`nx_srcfmt.nx` source

↩ module page · 1096 lines · 51757 B
1// nx_srcfmt.nx -- THE CANONICAL SOURCE FORMATTER for NishiLang (lang.plan rung LN9, watch symbol
2// srcfmt_emit).  One style, no options -- the gofmt / zig fmt / elm-format shape.  The style was not
3// chosen, it was MEASURED: every rule below is the majority convention of the whole runtime corpus
4// (18,561 files, 2.97 M lines, census 2026-08-23; re-measure any time with `nx_srcfmt census`, which
5// uses this same scanner so the ruler and the rule cannot drift apart):
6//   indent 4 spaces per brace depth (2,216,007 lines are multiples of 4 vs 9,644 that are not), tabs
7//     never (0 tab-indented lines); a continuation line inside an unclosed ( or [ takes base + 4
8//     (20,695 vs 7,210 at +0 vs 4,536 at +8), except a line that opens with ) or ] (base)
9//   `{` stays on the line that opens it (179,575 vs 2 own-line); `} else {` on one line (33,968 vs
10//     5,444 split) -- a lone `}` line followed by an `else` line is JOINED
11//   `, ` (1,098,119 vs 110,794) ; `; ` (455,500 vs 26,006) ; ` = ` and every binary operator spaced
12//     (955,786 vs 276,475 for `=`; 385,897 vs 134,264 for + == != <= >= && ||) ; ` -> ` (103,535 vs 1)
13//   `x: T` (781,324 vs 2,337; a space BEFORE the colon 10) ; `*u8` `&x` `-1` `!b` unary glued
14//     (700,588 vs 2 for the type star) ; `f(` (966,045 vs 19,129) but `if (` `return (` `while (`
15//     keyword-then-paren spaced (15,689 vs 1,315 for `if`) ; `{ stmt }` one-line blocks padded
16//     (338,077 vs 11,657) and `{}` empty blocks closed (457 vs 143) ; `a..b` `a.b` `a::b` glued
17//     (4,644 vs 91 for `..`)
18//   struct field TYPE COLUMNS are aligned (measured 2026-08-23: of 1,712 multi-field struct runs,
19//     1,340 column-align their types, 193 single-space, 179 ragged) -- the type starts one space past
20//     the run's longest field name; a blank line or a comment breaks the run. This is the ONE place a
21//     token's spacing depends on other lines, and it is still whitespace between tokens so the oracle
22//     and the byte-identical-build proof are untouched.
23//   const / static / let / var declarations are NOT aligned -- single space after the colon. The
24//     corpus does NOT decisively align these the way it aligns struct fields: const runs split 4,234
25//     aligned vs 4,760 single (single is the plurality), static 47 vs 174 single, and body-level
26//     let/var are single-space 437,751 vs 6,278. Where the corpus has no clear majority the simpler
27//     rule wins, so aligned const blocks reformat to single-space -- expected, measured churn.
28//   LF line endings (2,524 of 18,801 files carried CRLF), no trailing whitespace (1,914 lines had it),
29//     blank-line runs collapsed to one (348 runs of two or more), exactly one final newline (53 files
30//     had none)
31// PRESERVED BYTE-FOR-BYTE, by construction: every string literal (including the multi-line literals
32// this dialect permits -- 205 files carry one), every comment's text, every @-directive line
33// (@macro bodies through their real extent, found by the tokenizer's own lexm_body_end), and the
34// whitespace run that separates code from a trailing `//` comment (the corpus aligns those by column
35// -- widths 2..6 are all common -- so canonicalising them would destroy deliberate alignment; this is
36// a DECLARED floor, not an oversight).
37//
38// WHY THE TOKENIZER IS THE VERIFIER AND NOT THE EMITTER (measured, nx_tokenizer.nx): lex_source STRIPS
39// comments (skip_ws_comments), PRE-EXPANDS @macro into a new buffer (so token positions no longer
40// address the source), and CONSUMES @ifdef/@else/@endif branches at lex time (inactive code never
41// becomes a token).  A formatter driven by that stream would drop comments, directives and dead
42// branches.  So the emitter is a comment- and directive-aware whitespace scanner that never touches a
43// token's bytes, and lex_source is the ORACLE: srcfmt_verify lexes the input and the output and
44// refuses the output unless the two token streams are identical (kind, value, string bytes).  A
45// formatter that could change a program is the worst defect it can have; here that is impossible by
46// construction -- nothing is written unless the oracle agrees.
47//
48// Line structure MAY change (the else-join, blank-run collapse, CRLF) because the default toolchain
49// embeds no line numbers: measured 2026-08-23, a blank-line insert and a CRLF rewrite of
50// nx_option_enforce_ok.nx both compiled to byte-identical asm (0 .loc/.file directives).
51//
52// CLI
53//   nx_srcfmt <file>           formatted text -> stdout; exit 0 = already canonical, 1 = would change
54//   nx_srcfmt <file> --check   no text, one verdict line; same exit codes
55//   nx_srcfmt census [dir]     per-rule agreement census over the corpus (gk_corpus_scan, or one dir)
56//   exit 2 usage / unreadable ; exit 3 REFUSED: the oracle saw a different token stream (nothing
57//   written) ; exit 4 REFUSED: output capacity (derived from the input; cannot happen, announced)
58// DECLARED FLOOR (measured 2026-08-23, full corpus): 6 of 18,815 files are REFUSED (exit 3), not
59// formatted -- every one uses a metaprogramming construct the tokenizer EXPANDS before parsing that
60// this formatter does not model: `@for(i in 0..N) { ... $i ... }` range-expansion (nx_for_probe,
61// nx_forlist_probe) and `@macro` bodies using `$$gensym` / `$param` substitution (nx_macro_v2/v5/v7/v8
62// _test). The oracle catches the token-stream difference and the formatter DECLINES rather than emit a
63// program-changing result -- the safe direction by construction. The other 18,809 files format
64// idempotently and build byte-identically. Extending @for/gensym preservation is a follow-on rung.
65// NEVER writes in place -- in-place is a separate verb with CAS, not shipped here.
66// license_tier: ORIGINAL   No hw writes (Rule 26).
67import "nx_syscalls.nx"
68import "nx_tokenizer.nx"
69import "nx_gatekit_lib.nx"
70
71const SF_INDENT: i64 = 4          // the measured unit: 2,216,007 multiple-of-4 lines vs 9,644 other
72const SF_NAME_SLOT: i64 = 128     // per-path byte slot for the corpus census (same as MP_SLOT)
73const SF_CORPUS_CAP: i64 = 32768  // corpus is 18,561; 16,384 would REFUSE (same bar as nx_srclint)
74const SF_CENSUS_ROWS: i64 = 24    // rule rows the census verb reports
75
76// ---- previous-token classes (the only state the spacing rules read) ----
77const SP_NONE: i64 = 0       // start of line
78const SP_IDENT: i64 = 1
79const SP_KW: i64 = 2         // keyword that is not an operand (if while return as let ...)
80const SP_OPERAND: i64 = 3    // int / float / string / true / false
81const SP_LPAREN: i64 = 4
82const SP_RPAREN: i64 = 5
83const SP_LBRACK: i64 = 6
84const SP_RBRACK: i64 = 7
85const SP_LBRACE: i64 = 8
86const SP_RBRACE: i64 = 9
87const SP_COMMA: i64 = 10
88const SP_SEMI: i64 = 11
89const SP_COLON: i64 = 12
90const SP_GLUE: i64 = 13      // . .. :: -- no space either side
91const SP_BINOP: i64 = 14     // every binary operator, = -> => ? and the ternary :
92const SP_UNARY: i64 = 15     // - * & + ! ~ used as a prefix: nothing after it
93const SP_ATTR: i64 = 16      // @priv and any @name that is not a directive; #name
94
95// ---- census rule rows ----
96const CR_INDENT: i64 = 0
97const CR_TRAIL: i64 = 1
98const CR_CRLF: i64 = 2
99const CR_COMMA: i64 = 3
100const CR_SEMI: i64 = 4
101const CR_BINOP: i64 = 5
102const CR_ASSIGN: i64 = 6
103const CR_ARROW: i64 = 7
104const CR_COLON: i64 = 8
105const CR_UNARY: i64 = 9
106const CR_CALLPAREN: i64 = 10
107const CR_KWPAREN: i64 = 11
108const CR_LBRACE: i64 = 12
109const CR_BLOCKPAD: i64 = 13
110const CR_EMPTYBLOCK: i64 = 14
111const CR_GLUE: i64 = 15
112const CR_ELSEJOIN: i64 = 16
113const CR_BLANKRUN: i64 = 17
114const CR_CONT: i64 = 18
115const CR_FINALNL: i64 = 19
116const CR_TYPESUFFIX: i64 = 20
117const CR_BRACEOWN: i64 = 21
118const CR_STRUCTALIGN: i64 = 22
119
120struct Sf {
  src: *u8,
  n: i64,
  out: *u8,
  cap: i64,
  o: i64,
  depth: i64,          // brace depth
  pdepth: i64,         // paren + bracket depth
  tern: i64,           // pending ? on this line (ternary colon detection)
  prev: i64,           // SP_* class of the last emitted token on this line
  line_o: i64,         // output offset where the current line's content began (after indent)
  prev_nl: i64,        // output offset of the newline that ended the previous emitted line
  prev_kind: i64,      // 0 none 1 code 2 code+comment 3 comment-only 4 blank 5 raw
  prev_lone_rbrace: i64,
  blank_pending: i64,  // a blank line is owed before the next content line
  any_content: i64,    // something non-blank has been emitted
  overflow: i64,
  cen: *i64,           // census counters (2 per rule: agree, disagree) or 0
  tok_line: i64,       // first token on the current line seen
  in_struct_at: i64,   // brace depth of the current struct body, or -1
  pending_struct: i64, // the `struct` keyword was seen; the next `{` opens a struct body
  run_target: i64,     // aligned type column for the current field run (max name width), 0 = none
  line_ntok: i64,      // tokens emitted on the current line so far
  line_tok0_ident: i64,// the line's first token was a plain identifier
  line_name_len: i64,  // byte length of that first identifier
  align_pending: i64,  // spaces to emit before the next token (struct field type), 0 = use sf_sep
  line_had_field_colon: i64,
  line_start_src: i64,
148}
149
150static g_sf_verify_tok: i64
151static g_sf_verify_line: i64
152
153// ---- small helpers ----
154func sf_at(s: *u8, i: i64) -> i64 { return s[i] as i64 }
155func sf_is_ws(c: i64) -> i64 { if c == 32 { return 1 } if c == 9 { return 1 } if c == 13 { return 1 } return 0 }
156func sf_is_idstart(c: i64) -> i64 { if is_alpha(c) == 1 { return 1 } if c == 95 { return 1 } return 0 }
157func sf_is_idch(c: i64) -> i64 { if is_alnum(c) == 1 { return 1 } if c == 95 { return 1 } return 0 }
158
159func sf_put(F: *Sf, c: i64) -> i64 {
  if F.o >= F.cap { F.overflow = 1; return 0 }
  let ob: *u8 = F.out
  ob[F.o] = c as u8
  F.o = F.o + 1
  return 0
165}
166func sf_put_raw(F: *Sf, a: i64, b: i64) -> i64 {
  var i: i64 = a
  while i < b { sf_put(F, sf_at(F.src, i)); i = i + 1 }
  return 0
170}
171func sf_spaces(F: *Sf, k: i64) -> i64 { var i: i64 = 0; while i < k { sf_put(F, 32); i = i + 1 } return 0 }
172
173// keyword table (the lexer's TK_FUNC..TK_THEN set).  2 = operand keyword (true/false), 1 = keyword, 0 = ident.
174func sf_kw_class(s: *u8, a: i64, b: i64) -> i64 {
  let n: i64 = b - a
  let p: *u8 = ((s as i64) + a) as *u8
  if n == 2 { if streq_n(p, "if\x00" as *u8, 2) == 1 { return 1 } if streq_n(p, "in\x00" as *u8, 2) == 1 { return 1 } if streq_n(p, "as\x00" as *u8, 2) == 1 { return 1 } }
  if n == 3 { if streq_n(p, "let\x00" as *u8, 3) == 1 { return 1 } if streq_n(p, "var\x00" as *u8, 3) == 1 { return 1 } if streq_n(p, "for\x00" as *u8, 3) == 1 { return 1 } }
  if n == 4 {
      if streq_n(p, "func\x00" as *u8, 4) == 1 { return 1 } if streq_n(p, "else\x00" as *u8, 4) == 1 { return 1 }
      if streq_n(p, "loop\x00" as *u8, 4) == 1 { return 1 } if streq_n(p, "true\x00" as *u8, 4) == 1 { return 2 }
      if streq_n(p, "enum\x00" as *u8, 4) == 1 { return 1 } if streq_n(p, "then\x00" as *u8, 4) == 1 { return 1 }
  }
  if n == 5 {
      if streq_n(p, "const\x00" as *u8, 5) == 1 { return 1 } if streq_n(p, "while\x00" as *u8, 5) == 1 { return 1 }
      if streq_n(p, "break\x00" as *u8, 5) == 1 { return 1 } if streq_n(p, "false\x00" as *u8, 5) == 1 { return 2 }
      if streq_n(p, "match\x00" as *u8, 5) == 1 { return 1 }
  }
  if n == 6 {
      if streq_n(p, "static\x00" as *u8, 6) == 1 { return 1 } if streq_n(p, "return\x00" as *u8, 6) == 1 { return 1 }
      if streq_n(p, "struct\x00" as *u8, 6) == 1 { return 1 } if streq_n(p, "extern\x00" as *u8, 6) == 1 { return 1 }
      if streq_n(p, "import\x00" as *u8, 6) == 1 { return 1 }
  }
  if n == 8 { if streq_n(p, "continue\x00" as *u8, 8) == 1 { return 1 } if streq_n(p, "comptime\x00" as *u8, 8) == 1 { return 1 } }
  return 0
196}
197
198// Is the text at i (just after '@') one of the lexer's directives?  Mirrors _lex_handle_preprocessor's
199// table exactly: macro endif undef if( elif( else ifdef ifndef.  Returns 0, or 1 (line directive),
200// or 2 (@macro: body extent via lexm_body_end).
201func sf_directive(s: *u8, i: i64, n: i64) -> i64 {
  let p: *u8 = ((s as i64) + i) as *u8
  if i + 6 <= n { if _sf_eq(p, "macro \x00" as *u8, 6) == 1 { return 2 } }
  if i + 5 <= n { if _sf_eq(p, "endif\x00" as *u8, 5) == 1 { return 1 } }
  if i + 6 <= n { if _sf_eq(p, "undef \x00" as *u8, 6) == 1 { return 1 } }
  if i + 3 <= n { if _sf_eq(p, "if(\x00" as *u8, 3) == 1 { return 1 } }
  if i + 5 <= n { if _sf_eq(p, "elif(\x00" as *u8, 5) == 1 { return 1 } }
  if i + 4 <= n { if _sf_eq(p, "else\x00" as *u8, 4) == 1 { return 1 } }
  if i + 6 <= n { if _sf_eq(p, "ifdef \x00" as *u8, 6) == 1 { return 1 } }
  if i + 7 <= n { if _sf_eq(p, "ifndef \x00" as *u8, 7) == 1 { return 1 } }
  return 0
212}
213func _sf_eq(p: *u8, lit: *u8, k: i64) -> i64 {
  var j: i64 = 0
  while j < k { if p[j] != lit[j] { return 0 } j = j + 1 }
  return 1
217}
218
219// End of a string literal that opens at i (src[i] == '"'): index just past the closing quote, or n.
220func sf_string_end(s: *u8, i: i64, n: i64) -> i64 {
  var j: i64 = i + 1
  var go: i64 = 1
  while go == 1 {
      if j >= n { go = 0 } else {
          let c: i64 = sf_at(s, j)
          if c == 92 { j = j + 2 } else {
              if c == 34 { j = j + 1; go = 0 } else { j = j + 1 }
          }
      }
  }
  if j > n { j = n }
  return j
233}
234
235// End of a @macro directive that starts at i (src[i] == '@'): the body extent the lexer itself uses.
236func sf_macro_end(s: *u8, i: i64, n: i64) -> i64 {
  var np: i64 = i + 7
  var g1: i64 = 1
  while g1 == 1 { if np < n { if sf_at(s, np) == 32 { np = np + 1 } else { g1 = 0 } } else { g1 = 0 } }
  var ne: i64 = np
  var g2: i64 = 1
  while g2 == 1 { if ne < n { if is_alnum(sf_at(s, ne)) == 1 { ne = ne + 1 } else { g2 = 0 } } else { g2 = 0 } }
  var bp: i64 = ne
  var g3: i64 = 1
  while g3 == 1 { if bp < n { if sf_at(s, bp) == 32 { bp = bp + 1 } else { g3 = 0 } } else { g3 = 0 } }
  let be: i64 = lexm_body_end(s, n, bp)
  if be < bp { return bp }
  if be > n { return n }
  return be
250}
251
252// End of the current line: index of the '\n' (or n).
253func sf_eol(s: *u8, i: i64, n: i64) -> i64 {
  var j: i64 = i
  var go: i64 = 1
  while go == 1 { if j < n { if sf_at(s, j) == 10 { go = 0 } else { j = j + 1 } } else { go = 0 } }
  return j
258}
259
260// Strip trailing spaces / tabs / CR from [a, b).
261func sf_rtrim(s: *u8, a: i64, b: i64) -> i64 {
  var e: i64 = b
  while e > a { if sf_is_ws(sf_at(s, e - 1)) == 1 { e = e - 1 } else { return e } }
  return e
265}
266
267func sf_cen(F: *Sf, rule: i64, agree: i64) -> i64 {
  if (F.cen as i64) == 0 { return 0 }
  let cen: *i64 = F.cen
  if agree == 1 { cen[rule * 2] = cen[rule * 2] + 1 } else { cen[rule * 2 + 1] = cen[rule * 2 + 1] + 1 }
  return 0
272}
273
274// Max field-name length over the contiguous run of `ident : type` lines starting at line-start `j`.
275// A field line is: optional indent, an identifier, optional spaces, ':'.  The run breaks at the first
276// line that is not a field line (a blank line, a comment, the closing brace, or any other statement).
277// 0 means `j` itself is not a field line.  This is what makes the alignment column depend on the run.
278func sf_field_run_target(s: *u8, j: i64, n: i64) -> i64 {
  var best: i64 = 0
  var p: i64 = j
  var go: i64 = 1
  while go == 1 {
      // p is at the first non-ws byte of a line
      if p >= n { go = 0 } else {
          let c: i64 = sf_at(s, p)
          if sf_is_idstart(c) == 0 { go = 0 } else {
              var e: i64 = p + 1
              var ge: i64 = 1
              while ge == 1 { if e < n { if sf_is_idch(sf_at(s, e)) == 1 { e = e + 1 } else { ge = 0 } } else { ge = 0 } }
              var q: i64 = e
              var gq: i64 = 1
              while gq == 1 { if q < n { if sf_at(s, q) == 32 { q = q + 1 } else { gq = 0 } } else { gq = 0 } }
              if q >= n { go = 0 } else {
                  if sf_at(s, q) != 58 { go = 0 } else {
                      let nl: i64 = e - p
                      if nl > best { best = nl }
                      // advance to the next line's first non-ws byte
                      let eol: i64 = sf_eol(s, p, n)
                      if eol >= n { go = 0 } else {
                          var np: i64 = eol + 1
                          var gn: i64 = 1
                          while gn == 1 { if np < n { if sf_is_ws(sf_at(s, np)) == 1 { np = np + 1 } else { gn = 0 } } else { gn = 0 } }
                          p = np
                      }
                  }
              }
          }
      }
  }
  return best
311}
312
313// ---- the spacing rule: how many spaces go between the previous token class and this one ----
314// cur_cls is the SP_ class the current token WILL have; cur_kind distinguishes punctuation.
315func sf_sep(F: *Sf, prev: i64, cur: i64) -> i64 {
  if prev == SP_NONE { return 0 }
  if cur == SP_COMMA { return 0 }
  if cur == SP_SEMI { return 0 }
  if cur == SP_RPAREN { return 0 }
  if cur == SP_RBRACK { return 0 }
  if cur == SP_GLUE { return 0 }
  if cur == SP_COLON { return 0 }
  if prev == SP_LPAREN { return 0 }
  if prev == SP_LBRACK { return 0 }
  if prev == SP_GLUE { return 0 }
  if prev == SP_UNARY { return 0 }
  if prev == SP_ATTR { if cur == SP_LPAREN { return 0 } return 1 }
  if prev == SP_LBRACE { if cur == SP_RBRACE { return 0 } return 1 }
  if cur == SP_RBRACE { return 1 }
  if cur == SP_LBRACE { return 1 }
  if cur == SP_LPAREN {
      if prev == SP_IDENT { return 0 }
      if prev == SP_RPAREN { return 0 }
      if prev == SP_RBRACK { return 0 }
      return 1
  }
  if cur == SP_LBRACK {
      if prev == SP_IDENT { return 0 }
      if prev == SP_RPAREN { return 0 }
      if prev == SP_RBRACK { return 0 }
      return 1
  }
  if prev == SP_RBRACK { if cur == SP_IDENT { return 0 } }
  return 1
345}
346
347// Which census rule a (prev, cur) pair belongs to -- so the census can say, per rule, how much of the
348// corpus already agrees.  -1 = not a census-tracked pair.
349func sf_cen_rule(prev: i64, cur: i64, kind_cur: i64, kind_prev: i64) -> i64 {
  if prev == SP_COMMA { return CR_COMMA }
  if prev == SP_SEMI { return CR_SEMI }
  if cur == SP_UNARY { return CR_UNARY }
  if prev == SP_UNARY { return CR_UNARY }
  if kind_cur == 45 { return CR_ASSIGN }
  if kind_prev == 45 { return CR_ASSIGN }
  if kind_cur == 61 { return CR_ARROW }
  if kind_prev == 61 { return CR_ARROW }
  if cur == SP_BINOP { return CR_BINOP }
  if prev == SP_BINOP { return CR_BINOP }
  if cur == SP_COLON { return CR_COLON }
  if prev == SP_COLON { return CR_COLON }
  if cur == SP_LPAREN { if prev == SP_KW { return CR_KWPAREN } if prev == SP_IDENT { return CR_CALLPAREN } }
  if cur == SP_LBRACE { return CR_LBRACE }
  if prev == SP_LBRACE { if cur == SP_RBRACE { return CR_EMPTYBLOCK } return CR_BLOCKPAD }
  if cur == SP_RBRACE { return CR_BLOCKPAD }
  if cur == SP_GLUE { return CR_GLUE }
  if prev == SP_GLUE { return CR_GLUE }
  if prev == SP_RBRACK { if cur == SP_IDENT { return CR_TYPESUFFIX } }
  return 0 - 1
370}
371
372// Emit the separator for a token whose class is `cur`, given the raw gap [gap_a, gap_b) in the source.
373func sf_emit_sep(F: *Sf, cur: i64, kind_cur: i64, kind_prev: i64, gap_a: i64, gap_b: i64) -> i64 {
  if F.align_pending > 0 {
      let want: i64 = F.align_pending
      F.align_pending = 0
      var raw2: i64 = gap_b - gap_a
      if raw2 == want { sf_cen(F, CR_STRUCTALIGN, 1) } else { sf_cen(F, CR_STRUCTALIGN, 0) }
      sf_spaces(F, want)
      return 0
  }
  let k: i64 = sf_sep(F, F.prev, cur)
  let r: i64 = sf_cen_rule(F.prev, cur, kind_cur, kind_prev)
  if r >= 0 {
      if F.prev != SP_NONE {
          var raw: i64 = gap_b - gap_a
          if raw > 1 { raw = 2 }
          if raw == k { sf_cen(F, r, 1) } else { sf_cen(F, r, 0) }
      }
  }
  sf_spaces(F, k)
  return 0
393}
394
395// Is the operator at s[i] (one of - * & +) binary here?  Binary iff the previous token ends an operand.
396func sf_is_binary(F: *Sf) -> i64 {
  if F.prev == SP_IDENT { return 1 }
  if F.prev == SP_OPERAND { return 1 }
  if F.prev == SP_RPAREN { return 1 }
  if F.prev == SP_RBRACK { return 1 }
  return 0
402}
403
404// Classify the punctuation at s[i]; returns the token length (1 or 2) and writes kind (the lexer's
405// TK number) + the SP_ class through out[0..1].
406func sf_punct(s: *u8, i: i64, n: i64, out: *i64) -> i64 {
  let c: i64 = sf_at(s, i)
  var c2: i64 = 0
  if i + 1 < n { c2 = sf_at(s, i + 1) }
  if c == 45 { if c2 == 62 { out[0] = 61; out[1] = SP_BINOP; return 2 } }   // ->
  if c == 61 { if c2 == 61 { out[0] = 46; out[1] = SP_BINOP; return 2 } if c2 == 62 { out[0] = 76; out[1] = SP_BINOP; return 2 } }  // == =>
  if c == 33 { if c2 == 61 { out[0] = 47; out[1] = SP_BINOP; return 2 } }   // !=
  if c == 60 { if c2 == 61 { out[0] = 50; out[1] = SP_BINOP; return 2 } if c2 == 60 { out[0] = 59; out[1] = SP_BINOP; return 2 } }
  if c == 62 { if c2 == 61 { out[0] = 51; out[1] = SP_BINOP; return 2 } if c2 == 62 { out[0] = 60; out[1] = SP_BINOP; return 2 } }
  if c == 38 { if c2 == 38 { out[0] = 52; out[1] = SP_BINOP; return 2 } }
  if c == 124 { if c2 == 124 { out[0] = 53; out[1] = SP_BINOP; return 2 } }
  if c == 46 { if c2 == 46 { out[0] = 62; out[1] = SP_GLUE; return 2 } }
  if c == 58 { if c2 == 58 { out[0] = 75; out[1] = SP_GLUE; return 2 } }
  if c == 43 { out[0] = 40; out[1] = SP_BINOP; return 1 }
  if c == 45 { out[0] = 41; out[1] = SP_BINOP; return 1 }
  if c == 42 { out[0] = 42; out[1] = SP_BINOP; return 1 }
  if c == 47 { out[0] = 43; out[1] = SP_BINOP; return 1 }
  if c == 37 { out[0] = 44; out[1] = SP_BINOP; return 1 }
  if c == 61 { out[0] = 45; out[1] = SP_BINOP; return 1 }
  if c == 60 { out[0] = 48; out[1] = SP_BINOP; return 1 }
  if c == 62 { out[0] = 49; out[1] = SP_BINOP; return 1 }
  if c == 33 { out[0] = 54; out[1] = SP_UNARY; return 1 }
  if c == 38 { out[0] = 55; out[1] = SP_BINOP; return 1 }
  if c == 124 { out[0] = 56; out[1] = SP_BINOP; return 1 }
  if c == 94 { out[0] = 57; out[1] = SP_BINOP; return 1 }
  if c == 126 { out[0] = 58; out[1] = SP_UNARY; return 1 }
  if c == 46 { out[0] = 63; out[1] = SP_GLUE; return 1 }
  if c == 58 { out[0] = 64; out[1] = SP_COLON; return 1 }
  if c == 59 { out[0] = 65; out[1] = SP_SEMI; return 1 }
  if c == 44 { out[0] = 66; out[1] = SP_COMMA; return 1 }
  if c == 40 { out[0] = 67; out[1] = SP_LPAREN; return 1 }
  if c == 41 { out[0] = 68; out[1] = SP_RPAREN; return 1 }
  if c == 123 { out[0] = 69; out[1] = SP_LBRACE; return 1 }
  if c == 125 { out[0] = 70; out[1] = SP_RBRACE; return 1 }
  if c == 91 { out[0] = 71; out[1] = SP_LBRACK; return 1 }
  if c == 93 { out[0] = 72; out[1] = SP_RBRACK; return 1 }
  if c == 63 { out[0] = 77; out[1] = SP_BINOP; return 1 }
  // unknown byte: the lexer skips it; we copy it through as an attribute-like glued token
  out[0] = 0; out[1] = SP_ATTR
  return 1
446}
447
448// Count the `}` tokens that open a code line (for the indent of that line).  Also reports whether the
449// first token is a closing ) or ] (a continuation line that gets base indent) and whether the line is
450// exactly one `{` / the keyword `else`.
451func sf_line_shape(s: *u8, i: i64, n: i64, out: *i64) -> i64 {
  var j: i64 = i
  var nclose: i64 = 0
  var go: i64 = 1
  out[1] = 0
  out[2] = 0
  out[3] = 0
  while go == 1 {
      var gw: i64 = 1
      while gw == 1 { if j < n { if sf_is_ws(sf_at(s, j)) == 1 { j = j + 1 } else { gw = 0 } } else { gw = 0 } }
      if j < n {
          if sf_at(s, j) == 125 { nclose = nclose + 1; j = j + 1 } else { go = 0 }
      } else { go = 0 }
  }
  out[0] = nclose
  if nclose == 0 {
      if j < n {
          let c: i64 = sf_at(s, j)
          if c == 41 { out[1] = 1 }
          if c == 93 { out[1] = 1 }
          if c == 123 {
              let e: i64 = sf_rtrim(s, j + 1, sf_eol(s, j, n))
              if e == j + 1 { out[2] = 1 }
          }
          if c == 101 { if j + 4 <= n { if _sf_eq(((s as i64) + j) as *u8, "else\x00" as *u8, 4) == 1 { var after: i64 = 0; if j + 4 < n { after = sf_at(s, j + 4) } if sf_is_idch(after) == 0 { out[3] = 1 } } } }
      }
  }
  return 0
479}
480
481// Close the current output line: drop trailing whitespace, write '\n', record the line kind.
482func sf_end_line(F: *Sf, kind: i64) -> i64 {
  var gt: i64 = 1
  while gt == 1 { if F.o > F.line_o { if sf_is_ws(sf_at(F.out, F.o - 1)) == 1 { F.o = F.o - 1 } else { gt = 0 } } else { gt = 0 } }
  var lone: i64 = 0
  if kind == 1 { if F.o == F.line_o + 1 { if sf_at(F.out, F.o - 1) == 125 { lone = 1 } } }
  // a line that became empty (e.g. only a CR) is a blank line
  if F.o == F.line_o { if kind != 3 { F.blank_pending = 1; return 0 } }
  F.prev_nl = F.o
  sf_put(F, 10)
  F.prev_kind = kind
  F.prev_lone_rbrace = lone
  F.any_content = 1
  F.tern = 0
  F.prev = SP_NONE
  return 0
497}
498
499// Start a content line: pay any owed blank line, then the canonical indent (or a join).
500// first_tok: 1 = `else` keyword, 2 = lone `{`.  nclose / closer drive the indent.
501func sf_begin_line(F: *Sf, nclose: i64, closer: i64, first_tok: i64, raw_indent: i64) -> i64 {
  if F.blank_pending == 1 {
      F.blank_pending = 0
      if F.any_content == 1 { sf_put(F, 10); F.prev_kind = 4; F.prev_lone_rbrace = 0 }
  }
  var joined: i64 = 0
  if first_tok == 1 { if F.prev_lone_rbrace == 1 { if F.prev_kind == 1 { joined = 1 } } }
  if first_tok == 2 { if F.prev_kind == 1 { joined = 1 } }
  if joined == 1 {
      // rewind over the newline that ended the previous line and continue it with one space
      F.o = F.prev_nl
      F.line_o = F.o
      if first_tok == 1 { sf_cen(F, CR_ELSEJOIN, 0) } else { sf_cen(F, CR_BRACEOWN, 0) }
      F.prev = SP_RBRACE
      if first_tok == 2 { F.prev = SP_IDENT }
      return 0
  }
  var d: i64 = F.depth - nclose
  if d < 0 { d = 0 }
  var ind: i64 = d * SF_INDENT
  if F.pdepth > 0 { if closer == 0 { ind = ind + SF_INDENT; if raw_indent == ind { sf_cen(F, CR_CONT, 1) } else { sf_cen(F, CR_CONT, 0) } } }
  if raw_indent == ind { sf_cen(F, CR_INDENT, 1) } else { sf_cen(F, CR_INDENT, 0) }
  sf_spaces(F, ind)
  F.line_o = F.o
  F.prev = SP_NONE
  return 0
527}
528
529// ---- THE EMITTER (watch symbol).  Returns the output length, or -1 when `cap` would be exceeded. ----
530func srcfmt_emit(src: *u8, n: i64, out: *u8, cap: i64) -> i64 {
  let F_raw: *u8 = sys_mmap(256)
  let F: *Sf = F_raw as *Sf
  F.src = src; F.n = n; F.out = out; F.cap = cap; F.o = 0
  F.depth = 0; F.pdepth = 0; F.tern = 0; F.prev = SP_NONE; F.line_o = 0; F.prev_nl = 0
  F.prev_kind = 0; F.prev_lone_rbrace = 0; F.blank_pending = 0; F.any_content = 0; F.overflow = 0
  F.cen = 0 as *i64
  F.tok_line = 0
  F.in_struct_at = 0 - 1; F.pending_struct = 0; F.run_target = 0
  F.line_ntok = 0; F.line_tok0_ident = 0; F.line_name_len = 0; F.align_pending = 0
  F.line_had_field_colon = 0; F.line_start_src = 0
  sf_run(F)
  if F.overflow == 1 { return 0 - 1 }
  return F.o
544}
545
546// Same emitter with census counters attached (the `census` verb); out still receives the text.
547func srcfmt_emit_census(src: *u8, n: i64, out: *u8, cap: i64, cen: *i64) -> i64 {
  let F_raw: *u8 = sys_mmap(256)
  let F: *Sf = F_raw as *Sf
  F.src = src; F.n = n; F.out = out; F.cap = cap; F.o = 0
  F.depth = 0; F.pdepth = 0; F.tern = 0; F.prev = SP_NONE; F.line_o = 0; F.prev_nl = 0
  F.prev_kind = 0; F.prev_lone_rbrace = 0; F.blank_pending = 0; F.any_content = 0; F.overflow = 0
  F.cen = cen
  F.tok_line = 0
  F.in_struct_at = 0 - 1; F.pending_struct = 0; F.run_target = 0
  F.line_ntok = 0; F.line_tok0_ident = 0; F.line_name_len = 0; F.align_pending = 0
  F.line_had_field_colon = 0; F.line_start_src = 0
  sf_run(F)
  if F.overflow == 1 { return 0 - 1 }
  return F.o
561}
562
563func sf_run(F: *Sf) -> i64 {
  let s: *u8 = F.src
  let n: i64 = F.n
  let shape: *i64 = sys_mmap(64) as *i64
  let pk: *i64 = sys_mmap(32) as *i64
  var i: i64 = 0
  var at_start: i64 = 1
  var line_has_comment: i64 = 0
  var gap_a: i64 = 0
  var kind_prev: i64 = 0
  var blank_run: i64 = 0
  var crlf_seen: i64 = 0
  var line_no: i64 = 1
  while i < n {
      if at_start == 1 {
          // ---- classify the line ----
          var j: i64 = i
          var gj: i64 = 1
          while gj == 1 { if j < n { if sf_is_ws(sf_at(s, j)) == 1 { j = j + 1 } else { gj = 0 } } else { gj = 0 } }
          let raw_indent: i64 = j - i
          var c0: i64 = 10
          if j < n { c0 = sf_at(s, j) }
          if c0 == 10 {
              // blank line
              blank_run = blank_run + 1
              F.run_target = 0
              if blank_run >= 2 { sf_cen(F, CR_BLANKRUN, 0) }
              if j > i { sf_cen(F, CR_TRAIL, 0) } else { sf_cen(F, CR_TRAIL, 1) }
              F.blank_pending = 1
              i = j + 1
              line_no = line_no + 1
              continue
          }
          if blank_run == 1 { sf_cen(F, CR_BLANKRUN, 1) }
          blank_run = 0
          var c1: i64 = 0
          if j + 1 < n { c1 = sf_at(s, j + 1) }
          if c0 == 47 { if c1 == 47 {
              // comment-only line: canonical indent, comment text verbatim
              let e: i64 = sf_eol(s, j, n)
              let et: i64 = sf_rtrim(s, j, e)
              if et < e { sf_cen(F, CR_TRAIL, 0) } else { sf_cen(F, CR_TRAIL, 1) }
              F.run_target = 0
              sf_begin_line(F, 0, 0, 0, raw_indent)
              sf_put_raw(F, j, et)
              sf_end_line(F, 3)
              i = e + 1
              line_no = line_no + 1
              continue
          } }
          if c0 == 64 {
              let dk: i64 = sf_directive(s, j + 1, n)
              if dk > 0 {
                  // directive: the whole line (or the macro body extent) byte-for-byte
                  var e2: i64 = sf_eol(s, j, n)
                  if dk == 2 { let me: i64 = sf_macro_end(s, j, n); if me > e2 { e2 = me } }
                  let et2: i64 = sf_rtrim(s, i, e2)
                  if F.blank_pending == 1 { F.blank_pending = 0; if F.any_content == 1 { sf_put(F, 10) } }
                  F.run_target = 0
                  F.line_o = F.o
                  sf_put_raw(F, i, et2)
                  // count the newlines we swallowed inside a multi-line body
                  var q: i64 = i
                  while q < et2 { if sf_at(s, q) == 10 { line_no = line_no + 1 } q = q + 1 }
                  let eol2: i64 = sf_eol(s, j, n)
                  if e2 > eol2 {
                      // a multi-line body: whatever follows the closing brace is still this line
                      F.prev = SP_ATTR
                      at_start = 0
                      line_has_comment = 0
                      kind_prev = 73
                      i = e2
                      gap_a = i
                      continue
                  }
                  sf_end_line(F, 5)
                  F.prev_kind = 5
                  i = e2 + 1
                  line_no = line_no + 1
                  continue
              }
          }
          // code line
          sf_line_shape(s, j, n, shape)
          var ft: i64 = 0
          if shape[3] == 1 { ft = 1 }
          if shape[2] == 1 { ft = 2 }
          sf_begin_line(F, shape[0], shape[1], ft, raw_indent)
          at_start = 0
          line_has_comment = 0
          kind_prev = 0
          F.line_ntok = 0
          F.line_tok0_ident = 0
          F.line_name_len = 0
          F.line_had_field_colon = 0
          F.line_start_src = j
          i = j
          gap_a = j
          continue
      }
      // ---- inside a line ----
      let c: i64 = sf_at(s, i)
      if c == 10 {
          if F.in_struct_at >= 0 { if F.depth == F.in_struct_at { if F.line_had_field_colon == 0 { F.run_target = 0 } } }
          sf_end_line(F, 1 + line_has_comment)
          at_start = 1
          i = i + 1
          line_no = line_no + 1
          continue
      }
      if sf_is_ws(c) == 1 {
          if c == 13 { if i + 1 < n { if sf_at(s, i + 1) == 10 { crlf_seen = 1; sf_cen(F, CR_CRLF, 0) } } }
          i = i + 1
          continue
      }
      var c2: i64 = 0
      if i + 1 < n { c2 = sf_at(s, i + 1) }
      if c == 47 { if c2 == 47 {
          // trailing comment: keep the raw gap (declared floor), then the comment text
          let e3: i64 = sf_eol(s, i, n)
          let et3: i64 = sf_rtrim(s, i, e3)
          if et3 < e3 { sf_cen(F, CR_TRAIL, 0) } else { sf_cen(F, CR_TRAIL, 1) }
          var g: i64 = gap_a
          while g < i { let gc: i64 = sf_at(s, g); if gc != 13 { sf_put(F, gc) } g = g + 1 }
          sf_put_raw(F, i, et3)
          line_has_comment = 1
          i = e3
          continue
      } }
      if c == 34 {
          let se: i64 = sf_string_end(s, i, n)
          sf_emit_sep(F, SP_OPERAND, 3, kind_prev, gap_a, i)
          sf_put_raw(F, i, se)
          // newlines inside the literal are part of the literal, but the line counter must follow
          var q2: i64 = i
          while q2 < se { if sf_at(s, q2) == 10 { line_no = line_no + 1 } q2 = q2 + 1 }
          F.prev = SP_OPERAND
          kind_prev = 3
          F.line_ntok = F.line_ntok + 1
          i = se
          gap_a = i
          continue
      }
      if c == 64 {
          let dk2: i64 = sf_directive(s, i + 1, n)
          if dk2 > 0 {
              var e4: i64 = sf_eol(s, i, n)
              if dk2 == 2 { let me2: i64 = sf_macro_end(s, i, n); if me2 > e4 { e4 = me2 } }
              let et4: i64 = sf_rtrim(s, i, e4)
              sf_emit_sep(F, SP_ATTR, 73, kind_prev, gap_a, i)
              sf_put_raw(F, i, et4)
              var q3: i64 = i
              while q3 < et4 { if sf_at(s, q3) == 10 { line_no = line_no + 1 } q3 = q3 + 1 }
              F.prev = SP_ATTR
              kind_prev = 73
              i = e4
              gap_a = i
              continue
          }
          // @name attribute: glue the name
          sf_emit_sep(F, SP_ATTR, 73, kind_prev, gap_a, i)
          sf_put(F, 64)
          var k2: i64 = i + 1
          var gk2: i64 = 1
          while gk2 == 1 { if k2 < n { if sf_is_idch(sf_at(s, k2)) == 1 { k2 = k2 + 1 } else { gk2 = 0 } } else { gk2 = 0 } }
          sf_put_raw(F, i + 1, k2)
          F.prev = SP_ATTR
          kind_prev = 73
          F.line_ntok = F.line_ntok + 1
          i = k2
          gap_a = i
          continue
      }
      if sf_is_idstart(c) == 1 {
          var k3: i64 = i + 1
          var gk3: i64 = 1
          while gk3 == 1 { if k3 < n { if sf_is_idch(sf_at(s, k3)) == 1 { k3 = k3 + 1 } else { gk3 = 0 } } else { gk3 = 0 } }
          let kc: i64 = sf_kw_class(s, i, k3)
          var cls: i64 = SP_IDENT
          if kc == 1 { cls = SP_KW }
          if kc == 2 { cls = SP_OPERAND }
          if kc == 1 { if F.prev == SP_RBRACE { if k3 - i == 4 { if _sf_eq(((s as i64) + i) as *u8, "else\x00" as *u8, 4) == 1 { sf_cen(F, CR_ELSEJOIN, 1) } } } }
          if F.line_ntok == 0 { if cls == SP_IDENT { F.line_tok0_ident = 1; F.line_name_len = k3 - i } }
          if kc == 1 { if k3 - i == 6 { if _sf_eq(((s as i64) + i) as *u8, "struct\x00" as *u8, 6) == 1 { F.pending_struct = 1 } } }
          sf_emit_sep(F, cls, 2, kind_prev, gap_a, i)
          sf_put_raw(F, i, k3)
          F.prev = cls
          kind_prev = 2
          F.line_ntok = F.line_ntok + 1
          i = k3
          gap_a = i
          continue
      }
      if is_digit(c) == 1 {
          var k4: i64 = i + 1
          var go4: i64 = 1
          while go4 == 1 {
              if k4 >= n { go4 = 0 } else {
                  let d: i64 = sf_at(s, k4)
                  if sf_is_idch(d) == 1 { k4 = k4 + 1 } else {
                      if d == 46 { var d2: i64 = 0; if k4 + 1 < n { d2 = sf_at(s, k4 + 1) } if is_digit(d2) == 1 { k4 = k4 + 2 } else { go4 = 0 } } else { go4 = 0 }
                  }
              }
          }
          sf_emit_sep(F, SP_OPERAND, 1, kind_prev, gap_a, i)
          sf_put_raw(F, i, k4)
          F.prev = SP_OPERAND
          kind_prev = 1
          F.line_ntok = F.line_ntok + 1
          i = k4
          gap_a = i
          continue
      }
      if c == 35 {
          // #name: glued like @name
          sf_emit_sep(F, SP_ATTR, 74, kind_prev, gap_a, i)
          sf_put(F, 35)
          F.prev = SP_ATTR
          kind_prev = 74
          F.line_ntok = F.line_ntok + 1
          i = i + 1
          gap_a = i
          continue
      }
      // punctuation
      let pl: i64 = sf_punct(s, i, n, pk)
      var kind: i64 = pk[0]
      var cls2: i64 = pk[1]
      if cls2 == SP_BINOP {
          if kind == 41 { if sf_is_binary(F) == 0 { cls2 = SP_UNARY } }    // -
          if kind == 42 { if sf_is_binary(F) == 0 { cls2 = SP_UNARY } }    // *
          if kind == 55 { if sf_is_binary(F) == 0 { cls2 = SP_UNARY } }    // &
          if kind == 40 { if sf_is_binary(F) == 0 { cls2 = SP_UNARY } }    // +
      }
      if kind == 77 { F.tern = F.tern + 1 }
      if cls2 == SP_COLON { if F.tern > 0 { cls2 = SP_BINOP; F.tern = F.tern - 1 } }
      // struct field colon: first token was the field name, we are at struct-body depth -> align the type.
      // The padding goes AFTER the colon (the type column is aligned), so it is set once the colon is
      // emitted, to apply to the next token's separator -- not to the colon's own (which stays glued).
      var field_colon_want: i64 = 0
      if cls2 == SP_COLON {
          if F.in_struct_at >= 0 { if F.depth == F.in_struct_at { if F.line_ntok == 1 { if F.line_tok0_ident == 1 {
              if F.run_target == 0 { F.run_target = sf_field_run_target(s, F.line_start_src, n) }
              field_colon_want = F.run_target - F.line_name_len + 1
              if field_colon_want < 1 { field_colon_want = 1 }
              F.line_had_field_colon = 1
          } } } }
      }
      sf_emit_sep(F, cls2, kind, kind_prev, gap_a, i)
      sf_put_raw(F, i, i + pl)
      if field_colon_want > 0 { F.align_pending = field_colon_want }
      if kind == 67 { F.pdepth = F.pdepth + 1 }
      if kind == 71 { F.pdepth = F.pdepth + 1 }
      if kind == 68 { F.pdepth = F.pdepth - 1; if F.pdepth < 0 { F.pdepth = 0 } }
      if kind == 72 { F.pdepth = F.pdepth - 1; if F.pdepth < 0 { F.pdepth = 0 } }
      if kind == 69 { F.depth = F.depth + 1; if F.pending_struct == 1 { F.in_struct_at = F.depth; F.pending_struct = 0; F.run_target = 0 } }
      if kind == 70 { F.depth = F.depth - 1; if F.depth < 0 { F.depth = 0 } if F.in_struct_at >= 0 { if F.depth < F.in_struct_at { F.in_struct_at = 0 - 1; F.run_target = 0 } } }
      F.prev = cls2
      kind_prev = kind
      F.line_ntok = F.line_ntok + 1
      i = i + pl
      gap_a = i
  }
  // EOF: close an open line, drop trailing blank lines, exactly one final newline
  F.pending_struct = 0
  if at_start == 0 { sf_end_line(F, 1 + line_has_comment) }
  if n > 0 { if sf_at(s, n - 1) == 10 { if F.blank_pending == 0 { sf_cen(F, CR_FINALNL, 1) } else { sf_cen(F, CR_FINALNL, 0) } } else { sf_cen(F, CR_FINALNL, 0) } }
  F.blank_pending = 0
  return 0
832}
833
834// Output capacity derived from the input: every byte can survive, every token can gain one space,
835// every line can gain an indent bounded by the brace count, plus the final newline.
836// First attempt: every byte survives, every line may gain two indent units and every byte one space.
837// If that overflows the caller doubles and retries (srcfmt_emit reports -1, never truncates); the
838// absolute ceiling is lines * 4 * braces, which no real file approaches.
839func srcfmt_cap(src: *u8, n: i64) -> i64 {
  var lines: i64 = 1
  var i: i64 = 0
  while i < n { if sf_at(src, i) == 10 { lines = lines + 1 } i = i + 1 }
  return n * 2 + lines * SF_INDENT * 2 + 64
844}
845func srcfmt_cap_ceiling(src: *u8, n: i64) -> i64 {
  var lines: i64 = 1
  var braces: i64 = 1
  var i: i64 = 0
  while i < n { let c: i64 = sf_at(src, i); if c == 10 { lines = lines + 1 } if c == 123 { braces = braces + 1 } i = i + 1 }
  return n * 2 + lines * (braces * SF_INDENT + SF_INDENT * 2) + 64
851}
852// Emit with a measured capacity: grow on -1 up to the ceiling.  Returns the length and writes the
853// buffer + its capacity through outp/capp; -4 only if the ceiling itself overflowed.
854func srcfmt_emit_grow(src: *u8, n: i64, outp: *i64, capp: *i64, cen: *i64) -> i64 {
  var cap: i64 = srcfmt_cap(src, n)
  let ceil: i64 = srcfmt_cap_ceiling(src, n)
  var go: i64 = 1
  var m: i64 = 0 - 4
  while go == 1 {
      let out: *u8 = sys_mmap(cap + 16)
      if (cen as i64) == 0 { m = srcfmt_emit(src, n, out, cap) } else { m = srcfmt_emit_census(src, n, out, cap, cen) }
      if m >= 0 { outp[0] = out as i64; capp[0] = cap + 16; go = 0 } else {
          sys_munmap(out, cap + 16)
          if cap >= ceil { go = 0; m = 0 - 4 } else { cap = cap * 2; if cap > ceil { cap = ceil } }
      }
  }
  return m
868}
869
870// ---- THE ORACLE: both texts lex to the same token stream?  0 = same; else 1-based index of the
871// first differing token (g_sf_verify_tok) with its line in `a` (g_sf_verify_line). ----
872func srcfmt_verify(a: *u8, an: i64, b: *u8, bn: i64) -> i64 {
  let ta: *Tok = lex_source(a, an + 2)
  let tb: *Tok = lex_source(b, bn + 2)
  var k: i64 = 0
  var go: i64 = 1
  var bad: i64 = 0
  while go == 1 {
      let x: *Tok = (((ta as i64) + k * TOK_BYTES)) as *Tok
      let y: *Tok = (((tb as i64) + k * TOK_BYTES)) as *Tok
      if x.kind != y.kind { bad = k + 1; go = 0 } else {
          if sf_tok_same(x, y) == 0 { bad = k + 1; go = 0 }
          if x.kind == 0 { go = 0 }
      }
      if go == 1 { k = k + 1 }
      if bad != 0 { g_sf_verify_tok = bad; g_sf_verify_line = x.line }
  }
  sys_munmap(ta as *u8, (an + 2) * TOK_BYTES + TOK_BYTES)
  sys_munmap(tb as *u8, (bn + 2) * TOK_BYTES + TOK_BYTES)
  if bad == 0 { g_sf_verify_tok = 0; g_sf_verify_line = 0 }
  return bad
892}
893
894func sf_tok_same(x: *Tok, y: *Tok) -> i64 {
  if x.int_val != y.int_val { return 0 }
  if x.kind == 3 {
      if x.str_len != y.str_len { return 0 }
      if x.str_data != 0 { if y.str_data != 0 {
          let p: *u8 = x.str_data as *u8
          let q: *u8 = y.str_data as *u8
          var i: i64 = 0
          while i < x.str_len { if p[i] != q[i] { return 0 } i = i + 1 }
          return 1
      } }
  }
  if x.text0 != y.text0 { return 0 }
  if x.text1 != y.text1 { return 0 }
  if x.text2 != y.text2 { return 0 }
  if x.text3 != y.text3 { return 0 }
  if x.text4 != y.text4 { return 0 }
  if x.text5 != y.text5 { return 0 }
  if x.text6 != y.text6 { return 0 }
  if x.text7 != y.text7 { return 0 }
  return 1
915}
916
917// ---- output helpers ----
918func sf_puts(fd: i64, s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } sys_write(fd, s, n); return 0 }
919func sf_putn(fd: i64, v: i64) -> i64 {
  let b: *u8 = sys_mmap(32)
  var m: i64 = v
  var neg: i64 = 0
  if m < 0 { neg = 1; m = 0 - m }
  var k: i64 = 31
  b[k] = 0 as u8
  if m == 0 { k = k - 1; b[k] = 48 as u8 }
  while m > 0 { k = k - 1; b[k] = (48 + m % 10) as u8; m = m / 10 }
  if neg == 1 { k = k - 1; b[k] = 45 as u8 }
  sf_puts(fd, ((b as i64) + k) as *u8)
  return 0
931}
932func sf_streq(a: *u8, b: *u8) -> i64 {
  var i: i64 = 0
  while a[i] != (0 as u8) { if a[i] != b[i] { return 0 } i = i + 1 }
  if b[i] != (0 as u8) { return 0 }
  return 1
937}
938func sf_same_bytes(a: *u8, an: i64, b: *u8, bn: i64) -> i64 {
  if an != bn { return 0 }
  var i: i64 = 0
  while i < an { if a[i] != b[i] { return 0 } i = i + 1 }
  return 1
943}
944
945// Format one file in memory: returns the output length, or a negative code (-2 unreadable, -3 oracle
946// refused, -4 capacity).  `outp` receives the buffer; `inp`/`inn` the input (for the caller's diff).
947func srcfmt_file(path: *u8, outp: *i64, inp: *i64, inn: *i64) -> i64 {
  let szp: *i64 = sys_mmap(16) as *i64
  let src: *u8 = sys_read_file(path, szp)
  if (src as i64) == 0 { return 0 - 2 }
  let n: i64 = szp[0]
  let capp: *i64 = sys_mmap(16) as *i64
  let m: i64 = srcfmt_emit_grow(src, n, outp, capp, 0 as *i64)
  inp[0] = src as i64
  inn[0] = n
  if m < 0 { return 0 - 4 }
  let out: *u8 = outp[0] as *u8
  out[m] = 0 as u8
  if srcfmt_verify(src, n, out, m) != 0 { return 0 - 3 }
  return m
961}
962
963func sf_census_name(r: i64) -> *u8 {
  if r == CR_INDENT { return "indent-4-per-depth\x00" as *u8 }
  if r == CR_TRAIL { return "no-trailing-whitespace\x00" as *u8 }
  if r == CR_CRLF { return "lf-line-endings\x00" as *u8 }
  if r == CR_COMMA { return "comma-then-one-space\x00" as *u8 }
  if r == CR_SEMI { return "semicolon-then-one-space\x00" as *u8 }
  if r == CR_BINOP { return "binary-operator-spaced\x00" as *u8 }
  if r == CR_ASSIGN { return "assign-spaced\x00" as *u8 }
  if r == CR_ARROW { return "arrow-spaced\x00" as *u8 }
  if r == CR_COLON { return "decl-colon-x-colon-space-T\x00" as *u8 }
  if r == CR_UNARY { return "unary-glued\x00" as *u8 }
  if r == CR_CALLPAREN { return "call-paren-glued\x00" as *u8 }
  if r == CR_KWPAREN { return "keyword-paren-spaced\x00" as *u8 }
  if r == CR_LBRACE { return "space-before-open-brace\x00" as *u8 }
  if r == CR_BLOCKPAD { return "one-line-block-padded\x00" as *u8 }
  if r == CR_EMPTYBLOCK { return "empty-block-closed\x00" as *u8 }
  if r == CR_GLUE { return "dot-dotdot-coloncolon-glued\x00" as *u8 }
  if r == CR_ELSEJOIN { return "else-joined-to-closing-brace\x00" as *u8 }
  if r == CR_BLANKRUN { return "blank-runs-collapsed\x00" as *u8 }
  if r == CR_CONT { return "continuation-plus-4\x00" as *u8 }
  if r == CR_FINALNL { return "one-final-newline\x00" as *u8 }
  if r == CR_TYPESUFFIX { return "array-type-suffix-glued\x00" as *u8 }
  if r == CR_BRACEOWN { return "open-brace-joined-to-its-line\x00" as *u8 }
  if r == CR_STRUCTALIGN { return "struct-field-type-column-aligned\x00" as *u8 }
  return "?\x00" as *u8
988}
989
990func sf_usage() -> i64 {
  sf_puts(2, "usage: nx_srcfmt <file> [--check] | nx_srcfmt census [dir]\n  exit 0 canonical, 1 would change, 2 usage/unreadable, 3 REFUSED token stream differs, 4 REFUSED capacity\n\x00" as *u8)
  return 2
993}
994
995func sf_census(dir: *u8) -> i64 {
  let names: *u8 = sys_mmap(SF_CORPUS_CAP * SF_NAME_SLOT)
  var cnt: i64 = 0
  if (dir as i64) == 0 { cnt = gk_corpus_scan(names, SF_NAME_SLOT, SF_CORPUS_CAP) } else { cnt = gk_dirscan(dir, 0 as *u8, names, SF_NAME_SLOT, SF_CORPUS_CAP, 0) }
  if cnt <= 0 {
      sf_puts(1, "SRCFMT-CENSUS REFUSED: could not enumerate the corpus (rc=\x00" as *u8); sf_putn(1, cnt); sf_puts(1, ") -- a census over an unknown population is not a census\n\x00" as *u8)
      return 2
  }
  let cen: *i64 = sys_mmap(SF_CENSUS_ROWS * 16 + 64) as *i64
  var f: i64 = 0
  var unreadable: i64 = 0
  var canonical: i64 = 0
  var changed: i64 = 0
  var refused: i64 = 0
  let szp: *i64 = sys_mmap(16) as *i64
  let outp: *i64 = sys_mmap(16) as *i64
  let capp: *i64 = sys_mmap(16) as *i64
  while f < cnt {
      let p: *u8 = ((names as i64) + f * SF_NAME_SLOT) as *u8
      let src: *u8 = sys_read_file(p, szp)
      if (src as i64) == 0 { unreadable = unreadable + 1 } else {
          let n: i64 = szp[0]
          let m: i64 = srcfmt_emit_grow(src, n, outp, capp, cen)
          if m < 0 { refused = refused + 1 } else {
              let out: *u8 = outp[0] as *u8
              if sf_same_bytes(src, n, out, m) == 1 { canonical = canonical + 1 } else { changed = changed + 1 }
              sys_munmap(out, capp[0])
          }
          sys_free_file(src, n)
      }
      f = f + 1
  }
  sf_puts(1, "=== nx_srcfmt census -- per-rule agreement of the corpus with the canonical style (same scanner as the emitter) ===\n\x00" as *u8)
  sf_puts(1, "files=\x00" as *u8); sf_putn(1, cnt)
  sf_puts(1, " canonical=\x00" as *u8); sf_putn(1, canonical)
  sf_puts(1, " would_change=\x00" as *u8); sf_putn(1, changed)
  sf_puts(1, " unreadable=\x00" as *u8); sf_putn(1, unreadable)
  sf_puts(1, " capacity_refused=\x00" as *u8); sf_putn(1, refused)
  sf_puts(1, " (partition sums to files)\n\x00" as *u8)
  var r: i64 = 0
  while r < SF_CENSUS_ROWS {
      let ag: i64 = cen[r * 2]
      let dg: i64 = cen[r * 2 + 1]
      if ag + dg > 0 {
          sf_puts(1, "RULE \x00" as *u8); sf_puts(1, sf_census_name(r))
          sf_puts(1, " agree=\x00" as *u8); sf_putn(1, ag)
          sf_puts(1, " disagree=\x00" as *u8); sf_putn(1, dg)
          sf_puts(1, " permil=\x00" as *u8); sf_putn(1, (ag * 1000) / (ag + dg))
          sf_puts(1, "\n\x00" as *u8)
      }
      r = r + 1
  }
  sf_puts(1, "SRCFMT-CENSUS done files=\x00" as *u8); sf_putn(1, cnt); sf_puts(1, "\n\x00" as *u8)
  return 0
1049}
1050
1051func main(argc: i64, argv: *i64) -> i64 {
  if argc < 2 { return sf_usage() }
  let a1: *u8 = argv[1] as *u8
  if sf_streq(a1, "census\x00" as *u8) == 1 {
      var d: *u8 = 0 as *u8
      if argc >= 3 { d = argv[2] as *u8 }
      return sf_census(d)
  }
  var check: i64 = 0
  if argc >= 3 { if sf_streq(argv[2] as *u8, "--check\x00" as *u8) == 1 { check = 1 } }
  let outp: *i64 = sys_mmap(16) as *i64
  let inp: *i64 = sys_mmap(16) as *i64
  let inn: *i64 = sys_mmap(16) as *i64
  let m: i64 = srcfmt_file(a1, outp, inp, inn)
  if m == (0 - 2) { sf_puts(2, "nx_srcfmt: cannot read \x00" as *u8); sf_puts(2, a1); sf_puts(2, "\n\x00" as *u8); return 2 }
  if m == (0 - 4) { sf_puts(2, "nx_srcfmt: REFUSED output capacity exceeded (derived bound; report this) for \x00" as *u8); sf_puts(2, a1); sf_puts(2, "\n\x00" as *u8); return 4 }
  if m == (0 - 3) {
      sf_puts(2, "nx_srcfmt: REFUSED -- the tokenizer sees a DIFFERENT token stream after formatting \x00" as *u8); sf_puts(2, a1)
      sf_puts(2, " (first differing token #\x00" as *u8); sf_putn(2, g_sf_verify_tok); sf_puts(2, " at source line \x00" as *u8); sf_putn(2, g_sf_verify_line)
      sf_puts(2, "); nothing written. A formatter that changes a program is the defect this check exists to make impossible.\n\x00" as *u8)
      return 3
  }
  let src: *u8 = inp[0] as *u8
  let n: i64 = inn[0]
  let out: *u8 = outp[0] as *u8
  let same: i64 = sf_same_bytes(src, n, out, m)
  if check == 1 {
      sf_puts(1, "SRCFMT \x00" as *u8); sf_puts(1, a1)
      if same == 1 { sf_puts(1, " canonical\x00" as *u8) } else { sf_puts(1, " would-change\x00" as *u8) }
      sf_puts(1, " bytes_in=\x00" as *u8); sf_putn(1, n); sf_puts(1, " bytes_out=\x00" as *u8); sf_putn(1, m); sf_puts(1, " oracle=token-stream-identical\n\x00" as *u8)
  } else {
      mp_write_all_sf(1, out, m)
  }
  if same == 1 { return 0 }
  return 1
1086}
1087
1088func mp_write_all_sf(fd: i64, buf: *u8, n: i64) -> i64 {
  var done: i64 = 0
  while done < n {
      let w: i64 = sys_write(fd, ((buf as i64) + done) as *u8, n - done)
      if w <= 0 { return done }
      done = done + w
  }
  return done
1096}
nx_srcfmt.nx source

`nx_srcfmt.nx` source
