structuralIdentity merges distinct RegExp values with reference-valued lastIndex #2192

Bug

D2 equality treats RegExp lastIndex as a header compared with ===, but structuralIdentity recursively encodes that header. Separate reference-valued headers with the same contents therefore produce one defined identity for unequal values.

import {
  equalHashValues,
  structuralIdentity,
} from './packages/db-ivm/src/hashing/hash.ts'

const a = /a/g
const b = /a/g
a.lastIndex = Object.freeze({ x: 1 })
b.lastIndex = Object.freeze({ x: 1 })
Object.freeze(a)
Object.freeze(b)

console.log(equalHashValues(a, b)) // false
console.log(structuralIdentity(a) === structuralIdentity(b)) // true

JavaScript permits assigning an object to lastIndex; TypeScript's RegExp declaration models only the usual numeric value. The witness remains after both values and headers are frozen. hash.ts explicitly allows any lastIndex value in the header.

Impact

groupBy uses the defined structural identity as a prefix key. A real D2 aggregate over the two values above reported one distinct contribution where D2 equality distinguishes two. The two values also have equal structural hash digests, so returning undefined from structuralIdentity alone does not establish a correct groupBy fallback.

Test gap and repair boundary

The structural-identity oracle currently generates only numeric lastIndex values. The hash-identity oracle also limits its RegExp grammar. Add reference-valued headers to an independent model and a direct helper witness, then exercise the receiving groupBy path. The production fix should preserve the law that a shared defined identity implies D2 equality and that D2-unequal contributions stay separate. This is a pre-existing defect found while reviewing PR #2153; that PR only repairs the oracle's nested-array normal form.