GET-041 HIGH: be/ worktree bring-up is broken end-to-end — fix the stack FIRST

The Issues work loop starts with "stand up a beagle-ext worktree from the store" — and that first step fails every way it is tried (evidence 2026-07-07, the URI-015 worker had to run in the main tree by explicit order). Umbrella over the self-locator/self-gitlink cluster GET-036/GET-037/GET-038/GET-039: jab get of beagle-ext loops module resolution through the checked-out be -> . link, a retry SELF-HOSTS jab from the partial checkout it is itself writing, and the native ASan be get aborts on a stack-buffer-overflow after a sniff miss. Until this lands, every be/-stack ticket worker is forced into the main tree — the loop's isolation guarantee (rm -rf a suspect worktree, zero side-effects) is gone. Priority: fix FIRST, before further be/ feature tickets. Method Issues.

Input

Context

mkdir ~/src/URI-015; cd; ln -s ~/src/journal/be be; jab get 'file:/home/gritzko/.be?/beagle-ext' → require: cannot find './gitmodules.js' from '/home/gritzko/src/URI-015/be/be/be/shared' — checkout replaced the planted locator with the repo's own be -> . mid-clone, the upward be/-scan looped, checkout left partial (top files only).
Retry jab get in the partial tree → require: cannot find '<wt>/be/core/discover.js' — jab SELF-HOSTED from the partial checkout (its be -> . wins the scan): the tool being fetched became the tool running the fetch; the retry also dropped .be/.gitmodules from the dir.
Native be get 'file:/home/gritzko/.be?/beagle-ext' → sniff: object not found: hex=830e16da… hexlen=15 hashlet=0830e16da9b90cb1 project=beagle-ext packs=61 then AddressSanitizer stack-buffer-overflow ABORT — a missing sub object must refuse cleanly, and hexlen=15 + the 0-shifted hashlet smell like a slice/offset bug in the sniff diag path itself.
WORKS (gritzko): the worktree-source clone jab get file:/home/gritzko/src/journal/be from an empty dir — the interim bring-up path (via the GET-038 redirect shape).

Goals

One command stands up a working beagle-ext worktree from the central store (jab get 'file:/…/.be?/beagle-ext') — checkout complete, jab status/ctest runnable, Issues loop step 1 restored.
jab pins its extension dir for the WHOLE run (never re-scans into the tree it is writing); a partial checkout must never capture the running tool.
Native sniff refuses a missing object cleanly (no ASan abort); the hexlen=15 diag anomaly triaged — its own C-side ticket if real.

Constraints

Consolidate, don't duplicate: GET-039 (symlinks as plain git blobs) dissolves the self-locator special-casing of GET-036/GET-037 — land that design here or under it, one ruling.
Repro-first per Issues; the store-selector clone crash needs a hermetic repro (a toy project with a link -> . gitlink/symlink, not beagle-ext itself).

WIP

Design decisions

(pending ruling — likely GET-039's "symlink is a leaf blob, never mount/recurse/follow" + a run-pinned extension root in jab)

TODOs

Hermetic repro: store-backed clone of a project carrying a be -> .-style self-link; assert complete checkout, no resolution loop. (test/sub/selfloop covers the 120000 form for a TOY project; the beagle-ext store-selector clone still fails — evidence above.)
jab: resolve+pin the extension dir once at startup (before any checkout writes). Audit 2026-07-07: jab/require.cpp still scans UP per-require from each script's dir (./be ../be …, ceiling $HOME/be else /be) — no run-pin; the mid-clone capture is live.
Native: sniff missing-object → clean refusal; triage the hexlen=15 diag (own ticket if a real slice bug).
Fold in / cross-rule GET-036 GET-037 GET-038 GET-039. Audit: 037's sub-mount crash + 038's redirect + 039's symlink-leaf are IN-TREE (see those tickets); the remaining breakage is the jab run-pin + the native sniff abort.
Established-wt clone guard: verbs/get/get.js seedRemote now refuses to mint <wt>/.be/<proj> under a redirect-file anchor (GET-041 comment, landed in 50e90012).

Blockers and bummers

Workers needing a be/ worktree meanwhile: clone from the WORKTREE source (jab get file:/home/gritzko/src/journal/be), not the store selector.

Outcome

(pending)