[P1] Equality escapes the runtime's resource limits #9

Reproduced during the 2026-09-04 language review at a20753c6cff96ee86758744e227a04460234a832. Priority: P1.

This complete canonical program aborts both debug and optimized probe processes with SIGABRT and fatal runtime error: stack overflow, aborting:

let a = [nil]
a[0] = a
let b = [nil]
b[0] = b
a == b

The same failure occurs with two records whose self fields point back to themselves. The identity fast path protects a == a; it does not protect two distinct cyclic graphs.

The equality opcode calls recursive ScriptHeap::deep_eq, which follows object fields and array elements without a visited-pair set or a work/depth limit. VM call-frame and operand-stack bounds do not measure these Rust calls. Instruction and time sampling happen around VM instructions, so they cannot interrupt work inside this equality operation. See opcodes_ops.rs, heap.rs, and vm.rs.

Cycles are only one manifestation. Starting with two [0] arrays and repeatedly replacing each with [previous, previous] constructs a small shared graph. Comparing two such graphs revisits the same pairs exponentially. At depth 20 the debug probe completed successfully after approximately 0.288 seconds despite the default 64 ms hard timeout. At depth 29 the optimized probe was still running when an external two-second timeout killed it. Those are subprocess observations, not performance benchmarks; the structural lack of an internal work bound is the finding.

Use an iterative comparison with a visited-pair set and a charged work budget. Specify the equality result for cyclic graphs. Merely detecting cycles will not fix repeated work on acyclic shared graphs, and merely lowering the Splash call-frame limit will not fix native recursion. Add subprocess regressions for distinct cycles, long chains, and shared DAGs, asserting bounded termination and process survival.

Acceptance: implement the described correction, publish the resulting language contract, and add focused regression coverage including applicable capability, streaming-parser, and resource-limit cases.

Fix and executable regressions: PR #19. Workspace tests, explicit vendor suites, formatting, strict Clippy, and the Linux ARM64/RISC-V and Windows GNU compile checks pass locally. All GitHub Actions checks pass on f1e775f, including Linux tests, fuzzing, AddressSanitizer, and Miri. This issue remains open until the fix is merged.