Merge FEATURE-ci-outbox-capacity: Admit allocator-rounded response storage

Author: etr

specs/tasks/FEATURE-ci-outbox-capacity.md

@@ -0,0 +1,29 @@
+# FEATURE-ci-outbox-capacity: portable HTTP/1 outbox capacity admission
+
+Status: Complete (local implementation, Groundwork validation and finalization). Native execution remains CI / v3 PR owned. Base: `v3` at `56da7ec9e7ca848de9a19e58fbeb59e2baaa801c`.
+
+A valid response head previously failed under libc++19 because `reserve(276)` retained capacity279 and the outbox required an exact capacity match. The unchanged real outbox reproduced the failure while its framer accepted the same response. Native macOS CI attribution remains corroborated; the original failing wire/subcase was not observed.
+
+The outbox now admits the existing geometric request and then any observed allocator-rounded excess before copying or publishing. It records actual retained capacity, keeps the old buffer charged until destruction, and rolls back provisional storage on refusal or exception. Final-head exceptions restore the previous interim buffer and its charge. Growth arithmetic checks string/aggregate bounds. This preserves the existing transient private candidate allocation behavior; it does not promise advance knowledge of allocator rounding.
+
+Action items:
+
+- [x] Isolate from v3; preserve unrelated worktrees.
+- [x] Reproduce original real libc++ outbox refusal with a durable behavior regression (RED).
+- [x] Admit actual rounded capacity without changing budget limits or serialized ownership.
+- [x] Verify exact root/child charge, child/parent refusal, old-plus-replacement admission, byte preservation, rollback and release.
+- [x] Verify exception/overflow negative contracts against actual outbox paths.
+- [x] Apply doubt-driven development before commit; evidence: `.debug/FEATURE-ci-outbox-capacity/doubts.md`.
+- [x] Finish focused GNU/libc++ outbox and affected existing resource-allocation checks, plus cpplint.
+
+Final verification: GNU and libc++19 each pass the full affected outbox executable (29 tests/244 checks), four unchanged selected existing H1 resource-allocation tests (4 tests/414 checks), and actual allocation-failure/SIZE_MAX probes. cpplint passes all three changed C++ files; `git diff --check` passes. The focused resource selection is not a claim that the complete cross-protocol resource suite ran. Source hashes and original failing/passing commands and outputs are retained with the journal.
+
+Evidence is retained in `.debug/FEATURE-ci-outbox-capacity/`: commands, build/run logs, original RED, bounded fault probe and journal. Scratch probe programs remain uncommitted. No broad baseline suite was run. Native macOS/BSD/Windows execution remains CI/v3-PR owned under AGENTS.md and does not block local completion.
+
+Separate Linux incidental failure remains **UNCERTAIN**, as settled by the prior single bounded check. Its evidence is `.debug/FEATURE-ci-native-runtime/journal.md`: native `icy_http10_and_head_keep_framing` assertions354/356 failed; a subsequent unchanged-core parity replay passed6 tests/35 assertions but its process failed LSan because ptrace is unsupported in the sandbox. This is not a passing process gate or proof of independence. This task does not reopen, retry or repair that failure.
+
+Project notes: C++20; normal setup is `./bootstrap`, out-of-tree `configure --disable-v3-tls`, `make`. Tests use `test/littletest.hpp`; this task directly compiled the affected existing test with its real production translation units using GNU libstdc++ and the retained task-local libc++19, without installing dependencies. `cpplint` reads root `CPPLINT.cfg` (200-column limit). Worktree creation required the existing Git sandbox escalation; branch/path came verbatim from Groundwork's identity helper. No configured agent memory was available.
+
+- [x] Caller: Groundwork validation completed with seven approvals and zero findings; matching evidence reused.
+- [x] Caller: local task finalization into v3.
+- [ ] CI / v3 PR: obtain fresh native platform evidence; no release-readiness claim.

src/detail/http1_response_outbox.cpp

@@ -1,5 +1,6 @@
 /* Copyright (C) 2026 Sebastiano Merlino; SPDX-License-Identifier: LGPL-2.1-or-later */
 #include <algorithm>
+#include <limits>
 #include <memory>
 #include <string>
 #include <utility>
@@ -142,19 +143,30 @@ auto http1_response_outbox::reserve_buffer_locked(http1_response_sink& sink, std
         sink.storage_units_ = sink.bytes_.capacity();
         return true;
     }
-    const auto bound = std::max(size, 2 * sink.bytes_.capacity());
-    if (!storage_charge_.grow(bound)) return false;
+    const auto maximum = sink.bytes_.max_size();
+    if (size > maximum) return false;
+    const auto capacity = sink.bytes_.capacity();
+    const auto bound = std::max(size, capacity > maximum / 2 ? maximum : 2 * capacity);
+    if (bound > std::numeric_limits<std::size_t>::max() - storage_charge_.units() ||
+        !storage_charge_.grow(bound)) return false;
+    // Destroy the private candidate before rolling back its admission.
+    struct provisional_charge {
+        resource_charge& charge;
+        std::size_t units;
+        ~provisional_charge() { charge.shrink(units); }
+    } pending{storage_charge_, bound};
     std::string replacement;
     replacement.reserve(bound);
-    if (replacement.capacity() > bound) {
-        std::string().swap(replacement);
-        storage_charge_.shrink(bound);
-        return false;
-    }
+    const auto actual = replacement.capacity();
+    const auto excess = actual - bound;
+    if (excess > std::numeric_limits<std::size_t>::max() - storage_charge_.units() ||
+        !storage_charge_.grow(excess)) return false;
+    pending.units = actual;
     replacement.append(sink.bytes_);
     sink.bytes_.swap(replacement);
     std::string().swap(replacement);
-    storage_charge_.shrink(std::exchange(sink.storage_units_, bound));
+    storage_charge_.shrink(std::exchange(sink.storage_units_, actual));
+    pending.units = 0;
     return true;
 }
 
@@ -319,23 +331,33 @@ http::outcome http1_response_sink::start(const http::request_head& request, cons
     // candidate allocation before returning any of its shared capacity.
     std::string previous = std::move(bytes_);
     const auto previous_units = std::exchange(storage_units_, 0);
-    const auto rollback = [this, &previous, previous_units](http::outcome failure) {
+    bool restored = false;
+    const auto restore = [this, &previous, previous_units, &restored] {
+        if (std::exchange(restored, true)) return;
         owner_->release_buffer_locked(*this);
         bytes_ = std::move(previous);
         storage_units_ = previous_units;
+    };
+    const auto rollback = [this, &restore](http::outcome failure) {
+        restore();
         return fail_locked(failure);
     };
-    std::size_t bound = 0;
-    if (!owner_->field_bound(f, 256, bound) || !owner_->reserve_buffer_locked(*this, before_head + bound)) {
-        return rollback({http::outcome_code::limit_exceeded, "shared response head capacity exhausted"});
-    }
-    bytes_.append(previous);
-    const http::outcome head = framer_->start_head(bytes_, request, s, f);
-    if (!head.ok()) return rollback(head);
-    if (bytes_.size() > owner_->budget_.max_head_bytes) {
-        return rollback(http::outcome(http::outcome_code::limit_exceeded,
-                                      "http1_response_sink: serialized response head exceeds the"
-                                      " head budget"));
+    try {
+        std::size_t bound = 0;
+        if (!owner_->field_bound(f, 256, bound) || !owner_->reserve_buffer_locked(*this, before_head + bound)) {
+            return rollback({http::outcome_code::limit_exceeded, "shared response head capacity exhausted"});
+        }
+        bytes_.append(previous);
+        const http::outcome head = framer_->start_head(bytes_, request, s, f);
+        if (!head.ok()) return rollback(head);
+        if (bytes_.size() > owner_->budget_.max_head_bytes) {
+            return rollback(http::outcome(http::outcome_code::limit_exceeded,
+                                          "http1_response_sink: serialized response head exceeds the"
+                                          " head budget"));
+        }
+    } catch (...) {
+        restore();
+        throw;
     }
     std::string().swap(previous);
     owner_->storage_charge_.shrink(previous_units);

src/httpserver/detail/http1_response_outbox.hpp

@@ -243,8 +243,9 @@ class http1_response_outbox {
 
     // Preallocate the whole candidate before serialization and keep the
     // old allocation charged until its replacement has copied the bytes.
-    // Geometric growth preserves amortized append cost. An allocator that
-    // exceeds this admitted bound is refused before publishing its buffer.
+    // Geometric growth preserves amortized append cost. Allocator-rounded
+    // excess must also be admitted before copying or publishing the buffer;
+    // refusal or an exception destroys the candidate and rolls back its charge.
     // Inline capacity is conservatively included for nonempty buffers.
     bool reserve_buffer_locked(http1_response_sink& sink, std::size_t size);