test: regression test for #223 (serial hook must not receive c_newline)

.cursor/rules/architecture-docs.mdc

@@ -0,0 +1,18 @@
+---
+description: Keep architecture documentation current with code changes
+globs:
+  - "**/*"
+alwaysApply: true
+---
+
+Before non-trivial code changes, read the repository architecture context:
+
+- `AGENTS.md`
+- `ARCHITECTURE.md`
+- `docs/architecture/architecture.html` when a visual graph or traversal overview helps
+- Relevant files under `docs/architecture/`
+- `source-research/research-index.md` and relevant source-research artifacts for architecture, dependency, public API, hook, transport, runtime-flow, build-variant, or broad code-generation work
+
+When a change affects module boundaries, public APIs, hook signatures, dependencies, data/control flow, transport behavior, runtime assumptions, or build/test strategy, update the closest relevant architecture docs in the same change. Keep the Markdown docs and `docs/architecture/architecture.html` synchronized when applicable. Update `source-research/` when the same change affects source-derived behavior, dependencies, public APIs, hooks, runtime flow, build variants, or architecture claims.
+
+If no architecture doc update is needed, say so explicitly in the final response or PR notes.

.devcontainer/ci/Dockerfile

@@ -26,19 +26,24 @@ ENV LC_ALL="C.UTF-8"
 
 # Create Non-Root User
 RUN ["dash", "-c", "\
-    addgroup \
-     --gid ${UID} \
-     \"${USER}\" \
- && adduser \
-     --disabled-password \
-     --gecos \"\" \
-     --ingroup \"${USER}\" \
-     --uid ${UID} \
-     \"${USER}\" \
+    groupadd \
+      --gid ${UID} \
+      \"${USER}\" \
+ && useradd \
+      --uid ${UID} \
+      --gid ${UID} \
+      --no-create-home \
+      --shell /bin/bash \
+      --comment \"\" \
+      \"${USER}\" \
+ && mkdir -p /home/\"${USER}\" \
+ && chown \"${USER}\":\"${USER}\" /home/\"${USER}\" \
+ && groupadd \
+      --force gpio \
  && usermod \
-     --append \
-     --groups \"dialout,plugdev\" \
-     \"${USER}\" \
+      --append \
+      --groups dialout,gpio,plugdev \
+      \"${USER}\" \
 "]
 
 # Add 32-bit binaries to the index.
@@ -61,6 +66,7 @@ RUN ["dash", "-c", "\
      git \
      lcov \
      libc6-dbg:i386 \
+     libjson-xs-perl \
      make \
      nano \
      python3-pip \

.github/copilot-instructions.md

@@ -0,0 +1,13 @@
+# Copilot Instructions
+
+Before making non-trivial code changes in this repository, read:
+
+- `AGENTS.md`
+- `ARCHITECTURE.md`
+- `docs/architecture/architecture.html` when a visual graph or traversal overview helps
+- Relevant files under `docs/architecture/`
+- `source-research/research-index.md` and relevant source-research artifacts for architecture, dependency, public API, hook, transport, runtime-flow, build-variant, or broad code-generation work
+
+Keep architecture documentation current with code changes. Update the closest relevant architecture file when a change affects boundaries, public APIs, hook signatures, dependencies, data/control flow, transport behavior, runtime assumptions, or build/test strategy. Keep the Markdown docs and `docs/architecture/architecture.html` synchronized when applicable. Update `source-research/` when the same change affects source-derived behavior, dependencies, public APIs, hooks, runtime flow, build variants, or architecture claims.
+
+If a change is implementation-only and does not require architecture doc updates, mention that explicitly in PR notes.

.github/workflows/ci.yml

@@ -5,6 +5,13 @@ on:
     branches: [ master ]
   pull_request:
     branches: [ master ]
+  workflow_dispatch:
+    inputs:
+      force_build:
+        description: 'Force rebuild and publish Docker image (even if Dockerfile unchanged)'
+        required: false
+        type: boolean
+        default: false
 
 jobs:
   check_dockerfile_changed:
@@ -30,7 +37,7 @@ jobs:
   build_ci_docker_image:
     runs-on: ubuntu-latest
     needs: [check_dockerfile_changed]
-    if: ${{ needs.check_dockerfile_changed.outputs.changed == 'true' }}
+    if: ${{ needs.check_dockerfile_changed.outputs.changed == 'true' || inputs.force_build == true }}
 
     steps:
       - name: Checkout code
@@ -61,6 +68,24 @@ jobs:
           name: note_c_ci_image
           path: /tmp/note_c_ci_image.tar
 
+  check_architecture_docs:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Check architecture docs do not reference removed JSON map
+        run: |
+          architecture_json_pattern='architecture[.]''json'
+          embed_script_pattern='embed-architecture''-json'
+          for pattern in "$architecture_json_pattern" "$embed_script_pattern"; do
+            ! grep -R "$pattern" \
+              AGENTS.md ARCHITECTURE.md CLAUDE.md GEMINI.md \
+              .github/copilot-instructions.md .cursor/rules/architecture-docs.mdc \
+              docs
+          done
+
   build_docs:
     runs-on: ubuntu-latest
     if: ${{ always() }}
@@ -99,6 +124,22 @@ jobs:
         run: |
           docker run --rm --volume $(pwd):/note-c/ --workdir /note-c/ --entrypoint ./scripts/check_libc_dependencies.sh ghcr.io/blues/note_c_ci:latest
 
+  run_integration_tests:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Configure add_subdirectory integration test
+        run: cmake -S test/integration -B build-integration
+
+      - name: Build add_subdirectory integration test
+        run: cmake --build build-integration --parallel $(nproc)
+
+      - name: Run add_subdirectory integration test
+        run: ctest --test-dir build-integration --output-on-failure
+
   run_unit_tests:
     runs-on: ubuntu-latest
     if: ${{ always() }}
@@ -188,26 +229,55 @@ jobs:
         run: |
           docker run --rm --volume $(pwd):/note-c/ --workdir /note-c/ --entrypoint ./scripts/run_cppcheck.sh ghcr.io/blues/note_c_ci:latest
 
+  run_macos_unit_tests:
+    # Stay on macos-latest (currently macOS 26 / Xcode 26.5). Integer limit
+    # comparisons in n_cjson.c / n_ftoa.c use explicit (JNUMBER) casts so
+    # AppleClang -Wimplicit-const-int-float-conversion does not fail -Werror.
+    runs-on: macos-latest
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Configure
+        run: cmake -B build -DNOTE_C_BUILD_TESTS=ON
+
+      - name: Build
+        run: cmake --build build --parallel $(sysctl -n hw.ncpu)
+
+      # NOTE: ctest is not run here. A subset of tests that rely on FFF
+      # symbol interposition fail on macOS due to two-level namespace
+      # linking. The build step above verifies that all sources and tests
+      # compile and link successfully.
+      #
+      # Even with -Wl,-flat_namespace, intra-library calls within the
+      # note_c dylib are resolved at link time as direct calls, so FFF
+      # fakes in the test executable cannot interpose them. Fully fixing
+      # this would require linking note-c as a static library for tests
+      # or using a different mocking approach on macOS.
+
   publish_ci_image:
     runs-on: ubuntu-latest
     # Make sure unit tests unit tests passed before publishing.
     needs: [build_ci_docker_image, run_unit_tests]
-    # Only publish the image if this is a push event and the Docker image was rebuilt
-    if: ${{ github.event_name == 'push' && needs.build_ci_docker_image.result == 'success' }}
+    # Only publish the image if this is a push event (or manual trigger with force_build) and the Docker image was rebuilt
+    if: ${{ (github.event_name == 'push' || (github.event_name == 'workflow_dispatch' && inputs.force_build == true)) && needs.build_ci_docker_image.result == 'success' }}
 
     steps:
+      - name: Download image artifact
+        uses: actions/download-artifact@v4
+        with:
+          name: note_c_ci_image
+          path: /tmp
+
       - name: Login to GitHub Container Registry
         uses: docker/login-action@v2
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v2
-
-      - name: Push image to registry
-        uses: docker/build-push-action@v4
-        with:
-          push: true
-          tags: ghcr.io/blues/note_c_ci:latest
+      - name: Load and push image
+        run: |
+          docker load --input /tmp/note_c_ci_image.tar
+          docker push ghcr.io/blues/note_c_ci:latest