[professional-tester]

What does this PR do?

Ports src/semantic from C to Zig, following the pattern of #163. Stacked on the storage-chain port (#165, refactor/store-zova-zig); review #164 and #165 first.

semantic.c, ast_profile.c and rotsq.c become semantic.zig, ast_profile.zig and rotsq.zig in libcbm_zig, plus a 28-line fp.zig. No C file and no shim remains in src/semantic.

The C headers do not change. cbm_zig.zig checks every exported cbm_* function against its header declaration at compile time.

Net change: 2,236 lines removed, 2,154 added (−82).

Behavior differences

• rotsq: the ±1 diagonal is built at compile time instead of on first use through cbm_once. Same values.
• Floating point: fp.mulAdd fuses multiply-add at the places where clang's default -ffp-contract=on fused it in the C build, so scores stay bit-identical (see Verification).

Build and audit wiring

• Makefile.cbm and build.zig drop the three C sources and list the Zig files and headers in CBM_ZIG_SRCS; scripts/check-build-sources.sh passes.
• cbm_zig_c.h adds nomic/code_vectors.h and semantic/ast_profile.h, and moves semantic/semantic.h to the ported-modules list.
• scripts/extract_nomic_vectors.py: the hint it prints named semantic.c; it now names src/cbm_zig_c.h.
• No audit count changes.

Verification

Run on Linux x86_64 with the pinned Zova.

At this branch's commit (on top of #165):

• The production binary builds with Zova.
• libcbm_zig.a builds for native, x86_64-linux-gnu, aarch64-linux-gnu, x86_64-windows-gnu and aarch64-macos (without Zova).
• zig fmt --check, scripts/check-build-sources.sh, scripts/security-audit.sh and scripts/check-dco.sh pass.

Before the rebase onto #165 (same semantic files, on top of main a592846a):

• 43 suites through scripts/zova-run-tests.sh match main, including semantic 33, ast_profile 10, pipeline 276, incremental 149 and mcp 176.
• Full index of redis, cpython and kubernetes: node and edge counts per label and type are identical to main. On redis, all 480 SEMANTICALLY_RELATED edges and their scores are byte-identical.
• Full-index wall time, median of 3 (main / port): redis 32.9 s / 27.1 s, cpython 155.4 s / 145.4 s, kubernetes 285.9 s / 266.1 s. The port is faster because zig build cbm compiles the C sources without -Doptimize, which leaves undefined-behaviour checks in the C code, while the Zig library is ReleaseFast. On redis only the semantic_edges pass changed (9.07 s → 3.23 s).

Not run / not verified:

• The suites and the graph comparison were not repeated at this exact commit. They were repeated on the stacked pipeline branch (see the follow-up PR).
• Incremental re-index counts are not compared: the same main binary gives different counts from run to run (redis CALLS 40,815 or 40,813).
• make -f Makefile.cbm test, lint-ci and smoke-test.sh.
• Any runtime test on Windows or macOS. Those paths are compile-checked only.

Checklist

• Every commit is signed off (git commit -s)
• Tests pass locally (make -f Makefile.cbm test): not run; the Zova-enabled suites listed above pass
• Lint passes (make -f Makefile.cbm lint-ci): not run
• New behavior is covered by a test: no new behavior; the existing suites cover the ported code

🤖 Generated with Claude Code