Beagle SCM

BE — the be/ JS project (dispatcher + kernel + verbs + views)

be's front-end (verb/projector dispatch, bareword routing, the error/UX surface) plus the be/ JS kernel/verbs/views the 2026-07-07 review covered (BE/REVIEW). One topic dir, Plan-shaped tickets cleared by the Issues fix-and-land loop.

Review 2026-07-07 (BE-010..025)

Parallelized 5-dimension review of be/ (54 confirmed, adversarially verified) — full record in BE/REVIEW. Grouped by root cause:

• BE-010 CRIT — PATCH weaves the COMMIT tree as "ours", clobbering dirty wt edits (JS twin of native PATCH-002/JGET-004).
• BE-011 HIGH — wtdir SRC_ROOT confinement is lexical; //../name escapes the root (JS twin of DOG-009).
• BE-012 HIGH — emitPack 256B deflate slack overflows on >4MB incompressible blobs → every such push aborts.
• BE-013 HIGH — wire.js child/fd lifecycle: push() finally leaks stdin → reap HANGS; curlRun/curlPost leak.
• BE-014 HIGH — DELETE ignores the Host slot: be delete //origin?feat tombstones the LOCAL branch.
• BE-015 HIGH — POST #/#!/#msg! message forms unimplemented (reuse missing, forget-! dropped).
• BE-016 HIGH — pager emits file-content control bytes to the tty (ANSI/OSC injection).
• BE-017 HIGH — io.mmap-and-never-unmap leak class at 4 sites (ignore/diff/gitmodules/why); gated on JAB-006.
• BE-018 MED — hunk-body tok32 end field wraps at 16 MiB (log/why) → large-file views corrupt.
• BE-019 MED — thin-pack buffer sizing: silent object drop + >1GB balloon on corrupt input (store.js).
• BE-020 MED — verb URI-slot gaps: HEAD drops Path, pathless PUT force-pushes, host decoded 3 ways.
• BE-021 MED — classify: exec bit ignored, dir/merge baseline mismatch, nested .be DIR floods unk.
• BE-022 MED — helper duplication sweep (~9 sites: head/get tip-peek, ZERO_SHA×3, pager/spell, status isMount, …).
• BE-023 MED — view semantics: multi-arg grep/spot drop args, theme bold sticks, pager escape-split leak.
• BE-024 MED — robustness/doctrine: unguarded parse aborts walk, non-crash-safe _book, wrong-target rollback, +4.
• BE-025 LOW — perf/style: repeated full-wtlog scans, double hunk retention, redundant re-encode, whitespace.

BE-011 follow-up: wt-open confinement audit (BE-026..028)

BE-011 landed segment path helpers (shared/util/path.js split/merge/resolveInTree/wtJoin) + the unified discover.resolve(). A codebase-wide audit of worktree-file opens then surfaced THREE more live ..-escapes of the same class, each its own ticket (fix in progress, same tree):

• BE-026 HIGH — core/recurse.js composes wt paths from UNVALIDATED .gitmodules path=; a crafted submodule escapes via stat/be.find.
• BE-027 HIGH — pager _fsCompletions Tab-completion raw-concats an uncollapsed ../ stem into readdir/lstat (enumerates ABOVE the wt).
• BE-028 HIGH — classifyDir opens the ls nav scope via relDir's lexical prefix that .. defeats (ls:../../etc).

Then a universal wtJoin routing pass (P2/P3) confined the remaining wt-file opens: cat/why/diff untrusted URI paths, a LIVE destructive delete --force ../x unlink escape, get's raw-concat + sub sites, and defense-in-depth leaf guards in checkout/submount/stage. All six landings share the shared/util/path.js wtJoin/resolveInTree chokepoint; final combined suite 136 pass / 10 skip / 0 fail.

Context-URI / hive audit 2026-07-09 (BE-031..035)

The hive ruling (worktrees → <meta>/work/, scheme-less //name = worktree, remotes always scheme-ful, --at retired) landed in the wiki 2026-07-09; a two-agent be/ audit against the settled model produced the migration plan and four conformance bugs:

• BE-031 HIGH — the hive migration: S1 gitignore + S2 srcRoot/topWt/navCwd flip + S3 get seeds cells DONE 2026-07-09 (uncommitted, suite 157/160 = baseline, live-smoked: work/beagle-ext-tests minted, //name + hop + meta-blind status all pass); open: S4 tests/prose, S5 self-hosting ruling, drop the SRC_ROOT=~/src shell export.
• BE-032 HIGH — CLI drops the cwd sub-path: verbs resolve args at the wt ROOT (cd MAIN/src && be cat main.c reads MAIN/main.c); pager sees the sub-path, CLI doesn't.
• BE-033 MED — RULED + implemented 2026-07-09 (uncommitted): cached-remote dropped, scheme-less //X = wtdir hit or NAVNONE everywhere (loop/get/head/put); cached tests dropped (head-cached, get-cached deleted; nav-navnone part b flipped to assert NAVNONE); suite = baseline. Pending land only.
• BE-034 MED — be get //name FFs the NAMED wt to its branch tip; spec: checkout, in the context wt, the rev that wt is ON (curTip); compounds BE-030.
• BE-035 LOW — ls/status silently drop a ?rev context (live wt shown at a pinned rev); _snapBe omits authority/verb, leaking spell scope past reentry.

Active tickets (dispatcher/UX)

• BE-061 HIGH — a pre-seeded empty .be/ (the rs_fresh_wt/rs_shield shape every test worktree uses) makes the FIRST jab get throw ToBigInt in hashlet60FromBytes ← locate ← fanoutWholeTree; a second get into the same wt succeeds. Found by TEST-004.
• BE-062 MED — curlRun calls io.spawn with an argv missing argv0, so curl never receives -sSf: no --fail (HTTP errors return success) and the progress meter leaks to stderr. Same function as BE-013. Found by TEST-004.

• BE-037 HIGH — FIXED 2026-07-09 (uncommitted, repro-first, suite 161/162 = baseline): ./ canonicalized in diff/cat/why (+ diff ./file wholly-added bonus leg); // = topWt in resolve/wtdir (memoized launchTop, matches navCwd); authorityRepo NAVNONEs every miss; new cases diff/15-dot-dir-scope + uri011/nav-empty-host-top. Pending land.
• BE-038 MED — todo view verb: :todo open-ticket board / :todo TOPIC topic list / :todo TOPIC-123 one ticket; titles, ticket ids and wiki links are click-targets (requested 2026-07-09, iterate till NICE).
• BE-040 MED — done verb LANDED 9dad5857 (header [DONE] flip incl multi-mark collapse, README delist); residual: round-3 [done] buttons in :todo rows staged in wt work/BE-040, pending land.
• BE-041 MED — [put] buttons on pager status rows (unk/mod/new): visible Y label + hidden O put <path> spell, plain byte-unchanged; DONE in wt work/BE-041, pending land.
• BE-042 OPEN — formal context model: context(cwd) total (tree root → // + first segment as authority, ~/src/journal/wiki → //wiki; hive wt → //N; sub → parent+mount); two //X rulings open; sequences URI-010 merge + BE-032 sweep.
• BE-049 HIGH — //-empty-host nav anchors rootTop, not the tree you stand in: from a nested worktree (work/*) a ///path mutation arg0 / // context silently rescopes to the OUTER repo. Needs the //X ruling (BE-042); spin-off of PUT-008.
• BE-039 HIGH — pager put/delete crossing a sub mount: authorityRepo anchors on arg0's FULL path (be.find climbs from the file, lands on the SUB), raw rest args then resolve in the wrong tree; delete can mis-target same-named sub files. RULED 2026-07-10: pager passes context + RAW args (arg0 too — no ctx-merge); put/delete resolve each arg via resolve(context,base,rel) (BE-030). Repro in the ticket dir; found exercising BE-036.
• BE-036 LOW — pager word spells expand shell-style globs (put *.c, delete src/*): today the literal pattern reaches the verb (FILENONE); reuse the Tab-completion confined FS walk (BE-027), pager multiplies raw words, verbs still resolve (BE-030).
• BE-030 HIGH — context-confined path resolution: get anchors its write/clone on raw io.cwd() (a :get under a //parent nav context with cwd in a SUBMODULE writes the sub's wtlog + clobbers it), and discover.resolve(base,ref) lets a //authority in the ref slot escape the context tree; unify onto resolve(context,base,rel) confined to $SRC_ROOT/<name>. Continues BE-011.
• BE-029 — verb discovery must be-climb from CWD so a nested be/ shard (html/be publication verbs) is found while core/shared inherit up-tree; registry.verbFile/resolveVerb + repro landed in the BE-029 wt, pending land into journal/be (prereq for MARK mark).
• BE-003 — every dog must print name + verb + URI + error code on an error exit (one uniform line, single-sourced) — today error exits are contextless (Error: SNIFFFAIL, bro: cannot open …: FILENONE); general form of BE-002.
• BE-008 — be put/be post leak a sub's empty-put cascade (sniff: put: no changes + empty put put: + Error: PUTNONE + Error: NONE) when recursing into an UNCHANGED submodule. PARTIAL: the be post arm landed (quiet captured gitlink bump); the bare be put arm (BEActSubsRelay, no -q) still sprays. Evidence in the ticket dir; kin of POST-019 (closed).

BE-007 (root out ROWS — deleted dog/ROWS.{h,c} + 4 types, 18 callers repointed to the typeless HUNKu8sFeedRow ULOG→HUNK serializer; fixed POST-022's wrecked output) landed 1a006d08; retires BE-005 (the ROWS-banner umbrella).