ABC-017: build/CI: no warnings, net stack never tested, LEX drift

Now: OPEN
Sev: MED

Toolchain batch (2026-07-07 review). The build sets no -Wall -Wextra (dead code and unused results the review found by hand would have been compiler-flagged); the entire network stack + fuzz targets are invisible to CI; and the LEX code generator has drifted from its own committed output, so regenerating any grammar silently changes error-path semantics.

Input

Context

CMakeLists.txt — only C23 + optional ASAN/fuzz flags; no warning flags on any target. Hand-found consequences: unused int s (TCP.c:11,39), unused locals (UDP.c:42-43), dead if (rc == 0) break; (TCP.c:56).
test/CMakeLists.txt:193 gates HTTP/UDP/TCP/CURL/POL tests behind WITH_INET, but no option(WITH_INET) is declared anywhere and neither CI job passes it → every network test (incl. MEM-009 leak regressions) is skipped; WITH_FUZZ/WITH_ASAN likewise never built in CI.
LEX generator drift: LEX.c:27-29 template emits fbreak; in error actions while committed JSON.c.rl/URI.c.rl/HTTP.c.rl use goto _out; — regen changes consumed-position semantics on callback failure. LEX.c:78 u64 mark0[64] cap never validated vs rule count (silent OOB in generated code for big grammars). Blocks ABC-011's regen.
LEX.c:260-289 lex2rl — ~2.3 MB of a_pad stack scratch (256K+1M+1M); abc.mkd prescribes a_carve/BASS. Overflows non-main threads.
LEX.cli.c:17-21 + nfagrep.c:35-39 — sane(argc...) fires before the usage message can print (debug), or is ignored (release): behavior differs by build, usage is dead code either way. nfagrep also: 256-byte snprintf path truncation (opens the wrong file), fp leak shape at :70-71.
INT.h:160-186 — the ABC_ALIGN branch does not compile (u8sfrom token, C++-cast, flipped args, missing Feed twins). Dead config rot: fix or delete.
Test hygiene: test/CURL.c:24 depends on live google.com; TCP/UDP tests hardcode ports 12345/12399/3456/3499 (NETRandomPort exists); test/UDP.c leaks cfd.

Goals

-Wall -Wextra (+ -Wshadow -Wconversion audit list) with a clean build; a CI lane with WITH_INET+WITH_ASAN and fuzz smoke (build + N iterations); LEX template reconciled with committed output (pick fbreak OR goto, regen all three grammars, diff-verify); dead branches fixed or deleted.

Constraints

CI runtime budget: loopback-only net tests (no live-internet dependencies) so the lane is deterministic.
Regen diffs must be inspected grammar-by-grammar, not bulk-landed.

WIP

Design decisions

RULING MADE: goto _out, fbreak is wrong — ragel expands fbreak to {p++; goto _out;}, off-by-one resume position on callback failure, and inside EOF actions it leaves p = pe+1 → data[0] past data[1], an invalid slice. Committed JSON/HTTP already used goto _out (de-facto contract); ABC-011 regenned in that style.
Second template drift found: abc/INT.h → INT.h includes.
Warning waivers (commented in CMake): -Wno-unused-parameter global (69 fixed-signature callbacks) and -Wno-unused-variable on the 5 generated *.rl.c only.
INT.h ABC_ALIGN branch DELETED (never compiled).
nfagrep snprintf copy dropped (argv NUL-terminated per PRO.h).

TODOs

-Wall -Wextra all targets, ~~35K warnings/306 sites → 0 across gcc Debug/Release, clang Release/ASAN; audit: -Wshadow 42/14 sites, -Wconversion~~ 400 sites = slice-API-wide sweep, NOT on
option(WITH_INET); CURL test → loopback one-shot server; NETRandomPort in TCP/UDP tests; UDP cfd leak fixed
CI: inet-asan (clang) + fuzz-smoke jobs; WITH_FUZZ link fix (fuzzer-no-link was compile-only, every non-fuzz binary broke)
LEX template goto out + INT.h include; mark0 cap → LEXNOROOM at ruleno>=64; lex2rl apad 2.3MB → a_carve/BASS; regen verified: JSON/HTTP byte-identical, URI 36x fbreak-form fixes
LEX.cli/nfagrep usage-before-sane both builds; fp leak fixed

Blockers and bummers

fuzz-smoke CI will be RED at birth: HASHdfuzz + SORTfuzz crash <2k iters on PRISTINE pre-ABC-017 sources (reverse-patch verified); artifacts in the worker scratchpad — needs own ticket(s), not this regression.
test/POL.c POLtest2 fetches 5 LIVE sites — excluded from the CI lane via -E, needs its own ruling.
Merge conflicts RESOLVED (2nd pass, after gritzko updated the tree to #99b58946): NET.h/TCP.c/UDP.c kept trunk's ABC-012 semantics, stale hygiene fragments dropped, one char-level merge corruption in CURL.c repaired, BindLeak ports moved +9. 0 warnings, 46/46 + 52/52 re-verified. LEX regen re-validated byte-identical against the updated trunk (ABC-011's landed grammar confirms goto _out).
UPSTREAM GAP found during the merge: landed ABC-012 lacks test/NET.c (see ABC-012 Outcome for recovery); the CMake NETtest block is if(EXISTS)-guarded until recovered.

Outcome

In work/ABC-017, uncommitted by the worker (61 mod, +586/-485, full diff at its scratchpad/abc017-final.diff): warnings, INET, CI lanes, LEX reconcile+regen. Suites: default 46/46, INET 52/52, INET+ASAN clang 51/51 (-E POLtest), fuzz smoke 13/15 (2 pre-existing crashers above). Orchestrator re-verified default suite + URI.rl.c goto count.