The run-merge stack (LSM.h/LSM.c/Y.h/Yx.h) has a room-check bypassed by a raw memcpy, a sort that can return OK having moved the data OUT of the caller's slice, and a qsort driven by a b8 less-than through an int comparator cast (UB + inconsistent order). Found 2026-07-07, all verified by inspection against the quoted lines.
LSM.h:20-27 LSMMore: the checked u8cssFeed1 is commented out,
replaced by memcpy(lsm[2], x, sizeof(u8cs)) with NO idle check — a full run stack takes a 16-byte OOB write. And u8cssUpZ(lsm, z) passes the BUFFER (PAST cells) where a slice is expected: the sift-up is a permanent no-op; only LSMMerge's from-scratch heapify masks it. HEAPu8csPushZ (used by test/LSM.c:54) is the correct helper.
LSM.c:83-84 LSMSort: LSMSort1's single-sorted-run early return
(LSM.c:58) writes nothing to into; the FIRST call handles runs==0 (data already sorted in place) but the SECOND call does not — data[1] = out2[0] then EMPTIES the caller's slice while the sorted content is stranded in tmp. "Roughly ordered input" (the module's stated target case) triggers it. Silent loss with OK status.
Yx.h:38 _X(sort): $sort(lsm, _X(z)) casts a b8(*)(a,b)
less-than to qsort's int(*)(void*,void*) — call through wrong type is UB (callee sets only AL), and 1/0 less-than is an inconsistent qsort order → arbitrary run order into _X(merge). LSMMerge does it right via u8cssHeapZ.
Yx.h:17 — u8cssFeedP(inidle, &next) return dropped; >64 tied runs(Y_MAX_INPUTS pad) silently lose the 65th record, OK returned.
LSM.h:5 #include "PRO.h" — PRO.h must never be included by a header(INDEX.md §OK.h; abc.mkd §PRO.h flow); pollutes every including TU.
input asserting content survives in data; Y merge with >64 tied runs.
copy-back, heap-order instead of qsort in Yx, check the FeedP, move the PRO.h include into the .c files.
s_purge fix in ABC-005 (same consumers) — scheduleafter or in one tree.