[iterate-4A] jit: native superblock chaining B1 (bx + fall-through), −6.4% wall

Increment B1 of block-linking: compile a chain of same-page, fully-covered
blocks into ONE Cranelift function whose internal block-to-block edges are
direct machine jumps, eliminating the per-block return to run_block and the
run_superblock dispatch tax for the chain. Env-gated XENIA_JIT_CHAIN (off by
default), and additionally disabled under the diff harness or with diagnostic
probes / mem-watch armed (chaining runs several blocks natively without the
per-block-entry observation those need, so they are mutually exclusive).

Mechanism (cranelift-jit can't patch finalized code, so no QEMU-style TB
chaining): SUPERBLOCK COMPILATION. compile_chain enumerates the forward-linear
chain from the entry — following static bx targets and fall-throughs, all
same-page (so the entry page_version is a sound cache key), outside the thunk
band, and covered — and emits one node per block plus a shared exit. At every
internal boundary it re-checks the two runtime stop-conditions exactly as the
Rust runner does: an MMIO touch (*mmio_count advanced vs the entry sample) and
the instruction budget (cumulative >= remaining, passed as a runtime param);
either stops the chain with pc/cycle/timebase already correct, and the runner
re-dispatches from the clean boundary. B1 scope is forward-linear: a bx or
fall-through continues; a conditional bcx, dynamic bclrx/bcctrx, off-page /
thunk / uncovered / already-visited successor ends the chain (B2 adds bcx
two-way + loop back-edges). Being *more* conservative (stopping earlier) is
always safe.

Correctness rests on composition: each node body is the same emit_node_body IR
the single-block path emits (already diff-validated bit-exact), so only the
chain glue is new — validated by two new unit tests (multi-block chain vs
interpreter over the same PCs; budget cut at the exact boundary) plus e2e.
Boundary MMIO check is skipped for load/store-free blocks (a pure-ALU block
can't advance mmio_count), dropping a memory load+compare per ALU boundary.

Plumbing: build_block exposed (xenia-cpu); KernelState::thunk_band getter;
MemEnv mmio_count null-safety (points at a static zero when no flat mapping);
CompiledFn gains a remaining-budget param (single-block ignores it); all
compiled entries share the (ctx, mem_env, remaining) ABI.

Validation: diff MISMATCHES=0 over 25.0M blocks (single-block op bodies
unbroken by the emit_node_body refactor); XENIA_JIT_CHAIN=1 movie plays,
tid25 resumes, source-read=12; fair perf (RUST_LOG=warn) interp 44.1s vs
chain 41.3s = −6.4% wall — run_superblock "other" 30.4%->26.2%, run_block
calls 145.7M->116.2M (1.25x block merge), step_block at parity (100.6->102.4
MIPS; the earlier "slower" reading was cranelift IR-logging inside the STEP
timer). Uncommitted probe knobs unchanged.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

crates/xenia-app/src/main.rs

@@ -3083,6 +3083,27 @@ fn run_superblock(
 
     let budget = superblock_budget();
 
+    // Install the JIT superblock-chaining config once per run (idempotent). The
+    // gate is deliberately conservative and stable for a run: chaining requires
+    // `XENIA_JIT_CHAIN`, the diff harness OFF (a multi-block superblock can't be
+    // compared against one interpreter step), and NO diagnostic probes / mem-watch
+    // armed (chaining runs several blocks natively without the per-block-entry
+    // observation the Heisenbug fix fires inside this loop — so chaining and
+    // probes are mutually exclusive). Probes/mem-watch are env-armed at startup,
+    // so evaluating this once is sound; a cached block never has to change shape.
+    if !wc.jit_cache.is_configured() {
+        let chain_enabled = xenia_cpu::recompiler::chain_requested()
+            && xenia_cpu::recompiler::jit_enabled()
+            && !xenia_cpu::recompiler::diff_enabled()
+            && !kernel.any_probe_active()
+            && !mem.has_mem_watch();
+        wc.jit_cache.set_chain_config(xenia_cpu::jit::ChainConfig {
+            enabled: chain_enabled,
+            max_budget: budget,
+            thunk_band: kernel.thunk_band(),
+        });
+    }
+
     // Heisenbug fix (toolkit audit, 2026-06-21): probes and mem-watch are
     // OBSERVE-ONLY diagnostics and must NOT change guest scheduling. The
     // previous implementation disabled superblock chaining whenever any
@@ -3152,7 +3173,11 @@ fn run_superblock(
             if xenia_cpu::recompiler::diff_enabled() {
                 xenia_cpu::recompiler::diff_step(ctx, mem, block, &mut wc.jit_cache)
             } else if xenia_cpu::recompiler::jit_enabled() {
-                xenia_cpu::recompiler::run_block(ctx, mem, block, &mut wc.jit_cache)
+                // Hand the JIT the remaining budget so a superblock stops
+                // chaining at exactly the same instruction count the runner
+                // would (`total_executed >= budget`).
+                let remaining = budget.saturating_sub(total_executed);
+                xenia_cpu::recompiler::run_block(ctx, mem, block, &mut wc.jit_cache, remaining)
             } else {
                 step_block(ctx, mem, block)
             }