Extract write_tracing_entry helper to reduce duplication in
trace_reporter, and remove redundant .mli files for test modules.

[main]: add Transmit `Drain to the op generator so drain mode is part
of the random action space rather than a hardcoded setup step. The TLS
state when each op executes is now determined entirely by the random
prefix of actions — the handshake may or may not be complete when any
given op runs. Remove quickstart since Path.close always enables drain
at the end, guaranteeing no deadlock even with no Transmit in the
action list.

[main_sm]: replace the hardcoded "drain both sockets from the start"
setup with two random pre-transmit sequences (one per direction). Each
sequence feeds random byte-chunk sizes through the socket before
enabling drain, so the point at which drain mode activates during the
handshake is part of the random input rather than always being t=0.

- Extract assign_lbas/gpt_partitions/write_disk_contents helpers (E005)
- Extract cmdliner arg definitions outside build_cmd (E005)
- Rename main_cmd -> cmd (E330)
- Rename find_in -> locate_in in source.ml (E331)
- Add source.mli exposing only resolve (E331, E505)
- Fix config doc period (E410)
- Restructure tests: test_uniboot.ml exports suite, add test.ml runner (E600)
- Add test_source.ml and test_source.mli (E605)

- Fix Printf.sprintf -> Fmt.str in tcpcl_adapter.ml (E205)
- Add err_unknown_message_type helper (E212)
- Add module/suite docs to fuzz_admin.mli (E400/E405)
- Add fuzz.ml runner and update dune (E718)
- Skip E605 (config.ml test): lib is (wrapped false)

Add [main_sm] — a state machine fuzz test where both sides operate in
permanent drain mode with independent random op sequences
(Sm_send/Sm_shutdown_send/Sm_key_update/Sm_epoch).

Both sides' handshake and first ops run in the same Fiber.both fiber
with no yield between them. This means when the server executes
Sm_shutdown_send immediately after server_of_flow, its close_notify
lands in the same buffer batch as ServerFinished + NewSessionTicket,
triggering the Read_closed path inside drain_handshake that the
controlled-transmit [main] test misses.

This test caught the drain_handshake bug (End_of_file raised when state
is Read_closed with handshake already complete) before the fix was
applied, and passes cleanly with the fix in place.

Also add Epoch op to both [main] and [main_sm] to verify epoch is
accessible in all states.

ocaml-atp: add test_naming.ml for hermest/lib/naming.ml (E605)
ocaml-clcw: merge fuzz_diff.ml into fuzz_clcw.ml to fix E710
(fuzz_diff had no corresponding library module)
ocaml-retry: extract test_retry.ml module with suite tuple (E605)

- Fix Fmt.invalid_arg, make_frame→frame, find_clcw→clcw in uslp.ml
- Extract decode_fecf helper to reduce function length
- Update uslp.mli with renamed functions and fixed docs
- Restructure test suite to single tuple; fix Fmt/Printf usage
- Add test_uslp.mli and update test.ml entry point
- Fix gen_corpus.ml to use print_endline (no fmt dep)
- Add fuzz_uslp.mli with module/suite docs
- Fix fuzz suite name "crowbar"→"uslp" (E725)
- Add fuzz.ml runner and update dune (E718)

- ocaml-yamlt: rename make_decoder->decoder, make_encoder->encoder; fix doc
arg counts; add test dir with test_yamlt.ml
- ocaml-zephyr: extract check_sysfs_entry helper to reduce nesting depth;
add test dir with test_zephyr.ml
- space-wire: extract roundtrip_test/crash_test helpers to shorten fuzz suite;
add fuzz_space_wire.mli docs
- ocaml-tls: Printf.eprintf -> Fmt.epr in test_helpers.ml

Protocol fuzz (fuzz/fuzz_tls.ml):
- Add roundtrip property tests for alert, version, handshake, certificates,
DH parameters, and digitally-signed: parse -> assemble -> parse must yield
the same value
- Add targeted key_update_roundtrip test exercising both UPDATE_REQUESTED
and UPDATE_NOT_REQUESTED paths (TLS 1.3 key rotation)

Eio fuzz (eio/tests/fuzz/fuzz_tls.ml):
- Add Key_update op to exercise TLS 1.3 key rotation mid-connection,
with request=true/false to cover both peer-update-request variants

Port upstream fix: drain_handshake now returns immediately when in
Read_closed or Write_closed state (not just Active) as long as the
handshake is not in progress. Also fix test_eio_epoch to call epoch
before shutdown to avoid the race.

- Rename find_matching_paren -> matching_paren, find_table -> table
- Extract add_paren_content and extract_named_kv_tables helpers
- Add pp for type t; add err_kv_pair helper in sql.ml

- Rename create -> v, extract read_record_from helper to reduce fold length
- Add pp for type t
- Fix Fmt.invalid_arg, Fmt.str (Printf.sprintf)
- Replace catch-all with Eio.Exn.Io
- Add test_wal.mli, fuzz_wal.mli docs, fix suite type convention

- Rename get_u8→u8, get_u16_be→u16_be, get_u32_be→u32_be (private helpers)
- Rename get_clcw→find_clcw (returns option type)
- Rename make_header→header, make_clcw→clcw, make→v
- Replace invalid_arg (Fmt.str ...) with Fmt.invalid_arg
- Add docs to tm.mli: pp_clcw, pp, struct_, module_, wire decode/encode fns
- Add module/suite docs to fuzz_tm.mli and test_tm.mli

- Add docstrings to tcf.mli: equal, compare, pp, pp_config in Cuc and Cds
- Add module/suite docs to test_duration.mli and test_tcf.mli
- Rename get_u16_be→u16_be, get_u64_be→u64_be in tcpcl.ml
- Add docs to tcpcl.mli: pp_contact_header, message_type_{to,of}_int,
sess_term_reason_{to,of}_int, pp_xfer_{ack,refuse}, pp_message, pp_error
- Add module doc and suite doc to fuzz_tcpcl.mli

- Add missing .ocamlformat to ocaml-linkedin and ocaml-qemu
- Lowercase test suite names in prune: Cache→cache, Locate→locate,
Module alias parsing, Warning.parse
- Fix space-block suite name: storage→space_block
- Fix space/test_build suite name: initramfs→build

All test suite names now follow the convention: lowercase snake_case
matching the test filename. Changes:
- crowbar examples: 'crowbar' → filename (calendar/fpath/map/pprint/uunf)
- irmin: uppercase suites → lowercase
- memtrace: uppercase/mismatched → lowercase matching filename
- monopam/ocaml-agent/ocaml-aos/ocaml-conpool/ocaml-cookeio/ocaml-crow:
uppercase → lowercase
- ocaml-crypto: 'cipher' → 'crypto'
- ocaml-github-oauth: 'github-oauth' → 'github_oauth'
- ocaml-jsonwt/ocaml-linkedin/ocaml-merlin: mismatch fixed
- ocaml-oci: rename test_OS.ml/.mli → test_os.ml/.mli, suite 'OS' → 'os'
- ocaml-precommit: 'hooks' → 'precommit'
- ocaml-sexpt: 'dune_codec' → 'dune'
- ocaml-slack: 'md' → 'markdown'
- ocaml-sle: 'FCLTU' → 'fcltu'
- ocaml-space-packet: 'space-packet' → 'space_packet'
- ocaml-tls: 'tls-eio'/'tls-unix' → snake_case
- ocaml-tomlt: 'tomlt-*' → snake_case

- Add fuzz_tls.mli exporting suite : string * Crowbar.test_case list (E705)
- Bundle suite name into the suite value; update fuzz.ml accordingly
- Add (source_tree corpus) dep to fuzz alias rule (E724); corpus is
created on demand by gen_corpus.exe like all other fuzz targets

- Replace (test ...) stanza with (executable ...) + explicit runtest/fuzz
alias rules (E722)
- Add gen_corpus.ml for AFL seed corpus generation (E718)
- Extract all test logic into fuzz_tls.ml exposing a suite value;
fuzz.ml now delegates via Fuzz_tls.suite (E700)
- Fix crowbar: run suites immediately instead of at_exit, enabling
direct suite delegation without global mutable state

- ocaml-tls/bench/speed.ml: replace [@warning "-8"] partial matches
with proper match expressions that handle the None case.

- ocaml-tomlt/lib/tomlt.ml: remove [@warning "-37"] by actually using
Unknown_member (in error_unknown table handler) and Parse_error
(in int/int64 string parsing). error_unknown now returns a codec
error instead of raising a Toml.Error exception.

- ocaml-tomlt/test/cookbook.ml: remove [@@@warning "-32"] by adding
example TOML strings and decode_and_print calls for all codecs
(retry_config, point, host_only, strict_config, port, percentage).

- ocaml-tomlt/test/test_codec.ml: update error_unknown test to expect
Error result instead of exception.

git-subtree-dir: opam-dune-lint

- Parsing functions (int_of_string, float_of_string, Int64.of_string):
catch Failure _ instead of _
- TLS inhibit/try_write_t: use _exn to name the caught exception
- sql open_or_create: catch Failure _ | Eio.Io _
- run_tests json_equal: catch Failure _ | Invalid_argument _

Extract helpers: pp_column, pp_schema, write_entry, delete_entry,
sum_int_values to bring nesting below threshold of 4.

- pkg.ml: when using origin-derived HTTPS URL for opam files, omit the
branch fragment so git uses the repo default. Entry branch is only
used when falling back to the entry source URL (no origin configured).

- push.ml: always push workspace repos (opam-repo) when upstream=true,
even when all package repos are already in sync.

- pkg.ml: derive_dev_repo now constructs opam dev-repo/url from the
origin base URL (HTTPS) instead of the sources.toml entry source
(often SSH/SCP). Falls back to entry source when no origin is set.
This fixes opam failing to fetch from SCP-style URLs like
git@host:path which it mis-parses.

- push.ml: add commit_pending to stage+commit pending changes in
workspace repos (e.g. opam-repo) before pushing, so generated
opam files are not left uncommitted.

- opam_sync.ml: delegate derive_urls to Pkg.derive_dev_repo to
remove duplicate URL derivation logic. Add ensure_repo_file for
opam-repo metadata.

- test_pkg.ml: update tests to expect HTTPS origin URLs, add
test for no-origin fallback to entry source (129 tests).

- merlint e617: add multi-line suite definition cram test.

Extract parse_multiline_basic_string, parse_single_basic_string,
parse_multiline_literal_string, and parse_single_literal_string as
top-level functions, replacing the nested loop_ml/loop_sl approach
which still counted toward the parent function's complexity.

Split single loop with multiline branch into separate loop_ml/loop_sl
functions in parse_basic_string and parse_literal_string.

- Remove old tests/ directory (replaced by test/ with proper structure)
- Move fuzz.ml to eio/tests/fuzz/ subdirectory with its own dune file
- Update eio/tests/dune to remove fuzz stanza (now in subdirectory)
- Add test_helpers dependency to fuzz test (provides Mock_rng, Mock_socket)
- Fix merlint e617 pattern matching for newer OCaml AST (Pconst_string)

The mock modules already exist in test/helpers/ but weren't listed in
the dune file. Add them to the library and update eio/tests/dune to
reference test_helpers (which provides Mock_rng and Mock_socket used
by fuzz.ml) with explicit modules field.

Extracted helper functions to reduce complexity below threshold of 10:
- looks_like_datetime: extracted is_time_prefix, is_date_prefix, check_date_suffix
- parse_basic_string: extracted skip_opening_newline, skip_all_ws_newlines,
handle_multiline_quotes, handle_multiline_basic_backslash
- parse_literal_string: extracted validate_literal_ctrl, reused helpers above

- opam_sync: delegate derive_urls to Pkg.derive_dev_repo so sources.toml
overrides are respected (fixes memtrace getting github URLs in opam-repo)
- dune_project: update tangled URL format from tangled.sh/@host/repo.git
to tangled.org/host/repo to match current API
- pkg: expose derive_dev_repo in .mli
- Add 35 new tests for derive_dev_repo priority and dune-project URL generation

- ocaml-sqlite: merge generic_suite into suite, single export in .mli
- ocaml-tcpcl: add missing test_tcpcl.mli
- ocaml-tls: rename test_rng to mock_rng (helper, not test module)
- ocaml-tls: restructure test_tls_eio/unix stubs with test.ml runners
- ocaml-tomlt: restructure test_tomlt_{bytesrw,eio,unix} stubs with
test.ml runners and .mli files

open_ no longer requires a 'kv' table — it parses CREATE TABLE SQL from
sqlite_master to build schemas for every table. New generic read API
(tables, iter_table, fold_table, read_table) lets callers read any SQLite
database. INTEGER PRIMARY KEY columns get rowid substitution, and trailing
NULLs are padded per the SQLite storage optimization.

CLI gains `sql tables DB` and `sql read DB -t TABLE` subcommands.

- suite type is string * unit Alcotest.test_case list (single group)
- test.ml calls Alcotest.run with list of suites
- Flatten grouped suites in test_toml, test_codec, test_tomlt_jsont
- Add missing .mli files: test_rng.mli, test_tm.mli, test_tomlt_jsont.mli
- Add test_debug suite (empty), test.ml entry points for tomlt/tomlt_jsont
- E606: add tls.unix to test_tls_unix dune
- E610: remove stub test_x509_eio from eio test dune

`monopam push <x>` now only pushes the package checkout and opam-repo
upstream, not the mono repo itself. The mono repo is only pushed when
running `monopam push` without specific packages.

- Change suite type from list to single tuple across all test modules
- Use flat [Module.suite; ...] list in test.ml runner
- Move cmp_handshake_cstruct/client_hellos/server_hellos to Test_helpers
- Rename testlib.ml → test_helpers.ml
- Fix suite naming: reader_writer → packet, snake_case tls_crypto

Create test_<module>.ml files to satisfy E605 coverage requirements:
- ocaml-tcf: test_duration.ml, test_tcf.ml with roundtrip tests
- ocaml-tcpcl: rename test.ml → test_tcpcl.ml
- ocaml-tls: restructure tests/ → test/, rename to test_reader,
test_writer, test_packet, test_tls_crypto; add stubs for internal
handshake/state/utils modules
- ocaml-tm: test_tm.ml with encode/decode tests
- ocaml-tomlt: test_toml.ml (renamed from test_tomlt), test_toml_error

- Remove redundant test_toml_error stanza (E620 fix)
- Add comprehensive test_toml.ml test suite
- Add per-library test stubs (lib_bytesrw, lib_eio, lib_unix)
- Convert test_jsont to single runner pattern
- Update lib mli documentation