[PHP] Batch 2: PHPT platform and ABI fixes

[brandonpayton]

Purpose

This is the stacked Batch 2 integration PR for the PHP PHPT platform fixes split from #717. It is based on the still-open Batch 1 integration branch rather than main, so the batches remain independently reviewable while constituent PRs are landed linearly with rebase merges.

This PR is intentionally open and incomplete. Do not merge it into Batch 1 or main until every constituent has been reviewed, the divergent ABI-16 lineages have been reconciled as ABI 17, and the exact aggregate branch has passed the full gate.

Constituent review ledger

PR	Summary	Review changes	View
#740	Establishes a reproducible PHP 8.3.15 package and upstream-aware PHPT surface for Node and browser, including package recipes, VFS/page wiring, fixtures, structured reports, and bounded execution.	Replayed the five source commits onto Batch 1; appended deterministic fork instrumentation and leading-dylink.0 preservation, reproducible package/SDK/timer work, canonical packaged browser state, truthful PHPT verdict/evidence handling, a 2 GiB/131,072-inode PHPT VFS capacity repair, and a clean browser-readiness asset fix.	Accept into Batch 2 only. The PHP artifact intentionally imports env.__wasm_posix_vm_interrupt_after, supplied by #757; it is not independently runnable or publishable and must receive the aggregate ABI 16→17 reconciliation plus a PHP ABI floor of 17.
#754	Establishes coherent IPv4/IPv6/Unix socket addressing, local datagrams, multicast, structured socket options, dual-stack listeners, and shared hostname validation for PHP's ordinary socket surface.	Replayed six source commits while preserving #753's pathname-socket permissions; added exact binding-owner inheritance across fork/spawn, AF_UNIX lifecycle and stale-identity repairs, machine-scoped IPv6 stream state, mapped dual-stack peers, correct accept flags, bounded getsockopt copies, complete forked socket state, multicast/interface fixes, Node/browser hostname parity, focused tests, and truthful architecture/POSIX/browser docs.	Accept into Batch 2 only. Datagram delivery remains process-local; #859 and #860 now supply queue/backpressure plus limited-broadcast/MSG_TRUNC semantics, while host-backed UDP fork ownership, AF_UNIX shared backlog, and #855's deferred machine-wide routing redesign remain. Observable semantic changes require the final aggregate ABI 16→17 reconciliation; the structural ABI-16 check is not standalone clearance.
#755	Makes TCP close orderly across kernel loopback, Node real sockets, and LocalVirtualNetwork, separating FIN from abort/reset while preserving queued data and independent stream directions.	Replayed the two unique source commits; replaced the fabricated exact-one post-FIN write model with a persistent pipe-backed discard sink and OS-driven Node close; made shutdown refs idempotent; fixed direct-I/O wakeups, accepted-bridge backpressure, fork/listener lifetime, final-owner cleanup, and port reuse; rejected enabled SO_LINGER; added an additive real-reader export/snapshot; strengthened Node, virtual, fork, large-payload, zero-FIN, Sortix, and browser coverage; and documented the remaining reset limitation truthfully.	Accept into Batch 2 only. The FIN/reset, wakeup, and ownership repairs passed focused review and validation. The host now requires kernel_pipe_has_readers while the constituent still reports ABI 16, so it is deliberately not independently main-ready and must be included in the aggregate ABI 16→17 reconciliation. Full PHPT/host/browser gating still awaits #757 and the final aggregate.
#859	Preserves already-accepted UDP order under overflow and gives bounded AF_UNIX datagram queues reliable sender backpressure with coherent readiness and shutdown behavior.	Expanded the original tail-drop hunk into lazy capacity admission across IPv4/IPv6/multicast/host injection; reliable AF_UNIX EAGAIN; connected-peer purge/admission and EPERM; read-shutdown EPIPE/SIGPIPE; dequeue/connect/shutdown/close/unlink send-state wakes; one absolute finite readiness deadline with final kernel checks; and Rust, host, pthread guest, Node, and Chromium coverage.	Accept into Batch 2 only. The repaired behavior is sound and the cross-process routing gap remains explicit. Its new kernel-host wake bit is semantic ABI state not captured by the snapshot, so #859 remains quarantined for the aggregate ABI 16->17 reconciliation.
#860	Enforces SO_BROADCAST for IPv4 limited broadcast and Linux-compatible input MSG_TRUNC length reporting across IPv4, IPv6, and Unix datagrams.	Replaced the stale one-commit patch with a three-commit stack on the aggregate tip; moved permission checking into the central send path with coherent error ordering; dropped fabricated requested-value buffer readback; preserved #859's queue/backpressure contract; hardened zero-length recv/recvfrom/recvmsg marshalling; and added Rust, guest-ABI, Node, Chromium, and contract-documentation coverage.	Accept into Batch 2 only. The repaired behavior is sound, with broadcast delivery and recvmsg() output msg_flags still explicit gaps. Its changed send errno and receive return-length semantics are semantic ABI changes and remain quarantined for the aggregate ABI 16→17 reconciliation.

#740's review includes two byte-identical five-artifact PHP builds, full kernel and host evidence, exact artifact hashes, a complete 19,017-test VFS image audit, and a clean headed-Chromium readiness check. Full PHPT results in its description are explicitly labeled historical and were not rerun on the repaired constituent.

#754's final repaired source passed 1,005 kernel tests, 114 host test files/919 passing tests, wasm32+wasm64 checks, host typecheck, build.sh, and the structural ABI-16 check. A real Chromium run passed the three-machine UDP/TCP/curl network lab. The canonical ./run.sh browser package preparation resolved 64/66 targets but stopped at WordPress preinstall on #740's known missing #757 import; that is recorded as a failed aggregate startup attempt, not a passing result.

#755's final repaired source passed 1,010 kernel tests; 32 focused host networking tests with 2 skipped; host typecheck; build.sh; and 3/3 focused Sortix close/shutdown cases in both the native runner and real Chromium. Its structural ABI check reports only the additive reader export, which does not clear the semantic or prebuilt-kernel compatibility boundary. Exact full-host and canonical-browser attempts reached the generated PHP artifact and failed on #740's known missing #757 interrupt import; the final network-lab rerun was separately blocked by the currently generated GNU netcat artifact, which fails its own Node tests. None of those blocked/failed aggregate attempts is claimed as a pass.
#859's final repaired source passed 1,015 kernel tests; 3 focused host wake/deadline tests; host build/type declarations; warning-clean wasm32 guest syntax; and the two exact overflow/backpressure Sortix tests in both Node and real Chromium. Full host Vitest reached 115 passing files / 5 failing files and 903 passing / 23 failing tests; every failure was the known missing #757 PHP interrupt import or absent wasm64 hello artifact, not a datagram regression. The ABI check remained synchronized and reported only #755's existing additive export. ./run.sh browser is still blocked by the current #740/#757 aggregate startup dependency, so only the exact real-Chromium guest result is claimed.
#860's repaired source passed 1,021 kernel tests; the focused #859 host wake/deadline regressions (2 files / 3 tests); host build and declaration generation; warning-clean wasm32 guest syntax; and its exact datagram-flags guest test in both Node and real Chromium. The guest path covers bounded-copy sentinels, zero-length recvfrom/recvmsg, all three datagram families, MSG_PEEK, fixed buffer readback, and AF_UNIX full-queue readiness. The ABI check stayed synchronized and still reports only #755's existing additive export structurally; #860's syscall-semantic changes are reserved for ABI 17. The full host/libc/browser-demo gate remains aggregate-only, and the known #740/#757 startup dependency still blocks ./run.sh browser.

#855 is now explicitly deferred without replaying its current commits. #754/#859 leave a genuine machine-wide datagram gap, but #855's IPv4-only post-send helper can duplicate reuse-address delivery and attach ECONNREFUSED after a successful delivery. A future replacement must route once through ProcessTable-owned Inet/Inet6/multicast/Unix state and test the public syscall wrapper.

Planned remaining constituents

• Networking remainder: Deliver loopback UDP datagrams across processes on the same machine #855 is deferred pending a ProcessTable-owned machine-wide datagram routing redesign; do not replay its current commits.
• Ancestry-bearing sequence: range-diff the landed [PHP] fix: preserve socket identity and routing semantics #754 result against [PHP] fix: split fork/process/shared-memory runtime fixes #756's altered socket base, then repair/replay [PHP] fix: split fork/process/shared-memory runtime fixes #756 → [PHP] fix: split host browser and SharedFS runtime fixes #757 → [PHP] fix: split ABI syscall and residual runtime fixes #758 without duplicating prerequisites.
• Independent/special constituents: [PHP] fix: canonicalize cwd after chdir #741, [PHP] fix: preserve fork environment and trim stale xfails #742, [PHP] fix: marshal lchown path through syscall channel #743, [PHP] fix: preserve unix listener state across exec #745, [PHP] fix: provide default openssl config file #746, [PHP] fix: restore boxed process construction helpers #747, [PHP] fix: apply POSIX file size limit writes #748, [PHP] perf: avoid per-mmap gap sort allocation #751, [PHP] fix: align pathconf constants with libc #752, and [PHP] fix: implement stopped-child wait4 semantics #759.
• [PHP] fix: provide default openssl config file #746 must be retitled/squashed or otherwise repaired so its history truthfully describes both changes and static SSL policy is owned by the rootfs/VFS contract.
• Commit-message overclaims in [PHP] fix: split fork/process/shared-memory runtime fixes #756, [PHP] fix: split host browser and SharedFS runtime fixes #757, and [PHP] fix: preserve fork environment and trim stale xfails #742 must be corrected before their constituent merges.

The ledger above will be extended with the summary, review changes, and recommendation for each constituent as it is reviewed and landed.

Required aggregate reconciliation

Both current main/Batch 1 and the historical PHP stack independently moved ABI 15→16 with divergent kernel exports. Batch 2 must perform one explicit ABI 16→17 reconciliation that:

• selects a coherent stdio-pipe/process-creation design rather than combining incompatible mechanisms;
• retains the Times syscall and the PHP stack's required platform exports, including [PHP] fix: preserve orderly TCP close across bridges #755's kernel_pipe_has_readers host dependency, and assigns [PHP] fix: preserve queued datagrams under receive overflow #859's kernel-host datagram wake contract plus [PHP] fix: enforce limited-broadcast and datagram truncation semantics #860's send/receive semantic changes to ABI 17;
• updates ABI_VERSION, abi/snapshot.json, the C header, and generated TypeScript bindings in the same change;
• rebuilds all affected programs/images and raises PHP's declared kernel_abi floor to 17.

The /etc/ssl rootfs/VFS ownership decision and browser PHPT image contract must also be resolved before the aggregate is considered complete.

Verification status

• Constituent-ready CI is intentionally skipped under the agreed batching plan.
• [PHP] Establish a reproducible PHPT conformance surface #740, [PHP] fix: preserve socket identity and routing semantics #754, [PHP] fix: preserve orderly TCP close across bridges #755, [PHP] fix: preserve queued datagrams under receive overflow #859, and [PHP] fix: enforce limited-broadcast and datagram truncation semantics #860 were validated on their repaired source trees before their rebase merges; see their PR descriptions for exact commands, counts, hashes, browser evidence, and explicit non-runs.
• The full aggregate gate has not been run and is not claimed.
• Before this PR advances, run on its exact final head through scripts/dev-shell.sh:
  • cargo test -p kandelo --target aarch64-apple-darwin --lib
  • cd host && npx vitest run
  • scripts/run-libc-tests.sh
  • bash scripts/check-abi-version.sh
  • ./run.sh browser plus real browser verification for the PHPT/browser surface

Landing mechanics

• Constituent PRs are rebase-merged into this branch, preserving their commits linearly.
• This PR is stacked on integration/kd-6nz-php-phpt-batch-1-kernel-fixes.
• No aggregate branch is to be merged to main without Brandon's explicit approval.
• Current final batch-to-main assumption is rebase merge for granular/revertible history; confirm before the aggregate landing.

[github-actions]

Phase B-1 matrix build status — pr-871-staging

ABI v16. 66 built, 0 failed, 66 total.

Package	Arch	Status	Sha
libcurl	wasm32	built	873f0298
libcxx	wasm32	built	5009ca76
libcxx	wasm64	built	b81726d2
libiconv	wasm32	built	912738bc
libpng	wasm32	built	c06623bd
libxml2	wasm32	built	72e9b8e6
openssl	wasm32	built	d180bd20
openssl	wasm64	built	d2bce644
sqlite	wasm32	built	7f6b5db4
sqlite	wasm64	built	31cfdd1e
zlib	wasm32	built	31462832
zlib	wasm64	built	ef001a95
bc	wasm32	built	a04c9d63
bzip2	wasm32	built	9a8e0ba0
coreutils	wasm32	built	1324bdbd
curl	wasm32	built	dbcad540
dash	wasm32	built	e236a704
diffutils	wasm32	built	49ec62af
dinit	wasm32	built	d3b3bb21
fbdoom	wasm32	built	da0d0acd
file	wasm32	built	72e9075f
findutils	wasm32	built	754bbe43
gawk	wasm32	built	b93bbd73
git	wasm32	built	68281ae8
grep	wasm32	built	ef5f740c
gzip	wasm32	built	b5be4abd
hello	wasm32	built	26179d3b
kandelo-sdk	wasm32	built	c59ff562
kernel	wasm32	built	76091ee0
less	wasm32	built	6b0267f0
lsof	wasm32	built	0a6b10ab
m4	wasm32	built	d51871a1
make	wasm32	built	f9479cbb
mariadb	wasm32	built	e7b1d66a
mariadb	wasm64	built	3e32ca3c
modeset	wasm32	built	d7914254
msmtpd	wasm32	built	8a4c1bd1
nano	wasm32	built	9c631e65
ncurses	wasm32	built	835bc116
netcat	wasm32	built	72d0bb72
nginx	wasm32	built	c021a0cf
php	wasm32	built	c0cbce54
posix-utils-lite	wasm32	built	ad1c3a04
sed	wasm32	built	b3ef7bbc
spidermonkey	wasm32	built	f6095bbd
tar	wasm32	built	fda46d6e
tcl	wasm32	built	a2f0fb11
unzip	wasm32	built	56b0c5b0
userspace	wasm32	built	8f5ae0d3
vim	wasm32	built	a82fcb97
wget	wasm32	built	a644c121
xz	wasm32	built	4f2ac1f3
zip	wasm32	built	a5b4a020
zstd	wasm32	built	300b21ee
bash	wasm32	built	7e29afe9
mariadb-test	wasm32	built	f15fb28b
mariadb-vfs	wasm32	built	5482ab12
mariadb-vfs	wasm64	built	55ec8746
nethack	wasm32	built	08844797
node	wasm32	built	ed4a6deb
spidermonkey-node	wasm32	built	2d4722d5
vim-browser-bundle	wasm32	built	64129df8
nethack-browser-bundle	wasm32	built	879d6625
rootfs	wasm32	built	726bc8e6
shell	wasm32	built	b38678e4
node-vfs	wasm32	built	3f692e41

_{Auto-generated; replaced on each push. Raw data in the publish-status workflow artifact.}