Both found while auditing the pool for the cross-thread transfer guarantee. AGENTS.md said the two exit() calls that bypass akerr_exit() are "both in src/error.c". ENSURE_ERROR_READY's pool-exhaustion abort is in include/akerror.tmpl.h. The count of abort sites is load-bearing -- it is the argument against any API that could fail on pool exhaustion -- so pointing at the wrong file makes it hard to check. akerr_valid_error_address() returns 1 for NULL, which is right for VALID() (NULL is how a function reports success) and a trap for anything reading it as "is this a pool slot". Say so where the function is defined. Comments only; no behavior change. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>