A14-08: expected_mi() reads ni[1] out of bounds with no length check (unlike the sibling mi_key)

[ms609]

src/expected_mi.cpp:56-60 — no length check on ni, unlike mi_key at :115 which validates ni.size()==2. Exported and documented with a worked example.

Reproduced by the haiku verifier: expected_mi(3L, c(2L,5L)) returns 0.0004173666 with an Rcpp bounds warning in a debug build; a release/NDEBUG build would read freed/adjacent memory silently instead of warning.

Fix: validate ni.size() == 2 (or whatever the correct expected length is) at function entry, matching mi_key's existing guard.

Filed by /red-team area 14 (opus finder, 2026-08-05), confirmed by haiku verifier with live repro.

[ms609]

Claimed. Branch feature/expected-mi-underflow, worktree C:/Users/pjjg18/GitHub/worktrees/TS-expected-mi (fixing #91, #104, #105, #107 together — they share src/expected_mi.cpp).

[ms609]

PR: #127 (branch feature/expected-mi-underflow). GHA agent-check green on ubuntu-arm64 and windows. Awaiting review.