js-on-sx: lower array pad bail-out to 1M to kill remaining hang

The 2^32-1 threshold still allowed indices like 2147483648 to pad
billions of undefineds. Without sparse-array support there's no
semantic value in >1M padding; lowering the bail turns those tests
into fast assertion fails instead of timeouts.
built-ins/Array timeouts: 2 → 1. conformance.sh: 148/148.

plans/js-on-sx.md

@@ -158,6 +158,8 @@ Each item: implement → tests → update progress. Mark `[x]` when tests green.
 
 Append-only record of completed iterations. Loop writes one line per iteration: date, what was done, test count delta.
 
+- 2026-05-08 — **Lowered array padding bail-out from 2^32-1 to 1M.** Yesterday's 2^32-1 threshold still allowed indices like `2147483648` to pad billions of `js-undefined` entries, hanging the worker. Without sparse-array support there's no semantic value in supporting >1M sparse padding; lowering the bail to 1M turns those tests into fast assertion failures instead of timeouts. Removes another timeout (Array 7→1). built-ins/Array stays at 23/45, but the run is faster and no longer wall-time-bound. conformance.sh: 148/148.
+
 - 2026-05-08 — **Out-of-range array indices and lengths no longer hang.** `arr[4294967295] = 'x'` and `arr.length = 4294967295` were padding the SX list with `js-undefined` for ~4 billion entries — guaranteed timeout. Per ES spec, indices ≥ 2^32-1 aren't array indices (they're regular properties, which we can't store on a list). Added a `(>= i 4294967295)` bail-out clause to both `js-list-set!` (numeric index path) and the `length` setter; both now no-op at that bound. Removed 5 of the 7 Array timeouts. built-ins/Array: 21/45 → 23/45. conformance.sh: 148/148.
 
 - 2026-05-08 — **Built-in `.length` returns spec-defined values for variadic functions.** `String.fromCharCode.length`, `Math.max.length`, `Array.from.length` were all returning `0` because the underlying SX lambdas use `&rest args` with no required params — but the spec assigns each built-in a specific length (`fromCharCode === 1`, `max === 2`, etc.). Added `js-builtin-fn-length` that maps the unmapped JS name to its spec length (12 entries covering fromCharCode, fromCodePoint, raw, of, from, isArray, max, min, hypot, atan2, imul, pow). `js-fn-length` consults this table first and falls back to counting real params. built-ins/String: 79/99 → 80/99, built-ins/Array: 20/45 → 21/45. conformance.sh: 148/148.