[ymote]

Uncaught script errors could allow later granted effects to execute; structural equality and empty UI expansion could escape execution bounds. This change makes those paths terminate safely and fixes the operator, block-result, indexing, and JSON semantics reported in the language review.

Issue	Result
#9	Iterative, cycle-aware equality with instruction fuel, hard-deadline checks, and an independent 65,536-unit native-work ceiling.
#10	Uncaught errors stop before the next instruction; workflows fail the current step before later granted steps. Explicit try/catch still recovers.
#11	Canonical source rejects ~; standalone compatibility evaluation also disables direct VM output.
#12	Comparisons bind above equality and && above `
#13	UI realization charges aggregate element visits and loop iterations, including empty expansions, and reports truncation on exhaustion.
#14	! always performs logical negation.
#15	Conditional blocks preserve their final expression across newlines and semicolons; empty or declaration-ending branches produce nil.
#16	Array reads and writes reject negative, fractional, nonnumeric, and nonfinite indices before accessing storage.
#17	Numeric string conversion treats inline and heap strings alike; invalid text produces NaN.
#18	Unsafe integers are rejected at the VM JSON boundary; validated JSON is copied directly into VM values, preserving negative signs.

The stricter error handling exposed latent contract failures. Updating an object field now preserves insertion order, and the existing fixtures explicitly import their assertions and use record iteration for three binders. The patch also includes small existing formatting/lint corrections needed for the workspace quality gate, including fixed-size byte iteration required by Rust 1.98 in the Linux and storage paths.

Behavior changes are published in docs/grammar.md, docs/language-profile.md, and the UI profile. Vendor changes and their upstream-sync requirements are recorded in vendor/makepad/PATCHES.md.

Validation:

All GitHub Actions checks pass on f1e775f: Linux tests, fuzz targets, AddressSanitizer, and Miri.

• cargo fmt --check
• cargo +1.98.0 clippy --workspace --all-targets --all-features -- -D warnings
• Strict Clippy for the Linux ARM64 sandbox tests under Rust 1.98, matching CI.
• cargo +1.98.0 test --locked --workspace --all-features
• Explicit makepad-script and makepad-regex suites (378 test executions), including streaming and reload coverage.
• Sandbox test compilation for Linux ARM64, Linux RISC-V, and Windows GNU.
• Timed child-process regressions for cycles, long chains, and shared DAGs; independent native-work/fuel tests; capability and workflow assertions that skipped effects never execute.
• Optimized reproductions of the original crash/hang, error continuation, precedence, conditional, index, and JSON cases.

Compatibility: larger integer identifiers must be strings; canonical integer literals and VM JSON integers are limited to +/-9007199254740991. Arithmetic remains binary64. Host-only JSON for schemas and telemetry keeps its integer range. Invalid index coercions and direct script logging are no longer accepted. Linux containment paths were cross-compiled on macOS; live Linux kernel enforcement was not exercised in this environment.

Fixes #9
Fixes #10
Fixes #11
Fixes #12
Fixes #13
Fixes #14
Fixes #15
Fixes #16
Fixes #17
Fixes #18