact-parent gate over 101 order-balanced pairs records 8.710 -> 8.575 ms (0.984x, diagnostic host), retired instructions 124,344,558 -> 123,064,790 (0.9897x), cycles 31,480,765 -> 30,928,268 (0.9824x), and neutral median RSS (1.0005x). Energy was noisy and is not claimed.

Separate 41-pair cold controls, all with exact checksums, improved:

• strings: -1.534%, 36/41 wins
• NumberFormat construction: -1.669%, 34/41 wins
• ListFormat/RelativeTimeFormat reflection: -4.334%, 41/41 wins

Validation:

• focused parser and interpreter invariants pass with zero leaks
• focused TSan witness passes
• all 13 debugger unit tests pass, including late attach, warmed functions, module graphs, stepping, exception policy, and generator/async checkpoints
• Error.stack and source-location gates pass
• full sharded units: 1,724 pass, 1 skip, 0 fail/leak
• exact test262 test/language/statements/debugger: 2 -> 2, so 0 flips and 0 regressions

No AST widening, debugger disablement, cache growth, or input-specific path was introduced.