wpfacts, codegen: an element site consumes its key's interval: an int32 key takes no normalizer, a non-negative one no sign test (key signs) - #14458

The "interval proves ≥ 0" lever (CENSUS-residual cause (i), the part N10 #14426 left: "removing it is the 'interval
proves ≥ 0' case"). An element read or store whose key is only statically numeric goes through the canonical key
split: the shared normalizer perry_array_index_normalize_i32 maps every key that is no array index (a fraction,
NaN, a negative, a value past int32) to -1, and the sign of the result picks the element tier or the exact
property-key arm (since N10 the unsigned bound absorbs that test where a bound exists). When the whole-program facts
bound the key, none of that is needed. This PR exports the key interval of every element site and makes codegen
obey it.

Census first (main fd6e707, with the board at rest, #14439)

qb10, callgrind with --dump-instr=yes (exact executions per instruction; an x86-64-v3 build, valgrind cannot run
the native one), chess, all four workloads:

• The split's own test; js/jns/cmovns on element keys is gone already: search 0.42 M executions (the N10
  miss-arm exit of one evaluate read, 2 per call), evaluate 0.20 M, perft 0, legal 0: below 0.01% everywhere. The
  other executed sign tests in chess code are no element keys: make 13.5 M (search) / 0.43 M (perft) / 0.40 M
  (legal) is the set call's index-clone admission of square and piece (lower_call/index_split.rs; piece
  really is negative; the typed-set lane), generatePseudo 2.0 M is color arithmetic, unmake 0.26 M a flag byte.

• What is still executed is the admission in front of that test, the normalizer call (14 instructions per
  call, plus the call sequence and what the call keeps out of registers):

  workload	normalizer calls	self instructions	share	from
  search 250000	26.84 M	375.8 M	1.69%	negamax (orderMoves inlined) 9.14 M, make (the set clone inlined) 8.95 M, set$pshape$generic 4.83 M, evaluate 3.31 M, repetitions 0.31 M, quiescence 0.26 M
  evaluate 100000	1.62 M	22.6 M	1.51%	evaluate (own[file - 1], once per pawn)
  perft 4	0.43 M	6.1 M	1.17%	make 0.23 M, set$pshape$generic 0.20 M
  legal 10000	0.40 M	5.7 M	0.77%	make

  These are the keys codegen cannot prove an index by itself: evaluate's own[file - 1] (the pawn-file Arrays,
  [-1,6]), the four this.zobristA/B[(old + 6) * 128 + square] reads of set (chess.ts:466-472), and in
  orderMoves / negamax the VALUES[...], this.killers[ply * 2] and this.historyScores[from * 128 + to] reads
  and stores (:793-797, :846-849) and the insertion sort's result[i] / scores[j]. Statically the engine module
  has 47 normalizer calls and 44 property-key arms.

• Their keys' intervals (the new probe): 36 of chess's 63 integer-key sites are non-negative int32 (VALUES
[0,8], killers [0,254], historyScores [0,16383], the pawn-file Arrays [0,7]), 9 are int32 that may be
  negative (the zobrist keys [-384,1919], the board stores [-128,255], [-16,143]), 18 are integers past int32
  (loop counters bounded only by a .length: [0,4294967294] for a for-of, [1,2^60] for orderMoves' insertion
  sort).

What changes

• wpfacts (element_keys::collect_signs, ModuleBindings::key_signs): every element site of any operation (a
  read, a store, a called element) whose key is an integer Number inside the int32 range at every copy, and at every
  site that shares its offset, with the hull of its interval. (element_keys, PR-C2, covers reads only and is
  unchanged.) Only the key node's own Number interval counts: a key the solve resolves to the name "3" may be that
  string at run time, so it has no key sign.
• codegen (expr::index_key::{KeyFact, key_fact, store_key_fact, exact_i32}), at the three places that call the
  normalizer or lower an at-rest key as a double:
  • the read split (index_get/runtime_key.rs). A key proven a non-negative int32 is an array index at every
    evaluation: it is converted with one exact fptosi (or is the native integer it was widened from) and enters
    the element tier directly. No normalizer, no sign test, no -1 select, and the property-key arm is not emitted;
    the tier's own cold read serves every miss (the key may still be past the length). An int32 key that may be
    negative also takes no normalizer; its sign is handled as before (N10's miss-arm exit, or the split's test), so
    a negative key still reaches the runtime-key arm with its original double.
  • the runtime-key store (index_set.rs): an int32 key is its i32; the guarded store's one bound
    idx <u capacity declines a negative key onto the exact helper, as it declines the normalizer's -1. A source
    store a[k] = v is a PutValueSet whose index-set fast path (proxy_reflect.rs) built its IndexSet with
    element_offset: 0; it now carries the store's site offset, so the store finds its key fact.
  • at-rest reads (rest_elems::lower_read): a key only the facts prove an int32 takes the int32 forms (the
    rep-keyed tier or one k <u floor) instead of the double round trip.
• Not touched: Array.prototype.at (a negative index counts from the end), the $idx_u31 index clones and their
  call split, typed arrays (their store keeps the normalizer), at-rest stores (rest_elems::lower_write, the
  typed-set lane's file), and a b1 call's synthesized read (it carries the body module's offset, so this module's
  key facts say nothing of it).

The evaluate site (own[file - 1], key [-1,6]; qb10, evaluate$sig, the x86-64-v3 builds of rel1):

off:  lea -0x1(%rbx),%eax ; vcvtsi2sd %eax,%xmm15,%xmm0 ; vmovsd %xmm0,-0x48(%rbp) ;
      call perry_array_index_normalize_i32 ; cmp 0x4(%r12),%eax ; jae <cold>
on:   lea -0x1(%rbx),%edx ; cmp 0x4(%rcx),%edx ; jae <cold>

Switch, probe, witness, sabotage

• PERRY_FACTS_KEY_SIGN=0 (off, false): wpfacts exports no key sign and codegen consumes none (= main). A
  compile-cache input (compile_env.rs, test key_sign_switch_is_a_cache_input).
• Probe (PERRY_FACTS_DUMP): # key_sign module=<m> site=<offset> op=<r|w|rw> key=[lo,hi] int32=<0|1> nonneg=<0|1>,
  one line per element site with an integer key.
• Check mode (PERRY_VERIFY_FACTS=1): each consuming site first tests that its key is an integer inside int32 and,
  when the fact says so, not negative (index_key::witness_sign, Fact::KeySign, "key sign"); a miss reports the
  false proof and exits 86.
• S0 arm key-sign-negative / PERRY_FACTS_SABOTAGE=keysign: every int32 key is claimed non-negative. Correct rc 0
  (the key -2 reads the named property), sabotaged rc 86, predicate key sign.

Results

Chess (qb10, instructions:u M, one build, on vs PERRY_FACTS_KEY_SIGN=0, twice each, identical runs,
checksums and PV equal in every arm).

The head's code (rel3 = d6b8328: this branch merged with main e4f004e, N12 #14442 among others):

Before merging main and before the stores consumed their key fact (rel1 = 88a78d4 on main fd6e707; the off
arm equals a separate build of that main on all four workloads):

Exact per function (callgrind, x86-64-v3 builds of rel3, off vs on; self instructions, M):

Normalizer calls: search 26.84 M → 7.79 M, evaluate 1.62 M → 0, perft 0.43 M → 0, legal 0.40 M → 0. Statically the
engine module goes from 47 normalizer calls to 17 and from 44 property-key arms to 30. The callers gain more than
the 14 instructions of the call: a call site keeps its live values out of the caller-saved registers. What is left
on search (0.50%; 7.35 M of the 7.79 M calls come from orderMoves' insertion sort) are keys that are integers but
not int32 by the facts; see "Not done".

Peak RSS (/usr/bin/time %M, KiB, 5 runs each). rel3, under load: search 25 600–26 368 on, 25 856–26 368
off; perft, evaluate and legal 18 688–19 456 in both arms. rel1, quieter: search 26 880 on and off (one 26 368 in
each arm), the other three 19 456 (one or two 19 200 in either arm). On = off inside the allocator's steps.

Gates

qb10, on vs PERRY_FACTS_KEY_SIGN=0. Gate builds: rel3 = d6b8328 (this branch merged with main e4f004e;
c8adb42 adds only an edit of the new parity fixture, and its arms were rerun on rel3; the PR head then merges
main 6d3cd78, typed set #14450 among others, with one additive conflict in compile_env/tests.rs: that head is cargo checked for perry-wpfacts, perry-codegen and perry with tests, not built or measured)
and rel1 =
88a78d4 (on main fd6e707, before the stores consumed their key fact). Rows without a build name are rel3's.

A first run of the touched test modules on rel1's tree found five failures, all in this PR's new tests: three
wpfacts tests expected a hull from a single caller (the facts give the exact value), and the two codegen tests that
include a store failed because no store consumed its key fact: a[k] = v is a PutValueSet, and its index-set
fast path built the IndexSet with element_offset: 0. d6b8328 carries the site offset (the at-rest store was
already taken before that point, and no other consumer reads the offset of an IndexSet).

Not done

See FOLLOWUPS "[key-sign follow-ups]". In short:

• an integer key past int32 keeps the normalizer: a counter bounded only by a .length is [0,4294967294] (for-of)
  or the widening ladder's top (for (let i = 1; i < xs.length; i++), j-- loops). On chess that is orderMoves'
  insertion sort: 7.35 M of the 7.79 M normalizer calls left on search (0.50%); none on the other three workloads;
• at-rest stores and typed-array stores do not consume the key fact;
• a b1 call's read gets no key fact (its own call_arg_ranges could give one);
• the set call's index-clone admission in make (13.5 M sign tests on search) is the typed-set lane's.