Merge train: #9728, #9729, #9730, #9731, #9732, #9733

[proggeramlug]

Merge train: #9728, #9729, #9730, #9731, #9732, #9733, plus one gate verdict. Validated once as a tree, rebase-merged so each commit keeps its author.

Three of these are GC changes that interact — when idle reclaim runs (#9731), what a budgeted cycle will trace (#9732), and when a descriptor may be retired (#9733) — which is why they were validated together rather than landed separately.

#9732 — a hono server 404s forever on a late first request (#9717). hono/router/smart-router replays not-yet-installed routes from a #private array on the first match(). Growing that array past its inline capacity leaves a permanent forwarding stub, and the live field keeps pointing at the stub. A synchronous full trace copes: its exact census admits every arena object, stubs included. A budgeted full trace — what the idle reducer runs when the server goes quiet — resolves membership through the page-metadata classifier, which rejected every GC_FLAG_FORWARDED header by design (#8040). So the field→stub edge was dropped, the array reachable only through the stub was swept, and every route returned 404. Only reproduces on a late first request, because an early one builds the router before any idle collection.

The classifier now admits a plausible forwarded arena stub — GC_FLAG_ARENA plus a valid obj_type/size. That is precisely what separates it from #8040's case, whose recycled bytes carried obj_type = 104 (no GcTypeInfo recognises it, per copying.rs:335); the pre-existing #8040 tests still pass. The forwarding target is still validated in the follow, so a garbage target stops the walk. The new regression asserts the pre-fix gate would have rejected the stub and fails without the fix, verified by disabling the branch.

#9731 — right-size idle arena capacity. Adds no new env knob (reuses PERRY_GC_DIAG), so there is no new mode needing a CI arm to exercise its OFF state. Its tests discriminate in both directions: !owed() for a single low collection, owed() for two consecutive — the negative assertion is what proves the hysteresis gates rather than always firing.

#9733 — retire uncarried shape descriptors (#9726). Stacked on #9724 (landed in #9734); only its top commit is picked here. Retirement is gated on a full-trace census of reachable objects, complete by construction, with per-record carrier flags set at each stamp site covering ids held outside object headers — better than a central enumeration that must be kept in sync. Minor and budgeted cycles stay conservative. It preserves all 17 of shape_descriptor_census.py's pinned patterns (13 on main before #9724).

#9730 — labeled escape out of nested loops (#9199). break O from a nested loop produced Cannot read properties of undefined (reading 'done'); continue O produced nothing at all, with the for await never yielding and never settling. Handles Stmt::Try/finally along the unwind path, and keeps the rows that already worked via the switch-wrapped route (#9186/#9189) as regression guards.

#9729 — inline caches per used site (#9708). 262k caches on the Claude Code bundle, 25 MB of zero-fill, 18.7 MB dirty resident at idle, replaced by an 8-byte slot per site with words allocated on first priming miss and published by CAS. GC-neutral: the cache word is (ShapeId << 32) | class_id — packed integer ids, never a pointer — and perry_ic appears nowhere under gc/, so these were never traced roots on main either.

#9728 — dynamic x["toString"]() on a number (#9713). Formatted with bare Rust f64::to_string(), which never switches to scientific notation and spells the infinities inf, while the same value's four static renderings were correct. All three arms now route through js_number_to_string, and the radix argument the old code ignored is honoured. Gap test pins -0, 1e21, 1e-6/1e-7, 2.2e-308, 1e-310, Infinity, NaN.

Gate verdict (mine). #9732 adds a PERRY_GC_DIAG counter, FORWARDED_STUB_MEMBERSHIP_RECOVERIES, without classifying it, so gc_runtime_root_holders went red. It is a Cell<u64> tally holding no address; recorded not_a_gc_pointer.

Validation

64/64 lint gates; release build; perry-runtime, perry-transform, perry-codegen (all RUST_TEST_THREADS=1) — all green.