Beagle SCM

ABC-018: GATED style sweep: manual parsers, slice-from-arith, naming drift

Behavior-preserving style audit (2026-07-07 review), the PTR-001 pattern: surfaced for human review, never autolanded. Two hand-written parsers remain in direct violation of the canon's loudest rule, plus a cluster of slice-from-pointer-arithmetic sites and naming/error-code drift.

Input

Context

• DNS.h:154-237,296 — the whole name codec is a manual byte scanner

  (while (dot < src[1] && *dot != '.') ++dot;, p += 1 + len;, rr->rdata[0] = *from; *from += rdlen;). Bounds were probed and are CORRECT (compression-pointer chase incl.) — style/maintainability only. Also: 255-byte total-name cap unenforced (DNS_NAME_MAX only caps hops), and a wire name without the 0 terminator drains OK.

• NFA.h:92-365 — the regex compiler is recursive-descent manual parsing

  with raw *p++ cursors (class parser, counted-repeat re-parse via saved raw pointers). Big job; ragel-vs-slice-movers needs a ruling. (ABC-004 owns only the class-bitmap storage migration.)

• Slice-from-pointer-arithmetic cluster (abc.mkd: "very very bad …

  Never ever do that!"): SORT.c:26-28 (chunk[0]=(u8c*)p; p+=clen), SLOG.c:128/146/159/167/177 ({stream[0]+off, stream[1]}), FILE.h:210-211, FILE.c:1301-1302 (name[1][-1]), PATH.c:292-297, URI.c:501-509 (*esc[0]++, esc[0] += 2). a_rest/a_head/a_part/$eat exist for all of these.

• UDP.h:7-14 a$c — the copy-truncate-NUL anti-pattern verbatim

  (canon's named refactor candidate), UDP-namespaced in name only, zero users: delete.

• memset-vs-zero(): PACK.c:23,169; MMAP.h:14 (also drops munmap return).

  a_pad-vs-a_path: FILE.c:64,80. PATH.h:193 expands FILE_PATH_MAX_LEN which FILE.h defines — PATH.h alone doesn't compile.

• Error-code drift: slice ops returning buffer codes (put32 BNOROOM

  INT.h:128; u8sFeed1xN BUF.h:236; $drainn Sx.h:735 vs sFeedN); FILE.c mixing FILEFAIL/FILEERROR instead of its own FILEErr errno map (FILE.h:74); FSWFAIL discards errno.

• Naming drift vs MOD typ8 VerbStuff: u64hexfeed/u64hexdrain/

  HEXPut (HEX.h:100-122), sSup/scSup (Sx.h:444), snake_case s_purge/cs_len/s_len (Sx.h), FILEdrain vs FILEDrain twin with SWAPPED arg order (FILE.h:408/421), FILECreateAt undeclared in FILE.h. HEX.h:11 static $u8 BASE16 — writable slice over a string literal in a header (one stray write = segfault); UTF8.h:47 mutable per-TU UTF8_LEN.

• Misc LOWs parked here: TTY.c:18 5-byte reserve vs 6-byte worst case;

  PATH.c:201 predictable AddTmp names + no O_EXCL creator (tests-only today); NUM.h:115 NUMLen ignores feed status + raw C-string param; POL.c:83 TrackEvents ignores its fd param; PACK.c:240 u64 pg shadows param pagep pg; BSD.h:46 doc-vs-code on negative sizes; FSW.c:71 nameless events (Q_OVERFLOW) never delivered on Linux, contra FSW.md.

Goals

• DNS name codec → ragel or typed-mover rewrite (bounds already sound:

  differential-test old vs new on a corpus). NFA: ruling first.

• Mechanical sweeps per cluster, one commit each, fuzz/tests green,

  byte-identical outputs where a corpus exists.

Constraints

• GATED like PTR-001: surface diffs for review, do NOT land

  autonomously. Behavior-preserving; repro/differential tests first.

• Renames (s_purge et al.) ripple into ABC-005/007 — land those fixes

  first, sweep names after.

WIP

Design decisions

• (open) NFA compiler: ragel rewrite vs slice-cursor cleanup — user

  ruling required before anyone burns tokens on it.

TODOs

• DNS codec rewrite + differential corpus test + name-length caps
• slice-arith cluster sweep (SORT/SLOG/FILE/PATH/URI)
• error-code + naming sweeps (after ABC-005/007 land)
• delete a$c; BASE16/UTF8_LEN const-ify; misc LOW list above
• NFA ruling, then its own plan

Blockers and bummers

• Waits on ABC-005/ABC-007 for the touched symbols.

Outcome

• (open)