@@ -24,11 +24,16 @@
 # md-table-align no longer pads it to ~800 KB of whitespace.
 
 active:
+  - id: "D-557"
+    status: "open (2026-07-07, found DURING the D-556 verification — a SEPARATE, GC-independent tree_walk bug). The rewritten cw-arcade rush-hour solver (two-list amortized queue: 3-arity self-call chain + loop [front back visited] + (recur (reverse back) () visited) + a let that destructures [state path] (first front) and SHADOWS front with (rest front)) fails on the tree_walk backend with `-nth on Long` at the destructure line — (first front) returns a Long, i.e. a slot/shadow resolution defect. DETERMINISTIC; vm green on the identical code; CLJW_GC_THRESHOLD_MB=100000 (GC off) still fails -> NOT a rooting issue. Direct call fails too (no clojure.test needed). Simple synthetic shadow shapes pass — the trigger needs the real solver's combination (multi-arity self-call + reverse/list queue + same-name shadow + for). REPRO: scratchpad rhmin copy (or cw-arcade apps/rush-hour post-2026-07-07-edit sources), tree_walk build, cljw -cp src run_direct.clj. Fix by minimizing from the real solver; land the distilled case as a diff-oracle case (the F-012 net SHOULD have caught this — its absence is the gap D-555's cadence work addresses)."
+    category: "runtime"
+    barrier: "none — deterministic repro in hand (tree_walk build + the rhmin copy). Minimize -> analyzer slot-allocation fix -> diff case."
+    last_reviewed: "2026-07-07"
   - id: "D-556"
-    status: "RE-NARROWED 2026-07-06 (late session): the panic REPRODUCES — the split observation is explained: the repro binary was a -Dbackend=tree_walk build (the --version fingerprint shows \", tree_walk\"); the vm default never panics. ROOT CLASS confirmed by bisection: CLJW_GC_THRESHOLD_MB=100000 (auto-collect off) -> 3/3 tests pass; default threshold -> deterministic panic; 1MB threshold -> an EARLIER, cleaner corruption (\"+: expected number, got nil\" inside board.clj occupied). So: tree_walk holds evaluation intermediates ONLY on the C stack, and a mid-eval ADR-0164 auto-collect sweeps them — the corrupted-string usize overflow in Writer.drain is the downstream symptom. SEVEN real unrooted sites were found+fixed this session (A6 locals: callMethodImpl + driver.evalForm + evaluator oracle; A6b progressive-publish ArgsFrame: evalCall callee+args, ctor/instance/static interop args, vector/map/set literal accumulators, evalRecur pending buf, evalBinding pass-1 inits) — symbol-meta GC loss is FIXED — but the rush-hour repro STILL panics: at least one more unrooted path remains (the 1MB trace points at a closure/lazy intermediate in a some-fn/for chain). FINISHED-FORM DECISION RECORDED: stop the whack-a-mole — implement a CONSERVATIVE C-STACK SCAN for the tree_walk backend: at collect, walk the native stack words from the ADR-0157 stack_base anchor (already threadlocal!) down to the collector frame, decode each word as a potential NaN-boxed heap Value, validate the pointer against a per-collect hash set of live objects (built in one O(live) pass over the live list), and pin matches. Non-moving mark-sweep makes conservative pinning sound (false positives just delay a free). ~100-150 lines in root_set/mark_sweep + a tree_walk-registered stack-range provider. This makes ALL C-stack intermediates safe structurally and lets the explicit-bracket sites become optimizations rather than correctness requirements. Repro: cw-arcade rush-hour solver-test on a tree_walk build (see the private handover note); ALSO reachable via bash scripts/check_vm_parity.sh."
+    status: "ROOT CAUSE FOUND + FIXED 2026-07-07 (the deftest-BFS integer-overflow panic + the D-555 GC family). The swept-string probe showed the FIRST post-bootstrap collect sweeping foundation strings (\"map\", \"clojure.core\", \"*in*\") on the tree_walk backend: fn-body Node literals live in the heap-lifetime analyzer arena, but the ADR-0169 AnalysisFrame bracket DROPPED its roots at form end — correct only for Nodes that die with their form; a (defn f …) body Node survives via Function.body and its literal pool was unrooted from the first collect on (the vm masks the EXECUTING chunk via the A1 pool root; a not-yet-executed fn had the same latent hole). FIX: root_set.endAnalysisPersist — production seams (driver x2, loader, repl, nrepl, evaluator oracle) persist their bracket roots into gc.persisted_analysis_roots (a GcHeap field, walked after permanent_roots; same lifetime the Nodes already have). ALSO landed in the same arc: the conservative C-stack scan (mark_sweep.conservativeStackScan: stack words from the ADR-0157 anchor + a setjmp register spill (Boehm GC_push_regs idiom), validated against a per-collect live-set hash, pinned — sound under non-moving mark-sweep) as the STRUCTURAL backstop for tree_walk's C-stack intermediates, and the 7 explicit A6/A6b brackets. VERIFIED: the original repro (rush-hour solver-test, pre-edit sources preserved in the scratchpad rhmin copy) passes 3/3 at BOTH default and 1MB thresholds on tree_walk; sym-meta GC e2e green; vm untouched. REMAINING out of scope: registered-WORKER-thread stacks are not conservatively scanned (parked at alloc-prologue; agent+tree_walk is the known D-418-adjacent area)."
     category: "runtime"
-    barrier: "none — live deterministic repro (tree_walk build + cw-arcade rush-hour solver-test; vm default unaffected). NEXT UNIT = the conservative C-stack scan (the finished form; design in status). The 7 explicit-bracket fixes landed 2026-07-06 remain correct and useful regardless."
-    last_reviewed: "2026-07-06"
+    barrier: "FIXED for the reported class — keep open until the D-555 re-sweep (check_vm_parity.sh) confirms which of the 6 findings cleared, then discharge with the sweep numbers."
+    last_reviewed: "2026-07-07"
   - id: "D-555"
     status: "RE-NARROWED 2026-07-06 (same day): finding (1) watch_recursion SEGFAULT is FIXED — the ADR-0157 native-stack guard (threadlocal stack_base anchor + 6MiB budget) existed ONLY in vm.zig; the tree_walk arm is now ported (per-node check in eval; a threadlocal read + two compares). SIGSEGV -> catchable stack_overflow, all watch/validator/reducer reentry cases green on BOTH backends. The e2e 500-deep legit-recursion cases were vm-shaped: tree_walk pays ~30KB native per HOF step / ~13KB per direct step (ReleaseSafe), so 500 PHYSICALLY exceeds the 6MiB budget (pre-guard: raw SIGSEGV) — cases (6)/(7) are now backend-aware (100/300 deep on tree_walk; --version gained a \", tree_walk\" marker for detection, vm banner unchanged). FORWARD: raising tree_walk depth to clj-like levels needs build.zig stack_size + an ADR-0157 budget amendment (depth-2) — take up if the oracle depth becomes limiting. REMAINING (4 findings): (2) phase16_gc_torture dies; (3) phase14_symbol_metadata sym_meta_gc_survives nil-want-1 (GC rooting gap, tree_walk-only); (4) phase14_seq_helpers2 interleave_large got-empty (possibly the SAME budget physics on a deep lazy realize — triage vs a rooting bug); (5) phase15_dynamic_var guard + (6) phase15_require_fs missing, both got-2-want-1 (exit-code shaped). ORIGINAL: six e2e fail on -Dbackend=tree_walk (D-553 first sweep), corpus green, F-012 oracle green."
     category: "runtime"
 
@@ -309,7 +309,7 @@ fn replyEval(
         // every exit of this loop iteration.
         var af: root_set.AnalysisFrame = undefined;
         root_set.beginAnalysis(&af, rt.gc.infra);
-        defer root_set.endAnalysis(&af);
+        defer root_set.endAnalysisPersist(&af, &rt.gc);
         const node = analyzeForm(arena, rt, env, null, form, macro_table) catch |err| {
             try replyError(arena, w, @errorName(err), session_id, id_val);
             continue;
 
@@ -223,7 +223,7 @@ fn evalOneLine(
         // D-430: per-form analysis bracket (roots literals through eval).
         var af: root_set.AnalysisFrame = undefined;
         root_set.beginAnalysis(&af, rt.gc.infra);
-        defer root_set.endAnalysis(&af);
+        defer root_set.endAnalysisPersist(&af, &rt.gc);
         const node = try analyzeForm(arena, rt, env, null, form, macro_table);
         var locals: [driver.MAX_LOCALS]Value = [_]Value{.nil_val} ** driver.MAX_LOCALS;
         const result = try driver.evalForm(rt, env, &locals, arena, node);
 
@@ -65,7 +65,7 @@ pub fn runEnvelope(rt: *Runtime, env: *Env, arena: std.mem.Allocator, payload: [
         // constants, not the whole envelope's).
         var af: root_set.AnalysisFrame = undefined;
         root_set.beginAnalysis(&af, rt.gc.infra);
-        defer root_set.endAnalysis(&af);
+        defer root_set.endAnalysisPersist(&af, &rt.gc);
         var chunk = try serialize.deserializeChunk(arena, rt, env, chunk_bytes);
         _ = try vm.eval(rt, env, &locals, &chunk);
     }
@@ -154,7 +154,7 @@ pub fn evalTopLevelForm(
     // covers tree_walk Node constants, which have no EvalFrame pool).
     var af: root_set.AnalysisFrame = undefined;
     root_set.beginAnalysis(&af, rt.gc.infra);
-    defer root_set.endAnalysis(&af);
+    defer root_set.endAnalysisPersist(&af, &rt.gc);
     const node = try analyzer.analyze(arena, rt, env, null, form, table);
     return evalForm(rt, env, locals, arena, node);
 }
 
@@ -103,7 +103,7 @@ fn evalTopLevelInBackend(
     // twin of driver.evalTopLevelForm's bracket.
     var af: root_set.AnalysisFrame = undefined;
     root_set.beginAnalysis(&af, rt.gc.infra);
-    defer root_set.endAnalysis(&af);
+    defer root_set.endAnalysisPersist(&af, &rt.gc);
     const node = try analyzer.analyze(arena, rt, env, null, form, table);
     var locals: [256]Value = [_]Value{.nil_val} ** 256;
     return switch (backend) {
 
@@ -96,7 +96,7 @@ fn loadTopLevelForm(
     // driver.evalTopLevelForm's (kept open through eval + the sink recompile).
     var af: root_set.AnalysisFrame = undefined;
     root_set.beginAnalysis(&af, rt.gc.infra);
-    defer root_set.endAnalysis(&af);
+    defer root_set.endAnalysisPersist(&af, &rt.gc);
     const node = try analyzeForm(arena, rt, env, null, form, macro_table);
     var locals: [driver.MAX_LOCALS]Value = [_]Value{.nil_val} ** driver.MAX_LOCALS;
     _ = try driver.evalForm(rt, env, &locals, arena, node);
 
@@ -170,6 +170,13 @@ pub const GcHeap = struct {
     /// first match. The root walker yields each entry's
     /// `Value.heapHeader()` (skipping immediates).
     permanent_roots: std.ArrayList(Value) = .empty,
+    /// D-556: analysis-produced Values persisted past their bracket — the
+    /// literal pool of every analyzed form whose Nodes outlive the form (fn
+    /// bodies held by `Function.body` in the heap-lifetime analyzer arena).
+    /// Appended by `root_set.endAnalysisPersist`; walked right after
+    /// `permanent_roots`. Grows with the arena — the same lifetime the
+    /// Nodes themselves already have.
+    persisted_analysis_roots: std.ArrayList(Value) = .empty,
     /// Process-lifetime mark-waypoints (D-251): headers of `trackHeap`'d
     /// objects (`Function` / `ProtocolDescriptor` / `TypeDescriptorRef`) that
     /// are NOT in `allocations` and so are never swept. The mark bit doubles as
@@ -270,6 +277,7 @@ pub const GcHeap = struct {
         }
         self.allocations.deinit(self.infra);
         self.permanent_roots.deinit(self.infra);
+        self.persisted_analysis_roots.deinit(self.infra);
         self.persistent_marks.deinit(self.infra);
         self.free_pools.deinit(self.infra);
         self.mark_worklist.deinit(self.infra);
 
@@ -211,6 +211,13 @@ pub fn collect(gc: *GcHeap, ctx: root_set_mod.WalkContext) void {
     // ...and every registered WORKER thread's transaction (parked at a safepoint
     // during STW, so its tx is quiescent). Empty registry in single-thread → no-op.
     root_set_mod.markRegisteredTxs(@ptrCast(gc), &markWorkerTx);
+    // D-556: conservative native-stack scan (tree_walk backend only — the vm's
+    // operand stack is the A1 root). Pins every stack word that decodes to a
+    // live heap Value, covering evaluation intermediates the explicit brackets
+    // miss. Runs on the COLLECTING thread's stack (workers are parked at their
+    // alloc-prologue, where their intermediates are bracket-covered or a known
+    // D-556 residual).
+    conservativeStackScan(gc);
     // All roots are shaded gray; blacken transitively (ADR-0028 amendment 3).
     drainGray(gc);
     sweep(gc);
@@ -225,6 +232,57 @@ pub fn collect(gc: *GcHeap, ctx: root_set_mod.WalkContext) void {
     gc.stats.collect_count += 1;
 }
 
+/// D-556: conservatively scan the collecting thread's native stack for live
+/// heap Values (tree_walk backend). Range: from the collector's own frame
+/// (deep) up to `root_set.conservative_stack_top` (the shallowest tree_walk
+/// eval entry; 0 = tree_walk never ran on this thread → skip). Each 8-byte
+/// word is decoded via the `Value.heapHeader()` membrane (tag check only, no
+/// deref) and pinned IFF the pointer matches a live allocation record — a
+/// stale/garbage word that happens to look like a heap tag can only pin a
+/// still-live object (false positive = one delayed free), never deref a
+/// dangling pointer. The live-pointer set is built in one pass over the
+/// `allocations` side-table using `gc.infra` (never `gc.alloc` — collect must
+/// not re-enter the heap).
+/// libc setjmp — used ONLY as a register spill (Boehm GC's `GC_push_regs`
+/// idiom): it writes every callee-saved register into the buffer, so a heap
+/// Value living ONLY in a callee-saved register (never spilled on the paths
+/// the collector happened to take) becomes scannable. We never longjmp.
+extern fn setjmp(env: *anyopaque) c_int;
+
+/// Decode one candidate word and pin it if it is a live heap Value.
+inline fn pinIfLiveWord(gc: *GcHeap, live: *const std.AutoHashMapUnmanaged(usize, void), word: u64) void {
+    const Value = @import("../value/value.zig").Value;
+    const nb = @import("../value/nan_box.zig");
+    // Pre-filter a zero address: `heapHeader`'s decodePtr would cast it to a
+    // null pointer (a ReleaseSafe panic) — a heap-TAGGED word with address
+    // bits 0 is garbage, never a real Value.
+    if (word & nb.NB_ADDR_SHIFTED_MASK == 0) return;
+    const v: Value = @enumFromInt(word);
+    const hdr = v.heapHeader() orelse return;
+    if (live.contains(@intFromPtr(hdr))) mark(gc, hdr);
+}
+
+fn conservativeStackScan(gc: *GcHeap) void {
+    const top = root_set_mod.conservative_stack_top;
+    if (top == 0) return;
+    const bottom = @frameAddress();
+    if (bottom >= top) return;
+    var live: std.AutoHashMapUnmanaged(usize, void) = .empty;
+    defer live.deinit(gc.infra);
+    live.ensureTotalCapacity(gc.infra, @intCast(gc.allocations.items.len)) catch return;
+    for (gc.allocations.items) |rec| live.putAssumeCapacity(@intFromPtr(rec.header), {});
+    // Registers first (see `setjmp` above): 128 u64s comfortably hold any
+    // ABI's jmp_buf; unwritten tail words stay zero and are filtered.
+    var jb: [128]u64 align(16) = [_]u64{0} ** 128;
+    _ = setjmp(@ptrCast(&jb));
+    for (jb) |word| pinIfLiveWord(gc, &live, word);
+    // Then the native stack from the collector's frame up to the anchor.
+    var addr = std.mem.alignForward(usize, bottom, @alignOf(u64));
+    while (addr + @sizeOf(u64) <= top) : (addr += @sizeOf(u64)) {
+        pinIfLiveWord(gc, &live, @as(*const u64, @ptrFromInt(addr)).*);
+    }
+}
+
 /// Stop-the-world collect (ADR-0090 Alt B / D-244 #4): pause every other
 /// registered worker at a safe point (its `alloc`-prologue park or the VM
 /// back-edge poll), run a full `collect` over the union root set (every parked
 
@@ -124,6 +124,19 @@ pub const EvalFrame = struct {
 /// a `ThreadGcContext.eval_frame_slot` pointer (union walk).
 pub threadlocal var eval_frame_head: ?*EvalFrame = null;
 
+/// D-556: conservative C-stack scan anchor for the tree_walk backend. The
+/// tree-walk evaluator holds evaluation intermediates in NATIVE stack slots
+/// (locals arrays, argument buffers, accumulator temporaries) — the explicit
+/// EvalFrame brackets cover the known hot sites, but per-site bracketing is
+/// not exhaustively provable, so the collector ALSO conservatively scans the
+/// native stack from this anchor (the shallowest tree_walk `eval` entry —
+/// the same value as its ADR-0157 budget anchor) down to the collector's own
+/// frame, pinning any word that decodes to a live heap Value. Sound under
+/// the non-moving mark-sweep (a false positive only delays one free). Zero
+/// (the default) = no tree_walk eval on this thread → scan skipped; the vm
+/// backend never sets it (its operand stack is the A1 root).
+pub threadlocal var conservative_stack_top: usize = 0;
+
 /// Analysis-roots frame (D-430 root cause; EvalFrame's analysis-side
 /// sibling): GC Values produced BEFORE any frame executes — literal strings /
 /// quoted data (`analyzer.makeConstant` / `analyzeQuote`), compiler-alloc'd
@@ -176,6 +189,26 @@ pub fn endAnalysis(frame: *AnalysisFrame) void {
     frame.roots.deinit(frame.alloc);
 }
 
+/// D-556: close an analysis bracket by PERSISTING its roots into the heap's
+/// `persisted_analysis_roots` (walked right after `permanent_roots`) instead
+/// of dropping them. The analyzer arena — and every `*Node` it holds,
+/// including fn bodies that survive the defining form via `Function.body` —
+/// lives as long as the heap, so the GC Values embedded in those Nodes
+/// (`.constant` literals, name strings, quoted collections) must stay rooted
+/// for the same lifetime. `endAnalysis`'s drop-on-close is correct only for
+/// Nodes that die with their form (test fixtures); a `(defn f …)` body Node
+/// survives, and its literals were swept at the first post-definition
+/// collect — the tree_walk bootstrap-string corruption class (the vm masks
+/// the EXECUTING chunk via the A1 pool root, but a not-yet-executed fn's
+/// pool had the same hole). An append failure leaks the frame's list in
+/// place — still reachable beats swept.
+pub fn endAnalysisPersist(frame: *AnalysisFrame, gc: *GcHeap) void {
+    std.debug.assert(analysis_frame_head == frame);
+    analysis_frame_head = frame.parent;
+    gc.persisted_analysis_roots.appendSlice(gc.infra, frame.roots.items) catch return;
+    frame.roots.deinit(frame.alloc);
+}
+
 /// Root a Value produced during analysis/compile/deserialize until the
 /// owning bracket closes. Immediates / infra-lifetime values (var_ref, ns)
 /// are filtered here so the registry holds only real heap objects.
@@ -488,6 +521,9 @@ pub const RootIterator = struct {
 
     pub const PermanentRootsCursor = struct {
         idx: usize = 0,
+        /// D-556: cursor into `persisted_analysis_roots` (walked after the
+        /// gc's own permanent_roots).
+        persisted_idx: usize = 0,
     };
 
     pub fn next(self: *RootIterator) ?*HeapHeader {
@@ -698,6 +734,13 @@ pub const RootIterator = struct {
             c.idx += 1;
             if (v.heapHeader()) |hdr| return hdr;
         }
+        // D-556: then the persisted analysis roots (fn-body literals whose
+        // Nodes live in the heap-lifetime analyzer arena).
+        while (c.persisted_idx < self.ctx.gc.persisted_analysis_roots.items.len) {
+            const v = self.ctx.gc.persisted_analysis_roots.items[c.persisted_idx];
+            c.persisted_idx += 1;
+            if (v.heapHeader()) |hdr| return hdr;
+        }
         return null;
     }
 };