Keep the short-lived compiler VM on the first JIT tier while preserving student runtime options and every resource budget. The closed profile validator rejects removed or overridden compiler tier options.
Validation: make contracts; make check. Actual isolated VM reacceptance remains pending.