Template-family batch (2026-07-07 review). SSTx.h contains literal non-C
(FILEmaok64 sst(path); — a botched mass-rename) and its test target is
commented out; the convergent HASH insert compares against a stale hash;
several templates have instantiation traps that only the current one-type-
per-TU usage hides.
SSTx.h:34 ok64 o = FILEmaok64 sst(path); — not C; also calls
nonexistent FILEmapnew/TLVFeedkv/FILEresize/FILEclose/
FILEunmap; test/CMakeLists.txt:258 has SSTtest commented out. If
revived, note: metalen + datalen u64 wrap bypasses the bound check
(:37); SSTmeta accepts metalen < header → inverted slice (:13);
hasindex returns a boolean as ok64 (:46). NEEDS A RULING: revive
or delete.HASHx.h:88-89 — convergent insert: after Swap(&r, slot) the carried
record's hash is hash2, but hash is never updated; later
hash2 > hash comparisons use the stale value → final layout depends
on op order, defeating ABC_HASH_CONVERGE's bit-state guarantee
(HASH.md). Lookups unaffected. Also hashEq arg order flips between
scan (:37) and Get/Del (:56-84).MSETx.h:170 MSETSeekZ — binary-search via sFindGE (hardwired
default Z, Sx.h:239) inside a custom-z seek: garbage positions for
any non-default order. Add sFindGEZ or document z==Z.MSETx.h:269 MSETGet — if (n > MSET_MAX_LEVELS) n = 24; silently
excludes newest runs → MSETNONE for existing keys; error instead.HEAPx.h:115-133 sTopsZ — no empty-heap guard, fabricates a
1-element slice over nothing (OOB for consumers); twin MSETTopZ
guards. HEAPx.h:149 sHeap(heap, z) ignores z, calls default-Z.
Both currently caller-less; fix or drop.SKIPx.h:38 — (1 << hi) - 1 int-shift UB/garbage for hi ≥ 31,
legitimately reached past 512 GiB logs; ((size_t)1 << hi). Also
SKIP_BLK_MASK 1UL << 64 UB for a u64 instantiation, and
SKIPfinish/SKIPload byte-vs-element mismatch for sizeof(T) > 1
(u8-only today). (MEM-021 owns the :45 off-by-one.)DIFFx.h:153-187 — degenerate FindMiddle result (x==0, y==0, len
revalidated to 0) recurses on the IDENTICAL subproblem → stack
overflow; the code already distrusts FindMiddle (revalidation pass),
so add the one-line progress guard. Also i32 truncation for ≥2^30
inputs (DIFF.h:22 masks run lengths, no error).X (non-u8 instantiation breaks unless NFA.h came first); HEAPx.h:3 +
LISTx.h:3 never #undef T (leaks into every TU via DIJK.h/LSM.h);
HASHx.h:133 undefs ABC_HASH_LINE but not ABC_HASH_CONVERGE; SKIPx.h
undefs never-defined aSKIP, leaves T/SKIP_* defined; SSTx.h leaks a
bare Key typedef.LIST.h:21-23 — dead macros referencing _ (PRO's carrier is __)
and Batp(...).next (type error); zero users; delete or fix.COMB.h:14 — const char* COMBmagic = ... non-static DEFINITION in a
header (duplicate symbol for multi-TU includers); COMBload (:25-31)
restores b[1]/b[2] from stored offsets with NO magic check and no range
validation vs Blen — COMB.md advertises cross-process sharing, so the
offsets are untrusted. COMBsize breaks on 32-bit (16 B header vs 32 B
written). Bodies not do-while-wrapped.HITx.h:121+ — drain family writes through a bare unbounded X(,p)*
cursor (Merge/Intersect too) where twin MSETMerge takes a slice +
NOROOM; HITx.h:323 HITIsCompact/Compact near-duplicate MSETx.h:224
with different NOROOM codes — one home for the LSM-ladder logic.ROCKMERGE.h:43 — int i counter can overflow (total can exceed
INT_MAX; the header exists to be overflow-paranoid, MEM-012). ROCK.c
LOWs: ROCKerr frees the message unread; Init test() paths leak
opt/topt/cache; Iter Key/Val skip NULL checks; SetMerge twice leaks.sFindGEZ in Sx.h (sFindGE delegates); MSETSeekZ passes the
caller's z.ABC-015: container template fixes.