qt: move QtWebSocketBackend onto the structural registration surface

[Yaraslaut]

Closes #568, fixes #593, fixes #594. Step 2 of the five-step set re-scoped out of #522.

Status: unblocked. The regression this PR previously carried is fixed inside
it, because the fix is a change to the surface #568 moved onto and belongs
nowhere else.

Three commits, one per ticket:

Commit	Ticket	What it does
qt: move QtWebSocketBackend onto the structural surface, natively (+ the three that go with it)	#568	Unchanged from this PR's earlier revisions — see Done below.
core: let a backend say whether its caller may wait for a bind	#593	Adds IBackend::bindWaitPolicy(), the one signal #567's surface left Bridge::registerHandlerImpl without. Fixes the "handler not bound" regression this PR caused in morph::net::SocketBackend.
qt: carry contextKey on a blocking private registration	#594	QtWebSocketBackend now overrides registerModelWithContext, so a privately registered instance is journalled. Reproduced first, then fixed.

Rebased onto a020e69c, not 70792bee. The previous red was judged against
a base that has since moved on three counts that matter here: the gates changed
(.github/workflows/ci.yml, cmake/CompileCache.cmake), files this PR touches
changed (include/morph/core/backend.hpp,
scripts/branch_partial_allowlist.json, docs/spec/core/backend.md), and the
failing test's own file changed (tests/net/test_socket_backend.cpp,
include/morph/net/socket_backend.hpp). Everything measured below was measured
on the rebased tree. One conflict, in docs/spec/core/backend.md's IBackend
table: master's registerModelWithContext row (#587's, which names
SocketBackend) and this branch's registerModelAsync row (which records that
no backend overrides it since #568) — both kept, neither is about the other.

Three things fixed along the way, earlier in this PR's history: two
misc-const-correctness clang-tidy findings on the new test file (const QUrl); a stale coverage-allowlist line hint in bridge.hpp (repointed and
disambiguated — it is one of three textually-identical if (deadlineHandle && schedulerRef) guards, and the entry now names which one it covers and why the
other two are a different, reachable arm); and #589, a pre-existing and
unrelated master clang-tsan timeout in equation()'s stack-safety test, fixed
separately and merged rather than folded in here.

Three things were fixed along the way: two misc-const-correctness clang-tidy
findings on the new test file (const QUrl); a stale coverage-allowlist line
hint in bridge.hpp that master's insertions had shifted (repointed and
disambiguated — it is one of three textually-identical if (deadlineHandle && schedulerRef) guards, and the entry now names which one it covers and why the
other two are a different, reachable arm); and #589, a pre-existing and
unrelated master clang-tsan timeout in equation()'s stack-safety test, which
was fixed separately and merged rather than folded in here.

Reconciliation with #586 (SocketBackend, morph#569)

#586 landed on master first and edits the same spec, so docs/spec/core/backend.md
was reconciled, not resolved by taking a side. Both descriptions survive
independently in the merged file:

Evidence in the merged docs/spec/core/backend.md	From
SocketBackend ×119, bindModel ×55	#586
QtWebSocketBackend ×61, inlineExecutor ×3	#585
Row: "morph#568 — QtWebSocketBackend implements the surface natively and drops all four *Async overrides"	#585
Row: "morph#569 — SocketBackend implements the surface natively, keeping every legacy verb on sendSync"	#586
Line 2283, SocketBackend's full "native rather than SynchronousBackendAdapter" rationale, intact	#586

The backend/binding table at lines 564-566 now lists all three cases together
(QtWebSocketBackend with the flag unset → blocking/bound, with it set →
native/unbound, SocketBackend → native/unbound). No conflict markers remain
anywhere in the tree.

Everything below is written for someone picking this up cold.

State

It builds and the full local suite passes. Measured on the rebased tree at
the exact commit pushed (49bd5b8b, working tree clean — what was built is what
was pushed), GCC 16.2.1, Debug, -DMORPH_BUILD_QT=ON -DMORPH_BUILD_NET=ON:

• cmake --build — clean, no warnings (this tree is -Werror, 63 warning
  flags, strict=ON).
• QT_QPA_PLATFORM=offscreen ctest -j4 → 100% tests passed out of 1836
  (16 s).
• clang-format --dry-run --Werror (v22.1.8) over every changed .hpp/.cpp →
  clean, no output.
• clang-tidy-diff.py over git diff origin/master, clang-tidy 22.1.8 against
  a clang-debug compile database configured with MORPH_BUILD_QT=ON MORPH_BUILD_NET=ON → exit 0, no findings. It found one on the first run
  (readability-redundant-member-init on the new test double's
  std::thread::id callerThread{}), which is fixed in the core: #567's registration surface gives Bridge no way to tell a natively non-blocking backend from a blocking one, and two shipped backends now need opposite behaviour at that one call site #593 commit.
• git diff --name-only origin/master HEAD | bash scripts/check_spec_sync.sh →
  Spec sync OK: 10 sub-domain(s) classified.
• bash scripts/check_spec_citations.sh → Prose lint OK.

Both MORPH_BUILD_QT and MORPH_BUILD_NET are ON, and that is the point.
The earlier 1613-pass run in this PR's history had MORPH_BUILD_NET=OFF, so
tests/net/ was never built, which is exactly how the regression was missed the
first time.

Verified against the allowlist repoint, not assumed. The #593 commit's
insertions shifted bridge.hpp again: 1498 → 1542
(if (_executeDeadline.count() > 0 && _timeoutScheduler) {, still the only
occurrence of that text) and 1610 → 1654 (the catch-block
if (deadlineHandle && schedulerRef) { the disposition's own reasoning
describes, with the other two now at 1678 and 1767, and the entry's prose
updated to say so).

Not run locally, so inferred from CI rather than measured here: the sanitizer
builds (ASan/UBSan/TSan), Doxygen, the WASM ladder/demo legs, and Windows.
tests/qt/ is sanitizer-instrumented as of #576.

#593 — the blocking regression, and its fix

What it was

registerHandlerImpl probes registerModelAsync first; with #568's overrides
deleted it returns false, so control reaches this PR's bindModel fallback.
SocketBackend::bindModel is non-blocking (#586), so registerHandlerImpl
returned with binding->currentId == 0, and the next line's execute hit the
fail-fast guard:

if (raw == 0U) {
    typedState->setException(std::make_exception_ptr(std::runtime_error("handler not bound")));
    return typed;
}

Reproduced on the rebased tree before the fix — 99% tests passed, 6 tests failed out of 1833, the same six #593 names:

	1660 - SocketBackend: action result delivered via then (Failed)
	1676 - SocketBackend: executeTimeout surfaces as backend::TimeoutError, not a generic runtime_error (Failed)
	1681 - SocketBackend: many concurrent in-flight executes all resolve, matched by callId (Failed)
	1689 - SocketBackend: server dropping mid-call resolves the pending completion with DisconnectedError (Failed)
	1692 - SocketBackend: two backends share one server with isolated model state (Failed)
	1833 - SocketBackend interop: connects to a QtWebSocketServer and completes an action (Failed)

The 1-versus-6 discrepancy, resolved rather than assumed

#593's body reports six failing tests; CI reported one, on every failing leg.
Both are right. Every test preset in CMakePresets.json sets
stopOnFailure, and ci.yml drives every leg through ctest --preset …, so a
leg with six failures stops at the first and reports it. The one failing leg
that does not use a preset — Valgrind memcheck — reported five, read from
its log rather than from this PR's earlier summary of it:

tests/net/test_socket_backend.cpp:242: FAILED:
tests/net/test_socket_backend.cpp:299: FAILED:
tests/net/test_socket_backend.cpp:327: FAILED:
tests/net/test_socket_backend.cpp:1241: FAILED:
tests/net/test_socket_backend.cpp:1440: FAILED:
test cases:  189 |  184 passed | 5 failed
==10010== ERROR SUMMARY: 0 errors from 0 contexts (suppressed: 0 from 0)

So Valgrind's failure is the same functional regression and not a memcheck
finding — confirmed from the log, which the previous revision of this PR
asserted without having read it. Filed the preset behaviour as #616; it is
not this PR's to fix.

The fix

IBackend::bindWaitPolicy(), returning a two-valued BindWait:

Value	Meaning	Who says it
kCallerMayBlock	The completion settles without the calling thread's participation — inside the call, or on a thread the caller does not own. Default.	Everything that has not overridden bindModel (settles inline), and SocketBackend (its I/O thread settles it)
kCallerMustNotBlock	Waiting is impossible or pointless.	QtWebSocketBackend when asyncRegistrationEnabled is set (the reply is delivered by the calling thread's own Qt event loop), and SynchronousBackendAdapter (it exists to move the blocking off the caller, and would deadlock against its own strand)

registerHandlerImpl then holds its inline window open until the completion
settles (detail::awaitHandoff, claimHandoff's blocking twin) and publishes
the outcome through the code that already handled a backend settling inline —
including the rethrow, so a failed registration still throws out of the
BridgeHandler constructor exactly as it always did. The two cases differ in
how long the frame sits still, not in what the caller observes.

Why this is not the bool #567 deliberately removed. That bool chose
which verb to call, so every call site carried two paths and a backend could be
half-migrated. This one chooses nothing: one verb, called unconditionally, one
continuation. It says only whether the thread that registered that continuation
may stop and wait for it. backend.hpp's design note now says this in place,
next to the point it qualifies.

Why not just update the six tests instead. That was #593's own stated
alternative, conditional on evidence that SocketBackend's synchronous
registration contract was not load-bearing outside tests/net/ — evidence
nobody has. Rather than acquire it, this keeps the contract: registerHandler
goes on returning a bound handler for every backend that can honour it, and the
break is confined to the one deployment that opted into it by name.

Verification — both horns, measured on the fix

Mutation at the call site	Result
none (the fix as shipped)	100% tests passed out of 1835
false && … — never wait, i.e. the discriminator ripped out	7 failed: the six SocketBackend cases above, plus the new registerHandler waits out a kCallerMayBlock backend's bind case
true ‖ … — always wait	6 failed: the new registerHandler does not wait for a kCallerMustNotBlock backend case, plus five tests/qt/ cases that time out at 120 s rather than fail — the nested-QEventLoop deadlock, not a wrong answer

	1596 - morph::qt::QtWebSocketBackend: (serverUrl, tls, cfg) constructor overload ... (Timeout)
	1597 - morph::qt::QtWebSocketBackend: Config-only constructor overload ... (Timeout)
	1601 - morph::qt::QtWebSocketBackend: bindModel (non-blocking via Config::asyncRegistrationEnabled) registers without blocking (Timeout)
	1602 - morph::qt::QtWebSocketBackend: bindModel called before the socket connects queues and retries once connected fires (Timeout)
	1607 - morph::qt::QtWebSocketBackend: bindModel's pending registration is cancelled when the connection drops before a reply arrives (Timeout)

Neither fixed setting of that call site is correct. That is #593's finding, and
it is what the discriminator exists for.

The two new tests

Both in tests/test_backend_registration_surface.cpp, driving a Bridge over a
double whose bind reply arrives 200 ms later from a transport thread:

• registerHandler waits out a kCallerMayBlock backend's bind and returns bound
  — asserts isBound with no polling and no drain, plus that the value was
  produced on a thread registerHandler does not own.
• registerHandler does not wait for a kCallerMustNotBlock backend — asserts
  REQUIRE_FALSE(isBound) immediately after the call, then polls until it binds.

The 200 ms delay is what makes each one fail under the opposite policy; neither
assertion's passing direction depends on its value (the waiting case waits
however long the reply takes; the non-waiting case polls).

#594 — contextKey on a blocking private registration

#594's verification status was "inferred from reading the code, not reproduced".
It is now reproduced. The new case in tests/qt/test_qt_websocket.cpp stands
up a QtWebSocketServer over a RemoteServer with a LogProvider installed,
and before the fix — on a tree that already had #593's fix, so the mechanism was
not made moot by it — failed exactly where #594 predicted:

tests/qt/test_qt_websocket.cpp:2504: FAILED:
  CHECK( requestedFor == std::vector<std::string>{"WsEchoModel:acct-594"} )
with expansion:
  {  } == { "WsEchoModel:acct-594" }

tests/qt/test_qt_websocket.cpp:2523: FAILED:
  CHECK( requestedFor == std::vector<std::string>{"WsEchoModel:acct-bind"} )
with expansion:
  {  } == { "WsEchoModel:acct-bind" }

Per AGENTS.md's "would this still pass if the feature did nothing": the assertion
is on the provider, not on the registration. Registration succeeded before the
fix too — 13 of the case's 15 assertions passed. This matters because
RemoteServer::attachLogIfConfigured returns before consulting its
LogProvider on an empty contextKey, so the symptom is not an audit record
missing a field, it is no audit record at all.

Fix is #587's two lines: override registerModelWithContext to build
makeRegister(typeId, contextKey), and have registerModel forward to it with
an empty key. A third section asserts the other direction — plain registerModel
still sends no key, so the provider is not consulted.

Done

• QtWebSocketBackend overrides none of the four *Async verbs and
  implements bindModel/promoteModel natively. Evidence:

  $ grep -rn "registerModelAsync\|registerModelSharedAsync\|attachModelAsync\|assignPrimaryAsync" include/morph/qt src/qt
  include/morph/qt/qt_websocket_backend.hpp:314:    /// preserve — which is why `assignPrimaryAsync`, the verb this replaces,
  

  One hit, in prose, naming the verb it replaced. No declaration, no definition.

  $ grep -rn "registerModelAsync\|registerModelSharedAsync\|attachModelAsync\|assignPrimaryAsync" include src | grep override
  (no output)
  

  No backend anywhere in include/ or src/ overrides any of the four now.
• Bridge's four dispatch sites fall back to bindModel/promoteModel instead
  of to a blocking verb. This is not optional decoration: Bridge is the only
  framework caller of the four verbs, so without it a QtWebSocketBackend that
  stopped overriding them would be routed straight back into the nested
  QEventLoop the verbs existed to avoid.
• The single-threaded WASM registration path works with no special case in the
  interface, proven end to end (see Tests below).
• Specs updated in the same PR: docs/spec/core/backend.md and
  docs/spec/concurrency_and_lifetimes.md.
• tests/test_async_registration.cpp's eleven doubles are untouched except one
  (see Traps), so core: remove IBackend's four async twins and retire the prose threading contract #571's scope is intact.

Tests, and their verification status

Test	Proven by mutation?
bindModel delivers its continuation on the caller's executor, not the thread it settles on (new)	Yes, measured. Replacing makeSettleable(&cbExec) with makeSettleable(&inlineExecutor()) → FAILED: REQUIRE(cbExec.posted.load() != 0).
bindModel called before the socket connects queues and retries once connected fires	Yes, measured. Forcing bindModel to always take the blocking default → FAILED ... due to unexpected exception: register failed: disconnected.
examples/common/testkit/test_wasm_registration_path_native.cpp, both cases	Yes, measured. Same mutation → one fails with register failed: disconnected, the other hangs and dies on SIGTERM — the nested-QEventLoop deadlock, which is the WASM page abort in desktop clothing.
The rewritten keyed-bind / re-point / degrade-to-private / dead-socket / promoteModel cases	No. They are direct ports of existing *Async tests onto bindModel. They pass; I did not watch each one fail on unfixed code. Treat them as regression coverage, not as proof of the new shape.

The delivery-thread test is the one that matters: #567's equivalent case
exercised a test double settling its own promise, so it pinned the shape an
implementor needs. This is the first time the guarantee has been tested against
a real transport.

Decisions made

bindModel is implemented natively, not via SynchronousBackendAdapter.
The adapter moves a blocking call onto another thread; a WASM main thread has no
other thread to move it to. With Config::asyncRegistrationEnabled set,
bindModel builds the envelope the request's shape names, assigns a callId,
sends, and returns an unsettled Completion that onTextMessage settles:

primary	current	Envelope
empty	0	register (queued if the socket has not connected yet)
empty	non-zero	deregister of current, then register
non-empty	0	register + shared
non-empty	non-zero	attach, naming current

A keyed bind on a dead socket rejects rather than queueing: unlike a private
registration it may be a re-point, and replaying it against a re-established
connection would attach from a current that connection never issued.

Config::asyncRegistrationEnabled is kept, with its meaning narrowed. Unset
(the desktop default) bindModel defers to IBackend::bindModel, which blocks
in the nested QEventLoop. Removing the flag would change desktop semantics —
a BridgeHandler would stop being usable on the line after its constructor — and
break every desktop example and its tests. It is no longer an opt-in to a second
set of interface verbs; that is the part #568 asked to delete, and it is gone.

Is the WASM special case gone? In the interface, yes: no *Async override,
no bool return, no fallback verb, one bindModel whose non-blocking case is
its ordinary shape. What remains is a Config field that chooses whether the
transport blocks, which is a deployment property rather than an interface
special case. If a reviewer disagrees and wants the flag gone too, that is a
behaviour change that belongs with #570 (which owns the example mains that set
it), not here.

Three duplications collapsed with the verbs: one send path (sendControl,
so the encode-before-record invariant and morph#495's env.session stamp exist
once instead of four times); one pending map (all four reply kinds were matched
identically); a Completion<ModelId>::Promise per entry instead of two
std::functions, so a dropped socket rejects with the DisconnectedError
itself rather than a runtime_error rebuilt from its what().

Behaviour preservation in Bridge was deliberate at each site:

• Executor named is inlineExecutor() → continuations run where they ran before.
• A blocking backend settles inside the dispatch frame with _attachMtx held,
  which is exactly what detail::AsyncDispatchHandoff/parkIfInFrame already
  existed for, so both branches park and the dispatching frame publishes under
  the lock it owns and reports once it is gone.
• attachHandlerAsync/ensureBoundAsync now deliver the original
  exception_ptr to onDone rather than a stringified one — closer to the
  synchronous fallback they replace, which propagated the original.
• registerHandlerImpl parks a rejection arriving inside its own frame and
  rethrows it, because a BridgeHandler constructor that could not bind
  must not return as if it had.
• One named behaviour change: assignHandlerPrimary's blocking branch used to
  let assignPrimary throw out of a Completion handler (where
  CompletionState swallowed and logged it). It now logs directly.

tryRouteControlReply settles outside _pendingMtx — it moves the promise
out of the map, releases the lock, then settles. With an inline executor,
settling under the lock would re-enter the backend under a lock the frame holds.

Not done

In order, for whoever continues:

1. Push and watch CI. Done — pushed and driven to the result in the
   status line at the top of this PR.
2. Run --no-tests=error mentally over the renamed cases. Done.
   Four TEST_CASE titles changed (registerModelAsync ... → bindModel ...).
   All still begin morph::qt::QtWebSocketBackend:, so the leg's
   -R 'morph::qt::|qt_tls_example_runs' filter still matches — confirmed by
   running that exact filter on the rebased tree: 59/59, none skipped.
3. Decide whether to file the two core: give IBackend a registration surface whose threading contract is structural, not prose #567 surface gaps below as issues.
   Partly done. Gap 2 is now filed as core: give Bridge an executor bound to its own thread, so the threading guarantee is structural for Bridge-mediated calls too #588, triaged rescope — its
   proposed remedy contradicts docs/spec/concurrency_and_lifetimes.md:205
   ("teardown is order-independent, on any thread"), so it belongs to core: remove IBackend's four async twins and retire the prose threading contract #571
   rather than here. Gap 1 and gap 3 remain notes for net: move SocketBackend onto the structural registration surface, or justify the adapter #569/core: remove IBackend's four async twins and retire the prose threading contract #571.
4. Consider whether the Config flag should survive — see "Decisions still
   open".
5. Un-draft and switch Refs #568 to Closes #568 once CI is green.
   Done — this PR is out of draft and says Closes #568.

Decisions still open

Should Config::asyncRegistrationEnabled be removed? I kept it. Arguments I
weighed: removing it would make QtWebSocketBackend unconditionally
non-blocking, which is arguably the honest end state and would delete the last
thing that smells like a WASM special case; but it changes desktop registration
from synchronous to asynchronous, which every desktop example and a large number
of ladder tests depend on (a handler usable on the next line). Evidence I have:
the flag is read in exactly one place now (src/qt/qt_websocket_backend.cpp:163),
and its consumers are the example WASM mains, which are #570's scope. I
concluded that removing it is a behaviour decision for #570/#571 and out of
scope for step 2. Someone may reasonably disagree.

Should Bridge grow an executor of its own? Not attempted — see the gaps
section. This is the difference between "the guarantee is structural" and "the
decision is structural", and only the second is true today.

Gaps in #567's surface — read this before #569, #570 and #571

1. bindModel alone cannot replace a *Async verb; the caller has to move
with it. #567's surface deliberately removed the bool that meant "I have no
async path". That is the right design, but it has a consequence the ticket set
does not account for: there is no way for a caller to tell a natively
non-blocking backend from a blocking one, so a backend cannot be migrated
without its caller being migrated in the same change. Bridge is that caller
for all four verbs. #568 as written ("move QtWebSocketBackend, do not touch
anything else") is therefore not achievable as stated — the WASM path breaks the
moment the overrides are dropped. I migrated Bridge's four dispatch sites,
keeping the legacy branch first so the eleven test doubles in
tests/test_async_registration.cpp still exercise it and #571's scope is intact.
#569 will hit exactly the same wall if it chooses the native route for
SocketBackend; if it chooses the adapter, it will not, because the adapter is
reached through the same bindModel Bridge now calls.

Update: #569 (#586) chose the native route, the wall was hit, and this PR
now goes through it. The prediction was reproduced, filed as #593, and
fixed here by IBackend::bindWaitPolicy() — see #593 — the blocking
regression, and its fix above. The gap as written ("there is no way for a
caller to tell a natively non-blocking backend from a blocking one") is
closed; what it was really asking for was narrower than it looked, since the
caller does not need to know how the backend works, only whether it may
wait.

2. The structural threading guarantee is not yet real, because Bridge has no
thread to name. Completion delivers to the executor the caller passes. The
caller here is Bridge, which owns no event loop and no strand, so the only
executor it can honestly name is exec::detail::inlineExecutor() — "deliver
wherever you settled", which is precisely what the prose contract already
required of backends. So #568 does not close morph#486 and this PR does not
claim it does. What changed is who decides: one value at four call sites
instead of an obligation on fifteen implementors. Turning that into an actual
guarantee needs Bridge to hold an executor bound to the thread that runs
~Bridge, and no ticket in the #522 set owns that. If #571 intends to
"retire the prose threading contract" rather than relocate it, this is the
missing piece. Both specs now say so explicitly rather than implying otherwise.

Filed as #588, and triaged rescope: the remedy as written there (give
Bridge an executor bound to the thread that runs ~Bridge) contradicts
docs/spec/concurrency_and_lifetimes.md:205, which states that teardown is
order-independent and may run on any thread. The finding is real; the fix
belongs to #571's redesign, not to this PR. This PR therefore continues to
state that #568 does not close morph#486.

3. BindRequest cannot express registerModelShared with an empty primary.
Bridge::ensureBoundAsync asks for an anonymous shared instance — it calls
registerModelShared(typeId, factory, {contextKey, primary = {}}). In
BindRequest terms that is primary empty + current zero, which
bindModelBlocking routes to registerModelWithContext. Different verb.
Verified harmless: IBackend::registerModelShared documents an empty primary as
degrading to registerModelWithContext, and every backend in the tree
implements that degrade as its first statement (LocalBackend,
SimulatedRemoteBackend at remote.hpp:1874, SocketBackend at
socket_backend.hpp:219, QtWebSocketBackend). It cost me one test failure
anyway — see Traps. Related and also verified harmless:
attachModel(..., current = 0) is not expressible either (it maps to
registerModelShared); server-side, register+shared and attach with
modelId == 0 both reach acquireSharedInstance(..., ModelId{0}) through the
same authorizeRegister gate (remote.hpp:1067 vs :1154). #571 should not
assume the request-shape mapping is injective.

Traps

• The bindModelBlocking routing change is silent. It cost me exactly one
  failing test: ensureBoundAsync's synchronous fallback surfaces a real registerModelShared throw through onDone (Task 15a finding B2). Its double
  overrode only registerModelShared to throw, so after the routing change the
  call reached registerModelWithContext, succeeded, and the test passed by
  registering rather than by surfacing a throw. I made the double throw from
  both verbs and documented why in place. If you see another test go green for
  no reason, check which verb it is actually reaching now.
• Do not trust an empty build log. I filtered cmake --build output with
  grep -vE "^-- |^\[[0-9]+/", which yields an empty file on success and on a
  build that has not reached the failing target yet. Check the exit code.
• Qt tests need QT_QPA_PLATFORM=offscreen at build time as well as test
  time — Catch2's catch_discover_tests() runs each Qt-linked binary once
  during the build to enumerate cases.
• A full Debug build of this tree with -DMORPH_BUILD_LADDER=ON took ~40
  minutes on a machine shared with two other lanes' builds. Budget for it.
• The mutation that proves the WASM path hangs rather than fails. The second
  test_wasm_registration_path_native.cpp case blocks in a nested QEventLoop
  forever; I only saw it because I ran it under timeout. Always use one.
• tests/qt and tests/net_qt_interop are sanitizer-instrumented for the first
  time as of Four gates that could not fail: UBSan modes, sanitizer instrumentation, spec-sync, and the forms key vocabulary #576, and -DAF_SANITIZER=<unknown> is now a configure-time
  FATAL_ERROR. I did not run a sanitizer build, so I have no evidence either
  way about what they will find here. If instrumentation surfaces a pre-existing
  defect, file it per AGENTS.md rather than folding the fix in.

Issues filed

Closed by this PR:

• core: #567's registration surface gives Bridge no way to tell a natively non-blocking backend from a blocking one, and two shipped backends now need opposite behaviour at that one call site #593 — the blocking regression. Fixed here rather than worked around,
  because the defect is in the surface qt: move QtWebSocketBackend onto the structural registration surface and delete the WASM special case #568 moved onto: no other PR owns that
  call site.
• qt: QtWebSocketBackend drops contextKey on a blocking private registration, disagreeing with its own async path #594 — QtWebSocketBackend dropping contextKey. Reproduced, then fixed.

Filed in passing from this lane, not folded in:

• core: Bridge::switchBackend and installReconnectHandler still call the blocking registration verbs, so a backend that says kCallerMustNotBlock is blocked there anyway #615 — Bridge::switchBackend's phase 1 and installReconnectHandler's
  callback still call the blocking registerModelWithContext/
  registerModelShared directly, with no structural path and no
  bindWaitPolicy() check. So a kCallerMustNotBlock backend is blocked there
  anyway: a WASM client that never blocks on its first registration can still
  block on a reconnect or a backend swap. Inferred from reading the code, not
  reproduced — no WASM client was built and no reconnect deadlock observed.
  Includes a second, smaller finding: docs/spec/core/backend.md's migration
  table assigns the reconnect half to ladder: move the example GUIs and the WASM spike onto the structural registration surface #570, while ladder: move the example GUIs and the WASM spike onto the structural registration surface #570's own body scopes itself
  to examples/ and never mentions bridge.hpp. switchBackend is named by
  neither, and its atomicity (rollback keyed on a throw) is why it is not a
  one-line substitution.
• ci: every ctest preset sets stopOnFailure, so a leg with six failures reports one — and which one is a race #616 — every ctest preset sets stopOnFailure, so a red leg reports one
  failing test when six fail, and which one it reports is a -j race.
  Reproduced: same commit, 1 in CI versus 6 locally, with both outputs.

Still open from earlier revisions of this PR:

• core: give Bridge an executor bound to its own thread, so the threading guarantee is structural for Bridge-mediated calls too #588 — "Bridge names no executor bound to its own thread" (gap 2 above),
  triaged rescope to core: remove IBackend's four async twins and retire the prose threading contract #571. This PR continues to state that qt: move QtWebSocketBackend onto the structural registration surface and delete the WASM special case #568 does not
  close morph#486.

Gaps 1 and 3 above remain written up here rather than filed: gap 1 is now closed
by #593's fix, and gap 3 is a footnote #571 needs when it touches the
request-shape mapping.

Nothing else was found in passing that needed a separate issue.

🤖 Generated with Claude Code

https://claude.ai/code/session_01AbwhcguQFkhvVi2AH19sWk

[codecov]

Codecov Report

❌ Patch coverage is 93.84615% with 12 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
include/morph/core/bridge.hpp	96.72%	5 Missing and 1 partial ⚠️
include/morph/qt/qt_websocket_backend.hpp	0.00%	3 Missing ⚠️
include/morph/core/backend.hpp	33.33%	2 Missing ⚠️
include/morph/core/executor.hpp	83.33%	0 Missing and 1 partial ⚠️

📢 Thoughts on this report? Let us know!

[Yaraslaut]

Heads-up for this PR's eventual rebase: docs/spec/core/backend.md will have moved.

PR #595 (issue #587, SocketBackend dropping contextKey on a private registration) has to edit that file. I had originally told its lane the file was off limits because this PR holds it, but that instruction was unworkable: scripts/check_spec_sync.sh:60 maps include/morph/net/** to

net|^docs/spec/net/|^docs/spec/core/backend\.md$|^docs/spec/security\.md$

docs/spec/net/ does not exist, and security.md is the wrong home for a registration/journaling contract — so backend.md is the only honest way for #595 to pass the Header ↔ spec sync gate. Its CI failed with include/morph/net/** changed but none of its spec paths did.

Why I let it through rather than making it wait: this PR is blocked on #593, a design decision at the #567/#571 level with no timetable. Holding backend.md against a blocked PR would stall correct, unrelated work for an unbounded period. That is the wrong trade, so #595 goes first.

The expected overlap is small and near backend.md:155, the sentence that reads "Backends whose model instances live behind a wire protocol (SimulatedRemoteBackend) override this to carry @p contextKey across" — #595 makes that true of SocketBackend too. I asked it to keep the edit to what its own change establishes and to document nothing about bindModel's blocking/non-blocking question, which is #593's to settle.

This branch already reconciled backend.md once against #586 and did it properly — kept both sides rather than picking one — so this should be familiar ground rather than a surprise.

[Yaraslaut]

Merge ordering, decided by the runner: #585 first, then #614

These two PRs interact, and the interaction is measured rather than predicted. #614 adds a per-PR gate that resolves scripts/mutation_survivors.json's {file, line, source} citations against the tree and fails when a line hint has drifted. #585 moves code in both files two of those citations point into.

Measured against #585's head 49bd5b8b and #614's refreshed JSON:

include/morph/core/bridge.hpp
   #614 refreshed it to 121; on #585's branch the text is at [122]   -> WILL GO STALE
include/morph/core/backend.hpp
   #614 refreshed it to 1228; on #585's branch the text is at [1322] -> WILL GO STALE

The backend.hpp delta is 94 lines, exactly the +94 #585 adds to that file. This is not a merge conflict — #585 does not touch the JSON, and #614 does not touch the headers — so git will merge them cleanly and the gate is what will object.

Why this order:

• ci: audit mutation_survivors.json's line citations instead of hoping (fixes #608) #614's gate does not exist on master yet, so merging qt: move QtWebSocketBackend onto the structural registration surface #585 first cannot be blocked by it. The reverse is not true: if ci: audit mutation_survivors.json's line citations instead of hoping (fixes #608) #614 lands first, qt: move QtWebSocketBackend onto the structural registration surface #585 goes red on a gate it has nothing to do with, and pays a full 26–74 minute re-run — on the PR that unblocks ladder: move the example GUIs and the WASM spike onto the structural registration surface #570 → core: remove IBackend's four async twins and retire the prose threading contract #571 → core: IBackend has grown a parallel async shadow of four of its own methods #522, a four-issue chain.
• The correction on ci: audit mutation_survivors.json's line citations instead of hoping (fixes #608) #614's side is editing two integers, and its own failure message prints the corrected line numbers, so the rebase is mechanical rather than an investigation.

So: land #585 when green. Then rebase #614, re-run its gate (python3 scripts/check_mutation_survivors.py), update the two hints it names, and land it.

This is the gate working as designed, and it is the argument #614's PR body makes for the resolver approach over hand-maintained coordinates — recorded here so whoever runs the next landing sweep does not have to re-derive it.

[Yaraslaut]