JIT: order Class-A invalidation against shared-GC waits

[chrisbbreuer]

Parent: #433
Blocks: #429
Child: #457

Integrate optimizer invalidation/jettison with the shared-GC stop protocol so a Class-A stop cannot publish behind a mutator waiting for collection completion. Dependent code must be invalid before mutators resume.

Acceptance

• Serialize stop publication with shared-GC conductor/completion ordering.
• Bump the optimizer invalidation generation inside the stop window before resume.
• Jettison dependent tiers while native polls preserve exact resumable state and roots.
• Prove bounded convergence under concurrent allocation/collection pressure.
• Add poll/resume and both GC-wait-vs-Class-A normal + TSan witnesses.

[chrisbbreuer]

26ef612/d845cc40 completes the shared conductor and core evidence. The heap-owned gate is shared by precise sibling realms; cooperative, abort-safe M3, allocation-failure, quiescent, and moving collectors enter it before publication, while Class-A invalidation takes it before Owner.clear bumps the generation and jettisons tiers. Focused normal/TSan results: conductor 3/3, cooperative rendezvous 3/3, exit cleanup 3/3, M3 wait-peer publication 3/3, and allocation recovery 4/4. The first four acceptance items are checked. This issue stays open for explicit promotion of the two pinned mc-safe-gcwait-vs-classa-stop executables rather than treating internal witnesses as corpus completion.

[chrisbbreuer]

Checkpoint 01306740 / 427ba867 wires real parallel-realm named-property mutation into Class-A invalidation. VM fast-slot and canonical writes rotate the executable generation only after native heap assumptions exist; a waiting mutator remains a cooperative-GC participant while contending for the shared conductor. Tree-walker→VM function calls now acquire the same outer execution epoch as top-level VM runs. Focused Class-A evidence passes 4/4 normally and under TSan; README and detailed evidence are current.

The exact two PR-249 witnesses remain intentionally unpromoted: diagnosis proved their return o.y + 1 victim depends on inherited-property specialization/watchpoints that zig-js does not yet publish. The mechanism-only case completed seven real cooperative collections but zero Class-A fires before this batch; the rope-bearing case additionally exposed its existing concurrent ReferenceError: i. #457 now owns the non-vacuous prototype-chain/watchpoint prerequisite and exact promotion gate.

[chrisbbreuer]

Final acceptance item ("poll/resume and both GC-wait-vs-Class-A normal + TSan witnesses") is now met, so this closes.

The prerequisite that kept it open was the non-vacuous inherited-property assumption, now delivered under #457 (16b2a1a2/a757cd1a/2bdb47be). With it in place both pinned executables run a real published assumption through the shared conductor and were promoted in 3f2fe88b:

cve/mc-safe-gcwait-vs-classa-stop.js                publications=18 invalidations=13 collections=1
cve/mc-safe-gcwait-vs-classa-stop-noropevariant.js  publications=18 invalidations=13 collections=1

Identical under ThreadSanitizer with no race reported. That is the discrimination this issue asked for: the mechanism-only case previously completed real cooperative collections but zero Class-A fires, and promoting it on the green assertion alone would have been exactly the bookkeeping promotion #429 forbids. Poll/resume evidence is the 89fc073e cooperative-stop / expired-watchdog / shell-timeout set, where an optimized loop reconstructs before the boundary and bytecode services each request at step 1,024 in normal and TSan runs.

Conductor evidence from the earlier batch stands: conductor 3/3, cooperative rendezvous 3/3, exit cleanup 3/3, M3 wait-peer publication 3/3, allocation recovery 4/4, focused Class-A 4/4 normal and TSan.

Inventory: 243 → 245 promoted, 10 → 8 blocked of 259. Remaining #433 work is the corpus evidence for the still-blocked optimizer cases, tracked on #429/#433.