On the push path wpush_walk_commit and wpush_walk_tree mmap a 1MB buffer and recurse before unmapping, so a long linear commit chain or deep tree stacks one C frame plus one live mmap per level. The dedup count caps bound distinct objects, not single-chain depth: haveset-build callers pass out==NULL so no count cap applies at all, and pack mode's cap (65536) far exceeds the ~8MB C stack. A deep/force-pushed history → stack-overflow SIGSEGV; the discarded recursive return also drops errors. (Category is unbounded recursion — the NORESERVE mmap is reclaimed on unwind, not leaked.) The goal is to bound depth and stop holding the buffer across recursion.
Recursion per parent/subtree with a 1MB mmap live across the call; caps don't bound depth.
keeper/WIRECLI.c:1182 wpush_walk_commit recurses on each parent with cbuf (mmap 1MB at :1144) still mapped until :1186; no depth guard → linear chain stacks N frames → stack overflow.*n>=cap (cap=WPUSH_MAX_OBJS=65536, :1136) bounds only emitted shas; haveset callers (:1561,:1657) pass out=NULL so even that is skipped → depth = full chain length.keeper/WIRECLI.c:1182 (errors swallowed).keeper/WIRECLI.c:1102 wpush_walk_tree same pattern: tbuf mmap 1MB (:1077) held live across subtree recursion until :1113 (lower risk; trees usually shallow).None.
Re-verified 2026-07-07: the tree arm was fixed by KEEP-001/POST-021; the commit-chain recursion (and a new sibling walker) remains.
wpush_walk_tree — no longer hand-recurses: delegates to depth-capped KEEPWalkTree via try() so per-call BASS scratch rewinds (keeper/WIRECLI.c:1265-1291; 0eb0afab KEEP-001, 387a6f99 POST-021).keeper/WIRECLI.c:1303-1359 wpush_walk_commit — 1MB u8bMap(cbuf) (:1319-1320) still live across the per-parent recursion (:1352), unmapped only at :1356; capture parents by value and unmap BEFORE recursing, or convert to a bounded work-stack.keeper/WIRECLI.c:1352 — recursive return still discarded; no depth cap in either mode (haveset callers :1997-2002 pass out=NULL so even the *n>=cap count check (:1312) is skipped → depth = full chain length).keeper/WIRECLI.c:1366-1395 wpush_collect_commits — 1MB map (:1373-1374) live across the :1390 parent recursion, recursive return discarded, no depth cap (seen dedups revisits, not first-visit chain depth).WIREPush it; assert bounded failure rather than SIGSEGV.None.