Template-family batch (2026-07-07 review). SSTx.h contains literal non-C (FILEmaok64 sst(path); — a botched mass-rename) and its test target is commented out; the convergent HASH insert compares against a stale hash; several templates have instantiation traps that only the current one-type- per-TU usage hides.
SSTx.h:34 ok64 o = FILEmaok64 sst(path); — not C; also calls
nonexistent FILEmapnew/TLVFeedkv/FILEresize/FILEclose/ FILEunmap; test/CMakeLists.txt:258 has SSTtest commented out. If revived, note: metalen + datalen u64 wrap bypasses the bound check (:37); SSTmeta accepts metalen < header → inverted slice (:13); hasindex returns a boolean as ok64 (:46). NEEDS A RULING: revive or delete.
HASHx.h:88-89 — convergent insert: after Swap(&r, slot) the carried
record's hash is hash2, but hash is never updated; later hash2 > hash comparisons use the stale value → final layout depends on op order, defeating ABC_HASH_CONVERGE's bit-state guarantee (HASH.md). Lookups unaffected. Also hashEq arg order flips between scan (:37) and Get/Del (:56-84).
MSETx.h:170 MSETSeekZ — binary-search via sFindGE (hardwired
default Z, Sx.h:239) inside a custom-z seek: garbage positions for any non-default order. Add sFindGEZ or document z==Z.
MSETx.h:269 MSETGet — if (n > MSET_MAX_LEVELS) n = 24; silentlyexcludes newest runs → MSETNONE for existing keys; error instead.
HEAPx.h:115-133 sTopsZ — no empty-heap guard, fabricates a
1-element slice over nothing (OOB for consumers); twin MSETTopZ guards. HEAPx.h:149 sHeap(heap, z) ignores z, calls default-Z. Both currently caller-less; fix or drop.
SKIPx.h:38 — (1 << hi) - 1 int-shift UB/garbage for hi ≥ 31,
legitimately reached past 512 GiB logs; ((size_t)1 << hi). Also SKIP_BLK_MASK 1UL << 64 UB for a u64 instantiation, and SKIPfinish/SKIPload byte-vs-element mismatch for sizeof(T) > 1 (u8-only today). (MEM-021 owns the :45 off-by-one.)
DIFFx.h:153-187 — degenerate FindMiddle result (x==0, y==0, lenrevalidated to 0) recurses on the IDENTICAL subproblem → stack overflow; the code already distrusts FindMiddle (revalidation pass), so add the one-line progress guard. Also i32 truncation for ≥2^30 inputs (DIFF.h:22 masks run lengths, no error).
X (non-u8 instantiation breaks unless NFA.h came first); HEAPx.h:3 + LISTx.h:3 never #undef T (leaks into every TU via DIJK.h/LSM.h); HASHx.h:133 undefs ABC_HASH_LINE but not ABC_HASH_CONVERGE; SKIPx.h undefs never-defined aSKIP, leaves T/SKIP_* defined; SSTx.h leaks a bare Key typedef.
LIST.h:21-23 — dead macros referencing _ (PRO's carrier is __)
and Batp(...).next (type error); zero users; delete or fix.
COMB.h:14 — const char* COMBmagic = ... non-static DEFINITION in a
header (duplicate symbol for multi-TU includers); COMBload (:25-31) restores b1/b2 from stored offsets with NO magic check and no range validation vs Blen — COMB.md advertises cross-process sharing, so the offsets are untrusted. COMBsize breaks on 32-bit (16 B header vs 32 B written). Bodies not do-while-wrapped.
HITx.h:121+ — drain family writes through a bare unbounded X(,p)*cursor (Merge/Intersect too) where twin MSETMerge takes a slice + NOROOM; HITx.h:323 HITIsCompact/Compact near-duplicate MSETx.h:224 with different NOROOM codes — one home for the LSM-ladder logic.
ROCKMERGE.h:43 — int i counter can overflow (total can exceedINT_MAX; the header exists to be overflow-paranoid, MEM-012). ROCK.c LOWs: ROCKerr frees the message unread; Init test() paths leak opt/topt/cache; Iter Key/Val skip NULL checks; SetMerge twice leaks.
tests; a non-u8 instantiation test TU to pin the template hygiene.
where a repro proves it wrong. Review-gated abc/.
fixed-key variant never shipped.