Triage the first clang-tidy run

Disable three checks that fire systemically on framework-dictated or
deliberate patterns, documented in .clang-tidy:
  - performance-unnecessary-value-param: every NIF takes its ResourcePtr
    args by value per Fine's FINE_NIF decode convention (the cppcheck
    build suppresses the same thing as passedByValueCallback).
  - bugprone-throwing-static-initialization: FINE_NIF/FINE_RESOURCE
    register at static-init via throwing ctors, across macro expansions.
  - performance-enum-size: Opcode and ref::Kind are int64_t on purpose to
    pack into the int64 refs the Elixir lowerer emits.

Fix the genuine findings:
  - Rename the reserved-identifier namespaces __async/__op (leading double
    underscore is reserved) to async_detail/op_detail.
  - Bind window-reduce shapes by const reference instead of copying
    (performance-unnecessary-copy-initialization), matching the existing
    style a few lines up.
  - Widen `rank` before the `2 * rank` reserve() so the multiplication
    happens in size_t (bugprone-implicit-widening-of-multiplication-result).

Suppress the remaining false positives inline, with rationale:
  - The make_binary_from_cstr memcpy targets a length-counted BEAM binary,
    not a C string (bugprone-not-null-terminated-result).
  - ~Program/~Reaper/~WorkerThread are best-effort cleanup destructors
    where a throw is already fatal (bugprone-exception-escape); the check
    stays enabled for every other function.

Author: claude

.clang-tidy

@@ -4,16 +4,30 @@
 # env) — see lib/mix/tasks/clang.tidy.ex and the `clang-tidy` target in
 # the Makefile.
 #
-# A focused, high-signal starting set: bug patterns, the clang static
-# analyzer (clang-analyzer-*), and performance checks. Deliberately not
-# the modernize/readability/cppcoreguidelines firehose yet — broaden once
-# this baseline is green. `bugprone-easily-swappable-parameters` is off
-# because it fires on nearly every NIF entry point (many same-typed args)
-# without pointing at a real defect.
+# A focused, high-signal set: bug patterns, the clang static analyzer
+# (clang-analyzer-*), and performance checks. Deliberately not the
+# modernize/readability/cppcoreguidelines firehose yet — broaden once this
+# baseline stays green.
+#
+# Disabled checks and why:
+#   * bugprone-easily-swappable-parameters — fires on nearly every NIF
+#     entry point (many same-typed args) without pointing at a real defect.
+#   * performance-unnecessary-value-param — every NIF takes its
+#     fine::ResourcePtr args by value because Fine's FINE_NIF macro decodes
+#     each BEAM term into a value and passes it in; the signature is the
+#     binding convention, not a stray copy (the cppcheck build suppresses
+#     the same thing as passedByValueCallback).
+#   * bugprone-throwing-static-initialization — FINE_NIF / FINE_RESOURCE
+#     register callbacks at static-init time via throwing constructors;
+#     this is inherent to Fine's registration model, across ~25 macro
+#     expansions we don't own.
+#   * performance-enum-size — Opcode and ref::Kind are int64_t on purpose
+#     (they pack into the int64 refs the Elixir lowerer emits); shrinking
+#     the base type would break that ABI.
 #
 # HeaderFilterRegex scopes diagnostics to our own headers; MLX and Fine
 # arrive via -isystem and are skipped, exactly as the compiler skips them.
-Checks: '-*,bugprone-*,clang-analyzer-*,performance-*,-bugprone-easily-swappable-parameters'
+Checks: '-*,bugprone-*,clang-analyzer-*,performance-*,-bugprone-easily-swappable-parameters,-performance-unnecessary-value-param,-bugprone-throwing-static-initialization,-performance-enum-size'
 WarningsAsErrors: '*'
 HeaderFilterRegex: 'c_src/'
 FormatStyle: none

c_src/emily/async.hpp

@@ -44,13 +44,16 @@ namespace emily {
 
 namespace mx = mlx::core;
 
-namespace __async {
+namespace async_detail {
 
 // Build a binary term in msg_env from a null-terminated C string.
 inline ERL_NIF_TERM make_binary_from_cstr(ErlNifEnv *msg_env, const char *s) {
   size_t len = std::strlen(s);
   ERL_NIF_TERM term;
   unsigned char *data = enif_make_new_binary(msg_env, len, &term);
+  // The destination is a length-counted BEAM binary of exactly `len`
+  // bytes, not a C string, so a trailing NUL is neither needed nor wanted.
+  // NOLINTNEXTLINE(bugprone-not-null-terminated-result)
   std::memcpy(data, s, len);
   return term;
 }
@@ -80,7 +83,7 @@ error_reason_from_current_exception(ErlNifEnv *msg_env) {
   }
 }
 
-}  // namespace __async
+}  // namespace async_detail
 
 // Run `build_payload` on the worker thread of `w` and post the
 // result back to the caller PID as a message. Returns a fresh ref
@@ -132,7 +135,7 @@ fine::Term async_reply(ErlNifEnv *env,
               msg_env, ref_in_msg,
               enif_make_tuple2(
                   msg_env, fine::encode(msg_env, emily::atoms::error),
-                  __async::error_reason_from_current_exception(msg_env)));
+                  async_detail::error_reason_from_current_exception(msg_env)));
         }
       }
 

c_src/emily/op_cores.hpp

@@ -154,8 +154,8 @@ inline mx::array sliding_windows_view(
   out_dims.assign(rank, 0);
   mx::Shape new_shape;
   mx::Strides new_strides;
-  new_shape.reserve(2 * rank);
-  new_strides.reserve(2 * rank);
+  new_shape.reserve(2 * static_cast<std::size_t>(rank));
+  new_strides.reserve(2 * static_cast<std::size_t>(rank));
 
   for (int i = 0; i < rank; ++i) {
     int64_t eff = (window_shape[i] - 1) * dilations[i] + 1;
@@ -251,11 +251,11 @@ inline mx::array window_scatter_core(
     bool is_max,
     mx::Stream &s) {
   int rank = static_cast<int>(window_shape.size());
-  auto original_shape = tensor.shape();
+  const auto &original_shape = tensor.shape();
 
   // 1. Pad input with init_value.
   auto padded = do_pad(tensor, pad_lo, pad_hi, init_value, s);
-  auto padded_shape = padded.shape();
+  const auto &padded_shape = padded.shape();
 
   // 2. Sliding-window view (dilation is implicitly 1 per axis for scatter).
   std::vector<int64_t> dilations(rank, 1);
@@ -329,7 +329,7 @@ inline mx::array window_scatter_core(
 
   // 7. Reshape source so each index tuple is a single-point write.
   mx::Shape source_reshape;
-  source_reshape.reserve(2 * rank);
+  source_reshape.reserve(2 * static_cast<std::size_t>(rank));
   for (int i = 0; i < rank; ++i)
     source_reshape.push_back(static_cast<mx::ShapeElem>(out_dims[i]));
   for (int i = 0; i < rank; ++i)

c_src/emily/opcodes.hpp

@@ -280,7 +280,7 @@ inline double f64_from_bits(int64_t bits) {
   return d;
 }
 
-namespace __op {
+namespace op_detail {
 
 inline const mx::array &arg1(const std::vector<mx::array> &in,
                              const char *name) {
@@ -338,13 +338,13 @@ inline bool keepdims_attr(const std::vector<std::vector<int64_t>> &a,
   return v[0] != 0;
 }
 
-} // namespace __op
+} // namespace op_detail
 
 // Replay one instruction: apply `op` to its resolved operands + attrs.
 inline mx::array dispatch_op(Opcode op, const std::vector<mx::array> &in,
                              const std::vector<std::vector<int64_t>> &iattrs,
                              mx::Stream &s) {
-  using namespace emily::__op;
+  using namespace emily::op_detail;
   switch (op) {
   // --- Binary arithmetic / bitwise ---
   case Opcode::Add:

c_src/emily/program.hpp

@@ -122,6 +122,11 @@ class Program {
   //   * the recycled-`fun_id` collision the on-worker erase guards against
   //     can't fire on a stopping worker — it runs no further compiles.
   // So on the declined path we simply let `drop` destruct below (issue #172).
+  //
+  // post_to_worker constructs a std::function (may throw bad_alloc); a throw
+  // from this best-effort cleanup destructor is unrecoverable and would
+  // std::terminate regardless, so the escape is accepted here.
+  // NOLINTNEXTLINE(bugprone-exception-escape)
   ~Program() {
     for (auto &kv : compiled) {
       CompiledEntry &entry = kv.second;

c_src/emily/worker.hpp

@@ -148,6 +148,10 @@ class Reaper {
     }
   }
 
+  // shutdown() joins the reaper thread; std::thread::join can in theory
+  // throw std::system_error, but a throw from this best-effort teardown
+  // destructor is unrecoverable and would std::terminate regardless.
+  // NOLINTNEXTLINE(bugprone-exception-escape)
   ~Reaper() { shutdown(); }
 
 private:
@@ -198,6 +202,10 @@ class WorkerThread {
 
   // Non-blocking: signal stop and hand the thread to the Reaper to join
   // off-scheduler. Pending tasks are cancelled with {:error, :stopped}.
+  //
+  // retire() takes a lock and moves the thread to the reaper; a throw here
+  // is unrecoverable from a destructor and would std::terminate regardless.
+  // NOLINTNEXTLINE(bugprone-exception-escape)
   ~WorkerThread() { Reaper::instance().retire(state_.get()); }
 
   // Enqueue a task. Throws if the worker has been stopped or the queue is