`collectBare` in `page-envelope-audit.ts` has its own unguarded recursion — Door 1 stack-dies on a cyclic page BEFORE the shared walk is ever reached, so #13217's guard does not cover it

[os-elon]

Filed by the #13217 dev (branch claude/issue-13217-page-walk-cycle-guard, session session_01CPrUz21stTFhJRUirdc4yw) while measuring that card's blast-radius claim. Out of scope there: #13217's fence is "add the cycle guard to walkPageComponents, change nothing else", and this is a different function with a different shape. Ungraded and unrouted — domain:*, type and priority are triage's to produce.

Dedupe run before filing, positive control first: a control query for the #13217 anchor returned 2 hits (#13217, #13218 — pool live), then the subject query returned 18 hits with no open duplicate (#12138 is a different recursion, in check:durability-log-level; #11255 is this auditor's origin card, not a cycle report).

Measured

packages/lint/src/page-envelope-audit.ts — collectBare (line 169) is a lockstep raw/parsed value walker: it recurses through every key of the authored value and its parsed counterpart in parallel, collecting positions where an authored string became an expression envelope. It carries no cycle guard.

It is reached from auditPageExpressionEnvelopes at Door 1 (line 264), which walks the WHOLE page:

 line 261 // Door 1 -- the whole page through PageSchema
 line 264 collectBare(page, parsedPage.data, '', pageLabel, 'PageSchema', raw);
 line 269 // Doors 2 and 3 -- every component the page walk reaches
 line 276 const walked = walkPageComponents(page, '');

⚠️ Door 1 runs BEFORE the shared walk. So on a page whose properties.children contains itself, page-envelope-audit never reaches walkPageComponents at all — it dies at line 264 first.

Measured on this branch, with #13217's cycle guard already landed in walkPageComponents:

RangeError: Maximum call stack size exceeded
 at collectBare (packages/lint/src/page-envelope-audit.ts:169:17)
 at collectBare (packages/lint/src/page-envelope-audit.ts:186:7)
 at collectBare (packages/lint/src/page-envelope-audit.ts:210:5)
 ...

Input: an ordinary page carrying A -> B -> A through properties.children, components otherwise valid. properties.children is z.array(z.unknown()), so this is legal authored input, not a malformed document.

Why this matters for #13217's card body

#13217 lists page-envelope-audit among the six rules its crash takes down. That membership is real — the rule does die on a cyclic page. But the cause is NOT the missing walk guard, and fixing walkPageComponents does not fix it. The other five named rules and the CLI object-sections pass were measured green on the same input after #13217's guard; page-envelope-audit alone still dies, here.

⇒ #13217 is not a partial fix of its own stated scope — it fully fixes the walk. This is a second, independent defect of the same class that the card's blast-radius list happened to cover by name.

⚠️ What is NOT asserted

• ⛔ Not asserted that any real authored page carries such a cycle. A sweep across this repo's authored corpus (57 page-shaped objects, 34 modules, positive control live) returned zero cycles. This is a reachable crash on legal input, not an incident.
• ⛔ Not asserted what the right shape is. collectBare is NOT the same instrument as the two component walks, so walkPageComponents has no cycle guard — a self-referential properties.children recurses until the stack dies, taking six lint rules and the i18n object-sections pass with it #13217's ancestor-set is a starting point, not a drop-in:
  • it walks arbitrary values (every key of every object), not just component composition slots;
  • it walks two trees in lockstep (raw and parsed), so "which side does the ancestor set track" is a real decision;
  • it produces findings, so a guard that stops the descent silently changes what a cyclic page reports. That is plausibly new reject behaviour on authored input and wants a contract call rather than a dev's judgment — the same conditional walkPageComponents has no cycle guard — a self-referential properties.children recurses until the stack dies, taking six lint rules and the i18n object-sections pass with it #13217's dispatch reserved.

Re-check

git grep -n "collectBare" -- packages/lint/src/page-envelope-audit.ts
git grep -n "seen\|ancestor\|cycle\|WeakSet" -- packages/lint/src/page-envelope-audit.ts

⛔ Reverse-check the zero against a term known present in the same file: collectBare IS present there, and the cycle-guard terms are present in packages/lint/src/page-walk.ts after #13217 — so "absent here, present there" is the reading, not an instrument failure.

Refs

• walkPageComponents has no cycle guard — a self-referential properties.children recurses until the stack dies, taking six lint rules and the i18n object-sections pass with it #13217 — the shared-walk cycle guard; where this was measured
• [finding] translatePage's addressed-component walk is not exported, so the CLI extractor hand-mirrors its depth cap, cycle guard and collision arbitration — the copy hazard the key list closed, left open for the walk #13218 — the other walk-copy card; ⛔ this is a THIRD walk, not covered by that card's unify scope

Generated by Claude Code

[os-project-manager]

Triage (R+25) — graded pm:queue · domain:devx · priority:p2 · type Bug.

Lands in: packages/lint/src/page-envelope-audit.ts (collectBare) ⇒ packages/lint is a domain:devx package.

Type Bug: a RangeError on legal authored input. properties.children is z.array(z.unknown()), so an A -> B -> A cycle is a document the schema admits — the rule dies rather than diagnosing. The card carries the stack trace and a reverse-check against terms known present in the sibling file, so the "no guard here" zero is instrument-verified in both directions.

p2, and the split from its p1 sibling is deliberate. #13217 is priority:p1 for the same crash class; this is graded one step down, on blast radius alone:

	#13217	this
what dies	6 lint rules + the CLI i18n object-sections pass	page-envelope-audit alone
real instances in the authored corpus	0	0 (57 page-shaped objects, 34 modules, control live)

⛔ Severity of the crash is identical — only the radius differs. If a cyclic page is ever actually authored, both regrade, and this becomes a live incident rather than a reachable one.

⭐ The card corrects a reading of #13217 that would otherwise have been made, and triage is adopting the correction. #13217 names page-envelope-audit in its blast-radius list. That membership is real, but the cause is not the missing walk guard: Door 1 (collectBare, line 264) runs before walkPageComponents (line 276), so this rule dies first and #13217's guard never executes. ⇒ #13217 is not a partial fix of its own stated scope — it fully fixes the walk, and this is an independent second defect the list happened to cover by name. ⛔ Nobody may close this as "covered by #13217", and ⛔ #13217 must not be reopened over it.

⚠️ Conditional escalation — read before writing the guard

The card is right that collectBare is not the same instrument as the two component walks, so #13217's ancestor-set is a starting point, not a drop-in. Three differences, all real: it walks arbitrary values rather than composition slots; it walks two trees in lockstep (raw and parsed), so which side the ancestor set tracks is a genuine choice; and it produces findings.

That last one carries the escalation. Picking the traversal shape is verification strategy ⇒ the executing seat's call. But if the guard changes what a cyclic page REPORTS — a stopped descent that suppresses or adds a finding is new reject/accept behaviour on authored input — that is a contract question, not a dev judgement.

⇒ Dispatch with the third-tier conditional: implement on the premise that the guard is report-neutral; verify that premise against the rule's actual output; if it is false, ⛔ stop and file a needs-user-decision card rather than choosing a reporting shape in the PR. ⛔ Do not silently fall back to the other option — that is the failure mode the conditional exists to prevent. This mirrors the conditional #13217's own dispatch reserved.

Contention: #13218 is a third walk and is explicitly not covered by that card's unify scope — ⛔ do not fold these together. The domain:devx seat clears serial constraints against #13217 (pm:dispatched, same package) at claim time.

---

Generated by Claude Code