[PerryLink]

Problem

A json node accepts any value (src/client/guard.ts, repair case json). A value nested a few thousand levels deep therefore passes validation with no errors, and the first serialization at render time overflows the stack:

• src/client/fence-render.tsx:194 — the fence state key calls JSON.stringify(spec)
• src/client/GenuiBlock.tsx:86 — the streaming memo fingerprint stringifies the spec
• src/client/blocks/advanced.tsx:102 — the JSON tree recurses over the value

Repro on the base commit (~30 KB body, 5 000 levels):

processGenuiSpec: errors=0, renderable=true
JSON.stringify(spec): RangeError: Maximum call stack size exceeded

In jsdom the whole fence then fails to render ([dsh-genui] render failed: RangeError) and the reader gets the error boundary instead of a code block. The same pattern exists in repairStrings: a deep object used as a select/radio/segmented-control option falls back to JSON.stringify(item) and throws out of processGenuiSpec itself.

Fix

GENUI_LIMITS.maxJsonDepth = 32, checked by an iterative jsonValueTooDeep helper (a recursive check would just move the overflow into the guard):

• validate: an over-deep json.value is a validation error — items[0].value nesting depth exceeds JSON limit 32; flatten or split the value (same shape as the SVG length diagnostic from [Bug] svg 组件 code 超过 maxCode（12,000）时被静默截断 → XML 解析失败 → 降级为显示源码；validate_dsh_ui 仍返回 valid #378);
• repair: the node is dropped, so no unserializable payload reaches the renderer; the fence falls back to the code block with the diagnostic;
• repairStrings: over-deep junk object options are dropped instead of stringified; labelled options and shallow objects behave exactly as before.

32 is far inside what the JSON tree can draw and what V8 can stringify (a few thousand levels), and well above a readable JSON payload. Values at 32 still round-trip verbatim; 33 is the first rejected level.

Tests

tests/genui-guard.spec.ts (+3):

1. 5 000-level value: validation error, node dropped, JSON.stringify(processed.spec) does not throw; 32-level value round-trips;
2. direct validateGenuiSpec produces the diagnostic and repairGenuiSpec returns {items: []}; shallow payloads keep their exact shape;
3. a 5 000-level object option no longer throws out of processGenuiSpec, and labelled object options still become labels.

On the base commit all 3 fail (two with RangeError); with the patch npx vitest run tests/genui-guard.spec.ts is 52 passed, full suite 2109 passed / 152 files, npx tsc -p tsconfig.json --noEmit clean.

Not covered here: the render_ui tool wrapper-unwrapping depth (src/plugin/tool.ts), which is a separate path.