- web.ts: outbound downloads resolve DNS once, validate the address, and
connect to the validated IP directly, closing the DNS-rebinding TOCTOU
window; malformed SearXNG result URLs are skipped instead of failing the
whole search; web cache is bounded (evicts oldest past 500 entries).
- experiment.ts: reviewer must not be a descendant of the experiment author
(tool-level lineage check on top of the author-id check); stdout/stderr
buffers capped at 512 KB.
- Confirmed Pi's extension tool registry is per-extension-instance, so
reload re-registration is safe; no change needed there.
- Adds a lineage-independence test (39 tests passing, tsc clean).
Emil