rose-ash/plans/sx-review/hosts.md

SX Hosts Review — findings (hosts axis)

Reviewer lane: per-target host implementations + FFI seam. Targets: hosts/ocaml (kernel, VM/JIT, epoch protocol, server env, HTTP path), hosts/javascript, hosts/python, hosts/native, WASM browser kernel, web/ adapters.

Status: COMPLETE — all 7 verification agents done (OCaml VM/JIT, sx_server epoch/env/HTTP, JS host, Python host, web-FFI seam, cross-host parity, native/WASM). OCaml run_tests baseline + --jit differential both done. The highest-severity findings were reproduced live and self-verified by the lead reviewer (marked "self-verified").

Live HTTP-path verification (follow-up): booted sx_server --http on free ports (3 bounded runs, own PIDs only — never pkill) and drove concurrent load. This UPGRADED three suspected HTTP-race items to CONFIRMED — S1 (multi-Domain render pool crashed intermittently under concurrent load; empty responses, no exception, OOM ruled out at ~292 MB peak RSS), S4 (routing failures served as HTTP 200 and cached: cold 2.02s → warm 0.0005s), and S5 (cache key ignores cookies/query — three different session= cookies returned one identical cached body). S2/S3 stay SUSPECTED: their code paths were verified live but the stock static-docs app has no request-varying full-page render to exhibit a visible symptom. Logs: /tmp/sx-review/http-server{,2,3}.log.

Finding tally: ~65 CONFIRMED (incl. S1/S4/S5 upgraded via live repro) + ~13 SUSPECTED (incl. S2/S3) + 2 positive/informational. Full detail below.

TOP-LINE (most severe; CONFIRMED unless noted):

• Production serving-JIT silently miscompiles (J1): (-> …) in argument position and user-macro args (J3) yield wrong values; JIT-fallback double-applies side effects (J2). The http server registers the JIT hook UNCONDITIONALLY (sx_server.ml:4163) — live on sx.rose-ash.com.
• One malformed line kills the whole sx_server process (C1) — unguarded command-channel parse; a non-ASCII byte does the same (C1b).
• JS bundle is hollow (C0a): render/engine/router/signals/all adapters transpile to 0 bytes because the transpiler doesn't recurse into define-library; JS conformance is 2490 failing (C0b).
• Python↔OCaml boundary + parser diverge: NUL/escape corruption (C25), boundary validation is a permanent no-op (C24), bridge desync is unrecoverable (S-bridge).
• Cross-host primitive parity is broken in ~30 confirmed ways (P1–P12): OCaml lossy float wire, mixed-number sort, into needs a bridge; JS lenient-coercion cluster + missing equal?/eq?.
• HTTP serving path breaks under concurrency (live-verified on a booted server): the multi-Domain render pool crashed intermittently under concurrent load — a genuine data race on unsynchronized cross-Domain Hashtbls, OOM ruled out (S1, CONFIRMED); routing failures are served as HTTP 200 and cached indefinitely (S4, CONFIRMED); the response cache key ignores cookies/query, so it would serve one user's response to another on any cookie/auth-varying app (S5, CONFIRMED). Still SUSPECTED: per-request globals read by queued workers (S2) and expand-components? removed on the shared env by AJAX renders (S3) — both code paths verified live, but need a request-varying app (not the static docs site) to exhibit a visible symptom.

Baseline (no JIT): run_tests.exe → 5762 passed, 274 failed. 273 failures are hs-* hyperscript suites (in-progress guest project — baseline caveat, not a host bug; note the can-map-an-array / "map with block" line prints with a blank suite label due to C9 but belongs to a hyperscript compat suite). The single genuine non-hyperscript host failure is C2 (r7rs string->number shadow). --jit run: 5760p/276f, with 2 deterministic JIT-only divergences (J9). Logs: /tmp/sx-review/ocaml-run_tests-baseline.log, /tmp/sx-review/ocaml-run_tests-jit.log

Numbering note: findings carry mnemonic prefixes (J* serving-JIT, C* OCaml/kernel/protocol, JS* JavaScript host, P* cross-host parity, S* suspected). Order within CONFIRMED is roughly severity-desc but read the whole section — prefixes were assigned as agents reported, not in rank order.

---

CONFIRMED (most severe first)

Serving-JIT correctness cluster (J1–J8). The OCaml http_mode (the production HTTP server behind sx.rose-ash.com) registers the JIT hook unconditionally (sx_server.ml:4163) — it is NOT gated by SX_SERVING_JIT (that env var only gates the epoch/persistent serving mode, sx_server.ml:5011). So every named top-level lambda invoked during page rendering is JIT-compiled on first call, and the divergences below are reachable in production for any rendered lambda that hits these patterns. The default run_tests --jit uses a different, low-hit-rate JIT path and surfaced only 2 divergent tests (see J9); the serving-JIT path is where the silent-wrong-value bugs live. All J1–J8 reproduced live at the kernel level.

IMPORTANT reconciliation: there is a belief on record (project memory / a comment at sx_server.ml:5001-5011) that "serving-JIT is OPT-IN via SX_SERVING_JIT=1, default OFF." That gate applies ONLY to the epoch/persistent serving mode. The actual HTTP server (http_mode) calls register_jit_hook env UNCONDITIONALLY at sx_server.ml:4163 with no env-var check. So anyone who concludes "JIT is off in production, therefore J1–J8 don't apply" is wrong — the http server that serves sx.rose-ash.com runs with JIT on. Confirmed by reading the http_mode entry and by the live boot logs ([jit] … compile in …s lines during every page render).

J1. -> threading miscompiles under serving-JIT — silent wrong value + duplicated side effects

• severity: critical
• confidence: CONFIRMED (reproduced live, self-verified)
• where: lib/compiler.sx:934-951 (compile-thread-step); stale twin hosts/ocaml/lib/sx_compiler.ml:178
• what: For (-> v f g) with non-empty rest-forms, compile-thread-step compiles call-expr (pushing a value that's never popped) then recurses with call-expr re-embedded, compiling it AGAIN. Each non-final step is evaluated once per remaining step (side effects duplicated) and leaves a stack residue. When the -> is argument ≥2 of a primitive call, CALL_PRIM pops the residue instead of the sibling arg → silently wrong value. In arg position of a user call the slot misaligns → "not callable" → self-heals via CEK fallback.
• repro: with lib/compiler.sx loaded, serving-JIT on: (+ 1 (-> 2 inc inc)) on CEK → 5; JIT'd (define (t1) (+ 1 (-> 2 inc inc))) called → 7 (self-verified: (t1 ×5) → (7 7 7 7 7); same source with JIT off → 5). bytecode-inspect shows the residue CONST/CALL_PRIM that's never popped.

J2. JIT-fallback re-runs the entire call on the CEK → side effects execute twice (persist/counter/emit double-apply)

• severity: high
• confidence: CONFIRMED (reproduced live, self-verified)
• where: sx_server.ml:1630-1638, 1674-1680 (catch-all | e -> … l_compiled <- jit_failed; None); sx_vm.ml:461-464, 490-493 (Component/Island with _ -> cek_call_or_suspend re-run)
• what: Any exception during VM execution of a JIT'd lambda (data-first HO form, macro call, raise/error, call/cc, undefined global) marks it jit-failed and re-runs the WHOLE call under the CEK. Mutations performed before the failure point are applied twice. A code comment claims idempotence "for the host's durable reads" — but it is NOT idempotent for writes (persist appends, counters, emits). The Component/Island path catches even VmSuspended, so a component that performed IO can have that IO re-issued.
• repro (self-verified): (do (define fb-count 0) (define (fb) (set! fb-count (+ fb-count 1)) (map (list 1 2) (fn (x) x))) (fb) fb-count) → serving-JIT: 2 after ONE call; JIT off: 1.

J3. JIT'd functions eagerly evaluate arguments of user-macro calls before falling back

• severity: high
• confidence: CONFIRMED (reproduced live, self-verified)
• where: lib/compiler.sx compile-list/compile-call (no macro-expansion pass); sx_vm.ml:497 (vm_call has no Macro case)
• what: The compiler treats a user-macro call as an ordinary call — compiles and evaluates ALL arguments, then vm_call raises "not callable: " and the hook re-runs on the CEK. Code a macro guards from evaluation executes once in the VM.
• repro (self-verified): my-unless macro that expands true → skip body; JIT'd (um) that does (my-unless true (set! hit (+ hit 1))) → serving-JIT: hit = 1; JIT off: hit = 0.

J4. VM component calls misparse positional string args equal to a param name

• severity: high
• confidence: CONFIRMED (agent-reproduced)
• where: sx_vm.ml:144-156 (parse_keyword_args), fed by compile-expr lowering :kw to its string name
• what: The compiler erases the keyword/string distinction (keywords become their string names in the constant pool), so parse_keyword_args treats ANY string matching a declared param as a keyword marker and consumes the next value → silent wrong props/children, no error, no fallback.
• repro: (defcomp ~box2 (&key title &rest children) (list "BOX" title children)); (~box2 :title "T" "title" "x") CEK → ("BOX" "T" ("title" "x")); JIT'd → ("BOX" "x" ()).

J5. Specialized opcodes freeze primitive semantics at compile time — redefinition ignored by JIT'd code

• severity: medium
• confidence: CONFIRMED (agent-reproduced)
• where: lib/compiler.sx:1061-1077 (specializes + - * / = < > cons 2-arg, not len first rest 1-arg → opcodes 160-172); sx_vm.ml:804-914
• what: CALL_PRIM resolves through vm.globals at run time (redefinitions respected), but the 12 specialized opcodes inline the original semantics. A function JIT'd before (define + …) keeps the old + forever while the CEK sees the new one → CEK/JIT divergence.
• repro: (define (q) (+ 1 2)) JIT'd → 3; (define + (fn (a b) 999)); (q) → 3 (stale OP_ADD) vs fresh CEK → 999.

J6. Redefining a primitive the compiler itself uses poisons subsequent JIT compilation

• severity: medium
• confidence: CONFIRMED (agent-reproduced)
• where: sx_vm.ml:732-766 (CALL_PRIM globals-first lookup) + the compiler running as VM bytecode
• what: The SX compiler's own bytecode calls +, first, nth… through CALL_PRIM → globals. After a user redefines one, every subsequent JIT compile computes with the user's fn — observed as corrupted pools/offsets ("CONST index 999 out of bounds"). Currently every hit errors → CEK fallback (correct), but a redefinition returning plausible numbers could emit structurally-valid wrong bytecode silently.

J7. Data-first HO forms (map coll fn) / -> coll (map fn) always fail under the VM → permanent deopt (+ J2 double-effect on first call)

• severity: medium (perf/coverage; correctness preserved by fallback, but triggers J2)
• confidence: CONFIRMED (agent-reproduced)
• where: sx_primitives.ml:1584-1637 (map/filter/reduce/some/every?/for-each accept fn-first only); CEK ho-swap-args has no VM counterpart
• what: Every JIT'd function using the documented data-first arg order (or threading a collection into an HO form) errors on first VM call and runs on the CEK forever. Results correct, but never benefits from JIT and the first call incurs the J2 double-side-effect hazard.

J8. Local bindings shadow HO-form names in the VM but not the CEK

• severity: medium-low
• confidence: CONFIRMED (agent-reproduced)
• where: compiler compile-call scope resolution (locals win) vs CEK HO-form dispatch (form wins)
• what: (let ((map (fn (a b) 42))) (map 1 2)) → JIT'd: 42; CEK inline: error "rest: 1 list arg" (dispatches as HO map). Divergent semantics for the 7 HO-form names.

J9. run_tests --jit diverges from interpreter on 2 hyperscript scoping tests (deterministic)

• severity: medium
• confidence: CONFIRMED (self-verified, 3× each mode, deterministic)
• where: default run_tests --jit path (guard-installing lambdas interpret-only); hs-upstream-core/scoping suite
• what: hs-upstream-core/scoping > behavior scoping is isolated from other behaviors and … from the core element scope PASS interpreter-only but FAIL under --jit with an empty result (Expected 20, got ). Deterministic across 3 runs each mode. This is the low-hit-rate default-JIT path (distinct from serving-JIT J1–J8), so it's a second, independent JIT/CEK divergence surface. (Baseline 5762p/274f → --jit 5760p/276f; the hs-runtime-e2e "def function" entry fails in BOTH and is not a JIT regression.)

J10. Stale/incomplete Sx_compiler stub still bound as compile; JIT hook registered even if lib/compiler.sx fails to load

• severity: medium-low
• confidence: CONFIRMED (binding + staleness) / SUSPECTED (reachability)
• where: sx_server.ml:1315 (bind), comment at :5014 ("incomplete stub"); hosts/ocaml/lib/sx_compiler.ml (May-7, no POP after LOCAL_SET, no rest-arity/guard/match/scope)
• what: If lib/compiler.sx fails to load in serving-JIT mode the code warns but still registers the JIT hook, so jit_compile_lambda would compile with the stub whose missing LOCAL_SET/POP discipline can silently corrupt stacks (let-in-argument-position) rather than merely erroring.

J11. JIT debug/aux paths diverge from the real VM (vm-trace, code_from_value locals-scan, resume-error handler, threshold)

• severity: low (tooling / edge)
• confidence: CONFIRMED (by reading; J-threshold self-observed)
• where: sx_vm.ml:1436-1632 (trace_run), :230-252 (code_from_value), :990-1005 (resume handler); sx_server.ml:1640-1656 (hook ignores jit_threshold)
• what: (a) vm-trace resolves CALL_PRIM via get_primitive BEFORE globals (real run does opposite → user redefs invisible in trace), pushes Nil for non-NativeFn callees, inline ops 160-175 handle only Number, OP_EQ uses OCaml structural = → traces can show different values than execution. (b) code_from_value's max-local scan mis-walks operands for opcodes 8/33/35/144/51 (masked by +16 headroom). (c) resume-path error handler delivers String msg instead of the raised condition value (only reachable via extension opcodes / hand-built bytecode). (d) the CEK-side hook ignores jit_threshold=4 and compiles on the very FIRST call (why J1's t1 was already wrong on call #1); lambdas defined inside let-wrapped library modules never JIT at all (e.g. all of lib/highlight.sx).

J12. (verification, positive) perform/resume stack-misalignment from repro_jit_resume.ml is FIXED

• confidence: CONFIRMED — all 9 repro cases (direct/multiframe/map-callback/pending_cek/reduce/ nested-map perform) produce expected values; the "drop all-but-first in map/for-each" hazard from the memory note does NOT reproduce at this level. Also verified matching (no divergence): closures with set! on captured locals, &rest under/over-application, define in do/let, named let, letrec, TCO + non-tail at 100k, quasiquote unquote/splice incl nested, dict literals, cond/case/when multi-expr, and/or, string/arith edge prims, keyword equality, apply, guard (correctly JIT-excluded), call/cc fallback, map over rest/filter/append lists, CEK↔VM global visibility both ways.

C0a. JS transpiler is blind to define-library — the browser/CI bundle is hollow (render/engine/router/signals/all adapters = 0 bytes)

• severity: critical
• confidence: CONFIRMED (reproduced live, self-verified — fresh build)
• where: hosts/javascript/platform.py:15-35 (extract_defines), bootstrap.py:205-226
• what: extract_defines only extracts top-level (define …) / register-special-form!. The spec+web files were since wrapped in R7RS (define-library … (begin …)) (spec/render.sx, web/adapter-html/-dom/-sx.sx, web/engine.sx, web/router.sx, spec/signals.sx, web/deps.sx, web/page-helpers.sx, web/orchestration.sx, web/web-signals.sx, lib/freeze.sx), so those files now transpile to ZERO bytes. The bundle still references the missing functions (renderToHtml in its own public API; dom-* guarded by typeof checks that silently skip), so rendering, signals, router, engine are simply ABSENT. spec/content.sx no longer exists and is silently skipped. This is the JS host's single biggest defect and reframes its status.
• repro (self-verified): python3 hosts/javascript/cli.py --output <scratch>/verify-js.js then per-section byte counts → render/adapter-html/adapter-sx/adapter-dom/engine/orchestration/deps/ page-helpers/router/signals/freeze/content all = 6 bytes (marker only); evaluator 140KB, signals-web 99KB, boot 14KB, web-forms 8KB, parser 12KB survive (not define-library-wrapped).

C0b. node run_tests.js fails 2490/5086 — the JS conformance/CI gate is structurally red

• severity: critical
• confidence: CONFIRMED (reproduced live, self-verified)
• where: hosts/javascript/run_tests.js; .gitea/run-ci-tests.sh (CI gates on this)
• what: node hosts/javascript/run_tests.js → 2596 passed, 2490 failed (exit 1); --full → 2453p/3203f. A fresh rebuild produces identical failures — structural, not stale artifact. Same corpus on OCaml → 5762p/274f. Failure signature: 1190× Undefined symbol: dom-set-inner-html, 538× hs-to-sx*, 229× renderToHtml is not defined, 13× makeRtd is not defined — the hollow bundle (C0a) plus a runner that never learned to load the newer lib deps (parser-combinators, gql, hyperscript) the OCaml runner loads. Memory's "957/957 standard, 1080/1080 full" is stale. The JS host is alive as a CI/test host (sx-build-all.sh, run-tests.sh, .gitea CI) but DEAD as a served artifact (the live shell injects wasm/sx_browser.bc.wasm.js, not scripts/sx-browser.js) — so this drift breaks CI/conformance, not visitors.
• repro (self-verified): timeout 400 node hosts/javascript/run_tests.js → Results: 2596 passed, 2490 failed.

C1. Malformed command line crashes the whole persistent/site sx_server process

• severity: critical
• confidence: CONFIRMED (reproduced live)
• where: hosts/ocaml/bin/sx_server.ml:5048 (persistent mode) and :4950 (site_mode)
• what: The dispatch loop calls Sx_parser.parse_all line outside any try; the enclosing handler only catches End_of_file, so Sx_types.Parse_error from one malformed line kills the entire process (the shared command channel used by bridges/conformance runners). site_mode has the identical unguarded parse.
• repro: printf '(epoch 2)\n(eval "(+ 1 2"\n(epoch 3)\n(eval "99")\n' | timeout 60 hosts/ocaml/_build/default/bin/sx_server.exe → Fatal error: exception Sx_types.Parse_error("Unterminated list"); subsequent commands never run. Same with a plain-garbage line (not an s-expr ]]] {{{).

C10. Served browser JIT compiler is one fix behind lib/compiler.sx — the HO-loop desugar parity fix never shipped to the browser

• severity: high
• confidence: CONFIRMED (drift) / SUSPECTED (user impact)
• where: shared/static/wasm/sx/compiler.sx + compiler.sxbc vs lib/compiler.sx:390-443
• what: Commit 921db09f (2026-06-30, "jit: HO-loop desugar + --jit == CEK parity") added map/filter/reduce/for-each lambda-inlining to lib/compiler.sx, but the copy served to the browser (content from 59ac51a8, 2026-06-29) lacks all 54 lines; the .sxbc was rebuilt later (1e2ff387, Jul 2) but from the stale source. The browser JIT therefore misses the exact parity fix for the known "map/for-each drops all-but-first" bug class fixed server-side.
• repro: diff lib/compiler.sx shared/static/wasm/sx/compiler.sx | head → 390,443d389; grep -c "_hml" lib/compiler.sx shared/static/wasm/sx/compiler.sx → 6 vs 0.

C11. Client reads module-manifest.sx that nothing generates anymore — stale lazy-dep graph

• severity: high
• confidence: CONFIRMED
• where: consumer hosts/ocaml/browser/sx-platform.js:575 (fetches sx/module-manifest.sx); generator hosts/ocaml/browser/compile-modules.js:504 (writes module-manifest.json only)
• what: loadWebStack() drives client module loading from module-manifest.sx, but the generator now only emits .json; no .sx writer exists. The served .sx manifest is from 2026-04-16 while modules are from Jul 1-2. Concretely _entry :lazy-deps is missing hs-worker and hs-prolog, so those plugins never lazy-load in the browser; any future dep/export change is invisible to the client.
• repro: grep '_entry' shared/static/wasm/sx/module-manifest.sx → lazy-deps ends at hs-integration hs-htmx; module-manifest.json includes hs-worker, hs-prolog.

C1b. Non-ASCII byte on the top-level command channel also crashes the sx_server process (2nd instance of C1)

• severity: critical
• confidence: CONFIRMED (reproduced live, self-verified)
• where: hosts/ocaml/lib/sx_parser.ml:38 (is_symbol_char is ASCII-only) + the unguarded command-channel parse (C1, sx_server.ml:5048)
• what: A non-ASCII byte reaching the kernel's top-level command reader raises an uncaught Parse_error that kills the subprocess — same unguarded-parse root cause as C1, but reachable from any client that forwards a unicode-named symbol. The Python parser accepts and serializes bare unicode symbols (shared/sx/parser.py:158 accepts €-￿), so a Python-bridge caller can trigger this. Inside (eval "…") it's a catchable error; on the command channel it's fatal.
• repro: printf '(epoch 1)\n(eval (quote café))\n(epoch 2)\n(eval "99")\n' | timeout 30 hosts/ocaml/_build/default/bin/sx_server.exe → Fatal error: exception Sx_types.Parse_error("Unexpected char: \195 …"); epoch-2 never runs.

JS1. define-record-type broken on JS: makeRtd platform constructor missing

• severity: high
• confidence: CONFIRMED (agent-reproduced)
• where: spec/evaluator.sx:2584 calls (make-rtd …); no makeRtd in hosts/javascript/platform.py
• what: The transpiled evaluator's record support calls makeRtd, which the JS platform never defines. Any define-record-type throws; test-cross-lang-types.sx (18 deftests) aborts.
• repro: (define-record-type point (make-point x y) point? (x point-x) (y point-y)) → JS ERROR: makeRtd is not defined; OCaml (point-x (make-point 3 4)) → 3.

JS2. host-callback / host-await never fire for SX lambdas (wrong type tag)

• severity: high
• confidence: CONFIRMED (agent-reproduced)
• where: hosts/javascript/platform.py:2332-2342 (host-callback), 2354-2361 (host-await)
• what: Both check fn._type === "lambda", but Lambda instances are tagged _lambda === true (platform.py:889); the check never matches, so SX lambdas wrapped as JS callbacks become silent no-op functions. Any DOM event/promise callback registered through these does nothing.
• repro: JS (let ((cb (host-callback (fn (x) (* x 2))))) (cb 21)) → nil; OCaml → 42.

JS3. JS arithmetic silently drops extra arguments (arity not checked)

• severity: high
• confidence: CONFIRMED (agent-reproduced)
• where: hosts/javascript/platform.py:1021 (-), 1045 (/), 1086-1101 (< > <= >=)
• what: Non-rational - returns args[0]-args[1] regardless of arity; / is strictly 2-arg; comparisons ignore args past the 2nd. OCaml errors on wrong arity, so buggy guest code passes silently on JS with wrong values.
• repro: JS (- 5 1 2) → 4 (OCaml 2); (/ 24 2 3) → 12 (OCaml errors); (< 1 2 3) → true (OCaml errors).

JS4. Parser rejects . as a symbol — whole hyperscript-parser test file aborts

• severity: high
• confidence: CONFIRMED (agent-reproduced)
• where: hosts/javascript/platform.py:2622 (_identStartRe lacks .)
• what: . is a valid symbol on OCaml but "Unexpected character: ." on JS. test-hyperscript-parser.sx uses (quote .), so the file fails to parse and all 93 deftests are skipped (counted as 1 failure).
• repro: JS (str (quote .)) → ERROR; OCaml → ".", type-of → "symbol". (Handoff: spec must rule whether . is a legal symbol.)

JS5. run_tests.js harness undercounts + shadows semantics

• severity: medium
• confidence: CONFIRMED (agent-reproduced)
• where: hosts/javascript/run_tests.js:457-467, 78-79, 88-96, 126
• what: (1) Each test file is wrapped in one try/catch — the first throw abandons the rest of the file and counts as ONE failure (~111 deftests silently skipped this run). (2) env-bind! and env-set! are defined identically (e[k]=v) — no scope-chain walk for env-set!, contradicting the platform's own envSet (platform.py:2098) and the spec bind/set distinction, so tests exercising that semantics test the wrong thing. (3) sha3-256 is a fake 32-bit hash padded to 64 hex — cross-host content-address comparison is meaningless. (4) lib/harness load errors are logged but never counted.

JS6. Transpiled (str …) doesn't skip nil (emission vs runtime disagree)

• severity: medium
• confidence: CONFIRMED (agent, emission rule read + runtime verified opposite)
• where: hosts/javascript/transpiler.sx js-emit-list str clause vs runtime platform.py:1138-1144
• what: The transpiler emits String(a)+String(b) for str, so transpiled spec code concatenates String(NIL) → "nil", while the CEK runtime skips nils. Identical expressions disagree between transpiled internals and guest code.

JS7. Transpiler has no quasiquote emission; quoted dicts emit garbage

• severity: low
• confidence: CONFIRMED (code read)
• where: hosts/javascript/transpiler.sx js-emit-quote (no dict clause → [object Object]); no quasiquote case in js-emit-list
• what: Only a hazard if a transpiled spec file uses top-level quasiquote or quoted dict literals; runtime quasiquote via CEK is correct on both hosts.

JS8. Stale JS host metadata + stale checked-in sx-full-test.js

• severity: low
• confidence: CONFIRMED (agent)
• where: bootstrap.py:2-11 docstring (refs deleted js.sx/run_js_sx.py/platform_js.py/shared/sx/ref/*), bootstrap.py:287 (bad default output path), cli.py:17 (_PROJECT one level too high → /root on sys.path), manifest.py (reports the hollow bundle as healthy); shared/static/scripts/sx-full-test.js (Apr 26, predates open-input-string → 35 --full failures)

C24. Python↔OCaml boundary validation is permanently a no-op (imports a nonexistent module)

• severity: high
• confidence: CONFIRMED (reproduced live, self-verified)
• where: shared/sx/boundary.py:34
• what: _load_declarations() does from .ref.boundary_parser import … but shared/sx/ref/boundary_parser.py does not exist (real file is hosts/python/boundary_parser.py). The ModuleNotFoundError is swallowed by a bare except Exception and NOT cached, so every validate_primitive/validate_io/validate_helper/validate_boundary_value silently returns without checking — even under SX_BOUNDARY_STRICT=1. The whole SX-boundary enforcement subsystem is dead. NOTE: shared/sx/ is load-bearing in production (Quart services render SX via the bridge), so this is not dead-host code.
• repro: SX_BOUNDARY_STRICT=1 python3 -c "from shared.sx import boundary; boundary.validate_primitive('definitely-not-a-primitive-xyz')" → pure: 0 and NO ERROR RAISED.

C25. Parser string-escape divergence corrupts data across the Python↔OCaml boundary (\0, \x, unknown escapes)

• severity: high
• confidence: CONFIRMED (reproduced live, self-verified)
• where: shared/sx/parser.py:108 (_ESCAPE_MAP) / :471 (serialize) vs hosts/ocaml/lib/sx_parser.ml:61-79
• what: Python maps \0→NUL and drops the backslash on unknown escapes (\x→x); OCaml treats \0 as literal backslash+zero and preserves the backslash on unknown escapes (\x→\x). Python serialize() emits \0 for a NUL char, so a 3-char Python string round-trips to a 4-char OCaml string — silent corruption on any path that serializes a NUL-bearing string and re-parses it in the kernel. </script also diverges (Python <\/script vs OCaml differently).
• repro: python3 -c "from shared.sx.parser import serialize; print(repr(serialize('a\x00b')))" → '"a\\0b"'; kernel (len "a\0b") → 4 (should be 3).

C26. Python parser accepts bare unicode symbols the OCaml kernel rejects → error or crash

• severity: high
• confidence: CONFIRMED (reproduced live, self-verified — see C1b)
• where: shared/sx/parser.py:158 (SYMBOL regex accepts €-￿) / :462 (serialize bare) vs sx_parser.ml:38 (ASCII-only)
• what: The Python tokenizer accepts unicode letters in symbol names and serializes them bare; OCaml's symbol charset is ASCII-only and raises Parse_error on the first non-ASCII byte. In an (eval "…") string it's catchable; on the command channel it's a fatal subprocess kill (C1b).
• repro: python3 -c "from shared.sx.parser import serialize; from shared.sx.types import Symbol; print(serialize(Symbol('café')))" → café (bare); kernel crashes on it.

C27. Dict key ordering not preserved across hosts (wire/golden/cache-key mismatch)

• severity: medium
• confidence: CONFIRMED (reproduced live, self-verified)
• where: shared/sx/parser.py:394-413 / :488-493 vs OCaml kernel dict serialization
• what: Python dict preserves insertion order; the OCaml kernel reorders/reverses. Any cache key, golden fixture, or wire payload relying on stable dict serialization mismatches between the Python-serialized form and the kernel-serialized form.
• repro: Python serialize(parse('{:a 1 :b "two"}')) → {:a 1 :b "two"}; kernel (quote {:a 1 :b "two"}) → {:b "two" :a 1}.

C28. Two distinct SxExpr classes; serialize() double-quotes the types.py one (nested wire corruption)

• severity: medium
• confidence: CONFIRMED (agent-reproduced)
• where: shared/sx/parser.py:71 and shared/sx/types.py:408 (two unrelated class SxExpr(str)); parser.py:441 isinstance checks only the parser one
• what: parser.SxExpr and types.SxExpr are unrelated classes. serialize() emits pre-built SX unquoted only for parser.SxExpr; a types.SxExpr falls through to the plain-string branch and is double-quoted/escaped. handlers.py:182 returns SxExpr(result_sx) (the types one), so any path nesting a handler result into an AST and re-serializing wraps the wire fragment in quotes.
• repro: serialize([Symbol('div'), types.SxExpr('(~inner :a 1)')]) → (div "(~inner :a 1)") (wrong) vs parser.SxExpr → (div (~inner :a 1)) (right).

C29. Reader-macro auto-resolution broken (OcamlSync.start() doesn't exist)

• severity: medium
• confidence: CONFIRMED (agent-reproduced)
• where: shared/sx/parser.py:57 (_sync.start()); shared/sx/ocaml_sync.py (class has _ensure, no start)
• what: _resolve_sx_reader_macro (auto-resolving #name reader macros like #z3) calls OcamlSync().start(), but OcamlSync exposes _ensure(). The AttributeError is caught by except Exception: return None, so every auto-resolve silently returns None → ParseError("Unknown reader macro: #…"). The feature is non-functional.
• repro: python3 -c "from shared.sx.ocaml_sync import OcamlSync; print(hasattr(OcamlSync(),'start'))" → False.

C30. Python standalone host (hosts/python/) is a non-functional stale target

• severity: medium
• confidence: CONFIRMED (agent-reproduced)
• where: hosts/python/bootstrap.py, platform.py, transpiler.sx
• what: hosts/python/ masquerades as a supported host but its bootstrapper emits syntactically invalid Python (if sx_truthy((len(*winders*) > …)) — SyntaxError) and can't produce a working evaluator. Nothing imports it except its own internal bootstrap→platform. The hosts/python/tests/ dir referenced by memory/RESTRUCTURE_PLAN.md does not exist. Transpiler also warns its spec has drifted (eval.sx dispatches forms not in special-forms.sx: provide, scope, define-record-type …).
• repro: python3 hosts/python/bootstrap.py > /tmp/t.py; python3 -c "import t" → SyntaxError at line 1564.

C31. shared/sx/tests/ is 14/33 files broken; test_ocaml_bridge.py has 5 live failures

• severity: medium
• confidence: CONFIRMED (agent-reproduced)
• where: shared/sx/tests/ (dangling shared.sx.ref.sx_ref imports); test_ocaml_bridge.py
• what: 14/33 test files fail collection (import the deleted shared.sx.ref.sx_ref). test_ocaml_bridge.py has 5 failures: test_parse_response_ok_number (the (ok N) epoch-ambiguity below) and 4 test_render_* that still use flat (let (x v) body) binding syntax the kernel now rejects (real Python-test/kernel drift).

C2. lib/r7rs.sx shadows string->number, dropping the spec's optional radix — spec test fails on the OCaml runner

• severity: medium
• confidence: CONFIRMED (baseline test failure + root cause isolated + differential vs bare server)
• what: spec/primitives.sx:1104 declares string->number with &rest (radix :as number), and the native prim (hosts/ocaml/lib/sx_primitives.ml:486) accepts 1–2 args. But lib/r7rs.sx:83 redefines it as (fn (s) ...) (1 param) and re-exports to the global namespace ("backward compatibility" import at end of file). Every environment that loads r7rs.sx (run_tests does, at run_tests.ml:3711) loses the radix arg: (string->number "ff" 16) → string->number expects 1 args, got 2. Note the adjacent number->string wrapper (r7rs.sx:76) does this correctly by delegating to the captured native prim for the radix case — string->number just wasn't given the same treatment. The shadow also changes 1-arg semantics (parse-int/parse-float vs the native parser).
• repro: baseline log line 4179 FAIL: > string->number: string->number expects 1 args, got 2 (spec/tests/test-math.sx:112). Bare server WITHOUT r7rs loaded: printf '(epoch 1)\n(eval "(string->number \"ff\" 16)")\n' | timeout 30 hosts/ocaml/_build/default/bin/sx_server.exe → 255 (correct).

C12. compile-modules.js SOURCE_MAP has 5 dead source paths that silently no-op

• severity: medium
• confidence: CONFIRMED
• where: hosts/ocaml/browser/compile-modules.js:38-49
• what: signals.sx→web/signals.sx, hypersx.sx→web/hypersx.sx, tw-layout/tw-type/tw.sx→web/tw-*.sx all point at files that no longer exist (moved to web/web-signals.sx, web/lib/hypersx.sx, shared/sx/templates/tw-*.sx). fs.existsSync guards make the skips silent, so edits to the real sources are never synced by this script — the rot vector that plausibly produced the C10 compiler drift.
• repro: for f in web/signals.sx web/hypersx.sx web/tw-layout.sx web/tw-type.sx web/tw.sx; do [ -f $f ] || echo MISSING $f; done → all 5 MISSING.

C13. test_platform.js broken — references deleted web/signals.sx (browser platform test tier unrunnable)

• severity: medium
• confidence: CONFIRMED
• where: hosts/ocaml/browser/test_platform.js:65
• what: The "full WASM + platform stack" Node test crashes at load: web/signals.sx was renamed to web/web-signals.sx and the file list was never updated.
• repro: timeout 60 node hosts/ocaml/browser/test_platform.js → Error: ENOENT … web/signals.sx.

C14. hosts/ocaml/browser/dist/ is an 8-week-stale duplicate bundle that sx-build-all.sh still feeds

• severity: medium
• confidence: CONFIRMED
• where: hosts/ocaml/browser/dist/ (72 files, May 7) vs shared/static/wasm/ (101 files, Jul 1-2); scripts/sx-build-all.sh:19-32
• what: Runtime serving is exclusively from shared/static/wasm/ (shared/sx/helpers.py:1080, sx_server.ml:3349/4525), but bundle.sh/compile-modules.js default to dist/ and sx-build-all.sh still syncs into and compiles from it — a full run can compile .sxbc from May-7-era sources for anything its sync list misses. Two half-overlapping bundle dirs are the root cause of C10/C11.
• repro: ls hosts/ocaml/browser/dist/sx | wc -l → 72 vs 101; dist mtimes 2026-05-07.

C15. Git-tracked stale kernel artifacts in hosts/ocaml/shared/static/wasm (5MB dead blob)

• severity: medium
• confidence: CONFIRMED
• where: hosts/ocaml/shared/static/wasm/{sx_browser.bc.js (5.0MB Apr 9), sx_browser.bc.wasm.js, sx-platform.js (Apr 16)}
• what: A wrong-cwd copy of the deployed wasm dir, committed to git, months stale (missing newer kernel exports like resetStepCount/setStepLimit); nothing references it.
• repro: git ls-files hosts/ocaml/shared/ → 3 files.

C19. HTML vs DOM adapter disagree on non-boolean attributes with raw boolean values (SSR/hydration mismatch)

• severity: medium
• confidence: CONFIRMED (HTML side run; DOM side unambiguous in source)
• where: spec/render.sx:render-attrs (~263-283) vs web/adapter-dom.sx:render-dom-element (~356-366)
• what: For an attr NOT in BOOLEAN_ATTRS with value true: HTML emits attr="true", DOM emits attr="". With value false: HTML emits attr="false", DOM omits the attribute. Any data-*/aria attr driven by a boolean diverges between SSR and client render → hydration mismatch + needless sync-attrs morph churn.
• repro: sx_harness_eval (render-to-html (quote (div :data-x false :data-y true :data-z nil))) → <div data-y="true" data-x="false"></div>; DOM branch produces data-y="" and drops data-x.

C20. CSRF token attached to cross-origin fetches; computed cross-origin flag is dead

• severity: medium
• confidence: CONFIRMED (code path) / SUSPECTED (browser-level exploitability)
• where: web/orchestration.sx:do-fetch (line 183 header injection, 207-208 cross-origin flag); consumer web/lib/boot-helpers.sx:fetch-request (354-390)
• what: do-fetch adds X-CSRFToken unconditionally (no origin gate) and computes a cross-origin field that fetch-request never reads (nor sets credentials/mode). Net: CSRF token leaks to third-party endpoints; the cross-origin classification is inert. No test exercises CSRF header injection or origin gating.

C21. Test harness IO model bypasses the real perform/suspend path (structural coverage gap)

• severity: medium
• confidence: CONFIRMED
• where: spec/harness.sx default-platform (line 34), make-interceptor (52), install-interceptors (55)
• what: The harness binds IO ops as plain synchronous NativeFns, never as perform-suspending primitives — so no harness test can exercise CEK suspend/cek-resume or the VM inline-settle path. The known HO+perform element-drop class (S10) is structurally invisible to the harness: (map (fn (u) (fetch u)) …) under a mock returns all elements because fetch is a direct call.
• repro: sx_harness_eval of (map (fn (u) (get (fetch u) "status")) (list "a" "b" "c")) with fetch mock → (200 200 200), all logged — real serving path is the one at risk.

C22. Harness interceptor logs IO call only after the mock returns — throwing mocks invisible

• severity: low
• confidence: CONFIRMED
• where: spec/harness.sx:make-interceptor (line 52)
• what: append! to the IO log happens after mock-fn returns; a raising mock leaves no log entry, so assert-io-called/count falsely report "never invoked" on error-path tests. (Positive side-finding: host IO errors DO surface as catchable SX errors.)
• repro: try-catch around (fetch "http://a") with mock raising "boom-io" → caught, but IO log shows "(no IO calls)".

C23. adapter-dom test suite tests membership predicates only — zero render-output tests

• severity: low
• confidence: CONFIRMED
• where: web/tests/test-adapter-dom.sx (18 deftests)
• what: All 18 tests assert *-is-a-render-form?/RENDER_HTML_FORMS membership; none test actual render-to-dom output (boolean attrs, on-*/bind/ref/key, reactive attrs, void elements, hydration cursor). The 1512-line DOM adapter holding C19 + hydration handoff is the thinnest-tested adapter relative to size.

C3. Dead stale-io-response guard in the epoch loop (13-char literal vs 14-char substring)

• severity: low
• confidence: CONFIRMED (reproduced live)
• where: hosts/ocaml/bin/sx_server.ml:5043-5046
• what: String.sub line 0 14 = "(io-response " compares a 14-byte substring to a 13-byte literal — never true, guard never fires. A stray (io-response …) line falls through to dispatch and emits an extra (error N "Unknown command …") reply instead of being silently discarded — an unexpected extra response for the client.
• repro: printf '(epoch 1)\n(io-response 1 42)\n(eval "5")\n' | timeout 60 …/sx_server.exe → (error 1 "Unknown command: (io-response 1 42)") then the eval reply.

C4. Malformed (epoch) / (epoch foo) doesn't update the epoch — responses tagged stale

• severity: low
• confidence: CONFIRMED (reproduced live)
• where: hosts/ocaml/bin/sx_server.ml:5051-5054
• what: Only (epoch <number>) updates current_epoch; malformed epoch markers fall through as unknown commands and the old epoch keeps tagging subsequent responses. A client whose epoch line was mangled will discard every following response as stale → hang.
• repro: printf '(epoch)\n(eval "2")\n(epoch foo)\n(eval "3")\n' | … → all replies tagged epoch 0.

C5. No monotonic-epoch enforcement despite protocol comment claiming it

• severity: low
• confidence: CONFIRMED (reproduced live)
• where: hosts/ocaml/bin/sx_server.ml:5051-5054, :4952-4955 (comment at :259-262)
• what: current_epoch := n unconditionally; decreasing/repeated epochs accepted silently, so client bugs/reordering mis-tag responses instead of being detected.
• repro: printf '(epoch 9)\n(epoch 3)\n(eval "42")\n' | … → (ok-len 3 2).

C6. Two commands on one line → both dropped with a single error (client desync)

• severity: low
• confidence: CONFIRMED (reproduced live)
• where: hosts/ocaml/bin/sx_server.ml:5055-5056
• what: A line parsing to >1 expr returns one (error … "Expected single command, got 2") and executes neither — a pipelining client gets a response-count desync. Related: a command with no preceding (epoch N) is answered under the previous epoch tag.

C7. vm-trace with compiler not loaded errors as "Not callable: nil"

• severity: low
• confidence: CONFIRMED (reproduced live)
• where: hosts/ocaml/bin/sx_server.ml:2193-2201 (vm-trace dispatch)
• what: If lib/compiler.sx isn't loaded (e.g. load failed because it is cwd-relative and the server was started from hosts/ocaml), (vm-trace "…") fails with the opaque (error N "Not callable: nil") instead of "compiler not loaded". Minor DX.
• repro: from hosts/ocaml: printf '(epoch 1)\n(load "lib/compiler.sx")\n(epoch 2)\n(vm-trace "(+ 1 2)")\n' | timeout 60 _build/default/bin/sx_server.exe → (error 1 "File error: …") then (error 2 "Not callable: nil").

C8. Stray triplicated source tree hosts/ocaml/hosts/ocaml/hosts/ocaml/

• severity: low
• confidence: CONFIRMED
• what: A nested duplicate of the OCaml tree (154 KB Apr-9 copy of sx_server.ml etc.) sits inside hosts/ocaml. Not built by dune, but a grep/edit-wrong-file trap.

C16. hosts/native is an orphaned but healthy PoC — builds green, referenced by nothing

• severity: low
• confidence: CONFIRMED
• where: hosts/native/ (own dune-workspace; lib_sx → ../../hosts/ocaml/lib symlink)
• what: SDL2/Cairo native SX renderer, single commit f0d8db9b (2026-04-09), unreferenced by scripts/CI/docs. NOT bit-rotted: compiles against current sx library and its smoke test passes (parse → 25-node render tree → layout → Cairo paint → PNG). Because it has its own dune-workspace, the main build never compiles it, so silent breakage would go unnoticed. Positive: it shares the evaluator by tracked symlink — no fork drift possible.
• repro: cd hosts/native && eval $(opam env) && timeout 280 dune build ./test/test_render.exe → exit 0; run → === All OK! ===.

C17. Tracked-but-dead browser files: sx-platform-2.js and 23 *.sxbc.json

• severity: low
• confidence: CONFIRMED (dead refs) / SUSPECTED (.sxbc.json fully unused)
• where: shared/static/wasm/sx-platform-2.js (Apr 16); shared/static/wasm/sx/*.sxbc.json
• what: sx-platform-2.js referenced by nothing. .sxbc.json written by mcp_tree.ml:1211 and copied by compile-modules.js:355, but the client loads the .sxbc SX-text format — no runtime reader found. All ~2.5 months stale vs their .sxbc twins.

C18. Untracked repo-root clutter: spa-debug.js, scripts/sx-sessions-restore.sh

• severity: low
• confidence: CONFIRMED
• what: spa-debug.js is a leftover Playwright compare of direct-load vs boosted SPA nav of relate-picker (Jun 30 debugging); sx-sessions-restore.sh is an ops script embedding session UUIDs + claude --dangerously-skip-permissions invocations. Commit, relocate, or remove.

C9. run_tests spec suites print with empty suite label

• severity: low
• confidence: CONFIRMED (baseline log)
• what: spec test suites (e.g. test-math.sx) report as FAIL: > string->number with a blank suite name in run_tests output — harness labeling defect, makes triage harder.

---

CROSS-HOST PARITY (CONFIRMED divergences — same expr, different result per host)

Enumeration (900-name universe): spec declares 202 primitives; OCaml resolves 536, JS 668, Python 112. Only 97 names common to all three. Spec primitives MISSING: OCaml 9 (eq? eqv? escape format format-date parse-datetime pluralize strip-tags sx-parse), JS 6 (downcase eq? eqv? equal? json-encode upcase), Python 108 (whole modules — see PY block). Differential battery files in scratchpad: battery*.json, parity-js.js.

P1. OCaml float serialization is lossy — SX-text wire round-trip destroys precision

• severity: high
• confidence: CONFIRMED (self-verified)
• where: hosts/ocaml/lib/sx_types.ml:415-423 (format_number uses %g = 6 sig digits for fractional floats)
• what: All fractional floats print with 6 sig digits; JS prints shortest-round-trip. Any value crossing the SX text wire (aser, epoch protocol, persisted SX) from OCaml silently loses precision. Integral floats ≥1e16 use %.17g (lossless) — inconsistent within the same host. This is the PRODUCTION evaluator, so it affects live wire payloads.
• repro (self-verified): OCaml (number->string (/ 1 3)) → "0.333333"; (+ 0.1 0.2) → "0.3"; (= (parse-number (number->string (/ 1 3))) (/ 1 3)) → false. JS same → true / 0.3333333333333333.

P2. OCaml sort breaks on mixed int/float lists (polymorphic compare on constructor tag)

• severity: high
• confidence: CONFIRMED (self-verified)
• where: hosts/ocaml/lib/sx_primitives.ml:1290-1292 (List.sort compare l)
• what: OCaml polymorphic compare orders Integer before Number by variant tag, so numerically mixed lists sort wrongly and silently.
• repro (self-verified): OCaml (sort (list 1.5 10 2)) → (2 10 1.5); JS → (1.5 2 10).

P3. into is not native on the OCaml kernel — routed over the IO helper bridge, fails standalone

• severity: medium
• confidence: CONFIRMED (self-verified)
• where: OCaml resolves into but execution emits (io-request N "helper" "into" …)
• what: A spec core.dict primitive requires a live Python-side helper on OCaml; JS/Python have it native. Any pure-OCaml context (tests, CLI, and notably the eval/load-source command paths that don't service helper IO) can't use into.
• repro (self-verified): OCaml (into {} (list (list :a 1))) → io-request then error … "IO bridge: stdin closed while waiting for io-response"; JS → {:a 1}.

P4. Exact-integer semantics diverge (OCaml int63 Integer vs JS float64)

• severity: high
• confidence: CONFIRMED (agent)
• where: hosts/ocaml/lib/sx_types.ml:47-48 (Integer distinct from Number); JS has only doubles
• what: Arithmetic differs beyond 2^53; literals above int63 silently become floats on OCaml with different text form; exactness is host-dependent and not wire-preserved (both serialize 1.0 as "1", which OCaml re-reads as exact Integer).
• repro: (+ 9007199254740992 1) → OCaml 9007199254740993, JS …992; (* 111111111 111111111) → OCaml 12345678987654321, JS …320; (float? 1.0) → OCaml true, JS false.

P5. JS = is not deep on dicts (spec: alias for equal?); equal?/eq?/eqv? missing from JS bundle

• severity: high
• confidence: CONFIRMED (agent + JS agent)
• where: hosts/javascript/platform.py:841 (sxEq falls through to false for plain-object dicts); no PRIMITIVES["equal?"/"eq?"/"eqv?"] in the JS bundle (run_tests.js:126 patches them only into the test env)
• what: = deep-compares lists but reference-compares dicts on JS; OCaml deep-compares both. And the spec equality trio is absent from the browser bundle — harness assertions (spec/harness.sx:82,85,88 call equal?) and any component using equal? crash client-side. OCaml also lacks eq?/eqv? (has non-spec identical? instead).
• repro: (= {:a 1} {:a 1}) → OCaml true, JS false; (equal? (list 1 2) (list 1 2)) → OCaml true, JS ERROR.

P6. String length/indexing units differ across hosts (UTF-8 bytes vs UTF-16 code units)

• severity: high
• confidence: CONFIRMED (agent)
• where: OCaml String.length (bytes) vs JS .length (UTF-16, platform.py:1386)
• what: Neither counts codepoints; any substring/index arithmetic on non-ASCII text diverges cross-host (and both differ from user-perceived length).
• repro: (len "héllo") → OCaml 6, JS 5; (len "🎉") → OCaml 4, JS 2.

P7. JS lenient-coercion cluster vs OCaml strictness (silent wrong values on the client)

• severity: medium (aggregate; several individually medium/high)
• confidence: CONFIRMED (agent + JS agent)
• where: hosts/javascript/platform.py (str 1138, range 1380, len 1386, cons 1391, get 1385, parse-int 1500, split 1148, round 1058, slice 1167, max/min 1065)
• what: JS coerces where OCaml errors/strict → divergent results the client renders silently: (str (list 1 2)) JS "1,2" (OCaml "(1 2)"); (str {:a 1}) JS "[object Object]" (OCaml "{:a 1}"); (range 3) JS () (OCaml (0 1 2)); (len nil) JS 2 (OCaml 0); (cons 1 nil) JS (1 nil) (OCaml (1)); (get {:a nil} :a 42) JS nil (OCaml 42); (get "abc" 1) JS "b" (OCaml nil); (parse-int "abc") JS 0 (OCaml nil); (parse-int "42px") JS 42 (OCaml nil); (split "abc" "") JS ("abc") (OCaml ("a" "b" "c")); (round -2.5) JS -2 (OCaml -3); (slice "hello" -3) JS "llo" (OCaml "hello"); (max) JS -Infinity (OCaml errors); (+ 1 "2") JS "12" (OCaml 3); (mod 10 0) JS NaN (OCaml Division_by_zero).

P8. nil/list-strictness family diverges, some arms violating the spec on OCaml's side

• severity: medium
• confidence: CONFIRMED (agent)
• where: OCaml sx_primitives.ml strict arms vs JS lenient (platform.py:1391-1392)
• what: (merge nil {:a 1}) → OCaml ERROR (spec says skip nil → OCaml BUG) vs JS {:a 1}; (contains? {:a 1} :a) → OCaml ERROR "contains?: 2 args" (spec: dict key check → OCaml BUG) vs JS true; (append nil (list 1)) → OCaml (1) vs JS ERROR; (cons 1 2) → OCaml ERROR vs JS (1 2); (reverse "abc") → OCaml ERROR vs JS "cba".

P9. Dict key ordering differs per host (Hashtbl vs insertion order) — SX text wire not canonical

• severity: medium
• confidence: CONFIRMED (agent; also self-verified in the Python block C27)
• where: OCaml dicts are Hashtbl (arbitrary bucket order); JS objects preserve insertion; Python preserves insertion
• what: keys/vals iteration order and serialized dict text differ per host — anything comparing or hashing serialized SX text cross-host diverges. CBOR/CID layer is safe (sx_cbor.ml:67 sorts keys).
• repro: (keys {:z 1 :a 2 :m 3}) → OCaml ("m" "z" "a"), JS ("z" "a" "m").

P10. NaN/Infinity are not portable wire tokens; JS can't re-read its own output

• severity: medium
• confidence: CONFIRMED (agent)
• where: sx_types.ml:416-418 prints nan/inf/-inf (OCaml re-reads all forms) vs JS prints Infinity/NaN (resolves neither)
• repro: (/ 1 0) → OCaml inf, JS Infinity; eval Infinity → OCaml inf, JS ERROR undefined symbol.

P11. upper/lower Unicode behavior differs; upcase/downcase aliases missing on JS; round half-mode differs

• severity: medium
• confidence: CONFIRMED (agent)
• where: sx_primitives.ml:890-897 (uppercase_ascii) vs platform.py:1145 (full Unicode); JS lacks upcase/downcase; round half-mode
• repro: (upper "héllo") → OCaml "HéLLO", JS "HÉLLO"; (upcase "x") → OCaml "X", JS ERROR; (round -2.5) → OCaml -3, JS -2.

P12. OCaml zip-pairs chunks pairs; spec + lib/stdlib.sx define a sliding window (kernel diverges from its own spec)

• severity: medium
• confidence: CONFIRMED (JS agent handoff)
• where: OCaml native zip-pairs vs spec/primitives.sx:663 + lib/stdlib.sx:207 (JS matches spec)
• what: OCaml native zip-pairs returns ((1 2)(3 4)) but the spec + stdlib define sliding window ((1 2)(2 3)(3 4)). Handoff to core, but the OCaml host is the one diverging from the spec.

PY (Python host). Standalone hosts/python/ cannot evaluate the current spec at all

• severity: critical (as a supported target) — see C30 for the standalone-host summary
• confidence: CONFIRMED (agent)
• where: hosts/python/bootstrap.py:119 (_mangle), generated lines 1564/3482/3498; spec match form
• what: Four independent breaks in the Python bootstrapper: (1) _mangle RENAMES lacks *winders* → SyntaxError; (2) no rule for -> in names → def string_>symbol invalid; (3) the match special form is emitted as an eager function call → undefined match, and even shimmed it evaluates all branches eagerly (core dispatch unrunnable); (4) references missing natives make-char/aser-call/aser-fragment. Python resolves only 112 of the 900-name universe and lacks 8 primitive modules (math/bitwise/bytevectors/vectors/regexp/sets/rational/hash-table = 108 spec primitives). This overlaps/extends C30. NOTE: shared/sx/ Python (parser+bridge) IS load-bearing in production; the standalone evaluator host is what's dead.
• repro: python3 hosts/python/bootstrap.py > /tmp/x.py && python3 -c "import x" → SyntaxError line 1564; after mangle-patch, (+ 1 2) → name 'match' is not defined.

---

(informational) ok-len framing is byte-accurate and desync-resistant

• confidence: CONFIRMED — length prefixes are byte counts; newlines/framing patterns in payloads are escaped; multibyte UTF-8 counted correctly. (Positive result.)

(informational) WASM browser kernel boots green; kernel is single-source with server

• confidence: CONFIRMED — test_boot.sh → WASM boot: OK; test_wasm.sh → 29/29; test_kernel.js → 24/24; deployed kernel artifacts byte-identical to _build outputs. Browser links the identical sx OCaml library as sx_server (no evaluator fork); only sx_browser.ml FFI glue is browser-specific. (Positive result.)

---

SUSPECTED (reasoning only) — NOTE: S1/S4/S5 UPGRADED to CONFIRMED via live HTTP repro

Follow-up live testing (bounded sx_server --http on free ports, 3 runs) upgraded three of the HTTP-race items and clarified two more:

• S1 CONFIRMED — observed a live intermittent crash (empty responses, no exception, OOM ruled out at ~292 MB peak) under concurrent multi-Domain load.
• S4 CONFIRMED — routing-failure page served as HTTP 200 and cached (cold 2.02s → warm 0.0005s).
• S5 CONFIRMED — cache key ignores cookies (3 different session= → identical cached body) and query.
• S2/S3 remain SUSPECTED — mechanism verified live in the code path, but no visible symptom is triggerable in the stock static-docs app (no full-page route renders request args / no expansion-sensitive component to observe). They become observable on request-varying apps. Their entries below carry updated per-finding confidence lines.

S1. HTTP mode: shared mutable state raced across parallel render-worker Domains — LIVE CRASH OBSERVED

• severity: high
• confidence: CONFIRMED (live crash reproduced once; race is real by construction) — was SUSPECTED
• where: hosts/ocaml/bin/sx_server.ml:4717 (Domain.spawn × max 4 (recommended_domain_count)), :4312/:4677 (Hashtbl.replace response_cache from workers + main), :4654 (main reads it), :2666-2670 (env.bindings bind+remove), :345 (_stream_mutex created but NEVER locked)
• what: http_mode spawns 4 real Domain.spawn workers rendering full-page requests on the single shared env, concurrently with the accept-domain doing AJAX renders. There is no lock around rendering. Workers + main mutate process-global Stdlib.Hashtbls (response_cache, env.bindings) concurrently; OCaml 5 Stdlib.Hashtbl is NOT domain-safe (memory corruption on rehash → segfault, no catchable exception). The comment at :4204 claiming cache writes happen "only during single-threaded startup" is false (workers write at runtime); the :343-345 comment admits "concurrent CEK evaluations corrupt shared state".
• LIVE REPRO (self-verified). Booted sx_server --http <port> on a free port (3 runs). Under a burst of ~300 concurrent AJAX + ~150 concurrent full-page requests to distinct uncached paths (all 4 worker Domains + main thread writing response_cache/env.bindings simultaneously), run 2 CRASHED: the process vanished mid-render — no OCaml exception logged (the try/with at :4315 would have printed [render] Error; none present), no "Binary changed" restart, and a concurrent poll of a known-good cached page began returning EMPTY bodies (md5 of "") for 59/60 reads as the server died. OOM ruled out: run 3 under an even heavier burst survived with peak RSS ~292 MB (baseline ~200 MB) — memory never approached exhaustion. The crash is INTERMITTENT (run 1 clean, run 2 crashed, run 3 survived) — the classic signature of a data race, not a deterministic fault. Net: the production HTTP server can crash under concurrent load; I couldn't capture a core dump (apport core_pattern, restricted) to pin the exact fault address, so the "Hashtbl-rehash-segfault" mechanism is inferred from the crash profile + the unsynchronized-access code, not a stack trace. Logs: /tmp/sx-review/http-server{,2,3}.log.

S2. HTTP mode: per-request state is process-global → cross-request contamination

• severity: high
• confidence: SUSPECTED (mechanism confirmed live; visible symptom not triggerable in the stock docs app)
• where: sx_server.ml:4335-4354 (main domain sets _req_method/_req_query/_req_headers/_req_body
  • Hashtbl.clear/replace _request_cookies), :4703 (full-page render QUEUED to a worker with only (fd, path, headers) — NOT the request context), consumed by request-* primitives at :3772-3829
• what: I confirmed live that full-page misses are queued to worker Domains carrying only the path, while the worker's render reads the process-global _req_query/_req_body/_request_cookies that the main loop overwrites on the very next request. So a queued render can read a subsequent request's query/body/cookies (plus a plain main-writes-while-worker-reads data race). I could NOT produce a visible crossed-value symptom because the sx-docs app has no full-page route that renders (request-arg …)/get-cookie/body into its output — the docs pages are static. The contamination is therefore structurally present and live-reachable but only becomes observable for an app whose full-page renders vary by request args (e.g. any of the real Quart-replacement domains). Kept SUSPECTED honestly: mechanism verified, symptom not exhibited on the stock app.

S3. expand-components? global binding removed mid-flight by AJAX render

• severity: medium
• confidence: SUSPECTED (bind/remove verified live in code path; visible symptom not isolated)
• where: sx_server.ml:4157 (bound globally = true for ALL renders), :2666/:2670 (AJAX branch binds then Hashtbl.remove env.bindings "expand-components?")
• what: http_mode binds expand-components? once globally so full-page worker renders expand components. The AJAX branch of http_render_page binds and then REMOVES it on the SAME shared env — so after any AJAX request the global binding is gone, and a concurrent (or subsequent) full-page aser render can observe it vanished (components silently not expanded), plus the remove races worker lookups. Confirmed the bind/remove-on-shared-env code path executes during live AJAX requests (the log shows "[sx-http] … (SX) aser=" for every AJAX hit); did not isolate a visibly-unexpanded component in output because the docs pages' aser output is SSR-expanded through a different path. Mechanism confirmed; symptom not pinned.

S4. Response cache stores soft error pages (routing failures cached as HTTP 200) — LIVE CONFIRMED

• severity: medium
• confidence: CONFIRMED (self-verified live) — was SUSPECTED
• where: sx_server.ml:2635-2658 (error_page_ast returned as Some body), cached at :4312/:4677
• what: A routing failure renders error_page_ast returned as a normal Some body and served with HTTP 200; the worker/ajax paths cache any Some body. So the not-found/error page is cached and served from cache to every subsequent visitor until restart. (Hard 500s from raised exceptions at :4315 are NOT cached; soft error pages ARE.) The "transient cross-service failure" sub-case (a fetch error rendered into the page, then cached) is reasoned from the same code path but needs the Python bridge to trigger, so it stays inferred.
• repro (self-verified): GET /sx/<random-nonexistent-path> → HTTP 200 containing the "404"/not-found page; a 2nd GET of the same path returned byte-identical bytes served from cache — cold render 2.02s vs warm 0.0005s (~4000×), and the server log shows only ONE render line for that path.

S5. Response cache keying ignores cookies/query/auth (except one hardcoded cookie) — LIVE CONFIRMED

• severity: medium
• confidence: CONFIRMED (self-verified live) — was SUSPECTED
• where: sx_server.ml:4296/:4651-4654 (cache_key = path, +ajax:/htmx: prefix), :4649 (only sx-home-stepper bypasses the cache), :4331-4332 (query stripped before keying)
• what: The cache key is the path only; cookies (except the hardcoded sx-home-stepper) and the query string are absent from it. Any page whose output varied by cookie/session/auth or query would be cached under a shared key and served across users. Benign for the current public docs (pages don't vary by cookie), but a real footgun for the cookie/auth-dependent Quart-replacement domains.
• repro (self-verified): GET /sx/(geography.(hypermedia)) with three different Cookie: headers (different session= values) → three byte-identical responses from one cache entry; same path with ?u=1 vs ?u=2 → byte-identical (query stripped from key).

S8. Browser env missing spec platform constructors + a small primitive tail — latent break for shared modules

• severity: medium
• where: sx_browser.ml:626+ (91 server-only binds vs 22 browser-only; lists in scratchpad server-binds.txt / browser-binds.txt)
• what: make-lambda/make-component/make-macro/make-thunk, now, json-encode, parse-safe, pretty-print, into are bound only in sx_server's env, absent client-side. Currently harmless (spec/evaluator.sx isn't shipped to the browser; the only consumer of the latter group is web/io.sx, not bundled) — but any shared .sx module that starts using them silently breaks in the browser only.

S9. Aser/SPA boosted-nav component expansion still fragile — hinges on boot-manifest eager-load fed by stale artifacts

• severity: medium
• where: web/adapter-sx.sx; sx-platform.js:649-660 (page-manifest boot array); lib/host/sx/relate-picker.sx; bundle.sh:74-77
• what: The April blocker was fixed (ac65666f) and Jun-29 commits added server-embedded data-sx-manifest eager-loading, but the untracked Jun-30 spa-debug.js shows boosted-nav expansion of the picker was still being debugged the next day — and both the stale served compiler (C10) and stale module-manifest.sx (C11) sit directly on this code path.

S10. VM inline-resolve of IO inside HO-primitive callbacks cannot suspend/resume (async-IO correctness cliff)

• severity: high
• confidence: SUSPECTED (documented + code-confirmed; not reproducible through the harness — see C21)
• where: hosts/ocaml/lib/sx_vm.ml:call_closure_reuse (~349-375); _cek_io_resolver installed at sx_server.ml:4166
• what: When perform fires inside a JIT/VM HO-primitive callback (map/filter/reduce/for-each), the native OCaml loop sits between perform and resume, so it can't unwind-and-resume; it resolves IO inline via a local settle loop. The in-code comment states the alternative "would drop the remaining elements — corrupting the stack so the next CALL_PRIM sees wrong args." This works only because durable-KV reads are synchronous; a genuinely async IO op inside an HO callback on the serving path is not correctly supported. This is the same hazard class as the memory note about serving JIT dropping all-but-first in map/for-each.

S11. Server page routing evaluates the URL as SX — any env-bound function is URL-invokable

• severity: medium
• confidence: SUSPECTED
• where: web/request-handler.sx (sx-url-to-expr, sx-auto-quote, sx-eval-page/call-page); driven by sx_server.ml:http_render_page:2620 (sx-handle-request)
• what: sx-url-to-expr strips /sx/, splits on ., joins with spaces; call-page parses and invokes it. sx-auto-quote only quotes unbound symbols, so a bound symbol as list head is called with attacker-supplied (recursively evaluated) args. A path with parens (a legal path char) can reach (env-get env "some-fn") + apply for any render-env binding. cek-try swallows errors (→ nil/error page) limiting impact, but this is an SSR eval surface worth whitelisting to page:-prefixed bindings. Couldn't confirm whether the OCaml front door pre-sanitizes the path.

S12. Island hydration replaceChildren-then-render → hydration cursor reuses no SSR DOM

• severity: low
• confidence: SUSPECTED
• where: web/boot.sx:hydrate-island (~333-350)
• what: hydrate-island calls (host-call el "replaceChildren") (empties the element) then renders the body in sx-hydrating mode. But the hydration matcher reads childNodes.item(idx) on the just-emptied element, so it reuses nothing — effectively clear-and-fresh-render. If intended, the sx-hydrating scope push is dead work; if not, element-rooted islands never reuse SSR DOM. Not runnable through the DOM path to confirm.

S13. SSR/client parity relies on island body being pure over serialized kwargs (no dev-mode check)

• severity: low
• confidence: SUSPECTED
• where: web/adapter-html.sx:render-html-island + serialize-island-state (608) vs web/boot.sx:hydrate-island
• what: Only kwargs are serialized into data-sx-state; a body reading request-scoped/ non-deterministic IO (now, request-arg, random) or scope/context values not in kwargs produces SSR HTML differing from the client render → hydration mismatch. Inherent to the design, but there's no guard or dev-mode mismatch check and no test for a non-pure body.

S14. Deep (≥2-level) nested-list children flatten differently between HTML and aser

• severity: low
• confidence: SUSPECTED
• where: spec/render.sx render-list path (recursive) vs web/adapter-sx.sx:aser-call/aser-fragment (one-level flatten)
• what: HTML recursively flattens arbitrarily nested child lists to text; aser flattens one level and serializes deeper lists structurally. Single-level map output agrees (tested), but 2+-level raw nesting could serialize differently between modes. No test covers depth ≥ 2.

S-bridge. Python↔OCaml bridge desync on coroutine cancellation is unrecoverable (dead _restart, no timeouts)

• severity: high
• confidence: SUSPECTED (bridge-side reasoning; kernel-side stale-message mechanism self-verified)
• where: shared/sx/ocaml_bridge.py:99 (_restart, 0 callers), :613 (_read_until_ok), :139 (async with self._lock)
• what: render/eval/aser hold self._lock while blocked in _read_until_ok awaiting a kernel io-response. If the awaiting coroutine is cancelled (client disconnect / timeout), the async with releases the lock while the kernel is still blocked in read_io_response for the OLD epoch. The next coroutine acquires the lock and sends (epoch N+1)\n(command); the kernel — still inside read_io_response — consumes both lines as "stale messages" and keeps blocking, so the new command never runs and the new coroutine hangs on _readline forever. No asyncio.wait_for wraps bridge calls, and _restart() pipe-recovery is never invoked, so the bridge can't self-heal — it stays wedged until the process is killed. Under a shared multi-Domain HTTP server (S1/S2) this is a real liveness hazard.
• repro (self-verified, kernel-side mechanism): printf '(epoch 1)\n(eval "(helper \"w\" 1)")\n(epoch 2)\n(eval "(+ 1 2)")\n' | timeout 20 hosts/ocaml/_build/default/bin/sx_server.exe → (io-request 1 "helper" "w" nil), then [io] discarding stale message (…) ×2 eating the epoch-2 command, then the epoch-2 eval never runs.

S-bridge2. _parse_response treats a numeric result value as an epoch (ambiguity)

• severity: low
• confidence: CONFIRMED (agent)
• where: shared/sx/ocaml_bridge.py:915, shared/sx/ocaml_sync.py:115
• what: (ok EPOCH VALUE) parsing strips a leading number as the epoch, but the guard line[4:-1].isdigit() classifies (ok 3) as epoch-only-no-value and returns ('ok', None) instead of ('ok','3'). Latent (kernel always emits (ok EPOCH VALUE)), but the digit-sniffing epoch strip is fragile for any value that begins with a digit. test_ocaml_bridge.py has 5 live failures incl this.

S6. io_request-based primitives under eval can consume subsequent command lines

• severity: low
• where: sx_server.ml:617-669 (query/action/helper → blocking read_io_response), eval dispatch at :1816
• what: query/action/helper block reading the next stdin line as an IO response; under a client that doesn't speak the IO sub-protocol, the next queued command is consumed → desync/hang.

S7. Multiple eval entry points with divergent IO semantics for the same source

• severity: low
• where: eval (:1816-1849, import+persist inline), load-source (:1772-1783, no IO handling), load (:1755, full eval_expr_io), http render (:2575, import→nil)
• what: The same source behaves differently depending on the wrapping command — the known "unify eval/JIT paths" TODO surfacing as behavioral drift.

---

Notes / baseline caveats

• 272/274 baseline run_tests failures are the in-progress hyperscript (hs-*) suites — guest-language project, not host defects. Undefined symbols: hs-is-set? (16), eval-hs-error (18), hs-ref-eq (4), host-hs-normalize-exc (2), plus DOM-mock assertion failures.
• run_tests JIT is opt-in (--jit, run_tests.ml:4035). Baseline ran interpreter-only ([jit] calls=3045835 hit=0 miss=0 skip=3045835). A --jit differential run is in progress to diff pass/fail sets — results pending.
• sx_scope.ml does not exist on this branch (only in sibling worktrees); memory/docs referencing it are stale for architecture. Scope prims live in sx_primitives.ml as process-globals (see S1/handoffs).

Handoffs to other lanes

• core: served browser JIT compiler missing 921db09f's HO-loop desugar (see C10) — the browser-side --jit == CEK parity fix needs a re-sync + recompile pipeline fix.
• conformance: module-manifest format split (C11) — regenerate .sx or point sx-platform.js at .json; until then hs-worker/hs-prolog never lazy-load client-side.
• conformance: hosts/native has a working test nothing runs; test_platform.js needs web/signals.sx → web/web-signals.sx to restore the browser platform test tier.
• hygiene: unify dist/ vs shared/static/wasm/ behind one sync script; delete the ignored hosts/ocaml/hosts/ nest, tracked stale hosts/ocaml/shared/static/wasm blobs, sx-platform-2.js, and (if reader-less) *.sxbc.json.
• core (spec/render.sx parity): render-attrs renders non-BOOLEAN_ATTRS boolean-valued attrs as attr="true"/attr="false" while adapter-dom emits attr=""/omits — pick one contract and align all four adapters; add conformance cases (see C19).
• conformance (spec/harness.sx): (1) log the IO call before invoking the mock so throwing mocks are recorded (C22); (2) add a harness mode that routes IO through real perform/cek-resume so the HO+perform element-drop cliff (S10) becomes testable (C21).
• host (sx_vm.ml): add a targeted conformance test performing IO inside a JIT-compiled HO callback over a function-produced list — the inline-settle path is a correctness cliff for any future genuinely-async seam IO op (S10).
• core: _scope_stacks / _request_cookies / _req_* being process-global means scope/provide/emit! and request primitives are not isolable per concurrent flow; spec scope semantics assume single-flow evaluation. Needs a per-flow story if the OCaml HTTP server stays multi-Domain.
• core: eval vs load-source vs load vs http-render resolve import/durable IO differently — converge on one IO-resolution policy.
• core/eval: scope/emit! appears to LEAK across invocations — (scope (emit! :k 1) (emit! :k 2) (len (emitted :k))) returns 2, 4, 6… cumulatively across epoch-server calls, with JIT disabled too (so not a VM bug — looks like a scope-stack state leak in scope-in-frames or the epoch env's scope stack). Flagged by the VM/JIT agent.
• core/docs: let is SEQUENTIAL (let*) in BOTH CEK and VM ((let ((x 2) (y x)) y) → 2 with outer x=1) — contradicts the documented "let is parallel" authoring rule. Engines agree; docs don't.
• core/spec: nested quasiquote evaluates inner unquotes at depth 2 on both OCaml and JS (`(a `(b ,(c))) errors) — nonstandard but consistent; needs a spec ruling.
• core/spec: = deep-on-dicts, eq?/eqv?/equal?, upcase/downcase, json-encode, 1-arg range, empty-sep split, parse-int failure, get stored-nil-vs-default, (max), round half-negative, string-length units, exactness-across-wire — all need normative rulings; then each host aligned. OCaml wire float printing (%g) should be shortest-round-trip; OCaml sort numeric-compare Integer/Number; OCaml into/contains?-on-dict/merge-skip-nil made native+conformant; OCaml zip-pairs reconciled with its own spec.
• conformance: NO differential CEK-vs-JIT parity suite exists — all four silent-wrong-value JIT bugs (J1 ->, J3 macro-arg, J4 component-kwargs, J5 stale opcodes) pass the existing tests. A harness that runs each conformance expr both interpreted and through a forced-JIT wrapper would catch them. Also add a cross-host differential battery (scratchpad battery*.json) — the spec corpus currently runs green only against OCaml; the JS bundle is 2490 failing and the Python standalone host can't load.
• conformance: add a protocol-fuzz suite for the epoch loop (malformed line must not crash; (epoch)/(epoch foo); stray (io-response …); two-exprs-per-line).
• conformance: no suite catches the r7rs string->number radix shadow — the spec test fails only in the OCaml runner env; JS/Python runner r7rs load status differs.

Recommended triage / next steps

This is a reviewer's suggested reading order, NOT a verdict — severity/confidence tags on each finding are the ranking signal; a maintainer decides what blocks a release. No new claims here; every item points back to the evidence above.

Confirmed-severe clusters, in suggested blocker order:

1. Production serving-JIT silently miscompiles (J1–J8). Highest concern because it produces wrong values with no error on the live sx.rose-ash.com HTTP path (JIT hook is unconditional at sx_server.ml:4163 — see the reconciliation note; the "opt-in/default-off" belief does not apply to http_mode). J1 (-> in arg position) and J3 (macro args) return wrong results; J2 double-applies side effects on fallback (a data-integrity risk for persist/counter writes). Blast radius depends on whether rendered lambdas hit those patterns — a fleet audit of served pages, or disabling the http_mode JIT hook until fixed, is the pragmatic call. Fix lives in lib/compiler.sx (compile-thread-step at 934-951 for J1) + macro handling in the compiler/VM.

2. Process-killing parse crash (C1 / C1b). One malformed or non-ASCII line on the command channel kills the whole sx_server process — it's the shared channel for the Python bridge and conformance runners. Small, localized fix (wrap the command-channel parse at sx_server.ml:5048/:4950 in a handler that catches Parse_error). Cheap to fix, high blast radius; good early win.

3. HTTP serving path breaks under concurrency (S1 / S4 / S5). S1 crashed the live server intermittently (data race on unsynchronized cross-Domain Hashtbls, OOM ruled out) — needs either a lock around cache/env mutation or per-Domain state. S4 (error pages cached as 200) and S5 (cache key ignores cookies/query) are cheap keying fixes but S5 becomes a cross-user data-leak on any cookie/auth-varying domain, so fix it before the Quart-replacement domains go live on this server.

4. Hollow JS bundle + red JS CI (C0a / C0b). Breaks conformance/CI, not visitors (the live site serves the wasm kernel). Fix is a define-library-aware extract_defines (hosts/javascript/platform.py:15) plus loading the newer lib deps + make-rtd/dom prims — or, if the JS host is being retired, stop CI gating on it. A product/ownership decision as much as a code fix.

Not-yet-symptomatic, needs a real app to exercise:

• S2 (queued workers read process-global request context) and S3 (expand-components? removed on the shared env) are mechanism-confirmed but only exhibit a visible symptom on a full-page route that varies by request args/cookies. Re-run the S1-style concurrent-load repro against one of the real Quart-replacement domains (not the static docs site) to turn these CONFIRMED or clear them.

Cross-cutting, lower urgency:

• Cross-host parity (P1–P12) and the Python boundary/bridge issues (C24–C31, S-bridge) matter most if the JS/Python hosts are still targets; if OCaml is the sole production evaluator, prioritize the OCaml-side ones that affect the wire (P1 lossy float, P9 dict order, P3 into).
• Hygiene items (C8, C14–C18) are safe cleanups, no behavior change.

Handoffs above route the core/conformance-owned items (scope leak, let-sequential docs, the missing CEK-vs-JIT differential suite) to the sibling review lanes — not this lane's to fix.