perf(codegen,runtime): inline precheck for boxed class-field stores, arguments-registry emptiness latch, declared-type refinement for property reads (interp 1.236 -> 1.097, iso_miss 1.670 -> 1.465) - #7854

Round 4 of the interp campaign (3.96 s → 1.893 → 1.499 → 1.237 → this). Three
independent changes plus one refutation that closes the lever the previous round's
handoff was built around.

A — the strict class-field SET arm skipped the inline precheck for BOXED fields

expr/property_set.rs gated emit_class_field_inline_precheck on
requires_raw_f64. Every store into a declared field that is not a number — a
string, a class type, a union: most fields of most objects — therefore paid an
unconditional cross-crate js_typed_feedback_class_field_set_guard call. That
includes the synthesized __AnonShape_*_constructor that every closed-shape object
literal runs, which is why js_typed_feedback_class_field_set_guard (2.9%) and
typed_feedback::guards::class_field_fast_contract (2.1%) sat near the top of
interp's profile: { kind: "bin", op, left, right } is four stores, three boxed.

The stated reason for the gate ("its setter-in-chain handling and write barrier
aren't reproduced inline") was already answered by
try_lower_sloppy_class_field_boxed_store, which has taken the boxed inline
precheck since #7288 — the write barrier, layout note and string demote come from
emit_jsvalue_slot_store_pointer_tested, which the shared fast block calls with the
identical value-side predicates; a setter anywhere in the chain is refused upstream
by class_field_global_index's accessor_in_chain. The precheck proves a strict
subset of the runtime's class_field_fast_contract, so on a hit the guard would
have answered "fast" too. Every miss still lands on the guardcall block and the
unchanged strict fallback.

Verified live rather than assumed: interp.ts goes from 3 to 44 emitted
PERRY_CLASS_FIELD_INLINE_GUARD_DISABLED gate loads (41 new prechecks) with the
same 43 guard-call sites, now on the miss arm.

B — is_arguments_object had no emptiness latch

It is a probe, called from the by-name property-get tail, Array.prototype.push,
the array and Symbol.iterator iterator entries, Array.from/concat and class
construction. In a program that never writes arguments it was still 2.8% of
interp: a thread-local resolution (Darwin has no local-exec TLS, so that is a real
_tlv_get_addr — 7.1% of the same profile), a RefCell borrow and a pointer hash,
per call, to prove the absence of a feature the source does not contain.

ARGUMENTS_OBJECTS_EVER_USED is a process-global AtomicBool latched by the one
and only registry insert and checked before the thread-local — the
EXTERNAL_BUFFERS_NONEMPTY / SET_REGISTRY_EVER_USED idiom verbatim (#7474,
#7469).

object/arguments_latch_tests.rs asserts the SUBJECT, not the answer:
latch_off_is_what_makes_the_probe_cheap registers a real arguments object, forces
the latch back off, and requires the probe to answer false — deliberately the
wrong answer, and the only way to show the short-circuit is the arm being taken
rather than dead code in front of a registry that would have answered anyway. Delete
the early-out and it goes red.

C — a property read into an unannotated local threw its type away

const names = e.names left names at Any, so names[i] lowered to a
js_dyn_index_get call (4.3% of interp) whose own miss path calls
js_array_length (2.9%), and names[i] === name lowered to the fully dynamic
js_eq. refine_type_from_init's PropertyGet arm resolves the receiver with
receiver_class_name — which answers None for a reassigned local and for a union
— and then looks only in ctx.classes. A chain-walking cursor over a
type Env = { … } alias therefore failed three separate ways.

declared_property_type_from_annotation resolves through the same class / interface
/ object-alias tables static_type_of already consults, after stripping
null/undefined from the receiver's union (a read that returns at all had a
non-nullish receiver — reading through null throws).

★ It is a claim, not a proof — and one consumer could not take one

Element reads and stores tolerate a violated claim: both re-check GC_TYPE_ARRAY
and fall back. .length does not. Its inline arm is guarded, but its fallback
js_value_length_f64 answers 0 for every value that carries no length, where JS
answers undefined (and where a nullish receiver must throw). That degradation is
pre-existing and documented in place in the runtime — and it is already reachable on
main through a hand-written annotation:

type Bag = { items: string[] };
function mk(v: any): Bag { return { items: v }; }
const items: string[] = mk(42).items;
items.length            // node: undefined      main today: 0

So .length must not be handed a fresh claim. refined_array_type_is_declared_only
records these ids in FnCtx::declared_only_array_locals — the mechanism #7773
introduced for the numeric half — and the .length arm refuses them, leaving them
on exactly the generic path the unrefined Any local takes today.

test-files/test_gap_declared_field_type_refine_guarded.ts is the sabotage test:
one items: string[] declaration handed arrays, strings, plain objects aping
arrays, numbers, null and undefined, through an alias, an interface and a class,
via a nullable reassigned cursor, a nested read chain, an element store and an
element-typed ===/+. Every row must match node byte for byte. It was written
before the guard and it failed — four rows read len=0 — which is how the hazard
above was found rather than shipped.

Measured — quiet M1 mini, best-of-5, exit-checked

origin/main @ 0321c6554 (perry 0.5.1467) vs this branch. Every output
byte-compared against node --experimental-strip-types before timing; exit code
recorded per cell. Load 1.48 before / 2.11 after, zero foreign processes at both ends.

Zero regressions. The fourteen programs sitting inside +/-0.5% are the run's own
noise floor (med within 1 ms of best in every cell), which is what makes the three
movers credible. All protected ceilings met.

Correctness canaries: interp.ts prints 1708840; iso_miss.ts prints
checksum 437840 misses 0 — gated on the miss counter, and re-verified under
PERRY_GC_PROTECT_FROMSPACE=1 PERRY_GC_PROTECT_FROMSPACE_DEPTH=800 PERRY_GC_VERIFY_EVACUATION=1 (both exit 0, output unchanged).

cmp does not apply here: this touches perry-runtime, so the two arms link
different archives and all 19 binaries differ by construction.

Tests

• cargo test --release -p perry-runtime arguments — 4 passed, including the two new
  latch tests and the two existing ARGUMENTS_OBJECTS GC-side-table tests.
• cargo test --release -p perry-codegen — all unit + integration suites pass except
  large_object_barriers::large_local_array_push_inbounds_store_emits_precise_slot_barrier,
  which is already red on main @ 0321c6554 and unrelated: perf(codegen): put the numeric array push's GC bookkeeping behind one live test (push_num 0.149 -> 0.069) #7839
  (a64c5a9eb, the commit immediately before this branch point) moved
  js_gc_note_slot_layout / js_write_barrier_slot out of apush.inbounds into a
  new apush.gc_bookkeeping block emitted after apush.realloc, outside the slice
  the old assertion searches. Verified empirically against a reference build of
  0321c6554, not inferred: neither call appears between apush.inbounds and
  apush.realloc, and apush.gc_bookkeeping is present. perf(codegen): put the numeric array push's GC bookkeeping behind one live test (push_num 0.149 -> 0.069) #7839 wrote its own
  replacement gate and left this one stale; it landed green because
  crates/*/tests/*.rs do not run per-PR.
• cargo fmt --all -- --check, scripts/check_file_size.sh clean.
• Gap suite: run locally with this compiler (PERRY_SKIP_BUILD=1, node 26.5.1 per
  .node-version) — see the comment below for the outcome.

Follow-up filed

#7853 — .length on a receiver whose declared type is an array/Named but whose
runtime value carries no length returns 0 instead of undefined, and returns 0
where JS throws. Pre-existing on main, reachable from a hand-written annotation, and
the reason change C has to carve .length out. Fixing it removes the carve-out and
recovers the remaining ~3%.

Refuted: shape narrowing after a discriminant test

PROFILE-interp-round3.md proposed narrowing n to its matching union member
inside if (n.kind === "bin") so evalNode's surviving diamonds (27.2% of the
program) become class-keyed slot loads. The ceiling was measured before building
it: ~5%, not the projected ~20%.

Three source-level arms of interp.ts, built from one compiler and identical in
every other respect — object literals (the original); each union member as a real
class (isolating allocation from typing); that program plus hand-written narrowing
casts in every evalNode arm. The narrowed arm converts 19 of 31 generic
property diamonds into guarded class-field inline reads and is 1.226 → 1.162 s
against its own control, 5.2%. The reason is structural: a class-field guarded read
is only about a third cheaper than the polymorphic-IC read, because the cost is the
guard, not the lookup — narrowing swaps one guarded diamond for another. A large
win needs the check hoisted out of the branch (one shape test, N unguarded slot
loads), i.e. loop-versioning applied to a discriminant arm.