[PHP] Batch 1: independent PHPT kernel fixes

[brandonpayton]

Batch 1 — independent PHP-PHPT kernel fixes

Aggregation PR for independent kernel fixes split from the PHP PHPT port (old PR #717 / convoy kd-6nz). Constituent PRs are reviewed against the live batch tip and rebase-merged here so their commits remain distinct and revertable. This batch PR is the only vehicle to main; it stays open until Brandon approves the batch merge.

Per-constituent ready-to-merge CI is intentionally skipped. Focused review checks may run while each PR is incorporated; the full ready-to-merge gate runs on this exact aggregate tree before the batch merges to main.

Constituent review ledger

#749 — raise SIGPIPE for bridged TCP EPIPE — incorporated

• Summary: Makes external bridged TCP write()/send() raise SIGPIPE on EPIPE, while preserving MSG_NOSIGNAL suppression and existing loopback behavior.
• Review changes: Added default-flags external-TCP coverage and documented send()/recv() behavior in docs/posix-status.md; closed Honor MSG_NOSIGNAL on AF_INET loopback stream send #858 as a superseded strict subset.
• View: Accept. This fixes shared kernel signal semantics at the platform layer, and the added test covers the previously untested default-flags path.
• Batch commits: a4126dfdb, f64447410.

#750 — reject unsupported mremap flags — incorporated

• Summary: Rejects every mremap flag except MREMAP_MAYMOVE with EINVAL, including MREMAP_FIXED and MREMAP_DONTUNMAP, rather than silently performing a different remap.
• Review changes: None; the source and commit message were already accurate. Re-verified a clean cherry-pick onto the live batch tip.
• View: Accept. Kandelo's current four-argument path cannot honor MREMAP_FIXED, and it does not implement MREMAP_DONTUNMAP aliasing. Truthful failure is the correct contract. The test also proves rejection leaves the original mapping intact.
• Focused evidence: Dev-shell cargo test -p kandelo --target aarch64-apple-darwin --lib mremap -- --nocapture — 4 passed, 0 failed.
• Batch commit: 01ec01912.

#752 — align pathconf constants with libc — reviewed, deferred to batch 2

• Summary: Renumbers the Rust kernel's pathconf selector table and adds more _PC_* answers.
• Review changes: None applied; the PR remains open and was not retargeted or merged.
• View: Do not merge as written. Normal programs and PHP use musl's local table, so this Rust-only patch is not on the claimed platform path. Raw SYS_PATHCONF also lacks pathname marshalling, and several fixed answers are false across Node, MemoryFS, and OPFS. The real repair crosses libc, host ABI metadata, mount capabilities, errno semantics, documentation, and end-to-end tests, so it belongs with batch 2's ABI reconciliation.

#753 — preserve Unix-socket path ownership in stat — incorporated

• Summary: Uses the backing VFS inode as the source of uid, gid, permissions, timestamps, link count, inode, device, and size for registered AF_UNIX pathname sockets, overlaying only S_IFSOCK.
• Review changes: Appended a second commit without rewriting the original. Bind now creates the VFS node with Linux-observable mode 0777 & ~umask; removed an unexplained zero-link-count rewrite; expanded initial-mode and chmod/chown coverage across stat, lstat, and fstatat; documented registry limitations.
• View: Accept after repair. The original direction was sound but its hard-coded 0600 placeholder would have regressed the default visible mode from 0755 to 0600.
• Focused evidence: The dev-shell AF_UNIX kernel subset ran on both the repaired PR branch and a replay onto the live batch tip — 9 passed, 0 failed each time.
• Batch commits: d9950c7a0, 91d13955f.

#741 — canonicalize cwd after chdir — reviewed, deferred to batch 2

• Summary: Changes global pathname cleaning and tries to store a canonical cwd after chdir.
• Review changes: None applied; the PR remains open and was not retargeted or merged.
• View: Do not merge as written. Lexical .. collapse after symlink validation can store the wrong cwd, while unresolved components break mount routing, virtual /dev//proc matching, AF_UNIX keys, and Node/browser parity. A component-aware namespace resolver is cross-cutting VFS design work for batch 2.

#751 — avoid per-mmap gap-sort allocation — reviewed, deferred to batch 2

• Summary: Replaces a temporary combined-vector allocation and sort with a two-stream scan over already sorted mapping and host-reservation lists.
• Review changes: None applied; the PR remains open and was not retargeted or merged.
• View: Do not merge as written. The split accidentally carries a [PHP] fix: preserve process-shared state across fork and exec #756 munmap length-rounding test without [PHP] fix: preserve process-shared state across fork and exec #756's implementation, producing a real 960-pass/1-fail cargo result and leaving a mapped tail. Its permanent perf framing and PHP-coverage text also make unmeasured claims; the required application benchmark prerequisites are absent locally. Rejoin it with [PHP] fix: preserve process-shared state across fork and exec #756 in batch 2, strengthen equivalence coverage, and satisfy the performance contract or explicitly rewrite/reframe the history before landing.

#743 — marshal lchown path through syscall channel — reviewed, deferred to batch 2

• Summary: Adds the correct inbound-cstring descriptor for syscall 299, but dispatch still routes lchown to symlink-following chown behavior.
• Review changes: None applied; the PR remains open and was not retargeted or merged.
• View: Do not merge as written. It changes a symlink target instead of the link, fails on dangling links, and leaves fchownat(AT_SYMLINK_NOFOLLOW) wrong. Its unrelated cstring validator runs after host pointer rewriting, accepts NULL, duplicates descriptor metadata, can accept stale scratch bytes, and has no tests. The truthful fix needs a distinct no-follow kernel/host/VFS operation, Node/browser parity, integration with [PHP] fix: preserve process environments and chown sentinel semantics #742's ownership-sentinel repair, runtime symlink tests, docs, and batch 2's ABI 17 regeneration.

#744 — expose truthful procfs scheduling and process visibility — incorporated

• Summary: Corrects Linux-style /proc/<pid>/stat priority/nice fields, makes PID-scoped procfs metadata reflect authoritative process-table visibility, and extends posix-utils-lite ps with strict -p/-o support.
• Review changes: Appended a repair commit without rewriting the original. Removed nonexistent WasmStat::default() calls; wired validation across metadata/access/chdir/readlink paths; separated global /proc/net from PID 0; hid reaped Limbo entries while retaining zombies; made ps fail truthfully for invalid/missing selections; advanced the package revision to 3; activated the worktree-local SDK; added tests and documentation.
• View: Accept after repair. The original proc-stat direction was correct, but it did not compile and its liveness helper was not connected to the syscall surface. The repaired version derives visible state from the process table and exercises the normal package/runtime path.
• Focused evidence: Replayed cleanly on the then-current batch tip. Kernel library 970 passed; musl rebuild, resolver source build, kernel Wasm build, Node runtime self/missing-PID checks, and ABI consistency check passed. A separate cross-process runtime check observed nice 5.
• Batch commits: 1449aa8b9, 5e011b6f4.

#748 — enforce RLIMIT_FSIZE across write paths — reviewed, deferred to batch 2

• Summary: Attempts to apply file-size limits and SIGXFSZ behavior across scalar, vectored, positioned, sendfile, and copy-file write paths.
• Review changes: None applied; the PR remains open and was not retargeted or merged.
• View: Do not merge as written. It fails to compile with an E0502 borrow conflict. More importantly, its remaining-limit cast wraps for limits above 4 GiB on wasm32, and it enforces the limit per internal chunk rather than at the operation boundary, which can spuriously signal or report failure after partial writev/pwritev/sendfile/copy progress. Memfd writes bypass the check, tests do not cover these semantics, and changing existing write return/errno/signal behavior is ABI-semantic work. Repair it with the batch 2 ABI 17 reconciliation.

Batch verification gate — exact aggregate tip 5e011b6f4

All commands ran through the repository dev shell in a fresh detached worktree at the exact open-PR head.

• cargo test -p kandelo --target aarch64-apple-darwin --lib — 970 passed, 0 failed.
• cd host && npx vitest run — 99 files passed; 781 tests passed, 2 expected failures, 111 skipped.
• scripts/run-libc-tests.sh — exit 0; 302 passed, 0 failed, 20 expected failures, 1 flake-pass, and 1 timeout (regression/raise-race).
• scripts/run-posix-tests.sh — 174 passed, 0 failed, 3 expected failures, 2 unsupported skips.
• scripts/run-sortix-tests.sh --all — 5,035 passed, 0 failed, 19 expected failures, 52 skipped, 0 timeouts.
• bash scripts/check-abi-version.sh — snapshot, C header, TypeScript bindings, and ABI_VERSION consistency are current.

Fresh-worktree preparation used the committed lockfiles, rebuilt the wasm32 and wasm64 sysroots, and ran bash build.sh plus scripts/build-programs.sh so Vitest consumed exact-tree kernel and fixture artifacts. Earlier Vitest invocations exposed missing dependencies/sysroots/binaries and are not counted as passing evidence; the fully prepared rerun above is the gate result.

This batch changes the shared kernel and package/runtime behavior but no browser adapter, UI, service worker, or browser-demo files. Manual ./run.sh browser verification was therefore not run; browser-facing work remains in batch 2.

2026-07-12 live-main rebase

• Rebased the seven constituent commits onto live main 2c083e143 (ABI 18) and force-updated this still-open aggregate with an exact lease. The current tip is 372387b15.
• git range-diff reports all seven patches unchanged; the rebase resolved no source conflicts and introduced no fixup commit.
• The exact-tip gate above belongs to the former pre-rebase tip 5e011b6f4. The stacked Batch 2 runtime tree has since passed the broader kernel/host/libc/ABI gate after incorporating this rebased branch, but that does not replace a final exact-head Batch 1 gate before any merge to main.
• This PR remains open. Nothing here is authorized to merge to main without Brandon's explicit approval.

Deferred batches

• Batch 2: [PHP] Establish a reproducible PHPT conformance surface #740 → [PHP] fix: preserve socket identity and routing semantics #754 → [PHP] fix: preserve process-shared state across fork and exec #756 → [PHP] fix: keep host/browser runtime and SharedFS state coherent #757 → [PHP] fix: preserve syscall widths, seek state, and select signals #758 plus [PHP] vfs: resolve pathname components across mounts #741, [PHP] fix: preserve process environments and chown sentinel semantics #742, [PHP] vfs: change symlink ownership without following final link #743, [PHP] test: verify AF_UNIX listener queues across fork and exec #745, [PHP] fix: provide OpenSSL defaults from rootfs images #746, [PHP] fix: restore boxed process construction helpers #747, [PHP] fix: enforce RLIMIT_FSIZE at file-write operation boundaries #748, [PHP] refactor: preserve first-fit mmap gap selection #751, [PHP] vfs: report truthful per-object path configuration #752, [PHP] fix: preserve orderly TCP close across bridges #755, and [PHP] fix: preserve stopped-child wait and pthread exit lifecycle #759; includes the ABI 16→17 reconciliation, pathname/VFS design, and browser verification.
• Batch 3: extension PRs [PHP] Ship the libzip-backed ZIP extension #647, [PHP] Ship the libcurl-backed curl extension #648, and PHP: ship intl as an optional ICU-backed side module #839.

[github-actions]

Phase B-1 matrix build status — pr-866-staging

ABI v18. 6 built, 0 failed, 6 total.

Package	Arch	Status	Sha
posix-utils-lite	wasm32	built	daf49994
rootfs	wasm32	built	6212200b
shell	wasm32	built	8550f1b4
lamp	wasm32	built	ea962e1a
node-vfs	wasm32	built	fd3c6127
wordpress	wasm32	built	50c49b65

_{Auto-generated; replaced on each push. Raw data in the publish-status workflow artifact.}