[tap]

What this changes

Roadmap A3 (docs/ROADMAP.md, row P4). Each engine now has a noexcept validate(...) that returns the rejection reason as a const char*, or nullptr when the converter will construct. The constructors reject with that same text through tap::dsp::raise (tap/DspTap#59): it throws where the build has exceptions and calls std::terminate() where it does not. Every public header now compiles under -fno-exceptions. The family's error model is written down as PLAN.md D17.

• async: config::validate(cfg). It also covers what the bank's designer rejects and the FIFO's high-water relation, so a config that validates constructs with no throw other than bad_alloc. polyphase_filter.h rejects through raise.
• bridge: basic_converter<S, D, K>::validate(channels, profile), built on validate_profile<D, K>.
• rational: basic_stage<S, R>::validate(channels, profile) and basic_chain<...>::validate(channels, profile) (the stages are checked at their design divisors; the first reason wins). design.h's validate(profile) now returns the reason instead of throwing. A spec that no filter length meets still raises std::runtime_error (k_unmeetable_spec_reason).
• C ABIs (all three): validate before constructing and return NULL. They keep their catch (for a refused allocation) only under TAP_DSP_HAS_EXCEPTIONS.
• Pico firmwares (pico2_cyccnt, pico2_dualcore): they call validate first, then construct. They build with the SDK's default -fno-exceptions (-DPICO_CXX_ENABLE_EXCEPTIONS=0) and still build with exceptions on.
• Gates:
  • <engine>.Family.HeadersCompileWithoutExceptions: every public header compiled in its own translation unit under -fno-exceptions, on hosted GCC and Clang.
  • A new no-exceptions CI job: clang, every engine and the three C ABIs, warnings fatal.
  • The Pico job builds each firmware a second time with exceptions off.
• DspTap pin: moved to 6eaca2d (expects.h: tap::dsp::raise, the construction-time rejection without exceptions DspTap#59 as merged on its main).

Why

Every engine's constructor rejected a bad configuration by throwing, so no header compiled under -fno-exceptions. That flag is the default of the Pico SDK, Zephyr and most Cortex-M firmware trees, and our own Pico firmwares had to force exceptions on. Firmware needs a way to reject a configuration without exceptions, and hosts should keep the exception they rely on today.

Verification

All of this was run locally on this branch's head, which is main 442a09b (A1 merged) plus this PR's commits:

• Host build, clang, warnings fatal on all three engines: 298/298 ctest pass, including the three HeadersCompileWithoutExceptions entries.
• The no-exceptions job's configure, run by hand (clang, -fno-exceptions, the three C ABIs on, warnings fatal): builds clean.
• scripts/check_retired_words.py: clean.
• clang-format: clean on every changed C/C++ file.
• Before the branch restart (same tree apart from the base): clang-tidy clean on the changed translation units, and both Pico firmwares built both ways (with exceptions and without).
• Tests: in every engine, validate() agrees with the constructor on every rejection. It returns the same text the exception carries, and nullptr exactly where construction succeeds (async ValidateAgreesWithTheConstructorOnEveryRejection covers 16 rejections; bridge has Converter.ValidateAgreesWithTheConstructor; rational has Stage and Chain versions). The existing throw tests now also pin the texts.
• Ratchet (scripts/icount.py, gcc-arm-none-eabi 13.2.1 and qemu-system-arm 8.2.2 for M33/M55, CodeLinaro clang 19.1.5 and qemu-hexagon 8.2.2 for Hexagon):
  • rational: re-measured after the restart against the A1 baselines. Every row is exact on M33, M55 and Hexagon.
  • bridge: exact on every target.
  • async: every row moves by one construction-side constant per target (M55 +37, Hexagon +32 to +34, M33 +182 instructions). That is the precheck's cost at construction, inside tolerance, so the baselines are not re-recorded.
• Rational M33 battery under qemu, run locally: passes in 9 min 2 s, with Stage.ValidateAgreesWithTheConstructor at 57 s.
• CI: all 31 checks green on 3aa9faa, including Windows MSVC, macOS and the arm64 leg, which were never run locally.

Notes for the reviewer

• Contract change. tap::sr::rational::validate(profile) used to return void and throw; it now returns the reason and never throws. A caller that relied on it throwing must now test its result. The constructors still throw the same types with the same texts on hosts. Under -fno-exceptions a rejected construction terminates, so firmware calls validate() first.
• Submodule pin moved. submodules/dsptap now points at 6eaca2d, expects.h: tap::dsp::raise, the construction-time rejection without exceptions DspTap#59 as merged on DspTap's main, so the pin is already reachable after branch cleanup.
• A finding (in rational/PLAN.md §6). The first version of DspTap's raise was an out-of-line [[noreturn]] template. That was enough for GCC to stop inlining rational's stage constructor, which then stopped feeding the channel count into the streaming loops as a constant. The cost was +11 to +37 % on the M55 rows and +16 to +51 % on the M33 Q15 rows. Forcing raise inline (DspTap's TAP_DSP_RAISE_INLINE) brings every row back to exact. So this engine's ratchet is sensitive to inlining decisions at construction, and future constructor changes should keep that in mind.
• Three CI fixes after the first push, each its own commit:
  • d218cb7: rational/tests/test_matrix.cpp builds with /bigobj under MSVC only. A3's new functions took its 182 instantiations past COFF's section limit (C1128).
  • c8843f5: the Hexagon legs now skip every ValidateAgrees* test, alongside the other throwing tests, because qemu-hexagon's static-musl toolchain cannot unwind a throw. book/src/part4/hexagon.md's ctest command has the same change.
  • 3aa9faa: the unmeetable-spec case moves into its own test, Stage.ValidateAgreesWithTheConstructorOnAnUnmeetableSpec, and the bare-metal legs skip it beside Design.UnmeetableSpecThrows. It searches the design grid for every filter length twice, and on the M33's soft-float double that outlasted the 20-minute job.
• The roadmap marks A3 landed and P4 ✓ for all three engines. The Hexagon throw is documented in async/docs/PERFORMANCE.md and async/PLAN.md: A3 makes it unreachable in an embedded deployment, and A2's time-boxed unwinder attempt is still open.

🤖 Generated with Claude Code

https://claude.ai/code/session_016GKzq1VSdcMYCRMhddiMaf