Differential model-test of LEGAL api sequences (fuzz_alist.c), all seeds,
stock (INVARIANTS-like asserts on) build, guest cc -O2:

seed 1 : ALL GEOMETRIES CLEAN: ops=730625 false_none=3495 firstfit_miss=1370 meta_deepest_blocked=0
seed 2 : ALL GEOMETRIES CLEAN: ops=734273 false_none=3648 firstfit_miss=1461 meta_deepest_blocked=0
seed 3 : ALL GEOMETRIES CLEAN: ops=730865 false_none=3603 firstfit_miss=1401 meta_deepest_blocked=0
seed 4 : ALL GEOMETRIES CLEAN: ops=726197 false_none=3702 firstfit_miss=1319 meta_deepest_blocked=0
seed 5 : ALL GEOMETRIES CLEAN: ops=732094 false_none=3674 firstfit_miss=1379 meta_deepest_blocked=0
seed 6 : ALL GEOMETRIES CLEAN: ops=725806 false_none=3426 firstfit_miss=1304 meta_deepest_blocked=0
seed 7 : ALL GEOMETRIES CLEAN: ops=730014 false_none=3517 firstfit_miss=1371 meta_deepest_blocked=0
seed 99 (post-fix-validation replication): ops=728363 false_none=3661 firstfit_miss=1375 meta_deepest_blocked=0

Geometries: 1,2,31,32,33,63,64,100,127,128,129,255,256,257,511,512,513,
1000,1023,1024,1025,2047,2048,4095,4096,5000,8192,65535,65536
(~5.1M operations total)

Invariants held for EVERY op of EVERY seed:
  H1 no overlapping allocation
  H2 returned block aligned / >= start / in domain
  H3 bl_free == reference free count (no accounting drift)
  H4 alist_free_info consistent (count + really-free range)
  H5 full radix-tree resolve == reference map (protocol state machine)
  H6 reserved '10' meta state never observed
  H7 poison persistence: records slots outside the initialized subtree
     (pre-poisoned 0xAA) never written  (DF-2789-class OOB-write detector)

Divergence attribution (classifier walks the root->leaf path of the
expected fit; deepest blocked bighint gate decides):
  every false_none / first-fit miss = LEAF-level gate => KNOWN DF-0052
  (alst_leaf_alloc:443 start mutation), including its upward propagation
  into meta hints via alst_meta_alloc:649-650 after :615 gate-skips.
  meta_deepest_blocked = 0 across all seeds: NO independent meta-level
  bighint corruption exists.

Conclusion: under legal API sequences the alist state machine is sound;
all availability divergence belongs to the already-filed DF-0052, and no
out-of-domain write is reachable without a caller range/count slip
(those are filed as DF-2797 / DF-2798).