door.js:588 looks a verb up as VERBS[target.slice(0, sp)] with no
own-property guard — the guard exists two screens up (door.js:101 verbOf)
and is bypassed. bee toString x resolves Object.prototype.toString, calls
it, and openTarget hands the pager a string instead of a hunk. http.js:150:3E
has the same raw read (own.verb = ROUTE[first]) in the repo-less branch
while the repo branch guards with hasOwnProperty six lines later; same raw
read in urlOf at http.js:184:3E. GET /toString/x passes the 404 gate at
http.js:688:3E and dies inside the try at :739. Found in the 2026-08-21 review.
Repro tests for the CLI and the http route. Route every verb-table read
through one guarded lookup (verbOf for the door, its twin for ROUTE).
bee toString x and GET /toString/x answer a clean refusal