diffnc 0.0.2__tar.gz → 0.0.4__tar.gz

{diffnc-0.0.2 → diffnc-0.0.4}/.github/workflows/publish.yml

@@ -14,10 +14,10 @@ jobs:
       contents: read
     steps:
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
 
       - name: Install uv
-        uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
+        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
         with:
           python-version: "3.12"
 

{diffnc-0.0.2 → diffnc-0.0.4}/.github/workflows/test.yml

@@ -20,10 +20,10 @@ jobs:
         python-version: ["3.11", "3.12", "3.13", "3.14"]
 
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
 
       - name: Install uv
-        uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
+        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
         with:
           python-version: ${{ matrix.python-version }}
           enable-cache: true

{diffnc-0.0.2 → diffnc-0.0.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: diffnc
-Version: 0.0.2
+Version: 0.0.4
 Summary: Structural diff library for network device configurations
 Author-email: minefuto <46558834+minefuto@users.noreply.github.com>
 License: MIT License
@@ -103,11 +103,11 @@ for line in reconcile(a, b):
     print(line)
 ```
 
-Output is config-mode commands only — no `configure terminal` / `end` / `commit` wrappers, no indentation. Pipe through your own session manager.
+Output is config-mode commands only — no `configure terminal` / `end` / `commit` wrappers. Lines are indented to mirror the section hierarchy (using each vendor's own indent unit), so the result reads like the source config; flat vendors such as Junos set form emit no indentation. Pipe through your own session manager.
 
-* **Cisco-like (NX-OS / IOS / IOS-XE / IOS-XR / EOS):** emits section navigation plus `<line>` for adds and `no <line>` for deletes (with `no no foo` collapsed to `foo`, so `no shutdown` ↔ `shutdown` toggles correctly).
-* **Junos hierarchical:** emits flat `set <path>` and `delete <path>` lines.
-* **Junos set:** emits `<line>` verbatim for adds and `delete <path>` (with the `set ` / `activate ` / `deactivate ` prefix stripped) for deletes.
+* **Cisco-like (NX-OS / IOS / IOS-XE / IOS-XR / EOS):** emits section navigation plus `<line>` for adds and `no <line>` for deletes. `X` / `no X` toggles are tracked as state: a transition (e.g. `no shutdown` → `shutdown`) emits just the new value, while a *removed* toggle resets to default — `default <cmd>` on vendors that support it (IOS / IOS-XE / NX-OS / EOS) and the inverted `no` on IOS-XR.
+* **Junos hierarchical:** emits flat `set <path>` and `delete <path>` lines. A node whose only change is its inactive state (`inactive: <line>`) emits `activate <path>` / `deactivate <path>` instead of a `delete`/`set` pair.
+* **Junos set:** emits `<line>` verbatim for adds and `delete <path>` (with the `set ` prefix stripped) for deletes. `activate` / `deactivate` are tracked as state: a removed toggle inverts to its counterpart (`deactivate X` → `activate X`) rather than deleting the underlying `set`.
 * **Order-sensitive sections** (ACL, `policy-map`, Junos `firewall filter` / `policy-statement` terms): on any change, the entire section is deleted and recreated from *B* — partial in-place edits are not attempted.
 
 Exceptions:
@@ -151,8 +151,7 @@ Or, in reconcile mode (**experimental**):
 ```bash
 $ diffnc before.conf after.conf -r
 interface Ethernet1/1
-no description uplink
-description uplink-to-spine
+  description uplink-to-spine
 feature ospf
 ```
 
@@ -254,6 +253,33 @@ Example: a reorder of one term plus a content change in another term
  }
 ```
 
+## Junos inactive/active toggles
+
+When a Junos hierarchical node only flips its `inactive:` state (the node itself and its subtree are otherwise identical), the diff does not re-emit the whole subtree as a `-`/`+` pair. Instead it pairs the two states as one node and marks the new state with a `!`:
+
+* A deactivated node keeps its literal `inactive:` prefix.
+* A reactivated node has no marker on the B side, so a synthetic `activate:` is shown to make the direction visible.
+
+```diff
+ system {
+!    inactive: host-name foo;
+ }
+```
+
+If the toggled section also has real changes inside it, the section header is marked `!` and expanded so the inner `-`/`+` (or nested `!`) lines still surface:
+
+```diff
+ protocols {
+!    inactive: ospf {
+         area 0.0.0.0 {
+!            activate: interface ge-0/0/0.0;
+         }
+     }
+ }
+```
+
+In `reconcile`, the same toggles emit `activate <path>` / `deactivate <path>` (see the reconcile section above).
+
 ### Customizing the behavior for a new vendor
 
 The `VendorParser` protocol exposes `is_order_sensitive(path: tuple[str, ...]) -> bool`. `path` is the tuple of `line` values from the root down to "the parent node whose children are being compared." Returning `True` makes the children compared positionally via `SequenceMatcher`; returning `False` (the default) falls back to set-style key comparison. If you're subclassing the Cisco family, the shortest path is to pass `order_sensitive_predicate` to `CiscoLikeParser(...)`.
@@ -280,7 +306,9 @@ Create a new module under `src/diffnc/vendors/`, expose an implementation of the
 * `render_close(node, depth) -> str | None`
 * `render_leaf(node, depth) -> str`
 * `is_order_sensitive(path) -> bool` (optional; treated as always `False` if not implemented. See the "How order is handled" section.)
-* `render_reconcile(events) -> Iterator[str]` (optional; required only to support `reconcile`. Receives a sequence of `ReconcileAdd` / `ReconcileDelete` / `ReconcileRecreate` events from `diffnc.reconcile` and yields the corresponding CLI lines.)
+* `render_reconcile(events) -> Iterator[str]` (optional; required only to support `reconcile`. Receives a sequence of `ReconcileAdd` / `ReconcileDelete` / `ReconcileRecreate` / `ReconcileToggle` events from `diffnc.reconcile` and yields the corresponding CLI lines.)
+* `toggle_partners(a, b) -> bool` / `is_toggle_state(line) -> bool` (optional; both default to `False`. Let `reconcile` recognise paired toggle states — e.g. `X` ↔ `no X`, `activate` ↔ `deactivate` — so a transition emits only the new value and a removed toggle is excluded from value-change matching.)
+* `base_identity(line) -> str` / `render_toggle_line(b_line, depth, *, became_active, kind) -> str` (optional; only needed for vendors with an inactive-state prefix such as Junos hierarchical `inactive:`. `base_identity` strips the prefix so a (de)activated node matches its active form as one node in two states; when that match's lines still differ, the diff/reconcile engines treat it as a toggle and call `render_toggle_line` to render the `!`-marked line — `kind` is `"leaf"`, `"section_open"` or `"section_collapsed"` — or emit a `ReconcileToggle`.)
 
 ## License
 

{diffnc-0.0.2 → diffnc-0.0.4}/README.md

@@ -68,11 +68,11 @@ for line in reconcile(a, b):
     print(line)
 ```
 
-Output is config-mode commands only — no `configure terminal` / `end` / `commit` wrappers, no indentation. Pipe through your own session manager.
+Output is config-mode commands only — no `configure terminal` / `end` / `commit` wrappers. Lines are indented to mirror the section hierarchy (using each vendor's own indent unit), so the result reads like the source config; flat vendors such as Junos set form emit no indentation. Pipe through your own session manager.
 
-* **Cisco-like (NX-OS / IOS / IOS-XE / IOS-XR / EOS):** emits section navigation plus `<line>` for adds and `no <line>` for deletes (with `no no foo` collapsed to `foo`, so `no shutdown` ↔ `shutdown` toggles correctly).
-* **Junos hierarchical:** emits flat `set <path>` and `delete <path>` lines.
-* **Junos set:** emits `<line>` verbatim for adds and `delete <path>` (with the `set ` / `activate ` / `deactivate ` prefix stripped) for deletes.
+* **Cisco-like (NX-OS / IOS / IOS-XE / IOS-XR / EOS):** emits section navigation plus `<line>` for adds and `no <line>` for deletes. `X` / `no X` toggles are tracked as state: a transition (e.g. `no shutdown` → `shutdown`) emits just the new value, while a *removed* toggle resets to default — `default <cmd>` on vendors that support it (IOS / IOS-XE / NX-OS / EOS) and the inverted `no` on IOS-XR.
+* **Junos hierarchical:** emits flat `set <path>` and `delete <path>` lines. A node whose only change is its inactive state (`inactive: <line>`) emits `activate <path>` / `deactivate <path>` instead of a `delete`/`set` pair.
+* **Junos set:** emits `<line>` verbatim for adds and `delete <path>` (with the `set ` prefix stripped) for deletes. `activate` / `deactivate` are tracked as state: a removed toggle inverts to its counterpart (`deactivate X` → `activate X`) rather than deleting the underlying `set`.
 * **Order-sensitive sections** (ACL, `policy-map`, Junos `firewall filter` / `policy-statement` terms): on any change, the entire section is deleted and recreated from *B* — partial in-place edits are not attempted.
 
 Exceptions:
@@ -116,8 +116,7 @@ Or, in reconcile mode (**experimental**):
 ```bash
 $ diffnc before.conf after.conf -r
 interface Ethernet1/1
-no description uplink
-description uplink-to-spine
+  description uplink-to-spine
 feature ospf
 ```
 
@@ -219,6 +218,33 @@ Example: a reorder of one term plus a content change in another term
  }
 ```
 
+## Junos inactive/active toggles
+
+When a Junos hierarchical node only flips its `inactive:` state (the node itself and its subtree are otherwise identical), the diff does not re-emit the whole subtree as a `-`/`+` pair. Instead it pairs the two states as one node and marks the new state with a `!`:
+
+* A deactivated node keeps its literal `inactive:` prefix.
+* A reactivated node has no marker on the B side, so a synthetic `activate:` is shown to make the direction visible.
+
+```diff
+ system {
+!    inactive: host-name foo;
+ }
+```
+
+If the toggled section also has real changes inside it, the section header is marked `!` and expanded so the inner `-`/`+` (or nested `!`) lines still surface:
+
+```diff
+ protocols {
+!    inactive: ospf {
+         area 0.0.0.0 {
+!            activate: interface ge-0/0/0.0;
+         }
+     }
+ }
+```
+
+In `reconcile`, the same toggles emit `activate <path>` / `deactivate <path>` (see the reconcile section above).
+
 ### Customizing the behavior for a new vendor
 
 The `VendorParser` protocol exposes `is_order_sensitive(path: tuple[str, ...]) -> bool`. `path` is the tuple of `line` values from the root down to "the parent node whose children are being compared." Returning `True` makes the children compared positionally via `SequenceMatcher`; returning `False` (the default) falls back to set-style key comparison. If you're subclassing the Cisco family, the shortest path is to pass `order_sensitive_predicate` to `CiscoLikeParser(...)`.
@@ -245,7 +271,9 @@ Create a new module under `src/diffnc/vendors/`, expose an implementation of the
 * `render_close(node, depth) -> str | None`
 * `render_leaf(node, depth) -> str`
 * `is_order_sensitive(path) -> bool` (optional; treated as always `False` if not implemented. See the "How order is handled" section.)
-* `render_reconcile(events) -> Iterator[str]` (optional; required only to support `reconcile`. Receives a sequence of `ReconcileAdd` / `ReconcileDelete` / `ReconcileRecreate` events from `diffnc.reconcile` and yields the corresponding CLI lines.)
+* `render_reconcile(events) -> Iterator[str]` (optional; required only to support `reconcile`. Receives a sequence of `ReconcileAdd` / `ReconcileDelete` / `ReconcileRecreate` / `ReconcileToggle` events from `diffnc.reconcile` and yields the corresponding CLI lines.)
+* `toggle_partners(a, b) -> bool` / `is_toggle_state(line) -> bool` (optional; both default to `False`. Let `reconcile` recognise paired toggle states — e.g. `X` ↔ `no X`, `activate` ↔ `deactivate` — so a transition emits only the new value and a removed toggle is excluded from value-change matching.)
+* `base_identity(line) -> str` / `render_toggle_line(b_line, depth, *, became_active, kind) -> str` (optional; only needed for vendors with an inactive-state prefix such as Junos hierarchical `inactive:`. `base_identity` strips the prefix so a (de)activated node matches its active form as one node in two states; when that match's lines still differ, the diff/reconcile engines treat it as a toggle and call `render_toggle_line` to render the `!`-marked line — `kind` is `"leaf"`, `"section_open"` or `"section_collapsed"` — or emit a `ReconcileToggle`.)
 
 ## License
 

{diffnc-0.0.2 → diffnc-0.0.4}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "diffnc"
-version = "0.0.2"
+version = "0.0.4"
 description = "Structural diff library for network device configurations"
 readme = "README.md"
 authors = [

{diffnc-0.0.2 → diffnc-0.0.4}/src/diffnc/detect.py

@@ -11,21 +11,23 @@ import re
 
 from diffnc.errors import ParseError
 
-_JUNOS_TOP_KEYWORDS = (
-    "interfaces",
-    "system",
-    "routing-options",
-    "routing-instances",
-    "protocols",
-    "policy-options",
-    "firewall",
-    "security",
-    "groups",
-    "chassis",
-    "snmp",
-    "services",
-    "applications",
-    "forwarding-options",
+_JUNOS_TOP_KEYWORDS = frozenset(
+    {
+        "interfaces",
+        "system",
+        "routing-options",
+        "routing-instances",
+        "protocols",
+        "policy-options",
+        "firewall",
+        "security",
+        "groups",
+        "chassis",
+        "snmp",
+        "services",
+        "applications",
+        "forwarding-options",
+    }
 )
 
 _NXOS_INTERFACE_RE = re.compile(r"^interface Ethernet\d+/\d+")
@@ -117,20 +119,30 @@ def _has_eos_marker(lines: list[str]) -> bool:
     return False
 
 
-def detect_vendor(text: str) -> str:
-    """Return the vendor name for *text*.
-
-    Raises:
-        ParseError: if no supported vendor can be confidently identified.
-    """
-
+def _significant_lines(text: str) -> list[str]:
     significant: list[str] = []
     for raw in text.splitlines():
         s = raw.strip()
         if not s or s.startswith("!") or s.startswith("#") or s.startswith("/*"):
             continue
         significant.append(s)
+    return significant
+
+
+def is_empty_config(text: str) -> bool:
+    """True if *text* has no significant (non-comment) lines."""
+
+    return not _significant_lines(text)
 
+
+def detect_vendor(text: str) -> str:
+    """Return the vendor name for *text*.
+
+    Raises:
+        ParseError: if no supported vendor can be confidently identified.
+    """
+
+    significant = _significant_lines(text)
     if not significant:
         raise ParseError("configuration is empty or comment-only")
 
@@ -142,12 +154,11 @@ def detect_vendor(text: str) -> str:
         return "junos_set"
 
     # Junos hierarchical: presence of braces and at least one Junos top-level keyword.
+    # The keyword check is just "first token is a Junos top-level word" — a line like
+    # ``interfaces {`` already has that word as its first token, so no separate brace-form
+    # scan (and no per-keyword inner loop) is needed.
     has_brace = any(s.endswith("{") or s == "}" for s in significant)
-    has_junos_kw = any(
-        s.split(" ", 1)[0] in _JUNOS_TOP_KEYWORDS or s.startswith(kw + " {")
-        for s in significant
-        for kw in _JUNOS_TOP_KEYWORDS
-    )
+    has_junos_kw = any(s.split(" ", 1)[0] in _JUNOS_TOP_KEYWORDS for s in significant)
     if has_brace and has_junos_kw:
         return "junos"
 

{diffnc-0.0.2 → diffnc-0.0.4}/src/diffnc/diff.py

@@ -17,17 +17,26 @@ lines, joined internally) for parity with :mod:`difflib`.
 
 from __future__ import annotations
 
+from collections import deque
 from collections.abc import Iterable, Iterator, Sequence
 from dataclasses import dataclass
 from difflib import SequenceMatcher
 
 from diffnc import vendors as _vendors
-from diffnc.detect import detect_vendor
+from diffnc.detect import detect_vendor, is_empty_config
 from diffnc.errors import VendorMismatchError
 from diffnc.ir import ConfigNode, ConfigTree
-from diffnc.vendors.base import VendorParser, is_order_sensitive_for, render_subtree
+from diffnc.vendors.base import (
+    VendorParser,
+    base_identity_for,
+    is_order_sensitive_for,
+    leaf_section_render_equivalent,
+    render_subtree,
+    render_toggle_line_for,
+)
 
 _SIMILARITY_CUTOFF = 0.6  # difflib.get_close_matches の既定値に合わせる
+_TOKEN_SHARE_CUTOFF = 0.4  # 先頭コマンド語が一致する場合に適用する緩い二次閾値
 
 
 @dataclass(frozen=True)
@@ -120,11 +129,21 @@ def _prepare(
     text_b = _coerce(b)
 
     if vendor is None:
-        vendor_a = detect_vendor(text_a)
-        vendor_b = detect_vendor(text_b)
-        if vendor_a != vendor_b:
-            raise VendorMismatchError(vendor_a, vendor_b)
-        vendor_name = vendor_a
+        empty_a = is_empty_config(text_a)
+        empty_b = is_empty_config(text_b)
+        if empty_a and empty_b:
+            # Nothing to detect from and nothing to diff: both trees parse empty, so no
+            # vendor-specific behaviour is ever reached and any registered parser will do.
+            vendor_name = "nxos"
+        elif empty_a or empty_b:
+            # An empty side carries no vendor signal; detect from the other side only.
+            vendor_name = detect_vendor(text_b if empty_a else text_a)
+        else:
+            vendor_a = detect_vendor(text_a)
+            vendor_b = detect_vendor(text_b)
+            if vendor_a != vendor_b:
+                raise VendorMismatchError(vendor_a, vendor_b)
+            vendor_name = vendor_a
     else:
         vendor_name = vendor
 
@@ -276,78 +295,151 @@ def _diff_children_unordered(
 
     a_children = node_a.children
     b_children = node_b.children
-    b_by_line = {child.line: child for child in b_children}
-    common = {child.line for child in a_children} & set(b_by_line)
-    b_match_index = {
-        child.line: idx for idx, child in enumerate(b_children) if child.line in common
-    }
+    # Match on base identity (toggle prefixes stripped) so an (de)activated node pairs with
+    # its active form; a base-key match whose lines still differ is an inactive toggle.
+    a_keys = [base_identity_for(parser, child.line) for child in a_children]
+    b_keys = [base_identity_for(parser, child.line) for child in b_children]
+    b_by_key = dict(zip(b_keys, b_children, strict=True))
+    common = set(a_keys) & set(b_by_key)
+    b_match_index = {key: idx for idx, key in enumerate(b_keys) if key in common}
 
     a_only_leaves = [
         (idx, child)
         for idx, child in enumerate(a_children)
-        if child.line not in common and child.is_leaf
+        if a_keys[idx] not in common and child.is_leaf
     ]
     b_only_leaves = [
         (idx, child)
         for idx, child in enumerate(b_children)
-        if child.line not in common and child.is_leaf
+        if b_keys[idx] not in common and child.is_leaf
     ]
     a_index_to_b_node, paired_b_positions = _pair_changed_leaves(a_only_leaves, b_only_leaves)
 
     b_pointer = 0
     for idx, child_a in enumerate(a_children):
-        if child_a.line not in common:
+        key_a = a_keys[idx]
+        if key_a not in common:
             yield from _emit_one_side(parser, child_a, depth, "-")
             partner = a_index_to_b_node.get(idx)
             if partner is not None:
                 yield from _emit_one_side(parser, partner, depth, "+")
             continue
-        b_pos = b_match_index[child_a.line]
+        b_pos = b_match_index[key_a]
         if b_pos >= b_pointer:
             for k in range(b_pointer, b_pos):
                 child_b = b_children[k]
-                if child_b.line not in common and k not in paired_b_positions:
+                if b_keys[k] not in common and k not in paired_b_positions:
                     yield from _emit_one_side(parser, child_b, depth, "+")
             b_pointer = b_pos + 1
-        yield from _equal_pair(parser, child_a, b_by_line[child_a.line], depth, hide_equal, path)
+        yield from _equal_pair(parser, child_a, b_by_key[key_a], depth, hide_equal, path)
 
     for k in range(b_pointer, len(b_children)):
         child_b = b_children[k]
-        if child_b.line not in common and k not in paired_b_positions:
+        if b_keys[k] not in common and k not in paired_b_positions:
             yield from _emit_one_side(parser, child_b, depth, "+")
 
 
+def _leading_token(line: str) -> str:
+    """Return the first whitespace-delimited token of *line* (its command word)."""
+
+    parts = line.split(maxsplit=1)
+    return parts[0] if parts else ""
+
+
+def _value_head(line: str) -> str | None:
+    """The part of *line* before its trailing token, or ``None`` for a single-token line.
+
+    ``"ip ospf cost 10"`` → ``"ip ospf cost"``; ``"shutdown"`` → ``None``. Two leaves with the
+    same head differ only in their trailing value — i.e. the same setting reassigned.
+    """
+
+    head, sep, _ = line.rpartition(" ")
+    return head if sep else None
+
+
 def _pair_changed_leaves(
     a_only: list[tuple[int, ConfigNode]],
     b_only: list[tuple[int, ConfigNode]],
 ) -> tuple[dict[int, ConfigNode], set[int]]:
     """Greedily pair A-only / B-only leaves that differ only in value.
 
-    Pairs are chosen highest-similarity first (``difflib`` ratio over the raw lines),
-    each side used at most once, and only above :data:`_SIMILARITY_CUTOFF`. Returns
-    ``(a_child_index -> paired b node, set of paired b child indices)`` so the caller can
-    emit the ``+`` next to its ``-`` and suppress it elsewhere.
+    Matching runs in two passes so it stays near-linear on large configs:
+
+    * **Phase 1 — exact value head.** Leaves that share a :func:`_value_head` (same setting,
+      new trailing value, e.g. ``ip route … <next-hop>`` or ``mtu <n>``) are paired directly
+      via a hash bucket. This is the overwhelmingly common case and the one that used to blow
+      up: thousands of same-prefix leaves no longer need an O(n²) ``SequenceMatcher`` sweep.
+    * **Phase 2 — ratio fallback.** Whatever stays unpaired (leaves whose *prefix* changed,
+      e.g. ``description uplink`` → ``description uplink-to-spine``, or short settings such as
+      ``vlan 1`` → ``vlan 1,100,200,300``) is matched within shared leading-token buckets by
+      ``difflib`` ratio, highest first, each side used once. The reused matcher is gated by the
+      cheap ``real_quick_ratio`` / ``quick_ratio`` upper bounds (the prefilter
+      :func:`difflib.get_close_matches` uses). The residual is small, so this stays cheap.
+
+    Restricting Phase 2 to a shared leading token (and Phase 1 to a shared head) is what makes
+    a value change meaningful; cross-token pairs — rare even under the old all-pairs scan — are
+    intentionally not formed.
+
+    Returns ``(a_child_index -> paired b node, set of paired b child indices)`` so the
+    caller can emit the ``+`` next to its ``-`` and suppress it elsewhere.
     """
 
-    candidates: list[tuple[float, int, int]] = []
-    for ai, (_, a_node) in enumerate(a_only):
-        for bi, (_, b_node) in enumerate(b_only):
-            ratio = SequenceMatcher(None, a_node.line, b_node.line).ratio()
-            if ratio >= _SIMILARITY_CUTOFF:
-                candidates.append((ratio, ai, bi))
-    candidates.sort(key=lambda t: t[0], reverse=True)
-
     used_a: set[int] = set()
     used_b: set[int] = set()
     a_index_to_b_node: dict[int, ConfigNode] = {}
     paired_b_positions: set[int] = set()
-    for _, ai, bi in candidates:
-        if ai in used_a or bi in used_b:
-            continue
+
+    def _commit(ai: int, bi: int) -> None:
         used_a.add(ai)
         used_b.add(bi)
         a_index_to_b_node[a_only[ai][0]] = b_only[bi][1]
         paired_b_positions.add(b_only[bi][0])
+
+    # Phase 1: pair leaves sharing an exact value head (in B order, one-to-one).
+    b_by_head: dict[str, deque[int]] = {}
+    for bi, (_, b_node) in enumerate(b_only):
+        head = _value_head(b_node.line)
+        if head is not None:
+            b_by_head.setdefault(head, deque()).append(bi)
+    for ai, (_, a_node) in enumerate(a_only):
+        head = _value_head(a_node.line)
+        if head is None:
+            continue
+        bucket = b_by_head.get(head)
+        if bucket:
+            _commit(ai, bucket.popleft())
+
+    # Phase 2: ratio-match the residual within shared leading-token buckets.
+    rem_b_by_token: dict[str, list[int]] = {}
+    for bi, (_, b_node) in enumerate(b_only):
+        if bi not in used_b:
+            rem_b_by_token.setdefault(_leading_token(b_node.line), []).append(bi)
+    if not rem_b_by_token:
+        return a_index_to_b_node, paired_b_positions
+
+    candidates: list[tuple[float, int, int]] = []
+    matcher = SequenceMatcher()  # autojunk left at difflib's default, as the old all-pairs scan did
+    for ai, (_, a_node) in enumerate(a_only):
+        if ai in used_a:
+            continue
+        bucket = rem_b_by_token.get(_leading_token(a_node.line))
+        if not bucket:
+            continue
+        matcher.set_seq2(a_node.line)
+        for bi in bucket:
+            matcher.set_seq1(b_only[bi][1].line)
+            if (
+                matcher.real_quick_ratio() < _TOKEN_SHARE_CUTOFF
+                or matcher.quick_ratio() < _TOKEN_SHARE_CUTOFF
+            ):
+                continue
+            ratio = matcher.ratio()
+            if ratio >= _TOKEN_SHARE_CUTOFF:
+                candidates.append((ratio, ai, bi))
+    candidates.sort(key=lambda t: t[0], reverse=True)
+    for _, ai, bi in candidates:
+        if ai not in used_a and bi not in used_b:
+            _commit(ai, bi)
     return a_index_to_b_node, paired_b_positions
 
 
@@ -362,7 +454,21 @@ def _equal_pair(
     a_is_section = not child_a.is_leaf
     b_is_section = not child_b.is_leaf
 
+    # Matched by base identity; if the raw lines still differ it is an inactive toggle.
+    key = base_identity_for(parser, child_a.line)
+    toggled = child_a.line != child_b.line
+    became_active = child_b.line == key
+
     if not a_is_section and not b_is_section:
+        if toggled:
+            # Only the (in)active state changed; show the new state marked ``!``.
+            yield _Event(
+                "!",
+                render_toggle_line_for(
+                    parser, child_b.line, depth, became_active=became_active, kind="leaf"
+                ),
+            )
+            return
         # Equal leaf at this level. Suppress in the compact view, show as context in ndiff.
         if not hide_equal:
             yield _Event(" ", parser.render_leaf(child_a, depth))
@@ -371,7 +477,7 @@ def _equal_pair(
     if a_is_section != b_is_section:
         leaf_node = child_b if a_is_section else child_a
         section_node = child_a if a_is_section else child_b
-        if not _leaf_section_render_equivalent(parser, leaf_node, section_node, depth):
+        if not leaf_section_render_equivalent(parser, leaf_node, section_node, depth):
             # A leaf that genuinely became a section (e.g. Junos ``foo;`` → ``foo { ... }``).
             yield from _emit_one_side(parser, child_a, depth, "-")
             yield from _emit_one_side(parser, child_b, depth, "+")
@@ -379,8 +485,8 @@ def _equal_pair(
         # Indent-based vendors: the "leaf" is just an empty section with the same header,
         # so fall through and diff their children (the empty side yields all ``-``/``+``).
 
-    # Both are sections with matching headers. Diff their children; only surface the section
-    # header if any descendant differs (compact mode) or always (ndiff).
+    # Both are sections with matching headers. Diff their children; surface the section header
+    # if any descendant differs, if its own state toggled (compact mode), or always (ndiff).
     inner = list(
         _diff_children(
             parser,
@@ -388,40 +494,37 @@ def _equal_pair(
             child_b,
             depth + 1,
             hide_equal=hide_equal,
-            path=(*path, child_a.line),
+            path=(*path, key),
         )
     )
     has_change = any(ev.op != " " for ev in inner)
 
-    if not has_change and hide_equal:
+    if not has_change and not toggled and hide_equal:
         return
 
-    yield _Event(" ", parser.render_open(child_a, depth))
+    if toggled and not has_change and hide_equal:
+        # Section state flipped but its subtree is identical: collapse to one marked line.
+        yield _Event(
+            "!",
+            render_toggle_line_for(
+                parser, child_b.line, depth, became_active=became_active, kind="section_collapsed"
+            ),
+        )
+        return
+
+    if toggled:
+        header = render_toggle_line_for(
+            parser, child_b.line, depth, became_active=became_active, kind="section_open"
+        )
+        yield _Event("!", header)
+    else:
+        yield _Event(" ", parser.render_open(child_a, depth))
     yield from inner
     close = parser.render_close(child_a, depth)
     if close is not None:
         yield _Event(" ", close)
 
 
-def _leaf_section_render_equivalent(
-    parser: VendorParser,
-    leaf_node: ConfigNode,
-    section_node: ConfigNode,
-    depth: int,
-) -> bool:
-    """Whether promoting *leaf_node* to an empty section is render-transparent.
-
-    True for indent-based vendors (Cisco/NX-OS), where ``render_leaf == render_open`` and
-    there is no closing line, so an empty ``interface eth1`` and a populated one share the
-    same header. False for brace/terminator vendors (Junos hierarchical), where a leaf
-    (``foo;``) is structurally distinct from a section (``foo { ... }``).
-    """
-
-    return parser.render_close(section_node, depth) is None and parser.render_leaf(
-        leaf_node, depth
-    ) == parser.render_open(section_node, depth)
-
-
 def _emit_one_side(
     parser: VendorParser,
     node: ConfigNode,