[P1] UI realization has no aggregate traversal budget #13

Reproduced during the 2026-09-04 language review at a20753c6cff96ee86758744e227a04460234a832. Priority: P1.

The independent UI profile avoids the workflow VM, which is a useful containment property. It still performs computation while traversing declarations and host data.

source movers sys.movers()
state show {shape: bool, initial: false}
view root Panel {
  for a in movers key a.id {
    for b in movers key b.id {
      for c in movers key c.id {
        for d in movers key d.id {
          when show { Rule() }
        }
      }
    }
  }
}

This card passes UI validation. With 128 distinct {id: ...} items in host-supplied movers, all four loops remain below the default per-collection limit of 512, and nesting remains below 64. Because show is false, the traversal would produce only the root panel. The optimized probe nevertheless exceeded the external two-second timeout. A smaller three-loop example completed with nodes=1, truncated=false, and no diagnostics.

RealizeLimits bounds output nodes, depth, and each collection. Realizer::element checks the node counter, but only constructors increment it. iteration does not consume a shared traversal budget. False guards therefore avoid the output counter while retaining the cross-product work.

Add a shared visit/iteration budget charged before every element visit and iteration, including false guards, references, slots, and component expansion. Stop remaining loops once it is exhausted. Bound materialization and cloning as well as output. A node cap alone cannot provide predictable UI latency.

Acceptance: implement the described correction, publish the resulting language contract, and add focused regression coverage including applicable capability, streaming-parser, and resource-limit cases.

Fix and executable regressions: PR #19. Workspace tests, explicit vendor suites, formatting, strict Clippy, and the Linux ARM64/RISC-V and Windows GNU compile checks pass locally. All GitHub Actions checks pass on f1e775f, including Linux tests, fuzzing, AddressSanitizer, and Miri. This issue remains open until the fix is merged.