- BinaryBBObserver extends SafetyObserver for binary BB analysis - Detects null-deref, div-by-zero, int-overflow via Z3 on binary paths - Wired into BinaryDetectorRunner in scan pipeline