JIT: make trap polling and optimized artifact lifetime concurrency-safe

[chrisbbreuer]

Parent: #146
Blocks: #429
Depends on: #431, #432
Related: #132, #133, #145

Implement concurrency-safe optimized trap polling, watchpoint invalidation, call/IC publication, and executable artifact retirement. No mutable optimizer record may be observed partially published or reclaimed while a compiler or mutator can still use it.

Acceptance

• Model trap polls as invalidation points that clobber every heap fact rewritten by a stop window.
• Publish shape/property/call IC records atomically and revalidate all advisory profiles/watchpoints at link time.
• Implement code, call-link, handler-chain, and IC retirement with bounded epoch reclamation and GC accounting.
• Serialize Class-A stop publication against shared-GC completion waits and prove bounded convergence.
• Jettison dependent code before mutators resume; preserve resumable side exits and precise roots.
• Pass writer/writer, reader/reset, poll/resume, GC-wait, memory-steady-state, no-GIL, TSan, and ASan evidence.

Current checkpoint

The numeric optimizer publishes immutable artifacts under owner leases, rejects stale compilation claims, polls the owner generation before entry and at every loop header, and side-exits exact state before bytecode checkpoint/trap work. 057a2ef adds a distinct instruction-level moving-GC safepoint: it publishes precise roots at a completed backedge and resumes after relocation without changing exact trap/checkpoint timing.

89fc073 adds exact poll/resume evidence for cooperative stop, expired watchdog, and shell-timeout trap requests: an optimized loop reconstructs before the boundary and bytecode services each request at step 1,024 in normal and TSan runs.

ad0b211 closes native entry while any statement-observation hook is installed, including already-published artifacts and active execution leases. Focused refusal proves zero native attempts and zero step consumption.

Calls and property effects now execute through the immutable runtime-operation ABI completed in #439, including exact exceptions, roots, and five-way finally dispatch. They intentionally do not yet publish speculative call-link or shape/property IC records. The next #433 slice follows guarded property lowering in #132 (and packed arrays in #133), then extends link-time revalidation, stop-window invalidation, and bounded retirement to real heap facts; fake counters and unused reset APIs remain out of scope.

[chrisbbreuer]

Foundation note: 74fd22d publishes the first optimizer artifact through the existing context owner execution/compilation lease and invalidates it before mapping release. This covers the current exact constant-return artifact, but #433 remains open for trap polling, compiled frames, mid-script exits, and broader concurrent optimized-artifact lifetime.

[chrisbbreuer]

Audit after 561a516: current owner leases, immutable publication, stale-claim rejection, entry/header generation polls, and exact pre-checkpoint side exits cover the real numeric optimizer artifacts. The remaining PR-249 premises are not bookkeeping gaps: optimized calls and property effects still exit to bytecode, so call-link/IC retirement records do not exist yet, and live in-native relocation still depends on #437 instruction-level safepoints. I am keeping every #433 acceptance box open rather than adding fake counters or unused reset hooks.

[chrisbbreuer]

#440 is complete through 7a26276/87513c28, so #433 now has a real immutable property-IC artifact to build on: four shape/slot pairs are copied with the live bytecode seqlock, owned by the optimizer artifact, and guarded against the receiver’s current shape and slot range. Shared native reads/writes are object-lock serialized and TSan-clean. #433 still owns link-time watchpoint revalidation, stop-window invalidation/jettison, call-link/IC atomic publication, and bounded epoch retirement; #132 remains open for direct backend guards and performance evidence.

[chrisbbreuer]

a35ee76 now consumes #440 metadata in generated AArch64: every cached pair is re-looked-up by name at link time, and isolated inline reads guard the exact object tag, cold/exotic state, live shape, and slot before bypassing the callback. Shared mode always falls back to the object-lock path. This supplies a real link-time property-IC revalidation witness for #433, but stop-window watchpoints, jettison, call-link publication, and bounded retirement remain open.