fix(core): cpp23 adversarial review — 2 HIGH + 10 MEDIUM findings cleanup

[lusoris]

Summary

Rollup of fixes for the 2 HIGH and 10 MEDIUM findings from the adversarial code
review of the C→C++23 conversion wave (VMAFx/vmafx PR #78). 3 LOW findings left
as nits per scope directive.

Rebases trivially on top of the cpp23 PRs (#41–#58) when they land.
Each commit targets exactly the file(s) from the corresponding cpp23 PR.

Findings addressed

HIGH (2)

• Finding chore(deps): Update dependency openai to >=2.38.0 #7 / PR refactor(core): C++23 pilot — log.c (real C++23, supersedes #42) #45 / core/src/log.cpp: Add assert(sv.data()[sv.size()] == '\0') before passing string_view::data() to fprintf %s. Arrays are constexpr string literals so asserts always pass; they document and enforce the NUL invariant (CERT STR32-C; Power of 10 chore(deps): Update fedora:45 Docker digest to 0c1f63e #5).
• Finding chore(deps): Update debian Docker tag to v13 #11 / PR refactor(core): cpp23 Wave 3 part B — psnr_tools, luminance_tools, mkdirp (ADR-0731) #51 / core/src/feature/mkdirp.cpp: Replace recursive mkdirp() with iterative prefix-walk bounded by pathname.size(). Eliminates stack-overflow risk on deeply-nested adversarial paths (Power of 10 chore(meta): post-cutover URL sweep — lusoris/vmaf → VMAFx/vmafx #1, chore(docs): update mkdocs site_url to vmafx.github.io/vmafx #2).

MEDIUM (10)

• Finding chore(deps): Update archlinux:latest Docker digest to 40ec92a #4 / PR refactor(core): C++23 pilot Wave 1 — opt.c → opt.cpp (ADR-0721) #43 / core/src/opt.h: Add [[nodiscard]] to vmaf_option_set declaration inside extern "C" block so C++ TUs see the attribute (CERT ERR33-C).
• Finding chore(deps): Update fedora:45 Docker digest to 0c1f63e #5 / PR refactor(core): C++23 pilot Wave 2 — fex_ctx_vector.c → .cpp (ADR-0723) #44 / core/src/fex_ctx_vector.cpp: Remove dead try/catch + abandoned vector from feature_extractor_vector_init — the vector was discarded before its RAII could help (Power of 10 chore(deps): Pin dependencies #3).
• Finding chore(deps): Update dependency anthropic to >=0.104.1 #6 / PR refactor(core): C++23 pilot Wave 2 — fex_ctx_vector.c → .cpp (ADR-0723) #44 / core/src/fex_ctx_vector.cpp: Add assert(capacity <= SIZE_MAX/2/sizeof(*fex_ctx)) before capacity-doubling realloc (CERT INT30-C).
• Finding chore(deps): Update rocm/rocm-terminal Docker tag to v6.4 #10 / PR refactor(core): cpp23 Wave 2 — project-wide cpp_std=c++23 + dict.c → dict.cpp #48 / core/src/dict.cpp + dict_internal.h + test/test_dict.cpp: Extract isnumeric to dict_internal.h as inline bool. Replace ODR-risky #include "dict.cpp" in test with #include "dict_internal.h" (Power of 10 chore(deps): Update Helm release prometheus-pushgateway to >=2.17.0 #8).
• Finding chore(deps): Update GitHub Actions (major) (major) #12 / PR refactor(core): cpp23 Wave 3 part B — psnr_tools, luminance_tools, mkdirp (ADR-0731) #51 / core/src/feature/luminance_tools.cpp: Remove redundant static from functions in anonymous namespace — anonymous namespace already provides internal linkage; static triggers -Wredundant-decls (Power of 10 chore(deps): Update rocm/rocm-terminal Docker tag to v6.4 #10).
• Finding feat(meta): VMAFX Phase 4 language-modernization foundation #14 / PR refactor(core): cpp23 Wave 3 — feature_name, picture_copy, model (ADR-0729) #54 / core/src/feature/picture_copy.cpp: Add comment documenting intentional negative-stride semantics for bottom-up image layout (CERT INT31-C clarification).
• Finding feat(server): vmafx-server in Go (gRPC + HTTP, observability) #15 / PR refactor(core): cpp23 Wave 3 — feature_name, picture_copy, model (ADR-0729) #54 / core/src/feature/feature_name.cpp: Check vmaf_dictionary_copy return value before wrapping in DictPtr — null dereference on OOM otherwise (CERT MEM31-C).
• Finding feat(bindings): Rust vmafx-sys FFI crate #16 / PR refactor(core): cpp23 Wave 4 — output writers (ADR-0733) #56 / core/src/output.cpp: Log VMAF_LOG_LEVEL_WARNING when LocaleGuard locale-push returns null — silent failure degrades decimal-separator correctness.
• Finding feat(tune): vmafx-tune in Go (Stage 1 — compare subcommand) #17 / PR refactor(core): cpp23 Wave 4 — output writers (ADR-0733) #56 / core/src/output.cpp: Add static_assert(VMAF_POOL_METHOD_NB == 5) after pool_method_name[] — catches out-of-bounds loop if enum grows (JPL Rule 23 spirit).
• Finding refactor(core): pilot C++23 conversion (metadata_handler) + migration research digest #19 / PR refactor(core): C++23 Wave 5 — cpu, ref, thread_locale (ADR-0735) #58 / core/src/cpu.cpp: Add constinit to g_flags / g_flags_mask atomics — prevents static-initialisation-order fiasco if a static initializer in another TU calls vmaf_get_cpu_flags() before cpu.cpp is constructed (C++20/23).

Deferred (3 LOWs, per scope directive)

• Finding chore(meta): post-cutover URL sweep — lusoris/vmaf → VMAFx/vmafx #1 (PR refactor(core): C++23 pilot — mem.c → mem.cpp (ADR-0720) #41): [[nodiscard]] C-visible limitation in mem.h — acceptable per stated design intent.
• Finding chore(docs): update mkdocs site_url to vmafx.github.io/vmafx #2 (PR refactor(core): C++23 pilot — mem.c → mem.cpp (ADR-0720) #41): Missing asserts in aligned_malloc — pre-existing, addressed separately.
• Finding chore(deps): Update Helm release prometheus-pushgateway to >=2.17.0 #8 (PR refactor(core): C++23 pilot — log.c (real C++23, supersedes #42) #45): vmaf_log_level / istty thread-safety — pre-existing C issue; std::atomic upgrade deferred.

Deep-dive deliverables (ADR-0108)

• Research digest — no digest needed: targeted cleanup of adversarial review findings (PR chore(review): adversarial code review of cpp23 wave (PRs #41-#58) #78).
• Decision matrix — no ADR (bug fix per CLAUDE §12 r8); sentinel.
• AGENTS.md invariant note — no rebase-sensitive invariants from this PR; invariants live in the cpp23 PRs.
• Reproducer — meson setup build-cleanup core -Denable_cuda=false -Denable_sycl=false && ninja -C build-cleanup && meson test -C build-cleanup --suite=fast (after cpp23 PRs land).
• Changelog fragment — changelog.d/fixed/cpp23-review-high-medium-cleanup.md.
• Rebase notes — docs/rebase-notes.md entry.

Per-surface docs

Sentinel: no user-discoverable surface changed. All fixes are internal code-quality / safety improvements with no change to computed scores, CLI flags, or public C API.

🤖 Generated with Claude Code