refactor: refcounted CRDT lifecycle, drop arena

[vieiralucas]

Convert the CRDT core from arena-lifetime ownership to refcount + displacement, then remove the arena allocator.

• Counter, Register, Element, Map: arena → host_malloc + refcount
• Refcount lifecycle: *_acquire / *_release, freed at refcount 0
• Displacement signal: *_displace / *_is_displaced — marks a handle evicted from its slot (the Doc layer skips op emission on orphaned handles)
• Element forwards lifecycle to its composite by kind (SCALAR: no-op acquire/displace, scalar_free on release)
• Map slots use Share semantics: accepted map_set acquires its own ref, so the caller always retains and releases its own handle; eviction displaces+releases the loser; map_get and helper install return borrows; helper detached path returns an owned, born-displaced handle
• Drop arena: hashtable_create() / scalar_clone(value) lose the Arena* param (host_malloc only); delete arena.c / arena.h / test_arena.c + the dual-mode test groups
• Tests cover refcount/displace/borrow/detached; verified under ASan (no use-after-free / double-free)

macOS ASan ships no LeakSanitizer, so the leak class needs Linux ASan+LSan in CI.

---

Summary by cubic

Refactored the CRDT core from arena-backed lifetime to refcounted host_malloc with acquire/release/displace, and switched Map to Share semantics. Fixed tombstone and scalar-string leaks, and avoided displacing on same-pointer re-sets; CI now runs Linux ASan+UBSan+LSan to gate leaks.

• Refactors

  • Counter, Register, Map: host-allocated with refcount=1 on *_create, *_acquire/*_release, and *_displace/*_is_displaced; free internals at refcount 0; displacement is independent of refcount.
  • Element: forwards acquire/release/displace by kind; element_clone returns refcount=1 children; SCALAR release frees string bytes.
  • Map (Share semantics): accepted map_set acquires a slot ref; map_get returns borrows; eviction displaces+releases the loser; detached path returns an owned, born-displaced handle; deep clones on LWW replace; map_release recursively drops slot refs.
  • HashTable: hashtable_create() now uses host_malloc; added hashtable_destroy(); nodes and key copies are freed on destroy/clear/remove.
  • Scalar: scalar_clone(value) allocates bytes via host_malloc (empty strings pass through); scalar_free releases them.
  • Dropped arena: removed arena.c/.h and tests; removed arena.h includes; tests/Makefile updated; added Linux CI job running ASan+UBSan+LSan.

• Bug Fixes

  • Map tombstones: never release an uninitialized/tombstone slot; seed tombstones with a null-scalar to prevent refcount underflow.
  • Same-pointer overwrite: map_set no longer displaces or releases when writing the exact composite already installed; only advances the stamp.
  • Leak fixes: free scalar-string storage on SCALAR release; in map_merge release LWW losers and drop the extra element_clone ref; tests now release/destroy handles so the suite is leak-free.
  • Safety/API: map_release aborts on refcount-zero before decrementing; map_is_displaced takes const Map *; element.h documents SCALAR release is valid only for owned scalars; register.h docs updated.

^{Written for commit ec20fe5. Summary will update on new commits.}

[Copilot]

Pull request overview

Copilot reviewed 25 out of 26 changed files in this pull request and generated no new comments.

Comments suppressed due to low confidence (1)

hashtable.c:62

• _hashtable_insert treats host_malloc(key_len) returning NULL as OOM. For key_len==0, malloc(0) is implementation-defined and may return NULL even when allocation succeeds logically, which would make zero-length keys impossible on some platforms. scalar_clone already special-cases len==0 for this exact portability reason; hashtable should do the same (e.g., allocate 1 byte when key_len==0 and skip memcpy).

    node->key = host_malloc(key_len);
    if (!node->key) {
        host_free(node);
        return HASHTABLE_ERR_OOM;
    }

    memcpy(node->key, key, key_len);
    node->value = value;