jit: count the admissions the gates refuse, and stop baking a thread's ec into a bridge - #1400

… has

`mapdict_frozen_unboxing_fold` carried `guard_failures=11` and
`surrogate_class_kwargs` carried `loops_aborted=12` and
`fbw_blackhole_adopted_single_frame=12`. All three `pyre/check.py` legs read
13 and 14/14 instead, on dynasm, cranelift and wasm alike, and a local dynasm
run reads the same. No leg flagged either row `UNSTABLE`.

Neither move comes from this branch. `pull_request` CI runs the merge ref, so
main reaches the suite without the branch being touched, and two commits
landed between the run where both fixtures passed (32552199619, created
04:37Z) and the one where both failed (32559523138, 07:24Z):

  b7986c8 (#1410, 05:50Z) raised this fixture's `N` from 406399 to
    2000000 and left the baseline alone.
  4bce927 (#1400, 06:21Z) re-recorded 15 jitstats files of its own.

`guard_failures` here is one per doubling of `N` -- measured at
406399/812798/2000000/4000000/8000000 as 11/12/13/14/15 -- so 11 was the
count at the old size and 13 is the count at the new one. It is the list the
comprehension builds reallocating once per doubling: main records 2 for this
fixture and is green at the larger `N`, because the loop only reaches the JIT
under this branch's `LIST_APPEND` admission, which is what took it 2 -> 11.

`surrogate_class_kwargs` keeps `REPEAT=3200`; its counters follow it, at
800/1600/3200/6400 reading `loops_aborted` 2/5/14/33 with
`fbw_blackhole_adopted_single_frame` equal at every point.

Assisted-by: Claude

… has

`mapdict_frozen_unboxing_fold` carried `guard_failures=11` and
`surrogate_class_kwargs` carried `loops_aborted=12` and
`fbw_blackhole_adopted_single_frame=12`. All three `pyre/check.py` legs read
13 and 14/14 instead, on dynasm, cranelift and wasm alike, and a local dynasm
run reads the same. No leg flagged either row `UNSTABLE`.

Neither move comes from this branch. `pull_request` CI runs the merge ref, so
main reaches the suite without the branch being touched, and two commits
landed between the run where both fixtures passed (32552199619, created
04:37Z) and the one where both failed (32559523138, 07:24Z):

  b7986c8 (#1410, 05:50Z) raised this fixture's `N` from 406399 to
    2000000 and left the baseline alone.
  4bce927 (#1400, 06:21Z) re-recorded 15 jitstats files of its own.

`guard_failures` here is one per doubling of `N` -- measured at
406399/812798/2000000/4000000/8000000 as 11/12/13/14/15 -- so 11 was the
count at the old size and 13 is the count at the new one. It is the list the
comprehension builds reallocating once per doubling: main records 2 for this
fixture and is green at the larger `N`, because the loop only reaches the JIT
under this branch's `LIST_APPEND` admission, which is what took it 2 -> 11.

`surrogate_class_kwargs` keeps `REPEAT=3200`; its counters follow it, at
800/1600/3200/6400 reading `loops_aborted` 2/5/14/33 with
`fbw_blackhole_adopted_single_frame` equal at every point.

Assisted-by: Claude

… has

`mapdict_frozen_unboxing_fold` carried `guard_failures=11` and
`surrogate_class_kwargs` carried `loops_aborted=12` and
`fbw_blackhole_adopted_single_frame=12`. All three `pyre/check.py` legs read
13 and 14/14 instead, on dynasm, cranelift and wasm alike, and a local dynasm
run reads the same. No leg flagged either row `UNSTABLE`.

Neither move comes from this branch. `pull_request` CI runs the merge ref, so
main reaches the suite without the branch being touched, and two commits
landed between the run where both fixtures passed (32552199619, created
04:37Z) and the one where both failed (32559523138, 07:24Z):

  b7986c8 (#1410, 05:50Z) raised this fixture's `N` from 406399 to
    2000000 and left the baseline alone.
  4bce927 (#1400, 06:21Z) re-recorded 15 jitstats files of its own.

`guard_failures` here is one per doubling of `N` -- measured at
406399/812798/2000000/4000000/8000000 as 11/12/13/14/15 -- so 11 was the
count at the old size and 13 is the count at the new one. It is the list the
comprehension builds reallocating once per doubling: main records 2 for this
fixture and is green at the larger `N`, because the loop only reaches the JIT
under this branch's `LIST_APPEND` admission, which is what took it 2 -> 11.

`surrogate_class_kwargs` keeps `REPEAT=3200`; its counters follow it, at
800/1600/3200/6400 reading `loops_aborted` 2/5/14/33 with
`fbw_blackhole_adopted_single_frame` equal at every point.

Assisted-by: Claude

… has

`mapdict_frozen_unboxing_fold` carried `guard_failures=11` and
`surrogate_class_kwargs` carried `loops_aborted=12` and
`fbw_blackhole_adopted_single_frame=12`. All three `pyre/check.py` legs read
13 and 14/14 instead, on dynasm, cranelift and wasm alike, and a local dynasm
run reads the same. No leg flagged either row `UNSTABLE`.

Neither move comes from this branch. `pull_request` CI runs the merge ref, so
main reaches the suite without the branch being touched, and two commits
landed between the run where both fixtures passed (32552199619, created
04:37Z) and the one where both failed (32559523138, 07:24Z):

  b7986c8 (#1410, 05:50Z) raised this fixture's `N` from 406399 to
    2000000 and left the baseline alone.
  4bce927 (#1400, 06:21Z) re-recorded 15 jitstats files of its own.

`guard_failures` here is one per doubling of `N` -- measured at
406399/812798/2000000/4000000/8000000 as 11/12/13/14/15 -- so 11 was the
count at the old size and 13 is the count at the new one. It is the list the
comprehension builds reallocating once per doubling: main records 2 for this
fixture and is green at the larger `N`, because the loop only reaches the JIT
under this branch's `LIST_APPEND` admission, which is what took it 2 -> 11.

`surrogate_class_kwargs` keeps `REPEAT=3200`; its counters follow it, at
800/1600/3200/6400 reading `loops_aborted` 2/5/14/33 with
`fbw_blackhole_adopted_single_frame` equal at every point.

Assisted-by: Claude

… has

`mapdict_frozen_unboxing_fold` carried `guard_failures=11` and
`surrogate_class_kwargs` carried `loops_aborted=12` and
`fbw_blackhole_adopted_single_frame=12`. All three `pyre/check.py` legs read
13 and 14/14 instead, on dynasm, cranelift and wasm alike, and a local dynasm
run reads the same. No leg flagged either row `UNSTABLE`.

Neither move comes from this branch. `pull_request` CI runs the merge ref, so
main reaches the suite without the branch being touched, and two commits
landed between the run where both fixtures passed (32552199619, created
04:37Z) and the one where both failed (32559523138, 07:24Z):

  b7986c8 (#1410, 05:50Z) raised this fixture's `N` from 406399 to
    2000000 and left the baseline alone.
  4bce927 (#1400, 06:21Z) re-recorded 15 jitstats files of its own.

`guard_failures` here is one per doubling of `N` -- measured at
406399/812798/2000000/4000000/8000000 as 11/12/13/14/15 -- so 11 was the
count at the old size and 13 is the count at the new one. It is the list the
comprehension builds reallocating once per doubling: main records 2 for this
fixture and is green at the larger `N`, because the loop only reaches the JIT
under this branch's `LIST_APPEND` admission, which is what took it 2 -> 11.

`surrogate_class_kwargs` keeps `REPEAT=3200`; its counters follow it, at
800/1600/3200/6400 reading `loops_aborted` 2/5/14/33 with
`fbw_blackhole_adopted_single_frame` equal at every point.

Assisted-by: Claude

…ing `_operator.index` as a body effect (#1382)

* jit-trace: classify `_operator.index` on an int operand as replay-safe

`writes_live_heap` holds for every `CallFn` residual, so `_operator.index`
was booked as a body effect. `space_index` returns an int argument unchanged
ahead of any `__index__` lookup, so that call runs no user code and mutates
nothing.

`provably_side_effect_free` now recognises it by the observed-value idiom the
neighbouring classes use: the callable pinned by fn-pointer identity, the
operand observed to be an int. Reaching that identity moved `index` out of the
`py_module!` `functions:` arm, whose `py_checked_arity_fn!` wrapper makes the
installed `BuiltinCode.func` pointer unnameable, into `interpleveldefs:` with
`make_module_builtin_function_with_arity`, which keeps `fast_natural_arity`.

With the call no longer an effect, the mid-body walk abort in
`for_iter_call_bearing_comprehension.py` reads `effects=0` and commits a
forward resume (`resume_py_pc=79`) instead of refusing the consumed item's
delivery; the in-flight take is not reached at all.

`bench/synth/foriter_operator_index_replay_regression.py` pins the carve-out:
it calls `_index` on an int and on an object whose `__index__` counts its
invocations, and a trailing `id()` forces the sub-walk abort and replay.

Assisted-by: Claude

* jit: admit LIST_APPEND in a FOR_ITER body that also contains a call

The `body_has_call` scan is removed, so the FOR_ITER admission gate no longer
withholds `LIST_APPEND` from a body carrying `CALL`/`CALL_KW`/`CALL_FUNCTION_EX`
— both opcodes were already admitted on their own.

Measured on the shape the gate was costing, same binary either way:
`[uf(x) for x in it]` runs 4.33s declined and 0.31s admitted, while the
statement form `for x in it: l.append(uf(x))` is 45x in both arms. 24 fixtures
change admission; a 7-rep per-fixture median moves +0.4%. Every jitstats delta
is `loops_compiled` 0 -> 1 or 2 with guards and bridges following, and an
N-sweep at x1/x2/x4 holds the counts flat (`minmax_key_rooting` 409/411/413,
`subscr_user_getitem_stack_index` 401/401/401), so the moves are warm-up.

Three `eval::tests` asserted the removed scan. The direct pin is inverted;
`unsafe_later_loop_does_not_blacklist_an_earlier_loop` and
`loop_region_includes_out_of_line_handler_rejoining_mid_body` used a
call-bearing comprehension only as an unsafe body and now use `with`, whose
`LOAD_SPECIAL` stays withheld. The second needed the `with` inside a loop of
its own: `loop_region_for_iter_bodies_all_jit_safe` scans the `ForIter` pcs it
finds in the region, so an unsafe op in the out-of-line handler is reachable
only through a `ForIter` there.

`extra_tests/parity_tests/for_iter_widened_list_append_never_doubles.py` pins
the element count and a call counter over 200 trials, in both the
comprehension and named-accumulator forms.

`for_iter_call_body_admitted` (`PYRE_FORITER_CALL_BODY`) gated the same
admission behind an off-by-default env var. Its only caller is the line above,
so it goes with the scan, and `gate-triage.md` moves it out of the default-OFF
experiments bucket.

Assisted-by: Claude

* check.py: refuse a --no-build run whose artefacts predate the sources

`--no-build` skips every artefact of a backend, and wasm has two: the native
runner and the wasm module the runner loads. A module left behind by an
earlier build produced a full green run, and a set of recorded baselines, for
code it did not contain; the only signal was one fixture failing on output
rather than on jitstats.

`require_fresh_artefacts` compares each artefact's mtime against the newest
tracked `.rs`/`.toml`/`.lock` and extracted `.ullbc`, and exits naming both
files. It is skipped under `--pyre-path`, whose binary comes from outside this
tree, and fails open where the tree cannot be enumerated. Enumerating the 1053
inputs costs 33ms.

`build_wasm_backend` now stamps the snapshot's mtime with `os.utime` when a
rebuild reproduces identical bytes. Without that the module would read as
stale on every subsequent run, since the copy is skipped precisely to keep the
content-hash-keyed `.cwasm` cache.

Assisted-by: Claude

* check.py: key the --no-build freshness gate on input content, not mtime

Two corrections to the gate.

The suffix allowlist (`.rs`/`.toml`/`.lock`/`.ullbc`) was not the set of build
inputs: `pyre-interpreter/build.rs` compiles the CJK codec `.c`/`.h` sources,
and the app-level `.py` bodies reach the binary through `include_str!`. Editing
either left the gate silent. The set is now every tracked file under a
workspace member directory whatever its suffix — derived from the root
`Cargo.toml` `members` array, as `pyrex/tests/gate_triage_complete.rs` derives
its own roots — plus the root manifests, `build/llbc/*.ullbc`, and every path
the build scripts declared with `cargo:rerun-if-changed=`, read back out of
`target/*/build/*/output`. That last source covers inputs outside any crate
(build.rs embeds a `lib-python/3` closure under `wasm_vfs`) without this check
carrying a second copy of the list.

mtime does not answer the question the gate asks. A concurrent
`git checkout <ref> -- .` in this worktree re-stamped whole subtrees twice in
one session with no content change, and the gate then refused three current
binaries. Each build now stamps `<artefact>.inputs` with a sha256 over those
inputs' contents and `--no-build` compares stamps; an artefact built outside
this script carries none and is reported as unchecked rather than refused.
Hashing ~1000 inputs costs 0.63s.

The `os.utime` on an unchanged wasm snapshot goes away with the mtime read it
existed for.

Controls: build then `--no-build` passes; `touch` on three inputs with no
content change still passes; one appended line in the CJK `.c`, and separately
in `app_multibytecodec.py`, is refused; reverting passes again.

Assisted-by: Claude

* check.py: derive the build-input set from the tree alone

Reading the build scripts' `cargo:rerun-if-changed=` declarations back out of
`target/*/build/*/output` is removed. It made the fingerprint depend on which
profiles and targets had been built, and it was inert while doing so: those
paths are written relative to each crate's own directory, so 56 of the 57 did
not resolve from the repository root and the 57th was `Cargo.toml`, already in
`ROOT_BUILD_INPUTS`. Removing it also retires the question of which of Cargo's
two directive spellings to parse.

The two inputs that genuinely sit outside the tracked member set are now named
directly. `PYRE_MIR_FRONTEND_LLBC` overrides the LLBC the front end reads
(`majit-translate/src/lib.rs:185`), so `llbc_input_paths` follows that
precedence instead of always globbing `build/llbc`. The `lib-python/3` closure
`pyre-interpreter/build.rs` embeds is guarded by `wasm_vfs`, a feature no
artefact this script measures is built with; `build_input_paths` records that
exclusion rather than carrying a copy of the list.

`workspace_member_dirs` parses `members` with an anchored regex instead of an
exact `"\nmembers = ["` split, which returned nothing for `members=[…]` and so
disabled the gate silently, and expands a glob member rather than reading it as
a literal directory.

The digest now takes each input's path before attempting the read, so a tracked
but unreadable file is distinguishable from an absent or empty one instead of
contributing nothing. A `None` path list is cached like any other result, and a
stamp that cannot be written says so.

Controls: build then `--no-build` passes; `touch` on three inputs with no
content change passes; one appended line in the CJK `.c`, in
`app_multibytecodec.py`, or `chmod 000` on the `.c`, each refuses; reverting
passes. The five `members` spellings in the review, plus a `default-members`
array above the real one, all parse.

Assisted-by: Claude

* jit-trace: source a branch-guard kept slot from the guard pc's own color map

`collect_outer_active_boxes` reported a kept operand-stack slot as unsourced
whenever the walk mirror held `OpRef::NONE` for it and the decoded edge-move
recovery carried no entry, and the branch-guard snapshot capture turned that
into `DispatchError::BranchGuardKeptSlotUnsourced`.

A slot whose live value is a NULL is such a hole by construction:
`reseed_vstack_from_shadow` sources the mirror from a dense array in which an
absent slot and a written NULL are the same word, so it refuses both.

Do not report the hole when `pcdep_color_slots` at the guard pc maps the color
to the same semantic slot. There `regs_r[color]` is the value
`get_list_of_active_boxes` (`pyjitpl.py`) reads as `registers_r[index]`, and
the operand-stack arm below already selects it through the same
`guard_pc_proves_slot` test. That resolution is hoisted to one site and read by
both.

On `pyre/bench/synth/surrogate_class_kwargs` the FOR_ITER back-edge guard at
the comprehension's loop header stopped declining: the walk that ended
`BranchGuardKeptSlotUnsourced committed=false leg=0 effects=10` now ends
`CloseLoop committed=true`, and `loops_aborted` and
`fbw_rolled_back_with_effects` are 0 again on all three backends.

Assisted-by: Claude

* interpreter: force the caller frame in type()'s __module__ fill

The three-argument `type()` path read the caller frame from the
`CURRENT_FRAME` thread-local. `ensure_module_attr` reads it through
`getexecutioncontext().gettopframe_nohidden()`, which starts at
`gettopframe()` and forces the frame through the `topframeref()` deref.

Route the read through `gettopframe_nohidden()` and call `force_frame`
before reading `w_globals`.

With the force in place `tracing_after_residual_call` reports the escape
at the `type()` residual, so a trace whose body creates a class aborts
with ABORT_ESCAPE. Re-recorded jitstats for the two fixtures that
covers, on all three backends:

  surrogate_class_kwargs     loops_compiled 3 -> 4, bridges_compiled 2 -> 0,
                             loops_aborted 0 -> 12, guard_failures 0 -> 2159
  type_name_surrogate_reject bridges_compiled 1 -> 0,
                             guard_failures 201 -> 18923

pypy on type_name_surrogate_reject reports `abort: vable escape: 1`,
2 loops and 0 bridges.

Assisted-by: Claude

* check.py: count untracked inputs, re-read the digest per build, and bind each stamp to its artefact

Three gaps in the `--no-build` freshness gate, all reported on #1382.

`build_input_paths` enumerated with `git ls-files`, which lists tracked
files only. A `.rs` under a member crate compiles into the artefact before
it is staged, so editing it left the fingerprint unchanged, and deleting it
returned the fingerprint to its earlier value while the artefact still held
its code. Enumerate with `--cached --others --exclude-standard`.

`build_inputs_fingerprint` is documented as computed after a build, because
cargo may rewrite `Cargo.lock`. Its memoisation made that hold for the first
stamped artefact only: a run building several backends stamps after each
one, and later stamps carried a digest read before the build that produced
them. Add `invalidate_build_inputs_fingerprint` and call it after each
build, so the memoisation covers the read-only path alone.

The stamp recorded the input digest but not which artefact it described. A
cargo build outside this script overwrites the executable and leaves the
sidecar; restoring the tree to the stamped state then made the input digests
agree over different code. Record the artefact's own sha256 beside the input
digest and check it first. A stamp in the previous single-line format reads
as absent, which is the existing "built outside this script" path.

Assisted-by: Claude

* jit, bench: say which of LIST_APPEND and its body is admitted unconditionally

The FOR_ITER gate comment read as though the body were admitted whatever it
contains. What is unconditional is the `LIST_APPEND` opcode; the scan below
still walks every body instruction and refuses the whole FOR_ITER on the
first one outside the permitted set.

Also annotate `__index__` in the replay-regression fixture with its `int`
return type (Ruff ANN204).

Assisted-by: Claude

* bench: record type_name_surrogate_reject's dynasm and cranelift jit-stats at the value CI measures

The dynasm and cranelift baselines carried `loops_aborted=0`,
`guard_failures=18923`, `fbw_blackhole_adopted_single_frame=0`, snapshotted
from a build on this machine.  All three `pyre/check.py` legs of the PR run
(ubuntu-24.04, windows-latest, macos-latest) report the same other vector on
both backends instead: `loops_aborted=1`, `guard_failures=17799`,
`fbw_blackhole_adopted_single_frame=1`, with `loops_compiled=2` and
`bridges_compiled=0` unchanged.  None of the three legs flagged the row
`UNSTABLE`, so the re-run each performs read the same counters again.

The `.wasm` baseline already carries `loops_aborted=1` and
`fbw_blackhole_adopted_single_frame=1`, and its sandbox job passed.

`MAJIT_LOG=1` on this machine's build counts 18922
`handle_async_forcing] forced` lines against `guard_failures=18923`, and no
`abort trace at key=` line.

Assisted-by: Claude

* bench: record pickle_terminal_raise_resume's wasm loops_aborted at the value CI measures

The baseline carried `loops_aborted=10`, snapshotted on this machine when the
FOR_ITER `LIST_APPEND` widening landed. `pyre/check.py (ubuntu-24.04)` reports
9 on the current base, with `guard_failures=316` and `loops_compiled=70`
matching the baseline exactly — `loops_aborted` is the only field that moved,
and it moved down.

The same leg read 10 on the earlier base `bd18056d428` and did not flag the row
`UNSTABLE`, so its same-binary re-run read 9 twice here.

Assisted-by: Claude

* parity: halve re_jit_call_resume's trip count

The dynasm arm timed out against the runner's 30s per-fixture budget on
windows-latest and, in a later run, on macos-latest. Bracketing the parity
log's neighbouring fixture timestamps puts the three-runtime block at 31-35s,
of which cpython and cranelift take about 5s, so dynasm alone was running at
roughly 27s against the 30s cap. The same bracket on main's windows leg reads
31.2s, so the margin is not something this branch introduced.

At 5_000 the fixture keeps `bridges_compiled=16`,
`fbw_rolled_back_with_effects=1`, `loops_compiled=32` (33 at 10_000) and 12 of
the 15 `fbw_blackhole_adopted_single_frame` adoptions. At 2_000 it does not:
6 adoptions, `fbw_rolled_back_with_effects=0`, `loops_aborted` 18 -> 6.

Assisted-by: Claude

* check.py: frame each file's content in the build-input digest, and gate the wasm module the runner loads

`build_inputs_fingerprint` fed each file's bytes into one running hash straight
after its path, leaving the boundary between one file's content and the next
file's name unmarked. A file holding `b"b\0x"` at path `a` produced the same
digest as an empty `a` beside a `b` holding `x`, and the `<unreadable>\0`
marker collided with a file whose content was those bytes. Each entry now
contributes a one-byte tag and, when the file was read, its own sha256 —
fixed-width, so the concatenation is unambiguous. Verified on both collisions
plus a stability/sensitivity pair.

`pyre_env` defaults `PYRE_WASM_MODULE` to `WASM_MODULE_PATH` but leaves an
inherited value alone, so under an override the `--no-build` existence check
and the freshness check both asked about a file the run never opens. Both now
resolve the module through `effective_wasm_module`. The module is also asked
about under `--pyre-path`, which previously skipped the whole block: the runner
comes from outside the tree but the module does not, and one that does carries
no stamp and draws the existing unchecked-freshness note.

Assisted-by: Claude

* object: cite rutf8's upstream members by symbol alone

The module doc named each `rpython/rlib/rutf8.py` member it accounts for and
appended that member's line number — 16 of them, the most in any file in the
tree. The symbol precedes every one, so the number carried nothing the
citation did not already have, and `scripts/check-new-line-citations.py`
judges only what a commit adds, so they were out of its reach.

Doc comment only; the paragraphs are reflowed to the same width.

Assisted-by: Claude

* jit-trace: resolve a blackhole codepoint index through the string's index table

`bh_unicodegetitem` read the operand as `code_points().nth(index)`, a linear
walk per access that consulted neither `W_UnicodeObject.byte_len` nor
`index_storage`. It reached the payload through `UNICODE_VALUE_OFFSET` alone,
so the two answers the rest of pyre gives for a codepoint index — an ASCII
payload indexes its bytes directly, a wider one resolves the position through
the cached `rutf8` table — were both unavailable to it. RPython's UNICODE is
an array, so upstream's `bh_unicodegetitem` never walks.

It now takes the same two arms `w_str_codepoint_at` does, and builds nothing:
a blackhole runs inside a deopt, so the table arm is taken only when the table
is already there and the walk remains the fallback. The bound is now the `len`
field rather than the walk running out, so an out-of-range or negative index
stops without scanning the string.

Values are unchanged by construction — all three arms are compared against a
codepoint walk over the whole index range, for an ASCII operand, a wide one
with and without its table built, and one carrying a lone surrogate.

Assisted-by: Claude

* object: port rutf8's check_utf8 and move the invalid-byte predicates to it

`rutf8.rs` declared `check_utf8` and `_check_utf8` covered by
`Wtf8::from_bytes`.  They are not: that function's surrogate arm matches
`[0xed, 0xa0.., b3, ..]`, leaving the second byte unbounded above and the
third unconstrained, so it accepts `ED C0 80` and `ED A0 41`, neither of
which encodes a code point.  It also has no way to spell
`allow_surrogates=False`.

Port `check_utf8` — `_check_utf8`'s ones'-complement return and the
`CheckError` its caller raises from it fused into one `Result` — and the
three predicates it shares with `typedef.rs`'s decoder, which now reads
them from here.  `codepoints_in_utf8` calls `invalid_cont_byte` instead of
respelling it.  `wtf8_from_bytes` is the `&Wtf8` view of a checked buffer.

Upstream's `start`/`stop` window is left out; no pyre caller has one.

Assisted-by: Claude

* pickle, marshal, time: check bytes from outside the runtime with check_utf8

`_pickle::str_from_utf8`, the marshal wire reader's `read_wtf8`, and
`interp_time`'s strftime result all validated with `Wtf8::from_bytes`.
It accepts `ED C0 80`, so `marshal.loads(b'u\x03\x00\x00\x00\xed\xc0\x80')`
returned a str whose stored code point count was 2 over a 3-byte buffer,
and the first random access read past the buffer inside
`create_utf8_index_storage`:

    index out of bounds: the len is 3 but the index is 3
      pyre-object/src/rutf8.rs:73  ->  pyre/pyrex/src/lib.rs:563

All three now go through `rutf8::wtf8_from_bytes`.  `read_wtf8` is a
provided method on the wire `Read` trait, so both marshal readers override
it; `unmarshal_bytes` gets a `BytesReader` wrapper to carry the override
and the error sink.  A rejected marshal payload raises the same
`UnicodeDecodeError` `r_object`'s `surrogatepass` decode does rather than
`bad marshal data`.

`utf8_decode_error` moves from `_pickle` to `typedef`, beside
`unicode_decode_error`, and takes a slice.

Assisted-by: Claude

* bytes.hex: read a separator's ASCII test off its WTF-8 payload

`b"ab".hex(chr(0xdc80))` reached `w_str_get_value`, which panics on a
buffer holding a lone surrogate, so the interpreter aborted where CPython
and PyPy raise `ValueError: sep must be ASCII.`  The str and bytes arms now
differ only in how they name the byte slice.

Assisted-by: Claude

* _json: bound scanstring's and scan_once's index by the code point count

`w_str_index_to_byte` takes an index in range, so the bound is the caller's
to check.  `scanstring_impl` checked only `end < 0` and `scanner_call_impl`
compared a byte offset it had already resolved, so
`_json.scanstring('中'*100, 200)` and
`json.JSONDecoder().scan_once('中'*100, 200)` indexed the index table out
of bounds and aborted:

    index out of bounds: the len is 2 but the index is 3
      pyre-object/src/rutf8.rs:201

An ASCII subject took the identity early-out and did not reach it.
`py_scanstring` and `scanner_call` compare against the code point count,
which is what both now do before resolving the offset.

Assisted-by: Claude

* parity: add utf8_check_untrusted_bytes

Covers the four cases above against CPython 3.14: the two three-byte
sequences that encode no code point through marshal and pickle, the lone
surrogate and the surrogate pair that must still decode, the two `_json`
entry points indexed past the subject, and a lone-surrogate `bytes.hex`
separator.

Assisted-by: Claude

* object: keep the crate's scan in wtf8_from_bytes, restoring only its two bounds

`str::from_utf8` scans a word at a time and `check_utf8` a byte at a time.
Measured over 200k short ASCII names (6.5 MB), the shape a marshal load
carries: 0.08 ns/byte against 0.35, so routing `read_wtf8` through the
faithful port cost 4.2x on a boundary every import crosses.

`wtf8_from_bytes` now runs the crate's own loop with the surrogate arm
bounded as `_invalid_byte_2_of_3` and `_invalid_byte_3_of_3` bound it —
0.10 ns/byte.  `check_utf8` stays for its code point count and its
`allow_surrogates=false` arm.  A differential test over every two-byte
buffer, every `0xE0..=0xEF`-led three-byte buffer, and the four-byte leads
around both range bounds holds the two to one answer.

Assisted-by: Claude

* bytes.fromhex: read the hex scan off the WTF-8 payload

`bytes.fromhex(chr(0xdc80))` reached `w_str_get_value` and aborted where
CPython and PyPy both raise `non-hexadecimal number found in fromhex() arg
at position 0`.  Every character before the first rejected one is a hex
digit or ASCII whitespace, so the byte offset the scan reports is the code
point offset `_PyBytes_FromHex` names.

Found by driving a lone surrogate through 78 str-taking entry points: it
was the only further abort.  `float`, `complex` and `memoryview.cast`
diverge from CPython there too, but each matches pypy3, so those are the
standing spec-versus-implementation question and are left alone.

Assisted-by: Claude

* codecs: take allow_surrogates as an argument instead of deriving it

`str_decode_utf8` defaults `allow_surrogates` to false and only
`interp_codecs.utf_8_decode` turns it on, and the two answers differ:

    b'\xed\xa0'.decode('utf-8', 'surrogatepass')
      pyre 0..2 'unexpected end of data'
      CPython 3.14 and pypy3 both 0..1 'invalid continuation byte'
    _codecs.utf_8_decode(b'\xed\xa0', 'surrogatepass', True)
      pyre 0..2, pypy3 0..2, CPython 0..1

Deriving the flag from `err_mode` inside the decoder gave the `bytes.decode`
path the `_codecs` answer, which matches neither reference.  With the flag
off there, the state machine stops at the bad continuation byte and
`surrogatepass_errors` decodes a complete `ED A0..BF 80..BF` itself; the
`_codecs` arm keeps PyPy's answer, which is what its own caller now passes.

All ten rows of the two entry points now agree with pypy3 exactly, and the
`bytes.decode` half also with CPython 3.14.

Assisted-by: Claude

* codecs: try the check before the state machine, as str_decode_utf8 does

`str_decode_utf8` runs `rutf8.check_utf8` first and only falls into
`_str_decode_utf8_slowpath` on `CheckError`.  pyre had no such arm: every
decode ran the byte-at-a-time machine, including the case where the buffer
is already well formed and is its own answer.

`wtf8_from_bytes` takes `allow_surrogates` so it can serve both — with the
flag off it is `str::from_utf8`, whose `valid_up_to` is the same offset
`check_utf8` reports.  Measured on a 39-byte ASCII name:

    bytes.decode('utf-8')            231.5 -> 166.1 ns
    bytes.decode(surrogateescape)    254.5 -> 180.5 ns
    os.listdir, per entry            452.3 -> 382.0 ns

`decode_object`'s own fast paths are deliberately not ported with it: its
`check_utf8_or_raise` passes `allow_surrogates=True`, which is why pypy3
returns '\ud800' from `str(b'\xed\xa0\x80', 'utf-8')` while its own
`bytes.decode` raises.  pyre raises on both, with CPython 3.14.

Assisted-by: Claude

* bytes.decode: stop copying the codec name, the error mode and the fold

`str_utf8_w` hands back the string object's own buffer and both arguments
stay rooted for the call, so the two `to_string()` copies were pure cost;
`to_ascii_lowercase().replace('_', "-")` allocated twice more, on a name
that is already spelled that way at every call inside the runtime and in
`bytes.decode`'s own default.

Four allocations per decode, on the path a 39-byte name crosses:

    bytes.decode('utf-8')            166.1 -> 127.6 ns
    bytes.decode(surrogateescape)    180.5 -> 139.3 ns
    bytes.decode('ascii')            243.7 -> 203.6 ns

Assisted-by: Claude

* rustfmt

Assisted-by: Claude

* gate-triage: stop naming the retired FOR_ITER gate in a live section

`every_live_triage_entry_still_has_a_reader` reads any `PYRE_*` name in a
non-history section as a live entry, so the sentence recording that the gate
had graduated re-listed it as live with no reader in the tree.  The fact
stays; the name goes, which is what the document's history is for.

Assisted-by: Claude

* check.py: fail open when the root manifest cannot be read

`build_input_paths` documents an unenumerable tree as fail-open and returns
`None` for an empty member list, but `workspace_member_dirs` read
`Cargo.toml` unguarded, so an absent or unreadable manifest raised `OSError`
out of `build_inputs_fingerprint` and ended the run on a traceback instead.

Assisted-by: Claude

* marshal, pickle: report the byte the surrogatepass validator stopped at

Both readers decode with `surrogatepass`, so `rutf8::wtf8_from_bytes` accepts
an encoded surrogate and rejects whatever follows it.  The error was then
built by `utf8_decode_error`, which restarts a strict scan from byte 0 --
and a strict scan stops at the surrogate the validator had accepted.  A
`u`/`\x8c` payload of `\xed\xa0\x80\xff` reported byte 0xed at 0..1 where
CPython 3.14 reports 0xff at 3..4.

`utf8_decode_error_from` takes the validator's position and resumes the
strict scan there; everything WTF-8 rejects at a position UTF-8 rejects
there too, so the resumed scan stops immediately and the reason and end
come out as before, shifted.  `read_line` keeps the from-zero form: pickle's
text protocols are strict UTF-8, where the two scans agree.

Six payloads covering both readers now match the oracle, including a
trailing truncated sequence and a second surrogate that does not encode.

Assisted-by: Claude

* codecs: narrow the surrogate allowance to a complete encoded surrogate

`interp_codecs.utf_8_decode` turns `allow_surrogates` on, which admits
`ED A0..BF` as a lead pair; `_str_decode_utf8_slowpath` then reports the
whole admitted pair when the sequence fails, so a truncated or badly
continued one spans two bytes.  `unicode_decode_utf8` has no
`allow_surrogates` at all and spans one.

Measured over the 42 rows of `utf8_surrogatepass_error_span.py` on CPython
3.14.0 and pypy3: the two disagree on exactly the six where the pair is a
surrogate and the sequence does not complete, and agree everywhere else --
including every non-surrogate lead, every four-byte sequence, and the
retention of a truncated pair at the end of a non-final chunk.  Since a
caller reads the span off `UnicodeDecodeError.start`/`.end`, this takes the
3.14 answer: the allowance now covers `ED A0..BF 80..BF` whole and nothing
less, and a pair that does not complete falls back to the span the
allowance was suspending.  `_surrogate_bytes` (`rutf8.py`) is the predicate,
ported beside the two `_invalid_byte_2_of_*` it belongs with.

Neither `str_decode_utf8` nor `_str_decode_utf8_slowpath` nor
`_invalid_byte_2_of_3` nor `_surrogate_bytes` carries a jit hint; the only
one in the family is `@jit.elidable` on `_check_utf8`, the fast-path
checker, which produces no span.  `_codecs.utf_8_decode` is the one caller
that passes the flag on, so nothing else moves: `bytes.decode` and every
`decode_utf8_with_errors` route pass it off and already matched both.

All 42 rows of the two entry points now read as CPython 3.14 does.

Assisted-by: Claude

* jit-trace: keep a guard-owned stack slot's NULL register value

The guard-proved arm reads the walk register because the guard pc's
`pcdep_color_slots` proves the color owns the slot there, which makes the
read exactly `registers_r[index]` -- but it read it through `walk_real`,
which drops a CONST_NULL, and then answered from the virtualizable shadow
instead.  `MIFrame` registers preserve a NULL box in a snapshot, so where
the proof holds the register's NULL is the value, not an absence to route
around.

The two arms without the proof are unchanged, including the one the shadow
answers: `synth/nested_break_not_hot` is what pins that a NULL shadow slot
must not win, and it is not reached from here.

Assisted-by: Claude

* object: pin the invariant surrogate_bytes is read under

The decoder's two `n == 3` span arms consult `surrogate_bytes` only after
`invalid_byte_2_of_3` has passed, and read it as "the allowance is why this
pair got through".  That reading is sound only if the predicate names exactly
the pairs the two `allow_surrogates` answers disagree on, which the test now
checks over every `0xE0..=0xEF` lead and all 256 second bytes.

Assisted-by: Claude

* Revert "jit-trace: keep a guard-owned stack slot's NULL register value"

This reverts commit 2d73d88fba8f95ac6a4ba0b1f2b30dfb3ba2a4f0.

Accepting a CONST_NULL walk register under the guard's ownership proof is
upstream-faithful in the abstract -- `registers_r[index]` does preserve a NULL
box -- but measured it costs more than it buys, on every host and every
backend:

    surrogate_class_kwargs        loops_aborted   12 -> 14
    mapdict_frozen_unboxing_fold  guard_failures  11 -> 13

identical on ubuntu-24.04 and windows-latest, dynasm, cranelift and wasm
alike.  `surrogate_class_kwargs` is the fixture whose kept-slot aborts
`6701c836308` closed, and it is the one that says why: a kept operand slot
whose value is NULL is a hole `reseed_vstack_from_shadow` cannot represent,
because it reads a dense array where an absent slot and a written NULL are
the same word.  Proving ownership is what lets the *decline* stand down; it
does not give the downstream consumer a way to carry the NULL, so feeding it
forward re-opens the hole the proof was meant to close.

The case the change was for -- a NULL walk register beside a non-NULL shadow
-- was never observed; the one trace on record has both NULL, where the two
arms agree.

Assisted-by: Claude

* object: drop the unused mut on the agreement test's probe closure

The closure stopped capturing the buffer when it took it as a parameter.

Assisted-by: Claude

* jit-trace: refuse a blackhole item index that does not convert to an offset

`bh_strgetitem` and `bh_unicodegetitem` cast the operand with `index as
usize`. A negative one wraps to a value the bounds test rejects, but where
`usize` is 32 bits -- the wasm32 target -- an operand wider than `u32`
truncates into range and reads the wrong element. Both now take the index
through one `usize::try_from`.

Assisted-by: Claude

* bench: record the two fixtures at the size and gate counting main now has

`mapdict_frozen_unboxing_fold` carried `guard_failures=11` and
`surrogate_class_kwargs` carried `loops_aborted=12` and
`fbw_blackhole_adopted_single_frame=12`. All three `pyre/check.py` legs read
13 and 14/14 instead, on dynasm, cranelift and wasm alike, and a local dynasm
run reads the same. No leg flagged either row `UNSTABLE`.

Neither move comes from this branch. `pull_request` CI runs the merge ref, so
main reaches the suite without the branch being touched, and two commits
landed between the run where both fixtures passed (32552199619, created
04:37Z) and the one where both failed (32559523138, 07:24Z):

  b7986c8 (#1410, 05:50Z) raised this fixture's `N` from 406399 to
    2000000 and left the baseline alone.
  4bce927 (#1400, 06:21Z) re-recorded 15 jitstats files of its own.

`guard_failures` here is one per doubling of `N` -- measured at
406399/812798/2000000/4000000/8000000 as 11/12/13/14/15 -- so 11 was the
count at the old size and 13 is the count at the new one. It is the list the
comprehension builds reallocating once per doubling: main records 2 for this
fixture and is green at the larger `N`, because the loop only reaches the JIT
under this branch's `LIST_APPEND` admission, which is what took it 2 -> 11.

`surrogate_class_kwargs` keeps `REPEAT=3200`; its counters follow it, at
800/1600/3200/6400 reading `loops_aborted` 2/5/14/33 with
`fbw_blackhole_adopted_single_frame` equal at every point.

Assisted-by: Claude

* jit-trace: carry an in-flight FOR_ITER item through an aborted sub-walk

`fbw_abort_nested_unjournaled_residual` computed `blackhole_required` from
the innermost frame's executed-effect delta. An in-flight FOR_ITER item
belongs to no frame image, so an effect committed in an enclosing frame left
that delta at zero while `fbw_foriter_inflight_take` refused the item on its
own body-effect mark. The abort then took the legacy drop path, and the item
was neither delivered nor rolled back: the body ran for it and its value did
not reach the accumulator.

`blackhole_required` now also reads the signal the refusal reads, so the
forward blackhole is armed for that case.

Adds a parity fixture. Its accumulator is a statement loop, so the shape
carries no LIST_APPEND.

Assisted-by: Claude

* jit-trace: test the blackhole item index conversion

Covers negative operands and, where `usize` is 32 bits, one wider than `u32`.

Assisted-by: Claude

* check.py: fingerprint files a member crate embeds from outside the member tree

`build_input_paths` selected inputs by path prefix, so a file named by an
`include_str!` outside every workspace member was absent from the digest.
`majit-metainterp/src/ruleopt/mod.rs` embeds
`rpython/jit/metainterp/ruleopt/real.rules`, which `rustc` records in the
release artefact's depinfo; editing it rebuilt the artefact while leaving the
fingerprint where it was, and a later `--no-build` run accepted the stamp.

The member-tree `.rs` sources are now scanned for `include_str!`,
`include_bytes!` and `include!` with a literal path, and a resolved target
outside every member directory is added to the set. Measured on this tree:
945 sources scanned, enumeration 0.11s, fingerprint 0.51s over 1053 inputs.
Perturbing `real.rules` moves the digest and restoring it returns the
original value; before this it moved neither way.

Assisted-by: Claude

* check.py: check the wasm module the runner will load on the build path

`PYRE_WASM_MODULE` reaches the child through the `PYRE_` allowlist prefix and
`pyre_env` leaves an inherited value alone, so it names the module the
benchmarks load whether or not a build ran. Both the existence check and the
freshness check sat under `args.no_build`, so a normal `--backend wasm` run
built and stamped `WASM_MODULE_PATH` and then measured, and recorded
baselines for, whatever the override named.

The existence check now runs on both paths. On the build path the effective
module goes through `require_fresh_artefacts` when `same_file` says it is not
the module the build produced. `require_fresh_artefacts` takes the reason and
the remedy from its caller, which were spelled `--no-build requested` in all
three of its messages.

Assisted-by: Claude

* check.py: fingerprint the build recipe, and refuse to vouch for a build the tree moved under

Two holes in what `--no-build` accepts.

The fingerprint covered the files a build reads and not the options it is
built with. `CARGO_CONFIG[*]["extra"]` and `WASM_RUSTFLAGS` are under no
member directory and in no `ROOT_BUILD_INPUTS`, so removing `--growable-table`
left the digest where it was and a later run approved a module built with it.
`build_recipe_digest` hashes the recipe table and goes into the digest ahead
of the file contents. Measured: dropping `--growable-table`, adding a feature
to the dynasm row, and setting `WASM_CARGO_TOOLCHAIN` each move it, and none
of the three did before.

The fingerprint is also read after the build, so that it names the
`Cargo.lock` the build may have resolved. An input edited while cargo was
reading them was therefore recorded against an artefact compiled without it.
`open_build_window` reads the tree at the start of each build and
`stamp_artefact_inputs` compares it against a fresh reading; the witness
leaves out `CARGO_WRITTEN_INPUTS`, so a lock the build resolved is not a
tree that moved. A window that did move stamps `tree-moved-during-build`,
which no digest equals, rather than leaving the artefact unstamped -- an
unstamped artefact draws a note and runs.

Assisted-by: Claude

* check.py: require a selfcheck run to have compiled a loop

`run_selfcheck` graded the exit status and the `PASS` marker. A self-asserted
invariant holds under interpretation too, so a fixture guarding a mis-admission
in compiled code passed without the JIT having run, and would have gone on
passing if the shape it guards stopped reaching the JIT.

It now also requires `loops_compiled >= 1`, read through `_jit_stats_merged` --
the unfiltered map, whose own docstring reserves it for a non-vacuity check
against a counter the recorded surface omits. No stats line, no such key and a
zero are reported apart from one another.

Measured across the 14 selfcheck fixtures: 12 compile at least one loop, with
dynasm and cranelift agreeing exactly. The two that read zero,
`oserror_errno_fields_regression` and `posix_replace_regression`, guard
interpreter-level behaviour and now carry `# pyre-check: selfcheck-interpreted`.
The floor is on by default so that a fixture which stops being compiled is
reported rather than passing in silence.

Assisted-by: Claude

* check.py: resolve a relative LLBC override from the package whose build script reads it

`llbc_input_paths` returned the `PYRE_MIR_FRONTEND_LLBC` entries as written.
The reader is `pyre-jit-trace/build.rs`, and cargo runs a build script with its
own package as the working directory, so `../../build/llbc/pyre-jit.ullbc` is
the workspace artefact to the build and two levels above the repository to a
caller resolving from the root. The digest recorded that as an unreadable
input, whose value does not move however often the real artefact is rewritten,
so `--no-build` would approve a generated front end built from an LLBC that had
since changed.

A relative entry is now joined to `LLBC_OVERRIDE_BASE`; an absolute one is left
alone.

Assisted-by: Claude

* bench: document the selfcheck JIT floor and its opt-out

The README stated the selfcheck contract as exit status plus the `PASS`
marker. It is now also `loops_compiled >= 1`, with
`# pyre-check: selfcheck-interpreted` naming the exception.

Assisted-by: Claude

* check.py: resolve the wasm module override by key presence

`pyre_env` copies an inherited `PYRE_WASM_MODULE` through unchanged, and
`pyre-wasm-runner` reads it with `var_os(...).map(PathBuf::from)`, so an empty
value reaches the runner and is opened as the empty path. `effective_wasm_module`
resolved it with `or`, which named the built module instead, so the preflight
and the `--no-build` freshness gate both described a file the run never opened.

Assisted-by: Claude

* bench: record pickle_terminal_raise_resume's wasm guard_failures on this base

`pyre/check.py (ubuntu-24.04)` reads 336 (run 32626176562); the recorded 319 is
the value `main` carries after #1431 (`2cc8a5604bb`) moved it there from 318.
The branch read 335 over a base of 318 at `19c381e84eb`, and that recording is
the commit this rebase dropped, so the branch-over-base difference is +17 at
both bases. `loops_compiled` stays 70, `bridges_compiled` 0, `loops_aborted` 9.

Assisted-by: Claude

* interpreter: drop the virtualizable force from type()'s __module__ fill

`ensure_module_attr` reads `caller.get_w_globals()`. `w_globals` is a declared
`_virtualizable_` field, but `jtransform.rewrite_op_jit_force_virtualizable`
returns `[]`, so no `jit_force_virtualizable` survives in a graph the codewriter
looks inside, and `ensure_module_attr` is one -- it carries no
`dont_look_inside`. On this side `restore_resume_state_from` records that the
walk writes only `last_instr`, `valuestackdepth` and the locals array on the
live frame and leaves `pycode` and `w_globals` out of the resume restore as
frame-invariant, so the heap slot this read takes is already current.
`gettopframe_nohidden`, whose own doc leaves `force_frame` to consumers that
hand a frame to application code, stays as the route to the caller.

Measured on `type('X', (), {})` in a loop body reached through a helper:
abrt_escape 10 -> 0, loops_compiled 0 -> 1. pypy 7.3.22 on the same program
reports `abort: vable escape: 0` and compiles 2 loops. Written directly in the
loop frame the same program now reads 0 escapes here where pypy reads 96.

The two fixtures covering this path keep their recorded jit-stats in this
commit.

Assisted-by: Claude

* bench: record type_name_surrogate_reject without the __module__ force

A local dynasm run reads loops_compiled=2, bridges_compiled=1, loops_aborted=0
and guard_failures=201, which is the value each of these three files carried
before `64ae20d6801` moved them. The wasm file kept bridges_compiled=1 and
guard_failures=201 through that commit, so only its two moved rows come back.

`surrogate_class_kwargs` also covers this path and is not touched here: main
raised its `N` from 406399 to 2000000 in #1410 after the values it carried
before the force were recorded, so there is no earlier reading to return it to.

Assisted-by: Claude

* bench: record surrogate_class_kwargs without the __module__ force

All three `pyre/check.py` legs of run 32643323885 read the same row on
dynasm, cranelift and wasm, and the ubuntu-24.04 and macos-latest legs agree:
`loops_compiled` 4 -> 3, `bridges_compiled` 0 -> 2, `guard_failures`
2159 -> 3041, `loops_aborted` 14 -> 0, `fbw_blackhole_adopted_single_frame`
14 -> 0. The fixture's `REPEAT` is unchanged at 3200.

The 14 aborts and the 14 single-frame blackhole adoptions were the vable
escape this branch's `type()` `__module__` force raised; the loop that used
to abort now compiles, and the bridges and guard failures are that loop's.

Assisted-by: Claude

* bench: record list_append_virtual_payload's wasm row on the rebased base

The rebase conflicted on this file: main's 0a38cdd (#1432) took the wasm
row from `bridges_compiled=4 guard_failures=1001` to `3`/`1190`, and this
branch's LIST_APPEND admission took the same two fields to `7`/`1403`. Neither
side's numbers compose arithmetically, so the conflict was resolved to the
branch's pair and the composed row measured instead: a local wasm run of
`pyre/check.py --synthetic-pattern list_append_virtual_payload --backend wasm`
reads `loops_compiled=2 bridges_compiled=6 guard_failures=1992`, twice, and no
run flagged the row UNSTABLE.

The dynasm and cranelift rows of this fixture did not conflict; main left them
at the branch's values.

Assisted-by: Claude