Parent: #473
Executed evidence
On exact current main c7dd8a7 with ReleaseFast, real zig-gc 0285ef8, and the frozen 2,200-job JSON rows, JSON.stringify creates an ordinary wrapper object with own key "" for every root value. ECMA-262 makes that holder observable only as the this value of a callable replacer; without one, toJSON observes the original value as receiver and only the empty key.
A candidate that supplies the root value directly when replacer_fn is null preserves checksum 324,952,086 on both base and anti-specialization rows and removes exactly per row:
- 198,000 GC cells (1,199,001 -> 1,001,001)
- 198,000 shape transitions (1,188,000 -> 990,000)
- 396,000 property-lock acquisitions (2,178,011 -> 1,782,011)
- 25,344,000 issued GC-cell bytes
Measured-boundary process CPU is diagnostic on the current host, not publication evidence: base user CPU 632.332 ms -> 593.446 ms; variant 610.302 ms -> 575.785 ms. Wall time remains excluded because the host has an unrelated unreapable crashed process.
Required change
- Elide the root holder only when no callable replacer can observe it.
- Preserve callable replacer this/own-property semantics exactly.
- Preserve root toJSON receiver and empty-key semantics, replacer arrays, primitive/undefined/function/symbol roots, raw JSON, cycle checks, error ordering, and every observable exotic path.
- Do not add an input-specific shortcut or external JSON implementation.
Definition of done
- Exact-parent base and anti-specialization attribution retain the frozen checksum and prove the exact cell/transition/lock reductions.
- Focused OOM, deep/alias/cycle, proxy, callback-GC and root-holder semantics pass.
- test/built-ins/JSON remains 165/165 and required-VM/tree agreement is exact.
- Real-GC no-GIL path passes unsuppressed TSan.
- Seven-sample direct-JSC timing is published only from a clean benchmark host state.