Full record of the parallelized be/ review (7 finders × 5 dimensions — style, duplication, memory/resource safety, semantics, consistency — each finding adversarially re-verified + novelty-checked against the board). 54 CONFIRMED, 6 KNOWN (already ticketed), 11 REFUTED. This digest holds every CONFIRMED finding; the BE tickets BE-010..BE-025 group them by root cause. Two jab-SIDE findings (buf.cpp) routed to JAB. Method Issues.
verbs/patch/patch.js:81 PATCH ours side = cur's COMMIT tree, not wt bytes → dirty edits clobbered (JS twin of native PATCH-002 2583217c; GET twin JGET-004). +patch.js:97 deleteLeaf swallows unlink errors → phantom deleted count.core/discover.js:232 wtdir SRC_ROOT confinement is a LEXICAL prefix check; //../name / //name/../../.. physically escape the root (safeRel never applied to host/path). JS twin of DOG-009.shared/wire.js:441 emitPack sizes the pack buffer at len+256/obj; real-zlib overhead on incompressible input is ~330 B/MB → a single >~4MB binary blob aborts every push (pack: feed (full?)), no grow path.shared/wire.js:642 push() finally never closes wfd; a pre-close throw leaves receive-pack blocked on stdin → blocking reap HANGS. +wire.js:181 curlRun and +wire.js:198 curlPost: no try/finally, child/fd/tmp leak on throw.verbs/delete/delete.js:318 DELETE ignores the Host slot: be delete //origin?feat tombstones the LOCAL branch, not the remote.verbs/post/post.js:190 POST #/#!/#msg! forms unimplemented: absorbed-message reuse missing, forget-! silently dropped.views/bro/pager.js:145 file-content control bytes emitted verbatim to the tty → ANSI/OSC injection from repo content.shared/util/ignore.js:155, views/diff/diff.js:313, shared/gitmodules.js:16, views/why/why.js:25 io.mmap and never unmap → region exhaustion in the resident loop.views/log/log.js:46 one unbounded hunk; views/why/why.js:166 body sized 64 MiB — blame spans corrupt past 16 MiB.shared/store.js:114 indexPackByWalk sizes off delta length, no NOROOM grow → silent object drop; store.js:366 readRecord retries ANY error as NOROOM → doubling to >1GB on a corrupt record; store.js:92 inferType mis-types blobs shaped like tree/commit headers.verbs/head/head.js:73 HEAD ignores the Path slot (full-tree diff); verbs/put/put.js:278 pathless no-ref remote falls past the log-only gate → force-pushes trunk; verbs/put/put.js:329 host slot decoded 3 divergent ways (put vs wire vs get/head).shared/classify.js:142 wtEqBase ignores the exec bit → chmod-only change reads ok, never committable, reverted by re-get; classify.js:470 classifyDir baselines baselineTip() vs classifyMerge curTip() → ls/lsr disagree with status after patch; classify.js:77 nested primary .be DIR floods status with unk.verbs/head/head.js:120+:203 cached-tip peek dup'd from get.js with divergent error vocab (HIGH-ish); verbs/get/get.js:130 oldTipOf re-reads wtlog tip, misses detached ?<sha>; shared/wire.js:545 ZERO_SHA thrice; views/bro/pager.js:228 re-impl of imported spell.js helpers; views/status/status.js:423 isMount re-impl w/o GET-036 symlink guard; views/cat/cat.js:104 readFileBytes re-impl vs wtread; shared/wtread.js:10 io.readAll 3rd arg ignored (5 sites); shared/serve.js:45 inline branch→refs/heads vs relate.resolveRef; core/loop.js:180 TRANSPORT vs SCHEME_ALLOW dup.views/grep/grep.js:38 multi-arg grep searches arg0 N times; views/spot/spot.js:26 drops trail args (spot:#body .c throws SPOTNOEXT); view/theme.js:123 reset() leaves BOLD on combined slots; views/bro/pager.js:779 _feed mishandles an escape split near the buffer end → tail bytes leak as keystrokes; view/bro.js:220 colorWhyHunk dead ternary + missing row newline.core/recurse.js:53 joinPrefix uri.parse unguarded → one bad .gitmodules path aborts the whole walk; core/loop.js:331 lowercase loop:/be.find: throw prefixes; shared/serve.js:74 uploadPack serves only wants0; shared/argline.js:44 shellSplit drops backslashes in double quotes; shared/ulog.js:233 book truncates before restoring snapshot (not crash-safe); shared/submount.js:327 mount() rollback unlinks a PRE-EXISTING healthy sub anchor; verbs/post/post.js:269 advanceBranch POSTNONE unreachable → reported POSTNOFF.core/discover.js:75 row0Uri scans the ENTIRE wtlog per find(), repeatedly per command; core/loop.js:81 _hunkSink retains every record in recs → ~2× peak memory; core/emit.js:150 flush encodes to UTF-8 then decodes back for writeStdout; core/loop.js:144 tab-indent + trailing whitespace in a 2-space file.buf.cpp:48 Buf.feedStr silently truncates on full IDLE vs API.md NOROOM; buf.cpp:124 API.md documents io.book/close/trim that buf.cpp lacks (no deterministic unmap).