fix(audience): guard Json.Serialize against cyclic / pathologically deep dicts

Two defences against StackOverflowException (uncatchable in .NET).

- MaxDepth = 64 — WriteObject/WriteArray throw FormatException past
  the cap rather than recursing.
- ReferenceEquality visited-set — self-referential or shared-
  instance containers throw on re-entry. Sibling diamonds (same
  dict under two independent keys) are NOT cycles; enforced by
  visited.Remove after the recursive write returns.

HashSet<object> is allocated lazily, so scalar-only payloads pay
nothing. No behaviour change for any acyclic, shallow caller.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: ImmutableJeffrey

src/Packages/Audience/Runtime/Utility/Json.cs

@@ -1,3 +1,4 @@
+using System;
 using System.Collections;
 using System.Collections.Generic;
 using System.Globalization;
@@ -7,10 +8,14 @@ namespace Immutable.Audience
 {
     internal static class Json
     {
+        // Depth cap so a pathological input throws FormatException
+        // instead of blowing the stack (StackOverflow is uncatchable).
+        internal const int MaxDepth = 64;
+
         internal static string Serialize(Dictionary<string, object> data)
         {
             var sb = new StringBuilder();
-            WriteObject(sb, data, indent: 0, depth: 0);
+            WriteObject(sb, data, indent: 0, depth: 0, visited: null);
             return sb.ToString();
         }
 
@@ -22,11 +27,11 @@ internal static string Serialize(Dictionary<string, object> data, int indent)
         {
             if (indent <= 0) return Serialize(data);
             var sb = new StringBuilder();
-            WriteObject(sb, data, indent, depth: 0);
+            WriteObject(sb, data, indent, depth: 0, visited: null);
             return sb.ToString();
         }
 
-        private static void WriteValue(StringBuilder sb, object value, int indent, int depth)
+        private static void WriteValue(StringBuilder sb, object value, int indent, int depth, HashSet<object> visited)
         {
             if (value == null)
             {
@@ -68,22 +73,25 @@ private static void WriteValue(StringBuilder sb, object value, int indent, int d
             }
             else if (value is Dictionary<string, object> dict)
             {
-                WriteObject(sb, dict, indent, depth);
+                WriteObject(sb, dict, indent, depth, visited);
             }
             else if (value is IList list)
             {
-                WriteArray(sb, list, indent, depth);
+                WriteArray(sb, list, indent, depth, visited);
             }
             else
             {
                 WriteString(sb, value.ToString());
             }
         }
 
-        private static void WriteObject(StringBuilder sb, Dictionary<string, object> dict, int indent, int depth)
+        private static void WriteObject(StringBuilder sb, Dictionary<string, object> dict, int indent, int depth, HashSet<object> visited)
         {
+            GuardDepth(depth);
+            visited = EnterContainer(dict, visited);
+
             sb.Append('{');
-            if (dict.Count == 0) { sb.Append('}'); return; }
+            if (dict.Count == 0) { sb.Append('}'); visited.Remove(dict); return; }
 
             var pretty = indent > 0;
             var first = true;
@@ -94,26 +102,31 @@ private static void WriteObject(StringBuilder sb, Dictionary<string, object> dic
                 if (pretty) AppendNewline(sb, indent, depth + 1);
                 WriteString(sb, kvp.Key);
                 sb.Append(pretty ? ": " : ":");
-                WriteValue(sb, kvp.Value, indent, depth + 1);
+                WriteValue(sb, kvp.Value, indent, depth + 1, visited);
             }
             if (pretty) AppendNewline(sb, indent, depth);
             sb.Append('}');
+            visited.Remove(dict);
         }
 
-        private static void WriteArray(StringBuilder sb, IList list, int indent, int depth)
+        private static void WriteArray(StringBuilder sb, IList list, int indent, int depth, HashSet<object> visited)
         {
+            GuardDepth(depth);
+            visited = EnterContainer(list, visited);
+
             sb.Append('[');
-            if (list.Count == 0) { sb.Append(']'); return; }
+            if (list.Count == 0) { sb.Append(']'); visited.Remove(list); return; }
 
             var pretty = indent > 0;
             for (var i = 0; i < list.Count; i++)
             {
                 if (i > 0) sb.Append(',');
                 if (pretty) AppendNewline(sb, indent, depth + 1);
-                WriteValue(sb, list[i], indent, depth + 1);
+                WriteValue(sb, list[i], indent, depth + 1, visited);
             }
             if (pretty) AppendNewline(sb, indent, depth);
             sb.Append(']');
+            visited.Remove(list);
         }
 
         private static void AppendNewline(StringBuilder sb, int indent, int depth)
@@ -122,6 +135,29 @@ private static void AppendNewline(StringBuilder sb, int indent, int depth)
             sb.Append(' ', indent * depth);
         }
 
+        private static void GuardDepth(int depth)
+        {
+            if (depth >= MaxDepth)
+                throw new FormatException(
+                    $"JSON nesting exceeds {MaxDepth} levels — refusing to serialize. " +
+                    "Check for a cyclic or excessively deep dictionary/list.");
+        }
+
+        private static HashSet<object> EnterContainer(object container, HashSet<object> visited)
+        {
+            visited ??= new HashSet<object>(ReferenceEqualityComparer.Instance);
+            if (!visited.Add(container))
+                throw new FormatException("JSON graph contains a cycle — refusing to serialize.");
+            return visited;
+        }
+
+        private sealed class ReferenceEqualityComparer : IEqualityComparer<object>
+        {
+            internal static readonly ReferenceEqualityComparer Instance = new ReferenceEqualityComparer();
+            public new bool Equals(object x, object y) => ReferenceEquals(x, y);
+            public int GetHashCode(object obj) => System.Runtime.CompilerServices.RuntimeHelpers.GetHashCode(obj);
+        }
+
         private static void WriteString(StringBuilder sb, string s)
         {
             sb.Append('"');