Re-vendor serialize at v1.15.0 (#336)

* Re-vendor serialize at v1.15.0, byte-for-byte as upstream ships it

Nine minor versions of the optimization and hardening work land in the
vendored header: the inlined write and read spines, word-wise WriteBytes,
the precomputed compressed-float entry points, the contraction-invariance
barrier that pins the compressed-float roundings in-source, the normative
integer clamp, degenerate ranges, and the stricter malformed-string reader.

Closes #334.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* Floating-point docs describe the vendored serialize as it is now

serialize 1.15.0 pins the compressed-float roundings in-source with an
optimization barrier, so the wire bytes no longer depend on the consumer's
-ffp-contract setting. BUILDING.md and the CMake rationale now state that;
-ffp-contract=off stays as standing policy (belt and braces, and the
certification setting), and -ffast-math / -Ofast remain unsupported.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* The structured fuzzer writes conforming strings, as the writer contract requires

serialize 1.15.0 debug-asserts that serialize_string writers supply valid
UTF-8 (the writer-trusted model). fuzz_connection_structured drives the real
write path, so it must generate conforming content: string bytes are masked
to ASCII, exactly as serialize's own fuzzer does. Arbitrary bytes still
reach the reader's malformed-string refusal path via fuzz_connection's raw
packets. Verified both ways: the unmasked harness reproduces the CI abort on
the new assert; the masked one replays the corpus plus 20,000 random inputs
under ASan+UBSan with asserts live, clean.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* yojimbo 1.11.0: the optimized serialization core is vendored

Both version sites carry 1.11.0 (the CMake project version and the
YOJIMBO_MAJOR/MINOR/PATCH_VERSION macros in include/yojimbo_config.h).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

Author: rowan-claude

BUILDING.md

@@ -27,23 +27,20 @@ The default is a debug build. For an optimized build, pass the build type:
 
 yojimbo's wire arithmetic lives in `serialize.h`, whose compressed float quantizes with two
 distinct roundings on write and on read: the product must round to float32 *before* the
-constant is added. A compiler allowed to contract fuses the multiply and the add into a
-single FMA and rounds once, which shifts the encoded integer and the decoded float by one
-ulp — a change to what goes on the wire.
-
-This build sets the right flag on every target it compiles, so nothing is required of you to
-build yojimbo itself:
-
-  - GCC/Clang: `-ffp-contract=off`. Not merely the absence of `-ffast-math` — GCC's default
-    is `-ffp-contract=fast`, which contracts across statement boundaries, and clang's default
-    `=on` still fuses within a single expression.
-  - MSVC: `/fp:precise`.
-
-**If you compile `serialize.h` in your own translation units, set the same flag there.** The
-flag is `PRIVATE` to yojimbo's targets and deliberately does not leak into your build, so
-this one is yours to set. It is easy to miss because the symptom is architecture-dependent:
-FMA is in the aarch64 baseline and absent from the x86-64 one, so an unflagged build is
-typically wrong on arm64 and accidentally right on amd64.
+constant is added. The vendored serialize pins those roundings in-source with an
+optimization barrier, so the compressed-float wire bytes are identical under every
+`-ffp-contract` setting. Two rules remain:
+
+  - `-ffast-math` (and `-Ofast`) are not supported: they license reciprocal approximation
+    and reassociation, which change the wire in ways no barrier can pin.
+  - `-ffp-contract=off` (MSVC: `/fp:precise`) is the standing policy for the network
+    libraries serialize ships in — belt and braces on top of the in-source barrier, and
+    the certification setting for golden vectors.
+
+This build sets the policy flag on every target it compiles, so nothing is required of you
+to build yojimbo itself. **If you compile `serialize.h` in your own translation units, set
+the same flag there** — the flag is `PRIVATE` to yojimbo's targets and deliberately does
+not leak into your build, so this one is yours to set.
 
 ## Building on Windows
 

CMakeLists.txt

@@ -14,7 +14,7 @@
 # section below).
 
 cmake_minimum_required(VERSION 3.16)
-project(Yojimbo VERSION 1.10.1 LANGUAGES C CXX)
+project(Yojimbo VERSION 1.11.0 LANGUAGES C CXX)
 
 option(YOJIMBO_SYSTEM_SODIUM
     "Link the system-installed libsodium instead of the bundled subset in sodium/" OFF)
@@ -171,27 +171,21 @@ endif()
 
 # yojimbo's wire arithmetic lives in serialize.h, and serialize's compressed float quantizes
 # with two DISTINCT roundings on write and on read -- the product must round to float32 before
-# the constant is added. A compiler permitted to contract fuses those into a single FMA and
-# rounds once, which moves the encoded integer and the decoded float by one ulp. That is a
-# change to yojimbo's traffic, not a test-suite detail.
+# the constant is added. The vendored serialize pins those roundings in-source with an
+# optimization barrier, so the compressed-float wire bytes are identical under every
+# -ffp-contract setting. -ffast-math / -Ofast remain unsupported: they license reciprocal
+# approximation and reassociation, which change the wire in ways no barrier can pin.
 #
-# It is architecture-dependent, which is why it stayed hidden: FMA is in the aarch64 baseline
-# and absent from the x86-64 one, so the same source and the same flags emit a fused multiply
-# add on arm64 and none on amd64. Debian package builds were green on every amd64 leg and red
-# on every arm64 leg (mas-bandwidth/yojimbo#332) -- and the green legs were green because of an
-# instruction set rather than because the build was right.
-#
-# So every target here that compiles serialize.h builds strict, exactly as serialize's own
+# Every target here that compiles serialize.h still builds strict, exactly as serialize's own
 # CMakeLists.txt does for its executables:
-#   - GCC/Clang: -ffp-contract=off. Not merely "no -ffast-math" -- GCC's default is
-#     -ffp-contract=fast, which contracts ACROSS statements, and clang's default =on still
-#     fuses within a single expression.
+#   - GCC/Clang: -ffp-contract=off.
 #   - MSVC: /fp:precise, which since VS 2022 does not imply contraction.
 #
 # This is Glenn's standing estate policy (2026-08-24): "generally speaking, network libraries
-# we work on require -ffp-contract=off". The flag is the floor. It is PRIVATE so nothing leaks
-# into consumers' own flags; consumers that compile serialize.h themselves need it too, and
-# BUILDING.md states that as a requirement.
+# we work on require -ffp-contract=off" -- belt and braces on top of the in-source barrier,
+# and the certification setting for golden vectors. The flag is PRIVATE so nothing leaks
+# into consumers' own flags; consumers that compile serialize.h themselves set it too, and
+# BUILDING.md states that as policy.
 
 if(MSVC)
     set(YOJIMBO_STRICT_FP_FLAGS /fp:precise)

fuzz/fuzz_connection_structured.cpp

@@ -77,7 +77,12 @@ static bool fill_message( Message * message, int type, Reader & r, ConnectionCon
             int n = r.u8() % FuzzMaxString;       // leave room for the terminator
             for ( int i = 0; i < n; ++i )
             {
-                uint8_t c = r.u8();
+                // masked to ASCII: the string payload is well-formed UTF-8 by the writer's
+                // contract (serialize debug-asserts it, and asserts are live in this
+                // harness), so this write-path target must generate conforming content —
+                // exactly as serialize's own fuzzer does. Arbitrary bytes still reach the
+                // reader's malformed-string refusal path via fuzz_connection's raw packets.
+                uint8_t c = r.u8() & 0x7F;
                 m->str[i] = (char) ( c ? c : ' ' );   // no embedded NUL
             }
             m->str[n] = '\0';

include/yojimbo_config.h

@@ -32,8 +32,8 @@
 #endif
 
 #define YOJIMBO_MAJOR_VERSION 1
-#define YOJIMBO_MINOR_VERSION 10
-#define YOJIMBO_PATCH_VERSION 1
+#define YOJIMBO_MINOR_VERSION 11
+#define YOJIMBO_PATCH_VERSION 0
 
 #if !defined(YOJIMBO_DEBUG) && !defined(YOJIMBO_RELEASE)
 #if defined(NDEBUG)