perf(runtime): tombstone deletes default-on again — the #9200 corruption that rolled them back is fixed (26x on populated delete)

[proggeramlug]

Restores #9038's default. The chain of custody:

• feat(runtime): tombstone object deletes default-on (populated delete 6.5x) #9038 shipped O(1) tombstone deletes default-on (6.5× populated delete at the time).
• fix(release): clear v0.5.1519 runtime preflight blockers #9212 returned them to opt-in because of Tombstone deletes lose a live object's keys array under evacuating GC — Object.keys() returns empty, fields read NaN (main, gc-stress red) #9200: an evacuating minor could sweep a deleted receiver's live keys array — the tombstone publish minted an unarmed successor descriptor, and that descriptor was the keys array's only root.
• fix(gc): tombstone shape publish arms old_carrier — deleted receivers no longer lose their keys array under evacuating GC (#9200) #9317 (merged) fixed that structurally: every post-birth ShapeId publish routes through stamp_object_shape_id_with_carrier_note, which arms old_carrier for any non-nursery receiver — the descriptor and its keys array are rooted by construction, not by the site remembering to.

This PR is the one-hunk default flip plus the changelog. PERRY_OBJECT_TOMBSTONES=0 remains the kill switch — deliberately, since that same switch attributed #9108, #9110 and #9200 each in one command.

Verified on this exact build

The five-configuration matrix over both #9200 fixtures — including the precise configuration that broke the old default — all byte-identical to node, 3/3 runs each:

fixture	default (ON)	kill	HL=8+FORCE_EVAC	HL=4+FORCE+VERIFY	evac+kill
tower_delete	PASS	PASS	PASS	PASS	PASS
tombstone_oldgen_delete	PASS	PASS	PASS	PASS	PASS

Tombstone unit suite: 27/27 with the flipped default.

The win it restores (500-key object, 200k delete/re-add rounds, interleaved on one box; node 24–25 ms):

	ms
default (tombstones ON)	82–89
kill switch (old default)	2,137–2,352

~26×. Perry remains ~3.4× node on this shape — the residual is the per-delete IC retirement documented in #9064, a separate lane.

Summary by CodeRabbit

• Performance
  • Tombstone-based object deletion is now enabled by default, improving deletion speed.
  • An environment-variable kill switch remains available to disable the behavior when needed.
• Documentation
  • Added release notes describing the default behavior, rollback history, structural fix, and performance improvements.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Team

Run ID: 4ca4cf9a-2ea2-4f5b-ba0e-918ea7efc0e9

📥 Commits

Reviewing files that changed from the base of the PR and between 9943dd9 and b81b57c.

📒 Files selected for processing (2)

• changelog.d/9330-tombstones-default-on.md
• crates/perry-runtime/src/object/delete_rest.rs

Included review availability: Your plan provides up to 8 included reviews per hour; 5 remain after this review.

---

📝 Walkthrough

Walkthrough

Tombstone deletes are now enabled by default. PERRY_OBJECT_TOMBSTONES disables them when set to 0, off, or false. The changelog documents this behavior and the related performance improvements.

Changes

Tombstone delete behavior

Layer / File(s)	Summary
Default-on configuration and documentation crates/perry-runtime/src/object/delete_rest.rs, changelog.d/9330-tombstones-default-on.md	The runtime enables tombstone deletes by default and treats PERRY_OBJECT_TOMBSTONES=0, off, or false as disable values. The changelog documents the change and opt-out.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: 🔵 Low · up to b81b5

This change restores faster default object deletion while retaining an emergency opt-out. The known rooting failure is structurally addressed, but real evacuating-collection behavior and production kill-switch initialization still warrant explicit owner awareness before merge.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies the main change: restoring tombstone deletes as the default runtime behavior. It also provides relevant context about the prior corruption fix and performance impact, alth…
Description check	✅ Passed	The description provides a clear summary, concrete change rationale, related issue references, detailed validation results, and benchmark data. It does not use the template headings or include the che…
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 1 functions across 1 files. (1 skipped: 1 …
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Full details: Title check

Explanation

The title clearly identifies the main change: restoring tombstone deletes as the default runtime behavior. It also provides relevant context about the prior corruption fix and performance impact, although it is longer than necessary.

Full details: Description check

Explanation

The description provides a clear summary, concrete change rationale, related issue references, detailed validation results, and benchmark data. It does not use the template headings or include the checklist, but the required information is mostly present.

Full details: Docstring Coverage

Explanation

Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 1 functions across 1 files. (1 skipped: 1 unsupported.)

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}