fix(arithmetic): budget expanded array keys before allocation

[chaliy]

What changed

Arithmetic associative-array keys and dollar-expanded expressions reserve intermediate capacity before growth, enforce the existing 64 KiB arithmetic cap, and charge shared work with synchronous cancellation/deadline checks. Shared-budget failures reach callers as request resource errors; subsequent executions can reuse the session.

Why

Repeated scalar substitution could allocate an oversized key before the final array writer checked retained memory. The arithmetic recursion guard did not enforce shared live-memory/work budgets during construction (TM-DOS-026).

Before / After

A bounded Bash::exec regression uses a 64-byte scalar, 32 substitutions, and a 512-byte intermediate limit. Before, arithmetic assignment succeeded and stored a 2 KiB key. After, assignments, updates, and reads reject with a typed resource-limit error; a fresh execution prints recovered and reports zero entries.

Validation:

• just pre-pr: green on the latest synchronized branch.
• All-feature clippy; 19 serial failpoint tests; arithmetic budget, boundary, cancellation, recovery, and finite Bash differential tests.
• CLI smoke: valid quoted-key updates print 5 (exit 0); a bounded 96 KiB expanded key reports expression too long (expected exit 1).
• Full parallel-execution benchmark suite completed; comparison harness passed all 96 cases with zero errors and 100% expected-output matches for Bashkit and Bash 5.3.20.
• Public security documentation and canonical knowledge updated.

Risk

• Medium: arithmetic intermediate-memory/work accounting now rejects allocations earlier and propagates previously swallowed shared-budget failures at command boundaries.
• Valid expressions within configured limits retain Bash behavior; size/recursion failures retain arithmetic diagnostics.

Checklist

• Tests added or updated
• Backward compatibility considered

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	bashkit	83b021d	Commit Preview URL Branch Preview URL	Oct 11 2026, 10:55 PM