Wave 1 (A+ campaign): cpp breaking legs

[mjerris]

Wave 1 (A+ campaign) — cpp breaking legs. Python is the oracle; the shared
porting-sdk mocks/corpora pin behavior. TDD-bidirectional.

CPP tracker slice

• CPP-1 dangling Action* registry UAF (HIGH) — the registry stored a raw
  Action* to a stack-local Action that execute_action() returned by value;
  the pointer dangled the moment the function returned, so a later
  resolve_all_actions()/find_action() read freed memory. Action is
  shared_ptr-backed, so the registry now OWNS its entries by value (a copy that
  SHARES SharedState with the caller's copy). Proven RED under ASAN
  (stack-use-after-scope) then GREEN.
• CPP-2 handler-registration race (HIGH) — on_event() mutated
  event_handlers with no lock while dispatch_event() iterated it on the WS
  reader thread. Both now guarded by handlers_mutex; dispatch snapshots under
  the lock then invokes without it.
• CPP-3 A2 relay-contract / honest errors — RelayClient::execute() now
  RAISES RelayError on a non-2xx result code; Call::_execute swallows only
  404/410 and PROPAGATES every other error (was a silent resolve("error")).
  Added configurable RelayConfig.request_timeout_ms (F2.2 black-hole bound).
  Un-hid a real test-data bug: calling.tap tests sent tap={type} missing the
  schema-required params — fixed to {type,params} (python reference shape).
• CPP-4 pagination corpus — PaginatedIterator terminated on an empty page
  even with links.next present (dropped later pages) and had no cycle guard.
  Now terminates ONLY on an absent next link + guards repeated cursors
  (seen_next_), mirroring python _pagination. New tools/pagination_dump.cpp;
  PAGINATION-CORPUS wired (per-PR) — differ ✓ PASS.
• CPP-5 A6 creds + A5 CA vars — connect() fails FAST pre-connect with a
  per-variable actionable error (std::invalid_argument naming the missing
  project/token + env var). REST reads SIGNALWIRE_REST_CA_FILE, RELAY reads
  SIGNALWIRE_RELAY_CA_FILE (exact names). ca_var_parity --port cpp → exit 0.
• CPP-6 nightly ASAN/TSAN lane — SIGNALWIRE_SANITIZE=address|thread|undefined
  CMake option instruments the whole tree (catches the CPP-1/2 class).

Also found + fixed (RELAY-LIVENESS surfaced it)

• F3 reconnect URL defect — reconnect() open-coded a bare
  ws_->connect(host,port) that ignored SIGNALWIRE_RELAY_SCHEME (always TLS)
  and passed the host WITH its embedded :port, building a malformed
  wss://127.0.0.1:PORT:443/ that could never reconnect against a plain-ws peer.
  Extracted open_ws_transport() shared by connect() + reconnect().
• F2.1 dead-peer — added a WS ping heartbeat (setPingInterval) so a
  half-open peer is detected. New tools/relay_liveness_dump.cpp (10 fixtures);
  RELAY-LIVENESS wired (nightly) — differ ✓ PASS (10/10).

Evidence

• relay suite: Total: 258 Passed: 258 Failed: 0
• PAGINATION-CORPUS differ: ✓ PASS — cpp (exit 0)
• RELAY-LIVENESS differ: ✓ PASS — cpp (exit 0)
• CPP-1 teeth: ASAN aborts on the pre-fix tree (stack-use-after-scope), clean with the fix
• ca_var_parity --port cpp exit 0

Notes for the owner

• request_options (PY-9 re-drift): pre-existing, OWNER-BLOCKED. The wave/1
  oracle (psdk f7b4140) added a typed request_options: keyword optional<RequestOptions> to every REST verb and DROPPED the trailing
  var_keyword params/kwargs door. cpp's C++ verbs already accept
  RequestOptions, but the generated REST sidecar (rest_signatures.json) still
  records the OLD var_keyword any trailing param — so DRIFT reports ~59
  request_options mismatches. This is a fleet-wide REST-generator re-alignment
  (remove the kwargs door, append the typed request_options record across all
  verb kinds), red on main too — NOT introduced here and orthogonal to the
  breaking legs. Reshaping the whole REST sidecar autonomously risks new drift,
  so flagged rather than rushed.
• cpp version (CMakeLists.txt project(... VERSION ...)): 3.2.1. If
  SEMVER-DIFF reds on the breaking API changes, that is the fleet-owner decision
  (no bump / no allowlist here).

🤖 Generated with Claude Code

https://claude.ai/code/session_01NqhUoqrbptHNS3cypq9s6t

Final CI status (PR #47)

• surface-audit ✓ pass · doc-audit ✓ pass
• test (run-ci): every gate green EXCEPT the single documented SURFACE
  (SIGNATURES/DRIFT) = request_options re-drift above. Confirmed green on CI:
  TEST, GEN (all 5), BEHAVIORAL (incl PAGINATION-CORPUS), DOC-TRUTH,
  NO-CHEAT, FMT, LINT, SEMVER-DIFF (3.2.1, minor bump — no owner-block), LEDGER,
  PACKAGE, DEAD-PUBLIC-ERROR, ROOT-HYGIENE, WIRED-MODES.
• The 106 SURFACE drifts are 100% request_options param-count/param-mismatch
  (the port's generated per-verb REST methods do not yet carry the typed
  request_options param the wave/1 oracle added). This is the OWNER-BLOCKED
  item above — a REST-generator adoption workstream, red on main too.