Parent: #480 Related: #493, #460, #459
Defect
Interpreter.objectOwnKeysList and proxyOwnKeys build non-owning integer/string membership tables from the realm arena for each enumeration. The returned ordered key slices and formatted index strings legitimately retain their arena lifetime, but the hash buckets are temporary. Repeated Reflect.ownKeys, Object.keys/values/entries, JSON object enumeration, or Proxy ownKeys invariant validation therefore retain historical bucket capacity until realm teardown.
This is user-controlled memory growth on a security-sensitive reflection boundary. Proxy trap ordering, duplicate detection, configurability/extensibility invariants, integer-index ordering, Symbols, hidden keys, host hooks, arrays, typed arrays, and function prototype materialization must remain exact.
Required change
- Add ordinary-object, array/sparse-index, and Proxy growth/plateau witnesses with exact ordered checksums.
- Route only non-owning membership buckets through Context-owned freeable scratch backing and deinitialize them on success and every abrupt path.
- Keep returned key bytes/slices and all observable property/trap results arena-owned for their required lifetime.
- Preserve no-GIL allocator synchronization and add normal/TSan concurrent coverage.
- Record exact-parent CPU and peak/retained-memory evidence; retain only demonstrated improvements.
- Run Reflect/Object/Proxy/JSON test262 subtrees with no regressions.
No-workaround rules
No key-count limit, skipped invariant, altered key order, hidden Proxy trap, global mutable cache, system runtime dependency, or benchmark-only path.