codegen: an unsigned bound absorbs the element key's sign test (N10) - #14426

CENSUS-residual §5 N10, cause (i): an element read through the canonical key split tested the key's sign (test; mov $-1; cmovns; js, or test; js after the normalizer) and then bounded it with an unsigned compare. The bound already declines every negative key, because a negative i32 is at least 2^31 unsigned and every length, capacity and floor is below 2^31. This PR moves the sign test off the hit path and onto the miss arm. It is codegen only, and wpfacts is unchanged.

D (#14420) and R1 (#14416) are both in main. The branch merges origin/main 682e548 (the measured head) and then 963ffae (N2 #14424 among others), and git merge-tree against it is clean. N10 changes only the guard computation, so it composes with N2's function-level bases.

What changes

• The read split (expr/index_get/runtime_key.rs, lower_array_index_get_via_canonical_i32_split).
  • When the element tier puts an unsigned bound in front of every element arm (guarded_array::unsigned_bound_covers), the split branches straight into the tier.
  • The tier's miss arm starts with idx <s 0 → runtime-key arm (guarded_array::emit_negative_exit, block ubound.cold). A negative key therefore still reaches the runtime-key arm with its original double (mode 0, the exact property-key read). A non-negative miss still reaches the tier's own cold read.
  • So every key takes the arm it takes today; only the place where the sign is tested moves.
• Which tiers qualify:
  • the guarded tier: idx <u prefix on the prefix hit, idx <u length and idx <u capacity on the full hit. Diagnostic builds with the observing guard are excluded, because the guard call receives the key.
  • the rep-keyed proven tier when the key is not in the floor (idx <u capacity);
  • the fixed-storage read when the key is not proven in bounds (idx <u len; proven_array::bounds_key).
  • A read whose key is proven in range has no bound and keeps the split's sign test exactly as today.
• A native integer key (a sitofp/uitofp i32 source: k | 0, an int32 local) is handed over as it is (index_key::normalize_unsigned), with no select(idx >= 0, idx, -1). The two store paths that decline every rejected key onto one helper with the original double get the same: index_set.rs's runtime-key store and StoreIndex::CanonicalOfDouble. Their one bound is idx <u capacity. Every other key form keeps its admission: the normalizer call still returns -1 for NaN, fractions, tags and out-of-range values, -0 still maps to element 0, and the charCodeAt alias keeps its ordered/pristine select.
• Soundness of the representation. ArrayHeader.length/capacity are u32 slots, and every element tier already compares them unsigned. A key at or above 2^31 (a uitofp source, or -1 from the normalizer) is declined by the bound and is negative as i32, so it takes the runtime-key arm as before.

The evaluate site from the disassembly (qb10, rel2, evaluate$sig, one of the two normalizer sites):

off:  call perry_array_index_normalize_i32 ; test eax,eax ; js <runtime key> ; … ; cmp 0x4(%r12),%eax ; jae <cold>
on:   call perry_array_index_normalize_i32 ; cmp 0x4(%r15),%eax ; jae <cold>

Sign-test census on the chess hot functions (js count in the disassembly, on vs PERRY_UNSIGNED_BOUND=0, qb10 rel2): evaluate 2 → 0, generatePseudo 1 → 0, make 25 → 9, negamax 20 → 12, quiescence 21 → 14, set$generic 5 → 0, set 6 → 2, unmake unchanged. attacked has no sign test on either arm: after D and R1 its reads are in the floor or held by a base. The remaining cmovns in make are number-to-string sign handling (or $0x2d, the '-' character) and ToInt32's slow path, not element bounds.

Check mode, switch, sabotage

• PERRY_VERIFY_FACTS=1: the tier's cold read, after the negative exit, tests that its key is non-negative. That is the fold's claim that only non-negative keys reach it. The new fact is "unsigned bound" (verify_facts::Fact::UnsignedBound).
• PERRY_UNSIGNED_BOUND=0: every read and store keeps its sign test in front of the bound (today's code). It is a compile-cache input (compile_env.rs, test unsigned_bound_switch_is_a_cache_input).
• PERRY_FACTS_SABOTAGE=unsignedbound: the miss arm drops the negative exit. S0 unsigned-bound-negative.ts exits 0 on the correct arm and 86 on the sabotaged arm ("unsigned bound").

Results (instructions:u, on vs PERRY_UNSIGNED_BOUND=0 on the same binary, two runs each, identical; checksums equal)

qb10, the head (rel2 = d4ca346: N10 merged with origin/main 682e548, which contains D, R1, N1a and N1b) (M):

qb10, the final head (rel3 = fc5284f: merged with origin/main 963ffae, which includes N2 #14424 and N7) (M; posted as a PR comment):

qb9, rel1 = 3fe1ade: N10 on main 0e35b90 with the D and R1 branches merged locally, before N1a/N1b (M; its own table):

• The census estimated (E) search −0.6%, perft −0.3%, evaluate −2.5%, legal −0.3%. Evaluate is below that estimate because D and R1 moved most of evaluate's reads into the floor or under a held base, where there is no split. The head beats rel1 on search, perft and legal because N1's int32 temporaries turn more keys into native ints, whose -1 select now goes away as well.
• Peak RSS (qb10, /usr/bin/time max RSS, on / off): search 26 880 / 26 880 kB, perft, evaluate and legal 19 456 / 19 456 kB.

Gates

The last head, fc5284f, merges origin/main 963ffae (N2 #14424, VR-0 #14423, N7, the Supabase top-level-await fix). The only conflict was the S0 arm list, which is additive. None of those commits touches this PR's files.

Size (every executable section; on vs off, qb9 rel1)

Supabase size: on rel1 (qb9) both arms stopped at the macro runner: main was broken from 8999cdb (exit 13, top-level await, #14413) until #14425. The row above is from the head rel3 (which contains 963ffae), compiled via /root/supa-one.sh on qb10; the other rows are from rel1 on qb9.

Departures and what is not done

• The sign test moves; it is not deleted. "Don't change which path an out-of-range index takes" means a negative key must still reach the runtime-key arm (mode 0: the exact property-key read). The tier's cold read is mode 2 or the absence-proof mode, and the absence-proof mode assumes a non-negative own-slot key. So the miss arm tests the sign once before its cold read, and the hit path has one unsigned compare.
• In-floor reads keep the split's test. A read proven in the floor has no bound to absorb the test. Their key is proven in [0, floor), so the split's test is redundant there too, but removing it is the "interval proves ≥ 0" case: a different lever, not done here.
• at$idx_u31 clones, Array.prototype.at and typed arrays are not touched. The clones take a raw non-negative i32 and have no split. at() with a negative index has different semantics (it counts from the end). The typed-array element paths have no sign test in front of their bound in the code here.
• The S0 sabotage drops the miss arm's exit. It does not make the hot compare signed: the claim that check mode can test is what the cold read receives.
• Hosts. qb10 was down 13:5x–14:45, so rel1 and its long gates ran on qb9 (owner override). The head (rel2) ran the chess table, peak RSS, the asm census, the fixture/S0/check-mode/hello gates and the suites on qb10. The parity IR census, vf, tssrc lost sites and the size census are from rel1 on qb9. Its N10 code is the same as the head's; the base differs by N1a/N1b and the final D/R1 merge.
• Not measured: macOS (the disk is nearly full; no Mac build was made).