docs: close Clang warning-clean ticket

Author: robertvokac

AGENTS.md

@@ -18,7 +18,9 @@
    Net +6, Net.Http.Headers +2, TimeZone +18, and Xml +5; all other executables are unchanged.
    Graph 41 / 96, test-only seams 5 / 22, negative fixtures 55 / 284. The Doxygen 1.9.8
    no-regression baseline is 2,675 and is enforced both locally and in
-   CI.
+   CI. Ticket #2419 additionally makes the complete production graph a permanent Clang gate:
+   Clang 19.1.7 builds all 219 first-party translation units with `-Werror`, 0 warnings and
+   0 errors, from both `local_ci_check.sh` and the GitHub full job.
 
 <details><summary>Historical test-count ledger retained verbatim</summary>
 
@@ -226,7 +228,8 @@ reconfigure/rebuild is the exception that must be justified, never the default.
 
 ### Compile support is not runtime support
 
-The current full build/test baseline is Linux/GCC. Post-modular MinGW-w64 GCC
+The current full build/test baseline is Linux/GCC; the complete production-only `All` graph is
+also warning-clean under Clang 19.1.7 and is enforced locally and in CI. Post-modular MinGW-w64 GCC
 14-win32/CMake 3.31.6 and Emscripten 5.0.7/CMake 3.31.6 library builds both
 compile the `All` graph and a selective `Text.Json` graph without
 GoogleTest/runtime execution. Real downstream Apple Clang/Xcode 15.4 builds

CLAUDE.md

@@ -18,7 +18,9 @@
    Net +6, Net.Http.Headers +2, TimeZone +18, and Xml +5; all other executables are unchanged.
    Graph 41 / 96, test-only seams 5 / 22, negative fixtures 55 / 284. The Doxygen 1.9.8
    no-regression baseline is 2,675 and is enforced both locally and in
-   CI.
+   CI. Ticket #2419 additionally makes the complete production graph a permanent Clang gate:
+   Clang 19.1.7 builds all 219 first-party translation units with `-Werror`, 0 warnings and
+   0 errors, from both `local_ci_check.sh` and the GitHub full job.
 
 <details><summary>Historical test-count ledger retained verbatim</summary>
 
@@ -226,7 +228,8 @@ reconfigure/rebuild is the exception that must be justified, never the default.
 
 ### Compile support is not runtime support
 
-The current full build/test baseline is Linux/GCC. Post-modular MinGW-w64 GCC
+The current full build/test baseline is Linux/GCC; the complete production-only `All` graph is
+also warning-clean under Clang 19.1.7 and is enforced locally and in CI. Post-modular MinGW-w64 GCC
 14-win32/CMake 3.31.6 and Emscripten 5.0.7/CMake 3.31.6 library builds both
 compile the `All` graph and a selective `Text.Json` graph without
 GoogleTest/runtime execution. Real downstream Apple Clang/Xcode 15.4 builds

NEXT.md

@@ -3,19 +3,19 @@
 
 # NEXT.md
 
-> **ACTIVE — #2419, 2026-08-22: restore the warning-clean Clang production build.** An
-> independent Clang 17 build found four bounded `-Werror` regressions after the GCC-only final
-> gate: one potentially evaluated `typeid`, two unused compression constants and one unused
-> WebSocket private field. The local reproducer is Clang 19.1.7. #2419 repairs those sites and
-> adds a production-only Clang CI gate so ticket #37's GCC/Clang warning-policy invariant is
-> measured continuously. The 364-row correctness audit remains fully dispositioned; maintenance
-> mode is withheld only until this portability gate is green and the full supported gate is
-> reverified.
+> **#2419 CLOSED — CLANG GATE GREEN, 2026-08-22.** An independent Clang 17 build found four
+> bounded `-Werror` regressions after the GCC-only final gate: one potentially evaluated `typeid`,
+> two unused compression constants and one unused WebSocket private field. They are repaired
+> without behavior changes. The permanent production-only gate builds **219/219** first-party
+> translation units with Clang 19.1.7 and `-Werror`: **0 warnings, 0 errors**. Six contract tests
+> pin compiler selection, all-components/no-tests scope, `-Werror`, warning detection, the
+> two-job ceiling, missing-compiler failure and local/CI wiring.
 >
 > **Test-count floor, 2026-08-22 — 17,840 / 38, AND THE GATE IS GREEN.** The complete
 > 38-executable gate reads **17,840 run: 17,840 passed, 0 failed, 0 skipped**, zero build warnings
-> at `--parallel 2` over a cache-disabled full repository build. Graph **41 / 96**, seams **5 / 22**,
-> negative fixtures **55 / 284**.
+> at `--parallel 2` over the GCC repository build. The same end-to-end local/CI gate now also
+> includes the fresh Clang production build above. Graph **41 / 96**, seams **5 / 22**, negative
+> fixtures **55 / 284**.
 >
 > **+59** on the 17,781 final-audit closure, all from #2418's post-`DateTimeKind` consumer audit:
 > `Core_Base` 6,156 → 6,178, `Globalization` 704 → 705, `IO` 700 → 705, `Net` 340 → 346,
@@ -53,13 +53,14 @@
 >
 > ---
 >
-> ## MAINTENANCE-READY FOR THE DECLARED SCOPE — #2418 CLOSED
+> ## MAINTENANCE-READY FOR THE DECLARED SCOPE — #2419 CLOSED
 >
-> Measured 2026-08-22: `ticket` is **2,408 done, 0 doing, 0 todo, 3 blocked, 5 wontfix**, and
+> Measured 2026-08-22: `ticket` is **2,409 done, 0 doing, 0 todo, 3 blocked, 5 wontfix**, and
 > `task` is fully classified (**1,087 ported, 140 ignore, 14,980 ignored**). Ticket #2417 remains a
 > truthful closure of the 364 historical audit findings; #2418 separately closes the later
-> post-#1941 `DateTimeKind` ripple discovered outside that audit. A bounded final scan found no
-> remaining actionable correctness work inside the declared practical subset.
+> post-#1941 `DateTimeKind` ripple discovered outside that audit; #2419 restores ticket #37's
+> cross-compiler warning invariant and makes it a permanent gate. A bounded final scan found no
+> remaining actionable internal work inside the declared practical subset.
 >
 > The other three incomplete tickets depend on external prerequisites this container lacks, as
 > measured rather than assumed:
@@ -71,6 +72,22 @@
 >
 > The five `wontfix` entries are recorded decisions with their reasons, not oversights.
 >
+> ## 2026-08-22 — #2419: warning-clean Clang production build
+>
+> Clang-specific warnings are repaired at their source: Delegate RTTI still observes the dynamic
+> invocation-list entry type without hiding a call in `typeid`'s polymorphic operand; two dead
+> compression constants are removed; and `CancellationScope` no longer stores a redundant raw
+> owner pointer that its callback never read. No public API, behavior, test count, layout exposed
+> to consumers, or module edge changed.
+>
+> `scripts/check_clang_production_build.sh` creates a fresh tree only under `build-tmp`, selects
+> Clang for C and C++, disables tests and benchmarks, builds `All` at most two jobs, and verifies
+> every first-party production command carries `-Werror`. It runs from `local_ci_check.sh` and
+> therefore the GitHub full job. Final evidence: Clang 19.1.7 **219/219 translation units, 0
+> warnings, 0 errors**; GCC **17,840/17,840**; selective matrix **10/10**; Doxygen **2,675/2,675**;
+> Python validator tests **124/124**; ASan+UBSan **6,399** targeted tests and TSan **108/108**
+> Net.WebSockets tests.
+>
 > ## 2026-08-22 — #2418: post-#1941 `DateTimeKind` consumer audit
 >
 > The ripple audit repaired local `DateTime::Now`/`Today`, UTC `UnixEpoch`, Kind-preserving
@@ -108,8 +125,8 @@
 > ## HOW THE LAST STRETCH WENT, AND WHAT IS WORTH CARRYING FORWARD
 >
 > The queue was emptied by the date/time chain rooted at **#1940**, the #2417 audit close-out and
-> #2418's post-feature ripple audit, plus three findings made **while working on something else**.
-> That last category is worth naming, because none of the three was on any list:
+> #2418's post-feature ripple audit, plus four findings made **while working on something else**.
+> That last category is worth naming, because none of the four was on any list:
 >
 > * **#2415 — a gate had been RED for a day behind a green test count.**
 >   `scripts/check_selective_components.sh` failed on a fixture #1889 had legitimately invalidated,
@@ -125,6 +142,9 @@
 > * **A limitation found by a test of mine FAILING** (#1945): `RoundtripKind` could not carry a kind
 >   across a string, because nothing wrote a marker and nothing read one. It was declared and
 >   pinned, and SA-16.3 later closed it — with the pin **inverted rather than deleted**.
+> * **#2419 — “warning-clean” meant GCC-only.** An independent Clang 17 build found four warnings
+>   promoted to errors even though ticket #37 explicitly named GCC and Clang. The fixes are small,
+>   but the durable repair is the fresh 219-translation-unit Clang gate now run locally and in CI.
 >
 > **Three recurring process lessons, each of which cost real time this stretch:**
 >

README.md

@@ -190,6 +190,9 @@ The component graph is enforced rather than documented only:
 - `scripts/generate_component_catalog.py --check` rejects catalogue drift.
 - `scripts/check_selective_components.sh` defines ten isolated positive
   consumers and negative leakage fixtures.
+- `scripts/check_clang_production_build.sh` builds all 219 first-party
+  production translation units with Clang, tests disabled, and verifies from
+  the compile database that every one still carries `-Werror`.
 - `scripts/check_negative_consumer_fixtures.py` compiles every negative consumer
   fixture in `test/consumer/` **once per marked site** and requires each site to
   be rejected for its own declared reason. A fixture marks each site with
@@ -200,7 +203,8 @@ The component graph is enforced rather than documented only:
   fixtures. Compilation jobs resolve as explicit `--jobs`, then
   `SHARP_RUNTIME_BUILD_JOBS`, then the safe default 2; only 1 or 2 is accepted.
 - `.github/workflows/components.yml` runs the selective matrix and the full
-  compatibility build on Ubuntu for pushes and pull requests.
+  compatibility build on Ubuntu for pushes and pull requests. The full job
+  includes both the GCC build/test gate and the Clang production warning gate.
 
 At the current baseline the graph has **41 physical modules and 96 direct
 production dependency edges**, with no allow-listed exception. The boundary
@@ -211,11 +215,13 @@ configure `Threading` or `TimeZone`.
 ## Platform status
 
 The complete build and test baseline is currently verified on Linux with GCC.
-Other platform evidence is narrower:
+The complete production graph is additionally warning-clean on Linux with
+Clang; other platform evidence is narrower:
 
 | Platform/toolchain | Verified scope |
 |---|---|
 | Linux/GCC | Current warning-free full component build and all 17,840 tests, with no failures or skips. |
+| Linux/Clang | Clang 19.1.7 builds all 219 first-party production translation units with `-Wall -Wextra -Werror`, 0 warnings and 0 errors. Tests remain covered by the Linux/GCC row. The production-only gate runs locally and in GitHub CI. |
 | Windows/MinGW | MinGW-w64 GCC 14-win32/CMake 3.31.6 compiled the post-component `All` and selective `Text.Json` library graphs under ticket #1741. GoogleTest was not cross-built and repository CI remains Ubuntu-only. |
 | Emscripten | Emscripten 5.0.7/CMake 3.31.6 compiled the post-component `All` and selective `Text.Json` library graphs under ticket #1741. Tests were not cross-built or run, and some runtime APIs deliberately throw `PlatformNotSupportedException`. |
 | macOS/Apple Clang | Real downstream Xcode 15.4 builds drove portability fixes on 2026-07-20; this repository has no macOS job or recorded full standalone test baseline. |

plan.md

@@ -1,21 +1,21 @@
 # Sharp Runtime plan
 
-*Last verified GCC gate: 2026-08-22 — branch **`next`**. Gate **17,840 across 38 executables: 17,840
+*Last verified cross-compiler gate: 2026-08-22 — branch **`next`**. GCC gate **17,840 across 38 executables: 17,840
 passed, 0 failed, 0 skipped — GREEN**, recounted from the per-executable logs with every executable
-run separately and continuing past failures, zero build warnings over a cache-disabled full build
-at `--parallel 2`. Graph **41 / 96**, seams **5 / 22**, negative fixtures **55 / 284**. Ticket
-#2418 closed the bounded post-#1941 `DateTimeKind` propagation gap. Ticket **#2419 is now doing**:
-an independent Clang 17 production build found four small `-Werror` regressions, so the repository
-is not called maintenance-ready again until Clang is warning-clean and a regression gate exists.*
+run separately and continuing past failures, with zero build warnings at `--parallel 2`. The fresh
+Clang 19.1.7 production-only gate built **219/219** first-party
+translation units with `-Werror`, 0 warnings and 0 errors. Graph **41 / 96**, seams **5 / 22**,
+negative fixtures **55 / 284**. Ticket #2418 closed the bounded post-#1941 `DateTimeKind`
+propagation gap; #2419 restored and permanently gates ticket #37's GCC/Clang warning invariant.*
 
-## Status: #2419 in progress — maintenance mode pending the Clang gate
+## Status: maintenance-ready for the declared scope
 
 Measured 2026-08-22, not estimated:
 
 | | |
 |---|---|
-| `ticket` done | **2,408** |
-| `ticket` doing | **1** |
+| `ticket` done | **2,409** |
+| `ticket` doing | **0** |
 | `ticket` **todo** | **0** |
 | `ticket` blocked | 3 |
 | `ticket` wontfix | 5 |
@@ -26,9 +26,11 @@ propagation/validation defects in `DateTime`, `DateTimeOffset`, `TimeZoneInfo`,
 their bounded consumers. The 364-row audit index remains fully dispositioned as historical audit
 truth; #2418 is a later correctness ticket and does not alter its distribution.
 
-Ticket **#2419** restores ticket #37's explicit GCC/Clang warning-policy invariant. Its bounded
-scope is the four independently reproduced Clang diagnostics plus a production-only Clang CI gate;
-it does not reopen the correctness audit or broaden the supported API subset.
+Ticket **#2419** restored ticket #37's explicit GCC/Clang warning-policy invariant. Four
+independently reproduced Clang diagnostics were repaired without behavior changes. A fresh
+production-only `All` build now runs from the local gate and GitHub full job, and its six contract
+tests prevent loss of compiler selection, scope, `-Werror`, warning detection or the two-job limit.
+It does not reopen the correctness audit or broaden the supported API subset.
 
 The other three incomplete tickets are externally blocked. Each was measured rather than assumed:
 
@@ -39,6 +41,13 @@ The other three incomplete tickets are externally blocked. Each was measured rat
 
 The five `wontfix` entries are recorded decisions with their reasons.
 
+Ticket #2419's final evidence is Clang 19.1.7 over **219/219** first-party production translation
+units with **0 warnings and 0 errors**; the unchanged GCC gate at **17,840/17,840** across 38
+executables; all ten selective configurations; Doxygen **2,675/2,675**; graph **41/96**; seams
+**5/22**; negative fixtures **55/284** over 339 compiler invocations; and Python validator tests
+**124/124**. Targeted ASan+UBSan passed **6,399** tests (Core.Base, IO.Compression and
+Net.WebSockets), and TSan passed **108/108** Net.WebSockets tests.
+
 Ticket #2418's final evidence is a warning-free cache-disabled full build; **17,840/17,840** tests
 across 38 executables; graph **41/96**; all ten selective component configurations; Doxygen
 **2,675/2,675**; and every repository consistency validator. ASan+UBSan+LSan and strict UBSan each
@@ -69,11 +78,12 @@ closed residual `Socket`, `Timer` and `Process::WaitForExit()` lifetime/order de
 
 The date/time chain rooted at **#1940** — #1940, #1941, #1942, #1943, #1944, #1945, #2409, #2410,
 #2412, #2414 and the final #2418 consumer ripple — together with **#1997** (all four groups),
-#2417's audit close-out and three findings made *while working on something else*: **#2415** (a
+#2417's audit close-out and four findings made *while working on something else*: **#2415** (a
 gate red for a day behind a green test count, and building into
 `/tmp`), **#2416** (`DateTime::ToString` had no standard-format table, so the two halves of one type
-disagreed about what `o` means), and #1945's `RoundtripKind` limitation, found by one of my own
-tests failing.
+disagreed about what `o` means), #1945's `RoundtripKind` limitation, found by one of my own tests
+failing, and **#2419** (an independent Clang build disproved a GCC-only warning-clean claim and led
+to a permanent second-compiler gate).
 
 Standing approvals **SA-14**, **SA-15** and **SA-16** were granted over 2026-08-20 and are recorded
 in `docs/StandingApprovals.md`; SA-16 is the one that unblocked the last four tickets.