BE-024 MED: robustness + error-doctrine — unguarded parse aborts walk, non-crash-safe book, wrong-target rollback

Seven correctness/robustness/doctrine gaps across shared/core/verbs:

core/recurse.js:53 — joinPrefix calls uri._parse UNGUARDED; one malformed .gitmodules path (a space or control byte — git allows sub paths with spaces) throws uri.parse: malformed and ABORTS the whole status/diff/log/commit recursion (every other _parse site try/catches; status.js:~398 duplicates the hole).
shared/submount.js:327 — mount() failure rollback unlinks a PRE-EXISTING healthy sub anchor → a transient re-get failure UNMOUNTS a live sub.
shared/ulog.js:233 — _book truncates the live ULOG BEFORE restoring the RAM snapshot, yet is documented as a crash-safe primitive (a crash in the window loses the log).
shared/serve.js:74 — uploadPack serves only wants0; additional want lines are collected then IGNORED.
shared/argline.js:44 — shellSplit drops EVERY backslash inside double quotes, diverging from POSIX quoting.
verbs/post/post.js:269 — advanceBranch: the 'target already contains cur' POSTNONE is UNREACHABLE — that case is reported as POSTNOFF (wrong code).
core/loop.js:331 — lowercase throw prefixes "loop: ..." / "be.find: ..." (also loop.js:89, discover.js:142) violate the UPPERCASE-code error doctrine.

From the 2026-07-07 be/ review (BE/REVIEW), CONFIRMED (recurse.js probed). Method Issues.

Input

recurse.js:53 probe: recurse.joinPrefix("parent", "my sub") throws uri.parse: malformed; the only enclosing catch (loop.js:62) re-propagates → whole-run abort on one bad declared path.
Doctrine (3): throws start with an UPPERCASE code word (NAVNONE/PUTNONE follow it); these are user-facing.

joinPrefix (both sites) guards the parse and SKIPS a bad path, not the whole walk; mount() rollback only unlinks anchors IT created; _book restores snapshot before truncation (or is documented non-crash-safe); uploadPack serves all wants; shellSplit keeps POSIX backslash semantics; advanceBranch emits the reachable POSTNONE; the three throws get code words.

Repro-first for the behavioral ones (bad-path recursion survives; transient re-get keeps the live sub; multi-want fetch).