Port onto libakstdlib 2b79aca and convert the eight bool predicates

akbasic's src/ now calls libakstdlib 313 times and raw libc 7 -- 2.2%
bypassed, against 86.4% on the same tree before this. The submodule bump
669b2b3 -> 2b79aca needed no source change of its own: the release is
drop-in for what akbasic already used.

Seven of the eight sites the earlier port left on raw libc change their own
signature rather than swallowing an error, per andrew's ruling on
libakstdlib#38. word_is, the is_waiting_for pair, the scanner's is_at_end,
peek, peek_next and match_next_char, format.c's overflow, and sink_akgl's
scroll/newline/putchar_at/echo_line/edit_key chain all return an
akerr_ErrorContext * and hand the answer back through an out parameter.
is_waiting_for and is_waiting_for_any are a public header change; every
call site that used one as a term in a condition hoists it into a
statement first.

verb_compare is the eighth and stays on strcmp. bsearch(3) fixes the
comparator's signature, so there is no out parameter to report through --
which is what libakstdlib#38 concluded. It carries a comment saying so and
saying why the bypass is safe there.

Six snprintf sites stay raw because they want truncation as an answer
rather than an error, and aksl_snprintf cannot express that until
libakstdlib#34 hands the required length back. Each of the six says so at
the site. Two of them, in host.c, are a latent defect rather than a
decision: a host type name over 31 characters truncates silently and two
sharing a prefix then collide, where structtype.c refuses the same case.

DLOAD leaked a file descriptor. Its read loop sat inside an ATTEMPT and the
PASS in it returned past CLEANUP, so a scan error left the file open.
Hoisting the loop into its own helper to convert fgets fixes it.

Refs libakstdlib#26, libakstdlib#38

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

src/format.c

@@ -12,6 +12,7 @@
 #include <string.h>
 
 #include <akerror.h>
+#include <akstdlib.h>
 
 #include <akbasic/error.h>
 #include <akbasic/format.h>
@@ -36,7 +37,7 @@ akerr_ErrorContext *akbasic_format_state_init(akbasic_FormatState *obj)
     PREPARE_ERROR(errctx);
 
     FAIL_ZERO_RETURN(errctx, (obj != NULL), AKERR_NULLPOINTER, "NULL format state in init");
-    memcpy(obj->chars, PUDEF_DEFAULTS, sizeof(obj->chars));
+    PASS(errctx, aksl_memcpy(obj->chars, PUDEF_DEFAULTS, sizeof(obj->chars)));
     SUCCEED_RETURN(errctx);
 }
 
@@ -161,11 +162,20 @@ static void measure_numeric(const char *field, size_t length, int *before, int *
     }
 }
 
-/** @brief Fill @p dest with @p width copies of `*`, the overflow marker. */
-static void overflow(char *dest, size_t width)
+/**
+ * @brief Fill @p dest with @p width copies of `*`, the overflow marker.
+ *
+ * Returns a context rather than `void` because the fill can fail and there was
+ * nowhere to say so. Both call sites are already inside `render_numeric`, which
+ * returns one. See libakstdlib #38.
+ */
+static akerr_ErrorContext *overflow(char *dest, size_t width)
 {
-    memset(dest, '*', width);
+    PREPARE_ERROR(errctx);
+
+    PASS(errctx, aksl_memset(dest, '*', width));
     dest[width] = '\0';
+    SUCCEED_RETURN(errctx);
 }
 
 /**
@@ -191,15 +201,21 @@ static akerr_ErrorContext *render_numeric(akbasic_FormatState *obj, const char *
     bool leadsign = false;
     bool trailsign = false;
     bool negative = (number < 0.0);
+    int written = 0;
 
     measure_numeric(field, length, &before, &after, &commas, &dollar, &leadsign, &trailsign);
     FAIL_ZERO_RETURN(errctx, (length + 1 <= len), AKBASIC_ERR_BOUNDS,
 		     "PRINT USING field of %zu characters does not fit", length);
 
-    snprintf(digits, sizeof(digits), "%.*f", after, (negative ? -number : number));
+    PASS(errctx, aksl_snprintf(&written, digits, sizeof(digits), "%.*f",
+			       after, (negative ? -number : number)));
 
-    point = strchr(digits, '.');
-    intlen = (point != NULL ? (size_t)(point - digits) : strlen(digits));
+    PASS(errctx, aksl_strchr(digits, '.', &point));
+    if ( point != NULL ) {
+	intlen = (size_t)(point - digits);
+    } else {
+	PASS(errctx, aksl_strlen(digits, &intlen));
+    }
 
     /* Group the integer part, if the field asked for separators. */
     used = 0;
@@ -213,7 +229,7 @@ static akerr_ErrorContext *render_numeric(akbasic_FormatState *obj, const char *
 	    used += 1;
 	}
     } else {
-	memcpy(grouped, digits, intlen);
+	PASS(errctx, aksl_memcpy(grouped, digits, intlen));
 	used = intlen;
     }
     grouped[used] = '\0';
@@ -226,7 +242,7 @@ static akerr_ErrorContext *render_numeric(akbasic_FormatState *obj, const char *
      * printing wider than asked, which would misalign every later column.
      */
     if ( (int)intlen > before ) {
-	overflow(dest, length);
+	PASS(errctx, overflow(dest, length));
 	SUCCEED_RETURN(errctx);
     }
 
@@ -252,13 +268,13 @@ static akerr_ErrorContext *render_numeric(akbasic_FormatState *obj, const char *
 	    used += 1;
 	}
     }
-    memcpy(dest + used, grouped, (size_t)group);
+    PASS(errctx, aksl_memcpy(dest + used, grouped, (size_t)group));
     used += (size_t)group;
 
     if ( after > 0 ) {
 	dest[used] = obj->chars[AKBASIC_PUDEF_POINT];
 	used += 1;
-	memcpy(dest + used, (point != NULL ? point + 1 : ""), (size_t)after);
+	PASS(errctx, aksl_memcpy(dest + used, (point != NULL ? point + 1 : ""), (size_t)after));
 	used += (size_t)after;
     }
     if ( trailsign ) {
@@ -271,7 +287,7 @@ static akerr_ErrorContext *render_numeric(akbasic_FormatState *obj, const char *
      * because a printed -5 that reads as 5 is worse than a row of stars.
      */
     if ( negative && !leadsign && !trailsign ) {
-	overflow(dest, length);
+	PASS(errctx, overflow(dest, length));
 	SUCCEED_RETURN(errctx);
     }
     dest[used] = '\0';
@@ -283,26 +299,27 @@ static akerr_ErrorContext *render_string(const char *field, size_t length, const
 					 char *dest, size_t len)
 {
     PREPARE_ERROR(errctx);
-    size_t textlen = strlen(text);
+    size_t textlen = 0;
     size_t pad = 0;
 
+    PASS(errctx, aksl_strlen(text, &textlen));
     FAIL_ZERO_RETURN(errctx, (length + 1 <= len), AKBASIC_ERR_BOUNDS,
 		     "PRINT USING field of %zu characters does not fit", length);
     if ( textlen > length ) {
 	/* Truncated, not starred: BASIC 7.0 cuts a string to its field. */
-	memcpy(dest, text, length);
+	PASS(errctx, aksl_memcpy(dest, text, length));
 	dest[length] = '\0';
 	SUCCEED_RETURN(errctx);
     }
 
-    memset(dest, ' ', length);
+    PASS(errctx, aksl_memset(dest, ' ', length));
     dest[length] = '\0';
     if ( field[0] == '=' ) {
 	pad = (length - textlen) / 2;
     } else {
 	pad = length - textlen;
     }
-    memcpy(dest + pad, text, textlen);
+    PASS(errctx, aksl_memcpy(dest + pad, text, textlen));
     SUCCEED_RETURN(errctx);
 }
 
@@ -313,6 +330,9 @@ akerr_ErrorContext *akbasic_format_using(akbasic_FormatState *obj, const char *f
     size_t start = 0;
     size_t length = 0;
     size_t used = 0;
+    size_t renderedlen = 0;
+    size_t formatlen = 0;
+    int written = 0;
     bool numeric = false;
 
     FAIL_ZERO_RETURN(errctx, (obj != NULL && format != NULL && value != NULL && dest != NULL),
@@ -343,12 +363,15 @@ akerr_ErrorContext *akbasic_format_using(akbasic_FormatState *obj, const char *f
     }
 
     /* Literal text before the field, the field, then literal text after it. */
-    used = strlen(rendered) + strlen(format) - length;
+    PASS(errctx, aksl_strlen(rendered, &renderedlen));
+    PASS(errctx, aksl_strlen(format, &formatlen));
+    used = renderedlen + formatlen - length;
     FAIL_ZERO_RETURN(errctx, (used + 1 <= len), AKBASIC_ERR_BOUNDS,
 		     "PRINT USING result of %zu characters does not fit", used);
-    memcpy(dest, format, start);
-    memcpy(dest + start, rendered, strlen(rendered));
-    snprintf(dest + start + strlen(rendered), len - start - strlen(rendered),
-	     "%s", format + start + length);
+    PASS(errctx, aksl_memcpy(dest, format, start));
+    PASS(errctx, aksl_memcpy(dest + start, rendered, renderedlen));
+    /* The check above already proved the tail fits, so this cannot truncate. */
+    PASS(errctx, aksl_snprintf(&written, dest + start + renderedlen,
+			       len - start - renderedlen, "%s", format + start + length));
     SUCCEED_RETURN(errctx);
 }