probe	rule	phase	note	nurlc
h01_forward_returning_callee	CallT.summary	A1	callee returns its param; result aliases arg, both freed (double free)	rejected
h02_conduit_read_after_owner_release	§2.12	A2	Vec stored in struct field, field freed, original name read	rejected
h03_user_wrapper_drops_elements	CallT.sink	A1	String pushed (moved) into Vec, user fn clears Vec, original name read	rejected
h05_closure_kept_by_callee	§2.11	A2	closure capturing String kept by callee in struct; String freed, closure run	rejected
h07_stale_view_after_push	StmtT.push	A1	string_data view taken, String grown by push_str in loop, view read	rejected
h08_defer_return_seam	§7.1	A2	owned value before a defer returned on one path only (leak)	runs-clean
h09_race_shared_vec	§6.5	A3	two threads push into one Vec captured by both closures	rejected
h16_option_payload_then_original	§2.1	A2	String moved into Option payload, consumed, original read	rejected
h18_thread_reads_freed	§6.5	A3	spawned thread reads a String the spawning thread frees	rejected
h21_chan_send_then_use	§6.5	A3	String sent on channel then read by sender after receiver freed it	rejected
h23_generic_returns_param	CallT.summary	A1	identity result lends from a; a freed then result freed: double free	rejected
h24_vec_elem_handle_alias	StmtT.free	A1	vec_get element borrow read after the Vec is freed	rejected
h25_field_reassign_old_alias	§2.10	A2	view of a struct's String field read after the field is reassigned	rejected
h26_view_stored_in_map	PushArg	A1	string view stored as map key; String freed; map read	rejected
h27_view_stored_in_vec	PushArg	A1	string view pushed into a Vec of views; String freed; element read	rejected
h28_view_kept_by_user_fn	CallT.summary	A1	callee stores view into its container argument; String freed; read	rejected
h29_view_kept_by_forward_fn	CallT.summary	A1	later-defined callee stores view into arg; owner dies at block end	rejected
h30_struct_raw_field_alias	§2.13	A2	struct with owned raw-string field copied out of block; field freed	rejected
h31_struct_field_into_byref_capture	§2.11	A2	struct with raw-string field copied into binding captured by reference	rejected
h32_slice_view_after_free	StmtT.free	A1	Slice of a Vec read after vec_free	rejected
h33_slice_view_after_grow	StmtT.push	A1	Slice of a Vec read after vec_push reallocates	rejected
h34_slice_sub_after_free	derive	A1	sub-slice of a slice read after the root Vec is freed	rejected
h35_slice_returned_by_user_fn	CallT.summary	A1	callee returns Slice of its parameter; Vec freed; slice read	rejected
h36_slice_of_local_returned	FnOK	A1	function returns a Slice of its own local Vec	rejected
h37_slice_in_user_struct	§2.12	A2	Slice stored in a user struct; Vec freed; read through struct	rejected
h38_proto_reader_after_free	CallT.summary	A1	ProtoReader lent from a Vec read after the Vec is freed	rejected
h39_slice_captured_by_closure	§2.11	A2	closure captures Slice; Vec freed; closure runs	rejected
h40_slice_stored_in_vec	PushArg	A1	Slice pushed into Vec of Slices; source Vec freed; element read	rejected
h41_slice_of_replaced_field	§2.10	A2	Slice of a struct's Vec field read after field gets a new Vec	rejected
h42_slice_after_vec_reassigned	StmtT.assign	A1	Slice read after its Vec binding is reassigned	rejected
h43_slice_after_vec_sunk	CallT.sink	A1	Slice read after its Vec was passed to a sink parameter	rejected
h44_slice_crosses_thread	§6.5	A3	thread closure captures Slice while spawner frees the Vec	rejected
h45_slice_of_element_vec	derive	A1	Slice of a borrowed inner Vec read after the outer Vec is freed	rejected
h46_view_in_struct_literal	§2.12	A2	string view stored in struct literal; String freed; field read	rejected
h47_view_stored_in_global	§2.10	A2	view of a local String stored into a global; String dies; global read	rejected
h48_view_returned_by_user_fn	CallT.summary	A1	callee returns view of its String param; String freed; view read	rejected
h49_view_in_option	§2.12	A2	string view wrapped in an Option; String freed; payload read	rejected
h50_borrow_outlives_block	exitScope	A1	element borrow assigned to outer binding; Vec dies at block end	rejected
h51_slice_from_raw_bogus_len	§6.4	B	slice_from_raw over Vec buffer with a length it does not have	rejected
h52_slice_literal_bogus_len	§6.2	B	Slice literal forged in safe code with bogus length	rejected
h53_slice_len_field_write	§6.2	B	safe write of a Slice's len field past its buffer	rejected
h54_slice_null_with_len	§6.2	B	null-data Slice literal with nonzero length	rejected
h55_vec_handle_forged	§6.2	B	Vec handle forged by struct literal from a String's raw view	rejected
h56_vec_ctl_field_write	§6.2	B	one Vec's ctl field copied into another: two owners of one block	rejected
h57_box_ptr_field_copied	§6.2	B	Box literal built from another Box's ptr field: two owners	rejected
h58_cast_int_to_string	§6.2	B	String forged from an integer by a cast	rejected
h59_handle_smuggled_through_int	§6.2	B	Vec handle cast to int, Vec freed, int cast back to a Vec	rejected
h60_vec_set_len_uninit	§6.4	B	vec_set_len exposes uninitialised String elements	rejected
h61_vec_borrow_raw_outlives	§6.4	B	vec_borrow_raw over another Vec's buffer outlives it	rejected
h62_vec_borrow_raw_bogus_len	§6.4	B	vec_borrow_raw with a length the buffer does not have	rejected
h63_slice_and_vec_to_grower	CallT.args	A1	Slice and its Vec passed to one fn that grows the Vec then reads Slice	rejected
h64_borrow_and_vec_to_clearer	CallT.args	A1	element borrow and its Vec passed to fn that clears Vec then reads borrow	rejected
h65_view_and_string_to_grower	CallT.args	A1	view and its String passed to fn that grows String then reads view	rejected
h66_inout_struct_and_borrow	CallT.args	A1	inout container and borrow of its element in one call; callee clears	rejected
h67_same_vec_two_params	CallT.args	A1	one Vec passed to two params; callee clears one while borrowing other	rejected
h68_push_own_view	CallT.args	A1	string_push_str of the String's own view: realloc then copy from freed	rejected
h69_closure_clears_borrowed_vec	§2.11	A2	closure clearing a Vec runs while an element borrow is live	rejected
h70_closure_grows_after_view	§2.11	A2	closure growing a String runs after a view of it was taken	rejected
h71_closure_param_clears_vec	§2.11	A2	callee runs closure that clears Vec while element borrow is live	rejected
h72_map_borrow_callee_replace	CallT.summary	A1	map value borrow; callee replaces that key dropping old value; borrow read	rejected
h73_map_borrow_replace	StmtT.assign	A1	map value borrow; map_set replaces key, old value dropped; borrow read	rejected
h74_box_borrow_then_set	StmtT.assign	A1	box_get borrow; box_set replaces the value; borrow read	rejected
h75_deque_borrow_then_pop	RhsT.pop	A1	deque_get borrow; element popped and dropped; borrow read	rejected
h76_btree_borrow_then_replace	StmtT.assign	A1	btree_get borrow; btree_set replaces key, old dropped; borrow read	rejected
h77_vec_with_cap_overflow	§6.2	B	vec_with_cap capacity byte size wraps; pushes write past buffer	runs-clean
h78_string_with_cap_overflow	§6.2	B	string_with_cap capacity size wraps	runs-clean
h79_vec_zeroed_overflow	§6.2	B	vec_zeroed length byte size wraps; length set over tiny buffer	runs-clean
h80_view_string_grow_helper	CallT.summary	A1	view of String; user helper grows String; view printed	rejected
h81_slice_grown_two_calls_deep	CallT.summary	A1	Slice of Vec; helper calls helper that pushes; slice read	rejected
h82_field_arg_borrow_then_set	§2.12	A2	element borrowed via struct field (vec_at); vec_set replaces; borrow read	rejected
h83_field_arg_payload_then_set	§2.12	A2	vec_get payload via struct field; element replaced; payload read	rejected
h84_field_arg_option_then_set	§2.12	A2	Option from vec_get via struct field; element replaced; payload read	rejected
h85_field_replaced_under_borrow	§2.12	A2	element borrowed via struct field; field reassigned; borrow read	rejected
h86_nested_field_cleared	§2.12	A2	element borrowed via nested field path; that field cleared; borrow read	rejected
h87_containing_field_replaced	§2.12	A2	element borrowed via nested path; containing field replaced; borrow read	rejected
h88_field_borrow_whole_to_mutator	§2.12	A2	element borrowed via field; whole struct to helper that clears field	rejected
h89_view_of_view_call	derive	A1	slice_sub of slice_from_vec result read after Vec freed	rejected
h90_payload_of_borrowed_option	derive	A1	payload of a vec_get option binding read after Vec freed	rejected
h91_shadowing_owner_dies_at_block_end	exitScope	A1	borrow of shadowing inner Vec's element outlives its block	rejected
h92_thread_captures_owned_string	§6.5	A3	thread closure captures string the spawning function frees on return	rejected
h93_view_of_value_moved_into_cleared_arena	RhsT.pop	A1	view kept; String moved into Vec; Vec cleared; view read	rejected
h94_element_grows_through_borrow	StmtT.push	A1	view of element's buffer; element grows through its borrow; view read	rejected
h95_element_view_after_clear	RhsT.pop	A1	view of element's buffer; Vec cleared; view read	rejected
h96_borrow_of_temporary_container	§7.1	A2	element borrowed from temporary Vec call result; temporary leaks	runs-clean
h97_memmem_past_short_haystack	§6.4	B	memmem given haystack length longer than string; reads past block	rejected
h98_raw_pointer_passed_as_string	§6.2	B	Vec raw data pointer passed as string; read to missing NUL	rejected
h99_str_at_with_a_lying_length	§6.4	B	nurl_str_at trusts a length longer than the string	rejected
h100_file_closed_twice	§3	B	FFI FILE handle typed as s, fclose called twice from safe code	rejected
h101_realpath_into_a_short_buffer	§3	B	FFI realpath writes whole path into a short string buffer	rejected
h102_null_string_printed	§3	B	null raw string (# s 0 / unset getenv) printed or measured	runs-clean
h103_csv_cell_read_as_a_string	§6.4	B	stdlib CSV cell view not NUL-terminated read as a C string	rejected
h104_generic_stdlib_internal	§3	B	stdlib internal __vec_grow called on string bytes as a Vec block	rejected
h105_generic_callee_hands_back_temporary	§2.8	A2	generic instance returns its arg; temporary freed under the result	runs-clean
h106_method_impl_keeps_argument	§2.12	A2	trait impl keeps its String arg in Vec; caller drops it too	runs-clean
h107_raw_pointer_method	§3	B	trait methods returning/taking raw pointers callable from safe code	rejected
h108_sink_parameter_handed_back	§7.6	A2	sink struct param copied and returned by builder; result leaked	runs-clean
h109_json_parse_keeps_its_text	§6.4	B	raw-pointer stdlib param summarised as keeping text; temporaries leak	runs-clean
h110_dyn_impl_keeps_argument	§2.12	A2	impl keeps String arg, called via trait object; caller drops it	runs-clean
h111_dyn_impl_keeps_receiver	§2.12	A2	impl keeps its receiver via dyn object; value dropped twice	rejected
h112_dyn_call_temporary	§7.1	A2	temporary passed to method via trait object leaked	runs-clean
h113_view_of_owned_string_reassigned	StmtT.assign	A1	copy of owning s binding is a view; owner reassigned, view read	rejected
h114_view_of_literal_born_string_reassigned	StmtT.assign	A1	view of literal-born owning s binding outlives its reassignment	rejected
h115_owned_string_view_across_loop_reassignment	StmtT.assign	A1	in loop body: view of owner taken, owner replaced, view read	rejected
h116_copy_of_owned_local_returned	FnOK	A1	view (copy) of owned local string returned while local dropped	rejected
h117_argument_handed_back_through_a_binding	CallT.summary	A1	callee may return its arg; result of owned local bound and returned	rejected
h118_cursor_whole_rest_after_replace	StmtT.assign	A1	piece is a view of rest (or rest itself); rest reassigned, piece read	rejected
h119_owned_copy_into_call_born_binding	§7.6	A2	owned copy assigned to view-born mutable s binding leaks per iteration	runs-clean
h120_owned_copy_into_call_born_binding_in_block	§7.6	A2	owned copy assigned to view-born binding from a block leaks	runs-clean
h121_field_read_into_owned_string	§2.13	A2	owning s binding assigned struct field pointer; frees field (bad free)	runs-clean
h122_owned_strings_into_field_born_binding	§2.13	A2	field-born mutable s binding assigned fresh strings; each leaks	runs-clean
h123_view_into_owned_field	§2.13	A2	owned s field assigned a view of a String; double free	rejected
h124_owned_local_into_owned_field	§2.12	A2	owned s field assigned owned local; both free the buffer	rejected
h125_literal_into_owned_field	§2.13	A2	owned s field assigned a literal; struct frees the literal	rejected
h126_owned_field_replaced	§2.13	A2	owned s field replaced by fresh strings; old ones leak	rejected
h127_view_in_owned_field_handed_back	§2.8	A2	view of local String stored in struct field; struct returned	rejected
h128_fresh_string_kept_by_vec_push	§2.13	A2	fresh string pushed into Vec s; nobody releases it (leak)	rejected
h129_struct_temporary_with_fresh_string_field	§2.13	A2	struct temp with fresh s field passed to call; string leaks	rejected
h130_struct_with_fresh_string_kept_by_vec	§2.13	A2	struct with fresh s field pushed into Vec; string leaks	rejected
h131_fresh_string_in_option_payload	§2.13	A2	fresh string as ?s option payload leaks	rejected
h132_fresh_string_option_handed_back	§2.13	A2	?s option with fresh payload returned; caller leaks it	rejected
h133_fresh_string_in_option_of_struct	§2.13	A2	struct with fresh s field inside option literal leaks	rejected
h134_fresh_string_into_literal_born_field	§2.13	A2	fresh strings assigned to literal-born s field leak	rejected
h135_fresh_string_into_view_born_field	§2.13	A2	fresh string assigned to view-born s field leaks	rejected
h136_nested_struct_temporary_fresh_field	§2.13	A2	nested struct temp with fresh s field leaks	rejected
h137_struct_literal_into_struct_field	§2.13	A2	struct literal with fresh s field stored into outer field leaks	rejected
h138_fresh_field_in_join_of_literals	§2.13	A2	join of struct literals, one with fresh s field; that one leaks	rejected
h139_fresh_field_in_reassigned_struct	§2.13	A2	struct reassigned literal with fresh s field; string leaks	rejected
h140_fresh_string_in_slice_literal	§2.13	A2	fresh string element of slice literal leaks	rejected
h141_closure_returned_capturing_owned_string	§2.11	A2	returned closure captures owned local string freed on exit	rejected
h142_kwargs_forward_consuming_callee	CallT.summary	A1	kwargs call to later fn that forwards arg to sink; caller drops again	runs-clean
h143_consumed_twice_in_one_call	CallT.sink	A1	one String passed to sink param and borrowed param of same call	rejected
h144_consumed_and_read_in_one_call	CallT.sink	A1	view of String in one arg, String consumed by later arg of same call	rejected
h145_closure_call_fresh_temp_string	§7.5	A2	fresh temp string passed to closure-value call never released	runs-clean
h146_dtor_closure_inside_drop_impl	§7.6	A2	closure inside Drop impl gets receiver's drop glue epilogue	runs-clean
h147_dtor_disposer_leaks_fields	§7.6	A2	Drop impl hands receiver to sink disposer; fields leak	runs-clean
h148_dtor_panics_runs_twice	§7.2	A2	Drop impl frees field then panics; unwind drops value again	runs-clean
h149_dtor_reassigns_receiver_field	§7.6	A2	Drop impl replaces receiver field; old value leaks	runs-clean
h150_dtor_skipped_when_handed_to_disposer	§7.6	A2	Drop-typed value passed to sink fn released by neither	runs-clean
h151_mem_forget_in_drop_hook	§3	B	mem_forget in safe library drop hook leaks fields	rejected
h152_mem_forget_in_generic	§3	B	mem_forget in safe generic function leaks argument	rejected
h153_mem_forget_in_spawned_closure	§3	B	mem_forget in thread-spawned closure in safe code leaks	rejected
h154_mem_forget_in_trait_method	§3	B	mem_forget in safe trait method body leaks	rejected
h155_mem_forget_owned_vec	§3	B	mem_forget of owned Vec accepted in safe code (leak)	rejected
h156_mem_take_field_borrow	§3	B	mem_take on borrowed field claims it; caller reads freed String	rejected
h157_mem_take_vec_element	§3	B	mem_take on vec_get element; element released twice	rejected
h158_rcbox_handle_literal_over_forged_block	§3	B	user rcbox handle built over String buffer; hook releases it as block	rejected
h159_rcbox_new_parks_value	§3	B	rcbox_new in safe code parks value behind plain i (leak)	rejected
h160_rcbox_release_any_address	§3	B	rcbox_release in safe code releases any i, twice	rejected
h161_string_consume_borrowed_param	CallT.sink	A1	borrowed s param / literal handed to string_adopt (taken over)	runs-clean
h162_string_consume_closure_param	§2.11	A2	closure's borrowed s param adopted; caller's string/literal freed	runs-clean
h163_string_consume_generic_sink_at_s	§2.13	A2	generic sink A at s: given-up string returned as view, leaks	runs-clean
h164_string_consume_left_in_param_container	§2.13	A2	sink s param pushed into caller's Vec s; nobody frees it	rejected
h165_string_consume_literal	CallT.sink	A1	string literal handed to string_adopt, freed as heap	runs-clean
h166_string_consume_maybe_fresh_result	CallT.summary	A1	result fresh on one path, literal on other, adopted and freed	runs-clean
h167_string_consume_method_and_trait_object	§2.13	A2	method sink s via static/dyn call: leaked or literal freed	runs-clean
h168_string_consume_panic_recover	§7.2	A2	sink s callee panics; unwind frees caller's literal	runs-clean
h169_string_consume_sink_param_only_read	§2.13	A2	string to sink s param that only reads it; leaks	runs-clean
h170_string_consume_view_of_string	CallT.sink	A1	string_adopt of a String's view while owner holds it: double free	runs-clean
h171_view_into_aliased_param_vec	FnOK	A1	view of local pushed via alias of caller's Vec param; caller reads	rejected
h172_view_into_inout_struct_field	§2.13	A2	view of local stored into s field of inout struct; caller reads	rejected
h173_view_into_param_container	FnOK	A1	view of local pushed into caller's Vec s param; local freed	rejected
h174_view_through_return_closure	§2.11	A2	helper returns closure capturing local's view via call result	rejected
h175_view_through_return_helper	CallT.summary	A1	^ ( pick x ) returns a view of local x released on exit	runs-clean
h176_view_through_return_vec	CallT.summary	A1	callee returns Vec holding view of arg; local's view escapes	rejected
h177_view_through_return_vec_literal	CallT.summary	A1	same as h176 via local binding of the call result	rejected
h179_view_into_field_of_outer_struct	§2.13	A2	loop-body raw string view stored into outer struct field, read after string freed	rejected
h180_omitted_vec_field	§6.2	B	struct literal omits Vec field: zero Vec with null control block, push writes null	rejected
h181_omitted_handle_field	§6.2	B	struct literal omits Rc field: zero handle, rc_get reads null block	rejected
h182_omitted_closure_field	§6.2	B	struct literal omits closure field: calling zero closure jumps to address 0	rejected
h183_omitted_enum_payload	§6.2	B	enum literal omits Vec payload: arm binds zero Vec, push writes through null	rejected
h184_option_tag_only	§6.2	B	option literal with tag only leaves Vec payload zero; push through null	rejected
h185_bare_variant_with_payload	§6.2	B	bare variant as value leaves Vec payload undefined; arm uses garbage Vec	rejected
h186_zeroed_vec_of_vecs	§6.2	B	vec_zeroed of Vec elements makes Vecs with no control block	rejected
h187_number_into_vec	§6.2	B	number 0 bound as a Vec: null control block, push writes through null	rejected
h188_number_as_vec_argument	§6.2	B	number passed for a Vec by-value parameter: callee pushes through null	rejected
h189_defer_reads_returned_field	§6.2	A2	defer pushes onto a struct field the returned literal already moved out	runs-clean
h190_empty_drop_hook_recurses	§7.6	A2	empty drop hook drops its sink receiver via drop glue, recursing forever	runs-clean
h191_copied_struct_field_into_literal	§7.6	A2	returned literal takes Vec field of struct cursor copy; owner frees it too	runs-clean
h192_cursor_field_handed_on	§7.6	A2	field of struct cursor sunk/returned while owner keeps it: double owner	runs-clean
h193_closure_field_into_literal_leaks_struct	§7.1	A2	returning closure field skips struct drop: other fields leak	runs-clean
h194_join_arm_copies_guarded_call	§7.1	A2	?-join copies a call arm that handed a fresh string over: string leaks	runs-clean
h195_closure_into_field_views_capture	§7.5	A2	closure stored into returned struct only views captured String freed at frame end	runs-clean
h196_field_view_outlives_replace	§2.10	A2	binding read from struct field outlives reassignment of that field	runs-clean
h197_inout_field_moved_out_and_returned	§2.10	A2	inout struct field read, field replaced, old view returned to caller	runs-clean
h198_option_field_replaced_leaks	§7.1	A2	replacing an option struct field does not drop old payload: leak	runs-clean
h199_inout_option_replaced_leaks	§7.1	A2	assigning option over inout option param does not drop old payload: leak	runs-clean
h200_local_option_moved_into_inout	§2.1	A2	local option assigned over inout option, local still drops it: caller UAF	runs-clean
h201_borrowed_param_stored_into_inout	CallT.summary	A1	borrowed String param assigned into inout param: caller's two names share buffer	runs-clean
h202_global_string_from_per_call_owner_leaks	§1	A3	module global given an owned fresh string; now rejected (threads may read global)	rejected
h203_join_initialised_string_cursor_leaks	§7.1	A2	string cursor from ?-join has no owner slot: each assigned fresh string leaks	runs-clean
h204_spawned_closure_arm_payload	§6.5	A3	fiber closure only views a match-arm payload released at arm end	runs-clean
h205_literal_field_moved_and_kept	§2.12	A2	struct literal moves t into a field and passes t to a keeper in another	rejected
h206_literal_nested_moved_twice	§2.12	A2	struct literal moves t into a field and into a nested literal: two owners	rejected
h207_param_to_keeper_then_read	CallT.sink	A1	param handed to callee that keeps and frees it (inferred sink), then read	rejected
h208_param_kept_in_result_owner_released	CallT.sink	A1	param kept in callee result, result freed, then param read	rejected
h209_vec_of_drop_type_in_struct	§7.6	A2	struct holding Vec of user %Drop type never dropped: leak, drop not run	runs-clean
h210_btree_merge_remove_lost_value	§6.4	B	stdlib BTree remove-with-merge moves emptied slot down: value leaks	runs-clean
h211_clone_through_shared_payload_races	§6.5	A3	threads cloning a handle from a shared Arc payload race on refcount	runs-clean
h212_arc_payload_mutated_without_a_named_view	§6.5	A3	two threads vec_push through arc_get unlocked: data race on payload	rejected
h213_arc_payload_changed_by_its_maker_while_shared	§6.5	A3	spawner vec_sets Arc payload while worker reads it: race, UAF	rejected
h214_nested_lending_call_borrowed_nothing	derive	A1	borrow of vec_at of vec_at depends on root top; top freed, inner read	rejected
h215_helper_lend_through_later_accessor	CallT.summary	A1	helper returns vec_at lend of temp arg; caller uses result after temp dropped	runs-clean
h216_block_value_through_its_own_binding	StmtT.free	A1	block value is a block-local borrow of outer; outer freed, value read	rejected
h217_closure_tail_hands_back_a_capture	§2.11	A2	closure falls off with lent element of capture; caller treats it as owned	runs-clean
h218_function_falls_off_with_a_lend	FnOK	A1	fn tail returns vec_at lend of param but treated as owned by caller	runs-clean
h219_closure_hands_back_what_it_cannot_copy	§7.5	A2	closure returns its %Drop capture by value: released by owner and caller	rejected
h220_closure_hands_back_a_view	§2.11	A2	closure returns slice view of its Vec arg; Vec grows, slice dangles	rejected
h221_field_of_a_dropped_struct_that_cannot_be_copied	§7.6	A2	return %Drop field of local struct that is dropped on the way out	rejected
h222_closure_moves_out_what_it_captured	§7.5	A2	closure moves %Drop capture into a literal; frame drops it again	rejected
h223_option_of_a_value_it_cannot_copy_never_dropped	§7.1	A2	option of %Drop value bound/replaced/discarded never dropped: leak	runs-clean
h224_closure_over_a_value_it_cannot_copy_outlives_it	§2.11	A2	returned closure captures %Drop local by bits; local freed on return	runs-clean
h225_view_of_a_sink_parameter_handed_back	FnOK	A1	returns slice view of a sink param the function drops on exit	rejected
h226_match_on_a_lent_option_released_its_payload	§7.6	A2	match on borrowed option param makes %Drop payload owned; released	runs-clean
h227_lent_payload_handed_out_of_a_match	§7.6	A2	match on option field hands %Drop payload to a binding; double owner	rejected
h228_lent_element_handed_to_a_sink	CallT.sink	A1	vec_at element borrow passed to sink param; Vec still holds freed elem	runs-clean
h229_field_it_cannot_copy_moved_to_a_sink	§7.6	A2	%Drop struct field passed to sink while struct still drops it	rejected
h230_lent_value_it_cannot_copy_stored	§2.12	A2	lent %Drop element stored into struct literal: two owners	rejected
h231_enum_payload_handed_to_a_sink	§7.6	A2	enum payload String handed to sink in arm; enum drops it again	runs-clean
h232_temporary_it_cannot_copy_never_dropped	§7.1	A2	discarded %Drop temporary / field-read temporary never dropped: leak	runs-clean
h233_match_on_a_temporary_enum_leaked_it	§7.1	A2	match on enum returned by call: enum and payload never dropped	runs-clean
h234_temporary_argument_it_cannot_copy_leaked	§7.1	A2	%Drop temporary passed to a borrowing call never dropped: leak	runs-clean
h235_generic_copy_of_a_value_it_cannot_copy	§7.6	A2	box_clone (mem_dup) of %Drop value copies bits: double free	rejected
h236_closure_never_run_leaked_its_capture	§7.5	A2	closure that would move %Drop capture never runs: capture leaks	runs-clean
h237_result_error_it_cannot_copy_never_dropped	§7.1	A2	result whose %Drop error is never dropped when bound: leak	runs-clean
h238_option_of_an_option_never_dropped	§7.1	A2	nested option of owning payload never dropped: leak	runs-clean
h239_returned_closure_never_run_leaked_its_capture	§7.5	A2	returned closure owning %Drop capture never run: capture leaks	runs-clean
h240_closure_bound_for_a_thread_never_handed_over_leaked	§7.5	A2	closure for thread on untaken path took %Drop capture: leak	runs-clean
h241_thread_closure_capture_used_after_spawn	§6.5	A3	thread closure moves %Drop capture; spawning frame also consumes it	rejected
h242_closure_argument_capture_used_after_call	§2.11	A2	closure arg moves %Drop capture; frame consumes it after call	rejected
h243_bound_closure_handed_back_reached_its_frame	§7.5	A2	bound closure returned, its capture drop flag left in dead frame	runs-clean
h244_closure_run_after_its_thread_copy_took_the_capture	§6.5	A3	closure given to thread and also run in frame: capture moved twice	runs-clean
h245_rc_view_kept_across_set_through_a_clone	§6.2	A2	rc_get view outlives rc_set through a cloned Rc handle	rejected
h246_rc_view_kept_across_set_through_an_aliased_parameter	§6.2	A2	rc_get view outlives rc_set via struct-field param aliasing same Rc	rejected
h247_rc_view_kept_across_set_through_a_field_handle	§6.2	A2	rc_get view outlives rc_set through a struct field holding an Rc clone	rejected
h248_put_back_into_another_slot	§3	B	vec_put_back writes element read from slot 0 into slot 1: two owners	rejected
h249_forged_runtime_handle_through_a_conn_view	§3	B	tcp_conn_view wraps a made-up number as a socket handle	rejected
h250_forged_runtime_handle_closed_by_a_builtin	§3	B	builtin nurl_tcp_close called with a forged handle number	rejected
h251_forged_runtime_handle_through_stdlib_ffi	§3	B	stdlib FFI nurl_udp_close called from safe code with forged handle	rejected
h252_forged_symbol_table_handle	§6.4	B	made-up integer passed as raw symbol-table handle to nurl_sym_get	rejected
h253_forged_symtab_literal	§6.2	B	SymTab struct literal forged around a made-up address; drop frees it	rejected
h254_symtab_shared_between_threads	§6.5	A3	NotSync SymTab in an Arc mutated from two threads without a lock	rejected
h255_mmio_write_to_a_made_up_address	§3	B	safe mmio_write32 to an arbitrary integer address	rejected
h256_string_closed_as_a_file_stream	§6.4	B	string literal taken as FILE* by file_from_raw and fclose'd	rejected
h257_field_binding_stored_back_leaks	§7.6	A2	binding taken from a replaced field stored back as a borrow; owned Vec leaks	runs-clean
h258_mapped_view_outlives_its_file	FnOK	A1	function returns view of its local MappedFile's bytes past the owner's drop	rejected
h259_closure_join_frees_assigned_binding	§2.11	A2	closure assigned in a ?? arm freed as join temporary while binding holds it	runs-clean
h261_temp_arg_leaks_under_enum_error_result	§7.1	A2	handle temporary passed to call returning !T Enum never dropped (leak)	runs-clean
h262_float_passed_as_a_struct	§6.2	B	float passed where a Slice struct parameter is expected (type confusion)	rejected
h263_start_global_shared_unsynchronised	§6.5	A3	start-set Vec global pushed from two threads without synchronisation	rejected
h264_literal_takes_uncopyable_field	§7.6	A2	returned struct literal copies non-copyable field; freed with source struct	runs-clean
h265_uncopyable_temp_arg_leaks	§7.1	A2	non-copyable struct temporary passed to call returning a struct leaks	runs-clean
h266_field_of_call_result_leaks	§7.1	A2	owned field read from a call result; rest of temporary never dropped	runs-clean
h267_option_taken_from_locked_stays_in_slot	§6.5	A3	option taken from Locked left in slot; restore drops value handed back	runs-clean
h268_string_passed_as_slice	§6.2	B	raw string pointer passed where a Slice struct is expected (type confusion)	rejected
h269_vec_passed_as_number	§6.2	B	Vec handle passed where an integer parameter is expected	rejected
h270_vec_get_payload_returned	CallT.summary	A1	accessor returns vec_get payload of arg without lend summary; arg truncated	rejected
h271_forwarded_lend	CallT.summary	A1	function forwards another fn's lent result; its own lend not summarised	rejected
h272_struct_global_torn_between_threads	§6.5	A3	mutable struct global written/read by two threads non-atomically	rejected
h273_string_global_freed_under_reader	§6.5	A3	string global reassigned (old freed) while another thread reads it	rejected
stdlib/h178_trusted_by_path_substring	§6.4	B	any path containing /stdlib/ compiled as trusted stdlib, checks off	rejected
stdlib/h260_zip_archive_outlives_its_bytes	§6.4	B	stdlib ZipArchive kept bare pointer into caller's Vec; Vec freed first	runs-clean
h274_closure_view_beside_growing_closure	§2.11	A2	closure holding a view of its capture handed to a call beside a closure growing it	rejected
h275_in_param_beside_growing_closure	§2.11	A2	Vec passed `in` beside a closure growing it	rejected
h276_closure_called_with_growing_closure	§2.11	A2	closure holding a view of its capture called with the closure that grows it	rejected
h277_borrow_beside_clearing_closure	§2.11	A2	element borrow passed beside a closure clearing its Vec	rejected
h278_nested_closure_effect_lost	§2.11	A2	closure runs a captured closure that grows a Vec; the outer closure's view of it read after	rejected
h279_closure_grows_capture_it_views	§2.11	A2	closure captured a Vec and a view of it, grows the one and reads the other	rejected
h280_nested_growing_closure_beside_vec	§2.11	A2	closure that runs a growing captured closure handed to a call beside the Vec	rejected
h281_returned_option_of_closure	§7.5	A2	option of a capturing closure handed back; the frame freed the env the option carried	runs-clean
h282_struct_field_option_of_closure	§7.5	A2	struct literal handed back with an option of a closure in a field; env freed by the frame	runs-clean
h283_closure_borrowed_from_field	§2.11	A2	closure read out of a struct field, field replaced (old env dropped), closure called	rejected
h284_returned_result_of_closure	§7.5	A2	result of a capturing closure handed back; the frame freed the env the result carried	runs-clean
h285_view_of_capture_across_opaque_closure_param	§2.11	A2	closure holds a view of a captured Vec across a call to its closure parameter, which re-enters and grows it	rejected
h286_view_of_capture_across_closure_in_struct_param	§2.11	A2	h285 with the closure run a field of a struct parameter	rejected
h287_view_of_capture_across_closure_in_vec_param	§2.11	A2	h285 with the closure run an element of a Vec parameter (vec_at)	rejected
h288_arc_payload_lent_through_a_struct	§6.5	A3	helper takes a struct holding an Arc and lends the payload; caller writes through the view while threads read	rejected
h289_foreign_write_into_a_frozen_view	§6.5	A3	unsafe helper preads into a slice it is handed; caller hands it a view of an Arc payload	rejected
h290_move_only_handle_in_a_struct_never_dropped	§7.6	A2	struct holding a lock guard (no share/clone hook) was dropped by nobody: lock held, block leaked	runs-clean
h291_unjournaled_drop_skipped_by_a_panic	§7.2	A2	panic past a struct holding a lock guard (or a Drop impl defined later): its drop was never journaled — lock held, leak, Drop not run	runs-clean
h292_argument_temporary_leaked_by_a_panic	§7.2	A2	a String / Vec made in an argument, the callee panics: the drop after the call was skipped and the journal did not know the temporary — leak	runs-clean
h293_thread_panic_message_outlives_the_thread	§7.2	A2	a thread's last panic message (kept for PanicInfo) was never released when the thread ended — leak per thread	runs-clean
h294_parked_drop_registration_never_forgotten	§7.2	A2	a value whose journal thunk is parked for module end was registered but never forgotten: a later panic dropped it from a returned frame	runs-clean
h295_param_copy_passed_inout_releases_callers_field	paramOK_inout	A2	a ': ~' copy of a parameter shares its fields; passed inout, the callee replaced a field and released the caller's (UAF)	rejected
h296_arm_payload_returned_registration_kept	§7.2	A2	a ?? arm handing its handle payload out as the match value left its journal registration: a later panic read a dead frame's flag	runs-clean
h297_inout_closure_param_replaced	StmtT.assign	A2	a closure handed to an inout parameter and replaced there: the callee dropped the new env as its own and leaked the old; the caller ran freed memory	runs-clean
h298_closure_inout_capture_replaced	§2.4	A2	a closure handing a captured : ~ String to an inout parameter took it by value; the callee replaced the copy and released the caller's buffer (UAF)	runs-clean
h299_closure_from_a_call_outlives_its_argument	§2.11	A2	a closure a call returned over an argument it captured without taking it over (retclo) stayed usable after the caller released the argument (UAF)	rejected
h300_vec_iterator_outlives_its_vec	§2.11	A2	h299 through iter_from_vec: the iterator called after its Vec was released	rejected
h301_map_iterator_outlives_its_map	§2.11	A2	map_iter captured a raw pointer to the map's control block: called after the map was released (UAF)	rejected
h302_option_captured_by_a_returned_closure	§2.11	A2	a returned closure over an option-of-String parameter was not recorded as lending it; the caller gave the option a new value, then called the closure	rejected
h303_map_keys_of_owned_keys	§7.6	A2	map_keys over String keys: a key read through the slot pointer was both copied into the Vec and emptied from its slot — leak, and the map lost the key	runs-clean
h304_nested_lend_stored_by_the_callee	§2.10	A2	a view a nested call lends (string_data x), stored by the callee in what it returns, was not a view of x in the result	rejected
h305_iterator_chain_over_a_temporary	§2.11	A2	iter_map over a temporary iter_from_vec: the sink combinator's result held nothing of the Vec (retcap)	rejected
h306_closure_literal_capture_given_a_new_value	§2.11	A2	a closure literal holds a copy of a captured : ~ Vec's handle; the binding given a new value released it, then the closure ran (UAF)	rejected
h307_closure_literal_capture_replaced_through_inout	§2.11	A2	h306 through an inout callee replacing the captured String	rejected
h308_returned_closure_argument_replaced_through_inout	§2.11	A2	h307 for a closure a call returned over a Vec it captured	rejected
h309_returned_closure_struct_field_replaced_through_inout	§2.11	A2	h308 for a struct whose Vec field the inout callee replaces	rejected
h310_closure_bound_then_returned_over_a_local	§2.11	A2	a closure literal over a local Vec bound and returned by name held only a copy of the handle; the frame released the Vec, the caller ran the closure (UAF)	rejected
h311_lend_returned_through_a_match_arm	§7.6	A2	a function returning a call's lend through a ?? arm was not summarised as lending; the caller released the payload — the Vec's own element (UAF)	rejected
h312_lend_returned_through_a_ternary	§7.6	A2	h311 through a ? ternary	rejected
h313_lru_get_value_released	§7.6	A2	h311 through lru_get: releasing the cached value freed what the cache held	rejected
h314_lru_value_read_after_eviction	§2.10	A2	a value lru_get lent, read after an lru_put that evicted it	rejected
h315_first_arm_statement_reads_what_the_scrutinee_ended	§2.10	A2	a match scrutinee call's effects were recorded after the first arm statement, which read a borrow the call had ended	rejected
h316_vector_result_keeps_its_temporary	§7.1	A2	a call returning a v128 was taken for a possible view of its temporary argument; the temporary's drop waited for a consumer, and a binding is none (leak)	runs-clean
h317_frozen_asserted_over_a_cell	§6.5	A3	a program's own % Frozen over a Cell, in an RwLocked, written through read guards on two threads: % Frozen only adds checks (question #21, rejected already)	rejected
h318_send_asserted_by_safe_code	§3	B	safe code asserted % Send over an Rc and raced its count from two threads; a positive marker is now unsafe % Send (heap-use-after-free)	rejected
h319_member_table_copy_on_two_threads	§6.5	A3	two copies of one PkMemberTable, one moved to a thread, both grew its member Vec (dist/heartbeat's shape); the table is % NotSend	rejected
h320_match_try_owned_join	§7.6	A2	a fresh handle try-unwrapped in a braced ?? arm lost its ownership at the join and leaked after storage; every arm now contributes an explicit ownership-lattice element	runs-clean
h321_match_arm_call_fresh_handle	§7.6	A2	a ?? arm whose value was a call's fresh handle made from the payload (an arc_clone) never dropped the payload; parked drops now run when the callee's lend summary rules the arm's locals out of the result	runs-clean
h322_destructor_moves_a_receiver_field_out	§7.6	A2	a drop hook stored a non-copyable field of its receiver into a generic struct literal; the field was not emptied and the receiver's drop glue released it again; a destructor receiver's field is now lent, as a parameter's is	rejected
h323_closure_field_read_out_of_a_call_result	§7.4	A2	a closure field read out of a call's result was neither the read's own nor dropped with the temporary, so its env and the temporary's other fields leaked; the field now leaves the temporary as an owned closure temporary and the rest is dropped	runs-clean
h324_non_copyable_field_stored_into_a_literal	§7.6	A2	a %Drop field with no clone, read out of a local struct, was stored into a struct literal without being emptied; the literal and the struct each released it; such a field read is now lent and the store rejected	rejected
h325_non_copyable_field_pushed_into_a_vec	§7.6	A2	the same field pushed into a Vec: the Vec and the struct each released it; lent, so the keeping callee is rejected at module end	rejected
h326_non_copyable_field_assigned_to_a_field	§7.6	A2	the same field assigned to another struct's field: both released it; lent, so the assignment is rejected	rejected
h327_returned_literal_lends_a_local_field	§7.6	A2	a returned literal held such a field of a local struct, released with the local on the way out; it must be lent by a parameter, as ^ . p f must	rejected
h328_outer_binding_borrows_an_inner_field	§7.6	A2	an outer binding assigned a %Drop field with no clone out of a struct an inner block declares went on borrowing it after the block dropped the struct; rejected where the struct's block ends first	rejected
h329_drop_type_call_result_field_read	§7.6	A2	a field read out of a call's result whose struct has its own %Drop left the temporary unowned: its destructor never ran and its contents leaked; the temporary now gets an owner for the rest of the scope	runs-clean
h330_non_copyable_call_result_field_read	§7.6	A2	a field that cannot be copied, read out of a call's result, was lent by a temporary nothing owned; the temporary now gets an owner for the rest of the scope and lends the field	runs-clean
h331_field_borrow_outlives_its_struct_moved	§7.6	A2	a binding read out of a field borrowed nothing in the checker (the let row's reads were empty) and outlived its struct handed to a sink; it borrows the field's path now	rejected
h332_field_borrow_outlives_its_struct_replaced	§7.6	A2	the same binding outlived its struct given a new value; ended by it now (a store replacing just that field hands the binding the old value)	rejected
h333_library_handle_field_copy_on_two_threads	§6.5	A3	a library handle read out of a struct's field kept by the spawner while the struct went to a thread: two threads changed one state; the field read is a borrow the move ends (agora #66's shape)	rejected
h334_call_temporary_owner_skipped_by_a_panic	§7.2	A2	a call's result given an owner for the rest of the scope (h233's matched enum, h329/h330's field read) was never journaled: a panic before the scope ended leaked it and skipped its destructors; journaled once by its slot now	runs-clean
h335_temporary_enum_matched_in_a_loop_condition_leaked	§7.1	A2	an enum a call handed over, matched in a loop's condition: each round overwrote the one before in the owner's slot, so every round but the last leaked; each round releases the one before now	runs-clean
h336_library_handle_captured_by_a_thread_and_kept	§6.5	A3	a thread's closure captured a library handle whose copies are one state (a PNCounter) and the spawner kept changing its own: a detached closure moves a share handle not asserted % Sync, as it moves a Vec	rejected
h337_library_handle_parameter_captured_by_a_thread	§6.5	A3	a thread's closure captured a parameter of such a handle while its caller kept changing the one it passed: rejected unless the parameter is sink	rejected
h338_arc_of_a_library_handle_on_two_threads	§6.5	A3	an ( Arc PNCounter ) shared by two threads: each arc_get copy is a share of one counter; under the Sync question a share handle not asserted % Sync is not Sync	rejected
h339_closure_in_an_arc_captures_a_library_handle	§6.5	A3	a closure capturing a PNCounter kept in an Arc and run by two threads at once: a capture that is not Sync is rejected where the closure is kept in a handle several threads run it from	rejected
h340_closure_sent_on_a_channel_captures_a_kept_handle	§6.5	A3	a closure capturing a PNCounter sent on a channel while the sender kept changing it: keeping a closure beside a handle another thread takes it from moves its captures that are not Sync	rejected
h341_listener_accept_after_close	§6.4	B	tcp_close_listener released the runtime socket record every copy of the listener still named; tcp_accept then read freed memory: a stop keeps the record until the last owner	runs-clean
h342_route_handler_changes_its_capture_on_two_threads	§6.5	A3	a route handler pushing to a Vec it captured, its router in an Arc dispatched by two threads: one closure environment grown by both; what a closure several threads run changes of a capture must synchronise itself	rejected
h343_mcp_task_handle_after_eviction	§6.4	B	mcp_task_create handed out a task as a bare address; eviction at the cap (or a TTL sweep) freed the task a kept handle still named, and mcp_task_status read freed memory: the handle is one owner of the task's rcbox	runs-clean
h344_dyn_object_carries_an_rc_to_a_thread	§6.5	A3	a trait object boxing a struct with an Rc went into a thread closure while the spawner kept a clone: the Send/Sync derivation saw { i8*, i8* } and answered Send; a trait object is Send only when its trait declares : Send (Sync with : Send Sync), a promise each impl is held to	rejected
h345_inout_param_given_a_field_read	§7.6	A2	an inout parameter given a binding read out of a field stored the field's buffer as is (two owners); it is given a copy, and the value it held is dropped	runs-clean
h346_closure_inout_param_given_a_capture	§7.6	A2	a closure's inout parameter given one of the closure's captures stored the captured buffer as is; a capture is copied in like any binding whose value another owner keeps	runs-clean
h347_closure_inout_param_drops_what_it_was_given	§7.6	A2	a closure's inout parameter given a fresh value dropped it on return: it was registered as an owner of its own; an inout parameter is the caller's binding, never an owner	runs-clean
h348_handle_field_read_after_its_viewer_was_consumed	§7.6	A2	a binding read out of a library handle field, handed to a sink, emptied the field (a null handle) and the struct was read after: the viewer takes its struct along	rejected
h349_library_handle_share_kept_by_the_spawner	§6.5	B	a share of a PNCounter made before the handle moved to a thread stayed with the spawner: the crossing (mem_send_check) panics unless the value carries every owner of each one-state handle it holds	runs-clean
h350_library_handle_in_a_literal_kept_by_the_spawner	§6.5	B	a literal storing a borrowed handle field (a share) kept while the struct went to a thread: thread_spawn's crossing check panics on the second owner	runs-clean
h351_library_handle_share_in_a_vec_taken_by_a_thread	§6.5	B	a share pushed into a Vec that went to a thread: the crossing check walks a Vec's elements (a container's through its S_sendck hook) and panics	runs-clean
h352_library_handle_sent_on_a_channel_while_a_share_stays	§6.5	B	a PNCounter sent on a channel while the sender kept a share: chan_send checks what it hands over and panics	runs-clean
h353_library_handle_put_in_a_locked_while_a_share_stays	§6.5	B	a PNCounter put into a Locked while the spawner kept a share: a value going into a Locked is checked and the crossing panics	runs-clean
h354_locked_update_stores_a_kept_handle_into_the_value	§6.5	B	a closure under a Locked's lock assigned a handle kept outside into the value: the value is checked before the lock is let go and the crossing panics	runs-clean
h355_locked_get_copies_a_handle_out_of_the_lock	§6.5	B	locked_get copied a PNCounter (a share, one state) out of the lock: its copy is checked and the crossing panics	runs-clean
h356_library_handle_field_read_taken_by_a_thread	§6.5	A3	a binding read out of a library handle field captured by a thread while its struct stayed usable: the thread takes the field and its struct along	rejected
h357_rwlocked_of_a_library_handle_on_two_threads	§6.5	A3	an RwLocked over a PNCounter crossed to a thread: an RwLocked's value faces the Sync question, as an Arc's payload does	rejected
h358_rc_in_a_locked_in_an_arc_on_two_threads	§6.5	A3	an Rc in a Locked in an Arc crossed to a thread: a Sync marker vouches for the container, never for its value, which faces the Send question	rejected
h359_index_panic_skipped_the_journal	§7.2	B	a function whose only panic is nurl_panic_index had its bindings' journal registrations elided and leaked them under recover: the may-panic summary knows the runtime's panicking entries	runs-clean
h360_dyn_object_carries_a_kept_share_to_a_thread	§6.5	B	a trait object of a : Send trait boxing a PNCounter crossed to a thread while the spawner kept a share: the crossing check saw { i8*, i8* }; the vtable's last slot carries the boxed type's check, and the crossing panics	runs-clean
h361_dyn_object_moved_into_a_literal_dropped_twice_by_a_panic	§7.2	A2	a trait object moved into a struct literal, then a recovered panic: its journal registration had read the drop flag at the push and dropped the box the struct dropped too; a flagged binding is journaled with its flag, read at the drain	runs-clean
h362_dyn_object_given_to_a_sink_dropped_twice_by_a_panic	§7.2	A2	a trait object handed to a sink parameter, then a recovered panic in the caller: the callee dropped it and the caller's registration, its flag read at the push, dropped it again	runs-clean
h363_dyn_object_captured_by_a_closure_dropped_twice_by_a_panic	§7.2	A2	a trait object captured by a closure held in a struct, then a recovered panic: the struct's drop dropped the environment and the object, and the binding's registration dropped it again	runs-clean
h364_dyn_inout_method_through_a_read_guard	§6.5	A3	a trait object read through a read guard, copied into a : ~ binding and handed to a method with an inout receiver: the impl wrote the box every reader sees; an inout receiver through a trait object changes the object, so it is a change to what the guard lends	rejected
h365_dyn_inout_method_replaces_what_a_view_reads	§2.10	A2	a String read out of a trait object, then an inout method whose impl gives it a new value: the virtual callee's replacement summary was not the impls' union, so the view outlived the release; each virtual parameter is an edge to every impl's	rejected
h366_helper_hands_its_parameter_to_a_dyn_method	§2.10	A2	as h365 through a helper handing its inout trait-object parameter on: the helper's summaries closed before the virtual callee had the impls'; the edges go into both fixed points	rejected
h367_inout_cursor_released_by_a_replacing_callee	§2.4	A2	a : ~ cursor over another binding handed inout to a callee that gives the parameter a new value: the callee released the owner's buffer; an argument in a borrow state may not go to a parameter its callee may replace	rejected
h368_inout_field_read_released_by_a_replacing_callee	§2.4	A2	as h367, the binding a field read and the callee replacing a field of it	rejected
h369_inout_lend_of_an_arc_payload_released_by_a_replacing_callee	§2.4	A2	as h367, the binding what arc_get lends: the callee released the Arc's payload	rejected
h370_local_read_after_its_copy_was_given_a_new_value	§2.4	A2	a local of a % Drop type copied into a : ~ binding (which took its drop flag), handed inout to a replacing callee, then the local read: the copy becomes the owner and the local is moved at the call	rejected
h371_arm_assigned_from_a_join_dropped_as_the_statement_value	§7.6	A2	a ? statement whose arm ends in = x ? c ( f ) ( g ) beside an arm assigning another binding: the statement dropped the joined value as discarded, the one x had just received; an assignment's value is lent to whatever reads it	runs-clean
h372_field_assigned_from_a_join_in_a_match_arm_dropped	§7.6	A2	as h371, a field store in a ?? statement's arm	runs-clean
h373_binding_given_its_own_value_through_a_join	§7.6	A2	= x ? c x ( f ): the join lent x's own value, which the assignment freed as the old value before storing it; where a join that may select the target lends, the value is copied in	runs-clean
h374_binding_given_its_own_value_through_a_match	§7.6	A2	as h373, through a ?? whose arm hands back the target	runs-clean
h375_panic_through_a_call_leaks_its_closure_argument	§7.2	A2	a closure literal handed to a call that panics: the env, dropped after the call, leaked; an argument's closure temporary is journaled while the call runs	runs-clean
h376_panic_past_a_closure_binding_leaks_its_env	§7.2	A2	a closure binding handed to a call that panics: its scope exit never ran; every closure binding is in the function's closure frame table	runs-clean
h377_panic_through_a_call_leaks_its_literal_argument	§7.2	A2	a struct literal handed to a call that panics: the String and closure it made leaked; a literal argument's owned fields are journaled while the call runs	runs-clean
h378_binding_viewing_a_call_temporary_leaked_it	§1	A2	: s v ( first ( string_from … ) ), first handing back a view of its argument: the temporary's drop waited for a call to consume the view, and a binding is none (leak); a view of a temporary no call consumes is rejected once the caller owned it	rejected
h379_closure_over_a_temporary_argument_leaked_it	§1	A2	as h378, a closure a call returned over its temporary argument (retclo)	rejected
h380_view_of_a_call_temporary_returned_leaked_it	§1	A2	as h378, the view returned straight out (^ ( first ( string_from … ) ))	rejected
h381_view_of_a_call_temporary_kept_by_a_callee_leaked_it	§1	A2	as h378, the view handed to a callee that keeps it (vec_push into a parameter Vec): no call could drop the temporary	rejected
h382_udp_socket_read_after_close	§6.4	B	a UdpSocket was the runtime record's address with no drop; udp_close freed the record every copy still named: a shared handle with a drop, udp_close only stops the socket	runs-clean
h383_udp_socket_never_closed_leaked	§6.4	B	as h382, a socket never closed leaked its record and fd: its last owner closes it	runs-clean
h384_closure_bound_then_returned_over_a_parameter	§2.11	A2	a closure literal bound to a local, then returned over a String parameter: retclo recorded only a literal written in the ^; the caller freed its argument and the closure read freed memory (UAF); a returned value that may hold a closure lends what its source expression reaches	rejected
h385_closure_over_a_view_of_a_parameter_returned	§2.11	A2	as h384, a closure over a local view of the parameter (: s v ( string_data s ))	rejected
h386_closure_returned_through_a_join_over_a_parameter	§2.11	A2	as h384, through a join of closure literals in the ^	rejected
h387_closure_binding_reassigned_then_returned_over_a_parameter	§2.11	A2	as h384, a closure binding given a new closure over the parameter	rejected
h388_closure_bindings_joined_then_returned_over_a_parameter	§2.11	A2	as h384, a join of closure bindings	rejected