2 files changed, 3 insertions, 3 deletions
diff --git a/docs/LEARN.md b/docs/LEARN.md
index d514d85..e9cdbcf 100644
--- a/docs/LEARN.md
+++ b/docs/LEARN.md
@@ -477,7 +477,7 @@ fn main() {
 output:
 
 ```text
-leak: line 6 3 words
+leak: line 6 1 words
 1
 ```
 
diff --git a/docs/SPEC.md b/docs/SPEC.md
index dd04cde..f422166 100644
--- a/docs/SPEC.md
+++ b/docs/SPEC.md
@@ -427,7 +427,7 @@ pn((int)(p + 1) - (int)p);    // 1: p + 1 moves one word
 
 3.7.3 `&x` is the address of a variable, field or element. it applies to a local (which then lives in memory and cannot be an o3 variable), a global, a field and an element of a non-packed array. an element of a packed array has no address (2.3.3).
 
-3.7.4 indexing a new object (`rt.new(int)[0]`) is error: index a new object only after binding it to a name. indexing is bounds checked at run time unless the function, block, statement or unit is unbounded or the code is o3 (4.15). a `T[?]` is checked against its length (3.13), a `T[n]` against `n`, and a pointer only when it points at the first word of a live heap block, against that block's payload (a buddy block rounds the payload up: `rt.new(4)` has 11 words). a pointer into the middle of a block, a frame array, a global or memory managed by hand is not checked. a constant index 0, and an index a loop test `i < k` with constant `k` (or `i < len(a)`) has already proved, are not checked again. a failed check prints `zy: index I out of range (length N)` and stops, as in 3.13.4.
+3.7.4 indexing a new object (`rt.new(int)[0]`) is error: index a new object only after binding it to a name. indexing is bounds checked at run time unless the function, block, statement or unit is unbounded or the code is o3 (4.15). a `T[?]` is checked against its length (3.13), a `T[n]` against `n`, and a pointer only when it points at the first word of a live heap block, against exactly the words new asked for (`rt.new(4)` has 4 words, though its block holds more; `rt.new(0)` has none). a freed block has none either: an index through a stale pointer to it is out of range (length 0), and under memdebug it is reported as a use after free. the runtime keeps that length in the block header, so a request over 2^31 - 6 words stops at the allocation with `zc: out of heap memory`. a pointer into the middle of a block, a frame array, a global or memory managed by hand is not checked. a constant index 0, and an index a loop test `i < k` with constant `k` (or `i < len(a)`) has already proved, are not checked again. a failed check prints `zy: index I out of range (length N)` and stops, as in 3.13.4.
 
 3.7.5 an index must be a number (typecheck on).
 
@@ -624,7 +624,7 @@ o3 int sum(fixed int[?] a) { int s = 0; for (int i = 0; i < len(a); i++) s += a[
 
 ### 4.11 memdebug
 
-`memdebug on;` turns on heap header checks and allocation-site tracking from this point in the file (top level) or from this point in the function (statement); the runtime enables the checks before `main` for the top-level form. `memdebug scrub;` additionally fills freed payloads with 57005; `memdebug off;` stops. with checks on, a use after free prints `zy: use after free from line N`, a double free prints `zy: double free from line N` and returns, a stray address prints `zy: bad heap pointer`. `rt.memreport()` prints a line `leak: line N W words` per live recorded object and returns the count.
+`memdebug on;` turns on heap header checks and allocation-site tracking from this point in the file (top level) or from this point in the function (statement); the runtime enables the checks before `main` for the top-level form. `memdebug scrub;` additionally fills freed payloads with 57005; `memdebug off;` stops. with checks on, a use after free prints `zy: use after free from line N`, a double free prints `zy: double free from line N` and returns, a stray address prints `zy: bad heap pointer`. `rt.memreport()` prints a line `leak: line N W words` per live recorded object (W is the n words new asked for, not the block's payload) and returns the count.
 
 ### 4.12 hints