docs: bring the document set into the standard shape

Assisted-by: GLM 5.3 Flash

.gitea/workflows/race.yml

@@ -0,0 +1,37 @@
+# Race, Go. Dispatched by hand, and never a gate on a push or a tag: the release tag is
+# cut only after `just gates` has already raced the tree, so this workflow is the
+# explicit second opinion, not a step of the release.
+#
+# The race detector roughly doubles both time and memory, which the shared runner box
+# cannot afford on every push. Locally it belongs to `just gates`, which runs it once per
+# task; here it is a decision rather than a routine.
+#
+# Every step is one command, so the step that fails is the gate that failed.
+name: Race
+
+on:
+  workflow_dispatch:
+
+env:
+  # One core: parallelism buys no speed here and costs memory the box does not have.
+  GOFLAGS: -p=1
+  GOMAXPROCS: "2"
+
+jobs:
+  race:
+    runs-on: fedora
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@v7
+
+      - uses: actions/setup-go@v6
+        with:
+          go-version-file: go.mod
+          cache: true
+
+      - name: Install gcc
+        # The race detector needs cgo and the runner image carries no C compiler.
+        run: dnf install -y gcc
+
+      - name: Race
+        run: go test -race -count=1 -timeout 10m ./...

.gitea/workflows/release.yml

@@ -1,73 +1,198 @@
-# Release — gasm binaries. Runs on version tags (v0.28.0) pushed to main.
+# Release, Go binaries. Runs on version tags (v1.2.3) pushed to main.
+#
+# The module sits at the repository root: the toolchain records a version only for a root
+# module, measured on go1.27.1, so a build of a module in a subdirectory reports (devel)
+# even at its own <module>/vX.Y.Z tag and this workflow's smoke test can never pass for
+# it. A Go repository is one module at the root.
+#
+# The version contract these steps implement is in the `release` skill, and its point is
+# that nothing is injected: the toolchain records the tag into the binary's build
+# information, so the build simply has to happen at the tag, which the trigger guarantees.
+#
+# The gates run in their own job, once, before the matrix, minus the race detector: race
+# never runs on a push path or a tag, and the local gate raced this tree before the tag
+# was cut. Putting the gates inside the matrix would run the whole suite once per target
+# on the box that also hosts the forge. Each job validates the tag for itself rather than
+# passing a value between jobs, so no workflow feature has to be trusted for the version
+# to reach the file name.
 name: Release
 
 on:
   push:
     tags: ["v*"]
 
+env:
+  # The box is shared with the forge, so parallelism is bounded on purpose. The gates job
+  # needs it most; the build jobs inherit it for their parallel compilation.
+  GOFLAGS: -p=1
+  GOMAXPROCS: "2"
+
 jobs:
+  gates:
+    runs-on: fedora
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v7
+
+      - uses: actions/setup-go@v6
+        with:
+          go-version-file: go.mod
+          cache: true
+
+      - name: Install Perl
+        # Perl for the steps below. The install is a no-op where the package
+        # is already present.
+        run: dnf install -y perl
+
+      - name: Validate the tag
+        env:
+          VERSION: ${{ gitea.ref_name }}
+        run: |
+          perl -e '
+            my $v = $ENV{VERSION} // q{};
+            $v =~ m{^v[0-9]+(\.[0-9]+){0,2}([-+].*)?$}
+              or die qq{ERROR: expected a semver tag like v1.2.3, got: $v\n};
+            print qq{tag $v\n};
+          '
+
+      - name: Build
+        run: go build ./...
+
+      - name: Format
+        run: |
+          perl -e '
+            open(my $g, q{-|}, q{gofmt}, q{-l}, q{.}) or die qq{gofmt: $!};
+            my @bad = <$g>;
+            close($g);
+            print @bad;
+            exit(@bad ? 1 : 0);
+          '
+
+      - name: Vet
+        run: go vet ./...
+
+      - name: Modernise
+        run: go fix -diff ./...
+
+      - name: Tests
+        # The same command as in test.yml, so the floor is the same number everywhere.
+        run: go test -count=1 -timeout 10m -coverprofile=coverage.out ./arch/... ./asm/... ./ast/... ./disasm/... ./format/... ./lexer/... ./lint/... ./lsp/... ./parser/... ./token/... ./verify/...
+
+      - name: Coverage floor
+        run: |
+          perl -e '
+            open(my $c, q{-|}, q{go}, q{tool}, q{cover}, q{-func=coverage.out}) or die qq{cover: $!};
+            my $total;
+            while (my $l = <$c>) { $total = $1 if $l =~ m{^total:\s+\S+\s+([0-9.]+)%} }
+            close($c);
+            die qq{no total line in coverage.out\n} unless defined $total;
+            printf qq{Total coverage: %s%%\n}, $total;
+            exit($total < 80 ? 1 : 0);
+          '
+
   build:
     runs-on: fedora
+    timeout-minutes: 25
+    needs: gates
     strategy:
       fail-fast: false
       matrix:
+        # Portable targets: amd64, arm64, loong64 and riscv64 on Linux, at the toolchain
+        # default level. No 32-bit, no wasm, no macOS, no Windows. FreeBSD stays out until
+        # verify/jit.go ports off syscall.Mprotect: the Go syscall package defines no
+        # Mprotect for freebsd, and verify/jit.go:50 calls it to drop the write bit from
+        # the JIT mapping, so every freebsd target fails to build with "undefined:
+        # syscall.Mprotect" (verified for amd64, arm64 and riscv64 on go1.27.1).
         include:
           - goos: linux
             goarch: amd64
           - goos: linux
             goarch: arm64
-          - goos: linux
-            goarch: riscv64
           - goos: linux
             goarch: loong64
+          - goos: linux
+            goarch: riscv64
     steps:
       - uses: actions/checkout@v7
 
       - uses: actions/setup-go@v6
         with:
-          go-version: "1.27"
+          go-version-file: go.mod
+          cache: true
 
-      - name: Download dependencies
-        run: go mod download
+      - name: Install Perl
+        run: dnf install -y perl
 
-      - name: Validate tag and build
-        id: build
+      - name: Validate the tag
+        id: version
         env:
           VERSION: ${{ gitea.ref_name }}
         run: |
-          set -euo pipefail
+          perl -e '
+            my $v = $ENV{VERSION} // q{};
+            $v =~ m{^v[0-9]+(\.[0-9]+){0,2}([-+].*)?$}
+              or die qq{ERROR: expected a semver tag like v1.2.3, got: $v\n};
+            (my $nv = $v) =~ s{^v}{};
+            open(my $o, q{>>}, $ENV{GITEA_OUTPUT}) or die qq{GITEA_OUTPUT: $!};
+            print $o qq{version_no_v=$nv\n};
+            close($o);
+            print qq{version $nv\n};
+          '
 
-          if ! echo "$VERSION" | grep -qE '^v[0-9]+(\.[0-9]+){0,2}([-+].*)?$'; then
-            echo "ERROR: expected a semver tag like v1.2.3, got: '$VERSION'"
-            exit 1
-          fi
-
-          VERSION_NO_V="${VERSION#v}"
-          echo "version_no_v=${VERSION_NO_V}" >> "$GITEA_OUTPUT"
-
-          mkdir -p bin
-          GOOS=${{ matrix.goos }} GOARCH=${{ matrix.goarch }} CGO_ENABLED=0 \
-            go build -ldflags "-s -w -X main.version=${VERSION_NO_V}" \
-              -o "bin/gasm-${VERSION_NO_V}-${{ matrix.goos }}-${{ matrix.goarch }}" \
-              ./cmd/gasm
+      - name: Build
+        env:
+          VERSION_NO_V: ${{ steps.version.outputs.version_no_v }}
+          GOOS: ${{ matrix.goos }}
+          GOARCH: ${{ matrix.goarch }}
+          CGO_ENABLED: "0"
+        run: |
+          # Nothing is injected. The toolchain records the tag into the binary's build
+          # information, so the version is right because this build happens at the tag, and
+          # there is no path for anyone to get wrong. -s -w only strips symbols.
+          go build -ldflags "-s -w" -o "bin/gasm-${VERSION_NO_V}-${GOOS}-${GOARCH}" ./cmd/gasm
 
+      # Artifacts stay on v3: v4 and later detect Gitea as GHES and abort.
       - name: Upload artifact
         uses: actions/upload-artifact@v3
         with:
           name: gasm-${{ matrix.goos }}-${{ matrix.goarch }}
-          path: bin/gasm-${{ steps.build.outputs.version_no_v }}-${{ matrix.goos }}-${{ matrix.goarch }}
+          path: bin/gasm-${{ steps.version.outputs.version_no_v }}-${{ matrix.goos }}-${{ matrix.goarch }}
           if-no-files-found: error
 
       - name: Smoke test
+        # Only a binary matching the runner can be run here. The check is not that --version
+        # exits cleanly but that it reports the tag and nothing more: a build outside version
+        # control reports (devel), and a build whose tree was dirty reports +dirty, and both
+        # would otherwise be published.
         if: matrix.goos == 'linux' && matrix.goarch == 'amd64'
+        env:
+          TAG: ${{ gitea.ref_name }}
+          BIN: bin/gasm-${{ steps.version.outputs.version_no_v }}-${{ matrix.goos }}-${{ matrix.goarch }}
         run: |
-          chmod +x bin/gasm-${{ steps.build.outputs.version_no_v }}-${{ matrix.goos }}-${{ matrix.goarch }}
-          ./bin/gasm-${{ steps.build.outputs.version_no_v }}-${{ matrix.goos }}-${{ matrix.goarch }} --version
+          perl -e '
+            my $want = $ENV{TAG} // die qq{ERROR: no tag\n};
+            open(my $bin, q{-|}, $ENV{BIN}, q{--version}) or die qq{$ENV{BIN}: $!};
+            my $got = <$bin>;
+            close($bin);
+            $got = defined $got ? $got : q{};
+            chomp $got;
+            index($got, $want) >= 0
+              or die qq{ERROR: the binary printed "$got", which does not contain $want. Version control was disabled, so there is no recorded version.\n};
+            index($got, q{+dirty}) < 0
+              or die qq{ERROR: the binary printed "$got". The tree was dirty at build time, which means the checkout was not the tag, or the build artefacts are not ignored.\n};
+            print qq{$ENV{BIN} reports $got\n};
+          '
 
   release:
     runs-on: fedora
+    timeout-minutes: 15
     needs: build
     permissions:
+      # contents: read is required for the checkout: a job that declares any
+      # permissions gets a token scoped to exactly those, and releases: write
+      # alone leaves the fetch with no read access, which Gitea answers with
+      # a 404 "Repository not found". Verified on the instance 2026-09-16.
+      contents: read
       releases: write
     steps:
       - uses: actions/checkout@v7
@@ -77,81 +202,125 @@ jobs:
         with:
           path: dist
 
-      - name: Extract CHANGELOG section
+      - name: Install Perl
+        run: dnf install -y perl
+
+      - name: Extract the CHANGELOG section
         env:
           VERSION: ${{ gitea.ref_name }}
         run: |
-          set -euo pipefail
-          VERSION_NO_V="${VERSION#v}"
+          # Each step derives what it needs from the tag, so no value has to travel between
+          # jobs.
+          perl -e '
+            my $v = $ENV{VERSION} // q{};
+            $v =~ s{^v}{};
+            open(my $vout, q{>}, q{version-no-v.txt}) or die qq{version-no-v.txt: $!};
+            print $vout $v;
+            close($vout);
+            open(my $in, q{<}, q{CHANGELOG.md}) or die qq{CHANGELOG.md: $!};
+            my @lines = <$in>;
+            close($in);
+            my ($start, $end) = (-1, scalar @lines);
+            for my $i (0 .. $#lines) {
+              if ($start < 0) { $start = $i if $lines[$i] =~ m{^##\s+\[\Q$v\E\]} }
+              elsif ($lines[$i] =~ m{^##\s+\[}) { $end = $i; last }
+            }
+            $start >= 0 or die qq{ERROR: no CHANGELOG section for $v, expected a heading like: ## [$v] - YYYY-MM-DD\n};
+            my @body = grep { m{\S} } @lines[$start + 1 .. $end - 1];
+            @body or die qq{ERROR: the CHANGELOG section for $v is empty\n};
+            open(my $out, q{>}, q{release-body.md}) or die qq{release-body.md: $!};
+            print $out @body;
+            close($out);
+            printf qq{notes for %s: %d lines\n}, $v, scalar @body;
+          '
 
-          sed -n "/^## \[${VERSION_NO_V}\] /,/^## \[/p" CHANGELOG.md \
-            | sed '$d' \
-            | tail -n +2 \
-            > release-body.md
+      - name: Build the release request
+        run: |
+          perl -e '
+            open(my $vin, q{<}, q{version-no-v.txt}) or die qq{version-no-v.txt: $!};
+            my $v = <$vin>;
+            close($vin);
+            chomp $v;
+            open(my $in, q{<:raw}, q{release-body.md}) or die qq{release-body.md: $!};
+            my $body = do { local $/; <$in> };
+            close($in);
+            # Byte-oriented escaping: JSON is UTF-8, so non-ASCII passes through and only the
+            # characters JSON forbids are rewritten.
+            $body =~ s/([\\"])/\\$1/g;
+            $body =~ s/\t/\\t/g;
+            $body =~ s/\r//g;
+            $body =~ s/\n/\\n/g;
+            $body =~ s/([\x00-\x08\x0b\x0c\x0e-\x1f])/sprintf(q{\u%04x}, ord($1))/ge;
+            my $json = sprintf(qq{{"tag_name":"v%s","name":"v%s","body":"%s","draft":false,"prerelease":false}}, $v, $v, $body);
+            open(my $out, q{>}, q{release.json}) or die qq{release.json: $!};
+            print $out $json;
+            close($out);
+            print qq{release.json written for v$v\n};
+          '
 
-          if [ ! -s release-body.md ]; then
-            echo "ERROR: no CHANGELOG section found for ${VERSION_NO_V}"
-            echo "Expected a heading like: ## [${VERSION_NO_V}] — YYYY-MM-DD"
-            exit 1
-          fi
-
-      - name: Create release
+      - name: Create the release
         env:
           GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
           GITEA_SERVER_URL: ${{ gitea.server_url }}
           GITEA_REPOSITORY: ${{ gitea.repository }}
-          GITEA_REF_NAME: ${{ gitea.ref_name }}
         run: |
-          set -euo pipefail
-
-          BODY=$(sed -e 's/\\/\\\\/g' -e 's/"/\\"/g' -e 's/\t/\\t/g' -e 's/\r//g' release-body.md | sed ':a;N;$!ba;s/\n/\\n/g')
-          BODY="\"${BODY}\""
-
-          response=$(curl -sS -w '\n%{http_code}' \
-            -H "Authorization: token ${GITEA_TOKEN}" \
-            -H "Content-Type: application/json" \
-            -X POST \
-            "${GITEA_SERVER_URL}/api/v1/repos/${GITEA_REPOSITORY}/releases" \
-            -d "{\"tag_name\":\"${GITEA_REF_NAME}\",\"name\":\"${GITEA_REF_NAME}\",\"body\":${BODY},\"draft\":false,\"prerelease\":false}")
-
-          http_code=$(echo "$response" | tail -1)
-          payload=$(echo "$response" | sed '$d')
-
-          echo "HTTP ${http_code}"
-          if [ "$http_code" != "201" ]; then
-            echo "Failed to create release: ${payload}"
-            exit 1
-          fi
-
-          RELEASE_ID=$(echo "$payload" | grep -oE '"id"[[:space:]]*:[[:space:]]*[0-9]+' | head -1 | grep -oE '[0-9]+')
-          echo "Created release ID=${RELEASE_ID}"
-          printf '%s' "${RELEASE_ID}" > release-id.txt
+          perl -e '
+            my @cmd = (q{curl}, q{-sS}, q{-o}, q{response.json}, q{-w}, q{%{http_code}},
+              q{-H}, qq{Authorization: token $ENV{GITEA_TOKEN}},
+              q{-H}, q{Content-Type: application/json},
+              q{-X}, q{POST},
+              qq{$ENV{GITEA_SERVER_URL}/api/v1/repos/$ENV{GITEA_REPOSITORY}/releases},
+              q{--data-binary}, q{@release.json});
+            open(my $curl, q{-|}, @cmd) or die qq{curl: $!};
+            my $code = <$curl>;
+            my $ok = close($curl);
+            my $exit = $? >> 8;
+            $code = defined $code ? $code : q{};
+            $ok or die qq{ERROR: curl failed (exit $exit) calling $ENV{GITEA_SERVER_URL}\n};
+            open(my $r, q{<:raw}, q{response.json}) or die qq{response.json: $!};
+            my $body = do { local $/; <$r> };
+            close($r);
+            $code eq q{201} or die qq{ERROR: the release was not created, HTTP $code: $body\n};
+            $body =~ m{"id"\s*:\s*([0-9]+)} or die qq{ERROR: no release id in the response: $body\n};
+            open(my $o, q{>}, q{release-id.txt}) or die qq{release-id.txt: $!};
+            print $o $1;
+            close($o);
+            print qq{release id $1\n};
+          '
 
       - name: Upload assets
         env:
           GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
           GITEA_SERVER_URL: ${{ gitea.server_url }}
           GITEA_REPOSITORY: ${{ gitea.repository }}
-          GITEA_REF_NAME: ${{ gitea.ref_name }}
         run: |
-          set -euo pipefail
-          RELEASE_ID=$(cat release-id.txt)
-
-          for binary in dist/gasm-*/gasm-*; do
-            [ -f "$binary" ] || continue
-            fname=$(basename "$binary")
-            echo "Uploading ${fname}..."
-            http_code=$(curl -sS -o /dev/null -w '%{http_code}' \
-              -H "Authorization: token ${GITEA_TOKEN}" \
-              -H "Content-Type: application/octet-stream" \
-              -X POST \
-              --data-binary "@${binary}" \
-              "${GITEA_SERVER_URL}/api/v1/repos/${GITEA_REPOSITORY}/releases/${RELEASE_ID}/assets?name=${fname}")
-            echo "  HTTP ${http_code}"
-            if [ "$http_code" != "201" ]; then
-              echo "Failed to upload ${fname}"
-              exit 1
-            fi
-          done
-
-          echo "Release ${GITEA_REF_NAME} is live."
+          perl -e '
+            open(my $f, q{<}, q{release-id.txt}) or die qq{release-id.txt: $!};
+            my $id = <$f>;
+            close($f);
+            chomp $id;
+            my @files = grep { -f $_ } glob(q{dist/*/*});
+            @files or die qq{ERROR: no assets under dist/\n};
+            my $bad = 0;
+            for my $path (@files) {
+              (my $name = $path) =~ s{.*/}{};
+              my @cmd = (q{curl}, q{-sS}, q{-o}, q{/dev/null}, q{-w}, q{%{http_code}},
+                q{-H}, qq{Authorization: token $ENV{GITEA_TOKEN}},
+                q{-H}, q{Content-Type: application/octet-stream},
+                q{-X}, q{POST}, q{--data-binary}, qq{@$path},
+                qq{$ENV{GITEA_SERVER_URL}/api/v1/repos/$ENV{GITEA_REPOSITORY}/releases/$id/assets?name=$name});
+              open(my $curl, q{-|}, @cmd) or die qq{curl: $!};
+              my $code = <$curl>;
+              my $ok = close($curl);
+              my $exit = $? >> 8;
+              $code = defined $code ? $code : q{};
+              unless ($ok) {
+                printf qq{%s: curl failed (exit %d)\n}, $name, $exit;
+                $bad = 1;
+                next;
+              }
+              printf qq{%s: HTTP %s\n}, $name, $code;
+              $bad = 1 if $code ne q{201};
+            }
+            exit($bad ? 1 : 0);
+          '

.gitea/workflows/test.yml

@@ -1,4 +1,17 @@
-# Test — gasm-devkit. Runs on push and pull request to development.
+# Test, Go. Push and pull request to development. Never on main.
+#
+# The gates are the ones the justfile's `gates` recipe runs, minus race: the shared
+# runner box cannot afford the race detector on every push, so it lives in race.yml.
+# The box is one core and 2 GB beside Gitea, so parallelism is bounded on purpose and
+# everything runs in one job. Extra jobs would duplicate the checkout, the Go setup and
+# the dependency download three times without buying any parallelism.
+#
+# Every step is one command, so the step that fails is the gate that failed, and no shell
+# option has to be trusted for the run to stop. The scripted steps are Perl, not shell and
+# not Python: Perl behaves the same on both runner images, there is no bashism to trip over
+# on ash, and it is one language instead of two. The Perl uses builtins only, because
+# Fedora packages the Perl modules separately and nothing beyond `perl` itself may be
+# assumed present.
 name: Test
 
 on:
@@ -7,90 +20,76 @@ on:
   pull_request:
     branches: [development]
 
+env:
+  # One core: parallelism buys no speed here and costs memory the box does not have.
+  GOFLAGS: -p=1
+  GOMAXPROCS: "2"
+
+# A superseded run of the same ref is cancelled instead of queueing behind one that
+# no longer matters. Verified on Gitea 1.27.1 on 2026-09-17: a queued run whose ref
+# moved on is cancelled before it ever reaches the runner, while a run already
+# dispatched there runs to completion.
+concurrency:
+  group: ${{ gitea.workflow }}-${{ gitea.ref }}
+  cancel-in-progress: true
+
 jobs:
-  vet:
-    runs-on: fedora
-    steps:
-      - uses: actions/checkout@v7
-
-      - uses: actions/setup-go@v6
-        with:
-          go-version: "1.27"
-
-      - name: Download dependencies
-        run: go mod download
-
-      - name: gofmt
-        run: |
-          set -euo pipefail
-          unformatted=$(gofmt -l .)
-          if [ -n "$unformatted" ]; then
-            echo "These files need gofmt:"
-            echo "$unformatted"
-            exit 1
-          fi
-
-      - name: go vet
-        run: go vet ./...
-
   test:
     runs-on: fedora
-    needs: vet
+    timeout-minutes: 10
     steps:
       - uses: actions/checkout@v7
 
       - uses: actions/setup-go@v6
         with:
-          go-version: "1.27"
+          # The module is the source of truth for the version, so it cannot drift.
+          go-version-file: go.mod
+          cache: true
 
-      - name: Download dependencies
-        run: go mod download
-
-      - name: Install gcc
-        run: dnf install -y gcc
-
-      - name: go test -race
-        run: go test -race -count=1 ./...
-
-      - name: Coverage gate — 80 % minimum
-        run: |
-          set -euo pipefail
-          # Exclude packages inherently untestable without hardware:
-          # debug — interactive ptrace, requires a live process
-          # cmd/gasm — CLI glue, covered by integration tests
-          go test -coverprofile=coverage.out \
-            sourcedock.dev/petrbalvin/gasm-devkit/arch \
-            sourcedock.dev/petrbalvin/gasm-devkit/asm \
-            sourcedock.dev/petrbalvin/gasm-devkit/ast \
-            sourcedock.dev/petrbalvin/gasm-devkit/format \
-            sourcedock.dev/petrbalvin/gasm-devkit/lexer \
-            sourcedock.dev/petrbalvin/gasm-devkit/lint \
-            sourcedock.dev/petrbalvin/gasm-devkit/lsp \
-            sourcedock.dev/petrbalvin/gasm-devkit/parser \
-            sourcedock.dev/petrbalvin/gasm-devkit/token \
-            sourcedock.dev/petrbalvin/gasm-devkit/verify
-          coverage=$(go tool cover -func=coverage.out | awk '/^total:/ { gsub("%", "", $3); print $3 }')
-          echo "Total coverage: ${coverage}%"
-          if awk -v c="$coverage" 'BEGIN { exit !(c+0 < 80) }'; then
-            echo "ERROR: coverage ${coverage}% is below the 80% threshold"
-            exit 1
-          fi
-
-  build:
-    runs-on: fedora
-    needs: test
-    steps:
-      - uses: actions/checkout@v7
-
-      - uses: actions/setup-go@v6
-        with:
-          go-version: "1.27"
-
-      - name: Download dependencies
-        run: go mod download
+      - name: Install Perl
+        # The runner images are minimal and Perl is not guaranteed. The install is a
+        # no-op where it is already present; drop this step once verified on the box.
+        run: dnf install -y perl
 
+      # The steps follow the `gates` order of the justfile contract: build, format,
+      # vet, test. The vet gate is go vet and go fix -diff, two steps here.
       - name: Build
-        run: go build -ldflags="-s -w" -o bin/gasm ./cmd/gasm
+        run: go build ./...
 
-      - name: Smoke test
-        run: ./bin/gasm --version
+      - name: Format
+        run: |
+          perl -e '
+            open(my $g, q{-|}, q{gofmt}, q{-l}, q{.}) or die qq{gofmt: $!};
+            my @bad = <$g>;
+            close($g);
+            print @bad;
+            exit(@bad ? 1 : 0);
+          '
+
+      - name: Vet
+        run: go vet ./...
+
+      - name: Modernise
+        # Exits non-zero when it has something to rewrite, so it needs no output capture.
+        run: go fix -diff ./...
+
+      - name: Tests
+        # The suite must be fast: a push pipeline that cannot finish in a few minutes moves
+        # its heavy part behind a dispatch. The inner timeout matches the job's, so a
+        # hanging test reports its own goroutine dump rather than a silent job kill.
+        # The pattern is `packages` in the project's justfile: the logic packages, since a
+        # thin cmd/ would drag the total under the floor. release.yml runs the same
+        # command, so the floor is the same number everywhere.
+        run: go test -count=1 -timeout 10m -coverprofile=coverage.out ./arch/... ./asm/... ./ast/... ./disasm/... ./format/... ./lexer/... ./lint/... ./lsp/... ./parser/... ./token/... ./verify/...
+
+      - name: Coverage floor
+        run: |
+          perl -e '
+            open(my $c, q{-|}, q{go}, q{tool}, q{cover}, q{-func=coverage.out}) or die qq{cover: $!};
+            my $total;
+            while (my $l = <$c>) { $total = $1 if $l =~ m{^total:\s+\S+\s+([0-9.]+)%} }
+            close($c);
+            die qq{no total line in coverage.out\n} unless defined $total;
+            printf qq{Total coverage: %s%%\n}, $total;
+            exit($total < 80 ? 1 : 0);
+          '

.gitignore

@@ -1,25 +1,13 @@
-# Metadata (always first, per repo convention)
 .idea/
 .zcode/
-.qwen/
-.mimocode/
 
-# Binaries
-/gasm
+# Build output
 /bin/
-*.exe
-
-# Test and coverage artefacts
+/gasm
 coverage.out
 *.test
 
-# Crash dumps
+# Crash dumps from the emulator runs
 core
 core.*
 *.core
-
-# Scratch / temporary work
-_scratch/
-
-# ZCode workspace
-.zcode

CHANGELOG.md

@@ -3,15 +3,54 @@
 All notable changes to gasm-devkit are documented here.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
-and this project adheres to [Conventional Commits](https://www.conventionalcommits.org/).
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ## [development]
 
-### Added
+### Changed
 
--
+- **Canonical just recipes.**  `just gates` is the definition of done
+  (build, fmt-check, vet, test, race).  `install` now builds and copies
+  the binary into `~/.local/bin` (`BINDIR` overrides) instead of
+  downloading module dependencies, and `install-bin` is gone.  The test
+  gate sweeps the logic packages (arch through verify; the hardware-bound
+  `debug` and the thin `cmd/gasm` sit outside it), so the coverage floor
+  is computed over the product code and the number is identical locally
+  and in CI.  `fuzz` requires its target package.
+- **The reported version comes from the build.**  `gasm --version`
+  prints the version the toolchain recorded: the tag on a tagged
+  checkout, a pseudo-version naming the commit below one, `+dirty` on a
+  dirty tree and `(devel)` outside version control.  Nothing is
+  injected with `-ldflags -X` any more.
+- **CI realigned with the gate set.**  The push pipeline runs the gates
+  minus race in one job, in the `gates` order, with a cached Go setup and
+  the module as the version source; a superseded run of the same branch
+  is cancelled instead of queueing; every `go test` runs under a
+  ten-minute bound that matches its job's; the race detector moved to a
+  hand-dispatched workflow and runs in the local gate before a tag is
+  cut, never on a push or a tag; the release builds without injection and
+  its smoke test requires the recorded tag and rejects `+dirty`.
+- **The documents follow the standard set.**  `docs/ARCHITECTURE.md` is
+  organised as Overview, Packages, Data flow, State and lifetime and
+  Dependencies, and carries a sequence diagram of the assembly path;
+  `docs/DEVELOPMENT.md` lists every recipe in one table and documents the
+  coverage floor, the CI and the release flow; `docs/CLI.md` gives the
+  synopsis, the commands, every flag with its default, the exit codes and
+  worked examples; `CONTRIBUTING.md` carries the Contributor terms and
+  states the commit trailer form, the one-logical-change rule and the
+  licence header rule.  The repository's own assembly (the `verify`
+  trampolines and the test kernels) is in `gasm fmt` canonical form.
 
-## [0.33.0] — 2026-09-14
+### Fixed
+
+- **The dependency statement was wrong.**  `golang.org/x/arch` is not
+  test-only: `gasm dis` and the debugger's listings decode through it, so
+  it is linked into the binary.  `CONTRIBUTING.md` and
+  `docs/ARCHITECTURE.md` said otherwise.
+- **The CLI reference listed 17 of the 18 lint rules.**  The missing
+  `reserved-register-write` is documented with the rest.
+
+## [0.33.0] - 2026-09-14
 
 ### Added
 
@@ -67,7 +106,7 @@ and this project adheres to [Conventional Commits](https://www.conventionalcommi
   the toolchain picks, and the morestack block saves the link register
   with the toolchain's `OR` form on loong64.
 
-## [0.32.0] — 2026-08-31
+## [0.32.0] - 2026-08-31
 
 ### Added
 
@@ -218,7 +257,7 @@ and this project adheres to [Conventional Commits](https://www.conventionalcommi
   outputs and operand strictness with `go tool asm`.
 - **asm help text.**  Updated to list arm64 as a supported architecture.
 
-## [0.31.1] — 2026-08-20
+## [0.31.1] - 2026-08-20
 
 ### Fixed
 
@@ -226,9 +265,9 @@ and this project adheres to [Conventional Commits](https://www.conventionalcommi
   because the version variables in `justfile` and `cmd/gasm/main.go` were not
   bumped during the release commit.
 
-## [0.31.0] — 2026-08-20
+## [0.31.0] - 2026-08-20
 
-The arm64 encoder (Phase 5 — complete) ships with ELF64 and GOOBJ emission,
+The arm64 encoder (Phase 5; complete) ships with ELF64 and GOOBJ emission,
 verified byte-for-byte against `GOARCH=arm64 go tool asm` and linked into a
 real `go build`.  The encoder covers the full integer instruction set, FP
 arithmetic, conditional select, CRC32, and the MOV pseudo-instruction with
@@ -236,7 +275,7 @@ bitmask immediate encoding.  The project now requires Go 1.27.
 
 ### Added
 
-- **arm64 encoder (Phase 5 — complete).**  `gasm asm` can now assemble `_arm64.s`
+- **arm64 encoder (Phase 5; complete).**  `gasm asm` can now assemble `_arm64.s`
   files: the AArch64 integer instruction set with the MOV pseudo-instruction and
   its immediate-constant expansions (MOVZ/MOVN/MOVK for wide immediates, ORR with
   logical bitmask encoding for values like `$1`), data-processing (shifted
@@ -245,7 +284,7 @@ bitmask immediate encoding.  The project now requires Go 1.27.
   SB/global symbol references (ADRP+ADD pairs with `R_ADDRARM64` relocations),
   jump chain folding, and ELF64 emission (`gasm asm --format elf`).  Ground-truth
   verification against `GOARCH=arm64 go tool asm` matches byte-for-byte.  Phase 5
-  (the other architectures — RISC-V, LoongArch, arm64) is now complete.
+  (the other architectures; RISC-V, LoongArch, arm64) is now complete.
 
 ### Changed
 
@@ -253,7 +292,7 @@ bitmask immediate encoding.  The project now requires Go 1.27.
   The `R_DWTXTADDR_U4` relocation type is detected at runtime for backward
   compatibility.
 
-## [0.30.0] — 2026-08-13
+## [0.30.0] - 2026-08-13
 
 The LoongArch encoder (Phase 5) ships with ELF64 and GOOBJ emission, verified
 byte-for-byte against `GOARCH=loong64 go tool asm` and linked into a real
@@ -278,7 +317,7 @@ tracks four hardware watchpoint slots, and the toolkit is Linux-only.
 - **GOOBJ DWARF symbols.**  The GOOBJ emitters now write the per-function
   DWARF symbols the linker requires (the subprogram DIE and the `.debug_line`
   program, byte-identical to `cmd/asm`'s), and the pc-value table deltas are
-  in the architecture's MinLC units as the runtime expects — the amd64 link
+  in the architecture's MinLC units as the runtime expects; the amd64 link
   test now genuinely substitutes the gasm object, and the amd64/loong64
   end-to-end GOOBJ link tests pass.
 - **RISC-V GOOBJ emission via the shared emitter.**  RISC-V GOOBJ output is
@@ -347,7 +386,7 @@ tracks four hardware watchpoint slots, and the toolkit is Linux-only.
   `GOARCH=riscv64 go tool asm`.
 - **Debugger watchpoint slots.**  `gasm debug`'s `watch` command always used
   hardware watchpoint slot 0, so a second `watch` call silently overwrote
-  the first.  Watchpoint slots are now tracked in the `Session` (DR0–DR3);
+  the first.  Watchpoint slots are now tracked in the `Session` (DR0-DR3);
   `watch` picks the first free slot and reports an error if all four are in
   use, and `unwatch <slot>` clears one (no argument clears all).
 
@@ -359,7 +398,7 @@ tracks four hardware watchpoint slots, and the toolkit is Linux-only.
   disassembly at PC, memory-write, watchpoints, and source-line mapping are
   all shipped.
 
-## [0.29.0] — 2026-08-07
+## [0.29.0] - 2026-08-07
 
 RISC-V GOOBJ emission, YMM vector register display, named buffer allocation
 in the debugger, two new CLI commands (`diff`, `profile`), go-to-definition in
@@ -369,30 +408,30 @@ new CLI commands. A signature-parser fix corrects grouped Go parameters.
 
 ### Added
 
-- **RISC-V GOOBJ emission** — `gasm asm --format goobj` for RISC-V produces
+- **RISC-V GOOBJ emission**; `gasm asm --format goobj` for RISC-V produces
   linkable Go objects with funcdata, pc-value tables, and RISC-V relocation
   types (same format as amd64 GOOBJ, with the RISC-V architecture marker).
-- **`gasm diff`** — compare the machine code of two assembly files byte-for-byte;
+- **`gasm diff`**; compare the machine code of two assembly files byte-for-byte;
   shows which functions differ and the first few differing bytes.
-- **`gasm profile`** — show the basic-block structure of each function: labels,
+- **`gasm profile`**; show the basic-block structure of each function: labels,
   offsets, frame size, and NOSPLIT flag.
-- **LSP go-to-definition** — `textDocument/definition` navigates from a label
+- **LSP go-to-definition**; `textDocument/definition` navigates from a label
   reference to its definition.
-- **did-you-mean** — when the RISC-V assembler encounters an undefined label, it
+- **did-you-mean**; when the RISC-V assembler encounters an undefined label, it
   suggests the closest existing label using Levenshtein distance.
-- **YMM vector register display** — `regs` in the debugger now shows YMM
+- **YMM vector register display**; `regs` in the debugger now shows YMM
   registers via `PTRACE_GETFPREGS` (falls back to XMM when XSAVE is unavailable).
-- **Named buffer allocation** — `gasm debug --buf name:size:pattern` allocates
+- **Named buffer allocation**; `gasm debug --buf name:size:pattern` allocates
   buffers in the debuggee filled with `zero`, `ones`, `seq`, or a hex pattern;
   buffer pointers are placed into the argument block at the matching positions.
-- **Crash input storage** — `FuzzResult.CrashInput` stores the input that caused
+- **Crash input storage**; `FuzzResult.CrashInput` stores the input that caused
   a crash or mismatch for reproducibility.
-- **ABI + fuzz combined** — `gasm verify --fuzz` now runs ABI checks (sentinel
+- **ABI + fuzz combined**; `gasm verify --fuzz` now runs ABI checks (sentinel
   registers, canary, stack bounds) alongside differential fuzz testing.
-- **`gasm diff --map`** — compare functions whose names differ between files
+- **`gasm diff --map`**; compare functions whose names differ between files
   (e.g. `--map wideCopyAVX2=wideCopyAVX512` pairs two variants regardless
   of suffix). Unmapped functions fall back to the original name match.
-- **`gasm verify --call`** — invoke a single function with user-supplied buffers
+- **`gasm verify --call`**; invoke a single function with user-supplied buffers
   (`--buf name:size:pattern`) instead of the smoke/abi/fuzz sweeps. Patterns:
   `zero`, `ones`, `seq`, or a hex blob. Useful for partial functions (e.g.
   decoders) that crash on random input but should succeed on valid data.
@@ -402,23 +441,23 @@ new CLI commands. A signature-parser fix corrects grouped Go parameters.
 
 ### Fixed
 
-- **Signature parser** — grouped Go parameters like `dst, src []byte` are now
+- **Signature parser**; grouped Go parameters like `dst, src []byte` are now
   parsed correctly (both get type `[]byte`). Previously the first name was
   treated as its own type (`dst` with size 8), causing wrong ABI0 arg-block
   layout in both `verify --call` and the fuzzer.
-- **Flaky JIT tests** — `runtime.KeepAlive` guards and package-level buffers
+- **Flaky JIT tests**; `runtime.KeepAlive` guards and package-level buffers
   prevent GC from collecting heap objects whose addresses were passed to JIT
   code via `unsafe.Pointer`; all verify tests pass 100/100 under `-race`.
 
 ### Changed
 
-- **Removed external kernel test dependencies** — the verify test suite no
+- **Removed external kernel test dependencies**; the verify test suite no
   longer references production kernels from the separate go-libraries project.
   The remaining test suite uses only `testdata/verify/*.s` kernels, which are
   part of this repository.  Coverage is identical locally and in CI (80.3 %).
 
 
-## [0.28.0] — 2026-08-03
+## [0.28.0] - 2026-08-03
 
 RISC-V encoder: full RV64IMAFDC instruction set with RVC compression, MOV
 pseudo-instruction, SB/global symbol references, ELF64 object emission, and
@@ -426,20 +465,20 @@ ground-truth verification against `GOARCH=riscv64 go tool asm`.
 
 ### Added
 
-- **RISC-V encoder** — RV64I, RV64M, RV64A, RV64F/D, FMA, CSR, JALR.
-- **MOV pseudo-instruction** — load, store, reg-to-reg, immediate, frame mapping.
-- **RVC compression** — 22 compressed instruction types (C.LDSP, C.SDSP, C.FLDSP,
+- **RISC-V encoder**; RV64I, RV64M, RV64A, RV64F/D, FMA, CSR, JALR.
+- **MOV pseudo-instruction**; load, store, reg-to-reg, immediate, frame mapping.
+- **RVC compression**; 22 compressed instruction types (C.LDSP, C.SDSP, C.FLDSP,
   C.FSDSP, C.ADDI, C.LI, C.LUI, C.ADDIW, C.MV, C.ADD, C.SUB, C.XOR, C.OR, C.AND,
   C.SLLI, C.SRLI, C.SRAI, C.ANDI, C.BEQZ, C.BNEZ, C.J, C.JR).
-- **SB/global symbols** — `MOV $sym(SB)`, `MOV sym(SB)`, `MOV rd, sym(SB)`
+- **SB/global symbols**; `MOV $sym(SB)`, `MOV sym(SB)`, `MOV rd, sym(SB)`
   encoded as AUIPC pairs with R_RISCV_PCREL_HI20/LO12 relocations.
-- **GLOBL/DATA** — data section layout in `AssembleFileRISCV`.
-- **ELF64 emission** — `gasm asm --format elf` produces EM_RISCV objects
+- **GLOBL/DATA**; data section layout in `AssembleFileRISCV`.
+- **ELF64 emission**; `gasm asm --format elf` produces EM_RISCV objects
   (.text, .data, .symtab, .rela.text).
-- **`gasm verify --ground-truth`** — byte-exact comparison against
+- **`gasm verify --ground-truth`**; byte-exact comparison against
   `GOARCH=riscv64 go tool asm`.
-- **`gasm verify --profile`** — function layout listing for RISC-V.
-- **CALL** — AUIPC + JALR pair encoding.
+- **`gasm verify --profile`**; function layout listing for RISC-V.
+- **CALL**; AUIPC + JALR pair encoding.
 
 ### Fixed
 
@@ -449,7 +488,7 @@ ground-truth verification against `GOARCH=riscv64 go tool asm`.
   (bit-interleaved format).
 
 
-## [0.27.0] — 2026-08-01
+## [0.27.0] - 2026-08-01
 
 Subprocess isolation for `--fuzz`: each function is fuzzed in its own child
 process, so a partial function (decoder) that faults on random garbage is
@@ -460,7 +499,7 @@ the parent.  CRASH is informational (exit 0); only MISMATCH is an error.
 
 - `gasm verify --fuzz` no longer crashes the process on partial functions.
 
-## [0.26.0] — 2026-07-31
+## [0.26.0] - 2026-07-31
 
 Universal differential fuzzing: `gasm verify --fuzz` needs no hand-written
 reference.  It parses the `// func` signature from the assembly source,
@@ -471,7 +510,7 @@ area bit-for-bit.
 
 ### Added
 
-- `verify`: `FuzzFunc` / `ExtractSignatures` / `parseFuncSig` — universal
+- `verify`: `FuzzFunc` / `ExtractSignatures` / `parseFuncSig`; universal
   differential fuzz driven by the conventional `// func` comment.  Each
   version gets its own buffer set (deep copy) so functions that write to
   their arguments (histogram increments) don't corrupt the other's input.
@@ -486,16 +525,16 @@ area bit-for-bit.
 over-copy paths read past the buffer on random garbage input.  Subprocess
 isolation (fork per function) is planned.  Use `--ground-truth` for decoders.
 
-## [0.25.0] — 2026-07-30
+## [0.25.0] - 2026-07-30
 
 Universal ground-truth verification: `gasm verify --ground-truth` assembles
 any `.s` file with both gasm and `go tool asm`, then compares the machine
 code byte-for-byte per function (relocation sites masked).  No hand-written
-reference needed — the Go toolchain IS the oracle.
+reference needed; the Go toolchain IS the oracle.
 
 ### Added
 
-- `verify`: `GroundTruth` — shells out to `go tool asm`, parses the GOOBJ
+- `verify`: `GroundTruth`; shells out to `go tool asm`, parses the GOOBJ
   output (minimal reader: block offsets, nonpkg symbol table, data index)
   and returns per-function code bytes.
 - `gasm verify --ground-truth`: compares gasm's output against the Go
@@ -504,11 +543,11 @@ reference needed — the Go toolchain IS the oracle.
   linker fills) are masked before comparison.
 - Verified: go-lz4 AVX2 2/2, go-flac AVX2 17/17 functions byte-identical.
 
-## [0.24.0] — 2026-07-29
+## [0.24.0] - 2026-07-29
 
 The full analyze family and stereo PCM decode are now differentially tested.
 15 of 17 go-flac AVX2 kernels have bit-for-bit differential coverage; the
-two remaining (autocorrAVX2 — FMA reassociation, lpcResidualAVX2 — complex
+two remaining (autocorrAVX2: FMA reassociation, lpcResidualAVX2: complex
 multi-arg) are deferred.
 
 ### Added
@@ -518,7 +557,7 @@ multi-arg) are deferred.
 - `verify`: `decodeStereo16AVX2` differential test (500 random interleaved
   stereo PCM buffers, both channels compared sample-by-sample).
 
-## [0.23.0] — 2026-07-28
+## [0.23.0] - 2026-07-28
 
 The analyze family and 24-bit PCM decode join the differential suite.
 
@@ -530,7 +569,7 @@ The analyze family and 24-bit PCM decode join the differential suite.
 - `verify`: `decodeMono24AVX2` differential test (500 random 24-bit PCM
   buffers, sign-extension compared sample-by-sample).
 
-## [0.22.0] — 2026-07-27
+## [0.22.0] - 2026-07-27
 
 The remaining go-flac encoder kernels join the differential suite.
 
@@ -544,39 +583,39 @@ The remaining go-flac encoder kernels join the differential suite.
   loop).
 
 
-## [0.21.0] — 2026-07-26
+## [0.21.0] - 2026-07-26
 
 Differential testing extended to all four production kernels and the CLI
 exposes the full dynamic-analysis toolkit.
 
 ### Added
 
-- `verify`: go-flac AVX2 differential tests — `decodeMono16AVX2` (500
+- `verify`: go-flac AVX2 differential tests; `decodeMono16AVX2` (500
   random PCM buffers), `pack16AVX2` (500 random int32→int16 packings) and
   all four decorrelation kernels (200 iterations each: left-side, side-right,
   mid-side, interleave) compared bit-for-bit against the portable Go
   references.
-- `verify`: go-lz4 AVX-512 differential tests — `decodeBlockAVX512` (3 000
-  fuzzed LZ4 blocks + known answers) and `wideCopyAVX512` (0–1024 bytes)
+- `verify`: go-lz4 AVX-512 differential tests; `decodeBlockAVX512` (3 000
+  fuzzed LZ4 blocks + known answers) and `wideCopyAVX512` (0-1024 bytes)
   against the same portable oracle as the AVX2 suite.
 - `gasm verify --abi`: runs each NOSPLIT function with sentinel registers
   and a red-zone canary, reporting violations.
 - `gasm verify --profile`: lists the static basic-block count per function.
 
-## [0.20.0] — 2026-07-25
+## [0.20.0] - 2026-07-25
 
 Coverage profiling: the third pillar of Phase 3.  Static basic-block
 enumeration from the assembler's label map, combined with multi-input path
-diversity measurement — how many observationally distinct execution paths a
+diversity measurement; how many observationally distinct execution paths a
 test corpus exercises.
 
 ### Added
 
-- `verify`: `Kernel.Blocks` / `Kernel.BlockCount` — enumerate basic blocks
+- `verify`: `Kernel.Blocks` / `Kernel.BlockCount`; enumerate basic blocks
   from the assembler's local-label map (every jump target is a block
   boundary; the function entry is always a block).  `decodeBlockAVX2` has
   27 blocks.
-- `verify`: `Kernel.ProfilePaths` — run the function with a corpus of
+- `verify`: `Kernel.ProfilePaths`; run the function with a corpus of
   argument blocks and collect distinct output fingerprints (the result
   words); reports path diversity as a lower bound on code coverage.
 
@@ -588,7 +627,7 @@ rt_sigaction handlers fragile in a Go process.  The static + path-diversity
 approach delivers the project's goal (proving the SIMD path and tail handling
 execute) without fighting the runtime.
 
-## [0.19.0] — 2026-07-24
+## [0.19.0] - 2026-07-24
 
 Runtime ABI checks: the second pillar of Phase 3.  The JIT trampoline now
 has an ABI-checking variant that sets sentinels in the callee-saved registers
@@ -598,41 +637,41 @@ detects any illegal write below the stack pointer.
 
 ### Added
 
-- `verify`: `CallChecked` / `Kernel.CallFuncChecked` — ABI-checking JIT call
+- `verify`: `CallChecked` / `Kernel.CallFuncChecked`; ABI-checking JIT call
   with sentinel registers and red-zone canary; returns an `ABIReport`
   (BPClobbered, R14Clobbered, RedZoneHit).
-- `verify`: the raw `leaveJITCheckedRaw` trampoline — a TEXT symbol with no
+- `verify`: the raw `leaveJITCheckedRaw` trampoline; a TEXT symbol with no
   ABIInternal wrapper (address obtained via GLOBL/DATA), so the JIT
   function's RET lands directly in the check code and sees the registers
   exactly as the function left them.
 - Tests: deliberate BP/R14 clobberers detected; both go-lz4 kernels
   confirmed ABI-clean (BP preserved, R14 preserved, red zone intact).
 
-## [0.18.0] — 2026-07-23
+## [0.18.0] - 2026-07-23
 
 Differential testing: the JIT-assembled go-lz4 `decodeBlockAVX2` kernel is
-fuzzed against a portable Go reference — 5 000 valid LZ4 blocks compared
+fuzzed against a portable Go reference; 5 000 valid LZ4 blocks compared
 bit-for-bit, plus 2 000 hostile (random garbage) inputs with matching error
 codes.  This is the automated form of the project's bit-identical contract.
 
 ### Added
 
-- `verify`: differential fuzz tests — a random LZ4 block generator produces
+- `verify`: differential fuzz tests; a random LZ4 block generator produces
   valid blocks (literals, overlapping matches, extension bytes) and the
   JIT-assembled kernel's output is compared byte-for-byte against a portable
   Go decoder; a hostile-input suite confirms error-code agreement on random
   garbage (no crashes, same classification).
 
-## [0.17.0] — 2026-07-22
+## [0.17.0] - 2026-07-22
 
 Phase 3 begins: dynamic analysis.  A JIT execution substrate that assembles
-Plan 9 amd64 kernels into executable memory and calls them directly — pure Go
+Plan 9 amd64 kernels into executable memory and calls them directly; pure Go
 (stdlib only, `syscall.Mmap` + an assembly trampoline), no cgo, no external
 toolchain.
 
 ### Added
 
-- `verify` package: JIT infrastructure — `Map` copies machine code into a
+- `verify` package: JIT infrastructure; `Map` copies machine code into a
   W^X memory mapping, `Call` invokes it through an ABI0 trampoline that
   switches to a prepared stack and back.  `Load`/`LoadSource`/`LoadAST`
   parse, assemble and map a `.s` file in one step; `Kernel.CallFunc`
@@ -641,34 +680,34 @@ toolchain.
   available functions; with `-smoke`, calls each NOSPLIT function with
   zeroed arguments to confirm the trampoline works end-to-end.
 - Integration tests: the go-lz4 `decodeBlockAVX2` and `wideCopyAVX2`
-  kernels (699 and 146 bytes) assemble, map and execute correctly —
-  known-answer LZ4 blocks decode bit-for-bit, wide copies of 0–1024 bytes
+  kernels (699 and 146 bytes) assemble, map and execute correctly;
+  known-answer LZ4 blocks decode bit-for-bit, wide copies of 0-1024 bytes
   match, malformed input returns the correct error codes.
 
 
-## [0.16.0] — 2026-07-21
+## [0.16.0] - 2026-07-21
 
-The scalar conversions between vector and general-purpose registers — the
+The scalar conversions between vector and general-purpose registers; the
 last of the amd64 EVEX instruction set.
 
 ### Added
 
 - `asm`: the GPR-interchanging conversions, byte for byte against the Go
   assembler (28 ground-truth cases including memory sources and extended
-  GPRs): vector to GPR — the signed and truncated VCVT{,T}S{D,S}2SI{,Q}
+  GPRs): vector to GPR; the signed and truncated VCVT{,T}S{D,S}2SI{,Q}
   in both VEX and EVEX, and the unsigned VCVT{,T}S{D,S}2USI{L,Q}
-  (EVEX only); GPR to vector — VCVTSI2SD{L,Q}/VCVTSI2SS{L,Q} (VEX and
+  (EVEX only); GPR to vector; VCVTSI2SD{L,Q}/VCVTSI2SS{L,Q} (VEX and
   EVEX) and VCVTUSI2SD{L,Q}/VCVTUSI2SS{L,Q} (EVEX only), whose preserved
   vector source sits in vvvv (three Plan 9 operands).
 
-## [0.15.0] — 2026-07-20
+## [0.15.0] - 2026-07-20
 
-The last of the EVEX conversions and narrowing/extending moves — the EVEX
+The last of the EVEX conversions and narrowing/extending moves; the EVEX
 instruction set is now complete save for the GPR-interchanging forms.
 
 ### Added
 
-- `asm`: the unsigned and truncating conversions — VCVTPD2PS (and the X/Y
+- `asm`: the unsigned and truncating conversions; VCVTPD2PS (and the X/Y
   spellings, whose length the spelling fixes), VCVTPD2UDQ (X/Y),
   VCVTTPD2UDQ (X/Y), VCVTTPD2UQQ, VCVTPS2UDQ, VCVTTPS2UDQ, VCVTPS2UQQ,
   VCVTTPS2UQQ, VCVTTPD2QQ, VCVTTPS2QQ, VCVTUQQ2PD, VCVTUQQ2PS (X/Y) and
@@ -681,20 +720,20 @@ instruction set is now complete save for the GPR-interchanging forms.
   D2M/Q2M), whose K register is a genuine operand rather than a mask and
   which therefore take no masking suffixes.
 
-## [0.14.0] — 2026-07-19
+## [0.14.0] - 2026-07-19
 
 The floating-point helper and conversion tail of the AVX-512 set, plus
-gather and scatter with VSIB addressing — every encoding verified byte for
+gather and scatter with VSIB addressing; every encoding verified byte for
 byte against the Go assembler.
 
 ### Added
 
-- `asm`: the floating-point helpers — reciprocals and reciprocal square
+- `asm`: the floating-point helpers; reciprocals and reciprocal square
   roots (VRCP14/VRSQRT14 PD/PS/SD/SS), exponents and mantissas (VGETEXP*,
   VGETMANT*), scaling by powers of two (VSCALEF*), rounding (VRNDSCALE*),
   reduction (VREDUCE*), immediate fixup (VFIXUPIMM*) and range selection
   (VRANGE*), and floating-point class tests (VFPCLASSPD/PS X/Y/Z and
-  VFPCLASSSD/SS — a new immediate form whose reg field carries the opmask
+  VFPCLASSSD/SS; a new immediate form whose reg field carries the opmask
   destination).
 - `asm`: **gather and scatter with VSIB addressing.**  The gathers take
   both Go spellings: the VEX form with a vector mask register (OP mask,
@@ -703,14 +742,14 @@ byte against the Go assembler.
   data register (a ZMM index with an YMM destination encodes L'L = 10, as
   the Go assembler emits).  The scatters (VSCATTER*/VPSCATTER*) are EVEX
   only (OP src, K, vsib).  All eight gather and eight scatter widths.
-- `asm`: the remaining conversions — VCVTQQ2PS (the 512-bit source sets
+- `asm`: the remaining conversions; VCVTQQ2PS (the 512-bit source sets
   the length), VCVTPD2QQ/UQQ, VCVTPS2QQ, VCVTUDQ2PD/PS, the half-precision
   VCVTPH2PS and VCVTPS2PH (the extract layout with an immediate).
 
-## [0.13.0] — 2026-07-18
+## [0.13.0] - 2026-07-18
 
 The wider AVX-512 set: ternary logic, permutes, compares, expand/compress,
-the opmask instructions and the EVEX rounding/SAE/broadcast suffixes — every
+the opmask instructions and the EVEX rounding/SAE/broadcast suffixes; every
 encoding verified byte for byte against the Go assembler.
 
 ### Added
@@ -718,7 +757,7 @@ encoding verified byte for byte against the Go assembler.
 - `asm`: the wider EVEX/AVX-512 set, across roughly sixty new ground-truth
   cases: ternary logic (VPTERNLOGD/Q), the lane shuffles/inserts/extracts
   (VSHUF{F,I}{32,64}X{2,4}, the VINSERT*/VEXTRACT* {F,I}{32,64}X{2,4,8}
-  family, VPALIGNR), compares with an opmask destination (VCMPPD/PS/SD/SS —
+  family, VPALIGNR), compares with an opmask destination (VCMPPD/PS/SD/SS;
   a new NDS-plus-immediate form with the K register in the reg field), the
   permutes (VPERMB/W, VPERMI2/T2 D/Q/PD), the wider integer families
   (VPMADDWD/UBSW, VPMULHUW, VPACKSSWB/USWB/SSDW/USDW, VPABS B/W/D/Q, the
@@ -732,15 +771,15 @@ encoding verified byte for byte against the Go assembler.
   (VMOVSLDUP/VMOVSHDUP), the conversions (VCVTPS2DQ, VCVTTPS2DQ) and the
   remaining extending and narrowing moves (VPMOVSXBW, VPMOVZXBW, VPMOVWB,
   VPMOVQB).
-- `asm`: the EVEX mnemonic suffixes the Go assembler accepts — the rounding
+- `asm`: the EVEX mnemonic suffixes the Go assembler accepts; the rounding
   modes `.RN_SAE`, `.RD_SAE`, `.RU_SAE`, `.RZ_SAE` (the EVEX b bit with the
   rounding control in L'L), suppress-all-exceptions `.SAE`, and memory
   broadcast `.BCST` (the b bit, the vector length preserved, disp8×N scaled
-  by the element size) — each combinable with the `.Z` zeroing suffix,
+  by the element size); each combinable with the `.Z` zeroing suffix,
   validated against the Go assembler's bytes, and rejected on instructions
   that do not support them.
 
-## [0.12.0] — 2026-07-17
+## [0.12.0] - 2026-07-17
 
 GOOBJ emission: gasm-assembled functions drop into a `go build` without the
 Go assembler.
@@ -748,7 +787,7 @@ Go assembler.
 ### Added
 
 - `asm`: **GOOBJ object output.**  `gasm asm --format goobj -p <pkgpath>`
-  writes the Go toolchain's own object format — the one `cmd/link` consumes
+  writes the Go toolchain's own object format; the one `cmd/link` consumes
   directly: the functions as non-package symbols qualified with the package
   path (exactly as `cmd/asm` records assembly symbols), the `GLOBL` data,
   one serialized `FuncInfo` per function (argument/frame sizes, the asm
@@ -757,8 +796,8 @@ Go assembler.
   real stack deltas: the assembler now tracks every stack-adjustment
   boundary through the prologue (`PUSHQ BP`, `SUBQ $frame, SP`) and each
   `RET`'s epilogue, so frame-pointer functions unwind correctly.  The
-  object preamble — the version-and-experiment header the linker compares
-  verbatim — is captured from the installed `go tool asm`, so the output is
+  object preamble; the version-and-experiment header the linker compares
+  verbatim; is captured from the installed `go tool asm`, so the output is
   always consistent with the toolchain that links it.
 - `asm`: relocations against file-local `GLOBL` symbols become `R_PCREL`
   entries in the GOOBJ output, with the instruction's displacement field
@@ -771,7 +810,7 @@ Go assembler.
   pattern, instead of being rejected as non-integer.
 
 
-## [0.11.0] — 2026-07-16
+## [0.11.0] - 2026-07-16
 
 Linkable object output: external symbols and relocatable ELF / Mach-O
 objects.
@@ -790,7 +829,7 @@ objects.
   external symbol; the Mach-O output is verified structurally with
   `debug/macho`.
 - `asm`: **external symbol references.**  A reference to a symbol no
-  `GLOBL` in the file defines no longer aborts assembly — it is recorded
+  `GLOBL` in the file defines no longer aborts assembly; it is recorded
   as an external relocation (`Image.Externals`, `FuncLayout.Relocs`) and
   becomes an undefined global symbol in the object output.  The raw image
   s (`--format raw`, the default) still reports them: only an object
@@ -802,7 +841,7 @@ objects.
   writes; without `--format` the behaviour is unchanged (the concatenated
   image).
 
-## [0.10.0] — 2026-07-15
+## [0.10.0] - 2026-07-15
 
 The EVEX floating-point and conversion set: the packed-double arithmetic,
 the scalar SD/SS forms, VMOVDDUP and the width-changing conversions, each
@@ -810,23 +849,23 @@ verified byte for byte against the Go assembler.
 
 ### Added
 
-- `asm`: the rest of the common EVEX/VEX floating-point set — packed double
+- `asm`: the rest of the common EVEX/VEX floating-point set; packed double
   arithmetic (VSUBPD, VDIVPD, VMINPD, VMAXPD, VUNPCKLPD and the EVEX form of
   VUNPCKHPD), the scalar double and single operations (VSUBSD, VDIVSD,
   VMINSD, VMAXSD and the full VADDSS/VSUBSS/VMULSS/VDIVSS/VMINSS/VMAXSS
-  family in both VEX and EVEX — the EVEX scalar forms exist for masked and
+  family in both VEX and EVEX; the EVEX scalar forms exist for masked and
   zeroing use), and VMOVDDUP (lane duplication, VEX and EVEX).
-- `asm`: the width-changing conversions — VCVTDQ2PS and VCVTPS2PD (VEX and
+- `asm`: the width-changing conversions; VCVTDQ2PS and VCVTPS2PD (VEX and
   EVEX; the destination sets the length for PS→PD), the EVEX form of
   VCVTDQ2PD, and the packed-double → dword family: VCVTPD2DQ/VCVTTPD2DQ
   (EVEX-512 only, a ZMM source and an XMM destination) and their X/Y
   spellings (VCVTPD2DQX/Y, VCVTTPD2DQX/Y), whose length follows the wider
-  source — a new operand form, since the destination is always XMM while
+  source; a new operand form, since the destination is always XMM while
   VEX.L / EVEX.L'L ride with the source (fixed by the spelling even for a
   memory source).
-- `asm`: masking and zeroing on every new form — the scalar SD/SS
+- `asm`: masking and zeroing on every new form; the scalar SD/SS
   arithmetic, the unpacks, VMOVDDUP and the conversions all accept the
-  explicit K1–K7 operand and the `.Z` suffix the way Go writes them.
+  explicit K1-K7 operand and the `.Z` suffix the way Go writes them.
 
 ### Changed
 
@@ -837,35 +876,35 @@ verified byte for byte against the Go assembler.
   shares the convention).
 
 
-## [0.9.0] — 2026-07-14
+## [0.9.0] - 2026-07-14
 
 AVX-512 masking and a wider EVEX integer set.
 
 ### Added
 
-- `asm`: **EVEX masking** the way Go writes it — an explicit `K1`–`K7`
+- `asm`: **EVEX masking** the way Go writes it; an explicit `K1`-`K7`
   operand placed among the operands (merging mask), and a `.Z` mnemonic
   suffix for zeroing (`VPADDD.Z Z1, Z2, K2, Z3`).  Supported across the NDS,
   reg/rm, immediate-shift, align, extract, convert and move forms, including
   masked comparisons with a K destination (`VPCMPEQD Z0, Z3, K2, K1`).  K0 is
   rejected as an explicit mask, and `.Z` without a mask is an error, matching
   the Go assembler.
-- `asm`: the common AVX-512 F/BW integer set — VPADDB/W, VPSUBB/W, VPANDD/Q,
+- `asm`: the common AVX-512 F/BW integer set; VPADDB/W, VPSUBB/W, VPANDD/Q,
   VPANDND/Q, VPMULLW, VPAVGB/W, the signed/unsigned min/max family for
   B/W/D/Q elements, the variable shifts VPSLLVD/Q, VPSRLVD/Q, VPSRAVD/Q, the
   EVEX forms of VPSHUFD/VPSHUFB, and the VMOVDQU8/VMOVDQU16 move aliases.
-  Register indices 16–31 encode correctly (the mod=11 quirk carries rm[4]
+  Register indices 16-31 encode correctly (the mod=11 quirk carries rm[4]
   in X̄).  All verified byte for byte against the Go assembler.
 - `lint`: masked EVEX forms (`.Z` suffix, K operands) are recognised by
   `unknown-instruction` and exempted from `operand-count`.
 
 ### Fixed
 
-- `asm`: EVEX register–register operands with indices 16–31 encoded rm[4]
+- `asm`: EVEX register-register operands with indices 16-31 encoded rm[4]
   into B̄ instead of X̄ (the EVEX mod=11 extension quirk), producing wrong
   prefix bytes for X16+/Y16+ r/m operands.
 
-## [0.8.0] — 2026-07-13
+## [0.8.0] - 2026-07-13
 
 Standard CLI ergonomics.
 
@@ -881,20 +920,20 @@ Standard CLI ergonomics.
 - The version is primarily available as the standard `gasm --version` / `-V`
   flag; the `gasm version` spelling remains as an alias.
 
-## [0.7.0] — 2026-07-12
+## [0.7.0] - 2026-07-12
 
 The formatter behaves like `go fmt` and canonicalises block separation.
 
 ### Added
 
-- `gasm fmt` now works like `go fmt`: with no arguments — or with a directory
-  argument — it reformats every `.s` file below it in place and lists the
+- `gasm fmt` now works like `go fmt`: with no arguments; or with a directory
+  argument; it reformats every `.s` file below it in place and lists the
   changed files, skipping `.` and `_` directories (`.git`, `_refs`, …).
   Explicit file arguments keep the `-w` / standard-output behaviour.
 
 ### Changed
 
-- `s`: canonical blank-line layout — a new block (a label, `TEXT` or
+- `s`: canonical blank-line layout; a new block (a label, `TEXT` or
   `GLOBL`) is preceded by exactly one blank line, neither more nor less.
   Comments leading a block stay with it (the blank line goes before them),
   stacked labels share their block, the function's first label keeps hugging
@@ -903,7 +942,7 @@ The formatter behaves like `go fmt` and canonicalises block separation.
   kernels were reformatted with this release and remain byte-identical when
   assembled.
 
-## [0.6.0] — 2026-07-11
+## [0.6.0] - 2026-07-11
 
 Calibrated to the Go ABI: `register-clobber` stops reporting legal code, and
 the encoder learns the legacy SSE moves.
@@ -912,13 +951,13 @@ the encoder learns the legacy SSE moves.
 
 - `lint`: **`register-clobber` is now calibrated to the Go ABI**
   (`cmd/compile/abi-internal.md`), not the platform ABI.  Go's stack-based
-  ABI0 has no System V style callee-saved registers — amd64 `BX`, `R12`–`R15`
+  ABI0 has no System V style callee-saved registers; amd64 `BX`, `R12`-`R15`
   and the arm64/riscv64/loong64 scratch sets are caller-saved or permanent
   scratch, and hand-written kernels may clobber them freely.  The rule now
   audits only the registers Go fixes across calls: the frame pointer and the
   goroutine pointer (amd64 `BP`/`R14`, arm64 `R18`/`R28`/`R29`, riscv64
   `X27`, loong64 `R22`), and the goroutine pointer is reported only when the
-  function can reach the runtime (is not `NOSPLIT` or makes a call) — the
+  function can reach the runtime (is not `NOSPLIT` or makes a call); the
   ABI0 transition restores it on those paths, and NOSPLIT call-free leaves
   may use it, exactly as the runtime's own assembly does.  Both go-flac
   kernels now lint with zero diagnostics.
@@ -935,21 +974,21 @@ the encoder learns the legacy SSE moves.
 
 ### Added
 
-- `asm`: the legacy (non-VEX) SSE moves — `MOVOU`/`MOVO` (the Plan 9 names
+- `asm`: the legacy (non-VEX) SSE moves; `MOVOU`/`MOVO` (the Plan 9 names
   for MOVDQU/MOVDQA), `MOVUPS`/`MOVAPS`/`MOVUPD`/`MOVAPD` and the scalar
-  `MOVSD`/`MOVSS` — and `VMOVDQU64` in the EVEX set.  All verified byte for
+  `MOVSD`/`MOVSS`; and `VMOVDQU64` in the EVEX set.  All verified byte for
   byte against the Go assembler.
 
-## [0.5.0] — 2026-07-10
+## [0.5.0] - 2026-07-10
 
 EVEX / AVX-512: the go-flac AVX-512 kernel now assembles, byte-identically to
 the Go toolchain, completing the production-kernel coverage.
 
 ### Added
 
-- `asm`: **EVEX (AVX-512) encoding** — the four-byte EVEX prefix with the
-  5-bit register fields (Z0–Z31, X/Y 16–31, with the reg-r/m X̄ quirk and
-  V'̄ shared between vvvv and the SIB index), opmask registers (K0–K7) as
+- `asm`: **EVEX (AVX-512) encoding**; the four-byte EVEX prefix with the
+  5-bit register fields (Z0-Z31, X/Y 16-31, with the reg-r/m X̄ quirk and
+  V'̄ shared between vvvv and the SIB index), opmask registers (K0-K7) as
   operands and as mask destinations, and the compressed disp8×N displacement
   (the multiplier follows the memory operand's size, as the Go assembler's
   opcode tables prescribe).  Covers every AVX-512 instruction the go-flac
@@ -959,20 +998,20 @@ the Go toolchain, completing the production-kernel coverage.
   extracts VEXTRACTI64X4/VEXTRACTF64X4, VFMADD231PD, VADDPD, VMULPD, the
   broadcasts VPBROADCASTD/Q (GPR and memory sources take different opcodes)
   and the mask moves KMOVW/KTESTW.  Masking/zeroing suffixes are out of scope
-  — the kernels use neither.
+ ; the kernels use neither.
 - `asm`: `AssembleFile` now accepts file-defined global (`non-<>`) symbols
   too; a reference is external only when no `GLOBL` in the file defines it.
 
 ### Fixed
 
-- `asm`: registers X16–Y31 force the EVEX encoding of dual-form mnemonics;
+- `asm`: registers X16-Y31 force the EVEX encoding of dual-form mnemonics;
   previously a `VPBROADCASTD AX, Y30` fell into the VEX encoder, which cannot
   represent indices above 15 and silently truncated them.
-- `asm`: the VEX encoder now rejects vector register indices 16–31 instead of
+- `asm`: the VEX encoder now rejects vector register indices 16-31 instead of
   encoding a truncated (wrong) register.
 
 
-## [0.4.0] — 2026-07-09
+## [0.4.0] - 2026-07-09
 
 The standalone assembler reaches the whole go-flac AVX2 kernel: static
 symbols assemble, and all 17 kernel functions now match the Go toolchain's
@@ -980,10 +1019,10 @@ machine code byte for byte.
 
 ### Added
 
-- `asm`: **file-level assembly** — `AssembleFile` turns a parsed file into an
+- `asm`: **file-level assembly**; `AssembleFile` turns a parsed file into an
   `Image`: the function bodies in source order followed by a data section
   built from the file's `GLOBL`/`DATA` directives (each symbol 16-aligned).
-- `asm`: **static-symbol (`SB`) operands** — `mask<>(SB)` references encode as
+- `asm`: **static-symbol (`SB`) operands**; `mask<>(SB)` references encode as
   RIP-relative loads with a patched disp32, resolved against the image layout
   so the output is self-consistent and position-independent.  External
   (non-file-local) symbols are rejected with a clear error: they need
@@ -992,7 +1031,7 @@ machine code byte for byte.
   and writes the whole image (code + data) with `-o`.
 
 
-## [0.3.0] — 2026-07-08
+## [0.3.0] - 2026-07-08
 
 The assembler reaches byte-identical parity with the Go toolchain on the
 production go-flac AVX2 kernels: every one of the 15 kernel functions that
@@ -1002,18 +1041,18 @@ support).
 
 ### Added
 
-- `asm`: the scalar instruction families the kernels use — `CMOVcc` and
+- `asm`: the scalar instruction families the kernels use; `CMOVcc` and
   `SETcc` (conditions spelled exactly like the jumps), `LZCNT`/`TZCNT`
   (legacy `F3 0F BD/BC`), the sign/zero-extending moves (`MOVBLZX`, `MOVBQZX`,
   `MOVWLZX`, `MOVWQZX`, `MOVWLSX`, `MOVLQSX`), `CVTSL2SD`/`CVTSQ2SD` (the
   legacy SSE encoding, as the Go assembler emits it), the traditional
   three-operand `IMUL3{W,L,Q}`, and the variable-count vector shifts
-  (`VPSRLQ X0, Y8, Y8` — the count in an XMM register or memory takes the
+  (`VPSRLQ X0, Y8, Y8`; the count in an XMM register or memory takes the
   ordinary NDS form).
-- `asm`: **jump relaxation** — jumps start in the short (rel8) form and
+- `asm`: **jump relaxation**; jumps start in the short (rel8) form and
   expand to rel32 when the settled displacement does not fit, iterating the
   layout to a fixed point (CALL is always rel32).
-- `asm`: **jump-to-jump folding** — a conditional jump to a label whose only
+- `asm`: **jump-to-jump folding**; a conditional jump to a label whose only
   instruction is an unconditional jump is redirected to the ultimate
   target, replicating the Go toolchain's linker, which chases such chains
   before it encodes branches.
@@ -1025,12 +1064,12 @@ support).
 - `asm`: `CMP` with a register or memory operand computed **second − first**
   instead of first − second, silently inverting every condition that followed
   (`CMPQ SI, R10; JGE` tested R10 ≥ SI).  The encoding now always records
-  first − second — `CMP r/m, r` with the first operand in r/m, `CMP r, r/m`
-  with the first operand in reg — and is byte-identical to the Go assembler.
+  first − second; `CMP r/m, r` with the first operand in r/m, `CMP r, r/m`
+  with the first operand in reg; and is byte-identical to the Go assembler.
 - `asm`: register-to-register `MOV` now uses the `r/m ← r` opcode (reg =
   source), the Go assembler's choice; the output is byte-identical.
 
-## [0.2.0] — 2026-07-07
+## [0.2.0] - 2026-07-07
 
 The Phase 2 assembler grows the SIMD set: shuffles, extract/insert, permute
 and the moves, on top of the Phase 1 VEX forms.
@@ -1043,10 +1082,10 @@ and the moves, on top of the Phase 1 VEX forms.
   - the immediate shuffle (`VPSHUFD`, `VPERMQ`),
   - the three-operand-plus-immediate form (`VSHUFPD`, `VPERM2I128`,
     `VINSERTI128`),
-  - the lane extract (`VEXTRACTI128`, `VEXTRACTF128` — the YMM source occupies
+  - the lane extract (`VEXTRACTI128`, `VEXTRACTF128`; the YMM source occupies
     the ModRM.reg field, the XMM/memory destination the r/m field),
   - the direction-sensitive moves (`VMOVDQU`, `VMOVUPD`, `VMOVD`, `VMOVQ`,
-    `VMOVSD` — each direction picks its own opcode and VEX.W; a vector→vector
+    `VMOVSD`; each direction picks its own opcode and VEX.W; a vector→vector
     move uses the store-form layout, matching the Go assembler),
   - the no-operand `VZEROUPPER`, and `VPERMD` in the NDS form,
   - the floating-point and FMA set (`VADDPD`, `VMULPD`, `VXORPD`,
@@ -1055,21 +1094,21 @@ and the moves, on top of the Phase 1 VEX forms.
   the encoder now covers every integer, shuffle and FP instruction the
   go-flac AVX2 kernels use.
 - `asm`: `CMP` accepts the immediate in the second operand position
-  (`CMPL CX, $31`) — the spelling the Go assembler accepts — encoding it
+  (`CMPL CX, $31`), the spelling the Go assembler accepts, encoding it
   identically to the immediate-first form.
 
 ### Fixed
 
 - `asm`: an unused VEX.vvvv field is now stored as `1111` (v̄vvv = 1111), as
-  the hardware requires — the previous value (`0000`) made the two-operand
+  the hardware requires; the previous value (`0000`) made the two-operand
   reg/rm forms (VPMOVSXWD, VPBROADCASTD, VMOVMSKPS, …) raise #UD on real CPUs
   and differ from the Go assembler's bytes.  The round-trip decoder ignores
   the field on these instructions, which is why the byte-for-byte Go
   comparison (added this release) is now part of the test suite.
 
-## [0.1.0] — 2026-07-06
+## [0.1.0] - 2026-07-06
 
-Initial release — the Phase 1 foundation.
+Initial release; the Phase 1 foundation.
 
 ### Added
 
@@ -1082,11 +1121,11 @@ Initial release — the Phase 1 foundation.
 - `arch`: register files and **complete** instruction tables for amd64,
   arm64, riscv64 and loong64, with the middle-dot symbol separator and static
   (`<>`) symbols.  Instruction names are generated from the Go toolchain's own
-  assembler source (`just gen`) — the `anames` opcode lists plus the common
+  assembler source (`just gen`); the `anames` opcode lists plus the common
   opcodes and the per-architecture front-end aliases (arm64 `B`/`BL`, the
   `.P`/`.W` addressing suffixes, loong64 `JAL`, the x86 conditional-jump
-  spellings) — so every mnemonic the real assembler accepts is recognised.
-- `lint`: conservative rules — `unknown-instruction`, `operand-count`,
+  spellings); so every mnemonic the real assembler accepts is recognised.
+- `lint`: conservative rules; `unknown-instruction`, `operand-count`,
   `undefined-label`, `duplicate-label`, `missing-ret`,
   `missing-textflag-include`, `abi-argsize` and `unreachable-code`.  Macro
   invocations are recognised (in-file `#define` names and underscore
@@ -1108,9 +1147,9 @@ Initial release — the Phase 1 foundation.
 - `lsp`: a Language Server Protocol server over stdio providing completion,
   hover documentation, document symbols, publish-diagnostics and semantic-token
   highlighting.
-- `asm`: a standalone amd64 (x86-64) assembler — an instruction encoder (REX/
+- `asm`: a standalone amd64 (x86-64) assembler; an instruction encoder (REX/
   ModR-M/SIB/displacement/immediate plus the scalar instruction set, and VEX/
-  AVX2 SIMD across three operand forms — NDS, reg/rm and immediate-shift —
+  AVX2 SIMD across the three operand forms NDS, reg/rm and immediate-shift,
   covering the bulk of the integer SIMD set) validated by round-trip decoding
   against `golang.org/x/arch`, and an assembler that drives the parser's AST
   into the encoder with local-label resolution and `FP`/`SP` frame mapping

CONTRIBUTING.md

@@ -1,107 +1,127 @@
-# Contributing to gasm-devkit
+# Contributing
 
-Thanks for contributing to gasm-devkit.
+Contributions to **gasm-devkit** are governed by the Contributor terms
+below; submitting one means you accept them.
+
+## Contributor terms
+
+1. This project belongs to its owner alone. The owner decides what is
+   accepted, in what form and when; the decision is final and needs no
+   justification.
+2. By submitting a contribution you assign to Petr Balvín
+   <opensource@petrbalvin.org> all present and future copyright and
+   related rights in it, worldwide, for the full term of the rights,
+   with the right to relicense and sublicense without restriction,
+   including under proprietary terms.
+3. Where that assignment is not effective, it counts as a perpetual,
+   irrevocable, royalty-free licence with the same scope.
+4. To the fullest extent permitted by law, you waive any right of
+   attribution and integrity in the contribution. The project names no
+   contributors and keeps no credits list.
+5. By submitting you represent that the work is yours and that you
+   hold the rights to assign it as above.
 
 ## Development setup
 
-Requirements: Go 1.27 or later, the [just](https://github.com/casey/just)
-command runner, and a Linux host on amd64, arm64, riscv64 or loong64.
+Requirements: Go 1.27.1, the exact version the `go` directive in `go.mod`
+declares, and [just](https://github.com/casey/just) for the recipes.
 
 ```sh
 git clone https://sourcedock.dev/petrbalvin/gasm-devkit.git
 cd gasm-devkit
-just install        # download module dependencies
-just build          # go vet + gofmt check
-just test           # full suite, race detector, 80 % coverage gate
+just build
+just gates
 ```
 
 ## Workflow
 
-1. Branch from `development`; never commit directly to `main` (`main` is
-   release-only: merge from `development`, then tag).
-2. Commit with [Conventional Commits](https://www.conventionalcommits.org/):
-   `type(scope): description`: subject line only, imperative mood,
-   lowercase after the colon, no trailing dot.  Allowed types: `feat`,
-   `fix`, `docs`, `style`, `refactor`, `perf`, `test`, `chore`, `ci`,
-   `build`, `revert`.  The only line after the subject is the trailer:
-   `Assisted-by: <model-name>`.  No `Co-Authored-By`, no `Signed-off-by`,
-   no other trailers.
-3. Record every user-visible change in `CHANGELOG.md` under
-   `## [development]` (categories: Added, Changed, Fixed, Removed,
-   Security).
-4. Add or update tests; coverage must stay **at or above 80 %** (hard
-   gate, enforced by CI).
-5. Update the documentation when behaviour, flags or the public surface
-   change.
-6. Open a pull request against `development`.
+1. Branch from `development`. Never commit directly to `main`, which is release-only.
+2. Commit in [Conventional Commits](https://www.conventionalcommits.org/) form:
+   `type(scope): description`, subject line only, imperative mood, lowercase after the
+   colon, no trailing full stop. Allowed types: `feat`, `fix`, `docs`, `style`,
+   `refactor`, `perf`, `test`, `chore`, `ci`, `build`, `revert`.
+3. One logical change per commit. A refactor, a behaviour change and a formatting pass
+   are three commits, never one.
+4. Record every user-visible change in `CHANGELOG.md` under `## [development]`.
+5. Add or update tests. Coverage stays at 80 percent or more; it is a hard gate.
+6. Update the documentation when the public API, the configuration or the behaviour
+   changes.
+7. Open a pull request against `development`.
 
-Releases are cut by merging `development` into `main` and tagging `vX.Y.Z`;
-CI builds and publishes the binaries for all four architectures.
+Releases are cut by merging `development` into `main` and tagging `vX.Y.Z`. The release
+workflow builds the assets and publishes the release and its notes.
 
 ## Code style
 
-`gofmt` and `go vet` via `just fmt` / `just build`; both must pass with
-zero output; `go fix -diff ./...` must report nothing on touched packages.
+`gofmt` and `go vet` run through `just fmt` and `just vet`, with zero diff and zero
+warnings tolerated. `just gates` is the definition of done in one command, and the recipe
+file names what it contains. Errors are checked explicitly, wrapped as
+`fmt.Errorf("context: %w", err)`, and nothing panics outside `main`. The `golang`
+skill holds the rules the project follows; the recipe file holds the commands.
 
-- Standard library only in production code; `golang.org/x/arch` is used
-  in tests only (round-trip decoding) and is never linked into the `gasm`
-  binary.
-- No cgo, no C, no external toolchains at runtime.
-- Explicit `if err != nil`; errors wrapped with
-  `fmt.Errorf("context: %w", err)`; no panics outside `main`.
-- The parser, lexer and formatter are hand-written; the `arch` instruction
-  tables are generated only via `_gen/gen.go` (`just gen`), never edited.
+- `golang.org/x/arch` is the one module dependency, and it is linked into the binary:
+  `gasm dis` and the debugger's listings decode through it. Everything else is the
+  standard library.
+- No cgo, no C, no external toolchain at runtime.
+- The parser, lexer and formatter are hand-written; the `arch` instruction tables are
+  generated only by `_gen/gen.go` (`just gen`) and never edited by hand.
+- Assembly committed to the repository goes through `gasm fmt` and `gasm lint`, so a
+  `.s` file that `gasm fmt -l .` lists is unfinished.
 
-## Running a single test
+New source files open with the project's two-line licence header, whose SPDX
+identifier matches `LICENSE`. Configuration files, workflows and dotfiles do not carry
+it.
 
-```sh
-go test -run TestVexGroundTruth ./asm/
-go test -run TestGroundTruthBasic ./verify/
-go test -run TestGOObjectLinkAndRun ./asm/
-go test -run TestFuzzWideCopy ./verify/
-```
+## AI contribution policy
 
-The interactive debugger (`gasm debug`) requires a compiled binary on
-`$PATH`; `go run` does not work for the traced child process.  Install
-first with `just install-bin`.
+AI tools are welcome as productivity aids and are a normal part of modern software
+development. What matters is that the contribution stays understandable, reviewable and
+genuinely useful.
 
-## CI (Gitea Actions)
+- **Disclose the assistance.** If AI helped draft any part of a commit, issue, pull
+  request or review, say so.
+- **Commit messages carry exactly one trailer**, as a git trailer on the line after a
+  blank line that closes the subject:
 
-Workflows live in `.gitea/workflows/` and run on self-hosted runners:
+  ```
+  Assisted-by: MODEL
+  ```
+
+  Name the model that did the work, spelled the way its maker spells it, for example
+  `GLM 5.3`, `DeepSeek V4.1 Flash` or `Qwen 3.8 Flash`. No `Co-Authored-By`, no `Signed-off-by`,
+  no other trailers, and no prose: the trailer is the disclosure.
+- **Issues and pull requests** attribute the assistance in a comment, for example
+  `_Assisted-by: GLM 5.3_`. It does not belong in the pull request description.
+- **Take responsibility.** You are accountable for the accuracy, completeness and
+  intent of everything you submit, whether or not AI produced it.
+- **Review before marking ready.** Read the diff carefully, run it locally, and add the
+  tests it needs. Do not mark a pull request ready until you can defend every change in
+  it.
+- **Quality over quantity.** Contributions that look like un-reviewed output, or whose
+  author cannot engage substantively during review, may be closed.
+- **Preferred models.** Prefer open-weight models with transparent training data and
+  minimal output filtering.
+
+AI assists. It does not replace judgement.
+
+## Continuous integration
+
+Workflows live in `.gitea/workflows/` and run on the project's own runners:
 
 | Workflow | Trigger | What it does |
-|----------|---------|--------------|
-| Test | push / PR to `development` | gofmt check, `go vet`, `go test -race`, 80 % coverage gate |
-| Release | tag `v*` | cross-compiles binaries for linux/{amd64,arm64,riscv64,loong64} and publishes the Gitea release |
+|---|---|---|
+| Test | push or pull request to `development` | build, format check, vet, modernisation, the test suite with the coverage floor |
+| Release | a `v*` tag | the same gates as Test, then the matrix build, the proven version and the release itself; the race detector runs locally in `just gates` before the tag is cut |
 
-The Definition of Done (`just build` + `just test` + `just fmt`) must
-still pass locally before pushing.
-
-## AI Contribution Policy
-
-AI tools are welcome as productivity aids.  What matters is that
-contributions remain understandable, reviewable, and genuinely useful.
-
-- **Disclose AI use.**  If you used AI to draft or generate any part of a
-  commit, issue, pull request, or code review, say so clearly.
-- **Commit messages:** end every commit with exactly one trailer:
-  `Assisted-by: <model-name>` (e.g. `Assisted-by: GLM 5.3`).
-- **Pull requests and issues:** attribute AI assistance in one trailing
-  line, e.g. `_Assisted-by: GLM 5.3_`.  Do not paste it into the PR
-  description as a section.
-- **Take responsibility.**  You remain accountable for the accuracy,
-  completeness, and intent of everything you submit.
-- **Review before marking ready.**  Read AI-generated diffs carefully, run
-  them locally, and add or update tests where appropriate.
-- **Preferred models.**  Prefer open-weight models with transparent
-  training data: **GLM**, **DeepSeek**, and **MiMo**.
+The local equivalent is `just gates`, which is the same set plus the race detector. The
+race detector also has its own workflow, dispatched by hand; it never runs on a push or a
+tag, where it would double the time and the memory a shared runner cannot spare.
 
 ## Reporting bugs
 
-Open an issue at
-[sourcedock.dev/petrbalvin/gasm-devkit](https://sourcedock.dev/petrbalvin/gasm-devkit/issues)
-with the version (`gasm --version`), OS and architecture, the exact
-command, the full output, and the expected versus actual behaviour.
+Open an issue at `https://sourcedock.dev/petrbalvin/gasm-devkit/issues` with the
+version, the operating system and architecture, the exact command, the full output,
+and the expected against the actual behaviour.
 
-**Security issues:** email **opensource@petrbalvin.org** instead of opening
-a public issue.
+**Security issues do not go in the issue tracker.** Report them as
+[SECURITY.md](SECURITY.md) describes, to **opensource@petrbalvin.org**.

README.md

@@ -72,18 +72,21 @@ has no runtime dependency on the toolchain.
 Prebuilt binaries for linux/amd64, linux/arm64, linux/riscv64 and
 linux/loong64 are on the
 [releases page](https://sourcedock.dev/petrbalvin/gasm-devkit/releases).
-From source (Go 1.27 or later):
+From source (Go 1.27.1):
 
 ```sh
 go install sourcedock.dev/petrbalvin/gasm-devkit/cmd/gasm@latest
 ```
 
-Or from a repository checkout, with the development version stamped:
+Or from a repository checkout:
 
 ```sh
-just install-bin
+just install
 ```
 
+The installed binary reports the version the toolchain recorded: the tag
+on a tagged checkout, a pseudo-version naming the commit below one.
+
 ## Quick start
 
 ```sh
@@ -142,9 +145,9 @@ infers the target architecture from the file-name suffix
 ## Development
 
 ```sh
-just install      # download module dependencies
-just build        # go vet + gofmt check, zero errors and zero warnings
-just test         # full suite, race detector, 80 % coverage gate
+just build        # compile, zero errors and zero warnings
+just test         # the suite, no cache, the 80 % coverage floor
+just gates        # build, fmt-check, vet, test, race: the definition of done
 just fmt          # gofmt the tree
 just gen          # regenerate the instruction tables from the Go toolchain
 ```
@@ -158,11 +161,10 @@ recipe.
 - [docs/ARCHITECTURE.md](docs/ARCHITECTURE.md): components and data flow
 - [docs/CLI.md](docs/CLI.md): full command reference
 - [docs/DEVELOPMENT.md](docs/DEVELOPMENT.md): development setup and recipes
-- [docs/DECISIONS.md](docs/DECISIONS.md): deferred design decisions
 - [CHANGELOG.md](CHANGELOG.md): release history
 
 ## Licence
 
-BSD-3-Clause — see [LICENSE](LICENSE).
+BSD-3-Clause; see [LICENSE](LICENSE).
 
 Copyright © 2026 [Petr Balvín](https://petrbalvin.org)

SECURITY.md

@@ -0,0 +1,40 @@
+# Security policy
+
+## Supported versions
+
+Security fixes go to the newest release and to the `development` branch. Older
+releases do not receive them.
+
+| Version | Supported |
+|---|---|
+| 0.33.0 | yes |
+| older releases | no |
+
+## Reporting a vulnerability
+
+**Do not open a public issue for a security problem.** A public report tells everyone
+about the flaw before there is a fix. Report it privately to
+**opensource@petrbalvin.org**.
+
+Include:
+
+- the version or commit you tested, and the platform
+- what the problem is, and what an attacker gains from it
+- the smallest reproducer you have, ideally a test or a single command
+- a suggested fix, if you have one
+
+## What to expect
+
+- A human reads the report, and you get an acknowledgement.
+- You are kept informed while the fix is being made, and told when it ships.
+- The fix is released before the details are published, and the timing is agreed with
+  you.
+- The reporter is credited in the release notes unless they ask otherwise.
+
+## Out of scope
+
+- Findings that require the attacker to already run code as the user, or to have local
+  access.
+- Missing hardening with no demonstrated impact.
+- Flaws in a third-party dependency: report them to that project, and to this one only
+  when this project's use of it makes them reachable.

asm/assemble_test.go

@@ -202,8 +202,8 @@ TEXT ·withframe(SB), NOSPLIT, $16-16
 }
 
 // TestAssembleVexKernel assembles the horizontal-sum reduction the go-flac
-// kernels end with — exercising the VEX moves, shuffle and extract forms
-// through the full parser → encoder path — and checks the output is
+// kernels end with; exercising the VEX moves, shuffle and extract forms
+// through the full parser → encoder path; and checks the output is
 // byte-identical to the Go assembler's.
 func TestAssembleVexKernel(t *testing.T) {
 	fn := firstText(t, `

asm/elf_test.go

@@ -52,7 +52,7 @@ func elfTestImage(t *testing.T) *Image {
 }
 
 // TestAssembleFileExternals checks that a reference to a symbol no GLOBL
-// defines is recorded as an external relocation instead of failing — the
+// defines is recorded as an external relocation instead of failing; the
 // raw image leaves the displacement zero, the object emitters carry it.
 func TestAssembleFileExternals(t *testing.T) {
 	img := elfTestImage(t)

asm/encode_test.go

@@ -230,7 +230,7 @@ func TestSSEMoveGroundTruth(t *testing.T) {
 // TestGoFlacScalarTail encodes the scalar tail of an analyze kernel to confirm
 // the encoder handles a realistic instruction sequence.
 func TestGoFlacScalarTail(t *testing.T) {
-	// MOVQ swin_base+0(FP), SI — modelled as MOVQ disp(reg), reg.
+	// MOVQ swin_base+0(FP), SI; modelled as MOVQ disp(reg), reg.
 	checkSyntax(t, "mov rsi, qword ptr [rax+0x10]", "MOVQ", Ptr(AX, 0x10, 8), SI)
 	checkSyntax(t, "lea r9, ptr [rsi+4*rbx]", "LEAQ", Idx(SI, BX, 4, 0, 8), Reg{idx: 9, size: 8})
 	checkSyntax(t, "and r10, -0x8", "ANDQ", Imm(-8), Reg{idx: 10, size: 8})
@@ -421,7 +421,7 @@ func TestSSEShuffleGroundTruth(t *testing.T) {
 }
 
 // TestMOVQXMMGroundTruth pins the SSE2 packed-quadword move encodings:
-// loads and register moves on F3 0F 7E, stores on 66 0F D6 — the forms
+// loads and register moves on F3 0F 7E, stores on 66 0F D6; the forms
 // the GPR-move fallback silently corrupted.
 func TestMOVQXMMGroundTruth(t *testing.T) {
 	cases := []struct {

asm/evex_test.go

@@ -16,7 +16,7 @@ import (
 // kernels use: NDS arithmetic, immediate and variable shifts, shuffles with
 // an immediate, lane extracts, narrowing stores, broadcasts from a GPR or
 // memory, mask destinations, mask moves, disp8×N compression and the 5-bit
-// register fields (X/Y 16–31, Z 0–31).
+// register fields (X/Y 16-31, Z 0-31).
 func TestEvexGroundTruth(t *testing.T) {
 	cases := []struct {
 		name string
@@ -58,7 +58,7 @@ func TestEvexGroundTruth(t *testing.T) {
 		{"VMOVDQU32 16(SI)(R15*4),Z4", "VMOVDQU32", []Operand{Idx(SI, vreg(t, "R15"), 4, 16, 64), vreg(t, "Z4")}, "62b17e486fa4be10000000"},
 		{"VMOVDQU32 Z0,4(SI)(AX*1)", "VMOVDQU32", []Operand{vreg(t, "Z0"), Idx(SI, AX, 1, 4, 64)}, "62f17e487f840604000000"},
 		{"VMOVDQU32 Z3,(DI)(R15*4)", "VMOVDQU32", []Operand{vreg(t, "Z3"), Idx(DI, vreg(t, "R15"), 4, 0, 64)}, "62b17e487f1cbf"},
-		// VMOVDQU64 — the W1 qword variant.
+		// VMOVDQU64; the W1 qword variant.
 		{"VMOVDQU64 (SI)(R15*4),Z3", "VMOVDQU64", []Operand{Idx(SI, vreg(t, "R15"), 4, 0, 64), vreg(t, "Z3")}, "62b1fe486f1cbe"},
 		{"VMOVDQU64 Z0,4(SI)(AX*1)", "VMOVDQU64", []Operand{vreg(t, "Z0"), Idx(SI, AX, 1, 4, 64)}, "62f1fe487f840604000000"},
 		{"VMOVDQU64 Z1,Z2", "VMOVDQU64", []Operand{vreg(t, "Z1"), vreg(t, "Z2")}, "62f1fe487fca"},
@@ -77,7 +77,7 @@ func TestEvexGroundTruth(t *testing.T) {
 		{"VPSHUFB Z1,Z2,Z3", "VPSHUFB", []Operand{vreg(t, "Z1"), vreg(t, "Z2"), vreg(t, "Z3")}, "62f26d4800d9"},
 		{"VMOVDQU8 Z1,Z2", "VMOVDQU8", []Operand{vreg(t, "Z1"), vreg(t, "Z2")}, "62f17f487fca"},
 		{"VMOVDQU16 Z1,Z2", "VMOVDQU16", []Operand{vreg(t, "Z1"), vreg(t, "Z2")}, "62f1ff487fca"},
-		// Indices 16–31: rm[4] rides in X̄ for register operands.
+		// Indices 16-31: rm[4] rides in X̄ for register operands.
 		{"VPSHUFD $1,X16,X17", "VPSHUFD", []Operand{Imm(1), vreg(t, "X16"), vreg(t, "X17")}, "62a17d0870c801"},
 		{"VMOVUPD (DI),Z14", "VMOVUPD", []Operand{Ptr(DI, 0, 64), vreg(t, "Z14")}, "6271fd481037"},
 		{"VMOVUPD 64(DI),Z14", "VMOVUPD", []Operand{Ptr(DI, 64, 64), vreg(t, "Z14")}, "6271fd48107701"},
@@ -96,7 +96,7 @@ func TestEvexGroundTruth(t *testing.T) {
 		{"VPBROADCASTD 4(SI),Z10", "VPBROADCASTD", []Operand{Ptr(SI, 4, 4), vreg(t, "Z10")}, "62727d48585601"},
 		{"VPBROADCASTQ R8,X31", "VPBROADCASTQ", []Operand{vreg(t, "R8"), vreg(t, "X31")}, "6242fd087cf8"},
 		{"VPBROADCASTQ AX,Z9", "VPBROADCASTQ", []Operand{AX, vreg(t, "Z9")}, "6272fd487cc8"},
-		// Register indices 16–31 exist only in EVEX encodings.
+		// Register indices 16-31 exist only in EVEX encodings.
 		{"VPBROADCASTD AX,Y30", "VPBROADCASTD", []Operand{AX, vreg(t, "Y30")}, "62627d287cf0"},
 		// Packed double arithmetic / unpack (EVEX forms carry W=1).
 		{"VSUBPD Z1,Z2,Z3", "VSUBPD", []Operand{vreg(t, "Z1"), vreg(t, "Z2"), vreg(t, "Z3")}, "62f1ed485cd9"},
@@ -107,7 +107,7 @@ func TestEvexGroundTruth(t *testing.T) {
 		{"VUNPCKHPD Z1,Z2,Z3", "VUNPCKHPD", []Operand{vreg(t, "Z1"), vreg(t, "Z2"), vreg(t, "Z3")}, "62f1ed4815d9"},
 		{"VSUBPD 64(AX),Z1,Z2", "VSUBPD", []Operand{Ptr(AX, 64, 64), vreg(t, "Z1"), vreg(t, "Z2")}, "62f1f5485c5001"},
 		{"VSUBPD Z17,Z18,Z19", "VSUBPD", []Operand{vreg(t, "Z17"), vreg(t, "Z18"), vreg(t, "Z19")}, "62a1ed405cd9"},
-		// VMOVDDUP — duplicate the low double; disp8×N = 64 at 512 bits, and
+		// VMOVDDUP; duplicate the low double; disp8×N = 64 at 512 bits, and
 		// X16/X17 force EVEX (the mod=11 rm[4] extension rides in X̄).
 		{"VMOVDDUP Z1,Z2", "VMOVDDUP", []Operand{vreg(t, "Z1"), vreg(t, "Z2")}, "62f1ff4812d1"},
 		{"VMOVDDUP 64(AX),Z1", "VMOVDDUP", []Operand{Ptr(AX, 64, 64), vreg(t, "Z1")}, "62f1ff48124801"},
@@ -150,7 +150,7 @@ func TestEvexGroundTruth(t *testing.T) {
 	}
 }
 
-// TestEvexMasking checks the AVX-512 mask operand (K1–K7, placed freely among
+// TestEvexMasking checks the AVX-512 mask operand (K1-K7, placed freely among
 // the operands) and the .Z zeroing suffix, byte for byte against the Go
 // assembler.
 func TestEvexMasking(t *testing.T) {
@@ -241,11 +241,11 @@ func TestEvexMasking(t *testing.T) {
 	}
 }
 
-// TestEvexExtendedGroundTruth covers the wider EVEX/AVX-512 set — ternary
+// TestEvexExtendedGroundTruth covers the wider EVEX/AVX-512 set; ternary
 // logic, lane shuffles/inserts/extracts, compares with a K destination,
 // permutes, the wider integer families, expand/compress, broadcasts,
 // rotates and word shifts, the opmask instructions, the EVEX suffixes
-// (rounding/SAE/broadcast) and the aligned/scalar moves — byte for byte
+// (rounding/SAE/broadcast) and the aligned/scalar moves; byte for byte
 // against the Go assembler.
 func TestEvexExtendedGroundTruth(t *testing.T) {
 	mem64 := func(base Reg) Operand { return Ptr(base, 0, 64) }
@@ -275,7 +275,7 @@ func TestEvexExtendedGroundTruth(t *testing.T) {
 		{"VMULPD.RZ_SAE.Z", "VMULPD.RZ_SAE.Z", []Operand{vreg(t, "Z1"), vreg(t, "Z2"), vreg(t, "K1"), vreg(t, "Z3")}, "62f1edf959d9"},
 		{"VMAXPD.SAE", "VMAXPD.SAE", []Operand{vreg(t, "Z1"), vreg(t, "Z2"), vreg(t, "Z3")}, "62f1ed585fd9"},
 		{"VADDPD.BCST", "VADDPD.BCST", []Operand{mem64(AX), vreg(t, "Z1"), vreg(t, "Z2")}, "62f1f5585810"},
-		// Packed single arithmetic (same opcodes, no mandatory prefix) —
+		// Packed single arithmetic (same opcodes, no mandatory prefix);
 		// ZMM, YMM and XMM widths, rounding and broadcast.
 		{"VADDPS", "VADDPS", []Operand{vreg(t, "Z1"), vreg(t, "Z2"), vreg(t, "Z3")}, "62f16c4858d9"},
 		{"VMULPS", "VMULPS", []Operand{vreg(t, "Y1"), vreg(t, "Y2"), vreg(t, "Y3")}, "c5ec59d9"},
@@ -399,8 +399,8 @@ func TestEvexExtendedGroundTruth(t *testing.T) {
 }
 
 // TestEvexHelperGroundTruth covers the floating-point helper and conversion
-// tail of the EVEX set — reciprocals, rsqrt, getexp/getmant, scalef,
-// rndscale, reduce, fixupimm, range, fpclass, the remaining conversions —
+// tail of the EVEX set; reciprocals, rsqrt, getexp/getmant, scalef,
+// rndscale, reduce, fixupimm, range, fpclass, the remaining conversions;
 // plus gather/scatter with VSIB addressing, byte for byte against the Go
 // assembler.
 func TestEvexHelperGroundTruth(t *testing.T) {
@@ -502,9 +502,9 @@ func TestEvexHelperGroundTruth(t *testing.T) {
 }
 
 // TestEvexGprGroundTruth covers the scalar conversions between vector and
-// general-purpose registers — the signed and truncated VCVT{,T}S{D,S}2SI
+// general-purpose registers; the signed and truncated VCVT{,T}S{D,S}2SI
 // forms (VEX and EVEX), the unsigned EVEX-only forms, and the GPR-to-vector
-// VCVTSI2*/VCVTUSI2* forms with the preserved vector source in vvvv — byte
+// VCVTSI2*/VCVTUSI2* forms with the preserved vector source in vvvv; byte
 // for byte against the Go assembler, including memory sources and extended
 // GPRs.
 func TestEvexGprGroundTruth(t *testing.T) {

asm/goobj_test.go

@@ -158,8 +158,8 @@ DATA mask<>+8(SB)/8, $0x800f0e0d0c0b0a09
 		t.Errorf("funcinfo bytes %x", fi)
 	}
 
-	// The pc-value tables of addq (non-package indices 0–3, so global
-	// indices 7–10): pcsp a flat zero over the whole function, pcinline a
+	// The pc-value tables of addq (non-package indices 0-3, so global
+	// indices 7-10): pcsp a flat zero over the whole function, pcinline a
 	// flat -1, both with the pc delta in MinLC (1) units.
 	pcsp := data[le.Uint32(didx[4*7:]):]
 	if got := pcsp[:3]; !bytes.Equal(got, []byte{0x02, 19, 0x00}) {
@@ -294,7 +294,7 @@ TEXT ·framed(SB), NOSPLIT, $8-0
 	}
 	for i := range wantPCs {
 		if pcs[i] != wantPCs[i] || vals[i] != wantVals[i] {
-			t.Errorf("pcsp[%d] = (%d,%d), want (%d,%d) — all: %v %v", i, pcs[i], vals[i], wantPCs[i], wantVals[i], pcs, vals)
+			t.Errorf("pcsp[%d] = (%d,%d), want (%d,%d); all: %v %v", i, pcs[i], vals[i], wantPCs[i], wantVals[i], pcs, vals)
 		}
 	}
 	// The last two steps unwind the epilogue to zero.
@@ -333,7 +333,7 @@ TEXT ·useext(SB), NOSPLIT, $0-8
 
 // TestGOObjectLinkAndRun is the end-to-end check: assemble the test
 // functions to a GOOBJ, swap it into a go build in place of the toolchain's
-// assembly object, link, and run — the output must match the baseline
+// assembly object, link, and run; the output must match the baseline
 // binary the Go assembler produced.  Skipped when no Go toolchain is
 // available.
 func TestGOObjectLinkAndRun(t *testing.T) {

asm/integration_test.go

@@ -19,8 +19,8 @@ import (
 	"sourcedock.dev/petrbalvin/gasm-devkit/parser"
 )
 
-// TestAssembleGoFlacAVX2Kernel assembles the whole production AVX2 kernel —
-// all functions plus the file-local mask24 constant — and checks that every
+// TestAssembleGoFlacAVX2Kernel assembles the whole production AVX2 kernel;
+// all functions plus the file-local mask24 constant; and checks that every
 // static-symbol load resolves to the right bytes in the image.
 func TestAssembleGoFlacAVX2Kernel(t *testing.T) {
 	path := "../../go-libraries/go-flac/avx2_amd64.s"
@@ -81,7 +81,7 @@ func TestAssembleGoFlacAVX2Kernel(t *testing.T) {
 }
 
 // TestAssembleGoFlacAVX512Kernel assembles the whole production AVX-512
-// kernel — all functions plus the file-global idx16 constant — and checks
+// kernel, all functions plus the file-global idx16 constant, and checks
 // that the static-symbol load resolves to the right bytes in the image.
 func TestAssembleGoFlacAVX512Kernel(t *testing.T) {
 	path := "../../go-libraries/go-flac/avx512_amd64.s"

asm/l64_goobj_test.go

@@ -94,9 +94,9 @@ DATA ·table<>+0(SB)/8, $0x1122334455667788
 	}
 
 	// The debug_line program: LNE_set_address (the R_ADDR relocation
-	// carries the function address), then one row per line change — the
+	// carries the function address), then one row per line change; the
 	// TEXT is on line 4 (a leading blank line precedes the include), the
-	// instructions on lines 5–9 — an advance to the 20-byte end and an
+	// instructions on lines 5-9; an advance to the 20-byte end and an
 	// end-of-sequence.
 	linesOff := le.Uint32(dataIdx[4*2:])
 	lines := dataBlk[linesOff : linesOff+21]

asm/link_test.go

@@ -10,8 +10,8 @@ import (
 	"sourcedock.dev/petrbalvin/gasm-devkit/parser"
 )
 
-// TestAssembleFileStaticData checks the whole-image layout — code, padding
-// and the data section — and that the RIP-relative displacements of static
+// TestAssembleFileStaticData checks the whole-image layout; code, padding
+// and the data section; and that the RIP-relative displacements of static
 // symbol loads resolve to the right bytes.
 func TestAssembleFileStaticData(t *testing.T) {
 	f, errs := parser.Parse("d_amd64.s", `

asm/loong64_more_test.go

@@ -280,7 +280,7 @@ done:
 // TestLOONG64_pcsp checks the stack-adjustment table of a framed function:
 // the prologue raises the SP delta by autosize (in effect from the third
 // instruction) and the RET's epilogue restores it to zero, with the pc deltas
-// in MinLC (4) units — byte-identical to `go tool asm`.
+// in MinLC (4) units; byte-identical to `go tool asm`.
 func TestLOONG64_pcsp(t *testing.T) {
 	cases := []struct {
 		name string

asm/riscv_encode_test.go

@@ -289,7 +289,7 @@ TEXT ·cmp(SB), NOSPLIT, $0
 }
 
 func TestRISCV_forwardBranch(t *testing.T) {
-	// Forward label reference — must not fail.
+	// Forward label reference; must not fail.
 	fn := firstTextRISCV(t, `#include "textflag.h"
 TEXT ·fwd(SB), NOSPLIT, $0
 	ADDI $1, X10, X10

asm/vex_test.go

@@ -173,7 +173,7 @@ func TestVexGroundTruth(t *testing.T) {
 		{"VPMULLD Y1,Y2,Y3", "VPMULLD", []Operand{vreg(t, "Y1"), vreg(t, "Y2"), vreg(t, "Y3")}, "c4e26d40d9", ""},
 		{"VPUNPCKLDQ Y4,Y3,Y5", "VPUNPCKLDQ", []Operand{vreg(t, "Y4"), vreg(t, "Y3"), vreg(t, "Y5")}, "c5e562ec", ""},
 		{"VPERMD Y1,Y2,Y3", "VPERMD", []Operand{vreg(t, "Y1"), vreg(t, "Y2"), vreg(t, "Y3")}, "c4e26d36d9", ""},
-		// Floating point (packed and scalar) and FMA — same NDS form, the pp
+		// Floating point (packed and scalar) and FMA; same NDS form, the pp
 		// bits and map select the operation.
 		{"VADDPD Y9,Y8,Y8", "VADDPD", []Operand{vreg(t, "Y9"), vreg(t, "Y8"), vreg(t, "Y8")}, "c4413d58c1", ""},
 		{"VADDPD X1,X2,X3", "VADDPD", []Operand{vreg(t, "X1"), vreg(t, "X2"), vreg(t, "X3")}, "c5e958d9", ""},
@@ -217,7 +217,7 @@ func TestVexGroundTruth(t *testing.T) {
 		{"VEXTRACTI128 $1,Y8,X9", "VEXTRACTI128", []Operand{Imm(1), vreg(t, "Y8"), vreg(t, "X9")}, "c4437d39c101", ""},
 		{"VEXTRACTI128 $1,Y8,(DI)", "VEXTRACTI128", []Operand{Imm(1), vreg(t, "Y8"), Ptr(DI, 0, 16)}, "c4637d390701", ""},
 		{"VEXTRACTF128 $1,Y8,X9", "VEXTRACTF128", []Operand{Imm(1), vreg(t, "Y8"), vreg(t, "X9")}, "c4437d19c101", ""},
-		// Moves — each direction picks its own opcode and VEX.W.
+		// Moves; each direction picks its own opcode and VEX.W.
 		{"VMOVDQU (SI),Y1", "VMOVDQU", []Operand{Ptr(SI, 0, 32), vreg(t, "Y1")}, "c5fe6f0e", ""},
 		{"VMOVDQU Y3,(DI)", "VMOVDQU", []Operand{vreg(t, "Y3"), Ptr(DI, 0, 32)}, "c5fe7f1f", ""},
 		{"VMOVDQU X1,X2", "VMOVDQU", []Operand{vreg(t, "X1"), vreg(t, "X2")}, "c5fa7fca", ""},
@@ -234,7 +234,7 @@ func TestVexGroundTruth(t *testing.T) {
 		{"VMOVD AX,X0", "VMOVD", []Operand{AX, vreg(t, "X0")}, "c5f96ec0", ""},
 		{"VMOVSD (SI),X8", "VMOVSD", []Operand{Ptr(SI, 0, 8), vreg(t, "X8")}, "c57b1006", ""},
 		{"VMOVSD X8,(SI)", "VMOVSD", []Operand{vreg(t, "X8"), Ptr(SI, 0, 8)}, "c57b1106", ""},
-		// Packed double arithmetic and unpack — the NDS form, the opcode
+		// Packed double arithmetic and unpack; the NDS form, the opcode
 		// selects the operation.
 		{"VSUBPD Y1,Y2,Y3", "VSUBPD", []Operand{vreg(t, "Y1"), vreg(t, "Y2"), vreg(t, "Y3")}, "c5ed5cd9", ""},
 		{"VDIVPD X1,X2,X3", "VDIVPD", []Operand{vreg(t, "X1"), vreg(t, "X2"), vreg(t, "X3")}, "c5e95ed9", ""},
@@ -255,12 +255,12 @@ func TestVexGroundTruth(t *testing.T) {
 		{"VMINSS X6,X7,X8", "VMINSS", []Operand{vreg(t, "X6"), vreg(t, "X7"), vreg(t, "X8")}, "c5425dc6", ""},
 		{"VMAXSS X1,X2,X3", "VMAXSS", []Operand{vreg(t, "X1"), vreg(t, "X2"), vreg(t, "X3")}, "c5ea5fd9", ""},
 		{"VADDSD 8(AX),X1,X2", "VADDSD", []Operand{Ptr(AX, 8, 8), vreg(t, "X1"), vreg(t, "X2")}, "c5f3585008", ""},
-		// VMOVDDUP — duplicate the low double (reg=dst, rm=src, F2 pp).
+		// VMOVDDUP; duplicate the low double (reg=dst, rm=src, F2 pp).
 		{"VMOVDDUP X1,X2", "VMOVDDUP", []Operand{vreg(t, "X1"), vreg(t, "X2")}, "c5fb12d1", ""},
 		{"VMOVDDUP Y1,Y2", "VMOVDDUP", []Operand{vreg(t, "Y1"), vreg(t, "Y2")}, "c5ff12d1", ""},
 		{"VMOVDDUP 8(AX),X1", "VMOVDDUP", []Operand{Ptr(AX, 8, 8), vreg(t, "X1")}, "c5fb124808", ""},
 		// Conversions: DQ→PS (no prefix), PS→PD (Go emits it without the F3
-		// prefix — see the table comment), DQ→PD.
+		// prefix; see the table comment), DQ→PD.
 		{"VCVTDQ2PS X1,X2", "VCVTDQ2PS", []Operand{vreg(t, "X1"), vreg(t, "X2")}, "c5f85bd1", ""},
 		{"VCVTDQ2PS Y3,Y4", "VCVTDQ2PS", []Operand{vreg(t, "Y3"), vreg(t, "Y4")}, "c5fc5be3", ""},
 		{"VCVTPS2PD X1,X2", "VCVTPS2PD", []Operand{vreg(t, "X1"), vreg(t, "X2")}, "c5f85ad1", ""},

cmd/gasm/main.go

@@ -18,6 +18,7 @@ import (
 	"os/exec"
 	"path/filepath"
 	"runtime"
+	"runtime/debug"
 	"slices"
 	"sort"
 	"strconv"
@@ -36,9 +37,16 @@ import (
 	"sourcedock.dev/petrbalvin/gasm-devkit/verify"
 )
 
-// version is the release version, stamped at build time via
-// -ldflags "-X main.version=…" (defaulting to the current release).
-var version = "0.33.0"
+// version reports the release the toolchain recorded for this build: the
+// tag on a tag, a pseudo-version below one, and (devel) outside version
+// control. Nothing is injected; the recorded value cannot go stale.
+func version() string {
+	bi, ok := debug.ReadBuildInfo()
+	if !ok || bi.Main.Version == "" {
+		return "(devel)"
+	}
+	return bi.Main.Version
+}
 
 func main() {
 	if len(os.Args) < 2 {
@@ -88,13 +96,13 @@ func main() {
 	}
 }
 
-// cmdVersion prints the release version.
+// cmdVersion prints the recorded version.
 func cmdVersion() int {
-	fmt.Printf("gasm %s\n", version)
+	fmt.Printf("gasm %s\n", version())
 	return 0
 }
 
-// ANSI color helpers for terminal output.
+// ANSI colour helpers for terminal output.
 const (
 	colorReset  = "\033[0m"
 	colorBold   = "\033[1m"
@@ -103,7 +111,7 @@ const (
 	colorGray   = "\033[90m"
 )
 
-// isTTY reports whether the writer is a terminal (for color output).
+// isTTY reports whether the writer is a terminal (for colour output).
 func isTTY(w io.Writer) bool {
 	if f, ok := w.(*os.File); ok {
 		stat, _ := f.Stat()
@@ -119,7 +127,7 @@ func usage(w io.Writer) {
 		bold, cyan, yellow, gray, reset = colorBold, colorCyan, colorYellow, colorGray, colorReset
 	}
 
-	fmt.Fprintf(w, "%sgasm %s%s: developer tooling for Go's Plan 9 assembler (GAsm)%s\n\n", bold, version, reset, reset)
+	fmt.Fprintf(w, "%sgasm %s%s: developer tooling for Go's Plan 9 assembler (GAsm)%s\n\n", bold, version(), reset, reset)
 	fmt.Fprintf(w, "gasm bundles a lexer, parser, formatter, linter, standalone assembler and\n")
 	fmt.Fprintf(w, "language server for Plan 9 assembly into one self-contained binary.\n\n")
 
@@ -442,7 +450,7 @@ hover, document symbols, diagnostics and semantic-token highlighting.
 `)
 	fs.Parse(args)
 	srv := lsp.New(os.Stdin, os.Stdout)
-	srv.SetVersion(version)
+	srv.SetVersion(version())
 	if err := srv.Run(); err != nil {
 		fmt.Fprintln(os.Stderr, "gasm lsp:", err)
 		return 1

cmd/gasm/main_test.go

@@ -219,8 +219,9 @@ func TestCmdVersion(t *testing.T) {
 	if code != 0 {
 		t.Fatalf("code = %d", code)
 	}
-	if !strings.Contains(out, version) {
-		t.Errorf("version output %q does not mention %q", out, version)
+	got := version()
+	if !strings.Contains(out, got) {
+		t.Errorf("version output %q does not mention %q", out, got)
 	}
 }
 
@@ -274,7 +275,7 @@ func TestVerifySmokeCrashIsolation(t *testing.T) {
 	}
 	if exitErr, ok := err.(*exec.ExitError); ok {
 		if ws, ok := exitErr.Sys().(syscall.WaitStatus); ok && ws.Signaled() {
-			t.Fatalf("verify died from %v — the crash was not isolated:\n%s", ws.Signal(), out)
+			t.Fatalf("verify died from %v; the crash was not isolated:\n%s", ws.Signal(), out)
 		}
 	}
 	if !strings.Contains(string(out), "CRASH") {

docs/ARCHITECTURE.md

@@ -4,7 +4,9 @@ How gasm-devkit is put together and why.
 
 Repository: [sourcedock.dev/petrbalvin/gasm-devkit](https://sourcedock.dev/petrbalvin/gasm-devkit)
 
-## Design goals
+## Overview
+
+Three design goals shape everything below.
 
 1. **A real AST, not a grammar hack.**  The linter, analyser, assembler and
    language server all need to *reason* about assembly, not just colour it.
@@ -20,10 +22,10 @@ Repository: [sourcedock.dev/petrbalvin/gasm-devkit](https://sourcedock.dev/petrb
    through two vendor-neutral interfaces: a CLI and an LSP server.  No editor
    owns the toolkit; the toolkit is offered to editors on standard terms.
 
-## Pipeline
+The components, and how data moves between them:
 
 ```mermaid
-graph TD
+flowchart TD
     SRC["source .s"] --> LEX["lexer<br/>token stream"]
     LEX --> PAR["parser<br/>AST + diagnostics"]
     LEX --> FMT["format<br/>re-space tokens"]
@@ -42,9 +44,34 @@ graph TD
 
 The lexer is the shared foundation: the parser builds the AST from it, the
 formatter re-spaces its tokens directly, and the language server uses it for
-semantic highlighting.
+semantic highlighting.  The phases follow a dependency chain: Phase 1 (static
+analysis) builds only on the AST, Phase 2 (the standalone assembler) emits
+object code, and Phases 3 (dynamic analysis) and 4 (the debugger) both consume
+the execution substrate that the assembler provides.
 
-## Components
+## Packages
+
+| Package | Responsibility |
+|---|---|
+| `token` | token kinds and positions |
+| `lexer` | hand-written scanner; permissive, and it never panics |
+| `ast` | the typed syntax tree: declarations, lines, operands |
+| `parser` | line-oriented parser producing the AST and its diagnostics |
+| `arch` | register and instruction tables for the four architectures |
+| `lint` | static checks over the AST |
+| `format` | canonical formatter over the token stream |
+| `lsp` | the language server |
+| `asm` | standalone assembler: encoders, image layout, object emitters |
+| `verify` | JIT execution, ABI checks, differential fuzzing |
+| `debug` | interactive ptrace debugger |
+| `cmd/gasm` | the CLI |
+| `_gen` | rebuilds the `arch` tables from the Go toolchain source |
+
+The boundaries matter as much as the responsibilities: `ast` records syntax
+only, and whether a name is a register or a label is left to `arch`, so the
+parser stays architecture-agnostic.  `asm` and `verify` are the only packages
+that touch machine code and executable memory, and `cmd/gasm` owns no logic
+beyond flags and output.
 
 ### `token` and `lexer`
 
@@ -206,7 +233,7 @@ The standalone assembler (Phase 2).  Its core is an amd64 instruction encoder:
 a REX/ModR-M/SIB/displacement/immediate engine plus the scalar instruction set,
 with the Plan 9 operand order (source first) mapped onto the x86 encoding.
 Every encoding is validated by decoding it again with `golang.org/x/arch`, the
-one module dependency, used in tests only and never linked into the binary.
+one module dependency, which also backs the `gasm dis` listings.
 
 A **RISC-V encoder** (Phase 5, RV64IMAFDC + RVC compression) encodes the full
 integer, atomic, float/double, FMA and CSR instruction sets with the MOV
@@ -383,8 +410,8 @@ the Go ABI fixes across calls (amd64 `BP`/`R14`, arm64 `R29`/`R28`, riscv64
 raw return trampoline `leaveJITCheckedRaw` verifies them, restoring the
 saved registers before Go code resumes.  riscv64 is validated end to
 end under qemu-user emulation; arm64 shares the same stack convention and
-fix; loong64 stays ground-truth-only until hardware validation (see
-docs/DECISIONS.md).  `gasm verify` runs the JIT checks when the host
+fix; loong64 stays ground-truth-only until hardware validation.
+`gasm verify` runs the JIT checks when the host
 matches the kernel's architecture and the toolchain comparisons
 elsewhere.
 
@@ -436,14 +463,72 @@ watchdog is armed before the ptrace attach, so a sandboxed debuggee cannot
 block it), and `--cover` runs to completion with a breakpoint on every
 label and reports which blocks executed.
 
-## Extension points
+### Extending the toolkit
 
 - **New architecture:** add an entry to the generator in `_gen`, run
   `just gen`, and add a `buildXXX()` register file plus a case in `ForArch`.
 - **New lint rule:** add a function in `lint` and a rule-code constant.
 - **New LSP feature:** add a method case in `dispatch` and a handler.
 
-The phases follow a dependency chain.  Phase 1 (static analysis) builds only on
-the AST; Phase 2 (the standalone assembler) emits object code; Phases 3
-(dynamic analysis) and 4 (the debugger) both consume the execution substrate
-that the assembler provides.
+## Data flow
+
+The main operation, assembling one file:
+
+```mermaid
+sequenceDiagram
+    participant User
+    participant CLI as gasm CLI
+    participant Parser as parser
+    participant Asm as asm
+    participant Go as go toolchain
+    User->>CLI: gasm asm --format goobj -p pkg -o k.o k_amd64.s
+    CLI->>Parser: Parse(path, src)
+    Parser-->>CLI: AST, diagnostics
+    CLI->>Asm: AssembleFile(AST)
+    Asm->>Asm: encode operands, settle label offsets, lay out data
+    Asm-->>CLI: Image, code and data and relocations
+    CLI->>Asm: GOObject(pkg, path)
+    Asm->>Go: go list -json -export, externals only
+    Go-->>Asm: package and symbol indices
+    Asm-->>CLI: Go object bytes
+    CLI-->>User: wrote N bytes to k.o
+```
+
+Errors are produced where the parse or the encoding fails and become values at
+the CLI boundary: the parser returns a diagnostic list and never aborts a file,
+`AssembleFile` returns an error, and `cmd/gasm` prints what it has to stderr
+and returns a non-zero exit code.  The formatter and the linter take the same
+AST by a different route: `gasm fmt` re-spaces the token stream and `gasm lint`
+walks the parsed file, so neither depends on an encoding.
+
+## State and lifetime
+
+- The analysis packages (`lexer`, `parser`, `format`, `lint`, `arch`) hold only
+  read-only lookup tables and no mutable state: every call allocates its own
+  tokens and AST, and any number of goroutines may read the `arch` tables.
+- A `verify.Kernel` owns one executable mapping, which `Close` releases.  The
+  JIT trampolines keep the Go stack pointer and the checked-call sentinels in
+  package globals, so a call is a process-wide, one-at-a-time operation.  The
+  `gasm verify` sweeps therefore run each function in a child process, which
+  contains a crash and keeps the globals unshared.
+- `lsp.Server` is long-lived: it runs a single read and dispatch loop over the
+  stream and touches its document store only from that loop, so one server
+  serves one connection.
+- A `debug.Session` owns a traced child process and pins its goroutine to the
+  forking OS thread, because ptrace requests must stay on that thread.
+
+## Dependencies
+
+- **`golang.org/x/arch`** (v0.30.0) is the one module dependency: it is the
+  disassembler backend (`gasm dis` and the debugger's listings) and the source
+  of the register metadata the encoder consults (`asm/reg.go`, `asm/vex.go`).
+  The tests additionally decode through it to validate the encodings.
+- **The Go toolchain**, as an oracle and never as a library: `go tool asm`
+  supplies the object preamble and the ground truth for `gasm verify
+  --ground-truth`, `go list -json -export` locates the archives of the packages
+  a GOOBJ object references, and `_gen` parses
+  `$GOROOT/src/cmd/internal/obj/<arch>/anames.go` to rebuild the tables.
+- **Linux process interfaces** for the dynamic work: `mmap` and `mprotect` for
+  the JIT mapping, ptrace with `/proc/pid/mem` for the debugger.  That is why
+  `verify` runs a JIT check only when the host architecture matches the
+  kernel's, and why `debug` is Linux-only.

docs/CLI.md

@@ -1,215 +1,440 @@
-# CLI Reference
+# Command line
 
-Repository: [sourcedock.dev/petrbalvin/gasm-devkit](https://sourcedock.dev/petrbalvin/gasm-devkit)
+The reference below is taken from the program's own `--help`. If the two disagree, the
+program is right and this file is a defect.
 
-`gasm` is a single binary with subcommands. Run `gasm --help` for an
-overview, or `gasm <command> -h` for a command's usage and flags.
+## Synopsis
 
-## Global Flags
+```sh
+gasm [global flags] <command> [command flags] [arguments]
+```
 
-| Flag | Description |
-|------|-------------|
-| `-h`, `--help` | Show help |
-| `-V`, `--version` | Print the version |
+## Commands
 
-## `gasm tokens <file>`
+| Command | Purpose |
+|---|---|
+| `tokens` | print the lexical token stream |
+| `parse` | parse a file and report syntax errors |
+| `fmt` | canonicalise the formatting of `.s` files |
+| `lint` | run the static checks |
+| `asm` | assemble `.s` files to machine code |
+| `dis` | disassemble machine code or an assembled file |
+| `verify` | JIT-assemble and run the dynamic checks |
+| `debug` | interactive source-level debugger |
+| `diff` | compare the machine code of two `.s` files |
+| `profile` | show the basic-block structure of the functions |
+| `audit-instructions` | diff the encoder against the toolchain's name table |
+| `scaffold` | generate a differential test skeleton for a kernel |
+| `lsp` | run the language server over stdio |
+| `version` | print the version |
 
-Print the lexical token stream of FILE: position, token kind, and text,
-one token per line. FILE may be `-` to read standard input.
+## tokens
 
-## `gasm parse <file>`
+```text
+Usage: gasm tokens <file>
+```
 
-Parse FILE and report syntax errors on stderr. On success, prints how
-many declarations and TEXT functions the file contains.
+Print the lexical token stream of FILE: position, token kind and text, one
+token per line. FILE may be `-` to read standard input.
 
-## `gasm fmt [-w|-l|-d] [path...]`
+```sh
+gasm tokens hello_amd64.s
+```
 
-Canonicalise the formatting of Plan 9 assembly sources: indentation,
-operand spacing, per-function mnemonic alignment, and blank-line layout.
+```text
+1:1	#	"#"
+1:2	IDENT	"include"
+1:10	STRING	"\"textflag.h\""
+```
 
-| Flag | Description |
-|------|-------------|
-| `-w` | Write result to the source file (default: print to stdout) |
-| `-l` | List files whose formatting differs, one per line; write nothing |
-| `-d` | Print a unified diff of the canonical formatting instead |
+## parse
 
-With no arguments, or with a directory argument, every `.s` file below
-it is reformatted in place and the names of changed files are listed
-(`go fmt` style). `.` and `_` directories are skipped.
+```text
+Usage: gasm parse <file>
+```
 
-## `gasm lint <file...>`
+Parse FILE and report syntax errors on stderr. On success, print how many
+declarations and TEXT functions the file contains.
 
-Run static checks and print diagnostics as
-`file:line:col: severity: message [code]`. Exit status is non-zero when
-an error-severity diagnostic is found.
+```sh
+gasm parse hello_amd64.s
+```
 
-| Flag | Description |
-|------|-------------|
-| `-disable` | Comma-separated rule codes to disable |
+```text
+hello_amd64.s: OK, 2 declarations, 1 functions
+```
+
+## fmt
+
+```text
+Usage: gasm fmt [-w|-l|-d] [path...]
+```
+
+| Flag | Default | Effect |
+|---|---|---|
+| `-w` | off | write the result back to the source file |
+| `-l` | off | list the files whose formatting differs; write nothing |
+| `-d` | off | print a unified diff of the canonical formatting instead |
+
+`-l` and `-d` are mutually exclusive. With no arguments, or with a directory
+argument, every `.s` file below it is reformatted in place and the names of the
+changed files are listed, the way `go fmt` does; `.` and `_` directories are
+skipped. Explicit file arguments print to stdout unless `-w` is given.
+
+```sh
+gasm fmt -l kernel_amd64.s
+```
+
+Empty output means every file is formatted, which is the shape a CI check
+wants; `-d` shows what would change:
+
+```sh
+gasm fmt -d ugly_amd64.s
+```
+
+```text
+--- ugly_amd64.s
++++ ugly_amd64.s
+@@ -2,8 +2,8 @@
+
+ // func add(a, b int) int
+ TEXT ·add(SB), NOSPLIT, $0-24
+-        MOVQ a+0(FP), AX
+-        ADDQ b+8(FP), AX
++	MOVQ a+0(FP), AX
++	ADDQ b+8(FP), AX
+```
+
+## lint
+
+```text
+Usage: gasm lint <file...>
+```
+
+| Flag | Default | Effect |
+|---|---|---|
+| `-disable` | empty | comma-separated rule codes to disable |
+
+Diagnostics are printed as `file:line:col: severity: message [code]`. The exit
+status is non-zero when an error-severity diagnostic is found; warnings (the
+register-clobber audit, for example) do not affect it.
 
 Rules: `unknown-instruction`, `operand-count`, `undefined-label`,
 `duplicate-label`, `missing-ret`, `missing-textflag-include`,
 `abi-argsize`, `unreachable-code`, `register-clobber`,
 `funcdata-pcdata`, `unused-label`, `invalid-textflag`,
 `stack-imbalance`, `register-width-mismatch`, `abi0-register-args`,
-`nonportable-register-name` and `unencodable-instruction`.
+`nonportable-register-name`, `unencodable-instruction` and
+`reserved-register-write`.
 
-## `gasm asm [--format raw|elf|goobj] [-p pkg] [-o out] <file>`
+```sh
+gasm lint kernel_amd64.s
+```
 
-Assemble FILE to machine code (amd64, arm64, riscv64, loong64).
+## asm
 
-| Flag | Description |
-|------|-------------|
-| `--format` | Output format: `raw` (default), `elf`, `goobj` |
-| `-p` | Package path (required for `--format goobj`) |
-| `-o` | Write output to file (default: hex dump to stdout) |
+```text
+Usage: gasm asm [--format raw|elf|goobj] [-p pkg] [-o out] <file>
+```
 
-## `gasm dis [-a arch] <file>`
+| Flag | Default | Effect |
+|---|---|---|
+| `-format` | `raw` | output format: `raw` (concatenated image), `elf` or `goobj` (Go object) |
+| `-p` | empty | package path for `--format goobj`, qualifying the exported symbols |
+| `-o` | empty | write the output to this file instead of a hex dump on stdout |
 
-Disassemble machine code to instruction text (via `golang.org/x/arch`).
+Supported architectures: amd64 (VEX/AVX2 and EVEX/AVX-512 included), arm64,
+riscv64 (RV64IMAFDC and RVC) and loong64, selected from the file's `_arch.s`
+suffix. `raw` concatenates the functions and the data section into one
+self-consistent image; `elf` emits a relocatable object that links with the
+system toolchain; `goobj` emits the Go toolchain's own object format, which
+`cmd/link` consumes directly.
 
-With a `.s` file, the file is assembled first and the listing follows the
-real layout: one block per `TEXT` function, local labels printed at their
-offsets.  The architecture comes from the file name suffix, or from `-a`.
-With any other file, or `-` for standard input, the bytes are
-disassembled linearly and `-a` selects the architecture (amd64, arm64,
-riscv64 or loong64).
+```sh
+gasm asm hello_amd64.s
+```
 
-| Flag | Description |
-|------|-------------|
-| `-a` | Architecture for raw input without a `_arch.s` name |
+```text
+add: 16 bytes
+  0000: 48 8b 44 24 08 48 03 44 24 10 48 89 44 24 18 c3
+```
 
-## `gasm verify [flags] <file.s>`
+## dis
 
-Assemble FILE, map it into executable memory, and run dynamic checks.
+```text
+Usage: gasm dis [-a arch] <file>
+```
 
-| Flag | Description |
-|------|-------------|
-| `--ground-truth` | Compare machine code byte-for-byte against `go tool asm` |
-| `--fuzz` | Differential fuzz: JIT both gasm and go-tool-asm, compare outputs |
-| `-n` | Fuzz iterations per function (default: 1000) |
-| `--abi` | Run ABI-checking calls (sentinel registers + red zone) |
-| `--abi-n` | Number of ABI check iterations with varied inputs (default: 100) |
-| `--profile` | List basic-block structure per function |
-| `--smoke` | Call each NOSPLIT function with zeroed args |
-| `--call <func>` | Invoke a single function with `--buf` instead of the sweeps |
-| `--buf <spec>` | Buffer spec for `--call`: `name:size:pattern[,name:size:pattern]` |
-| `--args <spec>` | Scalar args for `--call`: `name=value[,name=value]` (decimal or `0x` hex) |
-| `--repeat <n>` | Number of times to repeat a `--call` invocation (default: 1) |
-| `--save-corpus <dir>` | With `--fuzz`: write each failing input to DIR as replayable JSON |
-| `--replay <dir>` | Re-run saved corpus entries (JSON in DIR), one child process per entry |
+| Flag | Default | Effect |
+|---|---|---|
+| `-a` | empty | architecture for raw input without a `_arch.s` name |
 
-The `--fuzz` mode runs each function in a subprocess; a partial function
-(e.g. a decoder that faults on malformed input) is reported as
-`CRASH` without killing the parent. Use `--call` with `--buf` to invoke
-partial functions with valid data instead.
+With a `.s` file the file is assembled first and the listing follows the real
+layout: one block per `TEXT` function, local labels printed at their offsets.
+With any other file, or `-` for standard input, the bytes are disassembled
+linearly and `-a` selects the architecture (amd64, arm64, riscv64 or loong64).
 
-The `--call` mode parses the `// func` signature, allocates the requested
-buffers (`zero`, `ones`, `seq`, or a hex blob), builds the ABI0 argument
-block with buffer pointers/lengths/capacities at the matching parameter
-offsets, and prints the arg block before and after the call, showing
-return values and any output written to the buffers.  Scalar parameters
-are supplied with `--args` (decimal, or `0x` hex) at their ABI0 offsets.
+```sh
+gasm dis hello_amd64.s
+```
 
-The `--save-corpus` mode records the logical arguments (buffer contents and
-scalars, not raw pointers) of every failing fuzz input as JSON.  `--replay`
-rebuilds a live argument block from each entry and calls it in its own child
-process, reporting `OK`, `CRASH (reproduced)` or `FAIL` per entry and
-exiting non-zero when any entry fails.
+```text
+add: 16 bytes
+  0000: 48 8b 44 24 08   mov rax, qword ptr [rsp+0x8]
+  0005: 48 03 44 24 10   add rax, qword ptr [rsp+0x10]
+  000a: 48 89 44 24 18   mov qword ptr [rsp+0x18], rax
+  000f: c3               ret
+```
 
-## `gasm debug [--func <name>] [--buf spec] [--script file] <file.s>`
+## verify
 
-Interactive debugger for JIT-assembled functions (amd64, arm64, riscv64,
-loong64). Requires a compiled binary on `$PATH` (not `go run`).
+```text
+Usage: gasm verify [-smoke] [-abi] [-fuzz] [-ground-truth] [-profile] [-call] <file.s>
+```
 
-| Flag | Description |
-|------|-------------|
-| `--func` | Function to debug (required) |
-| `--buf` | Buffer spec: `name:size:pattern[,name:size:pattern]` |
-| `--args <file>` | File containing the ABI0 argument block |
-| `--script <file>` | Run REPL commands from a file (one per line) and exit; `-` reads stdin |
-| `--timeout <dur>` | Kill the debuggee after this duration (e.g. `30s`); for headless `--script` runs |
-| `--cover` | Run to completion with a breakpoint on every instruction; report which executed, how often, and which labels were reached |
+| Flag | Default | Effect |
+|---|---|---|
+| `--ground-truth` | off | compare the machine code byte-for-byte against `go tool asm` |
+| `--fuzz` | off | differential fuzz against the `go tool asm` build |
+| `-n` | 1000 | fuzz iterations per function |
+| `--abi` | off | ABI-checking calls: sentinel registers and a red-zone canary |
+| `--abi-n` | 100 | ABI check iterations with varied inputs |
+| `--profile` | off | list the basic-block structure per function |
+| `--smoke` | off | call each NOSPLIT function with zeroed arguments |
+| `--call` | empty | invoke a single function with `--buf` instead of the sweeps |
+| `--buf` | empty | buffer spec for `--call`: `name:size:pattern[,name:size:pattern]` |
+| `--args` | empty | scalar args for `--call`: `name=value[,name=value]` (decimal or `0x` hex) |
+| `--repeat` | 1 | number of times to repeat a `--call` invocation |
+| `--save-corpus` | empty | with `--fuzz`: write each failing input to this directory as replayable JSON |
+| `--replay` | empty | re-run saved corpus entries, one child process per entry |
+
+The JIT checks run when the host matches the file's architecture; the
+toolchain comparison works everywhere. `--fuzz`, `--smoke` and `--abi` run each
+function in its own child process, so a partial function that faults on random
+input is reported as `CRASH` instead of ending the sweep; `--call` with `--buf`
+invokes such a function with valid data. loong64 stays on the ground-truth path
+until hardware validation.
+
+```sh
+gasm verify --ground-truth hello_amd64.s
+```
+
+```text
+hello_amd64.s: 1 functions JIT-loaded
+  add: MATCH (16 bytes)
+ground truth: 1/1 functions byte-identical
+  add: 16 bytes, args=24, frame=0 NOSPLIT
+```
+
+```sh
+gasm verify --call add --args a=2,b=3 hello_amd64.s
+```
+
+```text
+add: 16 bytes, args=24
+  signature: func add(a int, b int) int
+  scalars:
+    a = 2
+    b = 3
+  args before: 02 00 00 00 00 00 00 00 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 (24 bytes)
+  args after:  02 00 00 00 00 00 00 00 03 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 (24 bytes)
+  call 1: OK
+```
+
+## debug
+
+```text
+Usage: gasm debug <file.s> --func <name>
+```
+
+| Flag | Default | Effect |
+|---|---|---|
+| `-func` | empty | the function to debug, required |
+| `-buf` | empty | buffer spec: `name:size:pattern[,name:size:pattern]` (zero, ones, seq or hex) |
+| `-args` | empty | file containing the ABI0 argument block |
+| `-script` | empty | run REPL commands from a file, one per line, and exit; `-` reads stdin |
+| `-timeout` | 0 | kill the debuggee after this duration, for headless `-script` runs |
+| `-cover` | off | run to completion with a breakpoint on every instruction and report which executed |
+
+The debugger spawns the debuggee from the `gasm` binary on `$PATH`, so install
+it first with `just install`; `go run` does not work for the traced child.
+Requires Linux (ptrace) and all four architectures are supported.
 
 REPL commands:
 
-| Command | Description |
-|---------|-------------|
-| `break <label\|addr> [if <reg> <op> <val>]` | Set a breakpoint, optionally conditional |
-| `delete <label\|addr>` | Remove a breakpoint |
-| `info break` | List all breakpoints |
-| `step [n]`, `s` | Single-step n instructions |
-| `next`, `n` | Step over CALL |
-| `finish`, `fin` | Run until the function returns |
-| `continue`, `c` | Run until breakpoint, watchpoint or exit |
-| `disas [n]`, `u` | Disassemble n instructions at PC |
-| `regs` | Print general-purpose + vector/FP registers |
-| `where` | Show source line and nearest label at PC |
-| `stack` | Show stack near RSP (return address + ABI0 args) |
-| `bt`, `backtrace` | Backtrace (current frame + return address) |
-| `x [addr] [len]` | Hex-dump memory |
-| `w <addr> <val...>` | Write bytes to memory |
-| `set <reg> <value>` | Set a register |
-| `watch <addr> [r\|w] [size]` | Set a hardware watchpoint (write by default) |
-| `unwatch [<slot>]` | Clear one or all watchpoints |
-| `labels`, `l` | List function labels and offsets |
-| `help`, `h`, `?` | Show command help |
-| `quit`, `q` | Kill the debuggee and exit |
+| Command | Effect |
+|---|---|
+| `break <label\|addr> [if <reg> <op> <val>]` | set a breakpoint, optionally conditional |
+| `delete <label\|addr>` | remove a breakpoint |
+| `info break` | list the breakpoints |
+| `step [n]`, `s` | single-step n instructions |
+| `next`, `n` | step over a CALL |
+| `finish`, `fin` | run until the function returns |
+| `continue`, `c` | run until a breakpoint, watchpoint or exit |
+| `disas [n]`, `u` | disassemble n instructions at the PC |
+| `regs` | print the general-purpose and vector/FP registers |
+| `where` | show the source line and the nearest label at the PC |
+| `stack` | show the stack near RSP, the return address and the ABI0 args |
+| `bt`, `backtrace` | backtrace: the current frame and the return address |
+| `x [addr] [len]` | hex-dump memory |
+| `w <addr> <val...>` | write bytes to memory |
+| `set <reg> <value>` | set a register |
+| `watch <addr> [r\|w] [size]` | set a hardware watchpoint, write by default |
+| `unwatch [<slot>]` | clear one watchpoint or all of them |
+| `labels`, `l` | list the function's labels and offsets |
+| `help`, `h`, `?` | show the command help |
+| `quit`, `q` | kill the debuggee and exit |
 
-## `gasm diff [--map old=new,...] <file1.s> <file2.s>`
+```sh
+gasm debug --func add --cover hello_amd64.s
+```
 
-Compare the machine code produced by assembling two files. Shows which
-functions differ and the first few differing bytes. Useful for verifying
-that two implementations produce identical code, or for tracking encoding
-changes between Go assembler versions.
+## diff
 
-| Flag | Description |
-|------|-------------|
-| `--map` | Comma-separated `old=new` pairs to match functions with different names |
+```text
+Usage: gasm diff <file1.s> <file2.s>
+```
 
-Without `--map`, functions are paired by exact name. With `--map`, a
-function named `old` in the first file is compared against the function
-named `new` in the second file (e.g. `--map wideCopyAVX2=wideCopyAVX512`
-pairs AVX2 and AVX-512 variants regardless of suffix).
+| Flag | Default | Effect |
+|---|---|---|
+| `-map` | empty | comma-separated `old=new` pairs to match functions with different names |
 
-## `gasm profile <file.s>`
+Functions are paired by exact name unless `--map` says otherwise, so
+`--map wideCopyAVX2=wideCopyAVX512` pairs two variants regardless of suffix.
+The exit status is non-zero when anything differs.
 
-Show the basic-block structure of functions in an assembly file. Lists
-each function's labels, their offsets, and the block boundaries. This is
-the static structure; for runtime execution counts, use `gasm verify
---fuzz` which exercises the code paths.
+```sh
+gasm diff hello_amd64.s hello_amd64.s
+```
 
-## `gasm audit-instructions [amd64|arm64|riscv64|loong64]`
+```text
+add: identical (16 bytes)
+all functions identical
+```
 
-Compare the gasm encoder for the given architecture (default amd64)
-against the installed `go tool asm` and print the diff: superset
-encodings (gasm-only spellings, shippable via `gasm asm --format goobj`),
-known-but-unencodable names (the encoder backlog) and go-only names
-(feature gaps). The Go side is probed black-box with a battery of operand
-shapes per mnemonic, so the audit tracks whatever toolchain
-`go env GOROOT` provides. On non-amd64 architectures the backlog is an
-over-approximation: a name counts as encodable only when a probe shape
-assembles cleanly, so a name whose real forms the battery misses lands
-in the backlog.
+## profile
 
-## `gasm scaffold differential <file.s>`
+```text
+Usage: gasm profile <file.s>
+```
 
-Print a differential test skeleton for every `// func` signature in
-FILE. The generated test seeds random states, drives the kernel and a
-portable reference (`<name>Portable`), and compares outputs
-byte-for-byte. Write the reference bodies, place the file in the
-kernel's package, and run it in CI.
+Show the basic-block structure of each function: its labels, their offsets and
+the block boundaries. This is the static structure; for runtime execution
+counts use `gasm debug --cover`, and for input coverage `gasm verify --fuzz`.
 
-## `gasm lsp`
+```sh
+gasm profile hello_amd64.s
+```
 
-Run the language server over standard input/output (JSON-RPC 2.0 with
-Content-Length framing). Point an LSP-capable editor at the binary and
-associate it with `.s` files. The target architecture is inferred from
-the file-name suffix (`_amd64.s`, `_arm64.s`, `_riscv64.s`,
-`_loong64.s`).
+```text
+add: 16 bytes, args=24, frame=0 NOSPLIT
+  basic blocks: 1
+```
 
-Provides: completion, hover, document symbols, push and pull
-diagnostics, semantic tokens, go-to-definition, find references, rename,
-document formatting, inlay hints, code actions, signature help, document
-highlights, workspace symbol search, #include document links, and
-folding ranges for function bodies.
+## audit-instructions
+
+```text
+Usage: gasm audit-instructions [amd64|arm64|riscv64|loong64]
+```
+
+Compare the gasm encoder for the given architecture (default amd64) against the
+installed `go tool asm` and print the diff: superset encodings (gasm-only
+spellings, shippable via `gasm asm --format goobj`), known-but-unencodable
+names (the encoder backlog) and go-only names (feature gaps). The Go side is
+probed black-box with a battery of operand shapes per mnemonic, so the audit
+tracks whatever toolchain `go env GOROOT` provides. On non-amd64
+architectures the backlog is an over-approximation: a name counts as encodable
+only when a probe shape assembles cleanly, so a name whose real forms the
+battery misses lands in the backlog.
+
+```sh
+gasm audit-instructions amd64
+```
+
+```text
+gasm table (amd64, families excluded): 1542 mnemonics
+gasm encodable: 580   go tool asm recognized: 1542
+shared: 580
+```
+
+## scaffold
+
+```text
+Usage: gasm scaffold differential <file.s>
+```
+
+Print a differential test skeleton for every `// func` signature in FILE. The
+generated test seeds random states, drives the kernel and a portable reference
+(`<name>Portable`), and compares the outputs byte-for-byte. Write the reference
+bodies, place the file in the kernel's package, and run it in CI.
+
+```sh
+gasm scaffold differential kernel_amd64.s > kernel_differential_test.go
+```
+
+## lsp
+
+```text
+Usage: gasm lsp
+```
+
+Run the language server over standard input/output, JSON-RPC 2.0 with
+`Content-Length` framing. Point an LSP-capable editor at the binary and
+associate it with `.s` files; the target architecture is inferred from the
+file-name suffix (`_amd64.s`, `_arm64.s`, `_riscv64.s`, `_loong64.s`).
+
+Provides: completion, hover, document symbols, push and pull diagnostics,
+semantic tokens, go-to-definition, find references, rename, document
+formatting, inlay hints, code actions, signature help, document highlights,
+workspace symbol search, #include document links, and folding ranges for
+function bodies. Definition, references and rename work across every open
+document.
+
+## version
+
+```text
+Usage: gasm version
+```
+
+Print the version the toolchain recorded for the build, the same string as
+`gasm --version`: the tag on a tagged checkout, a pseudo-version naming the
+commit below one, with `+dirty` appended on a dirty tree and `(devel)` outside
+version control.
+
+## Global flags
+
+| Flag | Default | Effect |
+|---|---|---|
+| `-h`, `--help` | off | print the usage |
+| `-V`, `--version` | off | print the version |
+
+## Exit codes
+
+| Code | Meaning |
+|---|---|
+| `0` | success |
+| `1` | a failure the program detected: a parse or assembly error, an error-severity lint diagnostic, a mismatch in `verify`, a file that cannot be read |
+| `2` | the arguments were wrong: a missing or extra argument, an unknown command or format, an invalid `--map` pair |
+
+## Examples
+
+Assemble a kernel, check it, and run it:
+
+```sh
+gasm lint kernel_amd64.s
+gasm fmt -l kernel_amd64.s
+gasm asm -o kernel.bin kernel_amd64.s
+gasm verify --ground-truth kernel_amd64.s
+```
+
+Link the kernel into a Go program through the toolchain's own object format:
+
+```sh
+gasm asm --format goobj -p example.com/kernel -o kernel.o kernel_amd64.s
+```
+
+Find which labels a failing kernel reaches, headlessly:
+
+```sh
+gasm debug --func decodeBlockAVX2 --cover --script cmds.txt --timeout 30s kernel_amd64.s
+```

docs/DECISIONS.md

@@ -1,111 +0,0 @@
-# Deferred decisions
-
-Design decisions deliberately postponed, with enough context to pick them up
-again without re-deriving the analysis.  Each entry records what is deferred,
-why, the options on the table, and the trigger that should reopen it.
-
----
-
-## GOOBJ external (cross-package) symbol references
-
-**Status:** resolved (v0.29.0+, 2026-08-07).
-
-**Approach taken.**  Instead of parsing the compiler's iexport data (which
-would have required either `golang.org/x/tools` or an in-house parser), the
-resolver reads the **GOOBJ data directly** from the target package's `.a`
-archive.  The `.a` file contains a `_go_.o` member whose GOOBJ s is the
-same one gasm writes; the parser reuses the same layout (`blkSymdef`,
-`blkNonpkgdef`, the string table), so no new dependency was needed.
-
-**How it works.**
-
-1. `go list -json -export <pkg>` finds the target package's `.a` file.
-2. `extractGOOBJ` reads the ar archive, finds the `_go_.o` member, skips
-   the `"go object …\n!\n"` preamble and parses the GOOBJ header.
-3. `goobjFile.symbols()` walks `blkSymdef` and `blkNonpkgdef` in definition
-   order (the same order the linker uses) to build the symbol-to-index
-   mapping.
-4. `resolveExternalSymbols` wires the resolved `{PkgIdx, SymIdx}` into the
-   GOOBJ emission.
-
-The resolver is invoked automatically when `img.Externals` is non-empty; it
-runs `go list` as a subprocess (consistent with `toolchainObjectPreamble`
-which already calls `go tool asm`).  All symbol data is cached per package
-for the lifetime of the GOOBJ emission.
-
-## 2026-08-30 non-amd64 JIT execution trampolines
-
-**Status:** resolved for riscv64 (validated end to end under qemu-user)
-and arm64 (fix in place, consistent with the observed frame convention);
-open for loong64 until hardware validation.
-
-**Root cause (found 2026-08-31).**  The trampolines advanced SP past the
-leave-address slot after loading it, while the assembled kernels read
-their first argument at SP+8 per the frame convention (the amd64 path
-already kept SP on that slot).  Removing the advance fixed riscv64
-immediately (plain and checked ABI tests pass under qemu-user); the
-arm64 kernel's pre-fix trace showed exactly the same SP+8 reading.  The
-apparent arm64/loong64 "crashes in the JIT" turned out to be dominated
-by an unrelated instability: the Go 1.26 and 1.27 runtimes crash under
-qemu-user arm64 emulation (GC worker start, identical signature with the
-JIT tests skipped, both qemu 7.2 and 10.2), and the Go loong64 runtime
-does not start at all.  `gasm verify` therefore keeps loong64 kernels on
-the ground-truth path until hardware validation; the GOARCH-guarded
-tests (`verify/jit_arch_test.go`, `verify/abi_arch_test.go`) are the
-hardware validation entry point.
-
-**State.**  The per-architecture trampolines compile for all targets, the
-kernels they execute are byte-for-byte correct against `go tool asm`, and
-under `qemu-aarch64` the arm64 kernel demonstrably executes and stores its
-result correctly.  The failure is on the return path into Go code: arm64
-and loong64 take a SIGSEGV after the kernel's RET (the Go-side unwind
-through `leaveJIT` and its interposed ABIInternal wrapper is the suspect),
-and riscv64 returns cleanly but with an untouched result area.  amd64 is
-unaffected (the checked trampoline saves and restores BP/R14 and the flow
-is validated end to end).
-
-**Evidence harness.**  `verify/jit_arch_test.go` (plain call) and
-`verify/abi_arch_test.go` (checked call) are GOARCH-guarded tests; build
-the test binary per target (`GOARCH=arm64 go test -c -o v.test ./verify/`)
-and run it under `qemu-aarch64-static` from the `verify/` directory.  A
-minimal reproducer pattern lives in the qemu exploration notes: verify
-loads, the kernel executes, the fault follows the return.
-
-**Fix direction.**  Compare the amd64 checked trampoline (GLOBL/DATA raw
-address, explicit SP/BP/R14 save-restore) against the arm64/riscv64/
-loong64 `leaveJIT` unwind, in particular the interaction with the
-ABIInternal wrapper that `reflect.ValueOf(leaveJIT).Pointer()` returns.
-The plain-call path (no sentinels) fails the same way, so the checked
-path is not the variable.
-
----
-
-## 2026-08-29 tooling round
-
-- `lint abi0-register-args`: flags kernels whose `// func` parameters are
-  never read from the FP frame.  Motivated by a real latent bug: kernels
-  reading arguments from registers pass every test while the autogenerated
-  `F.abi0` wrapper happens to leave the caller's register values intact, and
-  break on a toolchain upgrade.
-- `lint nonportable-register-name`: the RAX/EAX register spellings are a gasm
-  extension; go tool asm rejects them, so files using them only link through
-  the gasm goobj path.
-- `lint unencodable-instruction`: a mnemonic in the architecture table that
-  `asm.Encodable` rejects is flagged at edit time instead of failing at
-  assembly time.
-- `audit-instructions`: black-box diff of the encoder against go tool asm.
-  As of this round the tables fully overlap on names; the audit exists to
-  catch drift in both directions (future supersets and future gaps).
-- `scaffold differential`: generates the direct-call differential skeleton
-  (two independent seed sets, output and in-place buffer comparison) that a
-  pipeline-level fuzz can never replace.
-- `verify --args`: scalar arguments for `-call`, closing the repro gap where
-  only buffers could be supplied.
-- `debug --script/--timeout/--cover`: headless debugging with a watchdog
-  armed before the ptrace attach (untracing sandboxes hang the attach), and
-  label-level block coverage for the "did my test ever enter that branch"
-  question.
-- Superset policy remains: gasm may accept spellings and encodings go tool
-  asm lacks, but such kernels ship only via `gasm asm --format goobj`; the
-  audit reports the superset surface.  The register-alias superset is warned
-  about by lint because the default `go build` path cannot consume it.

docs/DEVELOPMENT.md

@@ -4,79 +4,80 @@ Repository: [sourcedock.dev/petrbalvin/gasm-devkit](https://sourcedock.dev/petrb
 
 ## Prerequisites
 
-- **Go** 1.27+ with `toolchain go1.27.0`
+- **Go** 1.27.1, the exact version the `go` directive in `go.mod` declares
 - **just**, the command runner; every task below is a just recipe
+- A Linux host on amd64, arm64, riscv64 or loong64: `gasm debug` needs ptrace
+  and the JIT checks of `gasm verify` need executable memory
 - No external dependencies beyond the Go toolchain
 
-## Quick Start
+## Setup
 
 ```sh
 git clone https://sourcedock.dev/petrbalvin/gasm-devkit.git
 cd gasm-devkit
-just install   # go mod download
-just build     # go vet + gofmt, must pass with zero output
-just test      # full suite, race detector, 80 % coverage gate
+just build     # compile bin/gasm, zero errors and zero warnings
+just gates     # build, fmt-check, vet, test, race: the definition of done
 ```
 
-## Just Recipes
+## Recipes
 
-### `just install`
+Every recipe in the `justfile`, and what it does.
 
-`go mod download`.  The only module dependency, `golang.org/x/arch`, is
-used in tests only.
-
-### `just build`
-
-Runs `go vet ./...` and checks `gofmt -l .` produces no output. This is
-the minimum bar before any commit.
+| Recipe | What it does |
+|---|---|
+| `just build` | compiles `bin/gasm` with `CGO_ENABLED=0` and stripped symbols; zero errors and zero warnings |
+| `just test` | the test gate: the suite with `-count=1`, the coverage profile and the 80 % floor |
+| `just race` | the same suite under the race detector; the expensive one, so it runs once, inside `gates` |
+| `just unit [packages] [run]` | fast, cached, scoped run for iterating: no race and no coverage, so an unchanged package reports instantly |
+| `just fuzz <target> <pkg> [fuzztime]` | time-boxed fuzz of one target; the package is required, because `go test -fuzz` refuses more than one |
+| `just bench [packages]` | benchmarks (`-benchmem -count=5`); on an idle machine only |
+| `just fmt` | formats the tree in place with `gofmt` |
+| `just fmt-check` | zero diff; prints nothing when everything is formatted, which is the shape the CI step wants |
+| `just vet` | both static gates: `go vet` and `go fix -diff` |
+| `just gates` | `build`, `fmt-check`, `vet`, `test` and `race`, in that order: the definition of done |
+| `just clean` | removes the build artefacts, `bin/` and `coverage.out` |
+| `just install` | builds, then copies the binary into `bindir` (`~/.local/bin`); `gasm debug` needs an installed binary, because it spawns the debuggee from `$PATH` |
+| `just uninstall` | removes the installed binary from `bindir` |
+| `just run` | runs the CLI with `go run -buildvcs=true`; the recipe takes no arguments, so flags go through the package instead |
+| `just dev` | the same as `run`; the project has no watcher to add |
+| `just gen` | regenerates the `arch` instruction tables from the Go toolchain source; not a gate |
 
 ### `just test`
 
 ```sh
-go test -race -count=1 ./...
+go test -count=1 -timeout 10m -coverprofile=coverage.out \
+    ./arch/... ./asm/... ./ast/... ./disasm/... ./format/... ./lexer/... \
+    ./lint/... ./lsp/... ./parser/... ./token/... ./verify/...
 ```
 
-Plus a coverage run over the ten analysable packages (arch, asm, ast,
-format, lexer, lint, lsp, parser, token, verify; `debug` and `cmd/gasm`
-need hardware or are CLI glue) and an `awk` gate that fails if total
-coverage is below 80 %.
+The suite runs over the logic packages (`-count=1`, so no cached pass
+counts): arch, asm, ast, disasm, format, lexer, lint, lsp, parser,
+token, verify. `debug` traces a live process and `cmd/gasm` is thin CLI
+glue, so both sit outside the sweep, and a thin `cmd/` in it would drag
+the coverage total under the floor. The floor fails if the total is
+below 80 %.  CI runs the same command with the same ten-minute bound, so
+the number is the same everywhere.
 
-### `just fmt`
+### `just run`
 
 ```sh
-gofmt -w .
+just run
+go run -buildvcs=true ./cmd/gasm lint kernel_amd64.s
+go run -buildvcs=true ./cmd/gasm verify --ground-truth kernel_amd64.s
 ```
 
-Run after editing any Go source. The output must be idempotent.
-
-### `just run -- <args>`
-
-Runs the CLI via `go run` with the version string stamped:
-
-```sh
-just run -- lint kernel_amd64.s
-just run -- fmt -w kernel_amd64.s
-just run -- verify --ground-truth kernel_amd64.s
-```
-
-### `just install-bin`
-
-Installs the `gasm` binary into `$GOBIN` with the release version
-embedded via `-ldflags "-X main.version=..."`.
+The flag on `go run` is there because it does not stamp the build otherwise,
+which `--version` would then report as `(devel)`.
 
 ### `just gen`
 
-Regenerates the architecture instruction tables in `arch/` by parsing
-the Go toolchain's own assembler source
+Regenerates the architecture instruction tables in `arch/` by parsing the Go
+toolchain's own assembler source
 (`$GOROOT/src/cmd/internal/obj/<arch>/anames.go`). Requires a Go
 installation. Output is committed, with no runtime dependency on the
 toolchain.
 
-### `just uninstall`
-
-Removes `coverage.out`, the `gasm` binary, and `*.test` artefacts.
-
-## Running Individual Tests
+## Running a single test
 
 ```sh
 go test -run TestVexGroundTruth ./asm/
@@ -85,32 +86,53 @@ go test -run TestGOObjectLinkAndRun ./asm/
 go test -run TestFuzzWideCopy ./verify/
 ```
 
-## Debugger Note
+Add `-v` for the sub-test names, and `-race` when the change touches
+concurrency. `-count=1` defeats the test cache when a result looks stale.
 
-`gasm debug` spawns a child process from the binary on `$PATH`. It does
-not work with `go run`; install first:
+## Coverage
 
 ```sh
-just install-bin
-gasm debug --func decodeBlockAVX2 path/to/kernel_amd64.s
+just test
+go tool cover -func=coverage.out
 ```
 
-## Project Layout
+The `total:` line is the number that matters, and it stays at 80 percent or
+more.
 
+## Debugging the build
+
+```sh
+go build -gcflags='-m' ./...    # inlining decisions
+go build -gcflags='-S' ./...    # what the compiler generated
+go tool asm -S kernel_amd64.s   # how the toolchain's assembler encodes a kernel
+gasm dis kernel_amd64.s         # what gasm makes of the same kernel
+gasm tokens kernel_amd64.s      # the token stream
+gasm profile kernel_amd64.s     # the basic blocks of each function
 ```
-cmd/gasm/           CLI entry point (subcommands)
-token/              Lexical token kinds and positions
-lexer/              Hand-written scanner
-ast/                Abstract syntax tree
-parser/             Line-oriented parser
-arch/               Register and instruction tables (generated)
-lint/               Static analysis rules
-format/             Canonical formatter
-lsp/                Language Server Protocol server
-asm/                Standalone assembler, encoder, object emitters
-verify/             JIT execution, differential testing, ABI checks
-debug/              Interactive ptrace debugger (all four architectures)
-_gen/               Instruction table generator
-testdata/           Test fixtures
-docs/               Architecture, development, CLI reference
-```
+
+`gasm verify --ground-truth` is the differential check that ties the two
+together: it compares gasm's bytes with `go tool asm`'s, with the relocation
+sites masked, so an encoding drift shows up as a byte difference rather than a
+crash later.
+
+## Continuous integration
+
+Workflows live in `.gitea/workflows/` and run on the project's own runners:
+Test on a push or pull request to `development`, race dispatched by hand, and
+the release on a `v*` tag.  They are written by hand rather than through
+`just`, but they enforce the same set of gates minus the race detector, which
+the shared runner cannot afford on a push; a green `just gates` locally is
+therefore the fastest way to a green pipeline.
+
+## Releases
+
+Releases are cut by merging `development` into `main` and tagging `vX.Y.Z`,
+which triggers the release workflow: it builds the portable Linux targets,
+takes the notes from the matching `CHANGELOG.md` section and uploads the
+assets.
+
+The version is never injected. `gasm --version` prints what the
+toolchain recorded in the build information: the tag on a tagged
+checkout, a pseudo-version naming the commit below one, `+dirty` on a
+dirty tree, and `(devel)` outside version control. There is no
+`-ldflags "-X"` anywhere and no version constant in the source.

format/format_test.go

@@ -39,7 +39,7 @@ func TestGolden(t *testing.T) {
 }
 
 // TestDocCommentIndent checks that a doc comment preceding a TEXT directive
-// sits at column 0 even when another function (ending in RET) precedes it —
+// sits at column 0 even when another function (ending in RET) precedes it;
 // the RET must terminate the previous body for indentation purposes.
 func TestDocCommentIndent(t *testing.T) {
 	in := "#include \"textflag.h\"\n" +

go.mod

@@ -1,7 +1,5 @@
 module sourcedock.dev/petrbalvin/gasm-devkit
 
-go 1.27
-
-toolchain go1.27.0
+go 1.27.1
 
 require golang.org/x/arch v0.30.0

justfile

@@ -1,58 +1,98 @@
-# Copyright (c) 2026 Petr Balvín <opensource@petrbalvin.org> (https://petrbalvin.org)
-# SPDX-License-Identifier: BSD-3-Clause
+# gasm-devkit.
+#
+# Replace gasm-devkit here and the values in the variable block. Everything below the block
+# is the standard set and is identical in every repository; see the `justfile` skill.
+binary := "gasm"
+package := "./cmd/gasm"
 
-# gasm-devkit — developer tooling for Go's Plan 9 assembler (GAsm).
+# What the test and bench recipes sweep. Scope this to the logic packages when a thin
+# cmd/ drags the coverage floor down, for example "./internal/... ./pkg/...". Never name
+# a directory the project does not have: a pattern that matches nothing is a setup
+# failure, not an empty run.
+packages := "./arch/... ./asm/... ./ast/... ./disasm/... ./format/... ./lexer/... ./lint/... ./lsp/... ./parser/... ./token/... ./verify/..."
 
-version := "0.33.0"
+bindir := env_var_or_default("BINDIR", env_var("HOME") / ".local" / "bin")
 
 default:
     @just --list
 
-# Download module dependencies.
-install:
-    go mod download
-
-# Vet + gofmt check — zero errors, zero warnings.
+# Compile. Zero errors, zero warnings.
 build:
-    go vet ./...
-    @test -z "$(gofmt -l .)" || { echo "gofmt diff:"; gofmt -l .; exit 1; }
+    CGO_ENABLED=0 go build -ldflags "-s -w" -o bin/{{binary}} {{package}}
 
-# Full test suite + race detector + 80 % coverage gate.
-# The coverage gate matches CI: it excludes packages that need hardware or
-# are CLI glue (debug, cmd/gasm), so the number is identical locally and in CI.
+# The test gate: the suite, no cache, the coverage floor.
 test:
-    go test -race -count=1 ./...
-    go test -count=1 -coverprofile=coverage.out \
-        sourcedock.dev/petrbalvin/gasm-devkit/arch \
-        sourcedock.dev/petrbalvin/gasm-devkit/asm \
-        sourcedock.dev/petrbalvin/gasm-devkit/ast \
-        sourcedock.dev/petrbalvin/gasm-devkit/format \
-        sourcedock.dev/petrbalvin/gasm-devkit/lexer \
-        sourcedock.dev/petrbalvin/gasm-devkit/lint \
-        sourcedock.dev/petrbalvin/gasm-devkit/lsp \
-        sourcedock.dev/petrbalvin/gasm-devkit/parser \
-        sourcedock.dev/petrbalvin/gasm-devkit/token \
-        sourcedock.dev/petrbalvin/gasm-devkit/verify
-    go tool cover -func=coverage.out | awk '/^total:/{gsub("%","",$3);if($3+0<80){print "coverage "$3"% < 80%";exit 1}print "coverage "$3"%"}'
+    #!/usr/bin/env perl
+    system(q{go}, q{test}, q{-count=1}, q{-timeout}, q{10m},
+      q{-coverprofile}, q{coverage.out}, qw({{packages}})) == 0
+      or die qq{the test suite failed\n};
+    open(my $c, q{-|}, q{go}, q{tool}, q{cover}, q{-func=coverage.out}) or die qq{cover: $!};
+    my $total;
+    while (my $l = <$c>) { $total = $1 if $l =~ m{^total:\s+\S+\s+([0-9.]+)%} }
+    close($c);
+    die qq{no total line in coverage.out\n} unless defined $total;
+    printf qq{Total coverage: %s%%\n}, $total;
+    exit($total < 80 ? 1 : 0);
 
-# Format all Go sources.
+# The same suite under the race detector. The expensive one.
+race:
+    go test -race -count=1 -timeout 10m {{packages}}
+
+# Fast scoped run for iterating. This is the one that runs after every edit.
+unit pkgs=packages run=".*":
+    go test {{pkgs}} -run '{{run}}'
+
+# Time-boxed fuzz of one target in one package. The package is required; never a gate.
+fuzz target pkg fuzztime="60s":
+    go test -run '^$' -fuzz '{{target}}' -fuzztime={{fuzztime}} {{pkg}}
+
+# Benchmarks. On an idle machine only.
+bench pkgs=packages:
+    go test -run '^$' -bench=. -benchmem -count=5 {{pkgs}}
+
+# Format in place.
 fmt:
     gofmt -w .
 
-# Run the gasm CLI (pass args after --, e.g. `just run -- lint file.s`).
-run *ARGS:
-    go run -ldflags "-X main.version={{version}}" ./cmd/gasm {{ARGS}}
+# Zero diff. Prints nothing when everything is formatted.
+fmt-check:
+    #!/usr/bin/env perl
+    open(my $g, q{-|}, q{gofmt}, q{-l}, q{.}) or die qq{gofmt: $!};
+    my @bad = <$g>;
+    close($g);
+    print @bad;
+    exit(@bad ? 1 : 0);
 
-# Install the gasm binary into $GOBIN (stamped with the release version).
-install-bin:
-    go install -ldflags "-X main.version={{version}}" ./cmd/gasm
+# Both static gates: go vet and go fix -diff.
+vet:
+    go vet ./...
+    go fix -diff ./...
 
-# Regenerate the architecture instruction tables from the Go toolchain source.
+# The definition of done, in one command. Once per task, never per edit.
+gates: build fmt-check vet test race
+
+# Build artefacts only, not the installed binary.
+clean:
+    rm -rf bin/ coverage.out
+
+# Build, then copy the binary into bindir.
+install: build
+    install -d "{{bindir}}"
+    install -m 755 bin/{{binary}} "{{bindir}}/{{binary}}"
+
+# Remove the installed binary.
+uninstall:
+    rm -f "{{bindir}}/{{binary}}"
+
+# Run the program. The flag is there because `go run` does not stamp the build otherwise.
+run:
+    go run -buildvcs=true {{package}}
+
+# Run with watch or hot reload, where the project has one.
+dev:
+    go run -buildvcs=true {{package}}
+
+# Regenerate the architecture instruction tables from the Go toolchain source. Not a gate.
 gen:
     go run _gen/gen.go
     gofmt -w arch/
-
-# Remove build artefacts.
-uninstall:
-    rm -f coverage.out gasm
-    find . -name '*.test' -delete

lint/corpus_test.go

@@ -20,7 +20,7 @@ import (
 // architecture's syntax (macros, addressing modes, branch aliases) against
 // production assembly.  It is skipped when the toolchain source is absent.
 //
-// The bar is zero parse errors and zero error-severity diagnostics — i.e. no
+// The bar is zero parse errors and zero error-severity diagnostics; i.e. no
 // false "unknown instruction" / "undefined label" findings on code the real
 // assembler accepts.  Advisory warnings are reported but not fatal, since they
 // are heuristics that may legitimately differ across Go versions.

lint/lint_test.go

@@ -48,7 +48,7 @@ func TestFixtureIsClean(t *testing.T) {
 		t.Fatalf("parse: %v", errs)
 	}
 	// The fixture mirrors the go-flac kernels, which write the Go ABI0
-	// scratch registers (BX, R13) without saving them — legal under Go's
+	// scratch registers (BX, R13) without saving them; legal under Go's
 	// stack-based ABI, so the register-clobber audit stays silent and the
 	// fixture must lint entirely clean.
 	diags := File(f, Config{Arch: arch.AMD64})
@@ -186,8 +186,8 @@ done:
 	}
 }
 
-// TestEvexMaskingRecognised checks that masked EVEX forms — the .Z suffix and
-// an explicit K operand — are recognised and exempt from operand-count
+// TestEvexMaskingRecognised checks that masked EVEX forms; the .Z suffix and
+// an explicit K operand; are recognised and exempt from operand-count
 // checks.
 func TestEvexMaskingRecognised(t *testing.T) {
 	diags := lintSrc(t, `
@@ -284,7 +284,7 @@ TEXT ·f(SB), NOSPLIT|NOFRAME|DUPOK, $0
 }
 
 func TestStackImbalance(t *testing.T) {
-	// Function with frame size 16 but only SUB 8, SP — imbalance.
+	// Function with frame size 16 but only SUB 8, SP; imbalance.
 	diags := lintSrc(t, `
 #include "textflag.h"
 TEXT ·f(SB), NOSPLIT, $16-0
@@ -297,7 +297,7 @@ TEXT ·f(SB), NOSPLIT, $16-0
 }
 
 func TestStackBalanced(t *testing.T) {
-	// Function with frame size 16 and matching SUB/ADD — balanced.
+	// Function with frame size 16 and matching SUB/ADD; balanced.
 	diags := lintSrc(t, `
 #include "textflag.h"
 TEXT ·f(SB), NOSPLIT, $16-0
@@ -311,7 +311,7 @@ TEXT ·f(SB), NOSPLIT, $16-0
 }
 
 func TestRegisterWidthMismatch(t *testing.T) {
-	// MOVQ with 32-bit register — mismatch.
+	// MOVQ with 32-bit register; mismatch.
 	diags := lintSrc(t, `
 #include "textflag.h"
 TEXT ·f(SB), NOSPLIT, $0
@@ -324,7 +324,7 @@ TEXT ·f(SB), NOSPLIT, $0
 }
 
 func TestRegisterWidthCorrect(t *testing.T) {
-	// MOVQ with 64-bit registers — correct.
+	// MOVQ with 64-bit registers; correct.
 	diags := lintSrc(t, `
 #include "textflag.h"
 TEXT ·f(SB), NOSPLIT, $0

lint/liveness_test.go

@@ -7,13 +7,13 @@ import "testing"
 
 // TestRegisterClobber checks the register-clobber audit is calibrated to the
 // Go ABI (cmd/compile/abi-internal.md), not the platform ABI: Go's
-// stack-based ABI0 — which hand-written assembly uses — has no System V
+// stack-based ABI0, which hand-written assembly uses, has no System V
 // style callee-saved registers, so argument and scratch registers may be
 // clobbered freely.  Only the registers the ABI fixes across calls (the
 // frame pointer, the goroutine pointer, OS-reserved registers) are audited.
 func TestRegisterClobber(t *testing.T) {
 	// amd64: BX, R12, R13 and R15 are argument/permanent-scratch registers in
-	// Go ABI0 — writing them unsaved is legal (a System V calibration would
+	// Go ABI0; writing them unsaved is legal (a System V calibration would
 	// report all of these).
 	scratch := lintSrc(t, "#include \"textflag.h\"\n"+
 		"TEXT ·f(SB), NOSPLIT, $0\n"+
@@ -27,7 +27,7 @@ func TestRegisterClobber(t *testing.T) {
 	}
 
 	// amd64: R14 (the goroutine pointer) in a NOSPLIT function without calls
-	// is the runtime's own pattern — the ABI0 transition restores it — so it
+	// is the runtime's own pattern (the ABI0 transition restores it), so it
 	// is not flagged.
 	leaf := lintSrc(t, "#include \"textflag.h\"\n"+
 		"TEXT ·f(SB), NOSPLIT, $0\n"+
@@ -101,7 +101,7 @@ func TestRegisterClobber(t *testing.T) {
 		t.Fatalf("arm64 R18 write should be flagged: %+v", armReserved)
 	}
 
-	// riscv64: X27 holds the goroutine; X5–X7 are scratch.
+	// riscv64: X27 holds the goroutine; X5-X7 are scratch.
 	riscScratch := lintSrcArch(t, "t_riscv64.s", "#include \"textflag.h\"\n"+
 		"TEXT ·f(SB), NOSPLIT, $0\n"+
 		"\tMOV X5, X6\n"+
@@ -117,7 +117,7 @@ func TestRegisterClobber(t *testing.T) {
 		t.Fatalf("unsaved riscv64 X27 write should be flagged: %+v", riscG)
 	}
 
-	// loong64: R22 holds the goroutine; R5–R19 are argument/scratch.
+	// loong64: R22 holds the goroutine; R5-R19 are argument/scratch.
 	loongScratch := lintSrcArch(t, "t_loong64.s", "#include \"textflag.h\"\n"+
 		"TEXT ·f(SB), NOSPLIT, $0\n"+
 		"\tMOVV R5, R6\n"+

parser/parser_test.go

@@ -149,7 +149,7 @@ func TestOperandStructure(t *testing.T) {
 		}
 	}
 
-	// MOVQ swin_base+0(FP), SI — the first MOVQ in the body.
+	// MOVQ swin_base+0(FP), SI; the first MOVQ in the body.
 	var mov *ast.Instr
 	for _, s := range fn.Body {
 		if in, ok := s.(*ast.Instr); ok && in.Mnemonic.Text == "MOVQ" {
@@ -202,7 +202,7 @@ func TestAVX512Operands(t *testing.T) {
 		}
 	}
 
-	// VALIGND $15, Z9, Z0, Z1 — four operands.
+	// VALIGND $15, Z9, Z0, Z1; four operands.
 	val := byMnem["VALIGND"]
 	if val == nil {
 		t.Fatal("VALIGND not found")
@@ -224,7 +224,7 @@ func TestAVX512Operands(t *testing.T) {
 		t.Errorf("VMOVDQU32 dst = %+v, want 4(SI)(AX*1)", dst)
 	}
 
-	// KTESTW K1, K1 — mask registers parse as bare names.
+	// KTESTW K1, K1; mask registers parse as bare names.
 	kt := byMnem["KTESTW"]
 	if kt == nil || len(kt.Operands) != 2 {
 		t.Fatalf("KTESTW = %+v, want two operands", kt)

testdata/add_riscv64.s

@@ -5,8 +5,8 @@
 
 // func add(a, b int64) int64
 TEXT ·add(SB), NOSPLIT, $0-24
-        MOV a+0(FP), X10
-        MOV b+8(FP), X11
-        ADD X11, X10, X10
-        MOV X10, ret+16(FP)
-        RET
+	MOV a+0(FP), X10
+	MOV b+8(FP), X11
+	ADD X11, X10, X10
+	MOV X10, ret+16(FP)
+	RET

testdata/amo_fp_riscv64.s

@@ -5,16 +5,16 @@
 
 // func atomicAdd(ptr *int64, val int64) int64
 TEXT ·atomicAdd(SB), NOSPLIT, $0-24
-        MOV a+0(FP), X10
-        MOV b+8(FP), X11
-        AMOADDD X11, (X10), X12
-        MOV X12, ret+16(FP)
-        RET
+	MOV     a+0(FP), X10
+	MOV     b+8(FP), X11
+	AMOADDD X11, (X10), X12
+	MOV     X12, ret+16(FP)
+	RET
 
 // func fpAdd(a, b float64) float64
 TEXT ·fpAdd(SB), NOSPLIT, $0-24
-        FLD a+0(FP), F10
-        FLD b+8(FP), F11
-        FADDD F10, F11, F12
-        FSD F12, ret+16(FP)
-        RET
+	FLD   a+0(FP), F10
+	FLD   b+8(FP), F11
+	FADDD F10, F11, F12
+	FSD   F12, ret+16(FP)
+	RET

testdata/csr_riscv64.s

@@ -5,22 +5,22 @@
 
 // func readCSR(csr int64) int64
 TEXT ·readCSR(SB), NOSPLIT, $0-16
-        MOV a+0(FP), X10
-        CSRRS $0x300, X0, X11
-        MOV X11, ret+8(FP)
-        RET
+	MOV   a+0(FP), X10
+	CSRRS $0x300, X0, X11
+	MOV   X11, ret+8(FP)
+	RET
 
 // func setCSRBit(csr, bit int64) int64
 TEXT ·setCSRBit(SB), NOSPLIT, $0-24
-        MOV a+0(FP), X10
-        MOV b+8(FP), X11
-        CSRRS $0x304, X11, X12
-        MOV X12, ret+16(FP)
-        RET
+	MOV   a+0(FP), X10
+	MOV   b+8(FP), X11
+	CSRRS $0x304, X11, X12
+	MOV   X12, ret+16(FP)
+	RET
 
 // func writeCSR(val int64) int64
 TEXT ·writeCSR(SB), NOSPLIT, $0-16
-        MOV a+0(FP), X10
-        CSRRW $0x305, X10, X11
-        MOV X11, ret+8(FP)
-        RET
+	MOV   a+0(FP), X10
+	CSRRW $0x305, X10, X11
+	MOV   X11, ret+8(FP)
+	RET

testdata/fma_riscv64.s

@@ -5,18 +5,18 @@
 
 // func fma(a, b, c float64) float64
 TEXT ·fma(SB), NOSPLIT, $0-32
-        FLD a+0(FP), F10
-        FLD b+8(FP), F11
-        FLD c+16(FP), F12
-        FMADDD F10, F11, F12, F13
-        FSD F13, ret+24(FP)
-        RET
+	FLD    a+0(FP), F10
+	FLD    b+8(FP), F11
+	FLD    c+16(FP), F12
+	FMADDD F10, F11, F12, F13
+	FSD    F13, ret+24(FP)
+	RET
 
 // func fms(a, b, c float64) float64
 TEXT ·fms(SB), NOSPLIT, $0-32
-        FLD a+0(FP), F10
-        FLD b+8(FP), F11
-        FLD c+16(FP), F12
-        FMSUBD F10, F11, F12, F13
-        FSD F13, ret+24(FP)
-        RET
+	FLD    a+0(FP), F10
+	FLD    b+8(FP), F11
+	FLD    c+16(FP), F12
+	FMSUBD F10, F11, F12, F13
+	FSD    F13, ret+24(FP)
+	RET

testdata/lrsc_cvt_riscv64.s

@@ -6,31 +6,32 @@
 // func casLoop(ptr *int64, old, new int64) bool
 TEXT ·casLoop(SB), NOSPLIT, $0-32
 cas_retry:
-        MOV a+0(FP), X10
-        LRD (X10), X11
-        MOV b+8(FP), X12
-        BNE X11, X12, cas_fail
-        MOV c+16(FP), X13
-        SCD X13, (X10), X14
-        BNE X14, X0, cas_retry
-        ADDI X0, $1, X15
-        MOV X15, ret+24(FP)
-        RET
+	MOV  a+0(FP), X10
+	LRD  (X10), X11
+	MOV  b+8(FP), X12
+	BNE  X11, X12, cas_fail
+	MOV  c+16(FP), X13
+	SCD  X13, (X10), X14
+	BNE  X14, X0, cas_retry
+	ADDI X0, $1, X15
+	MOV  X15, ret+24(FP)
+	RET
+
 cas_fail:
-        MOV X0, ret+24(FP)
-        RET
+	MOV  X0, ret+24(FP)
+	RET
 
 // func intToFloat(x int64) float64
 TEXT ·intToFloat(SB), NOSPLIT, $0-16
-        MOV a+0(FP), X10
-        FCVTDL X10, F10
-        FSD F10, ret+8(FP)
-        RET
+	MOV    a+0(FP), X10
+	FCVTDL X10, F10
+	FSD    F10, ret+8(FP)
+	RET
 
 // func compare(a, b float64) bool
 TEXT ·compare(SB), NOSPLIT, $0-24
-        FLD a+0(FP), F10
-        FLD b+8(FP), F11
-        FLTD F10, F11, X10
-        MOV X10, ret+16(FP)
-        RET
+	FLD  a+0(FP), F10
+	FLD  b+8(FP), F11
+	FLTD F10, F11, X10
+	MOV  X10, ret+16(FP)
+	RET

testdata/sample_amd64.s

@@ -15,43 +15,44 @@ DATA mask24<>+4(SB)/4, $0x80050403
 
 // func analyzeO1RangeAVX2(swin []int32, dstP []uint32, hist *[32]uint16) (partSum uint64, overflow bool)
 TEXT ·analyzeO1RangeAVX2(SB), NOSPLIT, $0-65
-	MOVQ swin_base+0(FP), SI
-	MOVQ dstP_base+24(FP), DI
-	MOVQ dstP_len+32(FP), BX
-	MOVQ hist+48(FP), R13
+	MOVQ       swin_base+0(FP), SI
+	MOVQ       dstP_base+24(FP), DI
+	MOVQ       dstP_len+32(FP), BX
+	MOVQ       hist+48(FP), R13
 
-	VPCMPEQD Y0, Y0, Y0
-	VPSLLD   $31, Y0, Y0
+	VPCMPEQD   Y0, Y0, Y0
+	VPSLLD     $31, Y0, Y0
 
-	LEAQ (SI)(BX*4), R9
-	MOVQ BX, R10
-	ANDQ $-8, R10
+	LEAQ       (SI)(BX*4), R9
+	MOVQ       BX, R10
+	ANDQ       $-8, R10
 
 vec1:
-	CMPQ    SI, R10
-	JGE     vec1done
-	VMOVDQU (SI), Y1
-	VMOVDQU 4(SI), Y2
-	VPSUBD  Y1, Y2, Y3
-	ADDQ    $32, SI
-	JMP     vec1
+	CMPQ       SI, R10
+	JGE        vec1done
+	VMOVDQU    (SI), Y1
+	VMOVDQU    4(SI), Y2
+	VPSUBD     Y1, Y2, Y3
+	ADDQ       $32, SI
+	JMP        vec1
+
 vec1done:
 
-	MOVQ AX, partSum+56(FP)
-	MOVB AL, overflow+64(FP)
+	MOVQ       AX, partSum+56(FP)
+	MOVB       AL, overflow+64(FP)
 	VZEROUPPER
 	RET
 
 // func decodeFixedO1AVX512(samples []int32, residual []int32)
 TEXT ·decodeFixedO1AVX512(SB), NOSPLIT, $0-48
-	MOVQ samples_base+0(FP), SI
-	MOVQ residual_base+16(FP), DI
+	MOVQ         samples_base+0(FP), SI
+	MOVQ         residual_base+16(FP), DI
 	VPBROADCASTD AX, Z15
-	VMOVDQU32 (DI)(AX*1), Z0
-	VALIGND   $15, Z9, Z0, Z1
-	VFMADD231PD Z14, Z12, Z10
-	VPCMPEQD  Z0, Z3, K1
-	KTESTW    K1, K1
-	VPSRAQ    X31, Z8, Z8
-	VMOVDQU32 Z0, 4(SI)(AX*1)
+	VMOVDQU32    (DI)(AX*1), Z0
+	VALIGND      $15, Z9, Z0, Z1
+	VFMADD231PD  Z14, Z12, Z10
+	VPCMPEQD     Z0, Z3, K1
+	KTESTW       K1, K1
+	VPSRAQ       X31, Z8, Z8
+	VMOVDQU32    Z0, 4(SI)(AX*1)
 	RET

testdata/verify/abi_amd64.s

@@ -20,7 +20,7 @@ TEXT ·dirtyBP(SB), NOSPLIT, $0-16
 	RET
 
 // func dirtyR14(a int64) int64
-// Deliberately clobbers R14 (the goroutine pointer — a serious ABI violation).
+// Deliberately clobbers R14 (the goroutine pointer; a serious ABI violation).
 TEXT ·dirtyR14(SB), NOSPLIT, $0-16
 	MOVQ $0x5678, R14
 	MOVQ a+0(FP), AX

testdata/verify/basic_amd64.s

@@ -13,55 +13,55 @@ TEXT ·add(SB), NOSPLIT, $0-24
 // func sum(data []int64) int64
 // Sums all elements of the slice.
 TEXT ·sum(SB), NOSPLIT, $0-32
-	MOVQ data_base+0(FP), SI
-	MOVQ data_len+8(FP), CX
-	XORQ AX, AX
+	MOVQ  data_base+0(FP), SI
+	MOVQ  data_len+8(FP), CX
+	XORQ  AX, AX
 	TESTQ CX, CX
-	JZ   sum_done
+	JZ    sum_done
 
 sum_loop:
-	ADDQ (SI), AX
-	ADDQ $8, SI
-	DECQ CX
-	JNZ  sum_loop
+	ADDQ  (SI), AX
+	ADDQ  $8, SI
+	DECQ  CX
+	JNZ   sum_loop
 
 sum_done:
-	MOVQ AX, ret+24(FP)
+	MOVQ  AX, ret+24(FP)
 	RET
 
 // func wideCopy(dst, src []byte)
 // Non-overlapping copy of min(len(dst), len(src)) bytes using 32-byte moves.
 TEXT ·wideCopy(SB), NOSPLIT, $0-48
-	MOVQ dst_base+0(FP), DI
-	MOVQ dst_len+8(FP), BX
-	MOVQ src_base+24(FP), SI
-	MOVQ src_len+32(FP), R8
-	CMPQ BX, R8
-	JLE  wc_have_n
-	MOVQ R8, BX
+	MOVQ       dst_base+0(FP), DI
+	MOVQ       dst_len+8(FP), BX
+	MOVQ       src_base+24(FP), SI
+	MOVQ       src_len+32(FP), R8
+	CMPQ       BX, R8
+	JLE        wc_have_n
+	MOVQ       R8, BX
 
 wc_have_n:
-	CMPQ BX, $32
-	JB   wc_small
+	CMPQ       BX, $32
+	JB         wc_small
 
-	VMOVDQU (SI), Y0
-	VMOVDQU Y0, (DI)
-	VMOVDQU -32(SI)(BX*1), Y0
-	VMOVDQU Y0, -32(DI)(BX*1)
+	VMOVDQU    (SI), Y0
+	VMOVDQU    Y0, (DI)
+	VMOVDQU    -32(SI)(BX*1), Y0
+	VMOVDQU    Y0,-32(DI)(BX*1)
 	VZEROUPPER
 	RET
 
 wc_small:
-	TESTQ BX, BX
-	JZ    wc_done
+	TESTQ      BX, BX
+	JZ         wc_done
 
 wc_byte:
-	MOVB (SI), R8B
-	MOVB R8B, (DI)
-	INCQ SI
-	INCQ DI
-	DECQ BX
-	JNZ  wc_byte
+	MOVB       (SI), R8B
+	MOVB       R8B, (DI)
+	INCQ       SI
+	INCQ       DI
+	DECQ       BX
+	JNZ        wc_byte
 
 wc_done:
 	RET

testdata/verify/basic_arm64.s

@@ -5,53 +5,56 @@
 
 // add returns a + b.
 TEXT ·add(SB), NOSPLIT, $0-24
-	MOVD	a+0(FP), R4
-	MOVD	b+8(FP), R5
-	ADD	R5, R4, R4
-	MOVD	R4, ret+16(FP)
+	MOVD a+0(FP), R4
+	MOVD b+8(FP), R5
+	ADD  R5, R4, R4
+	MOVD R4, ret+16(FP)
 	RET
 
 // arith exercises the register-register integer set.
 TEXT ·arith(SB), NOSPLIT, $0-0
-	ADD	R4, R5, R6
-	SUB	R7, R8, R9
-	AND	R10, R11, R12
-	ORR	R12, R13, R14
-	EOR	R14, R15, R16
-	CMP	R16, R17
-	ADD	R4, R5
-	SUB	R6, R7
+	ADD R4, R5, R6
+	SUB R7, R8, R9
+	AND R10, R11, R12
+	ORR R12, R13, R14
+	EOR R14, R15, R16
+	CMP R16, R17
+	ADD R4, R5
+	SUB R6, R7
 	RET
 
 // branch exercises conditional and unconditional control flow.
 TEXT ·branch(SB), NOSPLIT, $0-0
-	BEQ	done
-	BNE	skip
-	BGE	done
-	BLT	done
-	BGT	done
-	BLE	done
+	BEQ done
+	BNE skip
+	BGE done
+	BLT done
+	BGT done
+	BLE done
+
 skip:
-	B	loop
+	B   loop
+
 loop:
-	ADD	R4, R5
+	ADD R4, R5
 	RET
+
 done:
 	RET
 
 // mov exercises the MOV pseudo-instruction.
 TEXT ·mov(SB), NOSPLIT, $0-16
-	MOVD	$0, R4
-	MOVD	$1, R5
-	MOVD	$42, R6
-	MOVD	a+0(FP), R7
-	MOVD	R7, ret+0(FP)
-	MOVW	$100, R8
+	MOVD $0, R4
+	MOVD $1, R5
+	MOVD $42, R6
+	MOVD a+0(FP), R7
+	MOVD R7, ret+0(FP)
+	MOVW $100, R8
 	RET
 
 // frame exercises the prologue/epilogue of a function with a real frame.
 TEXT ·frame(SB), NOSPLIT, $32-8
-	MOVD	arg+0(FP), R4
-	ADD	$1, R4, R4
-	MOVD	R4, ret+0(FP)
+	MOVD arg+0(FP), R4
+	ADD  $1, R4, R4
+	MOVD R4, ret+0(FP)
 	RET

testdata/verify/basic_loong64.s

@@ -5,50 +5,53 @@
 
 // add returns a + b.
 TEXT ·add(SB), NOSPLIT, $0-24
-	MOVV	a+0(FP), R4
-	MOVV	b+8(FP), R5
-	ADDV	R5, R4, R4
-	MOVV	R4, ret+16(FP)
+	MOVV a+0(FP), R4
+	MOVV b+8(FP), R5
+	ADDV R5, R4, R4
+	MOVV R4, ret+16(FP)
 	RET
 
 // arith exercises the 3R integer and FP set.
 TEXT ·arith(SB), NOSPLIT, $0-0
-	ADDV	R4, R5, R6
-	SUBV	R7, R8, R9
-	MULV	R10, R11, R12
-	DIVV	R13, R14, R15
-	AND	R16, R17, R18
-	OR	R18, R19, R20
-	XOR	R20, R21, R2
-	SLLV	R2, R23, R24
-	SRLV	R24, R25, R26
-	SRAV	R26, R27, R28
+	ADDV R4, R5, R6
+	SUBV R7, R8, R9
+	MULV R10, R11, R12
+	DIVV R13, R14, R15
+	AND  R16, R17, R18
+	OR   R18, R19, R20
+	XOR  R20, R21, R2
+	SLLV R2, R23, R24
+	SRLV R24, R25, R26
+	SRAV R26, R27, R28
 	RET
 
 // imm exercises the immediate forms.
 TEXT ·imm(SB), NOSPLIT, $0-0
-	ADDV	$42, R4, R5
-	ADDV	$-8, R6
-	AND	$0xff, R7, R8
-	OR	$1, R9, R10
-	XOR	$0, R11, R12
-	SGT	$100, R13, R14
-	SLLV	$4, R15, R16
-	MOVV	$0x12345, R17
+	ADDV $42, R4, R5
+	ADDV $-8, R6
+	AND  $0xff, R7, R8
+	OR   $1, R9, R10
+	XOR  $0, R11, R12
+	SGT  $100, R13, R14
+	SLLV $4, R15, R16
+	MOVV $0x12345, R17
 	RET
 
 // branch exercises conditional and unconditional control flow.
 TEXT ·branch(SB), NOSPLIT, $0-0
-	BEQ	R4, R5, done
-	BNE	R6, R7, skip
-	BLT	R8, R9, done
-	BGE	R10, R11, done
-	BLTU	R12, R13, done
-	BGEU	R14, R15, done
+	BEQ  R4, R5, done
+	BNE  R6, R7, skip
+	BLT  R8, R9, done
+	BGE  R10, R11, done
+	BLTU R12, R13, done
+	BGEU R14, R15, done
+
 skip:
-	JMP	loop
+	JMP  loop
+
 loop:
-	JAL	skip
+	JAL  skip
 	RET
+
 done:
 	RET

testdata/verify/branch_arm64.s

@@ -5,23 +5,26 @@
 
 // branch exercises all conditional branch forms and jump chain folding.
 TEXT ·branch(SB), NOSPLIT, $0-0
-	BEQ	done
-	BNE	skip
-	BGE	done
-	BLT	done
-	BGT	done
-	BLE	done
-	BCS	done
-	BCC	done
-	BMI	done
-	BPL	done
-	BVS	done
-	BVC	done
-	BHI	done
-	BLS	done
+	BEQ done
+	BNE skip
+	BGE done
+	BLT done
+	BGT done
+	BLE done
+	BCS done
+	BCC done
+	BMI done
+	BPL done
+	BVS done
+	BVC done
+	BHI done
+	BLS done
+
 skip:
-	B	loop
+	B   loop
+
 loop:
-	ADD	R4, R5
+	ADD R4, R5
+
 done:
 	RET

testdata/verify/branch_riscv64.s

@@ -5,31 +5,39 @@
 
 TEXT ·branches(SB), NOSPLIT, $0
 	ADDI $1, X10, X10
-	BEQ X10, X11, beq_done
+	BEQ  X10, X11, beq_done
 	ADDI $2, X10, X10
+
 beq_done:
-	BNE X10, X11, bne_done
+	BNE  X10, X11, bne_done
 	ADDI $3, X10, X10
+
 bne_done:
-	BLT X10, X11, blt_done
+	BLT  X10, X11, blt_done
 	ADDI $4, X10, X10
+
 blt_done:
-	BGE X10, X11, bge_done
+	BGE  X10, X11, bge_done
 	ADDI $5, X10, X10
+
 bge_done:
 	BLTU X10, X11, bltu_done
 	ADDI $6, X10, X10
+
 bltu_done:
 	BGEU X10, X11, bgeu_done
 	ADDI $7, X10, X10
+
 bgeu_done:
 	RET
 
 TEXT ·jumps(SB), NOSPLIT, $0
-	JMP done
+	JMP  done
 	ADDI $1, X10, X10
+
 done:
-	JAL X11, skip
+	JAL  X11, skip
 	ADDI $2, X10, X10
+
 skip:
 	RET

testdata/verify/call_arm64.s

@@ -5,6 +5,6 @@
 
 // caller exercises BL to an external symbol (produces a relocation).
 TEXT ·caller(SB), NOSPLIT, $0-0
-	BL	other(SB)
-	ADD	R4, R5
+	BL  other(SB)
+	ADD R4, R5
 	RET

testdata/verify/fp_arm64.s

@@ -5,115 +5,115 @@
 
 // fparith exercises the FP arithmetic set.
 TEXT ·fparith(SB), NOSPLIT, $0-0
-	FADDD	F0, F1, F2
-	FSUBD	F3, F4, F5
-	FMULD	F6, F7, F8
-	FDIVD	F9, F10, F11
-	FADDS	F12, F13, F14
-	FSUBS	F15, F16, F17
-	FMULS	F18, F19, F20
-	FDIVS	F21, F22, F23
-	FSQRTD	F24, F25
-	FSQRTS	F26, F27
-	FNEGD	F28, F29
-	FNEGS	F30, F31
-	FABSD	F0, F1
-	FABSS	F2, F3
-	FNMULD	F4, F5, F6
-	FNMULS	F7, F8, F9
-	FMIND	F10, F11, F12
-	FMAXD	F13, F14, F15
-	FMINS	F16, F17, F18
-	FMAXS	F19, F20, F21
+	FADDD  F0, F1, F2
+	FSUBD  F3, F4, F5
+	FMULD  F6, F7, F8
+	FDIVD  F9, F10, F11
+	FADDS  F12, F13, F14
+	FSUBS  F15, F16, F17
+	FMULS  F18, F19, F20
+	FDIVS  F21, F22, F23
+	FSQRTD F24, F25
+	FSQRTS F26, F27
+	FNEGD  F28, F29
+	FNEGS  F30, F31
+	FABSD  F0, F1
+	FABSS  F2, F3
+	FNMULD F4, F5, F6
+	FNMULS F7, F8, F9
+	FMIND  F10, F11, F12
+	FMAXD  F13, F14, F15
+	FMINS  F16, F17, F18
+	FMAXS  F19, F20, F21
 	RET
 
 // fpfma exercises fused multiply-add.
 TEXT ·fpfma(SB), NOSPLIT, $0-0
-	FMADDD	F0, F1, F2, F3
-	FMSUBD	F4, F5, F6, F7
-	FNMADDD	F8, F9, F10, F11
-	FNMSUBD	F12, F13, F14, F15
-	FMADDS	F16, F17, F18, F19
-	FMSUBS	F20, F21, F22, F23
-	FNMADDS	F24, F25, F26, F27
-	FNMSUBS	F28, F29, F30, F0
+	FMADDD  F0, F1, F2, F3
+	FMSUBD  F4, F5, F6, F7
+	FNMADDD F8, F9, F10, F11
+	FNMSUBD F12, F13, F14, F15
+	FMADDS  F16, F17, F18, F19
+	FMSUBS  F20, F21, F22, F23
+	FNMADDS F24, F25, F26, F27
+	FNMSUBS F28, F29, F30, F0
 	RET
 
 // fpconv exercises FP↔integer conversion and cross-precision.
 // Syntax: FCVTZSD Fd, Rn (float→int: FP source first, int dest second)
 //         SCVTFD Rn, Fd (int→float: int source first, FP dest second)
 TEXT ·fpconv(SB), NOSPLIT, $0-0
-	FCVTSD	F0, F1
-	FCVTDS	F2, F3
-	FCVTZSD	F4, R0
-	FCVTZSS	F5, R1
-	FCVTZUD	F6, R2
-	FCVTZUS	F7, R3
-	SCVTFD	R4, F8
-	SCVTFS	R5, F9
-	UCVTFD	R6, F10
-	UCVTFS	R7, F11
-	SCVTFWD	R0, F12
-	SCVTFWS	R1, F13
-	UCVTFWD	R2, F14
-	UCVTFWS	R3, F15
-	FMOVS	F14, R20
-	FMOVS	R21, F15
-	FMOVD	F16, R22
-	FMOVD	R23, F17
+	FCVTSD  F0, F1
+	FCVTDS  F2, F3
+	FCVTZSD F4, R0
+	FCVTZSS F5, R1
+	FCVTZUD F6, R2
+	FCVTZUS F7, R3
+	SCVTFD  R4, F8
+	SCVTFS  R5, F9
+	UCVTFD  R6, F10
+	UCVTFS  R7, F11
+	SCVTFWD R0, F12
+	SCVTFWS R1, F13
+	UCVTFWD R2, F14
+	UCVTFWS R3, F15
+	FMOVS   F14, R20
+	FMOVS   R21, F15
+	FMOVD   F16, R22
+	FMOVD   R23, F17
 	RET
 
 // fpcmp exercises FP compare and conditional compare.
 // FCCMP syntax: FCCMP cond, Fn, Fm, $nzcv
 // FCSEL syntax: FCSEL cond, Fn, Fm, Fd
 TEXT ·fpcmp(SB), NOSPLIT, $0-0
-	FCMPS	F0, F1
-	FCMPD	F2, F3
-	FCMPS	$0.0, F4
-	FCMPD	$0.0, F5
-	FCCMPS	EQ, F6, F7, $0
-	FCCMPD	NE, F8, F9, $0
-	FCSELS	GE, F10, F11, F12
-	FCSELD	LT, F13, F14, F15
+	FCMPS  F0, F1
+	FCMPD  F2, F3
+	FCMPS  $0.0, F4
+	FCMPD  $0.0, F5
+	FCCMPS EQ, F6, F7, $0
+	FCCMPD NE, F8, F9, $0
+	FCSELS GE, F10, F11, F12
+	FCSELD LT, F13, F14, F15
 	RET
 
 // frint exercises FP rounding.
 TEXT ·frint(SB), NOSPLIT, $0-0
-	FRINTND	F0, F1
-	FRINTNS	F2, F3
-	FRINTPD	F4, F5
-	FRINTPS	F6, F7
-	FRINTMD	F8, F9
-	FRINTMS	F10, F11
-	FRINTZD	F12, F13
-	FRINTZS	F14, F15
-	FRINTAD	F16, F17
-	FRINTAS	F18, F19
-	FRINTXD	F20, F21
-	FRINTXS	F22, F23
-	FRINTID	F24, F25
-	FRINTIS	F26, F27
-	FMOVD	F0, F1
-	FMOVS	F2, F3
+	FRINTND F0, F1
+	FRINTNS F2, F3
+	FRINTPD F4, F5
+	FRINTPS F6, F7
+	FRINTMD F8, F9
+	FRINTMS F10, F11
+	FRINTZD F12, F13
+	FRINTZS F14, F15
+	FRINTAD F16, F17
+	FRINTAS F18, F19
+	FRINTXD F20, F21
+	FRINTXS F22, F23
+	FRINTID F24, F25
+	FRINTIS F26, F27
+	FMOVD   F0, F1
+	FMOVS   F2, F3
 	RET
 
 // condsel exercises conditional select and CRC32.
 TEXT ·condsel(SB), NOSPLIT, $0-0
-	CSEL	EQ, R0, R1, R2
-	CSINC	NE, R3, R4, R5
-	CSINV	GE, R6, R7, R8
-	CSNEG	LT, R9, R10, R11
-	CSET	EQ, R12
-	CSETM	NE, R13
-	CINC	EQ, R14, R15
-	CINV	NE, R16, R17
-	CNEG	GE, R19, R20
-	CRC32B	R0, R2
-	CRC32H	R3, R5
-	CRC32W	R6, R8
-	CRC32X	R9, R11
-	CRC32CB	R12, R14
-	CRC32CH	R15, R0
-	CRC32CW	R1, R3
-	CRC32CX	R4, R6
+	CSEL    EQ, R0, R1, R2
+	CSINC   NE, R3, R4, R5
+	CSINV   GE, R6, R7, R8
+	CSNEG   LT, R9, R10, R11
+	CSET    EQ, R12
+	CSETM   NE, R13
+	CINC    EQ, R14, R15
+	CINV    NE, R16, R17
+	CNEG    GE, R19, R20
+	CRC32B  R0, R2
+	CRC32H  R3, R5
+	CRC32W  R6, R8
+	CRC32X  R9, R11
+	CRC32CB R12, R14
+	CRC32CH R15, R0
+	CRC32CW R1, R3
+	CRC32CX R4, R6
 	RET

testdata/verify/fp_loong64.s

@@ -6,138 +6,154 @@
 // fp exercises the floating-point set: 3R arithmetic, 2R unary, compares
 // into FCC, fused multiply-add and the register moves.
 TEXT ·fp(SB), NOSPLIT, $0-0
-	ADDD	F4, F5, F6
-	SUBD	F7, F8, F9
-	MULD	F9, F10, F11
-	DIVD	F11, F12, F13
-	MULF	F13, F14, F15
-	ADDF	F15, F16, F17
-	SQRTD	F17, F18
-	SQRTF	F18, F19
-	ABSD	F19, F20
-	NEGD	F20, F21
-	MOVD	F21, F22
-	CMPEQD	F22, F23, FCC0
-	CMPGTF	F23, F24, FCC1
-	CMPGED	F24, F25, FCC2
-	FMADDD	F0, F1, F2, F3
-	FMSUBF	F3, F4, F5, F6
-	FNMADDD	F6, F7, F8, F9
-	FNMSUBF	F9, F10, F11, F12
-	FMAXD	F12, F13, F14
-	FMINF	F14, F15, F16
-	FMAXAD	F16, F17, F18
-	FMINAF	F18, F19, F20
-	FSCALEBF	F20, F21, F22
-	FCOPYSGD	F22, F23, F24
-	MOVV	F25, R25
-	MOVV	R26, F27
-	MOVW	R28, F29
-	MOVW	F30, R31
+	ADDD     F4, F5, F6
+	SUBD     F7, F8, F9
+	MULD     F9, F10, F11
+	DIVD     F11, F12, F13
+	MULF     F13, F14, F15
+	ADDF     F15, F16, F17
+	SQRTD    F17, F18
+	SQRTF    F18, F19
+	ABSD     F19, F20
+	NEGD     F20, F21
+	MOVD     F21, F22
+	CMPEQD   F22, F23, FCC0
+	CMPGTF   F23, F24, FCC1
+	CMPGED   F24, F25, FCC2
+	FMADDD   F0, F1, F2, F3
+	FMSUBF   F3, F4, F5, F6
+	FNMADDD  F6, F7, F8, F9
+	FNMSUBF  F9, F10, F11, F12
+	FMAXD    F12, F13, F14
+	FMINF    F14, F15, F16
+	FMAXAD   F16, F17, F18
+	FMINAF   F18, F19, F20
+	FSCALEBF F20, F21, F22
+	FCOPYSGD F22, F23, F24
+	MOVV     F25, R25
+	MOVV     R26, F27
+	MOVW     R28, F29
+	MOVW     F30, R31
 	RET
 
 // mov forms: register moves, immediates (12/32/64-bit), memory with FP/SP
 // pseudo-registers and the register-indexed forms.
 TEXT ·mov(SB), NOSPLIT, $0-16
-	MOVV	R4, R5
-	MOVW	R6, R7
-	MOVB	R8, R9
-	MOVBU	R10, R11
-	MOVHU	R12, R13
-	MOVWU	R14, R15
-	MOVV	$42, R16
-	MOVV	$0x12345, R17
-	MOVV	$0x100000, R18
-	MOVW	$-100, R19
-	MOVV	$0x123456789, R20
-	MOVV	a+0(FP), R21
-	MOVV	R23, b+8(FP)
-	MOVW	c+16(FP), R24
-	MOVV	(R24)(R25), R26
-	MOVV	R27, (R28)(R29)
+	MOVV  R4, R5
+	MOVW  R6, R7
+	MOVB  R8, R9
+	MOVBU R10, R11
+	MOVHU R12, R13
+	MOVWU R14, R15
+	MOVV  $42, R16
+	MOVV  $0x12345, R17
+	MOVV  $0x100000, R18
+	MOVW  $-100, R19
+	MOVV  $0x123456789, R20
+	MOVV  a+0(FP), R21
+	MOVV  R23, b+8(FP)
+	MOVW  c+16(FP), R24
+	MOVV  (R24)(R25), R26
+	MOVV  R27, (R28)(R29)
 	RET
 
 // frame exercises the prologue/epilogue of a function with a real frame.
 TEXT ·frame(SB), NOSPLIT, $32-8
-	MOVV	R4, R5
-	MOVV	arg+0(FP), R6
-	MOVV	R7, local-8(SP)
-	MOVV	local-8(SP), R8
-	MOVV	R9, ret+0(FP)
+	MOVV R4, R5
+	MOVV arg+0(FP), R6
+	MOVV R7, local-8(SP)
+	MOVV local-8(SP), R8
+	MOVV R9, ret+0(FP)
 	RET
 
 // branches21 exercises the single-register and zero-register branch forms
 // with 21-bit offsets.
 TEXT ·branches21(SB), NOSPLIT, $0-0
-	BEQ	R0, R4, l1
-	BEQ	R5, R0, l2
-	BNE	R0, R6, l3
-	BNE	R7, R0, l4
-	BLTZ	R8, l5
-	BGEZ	R9, l6
-	BLEZ	R10, l7
-	BGTZ	R11, l8
-	JMP	l9
+	BEQ       R0, R4, l1
+	BEQ       R5, R0, l2
+	BNE       R0, R6, l3
+	BNE       R7, R0, l4
+	BLTZ      R8, l5
+	BGEZ      R9, l6
+	BLEZ      R10, l7
+	BGTZ      R11, l8
+	JMP       l9
+
 l1:
-	JMP	l10
+	JMP       l10
+
 l2:
-	JMP	l11
+	JMP       l11
+
 l3:
-	JMP	l12
+	JMP       l12
+
 l4:
-	JMP	l13
+	JMP       l13
+
 l5:
-	JMP	l14
+	JMP       l14
+
 l6:
-	JMP	l15
+	JMP       l15
+
 l7:
-	JMP	l16
+	JMP       l16
+
 l8:
-	JMP	l16
+	JMP       l16
+
 l9:
-	MOVV	R1, R2
+	MOVV      R1, R2
+
 l10:
-	LL	(R12), R13
-	LLV	(R14), R15
-	SC	R16, (R17)
-	SCV	R18, (R19)
-	RDTIMED	R20, R21
+	LL        (R12), R13
+	LLV       (R14), R15
+	SC        R16, (R17)
+	SCV       R18, (R19)
+	RDTIMED   R20, R21
 	SYSCALL
 	DBAR
 	RET
+
 l11:
-	JAL	(R30)
+	JAL       (R30)
 	RET
+
 l12:
-	BSTRINSV	$7, R4, $0, R5
-	BSTRPICKV	$63, R6, $32, R7
-	ALSLV	$2, R8, R9, R10
-	ADDV16	$65536, R11, R12
+	BSTRINSV  $7, R4, $0, R5
+	BSTRPICKV $63, R6, $32, R7
+	ALSLV     $2, R8, R9, R10
+	ADDV16    $65536, R11, R12
 	RET
+
 l13:
-	MOVV	$0xffffffffffffffff, R13
+	MOVV      $0xffffffffffffffff, R13
 	RET
+
 l14:
-	CPUCFG	R14, R14
+	CPUCFG    R14, R14
 	RET
+
 l15:
-	NOR	R15, R16, R17
-	ORN	R18, R19, R20
-	ANDN	R21, R24, R25
+	NOR       R15, R16, R17
+	ORN       R18, R19, R20
+	ANDN      R21, R24, R25
 	RET
+
 l16:
-	MOVB	R26, (R27)
-	MOVB	(R28), R29
+	MOVB      R26, (R27)
+	MOVB      (R28), R29
 	RET
 
 // sbdata loads and stores a static symbol with relocations (the relocation
 // fields are masked before comparison).
-GLOBL	·table(SB), RODATA, $16
-DATA	·table+0(SB)/8, $0x1122334455667788
-DATA	·table+8(SB)/8, $0x8877665544332211
+GLOBL ·table(SB), RODATA, $16
+DATA ·table+0(SB)/8, $0x1122334455667788
+DATA ·table+8(SB)/8, $0x8877665544332211
 
 TEXT ·sbdata(SB), NOSPLIT, $0-0
-	MOVV	$·table(SB), R4
-	MOVV	·table(SB), R5
-	MOVV	R6, ·table+8(SB)
+	MOVV     $·table(SB), R4
+	MOVV     ·table(SB), R5
+	MOVV     R6, ·table+8(SB)
 	RET

testdata/verify/largeimm_riscv64.s

@@ -7,6 +7,6 @@ TEXT ·largeimm(SB), NOSPLIT, $0
 	ADDI $2048, X5
 	ADDI $4095, X5, X6
 	ANDI $4095, X5, X6
-	ORI $-4096, X5, X6
+	ORI  $-4096, X5, X6
 	XORI $0x12345, X5, X6
 	RET

testdata/verify/loadstore_riscv64.s

@@ -4,14 +4,14 @@
 #include "textflag.h"
 
 TEXT ·ldst(SB), NOSPLIT, $0
-	LD (X8), X9
-	SD X9, (X8)
-	LW (X8), X9
-	SW X9, (X8)
-	LD 8(X2), X10
-	SD X10, 16(X2)
-	LW 4(X2), X11
-	SW X11, 8(X2)
+	LD  (X8), X9
+	SD  X9, (X8)
+	LW  (X8), X9
+	SW  X9, (X8)
+	LD  8(X2), X10
+	SD  X10, 16(X2)
+	LW  4(X2), X11
+	SW  X11, 8(X2)
 	RET
 
 TEXT ·addi4spn(SB), NOSPLIT, $0

testdata/verify/movimm_arm64.s

@@ -5,17 +5,17 @@
 
 // movimm exercises MOV with various immediate values.
 TEXT ·movimm(SB), NOSPLIT, $0-0
-	MOVD	$0, R0
-	MOVD	$1, R1
-	MOVD	$42, R2
-	MOVD	$255, R3
-	MOVD	$256, R4
-	MOVD	$0xFFFF, R5
-	MOVD	$0x12345678, R6
-	MOVD	$0x123456789ABCDEF0, R7
-	MOVD	$-1, R8
-	MOVD	$-2, R9
-	MOVW	$0, R10
-	MOVW	$100, R11
-	MOVW	$0x12345, R12
+	MOVD $0, R0
+	MOVD $1, R1
+	MOVD $42, R2
+	MOVD $255, R3
+	MOVD $256, R4
+	MOVD $0xFFFF, R5
+	MOVD $0x12345678, R6
+	MOVD $0x123456789ABCDEF0, R7
+	MOVD $-1, R8
+	MOVD $-2, R9
+	MOVW $0, R10
+	MOVW $100, R11
+	MOVW $0x12345, R12
 	RET

testdata/verify/rvc_riscv64.s

@@ -10,9 +10,9 @@ TEXT ·shifts(SB), NOSPLIT, $0
 	RET
 
 TEXT ·logic(SB), NOSPLIT, $0
-	AND X11, X10, X10
-	OR X11, X10, X10
-	XOR X11, X10, X10
+	AND  X11, X10, X10
+	OR   X11, X10, X10
+	XOR  X11, X10, X10
 	ANDI $7, X10, X10
 	RET
 

verify/abi_amd64.s

@@ -9,7 +9,7 @@
 //
 // The return trampoline (leaveJITCheckedRaw) is a raw TEXT symbol with no
 // Go function declaration, so the toolchain does NOT interpose an
-// ABIInternal wrapper — the JIT function RETs directly into the check code,
+// ABIInternal wrapper; the JIT function RETs directly into the check code,
 // which sees the registers exactly as the function left them.
 //
 // Go ABI0 on amd64 guarantees:
@@ -17,32 +17,32 @@
 //   - R14 holds the goroutine pointer and must survive across any call.
 
 // Sentinel values chosen to be unlikely in normal execution.
-#define SENTINEL_BP  0xDEADBEEFCAFEF00D
+#define SENTINEL_BP 0xDEADBEEFCAFEF00D
 #define SENTINEL_R14 0x0BADF00DDEADBEEF
 
 // GLOBL holding the raw address of the leave trampoline, read by Go.
 GLOBL ·leaveCheckedPtr(SB), NOPTR, $8
-DATA  ·leaveCheckedPtr(SB)/8, $·leaveJITCheckedRaw(SB)
+DATA ·leaveCheckedPtr(SB)/8, $·leaveJITCheckedRaw(SB)
 
 // func enterJITChecked(fn uintptr, stack uintptr)
 // Sets sentinels in BP and R14, switches to the prepared stack and jumps
 // to fn.  The prepared stack's return address must be leaveJITCheckedRaw
 // (read from leaveCheckedPtr).
 TEXT ·enterJITChecked(SB), NOSPLIT, $0-16
-	MOVQ fn+0(FP), AX         // target (before SP switch)
-	MOVQ SP, ·savedSP(SB)     // preserve Go stack
-	MOVQ BP, ·savedBP(SB)     // preserve frame pointer (vet requires save before clobber)
-	MOVQ R14, ·savedR14(SB)   // preserve the goroutine pointer
-	MOVQ $SENTINEL_BP, BP     // sentinel in BP
-	MOVQ $SENTINEL_R14, R14   // sentinel in R14
-	MOVQ stack+8(FP), SP      // switch to prepared stack
+	MOVQ fn+0(FP), AX // target (before SP switch)
+	MOVQ SP, ·savedSP(SB) // preserve Go stack
+	MOVQ BP, ·savedBP(SB) // preserve frame pointer (vet requires save before clobber)
+	MOVQ R14, ·savedR14(SB) // preserve the goroutine pointer
+	MOVQ $SENTINEL_BP, BP // sentinel in BP
+	MOVQ $SENTINEL_R14, R14 // sentinel in R14
+	MOVQ stack+8(FP), SP // switch to prepared stack
 	JMP  AX
 
-// leaveJITCheckedRaw is the raw return trampoline.  It has NO Go function
-// declaration, so no ABIInternal wrapper is generated — the JIT function's
-// RET lands here directly, seeing BP and R14 exactly as the function left
-// them.  It checks the sentinels, records violations in abiResult, then
-// restores the Go stack and returns.
+	// leaveJITCheckedRaw is the raw return trampoline.  It has NO Go function
+	// declaration, so no ABIInternal wrapper is generated; the JIT function's
+	// RET lands here directly, seeing BP and R14 exactly as the function left
+	// them.  It checks the sentinels, records violations in abiResult, then
+	// restores the Go stack and returns.
 TEXT ·leaveJITCheckedRaw(SB), NOSPLIT, $0-0
 	// Check BP against the sentinel.
 	MOVQ $SENTINEL_BP, CX
@@ -58,10 +58,10 @@ bp_ok:
 	ORQ  $2, ·abiResult(SB)
 
 r14_ok:
-	MOVQ ·savedR14(SB), R14   // restore the goroutine pointer: the runtime
-	                          // needs it the moment Go code resumes, whether
-	                          // or not the kernel violated it (the violation
-	                          // is already recorded in abiResult)
-	MOVQ ·savedBP(SB), BP     // restore the frame pointer
+	MOVQ ·savedR14(SB), R14 // restore the goroutine pointer: the runtime
+	// needs it the moment Go code resumes, whether
+	// or not the kernel violated it (the violation
+	// is already recorded in abiResult)
+	MOVQ ·savedBP(SB), BP // restore the frame pointer
 	MOVQ ·savedSP(SB), SP
 	RET

verify/abi_arm64.s

@@ -9,7 +9,7 @@
 //
 // The return trampoline (leaveJITCheckedRaw) is a raw TEXT symbol with no
 // Go function declaration, so the toolchain does NOT interpose an
-// ABIInternal wrapper — the JIT function RETs directly into the check
+// ABIInternal wrapper; the JIT function RETs directly into the check
 // code, which sees the registers exactly as the function left them.
 //
 // Go ABI on arm64 guarantees:
@@ -21,12 +21,12 @@
 //     cannot cover it.
 
 // Sentinel values chosen to be unlikely in normal execution.
-#define SENTINEL_FP   0xDEADBEEFCAFEF00D
-#define SENTINEL_G    0x0BADF00DDEADBEEF
+#define SENTINEL_FP 0xDEADBEEFCAFEF00D
+#define SENTINEL_G 0x0BADF00DDEADBEEF
 
 // GLOBL holding the raw address of the leave trampoline, read by Go.
 GLOBL ·leaveCheckedPtr(SB), NOPTR, $8
-DATA  ·leaveCheckedPtr(SB)/8, $·leaveJITCheckedRaw(SB)
+DATA ·leaveCheckedPtr(SB)/8, $·leaveJITCheckedRaw(SB)
 
 // func enterJITChecked(fn uintptr, stack uintptr)
 // Sets sentinels in R29, R28 and R18, switches to the prepared stack and
@@ -34,26 +34,26 @@ DATA  ·leaveCheckedPtr(SB)/8, $·leaveJITCheckedRaw(SB)
 // leaveJITCheckedRaw (read from leaveCheckedPtr).  Only R0 and R3 are used
 // as scratch: caller-saved, and not among the checked registers.
 TEXT ·enterJITChecked(SB), NOSPLIT, $0-16
-	MOVD fn+0(FP), R0          // target (before SP switch)
-	MOVD R30, savedLR(SB)      // save link register
-	MOVD R3, savedSP(SB)       // save Go stack pointer
-	MOVD R29, savedFP(SB)      // save frame pointer (vet requires save before clobber)
-	MOVD g, savedG(SB)        // save g
-	MOVD $SENTINEL_FP, R29     // sentinel in the frame pointer
-	MOVD $SENTINEL_G, g        // sentinel in g
-	MOVD stack+8(FP), R3       // load prepared stack pointer
-	MOVD 0(R3), R30            // load leaveJITCheckedRaw into LR
-	MOVD R3, RSP               // SP stays on the leave slot: the kernel
-	                           // reads its first argument at SP+8
-	JMP  (R0)                  // branch to JIT function
+	MOVD fn+0(FP), R0 // target (before SP switch)
+	MOVD R30, savedLR(SB) // save link register
+	MOVD R3, savedSP(SB) // save Go stack pointer
+	MOVD R29, savedFP(SB) // save frame pointer (vet requires save before clobber)
+	MOVD g, savedG(SB) // save g
+	MOVD $SENTINEL_FP, R29 // sentinel in the frame pointer
+	MOVD $SENTINEL_G, g // sentinel in g
+	MOVD stack+8(FP), R3 // load prepared stack pointer
+	MOVD 0(R3), R30 // load leaveJITCheckedRaw into LR
+	MOVD R3, RSP // SP stays on the leave slot: the kernel
+	// reads its first argument at SP+8
+	JMP  (R0) // branch to JIT function
 
-// leaveJITCheckedRaw is the raw return trampoline.  It has NO Go function
-// declaration, so no ABIInternal wrapper is generated — the JIT function's
-// RET lands here directly, seeing R29 and g exactly as the function left
-// them.  It checks the sentinels, records violations in abiResult, then
-// restores the Go stack and returns.
+	// leaveJITCheckedRaw is the raw return trampoline.  It has NO Go function
+	// declaration, so no ABIInternal wrapper is generated; the JIT function's
+	// RET lands here directly, seeing R29 and g exactly as the function left
+	// them.  It checks the sentinels, records violations in abiResult, then
+	// restores the Go stack and returns.
 TEXT ·leaveJITCheckedRaw(SB), NOSPLIT, $0-0
-	MOVD $0, R4                // accumulated violation bits
+	MOVD $0, R4 // accumulated violation bits
 
 	// Check the frame pointer against the sentinel.
 	MOVD $SENTINEL_FP, R3
@@ -61,6 +61,7 @@ TEXT ·leaveJITCheckedRaw(SB), NOSPLIT, $0-0
 	BEQ  fp_ok
 	MOVD $1, R5
 	ORR  R5, R4, R4
+
 fp_ok:
 	// Check g against the sentinel.
 	MOVD $SENTINEL_G, R3
@@ -68,22 +69,24 @@ fp_ok:
 	BEQ  g_ok
 	MOVD $2, R5
 	ORR  R5, R4, R4
+
 g_ok:
 	CBZ  R4, restore
 	MOVD R4, ·abiResult(SB)
 
 restore:
-	MOVD savedSP(SB), R3       // restore Go stack pointer
+	MOVD savedSP(SB), R3 // restore Go stack pointer
 	MOVD R3, RSP
-	MOVD savedLR(SB), R30      // restore link register
-	MOVD savedFP(SB), R29      // restore frame pointer: Go code needs it the
-	                           // moment it resumes, violation or not
-	MOVD savedG(SB), g         // restore g
-	RET                        // return to Go caller
+	MOVD savedLR(SB), R30 // restore link register
+	MOVD savedFP(SB), R29 // restore frame pointer: Go code needs it the
+	// moment it resumes, violation or not
+	MOVD savedG(SB), g // restore g
+	RET  // return to Go caller
 
 // Package-level storage for the saved frame pointer.  Like savedSP and
 // savedLR in trampoline_arm64.s, this is assembly-side state: the amd64
 // checked trampoline saves the caller's frame pointer for vet's sake and
 // never restores it, and this file mirrors that.
 GLOBL savedFP(SB), NOPTR, $8
+
 GLOBL savedG(SB), NOPTR, $8

verify/abi_loong64.s

@@ -9,7 +9,7 @@
 //
 // The return trampoline (leaveJITCheckedRaw) is a raw TEXT symbol with no
 // Go function declaration, so the toolchain does NOT interpose an
-// ABIInternal wrapper — the JIT function RETs directly into the check
+// ABIInternal wrapper; the JIT function RETs directly into the check
 // code, which sees the registers exactly as the function left them.
 //
 // Go ABI on loong64 guarantees:
@@ -18,11 +18,11 @@
 //     spells this register "g"; R22 is not accepted.
 
 // Sentinel value chosen to be unlikely in normal execution.
-#define SENTINEL_G  0x0BADF00DDEADBEEF
+#define SENTINEL_G 0x0BADF00DDEADBEEF
 
 // GLOBL holding the raw address of the leave trampoline, read by Go.
 GLOBL ·leaveCheckedPtr(SB), NOPTR, $8
-DATA  ·leaveCheckedPtr(SB)/8, $·leaveJITCheckedRaw(SB)
+DATA ·leaveCheckedPtr(SB)/8, $·leaveJITCheckedRaw(SB)
 
 // func enterJITChecked(fn uintptr, stack uintptr)
 // Sets a sentinel in g (R22), switches to the prepared stack and jumps to
@@ -30,22 +30,22 @@ DATA  ·leaveCheckedPtr(SB)/8, $·leaveJITCheckedRaw(SB)
 // leaveJITCheckedRaw (read from leaveCheckedPtr).  Only R4 and R5 are used
 // as scratch: caller-saved, and R22 is not among them.
 TEXT ·enterJITChecked(SB), NOSPLIT, $0-16
-	MOVV fn+0(FP), R4           // target function address (A0)
-	MOVV R1, savedRA(SB)        // save return address (RA)
-	MOVV R3, savedSP(SB)        // save Go stack pointer (SP)
-	MOVV g, savedG(SB)          // save g
-	MOVV $SENTINEL_G, g         // sentinel in g
-	MOVV stack+8(FP), R5        // load prepared stack pointer (A1)
-	MOVV 0(R5), R1              // load leaveJITCheckedRaw into RA
-	MOVV R5, R3                 // SP stays on the leave slot: the kernel
-	                            // reads its first argument at SP+8
-	JIRL R0, R4, 0              // jump to JIT function
+	MOVV fn+0(FP), R4 // target function address (A0)
+	MOVV R1, savedRA(SB) // save return address (RA)
+	MOVV R3, savedSP(SB) // save Go stack pointer (SP)
+	MOVV g, savedG(SB) // save g
+	MOVV $SENTINEL_G, g // sentinel in g
+	MOVV stack+8(FP), R5 // load prepared stack pointer (A1)
+	MOVV 0(R5), R1 // load leaveJITCheckedRaw into RA
+	MOVV R5, R3 // SP stays on the leave slot: the kernel
+	// reads its first argument at SP+8
+	JIRL R0, R4, 0 // jump to JIT function
 
-// leaveJITCheckedRaw is the raw return trampoline.  It has NO Go function
-// declaration, so no ABIInternal wrapper is generated — the JIT function's
-// RET lands here directly, seeing g exactly as the function left it.  It
-// checks the sentinel, records violations in abiResult, then restores the
-// Go stack and returns.
+	// leaveJITCheckedRaw is the raw return trampoline.  It has NO Go function
+	// declaration, so no ABIInternal wrapper is generated; the JIT function's
+	// RET lands here directly, seeing g exactly as the function left it.  It
+	// checks the sentinel, records violations in abiResult, then restores the
+	// Go stack and returns.
 TEXT ·leaveJITCheckedRaw(SB), NOSPLIT, $0-0
 	// Check g against the sentinel.
 	MOVV $SENTINEL_G, R5
@@ -56,11 +56,11 @@ TEXT ·leaveJITCheckedRaw(SB), NOSPLIT, $0-0
 	MOVV R4, ·abiResult(SB)
 
 g_ok:
-	MOVV savedSP(SB), R5        // restore Go stack pointer
+	MOVV savedSP(SB), R5 // restore Go stack pointer
 	MOVV R5, R3
-	MOVV savedRA(SB), R1        // restore return address
-	MOVV savedG(SB), g          // restore g: Go code needs it the moment it
-	                            // resumes, violation or not
-	JIRL R0, R1, 0              // return to Go caller
+	MOVV savedRA(SB), R1 // restore return address
+	MOVV savedG(SB), g // restore g: Go code needs it the moment it
+	// resumes, violation or not
+	JIRL R0, R1, 0 // return to Go caller
 
 GLOBL savedG(SB), NOPTR, $8

verify/abi_riscv64.s

@@ -9,7 +9,7 @@
 //
 // The return trampoline (leaveJITCheckedRaw) is a raw TEXT symbol with no
 // Go function declaration, so the toolchain does NOT interpose an
-// ABIInternal wrapper — the JIT function RETs directly into the check
+// ABIInternal wrapper; the JIT function RETs directly into the check
 // code, which sees the registers exactly as the function left them.
 //
 // Go ABI on riscv64 guarantees:
@@ -18,11 +18,11 @@
 //     spells this register "g"; X27 is not accepted.
 
 // Sentinel value chosen to be unlikely in normal execution.
-#define SENTINEL_G  0x0BADF00DDEADBEEF
+#define SENTINEL_G 0x0BADF00DDEADBEEF
 
 // GLOBL holding the raw address of the leave trampoline, read by Go.
 GLOBL ·leaveCheckedPtr(SB), NOPTR, $8
-DATA  ·leaveCheckedPtr(SB)/8, $·leaveJITCheckedRaw(SB)
+DATA ·leaveCheckedPtr(SB)/8, $·leaveJITCheckedRaw(SB)
 
 // func enterJITChecked(fn uintptr, stack uintptr)
 // Sets a sentinel in g (X27), switches to the prepared stack and jumps to
@@ -30,22 +30,22 @@ DATA  ·leaveCheckedPtr(SB)/8, $·leaveJITCheckedRaw(SB)
 // leaveJITCheckedRaw (read from leaveCheckedPtr).  Only X5 and X6 are used
 // as scratch: caller-saved, and X27 is not among them.
 TEXT ·enterJITChecked(SB), NOSPLIT, $0-16
-	MOV  fn+0(FP), X5          // target function address (T0)
-	MOV  X1, savedRA(SB)       // save return address
-	MOV  X2, savedSP(SB)       // save Go stack pointer
-	MOV  g, savedG(SB)         // save g
-	MOV  $SENTINEL_G, g        // sentinel in g
-	MOV  stack+8(FP), X6       // load prepared stack pointer (T1)
-	LD   0(X6), X1             // load leaveJITCheckedRaw into RA
-	MOV  X6, X2                // SP stays on the leave slot: the kernel
-	                           // reads its first argument at SP+8
-	JALR X0, 0(X5)             // jump to JIT function
+	MOV  fn+0(FP), X5 // target function address (T0)
+	MOV  X1, savedRA(SB) // save return address
+	MOV  X2, savedSP(SB) // save Go stack pointer
+	MOV  g, savedG(SB) // save g
+	MOV  $SENTINEL_G, g // sentinel in g
+	MOV  stack+8(FP), X6 // load prepared stack pointer (T1)
+	LD   0(X6), X1 // load leaveJITCheckedRaw into RA
+	MOV  X6, X2 // SP stays on the leave slot: the kernel
+	// reads its first argument at SP+8
+	JALR X0, 0(X5) // jump to JIT function
 
-// leaveJITCheckedRaw is the raw return trampoline.  It has NO Go function
-// declaration, so no ABIInternal wrapper is generated — the JIT function's
-// RET lands here directly, seeing g exactly as the function left it.  It
-// checks the sentinel, records violations in abiResult, then restores the
-// Go stack and returns.
+	// leaveJITCheckedRaw is the raw return trampoline.  It has NO Go function
+	// declaration, so no ABIInternal wrapper is generated; the JIT function's
+	// RET lands here directly, seeing g exactly as the function left it.  It
+	// checks the sentinel, records violations in abiResult, then restores the
+	// Go stack and returns.
 TEXT ·leaveJITCheckedRaw(SB), NOSPLIT, $0-0
 	// Check g against the sentinel.
 	MOV  $SENTINEL_G, X6
@@ -56,11 +56,11 @@ TEXT ·leaveJITCheckedRaw(SB), NOSPLIT, $0-0
 	MOV  X7, ·abiResult(SB)
 
 g_ok:
-	MOV  savedSP(SB), X6       // restore Go stack pointer
+	MOV  savedSP(SB), X6 // restore Go stack pointer
 	MOV  X6, X2
-	MOV  savedRA(SB), X1       // restore return address
-	MOV  savedG(SB), g         // restore g: Go code needs it the moment it
-	                           // resumes, violation or not
-	JALR X0, 0(X1)             // return to Go caller
+	MOV  savedRA(SB), X1 // restore return address
+	MOV  savedG(SB), g // restore g: Go code needs it the moment it
+	// resumes, violation or not
+	JALR X0, 0(X1) // return to Go caller
 
 GLOBL savedG(SB), NOPTR, $8

verify/fuzz_extra_test.go

@@ -105,7 +105,7 @@ func TestBlockCount(t *testing.T) {
 
 func TestFillBuffer(t *testing.T) {
 	t.Run("zero", func(t *testing.T) {
-		// fillBuffer("zero") is a no-op — relies on make already zeroing.
+		// fillBuffer("zero") is a no-op; relies on make already zeroing.
 		buf := make([]byte, 16)
 		fillBuffer(buf, "zero")
 		for _, b := range buf {
@@ -159,7 +159,7 @@ func TestFuzzFuncChecked(t *testing.T) {
 	if !result.OK() {
 		t.Errorf("FuzzFuncChecked(sum): %s", result)
 	}
-	// Test with non-existent function — should report failure.
+	// Test with non-existent function; should report failure.
 	result = k.FuzzFuncChecked("nope", sig, 10, 0)
 	if result.OK() {
 		t.Error("FuzzFuncChecked(nope): expected failure")

verify/groundtruth_test.go

@@ -22,7 +22,7 @@ func mustRead(t *testing.T, path string) string {
 }
 
 func TestGroundTruthBasic(t *testing.T) {
-	// Use the simple test kernel — it assembles with go tool asm.
+	// Use the simple test kernel; it assembles with go tool asm.
 	gt, err := GroundTruth("../testdata/verify/basic_amd64.s")
 	if err != nil {
 		t.Fatalf("GroundTruth: %v", err)

verify/trampoline_amd64.s

@@ -18,13 +18,13 @@
 // Switches to the prepared stack and jumps to fn.  Does not return normally;
 // the JIT function's RET transfers control to leaveJIT.
 TEXT ·enterJIT(SB), NOSPLIT, $0-16
-	MOVQ fn+0(FP), AX      // target function address (before SP switch)
-	MOVQ SP, ·savedSP(SB)  // preserve the Go stack pointer
-	MOVQ stack+8(FP), SP   // switch to the prepared stack
+	MOVQ fn+0(FP), AX // target function address (before SP switch)
+	MOVQ SP, ·savedSP(SB) // preserve the Go stack pointer
+	MOVQ stack+8(FP), SP // switch to the prepared stack
 	JMP  AX
 
-// func leaveJIT()
-// Restores the Go stack pointer and returns to enterJIT's caller.
+	// func leaveJIT()
+	// Restores the Go stack pointer and returns to enterJIT's caller.
 TEXT ·leaveJIT(SB), NOSPLIT, $0-0
 	MOVQ ·savedSP(SB), SP
 	RET

verify/trampoline_arm64.s

@@ -15,32 +15,33 @@
 
 // func enterJIT(fn uintptr, stack uintptr)
 TEXT ·enterJIT(SB), NOSPLIT, $0-16
-	MOVD fn+0(FP), R0          // target function address
-	MOVD R30, savedLR(SB)      // save link register
-	MOVD R3, savedSP(SB)       // save Go stack pointer
-	MOVD stack+8(FP), R3       // load prepared stack pointer
-	MOVD 0(R3), R30            // load leaveJIT address into LR
-	MOVD R3, RSP               // switch to the prepared stack: SP stays on
-	                           // the leave slot, so the kernel reads its
-	                           // first argument at SP+8 per the frame
-	                           // convention (amd64 lays the stack out the
-	                           // same way)
-	JMP  (R0)                  // branch to JIT function
+	MOVD fn+0(FP), R0 // target function address
+	MOVD R30, savedLR(SB) // save link register
+	MOVD R3, savedSP(SB) // save Go stack pointer
+	MOVD stack+8(FP), R3 // load prepared stack pointer
+	MOVD 0(R3), R30 // load leaveJIT address into LR
+	MOVD R3, RSP // switch to the prepared stack: SP stays on
+	// the leave slot, so the kernel reads its
+	// first argument at SP+8 per the frame
+	// convention (amd64 lays the stack out the
+	// same way)
+	JMP  (R0) // branch to JIT function
 
-// func leaveJIT()
+	// func leaveJIT()
 TEXT ·leaveJIT(SB), NOSPLIT, $0-0
-	MOVD savedSP(SB), R3       // restore Go stack pointer
+	MOVD savedSP(SB), R3 // restore Go stack pointer
 	MOVD R3, RSP
-	MOVD savedLR(SB), R30      // restore link register
-	RET                        // return to Go caller
+	MOVD savedLR(SB), R30 // restore link register
+	RET  // return to Go caller
 
 // leaveRawAddr holds the raw .abi0 address of leaveJIT, read by call_arm64.go
 // in preference to reflect.ValueOf(leaveJIT), which returns the address of the
 // ABIInternal wrapper the linker interposes: the wrapper's prologue clobbers
 // the saved-register window the JIT call depends on.
 GLOBL ·leaveRawAddr(SB), NOPTR, $8
-DATA  ·leaveRawAddr(SB)/8, $·leaveJIT(SB)
+DATA ·leaveRawAddr(SB)/8, $·leaveJIT(SB)
 
 // Package-level storage for saved registers.
 GLOBL savedLR(SB), NOPTR, $8
+
 GLOBL savedSP(SB), NOPTR, $8

verify/trampoline_loong64.s

@@ -11,22 +11,23 @@
 
 // func enterJIT(fn uintptr, stack uintptr)
 TEXT ·enterJIT(SB), NOSPLIT, $0-16
-	MOVV fn+0(FP), R4           // target function address (A0)
-	MOVV R1, savedRA(SB)        // save return address (RA)
-	MOVV R3, savedSP(SB)        // save Go stack pointer (SP)
-	MOVV stack+8(FP), R5        // load prepared stack pointer (A1)
-	MOVV 0(R5), R1              // load leaveJIT address into RA
-	MOVV R5, R3                 // switch to the prepared stack: SP stays on
-	                            // the leave slot, so the kernel reads its
-	                            // first argument at SP+8
-	JIRL R0, R4, 0              // jump to JIT function
+	MOVV fn+0(FP), R4 // target function address (A0)
+	MOVV R1, savedRA(SB) // save return address (RA)
+	MOVV R3, savedSP(SB) // save Go stack pointer (SP)
+	MOVV stack+8(FP), R5 // load prepared stack pointer (A1)
+	MOVV 0(R5), R1 // load leaveJIT address into RA
+	MOVV R5, R3 // switch to the prepared stack: SP stays on
+	// the leave slot, so the kernel reads its
+	// first argument at SP+8
+	JIRL R0, R4, 0 // jump to JIT function
 
-// func leaveJIT()
+	// func leaveJIT()
 TEXT ·leaveJIT(SB), NOSPLIT, $0-0
-	MOVV savedSP(SB), R5        // restore Go stack pointer
-	MOVV R5, R3                 // restore SP
-	MOVV savedRA(SB), R1        // restore return address
-	JIRL R0, R1, 0              // return to Go caller
+	MOVV savedSP(SB), R5 // restore Go stack pointer
+	MOVV R5, R3 // restore SP
+	MOVV savedRA(SB), R1 // restore return address
+	JIRL R0, R1, 0 // return to Go caller
 
 GLOBL savedRA(SB), NOPTR, $8
+
 GLOBL savedSP(SB), NOPTR, $8

verify/trampoline_riscv64.s

@@ -11,22 +11,23 @@
 
 // func enterJIT(fn uintptr, stack uintptr)
 TEXT ·enterJIT(SB), NOSPLIT, $0-16
-	MOV  fn+0(FP), X5          // target function address (T0)
-	MOV  X1, savedRA(SB)       // save return address
-	MOV  X2, savedSP(SB)       // save Go stack pointer
-	MOV  stack+8(FP), X6       // load prepared stack pointer (T1)
-	LD   0(X6), X1             // load leaveJIT address into RA
-	MOV  X6, X2                // switch to the prepared stack: SP stays on
-	                           // the leave slot, so the kernel reads its
-	                           // first argument at SP+8
-	JALR X0, 0(X5)             // jump to JIT function
+	MOV  fn+0(FP), X5 // target function address (T0)
+	MOV  X1, savedRA(SB) // save return address
+	MOV  X2, savedSP(SB) // save Go stack pointer
+	MOV  stack+8(FP), X6 // load prepared stack pointer (T1)
+	LD   0(X6), X1 // load leaveJIT address into RA
+	MOV  X6, X2 // switch to the prepared stack: SP stays on
+	// the leave slot, so the kernel reads its
+	// first argument at SP+8
+	JALR X0, 0(X5) // jump to JIT function
 
-// func leaveJIT()
+	// func leaveJIT()
 TEXT ·leaveJIT(SB), NOSPLIT, $0-0
-	MOV  savedSP(SB), X6       // restore Go stack pointer
-	MOV  X6, X2                // restore SP
-	MOV  savedRA(SB), X1       // restore return address
-	JALR X0, 0(X1)             // return to Go caller
+	MOV  savedSP(SB), X6 // restore Go stack pointer
+	MOV  X6, X2 // restore SP
+	MOV  savedRA(SB), X1 // restore return address
+	JALR X0, 0(X1) // return to Go caller
 
 GLOBL savedRA(SB), NOPTR, $8
+
 GLOBL savedSP(SB), NOPTR, $8