[gg582]

Summary

Brings to main everything merged into dev that main still lacks. This covers dev's last week and an audit of every PR ever merged into dev from other branches. Commits are in dev order and use git cherry-pick -x, or a partial pick that names its source commit.

This week on dev

• 0222a586a feat(port): complete the bare-metal STM32 epic (#447) #460 feat(port): complete the bare-metal STM32 epic (epic: bare-metal STM32 (Cortex-M) port via the dispatch_memory core + lwIP #447)
• 9361cea43 example(port): STM32F769I-DISCO wire inspector on real Ethernet (#447) #461 example(port): STM32F769I-DISCO wire inspector on real Ethernet (epic: bare-metal STM32 (Cortex-M) port via the dispatch_memory core + lwIP #447)
• b8f3532d9 docs(example): document measured STM32F769I-DISCO connection limits
• 7e792528a example(stm32f769): measure the real connection ceiling, harden RMII watchdog
• 190696300 feat(lwip): static connection pool and streamed responses

The last three were committed to dev directly, not through a PR. The rest of dev's week (#452–#457) is already on main through #454 and #458. #459 is already present by content.

Older dev PRs that never reached main: whole picks

• fix(tutorials): keep the websocket chat handler receiving until the client closes #262 fix(tutorials): keep the websocket chat handler receiving until the client closes
• ci(queue): require Redis and NATS integration coverage #265 ci(queue): docs/durable-queue-gate.md. The workflow was already on main; the doc was not.
• docs(example): add README for example/json-builder (issue #275) #330, docs(example): add README for example/sstring (issue #275) #331, docs(example): add README for example/html (issue #275) #332, docs(example): add README for example/simple-server (issue #275) #368, docs(example): add README for example/http (issue #275) #369 docs(example): READMEs for example/json-builder, sstring, html, simple-server, http
• bench(web-frameworks): pin CWIST_WORKERS=4 in the-benchmarker config #334 bench(web-frameworks): pin CWIST_WORKERS=4 in the-benchmarker config

Older dev PRs: partial picks. Only the part that is missing on main and still present on dev is taken. The rest of each PR is already on main in its own form, and each commit message says which part was taken.

• fix(seq_auth): validate total chunks bound and cleanse session_id on destroy #60 the chunk-count bound test. seq_auth.c already cleanses session_id through SEQ_AUTH_CLEANSE.
• fix(sstring): prevent overflow in substr and normalize empty string compare #66 the empty-compare and INT_MAX substr tests. The sstring.c fixes are already on main.
• fix(wasip2): link stack size + edge-KV persistence example (issue #201) #206 the sqlite canary in tests/wasip2_smoke.c, the second /hello probe in wasip2-smoke (it catches a request-path stack overflow), and the stack note in docs/api/wasi.md. WASIP2_STACK_BYTES and example/wasip2-kv are already on main.
• ci(tutorials): compile every tutorial and the tutorial doc snippets in the ASan job #263 the CONTRIBUTING note on make tutorials-check. The target and the ASan step are already on main.
• ci(wasm): execute the WASI component bundle in Chromium #264 the "Browser runtime gate" section of docs/api/wasm-component.md and the tests/browser/node_modules/ ignore.
• docs(wasm): record issue #203 stage 3 status (JSPI still flagged) #425 the stage 3 status note in docs/api/wasm-component.md.
• fix: restore main-only v3.9 fixes that never reached dev #350 the test_gc_job_handoff ignore entry. The code fixes in fix: restore main-only v3.9 fixes that never reached dev #350 came from main in the first place.

Follow-up commits:

• scripts/ci/api-untested-baseline.txt drops cwist_sstring_compare_sstring, which fix(sstring): prevent overflow in substr and normalize empty string compare #66's test now calls. dev's list does not carry it either.
• Makefile: BAREMETAL_SRCS lists src/core/mem/gc.c once. On main it sits in both WASM_SRCS and WASIP2_EXTRA_SRCS, while dev has it only in the latter. The single-file bundle from feat(port): complete the bare-metal STM32 epic (#447) #460's baremetal-dist therefore defined gc.c twice, which failed baremetal-dist-check on the first CI run.

How missing changes were found

1. I listed all 279 PRs merged into dev (gh pr list --base dev --state merged).
2. I dropped those main already has. A PR counted as present on main if any of these held:
   • its diff reverse-applies to main's tree;
   • its PR number or commit sha is referenced in a main commit message or in a main PR body (that is how main records picks);
   • every line it adds is already in main's version of the same file.
3. For what was left, I kept only the lines that the PR added, that still exist in dev's current file, and that are missing from main's. This removes changes that dev itself later replaced. 28 PRs remained, and I went through each one by hand.

Not picked, with reasons

• fix(rust): make AsyncResponse own its handle and stop writing deferred responses #296, fix(middleware,rust): make Rust compression work and keep built-in middleware off deferred responses #299: Rust deferred-response tests in bindings/rust/cwist/tests/server.rs. The two branches deliberately differ here. dev's commit "test(rust): adjust deferred response server tests to conform to main contract" (a429d4ba2) and main's later history keep main's variant.
• ci(api): gate public headers against the v4.0 API baseline (#339) #357, docs: v4.0 soak test definition + public API baseline #337, fix(tsan): clear the open reports and run 11 more tests under TSan (#351) #358, and the http3.c/http3_client.c parts of docs(src): add missing Doxygen function comments #312 and fix(http): check sstring and header-add results on the right error channel #251: HTTP/3 close-error and WebTransport client API, plus their baseline entries. main deliberately ships server-only WebTransport on its own lsquic pin (2b30189, no lsquic_wt.h), as recorded in cherry-pick: embedded build work (#428, #435-#440, #442-#444) to main #445.
• chore(homebrew): point the formula at the v3.9 release tarball #317, chore(homebrew): pin the v3.9 formula to the published tarball sha #328, chore(homebrew): point the formula at the v3.9.1 release tarball #352: Homebrew formula pins for v3.9 and v3.9.1. main's formula already points at the newer v4 release.
• perf(app): default worker processes to one per three cores #333, perf(app): revert default workers to one per core (fixes webserver latency gate) #335: the worker-count retune and its revert cancel out. Defaults are identical (one worker per core); only a comment differs.
• docs(ko): Korean translation of docs/ #329 and the docs/ko/* pages from feat(port): complete the bare-metal STM32 epic (#447) #460, example(port): STM32F769I-DISCO wire inspector on real Ethernet (#447) #461 and 190696300 (Korean translations): main carries only docs/ko/runtime-config.md and docs/ko/versioning.md, as in cherry-pick: embedded build work (#428, #435-#440, #442-#444) to main #445.
• fix(bench): give Spring Boot the same tuned low-concurrency run CWIST gets #33 (Spring Boot tuned run), docs(tutorial): fix the CSS composer example routing and its section number #254 (tutorial heading): dev itself has since removed or replaced these.
• The src/net/redis/cwist_redis.c part of docs(src): add missing Doxygen function comments #312: Doxygen comments only. The surrounding functions are laid out differently on main.
• scripts/ci/malloc-baseline.txt hunks in fix(orm): prevent null dereference on dialect and reject empty update payloads #75, fix(db_crypt): short-circuit EVP cipher operations and cleanse stack keys #76, fix(graphql): validate selection set presence and unterminated string arguments #78, fix(ci): fix -Warray-compare in test_middleware_jwt and sync malloc-baseline line numbers #81, fix(http_client): cap response body at CWIST_HTTP_MAX_BODY_SIZE to prevent OOM #141, http_client: cap response header count at 200 to prevent OOM DoS #147, perf(http): one C1M reactor loop per CPU the worker actually owns #154: stale line-number references.
• Remaining comment-only gaps in fix(websocket): auto-reply PONG to PING frames (RFC 6455 §5.5.3) #140, websocket: fail connection on non-zero RSV bits (RFC 6455 §5.2) #146: the code itself is on main.

Conflict resolution

• feat(port): complete the bare-metal STM32 epic (#447) #460: docs/api/v4.0-api-baseline.txt. Regenerated with make api-baseline from main's headers. It adds only cwist_http_response_header_add, the same entry feat(port): complete the bare-metal STM32 epic (#447) #460 added on dev.
• feat(port): complete the bare-metal STM32 epic (#447) #460, example(port): STM32F769I-DISCO wire inspector on real Ethernet (#447) #461, 190696300: docs/ko/*. Kept off main, per the rule above.

Submodule gitlinks are unchanged. main keeps its own lsquic pin (2b30189).

How it was verified

On the picked tree, with main's submodule pins:

• check_test_wiring, check_api_baseline (incl. the v4 guarantee), check_env_knobs, check_api_test_coverage, check_inline_exports, malloc_lint.sh, scripts/ci unit tests: OK
• scripts/ci/cppcheck.sh with cppcheck 2.13: no findings
• make -j16 all and make -k test: all targets pass, exit 0 (lsquic built fresh at 2b30189).
• make baremetal-dist-check and make baremetal-size-gate: the bundles build and cross-compile; hello, hello-rtc, hello-lwip and hello-tls PASS under qemu-arm, all within budget.
• make wasip2-smoke: PASS, including the second /hello probe picked from fix(wasip2): link stack size + edge-KV persistence example (issue #201) #206.

[github-actions]

This PR targets main, but CWIST's contribution flow lands work on dev first (see CONTRIBUTING.md). Automatic redirect onto dev failed -- the commits didn't cherry-pick cleanly (likely a real content conflict against dev's current state, not just a base-branch mismatch).

A maintainer needs to recreate this PR's commits against dev by hand (git cherry-pick, preserving authorship) and close this one in favor of the recreation. Labeled needs-manual-dev-redirect for visibility.