perf(codegen): inline bump allocator never engages for indirectly-called closures (worth ~14% on pipeline)

[proggeramlug]

Summary

PERRY_INLINE_NEW=1 is worth a further −13.8% on pipeline (0.7924 of base, stacked on top of #7905), but the inline bump allocator never engages there by default. Cause: crates/perry-codegen/src/collectors/hot_callees.rs::record_callee records only Expr::FuncRef — i.e. direct calls.

pipeline's three stage closures are reached indirectly:

stages[s](rec)

so they are never recorded as hot callees and never get the inline allocator, even though they are the hottest allocation sites in the program.

Why this wasn't just fixed in #7905

The measurement is easy; the admission rule is the hard part. #7871 priced the inline allocator at ~268 bytes of emitted code per new site and bounded its application deliberately. "Called indirectly from a loop" is not the same predicate as "called directly and hot", and widening admission without a size analysis risks paying that 268 bytes at every indirect call site in the program — a code-size and I-cache regression that would not show up on this corpus.

So this needs its own round: a size/benefit analysis for indirect callees, not a one-line predicate change.

Evidence

• Measured with instructions retired (the dev box was at load 12–165; see gc-handoff/MEASUREMENT-PROTOCOL.md on why wall clock was unusable): pipeline fix+PERRY_INLINE_NEW=1 = 0.7924 of base, vs 0.9192 for perf(codegen): serve .length on an untyped string receiver inline — pipeline −8.1%, shapes −10.2% #7905 alone.
• After perf(codegen): serve .length on an untyped string receiver inline — pipeline −8.1%, shapes −10.2% #7905 the residual on pipeline is allocation, not dispatch — Generic class specialization is lost when a type argument is a type ALIAS — dispatch guard compiled against the template class, fast path permanently dead (53.8% of pipeline) #7848/fix(hir): expand type aliases in the inferred type of new C<...>() so the generic specialization resolves (#7848) #7852 is confirmed fixed at this baseline (zero js_method_direct_shape_guard, zero js_native_call_method_by_id, all Registry sites direct $pshape), and Every dynamic method call pays 7 side-registry probes to exclude kinds the program never creates — is_registered_symbol alone takes a mutex + SipHash (6.5% of pipeline) #7850's gc_pointer_and_type_from_value / is_registered_symbol appear zero times in the profile.

Acceptance

• An admission rule for indirect callees with a stated size bound, justified by measurement rather than assumed.
• No code-size regression on the corpus; report emitted-size delta alongside the speedup.
• pipeline improves materially toward node (currently 1.80x pre-perf(codegen): serve .length on an untyped string receiver inline — pipeline −8.1%, shapes −10.2% #7905).

Notes and reproduce commands: gc-handoff/PIPELINE2-NOTES.md. Preserved arms: $HOME/pipeline2-arms/{base,fix}, corpora gc-handoff/m0810/{p2base,p2fix,p2inl}.