Parser:
- assign IN explicit precedence (between AMPERSAND and EQEQ) so
arithmetic/relational operators bind tighter than membership; this
drops the 32 shift/reduce conflicts the IN production used to cause.
- accept patterns (not just identifiers) on the value/key positions of
[some ... in ...], so [some "foo" in [...]] and [some {"a": x} in
data.array] parse against the [SomeIn] AST shape.
- add a [ref_brack_head] alternative for the legacy [p[100]] body-less
partial-set form.

Evaluator:
- [eval_some_in] uses [bind_value_pattern] so [some] handles literal
patterns, array/object destructuring, and bound vars.
- [object.get] with an [Array] path walks nested objects/arrays and
returns the default when any segment is missing; non-object subjects
now error.
- glob.match recognises [{a,b,...}] alternation and [[!...]] negated
classes; default delimiter is [.] (matching gobwas/glob), and an
empty array is treated like the default.
- regex.* switched to the Re.Pcre flavour so backslash escapes ([\[],
[\d], etc.) match Go's regexp; regex.replace now substitutes [$N]
group references.

[monopam lint] enforces a convention: when sources.toml declares an
[upstream] for a subtree, the [dune-project (source ...)] field must
point at that upstream URL (so opam consumers find the canonical
issue tracker / source history). I had set [upstream =
github.com/ocaml/dune] but [(source (tangled gazagnaire.org/ocaml-xdg))]
in dune-project, which the lint rejected as a Source-URL mismatch.

The right fix is option (b): treat ocaml-xdg as its own canonical
source. The fork has diverged enough -- merged with the previous
nox-xdge Eio wrapper, renamed C symbol to dodge link collisions,
tests rewritten -- that pointing opam metadata at upstream dune
would just send users somewhere that doesn't have any of the changes.
The "fork of dune's xdg" attribution still lives in the description,
in xdg.ml's header comment, and in LICENSE.md (which keeps Jane
Street's copyright).

Core semantics:
- structural unification now destructures arrays/objects against bound
values, and exposes [bind_value_pattern] for matching AST patterns
against concrete [Value.t]s.
- function-rule parameters are unified with [bind_value_pattern], so
literal patterns ([multi(1, x)], [arrays([a, b])], [objects({...})])
match by value; function rules with [default] fall back when no spec
matches; body-less function rules return the head value directly.
- the call output-arg form destructures [Array]/[Object] patterns at
the result position, so [split(s, sep, [x])] binds [x] correctly.
- [Membership] is evaluated by walking the collection and pairing
values with their indices/keys for the [k, v in c] form.
- [object.remove] accepts object/set/array key collections and errors
on non-object subjects; [array.flatten]/[array.concat]/[array.reverse]
reject non-array inputs.

New builtins (with the helpers they need at file scope):
- glob.match / glob.quote_meta with a backtracking matcher honouring
`**` and the `[a-z]` character classes.
- units.parse and units.parse_bytes with case-insensitive binary
suffixes and quote stripping; [m] vs [M] disambiguates milli/mega.
- time.now_ns, time.parse_duration_ns, time.parse_rfc3339_ns,
time.parse_ns, time.date, time.clock, time.weekday, time.add_date,
time.diff. Calendar math uses [days_from_civil] (Howard Hinnant)
instead of [Unix.mktime] to stay timezone-independent. Adds [unix]
to the library's deps.
- net.cidr_contains parsing IPv4 and IPv6 (mapped through v4-in-v6).
- json.filter, json.remove, json.patch (RFC 6902: add/replace/remove/
move/copy/test) with a JSON-pointer parser.
- strings.any_prefix_match, strings.any_suffix_match, strings.count,
strings.reverse (UTF-8 code-point reversal), indexof_n, format_int.
- substring indexes by UTF-8 code points and rejects negative offsets.

- accept future-keyword identifiers in dotted refs so `import
future.keywords.in` and `import rego.v1` parse as ordinary imports.
- add `r=ref_expr op=assign_op v=expr b=rule_body` and the body-less
variant so `p = v { body }` and `p = v` are parsed as complete rules
instead of falling through to RuleDefault.
- introduce `infix_expr_no_in` / `expr_no_in` and a literal-level
`k, v in c` form (plus the parenthesised atom variant) so the
membership `in` operator and its keyed form both parse with the
expected precedence.
- treat the `contains` builtin as an identifier in atom position so
`contains("...", "...")` calls don't collide with the partial-set
`contains` keyword.
- in the lexer, peek past a synthetic SEMICOLON before `else` so
`} else` across a newline doesn't break the rule body's else_chain.

Sweep of every consumer that previously depended on either the
standalone [nox-xdge] package (the Eio wrapper) or dune's internal
[xdg] library. Both are gone after the previous commit; consumers
now point at the merged [nox-xdg] package's two libraries:

- Code that used the Eio wrapper ([Xdge.v fs app_name],
[Xdge.config_dir], etc.) -> [Xdg_eio.foo], library [nox-xdg.eio].
- Code that used the pure spec ([Xdg.create ~env ()],
[Xdg.cache_dir]) -> unchanged module name [Xdg], library
[nox-xdg].

Touched packages:

- gauth, gdocs, gsheets, gslides -- the Google credential stack;
[Gauth.Local_store] uses [Xdg_eio] internally.
- ocaml-requests, ocaml-cookie -- HTTP client and cookie jar;
[Requests.t] takes an [?xdg:Xdg_eio.t] for cookie persistence.
- ocaml-agent, ocaml-atp, ocaml-slack, ocaml-linkedin, monopam,
uniboot -- CLIs that compute their own config / cache / state
paths via the Eio wrapper.
- ocaml-oci -- uses the pure spec ([Xdg.cache_dir]) for OCI image
layout; migrated from dune-internal [xdg] to [nox-xdg].

Mechanical changes per package:

- [dune-project]: opam dep [nox-xdge] -> [nox-xdg].
- [lib/dune] and [bin/dune]: library reference [nox-xdge] ->
[nox-xdg.eio] (or [nox-xdg] for the rare pure-spec consumer).
- [.ml] / [.mli]: [Xdge] -> [Xdg_eio].

Generated [.opam] files updated by the dune build accordingly.

New package [nox-xdg], replacing the prior split between dune's
internal [xdg] library (META description: "[Internal] XDG base
directories specification implementation") and the standalone
[nox-xdge] Eio wrapper.

The fork was driven by two needs:

- dune's [xdg] is marked [Internal] in its META; dune doesn't promise
to keep it stable across releases. Building credential-handling
CLIs ([gdocs], [gsheets], [gslides], [gauth.Local_store]) on top of
a build-tool internal is a stability risk.
- The split layout had [nox-xdge] (Eio wrapper) depending on dune's
[xdg] (pure spec) by their shared library name [xdg], blocking any
attempt to give the wrapper a cleaner name.

Merging into one package solves both. The package provides two
libraries from one [ocaml-xdg/] source tree:

- [nox-xdg] (module [Xdg]) -- pure spec, no Eio dep.
lib/xdg.ml + xdg_stubs.c
- [nox-xdg.eio] (module [Xdg_eio]) -- Eio backend on top of the
resolver. lib/xdg_eio.ml

The pure spec is a Unix+Windows-faithful fork of dune's
[otherlibs/xdg/xdg.ml] and [xdg_stubs.c]. Original code by Jane
Street (MIT); LICENSE.md keeps both copyright lines. The C symbol
[dune_xdg__get_known_folder_path] is renamed to
[nox_xdg__get_known_folder_path] so a downstream binary that links
both this package and dune's internal xdg doesn't hit duplicate
symbols.

One small divergence from upstream: the [make] helper in xdg.ml
defers calling the C stub until the env-var override misses, instead
of computing it eagerly. Identical behaviour on Windows; lets the
test suite exercise the [~win32:true] code path from a non-Windows
host as long as every XDG_*_HOME is set. Documented inline.

Tests:

- [test/test_xdg.ml] (22 cases) -- spec-anchored: every default,
every env-var override, relative/empty/missing values per §4,
HOME interpretation, snapshot semantics at create-time, and the
full Windows extension.
- [test/eio/test_xdg_eio.ml] (5 cases) -- carried over from the old
xdge package, now driving the [Xdg_eio] module.
- [test/eio/cram/] -- the old xdge cram tests, against the renamed
module.

The previous [xdge/] subtree is removed; its [nox-xdge.opam] is
gone. Consumer migration (gauth, gdocs, gsheets, gslides, requests,
cookie, agent, atp, slack, linkedin, oci, uniboot, monopam) lands
in the next commit.

Also fixes an unrelated build break in [monopam-info/lib/index]: the
[Dune.Package.Library.codec] API was removed from [nox-dune] in
favour of the higher-level [Dune.Package.libraries] decoder; switch
to the new entry point and drop the now-unused [nox-sexp] dep.

Each file kind (File, Project, Workspace, Package) is now a self-
contained module with abstract t and the standard six-verb IO shape
(of_string / of_string_exn / to_string / of_reader / of_reader_exn /
to_writer). Sexp.t no longer appears in any signature; Dune.Error is
aliased from Sexp.Error.

- Project.t, Workspace.t, File.t made abstract; their old record
exposures (packages : Sexp.t list, env : Sexp.t option, etc.) are
now internal. Round-trip via the codec preserves unrecognized
stanzas.
- Project.Package is a typed view of a (package ...) stanza
(name / synopsis / depends).
- Workspace.Context.kind drops the (Other of Sexp.t) leak; unrecognized
context shapes still round-trip via the codec but are filtered out
of Workspace.contexts.
- File.t internally classifies stanzas (Library / Executable / Test /
Other) so library_names / private_library_names / executable_names /
test_names are typed projections, not Sexp tree walks.
- Dune.Package.libraries reads every (library ...) stanza from a
dune-package file; Sexp.Codec.decode_value stays internal.
- ?indent:int now visibly affects to_string: lists with non-atom
children wrap, single-child and atom-only lists <=4 stay inline.

Drops the old public Sexp-level helpers (parse, to_sexps, per-module
to_string, field / fields / field_atom / field_list / field_atoms /
set_field / remove_field, the library/executable/test builders,
pp_dune, to_string_dune, find_stanza, ...). The functionality lives
internally where each module needs it.

Caller migrations:
- monopam/lib/lint.ml: Dune.File.parse -> Dune.File.of_string.
- ocaml-dune/test/test_dune.ml rewritten against the new API.

README rewritten using the new API; mdx libraries reduces to
(libraries nox-dune) -- no nox-sexp leak.

Lift the per-tool [Store] modules into one [Gauth.Local_store]. All
three Google CLI tools ([gdocs], [gsheets], [gslides]) now point at a
single XDG config directory ([$XDG_CONFIG_HOME/google/{client,token}.json])
so a user runs [install] and [login] once and every tool that
recognizes the granted scopes can read the resulting token.

Before, each package had a near-identical 60-line [Store] (atomic
write, save/load client and token, [acquire] returning a refreshable
[Gauth.token]) keyed off its own per-tool app name -- three copies
with cosmetic differences (the [cli_name] in the
"Run [<tool> install] first" diagnostic). Each per-tool [Store] is
now a thin wrapper:

include Gauth.Local_store
let acquire http ~clock ~fs =
Gauth.Local_store.acquire http ~clock ~fs ~cli_name:"<tool>"

The shared [Local_store] keeps the atomic-write pattern from the
prior [ocaml-gdocs] / [ocaml-gsheets] / [ocaml-gslides] commits
(sibling [.tmp.<pid>] file with [`Exclusive 0o600], then [rename]
over the target -- no chmod-after-write race, crash-before-rename
leaves the original target untouched).

Side-effect: on first run after this lands, users must re-run
[install] and [login] -- their existing
[~/.config/{gdocs,gsheets,gslides}/] directories are no longer
consulted. Pre-1.0 packages, no migration script.

Move:

- [Gauth.Local_store] in [gauth/lib/gauth.{ml,mli}]: client record,
config_dir/client_path/token_path, save_client/load_client,
save_token/load_token, clear_token, persist, acquire (with
[~cli_name:string] for the diagnostic).
- [gauth] now depends on [nox-xdge] for XDG paths (and [unix] which
was already pulled in transitively).
- [Gdocs.Store], [Gsheets.Store], [Gslides.Store] reduce to ~3 lines
each ([include Gauth.Local_store] + specialized [acquire]).
- Per-tool [lib/dune] and [dune-project] drop their direct
[nox-xdge] / [unix] deps -- those come transitively through gauth.
- Two store tests updated: the "config dir contains '<tool>'"
assertions become "config dir is shared 'google'" since the path
is now [.../google/...] for every tool.

All 307 tests across the four packages pass: gauth (5), gdocs (61),
gsheets (156), gslides (85). [monopam lint] reports the same
pre-existing [oauth unused] / [base64 ptime unused] false positives,
nothing new.

Followups still in flight: the [nox-xdge] -> [nox-xdg] rename is
tracked separately so it can sweep every consumer in one commit
without conflating with this refactor.

Port the [Comments] module from [ocaml-gdocs] / [ocaml-gslides] (Drive
API client; drive.readonly scope) and add cell-level anchoring to the
Markdown renderer.

[Gsheets.Markdown.of_values ?comments v] takes an optional comments
list and renders each comment as a GFM footnote at the cell its Drive
anchor points to. The anchor format is ["=B5+&{...}"]; we extract the
A1 cell ref (uppercase columns only, to avoid greedy matches against
sheet names like ["Sheet1"]) and convert it to (row, col). The
rendered cell receives a [[^cN]] inline reference; the footnote
definition at the bottom of the table is labelled with the relative
cell ref ([[^c1]: **author** at B2: content]) so a reader can locate
the cell from the definition list.

Two new helpers support this:

- [Gsheets.Comments.anchor_cell : t -> (int * int) option] parses a
comment's anchor string into absolute spreadsheet coordinates.
- [Gsheets.Values.range_offset : t -> int * int] parses the values
range string ([Sheet1!B3:D10] -> (2, 1)) so the renderer can map
absolute anchor coordinates to positions inside the rendered grid.
Handles bare sheet names ([Sheet1] -> (0, 0)), quoted sheet names
(['My Sheet'!B3]), no sheet name ([A1:C10]), and single-cell ranges.

Comments whose anchor falls outside the rendered range (or doesn't
parse) are emitted in a trailing [## Comments] section as
blockquotes, labelled with [(anchored at A1)] when there's a
parseable anchor.

CSV gets no comments support: RFC 4180 has no annotation primitive.
The CLI warns when [--comments] is combined with [--format=csv] (or
[--format=json]) and proceeds without them.

Other changes:

- [bin/login.ml] now requests [Gsheets.Comments.scope] alongside the
Sheets scope, so [gsheets values --comments] works without a
separate login flow.
- [bin/values.ml] adds [--comments]/[-c] flag, fetches comments only
when format is [md], persists the token after the (potential) extra
Drive call.

31 new alcotest cases covering Comments parsing (full Drive payload
shapes, missing/empty/garbage anchors, A1 with metadata suffix, AA-style
double-letter columns), Values.range_offset (every shape of A1 range
including quoted sheet names and the lowercase-collision case that bit
the first iteration), and Markdown rendering with comments (inline
anchoring, relative offsets, out-of-range fallback, unanchored
fallback, multiple comments on one cell, comments-without-values).

Replace the two-function shape with a single
[Markdown.of_document ?comments doc]: the optional argument defaults
to [[]] (no comments rendered), and when supplied behaves as the old
[of_document_with_comments] -- footnote splicing where each comment's
[quoted_text] anchors, fallback to a trailing [## Comments] section
otherwise.

Matches the API shape we settled on for [Gslides.Marp.of_presentation]
/ [Gslides.Typst.of_presentation] in the previous commit, so all three
Google packages render comments through one optional argument rather
than a parallel function.

Update [bin/md.ml] and the eight markdown tests that referenced the
old name.

Mirrors the [ocaml-gdocs] / [ocaml-gsheets] shape: lib/bin/test layout,
[Gauth]-backed auth, XDG-stored client/token (atomic write via tmp +
rename), [Cmdliner] CLI. Implements a small slice of the Google Slides
v1 REST API: [presentations.get] -> a typed [Presentation.t] containing
slides, page elements, paragraphs, runs, and speaker notes.

Two renderers consume the same parsed structure:

- [Gslides.Marp.of_presentation ?comments p] emits Marp-flavored
markdown. YAML frontmatter for the deck title; [---] between slides;
level-1 headings as slide titles; native bullet/numbered lists;
inline style as [**bold**], [*italic*], [~~strike~~], plus HTML
escape hatches ([<u>], [<sup>], [<span style="color: ...">]) for
features without a CommonMark form. Speaker notes via Marp's
[<!-- _notes -->] pragma; hidden slides via [<!-- _hide: true -->].
Best for "review the deck in a PR diff".

- [Gslides.Typst.of_presentation ?comments p] emits Typst source using
[polylux] (version-pinned to 0.4.0; the value is exposed as
[Typst.polylux_version]). [#slide[...]] per slide, [#strong]/[#emph]/
[#strike]/[#underline]/[#link] for inline style, [#text(fill: rgb...)]
for color, [#table(...)] for tables, [#image("url", alt: ...)] for
images, [#speaker-note[...]] for notes. Best for "compile to a
typeset PDF".

Comments support:

- [Gslides.Comments] is a Drive-API fetch (drive.readonly scope).
Slides comments live on the underlying Drive file, not the Slides
surface itself.
- Both renderers take an optional [?comments] argument. When supplied,
each comment is anchored to its slide via the [pageObjectId]
embedded in the Drive [anchor] field, and rendered as a footnote
(Marp: GFM [[^slcN]] inline + definitions at the bottom; Typst:
[#footnote[...]] inside the slide block).
- Comments whose anchor doesn't reference a slide land in a trailing
[## Comments] section.

What's deliberately not exported: spatial information (positions,
transforms, rotations), shape-as-decoration (callout/flowchart shape
types, connector lines), animations (which the Slides API doesn't
expose anyway), and image bytes (the API gives short-lived
[contentUrl]s; stable references are a follow-up).

CLI:

- [gslides install] -- one-time OAuth client setup.
- [gslides login] -- OAuth flow with both Slides and
Drive comments scopes preauthorized.
- [gslides get <id>] -- print presentation JSON.
- [gslides md <id> [-c]] -- emit Marp markdown.
- [gslides typst <id> [-c]] -- emit polylux Typst.

85 alcotest cases covering the parser (paragraph/run extraction,
inline style decoding for bold/italic/strike/link/color/sup-sub/
monospace, bullet nesting, alignment), Marp rendering (frontmatter,
title -> h1, all inline-style emitters, bullets/nested/numbered, slide
separators, speaker notes, hidden slides, image refs, video/line/etc
placeholders, anchored and unanchored comments), Typst rendering (the
matching set against polylux primitives), Comments (parsing, anchor
extraction, drive scope), and Store (XDG roundtrips, 0600 perms,
atomic-write tightening).

Add the [llms.txt] entry between [gsheets] and [nox-git].

Note on duplication: [Comments] is structurally identical across
[ocaml-gdocs], [ocaml-gsheets] (pending), and [ocaml-gslides], and
each package has its own [Store] keyed off its own XDG dir
(~/.config/gdocs, /gsheets, /gslides). A follow-up will lift these
into a shared [Google_store] (likely in [gauth] or a small new
package) so all three Google tools share one client + one token
covering the union of scopes.

Two corrections surfaced by reviewing the equivalent code in
[ocaml-gsheets]:

- [Store.save_file] used [Eio.Path.save ~create:(`Or_truncate 0o600)]
followed by [Unix.chmod 0o600]. [Or_truncate] only applies the mode
on file creation, so when an existing file at the target was at a
wider mode (left over from a different tool, or a buggy older
version), the new content was written and briefly observable at the
wider mode before [chmod] tightened it. There was also no atomicity:
a crash mid-write left a half-written or zero-byte file. Replace
with the standard pattern -- write to a sibling [<path>.tmp.<pid>]
with [`Exclusive 0o600], then [Eio.Path.rename] over the target.
The new content is never observable at a wider mode (the file
inherits the tmp file's [0o600]), and a crash before the rename
leaves the original target untouched. Best-effort [unlink] of any
stale [.tmp.<pid>] from a previous crash before the [Exclusive]
open.

- [err_http] in both [Gdocs] and [Comments] piped the upstream
response body straight into a [`Msg]. A 4xx/5xx body from a CDN
edge can be multi-KB of HTML, which then dumps unbounded onto the
user's stderr. Add a local [truncate_body] that caps at 256 bytes
and appends ["... [truncated; <N> bytes total]"] so the user has a
rough sense of what was elided.

Mirrors the [ocaml-gdocs] shape: lib/bin/test layout, [Gauth]-backed
auth, XDG-stored client/token, [Cmdliner] CLI. Implements a small
slice of the Google Sheets v4 REST API: [spreadsheets.get] (metadata)
and [spreadsheets.values.get] (cell values), with the
[valueRenderOption] parameter exposed as a [render] variant
([Formatted_value] | [Unformatted_value] | [Formula]).

Library modules:

- [Gsheets] -- top-level [get]/[values] + scope strings.
- [Spreadsheet] / [Sheet] -- parsed metadata (id, title, sheet list,
grid dimensions). Decoded via [nox-json] codecs.
- [Values] -- a 2D block of [Cell.t]s for one range. [Cell.t] wraps a
[Json.Value.t] and exposes [to_string] (display string -- TRUE/FALSE
for booleans, JSON-formatted numbers without OCaml's trailing dot)
and [is_formula_source] (syntactic [=]-prefix check, only meaningful
under [Formula] render).
- [Csv] -- RFC 4180-quoted CSV: quotes fields containing comma, double
quote, CR, or LF; doubles embedded quotes; CRLF terminates every row.
- [Markdown] -- GFM pipe table; first row is the header, header padded
to widest body row, [|] escaped as [\|], embedded newlines mapped to
[<br>].
- [Store] -- XDG-aware client/token persistence, atomic write via
sibling tmp file + [Eio.Path.rename] (no chmod-after-write race),
acquire that returns a refreshable [Gauth.token].

CLI:

- [gsheets install] -- one-time OAuth client setup.
- [gsheets login] -- localhost-OAuth flow.
- [gsheets get <id>] -- print spreadsheet metadata as JSON.
- [gsheets values <id> <range> [--render OPTION] [--format FORMAT]] --
fetch a range and emit JSON, CSV (default), or Markdown.

125 alcotest cases covering parser edge cases (unicode, sparse rows,
sheet ordering, malformed input), CSV RFC 4180 corners (lone CR,
single double-quote field, null vs empty cells, CRLF inside quoted
cell), Markdown padding/escaping, store roundtrips with
[XDG_CONFIG_HOME] redirected to a temp dir, and the [truncate_body]
helper that caps oversized upstream error bodies. README has
MDX-checked OCaml examples.

Add the [llms.txt] entry between [gdocs] and [nox-git].

The eio test harness's [tls_eio.md] toplevel session used [#require
"crypto.c"] / [#require "tls-eio"] / [#require "crypto-rng.unix"] —
package names that don't match the renamed packages
([nox-crypto] / [nox-tls-eio] / [nox-crypto-rng.unix]).

The [(mdx ...)] stanza in [eio/tests/dune] also had no [(libraries
...)] declaration, so the toplevel couldn't link against [Tls],
[X509_eio], [Crypto_rng_unix].

Add the missing [(libraries nox-tls nox-tls-eio nox-x509
nox-crypto-rng.unix eio eio.core eio.unix eio_main domain-name ipaddr
ptime.clock.os)], rename the [#require] strings, and drop a stale
[<!-- $MDX non-deterministic=command -->] in the README that mdx
rejected as an invalid include label.

mdx caught a stale Csv.pp_error reference: Csv.decode_file returns
('a list, string) result, not a structured error. Updated the test
template to pattern-match on the string error.

Several signatures had drifted: [Tar_eio.extract] takes a [src] union
([Flow] or [File]) and a positional [dst], not [~src ~dst]; [v] is
the inverse of extract and takes [~src:dst-path]; [fold]'s callback
is [?global -> header -> 'acc -> ('acc, _, t) Tar.t] (returning a
[Tar.t], not a plain value); [Tar_gz.decode] doesn't exist (the API
is [Tar_gz.in_gzipped] / [out_gzipped]). Wrap each block as a
function ([extract ()] / [create ()] / [list_entries ()]), point
the gzip section at [Tar_gz] without inventing a [decode] symbol,
add [eio.core] / [fmt] mdx libraries.

git-rewrite now has an mdx stanza covering its three OCaml blocks
against the real ocaml-git API. mdx caught that drop_commit /
squash_commits / sort_commits all need a trailing unit argument that
the snippet was missing. The Git.Rewrite enumeration is split into
five small per-verb examples since one combined tuple-returning
function obscured what each verb does.

Also drop _-prefixed bindings introduced in the earlier vlog/tty/
requests pass: per project doctrine, bindings should either be used
(printed, returned) or omitted, never silenced with an underscore.

[helix] is not on opam-repo; pin to its git repo so [opam install
globe] from a fresh switch can find it. monopam lint --fix now reports
zero missing-pin issues.

mdx-checking flushed out a pile of stale API references that had drifted
from the actual library: Requests.create -> Requests.v, Auth.bearer
takes ~token: now, Body.json takes a Json.t (use Body.of_string Mime.json
for raw JSON strings), Retry.create_config -> Retry.config, Cmd.create
-> Cmd.v, Mime.pdf was never exposed (use Mime.of_string). Each block
now carries the full Eio_main.run/Switch.run/session setup so it stands
alone, matching the let run () = ... pattern used in osrelease and xdge.

Replace the 4-tuple [(name, runtime, all, pin_depends)] returned by
[scan_opam_files] with a record [opam_pkg] — names beat positional
fields once we got past three. While here, exempt deps already listed
in the consuming package's [pin-depends:] from the missing-pin check
so packages that ship a pin (like [irmin]'s [tw]) stop being flagged.

Add (mdx ...) stanzas covering each SKILL.md and rewrite the OCaml
blocks against the actual API: API renames (Table.create -> Table.v,
Panel.create -> Panel.v, Panel.create_lines -> Panel.lines, Tree.make
-> Tree.v, Node -> Tree.Node), defer side-effecting top-levels via
let main () so mdx_gen does not exit mid-test, and bind bare
expressions. Shell snippets keep their sh tag with a skip directive
since the placeholder myapp binary is not on PATH.

A runtime dep declared in some monorepo opam file may resolve fine on
the current developer's switch yet fail [opam install] from a fresh
switch, because the dep was installed from a local pin
([_opam/.opam-switch/overlay/<pkg>]) rather than from a public opam
repository. The publish path tripped on this for [tw] (pulled by
[irmin]) and [helix] (pulled by [globe]).

Add a [Missing_pin] kind to [Lint.kind] and a check that flags any
runtime dep that is:
- not provided by any monorepo subtree's opam file,
- not a [conf-*] / known builtin / implicit dep, and
- either currently sitting in [_opam/.opam-switch/overlay/<pkg>] or
absent from the active switch entirely.

Both [pp_table] and [pp_plain] in the lint CLI gain a "Missing pin"
column / "missing pin: ..." line, and the summary string includes
[N missing-pin].

Three blocks referenced [env] / [Eio_main] / [Cmdliner] free or as
top-level execution. Wrap each in a function ([make ~env], [run ()],
[term ~env]) and add [eio*] / [cmdliner] / [fmt] to the mdx
libraries.

The block ran at top level so mdx executed [Osrelease.OS.v ()] /
[Distro.v ()] and printed machine-specific output ("Running on macos
/ arm64") which then failed the diff. Wrap as [detect () = ...],
switch [Format.printf]/[Format.eprintf] to [Fmt.pr]/[Fmt.epr], add
[fmt] to the mdx libraries.

The block had stray newlines breaking [let writer = ...] /
[let reader = ...] across lines, missing [in], a top-level [match]
expression, and [print_endline] mixing. Wrap as [send () = ...] /
[recv () = ...] with [Fmt.pr], and add [fmt] to the mdx libraries.

The block referenced [xml_string] free and iterated over a [(name,
param)] tuple, but [Xtce.parameters] is a [parameter list] (each
record has both [name] and [parameter_type_ref] fields). Wrap as
[report xml_string = ...] and switch [Printf.printf] to [Fmt.pr]
with [fmt] in the mdx libs.

The three [let () = Eio_main.run] blocks executed under mdx, hitting
[int_of_string] on a non-numeric record value. Wrap each as
[let run () = ...] and add [eio.core] to the mdx libs so
[Eio.Switch] resolves.

The block called [Vz.Vm.v config] / [Vz.Vm.start] / [Vz.Vm.request_stop]
at top level, so mdx execution attempted to launch a real VZ VM
("Operation not supported"). Wrap as [run () = ...], pattern-match
each [(_, string) result] with [Fmt.failwith], and add [fmt] to the
mdx libraries.

The blocks had stray [let () = \n let buf = ""] gaps and ran a missing
newline ([... encoded) Printf.printf]). Wrap each as
[decode_frame buf] / [encode_frame ()] / [decode_with_crc32 buf],
switch [Printf.printf] to [Fmt.pr] / [Fmt.epr], and add [fmt] to
the mdx libraries.

The block had a top-level [match] expression and used [`One_third],
but the [rate] type uses [`R1_3] / [`R1_2] / [`R1_4] / [`R1_6]. Wrap
as [roundtrip data = ...], assert [Bytes.equal] on the decoded data,
and fix the rate constants in the example and the bullet list.

[Tm.clcw] is the constructor; the extractor is [Tm.extract_clcw],
which returns [(Clcw.t, Clcw.error) result option]. The CLCW record
has [report_value] and [lockout] at top level (no [flags]). Add
[clcw] / [fmt] to the mdx libs and switch [Format.printf] /
[Printf.printf] / [print_endline] to [Fmt.pr] / [Fmt.epr].

The block referenced [kvn_text] free, mixed [Printf.printf] /
[Fmt.epr]. Wrap as [report kvn_text = ...], use [Fmt.pr] / [Fmt.epr],
and add [fmt] to the mdx libraries.

The [Tcpcl.xfer_segment_flags] record uses [is_start] / [is_end]
(not [start_flag] / [end_flag]) and [xfer_segment] has no
[extensions] field. Add the [eio*] / [fmt] libs and update the
field names.

The block called [Tcf.Cuc.config ~coarse_bytes:4 ~fine_bytes:2 ()]
([config] takes [~coarse ~fine] without trailing unit and returns
[option]; use the [config_4_2] / [config_2_0] presets instead),
[Tcf.Cuc.encode ~coarse:... ~fine:...] (the API takes a [t] built
via [of_parts]), assumed [pp_error] / record fields ([t] is abstract;
use [pp]). Decode error is the polyvar [`Truncated], matched
explicitly. Add [fmt] to the mdx libs.

Top-level [match] doesn't parse; wrap in [let () = match ...] and
swap [Printf.printf]/[Format.printf] for [Fmt.pr]/[Fmt.epr]. Add
[fmt] to the mdx libraries.

The block referenced [session] / [secret] / [payload] / [signature]
free, mixed top-level [Printf.printf] with a top-level [match]
expression. Wrap as [create_subscription ~session] and
[handle_webhook ~secret ~payload ~signature], use [Fmt.pr] / [Fmt.epr],
and add [fmt] to the mdx libraries.

The blocks chained top-level [match] expressions and silently
discarded the decrypted plaintext. Wrap each as [roundtrip ~plaintext]
/ [roundtrip_aad ~plaintext ~aad] and [assert (Bytes.equal decoded
plaintext)] so the round-trip is checked. Add [fmt] to the mdx
libraries for [Fmt.failwith].

The block referenced [now] / [session] / [api_root] / [collection_id]
as free variables and chained an unbinding [Stix.Taxii.add_objects]
side-effecting call at top level. Wrap as
[push ~now ~session ~api_root ~collection_id = ...].

The example used [Bytes.Reader.of_string] which only resolves once
[bytesrw] is in scope. Qualify as [Bytesrw.Bytes.Reader.of_string]
and add [bytesrw] to the mdx libraries.

[Srp.Client.v] / [Srp.Server.v] / [Srp.Client.public] don't exist;
the API names are [Client.create], [Client.public_key],
[Client.compute_session_key] (returning [(_, [`Msg of string]) result]).
[Server.create] also takes [~username]; salt isn't passed by the
client to [compute_session_key], it's [~big_b] / [~big_a]. Initialise
[Crypto_rng_unix] so [Client.create] doesn't raise.

Pattern-match the [result], [assert] [String.equal] on the derived
keys, and add [nox-crypto-rng.unix] to the mdx libs.

Top-level [match] joined to a follow-up [match] doesn't parse, and
[Printf.eprintf] / [Format.printf] mixed with the rest. Wrap as
[read_image data = ...], use [Fmt.pr] / [Fmt.epr], add [fmt] to the
mdx libraries.