Small-codec batch from the 2026-07-07 review. The hex drain never validates the low nibble, OKscan recognizes "KO" (not "OK") as success, and the RON/ZINT feeds break the all-or-nothing Feed contract. All verified against the source; the OK/KO encoding was re-derived independently (OK=0x614, KO=0x518).
HEX.h:73-86 HEXu8sDrainSome — checks u == 0xff TWICE, never
l == 0xff: input "0g" decodes to 0xff and returns OK. Every odd-position non-hex char is accepted silently; hashlet/SHA parsing funnels through here.
OK.h:44-48 OKscan — if (oo == OK && *o == 0x518) *o = 0; butRON("OK") == 0x614; 0x518 is "KO". Print→scan round-trip of success yields 0x614 ≠ 0 (consumers: OK.cli.c, NEST.c:91).
RON.c:135-144 RONu8sFeedPad — writes via a local cursor, never
advances *into (chained feeds overwrite each other), and writes all width bytes BEFORE the val != 0 validity check → partial garbage on SBADARG. Tests read the pad directly, masking both.
RON.c:48-57 RONutf8sDrain — no length cap: 11+ valid chars silentlyshift high bits out (feed side caps at 11). Asymmetric, silently wrong.
RON.c:146-159 RONSpliceBase — need = 2*prob*n can wrap; avail
can reach 0 → division by zero at rand % avail.
ZINT.c:89-122 ZINTu8sFeed128 — public API ignores every u8sFeed*return; <16 bytes idle → some fields written, some skipped, returns OK with a corrupt encoding. abc.mkd: potentially-short feeds must be checked.
ZINT.c:79-87 ZINTu64sUndelta — *i + c wrap undetected while the
inverse Delta validates monotonicity; corrupt input decodes silently.
ZINT.h:45 ZINTu64feed demands 8 idle bytes even for a 1-byteencoding — spurious NOROOM near buffer end.
ZINT.h:121-127 — *(u64*)&val type-punning (strict-aliasing UB);
neighbors already use the memcpy-backed u8sFeed64.
short-slice ZINTu8sFeed128, undelta wrap.
contract compliance, length caps, checked feeds, memcpy punning.
OKscan fix changes observable behavior of ok64 parsing — grepdownstream (beagle) for reliance on the broken value first.