JIT: complete optimizer backends and publish differential evidence

[chrisbbreuer]

Parent: #146
Blocks: #147, #246
Depends on: #431, #432, #433, #132, #133

Finish every declared optimizer backend and publish the evidence needed to close #146 without overstating unsupported targets or workloads.

Acceptance

• Implement every architecture backend in the declared supported matrix, with W^X/JIT entitlement and executable-memory failure behavior.
• Differential-test the full supported optimizer surface against interpreter and baseline tiers, including randomized IR/guard/deopt cases.
• Run focused normal/no-GIL/leak/sanitizer/TSan suites and publish machine-readable pass/fail/skip inventories.
• Publish reproducible single-thread and multithread performance evidence against JavaScriptCore from committed raw artifacts.
• Update README and detailed docs from the final committed artifacts; distinguish optimizer correctness coverage from benchmark coverage.
• Make unsupported hosts/features fail or fall back explicitly, with no fake tier counters or shell-hook passes.

Current checkpoint

The AArch64 numeric optimizer now completes general reducible control through 48bfe60/b80e81f7/3d78eaf2: arbitrary reconvergence, internal exits, multiple latches, and fused nested loops own exact SSA copies, block-entry recovery, checkpoint accounting, and moving safepoints. The fused source gate passes 4/4 normally and 4/4 under focused TSan; the combined optimizer TSan gate is 42/42 lowering and 80/80 runtime/context tests with zero failures or leaks. Other architecture backends, randomized/broad differential inventories, and final matrix evidence remain open.

README optimizer scope was refreshed without changing benchmark scores. The committed July 17 single/multithread JSC comparison remains the current accepted performance artifact because this CFG batch does not alter its kernels or harness.

[chrisbbreuer]

Control-flow differential fix in 40d85b3: equal-cost terminal branches now carry their true/false block IDs into backend lowering and emit only the selected branch-local SSA operations before loading the result. The strengthened compiler fixture uses real x + 10 / y + 20 arms; the source-level differential that exposed undefined scratch is clean. Combined evidence: 39/39 lowering and 68/68 runtime tests, normal and TSan. Benchmark scores are unchanged because no benchmark kernel or harness changed.

[chrisbbreuer]

Differential checkpoint c99dafa/dfb728e2/ad39bae0: a source-level loop combining an exact exit guard with a shared-latch diamond converges across repeated interpreter/optimizer runs; an irreducible two-entry loop rejects before publication. The combined TSan optimizer gate passes 42/42 lowering and 74/74 runtime tests, with focused normal loop coverage at 9/9 plus the mixed source differential. Published JSC benchmark scores remain unchanged because neither measured kernels nor the harness changed.

[chrisbbreuer]

Differential checkpoint 149e065/f8a73432/43a83152: loop OSR now owns a sequence of shared-join branch segments after an optional exit prefix, accounting each selected arm incrementally before one final backedge safepoint. The source witness takes both outcomes of two diamonds across optimized iterations and preserves exact result/step convergence. Focused normal loop coverage passes 9/9 plus the source differential; the combined TSan optimizer gate remains 42/42 lowering and 74/74 runtime. JSC benchmark artifacts are unchanged because measured kernels and the harness did not change.