fix(api): Plumb safety + request IDs + array fields through singleton thunks

Closes the runtime gaps that surfaced once `-DNOTE_SINGLETON=1` started compiling against the polymorphic Notecard. Three independent singleton-mode bugs all routed through the same code path:

(1) Safety dropped to NonIdempotent. The thunks called execute_void / execute_generic_with_body without a Safety parameter, so retry_loop saw NonIdempotent regardless of `RequestT::safety`. Idempotent / ReadOnly endpoints didn't retry on transient ResponseLost (CRC mismatch, read timeout). Adds Safety to the thunk function-pointer signature; generated `execute()` passes `safety` (the per-class constexpr).

(2) Request IDs not injected. The static `execute()` template baked "id":N into its fields lambda; the singleton thunk path bypassed that lambda and the wire frame went out without an id. Adds `Notecard::next_request_id_or_zero()` (and the StaticNotecard mirror) and a `detail::IdWrapCtx` / `id_wrap_build` helper in protocol.hpp. The thunks wrap the caller's BuildFn with id_wrap so the id sits between "req" and the per-endpoint fields, matching the static template's wire format.

(3) Version-guarded fields and StringArray fields silently dropped. The codegen previously filtered `version_guard` and `is_array` properties out of `field_descs_table_`; GenericResponseSink saw the bare scalar set, so e.g. CardAttn::off (gated) and CardAttn::files (array of strings) never landed in the parsed Response. Codegen now emits version-guarded entries with their own `#if` guards and emits a new `FieldType::StringArray` for string-element ResponseArray fields. `field_count` is computed from the post-preprocessor table size. GenericResponseSink picks up an `active_string_array_` latch in on_array_begin/on_array_end so on_string can append into the matching ResponseArray. The buffered fallback in `execute_generic_with_body` switches from `sax_parse` (emits only on_number for numerics, which GenericResponseSink only forwards to body handlers) to `sax_lex` (emits typed on_int / on_float / on_bool that the response field table actually dispatches).

Also documents the Notecard::binary_ctrl_buf_[256] fixed buffer per Mat's earlier comment, and switches the err-stash from a fixed buffer to allocator-backed durable copy (heap-leaked, same model as StringPool::intern) so no new fixed-size buffer was added for these fixes.

NOTE_MINIMAL gates: under NOTE_MINIMAL, NOTE_NO_RETRY and NOTE_NO_REQUEST_IDS are forced on, so safety and id wrapping are no-ops. The thunks short-circuit to a direct call. The StringArray dispatch in GenericResponseSink and the durable_ptr field in NcErrorCapture are also gated out. AVR delta after these fixes: avr-notecpp           +78 B flash, RAM unchanged avr-notecpp-direct    +64 B flash, RAM unchanged avr-notecpp-raw       +0  B flash avr-notecpp-multistack -66 B flash (linker dedup of class-scope tables) The +78/+64 comes from version-guarded entries now landing in field_descs (one per gated property per endpoint) and Safety being threaded through `execute_generic_with_body`. Acceptable trade-off for closing three categories of correctness bugs that previously silently dropped fields.

Singleton test failures: 73 → 0 (all 1858 host tests pass under `-DNOTE_SINGLETON=1`; default and NOTE_MINIMAL builds also pass).

Author: m-mcgowan

src/note/api.hpp

@@ -156,24 +156,39 @@ class Api {
     // `result.error().code` and ignore the string), so the +250 bytes
     // of flash for the durable-copy logic isn't worth it. The dangling
     // `view()` quirk persists there, gated to that minimal build only.
-    static Result<void> void_thunk_(void* p, string_view req, BuildFn fn, void* ctx, detail::NcErrorCapture& err) {
+    // The thunks plumb `Safety` (so retry_loop can decide whether
+    // ResponseLost-style errors are retryable per-request) and inject
+    // request IDs (`"id":N`) by wrapping the caller's fields BuildFn
+    // with `id_wrap_build`. Both are needed for the singleton thunk
+    // path to match the per-template `Notecard::execute()` semantics.
+    //
+    // Under NOTE_MINIMAL, NOTE_NO_RETRY and NOTE_NO_REQUEST_IDS are
+    // forced on, so safety and request IDs have no observable effect —
+    // skip the wrapping and `stash_nc_err` to keep AVR flash flat.
+    // The function pointer signature stays uniform across builds so
+    // the generated `execute()` doesn't need NOTE_MINIMAL branches.
+    static Result<void> void_thunk_(void* p, string_view req, BuildFn fn, void* ctx, detail::NcErrorCapture& err, Safety safety) {
+        auto* nc = static_cast<NcT*>(p);
 #if NOTE_MINIMAL
-        return static_cast<NcT*>(p)->execute_void(req, fn, ctx, err);
+        (void)safety;
+        return nc->execute_void(req, fn, ctx, err);
 #else
-        auto* nc = static_cast<NcT*>(p);
-        auto rv = nc->execute_void(req, fn, ctx, err);
+        detail::IdWrapCtx id_wrap{fn, ctx, nc->next_request_id_or_zero()};
+        auto rv = nc->execute_void(req, &detail::id_wrap_build, &id_wrap, err, safety);
         err.set_durable(nc->stash_nc_err(err.view()));
         return rv;
 #endif
     }
     static Result<void> generic_thunk_(void* p, string_view req, BuildFn fn, void* ctx,
             void* rsp, const FieldDesc* f, uint8_t n, detail::NcErrorCapture& err, bool& ex,
-            void* body_ptr, BodyHandlerFactory body_factory) {
+            void* body_ptr, BodyHandlerFactory body_factory, Safety safety) {
+        auto* nc = static_cast<NcT*>(p);
 #if NOTE_MINIMAL
-        return static_cast<NcT*>(p)->execute_generic_with_body(req, fn, ctx, rsp, f, n, err, ex, body_ptr, body_factory);
+        (void)safety;
+        return nc->execute_generic_with_body(req, fn, ctx, rsp, f, n, err, ex, body_ptr, body_factory);
 #else
-        auto* nc = static_cast<NcT*>(p);
-        auto rv = nc->execute_generic_with_body(req, fn, ctx, rsp, f, n, err, ex, body_ptr, body_factory);
+        detail::IdWrapCtx id_wrap{fn, ctx, nc->next_request_id_or_zero()};
+        auto rv = nc->execute_generic_with_body(req, &detail::id_wrap_build, &id_wrap, rsp, f, n, err, ex, body_ptr, body_factory, safety);
         err.set_durable(nc->stash_nc_err(err.view()));
         return rv;
 #endif

src/note/api/card_attn.hpp

@@ -532,29 +532,30 @@ struct CardAux {
         std::unique_ptr<JsonReader> reader_;
 #endif
     };
-    static constexpr uint8_t field_count = 3;
-    static const ::note::FieldDesc* field_descs_ptr() {
 #pragma GCC diagnostic push
 #pragma GCC diagnostic ignored "-Winvalid-offsetof"
-        static constexpr ::note::FieldDesc table[] NOTE_FLASH_ATTR = {
-            {keys_::rsp_mode, static_cast<uint16_t>(offsetof(Response, mode)), ::note::FieldType::String},
-            {keys_::rsp_seconds, static_cast<uint16_t>(offsetof(Response, seconds)), ::note::FieldType::Int},
-            {keys_::rsp_time, static_cast<uint16_t>(offsetof(Response, time)), ::note::FieldType::Int},
-        };
+    static constexpr ::note::FieldDesc field_descs_table_[] NOTE_FLASH_ATTR = {
+        {keys_::rsp_mode, static_cast<uint16_t>(offsetof(Response, mode)), ::note::FieldType::String},
+#if NOTE_API_VERSION >= NOTE_VERSION(3, 3, 1) || !defined(NOTE_API_STRICT)
+        {keys_::rsp_power, static_cast<uint16_t>(offsetof(Response, power)), ::note::FieldType::Bool},
+#endif
+        {keys_::rsp_seconds, static_cast<uint16_t>(offsetof(Response, seconds)), ::note::FieldType::Int},
+        {keys_::rsp_time, static_cast<uint16_t>(offsetof(Response, time)), ::note::FieldType::Int},
+    };
 #pragma GCC diagnostic pop
-        return table;
-    }
+    static constexpr uint8_t field_count = sizeof(field_descs_table_) / sizeof(field_descs_table_[0]);
+    static const ::note::FieldDesc* field_descs_ptr() { return field_descs_table_; }
 
 #if NOTE_SINGLETON
     /// Singleton generic execute — shared thunk with body factory params.
-    static inline Result<void>(*execute_generic_fn_)(void*, ::note::string_view, BuildFn, void*, void*, const ::note::FieldDesc*, uint8_t, ::note::detail::NcErrorCapture&, bool&, void*, ::note::BodyHandlerFactory);
+    static inline Result<void>(*execute_generic_fn_)(void*, ::note::string_view, BuildFn, void*, void*, const ::note::FieldDesc*, uint8_t, ::note::detail::NcErrorCapture&, bool&, void*, ::note::BodyHandlerFactory, ::note::Safety);
     ApiResult<Response> execute() const {
         auto build_ = [&](JsonBuilder& b_) { this->build(b_); };
         BuildFn fn_ = [](JsonBuilder& b_, void* p_) { (*static_cast<decltype(build_)*>(p_))(b_); };
         Response rsp_{};
         ::note::detail::NcErrorCapture nc_err_;
         bool exhausted_ = false;
-        auto rv_ = execute_generic_fn_(nc_, notecard_request, fn_, &build_, &rsp_, field_descs_ptr(), field_count, nc_err_, exhausted_, nullptr, nullptr);
+        auto rv_ = execute_generic_fn_(nc_, notecard_request, fn_, &build_, &rsp_, field_descs_ptr(), field_count, nc_err_, exhausted_, nullptr, nullptr, safety);
         if (!rv_) return ::note::Unexpected(rv_.error());
         if (!nc_err_.empty()) return ApiResult<Response>(::note::ErrorInfo{::note::Error::Notecard, ::note::Cause::Unspecified, nc_err_.view()});
         if (exhausted_) return ApiResult<Response>(::note::ErrorInfo{::note::Error::Overflow, ::note::Cause::Unspecified, NOTE_ERR("arena exhausted")});

src/note/api/card_aux.hpp

@@ -355,27 +355,28 @@ struct CardAuxSerial {
             std::unique_ptr<JsonReader> reader_;
 #endif
         };
-        static constexpr uint8_t field_count = 1;
-        static const ::note::FieldDesc* field_descs_ptr() {
 #pragma GCC diagnostic push
 #pragma GCC diagnostic ignored "-Winvalid-offsetof"
-            static constexpr ::note::FieldDesc table[] NOTE_FLASH_ATTR = {
-                {keys_::rsp_mode, static_cast<uint16_t>(offsetof(Response, mode)), ::note::FieldType::String},
-            };
+        static constexpr ::note::FieldDesc field_descs_table_[] NOTE_FLASH_ATTR = {
+            {keys_::rsp_mode, static_cast<uint16_t>(offsetof(Response, mode)), ::note::FieldType::String},
+#if NOTE_API_VERSION >= NOTE_VERSION(4, 1, 1) || !defined(NOTE_API_STRICT)
+            {keys_::rsp_rate, static_cast<uint16_t>(offsetof(Response, rate)), ::note::FieldType::Int},
+#endif
+        };
 #pragma GCC diagnostic pop
-            return table;
-        }
+        static constexpr uint8_t field_count = sizeof(field_descs_table_) / sizeof(field_descs_table_[0]);
+        static const ::note::FieldDesc* field_descs_ptr() { return field_descs_table_; }
 
 #if NOTE_SINGLETON
         /// Singleton generic execute — shared thunk with body factory params.
-        static inline Result<void>(*execute_generic_fn_)(void*, ::note::string_view, BuildFn, void*, void*, const ::note::FieldDesc*, uint8_t, ::note::detail::NcErrorCapture&, bool&, void*, ::note::BodyHandlerFactory);
+        static inline Result<void>(*execute_generic_fn_)(void*, ::note::string_view, BuildFn, void*, void*, const ::note::FieldDesc*, uint8_t, ::note::detail::NcErrorCapture&, bool&, void*, ::note::BodyHandlerFactory, ::note::Safety);
         ApiResult<Response> execute() const {
             auto build_ = [&](JsonBuilder& b_) { this->build(b_); };
             BuildFn fn_ = [](JsonBuilder& b_, void* p_) { (*static_cast<decltype(build_)*>(p_))(b_); };
             Response rsp_{};
             ::note::detail::NcErrorCapture nc_err_;
             bool exhausted_ = false;
-            auto rv_ = execute_generic_fn_(nc_, notecard_request, fn_, &build_, &rsp_, field_descs_ptr(), field_count, nc_err_, exhausted_, nullptr, nullptr);
+            auto rv_ = execute_generic_fn_(nc_, notecard_request, fn_, &build_, &rsp_, field_descs_ptr(), field_count, nc_err_, exhausted_, nullptr, nullptr, safety);
             if (!rv_) return ::note::Unexpected(rv_.error());
             if (!nc_err_.empty()) return ApiResult<Response>(::note::ErrorInfo{::note::Error::Notecard, ::note::Cause::Unspecified, nc_err_.view()});
             if (exhausted_) return ApiResult<Response>(::note::ErrorInfo{::note::Error::Overflow, ::note::Cause::Unspecified, NOTE_ERR("arena exhausted")});
@@ -677,12 +678,12 @@ struct CardAuxSerial {
 
 #if NOTE_SINGLETON
         /// Singleton void execute — shared thunk, no per-type instantiation.
-        static inline Result<void>(*execute_void_fn_)(void*, ::note::string_view, BuildFn, void*, ::note::detail::NcErrorCapture&);
+        static inline Result<void>(*execute_void_fn_)(void*, ::note::string_view, BuildFn, void*, ::note::detail::NcErrorCapture&, ::note::Safety);
         ApiResult<void> execute() const {
             auto build_ = [&](JsonBuilder& b_) { this->build(b_); };
             BuildFn fn_ = [](JsonBuilder& b_, void* p_) { (*static_cast<decltype(build_)*>(p_))(b_); };
             ::note::detail::NcErrorCapture nc_err_;
-            auto rv_ = execute_void_fn_(nc_, notecard_request, fn_, &build_, nc_err_);
+            auto rv_ = execute_void_fn_(nc_, notecard_request, fn_, &build_, nc_err_, safety);
             if (!rv_) return ::note::Unexpected(rv_.error());
             if (!nc_err_.empty()) return ApiResult<void>(::note::ErrorInfo{::note::Error::Notecard, ::note::Cause::Unspecified, nc_err_.view()});
             return ApiResult<void>{};
@@ -869,12 +870,12 @@ struct CardAuxSerial {
 
 #if NOTE_SINGLETON
         /// Singleton void execute — shared thunk, no per-type instantiation.
-        static inline Result<void>(*execute_void_fn_)(void*, ::note::string_view, BuildFn, void*, ::note::detail::NcErrorCapture&);
+        static inline Result<void>(*execute_void_fn_)(void*, ::note::string_view, BuildFn, void*, ::note::detail::NcErrorCapture&, ::note::Safety);
         ApiResult<void> execute() const {
             auto build_ = [&](JsonBuilder& b_) { this->build(b_); };
             BuildFn fn_ = [](JsonBuilder& b_, void* p_) { (*static_cast<decltype(build_)*>(p_))(b_); };
             ::note::detail::NcErrorCapture nc_err_;
-            auto rv_ = execute_void_fn_(nc_, notecard_request, fn_, &build_, nc_err_);
+            auto rv_ = execute_void_fn_(nc_, notecard_request, fn_, &build_, nc_err_, safety);
             if (!rv_) return ::note::Unexpected(rv_.error());
             if (!nc_err_.empty()) return ApiResult<void>(::note::ErrorInfo{::note::Error::Notecard, ::note::Cause::Unspecified, nc_err_.view()});
             return ApiResult<void>{};
@@ -1020,12 +1021,12 @@ struct CardAuxSerial {
 
 #if NOTE_SINGLETON
         /// Singleton void execute — shared thunk, no per-type instantiation.
-        static inline Result<void>(*execute_void_fn_)(void*, ::note::string_view, BuildFn, void*, ::note::detail::NcErrorCapture&);
+        static inline Result<void>(*execute_void_fn_)(void*, ::note::string_view, BuildFn, void*, ::note::detail::NcErrorCapture&, ::note::Safety);
         ApiResult<void> execute() const {
             auto build_ = [&](JsonBuilder& b_) { this->build(b_); };
             BuildFn fn_ = [](JsonBuilder& b_, void* p_) { (*static_cast<decltype(build_)*>(p_))(b_); };
             ::note::detail::NcErrorCapture nc_err_;
-            auto rv_ = execute_void_fn_(nc_, notecard_request, fn_, &build_, nc_err_);
+            auto rv_ = execute_void_fn_(nc_, notecard_request, fn_, &build_, nc_err_, safety);
             if (!rv_) return ::note::Unexpected(rv_.error());
             if (!nc_err_.empty()) return ApiResult<void>(::note::ErrorInfo{::note::Error::Notecard, ::note::Cause::Unspecified, nc_err_.view()});
             return ApiResult<void>{};
@@ -1146,12 +1147,12 @@ struct CardAuxSerial {
 
 #if NOTE_SINGLETON
         /// Singleton void execute — shared thunk, no per-type instantiation.
-        static inline Result<void>(*execute_void_fn_)(void*, ::note::string_view, BuildFn, void*, ::note::detail::NcErrorCapture&);
+        static inline Result<void>(*execute_void_fn_)(void*, ::note::string_view, BuildFn, void*, ::note::detail::NcErrorCapture&, ::note::Safety);
         ApiResult<void> execute() const {
             auto build_ = [&](JsonBuilder& b_) { this->build(b_); };
             BuildFn fn_ = [](JsonBuilder& b_, void* p_) { (*static_cast<decltype(build_)*>(p_))(b_); };
             ::note::detail::NcErrorCapture nc_err_;
-            auto rv_ = execute_void_fn_(nc_, notecard_request, fn_, &build_, nc_err_);
+            auto rv_ = execute_void_fn_(nc_, notecard_request, fn_, &build_, nc_err_, safety);
             if (!rv_) return ::note::Unexpected(rv_.error());
             if (!nc_err_.empty()) return ApiResult<void>(::note::ErrorInfo{::note::Error::Notecard, ::note::Cause::Unspecified, nc_err_.view()});
             return ApiResult<void>{};