@@ -24,11 +24,6 @@
 # md-table-align no longer pads it to ~800 KB of whitespace.
 
 active:
-  - id: "D-557"
-    status: "NARROWED 2026-07-07 (same session): the SHADOW is innocent (renaming front->front2 still fails); reverse is innocent (dropping it still fails); wrapping the for in `vec` FIXES it -> the defect is in the LAZY `for` seq being held across recur iterations and consumed TWICE ((into back nexts) then (map first nexts)) on the tree_walk backend — (first front) later yields a Long, i.e. a lazy-seq cell or chunk is corrupted/mis-linked. Synthetic twins (int states, plain + map-destructure for-bindings, two-list queue, 3000 iters) do NOT reproduce — the real repro needs the cw-arcade board/puzzles shape (map-of-maps states as HAMT-set keys + legal-moves itself built from a for). GC-independent (fails with collect disabled); vm green. REPRO: scratchpad rhmin (solver.clj = the 2026-07-07 two-list version), tree_walk build, cljw -cp src run_direct.clj -> `-nth on Long` at solver.clj:48. Variants preserved: solver_v3 (shadow renamed, fails), v5 (no reverse, fails), v7 (vec-wrapped for, PASSES). NEXT: diff the tree_walk lazy-seq/chunk realization path for a double-walk-across-recur defect; distill with the real board shape; land as a diff-oracle case. ORIGINAL: found during D-556 verification."
-    category: "runtime"
-    barrier: "none — deterministic repro preserved at private/d557_repro (gitignored): tree_walk build + `cljw -cp src run_direct.clj` fails; run_v7.clj (vec-wrapped for) passes. Minimize with the real board shape -> fix the tree_walk lazy-for double-consumption defect -> diff-oracle case."
-    last_reviewed: "2026-07-07"
   - id: "D-556"
     status: "ROOT CAUSE FOUND + FIXED 2026-07-07 (the deftest-BFS integer-overflow panic + the D-555 GC family). The swept-string probe showed the FIRST post-bootstrap collect sweeping foundation strings (\"map\", \"clojure.core\", \"*in*\") on the tree_walk backend: fn-body Node literals live in the heap-lifetime analyzer arena, but the ADR-0169 AnalysisFrame bracket DROPPED its roots at form end — correct only for Nodes that die with their form; a (defn f …) body Node survives via Function.body and its literal pool was unrooted from the first collect on (the vm masks the EXECUTING chunk via the A1 pool root; a not-yet-executed fn had the same latent hole). FIX: root_set.endAnalysisPersist — production seams (driver x2, loader, repl, nrepl, evaluator oracle) persist their bracket roots into gc.persisted_analysis_roots (a GcHeap field, walked after permanent_roots; same lifetime the Nodes already have). ALSO landed in the same arc: the conservative C-stack scan (mark_sweep.conservativeStackScan: stack words from the ADR-0157 anchor + a setjmp register spill (Boehm GC_push_regs idiom), validated against a per-collect live-set hash, pinned — sound under non-moving mark-sweep) as the STRUCTURAL backstop for tree_walk's C-stack intermediates, and the 7 explicit A6/A6b brackets. VERIFIED: the original repro (rush-hour solver-test, pre-edit sources preserved in the scratchpad rhmin copy) passes 3/3 at BOTH default and 1MB thresholds on tree_walk; sym-meta GC e2e green; vm untouched. REMAINING out of scope: registered-WORKER-thread stacks are not conservatively scanned (parked at alloc-prologue; agent+tree_walk is the known D-418-adjacent area)."
     category: "runtime"
@@ -6525,6 +6520,12 @@ discharged:
     category: "tooling"
     barrier: "DISCHARGED (was: repurpose the idle probe)."
     last_reviewed: "2026-07-06"
+  - id: "D-557"
+    status: "DISCHARGED 2026-07-07 (same session as filed). ROOT CAUSE: evalRecur evaluated its args DIRECTLY into the threadlocal pending_recur_buf — but an arg's eval can force a lazy seq whose `for`-lowered iterator loop RECURS (the :when-miss arm emits `(recur (rest gxs))`), and that INNER recur clobbers the same threadlocal, corrupting the outer recur's already-evaluated args (the two-list-BFS `-nth on Long`: a stray :delta Long landed in the queue slot). Fired only when a :when miss occurred during recur-arg evaluation — why the visited-heavy real solver hit it while synthetic twins passed; the vm is immune (recur args ride the operand stack). FIX: evaluate into a LOCAL buffer (ArgsFrame-rooted per D-556) and memcpy into the threadlocal only in the no-eval window right before RecurSignaled — the scratch is now touched only between signal and the matching loop frame's drain, where no nested recur can fire. VERIFIED: the cw-arcade two-list solver (direct + v3 shadow-renamed + v5 no-reverse variants + the full 3-test suite) all green on tree_walk; corpus lazy_eval +2 clj-byte-matched goldens (a distilled recur-arg-forces-:when-miss-for shape) — re-verified on the vm by every gate's corpus_regression AND on tree_walk by the check_vm_parity sweep (the double net). Diagnosis chain preserved in private/d557_repro + private/notes/D556-gc-persist-roots.md."
+    category: "runtime"
+    barrier: "DISCHARGED (was: pending_recur_buf reentrancy)."
+    last_reviewed: "2026-07-07"
+
 conventions: |-
   - Structure: two top-level lists — `active:` and `discharged:`. Active entries carry id / status / category / barrier (+ optional quality_floor / last_reviewed); discharged entries carry id / discharged_at / resolution. Edit as YAML (no Markdown table to align).
   - New debt: grep `.dev/debt.yaml` for class-overlap before adding (per `.claude/rules/debt_dedup.md`).
 
@@ -440,15 +440,15 @@ pub fn allocFunctionFromSerialized(
 
 // --- Top-level eval ---
 
-/// ADR-0157 2a (tree_walk arm): per-thread native-stack guard state, the
-/// sibling of vm.zig's. The tree-walk evaluator recurses NATIVE frames per
-/// Node, so a deep user recursion (or a self-triggering watch's
-/// notify→swap!→notify chain) overflows the native stack → SIGSEGV where
-/// the VM raises the catchable stack_overflow. Anchor to the shallowest
-/// `eval` entry seen on this thread and raise once the REAL bytes consumed
-/// exceed the same 6 MiB budget. Per-node cost is a threadlocal read + two
-/// compares — negligible even for the oracle backend.
-threadlocal var stack_base: usize = 0;
+/// ADR-0157 2a (tree_walk arm): per-thread native-stack guard, the sibling of
+/// vm.zig's. The tree-walk evaluator recurses NATIVE frames per Node, so a
+/// deep user recursion (or a self-triggering watch's notify→swap!→notify
+/// chain) overflows the native stack → SIGSEGV where the VM raises the
+/// catchable stack_overflow. Anchor to the shallowest `eval` entry seen on
+/// this thread and raise once the REAL bytes consumed exceed the same 6 MiB
+/// budget. The anchor LIVES in root_set (`conservative_stack_top`) — it
+/// doubles as the D-556 conservative-scan upper bound, one anchor for both
+/// concerns. Per-node cost is a threadlocal read + two compares.
 const STACK_BUDGET_BYTES: usize = 6 * 1024 * 1024;
 
 /// Evaluate one Node into a Value. `locals` is the slot array owned
@@ -461,9 +461,9 @@ pub fn eval(
 ) anyerror!Value {
     {
         const sp = @frameAddress();
-        if (stack_base == 0 or sp > stack_base) {
-            stack_base = sp; // (re-)anchor to the shallowest (highest) entry seen
-        } else if (stack_base - sp > STACK_BUDGET_BYTES) {
+        if (root_set.conservative_stack_top == 0 or sp > root_set.conservative_stack_top) {
+            root_set.conservative_stack_top = sp; // (re-)anchor to the shallowest (highest) entry seen
+        } else if (root_set.conservative_stack_top - sp > STACK_BUDGET_BYTES) {
             return error_catalog.raise(.stack_overflow, .{}, .{ .max = STACK_BUDGET_BYTES });
         }
     }
@@ -1030,21 +1030,28 @@ fn evalRecur(rt: *Runtime, env: *Env, locals: []Value, n: node_mod.RecurNode) an
         return error_catalog.raise(.recur_args_exceed_buffer, n.loc, .{ .got = n.args.len, .max = pending_recur_buf.len });
     // Evaluate **all** args before mutating any slot — otherwise a
     // recur arg that referenced an earlier binding would see the
-    // partially-rewritten frame. Stash them in the threadlocal scratch
-    // so the matching loop frame can drain them once the unwind
-    // returns control.
+    // partially-rewritten frame.
+    //
+    // D-557 REENTRANCY: evaluate into a LOCAL buffer, not the threadlocal
+    // scratch — an arg's eval can force a lazy seq whose iterator loop
+    // recurs (the `for` lowering's `:when`-miss arm), and that INNER recur
+    // writes the same threadlocal, clobbering the outer recur's
+    // already-evaluated args (the two-list-BFS `-nth on Long` corruption;
+    // vm is immune — its recur args ride the operand stack). The
+    // threadlocal is only written in the no-eval window between here and
+    // the matching loop frame's drain, where no nested recur can fire.
+    //
     // GC-ROOT: A6b — already-evaluated recur values are reachable only
-    // through the scratch while a LATER arg's eval allocates (D-556; the
-    // hottest case: a BFS loop/recur carrying fresh vectors/maps). The
-    // RecurSignaled unwind + slot writeback allocate nothing, so the frame
-    // popping at return is safe.
+    // through this buffer while a LATER arg's eval allocates (D-556).
+    var local_buf: [MAX_LOCALS]Value = undefined;
     var af: ArgsFrame = undefined;
-    af.push(&pending_recur_buf);
+    af.push(&local_buf);
     defer af.pop();
     for (n.args, 0..) |*a, i| {
-        pending_recur_buf[i] = try eval(rt, env, locals, a);
+        local_buf[i] = try eval(rt, env, locals, a);
         af.publish(i + 1);
     }
+    @memcpy(pending_recur_buf[0..n.args.len], local_buf[0..n.args.len]);
     pending_recur_len = @intCast(n.args.len);
     return error.RecurSignaled;
 }
 
@@ -28,3 +28,7 @@
 ;;=> [0 1 2 3]
 (realized? (lazy-seq [1]))
 ;;=> false
+(loop [acc [] xs [1 2 3 4]] (if (empty? xs) acc (recur (into acc (for [y [1 2] :when (odd? y)] [y (first xs)])) (rest xs))))
+;;=> [[1 1] [1 2] [1 3] [1 4]]
+(loop [front (list [:s []]) back () n 0] (if (or (> n 20) (nil? (first front))) n (let [[st p] (first front) nexts (for [d [1 2] :when (= d 1)] [d (conj p st)])] (recur (rest front) (into back nexts) (inc n)))))
+;;=> 1