AnyPS5/docs/dev/debt/libSceJson2.md

libSceJson2 technical debt

SDK 5/6 below refer to the application compatibility SDK queried by sceKernelGetCompiledSdkVersion (process-parameter offset 0x10). The PS5 SDK field at 0x14 and the console firmware version are distinct.

Unknown function info

• JSON real-number conversion - floating-point environment behavior and malformed numeric-token grammar remain unverified. Valid decimal conversion follows the instructions at 0x7750: separate multiply/add accumulation, per-digit fractional division and repeated exponent scaling. Reference-backed exact-bit tests cover signed underflow, subnormals, normal boundaries, large finite values and overflow across special-float modes. These results intentionally retain the reference rounding, which differs from standard correctly rounded conversion. Formatting still uses locale-independent to_chars with 17 significant digits for modern settings; broader formatting equivalence remains unverified.

• sce::Json::Array::pop_front - the console result for an empty array remains unverified; the existing host behavior throws std::out_of_range. Missing storage throws unsupported. Nonempty removal releases the allocator-owned node without allocating and preserves surviving element/iterator identity.

• sce::Json::Parser::parse - null text with nonzero size throws; decimal overflow follows the configured real-conversion mode. Numeric-token validation, more complex parser allocation failures and cross-thread operation behavior remain incomplete. Parsing mutates the supplied destination, following 0x6940, 0x6840 and 0x5d30: failed arrays/objects retain admitted entries, strings append their decoded prefix, and incomplete scalar literals preserve the previous value. Existing collections retain their entries across later parses. Local tests cover nested parent links, duplicate-member failure, type transitions and actual allocator cleanup; the same contract passes the reference module. These checks do not establish allocator-failure equivalence or Linux/Windows guest execution.

• sce::Json::InitParameter2, InitParameterRtti and InitParameterRtti2 (libSceJson2) - initialization owns its allocator-backed context, default resources, module fallback and kernel synchronization handles. Allocation admission, rollback and retry follow the observed default-resource protocol; file-buffer size is snapshotted and used by file parsing. Remaining kernel-status and callback/concurrent lifecycle paths, plus full guest execution, remain unverified. The active-byte and enum validation rules follow the inspected initializer at 0x920 and 0x12b0–0x13f7, with local allocation-failure coverage. The module firmware version is unverified; these are library observations, not console measurements.

• sce::Json::Value auxiliary ownership - values use the inspected 32-byte inline payload and parent layout, and allocator-backed auxiliary ownership. Outer value handles, string headers and characters, array and object storage and their iterator states use the supplied allocator; module defaults are allocated during initialization, including admitted partial default resources. Request sizes, failure admission and SDK-dependent ownership below SDK 6 remain incomplete. Modern callbacks and SDK 5 mismatch-map copying have reference-backed contracts below; legacy special-float/element registration and full guest execution remain incomplete.

• InitParameter2 special-float configuration follows assignment helpers at 0x40a0 and 0x41a0 and formatting at 0x26a0: mode 0 converts non-finite numbers to strings, mode 1 to null, and mode 2 retains real values and emits lowercase non-JSON tokens. Parser acceptance of those tokens, floating-point exception flags, signaling-NaN behavior and concurrent reconfiguration remain unverified. Legacy initialization does not enable the conversion; its internal formatter is now reproduced through the inspected float32 conversion, six truncating fractional digits, range saturation and NaN integer result. The regression covers signed zero, precision boundaries, large values, infinities and NaNs; floating-point rounding modes and exception flags remain unverified. Value::set(double) and toString(String&) expose no consistent return value and are declared void.

• sce::Json::Object::Pair, sce::Json::Array::iterator and sce::Json::Object::iterator members (libSceJson2) - Pair allocator-callback reentry and inherited older-SDK failure scopes still require audit. Both Pair constructors preserve the eight bytes between key and value and inactive Value bytes, following 0xc230 and 0xc280. Reference tests cover both constructor/destructor aliases, all value tags, independent copies and allocator cleanup. Array and object postfix increment use this and the dummy integer argument and advance in place, following 0xb270 and 0xc4a0; they do not take a hidden result pointer. This ABI is verified against the inspected module, not every firmware version.

• sce::Json::Value handler registration - legacy special-float/element registration and libc-heap failure handling remain incomplete. Modern auxiliary records, fallback values and callback records use the supplied allocator. The inspected setters at 0x39c0, 0x3b00, 0x3e90 and 0x3fa0 reject owned children with 0x80848104. The value null-access setter is a three-argument member returning status, rather than a static callback setter. Legacy mismatch-map storage is covered separately below; other SDK-dependent legacy combinations remain unverified.

• sce::Json::Value type-mismatch dispatch - libc-heap failures and untested legacy callback combinations remain incomplete. Global registration follows 0x1480; root-local mismatch precedes global null recovery, followed by global mismatch. Current root lookup and borrowed-result dispatch follow 0x22b0 and 0x2930, including requested type, source, immediate parent, callback precedence and a shared reentry guard. Additional legacy compatibility remains unverified.

• sce::Json::Value element-access failure dispatch - SDK-dependent dispatch remains incomplete. Global registration and fallback selection follow 0x1670 and 0x2c70. Root-owned fallback identity, reentry suppression and errors 0x80848115 through 0x80848118 follow 0x2c70, 0x4e80 and 0x5070. Nested fallback payload failures and compatibility below SDK 6 remain incomplete.

• sce::Json::Value special-float recovery - allocator-backed value failures remain incomplete. Global registration follows 0x14f0, including legacy-initializer rejection and duplicate registration; root handlers precede global handlers. Root recovery follows 0x2b90, 0x2d90 and 0x41a0, including the hidden result object, temporary cloning and teardown, function types 0/1, optional error flag and reentry suppression. SDK-dependent registration below SDK 6, signaling NaNs and floating-point exception flags remain unverified.

• sce::Json::MemAllocator::notifyError (libSceJson2) - the base class's virtual does nothing; whether the console's base implementation logs is unknown. String, array, object, callback metadata and file-buffer allocation failures dispatch the supplied allocator's notifier.

• sce::Json::String size, capacity, resize, append(const char*, size_t), operator+= (libSceJson2) - headers and characters use the supplied allocator, with the inspected 24-byte header and 32-bit capacity. Constructors, clear, reserve, resize, copy, assignment and append failure contracts follow 0xa100–0xb0a0, 0xde50 and the instructions at 0xdf20. Overlapping assignment, exact substring temporary allocations, allocator failure propagation through every value/parser operation and native assertion behavior for sizes above 32 bits remain incomplete. SDK-dependent growth reads process parameters; missing metadata uses the reference query-failure rule. Failed host metadata lookup is remembered to avoid repeated allocating exceptions; successful SDK queries remain live. Appending null text with a nonzero length throws instead of dereferencing it.

• sce::Json::Array::iterator::advance and Object::iterator members (libSceJson2) - the source-level return type of advance remains unverified; array advancement is declared void and tested for its side effects. Object iterator advancement past the end throws instead of asserting. Array iterators expose the inspected node payload address, including the sentinel; missing-state Array dereference/arrow share the initialized 32-byte allocator-owned fallback with keyed lookup. Iterator access allocates nothing and preserves its bytes under allocation failure.

• sce::Json::Value::operator bool - untested legacy callback combinations remain incomplete. Modern root-local mismatch precedes global mismatch; ordinary boolean values bypass both. Root-local mismatch dispatch precedes ordinary conversion, following 0x2100; the returned value is read through its boolean getter under the shared callback guard.

• sce::Json::Parser file input - allocator failures outside the file buffer and callback-read failure combinations remain incomplete. Buffer ownership and the read adapter follow 0x69c0 and 0x6b20; local contract tests substitute the kernel file boundary and do not prove guest filesystem integration on Linux or Windows.

• sce::Json::Array storage and iterators - nested value-copy allocator failures, shared concurrent allocation-operation accounting and legacy parent binding remain incomplete. Header, sentinel, node and iterator allocation follow 0xb2d0, 0xb410, 0xb540, 0xb6f0 and 0xb130; local contract tests cover scalar/nested copies and partial ownership. Failed node allocation in push_back removes the existing last entry, following 0xb880; this behavior is verified against the inspected module only. Circular traversal follows 0xb250 and 0xb290; large advances reduce complete cycles without changing the resulting node. front on a partial header with no sentinel throws instead of dereferencing null. Full Linux/Windows execution is unverified.

• sce::Json::Object storage and assignment - legacy ownership, callback-bearing copies and concurrent operation accounting remain incomplete. Allocator-backed tree nodes can retain incomplete entries or a source count exceeding their live nodes after copy failure (0xca40, 0xe000). Modern assignment (0xd400) preserves the original on initial allocation failure but can replace it with partial entries after later failures; self-assignment rebuilds the tree. Legacy insertion copies the pair directly. SDK 5 boundary tests do not establish cross-firmware compatibility. Erasure allocates nothing (0xd350). Missing-state iterator dereference throws if its temporary default iterator cannot be allocated; the reference can recurse. Full Linux/Windows execution remains unverified.

• sce::Json::Parser embedded zero characters - decoded Unicode zero is discarded through the inspected character-append behavior. Binary string values serialize using their stored length, while object keys serialize their C-string prefix. Broader malformed Unicode handling remains incomplete.

• sce::Json::Value handle admission and type changes - collection copy/assignment failure ordering, nested recovery failures and older SDK compatibility remain incomplete. The supplied allocator owns each eight-byte complex-value handle. Typed construction and type changes follow 0x580, 0x10d0, 0x1170 and 0x1210: the old payload is destroyed before replacement admission; string/header failure leaves null, an array can retain a header without its sentinel, and object construction reclaims a failed sentinel. Scalar changes preserve inactive payload bytes. Special-float string conversion follows the temporary string at 0x40a0; failure of its header preserves the prior value, while later failures can leave null or an empty string. Local tests cover SDK 6 process metadata, not every firmware version.

• sce::Json::Value auxiliary admission and retry - legacy special-float and element registration remain unsupported and throw. The helper at 0x3280 allocates 24 bytes below application SDK 6 (0x34d1), while the setters at 0x3e90 and 0x3fa0 read/write handler slots at offsets 0x20 and 0x28 without an SDK check. Those accesses exceed the legacy allocation, so this implementation throws. Modern admission follows 0x3280: a failed fallback allocation retains the 72-byte auxiliary record; later registration reuses it without recreating the missing fallback. Local tests cover all four callback setters, their allocation failures, replacement and null callbacks, child rejection, parent preservation and teardown through the original allocator. Legacy auxiliary records use 24 bytes; mismatch callbacks use a separate map whose header uses the supplied allocator and whose 56-byte nodes use libc new/delete.

• sce::Json::Value scalar and string copying - nested collection assignment failures remain incomplete. Scalar and string dispatch follow 0x1e40: null and boolean copies preserve inactive destination bytes, numeric values retain their exact payloads, and string assignment changes type before copying characters into the existing header. A character-allocation failure can empty an existing string; it does not restore its old contents. Copy construction initializes ownership metadata directly, following 0x1e20. Local allocator tests cover null, boolean, signed, unsigned, finite real and string sources across all destination types and failure budgets.

• sce::Json::Array and Value collection assignment - nested allocator failures, legacy callback propagation and concurrent operation accounting remain incomplete. Modern array assignment follows 0xbc80: initial header/sentinel failure preserves the original, node failures retain a partial replacement and iteration continues, self-assignment replaces the header, and entries bind to the destination owner. Legacy assignment uses replacement list storage inside the existing header, following 0xb540. Value collection dispatch follows 0x1e40, changing type before invoking Array/Object assignment rather than cloning through their copy constructors. Local tests cover scalar array assignment, self-assignment and empty collection Value admission across destination types.

• sce::Json::Value constructors and setters taking Array/Object - nested allocation failures and older SDK compatibility remain incomplete. These paths follow 0x1d00, 0x1d50, 0x1d90 and 0x1de0: a missing source header is ignored, while admitted inputs change the destination type before collection assignment. Missing-header construction initializes null ownership metadata without changing inactive payload bytes. Self-setting retains the Value handle and callback metadata while replacing collection storage. The setters expose no consistent status result and are declared void; local tests verify side effects rather than a fabricated success return.

• sce::Json::Value nested array allocation regressions - local same-source tests cover every allocation point in copying and assigning an array containing a string, integer and inner array containing another string. Persistent and single-allocation failures preserve the observed null entries, empty strings, missing sentinels, parent links, error counts and actual owned cleanup. These checks do not complete nested object failure coverage, callback-return cloning failures, legacy SDK behavior or full guest execution.

• sce::Json::Initializer resource admission - returned kernel setup/locking errors, recovery-callback termination and active-operation allocator-callback termination remain explicitly unsupported; concurrent/reentrant lifecycle and Linux/Windows integration remain unverified. Reference tests cover SDK 5/6 allocation failures, partial admission, null frees and retry; SDK 6 tests also reject duplicate initialization and inactive termination from allocate/notify/free callbacks while the context remains published. Seventeen host-boundary schedules verify mutex-construction errors/exceptions, balanced guest/attribute/mutex ownership and retry. Setup exceptions reclaim local resources before global rollback. The reference skips creation after attribute errors and ignores mutex-init/destroy results, potentially retaining unwritten handles; safely reproducing those states remains unverified.

• sce::Json::Value legacy mismatch map - legacy special-float/element registration and libc allocation exceptions remain incomplete. Map registration, lookup, copying and destruction follow 0x3b00, 0x7230, 0x22b0, 0x1e40 and 0x1810: a parsed root must already own auxiliary metadata; a shared 24-byte map header uses the supplied allocator, while its sentinel and entries use libc new/delete. Copies propagate callback records independently of auxiliary ownership. Empty map storage survives until termination. Local SDK 5 tests cover replacement, null handlers, parent dispatch, null-recovery ordering, swap temporary cleanup, tree balance, erasure and both allocator domains. Sentinel/entry allocation exceptions and retry follow the reference contracts below; broader exception paths remain unverified.

• sce::Json::Object nested allocation regressions - local tests cover 322 copy-construction and assignment cases for an object containing a string, inner object/string and array. Persistent and single-allocation failure budgets exercise every allocation position through successful completion (50 allocations for construction, 109 for assignment). Reference comparisons cover retained partial contents, collection counts, parent/owner links, request counts, notifications, unchanged source state and allocator cleanup. Construction may retain a source count larger than its admitted nodes and leave copied root entries unbound; tests preserve those observed semantics. Callback-bearing copy failures, alternate SDK behavior and concurrent failure accounting remain unverified.

• sce::Json::Parser value admission - recognized values change type before root metadata admission, following 0x5d30 and 0x3280; incomplete scalar tokens allocate no auxiliary record. Twelve reference-backed string cases cover persistent and one-shot failure at every allocation position, retained type, error status, request/notification counts, character retries and cleanup. A failed character allocation can discard the first character while later characters are admitted. More complex parser low-memory paths and callback-driven allocation failures remain incomplete; reference execution terminated during one missing-sentinel array case, so that case does not establish a verified recovery contract.

• sce::Json::Parser array allocation failures - numeric token storage uses the supplied allocator; array parsing uses the public append implementation. Parser and append operations share the depth/error flag observed at 0x6840, 0x310, 0x340 and 0xb880, retaining inherited errors until the outer operation finishes. Twenty-four reference-backed cases cover persistent and one-shot failures through successful parsing, partial counts, numeric-zero fallback after token-allocation failure, string suffixes, parent links, notifications and cleanup. Missing-sentinel parsing throws unsupported because reference execution crashes; callback-bearing collections and concurrent behavior remain incomplete.

• sce::Json::Parser object allocation failures - object keys use one allocator-backed string reused between members, following 0x6250; lookup closes its shared operation scope before assigning the exposed key and owner, following 0xda40. Sixty-six reference-backed cases cover persistent and one-shot failure at each returning allocation position through a 33-allocation successful parse of an object containing a string and array. Checks include partial keys/members, numeric and string fallback values, parent links, error status, request/notification counts and complete allocator cleanup. The nested array sentinel failure is excluded because reference execution crashes; more complex nested objects, callback-driven allocation failures and concurrency remain unverified.

• sce::Json::Collection inherited allocation errors - array assignment, object assignment/insertion and legacy mismatch-map updates now use the shared depth/error protocol instead of counter snapshots, following 0xbc80, 0xd400, 0xcd30 and 0x3b00. Six reference-backed public parser/read-callback cases invoke array assignment, object assignment or insertion after a one-shot character allocation failure, plus healthy controls. Checks cover placeholder retention, skipped payload binding, unchanged source, outer error persistence, recovery on the next independent parse and complete cleanup. Baseline and targeted assignment/insertion mutations fail these checks. Callback-return cloning and cross-thread failure propagation remain unverified; legacy map updates under inherited failure are covered separately below.

Unknown 3.20 import declarations

• _ZN3sce4Json12MemAllocatorD0Ev (libSceJson2) - NID ypazoTrKYhE; the deleting base allocator destructor traps in the reference. This invalid destruction path remains explicitly unsupported.

• Counted string searches with an admitted positive count and a null needle remain explicitly unsupported; the reference dereferences the invalid pointer. Oversized and zero counts retain their verified results.

• sce::Json::Array::erase - invalid, missing or sentinel positions in an allocated array remain explicitly unsupported. Reference invalid-iterator paths can corrupt storage or fault; valid erasure retains its mutation when returned-iterator allocation fails.

• Array insertion and payload transfer - nested copy-stage failures, missing-sentinel paths and older-SDK callback combinations still need direct regression coverage. String-copy failures and successful nested-array transfer follow the reference protocol. Forty-eight additional reference-backed cases reject every temporary iterator allocation during transfer of three-element nested arrays and objects, using persistent and one-shot failure schedules. Insertion retains the new node and rebinds only the admitted child prefix; prepending removes the new entry on failure. Checks cover exact requests/notifications, surviving iterator identity, existing destination order, unchanged source bytes and allocation generations, result identity, ordered object keys, nested links/counts and complete cleanup. Invalid insertion iterators are explicitly unsupported.

• Value keyed lookup - valid string-key overloads and C-string key-construction failures follow the observed iterator allocation and fallback protocol. Missing object handles, corrupted tree storage, lifecycle reentry during lookup and remaining older-SDK callback combinations remain unverified; invalid reference arguments are explicitly unsupported.

• Value callback serialization - nested iterator/metadata failures, non-finite recovery failures, lifecycle reentry, other legacy callback combinations and floating-point environment behavior still require audit. Null callback/output references are explicitly unsupported. All serialization shares the collecting/traversal protocol. Reference tests cover modern chunk boundaries, callback results, output mutation, scalar allocation failures and opening-callback array mutations. SDK 5 tests cover root admission/reset, child metadata release, numeric edge cases and persistent/one-shot root admission failures.

• Parser parent and auxiliary transitions - allocator-driven lifecycle changes, more complex nested metadata failures and alternate SDK combinations still require audit. Six notifier-reentry cases cover failure publication after notification, nested failures, callback-return copying and retry. Reader-driven allocation failures are checked before starting a value, following 0x5d30; an already-started literal still completes, while outermost completion reports and clears the shared failure. Reference tests cover direct parsing into an owned child across eight value forms, six root-admission failure/retry cases, incomplete-literal preservation, modern root callback retention and nested release of three handler records, fallback and auxiliary in native order. Allocation generations distinguish release from later address reuse.

• Special-float callback-return allocation - more complex object shapes, allocator-driven lifecycle changes and alternate SDK combinations remain unverified. Twelve reader/notifier-reentry cases verify delayed failure publication, inherited nested failures, string/object/nested-array callback returns, literal completion, request-order fingerprints and retry. Reference tests cover 834 persistent/one-shot cases through successful string, one-entry object and nested array/object recovery for assignment and serialization. Checks include partial contents, internal-key lookup, allocation-order fingerprints, notifications, callback ABI, destination metadata generations and complete cleanup. Object assignment copies the internal tree key separately from the public pair key, following 0xd400; these can diverge after allocation failure.

• Object Pair allocation and teardown - inherited failure scopes, allocator-driven reentry and alternate SDK behavior remain unverified. Reference tests cover 1,320 modern persistent/one-shot cases with and without four registered source handlers through every allocation position for default, null, string, nested-object and nested-array copies across both constructor/destructor aliases. Checks preserve inactive bytes, partial contents, collection counts, child parents, storage owners, allocation generations, request/notification order and construction/destruction release identities. Source auxiliary bytes, generations and handlers survive cleanup. Pair teardown releases the value before the key, following 0xc2b0. Failed temporary header allocation in modern collection assignment still calls the allocator free function with null, following 0xbc80 and 0xd400; failed sentinel allocation reclaims its admitted header.

• Modern callback-bearing copies - allocation-failure combinations, nested owners, lifecycle changes from callbacks and alternate SDK behavior remain unverified. Fifteen reference-backed cases exercise null, real and object sources with all four local handlers through Value construction, assignment with/without destination handlers, Pair construction and standalone Array insertion. Modern copies discard source-local handlers; assignment retains destination handlers. Tests invoke null/mismatch/element/float recovery and verify complete auxiliary bytes, fallback ownership, all callback-record generations, borrowed replacement identity and source-handler usability after copy destruction.

• Callback-time termination - composite-destruction reinitialization, teardown exceptions and unmeasured publication variants, concurrent lifecycle, older SDKs and guest-kernel error responses remain unverified. Recovery-callback owner termination and allocate/notify/free callback termination inside an active allocation operation are explicitly unsupported before teardown. Reference recovery/notifier probes reused freed/null mutex slots after termination and faulted at the substituted kernel boundary; direct allocate/free probes also faulted after termination returned success. These are not console measurements. Reference-backed controls preserve inactive-initializer termination, standalone Malloc-notifier termination and standalone Free-callback termination/reinitialization. Production tests verify ownership-preserving refusal, repeatable recovery, successful parse continuation, OOM/retry and fresh module generations.

• Termination reentry - callback exceptions during partially completed teardown and older-SDK combinations remain unverified. Nested owner termination while cleanup is already active is explicitly unsupported before further ownership changes. The reference allocator observed a duplicate free request when a teardown free callback recursively terminated the module; a standalone Free callback retained its target until its original release completed. Twelve production cases exercise reentry at every normal module release position, require one refusal and exactly twelve releases, and verify that the outer call completes and the next module generation initializes and terminates normally.

• Initialization callback publication - concurrent publication remains unverified. One hundred forty-four direct-allocator reference cases span SDK 5/6, both initializer overloads, shared/separate owners and receiver/context domains. They verify saved file-buffer settings, nested handoff, completed nested lifecycles and retry. Double success orphans the first epoch in its original domain: eleven resources/one mutex for SDK 5, twelve/two for SDK 6. Outer termination reclaims only its own epoch and nested termination reports not-initialized. Tests assert ownership and stale-domain avoidance, then separately reclaim the observed orphaned epoch through the caller-owned fixture. SDK 5 teardown also forwards its observed null free; fixture reclamation is not library cleanup.

• RTTI initialization publication - concurrent reconfiguration and thrown allocator callbacks remain unverified. One hundred ninety-two additional SDK 5/6 reference cases cover legacy construction/newer RTTI setters, shared/independent contexts and configuration before initialization or inside its first allocation callback. All parameter objects share one adapter. An already-entered first allocation uses the original callback once; subsequent allocations and releases use the latest table while preserving each context and file-buffer setting. Tests cover handoff, lifecycle completion, orphaned epochs, SDK-specific mutex ownership and retry, distinguishing actual RTTI releases, SDK 5 null-free callbacks and later fixture reclamation.

• Legacy Pair callback copies - inherited failure scopes, allocator-driven reentry and libc allocation exceptions remain unverified. Thirty-six SDK 5 reference-backed cases cover numeric and string sources with a registered mismatch handler, both constructor/destructor aliases and every guest allocation failure position through success using persistent and one-shot schedules. Even a null partial copy retains its independent callback map record. Checks cover exact request/notification order, partial key/text admission, inactive Pair bytes, borrowed callback result identity, independent auxiliary ownership, source allocation bytes/generations and source callback usability after copy cleanup. Every case restores the original live generations in both the guest allocator and libc heap.

• Legacy nested Pair copies - inherited failure scopes, allocator-driven reentry and libc allocation exceptions remain unverified. One hundred fifty-two SDK 5 reference-backed cases cover an array containing an object/string and an object containing an array/string, both Pair constructor/destructor aliases and persistent/one-shot failure at every allocation position through eighteen-allocation success. Checks cover partial counts, missing sentinels, independent internal/public object keys, exact request/notification fingerprints, inactive bytes, source bytes/generations and both allocator domains. Copies retain the root mismatch-map callback independently of auxiliary metadata; unbound descendants use typed defaults without inheriting that callback. Root and source recovery remain callable after copy cleanup.

• Legacy callback map inherited failures - allocator-driven lifecycle changes, concurrent propagation and thrown callbacks remain unverified. Fifty-four SDK 5 reference cases cover scalar and nested Array/Object copies through Value and both Pair constructor aliases, new/existing records, healthy readers, published errors and notifier-time registration. Published failure preserves existing handlers or retains empty records; payload copying still completes. Notifier-time copies retain callbacks before error publication. Checks cover exact requests/notices, Pair padding and independent keys, nested contents and parent links, borrowed callback results, source bytes/generations, record-reusing retry and cleanup in both allocator domains. A mutation that skips collection copying after inherited failure is detected.

• Composite-destruction termination - additional legacy callback combinations and thrown callbacks remain unverified. One hundred ten SDK 6 reference cases cover both Value destructor aliases, four payload/metadata shapes and every release position. Following 0x17e0, destruction requires the published recovery mutex after clearing the payload; callback termination during payload release therefore preserves the auxiliary pointer and bytes. Checks cover exact release-generation prefixes, allocator receiver/context, module/source ownership, repeated destruction and fresh initialization. Early termination orphans the remaining caller allocations; final-release termination completes cleanup. The caller-owned fixture separately reclaims the observed orphaned epoch. The pre-fix destructor fails the auxiliary-retention regression.

• Legacy auxiliary-cleanup termination - a missing recovery mutex after auxiliary-release callbacks is explicitly unsupported at legacy map cleanup, before kernel use. Eight reference probes across both Value destructor aliases returned termination success, then faulted through a null mutex slot at the substituted kernel boundary; these are not console measurements. Ninety-two termination-only production cases cover 84 returning reference cases and eight explicit errors. Checks preserve eleven module resources plus the observed null free, release prefixes, auxiliary state, allocator identities and retry. Termination itself remains allowed so its callback can reinitialize before cleanup resumes. Thrown callbacks remain unverified.

• Composite callback reinitialization - repeated nested reinitialization and thrown callbacks remain unverified. Five hundred sixty-four SDK 5/6 reference cases cover both destructor aliases, every release position and shared, changed-context or changed-receiver/context domains. The already-entered free keeps its original receiver/context; subsequent releases use the newly published allocator even for old allocations. Reinitialization admits a complete fresh module epoch and lets auxiliary/map cleanup finish. Tests verify release identities/order, domain routing, complete payload cleanup, repeated destruction and later module retry. The pooled backend records cross-domain dispatch; it does not establish safe transfer between independent allocator pools.

• Initialization allocator exceptions - rollback free exceptions and guest exception integration remain unverified. Fifty isolated SDK 5/6 reference-backed cases cover allocator/notifier throws at each resource position and success. Throws propagate with their original identity and no frees. A first context allocation returning null reports OOM without notifying; a first allocator throw propagates. Both permit retry. Later throws retain admitted resources, leave owners inactive and reject termination/retry. Checks cover resource sizes, receiver/context, exact notifier error/size and both owners. The fixture separately reclaims orphaned storage and any host mutex. SDK 5 normal teardown forwards its observed null free. Null-return rollback and kernel setup error cleanup remain covered. Pre-fix rollback and swallowed-notifier mutations fail the regressions.

• Termination free exceptions - nested cleanup, callbacks freeing then throwing at other stages and guest exception integration remain incomplete. Fifty SDK 5/6 reference cases cover throws around twelve frees and healthy controls, preserving exception identity, owner activity, release prefixes and initialization refusal. Sixteen returning retries cover null frees, retained generations and fresh owners. Completed defaults forward null frees during retry; the old ready gate fails the regression. Eighteen production cases reject destroyed mutex slots or poisoned default inner headers before retry effects. Retirement survives callback exceptions and clears only after the corresponding release returns. Outer-handle retries remain available. Separate probes faulted at substituted kernel boundaries or requested released resources; these are not returning contracts or console measurements. Fixture reclamation is separate.

• Legacy map heap exceptions - nested copy/erase exceptions and concurrent lock ownership remain unverified. Three isolated SDK 5 reference cases cover sentinel allocation failure, entry allocation failure and success. Sentinel failure propagates std::bad_alloc and orphans an unpublished 24-byte header with only its count initialized; retry allocates a replacement header. Entry failure retains the published sentinel and retry reuses it. Checks cover guest/libc domains, absent guest notifications, source bytes/generations, callback identity, termination and fresh initialization. The fixture reclaims the unpublished orphan only after asserting that library cleanup left it intact. The pre-fix implementation replaces the exception with an unsupported error and fails the regression.

• Legacy copy heap exceptions - deeper entry-allocation exceptions during collection insertion and concurrent lock ownership remain unverified. Twelve SDK 5 reference cases cover Value and both Pair constructor aliases with scalar, string and nested Array/Object sources. Failure to allocate the destination callback-map entry propagates std::bad_alloc after payload copying. Pair keys remain independently owned; constructor unwinding does not release them. Checks cover exact guest requests, complete payloads, padding, absent copy callbacks, preserved source callbacks/bytes/generations, shared-map invariants, assignment retry and cleanup in both allocator domains. The pre-fix Pair catch frees the key and fails the retained-allocation regression. Fresh initialization succeeds after explicit destruction and teardown.

• Array child callback heap exceptions - concurrent publication and additional thrown-callback combinations remain unverified. Twelve SDK 5 reference cases cover both direct Array and Value-wrapped constructor aliases, failure at either child map entry and success. Construction publishes the initial empty destination before copying a temporary list; Value wrappers also publish their type and independent handle. Entry exceptions orphan the temporary sentinel/admitted nodes while completed callback records survive until module teardown. Retry replaces active storage without reclaiming orphaned links. Checks cover requests, generations, source bytes, map invariants, recovery, teardown and fresh initialization. Fixture orphan reclamation is separate. Pre-fix rollback and a mutation clearing the wrapper type both fail regressions.

• Object child callback heap exceptions - deeper tree shapes, guest allocator throws during cloning and concurrent ownership remain unverified. Twelve SDK 5 reference cases cover both direct Object and Value-wrapped constructor aliases, either child entry exception and success. The initial empty tree remains published while unfinished replacement nodes, keys and sentinel become orphaned; completed callback records remain until module teardown. Retry publishes a complete tree without reclaiming the orphaned replacement. Checks cover exact requests, source bytes/generations, tree contents, key storage, callback identity, published wrappers, retry, cleanup and fresh initialization. The fixture separately reclaims orphaned caller storage. The pre-fix recursive rollback and delayed destination publication fail the regression.

• Partial element-recovery fallback - nested callback-created fallback payload failures and older SDK dispatch remain unverified. Eight SDK 6 reference cases cover failure of auxiliary/fallback/handler admission and success, with and without callback reentry. Registration retry reuses admitted metadata without repairing a missing fallback. Parsing preserves that missing state; root/child failures invoke the handler and return the module fallback instead. Checks cover request order, error/index/source/parent ABI, suppression of recursive dispatch, visible scalar mutation, zero-allocation dispatch under failure, stable auxiliary/fallback/record generations and complete teardown. A mutation recreating the missing fallback fails the retry regression.

• Element fallback String allocation failures - nested collection payloads and thrown allocator callbacks during fallback mutation remain unverified. Twenty-four SDK 6 reference cases cover root/module fallbacks, root/child dispatch, all C-string setter allocation positions and success. The setter first allocates a temporary String; failed temporary admission preserves the destination. Later failures retain null or empty payloads and exact notices, including two notices after temporary character failure. Retry reuses admitted handles/headers while recreating temporary storage. Checks cover callback reentry, request order, visible text, metadata generations, source bytes, repeated recovery and complete teardown. The previous host-string temporary skipped guest requests and fails the regression. The setter at 0x1c00 leaves guard residue in the return register; it is declared void and tests check state rather than fabricated status.

• Value setter return ABI - String references invalidated by destination type changes still require runtime audits. Type, Boolean, signed/unsigned integer, String and Value setters expose no defined status result. The type helper at 0x580 ends with guard verification; scalar wrappers at 0x1a90, 0x1ae0 and 0x1b30 do not establish another result. The String overload at 0x1cc0 can return without setting a result; Value setting at 0x1e40 also leaves guard residue. Definitions and test declarations use void; tests retain content, layout, ownership and callback assertions instead of testing fabricated zero returns. The reference scalar-layout contract passes with the corrected declaration. Full guest integration remains unverified.

• Value String-argument setter - sources nested inside a destination being replaced, binary aliases and thrown callbacks remain unverified. Eighteen SDK 6 reference cases cover missing headers on numeric/String destinations, direct/shared-header aliases, optional root callback metadata and allocation disabled/enabled. Those paths preserve all Value/allocation bytes and perform no allocator effects. Independent-source controls copy text through the existing handle/header, clear old characters before failed character admission and retry successfully. The old host-string snapshot changed missing-header destinations and reallocated self-aliases; it fails the regression. Checks retain source text/ownership and complete cleanup. The implementation uses the String header and underlying text alias check directly.

• Value self-setting and assignment - nested older-SDK self-copies, non-finite recovery and interrupted modern nonempty self-copies remain unverified. Fifty-two SDK 6 reference cases cover all eight types through both entry points, empty collection admission failures and healthy nonempty Array/Object copies. Assignment at 0x20e0 unconditionally calls the setter and returns its receiver. Both operations rebuild collections while retaining the Value handle and callback metadata. Scalars and Strings naturally preserve their storage. Checks cover replacement/null-free sequences, rollback, inactive bytes, unaffected allocations, internal/public keys, nested contents and the observed nested-header owner rebinding. The old self-guards suppress replacement and fail the regression. All original/replacement storage is reclaimed on destruction.

• Legacy collection self-use - nested/child-callback self-copies and concurrent ownership remain unverified. Twelve SDK 5 reference cases cover empty Array/Object setters and assignment, sentinel allocation failure and success. Both entry points retain the 24-byte collection header and Value/auxiliary ownership while replacing the sentinel. Failure still releases the old sentinel and leaves a destructible missing-sentinel header. Same-Value retry repairs it without forwarding a null free. Checks cover exact requests/releases, live generations, unchanged callback/fallback/module bytes, partial destruction and fresh module generations. The previous Object replacement helper forwards an extra null free and fails the retry regression.

• Nonempty legacy self-use failures - nested/child-callback payloads, thrown callbacks and concurrent accounting remain unverified. Fifty-six SDK 5 reference cases cover two-element Arrays/Objects through setters and assignment, persistent/one-shot failure at every sentinel/node/key admission position and success. Exact request and released-generation fingerprints accompany checks of partial values, parent links, missing sentinels, independent internal/public keys and counts exceeding live nodes. Retry clones the actual partial state without restoring lost entries or inventing key/count repairs. Checks preserve module, handle, auxiliary and fallback bytes/generations and verify complete teardown. A mutation clamping a partial tree count to its live nodes fails the regression.

• Element fallback collection allocation failures - nested payloads, thrown callbacks and concurrent lifecycle changes remain unverified. One hundred fifty-two SDK 6 reference cases cover two-element Array/Object assignment into root-owned and module fallbacks, persistent/one-shot failure at every allocation position and success. Checks include reentry suppression, exact request/notice fingerprints, missing sentinels, partial values/keys/counts, parent links, header ownership and unchanged source/module/callback allocation generations and bytes. Independent retry completes the replacement; subsequent recovery retains its handle. Teardown reclaims all source, partial and replacement payloads. All production probe results match the reference. A mutation dropping the fallback collection owner fails the regression.

• Initializer allocator-info callback - the inspected 19-byte function at 0x16e0 ignores the receiver, callback and context. It returns 0x80848110 when the allocation context is absent and zero when present, without storing or invoking the callback. The implementation intentionally follows that behavior; it is not evidence of allocation telemetry support on other library versions.

• Descendant assignment and overlapping swap - assigning a descendant or an owned object key snapshots its payload before releasing its owner. Cross-type Array/String ownership regressions exercise public setters and assignment. Swapping ancestor and descendant values throws before mutation: the first replacement invalidates the second receiver, and the reference contract remains unverified. Ordinary independent swaps retain their existing behavior.

• Legacy callback concurrency - allocation failure/depth state uses the host state mutex without nesting the shared legacy recovery mutex. A coordinated mismatch callback and parser test reproduces the former inverse lock order and verifies both operations complete. It substitutes the application-heap entry points and kernel mutex primitives; it exercises the real Json2 state locks, callbacks and parser. Concurrent initialization/termination, callback null-access cycles and partial object trees after failed key/subtree allocations remain unverified; partial copies can retain admitted nodes with incomplete keys or counts.