fix(net-http): a request may be sent once, and a status code is 0..999 (#2067, #2069)

#2067 -- HttpClient sent the same HttpRequestMessage as many times as it was
asked, and a counting handler received the exact same object twice. That is not
merely untidy: the second send reuses a content object the first send may
already have consumed, and both sends share one headers map the first handler
may have mutated. .NET has refused it since its first version, and this port now
raises InvalidOperationException with .NET's own message.

The claim is atomic, not merely a flag. .NET uses an interlocked
compare-and-exchange precisely so two concurrent sends cannot both win, and
std::atomic_flag::test_and_set is the same operation. The test asserts that
rather than trusting the type name -- eight threads released at one starting
line, two hundred times. The repetition was necessary: the mutation replacing
the claim with a non-atomic read-then-set PASSED a single eight-thread round,
and only failed once the test was strengthened. That is recorded rather than
quietly tidied.

The flag belongs to the message, so a second HttpClient cannot resend it either.
MarkAsSent() is public because a custom handler invoked directly, without an
HttpClient, is a legitimate caller.

sizeof(HttpRequestMessage) grows 192 -> 200 under SA-3, pinned by the layout
probe. Consumers must rebuild; no source change is needed.

#2069 -- HttpResponseMessage accepted any number as a status code: -1, 0, 1000
and 99999 all constructed and IsSuccessStatusCode answered false for each, so a
nonsense code was indistinguishable from a real failure. Both the constructor
and the setter now validate, with .NET's two checks in .NET's order.

The bound is 999, not 599: RFC 9112 makes a status code three digits and .NET
accepts every three-digit value rather than only the registered ranges, 0
included. Both facts are asserted, so a later "tightening" cannot land quietly.
An out-of-range value never reaches the object. The wire path cannot be
affected, because parseStatusLine has required exactly three digits since #2064
-- verified before implementing, not assumed.

#2069 needed no member, and neither did #2068. The response layout static_assert
is kept and reworded to record that, since the review expected both to need one.

+1 net test, two gated pins inverted. Four mutations, all caught.

Gate: 17,238 run, 0 failed, 38 executables -- green. Downstream, measured: zero
HttpClient sites in either consumer.

SR-AUD-314 and SR-AUD-316 -> remediated. This closes the modules/net-http
review: #2067, #2068, #2069 and #2071 all landed today. Record:
docs/Migration-HttpRequestSendOnceAndStatusCodeDomain.md.

Author: robertvokac

CLAUDE.md

@@ -0,0 +1,63 @@
+<!-- SPDX-License-Identifier: MIT -->
+<!-- Copyright (c) Robert Vokac and contributors -->
+
+# Migration — a request may be sent once, a status code is 0..999 (tickets #2067, #2069)
+
+*2026-08-17.* Two `System.Net.Http` shapes gain the validation .NET has.
+
+* **#2067** — `HttpClient` sent the same `HttpRequestMessage` as many times as you asked.
+  `sizeof(HttpRequestMessage)` grows **192 → 200** under `docs/StandingApprovals.md` SA-3.
+  **Downstream consumers must be recompiled.**
+* **#2069** — `HttpResponseMessage` accepted any number as a status code. No layout change.
+
+Both landed under SA-5 for the behaviour.
+
+---
+
+## 1. #2067 — send once
+
+| | Was | Is |
+|---|---|---|
+| `client.Send(request)` twice with one message | both succeeded; the **same object** reached the handler twice | the second raises `InvalidOperationException` |
+| the message afterwards | no observable state | `getWasSentProperty()` is `true` |
+| a second `HttpClient` sending the same message | succeeded | raises — the flag belongs to the **message** |
+| a different message | — | unchanged |
+
+The message is .NET's own: *"The request message was already sent. Cannot send the same request
+message multiple times."* (`HttpClient.cs:745-751`).
+
+**Why it matters beyond tidiness.** The second send reuses a content object the first send may
+already have consumed, and both sends share one headers map that the first handler may have
+mutated. .NET has refused this since its first version.
+
+The claim is atomic. .NET uses an interlocked compare-and-exchange
+(`HttpRequestMessage.cs:26,173`) precisely so two concurrent sends cannot both win;
+`std::atomic_flag::test_and_set` is the same operation, and a test releases eight threads at one
+starting line, two hundred times, to assert it rather than trust the type name.
+
+**To migrate:** build a new `HttpRequestMessage` per send. If you were reusing one to retry, the
+retry was already sharing consumed content with the original.
+
+## 2. #2069 — the status-code domain
+
+| Status code | Was | Is |
+|---|---|---|
+| `-1`, `-1000`, `1000`, `99999` | constructed; `IsSuccessStatusCode` false | `ArgumentOutOfRangeException` |
+| `0`, `1`, `100`, `599`, `998`, `999` | constructed | **unchanged** |
+| `setStatusCodeProperty` with an out-of-range value | accepted | raises, and the old value survives |
+
+The bound is **999, not 599**. RFC 9112 §4 makes a status code three digits, and .NET accepts
+every three-digit value rather than only the registered ranges — `0` included. Both checks, in
+both places, are transcribed from `HttpResponseMessage.cs:152-159` and `:65-76`.
+
+**The wire path cannot be affected.** `HttpClient::parseStatusLine` has required exactly three
+digits since #2064, so a server can never produce a code this rejects.
+
+**To migrate:** nothing, unless you constructed a sentinel response with a code outside 0..999,
+which .NET never allowed either.
+
+## 3. Downstream, measured
+
+Neither `cna` nor `mobile-eggbert` references `HttpClient` or `System::Net::Http` — **zero sites
+in both**. Neither repository was modified. The full-rebuild requirement for #2067's layout
+change is recorded here for any future consumer.

audit/AUDIT_FINDINGS_INDEX.md

@@ -8,6 +8,7 @@
 #include "System/Net/Http/detail/HttpFieldValidation.hpp"
 #include <memory>
 #include <string>
+#include <atomic>
 #include <unordered_map>
 
 namespace System::Net::Http {
@@ -29,6 +30,25 @@ class HttpRequestMessage {
     std::shared_ptr<HttpContent>                   content_;
     std::unordered_map<std::string, std::string>   headers_;
     HttpRequestOptions                              options_;
+    /**
+     * @brief Whether an `HttpClient` has already sent this message.
+     *
+     * Ticket #2067 (SR-AUD-314, CCF-019). .NET throws `InvalidOperationException` when one
+     * `HttpRequestMessage` is sent twice; this port had no such state, and a counting handler
+     * received the exact same object twice. That is not merely untidy: the second send reuses a
+     * content object the first send may already have consumed, and both sends share one headers
+     * map that the first one's handler may have mutated.
+     *
+     * .NET's flag is `_sendStatus`, set with an interlocked compare-and-exchange
+     * (`HttpRequestMessage.cs:26,173`) so two concurrent sends of one message cannot both win.
+     * `std::atomic_flag`'s `test_and_set` is the same operation, so this port gets the same
+     * guarantee rather than a racy approximation of it.
+     *
+     * Landed under `docs/StandingApprovals.md` SA-3: a private member, no vtable, base-class,
+     * signature or `noexcept` change, `sizeof` pinned by the layout probe.
+     */
+    std::atomic_flag sent_ = ATOMIC_FLAG_INIT;
+
 public:
     /** Constructs an HttpRequestMessage with the default GET method and an empty URI. */
     HttpRequestMessage() : method_(HttpMethod::Get()) {}
@@ -94,6 +114,25 @@ class HttpRequestMessage {
         return headers_;
     }
 
+    /**
+     * @brief Claims this message for one send, returning false if it was already claimed.
+     *
+     * Ticket #2067. The counterpart of .NET's `MarkAsSent()`
+     * (`HttpRequestMessage.cs:173`), which is an interlocked compare-and-exchange for the same
+     * reason this is a `test_and_set`: two threads sending one message must not both succeed.
+     *
+     * `HttpClient::Send` calls it and raises `InvalidOperationException` with .NET's own message
+     * when it returns false. It is public rather than private because a custom
+     * `HttpMessageHandler` invoked directly, without an `HttpClient`, is a legitimate caller.
+     */
+    bool MarkAsSent() noexcept { return !sent_.test_and_set(std::memory_order_acq_rel); }
+
+    /** @return Whether an `HttpClient` has already sent this message (#2067). */
+    [[nodiscard]] bool getWasSentProperty() const noexcept {
+        // test() is const-correct on the flag's value without claiming it.
+        return sent_.test(std::memory_order_acquire);
+    }
+
     /** Gets the per-request option collection. */
     [[nodiscard]] HttpRequestOptions& getOptionsProperty() noexcept { return options_; }
     [[nodiscard]] const HttpRequestOptions& getOptionsProperty() const noexcept { return options_; }

docs/Migration-HttpRequestSendOnceAndStatusCodeDomain.md

@@ -4,6 +4,7 @@
 #pragma once
 #include "System/Net/Http/HttpContent.hpp"
 #include "System/Net/Http/HttpRequestException.hpp"
+#include "System/ArgumentOutOfRangeException.hpp"
 #include "System/Net/Http/detail/HttpFieldValidation.hpp"
 #include "System/Net/HttpStatusCode.hpp"
 #include <memory>
@@ -19,13 +20,55 @@ class HttpResponseMessage {
     std::string                                    reasonPhrase_;
     std::shared_ptr<HttpContent>                   content_;
     std::unordered_map<std::string, std::string>   headers_;
+    /**
+     * @brief `0 <= code <= 999`, exactly .NET's bound.
+     *
+     * Ticket #2069 (SR-AUD-316's status-code half). Measured before it, `-1`, `0`, `1000` and
+     * `99999` all constructed, and `getIsSuccessStatusCodeProperty()` answered false for each --
+     * so a nonsense code was indistinguishable from a real failure. .NET validates in both the
+     * constructor and the setter, with the same two checks in the same order
+     * (`HttpResponseMessage.cs:152-159` and `:65-76`):
+     *
+     * ```csharp
+     * ArgumentOutOfRangeException.ThrowIfNegative((int)value, nameof(value));
+     * ArgumentOutOfRangeException.ThrowIfGreaterThan((int)value, 999, nameof(value));
+     * ```
+     *
+     * The upper bound is **999**, not 599: RFC 9112 §4 makes a status code three digits, and
+     * .NET accepts every three-digit value rather than only the registered ranges. `0` is
+     * accepted too, and that is .NET's choice, not an oversight here.
+     */
+    static void throwIfStatusCodeOutOfRange(System::Net::HttpStatusCode value) {
+        const int code = static_cast<int>(value);
+        if (code < 0) {
+            throw System::ArgumentOutOfRangeException("value", "The status code must not be negative.");
+        }
+        if (code > 999) {
+            throw System::ArgumentOutOfRangeException("value", "The status code must not exceed 999.");
+        }
+    }
+
 public:
+    /**
+     * @brief Constructs a response with @p statusCode.
+     * @throws System::ArgumentOutOfRangeException if @p statusCode is negative or above 999.
+     * @see throwIfStatusCodeOutOfRange
+     */
     explicit HttpResponseMessage(
         System::Net::HttpStatusCode statusCode = System::Net::HttpStatusCode::OK)
-        : statusCode_(statusCode) {}
+        : statusCode_(statusCode) {
+        throwIfStatusCodeOutOfRange(statusCode);
+    }
 
     [[nodiscard]] System::Net::HttpStatusCode getStatusCodeProperty() const { return statusCode_; }
-    void setStatusCodeProperty(System::Net::HttpStatusCode v)               { statusCode_ = v; }
+    /**
+     * @brief Sets the status code.
+     * @throws System::ArgumentOutOfRangeException if @p v is negative or above 999 (#2069).
+     */
+    void setStatusCodeProperty(System::Net::HttpStatusCode v) {
+        throwIfStatusCodeOutOfRange(v);
+        statusCode_ = v;
+    }
 
     [[nodiscard]] const std::string& getReasonPhraseProperty() const { return reasonPhrase_; }
 

modules/net-http/include/System/Net/Http/HttpRequestMessage.hpp

@@ -4,6 +4,7 @@
 
 #include "System/Net/Http/HttpClient.hpp"
 #include "System/ArgumentOutOfRangeException.hpp"
+#include "System/InvalidOperationException.hpp"
 #include <condition_variable>
 #include <memory>
 #include <mutex>
@@ -303,6 +304,16 @@ std::shared_ptr<HttpResponseMessage> HttpClient::Send(
     // override a header the caller already set on this specific request) before handing off
     // to the handler chain -- matching real .NET's HttpClient applying DefaultRequestHeaders
     // ahead of invoking the handler pipeline.
+    // Ticket #2067. .NET's CheckRequestMessage does exactly this, with exactly this message
+    // (HttpClient.cs:745-751, SR.net_http_client_request_already_sent). Sending one message
+    // twice reuses a content object the first send may already have consumed and shares one
+    // headers map the first handler may have mutated.
+    if (!request->MarkAsSent()) {
+        throw System::InvalidOperationException(
+            "The request message was already sent. Cannot send the same request message "
+            "multiple times.");
+    }
+
     for (const auto& [k, v] : defaultHeaders_) {
         // Ticket #2068: the "did the caller already set it" test is case-insensitive too. A
         // byte-exact find() meant a default named `Accept` was merged on top of a request that

modules/net-http/include/System/Net/Http/HttpResponseMessage.hpp

@@ -1888,6 +1888,10 @@ struct HttpRequestMessageLayoutProbe {
     std::shared_ptr<HttpContent>                 content;
     std::unordered_map<std::string, std::string> headers;
     HttpRequestOptions                           options;
+    // #2067 added exactly one member: the send-once flag, an atomic_flag for the same reason
+    // .NET uses an interlocked compare-and-exchange -- two threads sending one message must not
+    // both succeed.
+    std::atomic_flag                             sent;
 };
 struct HttpResponseMessageLayoutProbe {
     System::Net::HttpStatusCode                  statusCode;
@@ -1899,11 +1903,13 @@ struct HttpResponseMessageLayoutProbe {
 } // namespace
 
 static_assert(sizeof(HttpRequestMessage) == sizeof(HttpRequestMessageLayoutProbe),
-              "#2067's sent-state flag would grow HttpRequestMessage -- SR-AUD-314, "
-              "OBJECT LAYOUT CHANGE, NOT APPROVED");
+              "HttpRequestMessage's object layout moved. #2067 added exactly one member -- the "
+              "send-once flag -- under docs/StandingApprovals.md SA-3. Any further data member "
+              "here is a new object-layout change and needs its own approval.");
 static_assert(sizeof(HttpResponseMessage) == sizeof(HttpResponseMessageLayoutProbe),
-              "#2068/#2069 must not add state to HttpResponseMessage -- SR-AUD-315/316, "
-              "NOT APPROVED");
+              "HttpResponseMessage gained state. #2068 (case-insensitive lookup) and #2069 "
+              "(status-code validation) both landed WITHOUT adding a member -- neither "
+              "needed one, which is why neither needed an approval.");
 
 // The comparator of the returned map is PUBLIC SURFACE. #2062's review concluded from that
 // that #2068 "cannot make the lookup case-insensitive without changing this type, which is why
@@ -1930,17 +1936,52 @@ TEST(NetHttpGatedBehaviourPins, LayoutAndOwnershipModelAreStaticallyAsserted) {
     EXPECT_EQ(sizeof(HttpResponseMessage), sizeof(HttpResponseMessageLayoutProbe));
 }
 
-// #2067 (SR-AUD-314) -- .NET throws InvalidOperationException when one
-// HttpRequestMessage is sent twice. This port has no sent state.
-TEST(NetHttpGatedBehaviourPins, Pin2067_OneRequestMessageCanStillBeSentTwice) {
+// #2067 (SR-AUD-314) LANDED -- one HttpRequestMessage may be sent once, as in .NET.
+TEST(NetHttpGatedBehaviourPins, Fix2067_OneRequestMessageCannotBeSentTwice) {
+    // .NET's CheckRequestMessage, with .NET's own message
+    // (HttpClient.cs:745-751, SR.net_http_client_request_already_sent). The second send is not
+    // merely untidy: it reuses a content object the first send may already have consumed, and
+    // both sends share one headers map the first handler may have mutated.
     auto handler = std::make_shared<RecordingHandler>();
     HttpClient client(handler);
     auto request = std::make_shared<HttpRequestMessage>(HttpMethod::Get(), "http://example.com/");
 
+    EXPECT_FALSE(request->getWasSentProperty());
     EXPECT_NO_THROW((void)client.Send(request));
-    EXPECT_NO_THROW((void)client.Send(request));
-    EXPECT_EQ(handler->receivedRequest, request)
-        << "the SAME message object reaches the handler a second time";
+    EXPECT_TRUE(request->getWasSentProperty());
+    EXPECT_THROW((void)client.Send(request), System::InvalidOperationException);
+
+    // A DIFFERENT message is unaffected, and so is a second client.
+    auto fresh = std::make_shared<HttpRequestMessage>(HttpMethod::Get(), "http://example.com/");
+    EXPECT_NO_THROW((void)client.Send(fresh));
+    HttpClient other(handler);
+    EXPECT_THROW((void)other.Send(request), System::InvalidOperationException)
+        << "the flag belongs to the MESSAGE, not to the client that sent it";
+}
+
+TEST(NetHttpGatedBehaviourPins, Fix2067_TheSendOnceClaimIsAtomic) {
+    // .NET uses an interlocked compare-and-exchange, so two concurrent sends of one message
+    // cannot both win. std::atomic_flag::test_and_set is the same operation; this asserts the
+    // guarantee rather than trusting the type name.
+    // Repeated, because a lost update is probabilistic: one round of a non-atomic
+    // read-then-set usually still yields one winner. Two hundred rounds of eight threads
+    // released together does not.
+    for (int round = 0; round < 200; ++round) {
+        auto request = std::make_shared<HttpRequestMessage>(HttpMethod::Get(), "http://example.com/");
+        std::atomic<int>  winners{0};
+        std::atomic<bool> go{false};
+        std::vector<std::thread> threads;
+        for (int i = 0; i < 8; ++i) {
+            threads.emplace_back([&] {
+                while (!go.load(std::memory_order_acquire)) { /* spin to the same starting line */ }
+                if (request->MarkAsSent()) ++winners;
+            });
+        }
+        go.store(true, std::memory_order_release);
+        for (auto& t : threads) t.join();
+        ASSERT_EQ(winners.load(), 1)
+            << "exactly one caller may claim the message (round " << round << ")";
+    }
 }
 
 // #2068 (SR-AUD-315) LANDED -- field names are compared case-insensitively, as RFC 9110 5.1
@@ -2025,14 +2066,35 @@ TEST(NetHttpGatedBehaviourPins, Fix2068_TheHandlersDefaultFieldsYieldToTheCaller
         << "and it must be the caller's, not the handler's";
 }
 
-// #2069 (SR-AUD-316's status-code half) -- the constructor accepts any number.
-TEST(NetHttpGatedBehaviourPins, Pin2069_ResponseAcceptsAnyStatusNumber) {
-    for (int code : {-1, 0, 1000, 99999}) {
-        HttpResponseMessage response(static_cast<HttpStatusCode>(code));
-        EXPECT_EQ(static_cast<int>(response.getStatusCodeProperty()), code);
-        EXPECT_FALSE(response.getIsSuccessStatusCodeProperty());
-        EXPECT_THROW(response.EnsureSuccessStatusCode(), HttpRequestException);
+// #2069 (SR-AUD-316's status-code half) LANDED -- the domain is 0..999, exactly .NET's.
+TEST(NetHttpGatedBehaviourPins, Fix2069_TheStatusCodeDomainIsZeroToNineHundredNinetyNine) {
+    // HttpResponseMessage.cs:152-159 (constructor) and :65-76 (setter), same two checks in the
+    // same order. Before this, -1, 0, 1000 and 99999 all constructed and
+    // getIsSuccessStatusCodeProperty answered false for each -- a nonsense code was
+    // indistinguishable from a real failure.
+    for (int code : {-1, -1000, 1000, 99999}) {
+        SCOPED_TRACE(code);
+        EXPECT_THROW(HttpResponseMessage(static_cast<HttpStatusCode>(code)),
+                     System::ArgumentOutOfRangeException);
+        HttpResponseMessage response;
+        EXPECT_THROW(response.setStatusCodeProperty(static_cast<HttpStatusCode>(code)),
+                     System::ArgumentOutOfRangeException);
+    }
+
+    // The bound is 999, not 599: RFC 9112 4 makes a status code three digits and .NET accepts
+    // every three-digit value rather than only the registered ranges. 0 is accepted too, and
+    // that is .NET's choice rather than an oversight here.
+    for (int code : {0, 1, 100, 599, 998, 999}) {
+        SCOPED_TRACE(code);
+        EXPECT_NO_THROW(HttpResponseMessage(static_cast<HttpStatusCode>(code)));
     }
+
+    // ...and an out-of-range code never reaches the object, so a rejected value cannot be read
+    // back later.
+    HttpResponseMessage response(HttpStatusCode::OK);
+    EXPECT_THROW(response.setStatusCodeProperty(static_cast<HttpStatusCode>(1000)),
+                 System::ArgumentOutOfRangeException);
+    EXPECT_EQ(response.getStatusCodeProperty(), HttpStatusCode::OK);
 }
 
 // #2070 (SR-AUD-317) -- the charset is a label; the bytes are always the