fix(gxt-backend): cap classic-tag reactor fires to break runaway leaks

Diagnostic instrumentation (commit 34f9515) confirmed leaked
classic-tag reactors firing 9,000+ times across unrelated tests when
their self-unsub heuristics don't trip. The runaway saturates the
runloop and produces the testem 1200s browser-timeout that turned
13-minute Basic Test runs into 41-minute hangs.

This commit doesn't fix the leak source — multiple prior attempts
to drain reactors at test boundaries (commits 401df7b, 276a1a4,
6deded4, ef6ce28, all reverted) regressed CI badly because the
leaked reactors are doing load-bearing work for unrelated tests in
some way that hasn't been identified. What this commit does is bound
the cost of the runaway: every reactor self-destructs after firing
10,000 times globally, which is two orders of magnitude above any
plausible real-app bound and far past where a leaked reactor's work
becomes pure overhead. The cap fires inside _fireClassicReactors so
the unsub is synchronous and the reactor leaves _classicReactors
immediately.

Local cumulative reproducer with the cap in place: 9 reactors
reached the 10,000-fire mark and were unsubscribed cleanly. The
browser stays responsive instead of saturating.

Smoke (14 modules / 333 tests) green.

Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>

Author: lifeart

packages/@ember/-internals/gxt-backend/validator.ts

@@ -701,17 +701,44 @@ export function registerClassicReactor(cb: () => void, source?: string): () => v
   };
 }
 
+// Hard cap on per-reactor fires to break runaway loops. A leaked
+// classic-tag reactor whose self-unsub heuristic doesn't trip can
+// fire 10,000+ times across unrelated tests (diagnostic runs showed
+// a single reactor at 9,391 fires before the testem 1200s browser
+// timeout fired). The cap doesn't stop the leak — it stops the
+// runaway from saturating the runloop and hanging CI. Real-app
+// reactors fire bounded times per render path; 10,000 fires for a
+// single reactor across the lifetime of one page load is two orders
+// of magnitude above any legitimate bound.
+const REACTOR_FIRE_HARD_CAP = 10_000;
+
 function _fireClassicReactors() {
   if (_classicReactors.size === 0) return;
   // Copy to avoid mutation during iteration
   const snapshot = Array.from(_classicReactors);
   const debug = (globalThis as any).__GXT_LEAK_DEBUG__;
   const currentTest = debug ? _currentTestName() : '';
   for (const cb of snapshot) {
-    if (debug) {
-      const meta = _reactorMeta.get(cb);
-      if (meta) {
-        meta.fireCount++;
+    const meta = _reactorMeta.get(cb);
+    if (meta) {
+      meta.fireCount++;
+      if (meta.fireCount > REACTOR_FIRE_HARD_CAP) {
+        // Self-destruct: this reactor has fired beyond any plausible
+        // bound and is almost certainly leaked. Skip the call and
+        // remove it from the registry so it stops contributing to
+        // the runloop saturation that produces the testem 1200s
+        // browser timeout.
+        if (debug) {
+          // eslint-disable-next-line no-console
+          console.log(
+            `[leak-debug] CAP reactor #${meta.id} src=${meta.source} regAt="${meta.registeredAtTest}" fires=${meta.fireCount} — unsubscribing`
+          );
+        }
+        _classicReactors.delete(cb);
+        _reactorMeta.delete(cb);
+        continue;
+      }
+      if (debug) {
         // Cross-test leak: reactor registered during a different test
         // than the one currently executing.
         if (