44 files changed, 1490 insertions, 181 deletions

diff --git a/CMakeLists.txt b/CMakeLists.txt
index 04e0e4e..62ee1a8 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -8,10 +8,13 @@ add_subdirectory(cassert)
 add_subdirectory(cstring)
 add_subdirectory(error)
 add_subdirectory(filesystem)
+add_subdirectory(hash)
 add_subdirectory(list)
-add_subdirectory(mem)
 add_subdirectory(log)
+add_subdirectory(mem)
 add_subdirectory(mempool)
+add_subdirectory(memstack)
 add_subdirectory(plugin)
 add_subdirectory(random)
+add_subdirectory(simloop)
 add_subdirectory(timer)
diff --git a/cstring/CMakeLists.txt b/cstring/CMakeLists.txt
index a1abde2..92fe5a7 100644
--- a/cstring/CMakeLists.txt
+++ b/cstring/CMakeLists.txt
@@ -15,8 +15,3 @@ target_include_directories(cstring PUBLIC
 
 target_link_libraries(cstring PUBLIC
   cassert)
-
-if(LINUX)
-  target_link_libraries(cstring PUBLIC
-    -lbsd)
-endif()
diff --git a/cstring/include/cstring.h b/cstring/include/cstring.h
index b07dad6..419b604 100644
--- a/cstring/include/cstring.h
+++ b/cstring/include/cstring.h
@@ -3,14 +3,23 @@
 
 #include <cassert.h>
 
-#ifdef __linux__
-#include <bsd/string.h>
-#else
-#include <string.h>
-#endif
 #include <stdbool.h>
 #include <stdint.h>
 #include <stdio.h>
+#include <string.h>
+
+// -----------------------------------------------------------------------------
+// C-string helpers.
+
+/// Return a hash of the given string.
+uint64_t cstring_hash(const char* str);
+
+/// Copy 'count' characters from the source to the destination, null-terminating
+/// the destination.
+static inline void cstring_copy(char* dst, const char* src, size_t count) {
+  memcpy(dst, src, count * sizeof(char));
+  dst[count] = '\0';
+}
 
 // -----------------------------------------------------------------------------
 // Fix-sized strings.
@@ -38,11 +47,14 @@
       return (STRING){0};                                                     \
     } else {                                                                  \
       STRING str = (STRING){0};                                               \
-      str.length = strlcpy(str.str, cstr, SIZE);                              \
+      str.length = strlen(cstr);                                              \
+      cstring_copy(str.str, cstr, str.length);                                \
       return str;                                                             \
     }                                                                         \
   }                                                                           \
                                                                               \
+  static inline STRING STRING##_make_empty(void) { return (STRING){0}; }      \
+                                                                              \
   static inline STRING STRING##_dirname(const STRING path) {                  \
     STRING str = path;                                                        \
     for (int i = str.length - 1; i >= 0; --i) {                               \
@@ -63,7 +75,7 @@
   static inline void STRING##_append_cstr_len(                                \
       STRING* a, const char* b, const size_t b_length) {                      \
     ASSERT(a->length + b_length + 1 <= SIZE);                                 \
-    strlcpy(a->str + a->length, b, SIZE - a->length);                         \
+    cstring_copy(a->str + a->length, b, b_length);                            \
     a->length += b_length;                                                    \
   }                                                                           \
                                                                               \
@@ -79,9 +91,8 @@
       const STRING a, const char* b, const size_t b_length) {                 \
     ASSERT(a.length + b_length + 1 <= SIZE);                                  \
     STRING str = {0};                                                         \
-    strlcpy(str.str, a.str, SIZE);                                            \
-    strlcpy(str.str + a.length, b, SIZE - a.length);                          \
-    str.length = a.length + b_length;                                         \
+    STRING##_append_cstr_len(&str, a.str, a.length);                          \
+    STRING##_append_cstr_len(&str, b, b_length);                              \
     return str;                                                               \
   }                                                                           \
                                                                               \
@@ -97,6 +108,15 @@
     return STRING##_concat(STRING##_concat_cstr(a, "/"), b);                  \
   }                                                                           \
                                                                               \
+  static inline STRING STRING##_slice(                                        \
+      const STRING a, const size_t start, const size_t end) {                 \
+    ASSERT(start < a.length);                                                 \
+    ASSERT(end <= a.length);                                                  \
+    STRING str = {0};                                                         \
+    cstring_copy(str.str, &a.str[start], end - start);                        \
+    return str;                                                               \
+  }                                                                           \
+                                                                              \
   static inline bool STRING##_eq_cstr_len(                                    \
       const STRING a, const char* b, size_t b_length) {                       \
     return (a.length == b_length) && strncmp(a.str, b, a.length) == 0;        \
@@ -124,15 +144,6 @@
     return cstring_hash(str.str);                                             \
   }
 
-/// Return a hash of the given string.
-static inline uint64_t cstring_hash(const char* str) {
-  uint64_t hash = 0;
-  for (size_t i = 0; i < strlen(str); ++i) {
-    hash = (uint64_t)str[i] + (hash << 6) + (hash << 16) - hash;
-  }
-  return hash;
-}
-
 DEF_STRING(sstring, 32)    // Small.
 DEF_STRING(mstring, 256)   // Medium.
 DEF_STRING(lstring, 1024)  // Large.
@@ -158,6 +169,9 @@ static inline size_t string_length(const string str) { return str.length; }
 /// Get the string's data.
 static inline const char* string_data(const string str) { return str.data; }
 
+/// Get the string's data.
+static inline const char* string_cstr(const string* str) { return str->data; }
+
 /// Concatenate two strings.
 string string_concat(string left, string right);
 
diff --git a/cstring/src/cstring.c b/cstring/src/cstring.c
index 832cb85..100c130 100644
--- a/cstring/src/cstring.c
+++ b/cstring/src/cstring.c
@@ -23,7 +23,7 @@ string string_new(const char* cstr) {
 void string_del(string* str) {
   if (str->data) {
     free((void*)str->data);
-    str->data   = 0;
+    str->data   = nullptr;
     str->length = 0;
   }
 }
@@ -101,3 +101,11 @@ string string_format_size(size_t size) {
       .length = length,
   };
 }
+
+uint64_t cstring_hash(const char* str) {
+  uint64_t hash = 0;
+  for (size_t i = 0; i < strlen(str); ++i) {
+    hash = (uint64_t)str[i] + (hash << 6) + (hash << 16) - hash;
+  }
+  return hash;
+}
diff --git a/error/CMakeLists.txt b/error/CMakeLists.txt
index fbbc945..c74921f 100644
--- a/error/CMakeLists.txt
+++ b/error/CMakeLists.txt
@@ -15,4 +15,4 @@ target_include_directories(error PUBLIC
 target_link_libraries(error
   cstring)
 
-target_compile_options(error PRIVATE -Wall -Wextra)
+target_compile_options(error PRIVATE -Wall -Wextra -Wpedantic)
diff --git a/filesystem/CMakeLists.txt b/filesystem/CMakeLists.txt
index 508f99d..56cc870 100644
--- a/filesystem/CMakeLists.txt
+++ b/filesystem/CMakeLists.txt
@@ -16,4 +16,4 @@ target_include_directories(filesystem PUBLIC
 target_link_libraries(filesystem PRIVATE
   cassert)
 
-target_compile_options(filesystem PRIVATE -Wall -Wextra)
+target_compile_options(filesystem PRIVATE -Wall -Wextra -Wpedantic)
diff --git a/filesystem/include/filesystem.h b/filesystem/include/filesystem.h
index 1c354b7..bc7f953 100644
--- a/filesystem/include/filesystem.h
+++ b/filesystem/include/filesystem.h
@@ -6,8 +6,26 @@
 #include <stddef.h>
 #include <stdio.h>
 
+#define WITH_FILE(FILEPATH, BODY)       \
+  {                                     \
+    assert(FILEPATH);                   \
+    FILE* file = fopen(FILEPATH, "rb"); \
+    if (file) {                         \
+      BODY;                             \
+      fclose(file);                     \
+    }                                   \
+  }
+
+/// Get the file's size.
+size_t get_file_size(const char* filename);
+
 /// Get the file's size.
-size_t get_file_size(FILE* file);
+size_t get_file_size_f(FILE* file);
 
 /// Read the entire contents of the file into memory.
 void* read_file(const char* filepath);
+
+/// Read the entire contents of the file into memory.
+///
+/// The given buffer must be large enough to hold the file's contents.
+bool read_file_f(FILE*, void* buffer);
diff --git a/filesystem/src/filesystem.c b/filesystem/src/filesystem.c
index b228e85..b30c072 100644
--- a/filesystem/src/filesystem.c
+++ b/filesystem/src/filesystem.c
@@ -5,21 +5,27 @@
 #include <stdlib.h>
 #include <string.h>
 
-size_t get_file_size(FILE* file) {
+size_t get_file_size(const char* filename) {
+  size_t size = 0;
+  WITH_FILE(filename, size = get_file_size_f(file));
+  return size;
+}
+
+size_t get_file_size_f(FILE* file) {
   assert(file);
   const long int starting_pos = ftell(file);
   if (starting_pos == -1) {
-    return (size_t)-1;
+    return 0;
   }
   if (fseek(file, 0, SEEK_END) != 0) {
-    return (size_t)-1;
+    return 0;
   }
   const size_t file_size = ftell(file);
   if (file_size == (size_t)-1) {
-    return (size_t)-1;
+    return 0;
   }
   if (fseek(file, starting_pos, SEEK_SET) != 0) {
-    return (size_t)-1;
+    return 0;
   }
   return file_size;
 }
@@ -27,31 +33,38 @@ size_t get_file_size(FILE* file) {
 void* read_file(const char* filepath) {
   assert(filepath);
 
-  void* data = 0;
+  void* data    = nullptr;
+  bool  success = false;
 
-  FILE* file = fopen(filepath, "rb");
-  if (!file) {
-    return 0;
-  }
-  const size_t file_size = get_file_size(file);
-  if (file_size == (size_t)-1) {
-    goto cleanup;
-  }
+  WITH_FILE(filepath, {
+    const size_t file_size = get_file_size_f(file);
+    if (file_size > 0) {
+      data = calloc(1, file_size);
+      if (data != nullptr) {
+        if (fread(data, 1, file_size, file) == file_size) {
+          success = true;
+        }
+      }
+    }
+  });
 
-  data = calloc(1, file_size);
-  if (!data) {
-    goto cleanup;
-  }
-  if (fread(data, 1, file_size, file) != file_size) {
-    goto cleanup;
+  if (!success) {
+    free(data);
+    data = nullptr;
   }
-
   return data;
+}
 
-cleanup:
-  fclose(file);
-  if (data) {
-    free(data);
+bool read_file_f(FILE* file, void* buffer) {
+  assert(file);
+  assert(buffer);
+
+  bool         success   = false;
+  const size_t file_size = get_file_size_f(file);
+  if (file_size > 0) {
+    if (fread(buffer, 1, file_size, file) == file_size) {
+      success = true;
+    }
   }
-  return 0;
+  return success;
 }
diff --git a/filesystem/src/path.c b/filesystem/src/path.c
index 2ce5a04..544a5d1 100644
--- a/filesystem/src/path.c
+++ b/filesystem/src/path.c
@@ -21,7 +21,7 @@ path path_new(const char* str) {
 void path_del(path* path) {
   if (path) {
     free(path->data);
-    path->data = 0;
+    path->data = nullptr;
     path->size = 0;
   }
 }
diff --git a/hash/CMakeLists.txt b/hash/CMakeLists.txt
new file mode 100644
index 0000000..f0a5e55
--- /dev/null
+++ b/hash/CMakeLists.txt
@@ -0,0 +1,14 @@
+cmake_minimum_required(VERSION 3.5)
+
+project(hash)
+
+set(CMAKE_C_STANDARD 23)
+set(CMAKE_C_STANDARD_REQUIRED On)
+set(CMAKE_C_EXTENSIONS Off)
+
+add_library(hash
+  src/fnv1a.c)
+
+target_include_directories(hash PUBLIC include)
+
+target_compile_options(hash PRIVATE -Wall -Wextra -Wpedantic)
diff --git a/hash/include/fnv1a.h b/hash/include/fnv1a.h
new file mode 100644
index 0000000..0d2e7cf
--- /dev/null
+++ b/hash/include/fnv1a.h
@@ -0,0 +1,9 @@
+#pragma once
+
+#include <stddef.h>
+#include <stdint.h>
+
+uint32_t fnv1a32(const void* buffer, size_t size_bytes);
+
+uint32_t fnv1a32_begin();
+uint32_t fnv1a32_update(uint32_t hash, const void* buffer, size_t size_bytes);
diff --git a/hash/src/fnv1a.c b/hash/src/fnv1a.c
new file mode 100644
index 0000000..32cb538
--- /dev/null
+++ b/hash/src/fnv1a.c
@@ -0,0 +1,23 @@
+#include <fnv1a.h>
+
+#include <assert.h>
+
+#define FNV_PRIME        2166136261
+#define FNV_OFFSET_BASIS 16777619
+
+uint32_t fnv1a_32(const void* buffer, size_t size) {
+  assert(buffer);
+  return fnv1a32_update(fnv1a32_begin(), buffer, size);
+}
+
+uint32_t fnv1a32_begin() { return FNV_PRIME; }
+
+uint32_t fnv1a32_update(uint32_t hash, const void* buffer, size_t size) {
+  assert(buffer);
+  const uint8_t* bytes = buffer;
+  for (size_t i = 0; i < size; i++) {
+    hash = hash ^ bytes[i];
+    hash = hash * FNV_OFFSET_BASIS;
+  }
+  return hash;
+}
diff --git a/list/CMakeLists.txt b/list/CMakeLists.txt
index 7e1df38..23361cf 100644
--- a/list/CMakeLists.txt
+++ b/list/CMakeLists.txt
@@ -21,4 +21,4 @@ add_executable(list_test
 target_link_libraries(list_test
   list)
 
-target_compile_options(list_test PRIVATE -DUNIT_TEST -Wall -Wextra)
+target_compile_options(list_test PRIVATE -DUNIT_TEST -Wall -Wextra -Wpedantic)
diff --git a/list/include/list.h b/list/include/list.h
index 24291e1..92f30f7 100644
--- a/list/include/list.h
+++ b/list/include/list.h
@@ -23,7 +23,7 @@ static inline void* alloc(size_t size) {
 
 /// Create a new empty list.
 #define make_list(type) \
-  (type##_list) { 0 }
+  (type##_list) { nullptr }
 
 /// Delete the list.
 #define del_list(list)                                  \
@@ -32,7 +32,10 @@ static inline void* alloc(size_t size) {
     node                 = node->next;                  \
     free(cur);                                          \
   }                                                     \
-  list.head = 0;
+  list.head = nullptr;
+
+/// Whether the list is empty.
+#define list_empty(list) (!list.head)
 
 /// Prepend a value to the list.
 #define list_add(list, value)                               \
@@ -46,6 +49,23 @@ static inline void* alloc(size_t size) {
     list.head = node;                                       \
   }
 
+/// Append a value to the list.
+#define list_push(list, value)                              \
+  {                                                         \
+    __typeof__(list.head) node = alloc(sizeof(*list.head)); \
+    node->val                  = value;                     \
+    node->next                 = 0;                         \
+    if (!list.head) {                                       \
+      list.head = node;                                     \
+    } else {                                                \
+      __typeof__(list.head) next = list.head;               \
+      while (next && next->next) {                          \
+        next = next->next;                                  \
+      }                                                     \
+      next->next = node;                                    \
+    }                                                       \
+  }
+
 /// Delete the first occurrence of the value from the list.
 #define list_remove(list, search_value)                                   \
   for (__typeof__(list.head) iter = list.head; iter; iter = iter->next) { \
@@ -76,10 +96,10 @@ static inline void* alloc(size_t size) {
       node->next->prev = node->prev; \
     }                                \
     if (list.head == node) {         \
-      list.head = 0;                 \
+      list.head = nullptr;           \
     }                                \
     free(node);                      \
-    node = 0;                        \
+    node = nullptr;                  \
   }
 
 /// Iterate over all the items in the list.
diff --git a/list/test/list_test.c b/list/test/list_test.c
index 418e156..4ac5b5b 100644
--- a/list/test/list_test.c
+++ b/list/test/list_test.c
@@ -52,7 +52,7 @@ TEST_CASE(list_remove_by_value) {
 TEST_CASE(list_remove_by_address) {
   const int N = 3;
 
-  int* ptrs[3] = {0};
+  int* ptrs[3] = {nullptr};
 
   int_list list = make_list(int);
   for (int i = 0; i < N; ++i) {
diff --git a/log/CMakeLists.txt b/log/CMakeLists.txt
index 615e200..1aa96ee 100644
--- a/log/CMakeLists.txt
+++ b/log/CMakeLists.txt
@@ -12,4 +12,4 @@ add_library(log
 target_include_directories(log PUBLIC
   include)
 
-target_compile_options(log PRIVATE -Wall -Wextra)
+target_compile_options(log PRIVATE -Wall -Wextra -Wpedantic)
diff --git a/mem/CMakeLists.txt b/mem/CMakeLists.txt
index 89bf444..d4f065b 100644
--- a/mem/CMakeLists.txt
+++ b/mem/CMakeLists.txt
@@ -18,7 +18,7 @@ target_link_libraries(mem
   cassert
   list)
 
-target_compile_options(mem PRIVATE -Wall -Wextra)
+target_compile_options(mem PRIVATE -Wall -Wextra -Wpedantic)
 
 # Test
 
@@ -28,4 +28,4 @@ add_executable(mem_test
 target_link_libraries(mem_test
   mem)
 
-target_compile_options(mem_test PRIVATE -DUNIT_TEST -DNDEBUG -Wall -Wextra)
+target_compile_options(mem_test PRIVATE -DUNIT_TEST -DNDEBUG -Wall -Wextra -Wpedantic)
diff --git a/mem/include/mem.h b/mem/include/mem.h
index 224b069..d669f2d 100644
--- a/mem/include/mem.h
+++ b/mem/include/mem.h
@@ -68,13 +68,14 @@
 /// Allocate a new chunk of N blocks.
 /// Return a pointer to the first block of the chunk.
 /// When there is no space left in the allocator, allocation can either trap
-/// (default) or gracefully return 0. Call mem_enable_traps() to toggle this
+/// (default) or gracefully return null. Call mem_enable_traps() to toggle this
 /// behaviour.
 /// New chunks are conveniently zeroed out.
-#define mem_alloc(MEM, num_blocks) mem_alloc_(&(MEM)->mem, num_blocks)
+#define mem_alloc(MEM, num_blocks) \
+  (__typeof__((MEM)->object[0])*)mem_alloc_(&(MEM)->mem, num_blocks)
 
 /// Free the chunk.
-/// The chunk pointer is conveniently set to 0.
+/// The chunk pointer is conveniently set to null.
 #define mem_free(MEM, CHUNK) mem_free_(&(MEM)->mem, (void**)CHUNK)
 
 /// Return a pointer to a chunk given the chunk's handle.
diff --git a/mem/src/mem.c b/mem/src/mem.c
index 4f5e5ef..70648c9 100644
--- a/mem/src/mem.c
+++ b/mem/src/mem.c
@@ -46,24 +46,27 @@ void mem_del_(Memory* mem) {
   if (mem->dynamic) {
     if (mem->chunks) {
       free(mem->chunks);
-      mem->chunks = 0;
+      mem->chunks = nullptr;
     }
     if (mem->blocks) {
       free(mem->blocks);
-      mem->blocks = 0;
+      mem->blocks = nullptr;
     }
   }
 }
 
 void mem_clear_(Memory* mem) {
   assert(mem);
-  mem->next_free_chunk = 0;
-  memset(mem->blocks, 0, mem->num_blocks * mem->block_size_bytes);
-  memset(mem->chunks, 0, mem->num_blocks * sizeof(Chunk));
-
-  // Initialize the head as one large free chunk.
-  Chunk* head      = &mem->chunks[0];
-  head->num_blocks = mem->num_blocks;
+  if (mem->num_blocks > 0) {
+    mem->num_used_blocks = 0;
+    mem->next_free_chunk = 0;
+    memset(mem->blocks, 0, mem->num_blocks * mem->block_size_bytes);
+    memset(mem->chunks, 0, mem->num_blocks * sizeof(Chunk));
+
+    // Initialize the head as one large free chunk.
+    Chunk* head      = &mem->chunks[0];
+    head->num_blocks = mem->num_blocks;
+  }
 }
 
 void* mem_alloc_(Memory* mem, size_t num_blocks) {
@@ -113,10 +116,11 @@ void* mem_alloc_(Memory* mem, size_t num_blocks) {
     return &mem->blocks[chunk_idx * mem->block_size_bytes];
   } else {
     if (mem->trap) {
-      FAIL("Memory allocation failed, increase the allocator's capacity or "
-           "avoid fragmentation.");
+      FAIL(
+          "Memory allocation failed, increase the allocator's capacity or "
+          "avoid fragmentation.");
     }
-    return 0; // Large-enough free chunk not found.
+    return nullptr; // Large-enough free chunk not found.
   }
 }
 
@@ -172,7 +176,7 @@ void mem_free_(Memory* mem, void** chunk_ptr) {
 
   mem->num_used_blocks--;
 
-  *chunk_ptr = 0;
+  *chunk_ptr = nullptr;
 }
 
 // The handle is the chunk's index. We don't call it an index in the public API
diff --git a/mem/test/mem_test.c b/mem/test/mem_test.c
index 14718a5..52ce5a9 100644
--- a/mem/test/mem_test.c
+++ b/mem/test/mem_test.c
@@ -32,6 +32,12 @@ TEST_CASE(mem_create_dyn) {
   mem_make_dyn(&mem, NUM_BLOCKS, sizeof(int));
 }
 
+// Clear an uninitialized allocator.
+TEST_CASE(mem_clear_uninitialized) {
+  test_mem mem = {0};
+  mem_clear(&mem);
+}
+
 // Allocate N chunks of 1 block each.
 TEST_CASE(mem_fully_allocate) {
   test_mem mem;
@@ -39,7 +45,7 @@ TEST_CASE(mem_fully_allocate) {
 
   for (int i = 0; i < NUM_BLOCKS; ++i) {
     const int* block = mem_alloc(&mem, 1);
-    TEST_TRUE(block != 0);
+    TEST_TRUE(block != nullptr);
   }
 
   TEST_TRUE(mem_size(&mem) == NUM_BLOCKS);
@@ -50,15 +56,15 @@ TEST_CASE(mem_fill_then_free) {
   test_mem mem;
   mem_make(&mem);
 
-  int* blocks[NUM_BLOCKS] = {0};
+  int* blocks[NUM_BLOCKS] = {nullptr};
   for (int i = 0; i < NUM_BLOCKS; i++) {
     blocks[i] = mem_alloc(&mem, 1);
-    TEST_TRUE(blocks[i] != 0);
+    TEST_TRUE(blocks[i] != nullptr);
   }
 
   for (int i = 0; i < NUM_BLOCKS; i++) {
     mem_free(&mem, &blocks[i]);
-    TEST_EQUAL(blocks[i], 0); // Pointer should be set to 0 on free.
+    TEST_EQUAL(blocks[i], nullptr); // Pointer should be set to 0 on free.
   }
 
   TEST_EQUAL(count(&mem), 0);
@@ -74,12 +80,12 @@ TEST_CASE(mem_allocate_beyond_max_size) {
 
   // Fully allocate the mem.
   for (int i = 0; i < NUM_BLOCKS; ++i) {
-    TEST_TRUE(mem_alloc(&mem, 1) != 0);
+    TEST_TRUE(mem_alloc(&mem, 1) != nullptr);
   }
 
   // Past the end.
   for (int i = 0; i < NUM_BLOCKS; ++i) {
-    TEST_EQUAL(mem_alloc(&mem, 1), 0);
+    TEST_EQUAL(mem_alloc(&mem, 1), nullptr);
   }
 
   TEST_TRUE(mem_size(&mem) == NUM_BLOCKS);
@@ -105,7 +111,7 @@ TEST_CASE(mem_zero_free_block_after_free) {
   mem_make(&mem);
 
   int* val = mem_alloc(&mem, 1);
-  TEST_TRUE(val != 0);
+  TEST_TRUE(val != nullptr);
   *val = 177;
 
   int* old_val = val;
@@ -131,7 +137,7 @@ TEST_CASE(mem_traverse_partially_full) {
 
   for (int i = 0; i < N; ++i) {
     int* val = mem_alloc(&mem, 1);
-    TEST_TRUE(val != 0);
+    TEST_TRUE(val != nullptr);
     *val = i + 1;
   }
 
@@ -146,7 +152,7 @@ TEST_CASE(mem_traverse_full) {
 
   for (int i = 0; i < NUM_BLOCKS; ++i) {
     int* val = mem_alloc(&mem, 1);
-    TEST_TRUE(val != 0);
+    TEST_TRUE(val != nullptr);
     *val = i + 1;
   }
 
@@ -161,7 +167,7 @@ TEST_CASE(mem_get_block) {
 
   for (int i = 0; i < NUM_BLOCKS; ++i) {
     int* block = mem_alloc(&mem, 1);
-    TEST_TRUE(block != 0);
+    TEST_TRUE(block != nullptr);
     *block = i;
     TEST_EQUAL(mem_get_chunk_handle(&mem, block), (size_t)i);
   }
@@ -179,7 +185,7 @@ TEST_CASE(mem_fragmentation) {
   test_mem mem;
   mem_make(&mem);
 
-  int* blocks[NUM_BLOCKS] = {0};
+  int* blocks[NUM_BLOCKS] = {nullptr};
   int  next_block         = 0;
 
 #define ALLOC(num_blocks)                           \
@@ -205,7 +211,7 @@ TEST_CASE(mem_fragmentation) {
 
   // Should be able to allocate 1 chunk of N blocks.
   const void* chunk = mem_alloc(&mem, NUM_BLOCKS);
-  TEST_TRUE(chunk != 0);
+  TEST_TRUE(chunk != nullptr);
 }
 
 // Clear and re-use an allocator.
@@ -216,15 +222,17 @@ TEST_CASE(mem_clear_then_reuse) {
   // Allocate chunks, contents not important.
   for (int i = 0; i < NUM_BLOCKS; ++i) {
     int* chunk = mem_alloc(&mem, 1);
-    TEST_TRUE(chunk != 0);
+    TEST_TRUE(chunk != nullptr);
   }
 
   mem_clear(&mem);
+  TEST_EQUAL(mem_size(&mem), 0);
+  TEST_EQUAL(mem_capacity(&mem), NUM_BLOCKS);
 
   // Allocate chunks and assign values 0..N.
   for (int i = 0; i < NUM_BLOCKS; ++i) {
     int* chunk = mem_alloc(&mem, 1);
-    TEST_TRUE(chunk != 0);
+    TEST_TRUE(chunk != nullptr);
     *chunk = i + 1;
   }
 
diff --git a/mempool/CMakeLists.txt b/mempool/CMakeLists.txt
index 31ff0e1..d6a9772 100644
--- a/mempool/CMakeLists.txt
+++ b/mempool/CMakeLists.txt
@@ -17,7 +17,7 @@ target_include_directories(mempool PUBLIC
 target_link_libraries(mempool PRIVATE
   cassert)
 
-target_compile_options(mempool PRIVATE -Wall -Wextra)
+target_compile_options(mempool PRIVATE -Wall -Wextra -Wpedantic)
 
 # Test
 
@@ -27,4 +27,4 @@ add_executable(mempool_test
 target_link_libraries(mempool_test
   mempool)
 
-target_compile_options(mempool_test PRIVATE -DUNIT_TEST -DNDEBUG -Wall -Wextra)
+target_compile_options(mempool_test PRIVATE -DUNIT_TEST -DNDEBUG -Wall -Wextra -Wpedantic)
diff --git a/mempool/README.md b/mempool/README.md
index ed2935e..7eb950e 100644
--- a/mempool/README.md
+++ b/mempool/README.md
@@ -1,20 +1,15 @@
 # Mempool
 
-A memory pool implementation.
+A memory pool of fixed-sized blocks with O(1) allocation and deallocation.
 
 Each block in the pool is tagged with a boolean value that indicates whether the
-block is free or in use. The allocator otherwise maintains little additional
-information. Therefore, some operations have linear-time complexity.
-Specifically:
+block is free or in use, as well as a pointer to the next free/used block.
+Blocks thus form two lists, a free list and a used list. The allocator
+maintains the two lists when allocating/deallocating blocks.
 
-- Allocating a block scans the pool for the next free block in linear time.
-- Freeing a block runs in constant time.
-- Iterating over the pool's used blocks is linear over the number of blocks in
-  the pool, as opposed to just the number of used blocks.
+The allocator's internal data is stored separately from the block data so that
+the data remains tightly packed.
 
-The allocator's internal data is also stored separately from the main array of
-blocks so that the block data remains tightly packed.
-
-For convenience of programming and debugging, free blocks in the mempool always
-remain zeroed out. If your data structures are valid when zeroed out, then you
-do not need to explicitly initialize them.
+Free blocks in the mempool always remain zeroed out for convenience of
+programming and debugging. If the application's data structures are valid when
+zeroed out, then they do not need to be explicitly initialized.
diff --git a/mempool/include/mempool.h b/mempool/include/mempool.h
index 245173b..ad25614 100644
--- a/mempool/include/mempool.h
+++ b/mempool/include/mempool.h
@@ -64,15 +64,16 @@
 #define mempool_clear(POOL) mempool_clear_(&(POOL)->pool)
 
 /// Allocate a new block.
-/// Return 0 if there is no memory left.
+/// Return null if there is no memory left.
 /// When there is no space left in the pool, allocation can either trap
-/// (default) or gracefully return 0. Call mem_enable_traps() to toggle this
+/// (default) or gracefully return null. Call mem_enable_traps() to toggle this
 /// behaviour.
 /// New blocks are conveniently zeroed out.
-#define mempool_alloc(POOL) mempool_alloc_(&(POOL)->pool)
+#define mempool_alloc(POOL) \
+  (__typeof__((POOL)->object[0])*)mempool_alloc_(&(POOL)->pool)
 
 /// Free the block.
-/// The block pointer is conveniently set to 0.
+/// The block pointer is conveniently set to null.
 #define mempool_free(POOL, BLOCK_PTR) \
   assert(*BLOCK_PTR);                 \
   mempool_free_(&(POOL)->pool, (void**)BLOCK_PTR)
@@ -106,8 +107,8 @@
 /// It is valid to mempool_free() the object at each step of the iteration.
 #define mempool_foreach(POOL, ITER, BODY)                                  \
   {                                                                        \
-    size_t i = (POOL)->pool.used;                                          \
     if ((POOL)->pool.num_used_blocks > 0) {                                \
+      size_t i = (POOL)->pool.used;                                        \
       do {                                                                 \
         if ((POOL)->pool.block_info[i].used) {                             \
           __typeof__((POOL)->object[0])* ITER =                            \
diff --git a/mempool/src/mempool.c b/mempool/src/mempool.c
index 46f1053..2c3c725 100644
--- a/mempool/src/mempool.c
+++ b/mempool/src/mempool.c
@@ -9,6 +9,7 @@
 /// All of the blocks in the pool are assumed free.
 static void init_free_list(mempool* pool) {
   assert(pool);
+  assert(pool->num_blocks > 0);
   for (size_t i = 0; i < pool->num_blocks - 1; ++i) {
     pool->block_info[i].next_free = i + 1;
   }
@@ -34,7 +35,7 @@ bool mempool_make_(
     block_info    = calloc(num_blocks, sizeof(BlockInfo));
     blocks        = calloc(num_blocks, block_size_bytes);
     pool->dynamic = true;
-    if ((block_info == 0) || (blocks == 0)) {
+    if ((block_info == nullptr) || (blocks == nullptr)) {
       return false;
     }
   } else {
@@ -55,22 +56,25 @@ void mempool_del_(mempool* pool) {
   if (pool->dynamic) {
     if (pool->block_info) {
       free(pool->block_info);
-      pool->block_info = 0;
+      pool->block_info = nullptr;
     }
     if (pool->blocks) {
       free(pool->blocks);
-      pool->blocks = 0;
+      pool->blocks = nullptr;
     }
   }
 }
 
 void mempool_clear_(mempool* pool) {
   assert(pool);
-  pool->head = 0;
-  pool->used = 0;
-  memset(pool->blocks, 0, pool->num_blocks * pool->block_size_bytes);
-  memset(pool->block_info, 0, pool->num_blocks * sizeof(BlockInfo));
-  init_free_list(pool);
+  if (pool->num_blocks > 0) {
+    pool->head            = 0;
+    pool->used            = 0;
+    pool->num_used_blocks = 0;
+    memset(pool->blocks, 0, pool->num_blocks * pool->block_size_bytes);
+    memset(pool->block_info, 0, pool->num_blocks * sizeof(BlockInfo));
+    init_free_list(pool);
+  }
 }
 
 void* mempool_alloc_(mempool* pool) {
@@ -81,7 +85,7 @@ void* mempool_alloc_(mempool* pool) {
     if (pool->trap) {
       FAIL("mempool allocation failed, increase the pool's capacity.");
     }
-    return 0; // Pool is full.
+    return nullptr; // Pool is full.
   }
 
   // Allocate the block.
@@ -124,7 +128,7 @@ void mempool_free_(mempool* pool, void** block_ptr) {
 
   pool->num_used_blocks--;
 
-  *block_ptr = 0;
+  *block_ptr = nullptr;
 }
 
 void* mempool_get_block_(const mempool* pool, size_t block_index) {
diff --git a/mempool/test/mempool_test.c b/mempool/test/mempool_test.c
index 843f7e7..69658b9 100644
--- a/mempool/test/mempool_test.c
+++ b/mempool/test/mempool_test.c
@@ -25,13 +25,19 @@ TEST_CASE(mempool_create) {
 }
 
 // Create a dynamically-backed pool.
-TEST_CASE(mem_create_dyn) {
+TEST_CASE(mempool_create_dyn) {
   DEF_MEMPOOL_DYN(dyn_pool, int);
 
   dyn_pool pool;
   mempool_make_dyn(&pool, NUM_BLOCKS, sizeof(int));
 }
 
+// Clear an uninitialized pool.
+TEST_CASE(mempool_clear_uninitialized) {
+  test_pool pool = {0};
+  mempool_clear(&pool);
+}
+
 // Allocate all N blocks.
 TEST_CASE(mempool_allocate_until_full) {
   test_pool pool;
@@ -39,7 +45,7 @@ TEST_CASE(mempool_allocate_until_full) {
 
   for (int i = 0; i < NUM_BLOCKS; ++i) {
     const int* block = mempool_alloc(&pool);
-    TEST_TRUE(block != 0);
+    TEST_TRUE(block != nullptr);
   }
 
   TEST_TRUE(mempool_size(&pool) == NUM_BLOCKS);
@@ -50,10 +56,10 @@ TEST_CASE(mempool_fill_then_free) {
   test_pool pool;
   mempool_make(&pool);
 
-  int* blocks[NUM_BLOCKS] = {0};
+  int* blocks[NUM_BLOCKS] = {nullptr};
   for (int i = 0; i < NUM_BLOCKS; ++i) {
     blocks[i] = mempool_alloc(&pool);
-    TEST_TRUE(blocks[i] != 0);
+    TEST_TRUE(blocks[i] != nullptr);
   }
 
   for (int i = 0; i < NUM_BLOCKS; ++i) {
@@ -74,7 +80,7 @@ TEST_CASE(mempool_allocate_beyond_max_size) {
 
   // Fully allocate the pool.
   for (int i = 0; i < NUM_BLOCKS; ++i) {
-    TEST_TRUE(mempool_alloc(&pool) != 0);
+    TEST_TRUE(mempool_alloc(&pool) != nullptr);
   }
 
   // Past the end.
@@ -105,7 +111,7 @@ TEST_CASE(mempool_zero_free_block_after_free) {
   mempool_make(&pool);
 
   int* val = mempool_alloc(&pool);
-  TEST_TRUE(val != 0);
+  TEST_TRUE(val != nullptr);
   *val = 177;
 
   int* old_val = val;
@@ -131,7 +137,7 @@ TEST_CASE(mempool_traverse_partially_full) {
 
   for (int i = 0; i < N; ++i) {
     int* val = mempool_alloc(&pool);
-    TEST_TRUE(val != 0);
+    TEST_TRUE(val != nullptr);
     *val = i + 1;
   }
 
@@ -146,7 +152,7 @@ TEST_CASE(mempool_traverse_full) {
 
   for (int i = 0; i < NUM_BLOCKS; ++i) {
     int* val = mempool_alloc(&pool);
-    TEST_TRUE(val != 0);
+    TEST_TRUE(val != nullptr);
     *val = i + 1;
   }
 
@@ -161,7 +167,7 @@ TEST_CASE(mempool_get_block) {
 
   for (int i = 0; i < NUM_BLOCKS; ++i) {
     int* block = mempool_alloc(&pool);
-    TEST_TRUE(block != 0);
+    TEST_TRUE(block != nullptr);
     *block = i;
     TEST_EQUAL(mempool_get_block_index(&pool, block), (size_t)i);
   }
@@ -172,22 +178,24 @@ TEST_CASE(mempool_get_block) {
 }
 
 // Clear and re-use an allocator.
-TEST_CASE(mem_clear_then_reuse) {
+TEST_CASE(mempool_clear_then_reuse) {
   test_pool mem;
   mempool_make(&mem);
 
   // Allocate chunks, contents not important.
   for (int i = 0; i < NUM_BLOCKS; ++i) {
-    int* chunk = mempool_alloc(&mem);
-    TEST_TRUE(chunk != 0);
+    const int* chunk = mempool_alloc(&mem);
+    TEST_TRUE(chunk != nullptr);
   }
 
   mempool_clear(&mem);
+  TEST_EQUAL(mempool_size(&mem), 0);
+  TEST_EQUAL(mempool_capacity(&mem), NUM_BLOCKS);
 
   // Allocate chunks and assign values 0..N.
   for (int i = 0; i < NUM_BLOCKS; ++i) {
     int* chunk = mempool_alloc(&mem);
-    TEST_TRUE(chunk != 0);
+    TEST_TRUE(chunk != nullptr);
     *chunk = i + 1;
   }
 
diff --git a/memstack/CMakeLists.txt b/memstack/CMakeLists.txt
new file mode 100644
index 0000000..6846e87
--- /dev/null
+++ b/memstack/CMakeLists.txt
@@ -0,0 +1,30 @@
+cmake_minimum_required(VERSION 3.5)
+
+project(memstack)
+
+set(CMAKE_C_STANDARD 23)
+set(CMAKE_C_STANDARD_REQUIRED On)
+set(CMAKE_C_EXTENSIONS Off)
+
+# Library
+
+add_library(memstack
+  src/memstack.c)
+
+target_include_directories(memstack PUBLIC
+  include)
+
+target_link_libraries(memstack PRIVATE
+  cassert)
+
+target_compile_options(memstack PRIVATE -Wall -Wextra -Wpedantic)
+
+# Test
+
+add_executable(memstack_test
+  test/memstack_test.c)
+
+target_link_libraries(memstack_test
+  memstack)
+
+target_compile_options(memstack_test PRIVATE -DUNIT_TEST -DNDEBUG -Wall -Wextra -Wpedantic)
diff --git a/memstack/README.md b/memstack/README.md
new file mode 100644
index 0000000..7eb950e
--- /dev/null
+++ b/memstack/README.md
@@ -0,0 +1,15 @@
+# Mempool
+
+A memory pool of fixed-sized blocks with O(1) allocation and deallocation.
+
+Each block in the pool is tagged with a boolean value that indicates whether the
+block is free or in use, as well as a pointer to the next free/used block.
+Blocks thus form two lists, a free list and a used list. The allocator
+maintains the two lists when allocating/deallocating blocks.
+
+The allocator's internal data is stored separately from the block data so that
+the data remains tightly packed.
+
+Free blocks in the mempool always remain zeroed out for convenience of
+programming and debugging. If the application's data structures are valid when
+zeroed out, then they do not need to be explicitly initialized.
diff --git a/memstack/include/memstack.h b/memstack/include/memstack.h
new file mode 100644
index 0000000..93cd2e6
--- /dev/null
+++ b/memstack/include/memstack.h
@@ -0,0 +1,66 @@
+/*
+ * Stack-based allocator.
+ */
+#pragma once
+
+#include <stddef.h>
+#include <stdint.h>
+
+/// Stack-based allocator.
+typedef struct memstack {
+  size_t   capacity;  // Total size available.
+  uint8_t* base;      // Base pointer to memory.
+  uint8_t* watermark; // Pointer to next free area of memory.
+  bool     owned;     // True if memory is owned by the memstack.
+  bool     trap;      // Whether to trap when allocating beyond capacity.
+} memstack;
+
+/// Create a stack-based allocator.
+///
+/// `stack` may be user-provided or null.
+/// - If null, the allocator malloc()s the memory for them.
+/// - If given, `stack` must be at least `capacity` bytes.
+///
+/// The memory is zeroed out for convenience.
+bool memstack_make(memstack*, size_t capacity, void* memory);
+
+/// Destroy the stack.
+///
+/// If the allocator owns the memory, then this function frees it.
+void memstack_del(memstack*);
+
+/// Clear the stack.
+void memstack_clear(memstack*);
+
+/// Return the top of the stack.
+size_t memstack_watermark(const memstack*);
+
+/// Set the top of the stack.
+void memstack_set_watermark(memstack*, size_t watermark);
+
+/// Allocate a new block.
+///
+/// Return null if the block does not fit in the remaining memory.
+///
+/// When there is no space left in the stack, allocation can either trap
+/// (default) or gracefully return null. Call mem_enable_traps() to toggle this
+/// behaviour.
+///
+/// Newly allocated blocks are conveniently zeroed out.
+void* memstack_alloc(memstack*, size_t bytes);
+
+/// Allocate a new aligned block.
+///
+/// An alignment of 0 is allowed for convenience and has the same effect as 1.
+///
+/// Has the same properties as memstack_alloc().
+void* memstack_alloc_aligned(memstack*, size_t bytes, size_t alignment);
+
+/// Return the stack's used size in bytes.
+size_t memstack_size(const memstack*);
+
+/// Return the stack's total capacity in bytes.
+size_t memstack_capacity(const memstack*);
+
+/// Set whether to trap when attempting to allocate beyond capacity.
+void memstack_enable_traps(memstack*, bool);
diff --git a/memstack/src/memstack.c b/memstack/src/memstack.c
new file mode 100644
index 0000000..84131ef
--- /dev/null
+++ b/memstack/src/memstack.c
@@ -0,0 +1,119 @@
+#include "memstack.h"
+
+#include <cassert.h>
+
+#include <stdlib.h>
+#include <string.h>
+
+static bool is_pow2_or_0(size_t x) { return (x & (x - 1)) == 0; }
+
+/// Align the given address to the next address that is a multiple of the
+/// alignment. If the given address is already aligned, return the address.
+static uint8_t* align(uint8_t* address, size_t alignment) {
+  assert(is_pow2_or_0(alignment));
+  const size_t mask = alignment - 1;
+  return (uint8_t*)(((uintptr_t)address + mask) & ~mask);
+}
+
+bool memstack_make(memstack* stack, size_t capacity, void* memory) {
+  assert(stack);
+  assert(capacity >= 1);
+
+  // Allocate memory if not user-provided.
+  uint8_t* stack_memory = memory;
+  if (!stack_memory) {
+    stack_memory = calloc(1, capacity);
+    if (stack_memory == nullptr) {
+      return false;
+    }
+  }
+  assert(stack_memory);
+
+  stack->capacity  = capacity;
+  stack->base      = stack_memory;
+  stack->watermark = stack_memory;
+  stack->owned     = (stack_memory != memory);
+  stack->trap      = true;
+
+  return true;
+}
+
+void memstack_del(memstack* stack) {
+  assert(stack);
+
+  if (stack->owned && (stack->base != nullptr)) {
+    free(stack->base);
+    stack->base  = nullptr;
+    stack->owned = false;
+  }
+
+  stack->capacity  = 0;
+  stack->watermark = stack->base;
+}
+
+void memstack_clear(memstack* stack) {
+  assert(stack);
+
+  stack->watermark = stack->base;
+  memset(stack->base, 0, stack->capacity);
+}
+
+size_t memstack_watermark(const memstack* stack) {
+  assert(stack);
+  return stack->watermark - stack->base;
+}
+
+void memstack_set_watermark(memstack* stack, size_t watermark) {
+  assert(stack);
+  const bool fits = (watermark < stack->capacity);
+  if (stack->trap && !fits) {
+    FAIL("memstack watermark update failed, bad watermark");
+  }
+  assert(fits);
+  stack->watermark = stack->base + watermark;
+}
+
+void* memstack_alloc(memstack* stack, size_t bytes) {
+  assert(stack);
+
+  if ((memstack_size(stack) + bytes) > stack->capacity) {
+    if (stack->trap) {
+      FAIL("memstack allocation failed, increase the stack's capacity.");
+    }
+    return nullptr; // Block does not fit in remaining memory.
+  }
+
+  // Allocate the block.
+  uint8_t* const block = stack->watermark;
+  stack->watermark += bytes;
+  assert(memstack_size(stack) <= stack->capacity);
+
+  return block;
+}
+
+void* memstack_alloc_aligned(memstack* stack, size_t bytes, size_t alignment) {
+  assert(stack);
+
+  uint8_t* const new_watermark = align(stack->watermark, alignment);
+  assert(new_watermark >= stack->watermark);
+  assert((size_t)(new_watermark - stack->base) <= stack->capacity);
+  stack->capacity -= (new_watermark - stack->watermark);
+  stack->watermark = new_watermark;
+
+  return memstack_alloc(stack, bytes);
+}
+
+size_t memstack_size(const memstack* stack) {
+  assert(stack);
+  return stack->watermark - stack->base;
+}
+
+size_t memstack_capacity(const memstack* stack) {
+  assert(stack);
+  return stack->capacity;
+}
+
+void memstack_enable_traps(memstack* stack, bool enable) {
+  assert(stack);
+  stack->trap = enable;
+}
diff --git a/memstack/test/memstack_test.c b/memstack/test/memstack_test.c
new file mode 100644
index 0000000..2bcffcd
--- /dev/null
+++ b/memstack/test/memstack_test.c
@@ -0,0 +1,171 @@
+#include "memstack.h"
+
+#include "test.h"
+
+#define NUM_INTS 10
+#define CAPACITY (NUM_INTS * sizeof(int))
+
+// Create and destroy a statically-backed stack.
+TEST_CASE(memstack_create) {
+  int memory[CAPACITY];
+
+  memstack stack = {0};
+  memstack_make(&stack, CAPACITY, memory);
+  memstack_del(&stack);
+}
+
+// Create and destroy a dynamically-backed stack.
+TEST_CASE(memstack_create_dyn) {
+  memstack stack = {0};
+  memstack_make(&stack, CAPACITY, nullptr);
+  memstack_del(&stack);
+}
+
+// Clear an uninitialized stack.
+TEST_CASE(memstack_clear_uninitialized) {
+  memstack stack = {0};
+  memstack_clear(&stack);
+}
+
+// Allocate all N ints.
+TEST_CASE(memstack_allocate_until_full) {
+  memstack stack = {0};
+  memstack_make(&stack, CAPACITY, nullptr);
+
+  for (int i = 0; i < NUM_INTS; ++i) {
+    const int* block = memstack_alloc(&stack, sizeof(int));
+    TEST_TRUE(block != nullptr);
+  }
+
+  TEST_TRUE(memstack_size(&stack) == CAPACITY);
+
+  memstack_del(&stack);
+}
+
+// Allocate all N ints, then free them.
+TEST_CASE(memstack_fill_then_free) {
+  memstack stack = {0};
+  memstack_make(&stack, CAPACITY, nullptr);
+
+  int* blocks[NUM_INTS] = {nullptr};
+  for (int i = 0; i < NUM_INTS; ++i) {
+    blocks[i] = memstack_alloc(&stack, sizeof(int));
+    TEST_TRUE(blocks[i] != nullptr);
+  }
+
+  memstack_clear(&stack);
+
+  TEST_EQUAL(memstack_size(&stack), 0);
+
+  memstack_del(&stack);
+}
+
+// Attempt to allocate blocks past the maximum stack size.
+// The stack should handle the failed allocations gracefully.
+TEST_CASE(memstack_allocate_beyond_max_size) {
+  memstack stack = {0};
+  memstack_make(&stack, CAPACITY, nullptr);
+  memstack_enable_traps(&stack, false);
+
+  // Fully allocate the stack.
+  for (int i = 0; i < NUM_INTS; ++i) {
+    TEST_TRUE(memstack_alloc(&stack, sizeof(int)) != nullptr);
+  }
+
+  // Past the end.
+  for (int i = 0; i < NUM_INTS; ++i) {
+    TEST_EQUAL(memstack_alloc(&stack, sizeof(int)), nullptr);
+  }
+
+  TEST_TRUE(memstack_size(&stack) == CAPACITY);
+
+  memstack_del(&stack);
+}
+
+// Free blocks should always remain zeroed out.
+// This tests the invariant right after creating the stack.
+TEST_CASE(memstack_zero_free_blocks_after_creation) {
+  memstack stack = {0};
+  memstack_make(&stack, CAPACITY, nullptr);
+
+  for (int i = 0; i < NUM_INTS; ++i) {
+    const int* block = memstack_alloc(&stack, sizeof(int));
+    TEST_TRUE(block != nullptr);
+    TEST_EQUAL(*block, 0);
+  }
+
+  memstack_del(&stack);
+}
+
+// Free blocks should always remain zeroed out.
+// This tests the invariant after clearing the stack and allocating a new block.
+TEST_CASE(memstack_zero_free_block_after_free) {
+  memstack stack = {0};
+  memstack_make(&stack, CAPACITY, nullptr);
+
+  for (int i = 0; i < NUM_INTS; ++i) {
+    const int* block = memstack_alloc(&stack, sizeof(int));
+    TEST_TRUE(block != nullptr);
+    TEST_EQUAL(*block, 0);
+  }
+
+  memstack_clear(&stack);
+
+  for (int i = 0; i < NUM_INTS; ++i) {
+    const int* block = memstack_alloc(&stack, sizeof(int));
+    TEST_TRUE(block != nullptr);
+    TEST_EQUAL(*block, 0);
+  }
+
+  memstack_del(&stack);
+}
+
+// Aligned allocations should be properly aligned.
+TEST_CASE(memstack_alloc_aligned) {
+  memstack stack = {0};
+  memstack_make(&stack, CAPACITY, nullptr);
+
+  // -1 because the base address of the memory storage might be unaligned.
+  for (int i = 0; i < NUM_INTS - 1; ++i) {
+    const int* block =
+        memstack_alloc_aligned(&stack, sizeof(int), alignof(int));
+    TEST_TRUE(block != nullptr);
+    TEST_EQUAL(*block, 0);
+    TEST_EQUAL((uintptr_t)block % alignof(int), 0);
+  }
+
+  memstack_del(&stack);
+}
+
+// Get and set the watermark.
+TEST_CASE(memstack_watermark) {
+  memstack stack = {0};
+  memstack_make(&stack, CAPACITY, nullptr);
+
+  // Allocate N/2 ints.
+  for (int i = 0; i < NUM_INTS / 2; ++i) {
+    const int* block = memstack_alloc(&stack, sizeof(int));
+    TEST_TRUE(block != nullptr);
+  }
+
+  const size_t watermark = memstack_watermark(&stack);
+
+  // Allocate the remaining N/2 ints.
+  for (int i = 0; i < NUM_INTS / 2; ++i) {
+    const int* block = memstack_alloc(&stack, sizeof(int));
+    TEST_TRUE(block != nullptr);
+  }
+
+  // Now reset the watermark halfway through.
+  memstack_set_watermark(&stack, watermark);
+
+  // Allocate the remaining N/2 ints (again).
+  for (int i = 0; i < NUM_INTS / 2; ++i) {
+    const int* block = memstack_alloc(&stack, sizeof(int));
+    TEST_TRUE(block != nullptr);
+  }
+
+  memstack_del(&stack);
+}
+
+int main() { return 0; }
diff --git a/memstack/test/test.h b/memstack/test/test.h
new file mode 100644
index 0000000..fd8dc22
--- /dev/null
+++ b/memstack/test/test.h
@@ -0,0 +1,185 @@
+// SPDX-License-Identifier: MIT
+#pragma once
+
+#ifdef UNIT_TEST
+
+#include <stdbool.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+#if defined(__DragonFly__) || defined(__FreeBSD__) || defined(__FreeBSD_kernel__) ||     \
+    defined(__NetBSD__) || defined(__OpenBSD__)
+#define USE_SYSCTL_FOR_ARGS 1
+// clang-format off
+#include <sys/types.h>
+#include <sys/sysctl.h>
+// clang-format on
+#include <unistd.h>        // getpid
+#endif
+
+struct test_file_metadata;
+
+struct test_failure {
+        bool present;
+        const char *message;
+        const char *file;
+        int line;
+};
+
+struct test_case_metadata {
+        void (*fn)(struct test_case_metadata *, struct test_file_metadata *);
+        struct test_failure failure;
+        const char *name;
+        struct test_case_metadata *next;
+};
+
+struct test_file_metadata {
+        bool registered;
+        const char *name;
+        struct test_file_metadata *next;
+        struct test_case_metadata *tests;
+};
+
+struct test_file_metadata __attribute__((weak)) * test_file_head;
+
+#define SET_FAILURE(_message)                                                             \
+        metadata->failure = (struct test_failure) {                                       \
+                .message = _message, .file = __FILE__, .line = __LINE__, .present = true, \
+        }
+
+#define TEST_EQUAL(a, b)                                                                 \
+        do {                                                                             \
+                if ((a) != (b)) {                                                        \
+                        SET_FAILURE(#a " != " #b);                                       \
+                        return;                                                          \
+                }                                                                        \
+        } while (0)
+
+#define TEST_TRUE(a)                                                                     \
+        do {                                                                             \
+                if (!(a)) {                                                              \
+                        SET_FAILURE(#a " is not true");                                  \
+                        return;                                                          \
+                }                                                                        \
+        } while (0)
+
+#define TEST_STREQUAL(a, b)                                                              \
+        do {                                                                             \
+                if (strcmp(a, b) != 0) {                                                 \
+                        SET_FAILURE(#a " != " #b);                                       \
+                        return;                                                          \
+                }                                                                        \
+        } while (0)
+
+#define TEST_CASE(_name)                                                                  \
+        static void __test_h_##_name(struct test_case_metadata *,                         \
+                                     struct test_file_metadata *);                        \
+        static struct test_file_metadata __test_h_file;                                   \
+        static struct test_case_metadata __test_h_meta_##_name = {                        \
+            .name = #_name,                                                               \
+            .fn = __test_h_##_name,                                                       \
+        };                                                                                \
+        static void __attribute__((constructor(101))) __test_h_##_name##_register(void) { \
+                __test_h_meta_##_name.next = __test_h_file.tests;                         \
+                __test_h_file.tests = &__test_h_meta_##_name;                             \
+                if (!__test_h_file.registered) {                                          \
+                        __test_h_file.name = __FILE__;                                    \
+                        __test_h_file.next = test_file_head;                              \
+                        test_file_head = &__test_h_file;                                  \
+                        __test_h_file.registered = true;                                  \
+                }                                                                         \
+        }                                                                                 \
+        static void __test_h_##_name(                                                     \
+            struct test_case_metadata *metadata __attribute__((unused)),                  \
+            struct test_file_metadata *file_metadata __attribute__((unused)))
+
+extern void __attribute__((weak)) (*test_h_unittest_setup)(void);
+/// Run defined tests, return true if all tests succeeds
+/// @param[out] tests_run if not NULL, set to whether tests were run
+static inline void __attribute__((constructor(102))) run_tests(void) {
+        bool should_run = false;
+#ifdef USE_SYSCTL_FOR_ARGS
+        int mib[] = {
+                CTL_KERN,
+#if defined(__NetBSD__) || defined(__OpenBSD__)
+                KERN_PROC_ARGS,
+                getpid(),
+                KERN_PROC_ARGV,
+#else
+                KERN_PROC,
+                KERN_PROC_ARGS,
+                getpid(),
+#endif
+        };
+        char *arg = NULL;
+        size_t arglen;
+        sysctl(mib, sizeof(mib) / sizeof(mib[0]), NULL, &arglen, NULL, 0);
+        arg = malloc(arglen);
+        sysctl(mib, sizeof(mib) / sizeof(mib[0]), arg, &arglen, NULL, 0);
+#else
+        FILE *cmdlinef = fopen("/proc/self/cmdline", "r");
+        char *arg = NULL;
+        int arglen;
+        fscanf(cmdlinef, "%ms%n", &arg, &arglen);
+        fclose(cmdlinef);
+#endif
+        for (char *pos = arg; pos < arg + arglen; pos += strlen(pos) + 1) {
+                if (strcmp(pos, "--unittest") == 0) {
+                        should_run = true;
+                        break;
+                }
+        }
+        free(arg);
+
+        if (!should_run) {
+                return;
+        }
+
+        if (&test_h_unittest_setup) {
+                test_h_unittest_setup();
+        }
+
+        struct test_file_metadata *i = test_file_head;
+        int failed = 0, success = 0;
+        while (i) {
+                fprintf(stderr, "Running tests from %s:\n", i->name);
+                struct test_case_metadata *j = i->tests;
+                while (j) {
+                        fprintf(stderr, "\t%s ... ", j->name);
+                        j->failure.present = false;
+                        j->fn(j, i);
+                        if (j->failure.present) {
+                                fprintf(stderr, "failed (%s at %s:%d)\n", j->failure.message,
+                                        j->failure.file, j->failure.line);
+                                failed++;
+                        } else {
+                                fprintf(stderr, "passed\n");
+                                success++;
+                        }
+                        j = j->next;
+                }
+                fprintf(stderr, "\n");
+                i = i->next;
+        }
+        int total = failed + success;
+        fprintf(stderr, "Test results: passed %d/%d, failed %d/%d\n", success, total,
+                failed, total);
+        exit(failed == 0 ? EXIT_SUCCESS : EXIT_FAILURE);
+}
+
+#else
+
+#include <stdbool.h>
+
+#define TEST_CASE(name) static void __attribute__((unused)) __test_h_##name(void)
+
+#define TEST_EQUAL(a, b)                                                                 \
+        (void)(a);                                                                       \
+        (void)(b)
+#define TEST_TRUE(a) (void)(a)
+#define TEST_STREQUAL(a, b)                                                              \
+        (void)(a);                                                                       \
+        (void)(b)
+
+#endif
diff --git a/plugin/CMakeLists.txt b/plugin/CMakeLists.txt
index 2c34228..c132c0a 100644
--- a/plugin/CMakeLists.txt
+++ b/plugin/CMakeLists.txt
@@ -19,20 +19,20 @@ target_link_libraries(plugin PRIVATE
   list
   log)
 
-target_compile_options(plugin PRIVATE -Wall -Wextra)
+target_compile_options(plugin PRIVATE -Wall -Wextra -Wpedantic)
 
 # Test
 
 add_library(hello_plugin SHARED
   test/hello_plugin.c)
 
-target_compile_options(hello_plugin PRIVATE -Wall -Wextra)
+target_compile_options(hello_plugin PRIVATE -Wall -Wextra -Wpedantic)
 
 add_executable(plugin_test
   test/plugin_test.c)
 
 target_link_libraries(plugin_test
   plugin
-  test)
+  ctest)
 
-target_compile_options(plugin_test PRIVATE -DUNIT_TEST -DNDEBUG -Wall -Wextra)
+target_compile_options(plugin_test PRIVATE -DUNIT_TEST -DNDEBUG -Wall -Wextra -Wpedantic)
diff --git a/plugin/src/plugin.c b/plugin/src/plugin.c
index e2aae1f..3a0ef5d 100644
--- a/plugin/src/plugin.c
+++ b/plugin/src/plugin.c
@@ -64,14 +64,14 @@ static bool load_library(Plugin* plugin) {
   // Handle reloading a previously-loaded library.
   if (plugin->handle) {
     dlclose(plugin->handle);
-    plugin->handle = 0;
+    plugin->handle = nullptr;
   }
 
   const mstring lib = plugin_lib_path(plugin);
 
   // If the plugin fails to load, make sure to keep the plugin's old handle to
   // handle the error gracefully. This handles reload failures, specifically.
-  void* handle = 0;
+  void* handle = nullptr;
   if ((handle = dlopen(mstring_cstr(&lib), RTLD_NOW))) {
     LOGD("Plugin [%s] loaded successfully", mstring_cstr(&plugin->filename));
     plugin->handle = handle;
@@ -86,7 +86,7 @@ static bool load_library(Plugin* plugin) {
 static void delete_plugin_state(Plugin* plugin) {
   if (plugin->state) {
     free(plugin->state);
-    plugin->state = 0;
+    plugin->state = nullptr;
   }
 }
 
@@ -105,7 +105,7 @@ static void destroy_plugin(Plugin* plugin) {
   if (plugin) {
     if (plugin->handle) {
       dlclose(plugin->handle);
-      plugin->handle = 0;
+      plugin->handle = nullptr;
     }
     delete_plugin_state(plugin);
   }
@@ -118,7 +118,7 @@ Plugin* load_plugin(PluginEngine* eng, const char* filename) {
   Plugin plugin = (Plugin){.eng = eng, .filename = mstring_make(filename)};
 
   if (!load_library(&plugin)) {
-    return 0;
+    return nullptr;
   }
 
   list_add(eng->plugins, plugin);
@@ -132,7 +132,7 @@ void delete_plugin(Plugin** pPlugin) {
     assert(plugin->eng);
     destroy_plugin(plugin);
     list_remove_ptr(plugin->eng->plugins, plugin);
-    *pPlugin = 0;
+    *pPlugin = nullptr;
   }
 }
 
@@ -148,7 +148,7 @@ bool plugin_reloaded(Plugin* plugin) {
 // -----------------------------------------------------------------------------
 
 PluginEngine* new_plugin_engine(const PluginEngineDesc* desc) {
-  PluginEngine* eng = 0;
+  PluginEngine* eng = nullptr;
 
   if (!(eng = calloc(1, sizeof(PluginEngine)))) {
     goto cleanup;
@@ -173,7 +173,7 @@ PluginEngine* new_plugin_engine(const PluginEngineDesc* desc) {
 
 cleanup:
   delete_plugin_engine(&eng);
-  return 0;
+  return nullptr;
 }
 
 void delete_plugin_engine(PluginEngine** pEng) {
@@ -191,7 +191,7 @@ void delete_plugin_engine(PluginEngine** pEng) {
       close(eng->inotify_instance);
     }
     free(eng);
-    *pEng = 0;
+    *pEng = nullptr;
   }
 }
 
diff --git a/random/CMakeLists.txt b/random/CMakeLists.txt
index 3c4b2dc..c759ef8 100644
--- a/random/CMakeLists.txt
+++ b/random/CMakeLists.txt
@@ -12,4 +12,4 @@ add_library(random
 
 target_include_directories(random PUBLIC include)
 
-target_compile_options(random PRIVATE -Wall -Wextra)
+target_compile_options(random PRIVATE -Wall -Wextra -Wpedantic)
diff --git a/simloop/CMakeLists.txt b/simloop/CMakeLists.txt
new file mode 100644
index 0000000..2e0114b
--- /dev/null
+++ b/simloop/CMakeLists.txt
@@ -0,0 +1,29 @@
+cmake_minimum_required(VERSION 3.5)
+
+project(simloop)
+
+set(CMAKE_C_STANDARD 23)
+set(CMAKE_C_STANDARD_REQUIRED On)
+set(CMAKE_C_EXTENSIONS Off)
+
+add_library(simloop
+  include/simloop.h
+  src/simloop.c)
+
+target_include_directories(simloop PUBLIC
+  include)
+
+target_compile_options(simloop PRIVATE -Wall -Wextra -Wpedantic)
+
+# Test
+
+add_executable(simloop_test
+  test/simloop_test.c)
+
+target_link_libraries(simloop_test
+  simloop
+  ctest)
+
+target_compile_options(simloop_test PRIVATE -DUNIT_TEST -DNDEBUG -Wall -Wextra -pedantic)
+
+add_test(NAME simloop_test COMMAND simloop_test --unittest)
diff --git a/simloop/README.md b/simloop/README.md
new file mode 100644
index 0000000..f45ca05
--- /dev/null
+++ b/simloop/README.md
@@ -0,0 +1,99 @@
+# Simulation loop module
+
+Simulation loop for games and graphics applications.
+
+## Features
+
+- Client retains control flow.
+- Client-controlled time axis.
+- Updates are frame-rate capped and use a fixed time step for determinism.
+- Rendering is optionally frame-rate capped.
+- Interpolation factor for smooth animation and rendering between frames.
+
+Control flow: the client steps the loop and then checks whether the simulation
+must be updated and/or the result rendered. Time readings are external to the
+library and provided by the client.
+
+## Invariants
+
+- An initial render of the initial application state is always triggered.
+- The same frame is not re-rendered if time does not advance.
+- Animation interpolation factor in [0,1].
+
+## Handling Time Spikes
+
+Generally, the simulation's update logic should be able to keep up with the
+requested frame rate; it is the application's responsibility to ensure this.
+Specifically, the frequency with which the application loops must be higher
+than the requested update frequency, given by the update delta time.
+
+However, occasional time spikes may occur, for example when switching to the
+desktop or when pausing the application in a debugger. The library handles this
+simply by requesting an update from the application. Under the assumption that
+the loop frequency is higher than the update frequency, the simulation will
+catch up with the real-time clock.
+
+### Time Spikes in Detail
+
+When a time spike occurs, the simulation clock falls significantly behind the
+real-time clock. Ideally, the simulation should be able to recover and catch up
+to the real-time clock when this occurs.
+
+Under a variable time delta, the loop could simply update the simulation with
+a large delta that puts the simulation back into the current clock time.
+Under a fixed time delta, this isn't possible, and we seem to have the
+following choices instead:
+
+- a) Queue as many updates as necessary to bring the simulation back to the
+  current clock time (time_difference / fixed_delta).
+- b) Queue a single update.
+- c) Some middle ground between the two.
+
+The issue with (a) is that, if the simulation is never able to catch up, then
+the number of requested updates at every loop iteration diverges and the
+simulation eventually appears to freeze.
+
+(b) only works if:
+
+- clock time added per iter < desired update delta time
+
+Where:
+
+- clock time added per iter = update time + render time + vsync + etc
+- desired delta time = 1 / update frequency
+
+If the clock time added per iteration is greater or equal to the desired delta,
+then the simulation can never "catch up" and recover from the spike.
+
+The middle ground is to perform only some number of updates in each loop
+iteration N. The simulation catches up only if:
+
+- clock time added per iter < N * desired update delta time
+
+The ideal value of N depends on how many frames the application can actually
+render. For example, if the application is vsync'ed to a 240hz monitor and is
+able to render that many frames, then:
+
+- N = ceil(1/240hz / desired update delta time)
+
+Realistically, the actual frame rate will be variable. Moreover, if we queued
+as many frames as possible, then we would risk the freeze in option (a) if the
+actual update time were too large for the application to catch up. So the
+library can only guess the value of N.
+
+The library picks a small constant value of N, implementation-defined, that the
+application can override.
+
+### Example: Spike Handling with Option (A)
+
+- desired delta = 10ms (100 fps)
+- actual delta = 20ms ( 50 fps)
+
+| iter | sim time | clock time | comment                       |
+|------|----------|------------|-------------------------------|
+| 0    | 0        | 0          | initial state                 |
+| 1    | 0        | 10         | queue 1 update                |
+| 2    | 10       | 30         | queue (30-10)/10  = 2 updates |
+| 3    | 30       | 70         | queue (70-30)/10  = 4 updates |
+| 4    | 70       | 150        | queue (150-70)/10 = 8 updates |
+| ...  |
diff --git a/simloop/include/simloop.h b/simloop/include/simloop.h
new file mode 100644
index 0000000..6a83b23
--- /dev/null
+++ b/simloop/include/simloop.h
@@ -0,0 +1,40 @@
+#pragma once
+
+#include <stdint.h>
+
+typedef uint64_t simloop_time_t; ///< Time delta in nanoseconds.
+
+typedef struct SimloopArgs {
+  int update_fps;     ///< Update frame rate. Must be >0.
+  int max_render_fps; ///< Render frame rate cap. 0 to disable.
+} SimloopArgs;
+
+typedef struct SimloopOut {
+  uint64_t       frame;          ///< Frame counter.
+  simloop_time_t update_elapsed; ///< Amount of time elapsed in the simulation.
+  simloop_time_t update_dt;      ///< Delta time for simulation updates.
+  simloop_time_t throttle;      ///< Render throttle if max render fps is given.
+  double         percent_frame; ///< Percent progress between this frame and
+                                ///< the next. Used for smooth animation.
+  bool should_update;           ///< Whether the simulation should update.
+} SimloopOut;
+
+typedef struct SimloopTimeline {
+  simloop_time_t ddt;  ///< Desired delta time.
+  simloop_time_t time; ///< Time point of the last simulation step.
+} SimloopTimeline;
+
+typedef struct Simloop {
+  simloop_time_t  clock;      ///< Tracks simulation time.
+  uint64_t        frame;      ///< Frame counter, number of updates done.
+  SimloopTimeline update;     ///< Update timeline.
+  simloop_time_t  render_ddt; ///< Desired render delta time.
+} Simloop;
+
+/// Create a simulation loop.
+Simloop simloop_make(const SimloopArgs*);
+
+/// Step the simulation loop.
+///
+/// The simulation always triggers a render of the initial state of simulation.
+void simloop_update(Simloop*, simloop_time_t dt, SimloopOut*);
diff --git a/simloop/src/simloop.c b/simloop/src/simloop.c
new file mode 100644
index 0000000..4fa5f62
--- /dev/null
+++ b/simloop/src/simloop.c
@@ -0,0 +1,78 @@
+#include <simloop.h>
+
+#include <assert.h>
+
+static double min(double a, double b) { return a <= b ? a : b; }
+
+static simloop_time_t ddt_from_fps(int fps) {
+  static constexpr double NANOSECONDS = 1e9;
+  return (fps == 0) ? 0 : (simloop_time_t)(NANOSECONDS / (double)fps);
+}
+
+Simloop simloop_make(const SimloopArgs* args) {
+  assert(args);
+  assert(args->update_fps > 0);
+
+  return (Simloop){
+      .frame = 0,
+      .update =
+          (SimloopTimeline){
+                            .ddt  = ddt_from_fps(args->update_fps),
+                            .time = 0,
+                            },
+      .render_ddt = ddt_from_fps(args->max_render_fps),
+  };
+}
+
+void simloop_update(Simloop* sim, simloop_time_t dt, SimloopOut* out) {
+  assert(sim);
+  assert(out);
+
+  sim->clock += dt;
+
+  // Simulation update.
+  // If the simulation falls behind the clock, we advance by a single ddt
+  // increment per loop iteration here and give it a chance to catch up over
+  // subsequent iterations.
+  // This has the implication that percent_frame can fall out of range (>1) if
+  // we are not careful with how it is defined. See the logic below.
+  // If the delta is too large, then we simply warp the simulation to the wall
+  // clock. This avoids the appearance of the simulation playing in fast-forward
+  // as it tries to catch up. Large time spikes can typically occur at the start
+  // of the simulation when the application loads assets, compiles shaders, etc.
+  static const uint64_t max_catchup_frames = 10;
+  const simloop_time_t  delta              = sim->clock - sim->update.time;
+  const uint64_t        delta_frames       = delta / sim->update.ddt;
+  const bool            update_this_tick   = delta >= sim->update.ddt;
+  const bool            warp               = delta_frames > max_catchup_frames;
+  sim->update.time =
+      warp ? sim->clock
+           : (sim->update.time + (update_this_tick ? sim->update.ddt : 0));
+
+  // Loop-state update.
+  sim->frame += (update_this_tick ? 1 : 0);
+
+  // Interpolator for smooth animation.
+  // If the update falls behind the clock, then percent_frame can fall out of
+  // range (>1) if we are not careful. We impose that it is strictly never >1
+  // to account for this case.
+  assert(sim->update.ddt > 0);
+  assert(sim->update.time <= sim->clock);
+  out->percent_frame = min(
+      1., (double)(sim->clock - sim->update.time) / (double)sim->update.ddt);
+  assert((0. <= out->percent_frame) && (out->percent_frame <= 1.));
+
+  // Render frame rate throttle.
+  // Note that if no max render fps is given, then render_ddt is 0. The logic
+  // works for both render_ddt>0 and =0.
+  // Need to be careful with subtraction since the quantities are unsigned.
+  // Subtract an epsilon to account for delays in thread scheduling.
+  static const simloop_time_t eps = 50'000; // 50us
+  out->throttle =
+      (sim->render_ddt > (dt - eps)) ? (sim->render_ddt - eps - dt) : 0;
+
+  out->frame          = sim->frame;
+  out->update_elapsed = sim->update.time;
+  out->update_dt      = sim->update.ddt;
+  out->should_update  = update_this_tick;
+}
diff --git a/simloop/test/simloop_test.c b/simloop/test/simloop_test.c
new file mode 100644
index 0000000..bcf9d57
--- /dev/null
+++ b/simloop/test/simloop_test.c
@@ -0,0 +1,306 @@
+#include <simloop.h>
+
+#include <test.h>
+
+#include <stdint.h>
+
+// -----------------------------------------------------------------------------
+// Time.
+
+static simloop_time_t time_delta_from_sec(double seconds) {
+  static constexpr double NANOS_PER_SEC = 1e9;
+  return (simloop_time_t)(seconds * NANOS_PER_SEC);
+}
+
+// -----------------------------------------------------------------------------
+// Randomness.
+
+typedef struct {
+  uint64_t a;
+} XorShift64State;
+
+static uint64_t xorshift64(XorShift64State* state) {
+  uint64_t x = state->a;
+  x ^= x << 7;
+  x ^= x >> 9;
+  return state->a = x;
+}
+
+// -----------------------------------------------------------------------------
+// Tests.
+
+/// At time/frame 0, no update is triggered (not enough time passed).
+TEST_CASE(simloop_initial_render) {
+  Simloop    simloop = simloop_make(&(SimloopArgs){.update_fps = 10});
+  SimloopOut simout;
+
+  simloop_update(&simloop, 0, &simout);
+
+  TEST_TRUE(!simout.should_update);
+  TEST_EQUAL(simout.frame, 0);
+}
+
+/// The simulation is not updated if time does not advance.
+/// This applies generally to any time > 0.
+TEST_CASE(simloop_render_not_retriggered) {
+  Simloop    simloop = simloop_make(&(SimloopArgs){.update_fps = 10});
+  SimloopOut simout;
+
+  // Advance time by some amount to get past t=0.
+  simloop_update(&simloop, 1, &simout);
+
+  // Now "advance" by 0.
+  const uint64_t frame_before = simout.frame;
+  simloop_update(&simloop, 0, &simout);
+  const uint64_t frame_after = simout.frame;
+
+  TEST_TRUE(!simout.should_update);
+  TEST_EQUAL(frame_before, frame_after);
+}
+
+/// A simulation loop with no render frame cap:
+///   1. Updates based on the desired update frame rate.
+///   2. Does not throttle rendering.
+TEST_CASE(simloop_no_render_frame_cap) {
+  constexpr int        UPDATE_FPS = 10; // 100ms delta
+  const simloop_time_t UPDATE_DDT =
+      time_delta_from_sec(1.0 / (double)UPDATE_FPS);
+  const simloop_time_t STEP             = time_delta_from_sec(0.05); // 50ms
+  const simloop_time_t SIM_DURATION_SEC = time_delta_from_sec(30);
+
+  // We need simulation time to be an exact multiple of the desired deltas for
+  // the modulo comparison below.
+  TEST_TRUE((UPDATE_DDT % STEP) == 0);
+
+  Simloop    simloop = simloop_make(&(SimloopArgs){.update_fps = UPDATE_FPS});
+  SimloopOut simout;
+
+  simloop_update(&simloop, 0, &simout);
+  TEST_TRUE(!simout.should_update); // Time has not advanced.
+  TEST_EQUAL(simout.throttle, 0);   // No throttling with no render frame cap.
+
+  for (simloop_time_t t = STEP; t <= SIM_DURATION_SEC; t += STEP) {
+    simloop_update(&simloop, STEP, &simout);
+    const bool expect_update = (t % UPDATE_DDT) == 0;
+    TEST_EQUAL(simout.should_update, expect_update);
+    TEST_EQUAL(simout.throttle, 0);
+  }
+}
+
+/// A simulation loop with a render frame cap:
+///   1. Updates based on the desired update frame rate.
+///   2. Throttles rendering based on the desired render frame rate.
+TEST_CASE(simloop_with_render_frame_cap) {
+  constexpr int        UPDATE_FPS = 10; // 100ms delta
+  constexpr int        RENDER_FPS = 5;  // 200ms delta
+  const simloop_time_t UPDATE_DDT =
+      time_delta_from_sec(1.0 / (double)UPDATE_FPS);
+  const simloop_time_t RENDER_DDT =
+      time_delta_from_sec(1.0 / (double)RENDER_FPS);
+  const simloop_time_t STEP             = time_delta_from_sec(0.1); // 100ms
+  const simloop_time_t SIM_DURATION_SEC = time_delta_from_sec(30);
+
+  // We need simulation time to be an exact multiple of the desired deltas for
+  // the modulo comparisons below.
+  TEST_TRUE((UPDATE_DDT % STEP) == 0);
+
+  Simloop simloop = simloop_make(
+      &(SimloopArgs){.update_fps = UPDATE_FPS, .max_render_fps = RENDER_FPS});
+  SimloopOut simout;
+
+  simloop_update(&simloop, 0, &simout);
+  TEST_TRUE(!simout.should_update); // Time has not advanced.
+  TEST_EQUAL(simout.throttle, 0);   // No throttle since time has not advanced.
+
+  for (simloop_time_t t = STEP; t <= SIM_DURATION_SEC; t += STEP) {
+    simloop_update(&simloop, STEP, &simout);
+    TEST_EQUAL(simout.should_update, (t % UPDATE_DDT) == 0);
+    TEST_NOTEQUAL(simout.throttle, 0);
+  }
+}
+
+/// If the update falls behind the clock, then percent_frame can fall out of
+/// range (>1) if we are not careful. This tests for this condition.
+TEST_CASE(simloop_percent_frame_01_large_jump) {
+  constexpr int        UPDATE_FPS = 10; // 100ms delta
+  const simloop_time_t UPDATE_DDT =
+      time_delta_from_sec(1.0 / (double)UPDATE_FPS);
+  const simloop_time_t STEP             = time_delta_from_sec(1);
+  const simloop_time_t SIM_DURATION_SEC = time_delta_from_sec(30);
+
+  // We need simulation time to be an exact multiple of the desired deltas for
+  // the modulo comparison below.
+  TEST_TRUE((STEP % UPDATE_DDT) == 0);
+
+  Simloop    simloop = simloop_make(&(SimloopArgs){.update_fps = UPDATE_FPS});
+  SimloopOut simout;
+
+  simloop_update(&simloop, 0, &simout);
+  TEST_TRUE(!simout.should_update); // Time has not advanced.
+
+  for (simloop_time_t t = STEP; t <= SIM_DURATION_SEC; t += STEP) {
+    simloop_update(&simloop, STEP, &simout);
+    TEST_TRUE(simout.should_update); // Tries to catch up to clock.
+    TEST_TRUE(0. <= simout.percent_frame);
+    TEST_TRUE(simout.percent_frame <= 1.);
+  }
+}
+
+/// One benefit of fixed over variable time deltas is determinism. Test for
+/// this by getting to t=10 by different clock time increments.
+///
+/// Note that the time increments must be able to keep up with the desired frame
+/// delta, otherwise determinism is not maintained. We can guarantee determinism
+/// at the expense of re-introducing divergence.
+/// TODO: Perhaps the API should return an update count instead of a boolean,
+///  advance simulation time per the number of updates, then leave it up to
+///  the client to decide whether to update just once or as many times as
+///  requested, depending on whether they want determinism or convergence.
+TEST_CASE(simloop_determinism) {
+  constexpr int        UPDATE_FPS     = 100; // 10ms delta
+  const simloop_time_t RANDOM_STEPS[] = {
+      time_delta_from_sec(0.007), // 7ms
+      time_delta_from_sec(0.005), // 5ms
+      time_delta_from_sec(0.003), // 3ms
+  };
+  constexpr uint64_t NUM_RANDOM_STEPS =
+      sizeof(RANDOM_STEPS) / sizeof(RANDOM_STEPS[0]);
+  const simloop_time_t SIM_DURATION_SEC = time_delta_from_sec(10);
+  constexpr float      ADD              = 0.123f;
+
+  typedef struct Simulation {
+    int   iter_count;
+    float sum;
+  } Simulation;
+
+#define UPDATE_SIMULATION(SIM) \
+  {                            \
+    SIM.sum += ADD;            \
+    SIM.iter_count++;          \
+  }
+
+  Simulation      sim[2] = {0};
+  XorShift64State xss    = (XorShift64State){12069019817132197873ULL};
+
+  // Perform two simulations with random clock-time steps.
+  for (int s = 0; s < 2; ++s) {
+    simloop_time_t dt  = 0;
+    Simloop    simloop = simloop_make(&(SimloopArgs){.update_fps = UPDATE_FPS});
+    SimloopOut simout;
+
+    for (simloop_time_t t = 0; t <= SIM_DURATION_SEC;) {
+      simloop_update(&simloop, dt, &simout);
+
+      if (simout.should_update) {
+        UPDATE_SIMULATION(sim[s]);
+      }
+
+      // Advance time with a random step.
+      const simloop_time_t step =
+          RANDOM_STEPS[xorshift64(&xss) % NUM_RANDOM_STEPS];
+      t += step;
+      dt = step;
+    }
+  }
+
+  // Make sure the simulations have advanced by the same number of updates so
+  // that we can compare them. They may not have had the same update count
+  // depending on the clock-time steps.
+  while (sim[0].iter_count < sim[1].iter_count) {
+    UPDATE_SIMULATION(sim[0]);
+  }
+  while (sim[1].iter_count < sim[0].iter_count) {
+    UPDATE_SIMULATION(sim[1]);
+  }
+  TEST_EQUAL(sim[0].iter_count, sim[1].iter_count);
+
+  // The sums should be exactly equal if determinism holds.
+  // Check also that they are non-zero to make sure the simulation actually
+  // advanced.
+  TEST_TRUE(sim[0].sum > 0.f);
+  TEST_EQUAL(sim[0].sum, sim[1].sum);
+}
+
+/// The simulation loop attempts to catch up with the clock in the event of a
+/// time spike.
+///
+/// Catch-up is possible only if the simulation loops with a frequency higher
+/// than the requested update frequency given by the update delta time.
+///
+/// Catch-up is performed only for sufficiently small time spikes. For large
+/// time spikes, the simulation clock is warped. This test is for the small
+/// time spike case.
+static void simloop_catch_up(
+    struct test_case_metadata* metadata, int update_ddt_ms, int loop_step_ms,
+    bool expect_catchup) {
+  const int            UPDATE_FPS = 1000 / update_ddt_ms;
+  const simloop_time_t UPDATE_DDT =
+      time_delta_from_sec(1.0 / (double)UPDATE_FPS);
+  const simloop_time_t STEP =
+      time_delta_from_sec((double)loop_step_ms / 1000.0);
+  const simloop_time_t SIM_DURATION_SEC = time_delta_from_sec(30);
+  const int            EXPECTED_TOTAL_FRAMES_WITH_CATCHUP =
+      (int)(SIM_DURATION_SEC / UPDATE_DDT);
+
+  Simloop    simloop = simloop_make(&(SimloopArgs){.update_fps = UPDATE_FPS});
+  SimloopOut simout;
+  int        frames = 0;
+
+  // Simulate a time spike.
+  // Advance time to t=1s. That is a lag of 1,000ms / 100ms = 10 frames.
+  // 10 frames is the maximum allowed catch-up.
+  // The simulation now has 29s to catch up.
+  simloop_time_t dt = time_delta_from_sec(1);
+  for (simloop_time_t t = dt; t <= SIM_DURATION_SEC;) {
+    simloop_update(&simloop, dt, &simout);
+
+    if (simout.should_update) {
+      frames++;
+    }
+
+    // New delta is as usual.
+    dt = STEP;
+    t += dt;
+  }
+
+  if (expect_catchup) {
+    TEST_EQUAL(frames, EXPECTED_TOTAL_FRAMES_WITH_CATCHUP);
+  } else {
+    TEST_TRUE(frames < EXPECTED_TOTAL_FRAMES_WITH_CATCHUP);
+  }
+}
+/// (Loop frequency > update frequency) => successful catch-up.
+TEST_CASE(simloop_catch_up_success) {
+  constexpr int UPDATE_DDT_MS = 100;
+  constexpr int LOOP_DDT_MS   = 10;
+  simloop_catch_up(metadata, UPDATE_DDT_MS, LOOP_DDT_MS, true);
+}
+/// (Loop frequency < update frequency) => failed catch-up.
+TEST_CASE(simloop_catch_up_failure) {
+  constexpr int UPDATE_DDT_MS = 10;
+  constexpr int LOOP_DDT_MS   = 100;
+  simloop_catch_up(metadata, UPDATE_DDT_MS, LOOP_DDT_MS, false);
+}
+
+/// This tests the large time spike case, where the simulation clock is warped
+/// to the wall clock.
+TEST_CASE(simloop_warp) {
+  const int            UPDATE_FPS = 50;
+  const simloop_time_t UPDATE_DDT =
+      time_delta_from_sec(1.0 / (double)UPDATE_FPS);
+
+  Simloop    simloop = simloop_make(&(SimloopArgs){.update_fps = UPDATE_FPS});
+  SimloopOut simout;
+
+  // The maximum allowed catch-up is 10 frames. Simulate a time spike larger
+  // than that.
+  const simloop_time_t TIME_SPIKE = UPDATE_DDT * 20;
+  simloop_update(&simloop, TIME_SPIKE, &simout);
+  TEST_TRUE(simout.should_update); // Warp should still request update.
+
+  // Now "advance" by 0.
+  simloop_update(&simloop, 0, &simout);
+  TEST_TRUE(!simout.should_update); // No more updates after warp.
+}
+
+int main() { return 0; }
diff --git a/test/CMakeLists.txt b/test/CMakeLists.txt
index a35fde4..9fe9a9c 100644
--- a/test/CMakeLists.txt
+++ b/test/CMakeLists.txt
@@ -6,8 +6,8 @@ set(CMAKE_C_STANDARD 23)
 set(CMAKE_C_STANDARD_REQUIRED On)
 set(CMAKE_C_EXTENSIONS Off)
 
-add_library(test INTERFACE
+add_library(ctest INTERFACE
   test.h)
 
-target_include_directories(test INTERFACE
+target_include_directories(ctest INTERFACE
   .)
diff --git a/timer/CMakeLists.txt b/timer/CMakeLists.txt
index fb300a0..55f4d79 100644
--- a/timer/CMakeLists.txt
+++ b/timer/CMakeLists.txt
@@ -15,7 +15,7 @@ add_library(timer ${SRC})
 
 target_include_directories(timer PUBLIC include)
 
-target_compile_options(timer PRIVATE -Wall -Wextra)
+target_compile_options(timer PRIVATE -Wall -Wextra -Wpedantic)
 
 # Test
 
@@ -24,4 +24,4 @@ add_executable(timer_test
 
 target_link_libraries(timer_test timer)
 
-target_compile_options(timer_test PRIVATE -DUNIT_TEST -DNDEBUG -Wall -Wextra)
+target_compile_options(timer_test PRIVATE -DUNIT_TEST -DNDEBUG -Wall -Wextra -Wpedantic)
diff --git a/timer/include/timer.h b/timer/include/timer.h
index 94781d6..05f6009 100644
--- a/timer/include/timer.h
+++ b/timer/include/timer.h
@@ -20,11 +20,11 @@ typedef struct timespec time_point;
 typedef uint64_t time_delta;
 
 /// A high resolution timer.
-typedef struct {
-  time_point start_time;   // The instant the timer was last started.
-  time_point last_tick;    // The instant the timer was last ticked.
-  time_delta running_time; // Time elapsed since the timer was last started.
-  time_delta delta_time;   // Time elapsed since the last tick.
+typedef struct Timer {
+  time_point start_time;   ///< The instant the timer was last started.
+  time_point last_tick;    ///< The instant the timer was last ticked.
+  time_delta running_time; ///< Time elapsed since the timer was last started.
+  time_delta delta_time;   ///< Time elapsed since the last tick.
 } Timer;
 
 /// Construct a new timer.
@@ -38,6 +38,15 @@ void timer_start(Timer*);
 /// Update the timer's running and delta times.
 void timer_tick(Timer*);
 
+/// Advance the timer.
+///
+/// This is used for simulations that wish control over time. It should not be
+/// used together with timer_tick().
+///
+/// The input time is relative to the timer's start time. Successive calls to
+/// this function must use increasing values of time.
+void timer_advance(Timer* timer, time_delta t);
+
 /// Get the current time.
 time_point time_now(void);
 
@@ -48,11 +57,14 @@ time_delta time_diff(time_point start, time_point end);
 double time_delta_to_sec(time_delta dt);
 
 /// Convert the time elapsed in seconds to a time delta.
-time_delta sec_to_time_delta(double seconds);
+time_delta time_delta_from_sec(double seconds);
 
 /// Convert the time point to nanoseconds.
 uint64_t time_point_to_ns(time_point);
 
+/// Add a time delta to a timestamp.
+time_point time_add(time_point, time_delta);
+
 /// Put the caller thread to sleep for the given amount of time.
 void time_sleep(time_delta dt);
 
diff --git a/timer/src/timer.c b/timer/src/timer.c
index da3485b..b845491 100644
--- a/timer/src/timer.c
+++ b/timer/src/timer.c
@@ -7,9 +7,9 @@
 #endif
 
 #ifdef _WIN32
-static const int64_t microseconds = 1000000;
+static constexpr uint64_t microseconds = 1000000;
 #endif
-static const int64_t nanoseconds = 1000000000;
+static constexpr uint64_t nanoseconds = 1000000000;
 
 #ifdef _WIN32
 static double seconds_per_count;
@@ -37,11 +37,20 @@ void timer_start(Timer* timer) {
   timer->delta_time   = 0;
 }
 
+static void timer_update(Timer* timer, time_point this_tick) {
+  timer->running_time = time_diff(timer->start_time, this_tick);
+  timer->delta_time   = time_diff(timer->last_tick, this_tick);
+  timer->last_tick    = this_tick;
+}
+
 void timer_tick(Timer* timer) {
   const time_point this_tick = time_now();
-  timer->running_time        = time_diff(timer->start_time, this_tick);
-  timer->delta_time          = time_diff(timer->last_tick, this_tick);
-  timer->last_tick           = this_tick;
+  timer_update(timer, this_tick);
+}
+
+void timer_advance(Timer* timer, time_delta t) {
+  const time_point this_tick = time_add(timer->start_time, t);
+  timer_update(timer, this_tick);
 }
 
 time_point time_now(void) {
@@ -49,7 +58,7 @@ time_point time_now(void) {
 #ifdef _WIN32
   QueryPerformanceCounter((LARGE_INTEGER*)&t);
 #else
-  clock_gettime(CLOCK_REALTIME, &t);
+  clock_gettime(CLOCK_MONOTONIC_RAW, &t);
 #endif
   return t;
 }
@@ -61,7 +70,8 @@ time_delta time_diff(time_point start, time_point end) {
   // another processor, then the delta time can be negative.
   return std::max(0, end - start);
 #else
-  return (end.tv_sec - start.tv_sec) * 1e9 + (end.tv_nsec - start.tv_nsec);
+  return (end.tv_sec - start.tv_sec) * nanoseconds +
+         (end.tv_nsec - start.tv_nsec);
 #endif
 }
 
@@ -73,7 +83,7 @@ double time_delta_to_sec(time_delta dt) {
 #endif
 }
 
-time_delta sec_to_time_delta(double seconds) {
+time_delta time_delta_from_sec(double seconds) {
 #ifdef _WIN32
   return (time_delta)(seconds / seconds_per_count);
 #else
@@ -85,19 +95,30 @@ uint64_t time_point_to_ns(time_point t) {
 #ifdef _WIN32
   return (uint64_t)((double)t * seconds_per_count * 1.0e+9);
 #else
-  return (uint64_t)t.tv_sec * 1e+9 + (uint64_t)t.tv_nsec;
+  return (uint64_t)t.tv_sec * nanoseconds + (uint64_t)t.tv_nsec;
+#endif
+}
+
+time_point time_add(time_point t, time_delta dt) {
+  time_point out;
+#ifdef _WIN32
+  out = t + dt;
+#else
+  out.tv_sec  = t.tv_sec + (__time_t)(dt / nanoseconds);
+  out.tv_nsec = t.tv_nsec + (__time_t)(dt % nanoseconds);
 #endif
+  return out;
 }
 
 void time_sleep(time_delta dt) {
 #ifdef _WIN32
-  const int64_t ms = dt / microseconds;
+  const uint64_t ms = dt / microseconds;
   Sleep((DWORD)(ms));
 #else
-  const int64_t   sec = dt / nanoseconds;
+  const uint64_t  sec = dt / nanoseconds;
   struct timespec ts;
   ts.tv_sec  = (long)sec;
   ts.tv_nsec = (long)(dt % nanoseconds);
-  nanosleep(&ts, NULL);
+  nanosleep(&ts, nullptr);
 #endif
 }
diff --git a/timer/test/timer_test.c b/timer/test/timer_test.c
index a220ead..7fa102a 100644
--- a/timer/test/timer_test.c
+++ b/timer/test/timer_test.c
@@ -9,7 +9,7 @@ TEST_CASE(sleep) {
   const double sleep_time_sec = 0.1;
 
   const time_point start = time_now();
-  time_sleep(sec_to_time_delta(sleep_time_sec));
+  time_sleep(time_delta_from_sec(sleep_time_sec));
   const time_point end = time_now();
 
   TEST_TRUE(time_delta_to_sec(time_diff(start, end)) >= sleep_time_sec);
@@ -28,7 +28,7 @@ TEST_CASE(tick_updates_last_tick_time) {
   const double sleep_time_sec = 0.1;
 
   Timer timer = timer_make();
-  time_sleep(sec_to_time_delta(sleep_time_sec));
+  time_sleep(time_delta_from_sec(sleep_time_sec));
   timer_tick(&timer);
 
   TEST_TRUE(time_delta_to_sec(time_diff(timer.start_time, timer.last_tick)) >=
@@ -40,7 +40,7 @@ TEST_CASE(tick_updates_delta_time) {
   const double sleep_time_sec = 0.1;
 
   Timer timer = timer_make();
-  time_sleep(sec_to_time_delta(sleep_time_sec));
+  time_sleep(time_delta_from_sec(sleep_time_sec));
   timer_tick(&timer);
 
   TEST_TRUE(time_delta_to_sec(timer.delta_time) >= sleep_time_sec);
@@ -50,7 +50,7 @@ TEST_CASE(tick_updates_delta_time) {
 TEST_CASE(tick_does_not_change_start_time) {
   Timer timer = timer_make();
   const time_point start_time = timer.start_time;
-  time_sleep(sec_to_time_delta(0.1));
+  time_sleep(time_delta_from_sec(0.1));
   timer_tick(&timer);
   TEST_TRUE(time_delta_to_sec(time_diff(start_time, timer.start_time)) == 0.0);
 }
@@ -60,7 +60,7 @@ TEST_CASE(start_restarts_start_time) {
   const double sleep_time_seconds = 0.1;
   Timer timer = timer_make();
   const time_point start_time = timer.start_time;
-  time_sleep(sec_to_time_delta(sleep_time_seconds));
+  time_sleep(time_delta_from_sec(sleep_time_seconds));
   timer_start(&timer);
   TEST_TRUE(time_delta_to_sec(time_diff(start_time, timer.start_time)) >=
             sleep_time_seconds);
@@ -75,7 +75,7 @@ TEST_CASE(count) {
   {
     while (time_delta_to_sec(timer.running_time) <= 1.0) {
       hundred_seconds++;
-      time_sleep(sec_to_time_delta(0.1));
+      time_sleep(time_delta_from_sec(0.1));
       timer_tick(&timer);
       TEST_TRUE(time_delta_to_sec(timer.delta_time) >= 0.1);
     }