Adversarial readback of liris exact-tuple patch found three real bypasses of
the Object.keys check: (1) accessor/getter tuple splitting check-time from
use-time (TOCTOU) -> CHILD_MAY_ACT with chain_sha16 != verified content;
(2) non-enumerable own field smuggled past exact-shape; (3) symbol-keyed field
smuggled. Fix: single-read frozen snapshot via getOwnPropertyNames +
getOwnPropertySymbols + data-descriptor-only; materializeChain single index
read neutralizes proxy arrays. 18-case prefix byte-stable, cases 19-21 added,
self-test 12/12, pyramid 105/105.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
