@@ -222,6 +222,14 @@ jobs:
           rustc -O tests/helpers/stage1_stub.rs -o "$RUNNER_TEMP/stage1-stub$ext"
       - name: Build the owen launcher
         run: dotnet build frontend/roslyn/OwnSharp.Cli/OwnSharp.Cli.csproj -c Release --nologo
+      # Own.NET#401 on Windows: the wpf-extractor job runs this regression on Linux only, and
+      # the stack guard it pins (RuntimeHelpers.TryEnsureSufficientExecutionStack) depends on the
+      # platform's thread stack, so the n = 1000 case is checked on a Windows runner as well.
+      - name: Deep if / else-if chain does not take the run down, Windows (Own.NET#401)
+        if: runner.os == 'Windows'
+        env:
+          OWN_TIERB_REQUIRED: "1"
+        run: python tests/test_extractor_deep_flow.py
       # The vendored Python core is a PACK-time payload, so a plain build does
       # not place it where the launcher looks. Staging it here is harness setup
       # for the Python-engine paths, not a production behaviour.
@@ -802,6 +810,14 @@ jobs:
         env:
           OWN_TIERB_REQUIRED: "1"
         run: python tests/test_extractor_columns.py
+      - name: Deep if / else-if chain does not take the run down (Own.NET#401)
+        # One method with a tracked local and 31 conditions used to abort the whole extraction
+        # (System.Text.Json MaxDepth 64). Bodies within spec/OwnIR.md section 4.2 (<= 32) stay analysed;
+        # deeper ones are skipped and counted, and the core accepts every emitted document.
+        # REQUIRED here; skips cleanly in the offline Tier-A job.
+        env:
+          OWN_TIERB_REQUIRED: "1"
+        run: python tests/test_extractor_deep_flow.py
       - name: Guarded release is not a call-site handoff (INF-S2, #380)
         # A callee that releases its parameter only under a guard is a PARTIAL release, so
         # its call must not be lowered as the caller's `release` (the fabricated `must`),
 
@@ -3568,6 +3568,35 @@ cc.Filter is null
 // `tracked` local IDisposables. Returns null on any UNMODELLED statement (a `goto`, labeled
 // statement, local function, `lock`/`fixed`, …): the method is then honestly skipped, not
 // guessed. Loops, `try`, `do` and `switch` ARE modelled below.
+// spec/OwnIR.md §4.2: flow bodies nest at most 32 levels (`then` / `else` / `body`; the
+// top-level list is level 0). Both doors reject a document that nests deeper.
+const int OwnIrMaxNestingDepth = 32;
+
+// #401: each nested body costs two JSON levels (an object and an array), so a document at the
+// §4.2 limit is about 2 * 32 + 4 levels deep. The default MaxDepth (64) threw on 31 nested
+// `else if`; 128 is the cap §4.2 itself is measured against.
+const int FactsJsonMaxDepth = 128;
+
+// The deepest `then` / `else` / `body` nesting of a lowered flow body, counted as §4.2 counts it
+// (an existing list is a level, even an empty one). Flow ops are anonymous objects or
+// dictionaries, so the three keys are read by name.
+static int FlowNestingDepth(IReadOnlyList<object> nodes, int level = 0)
+{
+    var deepest = level;
+    foreach (var node in nodes)
+    {
+        foreach (var key in new[] { "then", "else", "body" })
+        {
+            object? child = node is IDictionary<string, object?> d
+                ? (d.TryGetValue(key, out var v) ? v : null)
+                : node?.GetType().GetProperty(key)?.GetValue(node);
+            if (child is IReadOnlyList<object> list)
+                deepest = Math.Max(deepest, FlowNestingDepth(list, level + 1));
+        }
+    }
+    return deepest;
+}
+
 static List<object>? LowerFlowBody(BlockSyntax block, HashSet<string> tracked, SemanticModel model)
 {
     var nodes = new List<object>();
@@ -3650,6 +3679,12 @@ static bool LowerFlowStmt(StatementSyntax st, HashSet<string> tracked, SemanticM
                           bool canEscape = true, List<object>? onThrow = null,
                           List<object>? onReturn = null, bool onThrowDefinite = false)
 {
+    // #401: the lowering recurses once per nested statement, so a few hundred `else if`
+    // overflowed the stack - an uncatchable crash that lost the whole run. Running short of
+    // stack means the body is far deeper than spec/OwnIR.md section 4.2 admits (32), which is
+    // skipped anyway: bail the method as unmodelled instead.
+    if (!System.Runtime.CompilerServices.RuntimeHelpers.TryEnsureSufficientExecutionStack())
+        return false;
     switch (st)
     {
         case BlockSyntax b:
@@ -7197,6 +7232,14 @@ or ImplicitObjectCreationExpressionSyntax } init
                     statMethodsSkipped++;   // unmodelled construct -> honestly skipped
                     continue;
                 }
+                // #401: a body nesting deeper than spec/OwnIR.md §4.2 admits would make BOTH
+                // doors reject the whole document, so it is skipped like any other unmodelled
+                // shape: this method loses its flow facts, the rest of the run keeps theirs.
+                if (FlowNestingDepth(fbody) > OwnIrMaxNestingDepth)
+                {
+                    statMethodsSkipped++;
+                    continue;
+                }
                 statMethodsAnalysed++;
                 // Stage 2 (spec §5.1): stamp the record's per-overload `sig` when the
                 // symbol resolves, so an overloaded method gets its own summary beside
@@ -7337,7 +7380,7 @@ or ImplicitObjectCreationExpressionSyntax } init
         Console.Error.WriteLine($"extractor: guarded_facts self-check failed: {violation}");
     return 2;
 }
-var json = JsonSerializer.Serialize(facts, new JsonSerializerOptions { WriteIndented = true });
+var json = JsonSerializer.Serialize(facts, new JsonSerializerOptions { WriteIndented = true, MaxDepth = FactsJsonMaxDepth });
 
 if (reportStats)
     Console.Error.WriteLine(
@@ -7352,7 +7395,7 @@ or ImplicitObjectCreationExpressionSyntax } init
 if (heapEffectsPath is not null)
     File.WriteAllText(heapEffectsPath, JsonSerializer.Serialize(
         HeapEffectFacts.Extract(compilation, parsed),
-        new JsonSerializerOptions { WriteIndented = true }));
+        new JsonSerializerOptions { WriteIndented = true, MaxDepth = FactsJsonMaxDepth }));
 return 0;
 
 // Opt-in recall knob for the flow pass, read deep in InjectThrowEdge (a static field rather than
 
@@ -0,0 +1,175 @@
+#!/usr/bin/env python3
+"""Own.NET#401 - a deep `if / else if` chain must not take the whole run down.
+
+THE DEFECT
+
+The flow pass lowers every `if` to `{op:"if", then:[...], else:[...]}`, so each `else if`
+nests two JSON levels (an object and an array). The facts document was serialised with
+System.Text.Json's default MaxDepth of 64, so ONE method with a tracked disposable local and
+31 conditions threw `JsonException` at the final serialise: no facts, no SARIF, every other
+method in the repository unanalysed (couchbase-net-client, dnSpy).
+
+WHAT THIS TEST PINS (each a separate PASS/KILL criterion of the fix)
+
+  P1  n <= 32 conditions (flow nesting <= 32, the spec/OwnIR.md §4.2 limit): the extractor
+      exits 0, the method IS flow-analysed, its body nests exactly n levels, and the core
+      accepts the document. A fix that dodges the crash by skipping these methods fails here
+      (it would lose coverage the spec allows).
+  P2  n >= 33 (deeper than the spec admits): the extractor exits 0, the method is honestly
+      skipped and counted in `methods_skipped_unmodelled`, and the core still accepts the
+      document - so the crash is not merely moved from the extractor to the core.
+  P3  In every case a sibling method with a real undisposed local is still reported, i.e.
+      one deep method never costs the rest of the file its analysis.
+  P4  n = 1000: the lowering recursion itself used to overflow the stack (an uncatchable
+      crash, the whole run lost) somewhere between 300 and 600 conditions; it must bail the
+      method as unmodelled instead (P2 and P3 apply).
+
+The boundary n = 32 / 33 is the spec's, not a tuning knob: `then`/`else` bodies are levels,
+the top-level body is level 0, so the k-th condition's `then` sits at level k+1 and a chain
+of n conditions nests exactly n.
+
+REQUIRED VS SKIPPED: as tests/test_extractor_columns.py - required when OWN_TIERB_REQUIRED=1
+(the wpf-extractor CI job), a clean, explained skip when dotnet is absent.
+
+Run:  OWN_TIERB_REQUIRED=1 python3 tests/test_extractor_deep_flow.py
+"""
+
+from __future__ import annotations
+
+import json
+import os
+import shutil
+import subprocess
+import sys
+import tempfile
+
+_REPO = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
+_EXT = os.path.join(_REPO, "frontend", "roslyn", "OwnSharp.Extractor")
+_LIMIT = 32  # spec/OwnIR.md §4.2: a body nesting exactly 32 is accepted, 33 rejected
+_CASES = (31, 32, 33, 200, 1000)
+
+
+def _source(n: int) -> str:
+    lines = [
+        "using System.IO;",
+        "",
+        "namespace Repro;",
+        "",
+        "public static class Chain",
+        "{",
+        "    public static int Classify(int x)",
+        "    {",
+        "        var ms = new MemoryStream();",
+        "        int r;",
+    ]
+    for i in range(n):
+        kw = "if" if i == 0 else "else if"
+        lines.append(f"        {kw} (x == {i}) {{ r = {i}; }}")
+    lines += [
+        "        else { r = -1; }",
+        "        ms.Dispose();",
+        "        return r;",
+        "    }",
+        "",
+        "    public static void Leaky()",
+        "    {",
+        "        var leaked = new MemoryStream();",
+        "        leaked.WriteByte(1);",
+        "    }",
+        "}",
+        "",
+    ]
+    return "\n".join(lines)
+
+
+def _depth(nodes: object, level: int = 0) -> int:
+    """Deepest body level, counted like spec §4.2 / ownir._check_flow_coordinates."""
+    if not isinstance(nodes, list):
+        return -1
+    deepest = level
+    for n in nodes:
+        if isinstance(n, dict):
+            for key in ("then", "else", "body"):
+                deepest = max(deepest, _depth(n.get(key), level + 1))
+    return deepest
+
+
+def _run_case(n: int, work: str, fails: list[str]) -> None:
+    src = os.path.join(work, f"n{n}")
+    os.makedirs(src)
+    with open(os.path.join(src, "Chain.cs"), "w", encoding="utf-8", newline="\n") as f:
+        f.write(_source(n))
+    facts_path = os.path.join(work, f"n{n}.facts.json")
+    ext = subprocess.run(
+        ["dotnet", "run", "--project", _EXT, "--",
+         src, "-o", facts_path, "--flow-locals", "--stats"],
+        cwd=_REPO, capture_output=True, text=True, encoding="utf-8", errors="replace")
+    tag = f"n={n}"
+    if ext.returncode != 0 or not os.path.exists(facts_path):
+        tail = (ext.stderr or ext.stdout).strip().splitlines()[-3:]
+        joined = " | ".join(tail)
+        fails.append(f"{tag}: extractor rc={ext.returncode}, no facts ({joined})")
+        return
+    with open(facts_path, encoding="utf-8") as f:
+        facts = json.load(f)
+    fns = {fn.get("name"): fn for fn in facts.get("functions", [])}
+    chain = fns.get("Repro.Chain.Classify")
+    skipped = (facts.get("stats") or {}).get("methods_skipped_unmodelled")
+    if n <= _LIMIT:
+        if chain is None:
+            fails.append(f"{tag}: P1 Classify was not flow-analysed "
+                         "(coverage the spec allows was lost)")
+        elif _depth(chain.get("body")) != n:
+            got = _depth(chain.get("body"))
+            fails.append(f"{tag}: P1 Classify nests {got} levels, expected {n}")
+    else:
+        if chain is not None:
+            got = _depth(chain.get("body"))
+            fails.append(f"{tag}: P2 Classify nests {got} > {_LIMIT} but was emitted")
+        if not isinstance(skipped, int) or skipped < 1:
+            fails.append(f"{tag}: P2 the skip is not counted "
+                         f"(methods_skipped_unmodelled={skipped!r})")
+    env = dict(os.environ, PYTHONPATH=_REPO)
+    core = subprocess.run(
+        [sys.executable, "-m", "ownlang", "ownir", facts_path,
+         "--format", "sarif", "--severity", "warning"],
+        cwd=_REPO, capture_output=True, text=True, encoding="utf-8", errors="replace", env=env)
+    try:
+        results = json.loads(core.stdout)["runs"][0]["results"]
+    except (ValueError, KeyError, IndexError):
+        fails.append(f"{tag}: core rejected the document (rc={core.returncode}): "
+                     f"{(core.stderr or core.stdout).strip()[-200:]}")
+        return
+    if not any("leaked" in r.get("message", {}).get("text", "") for r in results):
+        fails.append(f"{tag}: P3 the sibling leak in Leaky() is not reported")
+
+
+def run() -> int:
+    # Failure text can carry U+FFFD from a crashed extractor; never let printing it fail the run.
+    if hasattr(sys.stdout, "reconfigure"):
+        sys.stdout.reconfigure(errors="backslashreplace")
+    if not shutil.which("dotnet"):
+        if os.environ.get("OWN_TIERB_REQUIRED") == "1":
+            print("extractor deep flow: FAIL - dotnet is REQUIRED here "
+                  "(OWN_TIERB_REQUIRED=1) and is not on PATH")
+            return 1
+        print("extractor deep flow: SKIP - dotnet not on PATH")
+        return 0
+    fails: list[str] = []
+    work = tempfile.mkdtemp(prefix="own401-")
+    try:
+        for n in _CASES:
+            _run_case(n, work, fails)
+    finally:
+        shutil.rmtree(work, ignore_errors=True)
+    if fails:
+        print("extractor deep flow: FAIL")
+        for f in fails:
+            print("  -", f)
+        return 1
+    print(f"extractor deep flow: OK ({len(_CASES)} chain lengths, limit {_LIMIT})")
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(run())