null: bound self-run recursion + shell-safe CHECK

wizard-work/null/check.py

@@ -4,6 +4,11 @@
 Exit code is the verdict: 0 = everything holds, 1 = something broke.
 
 Run:  python3 /root/troupe-standup/wizard-work/null/check.py
+
+Self-run guard: the recursive probe runs this same file with
+NULL_CHECK_SELF=1, which makes the probe inert (report success without
+re-executing).  Without the guard the probe would re-arm the variable and
+recurse forever.
 """
 import os
 import re
@@ -53,9 +58,7 @@ def main():
     check("wizard.log.md has exactly one CHECK:", nc == 1, "found %d" % nc)
 
     # --- 5. self-verification: run check.py and require exit 0 ---
-    r = subprocess.run([sys.executable, os.path.join(MYDIR, "check.py")],
-                       capture_output=True, text=True)
-    check("check.py self-run exits 0", r.returncode == 0, "exit=%d" % r.returncode)
+    check("check.py self-run exits 0", _self_run(), "")
 
     # --- 6. git hygiene: commit exists and pushed HEAD is a descendant of it ---
     ok, detail = _git_ok()
@@ -69,6 +72,24 @@ def main():
     return 0
 
 
+def _self_run():
+    """Re-execute check.py under an inert marker env var; True iff it exits 0.
+
+    The child sees NULL_CHECK_SELF=1, so its own _self_run() reports True
+    without re-executing.  That bounds the recursion depth to exactly one
+    child process instead of an unbounded chain.
+    """
+    if os.environ.get("NULL_CHECK_SELF") == "1":
+        return True
+    env = dict(os.environ, NULL_CHECK_SELF="1")
+    try:
+        r = subprocess.run([sys.executable, os.path.join(MYDIR, "check.py")],
+                           capture_output=True, text=True, env=env, timeout=120)
+        return r.returncode == 0
+    except Exception:  # noqa: BLE001
+        return False
+
+
 def _compiles(src):
     try:
         compile(src, "wizard.py", "exec")