release blocker: native-region proof contracts lag packed-loop and byte-read lowering #9150

Release blocker

Full CI run 33298955917 failed compiler-output-regression in the native-region-proof suite at release SHA 97bae62ad9ee781830e609eda17429c16ccb1285.

The exact three failing workloads are:

• image_convolution
• packed_f64_loop_versioning
• packed_f64_loop_versioning_negative

Diagnosis

The immediately preceding release revision 330638064a passes all three on perrymaster.skelpo.net. The later mainline optimization merge changes the structural contracts:

1. PR codegen: byte-array reads reach the numeric proofs (bench_int_arithmetic 475 → 395 ms) #9146 correctly restores byte-array += to native numeric addition while preserving OOB undefined. The image blur now contains only the 75 documented js_number_coerce calls for kernel coefficients; the PR explicitly declined the unsound flat-const coefficient proof. Native evidence consequently records unknown_bounds materialization for the byte-or-undefined boundary.
2. PR perf(codegen): inline array store/push lanes for module-global receivers; drop the packed loop's per-store guard call #9041 removes the per-store guard/side-exit for statically genuine packed-f64 store values. The old proof still requires the deleted packed_f64_loop_store.fast/fallback pair.
3. PR perf(codegen): packed-clone endgame — receiver caching, poll striding, integer count accumulators, check-free genuine stores #9111 caches the packed receiver handle, adding one intentional ptrtoint in the aggregate fast-clone region.
4. PR perf(codegen): packed-loop read admissions — if-conditions, clone accumulator proofs, hazard relaxation #9084 admits locally built read loops behind the runtime packed-f64 entry guard. frozenLoop, sealedLoop, and nonExtensibleLoop are safe read-only admissions; the old negative proof rejects any guard anywhere in the fixture. The genuinely unsupported holey/sparse/accessor/non-number/any/unknown-index/alias-mutating functions still emit no packed-f64 guard.

Required fix

• merge current main so codegen: byte-array reads reach the numeric proofs (bench_int_arithmetic 475 → 395 ms) #9146 is present;
• allow only js_number_coerce in the image blur and unknown_bounds native materialization while retaining all byte-load/store and bounds/alias evidence checks;
• replace the obsolete packed store side-exit assertion with a check-free raw-f64 fast-store assertion;
• permit the single receiver-cache ptrtoint;
• scope the negative guard exclusion to the genuinely unsupported functions and positively require guards for the three safe read-only functions.

Acceptance

• the three workloads above pass individually on the dedicated Linux server;
• the complete native-region-proof suite passes;
• harness unit tests pass;
• Full CI compiler-output-regression passes before release publication.