nomen-lang 0.7.1 → 0.9.0

package/core/System/Set.nm

@@ -6,26 +6,46 @@
  * The capacity is always a power of two (initial 8, doubling on rehash), so
  * slot indexing is a mask (`hash & (cap - 1)`) — correct for negative hashes
  * too (two's-complement `&` already lands in `[0, cap)`).
+ *
+ * Each slot carries its value's hash (truncated to 32 bits) in a parallel
+ * `hashes` buffer. Probes compare the stored hash before the value itself
+ * (the Swiss-table short-circuit — the `==` only runs on a hash match, and a
+ * false match still falls through to `==`, so truncation costs nothing);
+ * rehash re-inserts hash-free, reading the stored word instead of calling
+ * `value.hash()` again.
  **/
 pub mv struct Set<T: Hashable + Equatable> {
 	var length = 0
 	var slots = Buffer<T>()
 	var used = Buffer<int>()
+	var hashes = Buffer<int>()
 
 	pub func add = (ref self, mv T value) {
 		var int cap = self.slots.cap
 		if cap == 0 {
 			cap = self.slots.alloc(8)
 			self.used.alloc_u32(8)
+			self.hashes.alloc_u32(8)
 		}
 		if self.length * 4 >= cap * 3 {
 			self.rehash(cap * 2)
 			cap = self.slots.cap
 		}
-		var int idx = self.find_slot(value, cap)
+		var uint32 h = value.hash() as uint32
+		var int idx = self.find_slot(value, h, cap)
 		if self.used.load_u32(idx) == 0 {
 			self.used.store_u32(idx, 1)
-			self.slots.store(idx, value)
+			// The value arrives owned (`mv T value`): a value-struct element
+			// moves into the fresh slot (store_take — the caller's storage is
+			// zeroed, no deep copy); a string's by-value pair keeps the
+			// deep-copying store (the caller still owns its buffer), and a
+			// class/trait handle is a pointer store either way.
+			if T_IS_VALUE_STRUCT {
+				self.slots.store_take(idx, value)
+			} else {
+				self.slots.store(idx, value)
+			}
+			self.hashes.store_u32(idx, h)
 			self.length += 1
 		}
 	}
@@ -35,7 +55,7 @@ pub mv struct Set<T: Hashable + Equatable> {
 		if cap == 0 {
 			return false
 		}
-		var int idx = self.find_slot(value, cap)
+		var int idx = self.find_slot(value, value.hash() as uint32, cap)
 		return self.used.load_u32(idx) != 0
 	}
 
@@ -44,7 +64,7 @@ pub mv struct Set<T: Hashable + Equatable> {
 		if cap == 0 {
 			return 0
 		}
-		var int idx = self.find_slot(key, cap)
+		var int idx = self.find_slot(key, key.hash() as uint32, cap)
 		if self.used.load_u32(idx) == 0 {
 			return 0
 		}
@@ -58,7 +78,7 @@ pub mv struct Set<T: Hashable + Equatable> {
 		if cap == 0 {
 			return fallback
 		}
-		var int idx = self.find_slot(key, cap)
+		var int idx = self.find_slot(key, key.hash() as uint32, cap)
 		if self.used.load_u32(idx) == 0 {
 			return fallback
 		}
@@ -71,7 +91,7 @@ pub mv struct Set<T: Hashable + Equatable> {
 		if cap == 0 {
 			panic("value not found in set")
 		}
-		var int idx = self.find_slot(key, cap)
+		var int idx = self.find_slot(key, key.hash() as uint32, cap)
 		if self.used.load_u32(idx) == 0 {
 			panic("value not found in set")
 		}
@@ -83,7 +103,7 @@ pub mv struct Set<T: Hashable + Equatable> {
 		if cap == 0 {
 			return
 		}
-		var int idx = self.find_slot(value, cap)
+		var int idx = self.find_slot(value, value.hash() as uint32, cap)
 		if self.used.load_u32(idx) == 0 {
 			return
 		}
@@ -96,7 +116,9 @@ pub mv struct Set<T: Hashable + Equatable> {
 		// so entries past a non-moveable one are not stranded behind an empty
 		// slot (which would make find_slot miss them). No tombstones, so
 		// find_slot/get/has/add are unchanged, and the cost is the local cluster
-		// length — not a full O(cap) rehash on every delete.
+		// length — not a full O(cap) rehash on every delete. `home` reads the
+		// stored hash word (no re-hash per shifted entry), and the word moves
+		// with the entry — find_slot's hash short-circuit trusts it.
 		var int gap = idx
 		var int k = idx
 		while true {
@@ -107,7 +129,7 @@ pub mv struct Set<T: Hashable + Equatable> {
 			if self.used.load_u32(k) == 0 {
 				break
 			}
-			var int home = (self.slots.load(k).hash() as int) & (cap - 1)
+			var int home = (self.hashes.load_u32(k) as int) & (cap - 1)
 			var int dgap = gap - home
 			if dgap < 0 {
 				dgap = dgap + cap
@@ -123,20 +145,68 @@ pub mv struct Set<T: Hashable + Equatable> {
 				// pointer at the vacated slot (leaked once used.store marks it
 				// empty; the buffer destroy skips unused slots).
 				self.slots.shift(gap, k)
+				self.hashes.store_u32(gap, self.hashes.load_u32(k))
 				self.used.store_u32(gap, 1)
 				gap = k
 			}
 		}
+		if T_NEEDS_STRDUP {
+			if gap == idx {
+				// No entry shifted: the removed entry still owns its strdup'd
+				// bytes in its slot (a shift's first move would have
+				// reclaimed them — see shift_T above). destroy_at frees the
+				// buffer and zeroes the slot: a later add() that lands in
+				// this hole stores over the bytes assuming a fresh slot, and
+				// a stranded-then-overwritten entry leaks.
+				self.slots.destroy_at(idx)
+			}
+		}
+		if T_IS_VALUE_STRUCT {
+			if gap == idx {
+				// Same hole for a value-struct element: reclaim the slot's
+				// owned fields (destroy_at frees and zeroes; scalars-only
+				// structs reclaim nothing and the call is a no-op).
+				self.slots.destroy_at(idx)
+			}
+		}
 		self.used.store_u32(gap, 0)
 		self.length = self.length - 1
 	}
 
-	func find_slot = (self, T value, int cap, out int: out >= 0 && out < cap) {
+	// An independent copy: a fresh Set whose member slabs are fresh (`slots`
+	// deep-copied per element, `used`/`hashes` copied word by word), with the
+	// same length and entries. The u32-word buffers are copied through their
+	// own primitives — `Buffer.copy` is T_SIZE-aware (8-byte loads for
+	// `int`), which would read past a 4-byte-per-slot `alloc_u32` slab. Not
+	// available for class/trait elements (the member routes to ClassBuffer,
+	// which has no copy — the checker rejects the call; the shape is also
+	// unreachable today since `T: Hashable + Equatable` cannot be a trait
+	// without trait-conformance syntax).
+	pub func copy = (self, out Set<T>) {
+		var dst = Set<T>()
+		dst.slots = self.slots.copy()
+		dst.used.alloc_u32(self.slots.cap)
+		dst.hashes.alloc_u32(self.slots.cap)
+		var i = 0
+		while i < self.slots.cap; i += 1 {
+			dst.used.store_u32(i, self.used.load_u32(i))
+			dst.hashes.store_u32(i, self.hashes.load_u32(i))
+		}
+		dst.length = self.length
+		return dst
+	}
+
+	func find_slot = (self, T value, uint32 h, int cap, out int: out >= 0 && out < cap) {
 		// cap is a power of two: `hash mod cap` via a mask, non-negative
 		// for any hash — no adjustment needed.
-		var int idx = (value.hash() as int) & (cap - 1)
+		var int idx = (h as int) & (cap - 1)
 		while self.used.load_u32(idx) != 0 {
-			if self.slots.load(idx) == value {
+			// The stored-hash word short-circuits the value compare: a probed
+			// slot whose hash differs (every step of a collision walk past
+			// the home slot) skips the value load and `==`. A hash match
+			// still falls through to `==`, so the 32-bit truncation costs
+			// nothing.
+			if self.hashes.load_u32(idx) == h && self.slots.load(idx) == value {
 				return idx
 			}
 			idx += 1
@@ -147,13 +217,20 @@ pub mv struct Set<T: Hashable + Equatable> {
 		return idx
 	}
 
+	// Rehash hash-free: the stored per-slot hash words move with the entries,
+	// so no `value.hash()` runs here and the insertion probe needs no value
+	// compares (values arrive unique — they came from a valid set). The old
+	// form re-inserted via `self.add(mv v)`, re-hashing every value and
+	// re-comparing values on every probed slot.
 	func rehash = (ref self, int new_cap) {
 		var Buffer<T> old_slots = mv self.slots swap Buffer<T>()
 		var Buffer<int> old_used = mv self.used swap Buffer<int>()
+		var Buffer<int> old_hashes = mv self.hashes swap Buffer<int>()
 		var int old_cap = old_slots.cap
 
 		self.slots.alloc(new_cap)
 		self.used.alloc_u32(new_cap)
+		self.hashes.alloc_u32(new_cap)
 		self.length = 0
 
 		var i = 0
@@ -168,7 +245,18 @@ pub mv struct Set<T: Hashable + Equatable> {
 				// once the new buffer has made its own copy — passing it inline
 				// would orphan the move_T result.
 				var T v = old_slots.move(i)
-				self.add(mv v)
+				var uint32 h = old_hashes.load_u32(i)
+				var int idx = (h as int) & (new_cap - 1)
+				while self.used.load_u32(idx) != 0 {
+					idx += 1
+					if idx >= new_cap {
+						idx = 0
+					}
+				}
+				self.used.store_u32(idx, 1)
+				self.slots.store(idx, v)
+				self.hashes.store_u32(idx, h)
+				self.length += 1
 			}
 		}
 	}

package/core/System/StableList.nm

@@ -0,0 +1,371 @@
+/**
+ * A grow-only, ordered list whose element borrows survive `push` — including
+ * interior slot ADDRESSES (stable grow-only arrays; v2).
+ *
+ * Storage is CHUNKED so that no slot address ever moves: chunk 0 is the
+ * `items` Buffer, allocated once at exactly 256 slots and never resized;
+ * chunks 1.. live in the `chunks` directory as raw slab pointers (each
+ * `calloc`'d once at 256 slots). The directory itself may realloc — it holds
+ * slab ADDRESSES, which survive the move. That is what lets `slot_ptr`
+ * exist: `ref T x = sl.at(i)` binds the slot itself, the checker's `push`
+ * exemption keeps the alias alive across pushes, and writes through it land
+ * in the list. The list is still append-only — no `pop`/`set`/`remove_at` —
+ * because displacing an element would invalidate its borrows.
+ *
+ * The tail pieces (store/load/destroy for directory chunks) delegate to
+ * Buffer's mono'd methods through a stack `Buffer_T` view — `load_from` is a
+ * bitwise slot load (the borrow form; never the strdup-copy the
+ * owning-specialized `load` would materialize), the tail store is the typed
+ * `store` against a `Buffer.init_view` view (deep-copy semantics into the
+ * chunk slot, no staging relay), and `#destroy` destroys each directory chunk
+ * through a view whose `cap` is the chunk's FILL count, so no uninitialized
+ * slot is ever walked. Chunk 0 (`items`) and the directory's own slab are
+ * reclaimed by the ordinary field destroy: the specialized per-element
+ * destroy guards zeroed slots and frees its slab.
+ **/
+pub mv struct StableList<T> {
+	var length = 0
+	// Chunk 0: an exact-cap 256-slot slab, allocated on first push, never
+	// grown — a realloc would move its slots and invalidate `slot_ptr` aliases.
+	var items = Buffer<T>()
+	// Directory of chunk-1.. slab addresses (uint64 words, `calloc`'d slabs of
+	// 256 T_SIZE bytes). The directory's slot array may realloc; the slabs it
+	// points at never move.
+	var chunks = Buffer<uint64>()
+	// A transient VIEW carrier for tail pushes: `push` points it at the
+	// target chunk slab, stores the value through it (deep-copy semantics via
+	// Buffer's specialized `store` — no staging relay, no byte copy), then
+	// clears it. A field (not a local) because an owning Buffer local is
+	// auto-destroyed at scope exit and would free the borrowed slab. Its own
+	// slab is always null, so its field destroy reclaims nothing.
+	var stage = Buffer<T>()
+
+	pub func push = (ref self, mv T value) {
+		if self.items.cap == 0 {
+			self.items.alloc(256)
+		}
+		if self.length < self.items.cap {
+			self.items.store(self.length, value)
+		} else {
+			var int dir_index = self.length / 256 - 1
+			if dir_index >= self.chunks.cap {
+				self.chunks.grow(dir_index + 1)
+			}
+			self.ensure_chunk(dir_index)
+			// The typed store lands the value straight into the chunk slot
+			// through the view — deep-copy semantics via Buffer's specialized
+			// `store`, no staging slot, no byte relay. Every T-value crossing
+			// stays inside Nomen's typed machinery.
+			self.stage.store_in_slab(
+				self.chunks.load(dir_index),
+				256,
+				self.length % 256,
+				value
+			)
+		}
+		self.length += 1
+	}
+
+	// Capacity for `extra` more appends: allocates chunk 0, grows the
+	// directory, and pre-callocs the target slab (the raw `ensure_chunk`'s
+	// zero-check keeps push's own calloc idempotent). Splitting it
+	// out of `push` is what makes the compiler's in-place push lowering
+	// possible: the destination slot for a `push(parse(x))` argument must
+	// exist before the argument call runs, so the backend reserves first
+	// and constructs the callee's result directly into the append slot
+	// (the in-place push contract). Byte-identical policy for extra=1: the same
+	// alloc/dir-grow/first-touch sequence push's inline branches performed.
+	internal func reserve = (ref self, int extra: extra >= 0, out int) {
+		if self.items.cap == 0 {
+			self.items.alloc(256)
+		}
+		if self.length + extra > self.items.cap {
+			var int last = self.length + extra - 1
+			var int dir_index = last / 256 - 1
+			if dir_index >= self.chunks.cap {
+				self.chunks.grow(dir_index + 1)
+			}
+			self.ensure_chunk(dir_index)
+		}
+		return self.items.cap
+	}
+
+	// Calloc the directory chunk's slab on first touch (zero words mark
+	// empty chunks) — push's tail store and the in-place append both rely on
+	// the slab existing before a slot address is taken from it.
+	internal func ensure_chunk = (ref self, int dir_index) {
+		```
+		#arch: c
+		if (((unsigned long long*)self->chunks.data)[dir_index] == 0) {
+			((unsigned long long*)self->chunks.data)[dir_index] =
+				(unsigned long long)calloc(256, T_SIZE);
+		}
+		```
+		```
+		#arch: aarch64
+		// x0 = self, x1 = dir_index. Stack-less raw functions get no
+		// `mov x19, x0` prologue, so load self explicitly and keep it in
+		// x19 (the prologue saved the caller's) with dir_index in x20
+		// (saved here — x20 is not covered by the prologue) across the
+		// calloc call.
+		stp x19, x20, [sp, #-16]!
+		mov x19, x0
+		mov x20, x1
+		ldr x9, [x19, #48]
+		ldr x10, [x9, x20, lsl #3]
+		cmp x10, #0
+		b.ne .Lsl_ec_have
+		mov x0, #256
+		mov x1, #T_SIZE
+		bl _calloc
+		ldr x9, [x19, #48]
+		str x0, [x9, x20, lsl #3]
+		.Lsl_ec_have:
+		ldp x19, x20, [sp], #16
+		```
+	}
+
+	// Address of the APPEND slot (element `length`) — reserve must have run,
+	// so the slot exists. The in-place push lowering constructs the argument
+	// call's result straight through this address (sole ownership transfers
+	// into the slot — the chunk slab is calloc'd on first touch by
+	// `reserve`'s `ensure_chunk` before the slot address is taken).
+	internal func append_slot_ptr = (ref self, out ptr T) {
+		```
+		#arch: c
+		unsigned long long idx = (unsigned long long)self->length;
+		if (idx < 256) {
+			return (T*)(unsigned long long)self->items.data + idx;
+		}
+		unsigned long long chunk = ((unsigned long long*)self->chunks.data)[idx / 256 - 1];
+		return (T*)chunk + (idx % 256);
+		```
+		```
+		#arch: aarch64
+		// x0 = self (stack-less raw: x19 is NOT loaded — read the fields
+		// from x0 and return the slot address in x0; the body calls
+		// nothing, so x9-x13 scratch is safe). Field offsets mirror
+		// push's: length @8, items.data @24, chunks.data @48 (the
+		// Buffer mono is {_vt, data, cap} = 24 bytes).
+		ldr x9, [x0, #8]
+		ldr x10, [x0, #24]
+		cmp x9, #256
+		b.lt .Lsl_as_c0
+		and x11, x9, #255
+		lsr x12, x9, #8
+		sub x12, x12, #1
+		ldr x13, [x0, #48]
+		ldr x10, [x13, x12, lsl #3]
+		b .Lsl_as_have
+		.Lsl_as_c0:
+		mov x11, x9
+		.Lsl_as_have:
+		mov x12, #T_SIZE
+		madd x0, x11, x12, x10
+		```
+	}
+
+	pub inline func at = (self, int i: i >= 0 && i < self.length, out T) {
+		if i < self.items.cap {
+			return self.items.load(i)
+		}
+		return self.load_tail(i)
+	}
+
+	// The directory-chunk half of `at`: a slot borrow exactly like `load`,
+	// routed through the chunk directory, delegating to the mono'd
+	// `load_from` through a stack view over the foreign slab. Named in the
+	// borrow-accessor family (string_return_analysis.ts) so a two-branch
+	// `at` classifies as a borrow on both branches.
+	internal func load_tail = (self, int i, out T) {
+		```
+		#arch: c
+		long dir_index = i / 256L - 1L;
+		long slot = i % 256L;
+		T_buffer _tmp;
+		_tmp._vt = 0;
+		_tmp.data = ((unsigned long long*)self->chunks.data)[dir_index];
+		_tmp.cap = 256;
+		return T_load_from(&_tmp, slot);
+		```
+		```
+		#arch: aarch64
+		// x19 = self, x1 = i. The result forwards: x0 for T_SIZE <= 16, or
+		// the x8 sret slot — which is this function's OWN sret slot, passed
+		// through untouched, so the callee writes the caller's destination
+		// directly.
+		sub sp, sp, #32
+		mov x9, #256
+		sdiv x10, x1, x9
+		msub x1, x10, x9, x1
+		sub x10, x10, #1
+		ldr x11, [x19, #48]
+		ldr x12, [x11, x10, lsl #3]
+		str xzr, [sp]
+		str x12, [sp, #8]
+		mov x13, #256
+		str x13, [sp, #16]
+		mov x0, sp
+		bl T_load_from
+		add sp, sp, #32
+		```
+	}
+
+	pub func at_or = (self, int i, T fallback, out T) {
+		if i >= 0 && i < self.length {
+			return self.at(i)
+		}
+		return fallback
+	}
+
+	// Bounds-checked access that traps when i is outside [0, self.length) —
+	// for indices that can't be proven at compile time and out-of-range is a
+	// bug, not a case.
+	pub func at_or_panic = (self, int i, out T) {
+		if i >= 0 && i < self.length {
+			return self.at(i)
+		}
+		panic("index out of range")
+	}
+
+	// Address of element `i` (INTERNAL — the ELEMENT BORROW primitive):
+	// `ref T x = sl.at(i)` lowers to this, binding the alias to the slot
+	// itself. The
+	// address is stable across any number of pushes (slabs are allocated
+	// once and never relocate), and the checker exempts `push` from borrow
+	// invalidation for this type, so the alias stays live and writes through
+	// it land in the list. The length constraint is the caller's proof
+	// obligation, exactly like `.at`.
+	internal func slot_ptr = (ref self, int i: i >= 0 && i < self.length, out ptr T) {
+		if i < self.items.cap {
+			return self.items.slot_ptr(i)
+		}
+		return self.slot_ptr_tail(i)
+	}
+
+	// The slot address in a directory chunk (pure address arithmetic — the
+	// slab never moves, so the pointer stays valid for the list's lifetime).
+	internal func slot_ptr_tail = (self, int i, out ptr T) {
+		```
+		#arch: c
+		long dir_index = i / 256L - 1L;
+		long slot = i % 256L;
+		return (T*)(unsigned long long)((unsigned long long*)self->chunks.data)[dir_index] + slot;
+		```
+		```
+		#arch: aarch64
+		// x19 = self, x1 = i — the slot address, returned in x0.
+		mov x9, #256
+		sdiv x10, x1, x9
+		msub x1, x10, x9, x1
+		sub x10, x10, #1
+		ldr x11, [x19, #48]
+		ldr x12, [x11, x10, lsl #3]
+		mov x13, #T_SIZE
+		madd x0, x1, x13, x12
+		```
+	}
+
+	// A deep copy: a fresh StableList<T> with an independent copy of every
+	// element. For mv element types (strings, mv value structs) each slot in
+	// the copy owns its own heap data (Buffer deep-copies on store), so the
+	// source and the copy share nothing. Not available for class/trait
+	// element types (the copy would share the stored instances — the checker
+	// rejects it). The element is bound to a local before push — the
+	// monomorphized body is never re-checked, so it can't rely on check-time
+	// call-arg hoisting for struct element types.
+	pub func copy = (self, out StableList<T>) {
+		var dst = StableList<T>()
+		var i = 0
+		while i < self.length {
+			var T v = self.at(i)
+			dst.push(v)
+			i += 1
+		}
+		return dst
+	}
+
+	// Chunk 0 first: `move` hands each element out (the binding's scope exit
+	// destroys it — exactly once), then `alloc(0)` retires the empty slab so
+	// the field destroy walks zero slots. Directory chunks: raw loop, each
+	// destroyed through a view whose cap is the chunk's FILL count (never
+	// its 256 capacity — uninitialized slots hold zeroes, and a user
+	// `#destroy` over zeroed elements is garbage). The directory's own slot
+	// array is reclaimed by the ordinary field destroy (plain free — pointer
+	// words own nothing).
+	// Only the directory slabs (chunks 1..) need explicit teardown — they are
+	// raw pointer words the field destroy cannot see — so each is destroyed
+	// through a cap=filled view (per-element destroy + slab free). Chunk 0
+	// (`items`) is reclaimed by the ordinary field destroy: the
+	// specialized per-element destroy guards zeroed slots (a calloc'd slot
+	// skips the element destroy instead of firing the user `#destroy` on
+	// unconstructed storage) and frees its own slab; pointer words own
+	// nothing.
+	// (The old `stage` relay field is gone — push's tail path stores into
+	// the chunk through a `Buffer.init_view` view.)
+	func #destroy = (ref self) {
+		self.destroy_tails()
+	}
+
+	// Raw: destroy directory chunks 1.. — per chunk, `filled` slots + the
+	// slab, via `T_buffer_destroy` on a cap=filled view.
+	internal func destroy_tails = (ref self) {
+		```
+		#arch: c
+		long n_dir = (self->length - 1L) / 256L;
+		for (long c = 0; c < n_dir; c++) {
+			unsigned long long slab = ((unsigned long long*)self->chunks.data)[c];
+			if (slab == 0) {
+				continue;
+			}
+			long filled = (c == n_dir - 1L) ? (self->length - n_dir * 256L) : 256L;
+			T_buffer _tmp;
+			_tmp._vt = 0;
+			_tmp.data = slab;
+			_tmp.cap = filled;
+			T_buffer_destroy(&_tmp);
+		}
+		```
+		```
+		#arch: aarch64
+		// x19 = self. n_dir = (length - 1) / 256; per chunk, a cap=filled
+		// view on the stack and `bl T_buffer_destroy`.
+		sub sp, sp, #48
+		ldr x20, [x19, #8]
+		sub x20, x20, #1
+		mov x9, #256
+		sdiv x20, x20, x9
+		str xzr, [sp, #24]
+		.Lsl_dt_loop:
+		ldr x21, [sp, #24]
+		cmp x21, x20
+		b.ge .Lsl_dt_end
+		lsl x22, x21, #3
+		ldr x9, [x19, #48]
+		ldr x10, [x9, x22]
+		cmp x10, #0
+		b.eq .Lsl_dt_next
+		mov x11, #256
+		cmp x21, x20
+		b.ne .Lsl_dt_full
+		ldr x11, [x19, #8]
+		msub x11, x20, x9, x11
+		b .Lsl_dt_have
+		.Lsl_dt_full:
+		mov x11, #256
+		.Lsl_dt_have:
+		str xzr, [sp]
+		str x10, [sp, #8]
+		str x11, [sp, #16]
+		mov x0, sp
+		bl T_buffer_destroy
+		.Lsl_dt_next:
+		ldr x21, [sp, #24]
+		add x21, x21, #1
+		str x21, [sp, #24]
+		b .Lsl_dt_loop
+		.Lsl_dt_end:
+		add sp, sp, #48
+		```
+	}
+}

package/core/System/Stream/Directory.nm

@@ -29,8 +29,8 @@ pub struct Directory {
 				return DirectoryError.not_empty
 			}
 		} else {
-				return DirectoryError.other
-			}
+			return DirectoryError.other
+		}
 	}
 
 	// (static) Create a directory at `path`; returns errno (0 on success).

package/core/System/Stream/File.nm

@@ -57,8 +57,8 @@ pub struct File {
 				return FileError.already_exists
 			}
 		} else {
-				return FileError.other
-			}
+			return FileError.other
+		}
 	}
 
 	// Open the file at `path` with a C mode string ("r", "w", "a", …).

package/core/System/Stream/Http.nm

@@ -49,8 +49,8 @@ pub struct Http {
 				return HttpError.connect
 			}
 		} else {
-				return HttpError.other
-			}
+			return HttpError.other
+		}
 	}
 
 	// Shared socket round-trip used by get/post. `method` is the request

package/core/System/String.nm

@@ -276,21 +276,26 @@ pub mv struct string: Stringable, Hashable, Equatable {
 	}
 
 	// Replace all non-overlapping occurrences of needle with replacement,
-	// left to right. Same edge behavior as replace_first.
+	// left to right. Same edge behavior as replace_first. Literal bytes
+	// between matches are copied in bulk runs (one `append_string_view` per
+	// run) — the old loop appended per byte.
 	pub func replace_all = (self, view string needle, view string replacement, out string) {
 		var sb = StringBuilder()
 		var i = 0
 		var int n = self.length
 		var int nlen = needle.length
-		while i < n {
-			if nlen > 0 && i + nlen <= n && match_at(self, needle, i) {
+		var run_start = 0
+		while nlen > 0 && i + nlen <= n {
+			if match_at(self, needle, i) {
+				sb.append_string_view(self.slice(run_start, i))
 				sb.append_string_view(replacement)
 				i = i + nlen
+				run_start = i
 			} else {
-				sb.append_char(self.at(i))
-				i = i + 1
+				i += 1
 			}
 		}
+		sb.append_string_view(self.slice(run_start, n))
 		return sb.to_string()
 	}