Lower-severity correctness, UB, and API-consistency items from the review. None is individually urgent; grouped so they land in one hardening pass. Each is a one-liner with a cited site; split out any that grows a repro of its own (per Tickets, a bug found mid-fix becomes its own ticket). Method: Issues.
git/GIT.c:163-173 git_drain_decimal does v=v*10+digit on a signed i64
with no bound → signed-overflow UB on a long digit run in a commit timestamp (flows into gmtime_r). Parse into u64 with an overflow guard / cap digits.
git/SHA1.h:17-21 sha1empty reads the u8[20] struct via u64*/u32*
casts — strict-aliasing + unaligned-load UB. Use memcmp vs a 20-byte zero.
DOG.c:761-828 DOGutf8sFeedDate uses non-reentrant localtime; correct
today (copies immediately) but localtime_r is the trivial fix (and check abc/INT.h/TTY.h for an existing date formatter before the month/day tables).
DPATH.h:126-136 DPATHBranchResolveRel resolves only ONE ..//./ level,
then fails ../../x with PATHBAD; the header's "../X, .." oversells it. Loop the prefix-strip or document the single-level limit.
DOG.c:723,742,835,848 index FILE_WANT_BUFS[fd] with a u64 fd read back
from the kv store, unchecked; a stale/corrupt value is an OOB read of the fd table. Bound-check fd < FILE_MAX_OPEN before indexing.
NEIL.c:483-523 neil_shift_pass → NEILTokEq (:61-74) → tok32Val indexes
toks[0][i] bounding the 24-bit offset wrap but NOT the token index — the bound NEILCleanup added (:164-169) and NEILBoundaryScore/NEILIsIdent have. NEILShift is public (NEIL.h:41); an over-run/mismatched EDL (the documented Myers-NOROOM fallback shape) reads far OOB. Latent via the current WEAVE caller.
ULOG.c:334-339 ulog_idx_scan_cap assumes ~16 B/row but the min row is ~6-8 B,
so a dense (~10 KB+) log opened read-only with a missing/stale sidecar UNDER-sizes the anon index (~2×) and fails to open. No overflow (pushes are SNOROOM-checked) — availability only. Size the cap by the min row width.
HOME.c:190-200 HOMEProjectExists: impl comment says it checks refs
non-empty, header (HOME.h:198-203) says existence-only; code does existence only. Delete the stale comment and pin the behaviour with a test (upload-pack fast-fail depends on it).
ULOG.h:200-204 ULOGClose rw flag is caller-replayed state — passing
rw=YES after an RO-ish open FILETrimBooks (ftruncate) a file it never owned for write; derive the mode from the booked fd instead.
ULOG.c:892 ULOGCompactLatest tmp-path feeds path unchecked and (unlike
ulog_idx_path :299-300) does not strip trailing NULs — a NUL-padded slice makes unlink(tmp_path) (:897) delete the LIVE log. Match the sibling's trim.
ULOG.c:325 ULOG_FAULT_ALLOC_ANON is a mutable global fault injectorcompiled into release; gate behind a build flag / setter.
ULOG.c:1078 merge-walk silently drops tie-group members past
LSM_MAX_INPUTS(64) — records are user data, deserves an error.
home_git_config_get collapses "unset" and
"spawn failed" into NODATA (HOME.c:62); HOMEResolveSibling always falls back to OK with a bare name so callers can't tell "found" from "guessing" (:1011,1099-1102); VERSNReport/WEAVEScope return decorative ok64.
behaviour-preserving on the happy path.
dog/ + dog/git libdog, ABC style.git_drain_decimal overflow, sha1empty aliasing, localtime_r.FILE_WANT_BUFS[fd], neil_shift_pass token index, ULOG tmp-path
NUL strip, ulog_idx_scan_cap min-row sizing.
HOMEProjectExists comment+test, ULOGClose rw derivation,
fault-injector gating, tie-cap error, DPATHBranchResolveRel doc/loop.
79612854 — git_drain_decimal v*10 GIT.c:167, sha1empty u64c*/u32c* casts SHA1.h:17-21, unchecked FILE_WANT_BUFS[fd] DOG.c:723,742,835,848, ULOG_FAULT_ALLOC_ANON live, LSM_MAX_INPUTS silent drop ULOG.c:1065,1080. ULOG-003 be89684d grew only the BOOKED sidecar (ulog_idx_push FILEBookEnsure); the anon ulog_idx_scan_cap /16 sizing (ULOG.c:334-339) is unchanged — re-check that sub-item against ULOG-003 semantics when fixing. WIP UNLANDED in worktree ~/src/DOG-016.