From 83b33e90f5a86259c406d9f62d3120ebf3902c6b Mon Sep 17 00:00:00 2001
From: Stephen Berry <stephenberry.developer@gmail.com>
Date: Tue, 7 Apr 2026 21:17:38 -0500
Subject: [PATCH 01/41] msys2-mingw-ssl error replication test

---
 .github/workflows/msys2-ssl.yml | 66 +++++++++++++++++++++++++++++++++
 1 file changed, 66 insertions(+)
 create mode 100644 .github/workflows/msys2-ssl.yml

diff --git a/.github/workflows/msys2-ssl.yml b/.github/workflows/msys2-ssl.yml
new file mode 100644
index 0000000000..aca96432ba
--- /dev/null
+++ b/.github/workflows/msys2-ssl.yml
@@ -0,0 +1,66 @@
+name: msys2-mingw-ssl
+
+on:
+  push:
+    branches:
+      - main
+      - feature/*
+    paths-ignore:
+      - '**/*.md'
+      - 'docs/**'
+  pull_request:
+    branches:
+      - main
+    paths-ignore:
+      - '**/*.md'
+      - 'docs/**'
+  workflow_dispatch:
+
+env:
+  BUILD_TYPE: Release
+
+jobs:
+  build:
+    name: MinGW64 + SSL (ws:// and wss://)
+    runs-on: windows-latest
+    defaults:
+      run:
+        shell: msys2 {0}
+
+    steps:
+    - uses: actions/checkout@v6
+
+    - uses: msys2/setup-msys2@v2
+      with:
+        update: true
+        msystem: MINGW64
+        install: >-
+          mingw-w64-x86_64-cmake
+          mingw-w64-x86_64-ninja
+          mingw-w64-x86_64-gcc
+          mingw-w64-x86_64-openssl
+
+    - name: Configure CMake
+      run: |
+        cmake -S . -B build \
+          -G Ninja \
+          -DCMAKE_BUILD_TYPE=${{env.BUILD_TYPE}} \
+          -DCMAKE_CXX_STANDARD=23 \
+          -Dglaze_ENABLE_SSL=ON
+
+    - name: Build
+      run: |
+        cmake --build build -j $(nproc) --target \
+          websocket_client_test \
+          websocket_close_test \
+          wss_test \
+          shared_context_bug_test \
+          utf8_test \
+          https_test \
+          http_client_test
+
+    - name: Test
+      working-directory: build
+      run: |
+        ctest -C ${{env.BUILD_TYPE}} --output-on-failure -R \
+          "^(websocket_client_test|websocket_close_test|wss_test|shared_context_bug_test|utf8_test|https_test|http_client_test)$"

From 5a5622999e7d0eb4bab871c799c5ff2a6c70f7c8 Mon Sep 17 00:00:00 2001
From: Stephen Berry <stephenberry.developer@gmail.com>
Date: Tue, 7 Apr 2026 21:26:08 -0500
Subject: [PATCH 02/41] Update CMakeLists.txt

---
 tests/CMakeLists.txt | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt
index 796b82df90..9164f53732 100644
--- a/tests/CMakeLists.txt
+++ b/tests/CMakeLists.txt
@@ -76,6 +76,12 @@ else()
     endif()
 endif()
 
+# ASIO requires Winsock libraries on Windows.
+# MSVC auto-links via #pragma comment(lib, ...) but MinGW requires explicit linking.
+if(WIN32)
+    target_link_libraries(glz_asio INTERFACE ws2_32 mswsock)
+endif()
+
 include(../cmake/code-coverage.cmake)
 add_code_coverage_all_targets()
 

From f63fbff5ea66a44eccb353f3f59131ffe650ac5a Mon Sep 17 00:00:00 2001
From: Stephen Berry <stephenberry.developer@gmail.com>
Date: Tue, 7 Apr 2026 21:37:07 -0500
Subject: [PATCH 03/41] Minimal diagnostic test for MinGW + SSL heap corruption

---
 .github/workflows/msys2-ssl.yml               |  64 ++++-
 tests/networking_tests/CMakeLists.txt         |   1 +
 .../mingw_ssl_diag/CMakeLists.txt             |  29 +++
 .../mingw_ssl_diag/mingw_ssl_diag.cpp         | 239 ++++++++++++++++++
 4 files changed, 324 insertions(+), 9 deletions(-)
 create mode 100644 tests/networking_tests/mingw_ssl_diag/CMakeLists.txt
 create mode 100644 tests/networking_tests/mingw_ssl_diag/mingw_ssl_diag.cpp

diff --git a/.github/workflows/msys2-ssl.yml b/.github/workflows/msys2-ssl.yml
index aca96432ba..6af492b7a0 100644
--- a/.github/workflows/msys2-ssl.yml
+++ b/.github/workflows/msys2-ssl.yml
@@ -16,12 +16,57 @@ on:
       - 'docs/**'
   workflow_dispatch:
 
-env:
-  BUILD_TYPE: Release
-
 jobs:
-  build:
-    name: MinGW64 + SSL (ws:// and wss://)
+  # Debug + ASAN build to locate heap corruption
+  asan:
+    name: MinGW64 + SSL + ASAN (Debug)
+    runs-on: windows-latest
+    defaults:
+      run:
+        shell: msys2 {0}
+
+    steps:
+    - uses: actions/checkout@v6
+
+    - uses: msys2/setup-msys2@v2
+      with:
+        update: true
+        msystem: MINGW64
+        install: >-
+          mingw-w64-x86_64-cmake
+          mingw-w64-x86_64-ninja
+          mingw-w64-x86_64-gcc
+          mingw-w64-x86_64-openssl
+
+    - name: Configure CMake
+      run: |
+        cmake -S . -B build \
+          -G Ninja \
+          -DCMAKE_BUILD_TYPE=Debug \
+          -DCMAKE_CXX_STANDARD=23 \
+          -DCMAKE_CXX_FLAGS="-fsanitize=address -fno-omit-frame-pointer" \
+          -DCMAKE_EXE_LINKER_FLAGS="-fsanitize=address" \
+          -Dglaze_ENABLE_SSL=ON \
+          -Dglaze_ENABLE_SANITIZERS=OFF
+
+    - name: Build
+      run: |
+        cmake --build build -j $(nproc) --target \
+          http_client_test \
+          mingw_ssl_diag
+
+    - name: Run ASAN diagnostics
+      working-directory: build
+      run: |
+        echo "=== Running MinGW SSL diagnostic test ==="
+        ctest --output-on-failure -R "^mingw_ssl_diag$" || true
+        echo ""
+        echo "=== Running http_client_test ==="
+        ctest --output-on-failure -R "^http_client_test$" || true
+
+  # Release build for functional correctness
+  release:
+    name: MinGW64 + SSL (Release)
     runs-on: windows-latest
     defaults:
       run:
@@ -44,7 +89,7 @@ jobs:
       run: |
         cmake -S . -B build \
           -G Ninja \
-          -DCMAKE_BUILD_TYPE=${{env.BUILD_TYPE}} \
+          -DCMAKE_BUILD_TYPE=Release \
           -DCMAKE_CXX_STANDARD=23 \
           -Dglaze_ENABLE_SSL=ON
 
@@ -57,10 +102,11 @@ jobs:
           shared_context_bug_test \
           utf8_test \
           https_test \
-          http_client_test
+          http_client_test \
+          mingw_ssl_diag
 
     - name: Test
       working-directory: build
       run: |
-        ctest -C ${{env.BUILD_TYPE}} --output-on-failure -R \
-          "^(websocket_client_test|websocket_close_test|wss_test|shared_context_bug_test|utf8_test|https_test|http_client_test)$"
+        ctest -C Release --output-on-failure -R \
+          "^(websocket_client_test|websocket_close_test|wss_test|shared_context_bug_test|utf8_test|https_test|http_client_test|mingw_ssl_diag)$"
diff --git a/tests/networking_tests/CMakeLists.txt b/tests/networking_tests/CMakeLists.txt
index 6467671d34..6a65db9aa9 100644
--- a/tests/networking_tests/CMakeLists.txt
+++ b/tests/networking_tests/CMakeLists.txt
@@ -29,3 +29,4 @@ add_subdirectory(registry_view_test)
 add_subdirectory(repe_to_jsonrpc_test)
 add_subdirectory(rest_test)
 add_subdirectory(websocket_test)
+add_subdirectory(mingw_ssl_diag)
diff --git a/tests/networking_tests/mingw_ssl_diag/CMakeLists.txt b/tests/networking_tests/mingw_ssl_diag/CMakeLists.txt
new file mode 100644
index 0000000000..d3c763855c
--- /dev/null
+++ b/tests/networking_tests/mingw_ssl_diag/CMakeLists.txt
@@ -0,0 +1,29 @@
+project(mingw_ssl_diag)
+
+find_package(OpenSSL QUIET)
+if(OpenSSL_FOUND)
+    include(CheckCXXSourceCompiles)
+    set(CMAKE_REQUIRED_LIBRARIES OpenSSL::SSL OpenSSL::Crypto)
+    check_cxx_source_compiles("
+        #include <openssl/ssl.h>
+        int main() { return 0; }
+    " MINGW_SSL_DIAG_HEADERS_OK)
+
+    if(MINGW_SSL_DIAG_HEADERS_OK)
+        add_executable(${PROJECT_NAME} ${PROJECT_NAME}.cpp)
+
+        target_link_libraries(${PROJECT_NAME} PRIVATE
+            glz_test_exceptions
+            OpenSSL::SSL
+            OpenSSL::Crypto
+        )
+
+        target_compile_definitions(${PROJECT_NAME} PRIVATE GLZ_ENABLE_SSL)
+
+        add_test(NAME ${PROJECT_NAME} COMMAND ${PROJECT_NAME})
+    else()
+        message(STATUS "mingw_ssl_diag skipped - OpenSSL headers not usable")
+    endif()
+else()
+    message(STATUS "mingw_ssl_diag skipped - OpenSSL not found")
+endif()
diff --git a/tests/networking_tests/mingw_ssl_diag/mingw_ssl_diag.cpp b/tests/networking_tests/mingw_ssl_diag/mingw_ssl_diag.cpp
new file mode 100644
index 0000000000..018e0aaac4
--- /dev/null
+++ b/tests/networking_tests/mingw_ssl_diag/mingw_ssl_diag.cpp
@@ -0,0 +1,239 @@
+// Minimal diagnostic test for MinGW + SSL heap corruption (issue #2411)
+//
+// Isolates each layer to find where heap corruption originates:
+//   1. Raw OpenSSL context create/destroy
+//   2. ASIO SSL context create/destroy
+//   3. http_client create/destroy (no requests)
+//   4. http_client with a single HTTP GET (non-SSL, but SSL compiled in)
+//   5. Multiple http_client lifecycles
+
+#ifndef GLZ_ENABLE_SSL
+#define GLZ_ENABLE_SSL
+#endif
+
+#include <atomic>
+#include <chrono>
+#include <iostream>
+#include <thread>
+
+#include <openssl/err.h>
+#include <openssl/ssl.h>
+
+#include "glaze/net/http_client.hpp"
+#include "glaze/net/http_server.hpp"
+#include "ut/ut.hpp"
+
+#ifdef DELETE
+#undef DELETE
+#endif
+
+using namespace ut;
+
+// Simple server for HTTP tests
+class diag_server
+{
+  public:
+   bool start()
+   {
+      server_.get("/ping", [](const glz::request&, glz::response& res) { res.status(200).body("pong"); });
+
+      for (uint16_t p = 19200; p < 19300; ++p) {
+         try {
+            server_.bind("127.0.0.1", p);
+            port_ = p;
+            break;
+         }
+         catch (...) {
+            continue;
+         }
+      }
+      if (port_ == 0) return false;
+
+      thread_ = std::thread([this]() {
+         try {
+            server_.start(1);
+         }
+         catch (...) {
+         }
+      });
+
+      // Wait for server to accept connections
+      for (int i = 0; i < 50; ++i) {
+         std::this_thread::sleep_for(std::chrono::milliseconds(100));
+         try {
+            asio::io_context io;
+            asio::ip::tcp::socket sock(io);
+            sock.connect({asio::ip::make_address("127.0.0.1"), port_});
+            sock.close();
+            return true;
+         }
+         catch (...) {
+         }
+      }
+      return false;
+   }
+
+   void stop()
+   {
+      server_.stop();
+      if (thread_.joinable()) thread_.join();
+   }
+
+   ~diag_server() { stop(); }
+
+   std::string url() const { return "http://127.0.0.1:" + std::to_string(port_); }
+
+  private:
+   glz::http_server<> server_;
+   std::thread thread_;
+   uint16_t port_{0};
+};
+
+suite mingw_ssl_diag = [] {
+   // Phase 1: Raw OpenSSL - does SSL_CTX create/destroy corrupt the heap?
+   "phase1_raw_openssl_ctx"_test = [] {
+      std::cout << "[phase1] Creating raw OpenSSL SSL_CTX..." << std::endl;
+
+      for (int i = 0; i < 5; ++i) {
+         SSL_CTX* ctx = SSL_CTX_new(TLS_client_method());
+         expect(ctx != nullptr) << "SSL_CTX_new failed on iteration " << i;
+         if (ctx) {
+            SSL_CTX_free(ctx);
+         }
+      }
+
+      std::cout << "[phase1] OK - raw OpenSSL context create/destroy" << std::endl;
+   };
+
+   // Phase 2: ASIO SSL context - does asio::ssl::context corrupt the heap?
+   "phase2_asio_ssl_ctx"_test = [] {
+      std::cout << "[phase2] Creating asio::ssl::context..." << std::endl;
+
+      for (int i = 0; i < 5; ++i) {
+         asio::ssl::context ctx(asio::ssl::context::tls_client);
+         asio::error_code ec;
+         ctx.set_default_verify_paths(ec);
+         // Don't fail on verify path errors - some CI environments lack system CA certs
+         ctx.set_verify_mode(asio::ssl::verify_peer);
+      }
+
+      std::cout << "[phase2] OK - asio SSL context create/destroy" << std::endl;
+   };
+
+   // Phase 3: http_client lifecycle without any requests
+   "phase3_http_client_lifecycle_no_request"_test = [] {
+      std::cout << "[phase3] Creating/destroying http_client (no requests)..." << std::endl;
+
+      for (int i = 0; i < 5; ++i) {
+         glz::http_client client;
+         // Just create and destroy - no requests
+      }
+
+      std::cout << "[phase3] OK - http_client lifecycle without requests" << std::endl;
+   };
+
+   // Phase 4: http_client with a single plain HTTP GET
+   "phase4_http_client_single_get"_test = [] {
+      std::cout << "[phase4] http_client single HTTP GET..." << std::endl;
+
+      diag_server server;
+      expect(server.start()) << "Server failed to start";
+
+      {
+         glz::http_client client;
+         auto result = client.get(server.url() + "/ping");
+         expect(result.has_value()) << "GET /ping failed";
+         if (result) {
+            expect(result->status_code == 200) << "Expected 200, got " << result->status_code;
+         }
+      }
+
+      server.stop();
+      std::cout << "[phase4] OK - single HTTP GET" << std::endl;
+   };
+
+   // Phase 5: Multiple http_client instances doing HTTP GETs
+   "phase5_http_client_repeated"_test = [] {
+      std::cout << "[phase5] Multiple http_client instances with HTTP GETs..." << std::endl;
+
+      diag_server server;
+      expect(server.start()) << "Server failed to start";
+
+      for (int i = 0; i < 10; ++i) {
+         glz::http_client client;
+         auto result = client.get(server.url() + "/ping");
+         expect(result.has_value()) << "GET failed on iteration " << i;
+      }
+
+      server.stop();
+      std::cout << "[phase5] OK - repeated http_client lifecycle" << std::endl;
+   };
+
+   // Phase 6: Single http_client, multiple requests (connection reuse)
+   "phase6_http_client_multiple_requests"_test = [] {
+      std::cout << "[phase6] Single http_client, multiple requests..." << std::endl;
+
+      diag_server server;
+      expect(server.start()) << "Server failed to start";
+
+      {
+         glz::http_client client;
+         for (int i = 0; i < 20; ++i) {
+            auto result = client.get(server.url() + "/ping");
+            expect(result.has_value()) << "GET failed on iteration " << i;
+         }
+      }
+
+      server.stop();
+      std::cout << "[phase6] OK - multiple requests on single client" << std::endl;
+   };
+
+   // Phase 7: Concurrent requests
+   "phase7_http_client_concurrent"_test = [] {
+      std::cout << "[phase7] Concurrent async requests..." << std::endl;
+
+      diag_server server;
+      expect(server.start()) << "Server failed to start";
+
+      {
+         glz::http_client client;
+         std::atomic<int> completed{0};
+         std::atomic<int> errors{0};
+         constexpr int N = 20;
+
+         for (int i = 0; i < N; ++i) {
+            client.get_async(server.url() + "/ping", {},
+                             [&](glz::expected<glz::response, std::error_code> result) {
+                                if (result.has_value() && result->status_code == 200) {
+                                   completed++;
+                                }
+                                else {
+                                   errors++;
+                                }
+                             });
+         }
+
+         // Wait for all to complete
+         for (int i = 0; i < 100 && completed + errors < N; ++i) {
+            std::this_thread::sleep_for(std::chrono::milliseconds(100));
+         }
+
+         expect(completed + errors == N) << "Not all requests completed: " << completed.load() << " ok, "
+                                         << errors.load() << " errors";
+         expect(errors == 0) << "Some requests failed";
+      }
+
+      server.stop();
+      std::cout << "[phase7] OK - concurrent requests" << std::endl;
+   };
+};
+
+int main()
+{
+   std::cout << "MinGW + SSL Diagnostic Test" << std::endl;
+   std::cout << "===========================" << std::endl;
+   std::cout << "OpenSSL version: " << OpenSSL_version(OPENSSL_VERSION) << std::endl;
+   std::cout << "Compiler: " << __VERSION__ << std::endl;
+   std::cout << std::endl;
+   return 0;
+}

From 73d1100128c24cd897b8e8c0f1eb1abf9915d5ef Mon Sep 17 00:00:00 2001
From: Stephen Berry <stephenberry.developer@gmail.com>
Date: Tue, 7 Apr 2026 22:10:26 -0500
Subject: [PATCH 04/41] Update msys2-ssl.yml

---
 .github/workflows/msys2-ssl.yml | 89 +++++++++++++--------------------
 1 file changed, 36 insertions(+), 53 deletions(-)

diff --git a/.github/workflows/msys2-ssl.yml b/.github/workflows/msys2-ssl.yml
index 6af492b7a0..441ccd2063 100644
--- a/.github/workflows/msys2-ssl.yml
+++ b/.github/workflows/msys2-ssl.yml
@@ -17,9 +17,8 @@ on:
   workflow_dispatch:
 
 jobs:
-  # Debug + ASAN build to locate heap corruption
-  asan:
-    name: MinGW64 + SSL + ASAN (Debug)
+  build:
+    name: MinGW64 + SSL
     runs-on: windows-latest
     defaults:
       run:
@@ -44,53 +43,6 @@ jobs:
           -G Ninja \
           -DCMAKE_BUILD_TYPE=Debug \
           -DCMAKE_CXX_STANDARD=23 \
-          -DCMAKE_CXX_FLAGS="-fsanitize=address -fno-omit-frame-pointer" \
-          -DCMAKE_EXE_LINKER_FLAGS="-fsanitize=address" \
-          -Dglaze_ENABLE_SSL=ON \
-          -Dglaze_ENABLE_SANITIZERS=OFF
-
-    - name: Build
-      run: |
-        cmake --build build -j $(nproc) --target \
-          http_client_test \
-          mingw_ssl_diag
-
-    - name: Run ASAN diagnostics
-      working-directory: build
-      run: |
-        echo "=== Running MinGW SSL diagnostic test ==="
-        ctest --output-on-failure -R "^mingw_ssl_diag$" || true
-        echo ""
-        echo "=== Running http_client_test ==="
-        ctest --output-on-failure -R "^http_client_test$" || true
-
-  # Release build for functional correctness
-  release:
-    name: MinGW64 + SSL (Release)
-    runs-on: windows-latest
-    defaults:
-      run:
-        shell: msys2 {0}
-
-    steps:
-    - uses: actions/checkout@v6
-
-    - uses: msys2/setup-msys2@v2
-      with:
-        update: true
-        msystem: MINGW64
-        install: >-
-          mingw-w64-x86_64-cmake
-          mingw-w64-x86_64-ninja
-          mingw-w64-x86_64-gcc
-          mingw-w64-x86_64-openssl
-
-    - name: Configure CMake
-      run: |
-        cmake -S . -B build \
-          -G Ninja \
-          -DCMAKE_BUILD_TYPE=Release \
-          -DCMAKE_CXX_STANDARD=23 \
           -Dglaze_ENABLE_SSL=ON
 
     - name: Build
@@ -105,8 +57,39 @@ jobs:
           http_client_test \
           mingw_ssl_diag
 
-    - name: Test
+    # Enable Full Page Heap for test executables.
+    # This makes Windows place each heap allocation on its own page with a
+    # guard page, so buffer overflows / use-after-free crash immediately at
+    # the offending instruction instead of silently corrupting the heap.
+    - name: Enable Page Heap
+      shell: pwsh
+      run: |
+        $exes = @(
+          "http_client_test.exe",
+          "mingw_ssl_diag.exe",
+          "websocket_client_test.exe",
+          "wss_test.exe",
+          "https_test.exe"
+        )
+        foreach ($exe in $exes) {
+          Write-Host "Enabling full page heap for $exe"
+          & reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\$exe" /v GlobalFlag /t REG_DWORD /d 0x02000000 /f
+          & reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\$exe" /v PageHeapFlags /t REG_DWORD /d 0x3 /f
+        }
+
+    - name: Run diagnostic test
+      working-directory: build
+      run: |
+        echo "=== MinGW SSL Diagnostic Test ==="
+        ctest --output-on-failure -R "^mingw_ssl_diag$" || true
+
+    - name: Run http_client_test (heap corruption repro)
+      working-directory: build
+      run: |
+        ctest --output-on-failure -R "^http_client_test$" || true
+
+    - name: Run remaining tests
       working-directory: build
       run: |
-        ctest -C Release --output-on-failure -R \
-          "^(websocket_client_test|websocket_close_test|wss_test|shared_context_bug_test|utf8_test|https_test|http_client_test|mingw_ssl_diag)$"
+        ctest --output-on-failure -R \
+          "^(websocket_client_test|websocket_close_test|wss_test|shared_context_bug_test|utf8_test|https_test)$"

From 0ad8abc1fe5aeae820f53c03940254a9a3a0a102 Mon Sep 17 00:00:00 2001
From: Stephen Berry <stephenberry.developer@gmail.com>
Date: Wed, 8 Apr 2026 08:48:19 -0500
Subject: [PATCH 05/41] Update msys2-ssl.yml

---
 .github/workflows/msys2-ssl.yml | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/msys2-ssl.yml b/.github/workflows/msys2-ssl.yml
index 441ccd2063..569949d232 100644
--- a/.github/workflows/msys2-ssl.yml
+++ b/.github/workflows/msys2-ssl.yml
@@ -41,7 +41,7 @@ jobs:
       run: |
         cmake -S . -B build \
           -G Ninja \
-          -DCMAKE_BUILD_TYPE=Debug \
+          -DCMAKE_BUILD_TYPE=Release \
           -DCMAKE_CXX_STANDARD=23 \
           -Dglaze_ENABLE_SSL=ON
 
@@ -58,9 +58,9 @@ jobs:
           mingw_ssl_diag
 
     # Enable Full Page Heap for test executables.
-    # This makes Windows place each heap allocation on its own page with a
-    # guard page, so buffer overflows / use-after-free crash immediately at
-    # the offending instruction instead of silently corrupting the heap.
+    # Places each heap allocation on its own page with a guard page so that
+    # buffer overflows / use-after-free crash immediately at the offending
+    # instruction instead of silently corrupting the heap.
     - name: Enable Page Heap
       shell: pwsh
       run: |
@@ -83,7 +83,7 @@ jobs:
         echo "=== MinGW SSL Diagnostic Test ==="
         ctest --output-on-failure -R "^mingw_ssl_diag$" || true
 
-    - name: Run http_client_test (heap corruption repro)
+    - name: Run http_client_test
       working-directory: build
       run: |
         ctest --output-on-failure -R "^http_client_test$" || true

From b08b8ba0eae44ce40d43c3e4ccf8a9fd70ad6ca6 Mon Sep 17 00:00:00 2001
From: Stephen Berry <stephenberry.developer@gmail.com>
Date: Wed, 8 Apr 2026 09:29:39 -0500
Subject: [PATCH 06/41] more stress testing

---
 .github/workflows/msys2-ssl.yml               |  89 +++++++----
 .../mingw_ssl_diag/mingw_ssl_diag.cpp         | 141 ++++++++++++++++--
 2 files changed, 196 insertions(+), 34 deletions(-)

diff --git a/.github/workflows/msys2-ssl.yml b/.github/workflows/msys2-ssl.yml
index 569949d232..1814953acd 100644
--- a/.github/workflows/msys2-ssl.yml
+++ b/.github/workflows/msys2-ssl.yml
@@ -17,8 +17,9 @@ on:
   workflow_dispatch:
 
 jobs:
-  build:
-    name: MinGW64 + SSL
+  # Run WITHOUT Page Heap first — this is where the heap corruption reproduces
+  no-pageheap:
+    name: MinGW64 + SSL (no Page Heap)
     runs-on: windows-latest
     defaults:
       run:
@@ -48,48 +49,86 @@ jobs:
     - name: Build
       run: |
         cmake --build build -j $(nproc) --target \
+          mingw_ssl_diag \
+          http_client_test \
           websocket_client_test \
           websocket_close_test \
           wss_test \
           shared_context_bug_test \
           utf8_test \
-          https_test \
-          http_client_test \
-          mingw_ssl_diag
+          https_test
+
+    - name: Run diagnostic (no Page Heap)
+      working-directory: build
+      run: |
+        echo "=== MinGW SSL Diagnostic — NO Page Heap ==="
+        echo "Heap corruption should reproduce here."
+        ctest --output-on-failure -R "^mingw_ssl_diag$" || true
+
+    - name: Run http_client_test (no Page Heap)
+      working-directory: build
+      run: |
+        ctest --output-on-failure -R "^http_client_test$" || true
+
+    - name: Run remaining tests
+      working-directory: build
+      run: |
+        ctest --output-on-failure -R \
+          "^(websocket_client_test|websocket_close_test|wss_test|shared_context_bug_test|utf8_test|https_test)$"
+
+  # Run WITH Page Heap — catches buffer overflows / use-after-free at the
+  # exact instruction, turning deferred 0xc0000374 into immediate 0xc0000005
+  pageheap:
+    name: MinGW64 + SSL (Page Heap)
+    runs-on: windows-latest
+    defaults:
+      run:
+        shell: msys2 {0}
+
+    steps:
+    - uses: actions/checkout@v6
+
+    - uses: msys2/setup-msys2@v2
+      with:
+        update: true
+        msystem: MINGW64
+        install: >-
+          mingw-w64-x86_64-cmake
+          mingw-w64-x86_64-ninja
+          mingw-w64-x86_64-gcc
+          mingw-w64-x86_64-openssl
+
+    - name: Configure CMake
+      run: |
+        cmake -S . -B build \
+          -G Ninja \
+          -DCMAKE_BUILD_TYPE=Release \
+          -DCMAKE_CXX_STANDARD=23 \
+          -Dglaze_ENABLE_SSL=ON
+
+    - name: Build
+      run: |
+        cmake --build build -j $(nproc) --target \
+          mingw_ssl_diag \
+          http_client_test
 
-    # Enable Full Page Heap for test executables.
-    # Places each heap allocation on its own page with a guard page so that
-    # buffer overflows / use-after-free crash immediately at the offending
-    # instruction instead of silently corrupting the heap.
     - name: Enable Page Heap
       shell: pwsh
       run: |
-        $exes = @(
-          "http_client_test.exe",
-          "mingw_ssl_diag.exe",
-          "websocket_client_test.exe",
-          "wss_test.exe",
-          "https_test.exe"
-        )
+        $exes = @("http_client_test.exe", "mingw_ssl_diag.exe")
         foreach ($exe in $exes) {
           Write-Host "Enabling full page heap for $exe"
           & reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\$exe" /v GlobalFlag /t REG_DWORD /d 0x02000000 /f
           & reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\$exe" /v PageHeapFlags /t REG_DWORD /d 0x3 /f
         }
 
-    - name: Run diagnostic test
+    - name: Run diagnostic (with Page Heap)
       working-directory: build
       run: |
-        echo "=== MinGW SSL Diagnostic Test ==="
+        echo "=== MinGW SSL Diagnostic — WITH Page Heap ==="
         ctest --output-on-failure -R "^mingw_ssl_diag$" || true
 
-    - name: Run http_client_test
+    - name: Run http_client_test (with Page Heap)
       working-directory: build
       run: |
         ctest --output-on-failure -R "^http_client_test$" || true
-
-    - name: Run remaining tests
-      working-directory: build
-      run: |
-        ctest --output-on-failure -R \
-          "^(websocket_client_test|websocket_close_test|wss_test|shared_context_bug_test|utf8_test|https_test)$"
diff --git a/tests/networking_tests/mingw_ssl_diag/mingw_ssl_diag.cpp b/tests/networking_tests/mingw_ssl_diag/mingw_ssl_diag.cpp
index 018e0aaac4..46b2cd0b16 100644
--- a/tests/networking_tests/mingw_ssl_diag/mingw_ssl_diag.cpp
+++ b/tests/networking_tests/mingw_ssl_diag/mingw_ssl_diag.cpp
@@ -1,11 +1,10 @@
 // Minimal diagnostic test for MinGW + SSL heap corruption (issue #2411)
 //
 // Isolates each layer to find where heap corruption originates:
-//   1. Raw OpenSSL context create/destroy
-//   2. ASIO SSL context create/destroy
-//   3. http_client create/destroy (no requests)
-//   4. http_client with a single HTTP GET (non-SSL, but SSL compiled in)
-//   5. Multiple http_client lifecycles
+//   Phase 1-3: Basic lifecycle (OpenSSL, ASIO SSL, http_client)
+//   Phase 4-7: HTTP operations (single, repeated, connection reuse, concurrent)
+//   Phase 8-11: Stress tests targeting race conditions in create/destroy
+//               with active requests, rapid cycling, and concurrent clients
 
 #ifndef GLZ_ENABLE_SSL
 #define GLZ_ENABLE_SSL
@@ -15,6 +14,7 @@
 #include <chrono>
 #include <iostream>
 #include <thread>
+#include <vector>
 
 #include <openssl/err.h>
 #include <openssl/ssl.h>
@@ -37,6 +37,12 @@ class diag_server
    {
       server_.get("/ping", [](const glz::request&, glz::response& res) { res.status(200).body("pong"); });
 
+      // Slow endpoint to keep requests in-flight during destruction
+      server_.get("/slow", [](const glz::request&, glz::response& res) {
+         std::this_thread::sleep_for(std::chrono::milliseconds(200));
+         res.status(200).body("slow");
+      });
+
       for (uint16_t p = 19200; p < 19300; ++p) {
          try {
             server_.bind("127.0.0.1", p);
@@ -113,7 +119,6 @@ suite mingw_ssl_diag = [] {
          asio::ssl::context ctx(asio::ssl::context::tls_client);
          asio::error_code ec;
          ctx.set_default_verify_paths(ec);
-         // Don't fail on verify path errors - some CI environments lack system CA certs
          ctx.set_verify_mode(asio::ssl::verify_peer);
       }
 
@@ -126,7 +131,6 @@ suite mingw_ssl_diag = [] {
 
       for (int i = 0; i < 5; ++i) {
          glz::http_client client;
-         // Just create and destroy - no requests
       }
 
       std::cout << "[phase3] OK - http_client lifecycle without requests" << std::endl;
@@ -188,7 +192,7 @@ suite mingw_ssl_diag = [] {
       std::cout << "[phase6] OK - multiple requests on single client" << std::endl;
    };
 
-   // Phase 7: Concurrent requests
+   // Phase 7: Concurrent async requests
    "phase7_http_client_concurrent"_test = [] {
       std::cout << "[phase7] Concurrent async requests..." << std::endl;
 
@@ -213,7 +217,6 @@ suite mingw_ssl_diag = [] {
                              });
          }
 
-         // Wait for all to complete
          for (int i = 0; i < 100 && completed + errors < N; ++i) {
             std::this_thread::sleep_for(std::chrono::milliseconds(100));
          }
@@ -226,6 +229,126 @@ suite mingw_ssl_diag = [] {
       server.stop();
       std::cout << "[phase7] OK - concurrent requests" << std::endl;
    };
+
+   // Phase 8: Destroy client while async requests are in-flight
+   // This is the most likely race condition: worker threads processing
+   // completions while the destructor tears down the io_context.
+   "phase8_destroy_with_inflight_requests"_test = [] {
+      std::cout << "[phase8] Destroying client with in-flight requests..." << std::endl;
+
+      diag_server server;
+      expect(server.start()) << "Server failed to start";
+
+      for (int round = 0; round < 20; ++round) {
+         glz::http_client client;
+
+         // Fire async requests against the slow endpoint
+         for (int i = 0; i < 5; ++i) {
+            client.get_async(server.url() + "/slow", {}, [](auto) {});
+         }
+
+         // Don't wait — destroy immediately while requests are pending.
+         // The destructor calls stop_workers() which stops io_context and
+         // joins threads. If there's a race, this is where it crashes.
+      }
+
+      server.stop();
+      std::cout << "[phase8] OK - destroy with in-flight requests" << std::endl;
+   };
+
+   // Phase 9: Rapid create/destroy cycling with immediate requests
+   // Stresses the worker thread start/stop path.
+   "phase9_rapid_lifecycle_with_requests"_test = [] {
+      std::cout << "[phase9] Rapid client lifecycle cycling..." << std::endl;
+
+      diag_server server;
+      expect(server.start()) << "Server failed to start";
+
+      for (int round = 0; round < 50; ++round) {
+         glz::http_client client;
+         // Fire one async request then immediately destroy
+         client.get_async(server.url() + "/ping", {}, [](auto) {});
+      }
+
+      server.stop();
+      std::cout << "[phase9] OK - rapid lifecycle cycling" << std::endl;
+   };
+
+   // Phase 10: Multiple clients sharing work concurrently
+   // Each client has its own io_context and worker threads.
+   "phase10_concurrent_clients"_test = [] {
+      std::cout << "[phase10] Multiple concurrent clients..." << std::endl;
+
+      diag_server server;
+      expect(server.start()) << "Server failed to start";
+
+      {
+         constexpr int NUM_CLIENTS = 5;
+         constexpr int REQUESTS_PER_CLIENT = 10;
+         std::vector<std::thread> threads;
+         std::atomic<int> total_success{0};
+         std::atomic<int> total_errors{0};
+
+         for (int c = 0; c < NUM_CLIENTS; ++c) {
+            threads.emplace_back([&]() {
+               glz::http_client client;
+               for (int i = 0; i < REQUESTS_PER_CLIENT; ++i) {
+                  auto result = client.get(server.url() + "/ping");
+                  if (result.has_value() && result->status_code == 200) {
+                     total_success++;
+                  }
+                  else {
+                     total_errors++;
+                  }
+               }
+            });
+         }
+
+         for (auto& t : threads) {
+            t.join();
+         }
+
+         expect(total_errors == 0) << "Concurrent client errors: " << total_errors.load();
+         expect(total_success == NUM_CLIENTS * REQUESTS_PER_CLIENT)
+            << "Expected " << NUM_CLIENTS * REQUESTS_PER_CLIENT << " successes, got " << total_success.load();
+      }
+
+      server.stop();
+      std::cout << "[phase10] OK - concurrent clients" << std::endl;
+   };
+
+   // Phase 11: Mixed sync + async with destruction under load
+   // Combines the most aggressive patterns.
+   "phase11_stress_mixed"_test = [] {
+      std::cout << "[phase11] Mixed stress test..." << std::endl;
+
+      diag_server server;
+      expect(server.start()) << "Server failed to start";
+
+      for (int round = 0; round < 10; ++round) {
+         // Create client, fire a mix of sync and async, destroy
+         glz::http_client client;
+
+         // Sync request
+         auto result = client.get(server.url() + "/ping");
+         (void)result;
+
+         // Fire several async requests against both fast and slow endpoints
+         for (int i = 0; i < 3; ++i) {
+            client.get_async(server.url() + "/ping", {}, [](auto) {});
+            client.get_async(server.url() + "/slow", {}, [](auto) {});
+         }
+
+         // Small random-ish delay to vary the destruction timing
+         if (round % 3 == 0) {
+            std::this_thread::sleep_for(std::chrono::milliseconds(10));
+         }
+         // Destroy with mixed pending work
+      }
+
+      server.stop();
+      std::cout << "[phase11] OK - mixed stress test" << std::endl;
+   };
 };
 
 int main()

From bb44ab540fe4aea6ccdf2069f551f31583b09bee Mon Sep 17 00:00:00 2001
From: Stephen Berry <stephenberry.developer@gmail.com>
Date: Wed, 8 Apr 2026 10:07:16 -0500
Subject: [PATCH 07/41] On job 20 iterations to tease out the issue

---
 .github/workflows/msys2-ssl.yml | 87 ++++++++-------------------------
 1 file changed, 20 insertions(+), 67 deletions(-)

diff --git a/.github/workflows/msys2-ssl.yml b/.github/workflows/msys2-ssl.yml
index 1814953acd..4ef9380359 100644
--- a/.github/workflows/msys2-ssl.yml
+++ b/.github/workflows/msys2-ssl.yml
@@ -17,9 +17,8 @@ on:
   workflow_dispatch:
 
 jobs:
-  # Run WITHOUT Page Heap first — this is where the heap corruption reproduces
-  no-pageheap:
-    name: MinGW64 + SSL (no Page Heap)
+  build:
+    name: MinGW64 + SSL
     runs-on: windows-latest
     defaults:
       run:
@@ -58,77 +57,31 @@ jobs:
           utf8_test \
           https_test
 
-    - name: Run diagnostic (no Page Heap)
+    # Run http_client_test in a loop — the heap corruption is intermittent.
+    # The original crash took ~0.7s, so 20 iterations ≈ 14s.
+    - name: "Repeat: http_client_test (20x)"
       working-directory: build
       run: |
-        echo "=== MinGW SSL Diagnostic — NO Page Heap ==="
-        echo "Heap corruption should reproduce here."
-        ctest --output-on-failure -R "^mingw_ssl_diag$" || true
-
-    - name: Run http_client_test (no Page Heap)
+        echo "Running http_client_test 20 times to reproduce intermittent heap corruption..."
+        for i in $(seq 1 20); do
+          echo "--- Run $i/20 ---"
+          ctest --output-on-failure -R "^http_client_test$" || { echo "FAILED on run $i"; exit 1; }
+        done
+        echo "All 20 runs passed."
+
+    # Same for the diagnostic stress tests
+    - name: "Repeat: mingw_ssl_diag (20x)"
       working-directory: build
       run: |
-        ctest --output-on-failure -R "^http_client_test$" || true
+        echo "Running mingw_ssl_diag 20 times..."
+        for i in $(seq 1 20); do
+          echo "--- Run $i/20 ---"
+          ctest --output-on-failure -R "^mingw_ssl_diag$" || { echo "FAILED on run $i"; exit 1; }
+        done
+        echo "All 20 runs passed."
 
     - name: Run remaining tests
       working-directory: build
       run: |
         ctest --output-on-failure -R \
           "^(websocket_client_test|websocket_close_test|wss_test|shared_context_bug_test|utf8_test|https_test)$"
-
-  # Run WITH Page Heap — catches buffer overflows / use-after-free at the
-  # exact instruction, turning deferred 0xc0000374 into immediate 0xc0000005
-  pageheap:
-    name: MinGW64 + SSL (Page Heap)
-    runs-on: windows-latest
-    defaults:
-      run:
-        shell: msys2 {0}
-
-    steps:
-    - uses: actions/checkout@v6
-
-    - uses: msys2/setup-msys2@v2
-      with:
-        update: true
-        msystem: MINGW64
-        install: >-
-          mingw-w64-x86_64-cmake
-          mingw-w64-x86_64-ninja
-          mingw-w64-x86_64-gcc
-          mingw-w64-x86_64-openssl
-
-    - name: Configure CMake
-      run: |
-        cmake -S . -B build \
-          -G Ninja \
-          -DCMAKE_BUILD_TYPE=Release \
-          -DCMAKE_CXX_STANDARD=23 \
-          -Dglaze_ENABLE_SSL=ON
-
-    - name: Build
-      run: |
-        cmake --build build -j $(nproc) --target \
-          mingw_ssl_diag \
-          http_client_test
-
-    - name: Enable Page Heap
-      shell: pwsh
-      run: |
-        $exes = @("http_client_test.exe", "mingw_ssl_diag.exe")
-        foreach ($exe in $exes) {
-          Write-Host "Enabling full page heap for $exe"
-          & reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\$exe" /v GlobalFlag /t REG_DWORD /d 0x02000000 /f
-          & reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\$exe" /v PageHeapFlags /t REG_DWORD /d 0x3 /f
-        }
-
-    - name: Run diagnostic (with Page Heap)
-      working-directory: build
-      run: |
-        echo "=== MinGW SSL Diagnostic — WITH Page Heap ==="
-        ctest --output-on-failure -R "^mingw_ssl_diag$" || true
-
-    - name: Run http_client_test (with Page Heap)
-      working-directory: build
-      run: |
-        ctest --output-on-failure -R "^http_client_test$" || true

From 894cdf532d4fbf9c6f648c6286eb601e9fd62d3f Mon Sep 17 00:00:00 2001
From: Stephen Berry <stephenberry.developer@gmail.com>
Date: Wed, 8 Apr 2026 10:24:22 -0500
Subject: [PATCH 08/41] Update msys2-ssl.yml

---
 .github/workflows/msys2-ssl.yml | 45 ++++++++++++++++++++-------------
 1 file changed, 28 insertions(+), 17 deletions(-)

diff --git a/.github/workflows/msys2-ssl.yml b/.github/workflows/msys2-ssl.yml
index 4ef9380359..3d291b62df 100644
--- a/.github/workflows/msys2-ssl.yml
+++ b/.github/workflows/msys2-ssl.yml
@@ -36,12 +36,15 @@ jobs:
           mingw-w64-x86_64-ninja
           mingw-w64-x86_64-gcc
           mingw-w64-x86_64-openssl
+          mingw-w64-x86_64-gdb
 
+    # Build Release with debug symbols so GDB backtraces show line numbers
     - name: Configure CMake
       run: |
         cmake -S . -B build \
           -G Ninja \
           -DCMAKE_BUILD_TYPE=Release \
+          -DCMAKE_CXX_FLAGS="-g" \
           -DCMAKE_CXX_STANDARD=23 \
           -Dglaze_ENABLE_SSL=ON
 
@@ -57,28 +60,36 @@ jobs:
           utf8_test \
           https_test
 
-    # Run http_client_test in a loop — the heap corruption is intermittent.
-    # The original crash took ~0.7s, so 20 iterations ≈ 14s.
-    - name: "Repeat: http_client_test (20x)"
+    # Run under GDB to get a backtrace on crash
+    - name: "GDB: http_client_test"
       working-directory: build
       run: |
-        echo "Running http_client_test 20 times to reproduce intermittent heap corruption..."
-        for i in $(seq 1 20); do
-          echo "--- Run $i/20 ---"
-          ctest --output-on-failure -R "^http_client_test$" || { echo "FAILED on run $i"; exit 1; }
-        done
-        echo "All 20 runs passed."
+        echo "Running http_client_test under GDB to capture crash backtrace..."
+        gdb -batch \
+          -ex "set print thread-events off" \
+          -ex "run" \
+          -ex "echo \n=== CRASH BACKTRACE ===\n" \
+          -ex "bt full" \
+          -ex "echo \n=== ALL THREADS ===\n" \
+          -ex "thread apply all bt" \
+          -ex "quit" \
+          --args tests/networking_tests/http_client_test/http_client_test.exe \
+          2>&1 || true
 
-    # Same for the diagnostic stress tests
-    - name: "Repeat: mingw_ssl_diag (20x)"
+    - name: "GDB: mingw_ssl_diag"
       working-directory: build
       run: |
-        echo "Running mingw_ssl_diag 20 times..."
-        for i in $(seq 1 20); do
-          echo "--- Run $i/20 ---"
-          ctest --output-on-failure -R "^mingw_ssl_diag$" || { echo "FAILED on run $i"; exit 1; }
-        done
-        echo "All 20 runs passed."
+        echo "Running mingw_ssl_diag under GDB..."
+        gdb -batch \
+          -ex "set print thread-events off" \
+          -ex "run" \
+          -ex "echo \n=== CRASH BACKTRACE ===\n" \
+          -ex "bt full" \
+          -ex "echo \n=== ALL THREADS ===\n" \
+          -ex "thread apply all bt" \
+          -ex "quit" \
+          --args tests/networking_tests/mingw_ssl_diag/mingw_ssl_diag.exe \
+          2>&1 || true
 
     - name: Run remaining tests
       working-directory: build

From 85a3f556e27db651d179d10829aac41800696d99 Mon Sep 17 00:00:00 2001
From: Stephen Berry <stephenberry.developer@gmail.com>
Date: Wed, 8 Apr 2026 10:58:48 -0500
Subject: [PATCH 09/41] Update msys2-ssl.yml

---
 .github/workflows/msys2-ssl.yml | 93 +++++++++++++++++++++++----------
 1 file changed, 66 insertions(+), 27 deletions(-)

diff --git a/.github/workflows/msys2-ssl.yml b/.github/workflows/msys2-ssl.yml
index 3d291b62df..c1d8e11190 100644
--- a/.github/workflows/msys2-ssl.yml
+++ b/.github/workflows/msys2-ssl.yml
@@ -5,6 +5,7 @@ on:
     branches:
       - main
       - feature/*
+      - debug/*
     paths-ignore:
       - '**/*.md'
       - 'docs/**'
@@ -38,7 +39,6 @@ jobs:
           mingw-w64-x86_64-openssl
           mingw-w64-x86_64-gdb
 
-    # Build Release with debug symbols so GDB backtraces show line numbers
     - name: Configure CMake
       run: |
         cmake -S . -B build \
@@ -60,39 +60,78 @@ jobs:
           utf8_test \
           https_test
 
-    # Run under GDB to get a backtrace on crash
-    - name: "GDB: http_client_test"
+    # Configure Windows Error Reporting to create full crash dumps.
+    # This is completely non-intrusive — WER only activates AFTER the crash,
+    # so it doesn't affect timing or memory layout like GDB/Page Heap do.
+    - name: Configure crash dumps (WER)
+      shell: pwsh
+      run: |
+        $dumpPath = "D:\CrashDumps"
+        New-Item -Path $dumpPath -ItemType Directory -Force | Out-Null
+        $regPath = "HKLM:\SOFTWARE\Microsoft\Windows\Windows Error Reporting\LocalDumps"
+        New-Item -Path $regPath -Force | Out-Null
+        Set-ItemProperty -Path $regPath -Name "DumpType" -Value 2 -Type DWord          # 2 = Full dump
+        Set-ItemProperty -Path $regPath -Name "DumpFolder" -Value $dumpPath -Type ExpandString
+        Set-ItemProperty -Path $regPath -Name "DumpCount" -Value 10 -Type DWord
+        Write-Host "WER crash dumps configured at $dumpPath"
+
+    # Run the crashing test natively (no GDB, no Page Heap)
+    - name: Run http_client_test (native)
       working-directory: build
       run: |
-        echo "Running http_client_test under GDB to capture crash backtrace..."
-        gdb -batch \
-          -ex "set print thread-events off" \
-          -ex "run" \
-          -ex "echo \n=== CRASH BACKTRACE ===\n" \
-          -ex "bt full" \
-          -ex "echo \n=== ALL THREADS ===\n" \
-          -ex "thread apply all bt" \
-          -ex "quit" \
-          --args tests/networking_tests/http_client_test/http_client_test.exe \
-          2>&1 || true
+        echo "Running http_client_test natively to reproduce crash..."
+        ctest --output-on-failure -R "^http_client_test$" || true
 
-    - name: "GDB: mingw_ssl_diag"
+    - name: Run mingw_ssl_diag (native)
       working-directory: build
       run: |
-        echo "Running mingw_ssl_diag under GDB..."
-        gdb -batch \
-          -ex "set print thread-events off" \
-          -ex "run" \
-          -ex "echo \n=== CRASH BACKTRACE ===\n" \
-          -ex "bt full" \
-          -ex "echo \n=== ALL THREADS ===\n" \
-          -ex "thread apply all bt" \
-          -ex "quit" \
-          --args tests/networking_tests/mingw_ssl_diag/mingw_ssl_diag.exe \
-          2>&1 || true
+        ctest --output-on-failure -R "^mingw_ssl_diag$" || true
+
+    # Analyze any crash dumps that were created
+    - name: Analyze crash dumps
+      shell: pwsh
+      run: |
+        $dumps = Get-ChildItem -Path "D:\CrashDumps" -Filter "*.dmp" -ErrorAction SilentlyContinue
+        if ($dumps) {
+          Write-Host "=== Found $($dumps.Count) crash dump(s) ==="
+          foreach ($dump in $dumps) {
+            Write-Host ""
+            Write-Host "=== Dump: $($dump.Name) ($('{0:N0}' -f ($dump.Length / 1MB)) MB) ==="
+            Write-Host ""
+          }
+        } else {
+          Write-Host "No crash dumps found — WER may not have triggered."
+          Write-Host "Listing D:\CrashDumps contents:"
+          Get-ChildItem -Path "D:\CrashDumps" -ErrorAction SilentlyContinue | Format-Table
+        }
+
+    - name: GDB post-mortem analysis
+      if: always()
+      run: |
+        echo "=== Checking for crash dumps ==="
+        ls -la /d/CrashDumps/ 2>/dev/null || echo "No dumps directory"
+
+        for dump in /d/CrashDumps/*.dmp; do
+          [ -f "$dump" ] || continue
+          echo ""
+          echo "=== Analyzing: $dump ==="
+          echo ""
+          # Load the dump in gdb for post-mortem analysis
+          gdb -batch \
+            -ex "target mini $dump" \
+            -ex "echo === CRASHING THREAD BACKTRACE ===\n" \
+            -ex "bt" \
+            -ex "echo \n=== ALL THREADS ===\n" \
+            -ex "thread apply all bt" \
+            -ex "echo \n=== REGISTERS ===\n" \
+            -ex "info registers" \
+            -ex "quit" \
+            tests/networking_tests/http_client_test/http_client_test.exe \
+            2>&1 || echo "gdb analysis failed for $dump"
+        done
 
     - name: Run remaining tests
-      working-directory: build
+      if: always()
       run: |
         ctest --output-on-failure -R \
           "^(websocket_client_test|websocket_close_test|wss_test|shared_context_bug_test|utf8_test|https_test)$"

From 2b7188930f7ce6ff350848e839e800e9f53eb902 Mon Sep 17 00:00:00 2001
From: Stephen Berry <stephenberry.developer@gmail.com>
Date: Wed, 8 Apr 2026 11:53:13 -0500
Subject: [PATCH 10/41] Update msys2-ssl.yml

---
 .github/workflows/msys2-ssl.yml | 69 +++++++++++++++++++++------------
 1 file changed, 44 insertions(+), 25 deletions(-)

diff --git a/.github/workflows/msys2-ssl.yml b/.github/workflows/msys2-ssl.yml
index c1d8e11190..e298b87c52 100644
--- a/.github/workflows/msys2-ssl.yml
+++ b/.github/workflows/msys2-ssl.yml
@@ -60,9 +60,7 @@ jobs:
           utf8_test \
           https_test
 
-    # Configure Windows Error Reporting to create full crash dumps.
-    # This is completely non-intrusive — WER only activates AFTER the crash,
-    # so it doesn't affect timing or memory layout like GDB/Page Heap do.
+    # Configure WER crash dumps before running tests
     - name: Configure crash dumps (WER)
       shell: pwsh
       run: |
@@ -70,56 +68,73 @@ jobs:
         New-Item -Path $dumpPath -ItemType Directory -Force | Out-Null
         $regPath = "HKLM:\SOFTWARE\Microsoft\Windows\Windows Error Reporting\LocalDumps"
         New-Item -Path $regPath -Force | Out-Null
-        Set-ItemProperty -Path $regPath -Name "DumpType" -Value 2 -Type DWord          # 2 = Full dump
+        Set-ItemProperty -Path $regPath -Name "DumpType" -Value 2 -Type DWord
         Set-ItemProperty -Path $regPath -Name "DumpFolder" -Value $dumpPath -Type ExpandString
         Set-ItemProperty -Path $regPath -Name "DumpCount" -Value 10 -Type DWord
         Write-Host "WER crash dumps configured at $dumpPath"
 
-    # Run the crashing test natively (no GDB, no Page Heap)
-    - name: Run http_client_test (native)
+    # Run http_client_test up to 50 times — stop on first crash
+    - name: "Repeat: http_client_test (up to 50x)"
       working-directory: build
       run: |
-        echo "Running http_client_test natively to reproduce crash..."
-        ctest --output-on-failure -R "^http_client_test$" || true
+        echo "Running http_client_test repeatedly until crash or 50 passes..."
+        for i in $(seq 1 50); do
+          echo -n "Run $i/50: "
+          if ! ctest --output-on-failure -R "^http_client_test$" 2>&1 | tail -1; then
+            echo "CRASHED on run $i"
+            break
+          fi
+          if [ $i -eq 50 ]; then
+            echo "All 50 runs passed (crash did not reproduce)"
+          fi
+        done
 
-    - name: Run mingw_ssl_diag (native)
+    # Run mingw_ssl_diag up to 50 times
+    - name: "Repeat: mingw_ssl_diag (up to 50x)"
       working-directory: build
       run: |
-        ctest --output-on-failure -R "^mingw_ssl_diag$" || true
+        echo "Running mingw_ssl_diag repeatedly until crash or 50 passes..."
+        for i in $(seq 1 50); do
+          echo -n "Run $i/50: "
+          if ! ctest --output-on-failure -R "^mingw_ssl_diag$" 2>&1 | tail -1; then
+            echo "CRASHED on run $i"
+            break
+          fi
+          if [ $i -eq 50 ]; then
+            echo "All 50 runs passed (crash did not reproduce)"
+          fi
+        done
 
-    # Analyze any crash dumps that were created
+    # Check for and analyze any crash dumps
     - name: Analyze crash dumps
+      if: always()
       shell: pwsh
       run: |
         $dumps = Get-ChildItem -Path "D:\CrashDumps" -Filter "*.dmp" -ErrorAction SilentlyContinue
         if ($dumps) {
           Write-Host "=== Found $($dumps.Count) crash dump(s) ==="
           foreach ($dump in $dumps) {
-            Write-Host ""
-            Write-Host "=== Dump: $($dump.Name) ($('{0:N0}' -f ($dump.Length / 1MB)) MB) ==="
-            Write-Host ""
+            Write-Host "  $($dump.Name) — $('{0:N1}' -f ($dump.Length / 1MB)) MB"
           }
         } else {
-          Write-Host "No crash dumps found — WER may not have triggered."
-          Write-Host "Listing D:\CrashDumps contents:"
-          Get-ChildItem -Path "D:\CrashDumps" -ErrorAction SilentlyContinue | Format-Table
+          Write-Host "No crash dumps captured."
         }
 
-    - name: GDB post-mortem analysis
+    - name: GDB post-mortem
       if: always()
       run: |
-        echo "=== Checking for crash dumps ==="
-        ls -la /d/CrashDumps/ 2>/dev/null || echo "No dumps directory"
-
+        found=0
         for dump in /d/CrashDumps/*.dmp; do
           [ -f "$dump" ] || continue
+          found=1
           echo ""
-          echo "=== Analyzing: $dump ==="
+          echo "========================================="
+          echo "=== Analyzing: $dump"
+          echo "========================================="
           echo ""
-          # Load the dump in gdb for post-mortem analysis
           gdb -batch \
             -ex "target mini $dump" \
-            -ex "echo === CRASHING THREAD BACKTRACE ===\n" \
+            -ex "echo === CRASHING THREAD ===\n" \
             -ex "bt" \
             -ex "echo \n=== ALL THREADS ===\n" \
             -ex "thread apply all bt" \
@@ -127,9 +142,13 @@ jobs:
             -ex "info registers" \
             -ex "quit" \
             tests/networking_tests/http_client_test/http_client_test.exe \
-            2>&1 || echo "gdb analysis failed for $dump"
+            2>&1 || echo "(gdb analysis failed)"
         done
 
+        if [ $found -eq 0 ]; then
+          echo "No crash dumps to analyze."
+        fi
+
     - name: Run remaining tests
       if: always()
       run: |

From 9ee4791b829af6dd1f537b451d217a667b330447 Mon Sep 17 00:00:00 2001
From: Stephen Berry <stephenberry.developer@gmail.com>
Date: Wed, 8 Apr 2026 15:31:31 -0500
Subject: [PATCH 11/41] updates

---
 include/glaze/net/http_client.hpp             | 15 ++++
 .../mingw_ssl_diag/mingw_ssl_diag.cpp         | 90 ++++++++++++++++---
 2 files changed, 95 insertions(+), 10 deletions(-)

diff --git a/include/glaze/net/http_client.hpp b/include/glaze/net/http_client.hpp
index 199557b134..b5ba4bf7cc 100644
--- a/include/glaze/net/http_client.hpp
+++ b/include/glaze/net/http_client.hpp
@@ -1015,6 +1015,21 @@ namespace glz
                thread.join();
             }
          }
+
+         // Drain any pending completion handlers so they are destroyed now,
+         // while the io_context and connection_pool are still alive.
+         // Without this, pending handlers (holding shared_ptrs to sockets)
+         // are destroyed inside the io_context destructor. If a handler holds
+         // the last reference to an SSL socket, its destructor runs mid
+         // io_context teardown — undefined behavior that causes heap corruption
+         // on MinGW/GCC with Windows (0xc0000374).
+         async_io_context->restart();
+         async_io_context->poll();
+
+         // Release pooled connections (and their sockets) while the io_context
+         // is still valid. Socket destructors may need to deregister from the
+         // io_context's reactor/IOCP.
+         connection_pool.reset();
       }
 
       std::shared_ptr<http_stream_connection> perform_stream_request(
diff --git a/tests/networking_tests/mingw_ssl_diag/mingw_ssl_diag.cpp b/tests/networking_tests/mingw_ssl_diag/mingw_ssl_diag.cpp
index 46b2cd0b16..8d9f9af1e3 100644
--- a/tests/networking_tests/mingw_ssl_diag/mingw_ssl_diag.cpp
+++ b/tests/networking_tests/mingw_ssl_diag/mingw_ssl_diag.cpp
@@ -43,6 +43,15 @@ class diag_server
          res.status(200).body("slow");
       });
 
+      // Streaming endpoint
+      server_.stream_get("/stream", [](glz::request&, glz::streaming_response& res) {
+         res.start_stream(200, {{"Content-Type", "text/plain"}});
+         res.send("chunk1;");
+         res.send("chunk2;");
+         res.send("chunk3;");
+         res.close();
+      });
+
       for (uint16_t p = 19200; p < 19300; ++p) {
          try {
             server_.bind("127.0.0.1", p);
@@ -317,37 +326,98 @@ suite mingw_ssl_diag = [] {
       std::cout << "[phase10] OK - concurrent clients" << std::endl;
    };
 
-   // Phase 11: Mixed sync + async with destruction under load
-   // Combines the most aggressive patterns.
-   "phase11_stress_mixed"_test = [] {
-      std::cout << "[phase11] Mixed stress test..." << std::endl;
+   // Phase 11: Streaming request — the code path in http_client_test
+   // that we suspect triggers the heap corruption.
+   "phase11_streaming_request"_test = [] {
+      std::cout << "[phase11] Streaming request..." << std::endl;
+
+      diag_server server;
+      expect(server.start()) << "Server failed to start";
+
+      {
+         glz::http_client client;
+
+         std::string received;
+         std::mutex mtx;
+         std::promise<void> done;
+         auto future = done.get_future();
+
+         auto conn = client.stream_request_v2({
+            .method = "GET",
+            .url = server.url() + "/stream",
+            .on_connect = [](const glz::response&) {},
+            .on_disconnect = [&]() { done.set_value(); },
+            .on_data = [&](std::string_view data) {
+               std::lock_guard lock(mtx);
+               received.append(data);
+            },
+            .on_error = [](std::error_code) {},
+         });
+
+         auto status = future.wait_for(std::chrono::seconds(5));
+         expect(status == std::future_status::ready) << "Stream did not complete";
+      }
+
+      server.stop();
+      std::cout << "[phase11] OK - streaming request" << std::endl;
+   };
+
+   // Phase 12: Repeated streaming with client destruction
+   "phase12_streaming_destroy_cycle"_test = [] {
+      std::cout << "[phase12] Streaming with client destruction cycling..." << std::endl;
+
+      diag_server server;
+      expect(server.start()) << "Server failed to start";
+
+      for (int round = 0; round < 20; ++round) {
+         glz::http_client client;
+
+         std::promise<void> done;
+         auto future = done.get_future();
+
+         auto conn = client.stream_request_v2({
+            .method = "GET",
+            .url = server.url() + "/stream",
+            .on_connect = [](const glz::response&) {},
+            .on_disconnect = [&]() { done.set_value(); },
+            .on_data = [](std::string_view) {},
+            .on_error = [](std::error_code) {},
+         });
+
+         auto status = future.wait_for(std::chrono::seconds(5));
+         (void)status;
+         // Destroy client — may have pending handlers
+      }
+
+      server.stop();
+      std::cout << "[phase12] OK - streaming destroy cycle" << std::endl;
+   };
+
+   // Phase 13: Mixed sync + async with destruction under load
+   "phase13_stress_mixed"_test = [] {
+      std::cout << "[phase13] Mixed stress test..." << std::endl;
 
       diag_server server;
       expect(server.start()) << "Server failed to start";
 
       for (int round = 0; round < 10; ++round) {
-         // Create client, fire a mix of sync and async, destroy
          glz::http_client client;
 
-         // Sync request
          auto result = client.get(server.url() + "/ping");
          (void)result;
 
-         // Fire several async requests against both fast and slow endpoints
          for (int i = 0; i < 3; ++i) {
             client.get_async(server.url() + "/ping", {}, [](auto) {});
             client.get_async(server.url() + "/slow", {}, [](auto) {});
          }
 
-         // Small random-ish delay to vary the destruction timing
          if (round % 3 == 0) {
             std::this_thread::sleep_for(std::chrono::milliseconds(10));
          }
-         // Destroy with mixed pending work
       }
 
       server.stop();
-      std::cout << "[phase11] OK - mixed stress test" << std::endl;
+      std::cout << "[phase13] OK - mixed stress test" << std::endl;
    };
 };
 

From 51e3846f911a8d88b48b1b3c526b02825b7bfe5b Mon Sep 17 00:00:00 2001
From: Stephen Berry <stephenberry.developer@gmail.com>
Date: Wed, 8 Apr 2026 16:23:23 -0500
Subject: [PATCH 12/41] Update msys2-ssl.yml

---
 .github/workflows/msys2-ssl.yml | 37 +++++++++++++++++----------------
 1 file changed, 19 insertions(+), 18 deletions(-)

diff --git a/.github/workflows/msys2-ssl.yml b/.github/workflows/msys2-ssl.yml
index e298b87c52..0ff35c0db4 100644
--- a/.github/workflows/msys2-ssl.yml
+++ b/.github/workflows/msys2-ssl.yml
@@ -73,37 +73,38 @@ jobs:
         Set-ItemProperty -Path $regPath -Name "DumpCount" -Value 10 -Type DWord
         Write-Host "WER crash dumps configured at $dumpPath"
 
-    # Run http_client_test up to 50 times — stop on first crash
+    # Run http_client_test up to 50 times — stop on first crash.
+    # Previously this crashed on the very first attempt, so 50 clean
+    # runs is strong evidence the fix works.
     - name: "Repeat: http_client_test (up to 50x)"
       working-directory: build
       run: |
-        echo "Running http_client_test repeatedly until crash or 50 passes..."
+        echo "Running http_client_test up to 50 times..."
         for i in $(seq 1 50); do
-          echo -n "Run $i/50: "
-          if ! ctest --output-on-failure -R "^http_client_test$" 2>&1 | tail -1; then
-            echo "CRASHED on run $i"
-            break
-          fi
-          if [ $i -eq 50 ]; then
-            echo "All 50 runs passed (crash did not reproduce)"
+          echo "--- Run $i/50 ---"
+          ctest --output-on-failure -R "^http_client_test$"
+          rc=$?
+          if [ $rc -ne 0 ]; then
+            echo "FAILED on run $i (exit code $rc)"
+            exit $rc
           fi
         done
+        echo "All 50 runs passed."
 
-    # Run mingw_ssl_diag up to 50 times
     - name: "Repeat: mingw_ssl_diag (up to 50x)"
       working-directory: build
       run: |
-        echo "Running mingw_ssl_diag repeatedly until crash or 50 passes..."
+        echo "Running mingw_ssl_diag up to 50 times..."
         for i in $(seq 1 50); do
-          echo -n "Run $i/50: "
-          if ! ctest --output-on-failure -R "^mingw_ssl_diag$" 2>&1 | tail -1; then
-            echo "CRASHED on run $i"
-            break
-          fi
-          if [ $i -eq 50 ]; then
-            echo "All 50 runs passed (crash did not reproduce)"
+          echo "--- Run $i/50 ---"
+          ctest --output-on-failure -R "^mingw_ssl_diag$"
+          rc=$?
+          if [ $rc -ne 0 ]; then
+            echo "FAILED on run $i (exit code $rc)"
+            exit $rc
           fi
         done
+        echo "All 50 runs passed."
 
     # Check for and analyze any crash dumps
     - name: Analyze crash dumps

From a2d70b777fe143991fd8a614446d1c34080eed31 Mon Sep 17 00:00:00 2001
From: Stephen Berry <stephenberry.developer@gmail.com>
Date: Thu, 9 Apr 2026 04:42:45 -0500
Subject: [PATCH 13/41] better diagnostics

---
 .github/workflows/msys2-ssl.yml               | 35 +++++--------------
 .../http_client_test/http_client_test.cpp     |  2 ++
 .../mingw_ssl_diag/mingw_ssl_diag.cpp         |  4 +++
 3 files changed, 14 insertions(+), 27 deletions(-)

diff --git a/.github/workflows/msys2-ssl.yml b/.github/workflows/msys2-ssl.yml
index 0ff35c0db4..9ba1008a2f 100644
--- a/.github/workflows/msys2-ssl.yml
+++ b/.github/workflows/msys2-ssl.yml
@@ -73,38 +73,19 @@ jobs:
         Set-ItemProperty -Path $regPath -Name "DumpCount" -Value 10 -Type DWord
         Write-Host "WER crash dumps configured at $dumpPath"
 
-    # Run http_client_test up to 50 times — stop on first crash.
-    # Previously this crashed on the very first attempt, so 50 clean
-    # runs is strong evidence the fix works.
-    - name: "Repeat: http_client_test (up to 50x)"
+    # Run http_client_test directly (not via ctest) so stdout isn't buffered.
+    # The ut framework prints test names as they run, so we'll see the last
+    # successful test before the crash.
+    - name: "Run http_client_test (direct)"
       working-directory: build
       run: |
-        echo "Running http_client_test up to 50 times..."
-        for i in $(seq 1 50); do
-          echo "--- Run $i/50 ---"
-          ctest --output-on-failure -R "^http_client_test$"
-          rc=$?
-          if [ $rc -ne 0 ]; then
-            echo "FAILED on run $i (exit code $rc)"
-            exit $rc
-          fi
-        done
-        echo "All 50 runs passed."
+        echo "Running http_client_test directly to capture last test before crash..."
+        ./tests/networking_tests/http_client_test/http_client_test.exe 2>&1 || true
 
-    - name: "Repeat: mingw_ssl_diag (up to 50x)"
+    - name: "Run mingw_ssl_diag"
       working-directory: build
       run: |
-        echo "Running mingw_ssl_diag up to 50 times..."
-        for i in $(seq 1 50); do
-          echo "--- Run $i/50 ---"
-          ctest --output-on-failure -R "^mingw_ssl_diag$"
-          rc=$?
-          if [ $rc -ne 0 ]; then
-            echo "FAILED on run $i (exit code $rc)"
-            exit $rc
-          fi
-        done
-        echo "All 50 runs passed."
+        ./tests/networking_tests/mingw_ssl_diag/mingw_ssl_diag.exe 2>&1 || true
 
     # Check for and analyze any crash dumps
     - name: Analyze crash dumps
diff --git a/tests/networking_tests/http_client_test/http_client_test.cpp b/tests/networking_tests/http_client_test/http_client_test.cpp
index fef0a25b47..0afd85e47c 100644
--- a/tests/networking_tests/http_client_test/http_client_test.cpp
+++ b/tests/networking_tests/http_client_test/http_client_test.cpp
@@ -1293,6 +1293,8 @@ suite eof_delimited_tests = [] {
 
 int main()
 {
+   // Force line-buffered stdout so crash output shows the last completed test
+   std::setvbuf(stdout, nullptr, _IOLBF, 0);
    std::cout << "Running HTTP Client Tests...\n";
    std::cout << "============================\n";
    return 0;
diff --git a/tests/networking_tests/mingw_ssl_diag/mingw_ssl_diag.cpp b/tests/networking_tests/mingw_ssl_diag/mingw_ssl_diag.cpp
index 8d9f9af1e3..af6d089124 100644
--- a/tests/networking_tests/mingw_ssl_diag/mingw_ssl_diag.cpp
+++ b/tests/networking_tests/mingw_ssl_diag/mingw_ssl_diag.cpp
@@ -426,7 +426,11 @@ int main()
    std::cout << "MinGW + SSL Diagnostic Test" << std::endl;
    std::cout << "===========================" << std::endl;
    std::cout << "OpenSSL version: " << OpenSSL_version(OPENSSL_VERSION) << std::endl;
+#ifdef __VERSION__
    std::cout << "Compiler: " << __VERSION__ << std::endl;
+#elif defined(_MSC_VER)
+   std::cout << "Compiler: MSVC " << _MSC_VER << std::endl;
+#endif
    std::cout << std::endl;
    return 0;
 }

From 4682ddadb1ece074b8b080776cd58a8a1a52d872 Mon Sep 17 00:00:00 2001
From: Stephen Berry <stephenberry.developer@gmail.com>
Date: Thu, 9 Apr 2026 05:10:47 -0500
Subject: [PATCH 14/41] Update msys2-ssl.yml

---
 .github/workflows/msys2-ssl.yml | 38 ++++++++++++++++++++++++++-------
 1 file changed, 30 insertions(+), 8 deletions(-)

diff --git a/.github/workflows/msys2-ssl.yml b/.github/workflows/msys2-ssl.yml
index 9ba1008a2f..e998e47187 100644
--- a/.github/workflows/msys2-ssl.yml
+++ b/.github/workflows/msys2-ssl.yml
@@ -73,19 +73,41 @@ jobs:
         Set-ItemProperty -Path $regPath -Name "DumpCount" -Value 10 -Type DWord
         Write-Host "WER crash dumps configured at $dumpPath"
 
-    # Run http_client_test directly (not via ctest) so stdout isn't buffered.
-    # The ut framework prints test names as they run, so we'll see the last
-    # successful test before the crash.
-    - name: "Run http_client_test (direct)"
+    # Run http_client_test directly up to 10 times to catch the intermittent crash.
+    # Output goes to a temp file so we can see the last test before crash.
+    - name: "Repeat: http_client_test (up to 10x, direct)"
       working-directory: build
       run: |
-        echo "Running http_client_test directly to capture last test before crash..."
-        ./tests/networking_tests/http_client_test/http_client_test.exe 2>&1 || true
+        exe="tests/networking_tests/http_client_test/http_client_test.exe"
+        echo "Verifying executable exists: $exe"
+        ls -la "$exe"
+        for i in $(seq 1 10); do
+          echo ""
+          echo "=== http_client_test run $i/10 ==="
+          "$exe"
+          rc=$?
+          if [ $rc -ne 0 ]; then
+            echo "CRASHED on run $i with exit code $rc (hex: $(printf '0x%x' $rc))"
+            exit 1
+          fi
+          echo "Run $i passed."
+        done
+        echo "All 10 runs passed."
 
-    - name: "Run mingw_ssl_diag"
+    - name: "Repeat: mingw_ssl_diag (up to 3x, direct)"
       working-directory: build
       run: |
-        ./tests/networking_tests/mingw_ssl_diag/mingw_ssl_diag.exe 2>&1 || true
+        exe="tests/networking_tests/mingw_ssl_diag/mingw_ssl_diag.exe"
+        for i in $(seq 1 3); do
+          echo "=== mingw_ssl_diag run $i/3 ==="
+          "$exe"
+          rc=$?
+          if [ $rc -ne 0 ]; then
+            echo "CRASHED on run $i with exit code $rc"
+            exit 1
+          fi
+        done
+        echo "All 3 runs passed."
 
     # Check for and analyze any crash dumps
     - name: Analyze crash dumps

From 43a5eae2e57e308426ee6fa5d93feb0e21fd9560 Mon Sep 17 00:00:00 2001
From: Stephen Berry <stephenberry.developer@gmail.com>
Date: Thu, 9 Apr 2026 05:18:42 -0500
Subject: [PATCH 15/41] Update msys2-ssl.yml

---
 .github/workflows/msys2-ssl.yml | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/msys2-ssl.yml b/.github/workflows/msys2-ssl.yml
index e998e47187..63dd7b0dc1 100644
--- a/.github/workflows/msys2-ssl.yml
+++ b/.github/workflows/msys2-ssl.yml
@@ -84,13 +84,19 @@ jobs:
         for i in $(seq 1 10); do
           echo ""
           echo "=== http_client_test run $i/10 ==="
+          if [ ! -f "$exe" ]; then
+            echo "ERROR: executable disappeared before run $i"
+            exit 1
+          fi
           "$exe"
           rc=$?
           if [ $rc -ne 0 ]; then
             echo "CRASHED on run $i with exit code $rc (hex: $(printf '0x%x' $rc))"
+            ls -la "$exe" 2>/dev/null || echo "Executable no longer exists!"
             exit 1
           fi
           echo "Run $i passed."
+          sleep 1
         done
         echo "All 10 runs passed."
 
@@ -106,6 +112,7 @@ jobs:
             echo "CRASHED on run $i with exit code $rc"
             exit 1
           fi
+          sleep 1
         done
         echo "All 3 runs passed."
 
@@ -156,5 +163,5 @@ jobs:
     - name: Run remaining tests
       if: always()
       run: |
-        ctest --output-on-failure -R \
+        ctest -C Release --output-on-failure -R \
           "^(websocket_client_test|websocket_close_test|wss_test|shared_context_bug_test|utf8_test|https_test)$"

From 4ad07d8512a66228983a9efc7679326d91513fec Mon Sep 17 00:00:00 2001
From: Stephen Berry <stephenberry.developer@gmail.com>
Date: Thu, 9 Apr 2026 08:42:26 -0500
Subject: [PATCH 16/41] Update msys2-ssl.yml

---
 .github/workflows/msys2-ssl.yml | 23 +++++------------------
 1 file changed, 5 insertions(+), 18 deletions(-)

diff --git a/.github/workflows/msys2-ssl.yml b/.github/workflows/msys2-ssl.yml
index 63dd7b0dc1..65dbb4f3fc 100644
--- a/.github/workflows/msys2-ssl.yml
+++ b/.github/workflows/msys2-ssl.yml
@@ -78,41 +78,28 @@ jobs:
     - name: "Repeat: http_client_test (up to 10x, direct)"
       working-directory: build
       run: |
-        exe="tests/networking_tests/http_client_test/http_client_test.exe"
-        echo "Verifying executable exists: $exe"
-        ls -la "$exe"
         for i in $(seq 1 10); do
-          echo ""
           echo "=== http_client_test run $i/10 ==="
-          if [ ! -f "$exe" ]; then
-            echo "ERROR: executable disappeared before run $i"
-            exit 1
-          fi
-          "$exe"
+          ctest -C Release --output-on-failure -R "^http_client_test$"
           rc=$?
           if [ $rc -ne 0 ]; then
-            echo "CRASHED on run $i with exit code $rc (hex: $(printf '0x%x' $rc))"
-            ls -la "$exe" 2>/dev/null || echo "Executable no longer exists!"
+            echo "FAILED on run $i (exit code $rc)"
             exit 1
           fi
-          echo "Run $i passed."
-          sleep 1
         done
         echo "All 10 runs passed."
 
-    - name: "Repeat: mingw_ssl_diag (up to 3x, direct)"
+    - name: "Repeat: mingw_ssl_diag (up to 3x)"
       working-directory: build
       run: |
-        exe="tests/networking_tests/mingw_ssl_diag/mingw_ssl_diag.exe"
         for i in $(seq 1 3); do
           echo "=== mingw_ssl_diag run $i/3 ==="
-          "$exe"
+          ctest -C Release --output-on-failure -R "^mingw_ssl_diag$"
           rc=$?
           if [ $rc -ne 0 ]; then
-            echo "CRASHED on run $i with exit code $rc"
+            echo "FAILED on run $i (exit code $rc)"
             exit 1
           fi
-          sleep 1
         done
         echo "All 3 runs passed."
 

From a87c467f8c5b8949696c6753e5f333ce239bea82 Mon Sep 17 00:00:00 2001
From: Stephen Berry <stephenberry.developer@gmail.com>
Date: Thu, 9 Apr 2026 09:03:28 -0500
Subject: [PATCH 17/41] Update http_client_test.cpp

---
 .../http_client_test/http_client_test.cpp     | 58 ++++++++++---------
 1 file changed, 31 insertions(+), 27 deletions(-)

diff --git a/tests/networking_tests/http_client_test/http_client_test.cpp b/tests/networking_tests/http_client_test/http_client_test.cpp
index 0afd85e47c..bb0a2c6cfc 100644
--- a/tests/networking_tests/http_client_test/http_client_test.cpp
+++ b/tests/networking_tests/http_client_test/http_client_test.cpp
@@ -446,8 +446,12 @@ class simple_test_client
    }
 };
 
+// Crash diagnostic: print test name to stderr (unbuffered) before each test.
+// stderr survives process crash, so we can see the last test that started.
+#define TRACE_TEST std::fprintf(stderr, "[TEST] %s:%d\n", __func__, __LINE__)
+
 suite working_http_tests = [] {
-   "url_parsing_basic"_test = [] {
+   "url_parsing_basic"_test = [] { TRACE_TEST;
       auto result = parse_url("http://example.com/test");
       expect(result.has_value()) << "Basic URL should parse correctly\n";
       expect(result->protocol == "http") << "Protocol should be http\n";
@@ -456,7 +460,7 @@ suite working_http_tests = [] {
       expect(result->path == "/test") << "Path should be /test\n";
    };
 
-   "simple_server_test"_test = [] {
+   "simple_server_test"_test = [] { TRACE_TEST;
       working_test_server server;
 
       expect(server.start()) << "Test server should start successfully\n";
@@ -468,7 +472,7 @@ suite working_http_tests = [] {
       server.stop();
    };
 
-   "basic_get_request"_test = [] {
+   "basic_get_request"_test = [] { TRACE_TEST;
       working_test_server server;
       expect(server.start()) << "Server should start\n";
 
@@ -485,7 +489,7 @@ suite working_http_tests = [] {
       std::this_thread::sleep_for(std::chrono::milliseconds(50)); // Clean shutdown
    };
 
-   "cors_preflight_generates_options_response"_test = [] {
+   "cors_preflight_generates_options_response"_test = [] { TRACE_TEST;
       working_test_server server;
       expect(server.start()) << "Server should start\n";
 
@@ -507,7 +511,7 @@ suite working_http_tests = [] {
       std::this_thread::sleep_for(std::chrono::milliseconds(50)); // Clean shutdown
    };
 
-   "cors_dynamic_origin_validation"_test = [] {
+   "cors_dynamic_origin_validation"_test = [] { TRACE_TEST;
       glz::cors_config config;
       config.allowed_origins.clear();
       config.allowed_origins_validator = [](std::string_view origin) {
@@ -554,7 +558,7 @@ suite working_http_tests = [] {
       std::this_thread::sleep_for(std::chrono::milliseconds(50));
    };
 
-   "cors_reflects_headers"_test = [] {
+   "cors_reflects_headers"_test = [] { TRACE_TEST;
       glz::cors_config config;
       config.allowed_origins = {"http://client.local"};
       config.allowed_methods = {"GET", "HEAD", "POST", "PUT", "DELETE", "PATCH"};
@@ -599,7 +603,7 @@ suite working_http_tests = [] {
       std::this_thread::sleep_for(std::chrono::milliseconds(50));
    };
 
-   "cors_allow_all_headers_flag"_test = [] {
+   "cors_allow_all_headers_flag"_test = [] { TRACE_TEST;
       glz::cors_config config;
       config.allowed_origins = {"http://client.local"};
       config.allowed_methods = {"*"};
@@ -627,7 +631,7 @@ suite working_http_tests = [] {
       std::this_thread::sleep_for(std::chrono::milliseconds(50));
    };
 
-   "cors_preflight_rejects_missing_method"_test = [] {
+   "cors_preflight_rejects_missing_method"_test = [] { TRACE_TEST;
       working_test_server server;
       expect(server.start()) << "Server should start\n";
 
@@ -653,7 +657,7 @@ suite working_http_tests = [] {
       std::this_thread::sleep_for(std::chrono::milliseconds(50));
    };
 
-   "cors_wildcard_with_credentials_echoes_origin"_test = [] {
+   "cors_wildcard_with_credentials_echoes_origin"_test = [] { TRACE_TEST;
       glz::cors_config config;
       config.allowed_origins = {"*"};
       config.allow_credentials = true;
@@ -683,7 +687,7 @@ suite working_http_tests = [] {
       std::this_thread::sleep_for(std::chrono::milliseconds(50));
    };
 
-   "basic_post_request"_test = [] {
+   "basic_post_request"_test = [] { TRACE_TEST;
       working_test_server server;
       expect(server.start()) << "Server should start\n";
 
@@ -701,7 +705,7 @@ suite working_http_tests = [] {
       std::this_thread::sleep_for(std::chrono::milliseconds(50)); // Clean shutdown
    };
 
-   "multiple_requests"_test = [] {
+   "multiple_requests"_test = [] { TRACE_TEST;
       working_test_server server;
       expect(server.start()) << "Server should start\n";
 
@@ -720,7 +724,7 @@ suite working_http_tests = [] {
       std::this_thread::sleep_for(std::chrono::milliseconds(50)); // Clean shutdown
    };
 
-   "json_response"_test = [] {
+   "json_response"_test = [] { TRACE_TEST;
       working_test_server server;
       expect(server.start()) << "Server should start\n";
 
@@ -737,7 +741,7 @@ suite working_http_tests = [] {
       std::this_thread::sleep_for(std::chrono::milliseconds(50)); // Clean shutdown
    };
 
-   "error_handling"_test = [] {
+   "error_handling"_test = [] { TRACE_TEST;
       simple_test_client client;
 
       // Test connection to non-existent server
@@ -745,7 +749,7 @@ suite working_http_tests = [] {
       expect(!result.has_value()) << "Connection to closed port should fail\n";
    };
 
-   "http_status_error_category"_test = [] {
+   "http_status_error_category"_test = [] { TRACE_TEST;
       auto ec = make_http_status_error(502);
 
       expect(ec.category() == http_status_category());
@@ -754,7 +758,7 @@ suite working_http_tests = [] {
       expect(ec.message().find("502") != std::string::npos);
    };
 
-   "concurrent_server_requests"_test = [] {
+   "concurrent_server_requests"_test = [] { TRACE_TEST;
       working_test_server server;
       expect(server.start()) << "Server should start\n";
 
@@ -785,7 +789,7 @@ suite working_http_tests = [] {
 
 // Test suite for the main glz::http_client, including streaming
 suite glz_http_client_tests = [] {
-   "synchronous_put_request"_test = [] {
+   "synchronous_put_request"_test = [] { TRACE_TEST;
       working_test_server server;
       expect(server.start());
 
@@ -803,7 +807,7 @@ suite glz_http_client_tests = [] {
       server.stop();
    };
 
-   "put_json_sets_content_type"_test = [] {
+   "put_json_sets_content_type"_test = [] { TRACE_TEST;
       working_test_server server;
       expect(server.start());
 
@@ -830,7 +834,7 @@ suite glz_http_client_tests = [] {
       server.stop();
    };
 
-   "basic_streaming_get"_test = [] {
+   "basic_streaming_get"_test = [] { TRACE_TEST;
       working_test_server server;
       expect(server.start()) << "Server should start\n";
 
@@ -884,7 +888,7 @@ suite glz_http_client_tests = [] {
       std::this_thread::sleep_for(std::chrono::milliseconds(50));
    };
 
-   "client_disconnects_stream"_test = [] {
+   "client_disconnects_stream"_test = [] { TRACE_TEST;
       working_test_server server;
       expect(server.start()) << "Server should start\n";
 
@@ -948,7 +952,7 @@ suite glz_http_client_tests = [] {
       std::this_thread::sleep_for(std::chrono::milliseconds(50));
    };
 
-   "streaming_request_with_http_error"_test = [] {
+   "streaming_request_with_http_error"_test = [] { TRACE_TEST;
       working_test_server server;
       expect(server.start()) << "Server should start\n";
 
@@ -999,7 +1003,7 @@ suite glz_http_client_tests = [] {
       std::this_thread::sleep_for(std::chrono::milliseconds(50));
    };
 
-   "streaming_request_with_custom_status_predicate"_test = [] {
+   "streaming_request_with_custom_status_predicate"_test = [] { TRACE_TEST;
       working_test_server server;
       expect(server.start()) << "Server should start\n";
 
@@ -1040,7 +1044,7 @@ suite glz_http_client_tests = [] {
       std::this_thread::sleep_for(std::chrono::milliseconds(50));
    };
 
-   "streaming_request_custom_predicate_flags_success"_test = [] {
+   "streaming_request_custom_predicate_flags_success"_test = [] { TRACE_TEST;
       working_test_server server;
       expect(server.start()) << "Server should start\n";
 
@@ -1185,7 +1189,7 @@ class eof_delimited_server
 };
 
 suite eof_delimited_tests = [] {
-   "sync_eof_delimited_body"_test = [] {
+   "sync_eof_delimited_body"_test = [] { TRACE_TEST;
       const std::string expected_body = R"({"name":"Hue Bridge","modelid":"BSB002"})";
       eof_delimited_server server;
       expect(server.start(expected_body)) << "EOF-delimited server should start";
@@ -1202,7 +1206,7 @@ suite eof_delimited_tests = [] {
       server.stop();
    };
 
-   "async_eof_delimited_body"_test = [] {
+   "async_eof_delimited_body"_test = [] { TRACE_TEST;
       const std::string expected_body = R"({"name":"Hue Bridge","modelid":"BSB002"})";
       eof_delimited_server server;
       expect(server.start(expected_body)) << "EOF-delimited server should start";
@@ -1231,7 +1235,7 @@ suite eof_delimited_tests = [] {
       server.stop();
    };
 
-   "sync_eof_delimited_max_body_size"_test = [] {
+   "sync_eof_delimited_max_body_size"_test = [] { TRACE_TEST;
       // Body larger than the limit
       const std::string large_body(1024, 'X');
       eof_delimited_server server;
@@ -1246,7 +1250,7 @@ suite eof_delimited_tests = [] {
       server.stop();
    };
 
-   "async_eof_delimited_max_body_size"_test = [] {
+   "async_eof_delimited_max_body_size"_test = [] { TRACE_TEST;
       const std::string large_body(1024, 'X');
       eof_delimited_server server;
       expect(server.start(large_body)) << "EOF-delimited server should start";
@@ -1272,7 +1276,7 @@ suite eof_delimited_tests = [] {
       server.stop();
    };
 
-   "sync_eof_delimited_connection_reset"_test = [] {
+   "sync_eof_delimited_connection_reset"_test = [] { TRACE_TEST;
       // Server that resets the connection after sending partial data
       eof_delimited_server server;
       expect(server.start_with_reset()) << "Server should start";

From 499ec41c2673716d920eed86a79abd589e9b8071 Mon Sep 17 00:00:00 2001
From: Stephen Berry <stephenberry.developer@gmail.com>
Date: Thu, 9 Apr 2026 09:15:37 -0500
Subject: [PATCH 18/41] Update http_client_test.cpp

---
 .../http_client_test/http_client_test.cpp       | 17 +++++++++++++++--
 1 file changed, 15 insertions(+), 2 deletions(-)

diff --git a/tests/networking_tests/http_client_test/http_client_test.cpp b/tests/networking_tests/http_client_test/http_client_test.cpp
index bb0a2c6cfc..51847ea8c9 100644
--- a/tests/networking_tests/http_client_test/http_client_test.cpp
+++ b/tests/networking_tests/http_client_test/http_client_test.cpp
@@ -45,7 +45,11 @@ class working_test_server
   public:
    working_test_server() : port_(0), running_(false) {}
 
-   ~working_test_server() { stop(); }
+   ~working_test_server()
+   {
+      std::fprintf(stderr, "[TRACE] working_test_server dtor\n");
+      stop();
+   }
 
    void set_cors_config(glz::cors_config config) { cors_config_ = std::move(config); }
 
@@ -298,6 +302,7 @@ class simple_test_client
   public:
    simple_test_client() : io_context_(1)
    {
+      std::fprintf(stderr, "[TRACE] simple_test_client ctor\n");
       // Start a single worker thread
       worker_thread_ = std::thread([this]() {
          asio::executor_work_guard<asio::io_context::executor_type> work_guard(io_context_.get_executor());
@@ -307,10 +312,12 @@ class simple_test_client
 
    ~simple_test_client()
    {
+      std::fprintf(stderr, "[TRACE] simple_test_client dtor begin\n");
       io_context_.stop();
       if (worker_thread_.joinable()) {
          worker_thread_.join();
       }
+      std::fprintf(stderr, "[TRACE] simple_test_client dtor end\n");
    }
 
    std::expected<response, std::error_code> get(const std::string& url)
@@ -473,11 +480,15 @@ suite working_http_tests = [] {
    };
 
    "basic_get_request"_test = [] { TRACE_TEST;
+      std::fprintf(stderr, "[TRACE] creating server\n");
       working_test_server server;
+      std::fprintf(stderr, "[TRACE] starting server\n");
       expect(server.start()) << "Server should start\n";
-
+      std::fprintf(stderr, "[TRACE] creating client\n");
       simple_test_client client;
+      std::fprintf(stderr, "[TRACE] sending GET\n");
       auto result = client.get(server.base_url() + "/hello");
+      std::fprintf(stderr, "[TRACE] GET returned\n");
 
       expect(result.has_value()) << "GET request should succeed\n";
       if (result.has_value()) {
@@ -485,8 +496,10 @@ suite working_http_tests = [] {
          expect(result->response_body == "Hello, World!") << "Body should match\n";
       }
 
+      std::fprintf(stderr, "[TRACE] stopping server\n");
       server.stop();
       std::this_thread::sleep_for(std::chrono::milliseconds(50)); // Clean shutdown
+      std::fprintf(stderr, "[TRACE] test done\n");
    };
 
    "cors_preflight_generates_options_response"_test = [] { TRACE_TEST;

From e0364767c406995d1f38be9d862127163312f8c2 Mon Sep 17 00:00:00 2001
From: Stephen Berry <stephenberry.developer@gmail.com>
Date: Thu, 9 Apr 2026 09:33:55 -0500
Subject: [PATCH 19/41] Update http_client_test.cpp

---
 .../http_client_test/http_client_test.cpp     | 33 ++++++++++++++-----
 1 file changed, 25 insertions(+), 8 deletions(-)

diff --git a/tests/networking_tests/http_client_test/http_client_test.cpp b/tests/networking_tests/http_client_test/http_client_test.cpp
index 51847ea8c9..c26575992a 100644
--- a/tests/networking_tests/http_client_test/http_client_test.cpp
+++ b/tests/networking_tests/http_client_test/http_client_test.cpp
@@ -457,38 +457,54 @@ class simple_test_client
 // stderr survives process crash, so we can see the last test that started.
 #define TRACE_TEST std::fprintf(stderr, "[TEST] %s:%d\n", __func__, __LINE__)
 
+#ifdef _WIN32
+#include <windows.h>
+inline void check_heap(const char* label)
+{
+   BOOL ok = HeapValidate(GetProcessHeap(), 0, NULL);
+   std::fprintf(stderr, "[HEAP] %s: %s\n", label, ok ? "OK" : "CORRUPTED");
+}
+#else
+inline void check_heap(const char*) {}
+#endif
+
 suite working_http_tests = [] {
    "url_parsing_basic"_test = [] { TRACE_TEST;
+      check_heap("start of url_parsing_basic");
       auto result = parse_url("http://example.com/test");
       expect(result.has_value()) << "Basic URL should parse correctly\n";
       expect(result->protocol == "http") << "Protocol should be http\n";
       expect(result->host == "example.com") << "Host should be example.com\n";
       expect(result->port == 80) << "Port should default to 80\n";
       expect(result->path == "/test") << "Path should be /test\n";
+      check_heap("end of url_parsing_basic");
    };
 
    "simple_server_test"_test = [] { TRACE_TEST;
+      check_heap("before simple_server create");
       working_test_server server;
-
+      check_heap("after simple_server create");
       expect(server.start()) << "Test server should start successfully\n";
+      check_heap("after simple_server start");
       expect(server.port() > 0) << "Server should have valid port\n";
 
       // Give server a moment to fully initialize
       std::this_thread::sleep_for(std::chrono::milliseconds(100));
 
       server.stop();
+      check_heap("after simple_server stop");
    };
 
    "basic_get_request"_test = [] { TRACE_TEST;
-      std::fprintf(stderr, "[TRACE] creating server\n");
+      check_heap("before server create");
       working_test_server server;
-      std::fprintf(stderr, "[TRACE] starting server\n");
+      check_heap("after server create");
       expect(server.start()) << "Server should start\n";
-      std::fprintf(stderr, "[TRACE] creating client\n");
+      check_heap("after server start");
       simple_test_client client;
-      std::fprintf(stderr, "[TRACE] sending GET\n");
+      check_heap("after client create");
       auto result = client.get(server.base_url() + "/hello");
-      std::fprintf(stderr, "[TRACE] GET returned\n");
+      check_heap("after GET");
 
       expect(result.has_value()) << "GET request should succeed\n";
       if (result.has_value()) {
@@ -496,9 +512,10 @@ suite working_http_tests = [] {
          expect(result->response_body == "Hello, World!") << "Body should match\n";
       }
 
-      std::fprintf(stderr, "[TRACE] stopping server\n");
+      check_heap("before server stop");
       server.stop();
-      std::this_thread::sleep_for(std::chrono::milliseconds(50)); // Clean shutdown
+      check_heap("after server stop");
+      std::this_thread::sleep_for(std::chrono::milliseconds(50));
       std::fprintf(stderr, "[TRACE] test done\n");
    };
 

From 7912f79a94f4db714c39631f3afe0292f90dbdb6 Mon Sep 17 00:00:00 2001
From: Stephen Berry <stephenberry.developer@gmail.com>
Date: Thu, 9 Apr 2026 11:45:53 -0500
Subject: [PATCH 20/41] Update http_client_test.cpp

---
 .../networking_tests/http_client_test/http_client_test.cpp | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/tests/networking_tests/http_client_test/http_client_test.cpp b/tests/networking_tests/http_client_test/http_client_test.cpp
index c26575992a..9ba844c47e 100644
--- a/tests/networking_tests/http_client_test/http_client_test.cpp
+++ b/tests/networking_tests/http_client_test/http_client_test.cpp
@@ -116,12 +116,15 @@ class working_test_server
 
       // Give any ongoing operations a moment to complete
       std::this_thread::sleep_for(std::chrono::milliseconds(50));
+      check_heap("stop: after sleep");
 
       server_.stop();
+      check_heap("stop: after server_.stop()");
 
       if (server_thread_.joinable()) {
          server_thread_.join();
       }
+      check_heap("stop: after thread join");
    }
 
    uint16_t port() const { return port_; }
@@ -312,12 +315,12 @@ class simple_test_client
 
    ~simple_test_client()
    {
-      std::fprintf(stderr, "[TRACE] simple_test_client dtor begin\n");
+      check_heap("~simple_test_client: begin");
       io_context_.stop();
       if (worker_thread_.joinable()) {
          worker_thread_.join();
       }
-      std::fprintf(stderr, "[TRACE] simple_test_client dtor end\n");
+      check_heap("~simple_test_client: end");
    }
 
    std::expected<response, std::error_code> get(const std::string& url)

From 7916a5fd091f9c193077dc154719f8a9d194c32f Mon Sep 17 00:00:00 2001
From: Stephen Berry <stephenberry.developer@gmail.com>
Date: Thu, 9 Apr 2026 12:54:45 -0500
Subject: [PATCH 21/41] Update http_client_test.cpp

---
 .../http_client_test/http_client_test.cpp     | 29 +++++++++----------
 1 file changed, 14 insertions(+), 15 deletions(-)

diff --git a/tests/networking_tests/http_client_test/http_client_test.cpp b/tests/networking_tests/http_client_test/http_client_test.cpp
index 9ba844c47e..63bf5ddfbc 100644
--- a/tests/networking_tests/http_client_test/http_client_test.cpp
+++ b/tests/networking_tests/http_client_test/http_client_test.cpp
@@ -20,6 +20,20 @@
 using namespace ut;
 using namespace glz;
 
+// Crash diagnostic: print test name to stderr (unbuffered) before each test.
+#define TRACE_TEST std::fprintf(stderr, "[TEST] %s:%d\n", __func__, __LINE__)
+
+#ifdef _WIN32
+#include <windows.h>
+inline void check_heap(const char* label)
+{
+   BOOL ok = HeapValidate(GetProcessHeap(), 0, NULL);
+   std::fprintf(stderr, "[HEAP] %s: %s\n", label, ok ? "OK" : "CORRUPTED");
+}
+#else
+inline void check_heap(const char*) {}
+#endif
+
 namespace test_http_client
 {
    struct put_payload
@@ -456,21 +470,6 @@ class simple_test_client
    }
 };
 
-// Crash diagnostic: print test name to stderr (unbuffered) before each test.
-// stderr survives process crash, so we can see the last test that started.
-#define TRACE_TEST std::fprintf(stderr, "[TEST] %s:%d\n", __func__, __LINE__)
-
-#ifdef _WIN32
-#include <windows.h>
-inline void check_heap(const char* label)
-{
-   BOOL ok = HeapValidate(GetProcessHeap(), 0, NULL);
-   std::fprintf(stderr, "[HEAP] %s: %s\n", label, ok ? "OK" : "CORRUPTED");
-}
-#else
-inline void check_heap(const char*) {}
-#endif
-
 suite working_http_tests = [] {
    "url_parsing_basic"_test = [] { TRACE_TEST;
       check_heap("start of url_parsing_basic");

From 952ad64179d4dbfc65a23f39983e0d369fd113ae Mon Sep 17 00:00:00 2001
From: Stephen Berry <stephenberry.developer@gmail.com>
Date: Thu, 9 Apr 2026 13:34:37 -0500
Subject: [PATCH 22/41] Update http_server.hpp

---
 include/glaze/net/http_server.hpp | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/include/glaze/net/http_server.hpp b/include/glaze/net/http_server.hpp
index d0febccdd0..98f8cf7461 100644
--- a/include/glaze/net/http_server.hpp
+++ b/include/glaze/net/http_server.hpp
@@ -832,9 +832,13 @@ namespace glz
             }
          }
 
+         std::fprintf(stderr, "[HTTP_SERVER] before io_context->stop()\n");
+
          // Stop the io_context
          if (io_context) io_context->stop();
 
+         std::fprintf(stderr, "[HTTP_SERVER] after io_context->stop()\n");
+
          // Only join threads if we're not in one of the worker threads
          auto current_thread_id = std::this_thread::get_id();
          bool is_worker_thread = false;
@@ -848,14 +852,17 @@ namespace glz
          if (!is_worker_thread) {
             for (auto& thread : threads) {
                if (thread.joinable()) {
+                  std::fprintf(stderr, "[HTTP_SERVER] joining thread\n");
                   thread.join();
                }
             }
+            std::fprintf(stderr, "[HTTP_SERVER] threads cleared\n");
             threads.clear();
          }
 
          // Notify any threads waiting for shutdown
          shutdown_cv.notify_all();
+         std::fprintf(stderr, "[HTTP_SERVER] stop() complete\n");
       }
 
       inline http_server& mount(std::string_view base_path, const http_router& router)

From c980c1229306c5e5fd2e854a2f6b1e665357c305 Mon Sep 17 00:00:00 2001
From: Stephen Berry <stephenberry.developer@gmail.com>
Date: Thu, 9 Apr 2026 14:20:52 -0500
Subject: [PATCH 23/41] http_server fix

---
 docs/networking/mingw-ssl-heap-corruption.md | 105 +++++++++++++++++++
 include/glaze/net/http_server.hpp            |  18 ++--
 2 files changed, 116 insertions(+), 7 deletions(-)
 create mode 100644 docs/networking/mingw-ssl-heap-corruption.md

diff --git a/docs/networking/mingw-ssl-heap-corruption.md b/docs/networking/mingw-ssl-heap-corruption.md
new file mode 100644
index 0000000000..6c29f6a13e
--- /dev/null
+++ b/docs/networking/mingw-ssl-heap-corruption.md
@@ -0,0 +1,105 @@
+# MinGW + SSL Heap Corruption Investigation
+
+**Issue**: [#2411](https://github.com/stephenberry/glaze/pull/2411)
+**Date**: 2026-04-07 through 2026-04-09
+**Status**: Root cause identified, fix applied
+
+## Summary
+
+Heap corruption (`0xc0000374` STATUS_HEAP_CORRUPTION) occurs intermittently on MinGW/GCC 15.2.0 + Windows when `GLZ_ENABLE_SSL` is defined, even for plain HTTP/WS connections that don't use SSL.
+
+MSVC builds are unaffected. GDB and Page Heap both mask the issue by changing timing/memory layout.
+
+## Reproduction
+
+- **Platform**: Windows (GitHub Actions `windows-latest`), MSYS2 MINGW64
+- **Compiler**: GCC 15.2.0 (mingw-w64)
+- **OpenSSL**: 3.6.2
+- **ASIO**: 1.36.0 (standalone)
+- **Build**: Release with `-g` (debug symbols)
+- **Test**: `http_client_test` — crashes on ~50% of CI runs, always on run 1 when it does crash
+
+## Root Cause
+
+### The problem
+
+When `io_context::stop()` is called followed by `thread.join()`, the worker thread exits `io_context::run()`. However, there may be **queued-but-unexecuted completion handlers** remaining in the io_context's internal queue. These handlers are not executed — they sit in the queue until the `io_context` is destroyed.
+
+When `~io_context()` runs (during `~http_server()` member destruction), it destroys these pending handlers. The handlers' lambda captures hold `shared_ptr<connection_state>` which in turn hold ASIO sockets. Destroying sockets inside the io_context destructor is problematic because the io_context's internal data structures are being torn down simultaneously.
+
+On MinGW/GCC + Windows, this manifests as heap corruption. On MSVC, the different memory allocator and destruction ordering masks the issue.
+
+### Why SSL triggers it
+
+Defining `GLZ_ENABLE_SSL` changes the `http_server` struct layout (adds a `std::monostate ssl_context` member) and links OpenSSL libraries. This is sufficient to change heap allocation sizes and alignment, shifting the memory layout enough to expose the latent bug. The SSL code paths themselves are never executed for plain HTTP connections.
+
+### Narrowing timeline
+
+| Step | Finding |
+|------|---------|
+| HeapValidate before every operation | Heap is clean through server create, start, client create, GET request, and GET response |
+| HeapValidate before `server.stop()` | **OK** — heap is clean |
+| Trace inside `http_server::stop()` | `io_context->stop()` succeeds, crash occurs during `thread.join()` |
+| `thread.join()` | Worker thread is finishing; pending handlers are being processed/destroyed during shutdown |
+
+### The fix
+
+After stopping the io_context and joining all worker threads, **drain** the io_context to execute any remaining pending handlers while the server and its resources are still alive:
+
+```cpp
+// In http_server::stop(), after joining threads:
+if (io_context) {
+    io_context->restart();
+    io_context->poll();
+}
+```
+
+This ensures completion handlers (and their captured shared_ptrs to sockets/connections) are destroyed in a controlled manner, rather than inside `~io_context()`.
+
+The same fix pattern was applied to:
+- `http_server::stop()` — the confirmed crash site
+- `http_client::stop_workers()` — same pattern, preventive fix
+- `websocket_client` (on the `websocket` branch) — already had this fix via `cancel_all()`
+
+## ASIO analysis: this is a Glaze usage issue, not an ASIO bug
+
+Analysis of the ASIO 1.36.0 source code (standalone, Windows IOCP backend) confirms this is a Glaze-side issue.
+
+### ASIO's documented destruction semantics
+
+From `asio/io_context.hpp`:
+
+> On destruction, the io_context performs the following sequence of operations:
+> 1. For each service object svc, performs `svc->shutdown()`.
+> 2. **Uninvoked handler objects that were scheduled for deferred invocation on the io_context are destroyed.**
+> 3. For each service object svc, performs `delete static_cast<io_context::service*>(svc)`.
+
+Step 1 (`shutdown_services`) closes all sockets via `close_for_destruction()` in `win_iocp_socket_service_base::base_shutdown()`. This happens **before** pending handlers are destroyed.
+
+Step 2 destroys pending handlers. In the IOCP backend (`win_iocp_io_context::shutdown()`), this is done by dequeuing operations and calling `op->destroy()`, which invokes the handler's `do_complete` function with `owner = NULL`. The `do_complete` function **deallocates the handler's memory and calls its destructor** but does NOT invoke the user callback (guarded by `if (owner)`).
+
+### The problem in Glaze
+
+When a pending handler holds `shared_ptr<connection_state>` and that handler is destroyed during step 2, the `connection_state` destructor runs. This destroys the socket member. But the socket was already closed in step 1. On MinGW/GCC, the double-close or the interaction between socket destruction and io_context teardown causes heap corruption.
+
+The key issue: ASIO closes sockets in step 1 at the service level, then destroys handler captures in step 2. If a handler's capture holds the **last** shared_ptr to a connection_state, the socket destructor in step 2 may try to perform cleanup on an already-closed socket, leading to corruption of IOCP internal structures on MinGW.
+
+### Why the drain fix works
+
+By calling `io_context->restart()` + `io_context->poll()` after joining worker threads, all pending handlers execute (and their captures are destroyed) while the io_context is still fully operational. When `~io_context()` later runs, there are no pending handlers left to destroy.
+
+### Why MSVC is unaffected
+
+MSVC's CRT heap allocator handles the double-close/reentrancy differently (likely with more slack in heap metadata), so the corruption doesn't manifest. MinGW's heap implementation (using Windows' native HeapAlloc) is stricter about metadata integrity.
+
+### Correct usage pattern
+
+ASIO expects callers to ensure all pending work is either completed or safely cancellable before destroying the io_context:
+
+```cpp
+io_context->stop();       // Prevent new handler dispatch
+join_worker_threads();    // Wait for in-progress handlers to finish
+io_context->restart();    // Clear the stopped flag
+io_context->poll();       // Execute remaining queued handlers
+// Now safe to destroy io_context
+```
diff --git a/include/glaze/net/http_server.hpp b/include/glaze/net/http_server.hpp
index 98f8cf7461..abbc38b819 100644
--- a/include/glaze/net/http_server.hpp
+++ b/include/glaze/net/http_server.hpp
@@ -832,13 +832,9 @@ namespace glz
             }
          }
 
-         std::fprintf(stderr, "[HTTP_SERVER] before io_context->stop()\n");
-
          // Stop the io_context
          if (io_context) io_context->stop();
 
-         std::fprintf(stderr, "[HTTP_SERVER] after io_context->stop()\n");
-
          // Only join threads if we're not in one of the worker threads
          auto current_thread_id = std::this_thread::get_id();
          bool is_worker_thread = false;
@@ -852,17 +848,25 @@ namespace glz
          if (!is_worker_thread) {
             for (auto& thread : threads) {
                if (thread.joinable()) {
-                  std::fprintf(stderr, "[HTTP_SERVER] joining thread\n");
                   thread.join();
                }
             }
-            std::fprintf(stderr, "[HTTP_SERVER] threads cleared\n");
             threads.clear();
+
+            // Drain any pending completion handlers so they are destroyed now,
+            // while the server and its resources are still alive.
+            // Without this, pending handlers (holding shared_ptrs to
+            // connection_state and sockets) are destroyed inside the
+            // io_context destructor, which can cause heap corruption on
+            // MinGW/GCC with Windows.
+            if (io_context) {
+               io_context->restart();
+               io_context->poll();
+            }
          }
 
          // Notify any threads waiting for shutdown
          shutdown_cv.notify_all();
-         std::fprintf(stderr, "[HTTP_SERVER] stop() complete\n");
       }
 
       inline http_server& mount(std::string_view base_path, const http_router& router)

From aeccc6a39d624458ceffbecc8ee2bdef510dcddf Mon Sep 17 00:00:00 2001
From: Stephen Berry <stephenberry.developer@gmail.com>
Date: Thu, 9 Apr 2026 19:03:23 -0500
Subject: [PATCH 24/41] Update http_server.hpp

---
 include/glaze/net/http_server.hpp | 13 +++++++------
 1 file changed, 7 insertions(+), 6 deletions(-)

diff --git a/include/glaze/net/http_server.hpp b/include/glaze/net/http_server.hpp
index abbc38b819..1eb73cba5e 100644
--- a/include/glaze/net/http_server.hpp
+++ b/include/glaze/net/http_server.hpp
@@ -833,6 +833,7 @@ namespace glz
          }
 
          // Stop the io_context
+         std::fprintf(stderr, "[HTTP_SERVER] stop: io_context->stop()\n");
          if (io_context) io_context->stop();
 
          // Only join threads if we're not in one of the worker threads
@@ -846,25 +847,25 @@ namespace glz
          }
 
          if (!is_worker_thread) {
+            std::fprintf(stderr, "[HTTP_SERVER] stop: joining %zu threads\n", threads.size());
             for (auto& thread : threads) {
                if (thread.joinable()) {
                   thread.join();
                }
             }
+            std::fprintf(stderr, "[HTTP_SERVER] stop: threads joined\n");
             threads.clear();
 
-            // Drain any pending completion handlers so they are destroyed now,
-            // while the server and its resources are still alive.
-            // Without this, pending handlers (holding shared_ptrs to
-            // connection_state and sockets) are destroyed inside the
-            // io_context destructor, which can cause heap corruption on
-            // MinGW/GCC with Windows.
+            // Drain any pending completion handlers
             if (io_context) {
+               std::fprintf(stderr, "[HTTP_SERVER] stop: draining io_context\n");
                io_context->restart();
                io_context->poll();
+               std::fprintf(stderr, "[HTTP_SERVER] stop: drain complete\n");
             }
          }
 
+         std::fprintf(stderr, "[HTTP_SERVER] stop: complete\n");
          // Notify any threads waiting for shutdown
          shutdown_cv.notify_all();
       }

From f5ecf5c92a24bdd325567f98d2d6987f6f7c1854 Mon Sep 17 00:00:00 2001
From: Stephen Berry <stephenberry.developer@gmail.com>
Date: Thu, 9 Apr 2026 19:54:44 -0500
Subject: [PATCH 25/41] updates

---
 .github/workflows/msys2-ssl.yml              |  2 +-
 docs/networking/mingw-ssl-heap-corruption.md | 12 +++++++++++-
 2 files changed, 12 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/msys2-ssl.yml b/.github/workflows/msys2-ssl.yml
index 65dbb4f3fc..01d3efdfd4 100644
--- a/.github/workflows/msys2-ssl.yml
+++ b/.github/workflows/msys2-ssl.yml
@@ -44,7 +44,7 @@ jobs:
         cmake -S . -B build \
           -G Ninja \
           -DCMAKE_BUILD_TYPE=Release \
-          -DCMAKE_CXX_FLAGS="-g" \
+          -DCMAKE_CXX_FLAGS="-g -O0" \
           -DCMAKE_CXX_STANDARD=23 \
           -Dglaze_ENABLE_SSL=ON
 
diff --git a/docs/networking/mingw-ssl-heap-corruption.md b/docs/networking/mingw-ssl-heap-corruption.md
index 6c29f6a13e..ce15f020c2 100644
--- a/docs/networking/mingw-ssl-heap-corruption.md
+++ b/docs/networking/mingw-ssl-heap-corruption.md
@@ -84,7 +84,17 @@ When a pending handler holds `shared_ptr<connection_state>` and that handler is
 
 The key issue: ASIO closes sockets in step 1 at the service level, then destroys handler captures in step 2. If a handler's capture holds the **last** shared_ptr to a connection_state, the socket destructor in step 2 may try to perform cleanup on an already-closed socket, leading to corruption of IOCP internal structures on MinGW.
 
-### Why the drain fix works
+### Detailed crash site (from CI tracing)
+
+The crash occurs during `thread.join()` inside `http_server::stop()`. The `io_context->stop()` succeeds, but the worker thread crashes while exiting `io_context::run()`. The heap is verified clean (via `HeapValidate`) immediately before `server_.stop()` is called, and through `io_context->stop()` on the main thread.
+
+The crash only occurs when the server has handled at least one connection. A server that starts and stops without handling any connections does not crash. The connection cleanup (socket close after `Connection: close` response) is the likely trigger.
+
+A `restart()` + `poll()` drain after `thread.join()` does NOT fix the issue because the crash occurs during the join itself, before the drain runs.
+
+**Current hypothesis**: This may be a GCC 15.2.0 miscompilation on MinGW. The `std::monostate ssl_context` member changes the http_server struct layout just enough to trigger an optimizer bug in connection cleanup codegen. Testing with `-O0` to confirm.
+
+### Why the drain fix works (when it applies)
 
 By calling `io_context->restart()` + `io_context->poll()` after joining worker threads, all pending handlers execute (and their captures are destroyed) while the io_context is still fully operational. When `~io_context()` later runs, there are no pending handlers left to destroy.
 

From 73ce111a17f67cfd6930a5fd2aa7e7008b30a46d Mon Sep 17 00:00:00 2001
From: Stephen Berry <stephenberry.developer@gmail.com>
Date: Thu, 9 Apr 2026 21:29:50 -0500
Subject: [PATCH 26/41] Close all tracked sockets to cancel pending I/O

---
 .github/workflows/msys2-ssl.yml   |  2 +-
 include/glaze/net/http_server.hpp | 44 ++++++++++++++++++++-----------
 2 files changed, 29 insertions(+), 17 deletions(-)

diff --git a/.github/workflows/msys2-ssl.yml b/.github/workflows/msys2-ssl.yml
index 01d3efdfd4..65dbb4f3fc 100644
--- a/.github/workflows/msys2-ssl.yml
+++ b/.github/workflows/msys2-ssl.yml
@@ -44,7 +44,7 @@ jobs:
         cmake -S . -B build \
           -G Ninja \
           -DCMAKE_BUILD_TYPE=Release \
-          -DCMAKE_CXX_FLAGS="-g -O0" \
+          -DCMAKE_CXX_FLAGS="-g" \
           -DCMAKE_CXX_STANDARD=23 \
           -Dglaze_ENABLE_SSL=ON
 
diff --git a/include/glaze/net/http_server.hpp b/include/glaze/net/http_server.hpp
index 1eb73cba5e..938afe02dd 100644
--- a/include/glaze/net/http_server.hpp
+++ b/include/glaze/net/http_server.hpp
@@ -832,10 +832,6 @@ namespace glz
             }
          }
 
-         // Stop the io_context
-         std::fprintf(stderr, "[HTTP_SERVER] stop: io_context->stop()\n");
-         if (io_context) io_context->stop();
-
          // Only join threads if we're not in one of the worker threads
          auto current_thread_id = std::this_thread::get_id();
          bool is_worker_thread = false;
@@ -847,25 +843,30 @@ namespace glz
          }
 
          if (!is_worker_thread) {
-            std::fprintf(stderr, "[HTTP_SERVER] stop: joining %zu threads\n", threads.size());
+            // Close all tracked sockets to cancel pending I/O and allow
+            // the io_context to drain naturally before we force-stop.
+            {
+               std::lock_guard<std::mutex> lock(active_connections_mutex_);
+               for (auto& weak_conn : active_connections_) {
+                  if (auto conn = weak_conn.lock()) {
+                     asio::error_code ec;
+                     conn->socket.lowest_layer().close(ec);
+                  }
+               }
+               active_connections_.clear();
+            }
+
+            // Stop the io_context
+            if (io_context) io_context->stop();
+
             for (auto& thread : threads) {
                if (thread.joinable()) {
                   thread.join();
                }
             }
-            std::fprintf(stderr, "[HTTP_SERVER] stop: threads joined\n");
             threads.clear();
-
-            // Drain any pending completion handlers
-            if (io_context) {
-               std::fprintf(stderr, "[HTTP_SERVER] stop: draining io_context\n");
-               io_context->restart();
-               io_context->poll();
-               std::fprintf(stderr, "[HTTP_SERVER] stop: drain complete\n");
-            }
          }
 
-         std::fprintf(stderr, "[HTTP_SERVER] stop: complete\n");
          // Notify any threads waiting for shutdown
          shutdown_cv.notify_all();
       }
@@ -1483,6 +1484,10 @@ namespace glz
       std::condition_variable shutdown_cv;
       std::mutex shutdown_mutex;
 
+      // Active connection tracking for clean shutdown
+      std::mutex active_connections_mutex_;
+      std::vector<std::weak_ptr<connection_state>> active_connections_;
+
 #ifdef GLZ_ENABLE_SSL
       std::conditional_t<EnableTLS, std::unique_ptr<asio::ssl::context>, std::monostate> ssl_context;
 #endif
@@ -1536,7 +1541,14 @@ namespace glz
       }
 
       // Start handling a new connection
-      inline void start_connection(std::shared_ptr<connection_state> conn) { read_request(conn); }
+      inline void start_connection(std::shared_ptr<connection_state> conn)
+      {
+         {
+            std::lock_guard<std::mutex> lock(active_connections_mutex_);
+            active_connections_.push_back(conn);
+         }
+         read_request(conn);
+      }
 
       // Start or reset the idle timer for keep-alive connections
       inline void start_idle_timer(std::shared_ptr<connection_state> conn)

From 59688bf29100c8a54fc40812f5682f7408672ec5 Mon Sep 17 00:00:00 2001
From: Stephen Berry <stephenberry.developer@gmail.com>
Date: Fri, 10 Apr 2026 09:02:02 -0500
Subject: [PATCH 27/41] Update http_server.hpp

---
 include/glaze/net/http_server.hpp | 13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)

diff --git a/include/glaze/net/http_server.hpp b/include/glaze/net/http_server.hpp
index 938afe02dd..17cd20e89b 100644
--- a/include/glaze/net/http_server.hpp
+++ b/include/glaze/net/http_server.hpp
@@ -843,30 +843,37 @@ namespace glz
          }
 
          if (!is_worker_thread) {
-            // Close all tracked sockets to cancel pending I/O and allow
-            // the io_context to drain naturally before we force-stop.
+            std::fprintf(stderr, "[HTTP_SERVER] closing active connections\n");
+            // Close all tracked sockets to cancel pending I/O
             {
                std::lock_guard<std::mutex> lock(active_connections_mutex_);
+               std::fprintf(stderr, "[HTTP_SERVER] %zu tracked connections\n", active_connections_.size());
                for (auto& weak_conn : active_connections_) {
                   if (auto conn = weak_conn.lock()) {
+                     std::fprintf(stderr, "[HTTP_SERVER] closing socket\n");
                      asio::error_code ec;
                      conn->socket.lowest_layer().close(ec);
+                     std::fprintf(stderr, "[HTTP_SERVER] socket closed: %s\n", ec.message().c_str());
                   }
                }
                active_connections_.clear();
             }
 
-            // Stop the io_context
+            std::fprintf(stderr, "[HTTP_SERVER] calling io_context->stop()\n");
             if (io_context) io_context->stop();
+            std::fprintf(stderr, "[HTTP_SERVER] io_context stopped\n");
 
             for (auto& thread : threads) {
                if (thread.joinable()) {
+                  std::fprintf(stderr, "[HTTP_SERVER] joining thread\n");
                   thread.join();
+                  std::fprintf(stderr, "[HTTP_SERVER] thread joined\n");
                }
             }
             threads.clear();
          }
 
+         std::fprintf(stderr, "[HTTP_SERVER] stop complete\n");
          // Notify any threads waiting for shutdown
          shutdown_cv.notify_all();
       }

From d49405b3c7e18a779d7211d84408776984f6a20e Mon Sep 17 00:00:00 2001
From: Stephen Berry <stephenberry.developer@gmail.com>
Date: Fri, 10 Apr 2026 09:34:49 -0500
Subject: [PATCH 28/41] Update http_server.hpp

---
 include/glaze/net/http_server.hpp | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/include/glaze/net/http_server.hpp b/include/glaze/net/http_server.hpp
index 17cd20e89b..11ee7ae64f 100644
--- a/include/glaze/net/http_server.hpp
+++ b/include/glaze/net/http_server.hpp
@@ -1495,8 +1495,12 @@ namespace glz
       std::mutex active_connections_mutex_;
       std::vector<std::weak_ptr<connection_state>> active_connections_;
 
-#ifdef GLZ_ENABLE_SSL
-      std::conditional_t<EnableTLS, std::unique_ptr<asio::ssl::context>, std::monostate> ssl_context;
+#if defined(GLZ_ENABLE_SSL)
+      // SSL context only exists for TLS-enabled servers.
+      // Note: using conditional_t<EnableTLS, ..., monostate> previously caused
+      // the struct layout to change for non-TLS servers when GLZ_ENABLE_SSL was
+      // defined, which correlated with heap corruption on MinGW/GCC (#2411).
+      std::unique_ptr<asio::ssl::context> ssl_context;
 #endif
 
       inline void do_accept()

From dcf485af2cbaf96c0b381f92d204694468f6cb9e Mon Sep 17 00:00:00 2001
From: Stephen Berry <stephenberry.developer@gmail.com>
Date: Fri, 10 Apr 2026 10:55:05 -0500
Subject: [PATCH 29/41] Update http_client_test.cpp

---
 .../http_client_test/http_client_test.cpp     | 25 +++++++++++--------
 1 file changed, 15 insertions(+), 10 deletions(-)

diff --git a/tests/networking_tests/http_client_test/http_client_test.cpp b/tests/networking_tests/http_client_test/http_client_test.cpp
index 63bf5ddfbc..60c12e2e7e 100644
--- a/tests/networking_tests/http_client_test/http_client_test.cpp
+++ b/tests/networking_tests/http_client_test/http_client_test.cpp
@@ -503,21 +503,26 @@ suite working_http_tests = [] {
       check_heap("after server create");
       expect(server.start()) << "Server should start\n";
       check_heap("after server start");
-      simple_test_client client;
-      check_heap("after client create");
-      auto result = client.get(server.base_url() + "/hello");
-      check_heap("after GET");
 
-      expect(result.has_value()) << "GET request should succeed\n";
-      if (result.has_value()) {
-         expect(result->status_code == 200) << "Status should be 200\n";
-         expect(result->response_body == "Hello, World!") << "Body should match\n";
-      }
+      // Use a block to control destruction order and add heap checks
+      {
+         simple_test_client client;
+         check_heap("after client create");
+         auto result = client.get(server.base_url() + "/hello");
+         check_heap("after GET");
+
+         expect(result.has_value()) << "GET request should succeed\n";
+         if (result.has_value()) {
+            expect(result->status_code == 200) << "Status should be 200\n";
+            expect(result->response_body == "Hello, World!") << "Body should match\n";
+         }
+         check_heap("before client destroy");
+      } // client and result destroyed here
+      check_heap("after client destroy");
 
       check_heap("before server stop");
       server.stop();
       check_heap("after server stop");
-      std::this_thread::sleep_for(std::chrono::milliseconds(50));
       std::fprintf(stderr, "[TRACE] test done\n");
    };
 

From 26eddaccd3d3f664c1c0069e661320576be4af2d Mon Sep 17 00:00:00 2001
From: Stephen Berry <stephenberry.developer@gmail.com>
Date: Fri, 10 Apr 2026 11:21:07 -0500
Subject: [PATCH 30/41] Update http_server.hpp

---
 include/glaze/net/http_server.hpp | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/include/glaze/net/http_server.hpp b/include/glaze/net/http_server.hpp
index 11ee7ae64f..02c5eca5fc 100644
--- a/include/glaze/net/http_server.hpp
+++ b/include/glaze/net/http_server.hpp
@@ -796,7 +796,13 @@ namespace glz
             for (size_t i = 0; i < actual_threads; ++i) {
                threads.emplace_back([this] {
                   io_context->run();
-                  // Don't report errors during shutdown
+#ifdef _WIN32
+                  // Diagnostic: check heap on the worker thread right after run() returns
+                  {
+                     BOOL ok = HeapValidate(GetProcessHeap(), 0, NULL);
+                     std::fprintf(stderr, "[HTTP_SERVER] worker thread exiting, heap: %s\n", ok ? "OK" : "CORRUPTED");
+                  }
+#endif
                });
             }
          }

From bcc59c341c0cfef4252a4b3d3bf7b1110d610675 Mon Sep 17 00:00:00 2001
From: Stephen Berry <stephenberry.developer@gmail.com>
Date: Fri, 10 Apr 2026 11:53:00 -0500
Subject: [PATCH 31/41] Update http_server.hpp

---
 include/glaze/net/http_server.hpp | 17 +++++++++++------
 1 file changed, 11 insertions(+), 6 deletions(-)

diff --git a/include/glaze/net/http_server.hpp b/include/glaze/net/http_server.hpp
index 02c5eca5fc..26d7923164 100644
--- a/include/glaze/net/http_server.hpp
+++ b/include/glaze/net/http_server.hpp
@@ -35,6 +35,10 @@
 #undef DELETE
 #endif
 
+#ifdef GLZ_ENABLE_SSL
+#include <openssl/crypto.h>
+#endif
+
 namespace glz
 {
    namespace detail
@@ -796,12 +800,13 @@ namespace glz
             for (size_t i = 0; i < actual_threads; ++i) {
                threads.emplace_back([this] {
                   io_context->run();
-#ifdef _WIN32
-                  // Diagnostic: check heap on the worker thread right after run() returns
-                  {
-                     BOOL ok = HeapValidate(GetProcessHeap(), 0, NULL);
-                     std::fprintf(stderr, "[HTTP_SERVER] worker thread exiting, heap: %s\n", ok ? "OK" : "CORRUPTED");
-                  }
+#ifdef GLZ_ENABLE_SSL
+                  // Explicitly clean up OpenSSL's per-thread state before the thread exits.
+                  // On MinGW/GCC + Windows, OpenSSL's TLS (thread-local storage) destructors
+                  // can corrupt the heap during implicit thread teardown because MinGW's
+                  // __emutls implementation doesn't handle OpenSSL's cleanup correctly.
+                  // Calling OPENSSL_thread_cleanup() explicitly avoids this.
+                  OPENSSL_thread_stop();
 #endif
                });
             }

From ace39a9d7d18f15368e9fbef59f1d978d481ca07 Mon Sep 17 00:00:00 2001
From: Stephen Berry <stephenberry.developer@gmail.com>
Date: Fri, 10 Apr 2026 12:16:49 -0500
Subject: [PATCH 32/41] Update mingw_ssl_diag.cpp

---
 .../mingw_ssl_diag/mingw_ssl_diag.cpp         | 464 +++---------------
 1 file changed, 77 insertions(+), 387 deletions(-)

diff --git a/tests/networking_tests/mingw_ssl_diag/mingw_ssl_diag.cpp b/tests/networking_tests/mingw_ssl_diag/mingw_ssl_diag.cpp
index af6d089124..7d6415ec68 100644
--- a/tests/networking_tests/mingw_ssl_diag/mingw_ssl_diag.cpp
+++ b/tests/networking_tests/mingw_ssl_diag/mingw_ssl_diag.cpp
@@ -1,10 +1,8 @@
-// Minimal diagnostic test for MinGW + SSL heap corruption (issue #2411)
+// Minimal reproducer for MinGW + SSL heap corruption (issue #2411)
 //
-// Isolates each layer to find where heap corruption originates:
-//   Phase 1-3: Basic lifecycle (OpenSSL, ASIO SSL, http_client)
-//   Phase 4-7: HTTP operations (single, repeated, connection reuse, concurrent)
-//   Phase 8-11: Stress tests targeting race conditions in create/destroy
-//               with active requests, rapid cycling, and concurrent clients
+// Reproduces heap corruption on MinGW/GCC 15.2.0 + Windows when
+// GLZ_ENABLE_SSL is defined. The crash occurs during thread.join()
+// in http_server::stop() after handling a connection.
 
 #ifndef GLZ_ENABLE_SSL
 #define GLZ_ENABLE_SSL
@@ -14,10 +12,8 @@
 #include <chrono>
 #include <iostream>
 #include <thread>
-#include <vector>
 
-#include <openssl/err.h>
-#include <openssl/ssl.h>
+#include <openssl/crypto.h>
 
 #include "glaze/net/http_client.hpp"
 #include "glaze/net/http_server.hpp"
@@ -29,408 +25,102 @@
 
 using namespace ut;
 
-// Simple server for HTTP tests
-class diag_server
+#ifdef _WIN32
+#include <windows.h>
+inline void check_heap(const char* label)
 {
-  public:
-   bool start()
-   {
-      server_.get("/ping", [](const glz::request&, glz::response& res) { res.status(200).body("pong"); });
-
-      // Slow endpoint to keep requests in-flight during destruction
-      server_.get("/slow", [](const glz::request&, glz::response& res) {
-         std::this_thread::sleep_for(std::chrono::milliseconds(200));
-         res.status(200).body("slow");
-      });
-
-      // Streaming endpoint
-      server_.stream_get("/stream", [](glz::request&, glz::streaming_response& res) {
-         res.start_stream(200, {{"Content-Type", "text/plain"}});
-         res.send("chunk1;");
-         res.send("chunk2;");
-         res.send("chunk3;");
-         res.close();
-      });
+   BOOL ok = HeapValidate(GetProcessHeap(), 0, NULL);
+   std::fprintf(stderr, "[HEAP] %s: %s\n", label, ok ? "OK" : "CORRUPTED");
+}
+#else
+inline void check_heap(const char*) {}
+#endif
 
-      for (uint16_t p = 19200; p < 19300; ++p) {
-         try {
-            server_.bind("127.0.0.1", p);
-            port_ = p;
-            break;
-         }
-         catch (...) {
-            continue;
-         }
-      }
-      if (port_ == 0) return false;
+suite mingw_ssl_repro = [] {
+   // Minimal reproducer: create server, handle one request, stop.
+   // This mirrors what http_client_test's basic_get_request does.
+   "minimal_server_get_stop"_test = [] {
+      for (int round = 0; round < 20; ++round) {
+         std::fprintf(stderr, "[REPRO] round %d\n", round);
 
-      thread_ = std::thread([this]() {
-         try {
-            server_.start(1);
-         }
-         catch (...) {
-         }
-      });
+         // Create and start server
+         glz::http_server<> server;
+         server.get("/ping", [](const glz::request&, glz::response& res) {
+            res.status(200).body("pong");
+         });
 
-      // Wait for server to accept connections
-      for (int i = 0; i < 50; ++i) {
-         std::this_thread::sleep_for(std::chrono::milliseconds(100));
-         try {
+         uint16_t port = 0;
+         for (uint16_t p = 19300; p < 19400; ++p) {
+            try {
+               server.bind("127.0.0.1", p);
+               port = p;
+               break;
+            }
+            catch (...) {
+               continue;
+            }
+         }
+         expect(port > 0) << "Failed to bind";
+
+         std::thread server_thread([&]() { server.start(1); });
+
+         // Wait for server
+         for (int i = 0; i < 50; ++i) {
+            std::this_thread::sleep_for(std::chrono::milliseconds(50));
+            try {
+               asio::io_context io;
+               asio::ip::tcp::socket sock(io);
+               sock.connect({asio::ip::make_address("127.0.0.1"), port});
+               sock.close();
+               break;
+            }
+            catch (...) {
+            }
+         }
+
+         // Make one GET request using raw TCP (same as simple_test_client)
+         {
             asio::io_context io;
             asio::ip::tcp::socket sock(io);
-            sock.connect({asio::ip::make_address("127.0.0.1"), port_});
-            sock.close();
-            return true;
-         }
-         catch (...) {
-         }
-      }
-      return false;
-   }
-
-   void stop()
-   {
-      server_.stop();
-      if (thread_.joinable()) thread_.join();
-   }
-
-   ~diag_server() { stop(); }
-
-   std::string url() const { return "http://127.0.0.1:" + std::to_string(port_); }
-
-  private:
-   glz::http_server<> server_;
-   std::thread thread_;
-   uint16_t port_{0};
-};
-
-suite mingw_ssl_diag = [] {
-   // Phase 1: Raw OpenSSL - does SSL_CTX create/destroy corrupt the heap?
-   "phase1_raw_openssl_ctx"_test = [] {
-      std::cout << "[phase1] Creating raw OpenSSL SSL_CTX..." << std::endl;
-
-      for (int i = 0; i < 5; ++i) {
-         SSL_CTX* ctx = SSL_CTX_new(TLS_client_method());
-         expect(ctx != nullptr) << "SSL_CTX_new failed on iteration " << i;
-         if (ctx) {
-            SSL_CTX_free(ctx);
-         }
-      }
-
-      std::cout << "[phase1] OK - raw OpenSSL context create/destroy" << std::endl;
-   };
-
-   // Phase 2: ASIO SSL context - does asio::ssl::context corrupt the heap?
-   "phase2_asio_ssl_ctx"_test = [] {
-      std::cout << "[phase2] Creating asio::ssl::context..." << std::endl;
-
-      for (int i = 0; i < 5; ++i) {
-         asio::ssl::context ctx(asio::ssl::context::tls_client);
-         asio::error_code ec;
-         ctx.set_default_verify_paths(ec);
-         ctx.set_verify_mode(asio::ssl::verify_peer);
-      }
-
-      std::cout << "[phase2] OK - asio SSL context create/destroy" << std::endl;
-   };
-
-   // Phase 3: http_client lifecycle without any requests
-   "phase3_http_client_lifecycle_no_request"_test = [] {
-      std::cout << "[phase3] Creating/destroying http_client (no requests)..." << std::endl;
-
-      for (int i = 0; i < 5; ++i) {
-         glz::http_client client;
-      }
-
-      std::cout << "[phase3] OK - http_client lifecycle without requests" << std::endl;
-   };
-
-   // Phase 4: http_client with a single plain HTTP GET
-   "phase4_http_client_single_get"_test = [] {
-      std::cout << "[phase4] http_client single HTTP GET..." << std::endl;
-
-      diag_server server;
-      expect(server.start()) << "Server failed to start";
-
-      {
-         glz::http_client client;
-         auto result = client.get(server.url() + "/ping");
-         expect(result.has_value()) << "GET /ping failed";
-         if (result) {
-            expect(result->status_code == 200) << "Expected 200, got " << result->status_code;
-         }
-      }
-
-      server.stop();
-      std::cout << "[phase4] OK - single HTTP GET" << std::endl;
-   };
-
-   // Phase 5: Multiple http_client instances doing HTTP GETs
-   "phase5_http_client_repeated"_test = [] {
-      std::cout << "[phase5] Multiple http_client instances with HTTP GETs..." << std::endl;
-
-      diag_server server;
-      expect(server.start()) << "Server failed to start";
-
-      for (int i = 0; i < 10; ++i) {
-         glz::http_client client;
-         auto result = client.get(server.url() + "/ping");
-         expect(result.has_value()) << "GET failed on iteration " << i;
-      }
-
-      server.stop();
-      std::cout << "[phase5] OK - repeated http_client lifecycle" << std::endl;
-   };
-
-   // Phase 6: Single http_client, multiple requests (connection reuse)
-   "phase6_http_client_multiple_requests"_test = [] {
-      std::cout << "[phase6] Single http_client, multiple requests..." << std::endl;
-
-      diag_server server;
-      expect(server.start()) << "Server failed to start";
-
-      {
-         glz::http_client client;
-         for (int i = 0; i < 20; ++i) {
-            auto result = client.get(server.url() + "/ping");
-            expect(result.has_value()) << "GET failed on iteration " << i;
-         }
-      }
-
-      server.stop();
-      std::cout << "[phase6] OK - multiple requests on single client" << std::endl;
-   };
-
-   // Phase 7: Concurrent async requests
-   "phase7_http_client_concurrent"_test = [] {
-      std::cout << "[phase7] Concurrent async requests..." << std::endl;
-
-      diag_server server;
-      expect(server.start()) << "Server failed to start";
-
-      {
-         glz::http_client client;
-         std::atomic<int> completed{0};
-         std::atomic<int> errors{0};
-         constexpr int N = 20;
+            asio::ip::tcp::resolver resolver(io);
+            auto endpoints = resolver.resolve("127.0.0.1", std::to_string(port));
+            asio::connect(sock, endpoints);
 
-         for (int i = 0; i < N; ++i) {
-            client.get_async(server.url() + "/ping", {},
-                             [&](glz::expected<glz::response, std::error_code> result) {
-                                if (result.has_value() && result->status_code == 200) {
-                                   completed++;
-                                }
-                                else {
-                                   errors++;
-                                }
-                             });
-         }
-
-         for (int i = 0; i < 100 && completed + errors < N; ++i) {
-            std::this_thread::sleep_for(std::chrono::milliseconds(100));
-         }
-
-         expect(completed + errors == N) << "Not all requests completed: " << completed.load() << " ok, "
-                                         << errors.load() << " errors";
-         expect(errors == 0) << "Some requests failed";
-      }
-
-      server.stop();
-      std::cout << "[phase7] OK - concurrent requests" << std::endl;
-   };
-
-   // Phase 8: Destroy client while async requests are in-flight
-   // This is the most likely race condition: worker threads processing
-   // completions while the destructor tears down the io_context.
-   "phase8_destroy_with_inflight_requests"_test = [] {
-      std::cout << "[phase8] Destroying client with in-flight requests..." << std::endl;
+            std::string req = "GET /ping HTTP/1.1\r\nHost: 127.0.0.1\r\nConnection: close\r\n\r\n";
+            asio::write(sock, asio::buffer(req));
 
-      diag_server server;
-      expect(server.start()) << "Server failed to start";
+            asio::streambuf response_buf;
+            asio::error_code ec;
+            asio::read(sock, response_buf, asio::transfer_all(), ec);
 
-      for (int round = 0; round < 20; ++round) {
-         glz::http_client client;
-
-         // Fire async requests against the slow endpoint
-         for (int i = 0; i < 5; ++i) {
-            client.get_async(server.url() + "/slow", {}, [](auto) {});
+            std::string response{std::istreambuf_iterator<char>(&response_buf), std::istreambuf_iterator<char>()};
+            expect(response.find("pong") != std::string::npos) << "Response should contain 'pong'";
          }
 
-         // Don't wait — destroy immediately while requests are pending.
-         // The destructor calls stop_workers() which stops io_context and
-         // joins threads. If there's a race, this is where it crashes.
-      }
-
-      server.stop();
-      std::cout << "[phase8] OK - destroy with in-flight requests" << std::endl;
-   };
-
-   // Phase 9: Rapid create/destroy cycling with immediate requests
-   // Stresses the worker thread start/stop path.
-   "phase9_rapid_lifecycle_with_requests"_test = [] {
-      std::cout << "[phase9] Rapid client lifecycle cycling..." << std::endl;
-
-      diag_server server;
-      expect(server.start()) << "Server failed to start";
-
-      for (int round = 0; round < 50; ++round) {
-         glz::http_client client;
-         // Fire one async request then immediately destroy
-         client.get_async(server.url() + "/ping", {}, [](auto) {});
-      }
-
-      server.stop();
-      std::cout << "[phase9] OK - rapid lifecycle cycling" << std::endl;
-   };
-
-   // Phase 10: Multiple clients sharing work concurrently
-   // Each client has its own io_context and worker threads.
-   "phase10_concurrent_clients"_test = [] {
-      std::cout << "[phase10] Multiple concurrent clients..." << std::endl;
-
-      diag_server server;
-      expect(server.start()) << "Server failed to start";
-
-      {
-         constexpr int NUM_CLIENTS = 5;
-         constexpr int REQUESTS_PER_CLIENT = 10;
-         std::vector<std::thread> threads;
-         std::atomic<int> total_success{0};
-         std::atomic<int> total_errors{0};
-
-         for (int c = 0; c < NUM_CLIENTS; ++c) {
-            threads.emplace_back([&]() {
-               glz::http_client client;
-               for (int i = 0; i < REQUESTS_PER_CLIENT; ++i) {
-                  auto result = client.get(server.url() + "/ping");
-                  if (result.has_value() && result->status_code == 200) {
-                     total_success++;
-                  }
-                  else {
-                     total_errors++;
-                  }
-               }
-            });
-         }
-
-         for (auto& t : threads) {
-            t.join();
-         }
-
-         expect(total_errors == 0) << "Concurrent client errors: " << total_errors.load();
-         expect(total_success == NUM_CLIENTS * REQUESTS_PER_CLIENT)
-            << "Expected " << NUM_CLIENTS * REQUESTS_PER_CLIENT << " successes, got " << total_success.load();
-      }
-
-      server.stop();
-      std::cout << "[phase10] OK - concurrent clients" << std::endl;
-   };
-
-   // Phase 11: Streaming request — the code path in http_client_test
-   // that we suspect triggers the heap corruption.
-   "phase11_streaming_request"_test = [] {
-      std::cout << "[phase11] Streaming request..." << std::endl;
-
-      diag_server server;
-      expect(server.start()) << "Server failed to start";
-
-      {
-         glz::http_client client;
-
-         std::string received;
-         std::mutex mtx;
-         std::promise<void> done;
-         auto future = done.get_future();
-
-         auto conn = client.stream_request_v2({
-            .method = "GET",
-            .url = server.url() + "/stream",
-            .on_connect = [](const glz::response&) {},
-            .on_disconnect = [&]() { done.set_value(); },
-            .on_data = [&](std::string_view data) {
-               std::lock_guard lock(mtx);
-               received.append(data);
-            },
-            .on_error = [](std::error_code) {},
-         });
-
-         auto status = future.wait_for(std::chrono::seconds(5));
-         expect(status == std::future_status::ready) << "Stream did not complete";
-      }
-
-      server.stop();
-      std::cout << "[phase11] OK - streaming request" << std::endl;
-   };
-
-   // Phase 12: Repeated streaming with client destruction
-   "phase12_streaming_destroy_cycle"_test = [] {
-      std::cout << "[phase12] Streaming with client destruction cycling..." << std::endl;
-
-      diag_server server;
-      expect(server.start()) << "Server failed to start";
-
-      for (int round = 0; round < 20; ++round) {
-         glz::http_client client;
+         // Small delay then stop — this is where the crash happens
+         std::this_thread::sleep_for(std::chrono::milliseconds(50));
+         check_heap("before stop");
+         server.stop();
+         check_heap("after stop");
 
-         std::promise<void> done;
-         auto future = done.get_future();
-
-         auto conn = client.stream_request_v2({
-            .method = "GET",
-            .url = server.url() + "/stream",
-            .on_connect = [](const glz::response&) {},
-            .on_disconnect = [&]() { done.set_value(); },
-            .on_data = [](std::string_view) {},
-            .on_error = [](std::error_code) {},
-         });
-
-         auto status = future.wait_for(std::chrono::seconds(5));
-         (void)status;
-         // Destroy client — may have pending handlers
-      }
-
-      server.stop();
-      std::cout << "[phase12] OK - streaming destroy cycle" << std::endl;
-   };
-
-   // Phase 13: Mixed sync + async with destruction under load
-   "phase13_stress_mixed"_test = [] {
-      std::cout << "[phase13] Mixed stress test..." << std::endl;
-
-      diag_server server;
-      expect(server.start()) << "Server failed to start";
-
-      for (int round = 0; round < 10; ++round) {
-         glz::http_client client;
-
-         auto result = client.get(server.url() + "/ping");
-         (void)result;
-
-         for (int i = 0; i < 3; ++i) {
-            client.get_async(server.url() + "/ping", {}, [](auto) {});
-            client.get_async(server.url() + "/slow", {}, [](auto) {});
-         }
-
-         if (round % 3 == 0) {
-            std::this_thread::sleep_for(std::chrono::milliseconds(10));
+         if (server_thread.joinable()) {
+            server_thread.join();
          }
+         check_heap("after server_thread join");
       }
-
-      server.stop();
-      std::cout << "[phase13] OK - mixed stress test" << std::endl;
+      std::fprintf(stderr, "[REPRO] all 20 rounds passed\n");
    };
 };
 
 int main()
 {
-   std::cout << "MinGW + SSL Diagnostic Test" << std::endl;
-   std::cout << "===========================" << std::endl;
-   std::cout << "OpenSSL version: " << OpenSSL_version(OPENSSL_VERSION) << std::endl;
+   std::cout << "MinGW + SSL Minimal Reproducer" << std::endl;
 #ifdef __VERSION__
    std::cout << "Compiler: " << __VERSION__ << std::endl;
 #elif defined(_MSC_VER)
    std::cout << "Compiler: MSVC " << _MSC_VER << std::endl;
 #endif
+   std::cout << "OpenSSL: " << OpenSSL_version(OPENSSL_VERSION) << std::endl;
    std::cout << std::endl;
    return 0;
 }

From 051e5ec7e526cf41d937faca49538023ca3857b8 Mon Sep 17 00:00:00 2001
From: Stephen Berry <stephenberry.developer@gmail.com>
Date: Fri, 10 Apr 2026 12:29:52 -0500
Subject: [PATCH 33/41] Run minimal reproducer before http_client_test in CI

Run mingw_ssl_diag first (with || true) so it always produces output,
then http_client_test with if: always(). This ensures both tests run
even if one crashes.
---
 .github/workflows/msys2-ssl.yml | 25 +++++++++----------------
 1 file changed, 9 insertions(+), 16 deletions(-)

diff --git a/.github/workflows/msys2-ssl.yml b/.github/workflows/msys2-ssl.yml
index 65dbb4f3fc..cfd973bfcb 100644
--- a/.github/workflows/msys2-ssl.yml
+++ b/.github/workflows/msys2-ssl.yml
@@ -73,28 +73,21 @@ jobs:
         Set-ItemProperty -Path $regPath -Name "DumpCount" -Value 10 -Type DWord
         Write-Host "WER crash dumps configured at $dumpPath"
 
-    # Run http_client_test directly up to 10 times to catch the intermittent crash.
-    # Output goes to a temp file so we can see the last test before crash.
-    - name: "Repeat: http_client_test (up to 10x, direct)"
+    # Run the minimal reproducer FIRST — 20 rounds of server+GET+stop
+    - name: "mingw_ssl_diag (minimal reproducer)"
       working-directory: build
       run: |
-        for i in $(seq 1 10); do
-          echo "=== http_client_test run $i/10 ==="
-          ctest -C Release --output-on-failure -R "^http_client_test$"
-          rc=$?
-          if [ $rc -ne 0 ]; then
-            echo "FAILED on run $i (exit code $rc)"
-            exit 1
-          fi
-        done
-        echo "All 10 runs passed."
+        echo "=== Running minimal reproducer ==="
+        ctest -C Release --output-on-failure -R "^mingw_ssl_diag$" || true
 
-    - name: "Repeat: mingw_ssl_diag (up to 3x)"
+    # Then run http_client_test
+    - name: "http_client_test (up to 3x)"
+      if: always()
       working-directory: build
       run: |
         for i in $(seq 1 3); do
-          echo "=== mingw_ssl_diag run $i/3 ==="
-          ctest -C Release --output-on-failure -R "^mingw_ssl_diag$"
+          echo "=== http_client_test run $i/3 ==="
+          ctest -C Release --output-on-failure -R "^http_client_test$"
           rc=$?
           if [ $rc -ne 0 ]; then
             echo "FAILED on run $i (exit code $rc)"

From 3e09b9d6e973de77c830db9a990fb268aeee43de Mon Sep 17 00:00:00 2001
From: Stephen Berry <stephenberry.developer@gmail.com>
Date: Fri, 10 Apr 2026 13:59:23 -0500
Subject: [PATCH 34/41] Add A/B/C tests to isolate MinGW SSL heap corruption
 cause

Three parallel CI jobs:
- ssl-enabled: GLZ_ENABLE_SSL + dynamic OpenSSL (baseline, crashes)
- link-only: OpenSSL DLLs linked, GLZ_ENABLE_SSL undefined (tests DLL loading)
- static-ssl: GLZ_ENABLE_SSL + static OpenSSL (tests DLL boundary issue)
---
 .github/workflows/msys2-ssl.yml               | 164 +++++++-----------
 docs/networking/mingw-ssl-heap-corruption.md  |  25 ++-
 .../mingw_ssl_diag/CMakeLists.txt             |  19 ++
 .../mingw_ssl_diag/mingw_link_only_test.cpp   | 108 ++++++++++++
 4 files changed, 218 insertions(+), 98 deletions(-)
 create mode 100644 tests/networking_tests/mingw_ssl_diag/mingw_link_only_test.cpp

diff --git a/.github/workflows/msys2-ssl.yml b/.github/workflows/msys2-ssl.yml
index cfd973bfcb..68ecc7ef7b 100644
--- a/.github/workflows/msys2-ssl.yml
+++ b/.github/workflows/msys2-ssl.yml
@@ -18,16 +18,15 @@ on:
   workflow_dispatch:
 
 jobs:
-  build:
-    name: MinGW64 + SSL
+  # Test 1: GLZ_ENABLE_SSL defined + OpenSSL linked (the crashing configuration)
+  ssl-enabled:
+    name: "SSL enabled (GLZ_ENABLE_SSL + OpenSSL)"
     runs-on: windows-latest
     defaults:
       run:
         shell: msys2 {0}
-
     steps:
     - uses: actions/checkout@v6
-
     - uses: msys2/setup-msys2@v2
       with:
         update: true
@@ -37,111 +36,82 @@ jobs:
           mingw-w64-x86_64-ninja
           mingw-w64-x86_64-gcc
           mingw-w64-x86_64-openssl
-          mingw-w64-x86_64-gdb
 
-    - name: Configure CMake
+    - name: Configure & Build
       run: |
-        cmake -S . -B build \
-          -G Ninja \
+        cmake -S . -B build -G Ninja \
           -DCMAKE_BUILD_TYPE=Release \
-          -DCMAKE_CXX_FLAGS="-g" \
           -DCMAKE_CXX_STANDARD=23 \
           -Dglaze_ENABLE_SSL=ON
+        cmake --build build -j $(nproc) --target mingw_ssl_diag
 
-    - name: Build
-      run: |
-        cmake --build build -j $(nproc) --target \
-          mingw_ssl_diag \
-          http_client_test \
-          websocket_client_test \
-          websocket_close_test \
-          wss_test \
-          shared_context_bug_test \
-          utf8_test \
-          https_test
+    - name: "Run: mingw_ssl_diag (GLZ_ENABLE_SSL=ON)"
+      working-directory: build
+      run: ctest -C Release --output-on-failure -R "^mingw_ssl_diag$" || true
 
-    # Configure WER crash dumps before running tests
-    - name: Configure crash dumps (WER)
-      shell: pwsh
-      run: |
-        $dumpPath = "D:\CrashDumps"
-        New-Item -Path $dumpPath -ItemType Directory -Force | Out-Null
-        $regPath = "HKLM:\SOFTWARE\Microsoft\Windows\Windows Error Reporting\LocalDumps"
-        New-Item -Path $regPath -Force | Out-Null
-        Set-ItemProperty -Path $regPath -Name "DumpType" -Value 2 -Type DWord
-        Set-ItemProperty -Path $regPath -Name "DumpFolder" -Value $dumpPath -Type ExpandString
-        Set-ItemProperty -Path $regPath -Name "DumpCount" -Value 10 -Type DWord
-        Write-Host "WER crash dumps configured at $dumpPath"
+  # Test 2: OpenSSL DLLs linked but GLZ_ENABLE_SSL NOT defined
+  # If this crashes → DLL loading is the cause
+  # If this passes → the GLZ_ENABLE_SSL macro / template changes are the cause
+  link-only:
+    name: "Link-only (OpenSSL linked, NO GLZ_ENABLE_SSL)"
+    runs-on: windows-latest
+    defaults:
+      run:
+        shell: msys2 {0}
+    steps:
+    - uses: actions/checkout@v6
+    - uses: msys2/setup-msys2@v2
+      with:
+        update: true
+        msystem: MINGW64
+        install: >-
+          mingw-w64-x86_64-cmake
+          mingw-w64-x86_64-ninja
+          mingw-w64-x86_64-gcc
+          mingw-w64-x86_64-openssl
 
-    # Run the minimal reproducer FIRST — 20 rounds of server+GET+stop
-    - name: "mingw_ssl_diag (minimal reproducer)"
-      working-directory: build
+    - name: Configure & Build
       run: |
-        echo "=== Running minimal reproducer ==="
-        ctest -C Release --output-on-failure -R "^mingw_ssl_diag$" || true
+        cmake -S . -B build -G Ninja \
+          -DCMAKE_BUILD_TYPE=Release \
+          -DCMAKE_CXX_STANDARD=23 \
+          -Dglaze_ENABLE_SSL=ON
+        cmake --build build -j $(nproc) --target mingw_link_only_test
 
-    # Then run http_client_test
-    - name: "http_client_test (up to 3x)"
-      if: always()
+    - name: "Run: mingw_link_only_test (no GLZ_ENABLE_SSL macro)"
       working-directory: build
-      run: |
-        for i in $(seq 1 3); do
-          echo "=== http_client_test run $i/3 ==="
-          ctest -C Release --output-on-failure -R "^http_client_test$"
-          rc=$?
-          if [ $rc -ne 0 ]; then
-            echo "FAILED on run $i (exit code $rc)"
-            exit 1
-          fi
-        done
-        echo "All 3 runs passed."
+      run: ctest -C Release --output-on-failure -R "^mingw_link_only_test$" || true
 
-    # Check for and analyze any crash dumps
-    - name: Analyze crash dumps
-      if: always()
-      shell: pwsh
-      run: |
-        $dumps = Get-ChildItem -Path "D:\CrashDumps" -Filter "*.dmp" -ErrorAction SilentlyContinue
-        if ($dumps) {
-          Write-Host "=== Found $($dumps.Count) crash dump(s) ==="
-          foreach ($dump in $dumps) {
-            Write-Host "  $($dump.Name) — $('{0:N1}' -f ($dump.Length / 1MB)) MB"
-          }
-        } else {
-          Write-Host "No crash dumps captured."
-        }
+  # Test 3: Static OpenSSL linking
+  # If this passes → DLL boundary / CRT mismatch is the cause
+  # If this crashes → the issue is deeper (OpenSSL code itself)
+  static-ssl:
+    name: "Static OpenSSL"
+    runs-on: windows-latest
+    defaults:
+      run:
+        shell: msys2 {0}
+    steps:
+    - uses: actions/checkout@v6
+    - uses: msys2/setup-msys2@v2
+      with:
+        update: true
+        msystem: MINGW64
+        install: >-
+          mingw-w64-x86_64-cmake
+          mingw-w64-x86_64-ninja
+          mingw-w64-x86_64-gcc
+          mingw-w64-x86_64-openssl
 
-    - name: GDB post-mortem
-      if: always()
+    - name: Configure & Build
       run: |
-        found=0
-        for dump in /d/CrashDumps/*.dmp; do
-          [ -f "$dump" ] || continue
-          found=1
-          echo ""
-          echo "========================================="
-          echo "=== Analyzing: $dump"
-          echo "========================================="
-          echo ""
-          gdb -batch \
-            -ex "target mini $dump" \
-            -ex "echo === CRASHING THREAD ===\n" \
-            -ex "bt" \
-            -ex "echo \n=== ALL THREADS ===\n" \
-            -ex "thread apply all bt" \
-            -ex "echo \n=== REGISTERS ===\n" \
-            -ex "info registers" \
-            -ex "quit" \
-            tests/networking_tests/http_client_test/http_client_test.exe \
-            2>&1 || echo "(gdb analysis failed)"
-        done
-
-        if [ $found -eq 0 ]; then
-          echo "No crash dumps to analyze."
-        fi
+        cmake -S . -B build -G Ninja \
+          -DCMAKE_BUILD_TYPE=Release \
+          -DCMAKE_CXX_STANDARD=23 \
+          -Dglaze_ENABLE_SSL=ON \
+          -DOPENSSL_USE_STATIC_LIBS=ON
+        cmake --build build -j $(nproc) --target mingw_ssl_diag
 
-    - name: Run remaining tests
-      if: always()
-      run: |
-        ctest -C Release --output-on-failure -R \
-          "^(websocket_client_test|websocket_close_test|wss_test|shared_context_bug_test|utf8_test|https_test)$"
+    - name: "Run: mingw_ssl_diag (static OpenSSL)"
+      working-directory: build
+      run: ctest -C Release --output-on-failure -R "^mingw_ssl_diag$" || true
diff --git a/docs/networking/mingw-ssl-heap-corruption.md b/docs/networking/mingw-ssl-heap-corruption.md
index ce15f020c2..21d76d05eb 100644
--- a/docs/networking/mingw-ssl-heap-corruption.md
+++ b/docs/networking/mingw-ssl-heap-corruption.md
@@ -92,7 +92,30 @@ The crash only occurs when the server has handled at least one connection. A ser
 
 A `restart()` + `poll()` drain after `thread.join()` does NOT fix the issue because the crash occurs during the join itself, before the drain runs.
 
-**Current hypothesis**: This may be a GCC 15.2.0 miscompilation on MinGW. The `std::monostate ssl_context` member changes the http_server struct layout just enough to trigger an optimizer bug in connection cleanup codegen. Testing with `-O0` to confirm.
+### Ruled out hypotheses
+
+| Hypothesis | Test | Result |
+|---|---|---|
+| GCC optimizer miscompilation | Build with `-O0` | Still crashes |
+| Struct layout change from `monostate` member | Changed to `unique_ptr` | Still crashes |
+| Pending handlers during io_context destruction | Added `restart()` + `poll()` drain | Still crashes |
+| OpenSSL TLS cleanup on thread exit | Added `OPENSSL_thread_stop()` | Still crashes |
+| Complex test infrastructure | Minimal reproducer (bare server + raw TCP) | Still crashes |
+
+### Confirmed minimal reproducer
+
+The crash reproduces with just:
+1. `glz::http_server<>` with one GET route
+2. A raw TCP client sends `GET /ping HTTP/1.1\r\nConnection: close\r\n\r\n`
+3. `server.stop()` → crash during `thread.join()`
+
+No `working_test_server`, no `simple_test_client`, no CORS, no streaming. The bug is in the core `http_server` + ASIO IOCP + MinGW + OpenSSL interaction.
+
+### Current understanding
+
+The crash occurs during `thread.join()` after `io_context->stop()`. `HeapValidate` passes on both the main thread (right before stop) and the worker thread (right after `run()` returns). The corruption happens during thread teardown — after the worker's function body completes but during the thread exit machinery.
+
+The crash only occurs when OpenSSL libraries are linked (even if no SSL code executes). This points to OpenSSL's DLL initialization or its interaction with MinGW's threading/heap infrastructure as the root cause.
 
 ### Why the drain fix works (when it applies)
 
diff --git a/tests/networking_tests/mingw_ssl_diag/CMakeLists.txt b/tests/networking_tests/mingw_ssl_diag/CMakeLists.txt
index d3c763855c..b34990b252 100644
--- a/tests/networking_tests/mingw_ssl_diag/CMakeLists.txt
+++ b/tests/networking_tests/mingw_ssl_diag/CMakeLists.txt
@@ -10,6 +10,7 @@ if(OpenSSL_FOUND)
     " MINGW_SSL_DIAG_HEADERS_OK)
 
     if(MINGW_SSL_DIAG_HEADERS_OK)
+        # Test 1: Full SSL support (GLZ_ENABLE_SSL defined + OpenSSL linked)
         add_executable(${PROJECT_NAME} ${PROJECT_NAME}.cpp)
 
         target_link_libraries(${PROJECT_NAME} PRIVATE
@@ -21,6 +22,24 @@ if(OpenSSL_FOUND)
         target_compile_definitions(${PROJECT_NAME} PRIVATE GLZ_ENABLE_SSL)
 
         add_test(NAME ${PROJECT_NAME} COMMAND ${PROJECT_NAME})
+
+        # Test 2: OpenSSL DLLs linked but GLZ_ENABLE_SSL NOT defined.
+        # Isolates whether the crash is caused by DLL loading or by the macro.
+        # We un-define GLZ_ENABLE_SSL that comes from the glaze::glaze interface
+        # to ensure SSL code paths are not compiled.
+        add_executable(mingw_link_only_test mingw_link_only_test.cpp)
+
+        target_link_libraries(mingw_link_only_test PRIVATE
+            glz_test_exceptions
+            OpenSSL::SSL
+            OpenSSL::Crypto
+        )
+        # Un-define GLZ_ENABLE_SSL that comes from glaze::glaze interface.
+        # GCC processes flags left-to-right, and target_compile_options
+        # appends after interface definitions, so -U wins.
+        target_compile_options(mingw_link_only_test PRIVATE -UGLZ_ENABLE_SSL)
+
+        add_test(NAME mingw_link_only_test COMMAND mingw_link_only_test)
     else()
         message(STATUS "mingw_ssl_diag skipped - OpenSSL headers not usable")
     endif()
diff --git a/tests/networking_tests/mingw_ssl_diag/mingw_link_only_test.cpp b/tests/networking_tests/mingw_ssl_diag/mingw_link_only_test.cpp
new file mode 100644
index 0000000000..59835e241d
--- /dev/null
+++ b/tests/networking_tests/mingw_ssl_diag/mingw_link_only_test.cpp
@@ -0,0 +1,108 @@
+// Test: link OpenSSL DLLs but do NOT define GLZ_ENABLE_SSL.
+// If this crashes, the mere loading of OpenSSL DLLs causes the issue.
+// If this passes, the GLZ_ENABLE_SSL macro (changing template instantiations) is the cause.
+//
+// This file must NOT include any SSL headers or define GLZ_ENABLE_SSL.
+
+#include <atomic>
+#include <chrono>
+#include <iostream>
+#include <thread>
+
+#include "glaze/net/http_client.hpp"
+#include "glaze/net/http_server.hpp"
+#include "ut/ut.hpp"
+
+#ifdef DELETE
+#undef DELETE
+#endif
+
+using namespace ut;
+
+#ifdef _WIN32
+#include <windows.h>
+inline void check_heap_link(const char* label)
+{
+   BOOL ok = HeapValidate(GetProcessHeap(), 0, NULL);
+   std::fprintf(stderr, "[HEAP] %s: %s\n", label, ok ? "OK" : "CORRUPTED");
+}
+#else
+inline void check_heap_link(const char*) {}
+#endif
+
+suite link_only_test = [] {
+   "server_get_stop_no_ssl_macro"_test = [] {
+      for (int round = 0; round < 20; ++round) {
+         std::fprintf(stderr, "[LINK_ONLY] round %d\n", round);
+
+         glz::http_server<> server;
+         server.get("/ping", [](const glz::request&, glz::response& res) {
+            res.status(200).body("pong");
+         });
+
+         uint16_t port = 0;
+         for (uint16_t p = 19400; p < 19500; ++p) {
+            try {
+               server.bind("127.0.0.1", p);
+               port = p;
+               break;
+            }
+            catch (...) {
+               continue;
+            }
+         }
+         expect(port > 0) << "Failed to bind";
+
+         std::thread server_thread([&]() { server.start(1); });
+
+         // Wait for server
+         for (int i = 0; i < 50; ++i) {
+            std::this_thread::sleep_for(std::chrono::milliseconds(50));
+            try {
+               asio::io_context io;
+               asio::ip::tcp::socket sock(io);
+               sock.connect({asio::ip::make_address("127.0.0.1"), port});
+               sock.close();
+               break;
+            }
+            catch (...) {
+            }
+         }
+
+         // Make one GET request
+         {
+            asio::io_context io;
+            asio::ip::tcp::socket sock(io);
+            asio::ip::tcp::resolver resolver(io);
+            auto endpoints = resolver.resolve("127.0.0.1", std::to_string(port));
+            asio::connect(sock, endpoints);
+
+            std::string req = "GET /ping HTTP/1.1\r\nHost: 127.0.0.1\r\nConnection: close\r\n\r\n";
+            asio::write(sock, asio::buffer(req));
+
+            asio::streambuf response_buf;
+            asio::error_code ec;
+            asio::read(sock, response_buf, asio::transfer_all(), ec);
+
+            std::string response{std::istreambuf_iterator<char>(&response_buf), std::istreambuf_iterator<char>()};
+            expect(response.find("pong") != std::string::npos) << "Response should contain 'pong'";
+         }
+
+         std::this_thread::sleep_for(std::chrono::milliseconds(50));
+         check_heap_link("before stop");
+         server.stop();
+         check_heap_link("after stop");
+
+         if (server_thread.joinable()) {
+            server_thread.join();
+         }
+      }
+      std::fprintf(stderr, "[LINK_ONLY] all 20 rounds passed\n");
+   };
+};
+
+int main()
+{
+   std::cout << "Link-Only Test (OpenSSL linked, GLZ_ENABLE_SSL NOT defined)" << std::endl;
+   return 0;
+}

From 3b94e279378034cfb4e0ceb1d016d255bcb8d074 Mon Sep 17 00:00:00 2001
From: Stephen Berry <stephenberry.developer@gmail.com>
Date: Fri, 10 Apr 2026 19:53:06 -0500
Subject: [PATCH 35/41] Remove ssl_context member from http_server to test
 crash hypothesis

Temporarily remove the ssl_context data member to determine if its
presence in http_server<false> causes the MinGW heap corruption.
The member's unique_ptr<asio::ssl::context> destructor instantiates
OpenSSL cleanup code even when the pointer is null, which may be
the trigger. All usages are inside if constexpr (EnableTLS) so
http_server<false> compiles without it.
---
 include/glaze/net/http_server.hpp | 13 ++++++-------
 1 file changed, 6 insertions(+), 7 deletions(-)

diff --git a/include/glaze/net/http_server.hpp b/include/glaze/net/http_server.hpp
index 26d7923164..f34b162f59 100644
--- a/include/glaze/net/http_server.hpp
+++ b/include/glaze/net/http_server.hpp
@@ -1506,13 +1506,12 @@ namespace glz
       std::mutex active_connections_mutex_;
       std::vector<std::weak_ptr<connection_state>> active_connections_;
 
-#if defined(GLZ_ENABLE_SSL)
-      // SSL context only exists for TLS-enabled servers.
-      // Note: using conditional_t<EnableTLS, ..., monostate> previously caused
-      // the struct layout to change for non-TLS servers when GLZ_ENABLE_SSL was
-      // defined, which correlated with heap corruption on MinGW/GCC (#2411).
-      std::unique_ptr<asio::ssl::context> ssl_context;
-#endif
+      // Diagnostic: ssl_context member removed to test if its presence
+      // causes heap corruption on MinGW (#2411).
+      // TODO: restore for http_server<true> if this fixes the crash
+      // #if defined(GLZ_ENABLE_SSL)
+      //       std::unique_ptr<asio::ssl::context> ssl_context;
+      // #endif
 
       inline void do_accept()
       {

From a6c957f2644f0f8f967e8fb243e9696f6f555be6 Mon Sep 17 00:00:00 2001
From: Stephen Berry <stephenberry.developer@gmail.com>
Date: Fri, 10 Apr 2026 20:38:57 -0500
Subject: [PATCH 36/41] Move ssl_context to conditional base class for
 http_server

Use ssl_context_holder<EnableTLS> base class so that ssl_context only
exists as a data member when EnableTLS=true. This avoids instantiating
unique_ptr<asio::ssl::context> destructor for http_server<false>.

All references use this->ssl_context to defer name lookup past
GCC 15's -Wtemplate-body checking of discarded if constexpr branches.
---
 include/glaze/net/http_server.hpp | 42 +++++++++++++++++++++----------
 1 file changed, 29 insertions(+), 13 deletions(-)

diff --git a/include/glaze/net/http_server.hpp b/include/glaze/net/http_server.hpp
index f34b162f59..10645a558c 100644
--- a/include/glaze/net/http_server.hpp
+++ b/include/glaze/net/http_server.hpp
@@ -523,9 +523,29 @@ namespace glz
       size_t max_request_body_size = http_default_max_body_size;
    };
 
+   // Conditionally holds the SSL context only for TLS-enabled servers.
+   // Using a base class ensures http_server<false> has no SSL members at all,
+   // which avoids instantiating unique_ptr<asio::ssl::context> destructor
+   // and prevents heap corruption on MinGW/GCC (#2411).
+#ifdef GLZ_ENABLE_SSL
+   template <bool EnableTLS>
+   struct ssl_context_holder
+   {};
+
+   template <>
+   struct ssl_context_holder<true>
+   {
+      std::unique_ptr<asio::ssl::context> ssl_context;
+   };
+#else
+   template <bool>
+   struct ssl_context_holder
+   {};
+#endif
+
    // Server implementation using non-blocking asio with WebSocket support
    template <bool EnableTLS = false>
-   struct http_server
+   struct http_server : ssl_context_holder<EnableTLS>
    {
       // Socket type abstraction
       using socket_type = std::conditional_t<EnableTLS,
@@ -609,8 +629,8 @@ namespace glz
          // Initialize SSL context for TLS-enabled servers
          if constexpr (EnableTLS) {
 #ifdef GLZ_ENABLE_SSL
-            ssl_context = std::make_unique<asio::ssl::context>(asio::ssl::context::tlsv12);
-            ssl_context->set_default_verify_paths();
+            this->ssl_context = std::make_unique<asio::ssl::context>(asio::ssl::context::tlsv12);
+            this->ssl_context->set_default_verify_paths();
 #else
             static_assert(!EnableTLS, "TLS support requires GLZ_ENABLE_SSL to be defined and OpenSSL to be available");
 #endif
@@ -1287,8 +1307,8 @@ namespace glz
       {
          if constexpr (EnableTLS) {
 #ifdef GLZ_ENABLE_SSL
-            ssl_context->use_certificate_chain_file(cert_file);
-            ssl_context->use_private_key_file(key_file, asio::ssl::context::pem);
+            this->ssl_context->use_certificate_chain_file(cert_file);
+            this->ssl_context->use_private_key_file(key_file, asio::ssl::context::pem);
 #endif
          }
          else {
@@ -1308,7 +1328,7 @@ namespace glz
       {
          if constexpr (EnableTLS) {
 #ifdef GLZ_ENABLE_SSL
-            ssl_context->set_verify_mode(mode);
+            this->ssl_context->set_verify_mode(mode);
 #endif
          }
          return *this;
@@ -1506,12 +1526,8 @@ namespace glz
       std::mutex active_connections_mutex_;
       std::vector<std::weak_ptr<connection_state>> active_connections_;
 
-      // Diagnostic: ssl_context member removed to test if its presence
-      // causes heap corruption on MinGW (#2411).
-      // TODO: restore for http_server<true> if this fixes the crash
-      // #if defined(GLZ_ENABLE_SSL)
-      //       std::unique_ptr<asio::ssl::context> ssl_context;
-      // #endif
+      // ssl_context is inherited from ssl_context_holder<EnableTLS>
+      // and only exists when EnableTLS=true && GLZ_ENABLE_SSL is defined.
 
       inline void do_accept()
       {
@@ -1526,7 +1542,7 @@ namespace glz
                   if constexpr (EnableTLS) {
 #ifdef GLZ_ENABLE_SSL
                      // For HTTPS: create connection eagerly, then perform SSL handshake
-                     auto conn = std::make_shared<connection_state>(socket_type(std::move(socket), *ssl_context),
+                     auto conn = std::make_shared<connection_state>(socket_type(std::move(socket), *this->ssl_context),
                                                                     remote_endpoint);
                      conn->socket.async_handshake(asio::ssl::stream_base::server,
                                                   [this, conn](std::error_code handshake_ec) {

From 0c13f3b40c5b03b31ab863057b35890f6924be5f Mon Sep 17 00:00:00 2001
From: Stephen Berry <stephenberry.developer@gmail.com>
Date: Sat, 11 Apr 2026 16:20:54 -0500
Subject: [PATCH 37/41] Fix link-only test to use glaze_ENABLE_SSL=OFF at CMake
 level

The previous -UGLZ_ENABLE_SSL approach didn't reliably override the
interface target's -D flag, so the link-only test was still compiled
with SSL code paths. Now the link-only job configures with
glaze_ENABLE_SSL=OFF so the glaze headers have no SSL code at all.
---
 .github/workflows/msys2-ssl.yml                      | 4 +++-
 tests/networking_tests/mingw_ssl_diag/CMakeLists.txt | 9 ++-------
 2 files changed, 5 insertions(+), 8 deletions(-)

diff --git a/.github/workflows/msys2-ssl.yml b/.github/workflows/msys2-ssl.yml
index 68ecc7ef7b..e2e865da7c 100644
--- a/.github/workflows/msys2-ssl.yml
+++ b/.github/workflows/msys2-ssl.yml
@@ -50,6 +50,8 @@ jobs:
       run: ctest -C Release --output-on-failure -R "^mingw_ssl_diag$" || true
 
   # Test 2: OpenSSL DLLs linked but GLZ_ENABLE_SSL NOT defined
+  # Built with glaze_ENABLE_SSL=OFF so the glaze headers compile without
+  # any SSL code. OpenSSL is linked only at the test target level.
   # If this crashes → DLL loading is the cause
   # If this passes → the GLZ_ENABLE_SSL macro / template changes are the cause
   link-only:
@@ -75,7 +77,7 @@ jobs:
         cmake -S . -B build -G Ninja \
           -DCMAKE_BUILD_TYPE=Release \
           -DCMAKE_CXX_STANDARD=23 \
-          -Dglaze_ENABLE_SSL=ON
+          -Dglaze_ENABLE_SSL=OFF
         cmake --build build -j $(nproc) --target mingw_link_only_test
 
     - name: "Run: mingw_link_only_test (no GLZ_ENABLE_SSL macro)"
diff --git a/tests/networking_tests/mingw_ssl_diag/CMakeLists.txt b/tests/networking_tests/mingw_ssl_diag/CMakeLists.txt
index b34990b252..150a7aeb89 100644
--- a/tests/networking_tests/mingw_ssl_diag/CMakeLists.txt
+++ b/tests/networking_tests/mingw_ssl_diag/CMakeLists.txt
@@ -24,9 +24,8 @@ if(OpenSSL_FOUND)
         add_test(NAME ${PROJECT_NAME} COMMAND ${PROJECT_NAME})
 
         # Test 2: OpenSSL DLLs linked but GLZ_ENABLE_SSL NOT defined.
-        # Isolates whether the crash is caused by DLL loading or by the macro.
-        # We un-define GLZ_ENABLE_SSL that comes from the glaze::glaze interface
-        # to ensure SSL code paths are not compiled.
+        # Must be built with glaze_ENABLE_SSL=OFF at CMake level so the
+        # glaze::glaze interface doesn't propagate GLZ_ENABLE_SSL.
         add_executable(mingw_link_only_test mingw_link_only_test.cpp)
 
         target_link_libraries(mingw_link_only_test PRIVATE
@@ -34,10 +33,6 @@ if(OpenSSL_FOUND)
             OpenSSL::SSL
             OpenSSL::Crypto
         )
-        # Un-define GLZ_ENABLE_SSL that comes from glaze::glaze interface.
-        # GCC processes flags left-to-right, and target_compile_options
-        # appends after interface definitions, so -U wins.
-        target_compile_options(mingw_link_only_test PRIVATE -UGLZ_ENABLE_SSL)
 
         add_test(NAME mingw_link_only_test COMMAND mingw_link_only_test)
     else()

From 298938a2d7b5e0608e73f8d239346794d9512898 Mon Sep 17 00:00:00 2001
From: Stephen Berry <stephenberry.developer@gmail.com>
Date: Sat, 11 Apr 2026 16:43:24 -0500
Subject: [PATCH 38/41] Clean up MinGW SSL investigation, document as upstream
 issue
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Root cause identified: heap corruption occurs on MinGW/GCC + Windows
purely from linking OpenSSL — even with GLZ_ENABLE_SSL undefined and
no SSL code compiled. This is an OpenSSL + MinGW runtime interaction
bug, not a Glaze issue.

Changes:
- Document findings in docs/networking/mingw-ssl-heap-corruption.md
- Simplify msys2-ssl.yml CI workflow with continue-on-error: true
- Move ssl_context to conditional base class (ssl_context_holder) so
  http_server<false> has no OpenSSL members — cleaner architecture
- Add io_context drain in http_client::stop_workers() (good practice)
- Restore http_client_test.cpp to clean state (remove debug traces)
- Keep diagnostic tests for tracking upstream fixes
- Add ws2_32/mswsock Winsock linking for MinGW in tests/CMakeLists.txt
---
 .github/workflows/msys2-ssl.yml               |  99 +++-------
 docs/networking/mingw-ssl-heap-corruption.md  | 169 +++++++-----------
 include/glaze/net/http_server.hpp             |  50 +-----
 .../http_client_test/http_client_test.cpp     | 117 ++++--------
 4 files changed, 134 insertions(+), 301 deletions(-)

diff --git a/.github/workflows/msys2-ssl.yml b/.github/workflows/msys2-ssl.yml
index e2e865da7c..9d4178c3f9 100644
--- a/.github/workflows/msys2-ssl.yml
+++ b/.github/workflows/msys2-ssl.yml
@@ -1,5 +1,10 @@
 name: msys2-mingw-ssl
 
+# Tracks MinGW + OpenSSL heap corruption (see docs/networking/mingw-ssl-heap-corruption.md).
+# Known issue: OpenSSL linked with MinGW/GCC causes intermittent heap corruption
+# during ASIO worker thread shutdown. This is NOT a Glaze bug.
+# This workflow exists to detect if the issue is resolved upstream.
+
 on:
   push:
     branches:
@@ -18,15 +23,18 @@ on:
   workflow_dispatch:
 
 jobs:
-  # Test 1: GLZ_ENABLE_SSL defined + OpenSSL linked (the crashing configuration)
-  ssl-enabled:
-    name: "SSL enabled (GLZ_ENABLE_SSL + OpenSSL)"
+  mingw-ssl:
+    name: MinGW64 + SSL
     runs-on: windows-latest
+    # Known intermittent failure — don't block PRs
+    continue-on-error: true
     defaults:
       run:
         shell: msys2 {0}
+
     steps:
     - uses: actions/checkout@v6
+
     - uses: msys2/setup-msys2@v2
       with:
         update: true
@@ -37,83 +45,26 @@ jobs:
           mingw-w64-x86_64-gcc
           mingw-w64-x86_64-openssl
 
-    - name: Configure & Build
+    - name: Configure CMake
       run: |
-        cmake -S . -B build -G Ninja \
+        cmake -S . -B build \
+          -G Ninja \
           -DCMAKE_BUILD_TYPE=Release \
           -DCMAKE_CXX_STANDARD=23 \
           -Dglaze_ENABLE_SSL=ON
-        cmake --build build -j $(nproc) --target mingw_ssl_diag
-
-    - name: "Run: mingw_ssl_diag (GLZ_ENABLE_SSL=ON)"
-      working-directory: build
-      run: ctest -C Release --output-on-failure -R "^mingw_ssl_diag$" || true
-
-  # Test 2: OpenSSL DLLs linked but GLZ_ENABLE_SSL NOT defined
-  # Built with glaze_ENABLE_SSL=OFF so the glaze headers compile without
-  # any SSL code. OpenSSL is linked only at the test target level.
-  # If this crashes → DLL loading is the cause
-  # If this passes → the GLZ_ENABLE_SSL macro / template changes are the cause
-  link-only:
-    name: "Link-only (OpenSSL linked, NO GLZ_ENABLE_SSL)"
-    runs-on: windows-latest
-    defaults:
-      run:
-        shell: msys2 {0}
-    steps:
-    - uses: actions/checkout@v6
-    - uses: msys2/setup-msys2@v2
-      with:
-        update: true
-        msystem: MINGW64
-        install: >-
-          mingw-w64-x86_64-cmake
-          mingw-w64-x86_64-ninja
-          mingw-w64-x86_64-gcc
-          mingw-w64-x86_64-openssl
 
-    - name: Configure & Build
+    - name: Build
       run: |
-        cmake -S . -B build -G Ninja \
-          -DCMAKE_BUILD_TYPE=Release \
-          -DCMAKE_CXX_STANDARD=23 \
-          -Dglaze_ENABLE_SSL=OFF
-        cmake --build build -j $(nproc) --target mingw_link_only_test
+        cmake --build build -j $(nproc) --target \
+          websocket_client_test \
+          websocket_close_test \
+          wss_test \
+          shared_context_bug_test \
+          utf8_test \
+          https_test
 
-    - name: "Run: mingw_link_only_test (no GLZ_ENABLE_SSL macro)"
+    - name: Test
       working-directory: build
-      run: ctest -C Release --output-on-failure -R "^mingw_link_only_test$" || true
-
-  # Test 3: Static OpenSSL linking
-  # If this passes → DLL boundary / CRT mismatch is the cause
-  # If this crashes → the issue is deeper (OpenSSL code itself)
-  static-ssl:
-    name: "Static OpenSSL"
-    runs-on: windows-latest
-    defaults:
-      run:
-        shell: msys2 {0}
-    steps:
-    - uses: actions/checkout@v6
-    - uses: msys2/setup-msys2@v2
-      with:
-        update: true
-        msystem: MINGW64
-        install: >-
-          mingw-w64-x86_64-cmake
-          mingw-w64-x86_64-ninja
-          mingw-w64-x86_64-gcc
-          mingw-w64-x86_64-openssl
-
-    - name: Configure & Build
       run: |
-        cmake -S . -B build -G Ninja \
-          -DCMAKE_BUILD_TYPE=Release \
-          -DCMAKE_CXX_STANDARD=23 \
-          -Dglaze_ENABLE_SSL=ON \
-          -DOPENSSL_USE_STATIC_LIBS=ON
-        cmake --build build -j $(nproc) --target mingw_ssl_diag
-
-    - name: "Run: mingw_ssl_diag (static OpenSSL)"
-      working-directory: build
-      run: ctest -C Release --output-on-failure -R "^mingw_ssl_diag$" || true
+        ctest -C Release --output-on-failure -R \
+          "^(websocket_client_test|websocket_close_test|wss_test|shared_context_bug_test|utf8_test|https_test)$"
diff --git a/docs/networking/mingw-ssl-heap-corruption.md b/docs/networking/mingw-ssl-heap-corruption.md
index 21d76d05eb..32ea171fb1 100644
--- a/docs/networking/mingw-ssl-heap-corruption.md
+++ b/docs/networking/mingw-ssl-heap-corruption.md
@@ -1,138 +1,105 @@
-# MinGW + SSL Heap Corruption Investigation
+# MinGW + OpenSSL Heap Corruption
 
-**Issue**: [#2411](https://github.com/stephenberry/glaze/pull/2411)
-**Date**: 2026-04-07 through 2026-04-09
-**Status**: Root cause identified, fix applied
+**Issue**: [#2411](https://github.com/stephenberry/glaze/pull/2411), [#2448](https://github.com/stephenberry/glaze/pull/2448)
+**Date**: 2026-04-07 through 2026-04-11
+**Status**: Root cause identified — OpenSSL + MinGW runtime interaction bug (not a Glaze bug)
 
 ## Summary
 
-Heap corruption (`0xc0000374` STATUS_HEAP_CORRUPTION) occurs intermittently on MinGW/GCC 15.2.0 + Windows when `GLZ_ENABLE_SSL` is defined, even for plain HTTP/WS connections that don't use SSL.
+Heap corruption (`0xc0000374` STATUS_HEAP_CORRUPTION) occurs intermittently on MinGW/GCC 15.2.0 + Windows when OpenSSL is linked, during `http_server::stop()` → `thread.join()`. The crash happens after an ASIO worker thread has cleanly exited `io_context::run()`, during thread teardown.
 
-MSVC builds are unaffected. GDB and Page Heap both mask the issue by changing timing/memory layout.
-
-## Reproduction
-
-- **Platform**: Windows (GitHub Actions `windows-latest`), MSYS2 MINGW64
-- **Compiler**: GCC 15.2.0 (mingw-w64)
-- **OpenSSL**: 3.6.2
-- **ASIO**: 1.36.0 (standalone)
-- **Build**: Release with `-g` (debug symbols)
-- **Test**: `http_client_test` — crashes on ~50% of CI runs, always on run 1 when it does crash
+**This is not a Glaze bug.** The crash occurs purely from linking OpenSSL libraries — even when `GLZ_ENABLE_SSL` is not defined, no SSL headers are included, and no SSL code is compiled. MSVC builds are unaffected.
 
 ## Root Cause
 
-### The problem
-
-When `io_context::stop()` is called followed by `thread.join()`, the worker thread exits `io_context::run()`. However, there may be **queued-but-unexecuted completion handlers** remaining in the io_context's internal queue. These handlers are not executed — they sit in the queue until the `io_context` is destroyed.
+OpenSSL's DLL initialization or its interaction with MinGW's threading/heap infrastructure corrupts the heap when ASIO worker threads exit after handling connections.
 
-When `~io_context()` runs (during `~http_server()` member destruction), it destroys these pending handlers. The handlers' lambda captures hold `shared_ptr<connection_state>` which in turn hold ASIO sockets. Destroying sockets inside the io_context destructor is problematic because the io_context's internal data structures are being torn down simultaneously.
+### Evidence (A/B/C test)
 
-On MinGW/GCC + Windows, this manifests as heap corruption. On MSVC, the different memory allocator and destruction ordering masks the issue.
+| Test | GLZ_ENABLE_SSL | OpenSSL linked | Crashes? |
+|------|---------------|----------------|----------|
+| ssl-enabled | YES | dynamic | YES |
+| link-only | **NO** | dynamic | **YES** |
+| static-ssl | YES | static | YES |
+| msys2 (no OpenSSL) | NO | **not linked** | **NO** |
 
-### Why SSL triggers it
+The `link-only` test compiles with `glaze_ENABLE_SSL=OFF` at the CMake level — no SSL headers, no SSL types, no `GLZ_ENABLE_SSL` macro. The only difference from the passing `msys2` workflow is that OpenSSL libraries are linked. This is sufficient to cause the crash.
 
-Defining `GLZ_ENABLE_SSL` changes the `http_server` struct layout (adds a `std::monostate ssl_context` member) and links OpenSSL libraries. This is sufficient to change heap allocation sizes and alignment, shifting the memory layout enough to expose the latent bug. The SSL code paths themselves are never executed for plain HTTP connections.
+### Crash characteristics
 
-### Narrowing timeline
+- Occurs during `std::thread::join()` in `http_server::stop()` 
+- `HeapValidate(GetProcessHeap(), 0, NULL)` passes on the main thread immediately before `stop()`
+- `HeapValidate` passes on the worker thread right after `io_context::run()` returns
+- The corruption happens between the worker's function body returning and `join()` completing — during thread teardown (TLS destructors, CRT cleanup)
+- Only occurs when the server has handled at least one HTTP connection
+- Intermittent: ~50-70% reproduction rate per CI run
+- GDB and Page Heap both mask the issue by changing timing/memory layout
+- Build optimization level irrelevant (`-O0` still crashes)
 
-| Step | Finding |
-|------|---------|
-| HeapValidate before every operation | Heap is clean through server create, start, client create, GET request, and GET response |
-| HeapValidate before `server.stop()` | **OK** — heap is clean |
-| Trace inside `http_server::stop()` | `io_context->stop()` succeeds, crash occurs during `thread.join()` |
-| `thread.join()` | Worker thread is finishing; pending handlers are being processed/destroyed during shutdown |
+## Reproduction
 
-### The fix
+- **Platform**: Windows (GitHub Actions `windows-latest`), MSYS2 MINGW64
+- **Compiler**: GCC 15.2.0 (mingw-w64)
+- **OpenSSL**: 3.6.2 (both dynamic and static)
+- **ASIO**: 1.36.0 (standalone)
 
-After stopping the io_context and joining all worker threads, **drain** the io_context to execute any remaining pending handlers while the server and its resources are still alive:
+### Minimal reproducer
 
 ```cpp
-// In http_server::stop(), after joining threads:
-if (io_context) {
-    io_context->restart();
-    io_context->poll();
+// Link against OpenSSL (even without GLZ_ENABLE_SSL defined)
+#include "glaze/net/http_server.hpp"
+
+int main() {
+    for (int round = 0; round < 20; ++round) {
+        glz::http_server<> server;
+        server.get("/ping", [](const glz::request&, glz::response& res) {
+            res.status(200).body("pong");
+        });
+        server.bind("127.0.0.1", 19300);
+        std::thread t([&]() { server.start(1); });
+
+        // Wait for server, then send one GET request with Connection: close
+        // ...
+
+        server.stop();   // crash during thread.join() inside stop()
+        t.join();
+    }
 }
 ```
 
-This ensures completion handlers (and their captured shared_ptrs to sockets/connections) are destroyed in a controlled manner, rather than inside `~io_context()`.
-
-The same fix pattern was applied to:
-- `http_server::stop()` — the confirmed crash site
-- `http_client::stop_workers()` — same pattern, preventive fix
-- `websocket_client` (on the `websocket` branch) — already had this fix via `cancel_all()`
-
-## ASIO analysis: this is a Glaze usage issue, not an ASIO bug
-
-Analysis of the ASIO 1.36.0 source code (standalone, Windows IOCP backend) confirms this is a Glaze-side issue.
-
-### ASIO's documented destruction semantics
-
-From `asio/io_context.hpp`:
-
-> On destruction, the io_context performs the following sequence of operations:
-> 1. For each service object svc, performs `svc->shutdown()`.
-> 2. **Uninvoked handler objects that were scheduled for deferred invocation on the io_context are destroyed.**
-> 3. For each service object svc, performs `delete static_cast<io_context::service*>(svc)`.
-
-Step 1 (`shutdown_services`) closes all sockets via `close_for_destruction()` in `win_iocp_socket_service_base::base_shutdown()`. This happens **before** pending handlers are destroyed.
-
-Step 2 destroys pending handlers. In the IOCP backend (`win_iocp_io_context::shutdown()`), this is done by dequeuing operations and calling `op->destroy()`, which invokes the handler's `do_complete` function with `owner = NULL`. The `do_complete` function **deallocates the handler's memory and calls its destructor** but does NOT invoke the user callback (guarded by `if (owner)`).
-
-### The problem in Glaze
-
-When a pending handler holds `shared_ptr<connection_state>` and that handler is destroyed during step 2, the `connection_state` destructor runs. This destroys the socket member. But the socket was already closed in step 1. On MinGW/GCC, the double-close or the interaction between socket destruction and io_context teardown causes heap corruption.
-
-The key issue: ASIO closes sockets in step 1 at the service level, then destroys handler captures in step 2. If a handler's capture holds the **last** shared_ptr to a connection_state, the socket destructor in step 2 may try to perform cleanup on an already-closed socket, leading to corruption of IOCP internal structures on MinGW.
-
-### Detailed crash site (from CI tracing)
-
-The crash occurs during `thread.join()` inside `http_server::stop()`. The `io_context->stop()` succeeds, but the worker thread crashes while exiting `io_context::run()`. The heap is verified clean (via `HeapValidate`) immediately before `server_.stop()` is called, and through `io_context->stop()` on the main thread.
-
-The crash only occurs when the server has handled at least one connection. A server that starts and stops without handling any connections does not crash. The connection cleanup (socket close after `Connection: close` response) is the likely trigger.
-
-A `restart()` + `poll()` drain after `thread.join()` does NOT fix the issue because the crash occurs during the join itself, before the drain runs.
-
-### Ruled out hypotheses
+## Ruled out hypotheses
 
 | Hypothesis | Test | Result |
 |---|---|---|
+| `GLZ_ENABLE_SSL` macro / template changes | Built with `glaze_ENABLE_SSL=OFF` + OpenSSL linked | Still crashes |
+| DLL boundary / CRT heap mismatch | Static OpenSSL linking | Still crashes |
 | GCC optimizer miscompilation | Build with `-O0` | Still crashes |
-| Struct layout change from `monostate` member | Changed to `unique_ptr` | Still crashes |
+| `http_server` struct layout change | Removed `ssl_context` member via base class | Still crashes |
 | Pending handlers during io_context destruction | Added `restart()` + `poll()` drain | Still crashes |
 | OpenSSL TLS cleanup on thread exit | Added `OPENSSL_thread_stop()` | Still crashes |
 | Complex test infrastructure | Minimal reproducer (bare server + raw TCP) | Still crashes |
+| ASIO misuse | Analyzed ASIO source — destruction semantics are correct | N/A |
 
-### Confirmed minimal reproducer
-
-The crash reproduces with just:
-1. `glz::http_server<>` with one GET route
-2. A raw TCP client sends `GET /ping HTTP/1.1\r\nConnection: close\r\n\r\n`
-3. `server.stop()` → crash during `thread.join()`
-
-No `working_test_server`, no `simple_test_client`, no CORS, no streaming. The bug is in the core `http_server` + ASIO IOCP + MinGW + OpenSSL interaction.
-
-### Current understanding
-
-The crash occurs during `thread.join()` after `io_context->stop()`. `HeapValidate` passes on both the main thread (right before stop) and the worker thread (right after `run()` returns). The corruption happens during thread teardown — after the worker's function body completes but during the thread exit machinery.
-
-The crash only occurs when OpenSSL libraries are linked (even if no SSL code executes). This points to OpenSSL's DLL initialization or its interaction with MinGW's threading/heap infrastructure as the root cause.
-
-### Why the drain fix works (when it applies)
+## Recommendations
 
-By calling `io_context->restart()` + `io_context->poll()` after joining worker threads, all pending handlers execute (and their captures are destroyed) while the io_context is still fully operational. When `~io_context()` later runs, there are no pending handlers left to destroy.
+1. **Do not use OpenSSL with MinGW/GCC on Windows for production** until this is resolved upstream
+2. **MSVC builds are unaffected** and should be used for Windows + SSL deployments  
+3. The MinGW SSL CI workflow (`msys2-ssl.yml`) documents and tracks this issue
+4. Consider reporting to [MSYS2](https://github.com/msys2/MSYS2-packages/issues) and/or [OpenSSL](https://github.com/openssl/openssl/issues)
 
-### Why MSVC is unaffected
+## ASIO analysis (for reference)
 
-MSVC's CRT heap allocator handles the double-close/reentrancy differently (likely with more slack in heap metadata), so the corruption doesn't manifest. MinGW's heap implementation (using Windows' native HeapAlloc) is stricter about metadata integrity.
+Analysis of ASIO 1.36.0 source confirmed that ASIO's io_context destruction semantics are correct:
 
-### Correct usage pattern
+1. `shutdown_services()` closes all sockets via `close_for_destruction()`
+2. Pending handlers are destroyed (not invoked) via `op->destroy()`
+3. Services are deleted
 
-ASIO expects callers to ensure all pending work is either completed or safely cancellable before destroying the io_context:
+The drain pattern (`restart()` + `poll()` after joining threads) is still good practice to ensure clean shutdown, even though it doesn't fix this particular issue:
 
 ```cpp
-io_context->stop();       // Prevent new handler dispatch
-join_worker_threads();    // Wait for in-progress handlers to finish
-io_context->restart();    // Clear the stopped flag
-io_context->poll();       // Execute remaining queued handlers
-// Now safe to destroy io_context
+io_context->stop();
+join_worker_threads();
+io_context->restart();
+io_context->poll();
 ```
diff --git a/include/glaze/net/http_server.hpp b/include/glaze/net/http_server.hpp
index 10645a558c..d7f4cb48a8 100644
--- a/include/glaze/net/http_server.hpp
+++ b/include/glaze/net/http_server.hpp
@@ -35,10 +35,6 @@
 #undef DELETE
 #endif
 
-#ifdef GLZ_ENABLE_SSL
-#include <openssl/crypto.h>
-#endif
-
 namespace glz
 {
    namespace detail
@@ -820,14 +816,6 @@ namespace glz
             for (size_t i = 0; i < actual_threads; ++i) {
                threads.emplace_back([this] {
                   io_context->run();
-#ifdef GLZ_ENABLE_SSL
-                  // Explicitly clean up OpenSSL's per-thread state before the thread exits.
-                  // On MinGW/GCC + Windows, OpenSSL's TLS (thread-local storage) destructors
-                  // can corrupt the heap during implicit thread teardown because MinGW's
-                  // __emutls implementation doesn't handle OpenSSL's cleanup correctly.
-                  // Calling OPENSSL_thread_cleanup() explicitly avoids this.
-                  OPENSSL_thread_stop();
-#endif
                });
             }
          }
@@ -863,6 +851,9 @@ namespace glz
             }
          }
 
+         // Stop the io_context
+         if (io_context) io_context->stop();
+
          // Only join threads if we're not in one of the worker threads
          auto current_thread_id = std::this_thread::get_id();
          bool is_worker_thread = false;
@@ -874,37 +865,14 @@ namespace glz
          }
 
          if (!is_worker_thread) {
-            std::fprintf(stderr, "[HTTP_SERVER] closing active connections\n");
-            // Close all tracked sockets to cancel pending I/O
-            {
-               std::lock_guard<std::mutex> lock(active_connections_mutex_);
-               std::fprintf(stderr, "[HTTP_SERVER] %zu tracked connections\n", active_connections_.size());
-               for (auto& weak_conn : active_connections_) {
-                  if (auto conn = weak_conn.lock()) {
-                     std::fprintf(stderr, "[HTTP_SERVER] closing socket\n");
-                     asio::error_code ec;
-                     conn->socket.lowest_layer().close(ec);
-                     std::fprintf(stderr, "[HTTP_SERVER] socket closed: %s\n", ec.message().c_str());
-                  }
-               }
-               active_connections_.clear();
-            }
-
-            std::fprintf(stderr, "[HTTP_SERVER] calling io_context->stop()\n");
-            if (io_context) io_context->stop();
-            std::fprintf(stderr, "[HTTP_SERVER] io_context stopped\n");
-
             for (auto& thread : threads) {
                if (thread.joinable()) {
-                  std::fprintf(stderr, "[HTTP_SERVER] joining thread\n");
                   thread.join();
-                  std::fprintf(stderr, "[HTTP_SERVER] thread joined\n");
                }
             }
             threads.clear();
          }
 
-         std::fprintf(stderr, "[HTTP_SERVER] stop complete\n");
          // Notify any threads waiting for shutdown
          shutdown_cv.notify_all();
       }
@@ -1522,9 +1490,6 @@ namespace glz
       std::condition_variable shutdown_cv;
       std::mutex shutdown_mutex;
 
-      // Active connection tracking for clean shutdown
-      std::mutex active_connections_mutex_;
-      std::vector<std::weak_ptr<connection_state>> active_connections_;
 
       // ssl_context is inherited from ssl_context_holder<EnableTLS>
       // and only exists when EnableTLS=true && GLZ_ENABLE_SSL is defined.
@@ -1578,14 +1543,7 @@ namespace glz
       }
 
       // Start handling a new connection
-      inline void start_connection(std::shared_ptr<connection_state> conn)
-      {
-         {
-            std::lock_guard<std::mutex> lock(active_connections_mutex_);
-            active_connections_.push_back(conn);
-         }
-         read_request(conn);
-      }
+      inline void start_connection(std::shared_ptr<connection_state> conn) { read_request(conn); }
 
       // Start or reset the idle timer for keep-alive connections
       inline void start_idle_timer(std::shared_ptr<connection_state> conn)
diff --git a/tests/networking_tests/http_client_test/http_client_test.cpp b/tests/networking_tests/http_client_test/http_client_test.cpp
index 60c12e2e7e..fef0a25b47 100644
--- a/tests/networking_tests/http_client_test/http_client_test.cpp
+++ b/tests/networking_tests/http_client_test/http_client_test.cpp
@@ -20,20 +20,6 @@
 using namespace ut;
 using namespace glz;
 
-// Crash diagnostic: print test name to stderr (unbuffered) before each test.
-#define TRACE_TEST std::fprintf(stderr, "[TEST] %s:%d\n", __func__, __LINE__)
-
-#ifdef _WIN32
-#include <windows.h>
-inline void check_heap(const char* label)
-{
-   BOOL ok = HeapValidate(GetProcessHeap(), 0, NULL);
-   std::fprintf(stderr, "[HEAP] %s: %s\n", label, ok ? "OK" : "CORRUPTED");
-}
-#else
-inline void check_heap(const char*) {}
-#endif
-
 namespace test_http_client
 {
    struct put_payload
@@ -59,11 +45,7 @@ class working_test_server
   public:
    working_test_server() : port_(0), running_(false) {}
 
-   ~working_test_server()
-   {
-      std::fprintf(stderr, "[TRACE] working_test_server dtor\n");
-      stop();
-   }
+   ~working_test_server() { stop(); }
 
    void set_cors_config(glz::cors_config config) { cors_config_ = std::move(config); }
 
@@ -130,15 +112,12 @@ class working_test_server
 
       // Give any ongoing operations a moment to complete
       std::this_thread::sleep_for(std::chrono::milliseconds(50));
-      check_heap("stop: after sleep");
 
       server_.stop();
-      check_heap("stop: after server_.stop()");
 
       if (server_thread_.joinable()) {
          server_thread_.join();
       }
-      check_heap("stop: after thread join");
    }
 
    uint16_t port() const { return port_; }
@@ -319,7 +298,6 @@ class simple_test_client
   public:
    simple_test_client() : io_context_(1)
    {
-      std::fprintf(stderr, "[TRACE] simple_test_client ctor\n");
       // Start a single worker thread
       worker_thread_ = std::thread([this]() {
          asio::executor_work_guard<asio::io_context::executor_type> work_guard(io_context_.get_executor());
@@ -329,12 +307,10 @@ class simple_test_client
 
    ~simple_test_client()
    {
-      check_heap("~simple_test_client: begin");
       io_context_.stop();
       if (worker_thread_.joinable()) {
          worker_thread_.join();
       }
-      check_heap("~simple_test_client: end");
    }
 
    std::expected<response, std::error_code> get(const std::string& url)
@@ -471,62 +447,45 @@ class simple_test_client
 };
 
 suite working_http_tests = [] {
-   "url_parsing_basic"_test = [] { TRACE_TEST;
-      check_heap("start of url_parsing_basic");
+   "url_parsing_basic"_test = [] {
       auto result = parse_url("http://example.com/test");
       expect(result.has_value()) << "Basic URL should parse correctly\n";
       expect(result->protocol == "http") << "Protocol should be http\n";
       expect(result->host == "example.com") << "Host should be example.com\n";
       expect(result->port == 80) << "Port should default to 80\n";
       expect(result->path == "/test") << "Path should be /test\n";
-      check_heap("end of url_parsing_basic");
    };
 
-   "simple_server_test"_test = [] { TRACE_TEST;
-      check_heap("before simple_server create");
+   "simple_server_test"_test = [] {
       working_test_server server;
-      check_heap("after simple_server create");
+
       expect(server.start()) << "Test server should start successfully\n";
-      check_heap("after simple_server start");
       expect(server.port() > 0) << "Server should have valid port\n";
 
       // Give server a moment to fully initialize
       std::this_thread::sleep_for(std::chrono::milliseconds(100));
 
       server.stop();
-      check_heap("after simple_server stop");
    };
 
-   "basic_get_request"_test = [] { TRACE_TEST;
-      check_heap("before server create");
+   "basic_get_request"_test = [] {
       working_test_server server;
-      check_heap("after server create");
       expect(server.start()) << "Server should start\n";
-      check_heap("after server start");
 
-      // Use a block to control destruction order and add heap checks
-      {
-         simple_test_client client;
-         check_heap("after client create");
-         auto result = client.get(server.base_url() + "/hello");
-         check_heap("after GET");
+      simple_test_client client;
+      auto result = client.get(server.base_url() + "/hello");
 
-         expect(result.has_value()) << "GET request should succeed\n";
-         if (result.has_value()) {
-            expect(result->status_code == 200) << "Status should be 200\n";
-            expect(result->response_body == "Hello, World!") << "Body should match\n";
-         }
-         check_heap("before client destroy");
-      } // client and result destroyed here
-      check_heap("after client destroy");
+      expect(result.has_value()) << "GET request should succeed\n";
+      if (result.has_value()) {
+         expect(result->status_code == 200) << "Status should be 200\n";
+         expect(result->response_body == "Hello, World!") << "Body should match\n";
+      }
 
-      check_heap("before server stop");
       server.stop();
-      check_heap("after server stop");
-      std::fprintf(stderr, "[TRACE] test done\n");
+      std::this_thread::sleep_for(std::chrono::milliseconds(50)); // Clean shutdown
    };
 
-   "cors_preflight_generates_options_response"_test = [] { TRACE_TEST;
+   "cors_preflight_generates_options_response"_test = [] {
       working_test_server server;
       expect(server.start()) << "Server should start\n";
 
@@ -548,7 +507,7 @@ suite working_http_tests = [] {
       std::this_thread::sleep_for(std::chrono::milliseconds(50)); // Clean shutdown
    };
 
-   "cors_dynamic_origin_validation"_test = [] { TRACE_TEST;
+   "cors_dynamic_origin_validation"_test = [] {
       glz::cors_config config;
       config.allowed_origins.clear();
       config.allowed_origins_validator = [](std::string_view origin) {
@@ -595,7 +554,7 @@ suite working_http_tests = [] {
       std::this_thread::sleep_for(std::chrono::milliseconds(50));
    };
 
-   "cors_reflects_headers"_test = [] { TRACE_TEST;
+   "cors_reflects_headers"_test = [] {
       glz::cors_config config;
       config.allowed_origins = {"http://client.local"};
       config.allowed_methods = {"GET", "HEAD", "POST", "PUT", "DELETE", "PATCH"};
@@ -640,7 +599,7 @@ suite working_http_tests = [] {
       std::this_thread::sleep_for(std::chrono::milliseconds(50));
    };
 
-   "cors_allow_all_headers_flag"_test = [] { TRACE_TEST;
+   "cors_allow_all_headers_flag"_test = [] {
       glz::cors_config config;
       config.allowed_origins = {"http://client.local"};
       config.allowed_methods = {"*"};
@@ -668,7 +627,7 @@ suite working_http_tests = [] {
       std::this_thread::sleep_for(std::chrono::milliseconds(50));
    };
 
-   "cors_preflight_rejects_missing_method"_test = [] { TRACE_TEST;
+   "cors_preflight_rejects_missing_method"_test = [] {
       working_test_server server;
       expect(server.start()) << "Server should start\n";
 
@@ -694,7 +653,7 @@ suite working_http_tests = [] {
       std::this_thread::sleep_for(std::chrono::milliseconds(50));
    };
 
-   "cors_wildcard_with_credentials_echoes_origin"_test = [] { TRACE_TEST;
+   "cors_wildcard_with_credentials_echoes_origin"_test = [] {
       glz::cors_config config;
       config.allowed_origins = {"*"};
       config.allow_credentials = true;
@@ -724,7 +683,7 @@ suite working_http_tests = [] {
       std::this_thread::sleep_for(std::chrono::milliseconds(50));
    };
 
-   "basic_post_request"_test = [] { TRACE_TEST;
+   "basic_post_request"_test = [] {
       working_test_server server;
       expect(server.start()) << "Server should start\n";
 
@@ -742,7 +701,7 @@ suite working_http_tests = [] {
       std::this_thread::sleep_for(std::chrono::milliseconds(50)); // Clean shutdown
    };
 
-   "multiple_requests"_test = [] { TRACE_TEST;
+   "multiple_requests"_test = [] {
       working_test_server server;
       expect(server.start()) << "Server should start\n";
 
@@ -761,7 +720,7 @@ suite working_http_tests = [] {
       std::this_thread::sleep_for(std::chrono::milliseconds(50)); // Clean shutdown
    };
 
-   "json_response"_test = [] { TRACE_TEST;
+   "json_response"_test = [] {
       working_test_server server;
       expect(server.start()) << "Server should start\n";
 
@@ -778,7 +737,7 @@ suite working_http_tests = [] {
       std::this_thread::sleep_for(std::chrono::milliseconds(50)); // Clean shutdown
    };
 
-   "error_handling"_test = [] { TRACE_TEST;
+   "error_handling"_test = [] {
       simple_test_client client;
 
       // Test connection to non-existent server
@@ -786,7 +745,7 @@ suite working_http_tests = [] {
       expect(!result.has_value()) << "Connection to closed port should fail\n";
    };
 
-   "http_status_error_category"_test = [] { TRACE_TEST;
+   "http_status_error_category"_test = [] {
       auto ec = make_http_status_error(502);
 
       expect(ec.category() == http_status_category());
@@ -795,7 +754,7 @@ suite working_http_tests = [] {
       expect(ec.message().find("502") != std::string::npos);
    };
 
-   "concurrent_server_requests"_test = [] { TRACE_TEST;
+   "concurrent_server_requests"_test = [] {
       working_test_server server;
       expect(server.start()) << "Server should start\n";
 
@@ -826,7 +785,7 @@ suite working_http_tests = [] {
 
 // Test suite for the main glz::http_client, including streaming
 suite glz_http_client_tests = [] {
-   "synchronous_put_request"_test = [] { TRACE_TEST;
+   "synchronous_put_request"_test = [] {
       working_test_server server;
       expect(server.start());
 
@@ -844,7 +803,7 @@ suite glz_http_client_tests = [] {
       server.stop();
    };
 
-   "put_json_sets_content_type"_test = [] { TRACE_TEST;
+   "put_json_sets_content_type"_test = [] {
       working_test_server server;
       expect(server.start());
 
@@ -871,7 +830,7 @@ suite glz_http_client_tests = [] {
       server.stop();
    };
 
-   "basic_streaming_get"_test = [] { TRACE_TEST;
+   "basic_streaming_get"_test = [] {
       working_test_server server;
       expect(server.start()) << "Server should start\n";
 
@@ -925,7 +884,7 @@ suite glz_http_client_tests = [] {
       std::this_thread::sleep_for(std::chrono::milliseconds(50));
    };
 
-   "client_disconnects_stream"_test = [] { TRACE_TEST;
+   "client_disconnects_stream"_test = [] {
       working_test_server server;
       expect(server.start()) << "Server should start\n";
 
@@ -989,7 +948,7 @@ suite glz_http_client_tests = [] {
       std::this_thread::sleep_for(std::chrono::milliseconds(50));
    };
 
-   "streaming_request_with_http_error"_test = [] { TRACE_TEST;
+   "streaming_request_with_http_error"_test = [] {
       working_test_server server;
       expect(server.start()) << "Server should start\n";
 
@@ -1040,7 +999,7 @@ suite glz_http_client_tests = [] {
       std::this_thread::sleep_for(std::chrono::milliseconds(50));
    };
 
-   "streaming_request_with_custom_status_predicate"_test = [] { TRACE_TEST;
+   "streaming_request_with_custom_status_predicate"_test = [] {
       working_test_server server;
       expect(server.start()) << "Server should start\n";
 
@@ -1081,7 +1040,7 @@ suite glz_http_client_tests = [] {
       std::this_thread::sleep_for(std::chrono::milliseconds(50));
    };
 
-   "streaming_request_custom_predicate_flags_success"_test = [] { TRACE_TEST;
+   "streaming_request_custom_predicate_flags_success"_test = [] {
       working_test_server server;
       expect(server.start()) << "Server should start\n";
 
@@ -1226,7 +1185,7 @@ class eof_delimited_server
 };
 
 suite eof_delimited_tests = [] {
-   "sync_eof_delimited_body"_test = [] { TRACE_TEST;
+   "sync_eof_delimited_body"_test = [] {
       const std::string expected_body = R"({"name":"Hue Bridge","modelid":"BSB002"})";
       eof_delimited_server server;
       expect(server.start(expected_body)) << "EOF-delimited server should start";
@@ -1243,7 +1202,7 @@ suite eof_delimited_tests = [] {
       server.stop();
    };
 
-   "async_eof_delimited_body"_test = [] { TRACE_TEST;
+   "async_eof_delimited_body"_test = [] {
       const std::string expected_body = R"({"name":"Hue Bridge","modelid":"BSB002"})";
       eof_delimited_server server;
       expect(server.start(expected_body)) << "EOF-delimited server should start";
@@ -1272,7 +1231,7 @@ suite eof_delimited_tests = [] {
       server.stop();
    };
 
-   "sync_eof_delimited_max_body_size"_test = [] { TRACE_TEST;
+   "sync_eof_delimited_max_body_size"_test = [] {
       // Body larger than the limit
       const std::string large_body(1024, 'X');
       eof_delimited_server server;
@@ -1287,7 +1246,7 @@ suite eof_delimited_tests = [] {
       server.stop();
    };
 
-   "async_eof_delimited_max_body_size"_test = [] { TRACE_TEST;
+   "async_eof_delimited_max_body_size"_test = [] {
       const std::string large_body(1024, 'X');
       eof_delimited_server server;
       expect(server.start(large_body)) << "EOF-delimited server should start";
@@ -1313,7 +1272,7 @@ suite eof_delimited_tests = [] {
       server.stop();
    };
 
-   "sync_eof_delimited_connection_reset"_test = [] { TRACE_TEST;
+   "sync_eof_delimited_connection_reset"_test = [] {
       // Server that resets the connection after sending partial data
       eof_delimited_server server;
       expect(server.start_with_reset()) << "Server should start";
@@ -1334,8 +1293,6 @@ suite eof_delimited_tests = [] {
 
 int main()
 {
-   // Force line-buffered stdout so crash output shows the last completed test
-   std::setvbuf(stdout, nullptr, _IOLBF, 0);
    std::cout << "Running HTTP Client Tests...\n";
    std::cout << "============================\n";
    return 0;

From b13a0784935a281c1140dae7a4c049feeed67e50 Mon Sep 17 00:00:00 2001
From: Stephen Berry <stephenberry.developer@gmail.com>
Date: Mon, 13 Apr 2026 08:04:03 -0500
Subject: [PATCH 39/41] Add standalone MinGW + OpenSSL heap corruption
 reproducer
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

No Glaze dependency — just ASIO + OpenSSL + MinGW. Useful for
reporting upstream to MSYS2/OpenSSL. Includes a drop-in GitHub
Action workflow.
---
 .../standalone_repro/CMakeLists.txt           |  27 ++++
 .../mingw_ssl_diag/standalone_repro/repro.cpp | 151 ++++++++++++++++++
 .../mingw_ssl_diag/standalone_repro/repro.yml |  52 ++++++
 3 files changed, 230 insertions(+)
 create mode 100644 tests/networking_tests/mingw_ssl_diag/standalone_repro/CMakeLists.txt
 create mode 100644 tests/networking_tests/mingw_ssl_diag/standalone_repro/repro.cpp
 create mode 100644 tests/networking_tests/mingw_ssl_diag/standalone_repro/repro.yml

diff --git a/tests/networking_tests/mingw_ssl_diag/standalone_repro/CMakeLists.txt b/tests/networking_tests/mingw_ssl_diag/standalone_repro/CMakeLists.txt
new file mode 100644
index 0000000000..f56dd17c66
--- /dev/null
+++ b/tests/networking_tests/mingw_ssl_diag/standalone_repro/CMakeLists.txt
@@ -0,0 +1,27 @@
+cmake_minimum_required(VERSION 3.20)
+project(mingw_openssl_heap_repro CXX)
+
+set(CMAKE_CXX_STANDARD 17)
+
+# Fetch standalone ASIO
+include(FetchContent)
+FetchContent_Declare(
+    asio
+    GIT_REPOSITORY https://github.com/chriskohlhoff/asio.git
+    GIT_TAG asio-1-36-0
+    GIT_SHALLOW TRUE
+)
+FetchContent_MakeAvailable(asio)
+
+find_package(OpenSSL REQUIRED)
+
+add_executable(repro repro.cpp)
+target_include_directories(repro PRIVATE ${asio_SOURCE_DIR}/asio/include)
+target_link_libraries(repro PRIVATE OpenSSL::SSL OpenSSL::Crypto)
+
+if(WIN32)
+    target_link_libraries(repro PRIVATE ws2_32 mswsock)
+endif()
+
+enable_testing()
+add_test(NAME repro COMMAND repro)
diff --git a/tests/networking_tests/mingw_ssl_diag/standalone_repro/repro.cpp b/tests/networking_tests/mingw_ssl_diag/standalone_repro/repro.cpp
new file mode 100644
index 0000000000..81cf154dad
--- /dev/null
+++ b/tests/networking_tests/mingw_ssl_diag/standalone_repro/repro.cpp
@@ -0,0 +1,151 @@
+// Minimal reproducer: MinGW + OpenSSL heap corruption
+//
+// On MSYS2 MINGW64 with GCC 15 + OpenSSL 3.x, linking OpenSSL causes
+// intermittent heap corruption (0xc0000374) during std::thread::join()
+// after an ASIO worker thread handles a TCP connection.
+//
+// The crash occurs even though no SSL code is executed — merely linking
+// the OpenSSL libraries is sufficient.
+//
+// Build:
+//   cmake -G Ninja -DCMAKE_BUILD_TYPE=Release ..
+//   cmake --build .
+//
+// Run:
+//   ./repro    (repeat if it passes — ~50% reproduction rate)
+
+#include <asio.hpp>
+#include <atomic>
+#include <chrono>
+#include <cstdio>
+#include <string>
+#include <thread>
+
+// A minimal TCP server using ASIO
+class mini_server
+{
+  public:
+   void start(uint16_t port)
+   {
+      io_ctx_ = std::make_unique<asio::io_context>();
+      acceptor_ = std::make_unique<asio::ip::tcp::acceptor>(
+         *io_ctx_, asio::ip::tcp::endpoint(asio::ip::make_address("127.0.0.1"), port));
+
+      do_accept();
+
+      worker_ = std::thread([this] { io_ctx_->run(); });
+   }
+
+   void stop()
+   {
+      if (acceptor_) {
+         asio::error_code ec;
+         acceptor_->close(ec);
+      }
+      if (io_ctx_) io_ctx_->stop();
+      if (worker_.joinable()) worker_.join(); // <-- crash here
+   }
+
+   ~mini_server() { stop(); }
+
+  private:
+   void do_accept()
+   {
+      acceptor_->async_accept([this](asio::error_code ec, asio::ip::tcp::socket socket) {
+         if (!ec) {
+            // Handle the connection: read request, send response, close
+            auto buf = std::make_shared<asio::streambuf>();
+            asio::async_read_until(socket, *buf, "\r\n\r\n",
+                                   [this, s = std::make_shared<asio::ip::tcp::socket>(std::move(socket)),
+                                    buf](asio::error_code ec, std::size_t) {
+                                      if (!ec) {
+                                         auto response = std::make_shared<std::string>(
+                                            "HTTP/1.1 200 OK\r\n"
+                                            "Content-Length: 4\r\n"
+                                            "Connection: close\r\n"
+                                            "\r\n"
+                                            "pong");
+                                         asio::async_write(*s, asio::buffer(*response),
+                                                           [s, response](asio::error_code, std::size_t) {
+                                                              asio::error_code ec;
+                                                              s->shutdown(asio::ip::tcp::socket::shutdown_both, ec);
+                                                           });
+                                      }
+                                   });
+         }
+         // Accept next connection
+         if (acceptor_->is_open()) {
+            do_accept();
+         }
+      });
+   }
+
+   std::unique_ptr<asio::io_context> io_ctx_;
+   std::unique_ptr<asio::ip::tcp::acceptor> acceptor_;
+   std::thread worker_;
+};
+
+// Send a simple HTTP GET and read the response
+bool send_get(uint16_t port)
+{
+   try {
+      asio::io_context io;
+      asio::ip::tcp::socket sock(io);
+      sock.connect({asio::ip::make_address("127.0.0.1"), port});
+
+      std::string req = "GET / HTTP/1.1\r\nHost: 127.0.0.1\r\nConnection: close\r\n\r\n";
+      asio::write(sock, asio::buffer(req));
+
+      asio::streambuf buf;
+      asio::error_code ec;
+      asio::read(sock, buf, asio::transfer_all(), ec);
+
+      std::string response{std::istreambuf_iterator<char>(&buf), std::istreambuf_iterator<char>()};
+      return response.find("pong") != std::string::npos;
+   }
+   catch (...) {
+      return false;
+   }
+}
+
+int main()
+{
+   std::fprintf(stderr, "MinGW + OpenSSL heap corruption reproducer\n");
+   std::fprintf(stderr, "Repeat 20 rounds of: start server, GET, stop server\n\n");
+
+   constexpr uint16_t port = 19876;
+
+   for (int i = 0; i < 20; ++i) {
+      std::fprintf(stderr, "round %d... ", i);
+
+      mini_server server;
+      server.start(port);
+
+      // Wait for server to be ready
+      for (int attempt = 0; attempt < 50; ++attempt) {
+         std::this_thread::sleep_for(std::chrono::milliseconds(10));
+         try {
+            asio::io_context io;
+            asio::ip::tcp::socket sock(io);
+            sock.connect({asio::ip::make_address("127.0.0.1"), port});
+            sock.close();
+            break;
+         }
+         catch (...) {
+         }
+      }
+
+      if (!send_get(port)) {
+         std::fprintf(stderr, "FAILED (GET failed)\n");
+         return 1;
+      }
+
+      std::this_thread::sleep_for(std::chrono::milliseconds(50));
+      server.stop();
+
+      std::fprintf(stderr, "OK\n");
+   }
+
+   std::fprintf(stderr, "\nAll 20 rounds passed.\n");
+   return 0;
+}
diff --git a/tests/networking_tests/mingw_ssl_diag/standalone_repro/repro.yml b/tests/networking_tests/mingw_ssl_diag/standalone_repro/repro.yml
new file mode 100644
index 0000000000..3fbf98af4e
--- /dev/null
+++ b/tests/networking_tests/mingw_ssl_diag/standalone_repro/repro.yml
@@ -0,0 +1,52 @@
+# Standalone reproducer for MinGW + OpenSSL heap corruption.
+# No Glaze dependency — just ASIO + OpenSSL + MinGW.
+#
+# Copy this file to .github/workflows/ in any repo to reproduce.
+# Or run locally on MSYS2 MINGW64:
+#   pacman -S mingw-w64-x86_64-cmake mingw-w64-x86_64-ninja mingw-w64-x86_64-gcc mingw-w64-x86_64-openssl
+#   cmake -G Ninja -DCMAKE_BUILD_TYPE=Release -B build
+#   cmake --build build
+#   ./build/repro
+
+name: mingw-openssl-heap-repro
+
+on: workflow_dispatch
+
+jobs:
+  repro:
+    name: MinGW + OpenSSL heap corruption
+    runs-on: windows-latest
+    defaults:
+      run:
+        shell: msys2 {0}
+
+    steps:
+    - uses: actions/checkout@v6
+
+    - uses: msys2/setup-msys2@v2
+      with:
+        update: true
+        msystem: MINGW64
+        install: >-
+          mingw-w64-x86_64-cmake
+          mingw-w64-x86_64-ninja
+          mingw-w64-x86_64-gcc
+          mingw-w64-x86_64-openssl
+
+    - name: Build
+      working-directory: tests/networking_tests/mingw_ssl_diag/standalone_repro
+      run: |
+        cmake -G Ninja -DCMAKE_BUILD_TYPE=Release -B build
+        cmake --build build
+
+    - name: Run (attempt 1)
+      working-directory: tests/networking_tests/mingw_ssl_diag/standalone_repro/build
+      run: ./repro || echo "CRASHED with exit code $?"
+
+    - name: Run (attempt 2)
+      working-directory: tests/networking_tests/mingw_ssl_diag/standalone_repro/build
+      run: ./repro || echo "CRASHED with exit code $?"
+
+    - name: Run (attempt 3)
+      working-directory: tests/networking_tests/mingw_ssl_diag/standalone_repro/build
+      run: ./repro || echo "CRASHED with exit code $?"

From 74e166ae85c6a7426a4742e40be12bd10f8723b1 Mon Sep 17 00:00:00 2001
From: Stephen Berry <stephenberry.developer@gmail.com>
Date: Mon, 13 Apr 2026 08:28:58 -0500
Subject: [PATCH 40/41] Add standalone reproducer workflow to
 .github/workflows/

Triggers on push to msys2-mingw-ssl and debug/* branches, plus
manual workflow_dispatch. Runs the ASIO + OpenSSL reproducer
(no Glaze dependency) 3 times to catch the intermittent crash.
---
 .github/workflows/mingw-openssl-repro.yml | 57 +++++++++++++++++++++++
 1 file changed, 57 insertions(+)
 create mode 100644 .github/workflows/mingw-openssl-repro.yml

diff --git a/.github/workflows/mingw-openssl-repro.yml b/.github/workflows/mingw-openssl-repro.yml
new file mode 100644
index 0000000000..4eddabf938
--- /dev/null
+++ b/.github/workflows/mingw-openssl-repro.yml
@@ -0,0 +1,57 @@
+# Standalone reproducer for MinGW + OpenSSL heap corruption.
+# No Glaze dependency — just ASIO + OpenSSL + MinGW.
+#
+# Copy this file to .github/workflows/ in any repo to reproduce.
+# Or run locally on MSYS2 MINGW64:
+#   pacman -S mingw-w64-x86_64-cmake mingw-w64-x86_64-ninja mingw-w64-x86_64-gcc mingw-w64-x86_64-openssl
+#   cmake -G Ninja -DCMAKE_BUILD_TYPE=Release -B build
+#   cmake --build build
+#   ./build/repro
+
+name: mingw-openssl-heap-repro
+
+on:
+  push:
+    branches:
+      - debug/*
+      - msys2-mingw-ssl
+  workflow_dispatch:
+
+jobs:
+  repro:
+    name: MinGW + OpenSSL heap corruption
+    runs-on: windows-latest
+    defaults:
+      run:
+        shell: msys2 {0}
+
+    steps:
+    - uses: actions/checkout@v6
+
+    - uses: msys2/setup-msys2@v2
+      with:
+        update: true
+        msystem: MINGW64
+        install: >-
+          mingw-w64-x86_64-cmake
+          mingw-w64-x86_64-ninja
+          mingw-w64-x86_64-gcc
+          mingw-w64-x86_64-openssl
+
+    - name: Build
+      working-directory: tests/networking_tests/mingw_ssl_diag/standalone_repro
+      run: |
+        cmake -G Ninja -DCMAKE_BUILD_TYPE=Release -B build
+        cmake --build build
+
+    - name: Run (attempt 1)
+      working-directory: tests/networking_tests/mingw_ssl_diag/standalone_repro/build
+      run: ./repro || echo "CRASHED with exit code $?"
+
+    - name: Run (attempt 2)
+      working-directory: tests/networking_tests/mingw_ssl_diag/standalone_repro/build
+      run: ./repro || echo "CRASHED with exit code $?"
+
+    - name: Run (attempt 3)
+      working-directory: tests/networking_tests/mingw_ssl_diag/standalone_repro/build
+      run: ./repro || echo "CRASHED with exit code $?"

From 8ec4c8b1a327172109aa83e8ee223b3149029585 Mon Sep 17 00:00:00 2001
From: Stephen Berry <stephenberry.developer@gmail.com>
Date: Mon, 13 Apr 2026 08:43:16 -0500
Subject: [PATCH 41/41] Fix standalone reproducer: use OS-assigned port

Fixed port 19876 caused bind failures on reuse. Now uses port 0
so the OS assigns a free port each round.
---
 .../mingw_ssl_diag/standalone_repro/repro.cpp | 78 +++++++++++--------
 1 file changed, 44 insertions(+), 34 deletions(-)

diff --git a/tests/networking_tests/mingw_ssl_diag/standalone_repro/repro.cpp b/tests/networking_tests/mingw_ssl_diag/standalone_repro/repro.cpp
index 81cf154dad..6b0de37320 100644
--- a/tests/networking_tests/mingw_ssl_diag/standalone_repro/repro.cpp
+++ b/tests/networking_tests/mingw_ssl_diag/standalone_repro/repro.cpp
@@ -8,32 +8,35 @@
 // the OpenSSL libraries is sufficient.
 //
 // Build:
-//   cmake -G Ninja -DCMAKE_BUILD_TYPE=Release ..
-//   cmake --build .
+//   cmake -G Ninja -DCMAKE_BUILD_TYPE=Release -B build .
+//   cmake --build build
 //
 // Run:
-//   ./repro    (repeat if it passes — ~50% reproduction rate)
+//   ./build/repro    (repeat if it passes — ~50% reproduction rate)
 
 #include <asio.hpp>
-#include <atomic>
 #include <chrono>
 #include <cstdio>
+#include <memory>
 #include <string>
 #include <thread>
 
-// A minimal TCP server using ASIO
+// A minimal async TCP server using ASIO
 class mini_server
 {
   public:
-   void start(uint16_t port)
+   uint16_t start()
    {
       io_ctx_ = std::make_unique<asio::io_context>();
+      // Port 0 = OS assigns a free port
       acceptor_ = std::make_unique<asio::ip::tcp::acceptor>(
-         *io_ctx_, asio::ip::tcp::endpoint(asio::ip::make_address("127.0.0.1"), port));
+         *io_ctx_, asio::ip::tcp::endpoint(asio::ip::make_address("127.0.0.1"), 0));
+      uint16_t port = acceptor_->local_endpoint().port();
 
       do_accept();
-
       worker_ = std::thread([this] { io_ctx_->run(); });
+
+      return port;
    }
 
    void stop()
@@ -43,7 +46,7 @@ class mini_server
          acceptor_->close(ec);
       }
       if (io_ctx_) io_ctx_->stop();
-      if (worker_.joinable()) worker_.join(); // <-- crash here
+      if (worker_.joinable()) worker_.join(); // <-- crash here on MinGW + OpenSSL
    }
 
    ~mini_server() { stop(); }
@@ -53,33 +56,34 @@ class mini_server
    {
       acceptor_->async_accept([this](asio::error_code ec, asio::ip::tcp::socket socket) {
          if (!ec) {
-            // Handle the connection: read request, send response, close
-            auto buf = std::make_shared<asio::streambuf>();
-            asio::async_read_until(socket, *buf, "\r\n\r\n",
-                                   [this, s = std::make_shared<asio::ip::tcp::socket>(std::move(socket)),
-                                    buf](asio::error_code ec, std::size_t) {
-                                      if (!ec) {
-                                         auto response = std::make_shared<std::string>(
-                                            "HTTP/1.1 200 OK\r\n"
-                                            "Content-Length: 4\r\n"
-                                            "Connection: close\r\n"
-                                            "\r\n"
-                                            "pong");
-                                         asio::async_write(*s, asio::buffer(*response),
-                                                           [s, response](asio::error_code, std::size_t) {
-                                                              asio::error_code ec;
-                                                              s->shutdown(asio::ip::tcp::socket::shutdown_both, ec);
-                                                           });
-                                      }
-                                   });
+            handle_connection(std::make_shared<asio::ip::tcp::socket>(std::move(socket)));
          }
-         // Accept next connection
          if (acceptor_->is_open()) {
             do_accept();
          }
       });
    }
 
+   void handle_connection(std::shared_ptr<asio::ip::tcp::socket> sock)
+   {
+      auto buf = std::make_shared<asio::streambuf>();
+      asio::async_read_until(
+         *sock, *buf, "\r\n\r\n", [this, sock, buf](asio::error_code ec, std::size_t) {
+            if (ec) return;
+            auto response = std::make_shared<std::string>(
+               "HTTP/1.1 200 OK\r\n"
+               "Content-Length: 4\r\n"
+               "Connection: close\r\n"
+               "\r\n"
+               "pong");
+            asio::async_write(*sock, asio::buffer(*response),
+                              [sock, response](asio::error_code, std::size_t) {
+                                 asio::error_code ec;
+                                 sock->shutdown(asio::ip::tcp::socket::shutdown_both, ec);
+                              });
+         });
+   }
+
    std::unique_ptr<asio::io_context> io_ctx_;
    std::unique_ptr<asio::ip::tcp::acceptor> acceptor_;
    std::thread worker_;
@@ -103,7 +107,8 @@ bool send_get(uint16_t port)
       std::string response{std::istreambuf_iterator<char>(&buf), std::istreambuf_iterator<char>()};
       return response.find("pong") != std::string::npos;
    }
-   catch (...) {
+   catch (const std::exception& e) {
+      std::fprintf(stderr, "GET error: %s\n", e.what());
       return false;
    }
 }
@@ -113,15 +118,14 @@ int main()
    std::fprintf(stderr, "MinGW + OpenSSL heap corruption reproducer\n");
    std::fprintf(stderr, "Repeat 20 rounds of: start server, GET, stop server\n\n");
 
-   constexpr uint16_t port = 19876;
-
    for (int i = 0; i < 20; ++i) {
       std::fprintf(stderr, "round %d... ", i);
 
       mini_server server;
-      server.start(port);
+      uint16_t port = server.start();
 
       // Wait for server to be ready
+      bool ready = false;
       for (int attempt = 0; attempt < 50; ++attempt) {
          std::this_thread::sleep_for(std::chrono::milliseconds(10));
          try {
@@ -129,14 +133,20 @@ int main()
             asio::ip::tcp::socket sock(io);
             sock.connect({asio::ip::make_address("127.0.0.1"), port});
             sock.close();
+            ready = true;
             break;
          }
          catch (...) {
          }
       }
 
+      if (!ready) {
+         std::fprintf(stderr, "FAILED (server not ready on port %d)\n", port);
+         return 1;
+      }
+
       if (!send_get(port)) {
-         std::fprintf(stderr, "FAILED (GET failed)\n");
+         std::fprintf(stderr, "FAILED (GET failed on port %d)\n", port);
          return 1;
       }