this MR replaces constants INT16_MIN by -INT16_MAX (so -32767) in places where it used for mathematical operations

Integration: `2025.w40`

* !3672 \[ci\] Fix MissingPropertyException - COTS-UE by binding OAI_Registry globally
* !3609 BWP with no PRACH occasions
* !3657 do not assert for mismatched TBS in phy-test mode
* !3667 CI: Updates for HO and AW2S pipeline
* !3674 NR UE: remove function get_nr_RSRP() and get_nr_rx_total_gain_dB() for cleanup
* !3478 NR UE: add UCI (HARQ-ACK/NACK) on PUSCH support at PHY
* !3664 modulation LUTs size was wrong, and remove inconsistent test of SSE2 enable
* !3665 Make all targets compile
* !3554 Handle failures in RRCReconfiguration encoding gracefully
* !3655 Improvements to N2 handover
* !3678 Add OAIUE longrun pipeline
* !3628 Update documentation

Closes #979, #726, #959, #967, and #930

See merge request oai/openairinterface5g!3676

Update documentation

Add OAIUE longrun pipeline

Add a new XML file for OAIUE longrun.

- Test description:
  * 40 MHz BW, n78
  * gNB with USRP N310, UE with USRP N310
  * CN deployed on OC
- Test duration: 1 hour
- Test scenario: 3x DL 10 min test (20 Mbps) + 3x UL 10 min test (5
  Mbps)

pods deployed through helm occasionally take more time, leading to
errors such as

    Error from server (BadRequest): container "physim" in pod "oai-physims-4g-sczvl" is waiting to start: ContainerCreating

Give a bit more time before checking the logs. We cannot wait too much,
as the container will just end on FINISHED in running state, so the logs
will always be there.

The goal of this MR is to resolve memory leaks, prevent crashes, and improve code quality.

Bug Fixes:
- Fix crash in get_du_for_ue when F1 UE data doesn't exist during N2 handover
- Fix memory leaks in handover preparation and UE context cleanup
- Fix duplicate handover request handling with proper UE context validation

Code Quality Improvements:
- Prevent ASN.1 double-free bug in NGAP memory management (caller ownership
  principle)
- Fix hardcoded instance 0 bug in UE context release command
- Refactor e1_send_bearer_updates into three specialized functions with
  extracted common code
- Replace impossible ID mismatch checks with DevAssert statements
- Fix inconsistent equality checking patterns in E1AP bearer context management
- Improve error message consistency across NGAP handover functions
- Optimize PLMN identity assignment using struct copies

Documentation Enhancements:
- Improve RRC neighbor configuration documentation with actual parameter names
- Add same-machine setup guidance for N2 handover with network configuration
  notes
- Fix grammar errors and standardize naming conventions

Follow up to !3334 (merged)

Handle failures in RRCReconfiguration encoding gracefully

Closes #979

Make all targets compile

This MR enables us to compile all targets, and does that in one CI test. This
closes #726. Now, this should work:

cd ~/openairinterface5g
mkdir build && cd build
cmake .. -GNinja && ninja

To achieve this, I did the following:
- some targets have been fixed (warnings, errors)
- some targets have been removed when they did not seem to serve a good purpose
  (e.g., an almost empty test)
- some targets have been commented (e.g., LTE simulators, some unitary tests)
  which we maybe want to revive in the future
- some targets built when just building with ninja, but not all. For instance,
  telnetsrv_enb would typically build, but it was missing a dependency. Doing
  cmake .. -GNinja && ninja telnetsrv_enb would show this (in develop)

To help with the last bullet point, there is a script compile_targets.sh that
can compile targets independently (and in parallel, to not wait for ages) to
show that targets compile properly compile-targets.patch.

In almost all cases, the problem is that a specific module uses the logging
module, which depends on T, which needs to dynamically create headers. The way
to do this is to have a dependency, and many targets use generate_T or {T_LIB}
({} intentional: T might be absent, so then it evaluates to nothing). However,
not all do this, and those that depend on T actually don't depend on T, but on
the logging module, which in turn depends on T. So in many places, a simple
dependency onto log_headers fixes this problem, and generate_T or {T_LIB}
simplifies the dependency (but not always). The commits should have more info.

Note that at least the targets in FlexRIC do not all compile, at least in the
configuration that we use in docker/Dockerfile.build.ubuntu. So for the latter,
we cannot build with a simple ninja, but FlexRIC seems to be the only one that
does not compile. Since FlexRIC is a separate repository, that needs to be
addressed in the corresponding repository.

Increase prach_dtx_threshold to avoid fake PRACH detection.

Previously, the script attempted to directly merge ${merge}, which could f
ail if the branch was not already available locally. This update explicitly
fetches the branch from origin and then merges FETCH_HEAD with --ff, ensuring
the merge works even when the branch is missing locally.

Test duration: 1 hour
Test scenario: 3x DL 10 min test (20 Mbps) + 3x UL 10 min test (5 Mbps)

- Update opening statement to reflect both F1 (intra-gNB) and N2 (inter-gNB) handover support
- Fix grammar error: 'either by by decision' -> 'either a decision'
- Standardize naming: 'gNB PCI1' -> 'gNB-PCI1'
- Fix typo: 'neighbor call' -> 'neighbor cell'
- Remove --sa flag from N2 handover target gNB command for consistency
- Add network configuration notes for same-machine setups:
  * IP address assignment instructions to avoid network conflicts
  * Target gNB command options for proper network interface configuration

- Move 'What is a gNB neighbor?' explanation from rrc-usage.md to handover-tutorial.md where it belongs
- Replace generic parameter names with actual configuration parameter names and specific descriptions (e.g. gNB_ID, nr_cellid)
- Add example configuration structure showing proper syntax
- Add missing 'band' parameter that was not listed before
- Provide concrete examples and exact constraints for each parameter
- Cross-reference between documents for better organization

This addresses documentation issues where generic parameter descriptions were
not useful for developers configuring neighbor cells.

- Remove extensive traffic testing before HO (iperf tests 030001, 030002)
- Do 1 ping test after attachment
- Reduce ping packet count from 100 to 50 packets for remaining connectivity test

Time savings: ~2-3 minutes by removing traffic validation overhead

Split monolithic e1_send_bearer_updates into three focused functions:
- e1_send_bearer_updates(): DRB setup from F1 UE Context Modification Response
- e1_request_pdcp_status(): Request PDCP status during inter-CU handover
- e1_notify_pdcp_status(): Notify CU-UP with PDCP status during handover

Extract common helpers:
- append_e1_drb_mod_req(): Common DRB-to-mod for bearer request logic
- e1_send_bearer_modification_request(): Common sending step

Bug fixes:
- Fix loop bounds (i < n instead of i == n)
- Fix array access bounds checking
- Fix DRB ID consistency

Memory management:
- Add missing free_e1ap_context_mod_request calls
- Improve error handling with early returns

In the process:
- Simplify cuup_notify_reestablishment with FOR_EACH_SEQ_ARR loop
- Adopted all callers to use new consolidated functions

Improves maintainability and eliminates complex conditional logic.

Add early return if get_du_by_cell_id returns NULL to prevent
segmentation fault when accessing DU structure members.

Replace field-by-field assignment with struct copy for plmn_identity.
Both source and destination use identical plmn_id_t type, making
this change safe and more maintainable.

- Reduces lines of code
- More readable and less error-prone
- Single memory copy operation instead of multiple field assignments

- ngap_gNB_handover_notify: Fix misleading error message from 'Failed to encode'
  to 'Failed to find UE context' for better clarity
- ngap_gNB_handle_ul_ran_status_transfer: Standardize error message format
  from 'Could not find' to 'Failed to find' for consistency across functions

This ensures consistent and accurate error reporting across all NGAP handover functions.

- Update encoder functions in ngap_gNB_mobility_management.c to use calloc_or_fail
- Provides zero-initialized memory and consistent error handling
- Prevents uninitialized fields and improves memory safety

Also:

- Update NG Setup Request to use calloc_or_fail

Handoer encoder functions never return NULL - they either return
a valid pointer or terminate the program. Remove dead code paths.

- Replace inefficient 'allocate, extract, free' pattern with direct value extraction
- Remove unused functions get_gap_config_from_smtc() and get_gap_config()
- Add extract_gap_config_from_smtc() that extracts values directly without allocation
- Eliminates use-after-free risk and improves performance
- No allocation overhead, no memory leaks

- Add missing ASN_STRUCT_FREE for NR_MeasGapConfig in create_measgap_config
- Fix 48-byte measurement gap config leak in get_gap_config_from_smtc

AddressSanitizer backtrace:
Direct leak of 48 byte(s) in 1 object(s) allocated from:
    /#0 0x7d32adab4a57 in __interceptor_calloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:154
    /#1 0x5751f99cbb79 in calloc_or_fail /home/guido/repo/openairinterface5g/develop/common/utils/utils.h:74
    /#2 0x5751f99cbb79 in get_gap_config_from_smtc /home/guido/repo/openairinterface5g/develop/openair2/LAYER2/NR_MAC_gNB/nr_radio_config.c:4164
    /#3 0x5751f99cbb79 in create_measgap_config /home/guido/repo/openairinterface5g/develop/openair2/LAYER2/NR_MAC_gNB/nr_radio_config.c:4310
    /#4 0x5751f9964abe in ue_context_setup_request /home/guido/repo/openairinterface5g/develop/openair2/LAYER2/NR_MAC_gNB/mac_rrc_dl_handler.c:709
    /#5 0x5751f979e568 in nr_initiate_handover /home/guido/repo/openairinterface5g/develop/openair2/RRC/NR/rrc_gNB_mobility.c:218
    /#6 0x5751f97a637f in nr_rrc_trigger_n2_ho_target /home/guido/repo/openairinterface5g/develop/openair2/RRC/NR/rrc_gNB_mobility.c:526
    /#7 0x5751f9703608 in rrc_gNB_process_e1_bearer_context_setup_resp /home/guido/repo/openairinterface5g/develop/openair2/RRC/NR/rrc_gNB.c:2641
    /#8 0x5751f9706b7b in rrc_gnb_task /home/guido/repo/openairinterface5g/develop/openair2/RRC/NR/rrc_gNB.c:3020
    /#9 0x7d32ac494ac2 in start_thread nptl/pthread_create.c:442

Root cause: create_measgap_config allocated NR_MeasGapConfig via get_gap_config_from_smtc()
but never freed it after extracting the needed values to populate the measgap_config_t
return structure.

- Add missing handover context cleanup in rrc_CU_process_ue_context_release_complete
- Fix 16-byte handover context leak in N2 handover source gNB trigger path

AddressSanitizer backtrace:
Direct leak of 16 byte(s) in 1 object(s) allocated from:
    /#0 0x7fee67cb4a57 in __interceptor_calloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:154
    /#1 0x58059e33454b in calloc_or_fail /home/guido/repo/openairinterface5g/develop/common/utils/utils.h:74
    /#2 0x58059e33454b in alloc_ho_ctx /home/guido/repo/openairinterface5g/develop/openair2/RRC/NR/rrc_gNB_mobility.c:47
    /#3 0x58059e339e4d in nr_rrc_trigger_n2_ho /home/guido/repo/openairinterface5g/develop/openair2/RRC/NR/rrc_gNB_mobility.c:556
    /#4 0x58059e33ae93 in nr_HO_N2_trigger_telnet /home/guido/repo/openairinterface5g/develop/openair2/RRC/NR/rrc_gNB_mobility.c:611

Root cause: Handover context allocated in N2 handover source gNB trigger path (nr_rrc_trigger_n2_ho)
for any successful N2 handover but not properly freed in all handover completion scenarios.
The UE context release complete handler was missing cleanup for handover context.

Solution: refactor handover context cleanup

- Move nr_rrc_finalize_ho() call to rrc_delete_ue_data() for centralized cleanup
- Remove redundant nr_rrc_finalize_ho() calls from handover failure paths:
  * rrc_CU_process_ue_context_release_request() - UE not deleted yet
  * invalidate_du_connections() - UE will be deleted later
- Keep nr_rrc_finalize_ho() calls in handover success paths where UE continues operating
- Ensures handover context is cleaned up exactly once when UE is actually deleted
- Prevents potential double-free and use-after-free issues in handover cleanup

This centralizes all UE data cleanup in rrc_delete_ue_data() and ensures
handover context is properly managed throughout the UE lifecycle and cleaned up
when UE delete happens.

modulation LUTs size was wrong, and remove inconsistent test of SSE2 enable

NR UE: add UCI (HARQ-ACK/NACK) on PUSCH support at PHY

Add UCI (HARQ-ACK/NACK) on PUSCH support at nrUE PHY, the multiplexing procedure
can be found in TS 38.212 section 6.2.7.

Verified with 3rd-pary gNB for cases when HARQ payload bits length is 1, 2 or 3.

Closes #959 and #967 .

- Add missing ASN_STRUCT_FREE for NR_MeasurementTimingConfiguration in ue_context_setup_request
- Fix 64-byte MTC sequence leak in get_nr_mtc → SEQUENCE_decode_uper

AddressSanitizer backtrace:
Direct leak of 64 byte(s) in 1 object(s) allocated from:
    /#0 0x7dcfcb8b4a57 in __interceptor_calloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:154
    /#1 0x591fcc59b67d in SEQUENCE_decode_uper /home/guido/repo/openairinterface5g/develop/cmake_targets/ran_build/build/openair2/RRC/LTE/MESSAGES/constr_SEQUENCE_uper.c:37
    /#2 0x591fcc57eaa1 in uper_decode /home/guido/repo/openairinterface5g/develop/openair2/RRC/LTE/MESSAGES/uper_decoder.c:83
    /#3 0x591fcbdbedeb in get_nr_mtc /home/guido/repo/openairinterface5g/develop/openair2/LAYER2/NR_MAC_gNB/nr_radio_config.c:4216
    /#4 0x591fcbd58188 in ue_context_setup_request /home/guido/repo/openairinterface5g/develop/openair2/LAYER2/NR_MAC_gNB/mac_rrc_dl_handler.c:635
    /#5 0x591fcbb92568 in nr_initiate_handover /home/guido/repo/openairinterface5g/develop/openair2/RRC/NR/rrc_gNB_mobility.c:218
    /#6 0x591fcbb9a37f in nr_rrc_trigger_n2_ho_target /home/guido/repo/openairinterface5g/develop/openair2/RRC/NR/rrc_gNB_mobility.c:526
    /#7 0x591fcbaf7608 in rrc_gNB_process_e1_bearer_context_setup_resp /home/guido/repo/openairinterface5g/develop/openair2/RRC/NR/rrc_gNB.c:2640
    /#8 0x591fcbafab7b in rrc_gnb_task /home/guido/repo/openairinterface5g/develop/openair2/RRC/NR/rrc_gNB.c:3019
    /#9 0x7dcfca294ac2 in start_thread nptl/pthread_create.c:442

Root cause: ue_context_setup_request allocated NR_MeasurementTimingConfiguration via
get_nr_mtc() but never freed it after creating the measurement gap configuration.
The create_measgap_config function only reads from the structure and doesn't take
ownership, so the caller must free it.

- Replace heap allocation with stack allocation for seq_arr_t structures
- Use proper seq_arr_free() with free functions for ASN.1 structures
- Remove unnecessary malloc/free calls for sequence containers
- Improve memory safety and performance with automatic cleanup

Fixes 128-byte memory leak:

Direct leak of 128 byte(s) in 2 object(s) allocated from:
   /#0 0x7e7f39ab4a57 in __interceptor_calloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:154
   /#1 0x56df8b07312d in SEQUENCE_decode_uper /home/guido/repo/openairinterface5g/develop/cmake_targets/ran_build/build/openair2/RRC/LTE/MESSAGES/constr_SEQUENCE_uper.c:37
   /#2 0x56df8b056551 in uper_decode /home/guido/repo/openairinterface5g/develop/cmake_targets/ran_build/build/openair2/RRC/LTE/MESSAGES/uper_decoder.c:83
   /#3 0x56df8a896b1b in get_nr_mtc /home/guido/repo/openairinterface5g/develop/openair2/LAYER2/NR_MAC_gNB/nr_radio_config.c:4216
   /#4 0x56df8a82feb8 in ue_context_setup_request /home/guido/repo/openairinterface5g/develop/openair2/LAYER2/NR_MAC_gNB/mac_rrc_dl_handler.c:635
   /#5 0x56df8a66a298 in nr_initiate_handover /home/guido/repo/openairinterface5g/develop/openair2/RRC/NR/rrc_gNB_mobility.c:218
   /#6 0x56df8a6720af in nr_rrc_trigger_n2_ho_target /home/guido/repo/openairinterface5g/develop/openair2/RRC/NR/rrc_gNB_mobility.c:526
   /#7 0x56df8a5cf338 in rrc_gNB_process_e1_bearer_context_setup_resp /home/guido/repo/openairinterface5g/develop/openair2/RRC/NR/rrc_gNB.c:2633
   /#8 0x56df8a5d28ab in rrc_gnb_task /home/guido/repo/openairinterface5g/develop/openair2/RRC/NR/rrc_gNB.c:3012
   /#9 0x7e7f38494ac2 in start_thread nptl/pthread_create.c:442

- Add early check for existing UE context by AMF UE NGAP ID at beginning of rrc_gNB_process_Handover_Request
- Add dedicated function to get UE context by AMF UE NGAP ID: rrc_gNB_get_ue_context_by_amf_ue_ngap_id()
- Send handover failure with appropriate cause if UE context already exists
- Remove redundant ho_context NULL check that could never be true for newly created UE contexts
- Prevents duplicate handover processing and resource leaks

Use the instance parameter instead of hardcoded 0 to access the correct
RRC instance. Also clean up redundant variable initialization.