@tishlang/tish-format 3.10.4 → 3.10.11

package/crates/tish_bytecode/tests/fundecl_slot_binding.rs

@@ -0,0 +1,115 @@
+//! #716: how a body-level `function NAME` binds its name in general slot mode.
+//!
+//! An UNCAPTURED name must be slot-bound (`StoreLocal`) — `DeclareVar` would insert the
+//! closure into the very `local_scope` map the closure captured, minting a per-call
+//! closure→scope→closure cycle that leaks the whole frame (refcount-only runtime, no
+//! cycle collector). A name referenced from inside ANY nested closure — the function's
+//! own body (self-recursion) or a sibling (mutual recursion) — is in the captured set
+//! and must STAY on the `DeclareVar` scope path, or the recursive name lookup breaks.
+
+use tishlang_bytecode::{compile, Chunk, Opcode};
+
+/// Count occurrences of `target` in `chunk.code`, walking real instruction boundaries.
+fn count_opcode(chunk: &Chunk, target: Opcode) -> usize {
+    let code = &chunk.code;
+    let mut ip = 0usize;
+    let mut n = 0usize;
+    while ip < code.len() {
+        let op = Opcode::from_u8(code[ip]).expect("valid opcode");
+        if op == target {
+            n += 1;
+        }
+        ip += op.instruction_size(code, ip).expect("sized instruction");
+    }
+    n
+}
+
+fn compile_src(src: &str) -> Chunk {
+    let program = tishlang_parser::parse(src).expect("parse");
+    compile(&program).expect("compile")
+}
+
+/// These tests assert slot-mode emission; running the suite with `TISH_VM_SLOTS=0`
+/// deliberately exercises the legacy name-based path, where they do not apply.
+fn slots_disabled() -> bool {
+    std::env::var("TISH_VM_SLOTS")
+        .map(|v| v == "0")
+        .unwrap_or(false)
+}
+
+#[test]
+fn uncaptured_body_level_fn_is_slot_bound() {
+    if slots_disabled() {
+        return;
+    }
+    let chunk = compile_src(
+        r#"
+function outer() {
+  function helper(a) { return a + 1 }
+  return helper(41)
+}
+console.log(outer())
+"#,
+    );
+    let outer = &chunk.nested[0];
+    assert!(
+        outer.slot_based,
+        "outer should compile in general slot mode"
+    );
+    assert_eq!(
+        count_opcode(outer, Opcode::DeclareVar),
+        0,
+        "uncaptured `function helper` must not DeclareVar into the captured scope (#716 cycle)"
+    );
+    assert!(
+        count_opcode(outer, Opcode::StoreLocal) >= 1,
+        "uncaptured `function helper` should be stored to a frame slot"
+    );
+}
+
+#[test]
+fn self_recursive_body_level_fn_stays_on_scope_path() {
+    if slots_disabled() {
+        return;
+    }
+    let chunk = compile_src(
+        r#"
+function outer() {
+  function fact(k) { if (k < 2) { return 1 } return k * fact(k - 1) }
+  return fact(5)
+}
+console.log(outer())
+"#,
+    );
+    let outer = &chunk.nested[0];
+    assert_eq!(
+        count_opcode(outer, Opcode::DeclareVar),
+        1,
+        "self-recursive `fact` references its own name from inside its body — that IS a \
+         capture, and the name must stay DeclareVar-bound in `local_scope`"
+    );
+}
+
+#[test]
+fn mutually_recursive_body_level_fns_stay_on_scope_path() {
+    if slots_disabled() {
+        return;
+    }
+    let chunk = compile_src(
+        r#"
+function outer(n) {
+  function isEven(k) { if (k === 0) { return true } return isOdd(k - 1) }
+  function isOdd(k) { if (k === 0) { return false } return isEven(k - 1) }
+  return isEven(n)
+}
+console.log(outer(10))
+"#,
+    );
+    let outer = &chunk.nested[0];
+    assert_eq!(
+        count_opcode(outer, Opcode::DeclareVar),
+        2,
+        "mutually recursive names are captured by the sibling closure and must both stay \
+         DeclareVar-bound"
+    );
+}

package/crates/tish_bytecode/tests/param_defaults_slot_binding.rs

@@ -0,0 +1,86 @@
+//! #727: WHERE the default-parameter prologue stores its value in general slot mode.
+//!
+//! In a general-slot-mode chunk every read of a param resolves to `LoadLocal <slot>`, so
+//! the applied default must be stored with `StoreLocal <slot>` — a `DeclareVarPlain`
+//! writes it into the name-based scope map where no read will ever find it (the slot
+//! keeps its missing-arg `Null`; `a + b` → NaN).
+
+use tishlang_bytecode::{compile, Chunk, Opcode};
+
+/// Count occurrences of `target` in `chunk.code`, walking real instruction boundaries.
+fn count_opcode(chunk: &Chunk, target: Opcode) -> usize {
+    let code = &chunk.code;
+    let mut ip = 0usize;
+    let mut n = 0usize;
+    while ip < code.len() {
+        let op = Opcode::from_u8(code[ip]).expect("valid opcode");
+        if op == target {
+            n += 1;
+        }
+        ip += op.instruction_size(code, ip).expect("sized instruction");
+    }
+    n
+}
+
+fn compile_src(src: &str) -> Chunk {
+    let program = tishlang_parser::parse(src).expect("parse");
+    compile(&program).expect("compile")
+}
+
+/// These tests assert slot-mode emission; running the suite with `TISH_VM_SLOTS=0`
+/// deliberately exercises the legacy name-based path, where they do not apply.
+fn slots_disabled() -> bool {
+    std::env::var("TISH_VM_SLOTS")
+        .map(|v| v == "0")
+        .unwrap_or(false)
+}
+
+#[test]
+fn general_slot_mode_default_stores_to_slot() {
+    if slots_disabled() {
+        return;
+    }
+    let chunk = compile_src(
+        r#"
+function f(a, b = 5) {
+  let c = a + b
+  return c
+}
+console.log(f(1))
+"#,
+    );
+    let f = &chunk.nested[0];
+    assert!(f.slot_based, "f should compile in general slot mode");
+    assert_eq!(
+        count_opcode(f, Opcode::DeclareVarPlain),
+        0,
+        "the applied default must not be declared into the name-based scope map — \
+         reads of the param resolve to its frame slot (#727)"
+    );
+    assert!(
+        count_opcode(f, Opcode::StoreLocal) >= 1,
+        "the applied default should be stored to the param's frame slot"
+    );
+}
+
+/// The slot-DISQUALIFIED shape (captured param → name-based chunk) must keep the
+/// `DeclareVarPlain` store: there is no slot, and closures read the param by name.
+#[test]
+fn name_based_chunk_default_still_declares_by_name() {
+    let chunk = compile_src(
+        r#"
+function g(a, b = 5) {
+  function h() { return b }
+  let c = a + h()
+  return c
+}
+console.log(g(1))
+"#,
+    );
+    let g = &chunk.nested[0];
+    assert_eq!(
+        count_opcode(g, Opcode::DeclareVarPlain),
+        1,
+        "captured-param chunk is name-based; its default must stay DeclareVarPlain-bound"
+    );
+}

package/crates/tish_core/src/shape.rs

@@ -31,10 +31,31 @@ pub const DICT_SHAPE: ShapeId = u32::MAX;
 /// Edges are keyed by an `ahash` map, not the default SipHash one: `transition` is on the hot path of
 /// every object construction (and `JSON.parse` — profiled as ~16% of parse, almost all SipHash), and
 /// ahash is ~2–3× faster on short string keys. Random-seeded per process, so no HashDoS regression.
+/// Growth backstops (#701/#706/#710). The registry has no eviction — a permanent `ShapeNode`
+/// plus an `Arc` clone of the key per distinct `(parent, key)` edge — so every mint site must be
+/// bounded. Three independent caps, all degrading to `DICT_SHAPE` (never an error):
+///
+/// - `MAX_TRANSITIONS_PER_NODE` bounds a node's fan-out. The hot pathology is node 0: every
+///   fresh `{}` that takes a data-dependent first key (`o[requestId] = …`) adds one edge to
+///   EMPTY_SHAPE's map, forever, under the global write lock.
+/// - `MAX_CHAIN_DEPTH` bounds a chain's length. A single object accumulating keys one at a time
+///   mints a linear chain (each node fan-out 1, so the fan-out cap never trips). `PropMap`
+///   promotion demotes to dictionary mode at 9 keys, but `with_capacity`-built maps skip
+///   promotion — the depth cap is their backstop.
+/// - `MAX_SHAPES` is the absolute registry ceiling; past it nothing new is ever interned.
+///
+/// Values are far above anything a program's TEXT can mint (shapes are meant to be bounded by
+/// code structure), and far below the ~750 GB where the u32 id-overflow guard would trip.
+const MAX_TRANSITIONS_PER_NODE: usize = 256;
+const MAX_CHAIN_DEPTH: u16 = 32;
+const MAX_SHAPES: usize = 1 << 18; // 262_144 nodes ≈ tens of MB worst-case, orders above real use
+
 #[cfg(not(feature = "portable"))]
 #[derive(Default)]
 struct ShapeNode {
     transitions: AHashMap<Arc<str>, ShapeId>,
+    /// Distance from EMPTY_SHAPE (== number of keys on the path). Bounds chain length.
+    depth: u16,
 }
 
 #[cfg(not(feature = "portable"))]
@@ -85,6 +106,8 @@ fn transition_tracked(from: ShapeId, key: &Arc<str>) -> ShapeId {
         return DICT_SHAPE;
     }
     // Fast path: the edge already exists (the common case after the first object of this shape).
+    // The caps are ALSO checked here, read-only: a saturated node keeps answering DICT_SHAPE
+    // from the read lock instead of convoying every miss through the write lock below.
     {
         let reg = registry().read().unwrap();
         match reg.nodes.get(from as usize) {
@@ -92,6 +115,11 @@ fn transition_tracked(from: ShapeId, key: &Arc<str>) -> ShapeId {
                 if let Some(&next) = node.transitions.get(key.as_ref()) {
                     return next;
                 }
+                if node.transitions.len() >= MAX_TRANSITIONS_PER_NODE
+                    || node.depth >= MAX_CHAIN_DEPTH
+                {
+                    return DICT_SHAPE;
+                }
             }
             None => return DICT_SHAPE, // out of range — should not happen; degrade safely
         }
@@ -102,13 +130,38 @@ fn transition_tracked(from: ShapeId, key: &Arc<str>) -> ShapeId {
     if let Some(&next) = reg.nodes[from as usize].transitions.get(key.as_ref()) {
         return next;
     }
+    // Re-check the caps under the write lock too (the read-path check can race).
+    let parent_depth = reg.nodes[from as usize].depth;
+    if reg.nodes[from as usize].transitions.len() >= MAX_TRANSITIONS_PER_NODE
+        || parent_depth >= MAX_CHAIN_DEPTH
+        || reg.nodes.len() >= MAX_SHAPES
+    {
+        return DICT_SHAPE;
+    }
     let new_id = reg.nodes.len();
     if new_id >= DICT_SHAPE as usize {
-        return DICT_SHAPE; // ran out of shape ids — extremely unlikely; degrade to dictionary mode
+        return DICT_SHAPE; // id-space overflow guard — prevents u32 truncation aliasing live ids
     }
-    reg.nodes.push(ShapeNode::default());
+    reg.nodes.push(ShapeNode {
+        transitions: AHashMap::default(),
+        depth: parent_depth + 1,
+    });
     reg.nodes[from as usize]
         .transitions
         .insert(Arc::clone(key), new_id as ShapeId);
     new_id as ShapeId
 }
+
+/// Number of interned shape nodes — for regression tests asserting that a workload does NOT
+/// grow the registry. Not part of the public surface.
+#[doc(hidden)]
+#[cfg(not(feature = "portable"))]
+pub fn shape_count() -> usize {
+    registry().read().unwrap().nodes.len()
+}
+
+#[doc(hidden)]
+#[cfg(feature = "portable")]
+pub fn shape_count() -> usize {
+    0
+}

package/crates/tish_core/src/value.rs

@@ -196,19 +196,46 @@ pub trait TishStruct {
 
 /// Trait for Promise-like values that can be awaited (block until settled).
 /// Implemented by the runtime for native compile; interpreter uses its own Promise.
-pub trait TishPromise: Send + Sync {
+///
+/// (`'static` is part of the contract: promises are shared as `Arc<dyn TishPromise>`
+/// inside `Value::Promise`, and settlement subscriptions outlive the subscribing frame.)
+pub trait TishPromise: Send + Sync + 'static {
     fn block_until_settled(&self) -> core::result::Result<Value, Value>;
     /// Try to settle WITHOUT blocking. Returns `Some(result)` if the promise was already
     /// settled before this call; returns `None` if it is still pending (a background thread
     /// / I/O task has not completed yet). Default: always pending — implementors of async
-    /// promises (fetch, spawn) leave this as `None`; `ImmediateSettledPromise` overrides it.
+    /// promises (fetch) leave this as `None`; settled/state-backed promises override it.
+    /// Must PEEK, not consume: a promise reporting `Some` here stays awaitable.
     ///
     /// Used by `race`/`any`/`allSettled` to handle already-settled promises in input-order
-    /// (deterministic, JS-compatible) before falling back to concurrent thread waiting for
-    /// genuinely-pending ones.
+    /// (deterministic, JS-compatible) before subscribing to genuinely-pending ones.
     fn try_settle(&self) -> Option<core::result::Result<Value, Value>> {
         None
     }
+
+    /// Register a callback to run exactly once when this promise settles (issue #702).
+    ///
+    /// `Promise.race` / `Promise.any` / `Promise.allSettled` use this to wait on N
+    /// promises concurrently WITHOUT parking one OS thread per pending input: an
+    /// implementor that can store the callback (state-cell or channel-backed promises)
+    /// invokes it from whichever thread settles the promise, so the combinator's own
+    /// channel `recv` is the only blocking wait. A subscription that loses a race is
+    /// simply dropped after (or instead of) firing — no cancellation path is needed.
+    ///
+    /// The default implementation is the legacy behavior — a detached waiter thread
+    /// blocking in [`Self::block_until_settled`] — so implementors that cannot register
+    /// callbacks keep working; they only miss the no-thread optimization until they
+    /// override this. Overrides MUST NOT block while the promise is pending.
+    #[cfg(feature = "send-values")]
+    fn subscribe(
+        self: Arc<Self>,
+        on_settled: Box<dyn FnOnce(core::result::Result<Value, Value>) + Send>,
+    ) {
+        std::thread::spawn(move || {
+            let r = self.block_until_settled();
+            on_settled(r);
+        });
+    }
 }
 
 /// JavaScript RegExp flags
@@ -847,11 +874,15 @@ impl PropMap {
             // Update existing key → value changes, layout (shape) does not.
             return Some(core::mem::replace(&mut slot.1, val));
         }
-        // New key (inline storage) → transition the shape away from the current one.
-        self.shape = crate::shape::transition(self.shape, &key);
         if self.inline.len() >= PROPMAP_INLINE {
-            // Promote inline storage to an insertion-ordered map (keys + their order are preserved,
-            // so the shape stays valid).
+            // Promote inline storage to an insertion-ordered map — and DEMOTE to dictionary
+            // mode. An object growing past PROPMAP_INLINE keys one insert at a time is being
+            // used as a map (`cache[k] = v`), and continuing to transition would intern a
+            // permanent registry node per novel key, forever (#701). Inline caches lose only
+            // the 9+-key tail, whose slot lookups already go through the IndexMap.
+            // NOTE: the transition for THIS key is deliberately skipped (checked before the
+            // old transition call site so the 9th-key edge is never minted).
+            self.shape = crate::shape::DICT_SHAPE;
             let mut m: IndexMap<Arc<str>, Value, RandomState> =
                 IndexMap::with_capacity_and_hasher(self.inline.len() + 1, RandomState::default());
             for (k, v) in self.inline.drain(..) {
@@ -861,6 +892,8 @@ impl PropMap {
             self.map = Some(Box::new(m));
             return None;
         }
+        // New key (inline storage) → transition the shape away from the current one.
+        self.shape = crate::shape::transition(self.shape, &key);
         self.inline.push((key, val));
         None
     }
@@ -972,6 +1005,13 @@ impl PropMap {
         if incoming == 0 {
             return;
         }
+        // Dictionary-ness PROPAGATES: a DICT_SHAPE source stores its keys in whatever order it
+        // was built with (for hashed-map sources, a random per-instance order — see
+        // `from_unordered`). Walking that order through tracked `insert` re-minted a fresh
+        // permanent shape chain per merge (#708: `{ ...headers, id }` at 100 req/s ≈ 950 MB/h).
+        // Copies of dictionaries are dictionaries; copies of tracked objects stay tracked.
+        let dict = self.shape == crate::shape::DICT_SHAPE
+            || other.shape == crate::shape::DICT_SHAPE;
         // If the combined worst-case size escapes inline storage, promote once up front so the
         // per-key inserts below never reallocate or re-promote.
         if self.map.is_none() && self.inline.len() + incoming > PROPMAP_INLINE {
@@ -986,8 +1026,15 @@ impl PropMap {
         } else if let Some(m) = &mut self.map {
             m.reserve(incoming);
         }
-        for (k, v) in other.iter() {
-            self.insert(Arc::clone(k), v.clone());
+        if dict {
+            for (k, v) in other.iter() {
+                self.insert_untracked(Arc::clone(k), v.clone());
+            }
+            self.shape = crate::shape::DICT_SHAPE;
+        } else {
+            for (k, v) in other.iter() {
+                self.insert(Arc::clone(k), v.clone());
+            }
         }
     }
 }
@@ -1314,9 +1361,12 @@ pub fn value_call(callee: &Value, args: &[Value]) -> Value {
 pub fn merge_object_data(left: &VmRef<ObjectData>, right: &VmRef<ObjectData>) -> ObjectData {
     let l = left.borrow();
     let r = right.borrow();
-    let mut strings = PropMap::with_capacity(l.strings.len() + r.strings.len());
-    strings.extend(l.strings.iter().map(|(k, v)| (Arc::clone(k), v.clone())));
-    strings.extend(r.strings.iter().map(|(k, v)| (Arc::clone(k), v.clone())));
+    // Seed from a CLONE of the left side: its shape id and storage carry over, so spreading
+    // the same left never re-walks (or re-mints) its chain — the old rebuild-from-empty walked
+    // BOTH sides' stored orders through tracked inserts, which for dictionary-mode sources
+    // minted a fresh permanent shape chain on every single spread (#708).
+    let mut strings = l.strings.clone();
+    strings.merge_from(&r.strings);
     let mut symbols: Option<AHashMap<u64, Value>> = None;
     if let Some(ls) = &l.symbols {
         symbols = Some(ls.clone());
@@ -2067,6 +2117,172 @@ mod number_to_string_tests {
     }
 }
 
+#[cfg(test)]
+mod shape_backstop_tests {
+    use super::*;
+
+    // The registry is process-global, so these tests serialize on one lock (parallel
+    // siblings would observe each other's minting) and still use small margins for
+    // unrelated tests running elsewhere in the binary. The leaks these guard against
+    // mint THOUSANDS of nodes per loop, so the margins cannot mask a regression.
+    static REGISTRY_TEST_LOCK: std::sync::Mutex<()> = std::sync::Mutex::new(());
+    pub(super) fn locked() -> std::sync::MutexGuard<'static, ()> {
+        REGISTRY_TEST_LOCK.lock().unwrap_or_else(|e| e.into_inner())
+    }
+
+    /// #701 pathology A: fresh `{}` objects each taking a novel first key. Pre-fix this
+    /// minted one EMPTY_SHAPE edge per iteration; the fan-out cap must bound it.
+    #[test]
+    fn fresh_object_novel_first_key_is_bounded() {
+        let _g = locked();
+        let before = crate::shape::shape_count();
+        for i in 0..10_000 {
+            let mut pm = PropMap::new();
+            pm.insert(format!("first-key-backstop-a-{i}").into(), Value::Number(i as f64));
+        }
+        let grown = crate::shape::shape_count() - before;
+        assert!(grown <= 256 + 64, "fan-out cap failed: registry grew by {grown}");
+    }
+
+    /// #701 pathology B: one object accumulating novel keys (`cache[k] = v`). Promotion at
+    /// PROPMAP_INLINE must demote to DICT_SHAPE and stop minting entirely.
+    #[test]
+    fn growing_dictionary_demotes_and_stops_minting() {
+        let _g = locked();
+        let mut pm = PropMap::new();
+        for i in 0..8 {
+            pm.insert(format!("dict-backstop-warm-{i}").into(), Value::Number(i as f64));
+        }
+        let before = crate::shape::shape_count();
+        for i in 0..10_000 {
+            pm.insert(format!("dict-backstop-b-{i}").into(), Value::Number(i as f64));
+        }
+        assert_eq!(pm.shape(), crate::shape::DICT_SHAPE, "promotion must demote to dict mode");
+        let grown = crate::shape::shape_count() - before;
+        assert!(grown <= 64, "dictionary keys kept minting: registry grew by {grown}");
+        assert_eq!(pm.len(), 10_008);
+        assert!(matches!(pm.get("dict-backstop-b-9999"), Some(Value::Number(_))));
+    }
+
+    /// #706 shape of the JSON.parse pathology: repeated small objects whose key SET varies
+    /// per iteration. Depth/fan-out caps must bound total registry growth.
+    #[test]
+    fn novel_key_pairs_are_bounded() {
+        let _g = locked();
+        let before = crate::shape::shape_count();
+        for i in 0..10_000 {
+            let mut pm = PropMap::new();
+            pm.insert(format!("json-backstop-{i}").into(), Value::Number(1.0));
+            pm.insert("b".into(), Value::Number(2.0));
+        }
+        let grown = crate::shape::shape_count() - before;
+        assert!(grown <= 2 * 256 + 64, "novel key pairs unbounded: registry grew by {grown}");
+    }
+
+    /// The intended fast path must still intern and DEDUPE: repeating the same fixed-order
+    /// construction mints its chain once, and the objects keep a real (non-dict) shape.
+    #[test]
+    fn fixed_shape_construction_still_dedupes_and_tracks() {
+        let _g = locked();
+        let mk = || {
+            let mut pm = PropMap::new();
+            pm.insert("fixed-backstop-x".into(), Value::Number(1.0));
+            pm.insert("fixed-backstop-y".into(), Value::Number(2.0));
+            pm.insert("fixed-backstop-z".into(), Value::Number(3.0));
+            pm
+        };
+        let first = mk();
+        let before = crate::shape::shape_count();
+        let mut last_shape = first.shape();
+        for _ in 0..5_000 {
+            let pm = mk();
+            assert_ne!(pm.shape(), crate::shape::DICT_SHAPE, "small fixed objects must stay tracked");
+            last_shape = pm.shape();
+        }
+        assert_eq!(last_shape, first.shape(), "identical construction must share one shape");
+        let grown = crate::shape::shape_count() - before;
+        assert!(grown <= 96, "fixed-shape loop should not mint: registry grew by {grown}");
+    }
+}
+
+#[cfg(test)]
+mod dict_propagation_tests {
+    use super::*;
+
+    // Shares the backstop tests' lock: all registry-count assertions serialize together.
+    use super::shape_backstop_tests::locked;
+
+    fn dict_source(n: usize, tag: &str) -> VmRef<ObjectData> {
+        let mut m = ObjectMap::default();
+        for i in 0..n {
+            m.insert(format!("hdr-{tag}-{i}").into(), Value::Number(i as f64));
+        }
+        let Value::Object(od) = Value::object(m) else { unreachable!() };
+        od
+    }
+
+    /// #708: spreading a dictionary-mode source must not mint shape chains, and the result
+    /// must itself be dictionary-mode (so downstream copies stay clean too).
+    #[test]
+    fn spread_from_dict_source_is_flat_and_dict() {
+        let _g = locked();
+        let left = dict_source(12, "left");
+        let right = dict_source(12, "right");
+        let before = crate::shape::shape_count();
+        let mut last = None;
+        for _ in 0..5_000 {
+            last = Some(merge_object_data(&left, &right));
+        }
+        let grown = crate::shape::shape_count() - before;
+        assert!(grown <= 64, "dict spread minted shapes: registry grew by {grown}");
+        let merged = last.unwrap();
+        assert_eq!(merged.strings.shape(), crate::shape::DICT_SHAPE);
+        assert_eq!(merged.strings.len(), 24);
+        assert!(matches!(merged.strings.get("hdr-right-11"), Some(Value::Number(_))));
+    }
+
+    /// Tracked x tracked spreads must still dedupe to one chain and keep a tracked result —
+    /// the fast path is preserved, not blanket-demoted.
+    #[test]
+    fn spread_tracked_sources_stays_tracked_and_dedupes() {
+        let _g = locked();
+        let mk = |a: &str, b: &str| {
+            let mut pm = PropMap::new();
+            pm.insert(a.into(), Value::Number(1.0));
+            pm.insert(b.into(), Value::Number(2.0));
+            VmRef::new(ObjectData { strings: pm, symbols: None, frozen: false })
+        };
+        let left = mk("prop-track-a", "prop-track-b");
+        let right = mk("prop-track-c", "prop-track-d");
+        let first = merge_object_data(&left, &right);
+        assert_ne!(first.strings.shape(), crate::shape::DICT_SHAPE);
+        let before = crate::shape::shape_count();
+        let mut last_shape = first.strings.shape();
+        for _ in 0..5_000 {
+            let m = merge_object_data(&left, &right);
+            last_shape = m.strings.shape();
+        }
+        assert_eq!(last_shape, first.strings.shape(), "repeated identical spread must share one shape");
+        let grown = crate::shape::shape_count() - before;
+        assert!(grown <= 96, "tracked spread re-minted: registry grew by {grown}");
+    }
+
+    /// Last-write-wins override order must be unchanged by the reseeded merge.
+    #[test]
+    fn spread_override_semantics_preserved() {
+        let mut lm = ObjectMap::default();
+        lm.insert("shared-key".into(), Value::Number(1.0));
+        lm.insert("only-left".into(), Value::Number(2.0));
+        let Value::Object(l) = Value::object(lm) else { unreachable!() };
+        let mut rm = ObjectMap::default();
+        rm.insert("shared-key".into(), Value::Number(9.0));
+        let Value::Object(r) = Value::object(rm) else { unreachable!() };
+        let m = merge_object_data(&l, &r);
+        assert!(matches!(m.strings.get("shared-key"), Some(Value::Number(n)) if *n == 9.0));
+        assert!(matches!(m.strings.get("only-left"), Some(Value::Number(n)) if *n == 2.0));
+    }
+}
+
 #[cfg(test)]
 mod dict_shape_leak_tests {
     use super::*;