Contract: preserve accepted queues and expose reliable backpressure

IPv4/IPv6 UDP overflow is lossy, but it must drop the incoming datagram rather than evicting and reordering data already accepted by the receive queue. AF_UNIX datagrams are reliable: a full receive queue must backpressure the sender, and capacity or endpoint-state changes must wake blocked sends and readiness waits.

What changed

• Tail-drop incoming IPv4, IPv6, multicast, and host-injected UDP datagrams at the fixed 128-message queue boundary while preserving accepted order.
• Construct datagram payloads only after capacity admission, so dropped UDP data and blocked AF_UNIX sends do not allocate throwaway buffers.
• Return EAGAIN for a full AF_UNIX datagram queue and route blocking sends through the host retry path; O_NONBLOCK and MSG_DONTWAIT remain immediate.
• Keep AF_UNIX connected-peer admission coherent: connecting a receiver purges non-peer messages, rejected senders receive EPERM, and POLLOUT is suppressed only when the next send would actually block.
• Treat peer read shutdown as EPIPE plus SIGPIPE unless MSG_NOSIGNAL is used; connect, dequeue, shutdown, last-close, and pathname unlink emit a broad datagram send-state wake.
• Reuse one absolute deadline across finite poll/ppoll/select/pselect/epoll retries and perform a final zero-time kernel readiness check. This also restores temporary ppoll/pselect signal masks on timeout.
• Document the fixed SO_RCVBUF boundary and AF_UNIX reliability semantics.
• Add Rust, host-unit, and guest-ABI coverage, including real pthread-blocked send and POLLOUT wakeups.

Review changes beyond the original PR

The original one-commit change only replaced oldest-entry eviction with an incoming drop. Rebase review found that the same queue was shared by reliable AF_UNIX datagrams and that the host retry loop restarted finite readiness timeouts. The added commits separate lossy UDP tail-drop from reliable AF_UNIX backpressure, repair connected-peer and shutdown/close state transitions, make the host wake/deadline path bounded, and exercise the behavior through the guest ABI on Node and Chromium.

Review view

Recommended for Batch 2. The repaired behavior matches the platform's POSIX-first queue model and keeps the remaining machine-wide AF_UNIX datagram routing gap explicit rather than pretending cross-process delivery works.

ABI

The structural ABI snapshot has no #859-specific delta, but the new kernel-to-host datagram wake bit is semantic ABI state not represented in the snapshot. This PR must remain in Batch 2's quarantined ABI work and be covered by the planned aggregate ABI 16 -> 17 reconciliation before the batch can merge to main. The current snapshot check also sees the already-quarantined additive kernel_pipe_has_readers export from #755.

Validation

• cargo test -p kandelo --target aarch64-apple-darwin --lib: 1,015 passed, 0 failed.
• Focused host Vitest (datagram-wakeup, readiness-deadline): 2 files, 3 tests passed.
• cd host && npm run build: passed (existing CJS import.meta warnings only).
• Full host Vitest: 115 files passed / 5 failed; 903 tests passed / 23 failed / 2 expected-fail / 56 skipped. All failures are the known Batch-2 scratch-artifact issues: stale PHP imports (__wasm_posix_vm_interrupt_after) and the absent wasm64 hello artifact, not these datagram tests.
• Warning-clean wasm32 syntax check for both new guest tests with -Wall -Wextra -Werror: passed.
• Node Sortix exact tests: queue-overflow-tail-drop and unix-dgram-queue-backpressure, 2/2 passed.
• Real Chromium exact tests: both passed (queue-overflow-tail-drop 281 ms; unix-dgram-queue-backpressure 1,543 ms).
• scripts/check-abi-version.sh: snapshot/header/TypeScript bindings in sync; only the existing additive [PHP] fix: preserve orderly TCP close across bridges #755 export is reported.
• ./run.sh browser was not used because the current Batch-2 aggregate has the known [PHP] Establish a reproducible PHPT conformance surface #740/[PHP] fix: keep host/browser runtime and SharedFS state coherent #757 browser-startup blocker; the exact guest binaries were nevertheless run in real Chromium.
• The full libc gate remains intentionally deferred to the aggregate Batch-2 ready-to-merge run, per the locked batch procedure.

Known pre-existing host limitations not claimed as fixed here: retry-map keys can collide across processes, select(0, ...) does not yet model signal interruption, and epoll_pwait does not yet implement its temporary signal-mask contract.