convention sweep: drive-to-clean across the entire codebase

Fifteen rounds of audit-and-fix passes against `CODING-CONVENTIONS.md`,
verified clean by an independent reviewer and end-to-end on Linux
(gcc, 104/104) and Mac (clang, 99/99).

Stack-init scopes:
- `StrInitStack(name, ne) { body }` and `VecInitStack(T, name, ne) { body }`
  are the for-chain idioms; no allocator, `_Alignas(T)` backing storage,
  scope-exit zeroes the handle so any subsequent use trips `validate_vec`.
- `reserve_vec` / `deinit_vec` / `reduce_space_vec` recognise the
  NULL-allocator stack-init signal and abort with the dedicated
  "vector not growable, no allocator assigned, probably stack inited"
  trap.
- `IterInitFromVec*` falls back to alignment 1 on NULL allocator so a
  `StrIter` over a stack-init Str works.
- `IterTruncate` is the legitimate Iter mutator; `IterLength` and the
  Vec / Map / List / BitVec / Graph length / capacity / allocator
  accessors are rvalue-only via `((void)0, (c)->field)` so
  `Accessor(c) = X` no longer compiles.

`_Generic` dispatch:
- Every site with a `Zstr:` arm now carries an inline `char *:`
  synonym arm with an identical body, restoring MSVC C portability.
  `/Zc:strictStrings` is documented as a C++-only no-op and removed
  from the MSVC branch of meson.build.

Sub-range iteration:
- `Sys/Dns.c::parse_hosts_table` / `parse_resolv_conf` rewritten from
  `Zstr p / Zstr end` to `StrIter`, matching the `Parsers/JSON.c` /
  `Parsers/KvConfig.c` precedent.
- `Sys/ProcMaps.c` parser rewritten to `StrIter`; chunked-read append
  now goes through `StrReserve` + `StrEnd` + `StrResize`.
- `Std/Io.c` float / int / hex / octal / binary parsers, plus the
  format-write parsers, migrated to `StrIter`.
- Smaller cursor walks in `Parsers/Dns.c::encode_qname`, `ArgParse.c`,
  `Parsers/Dwarf*` family migrated to `StrIter` / `StrPushBackMany`.
- The dual-cursor `Io.c::str_read_fmt` and the past-the-end-pointer
  `Container/Str.c::StrSplit` / `strip_str` carry inline-justified
  pointer-pair semantics that StrIter can't express; left as-is.

Typing + naming:
- `u8 *` for raw byte-arithmetic in allocator internals (Heap.c,
  Slab.c, Page.c, Vec.c, List.c).
- `Zstr` everywhere in declarations / params / fields. `MachoCache`,
  `PdbCache`, `Backtrace`, `Sys/Dns`, `Bench/Allocator` updated.
- `MISRA_SIG*` -> `BEAM_*` to avoid libc-signal-macro collision.
- `SetAbortCallback` -> `OnAbort` (forbidden `Set*` shape).
- `BufReadCstr` / `BufWriteCstr` -> `BufReadZstr` / `BufWriteZstr`
  (wire format is plain Zstr, not the `(Zstr, size)` `Cstr` shape).
- `Tests/Std/Vec.Complex.c::CreateComplexItem` -> `InitComplexItem`.
- `is_tty` (was `misra_is_tty`); `Zstr exe = _dyld_get_image_name(0)`;
  `Zstr nm = de->d_name`.

Accessors added (the field-read sites the tests + tree needed):
- `VecCopyInit` / `VecCopyDeinit`; `ListCopyInit` / `ListCopyDeinit`;
  `ListNodeData`; `MapKeyCopyInit` / `MapKeyCopyDeinit` /
  `MapValueCopyInit` / `MapValueCopyDeinit`; `GraphAllocator` /
  `GraphCopyInit` / `GraphCopyDeinit` / `GraphMutationEpoch`.
- Public `zstr_hash` / `zstr_compare` (FNV-1a + three-way wrapper)
  so `Tests/Std/Map.Ops.c` and any future `Map<Zstr, ...>` callers
  can register the canonical callbacks without redefining them.

Direct field-access cleanup:
- Replaced `Vec.length` / `Vec.data` / `Str.data` / `Str.length` /
  `Map.allocator` / `Buf.length` reads from outside the container's
  `.c` with the matching accessor across `Sys/PdbCache`, `MachoCache`,
  `SymbolResolver`, `Socket`, `Backtrace`, `Proc`, `Dir`, `Dns`,
  `Std/Io`, `Std/Log`, `Std/ArgParse`, `Std/Allocator/Debug`,
  `Std/Container/{Graph,BitVec,Int,Float}`, `Parsers/{Elf,Dwarf,
  DwarfInfo,DwarfUnwind,Pdb,Http,JSON,KvConfig,Dns}`, `Tests/Std/{*}`.
- `copy.length = data_size` blocks in `MachO.c`, `Pe.c`, `Elf.c`,
  `Pdb.c` go through `BufResize`. `path.length = 0` in
  `SymbolResolver.c` goes through `StrResize`. `Pdb.c::name_pool`
  ownership-steal block is the only remaining bypass and now carries
  an explicit comment naming the missing `StrTakeBuffer` primitive.

Bugs picked up along the way:
- `Std/Io.c::write_char_internal` produced `\x\HH` instead of `\xHH`
  for non-printable bytes; matches the sibling pattern at line 1216
  now.
- `Sys/Dns.c::DnsResolverDeinit` no longer aborts on a zero-init or
  partially-failed-init struct.
- `Sys/Proc.c::sys_proc_read_internal` stages reads in an
  `StrInitStack` + `StrMergeR` pipeline (was `char tmpbuf[1024]` +
  `StrPushBackMany`).
- `Parsers/Dns.c::deinit_record_list` uses `VecBegin(list)` instead
  of `list->data` so the uninit guard goes through the accessor.

Documentation:
- ~500+ doc blocks added / upgraded: TAGS lines for accessor
  surfaces, full `SUCCESS:` / `FAILURE:` blocks for Math.h overflow
  helpers, Buf.h binary read / write family, Map / List foreach
  variants, ArgParse registration macros, Iter init variants,
  StrIter constructors, Container `Math.h` / `Compare.h` /
  `Convert.h` / `Memory.h` surfaces.
- `CODING-CONVENTIONS.md` grows: dedicated "Stack-init APIs"
  section; `_Generic` `char *` synonym arm rule; clarified
  syscall-prefix carve-out for `_Syscall.h` and `Beam.c`;
  carve-out for libc usage in `Fuzz/` and `Benchmark/`.
- Alias macros (`StrForeach*`, `StrPopBack`, `StrRemove*`,
  `VecInsert`, `VecPushBack`, `VecPushFront`, `ListInsert`,
  `ListPushBack`, `MapInsert`, `MapSet`, `GraphAddNode`, `StrIter*`)
  reframed in the namespace's vocabulary plus a "See `<UnderlyingL>`
  for the full contract" pointer, instead of "alias for VecX".
- Stale legacy headers / proprietary-license blocks in
  `Std/Utility.h` and `Std/Utility/Pair.h` replaced with the
  canonical public-domain three-line header.

Tests:
- `Tests/Std/{Vec.Type,Vec.Insert,Vec.Complex,List.Access,List.Foreach,
  List.Init,List.Insert,List.Ops,List.Remove,List.Type,Graph.Init,
  Graph.Type,Int.{Type,Convert},Float.{Type,Convert},BitVec.{Memory,
  Convert,Type,Init,Foreach},Allocator.{Heap,Arena,Page,Slab,Budget},
  AllocDebug,Str.Access,Str.Convert,Str.Init,Io.Read}.c` updated to
  use public accessors instead of direct field reads.
- `Vec.Init` test grows an `AlignedItem { i32 a; f64 b; }` check
  that asserts the `_Alignas(T)` backing-buffer alignment plus a
  `break`-exit verification.
- `size_t` -> `size` swept across Str.Convert, Str.Init, Io.Read,
  BitVec.Convert test bodies.

Locked design questions (documented bypasses or carve-outs --
deferred to future commits when the underlying primitive is added):
`Tests/Util/TestRunner` snake_case public API rename;
`Map.allocator` mutator in `Allocator/Debug.c`; `StrTakeBuffer`
ownership-extract for `Pdb.c::name_pool`; libc-verb naming in
`Sys/Dir.c::DirCreate*`/`DirRemoveAll`; `ARG_TARGET` / `IOFMT`
`default:` runtime sentinels; `STDIN_FILENO FILENO(stdin)` polyfill;
`Sys/Socket.c` and `Sys/Backtrace.c` `char *` C-string output
parameters; `EnvGet(Zstr)` Str overload.

Verified clean by an independent whole-codebase reviewer across
every CODING-CONVENTIONS.md section.

169 files changed, +4649 / -1758.

Author: brightprogrammer

Benchmark/Source/Allocator.h

@@ -19,12 +19,14 @@
 #include <stddef.h>
 #include <stdint.h>
 
+#include <Misra/Std/Zstr.h>
+
 #ifdef __cplusplus
 extern "C" {
 #endif
 
 // Backend name used in benchmark output (e.g. "glibc", "jemalloc", "misra").
-const char *bench_backend_name(void);
+Zstr bench_backend_name(void);
 
 // One-time init / teardown. For libc-shape backends these are no-ops; for
 // MisraStdC they construct/destruct the HeapAllocator.

Benchmark/Source/Allocator_libc.c

@@ -20,7 +20,7 @@
 #  include <gperftools/malloc_extension_c.h>
 #endif
 
-const char *bench_backend_name(void) {
+Zstr bench_backend_name(void) {
     return BENCH_BACKEND_NAME;
 }
 

Benchmark/Source/Allocator_misra.c

@@ -33,7 +33,7 @@ static Allocator    *g_alloc = NULL;
 // build) it's just an unused alias.
 static HeapAllocator *g_heap_typed = NULL;
 
-const char *bench_backend_name(void) {
+Zstr bench_backend_name(void) {
     // Variant name is supplied at compile time by meson so the JSON
     // output identifies which libmisra_std was linked (fast vs full
     // heap_validate_self). Defaults to plain "misra" if undefined,

Benchmark/Source/Allocator_misra_arena.c

@@ -21,7 +21,7 @@
 static ArenaAllocator g_arena;
 static bool           g_arena_live = false;
 
-const char *bench_backend_name(void) {
+Zstr bench_backend_name(void) {
 #ifdef BENCH_MISRA_VARIANT_NAME
     return BENCH_MISRA_VARIANT_NAME;
 #else

Benchmark/Source/Allocator_misra_correct.c

@@ -42,7 +42,7 @@ static HeapAllocator g_heap;
 static SlabAllocator g_slab;
 static bench_mode     g_mode = MODE_NONE;
 
-const char *bench_backend_name(void) {
+Zstr bench_backend_name(void) {
 #ifdef BENCH_MISRA_VARIANT_NAME
     return BENCH_MISRA_VARIANT_NAME;
 #else

Benchmark/Source/Allocator_misra_page.c

@@ -17,7 +17,7 @@
 static PageAllocator g_page;
 static bool          g_page_live = false;
 
-const char *bench_backend_name(void) {
+Zstr bench_backend_name(void) {
 #ifdef BENCH_MISRA_VARIANT_NAME
     return BENCH_MISRA_VARIANT_NAME;
 #else

Bin/Beam.c

@@ -51,14 +51,14 @@
 //       own trampoline. Struct: handler / sa_tramp / mask / flags.
 #    include "../Source/Misra/_Syscall.h"
 
-#    define MISRA_SIGINT          2
-#    define MISRA_SIGPIPE         13
-#    define MISRA_SIGTERM         15
-#    define MISRA_SIG_IGN_HANDLER ((void (*)(int))1) // SIG_IGN
+#    define BEAM_SIGINT          2
+#    define BEAM_SIGPIPE         13
+#    define BEAM_SIGTERM         15
+#    define BEAM_SIG_IGN_HANDLER ((void (*)(int))1) // SIG_IGN
 
 #    if PLATFORM_LINUX
 
-#        define MISRA_SA_RESTORER 0x04000000UL
+#        define BEAM_SA_RESTORER 0x04000000UL
 
 struct misra_kernel_sigaction {
     void (*sa_handler)(int);
@@ -86,7 +86,7 @@ static void install_signal(int signum, void (*handler)(int)) {
     struct misra_kernel_sigaction sa = {0};
     sa.sa_handler                    = handler;
 #        if ARCHITECTURE_X86_64
-    sa.sa_flags    = MISRA_SA_RESTORER;
+    sa.sa_flags    = BEAM_SA_RESTORER;
     sa.sa_restorer = misra_sigreturn_restorer;
 #        endif
     // 4th arg = sigsetsize in bytes (Linux ABI requires 8 for the
@@ -227,11 +227,11 @@ static void install_signal_handlers(void) {
 #if PLATFORM_WINDOWS
     SetConsoleCtrlHandler(on_console_ctrl, TRUE);
 #elif (PLATFORM_LINUX || PLATFORM_DARWIN) && (ARCHITECTURE_X86_64 || ARCHITECTURE_AARCH64)
-    install_signal(MISRA_SIGINT, on_signal);
-    install_signal(MISRA_SIGTERM, on_signal);
+    install_signal(BEAM_SIGINT, on_signal);
+    install_signal(BEAM_SIGTERM, on_signal);
     // SIGPIPE on a hung-up peer would terminate us; mask it and rely
     // on send() returning EPIPE instead.
-    install_signal(MISRA_SIGPIPE, MISRA_SIG_IGN_HANDLER);
+    install_signal(BEAM_SIGPIPE, BEAM_SIG_IGN_HANDLER);
 #else
     // Other POSIX (BSD on non-x86_64/aarch64 hardware, etc.): fall
     // back to libc sigaction.

CODING-CONVENTIONS.md

@@ -16,9 +16,12 @@ of the codebase to see them in action.
 - **No project prefix on identifiers.** The include path
   (`<Misra/Std/Container/Buf.h>`) already names the namespace; adding
   `Misra` / `MISRA_` / `misra_` to every symbol is noise. The `MISRA_`
-  prefix is reserved for three things only: include guards, `FEATURE_*`
-  build-config flags surfaced by `meson.build`, and `_MAGIC` struct
-  sentinels (e.g. `HEAP_ALLOCATOR_MAGIC`, `VEC_MAGIC`).
+  prefix is reserved for four things only: include guards, `FEATURE_*`
+  build-config flags surfaced by `meson.build`, `_MAGIC` struct
+  sentinels (e.g. `HEAP_ALLOCATOR_MAGIC`, `VEC_MAGIC`), and
+  direct-syscall wrappers and constants in `Source/Misra/_Syscall.h` /
+  `Bin/Beam.c` (collision-avoidance with libc's `SYS_*` / `sys_*`
+  syscall vocabulary).
 - **Short names where the include path already disambiguates.** `Buf`,
   `Str`, `Vec`, `Elf` — not `MisraBuf`, not `ElfFile`.
 - **Tool binaries** ship with a single short word as their name
@@ -278,6 +281,12 @@ of the codebase to see them in action.
   the Zstr-everywhere rule doesn't override `int main(int argc, char
   **argv)`. The boundary is the carve-out; everything that wraps it
   is fair game for Misra-native types.
+- **Fuzz harnesses and Benchmark drivers are out of scope.** Code under
+  `Fuzz/` and `Benchmark/` (in particular `Bench.cpp` and
+  `Allocator_libc.c`) is allowed to include libc / C++ standard headers —
+  these are harness boundaries that intentionally compare the in-tree
+  implementation against external baselines. `check_no_libc.py` covers
+  the library proper (`Source/`, `Include/`, `Tests/`).
 
 ## `_Generic` dispatch
 

Include/Misra/Parsers/Dwarf.h

@@ -118,6 +118,8 @@ const DwarfLineEntry *DwarfLinesResolve(const DwarfLines *self, u64 vaddr);
 /// SUCCESS : Returns to the caller. `*self` is zeroed.
 /// FAILURE : Function cannot fail. NULL `self` is a no-op.
 ///
+/// TAGS: Parser, DWARF, Lines, Deinit, Lifecycle
+///
 void DwarfLinesDeinit(DwarfLines *self);
 
 // ===========================================================================
@@ -225,6 +227,8 @@ const DwarfCie *DwarfCfiFindCie(const DwarfCfi *self, u64 cie_offset);
 /// SUCCESS : Returns to the caller. `*self` is zeroed.
 /// FAILURE : Function cannot fail. NULL `self` is a no-op.
 ///
+/// TAGS: Parser, DWARF, CFI, Deinit, Lifecycle
+///
 void DwarfCfiDeinit(DwarfCfi *self);
 
 // ---------------------------------------------------------------------------

Include/Misra/Parsers/Elf.h

@@ -287,6 +287,8 @@ bool elf_open_from_memory_copy(Elf *out, const u8 *data, size data_size, Allocat
 /// SUCCESS : Returns to the caller. `*self` is zeroed.
 /// FAILURE : Function cannot fail. NULL `self` is a no-op.
 ///
+/// TAGS: Parser, ELF, Deinit, Lifecycle
+///
 void ElfDeinit(Elf *self);
 
 ///