JS-101: HEAP/HASH/sort leaves read args[] past argc — OOB read from plain JS

Proposed by the 2026-07-07 jab multi-agent review; confirmed by both skeptic verifiers. The container leaves are the only bindings in the tree that skip the argc guard, so a short-armed call reads past the JSC argument array — undefined behavior reachable from any script.

Input

Context

jheap_<lane>_push reads args1 and (via RDV) args2/args3 with no argc check (jab heap.hpp:56-68); same in jheap_*_pop (heap.hpp:70-82), every jhash_*_put/get/del (hash.hpp:76-111), and jsort_<lane> (hit.hpp:92-103).
All are installed on the global abc object, so jab --eval "abc._heap_u64_push(new BigUint64Array(4))" (argc=1) feeds a garbage JSValueRef to JSValueToNumber.
Every other binding guards argc (cf. pack.hpp:74, ulog.hpp:45, hit.hpp:111) — only the HEAP_DEF/HASH_DEF/SORT_LEAF macro families lack the prologue.

Goals

Repro first: a test that calls each leaf with too few args and expects a JS throw, not a crash.
if (argc < N) JABC_THROW(...) in the HEAP_DEF/HASH_DEF/SORT_LEAF prologues; suite stays green.

Constraints

Fix in the macro prologues, not per-leaf; no unrelated test edits.

WIP

TODOs

repro: short-arg calls for heap/hash/sort leaves in test/ (expect throw)
argc guard in the three macro families