fix(arrays): release mapfile budgets and surface refusals

[chaliy]

What changed

Repeated mapfile reads now release the replaced array's retained entry and byte charges. mapfile -O updates existing entries through the interpreter's checked writer, preserving other entries and refunding overwritten values. Array entry-limit refusals now fail execution through the existing memory-error path instead of silently dropping writes.

Why

The independent brush-web evaluation found that repeated large reads eventually emptied arrays, including unrelated arrays in later executions. Direct removal of mapfile destinations left phantom charges in the session-wide MemoryBudget; indexed merges also removed their destination before admission. The shared 100,000-entry ceiling was eventually exhausted, and ignored insertion refusals reported success. Both entry and retained-byte charges now follow storage ownership; resource ceilings are unchanged.

Before / After

Exact upstream reproduction, default limits:

seq 50000 > /tmp/s
for i in 1 2 3; do mapfile -t a < /tmp/s; echo "mapfile=$? n=${#a[@]}"; done
b=(x y z); echo "b=${#b[@]}"

Baseline (origin/main at 8a817bf0):

mapfile=0 n=50000
mapfile=0 n=50000
mapfile=0 n=0
b=0

Fixed CLI and GNU Bash 5.3.20, byte-for-byte:

mapfile=0 n=50000
mapfile=0 n=50000
mapfile=0 n=50000
b=3

The six original native regression tests failed on the baseline. Coverage includes tiny entry budgets, empty input, -O overwrite/merge, repeated 48 KB replacements, genuine entry/byte exhaustion, and recovery in subsequent host calls. Browser-WASM tests exercise repeated 50,000-line reads and a rejected 100,001-entry read followed by recovery. Existing security tests now require visible errors while checking retained counts.

mapfile also matches Bash's status-1 refusal for interpreter-owned debug-stack arrays (FUNCNAME, BASH_SOURCE, BASH_LINENO), whose uncharged metadata must not refund user capacity. A focused regression covers this ceiling-preservation edge case.

Validation

• just pre-pr: 7,121 Rust tests/doctests plus 165 latest-main script tests; formatting, lint, docs/knowledge/capability/release checks, and dependency vetting pass.
• All-target/all-feature Clippy passes.
• Workspace http_client,ssh,sqlite suites: 6,993 tests pass; expanded-feature doctests pass.
• Serialized failpoints: 19 pass. Serialized property-security tests: 29 pass. Resource-cap fixtures pin a 600-second deadline per the testing contract.
• Freshly built browser-WASM package: all 72 Node tests pass, including both new mapfile regressions. The latest-main shipping profile also passes the 24-case compatibility sample, compressed-size budgets, and npm archive/identity gates.
• cargo deny check passes; regenerated builtin inventory has no diff.
• parallel_execution Criterion benchmark completes. just bench: 96 cases, zero errors and 100% output match for both engines (local smoke run, not a before/after performance baseline).
• Exact reproduction and debug-stack refusal cases match GNU Bash 5.3.20 locally. The complete strict gate is platform-dependent on macOS (GNU/BSD tool mix: 3,657/3,735); canonical Linux CI passes the full strict Bash/sed/grep parity gates.

Risk

• Medium: entry-limit admission failures now return resource-limit errors; earlier admitted array writes may remain. This matches existing byte-limit behavior and is documented.
• FUNCNAME remains reserved after unset (L-MAPFILE-002); modeling removal of its special status is outside the interpreter-owned metadata lifecycle.
• No new dependencies or public API fields. No resource limits increased or disabled.

Checklist

• Tests added or updated
• Backward compatibility considered

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	bashkit	d166e9d	Commit Preview URL Branch Preview URL	Oct 15 2026, 03:15 PM