feat(kernel): R7a C/C++ walker — dual-lang ccpp module, preParse hoist, 7 new blanks, c/cpp default-routed (#1346)

Parity: 0 diffs on redis/git/fmt/protobuf/ALS sweeps; full-init dumps
byte-identical on all five + linux at kernel scale (10.4M dump lines,
same sha256 both arms). Linux 2c/6GB envelope: kernel-arm 19.1min vs
wasm-arm 22.9min (parse 356s vs 435s) on a much richer graph (the new
blanks recover error-swallowed code: git 2x nodes, linux kernel/+mm/ 3x).
Deferral guard corrected by measurement (C/C++ error incidence 9-42%;
--max-deferral flag); defer-reuse memo kills the 3x re-blank/re-parse
cost deferred files paid.

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

__tests__/fixtures/kernel-parity/torture.c

@@ -0,0 +1,84 @@
+/* Torture fixture for the C kernel walker (R7a) — exercises every c-path
+ * branch of the checklist: fn-ptr tables, typedef enum/struct, file-scope
+ * consts incl. multi-declarator, the macro-prototype misparse skip,
+ * value-refs (+ shadow prune), the leading-attr-macro preParse blank, and
+ * the C call shapes. Must parse ERROR-FREE post-preParse or the kernel arm
+ * defers. */
+#include <stdio.h>
+#include <sys/socket.h>
+#include "local_ops.h"
+
+/** Retry budget for the poller. */
+static const int MAX_RETRIES = 3;
+static const int LOW_WATER = 2, HIGH_WATER = 8;
+static int counter = 0;
+static const char *BANNER = "torture";
+
+/* Bare identifier declarators are the macro-prototype misparse shape and are
+ * skipped by design (uninit scalars are the accepted loss). */
+int bare_global;
+MYLIB_API config_handle;
+
+/* Leading attribute macro — blanked by preParseCSource (#1211), so the real
+ * name survives on both arms. */
+SEC_ATTR UINT32 masked_entry(VOID) { return 0; }
+
+typedef enum { STATE_IDLE, STATE_RUNNING, STATE_DONE } run_state_t;
+
+typedef struct {
+  int fd;
+  void (*on_recv)(int);
+} conn_t;
+
+typedef struct conn_pool conn_pool_t;
+
+typedef int (*cb_t)(int);
+
+enum wire_flags { WIRE_A = 1, WIRE_B = 2 };
+
+struct packet {
+  int len;
+  unsigned char body[64];
+  struct packet *next;
+  cb_t *async_cb;
+};
+
+/** Sum helper (docstring). */
+static int add(int a, int b) { return a + b; }
+
+static int cb_a(int x) { return add(x, 1); }
+static int cb_b(int x) { return add(x, 2); }
+
+/* fn-ptr table at file scope — the ungated 'list' capture positions. */
+static cb_t DISPATCH_TABLE[] = { cb_a, cb_b };
+
+static void handle_recv(int fd);
+
+/* struct initializer — the ungated 'value' capture positions. */
+static const struct handler_ops OPS = { .recv = handle_recv, .flags = WIRE_A };
+
+static void handle_recv(int fd) {
+  struct packet pkt;
+  pkt.len = fd;
+  printf("fd=%d retries=%d\n", fd, MAX_RETRIES);
+}
+
+/* Local shadow of a file-scope const — the shadow prune drops HIGH_WATER as a
+ * value-ref target while LOW_WATER stays live. */
+static int shadowed_reader(void) {
+  int HIGH_WATER = 99;
+  return HIGH_WATER + LOW_WATER;
+}
+
+static int use_table(int idx, int v) {
+  cb_t fn = DISPATCH_TABLE[idx];
+  int r = (*fn)(v);
+  conn_t c = { 1, 0 };
+  c.on_recv(r);
+  return counter + r;
+}
+
+static void spawn_workers(void) {
+  register_handler(cb_a);
+  signal_connect(&cb_b);
+}

__tests__/fixtures/kernel-parity/torture.cpp

@@ -0,0 +1,140 @@
+/// Torture fixture for the C++ kernel walker (R7a) — namespaces (incl. C++17
+/// nested + anonymous), out-of-line Cls::method defs, templates + template
+/// bases, operator definitions, stack construction, local fn-ptrs, UE-macro
+/// shapes THROUGH the hoisted preParse, using-aliases, access specifiers,
+/// static-member value reads, and the cpp call shapes. Must parse ERROR-FREE
+/// post-preParse or the kernel arm defers (spaced operator CALL SITES live in
+/// torture-defer.cpp — they produce ERROR nodes by design).
+#include <vector>
+#include "widget_base.hpp"
+
+namespace app {
+
+/** Engine config (docstring). */
+class Config {
+public:
+  int retries;
+  void apply();
+  int helper_count() const { return 2; }
+
+private:
+  int secret;
+};
+
+void Config::apply() { retries = helper_count(); }
+
+namespace detail {
+struct Counter {
+  int value;
+  Counter *next;
+};
+}  // namespace detail
+
+int detail_probe() { return 1; }
+
+}  // namespace app
+
+namespace app::net {
+class Session {
+public:
+  void open();
+  virtual ~Session() {}
+};
+void Session::open() {}
+}  // namespace app::net
+
+namespace {
+int hidden_helper() { return 3; }
+}  // namespace
+
+template <typename T>
+class Base {
+public:
+  T item;
+};
+
+template <typename T>
+class Box : public Base<T> {
+public:
+  T get() const { return value_; }
+  T unwrap();
+
+private:
+  T value_;
+};
+
+template <typename T>
+T Box<T>::unwrap() {
+  return value_;
+}
+
+class Derived : public Base<int>, private app::Config {
+public:
+  Derived() : total_(0) {}
+  int total() const { return total_; }
+
+private:
+  int total_;
+};
+
+struct Vec2 {
+  float x, y;
+  Vec2 operator+(const Vec2 &o) const { return {x + o.x, y + o.y}; }
+  explicit operator bool() const { return x != 0 || y != 0; }
+  Vec2 origin();
+};
+
+enum class Mode : unsigned char { Off, On };
+enum Legacy { LEGACY_A, LEGACY_B };
+typedef struct {
+  int id;
+} packet_t;
+using Handle = app::Config;
+
+// UE-macro shapes — every one below is recovered by the hoisted preParse
+// (export macro, reflection markup, inline specifier, API member prefix).
+class MYMODULE_API Widget : public app::Config {
+public:
+  UPROPERTY(EditAnywhere, Category = "State")
+  float Health;
+  FORCEINLINE float GetHealth() const { return Health; }
+  ENGINE_API virtual void Tick(float Delta);
+};
+
+void Widget::Tick(float Delta) { Health += Delta; }
+
+Config GlobalConfig;
+int build_number = 7;
+
+template <typename T>
+T compute_seed(T v) {
+  return v + 1;
+}
+
+float drive_helper(float v) { return v; }
+
+Widget *make_widget() { return new Widget(); }
+
+float drive() {
+  Widget local;
+  app::Config cfg;
+  Vec2 a{1, 2};
+  Vec2 b(a);
+  Vec2 c2(1.5f, 2.5f);
+  float f = a.x + b.y + c2.x;
+  make_widget()->Tick(0.5f);
+  auto kernel = &compute_seed<float>;
+  if (f > 1) {
+    kernel = &drive_helper;
+  }
+  float r = kernel(f);
+  int flags = GlobalConfig.retries;
+  Mode m = Mode::Off;
+  int leg = LEGACY_A;
+  app::detail_probe();
+  compute_seed<int>(2);
+  auto mp = &app::Config::apply;
+  (void)mp;
+  (void)m;
+  return r + f + flags + leg;
+}

__tests__/fixtures/kernel-parity/torture.hpp

@@ -0,0 +1,31 @@
+// Torture header for the C++ kernel walker (R7a) — include guard, forward
+// declarations (skipped, #1093), extern "C" prototypes, header templates,
+// and a UE-reflection-shaped class recovered by the hoisted preParse.
+#ifndef TORTURE_HPP
+#define TORTURE_HPP
+
+class Forward;
+struct Opaque;
+
+extern "C" {
+int c_bridge(int value);
+}
+
+/// Reusable clamp helper.
+template <typename T>
+T clamp_value(T v, T lo, T hi) {
+  return v < lo ? lo : (v > hi ? hi : v);
+}
+
+class MYLIB_API Meter : public Forward {
+public:
+  UPROPERTY(BlueprintReadOnly)
+  int Reading;
+  FORCEINLINE int Peek() const { return Reading; }
+  void Calibrate(int target);
+  Forward *owner();
+};
+
+inline void Meter::Calibrate(int target) { Reading = clamp_value(target, 0, 100); }
+
+#endif