converter: fix the printf argument/cast misalignment, and refuse loudly on a structured binding

printf casts were taken from the wrong slot, which is why `printf("%c")` printed
a numeric value -- a symptom recorded in AGENT-COMMON for a while and now
root-caused. Two independent bugs in the same alignment:

1. `if (types[j]) StrCat(kAs, types[j++]);` advanced `j` ONLY on a non-null
   entry. `types` is parallel to the VARIADIC ARGUMENTS -- printf2fmt pushes one
   entry per conversion that consumes an argument, and a null entry means "pass
   through, no cast" -- so every pass-through conversion PINNED `j` and the next
   cast-needing conversion took its cast from the wrong slot. Measured on
   `printf("%d %c\n", 65, 'B')`: the `%d` entry is null, `j` stayed 0, and the
   `u8 as char` cast from the `%c` slot was applied to the FIRST argument. It
   compiled and printed the wrong values. The index is now `i - first`, with a
   bounds check so more arguments than conversions gets no cast rather than an
   out-of-bounds read.
2. `case '%'` pushed a `types` entry, but `%%` is a literal percent and consumes
   NO argument, so it shifted every later argument by one on its own.

73cfd28 had made (1) more reachable: its survey arm pushes a null entry for an
unknown specifier, so `%f` followed by `%c` under --survey hits it too.
Verified byte-exact against clang after the fix, both models: C++ `65 B`,
unsafe MATCH, refcount MATCH; and the `%%` case `100% B`.

ReportUnsupportedStructuredBinding: the same NDEBUG silent-omission class as
73cfd28's exception fix, confirmed by measurement rather than by analogy. With
the pre-fix release binary a TU containing `auto [x, y] = p;` exited rc=0 and
the emitted Rust contained the following `println!` referring to `x` and `y`
while the declaration itself had VANISHED -- VisitVarDecl (converter.cpp:678)
returns false having emitted no text. Now report_fatal_error naming the
construct, its bindings and the location (rc=134); the pre-existing survey arm
still records and continues (rc=0, count=1).

Ranking note for the remaining asserts: standard Cpp2Rust#1 (NDEBUG-erased
non-termination) now has NO candidate. All 30 `assert(0` sites were scanned
mechanically for "last statement of a loop body with a non-advancing cursor" and
the printf loop fixed in 73cfd28 was the only one. Remaining sites are Cpp2Rust#2
(silent omission) and Cpp2Rust#3 (UB).

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: Agent User

cpp2rust/converter/converter.cpp

@@ -3880,8 +3880,14 @@ void Converter::ReportUnsupportedStructuredBinding(
     survey::Record(survey::GapKind::kUnsupportedConstruct, detail, loc);
     return;
   }
-  llvm::errs() << "unsupported " << detail << " at " << loc << '\n';
-  assert(0 && "unsupported structured binding (DecompositionDecl)");
+  // SILENT OMISSION under NDEBUG, which is the build everyone ships: the assert
+  // compiled to nothing, this returned, VisitVarDecl (converter.cpp:678)
+  // returned false having emitted NO TEXT for the declaration, and the process
+  // exited 0 -- so the `.rs` simply lacked the variable while every later use of
+  // its bindings referred to a name that was never declared. Same class as
+  // ReportUnsupportedException (73cfd28); refuse loudly instead, naming the
+  // construct, its bindings and the source location.
+  llvm::report_fatal_error(llvm::Twine("unsupported ") + detail + " at " + loc);
 }
 
 void Converter::ReportUnmappedSystemType(const clang::RecordDecl *decl) {

cpp2rust/converter/models/converter_refcount.cpp

@@ -999,7 +999,11 @@ static std::vector<const char *> printf2fmt(std::string &format,
       pos += 2;
       continue;
     case '%':
-      types.emplace_back();
+      // `%%` is a LITERAL percent: it consumes NO argument, so it must NOT push
+      // a `types` entry. `types` is indexed by ARGUMENT (see ConvertPrintf), and
+      // an entry here shifted every later argument's cast by one -- measured on
+      // `printf("100%% %c\n", ch)`, where the `%c` cast landed on the `%%` slot
+      // and the char printed as its numeric value.
       format.replace(pos, 2, "%");
       pos += 2;
       continue;
@@ -1127,12 +1131,30 @@ void ConverterRefCount::ConvertPrintf(clang::CallExpr *expr) {
       format, expr->getBeginLoc().printToString(ctx_.getSourceManager()));
   StrCat(format);
 
-  unsigned j = 0;
-  for (unsigned i = is_fprintf + 1, e = expr->getNumArgs(); i < e; ++i) {
+  // INVARIANT: `types` is parallel to the VARIADIC ARGUMENTS -- printf2fmt
+  // pushes exactly one entry per conversion that consumes an argument, and a
+  // NULL entry means "pass this argument through with no cast". So the cast for
+  // argument `i` is `types[i - first]`, nothing else.
+  //
+  // This used to read `if (types[j]) StrCat(kAs, types[j++]);`, which advanced
+  // `j` ONLY on a non-null entry: every pass-through conversion PINNED `j`, and
+  // the next cast-needing conversion then took its cast from the WRONG SLOT and
+  // applied it to an argument it does not belong to. Measured on
+  // `printf("%d %c\n", 65, 'B')`: the `%d` entry is null, so `j` stayed 0 and
+  // the `u8 as char` cast from the `%c` slot was applied to the FIRST argument,
+  // emitting `println!("{} {}", 65 as u8 as char, 'B' as u8)` -- prints "A 66"
+  // where C prints "65 B". It compiled and printed the wrong values, i.e. silent
+  // wrongness. 73cfd28 made it more reachable: the survey arm of printf2fmt now
+  // pushes a null entry for an unknown specifier, so `%f` followed by `%c`
+  // under --survey hits it too.
+  const unsigned first = is_fprintf + 1;
+  for (unsigned i = first, e = expr->getNumArgs(); i < e; ++i) {
     StrCat(token::kComma);
     Convert(expr->getArg(i));
-    if (types[j])
-      StrCat(keyword::kAs, types[j++]);
+    // A variadic argument with no conversion left to describe it (more args than
+    // conversions) gets no cast rather than an out-of-bounds read.
+    if (unsigned j = i - first; j < types.size() && types[j])
+      StrCat(keyword::kAs, types[j]);
   }
   StrCat(')');
 }