v2.19.0 — remove retired Zone/Command/Controller/Registry model

[SoundMatt]

Summary

Closes #84, #85, #86, #87, #88, #74, #75 from the 2026-07-29 ecosystem audit. Does not close #89 (cpp-RCP-FS-06) — that's owned by a parallel PR rewriting rcp/acf.hpp's wire-format code, and this PR deliberately does not touch that file (not even additively) to avoid colliding with it.

rcp/rcp.hpp was still the primary compiled public API, defining the entire pre-TC18 placeholder protocol (Zone, Priority, CommandType, Command, Response, Status, Controller, LoaningController, Registry) alongside the real TC18 model. This PR deletes that surface and rebinds its last four live dependents onto TC18/RequestFn primitives.

#84 (cpp-RCP-FS-01) — retired model deleted from rcp.hpp

rcp.hpp now defines only what never depended on the retired model: the Errc sentinel category (minus zone_mismatch/ErrZoneMismatch, which had no TC18 analog), the Context alias, and Loan (a generic RAII buffer holder — kept because rcp/loan.hpp's BufferPool still depends on it directly and it carries no Zone/Command coupling; the audit manifest suggested removing it too, but issue #84's own finding text doesn't name it, so I read that as the more authoritative scope and kept it — flagging this judgment call for review).

#85 (cpp-RCP-FS-02) — README quick start rewritten

Quick start now builds an rcp::mock::Server, wraps its dispatch() as an rcp::RequestFn, and calls it through rcp::Adapt(). "## Zones"/"## Command types" sections, the legacy_mock.hpp/rcp.hpp core-table rows, and the ErrZoneMismatch error-table row are removed. Also cleaned up README rows for headers that don't exist (federation.hpp, firmware.hpp, proxy.hpp, zonegroup.hpp, canbr.hpp, linbr.hpp, prioqueue.hpp — deleted at earlier milestones per ROADMAP.md, but still documented as if present).

#86 (cpp-RCP-FS-03) — legacy_mock/redundancy/faultinject/config rebound

• config.hpp rebound first (per the issue's own ordering): ZoneManifestEntry/Manifest.zones/load(json, rcp::Registry&) → EndpointManifestEntry/Manifest.endpoints/load(json, shmem::Registry&), parsing a stream_key+byte_bus_id manifest and bootstrapping one shmem::Channel per distinct stream_key.
• legacy_mock.hpp deleted outright, along with tooling/zone_manifest_schema.json and tests/test_legacy_mock.cpp.
• faultinject::Controller → faultinject::Interceptor, wrapping an rcp::RequestFn instead of decorating rcp::Controller.
• redundancy::RedundantController → redundancy::RedundantRequestFn, holding a primary/standby pair of RequestFns.
• admin::AdminServer moved from Zone-keyed rcp::Registry reporting to stream-keyed rcp::shmem::Registry reporting (not named in the issue by number, but it's a direct compiled dependent of the deleted Registry/Zone types, so it had to move too — flagging for review since it's a judgment call, not mechanical).

None of the three preserve close()/zone()/subscribe() passthroughs that have no analog on a plain RequestFn (matching the "no analog in the target request/response shape" reasoning already used throughout this codebase for the seven other ADAPTed bridges).

#87 (cpp-RCP-FS-04) — test suite re-certified

test_rcp.cpp no longer certifies Zone::FrontLeft==1/CommandType::Set==1/Priority ordering. It now covers what rcp.hpp actually defines (Errc sentinels, Context, Loan's release-exactly-once contract) plus two supplementary TC18 checks (avtp::ByteBusId's single-byte range, AcfMessageInfo's zero-value defaults) that don't duplicate test_acf.cpp/test_avtp.cpp's own much larger suites. bench_mock.cpp/command_latency_test.cpp (not named in the issue, but both compiled directly against legacy_mock::Controller) are rebound to benchmark/time rcp::mock::Server::dispatch() instead.

#88 (cpp-RCP-FS-05) — Message.id fixed to plain decimal ByteBusID

endpoint_id_to_relay_id/relay_id_to_endpoint_id/response_to_message/message_to_request drop the stream_key parameter. RELAY spec v2.0 §15.7.5 defines relay.Message.ID for RCP as just the decimal ByteBusID string (e.g. "9"), with the StreamID carried by the Caller/connection instance itself (§8.5: one StreamID per Caller), not folded into the ID. cli.hpp's send keeps its --server/--endpoint flags unchanged for CLI compatibility, but --server is now validated for shape only and no longer echoed into the constructed relay::Message — it never actually selected among multiple backends even before this fix (the CLI's demo backend was already a single hardcoded mock::Server), only its string representation in id changes here.

#74 (cpp-RCP-05) — spec version bumped, citations re-verified

kRelaySpecVersion bumped "1.11" → "2.0" (current stable, spec/version.json). I re-read every in-repo RELAY-spec §-citation against the current spec text rather than guessing: avtp.hpp/acf.hpp's §13.7.2 module-name-registry citations and rcp.hpp's §18.2 Context/StatusChannel citations both still match section content actually present in v2.0, so the issue's specific claim that those citations are stale doesn't hold up — I left them as-is and note this explicitly rather than "fixing" something that wasn't broken.

#75 (cpp-RCP-07) — "loaning" dropped from capabilities

capabilities_json() no longer reports "loaning" in features.

Deliberately left unresolved / simplified

• [cpp-RCP-FS-06] Canonical ControlFlags type and Message frame struct are absent #89/cpp-RCP-FS-06 is out of scope — see above.
• A new RELAY §8.5-shaped Controller interface (StreamID(), Request(ctx, addr, control, body)) is not introduced. None of the issues this PR closes ask for it, and rcp::RequestFn already covers the "client-side send-equivalent call" role every other decorator in this tree standardizes on. Worth a follow-up issue if the ecosystem wants formal parity with go-RCP's Controller.
• RELAY spec §18.2's own C++ binding section still describes rcp::StatusChannel = relay::Channel<Status> as "already implemented" — that's a documentation lag in the RELAY spec itself (§15.5's breaking-change note retires Status, but §18.2 wasn't updated to match), not something fixable from the cpp-RCP side.
• clang-tidy could not be run exactly as CI's own step does: there's no .clang-tidy config committed, so clang-tidy -p build --warnings-as-errors='*' with no explicit --checks reports "no checks enabled" and exits nonzero before analyzing anything — CI's own step already masks this with || true. I ran a representative --checks='clang-diagnostic-*,clang-analyzer-*,bugprone-*,performance-*' against every file this PR touches; the only hits are Catch2's own TEST_CASE static-registration pattern (present identically in every test file in the tree) and a couple of bugprone-branch-clone/bugprone-std-namespace-modification hits on switch/namespace-specialization shapes carried over unchanged from the pre-existing code — nothing new introduced by this PR.
• cpfusa check/lint/trace and RELAY conform --strict were not run locally — the cpfusa binary is built from a separate repo in CI (cpfusa-build job) and wasn't available in this environment. I hand-verified that every id in the resulting .fusa-reqs.json (364 entries) has exactly one fusa:req and one fusa:test tag somewhere in the tree, matching the shape cpfusa trace --req-coverage 100 checks for, but this should be confirmed by CI.

Build/test commands run

cmake -B build -DCMAKE_BUILD_TYPE=Debug -G Ninja
cmake --build build --parallel     # 0 errors
ctest --test-dir build --output-on-failure   # 52/52 passed (was 53; rcp_legacy_mock target removed)

Verification grep (per the task spec) returns nothing outside comments/a test-case description string:

grep -rn "rcp::Zone\|rcp::Command\b\|rcp::CommandType\|rcp::Response\b\|rcp::Status\b\|rcp::Controller\b\|rcp::Registry\b\|LoaningController" include/ tests/ cli/ README.md

See ROADMAP.md's new "Retired-model residue cleanup (2026-07-30, v2.19.0)" entry for full narrative detail matching this repo's own changelog convention.

Not merging — leaving open for review, especially around the config.hpp/admin.hpp/faultinject.hpp/redundancy.hpp rebind decisions and the Loan-kept judgment call.