json: a single parse root that owns the error and recoverable flags

[Nitjsefnie]

What does this PR do?

Fixes #777. Adds eigs_json_parse_root, which owns the lifetime of both g_json_parse_err and the g_json_parse_recoverable channel #778 introduced, and migrates all six entry points you named — json_decode, json_path, and the four ext_http.c sites — onto it. Callers no longer touch the globals, so the wrapper becomes the single place that defines "fresh parse", which is the shape you prescribed on the issue.

The parser both sets and mid-parse checks g_json_parse_err, but only json_decode cleared it. A stale flag hit the array guard and the object guard, so the next same-thread parse truncated arrays after the first element and emptied objects on the first key.

Strict json_decode behaviour is unchanged — same flags cleared at the same point, same raise check. Verified rather than assumed: a 67-input differential corpus, including stateful poison/raise/recoverable sequences, is byte-identical before and after, as are all four other test_json*.eigs files.

Changes

• src/builtins.c — new eigs_json_parse_root; json_decode and json_path migrated.
• src/ext_http.c — the four JSON entry points migrated.
• tests/test_json_hard.eigs — JH118–JH127, placed mid-file after the JH81–93 lenient section.

Testing

• Build clean; full suite 3348/3348 passed, 0 failed; make asan exit 0 with the asan+ubsan binary clean under detect_leaks=1 across the test file, both demos and the corpus.
• The poisoning, before and after. Before: unterminated / (empty) / (empty) / 0. After: unterminated / bob / 30 / 3. The strict-raise variant is poisoned before and correct after in the same way.
• JH118–JH126 bite. With the production files reverted to upstream and the tests kept, all nine fail standalone with their own assert labels.
• JH127 is different, and worth stating precisely. It pins the g_json_parse_recoverable reset: delete only that line from the wrapper and it fails, keep it and it passes. It does not fail against upstream, and cannot — upstream's builtin_json_decode cleared both flags on its own entry, so the recoverable-stale case only becomes reachable once the resets move into the wrapper. It is a regression guard for this PR's own structure, not a reproduction of the original bug.
• The JH118–JH127 block ends with an unnumbered cleanup decode so the pre-existing JH94–97 don't become collateral failures when the block runs against unfixed code. That guard is verified both ways: with it, JH94–97 pass on unfixed code; without it, JH96 fails.

Two disclosures. make asan compiles ext_http.c out, so the four migrated HTTP sites had no local sanitizer coverage — CI's asan-http leg is what covers them. And I've left CHANGELOG.md alone, since the convention across recent merges here is mixed; happy to add an entry if you'd like one.

Related Issues and Pull Requests

Fixes #777

Bugs Discovered

• eigs_json_lint_allow_for is a seventh lenient JSON parse root and never clears g_json_parse_err, silently emptying the lint allow-list #797 eigs_json_lint_allow_for is a seventh lenient JSON parse root and never clears g_json_parse_err, silently emptying the lint allow-list

Your prescription named six entry points. Enumerating them across the tree turned up a seventh — eigs_json_lint_allow_for in src/lint.c — which is a live lenient root that also never clears the flag. I've left it unmigrated because it's outside what you specified and it isn't reachable from any shipped binary (--lint is one file per process, and the LSP goes through lint_collect); it is reachable for embedders using the public C API, and #797 has the reproducer. Say the word if you'd rather it came into this PR.

Checklist

• make test passes locally — full suite 3348/3348 passed, 0 failed; tests/test_json_hard.eigs run directly, rc=0
• New builtins have signature comments and docs in docs/BUILTINS.md — n/a, no new builtins; eigs_json_parse_root is internal
• New library functions follow conventions in docs/STDLIB.md — n/a
• New examples have a comment header explaining what they demonstrate — n/a
• CHANGELOG.md updated (if user-facing change) — not done, see the note above; happy to add one

Generated by Claude Opus 5 (brief, review), Kimi K3 (implementation, verification)

[InauguralPhysicist]

Verified locally on top of your branch:

• test_json_hard.eigs (JH118–127) green under ASan (detect_leaks=1), rc=0.
• Planted fault reproduced: with src/builtins.c/src/ext_http.c/src/eigenscript.h reverted to main and your tests kept, JH118 fails exactly as claimed ("lenient json_path after malformed json_path") — the poison shape is real and the tests bite.
• The single-owner wrapper is the right structure: the parser checks g_json_parse_err mid-parse, so per-caller resets were always going to rot; eigs_json_parse_root makes "fresh parse" a property of the entry point instead of caller discipline. JH127's precise framing (guards the wrapper's own recoverable reset, not the original bug) is exactly the honesty this repo wants in test comments.
• Good catch on the seventh root (#797) — agreed it's correctly out of scope here with the issue filed. One nit for whoever picks that up: the new eigenscript.h comment says parse_root is "the ONLY entry point", which becomes true only once #797 lands; fine to leave as aspiration since the issue tracks it.

CI 16/16 green including asan-http (which covers your four migrated HTTP sites — right call flagging that make asan alone doesn't). Merging. Two for two today — thanks.