Prevent coalesced libuv wakes from stranding inbound reads

[Copilot]

On libuv before 1.53, an admission wake can be coalesced after the callback has consumed its recheck flag, potentially leaving paused reads idle until another event. This is a portable liveness risk, not a reproduced failure or lost response data.

• Ordering: Publish and consume the recheck flag under the existing queue mutex. The callback either sees the request, or its mutex release orders libuv's pending-bit clear before the next send.

  {
    ccf::ds::MutexGuard g(self->out_mutex);
    self->recheck_read_interest = true;
  }
  self->wake();

• Regression: Extend the real-socket test so one interface releases the inbound budget and another resumes without new client traffic.
• Documentation: Record the reduced ordering argument and update the release note.

Verified libuv versions

Checked on 2026-10-05 against Microsoft's official x86_64 package repositories:

Platform	libuv version	Published RPM version-release
Azure Linux 3.0	1.48.0	1.48.0-1.azl3
Azure Linux 4.0 (beta repository)	1.52.0	1.52.0-2.azl4

For Azure Linux 3, the downloaded RPM header was queried with rpm -qp. For Azure Linux 4, the installed libuv and libuv-devel RPM versions, pkg-config --modversion libuv, and the loaded library's uv_version_string() all agreed with the published package. CCF's setup scripts install the distribution's libuv-devel without an exact version pin, so this table records the verified packages rather than a guarantee for every installed system.

Both versions are below the 1.53 threshold discussed above. Their version-tagged upstream documentation explicitly warns that multiple uv_async_send() calls before a callback can yield only one callback (libuv 1.48.0, libuv 1.52.0). Coalesced notifications are therefore relevant to both environments; this does not claim that the stalled-read failure has been reproduced.

Closes #8436

• Fixes Investigate possible missed admission-resumption wakeup with libuv before 1.53 #8436

[Copilot]

Copilot review overview

🔵 Needs a closer look

The concurrency-sensitive ordering around older libuv versions warrants final human review.

Review effort: Balanced
Findings: None

What changed in this PR

Prevents older libuv notification coalescing from leaving inbound reads paused.

Changes:

• Protects admission rechecks with the output queue mutex.
• Adds cross-interface socket regression coverage.
• Documents the ordering and prepares release 7.0.19.

Custom instructions used

• .github/copilot-instructions.md
• .github/instructions/reviewing.instructions.md
• .github/instructions/changelog.instructions.md
• .github/skills/testing/SKILL.md

File	Description
src/​tls/​openssl_server.h	Synchronizes recheck publication and consumption.
src/​tls/​test/​openssl_server_test.cpp	Tests cross-interface budget resumption.
doc/​architecture/​tls_internals.rst	Documents the mutex ordering argument.
CHANGELOG.md	Adds the 7.0.19 fix entry.
python/​pyproject.toml	Bumps the SDK version to 7.0.19.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.