- ensure invalidation even when malloc fails (in hhash_map)
- check it is invalidated whenever the key set changes
- don't rebuild a valid index, so hhash_build_index() is cheap if valid