AnyPS5/docs/dev/debt/libSceJson2.md

libSceJson2 technical debt

SDK 5/6 below refer to the application compatibility SDK queried by sceKernelGetCompiledSdkVersion (process-parameter offset 0x10). The PS5 SDK field at 0x14 and the console firmware version are distinct.

Unknown function info

• JSON real-number conversion - floating-point environment behavior and malformed numeric-token grammar remain unverified. Valid decimal conversion follows the instructions at 0x7750: separate multiply/add accumulation, per-digit fractional division and repeated exponent scaling. Reference-backed exact-bit tests cover signed underflow, subnormals, normal boundaries, large finite values and overflow across special-float modes. These results intentionally retain the reference rounding, which differs from standard correctly rounded conversion. Formatting still uses locale-independent to_chars with 17 significant digits for modern settings; broader formatting equivalence remains unverified.

• sce::Json::Array::pop_front - the console result for an empty array remains unverified; the existing host behavior throws std::out_of_range. Missing storage throws unsupported. Nonempty removal releases the allocator-owned node without allocating and preserves surviving element/iterator identity.

• sce::Json::Parser::parse - null text with nonzero size throws; decimal overflow follows the configured real-conversion mode. Numeric-token validation, more complex parser allocation failures and cross-thread operation behavior remain incomplete. Parsing mutates the supplied destination, following 0x6940, 0x6840 and 0x5d30: failed arrays/objects retain admitted entries, strings append their decoded prefix, and incomplete scalar literals preserve the previous value. Existing collections retain their entries across later parses. Local tests cover nested parent links, duplicate-member failure, type transitions and actual allocator cleanup; the same contract passes the reference module. These checks do not establish allocator-failure equivalence or Linux/Windows guest execution.

• sce::Json::InitParameter2, InitParameterRtti and InitParameterRtti2 (libSceJson2) - initialization owns its allocator-backed context, default resources, module fallback and kernel synchronization handles. Allocation admission, rollback and retry follow the observed default-resource protocol; file-buffer size is snapshotted and used by file parsing. Remaining kernel-status and callback/concurrent lifecycle paths, plus full guest execution, remain unverified. The active-byte and enum validation rules follow the inspected initializer at 0x920 and 0x12b0–0x13f7, with local allocation-failure coverage. The module firmware version is unverified; these are library observations, not console measurements.

• sce::Json::Value auxiliary ownership - values use the inspected 32-byte inline payload and parent layout, and allocator-backed auxiliary ownership. Outer value handles, string headers and characters, array and object storage and their iterator states use the supplied allocator; module defaults are allocated during initialization, including admitted partial default resources. Request sizes, failure admission and SDK-dependent ownership below SDK 6 remain incomplete. The callback regressions exercise SDK 6 behavior; console execution and older-SDK callback compatibility are unverified.

• InitParameter2 special-float configuration follows assignment helpers at 0x40a0 and 0x41a0 and formatting at 0x26a0: mode 0 converts non-finite numbers to strings, mode 1 to null, and mode 2 retains real values and emits lowercase non-JSON tokens. Parser acceptance of those tokens, floating-point exception flags, signaling-NaN behavior and concurrent reconfiguration remain unverified. Legacy initialization does not enable the conversion; its internal formatter is now reproduced through the inspected float32 conversion, six truncating fractional digits, range saturation and NaN integer result. The regression covers signed zero, precision boundaries, large values, infinities and NaNs; floating-point rounding modes and exception flags remain unverified. Value::set(double) and toString(String&) expose no consistent return value and are declared void.

• sce::Json::Object::Pair, sce::Json::Array::iterator and sce::Json::Object::iterator members (libSceJson2) - Pair allocator-callback reentry and inherited older-SDK failure scopes still require audit. Both Pair constructors preserve the eight bytes between key and value and inactive Value bytes, following 0xc230 and 0xc280. Reference tests cover both constructor/destructor aliases, all value tags, independent copies and allocator cleanup. Array and object postfix increment use this and the dummy integer argument and advance in place, following 0xb270 and 0xc4a0; they do not take a hidden result pointer. This ABI is verified against the inspected module, not every firmware version.

• sce::Json::Value handler registration - legacy special-float/element registration and libc-heap failure handling remain incomplete. Modern auxiliary records, fallback values and callback records use the supplied allocator. The inspected setters at 0x39c0, 0x3b00, 0x3e90 and 0x3fa0 reject owned children with 0x80848104. The value null-access setter is a three-argument member returning status, rather than a static callback setter. Legacy mismatch-map storage is covered separately below; other SDK-dependent legacy combinations remain unverified.

• sce::Json::Value type-mismatch dispatch - libc-heap failures and untested legacy callback combinations remain incomplete. Global registration follows 0x1480; root-local mismatch precedes global null recovery, followed by global mismatch. Current root lookup and borrowed-result dispatch follow 0x22b0 and 0x2930, including requested type, source, immediate parent, callback precedence and a shared reentry guard. Additional legacy compatibility remains unverified.

• sce::Json::Value element-access failure dispatch - SDK-dependent dispatch remains incomplete. Global registration and fallback selection follow 0x1670 and 0x2c70. Root-owned fallback identity, reentry suppression and errors 0x80848115 through 0x80848118 follow 0x2c70, 0x4e80 and 0x5070. Nested fallback-value failure behavior and compatibility below SDK 6 remain incomplete.

• sce::Json::Value special-float recovery - allocator-backed value failures remain incomplete. Global registration follows 0x14f0, including legacy-initializer rejection and duplicate registration; root handlers precede global handlers. Root recovery follows 0x2b90, 0x2d90 and 0x41a0, including the hidden result object, temporary cloning and teardown, function types 0/1, optional error flag and reentry suppression. SDK-dependent registration below SDK 6, signaling NaNs and floating-point exception flags remain unverified.

• sce::Json::MemAllocator::notifyError (libSceJson2) - the base class's virtual does nothing; whether the console's base implementation logs is unknown. String, array, object, callback metadata and file-buffer allocation failures dispatch the supplied allocator's notifier.

• sce::Json::String size, capacity, resize, append(const char*, size_t), operator+= (libSceJson2) - headers and characters use the supplied allocator, with the inspected 24-byte header and 32-bit capacity. Constructors, clear, reserve, resize, copy, assignment and append failure contracts follow 0xa100–0xb0a0, 0xde50 and the instructions at 0xdf20. Overlapping assignment, exact substring temporary allocations, allocator failure propagation through every value/parser operation and native assertion behavior for sizes above 32 bits remain incomplete. SDK-dependent growth reads process parameters; missing metadata uses the reference query-failure rule. Appending null text with a nonzero length throws instead of dereferencing it.

• sce::Json::Array::iterator::advance and Object::iterator members (libSceJson2) - the source-level return type of advance remains unverified; array advancement is declared void and tested for its side effects. Object iterator advancement past the end throws instead of asserting. Array iterators expose the inspected node payload address, including the sentinel; a missing iterator state uses the module default value, whose allocator-backed identity remains incomplete.

• sce::Json::Value::operator bool - untested legacy callback combinations remain incomplete. Modern root-local mismatch precedes global mismatch; ordinary boolean values bypass both. Root-local mismatch dispatch precedes ordinary conversion, following 0x2100; the returned value is read through its boolean getter under the shared callback guard.

• sce::Json::Parser file input - allocator failures outside the file buffer and callback-read failure combinations remain incomplete. Buffer ownership and the read adapter follow 0x69c0 and 0x6b20; local contract tests substitute the kernel file boundary and do not prove guest filesystem integration on Linux or Windows.

• sce::Json::Array storage and iterators - nested value-copy allocator failures, shared concurrent allocation-operation accounting and legacy parent binding remain incomplete. Header, sentinel, node and iterator allocation follow 0xb2d0, 0xb410, 0xb540, 0xb6f0 and 0xb130; local contract tests cover scalar copies and partial ownership. Failed node allocation in push_back removes the existing last entry, following 0xb880; this behavior is verified against the inspected module only. Circular traversal follows 0xb250 and 0xb290; large advances reduce complete cycles without changing the resulting node. front on a partial header with no sentinel throws instead of dereferencing null. Full Linux/Windows execution is unverified.

• sce::Json::Object storage and assignment - legacy ownership, callback-bearing copies and concurrent operation accounting remain incomplete. Allocator-backed tree nodes can retain incomplete entries or a source count exceeding their live nodes after copy failure (0xca40, 0xe000). Modern assignment (0xd400) preserves the original on initial allocation failure but can replace it with partial entries after later failures; self-assignment rebuilds the tree. Legacy insertion copies the pair directly. SDK 5 boundary tests do not establish cross-firmware compatibility. Erasure allocates nothing (0xd350). Missing-state iterator dereference throws if its temporary default iterator cannot be allocated; the reference can recurse. Full Linux/Windows execution remains unverified.

• sce::Json::Parser embedded zero characters - decoded Unicode zero is discarded through the inspected character-append behavior. Binary string values serialize using their stored length, while object keys serialize their C-string prefix. Broader malformed Unicode handling remains incomplete.

• sce::Json::Value handle admission and type changes - collection copy/assignment failure ordering, nested recovery failures and older SDK compatibility remain incomplete. The supplied allocator owns each eight-byte complex-value handle. Typed construction and type changes follow 0x580, 0x10d0, 0x1170 and 0x1210: the old payload is destroyed before replacement admission; string/header failure leaves null, an array can retain a header without its sentinel, and object construction reclaims a failed sentinel. Scalar changes preserve inactive payload bytes. Special-float string conversion follows the temporary string at 0x40a0; failure of its header preserves the prior value, while later failures can leave null or an empty string. Local tests cover SDK 6 process metadata, not every firmware version.

• sce::Json::Value auxiliary admission and retry - legacy special-float and element registration remain unsupported and throw. Modern admission follows 0x3280: a failed fallback allocation retains the 72-byte auxiliary record; later registration reuses it without recreating the missing fallback. Local tests cover all four callback setters, their allocation failures, replacement and null callbacks, child rejection, parent preservation and teardown through the original allocator. Legacy auxiliary records use 24 bytes; mismatch callbacks use a separate map whose header uses the supplied allocator and whose 56-byte nodes use libc new/delete.

• sce::Json::Value scalar and string copying - nested collection assignment failures remain incomplete. Scalar and string dispatch follow 0x1e40: null and boolean copies preserve inactive destination bytes, numeric values retain their exact payloads, and string assignment changes type before copying characters into the existing header. A character-allocation failure can empty an existing string; it does not restore its old contents. Copy construction initializes ownership metadata directly, following 0x1e20. Local allocator tests cover null, boolean, signed, unsigned, finite real and string sources across all destination types and failure budgets.

• sce::Json::Array and Value collection assignment - nested allocator failures, legacy callback propagation and concurrent operation accounting remain incomplete. Modern array assignment follows 0xbc80: initial header/sentinel failure preserves the original, node failures retain a partial replacement and iteration continues, self-assignment replaces the header, and entries bind to the destination owner. Legacy assignment uses replacement list storage inside the existing header, following 0xb540. Value collection dispatch follows 0x1e40, changing type before invoking Array/Object assignment rather than cloning through their copy constructors. Local tests cover scalar array assignment, self-assignment and empty collection Value admission across destination types.

• sce::Json::Value constructors and setters taking Array/Object - nested allocation failures and older SDK compatibility remain incomplete. These paths follow 0x1d00, 0x1d50, 0x1d90 and 0x1de0: a missing source header is ignored, while admitted inputs change the destination type before collection assignment. Missing-header construction initializes null ownership metadata without changing inactive payload bytes. Self-setting retains the Value handle and callback metadata while replacing collection storage. The setters expose no consistent status result and are declared void; local tests verify side effects rather than a fabricated success return.

• sce::Json::Value nested array allocation regressions - local same-source tests cover every allocation point in copying and assigning an array containing a string, integer and inner array containing another string. Persistent and single-allocation failures preserve the observed null entries, empty strings, missing sentinels, parent links, error counts and actual owned cleanup. These checks do not complete nested object failure coverage, callback-return cloning failures, legacy SDK behavior or full guest execution.

• sce::Json::Initializer resource admission - returned kernel setup/locking errors, recovery-callback termination and active-operation allocator-callback termination remain explicitly unsupported; concurrent/reentrant lifecycle and Linux/Windows integration remain unverified. Reference tests cover SDK 5/6 allocation failures, partial admission, null frees and retry; SDK 6 tests also reject duplicate initialization and inactive termination from allocate/notify/free callbacks while the context remains published. Seventeen host-boundary schedules verify mutex-construction errors/exceptions, balanced guest/attribute/mutex ownership and retry. Setup exceptions reclaim local resources before global rollback. The reference skips creation after attribute errors and ignores mutex-init/destroy results, potentially retaining unwritten handles; safely reproducing those states remains unverified.

• sce::Json::Value legacy mismatch map - legacy special-float/element registration and libc allocation exceptions remain incomplete. Map registration, lookup, copying and destruction follow 0x3b00, 0x7230, 0x22b0, 0x1e40 and 0x1810: a parsed root must already own auxiliary metadata; a shared 24-byte map header uses the supplied allocator, while its sentinel and entries use libc new/delete. Copies propagate callback records independently of auxiliary ownership. Empty map storage survives until termination. Local SDK 5 tests cover replacement, null handlers, parent dispatch, null-recovery ordering, swap temporary cleanup, tree balance, erasure and both allocator domains. Failure to allocate the libc sentinel throws unsupported after reclaiming the unpublished header; reference exception unwinding is unverified.

• sce::Json::Object nested allocation regressions - local tests cover 322 copy-construction and assignment cases for an object containing a string, inner object/string and array. Persistent and single-allocation failure budgets exercise every allocation position through successful completion (50 allocations for construction, 109 for assignment). Reference comparisons cover retained partial contents, collection counts, parent/owner links, request counts, notifications, unchanged source state and allocator cleanup. Construction may retain a source count larger than its admitted nodes and leave copied root entries unbound; tests preserve those observed semantics. Callback-bearing copy failures, alternate SDK behavior and concurrent failure accounting remain unverified.

• sce::Json::Parser value admission - recognized values change type before root metadata admission, following 0x5d30 and 0x3280; incomplete scalar tokens allocate no auxiliary record. Twelve reference-backed string cases cover persistent and one-shot failure at every allocation position, retained type, error status, request/notification counts, character retries and cleanup. A failed character allocation can discard the first character while later characters are admitted. More complex parser low-memory paths and callback-driven allocation failures remain incomplete; reference execution terminated during one missing-sentinel array case, so that case does not establish a verified recovery contract.

• sce::Json::Parser array allocation failures - numeric token storage uses the supplied allocator; array parsing uses the public append implementation. Parser and append operations share the depth/error flag observed at 0x6840, 0x310, 0x340 and 0xb880, retaining inherited errors until the outer operation finishes. Twenty-four reference-backed cases cover persistent and one-shot failures through successful parsing, partial counts, numeric-zero fallback after token-allocation failure, string suffixes, parent links, notifications and cleanup. Missing-sentinel parsing throws unsupported because reference execution crashes; callback-bearing collections and concurrent behavior remain incomplete.

• sce::Json::Parser object allocation failures - object keys use one allocator-backed string reused between members, following 0x6250; lookup closes its shared operation scope before assigning the exposed key and owner, following 0xda40. Sixty-six reference-backed cases cover persistent and one-shot failure at each returning allocation position through a 33-allocation successful parse of an object containing a string and array. Checks include partial keys/members, numeric and string fallback values, parent links, error status, request/notification counts and complete allocator cleanup. The nested array sentinel failure is excluded because reference execution crashes; more complex nested objects, callback-driven allocation failures and concurrency remain unverified.

• sce::Json::Collection inherited allocation errors - array assignment, object assignment/insertion and legacy mismatch-map updates now use the shared depth/error protocol instead of counter snapshots, following 0xbc80, 0xd400, 0xcd30 and 0x3b00. Six reference-backed public parser/read-callback cases invoke array assignment, object assignment or insertion after a one-shot character allocation failure, plus healthy controls. Checks cover placeholder retention, skipped payload binding, unchanged source, outer error persistence, recovery on the next independent parse and complete cleanup. Baseline and targeted assignment/insertion mutations fail these checks. Callback-return cloning and cross-thread failure propagation remain unverified; legacy map updates under inherited failure are covered separately below.

Unknown 3.20 import declarations

• _ZN3sce4Json12MemAllocatorD0Ev (libSceJson2) - NID ypazoTrKYhE; the deleting base allocator destructor traps in the reference. This invalid destruction path remains explicitly unsupported.

• Counted string searches with an admitted positive count and a null needle remain explicitly unsupported; the reference dereferences the invalid pointer. Oversized and zero counts retain their verified results.

• sce::Json::Array::erase - invalid, missing or sentinel positions in an allocated array remain explicitly unsupported. Reference invalid-iterator paths can corrupt storage or fault; valid erasure retains its mutation when returned-iterator allocation fails.

• Array insertion and payload transfer - nested copy-stage failures, missing-sentinel paths and older-SDK callback combinations still need direct regression coverage. String-copy failures and successful nested-array transfer follow the reference protocol. Forty-eight additional reference-backed cases reject every temporary iterator allocation during transfer of three-element nested arrays and objects, using persistent and one-shot failure schedules. Insertion retains the new node and rebinds only the admitted child prefix; prepending removes the new entry on failure. Checks cover exact requests/notifications, surviving iterator identity, existing destination order, unchanged source bytes and allocation generations, result identity, ordered object keys, nested links/counts and complete cleanup. Invalid insertion iterators are explicitly unsupported.

• Value keyed lookup - valid string-key overloads and C-string key-construction failures follow the observed iterator allocation and fallback protocol. Missing object handles, corrupted tree storage, lifecycle reentry during lookup and remaining older-SDK callback combinations remain unverified; invalid reference arguments are explicitly unsupported.

• Value callback serialization - nested iterator/metadata failures, non-finite recovery failures, lifecycle reentry, other legacy callback combinations and floating-point environment behavior still require audit. Null callback/output references are explicitly unsupported. All serialization shares the collecting/traversal protocol. Reference tests cover modern chunk boundaries, callback results, output mutation, scalar allocation failures and opening-callback array mutations. SDK 5 tests cover root admission/reset, child metadata release, numeric edge cases and persistent/one-shot root admission failures.

• Parser parent and auxiliary transitions - allocator-driven lifecycle changes, more complex nested metadata failures and alternate SDK combinations still require audit. Six notifier-reentry cases cover failure publication after notification, nested failures, callback-return copying and retry. Reader-driven allocation failures are checked before starting a value, following 0x5d30; an already-started literal still completes, while outermost completion reports and clears the shared failure. Reference tests cover direct parsing into an owned child across eight value forms, six root-admission failure/retry cases, incomplete-literal preservation, modern root callback retention and nested release of three handler records, fallback and auxiliary in native order. Allocation generations distinguish release from later address reuse.

• Special-float callback-return allocation - more complex object shapes, allocator-driven lifecycle changes and alternate SDK combinations remain unverified. Twelve reader/notifier-reentry cases verify delayed failure publication, inherited nested failures, string/object/nested-array callback returns, literal completion, request-order fingerprints and retry. Reference tests cover 834 persistent/one-shot cases through successful string, one-entry object and nested array/object recovery for assignment and serialization. Checks include partial contents, internal-key lookup, allocation-order fingerprints, notifications, callback ABI, destination metadata generations and complete cleanup. Object assignment copies the internal tree key separately from the public pair key, following 0xd400; these can diverge after allocation failure.

• Object Pair allocation and teardown - inherited failure scopes, allocator-driven reentry and alternate SDK behavior remain unverified. Reference tests cover 1,320 modern persistent/one-shot cases with and without four registered source handlers through every allocation position for default, null, string, nested-object and nested-array copies across both constructor/destructor aliases. Checks preserve inactive bytes, partial contents, collection counts, child parents, storage owners, allocation generations, request/notification order and construction/destruction release identities. Source auxiliary bytes, generations and handlers survive cleanup. Pair teardown releases the value before the key, following 0xc2b0. Failed temporary header allocation in modern collection assignment still calls the allocator free function with null, following 0xbc80 and 0xd400; failed sentinel allocation reclaims its admitted header.

• Modern callback-bearing copies - allocation-failure combinations, nested owners, lifecycle changes from callbacks and alternate SDK behavior remain unverified. Fifteen reference-backed cases exercise null, real and object sources with all four local handlers through Value construction, assignment with/without destination handlers, Pair construction and standalone Array insertion. Modern copies discard source-local handlers; assignment retains destination handlers. Tests invoke null/mismatch/element/float recovery and verify complete auxiliary bytes, fallback ownership, all callback-record generations, borrowed replacement identity and source-handler usability after copy destruction.

• Callback-time termination - composite-destruction reinitialization, teardown exceptions and unmeasured publication variants, concurrent lifecycle, older SDKs and guest-kernel error responses remain unverified. Recovery-callback owner termination and allocate/notify/free callback termination inside an active allocation operation are explicitly unsupported before teardown. Reference recovery/notifier probes reused freed/null mutex slots after termination and faulted at the substituted kernel boundary; direct allocate/free probes also faulted after termination returned success. These are not console measurements. Reference-backed controls preserve inactive-initializer termination, standalone Malloc-notifier termination and standalone Free-callback termination/reinitialization. Production tests verify ownership-preserving refusal, repeatable recovery, successful parse continuation, OOM/retry and fresh module generations.

• Termination reentry - callback exceptions during partially completed teardown and older-SDK combinations remain unverified. Nested owner termination while cleanup is already active is explicitly unsupported before further ownership changes. The reference allocator observed a duplicate free request when a teardown free callback recursively terminated the module; a standalone Free callback retained its target until its original release completed. Twelve production cases exercise reentry at every normal module release position, require one refusal and exactly twelve releases, and verify that the outer call completes and the next module generation initializes and terminates normally.

• Initialization callback publication - concurrent publication remains unverified. One hundred forty-four direct-allocator reference cases span SDK 5/6, both initializer overloads, shared/separate owners and receiver/context domains. They verify saved file-buffer settings, nested handoff, completed nested lifecycles and retry. Double success orphans the first epoch in its original domain: eleven resources/one mutex for SDK 5, twelve/two for SDK 6. Outer termination reclaims only its own epoch and nested termination reports not-initialized. Tests assert ownership and stale-domain avoidance, then separately reclaim the observed orphaned epoch through the caller-owned fixture. SDK 5 teardown also forwards its observed null free; fixture reclamation is not library cleanup.

• RTTI initialization publication - concurrent reconfiguration and thrown allocator callbacks remain unverified. One hundred ninety-two additional SDK 5/6 reference cases cover legacy construction/newer RTTI setters, shared/independent contexts and configuration before initialization or inside its first allocation callback. All parameter objects share one adapter. An already-entered first allocation uses the original callback once; subsequent allocations and releases use the latest table while preserving each context and file-buffer setting. Tests cover handoff, lifecycle completion, orphaned epochs, SDK-specific mutex ownership and retry, distinguishing actual RTTI releases, SDK 5 null-free callbacks and later fixture reclamation.

• Legacy Pair callback copies - inherited failure scopes, allocator-driven reentry and libc allocation exceptions remain unverified. Thirty-six SDK 5 reference-backed cases cover numeric and string sources with a registered mismatch handler, both constructor/destructor aliases and every guest allocation failure position through success using persistent and one-shot schedules. Even a null partial copy retains its independent callback map record. Checks cover exact request/notification order, partial key/text admission, inactive Pair bytes, borrowed callback result identity, independent auxiliary ownership, source allocation bytes/generations and source callback usability after copy cleanup. Every case restores the original live generations in both the guest allocator and libc heap.

• Legacy nested Pair copies - inherited failure scopes, allocator-driven reentry and libc allocation exceptions remain unverified. One hundred fifty-two SDK 5 reference-backed cases cover an array containing an object/string and an object containing an array/string, both Pair constructor/destructor aliases and persistent/one-shot failure at every allocation position through eighteen-allocation success. Checks cover partial counts, missing sentinels, independent internal/public object keys, exact request/notification fingerprints, inactive bytes, source bytes/generations and both allocator domains. Copies retain the root mismatch-map callback independently of auxiliary metadata; unbound descendants use typed defaults without inheriting that callback. Root and source recovery remain callable after copy cleanup.

• Legacy callback map inherited failures - Collection copies inside an inherited failure scope, allocator-driven lifecycle changes and cross-thread propagation remain unverified. Eighteen SDK 5 reference cases exercise new/existing records through a parser reader: healthy controls, published allocation errors and notifier-time registration. Published failure preserves an existing handler or retains a new empty record; scalar Value and both Pair constructor aliases still copy the scalar but their callback record remains empty. Pair keys retain independently allocated complete text and inactive padding. Notifier-time registration and copying succeed before the shared error is published, while the outer parser completes its admitted literal and reports OOM. Checks cover allocation/notification order, borrowed callback results, auxiliary/fallback generations, record-reusing retry, independent parser retry and both allocator domains.

• Composite-destruction termination - additional legacy callback combinations and thrown callbacks remain unverified. One hundred ten SDK 6 reference cases cover both Value destructor aliases, four payload/metadata shapes and every release position. Following 0x17e0, destruction requires the published recovery mutex after clearing the payload; callback termination during payload release therefore preserves the auxiliary pointer and bytes. Checks cover exact release-generation prefixes, allocator receiver/context, module/source ownership, repeated destruction and fresh initialization. Early termination orphans the remaining caller allocations; final-release termination completes cleanup. The caller-owned fixture separately reclaims the observed orphaned epoch. The pre-fix destructor fails the auxiliary-retention regression.

• Legacy auxiliary-cleanup termination - a missing recovery mutex after auxiliary-release callbacks is explicitly unsupported at legacy map cleanup, before kernel use. Eight reference probes across both Value destructor aliases returned termination success, then faulted through a null mutex slot at the substituted kernel boundary; these are not console measurements. Ninety-two termination-only production cases cover 84 returning reference cases and eight explicit errors. Checks preserve eleven module resources plus the observed null free, release prefixes, auxiliary state, allocator identities and retry. Termination itself remains allowed so its callback can reinitialize before cleanup resumes. Thrown callbacks remain unverified.

• Composite callback reinitialization - repeated nested reinitialization and thrown callbacks remain unverified. Five hundred sixty-four SDK 5/6 reference cases cover both destructor aliases, every release position and shared, changed-context or changed-receiver/context domains. The already-entered free keeps its original receiver/context; subsequent releases use the newly published allocator even for old allocations. Reinitialization admits a complete fresh module epoch and lets auxiliary/map cleanup finish. Tests verify release identities/order, domain routing, complete payload cleanup, repeated destruction and later module retry. The pooled backend records cross-domain dispatch; it does not establish safe transfer between independent allocator pools.