[ruoka]

endpointbuf::wait_for polled only the socket. When one recv brought two messages, the second sat in the get area and wait_for reported nothing readable until the peer sent more bytes: a FIX session (fixer) read the second of two back-to-back execution reports only after the peer's next heartbeat.

wait_for now returns true at once while unread bytes are buffered. The WebSocket close drain's comment no longer says wait_for polls only the socket.

It also pins cryptic v3.0.2. Since v3.0.0, one of the cryptic tests that net builds with its own used OpenSSL, so the Linux test runner failed to link and master's CI has been red since v3.5.0. v3.0.2 keeps OpenSSL inside cryptic's own build. Nothing net builds uses OpenSSL, so CI and the dev container no longer install libssl-dev.

The fix was written on the previous master, and fixer's history pins it there, so v3.5.0 comes in by a merge (it merged cleanly) rather than a rebase. Please merge this with a merge commit, not squash or rebase, so the commits fixer pins stay on master.

Testing

• New scenario "wait_for sees a message already buffered" (net/net-endpoint_stream.test.c++): the client sends first\nsecond\n in one write; after reading first, wait_for(200ms) must report second without the client sending more.
• ./tools/CB.sh debug test --jsonl=failures: 993/993 passed on this tree.
• CI on this branch: build-and-test (debug and release), static-analysis and submodule-check pass.

---

Note

Medium Risk
Changes stream readiness semantics for any code using endpointbuf::wait_for (including WebSocket close draining); behavior is more correct but callers that relied on the old socket-only poll may see earlier readiness.

Overview
endpointbuf::wait_for no longer polls only the socket: it returns true immediately when unread bytes remain in the streambuf get area (gptr() < egptr()), so a second message delivered in the same recv is visible without waiting for more peer traffic (regression tied to back-to-back FIX-style reads).

A new BDD scenario in net-endpoint_stream.test.c++ locks this in (first\nsecond\n in one write; wait_for after first must see second). The WebSocket close-drain comment is updated to match buffered-byte behavior.

Docs bump the deps/cryptic pin to v3.0.2 in README and docs/release-policy.md. libssl-dev is dropped from the devcontainer Dockerfile, the setup-llvm default package list, and the CI static-analysis LLVM install step.

^{Reviewed by Cursor Bugbot for commit 2ead0f4. Bugbot is set up for automated code reviews on this repo. Configure here.}