ci: fix lint IWYU + latent CCN gate and cap concurrency stress under valgrind

Three failures on the feature/v2.0 Verify run, two of them latent behind
the lint job's step ordering:

- cpplint (lint lane): two build/include_what_you_use errors on
  webserver_impl_dispatch.hpp. The header is a class-body fragment
  (#error-gated, included mid-class) so it cannot carry its own
  #include lines; suppress with NOLINT on the two anchor declarations,
  matching the existing suppression already in this file.

- complexity gate (lint lane, never reached because cpplint failed
  first): fire_response_sent_gated had crept to CCN 11. The
  `server_gate || route_gate` predicate was spelled out twice; hoisting
  it into a named `user_gate` both reads better and drops one boolean
  operator, bringing the function back to CCN 10. Behaviour-preserving.

- valgrind-drd lane timeout (90 min): route_table_concurrency and
  ws_registry_concurrency spin up to 20 threads hammering a single
  shared_mutex for a 30 s real-time window. helgrind/drd track a
  happens-before relation over every lock/atomic across every thread
  pair, so that workload explodes their internal state (the drd lane
  hung with no output for 88 minutes). memcheck, which tracks no thread
  ordering, ran the same binary in ~60 s. Add stress_window() /
  stress_threads() helpers in test_utils.hpp that shrink the run window
  (30 s -> 3 s) and per-role fan-out (-> 3) only when VALGRIND is set; a
  race detector needs only a short concurrent window to flag a missing
  synchronisation. Native and TSan lanes keep the full-size stress.

Verified locally: cpplint clean, check-complexity/file-size/
warning-suppression gates pass, and make check is 113/113.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: etr

src/detail/webserver_hook_firing.cpp

@@ -188,8 +188,12 @@ void webserver_impl::fire_response_sent_gated(detail::modded_request* mr,
     auto* rtable = resource != nullptr ? resource->hook_table_raw_() : nullptr;
     const bool route_gate = rtable != nullptr &&
         rtable->any_hooks(hook_phase::response_sent);
+    // Whether any user hook (server-wide or per-route) will observe this
+    // firing. Distinct from the log_access alias slot, which fires
+    // regardless but never reads ctx.elapsed (see the elapsed gate below).
+    const bool user_gate = server_gate || route_gate;
 
-    if (!server_gate && !route_gate && !hooks_.has_log_access_alias()) return;
+    if (!user_gate && !hooks_.has_log_access_alias()) return;
     // mr->response is null only if materialize_and_queue_response's
     // belt-and-suspenders fallback also failed; fire nothing rather than crash.
     if (!mr->response) return;
@@ -203,7 +207,7 @@ void webserver_impl::fire_response_sent_gated(detail::modded_request* mr,
     // slot fires, to avoid a gratuitous clock syscall on the common path.
     // NOTE: the alias body MUST NOT read ctx.elapsed; any future change
     // that needs elapsed in the alias must also remove this optimisation.
-    const auto elapsed = (server_gate || route_gate)
+    const auto elapsed = user_gate
         ? std::chrono::duration_cast<std::chrono::nanoseconds>(
               std::chrono::steady_clock::now() - mr->start_time)
         : std::chrono::nanoseconds::zero();

src/httpserver/detail/webserver_impl_dispatch.hpp

@@ -319,12 +319,12 @@ bool resolve_resource_for_request(modded_request* mr,
 // header. On handler-throw, routes through the safe internal-error
 // path.
 void dispatch_resource_handler(modded_request* mr,
-        const std::shared_ptr<::httpserver::http_resource>& hrm);
+        const std::shared_ptr<::httpserver::http_resource>& hrm);  // NOLINT(build/include_what_you_use)
 
 // Serialize an allowed-method set into the comma-separated value
 // expected by the HTTP `Allow:` header. Enum-declaration order:
 // GET, HEAD, POST, PUT, DELETE, CONNECT, OPTIONS, TRACE, PATCH.
-std::string serialize_allow_methods(method_set allowed) const;
+std::string serialize_allow_methods(method_set allowed) const;  // NOLINT(build/include_what_you_use)
 
 // Final stage of finalize_answer: build an MHD_Response from
 // mr->response, decorate it, queue it on the connection. Handles

test/integ/route_table_concurrency.cpp

@@ -78,8 +78,8 @@ LT_BEGIN_AUTO_TEST(route_table_concurrency_suite,
     std::atomic<int> writer_ops{0};
     std::atomic<int> reader_ops{0};
 
-    constexpr int kWriters = 4;
-    constexpr int kReaders = 16;
+    const int kWriters = stress_threads(4);
+    const int kReaders = stress_threads(16);
 
     std::vector<std::thread> threads;
     threads.reserve(kWriters + kReaders);
@@ -127,8 +127,7 @@ LT_BEGIN_AUTO_TEST(route_table_concurrency_suite,
     // valgrind/TSan overhead. Using an operation count avoids fixed
     // wall-clock sleeps that inflate on loaded CI boxes.
     constexpr int kOpThreshold = 10000;
-    auto deadline =
-        std::chrono::steady_clock::now() + std::chrono::seconds(30);
+    auto deadline = std::chrono::steady_clock::now() + stress_window();
     while ((writer_ops.load() < kOpThreshold || reader_ops.load() < kOpThreshold)
            && std::chrono::steady_clock::now() < deadline) {
         std::this_thread::sleep_for(std::chrono::milliseconds(10));
@@ -173,8 +172,8 @@ LT_BEGIN_AUTO_TEST(route_table_concurrency_suite,
     std::atomic<int> writer_ops{0};
     std::atomic<int> reader_ops{0};
 
-    constexpr int kWriters = 4;
-    constexpr int kReaders = 8;
+    const int kWriters = stress_threads(4);
+    const int kReaders = stress_threads(8);
 
     std::vector<std::thread> threads;
     threads.reserve(kWriters + kReaders);
@@ -223,8 +222,7 @@ LT_BEGIN_AUTO_TEST(route_table_concurrency_suite,
     }
 
     // Same baseline + valgrind-tolerant extension as Cycle I above.
-    auto deadline2 =
-        std::chrono::steady_clock::now() + std::chrono::seconds(30);
+    auto deadline2 = std::chrono::steady_clock::now() + stress_window();
     std::this_thread::sleep_for(std::chrono::milliseconds(500));
     while ((writer_ops.load() == 0 || reader_ops.load() == 0)
            && std::chrono::steady_clock::now() < deadline2) {

test/integ/test_utils.hpp

@@ -21,6 +21,7 @@
 #ifndef TEST_INTEG_TEST_UTILS_HPP_
 #define TEST_INTEG_TEST_UTILS_HPP_
 
+#include <chrono>
 #include <cstdlib>
 
 // Shared helpers for the integration test suite.
@@ -33,6 +34,27 @@
 // (route_table_concurrency.cpp, ws_registry_concurrency.cpp) use this to
 // relax ONLY their liveness assertions, never the race/crash gate.
 inline bool under_valgrind() { return std::getenv("VALGRIND") != nullptr; }
+
+// Concurrency-stress sizing knobs (route_table_concurrency.cpp,
+// ws_registry_concurrency.cpp). helgrind/drd track a happens-before
+// relation over every lock and atomic across every pair of threads, so the
+// native-size stress (up to 20 threads hammering a single shared_mutex for a
+// 30 s real-time window) makes the tool's internal segment/vector-clock
+// state grow superlinearly -- enough to blow the 90-minute CI budget (the
+// drd lane was observed hanging inside route_table_concurrency, producing no
+// output for 88 minutes). memcheck, which tracks no thread ordering, runs the
+// same binary in ~60 s. A race detector needs only a short window of genuine
+// concurrency to flag a missing-synchronisation access, so shrink BOTH the
+// per-role thread fan-out and the run window sharply under valgrind. The
+// native and TSan lanes (VALGRIND unset) keep the full-size stress.
+inline std::chrono::seconds stress_window() {
+    return under_valgrind() ? std::chrono::seconds(3)
+                            : std::chrono::seconds(30);
+}
+inline int stress_threads(int full_native) {
+    return under_valgrind() ? (full_native < 3 ? full_native : 3)
+                            : full_native;
+}
 //
 // Historical note: this header previously exposed `as_shared(http_resource&)`,
 // a thin wrapper that returned a std::shared_ptr<http_resource> with a no-op

test/integ/ws_registry_concurrency.cpp

@@ -88,8 +88,8 @@ LT_BEGIN_AUTO_TEST(ws_registry_concurrency_suite,
     std::atomic<int> writer_ops{0};
     std::atomic<int> reader_ops{0};
 
-    constexpr int kWriters = 4;
-    constexpr int kReaders = 16;
+    const int kWriters = stress_threads(4);
+    const int kReaders = stress_threads(16);
 
     std::vector<std::thread> threads;
     threads.reserve(kWriters + kReaders);
@@ -130,12 +130,12 @@ LT_BEGIN_AUTO_TEST(ws_registry_concurrency_suite,
     }
 
     // Run until enough operations have been observed by both roles, or
-    // until a wall-clock safety ceiling (30s) to survive valgrind/TSan
-    // overhead. Mirrors route_table_concurrency.cpp's threshold-based
-    // stop condition (avoids a fixed wall-clock sleep).
+    // until stress_window() elapses (30s native/TSan; 3s under valgrind so
+    // the helgrind/drd happens-before engine fits the CI budget). Mirrors
+    // route_table_concurrency.cpp's threshold-based stop condition (avoids a
+    // fixed wall-clock sleep).
     constexpr int kOpThreshold = 10000;
-    auto deadline =
-        std::chrono::steady_clock::now() + std::chrono::seconds(30);
+    auto deadline = std::chrono::steady_clock::now() + stress_window();
     while ((writer_ops.load() < kOpThreshold || reader_ops.load() < kOpThreshold)
            && std::chrono::steady_clock::now() < deadline) {
         std::this_thread::sleep_for(std::chrono::milliseconds(10));