fix: 修复全局边界安全与内存稳定性问题

crates/oxide_kernel/src/kernel.rs

@@ -146,6 +146,18 @@ impl KernelCore {
     pub fn set_session_gc_threshold(&mut self, bytes: usize) {
         self.config.session_gc_threshold = bytes;
     }
+
+    pub fn sweep_runner_forges(&self) {
+        self.string_forge.maybe_sweep(self.config.max_dead_strings.or(Some(1)));
+        // test262 creates a fresh VM/session per test. At this boundary no JS object
+        // from prior tests may retain transient shapes/templates.
+        if self.shape_forge.len() > 50_000 {
+            self.shape_forge.clear_transient();
+            self.prop_forge.clear();
+        } else if self.prop_forge.len() > 50_000 {
+            self.prop_forge.clear();
+        }
+    }
 }
 
 /// Per-session mutable state: builtin prototype objects and the global object.

crates/oxide_kernel/src/prop_forge.rs

@@ -43,6 +43,18 @@ impl PropForge {
             }
         }
     }
+
+    pub fn clear(&self) {
+        self.templates.clear();
+    }
+
+    pub fn len(&self) -> usize {
+        self.templates.len()
+    }
+
+    pub fn is_empty(&self) -> bool {
+        self.templates.is_empty()
+    }
 }
 
 impl Default for PropForge {

crates/oxide_kernel/src/shape_forge.rs

@@ -114,6 +114,23 @@ impl ShapeForge {
         shapes.get((id - 1) as usize).and_then(|s| s.clone())
     }
 
+    pub fn len(&self) -> usize {
+        self.shapes.read().unwrap().len()
+    }
+
+    pub fn is_empty(&self) -> bool {
+        self.len() == 0
+    }
+
+    pub fn clear_transient(&self) {
+        let mut shapes = self.shapes.write().unwrap();
+        if shapes.len() > 1 {
+            shapes.truncate(1);
+        }
+        self.transitions.clear();
+        self.next_id.store(2, Ordering::Relaxed);
+    }
+
     pub fn lookup_position(&self, shape_id: ShapeId, prop_name: StringIndex) -> Option<u32> {
         let shapes = self.shapes.read().unwrap();
         let total_depth = Self::compute_depth(shape_id, &shapes);

crates/oxide_kernel/src/string_forge.rs

@@ -126,6 +126,14 @@ impl StringForge {
         inner.map = new_map;
         inner.entries = new_entries;
     }
+
+    pub fn len(&self) -> usize {
+        self.inner.read().unwrap().entries.len()
+    }
+
+    pub fn is_empty(&self) -> bool {
+        self.len() == 0
+    }
 }
 
 impl Default for StringForge {