In the ring-buffer follow-up, could you show the invariant that makes the capacity-based replacement valid? In particular, it would help to separate allocated capacity from the intended logical bound and show the boundary tests. That would make the reasoning behind removing the size field reusable, alongside the patch itself.