Four legit findings from the AI-skeptic review pass:

1. Go chunker emit() does two make+copy per chunk (the remainder copy is avoidable with an offset) — allocation-heavy. Perf before/after required.
2. Elixir within_limit uses length(oids) <= @max — O(n) guard traversing the list it bounds.
3. Magic caps (@max_chunks, @max_chunk_bytes, @max_manifest_bytes) are unrelated round numbers — derive/document the relationships without changing security semantics.
4. LCG generator copy-pasted across test files — share one helper per language.