shell: cat <path> TIL <marker> sugar + precise ordering errors

- `cat/hexdump <path> TIL <marker>` is now sugar for `USE <path> TIL
  <marker>`: the paths are the input source, truncated at the first
  marker line across the combined stream.  Path args + USE stays a
  syntax error (two input sources), now with a message that says so.
- The parser's `trailing` flag conflated filters with the output
  keyword, so `cat f TO out TIL m` blamed the filters.  USE/TIL now
  distinguish "before the filters" from "before the output keyword",
  and filters after the output keyword (`TO out -h 2`) are now
  rejected instead of silently accepted.
- cat_file_until/hexdump_file_until return a tri-state (Done/Marker/
  Aborted) so multi-path TIL truncation stops at the first marker.

Verified in QEMU (10 checks): truncation, combined-stream marker,
filters after the sugar, heredoc round trip, all four ordering-error
messages, USE-with-paths ambiguity, fsck clean.

1 files changed, 35 insertions, 6 deletions

diff --git a/CONTEXT.md b/CONTEXT.md
index 7514a6f..c6bd5f9 100644
--- a/CONTEXT.md
+++ b/CONTEXT.md
@@ -375,6 +375,12 @@ Resolved this session:
   All other commands reject input keywords with a syntax error — a
   command declares whether it takes input.  `USE`/`TIL` are general
   building blocks; more consumers will come later.
+- **`cat <path> TIL <marker>` is sugar for `cat USE <path> TIL
+  <marker>`** (refined this session): the paths are the input source,
+  truncated at the first marker line across the combined stream —
+  `cat a b TIL m` reads `a` then `b` and stops at the first `m` line.
+  The single-source reading is unambiguous, so path args + `TIL` is
+  valid; path args + `USE` stays a syntax error (two input sources).
 - **Keywords: uppercase-only, aliases valid.**  `WRITE`==`WRITING`,
   `TIL`==`UNTIL`, `USE`==`USING`; lowercase forms are ordinary text, so
   `echo use the force` can never redirect.  Keywords are reserved
@@ -404,8 +410,9 @@ Assumed edge semantics (flag if wrong):
   is silent, as `echo >` behaved before.
 - `-p` pauses terminal output only; with a file sink it is a no-op.
 - `-h N` / `-t N` require N ≥ 1; otherwise syntax error.
-- `cat p USE s` (path args *and* an input keyword) is a syntax error —
-  the input source is ambiguous.  `cat USE s` and path-less `cat TIL m`
+- `cat p USE s` (path args *and* an explicit source keyword) is a
+  syntax error — the input source is ambiguous.  `cat USE s`, path-less
+  `cat TIL m`, and `cat <path> TIL m` (sugar for `USE <path> TIL m`)
   are the valid input forms.
 - ADR 0002 (`docs/adr/0002-keyword-redirection-and-post-filters.md`)
   captures the keyword-redirection + post-filter decision; the ADR is
@@ -455,10 +462,16 @@ Everything above is now implemented in `shell/src/lib.rs`:
   truncates and writes from offset 0, `TO` appends at current size.
   Diagnostics (errors, usage) always go to the terminal, never into
   the pipeline or a file.
-- **Input consumers** — `cat`/`hexdump`, path-less only: no keyword =
-  keyboard until ^D, `USE f` = file, `TIL m` = keyboard heredoc,
-  `USE f TIL m` = file truncated at the exact marker line (marker and
-  everything after discarded).  Other commands reject input keywords.
+- **Input consumers** — `cat`/`hexdump`: no keyword = keyboard until
+  ^D, `USE f` = file, `TIL m` = keyboard heredoc, `USE f TIL m` =
+  file truncated at the exact marker line (marker and everything
+  after discarded), and `cat <path> TIL m` / `hexdump <path> TIL m` =
+  the paths as source, truncated at the first marker across the
+  combined stream.  Other commands reject input keywords.
+- **Ordering enforcement** — `USE`/`TIL` must precede the filters and
+  the output keyword; filters must precede the output keyword;
+  distinct messages for each violation ("must come before the
+  filters" / "must come before the output keyword").
 - **^D** — EOF everywhere, at the prompt it is a no-op (fresh
   prompt); ^C keeps line-cancel / stream-abort; `poweroff`/`exit`
   are the only shutdown verbs.
@@ -474,9 +487,25 @@ Bugs found by QEMU verification and fixed:
 2. `cat USE f TIL m` leaked everything after the marker — the
    final-partial-line emit ran even after the marker break; fixed
    with a `stopped` flag in `cat_file_until`/`hexdump_file_until`.
+3. `cat file TO out TIL m` blamed the filters — the `trailing` flag
+   was set by both filters and the output keyword, so the "must come
+   before the filters" error fired for the output keyword too; the
+   parser now distinguishes them (`TO dst TIL m` → "TIL must come
+   before the output keyword").  Also: filters after the output
+   keyword (`TO dst -h 2`) were silently accepted — now a syntax
+   error.
+4. `cat file TIL m` was rejected as ambiguous — path args + `TIL` is
+   now sugar for `USE <path> TIL <marker>` (single source, truncated
+   at the marker); path args + `USE` remains a syntax error.
 
 Verified: 26 grammar checks pass on a fresh disk *and* on a reused
 one (rewriting existing files), `make test-disk` round trip is
 fsck-clean, the `-p` pager pauses at screenfuls and resumes on
 keypress, `-h` stops `/dev/mem` at exactly N lines, and ^C flushes a
 `-t` window on an infinite stream.
+
+Follow-up verification (this session): 10 checks pass in QEMU for the
+`cat <path> TIL <marker>` sugar — truncation at the marker, combined
+multi-path stream truncated at the first marker, filters after the
+sugar (`-h 1`), the heredoc round trip, all four ordering-error
+messages, and the `USE`-with-paths ambiguity message; fsck clean.