finally confirmed that control will flow to invalidated jit-blocks, so I am indeed not yet keeping the code alive sufficiently long.
now attempting to backoff incrementally to a more conservative approach but first I need to determine if my scribbling is actually uncovering an underlying orthogonal bug (or if my scribbling is itself wrong).
finally something plausible hacked together.
changes to preserve new strategy while bringing reduced diff closer to moz-inbound.