fix(fmt): budget amplified output before allocation

[chaliy]

What changed

fmt reserves generated output capacity against the shared live-memory budget before allocation. Repeated indentation/prefix bytes and optimal-fit searches also consume work and observe cancellation/deadlines. Budget failures propagate to callers instead of returning successful partial output. Valid formatting, pipes, and VFS redirects retain their existing behavior.

Why

A small indented paragraph could multiply into gigabytes in an ordinary output buffer before downstream stdout capture applied. The synchronous formatter also ran without checking its execution deadline.

Before / After

• Before: a bounded production Bash API regression with 513 input bytes produced 33,024 output bytes despite an 8,192-byte live-memory limit.
• After: the same call fails with a resource-limit error and the shell remains reusable. With sufficient budget, exact 33,024-byte output still passes through a pipe or VFS redirect with a 16-byte stdout capture limit.
• Fresh CLI proof: a finite 34,817-byte input that would expand to 33,556,480 bytes fails before output in both quick and optimal modes under default limits:

  resource limit exceeded: execution budget exhausted: live intermediate bytes (33589302 requested, max 32000000)
  

  A valid 513-byte input still emits exactly 33,024 bytes, exit 0.

Risk

Medium: intentionally rejects formatter output/search work exceeding configured execution budgets. Existing layout/option behavior stays covered by formatter tests and a finite real-Bash/host-fmt differential. Uses existing budget-owned buffers; no dependencies or permission changes.

Validation

• just pre-pr
• just test
• cargo clippy --all-targets --all-features -- -D warnings
• cargo deny check
• cargo test --test proptest_security -- --test-threads=1
• generated builtin inventory matches the committed artifact
• bounded formatter API/CLI regression and session-recovery smoke
• cargo bench --bench parallel_execution
• 96-case Bashkit-vs-Bash benchmark: zero errors, 100% output match for both runners
• nested-substitution stack regression suite: 4 passed under the original stack limit

Checklist

• Tests added or updated
• Backward compatibility considered

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	bashkit	7c2f9eb	Commit Preview URL Branch Preview URL	Oct 11 2026, 11:21 PM