backlog: file #1222 -- a fail-closed contract pinned through a C-stack-dependent trigger

[wshallwshall]

Files BACKLOG #1222 -- a fail-closed contract pinned through a C-stack-dependent trigger.

tests/test_sandbox_codec.py::test_recursion_error_is_not_a_value_error pins a real contract:
decode_frame catches RecursionError explicitly because it is a RuntimeError, so an
except ValueError would let a deep-nesting rejection escape the fail-closed path -- exactly as the old
bare KeyError did. The contract deserves a test. The trigger does not test it portably.

with pytest.raises(RecursionError):
    json.loads(_deep_json(100000))          # "[" * 100000 + "]" * 100000

Measured on two environments, and the spread is the finding

	json.loads first raises at	100,000 raises?
a local box (CPython 3.14.6, win32)	16,913	yes -- 5.9x margin
the failing CI runner	above 100,000	no

Same bytes, same trigger, thresholds differing by more than six times. A binary "it passes here" would
have established almost nothing; the spread is what establishes that the trigger is environment-dependent.

The mechanism, which rules out the fix people will reach for first

sys.getrecursionlimit() is 1000, and json.loads reaches 16,913. The C accelerator does not
consult Python's recursion limit -- it consumes the C stack, which no Python-level knob controls. So
sys.setrecursionlimit(...) in a conftest is not an available fix, and no repo-side setting could
have caused or cured this.

Ruled out, so nobody re-derives it

• 48f8712d..8077a033: 908 added lines, and zero matches for setrecursionlimit,
  sys.setrecursion, threading.stack_size, stack_size, or RecursionError.
• tests/test_sandbox_codec.py unchanged across that range -- blob 24807e73e152 byte-identical at
  both ends. The failing test is literally the bytes that passed.
• No recursion or stack knob in conftest.py, pyproject.toml, or the sandbox modules.

Cause: UNKNOWN, and recorded as unknown

main at 8077a033 passes this test (11,199 passed, 0 failed, full suite) while two unrelated PRs
fail it. The runner-image hypothesis does not cleanly explain main passing, and no mechanism is
invented here to reconcile that. An honest unknown is worth more than a plausible story -- and a
plausible story here would be believed.

The named anti-fix

Do not raise the depth until it fails again. That buys a green on today's image, re-fires on the next
roll, and makes the test more environment-coupled rather than less.

The direct alternative: assert the type relationship, and drive decode_frame's handler with a raised
RecursionError rather than manufacturing one from real recursion. Acceptance criterion: the
replacement must still fail when the handler is narrowed to except ValueError, and must pass on
both a box that raises at 16,913 and one that does not raise at 100,000. Covering only one of those is
what produced this item.

Ledger-only. Verified: #1222 free in the live ledger and the archive; merges clean onto current main.