Problem
The bytecode VM already computes number-number arithmetic, comparison, and equality inline, but number-number bitwise and shift bytecodes still fall through Interpreter.applyBinary. That repeats generic ToPrimitive and BigInt dispatch even when both tagged operands already prove ordinary Number semantics.
The post-#66 object_churn profile shows this general dispatch as a meaningful remaining cost: Interpreter.applyBinary has 39 top-of-stack samples, Interpreter.toPrimitive 30, and Value.toInt32 19. The workload naturally exercises index masks and bounded checksum masks, but the same path affects ordinary JavaScript bitwise code.
Scope
- extend the existing VM number-number fast path to bitwise AND, OR, XOR, signed shifts, and unsigned right shift;
- preserve ECMAScript ToInt32/ToUint32 behavior for NaN, infinities, negative values, negative zero, and large shift counts;
- retain the generic path for BigInt, objects, strings, Symbols, and every case with observable coercion;
- add focused VM coverage that distinguishes the fast numeric path from coercion fallbacks;
- measure clean pinned A/B object_churn evidence with exact checksum equality.
Acceptance criteria
- Number-number bitwise and shift bytecodes avoid Interpreter.applyBinary.
- BigInt results and mixed BigInt/Number errors remain correct.
- Object valueOf/toString and Symbol failures remain observable in spec order.
- Edge-case Number conversion and shift behavior matches existing semantics.
- Focused tests and comparison-harness validation pass.
- Clean pinned A/B demonstrates no regression and records the exact cross-engine checksum.
- Commit references this issue and the measured checkpoint is added to #62.