[nick2781]

Growing a core POD array with a reference to one of its elements could read freed or shifted storage. Capacity arithmetic could wrap allocation bytes, while a failed allocation could leave array_map's name index inconsistent with its pointer array.

Snapshot aliased values before mutation, validate element counts before byte arithmetic, and reject null allocations with std::bad_alloc. Impossible capacities throw std::length_error. Keep existing mutation signatures and non-owning pointer semantics. Roll back a pointer append if index insertion fails; spare capacity may remain grown, while logical entries and lookups stay unchanged. Include the required null check in the default string-index allocator and synchronized English/Chinese guidance.

Validation on macOS arm64, C++20, exact CI arknet pin:

• Full check-core passed: 72 cases / 70,140 assertions, plus an isolated default-allocation failure executable with 3 cases / 74 assertions.
• Both executables passed AddressSanitizer and UndefinedBehaviorSanitizer; leak detection was disabled.
• Permanent tests cover scalar/pointer aliases, overflow, null/throwing allocation, copy independence, and pointer/index failure rollback.
• clang-format 18 and Nimbus passed; canonical article bodies and Markdown exports were inspected.

No ownership or layout redesign, real system OOM, large live allocation or deployment-capacity claim. Required hosted checks remain separate. Rebuild consumers/plugins to receive the corrected inline implementations.