lua: a numeral ends where its digits do, so 1then is two tokens

`AdvancedTradeSkillWindow2.lua:3878` is `if Item.ReplaceWords == 1then`, with no space, and it
compiles on the reference. Its `read_numeral` (`0x6ffee0`) is 5.0's: digits, at most one `.` and its
digits, then — given an `e`/`E` — the marker, an optional sign (the `0x2b`/`0x2d` test at `0x6fff04`,
reached with the marker already saved) and its own digit loop. The only character-class test in the
whole routine is the ctype digit mask at `0x6fff47`; past it the buffer is terminated and handed to
`luaO_str2d` (`0x6f5900`). 5.1 instead ends with
`while (isalnum(ls->current) || ls->current == '_') save_and_next(ls);`, which swallowed `1then`
into the numeral and failed it — so we raised `malformed number` and lost a 4000-line file and every
global it defines, and its own XML then raised four more times calling them. The addon was dead.

The ninth hunk of the `lua-src` fork, which is where a grammar difference belongs: `BENILLA.md` is
explicit that rewriting the chunk source means parsing Lua with a regex. A replacement, not a
deletion — 5.1 had no exponent-digit loop of its own, so deleting the slurp alone would have cost
`1e2`, which is what the new test caught.

The same boundary is the deliberate half: 1.12 has **no hex literals**. The digit loop stops at the
`x`, so the reference reads `0xFF` as `0` and the name `xFF` and cannot parse the statement around
it. A comment- and string-stripping scan of the installed corpus finds hex in code in exactly two
files, `pfQuest/toolbox/pngLua/deflate.lua` and `numberlua.lua`, which no `.toc` row reaches — zero
loaded sites, the same standard the fork's three other deletions were held to. Our own shipped Lua
and his saved variables have none either. Two of our own test chunks did, and are now decimal:
no chunk of benilla's Lua may use a construct the client's parser rejects.

Verified: the whole chain still loads with no failure, the `WOW_DATA` failure set is unchanged, and
`AdvancedTradeSkillWindow2` now publishes `ATSW_OnLoad` and `ATSWTypeColor`.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01SgstFWtn1RxEJ5kVrpgYwn

crates/benilla-ui/src/script/lua50.rs

@@ -636,12 +636,13 @@ mod tests {
         }
         // Two's complement, signed out: `bnot(0)` is -1, not 4294967295.
         assert_eq!(s.eval::<i64>("return bit.bnot(0)").unwrap(), -1);
-        assert_eq!(
-            s.eval::<i64>("return bit.band(0x1234, 0xFF)").unwrap(),
-            0x34
-        );
-        assert_eq!(s.eval::<i64>("return bit.bor(0xF0, 0x0F)").unwrap(), 0xFF);
-        assert_eq!(s.eval::<i64>("return bit.bxor(0xFF, 0x0F)").unwrap(), 0xF0);
+        // Decimal in the chunks, because 1.12's lexer has no hex literals (see
+        // `a_numeral_ends_where_the_digits_do_so_a_glued_keyword_is_its_own_token`) and no chunk of
+        // benilla's own Lua may use a construct the client's parser rejects. Hex stays on the Rust
+        // side, where the masks are what they are.
+        assert_eq!(s.eval::<i64>("return bit.band(4660, 255)").unwrap(), 0x34);
+        assert_eq!(s.eval::<i64>("return bit.bor(240, 15)").unwrap(), 0xFF);
+        assert_eq!(s.eval::<i64>("return bit.bxor(255, 15)").unwrap(), 0xF0);
         assert_eq!(s.eval::<i64>("return bit.lshift(1, 4)").unwrap(), 16);
         // `rshift` is logical, `arshift` propagates the sign.
         assert_eq!(s.eval::<i64>("return bit.rshift(-1, 28)").unwrap(), 15);
@@ -721,6 +722,50 @@ mod tests {
         assert_eq!(s.eval::<i64>("return string.len('abcd')").unwrap(), 4);
     }
 
+    /// Where the client's `read_numeral` (`0x6ffee0`) ends a numeral, and where 5.1's did not.
+    /// Its only character-class test is the ctype digit mask (`0x6fff47`); the tail terminates the
+    /// buffer and calls `luaO_str2d` (`0x6f5900`) with no further slurp, so `1then` is the number
+    /// 1 and the name `then`. 5.1 ended with `while (isalnum(c) || c == '_') save_and_next(ls);`,
+    /// gave the whole run to the numeral and failed it — which killed
+    /// `AdvancedTradeSkillWindow2.lua:3878`, `if Item.ReplaceWords == 1then`, and with it a
+    /// 4000-line file and every global it defines.
+    #[test]
+    fn a_numeral_ends_where_the_digits_do_so_a_glued_keyword_is_its_own_token() {
+        let s = UiScript::new().unwrap();
+        // The addon's own line, verbatim.
+        assert_eq!(
+            s.eval::<i64>("local Item = { ReplaceWords = 1 } if Item.ReplaceWords == 1then return 7 end return 0")
+                .unwrap(),
+            7
+        );
+        for (chunk, want) in [
+            ("local n = 0 for i = 1, 3do n = n + i end return n", 6),
+            ("if 1~=2and 3==3 then return 1 end return 0", 1),
+            ("local t = { 5 } return t[1]+0", 5),
+        ] {
+            assert_eq!(
+                s.eval::<i64>(chunk)
+                    .unwrap_or_else(|e| panic!("{chunk}: {e}")),
+                want
+            );
+        }
+        // A finished exponent is still one numeral, and the name behind it still its own token.
+        assert_eq!(
+            s.eval::<f64>("if 1e2then return 1e2 end return 0").unwrap(),
+            100.0
+        );
+        // The same boundary costs 1.12 its hex literals: the digit loop stops at the `x`, so the
+        // client reads `0` and the name `xFF` and cannot parse the statement. Zero loaded sites in
+        // the corpus (only pfQuest's unlisted `toolbox/pngLua`, which no toc row reaches).
+        assert!(s
+            .eval::<bool>(r#"return loadstring("return 0xFF") == nil"#)
+            .unwrap());
+        // A malformed numeral still raises, and names the prefix the client would have named.
+        assert!(s
+            .eval::<bool>(r#"return loadstring("return 1.2.3") == nil"#)
+            .unwrap());
+    }
+
     /// The 5.0 grammar the stock files use still parses, including the three constructs the fork
     /// restores: the iterator-less generic-for, nested long strings (`LUA_COMPAT_LSTR`) and the
     /// constructor's extra semicolon.