perf: ECS command path round 3 — field-push inline append, inline f64 typed guard, header-gated registry probes (+5.4%) - #8897

…esolver

PerryTS#8897's `field_push_local_bind` turns `this.packed.push(x)` into a local
`ArrayPush`, whose complete fallback is `js_array_push_f64_spec`. For an
object-backed Array subclass (wolf-ecs `Archetype`) that entry paid the
tracked resolver — a guaranteed miss on a `GC_TYPE_OBJECT` header — and
then delegated to `js_array_push_f64`, which paid it again before reaching
the dense subclass arm. Both entries now ask the dense arm first, off the
header tag the guarded element tiers already read; every rejected case
keeps the complete route.

Test: `spec_and_generic_push_entries_append_to_an_object_backed_subclass_densely`
pins, via a test-only probe counter on `try_read_tracked_gc_header`, that the
spec and generic entries reach the dense arm with exactly the fused u31
entry's probes (none).

Claude-Session: https://claude.ai/code/session_019WVcWKmYsUBnnFB7nBgbBJ

…esolver

PerryTS#8897's `field_push_local_bind` turns `this.packed.push(x)` into a local
`ArrayPush`, whose complete fallback is `js_array_push_f64_spec`. For an
object-backed Array subclass (wolf-ecs `Archetype`) that entry paid the
tracked resolver — a guaranteed miss on a `GC_TYPE_OBJECT` header — and
then delegated to `js_array_push_f64`, which paid it again before reaching
the dense subclass arm. Both entries now ask the dense arm first, off the
header tag the guarded element tiers already read; every rejected case
keeps the complete route.

Test: `spec_and_generic_push_entries_append_to_an_object_backed_subclass_densely`
pins, via a test-only probe counter on `try_read_tracked_gc_header`, that the
spec and generic entries reach the dense arm with exactly the fused u31
entry's probes (none).

Claude-Session: https://claude.ai/code/session_019WVcWKmYsUBnnFB7nBgbBJ

… push arm ahead of the tracked resolver (wolf-ecs −11.2% / −11.9%) (#8921)

* perf(codegen): field-value arguments to sibling methods keep the proven-this clone

The this-flow walker rejected a method as a proven-`this` clone candidate
whenever an internal `this.m(...)` / `super.m(...)` call's ARGUMENTS
mentioned `this` at all, even for a declared-field read such as
`this._archChange(this._ent[id], i)`. That argument hands the callee a
field's value, never the receiver; `expr_this_safe` already rejects a bare
`this` in value position, a `this`-capturing closure and a non-field
`this.x` read on its own. wolf-ecs `addComponent`, `removeComponent` and
`createEntity` each make such a call and therefore ran their public bodies,
re-proving `this` at every property, element and method site (≈14k
instructions for ~20 source lines; the flat 54% inline self time of the
add/remove profile).

Vet the arguments with `expr_this_safe` alone. A bare `this` argument still
rejects (pinned by the new test).

Claude-Session: https://claude.ai/code/session_019WVcWKmYsUBnnFB7nBgbBJ

* perf(runtime): object-backed subclass push arm ahead of the tracked resolver

#8897's `field_push_local_bind` turns `this.packed.push(x)` into a local
`ArrayPush`, whose complete fallback is `js_array_push_f64_spec`. For an
object-backed Array subclass (wolf-ecs `Archetype`) that entry paid the
tracked resolver — a guaranteed miss on a `GC_TYPE_OBJECT` header — and
then delegated to `js_array_push_f64`, which paid it again before reaching
the dense subclass arm. Both entries now ask the dense arm first, off the
header tag the guarded element tiers already read; every rejected case
keeps the complete route.

Test: `spec_and_generic_push_entries_append_to_an_object_backed_subclass_densely`
pins, via a test-only probe counter on `try_read_tracked_gc_header`, that the
spec and generic entries reach the dense arm with exactly the fused u31
entry's probes (none).

Claude-Session: https://claude.ai/code/session_019WVcWKmYsUBnnFB7nBgbBJ

* changelog: fragment for #8921

Claude-Session: https://claude.ai/code/session_019WVcWKmYsUBnnFB7nBgbBJ

* runtime: clear main's -D warnings errors (dangling doc, test-only meta-edge probe, unused layout test helper)

main f989075 fails the workspace -D warnings check on its own: a doc comment left without an item in object/shapes.rs, cell_has_meta_edge whose only caller is a test, and an unused #[cfg(test)] layout helper. Gate/remove them so this PR's warnings job can pass.

Claude-Session: https://claude.ai/code/session_019WVcWKmYsUBnnFB7nBgbBJ

* fix(gc): keep the layout-table test helpers, whose callers #8923 restored

This branch deleted `test_per_object_layout_present` and
`test_young_layout_records` to satisfy `-D warnings`. #8923 landed the other
resolution — restoring their regression-test callers — so removing them here
merges cleanly but does not compile.

---------

Co-authored-by: Ralph Küpper <ralph@skelpo.com>

…TS#8897)

`field_push_local_bind` expanded `this.f.push(v)` into a receiver local, an
inline `ArrayPush`, and `if (__push_recv !== __push_recv_old) this.f =
__push_recv`. That guard is dead: a growing append leaves the old head as a
forwarding stub to the new one and JS equality sees through forwarding
(perry matches Node), so the field kept the stub and every later
`this.f.length` / `this.f[i]` walked it through the dynamic property path —
a 2.5x cold-phase regression in the wolf-ecs entity cycle that decayed only
as the arrays stopped growing.

`Expr::ArrayPush` now carries `field_writeback: Option<String>`; the
transform emits two statements (`let __push_recv = this.f; push`) and
codegen compares the local's handle bits before and after the append — the
one comparison that does not see through forwarding — re-pointing `this.f`
through the ordinary class-field store when they differ, behind an inline
plain-object header gate (frozen / sealed / no-extend / descriptor-bearing
receivers keep the stub rather than risk a throw or an accessor).

The tiny-method rule in `hot_callees` counts the two-statement expansion as
the one authored statement; `stable_hash` hashes the new field and the
monomorph substitution propagates it.

Claude-Session: https://claude.ai/code/session_019WVcWKmYsUBnnFB7nBgbBJ

#8931)

* codegen: field-push write-back on handle bits, not JS equality (#8897)

`field_push_local_bind` expanded `this.f.push(v)` into a receiver local, an
inline `ArrayPush`, and `if (__push_recv !== __push_recv_old) this.f =
__push_recv`. That guard is dead: a growing append leaves the old head as a
forwarding stub to the new one and JS equality sees through forwarding
(perry matches Node), so the field kept the stub and every later
`this.f.length` / `this.f[i]` walked it through the dynamic property path —
a 2.5x cold-phase regression in the wolf-ecs entity cycle that decayed only
as the arrays stopped growing.

`Expr::ArrayPush` now carries `field_writeback: Option<String>`; the
transform emits two statements (`let __push_recv = this.f; push`) and
codegen compares the local's handle bits before and after the append — the
one comparison that does not see through forwarding — re-pointing `this.f`
through the ordinary class-field store when they differ, behind an inline
plain-object header gate (frozen / sealed / no-extend / descriptor-bearing
receivers keep the stub rather than risk a throw or an accessor).

The tiny-method rule in `hot_callees` counts the two-statement expansion as
the one authored statement; `stable_hash` hashes the new field and the
monomorph substitution propagates it.

Claude-Session: https://claude.ai/code/session_019WVcWKmYsUBnnFB7nBgbBJ

* field-push write-back: require the field to still hold the captured head; count only complete expansions

Review follow-ups on #8931:

- The write-back arm re-reads `this.<field>` (`apush.field.still_held`)
  and stores only when its bits equal the captured pre-push head. The
  receiver is read before the argument is evaluated, so an argument that
  assigns the field itself (`this.f.push(this.reset())`) must win over the
  repair — and now does; a collection that already rewrote the field to
  the moved array skips a redundant store the same way.
- `hot_callees`' tiny-method rule counts an expansion only as the complete
  adjacent shape (`let __push_recv = this.f` + the `ArrayPush` on that id
  with the same field as its write-back), so an author's own local named
  `__push_recv` cannot shrink a method into the hot-allocation set.
- e2e regression tests (`issue_8897_field_push_writeback.rs`): the issue's
  reproducer, the argument-reassigns-field case at 0/16/64 fills, and a
  frozen receiver — all node-identical output.

Claude-Session: https://claude.ai/code/session_019WVcWKmYsUBnnFB7nBgbBJ

---------

Co-authored-by: Ralph Küpper <ralph@skelpo.com>