regression(main): shapes.rs ShapeId/ObjectHeader disagreement aborts the entire perry-runtime test suite (SIGABRT, ~1000 tests masked) #9108

Symptom

cargo test -p perry-runtime --lib -- --test-threads=1 on current main ABORTS (SIGABRT, non-unwinding double panic):

test object::reserved_floor::tests::user_properties_read_back_through_the_get_path_at_scale ...
thread '...' panicked at crates/perry-runtime/src/object/shapes.rs:1539:9:
published ShapeId disagrees with authoritative ObjectHeader facts
thread caused non-unwinding panic. aborting.

~1800 tests pass before the crash; everything after object::reserved_floor is never run. Every branch's runtime-suite signal is currently masked, and worse: depending on output capture, the run can LOOK green (an isolation test's re-exec child prints test result: ok. 1 passed; 2822 filtered out and a piped tail -1 reads that as the verdict — two of my gate batteries did exactly that today).

Assessment

• The failing assertion is the shape-consistency invariant (shapes.rs:1539) tripping under the reserved_floor at-scale test — ShapeId/shape-key-index territory (perf(runtime): stop hashing a hash in the shape key index; memcpy the delete key clone #9000-perf(runtime): keep the migrated key index instead of dropping it (populated delete −36.2%) #9005/perf(runtime): compact an owned keys array in place on delete (populated delete −26.8%) #9013/perf(runtime): IC hits stop re-deriving shape-immutable facts (combined loop now beats node) #9022 lineage, plus the recent reserved_floor iterator-floor work fix(runtime): make iterator own properties readable; present-undefined .next throws (follow-up to #9066) #9075/fix(runtime): expose iterator helper next values #9080).
• Independent of my open PRs (perf(codegen): devirtualize single-binding closure calls — captured/global/local arrow calls to 3.6 ns (was 4.6-9.3) #9105, the param-gate branch): their diffs contain no perry-runtime files; the aborting binary is built from main's runtime sources.
• The double panic (assert inside an unwinding context) is what converts a single test failure into a whole-suite abort — even after the root cause is fixed, consider making that assertion abort-safe so one shape bug can't mask the suite again.

Repro

cargo test -p perry-runtime --lib -- --test-threads=1 > rt.log 2>&1; echo $?; tail -30 rt.log

(Do not pipe through early-closing readers; SIGPIPE kills the run mid-suite and fakes an exit-0.)

Filed by the perf campaign (session https://claude.ai/code/session_019WVcWKmYsUBnnFB7nBgbBJ); second suite-masking find of the day after #9106. Shape-lane ownership per the cc-socks channel.