codegen: P3 B3, delete the INT32 Number consumers - #14395

P3 "canonical Numbers", DESIGN-p3 rev 3.1 §3 B3 (REVIEW-p3 R3, S3). After B1 (#14354), B2 (#14358) and B4a (#14372) nothing can produce an INT32-tagged Number, so a Number has one encoding, the plain double, for every operand: proven, unproven or ⊤. This PR deletes every test and decode of that encoding from generated code, and the helpers that emitted them.

Why it is sound to delete

Checked on main before deleting each consumer:

• Foreign bits. The NaN-canonicalizing ingress fix (NANB, eb9ec0de82) is in main: v8_serde.rs read_double and the bun:ffi T_F64/T_F32 returns (float_value) no longer pass a payload through.
• Producer API. JSValue::int32 is gone (B4a).
• Every remaining writer of a 0x7FFE word (a scan of each non-test INT32_TAG |, 0x7FFE_0000_0000_0000 | in perry-runtime, perry-stdlib, perry-ffi, the ext crates and perry-abi) is one of DESIGN-p3 §1.2's internal words: overflow routes, the bound inline-args marker, the class id capture and evaluation state, the constructor identity word, the class key bits and method home word, key_attrs. The one exception is the build-time canonnum sabotage in math.rs. None is a JS value.
• Codegen's own 0x7FFE writers stay: the async i32 control cells (read with a typed i32 load), the class first-evaluation state (read by the runtime) and the realm atom. None of them flows into a deleted consumer.

Deleted

Guarded arithmetic: main has no inline INT32 arm to delete. emit_js_value_is_number already rejects the whole tag band and the dynamic arm is a runtime call. Only its comment changed.

Left, with the reason

• Calls into the runtime's own guards: js_typed_f64_arg_guard / js_typed_f64_arg_to_raw (the Map/Set number-key paths in math_simple.rs, bigint_set.rs, logical_collections.rs, method_override.rs) and js_typed_i32_arg_guard / _to_raw (scalar_method.rs). Their INT32 arm is inside the runtime functions, which is B4b. Once B4b lands, the to_raw call is an identity and goes with it.
• INT32_TAG / INT32_TAG_I64: kept for the internal words. The rename is B4b.
• Comments that list INT32 as one member of the tag band next to a band test (index.rs, index_set_*, member_update.rs, …): the tests are band tests, not tests of the tag.

No switch

A pure deletion has nothing to switch. Every comparison below is the branch against the main build at the merge base.

Controls

tests/parity/language/number/test_p3_b3_top_operands.ts drives each deleted path with unproven operands (values from JSON.parse and a mixed array: 0, ±1, 7, 2.5, int32 min and max, 2^32, 1e300, -0, NaN, ±Infinity, numeric and non-numeric strings, null, undefined, booleans, a BigInt, an object with valueOf, an array, a Symbol):

• ===/!== against int literals, a fraction and a Number local, both orders; relationals against a Number; every kind against every kind for === and <;
• a comparison graph; a dense numeric switch and a mixed-literal tower;
• an unproven array key, read and store;
• typed Number and int32 entries of functions, methods and closures, called through any;
• a method on a receiver that may be a Number; arithmetic over unproven leaves.

The negative controls are the non-Numbers: "7" === 7 is false, switch ("7") takes the string case, null >= 0 is true, undefined < 1 false, a BigInt and a Symbol take their own arms. Output equals node in normal mode, check mode, with moving-GC loop polls, with PERRY_FACTS_CANONICAL_NUMBERS=0, and on main.

Results (qb9 x86-64, instructions:u; branch a0923eb11c vs main 5de5bb7544, its merge base)

Two runs per arm, identical to 0.1 M; checksums equal. Chess IR: 125 INT32 identity tests on main, 0 on the branch; 707 fewer IR lines (and −146, icmp −131, select −101, sitofp −88, or −58).

The 10 output diffs: 5 programs fail to compile in both arms (crc 1/1: test_gap_s8b_computed_fields, test_gap_10554_fn_identity_own_module, test_gap_cjs_factory_slot, test_gap_11275_reexport_value_kinds, test_issue_5431_dollar_named_export_call), so there is no output to compare. 4 print time or random values (test_issue63_arr, test_date, test_math, test_issue58_object_string). test_gap_this_param_receiver_routes differs only in the PID of a deprecation warning line.

Size (every executable section; branch vs main)

All four shrink. In skin, .text grows by 11 456 B while perry_js_text shrinks by 80 704 B; the per-symbol cause of the .text part was not investigated.

The canonnum sabotage

scripts/p3-canonnum-runtime.sh built the runtime whose js_math_round returns an INT32 word (archive mtime check passed). The S0 false arm canonical-number-negative reports a false proof on the branch, and the clean arm passes. But the S0 script's assertion fails (rc 1) on both the branch and main 5de5bb7544: the miss is now reported first by the array-representation witness (predicate "array rep", from #14390), where the script expects "canonical number". The forged word is caught; the script's expectation is stale on main and is not changed here.

Tests changed

• expr/compare_chain_tests.rs, compare_tests.rs, hit_path_tests.rs, codegen/typed_abi/tests.rs, facts_number_locals_tests.rs, stmt/byte_result_tests.rs: they asserted the INT32 test or decode; they now assert its absence (and the one plain-number classification where there is one).
• tests/native_proof_regressions.rs: unboxes_number_arg (INT32 test plus sitofp) is replaced by tests_int32_tag, asserted absent. This file has 23 failing tests on main on macOS; the same 23 fail on the branch.
• macOS: perry-codegen lib has 15 failing tests on main; the same 15 fail on the branch. On qb9 the lib suite is 2838/0.

Not re-measured

The final head also merges main 8e1c285569 (PR-C2 and three wpfacts commits; a clean merge, cargo check -p perry-codegen --all-targets clean on macOS). The gates above ran on a0923eb11c, before that merge.