Second review copy, 2026-10-29 ~01:50 UTC, after Slowpen's source review. Supersedes scripts-for-review.tar. Not committed.
start-ocx.cr: connect and identity write bounded at 2 s (SO_SNDTIMEO); the receipt route read as src/ocx/cgi.cr reads a path, so /receipt/ and /receipt/x reach the service; --cap-drop ALL in the CGI sandbox.
receipts.cr: SQLite busy timeout 0 and lock waits in Crystal (sleep 50 ms, at most 2 s), so a locked repository stalls no other request; the whole connection bounded at 5 s.
record.txt: the scratch run with the four review tests (aliases, a lock on one repository while another is asked, the CGI sandbox from inside, a listener that never accepts).
