[paul-hammant]

Three fixes, one commit each, batched to save Actions minutes.

1. std.http: http_server_stop waits for the server, however it was started (88d650814)

• Bug: stop only joined a server started with http_server_start_background_raw. For a foreground http_server_start_raw on another thread (e.g. an actor), stop returned at once, and the http_server_free that followed freed the server under the still-running accept loop and a pool worker serving a keep-alive connection. ASan: heap-use-after-free in conn_serve / http_server_serve. Found by servirtium-vcr.
• Second bug found on the way: a background server stopped from one of its own handlers hung or used freed memory. The handler's stop joined the background thread, which was itself joining the worker running the handler.
• Contract: stop always signals and then waits until the run is over (accept loop returned; pool, event loop and parking lot joined), whichever start began it, so free after stop is always safe.
  • A stop from one of the run's own threads (a handler, the monitor, a proxy event-loop thread, an h2 dispatch worker) only signals, so it can't deadlock.
  • Starting a server that is already running is refused.
  • Free on a run thread while running aborts with a clear message.
  • The state is per server (run lock and condvar, serving flag, the run's thread ids). background_tid and background_tid_set are removed.
• Not covered (pre-existing): in actor-dispatch mode, actor handlers in flight are not waited for.
• Tests: tests/integration/http_server_stop_waits. foreground_actor holds a keep-alive connection across stop and free, 10 rounds; from_handler stops from a handler in foreground and background modes, and checks the double-start refusal.
  • On main: crash, fail or hang 3/3 on Linux and macOS.
  • With the fix: pass 3/3, ASan clean.

2. std.bytes: string_from_ptr refuses a bytes handle (e7b6ab557)

• Bug: string_from_ptr(src, n) wants a raw data pointer, but a bytes handle is also a ptr. Passing one silently copied the AetherBytes header: string_from_ptr(b, 4) gave 04000000 where to_string(b, 4) gives 4100ff42.
• Fix: AetherBytes now carries a tag, checked the way is_aether_string checks strings (byte by byte, so a raw C buffer is never over-read). A live handle panics with a message pointing to bytes.to_string(b, n) or bytes.data(b).
• Why not a typed handle: it would need compiler work or retyping about 271 files and every cryptography buffer argument.
• Docs and the API page say src must be a raw data pointer. Regression test included.

3. ae build on macOS: the deployment target defaults to the running OS (4cfa58624)

• Bug: with MACOSX_DEPLOYMENT_TARGET unset, clang targets the selected SDK's macOS (27.0 from an Xcode beta here). Homebrew builds its dylibs for the running OS (27.2), so every link against nghttp2 printed an ld "built for newer version" warning into ae run output. That failed http_server_monitor and two examples, and make ci on macOS stopped at step 5.
• Fix: ae build and ae cflags default the target to the running OS when the variable is unset; a value the caller sets still wins. http_server_monitor now builds first and compares only the program's output.
• Release builds of libaether itself are unchanged, so release artifacts don't start requiring a newer macOS.

Verified:

• make ci on cachyos (gcc 16, -Werror) with all three together: 714 C unit tests, 2203 .ae tests passed, 0 failed.
• macOS (Apple clang): full make ci passes all 11 steps for the first time.

🤖 Generated with Claude Code