• cas/mcp: BREAKING CHANGE: remove type:'url' from cas_add — no purely-TypeScript check closes every symlink/TOCTOU variant on a client-supplied path. Large content goes through the cas CLI instead #1236
• fsc: use assertEq instead of a hand-written if/throw in a proof case — an inline if/throw is itself a permanently-uncovered branch. Documented as an AGENTS.md testing rule #1234
• base64: fix encode silently producing a string for an over-maxLength vector — the explicit padding step is dropped, since baseN's vecToString already left-pads a trailing partial chunk #1229
• fs/effects: add the okStep / mapOk step adapters — collapses the hand-written "error passes through, ok continues" check that recurred at five Effect<O, IoResult<T>> call sites #1228
• js/tokenizer: reject unescaped control characters in string literals, as RFC 8259 §7 requires — fixed once in the shared scanner, so fs/json, fs/djs, and fs/js all match JSON.parse #1218
• path: export isProperPrefix from fs/path/module.f.ts — moves the pure segment-based containment predicate out of the virtual FS rename handler #1210