Land the focused platform follow-ups after #907 by brandonpayton · Pull Request #934 · Automattic/kandelo

brandonpayton · 2026-07-13T20:08:23Z

What this batch does

#907 already landed PHP 8.3.15, ABI 39, and the shared process, VFS,
networking, host-runtime, package, browser-image, Dinit, and Vitest fixes found
during that port. This batch does not replay those changes.

This PR brings the remaining reviewed follow-ups onto one current-main branch
so we can validate and land them together while keeping one commit per purpose.
The focused source PRs remain the review record; their exact heads are listed
below. They were closed only after this batch contained their work and the
combined CI run was green.

Unique work that remains

Browser regressions and wiring: stale clearImmediate handles, nonzero-exit
stderr, and configured CORS proxy routing.
VFS and process contracts: positioned SharedFS I/O, canonical rootfs overlay
assembly, zero-byte copy-back, initial credentials, mremap metadata,
ENOLCK, and directory fsync.
libc and ABI-adjacent tests: zero unreported stat fields, align wasm32
pthread entry stacks, deterministic fork instrumentation, and SjLj/noexcept
coverage.
Package/build cleanup: shared MariaDB writable-directory setup.
SQLite contract work: supported recursion limits, truthful all-mode outcome
evidence, UTF-16 STAT4 accounting, and TestRecover command lifetime.

Exact source heads

PR	Exact reviewed head	What this batch keeps
#782	`3f133f92bd971cc83fecefcd64709ed7b9f13ade`	`clearImmediate` cancellation cleanup
#784	`fc25245984f346a5620998f02f93ad9b85dae80b`	wasm32 pthread stack alignment and direct regression
#786	`905dbc0091a40ad9dce04f6ebc3e36e113b40129`	positioned SharedFS reads/writes
#875	`545048b123d9efabc1474d257329e4e6d154a0f6`	Chromium nonzero-exit stderr regression
#880	`79dd37dbffa2d373988585f954eb45fb162f7c4c`	CORS proxy runner wiring, assertion, docs, and integration test
#888	`ce70dc0061ce379d2d50872b48ee0b82908eb8bc`	fresh-process fork output determinism
#896	`224aeeb056829c190680e78bc1ac9a4d68398b54`	LAMP use of the shared MariaDB helper and dead helper removal
#923	`6ad38869d71274e773530a9d0860680292235dd1`	shared rootfs overlay helper and strict preservation tests
#924	`432857531a6969e9ae7d397c2c59406bfb21214d`	zero-byte syscall output-buffer preservation
#925	`8943e3155d495f9908f8c9ecc2d0e1e06f438805`	SjLj/noexcept controls, SIGCHLD fixture, and SDK boundary docs
#926	`471dc2335abe77c2c696f7bfc1d0cce529710ad7`	requested initial user/group credentials
#927	`2a8bfbcd6ae7f7ebb5799a8e2db3c05bb491cf02`	metadata-consistent `mremap` growth
#929	`38af72dcaa3c1550f572a63eaa2b7c79c5016218`	shared lock-table exhaustion as `ENOLCK`
#930	`c9f9a1a649c5551f02a24ab5487becccabb6068b`	directory `fsync` across kernel, host, and browser
#931	`c6f4977f3ea2c6bd909e4daaf3f6fbb01c7ca716`	zero initialization for unreported `stat` fields
#780	`4b04ff3de6b022549250358f6fe44f02b4475f20`	supported SQLite expression/JSON/compound limits
#781	`9e3fd3f6d8ae1693076906f6e462ad6e1f8113a3`	supported SQLite trigger recursion limit
#783	`f758ecb30b92b9c914e950094706f05169bb205e`	truthful SQLite all-mode runner and durable evidence
#932	`52ba9a72036d2bfc631157c737f91ed61093713d`	UTF-16 STAT4 allocation range regression
#933	`a0bc004f569898244f03989558086663d2ba1d78`	TestRecover Tcl command/handle lifetime

The batch was assembled from those reviewed commits in a straight line, then
condensed from 30 commits to 20 purpose commits. The #780 and #781 changes are
one SQLite recursion/stack-limit policy commit, and the two #926 commits are
one credentials commit. #783 remains represented by one all-mode runner commit
and one truthful-outcome-evidence commit. The final tree is byte-identical to
the reviewed 30-commit batch head. #931's code and test files are byte-identical
to its source head; only its docs/posix-status.md commit diff changes because
#929 and #930 update the same document earlier in the batch. #891 was
deliberately dropped after it was consolidated into #936; this PR no longer
duplicates that Homebrew workflow rename.

What was deliberately removed

mmap/munmap work, CORS runtime plumbing, open-unlinked inode lifetime,
fork-instrument implementation, MariaDB helper implementation, serialized
image coverage, Dinit production fixes, and other work already on main
through Batch PHP support and bundle ABI updates with their runtime changes #907;
stale Make teardown reclamation CI wait for a blocked worker #889 ancestry and the old composite Fix mmap accounting under partial munmap churn #769 ancestry;
the rejected fork: size continuation save buffers from live frames #862 ABI-17 cursor/frame-counter design;
SQLite no_mutex workarounds, fabricated outcome/database evidence, fake
host metadata, synthetic stat block counts, capacity bumps, and broad
pager-fault test omissions;
package revision bumps where declared output bytes do not change.

ABI and package-artifact impact

ABI stays at 39. The ABI snapshot and generated C/TypeScript bindings remain in
sync. The wasm32/wasm64 libc artifacts change for stat; wasm32 libc also
changes for pthread stack alignment. SQLite revisions 3 and 4 intentionally
cover the published recursion-limit byte changes. #896, #932, and #933 add no
extra revision because their declared package outputs do not change.

Combined staging must rebuild the affected toolchain and package closure. This
PR makes no performance claim; performance was not measured.

Validation

Exact current head: 822f35ea34cb07e84dac2d24da0505babd16ed7e

staging run 29293767304
ran on pre-compaction head 260d75d5adc31b327f5591229dbfbb287d395fd6
and passed with 84 successful jobs, two expected skips, and zero failures. This
includes 14/14 library rebuilds, 57/57 package/image rebuilds, staged binary
materialization, browser assets, cargo/kernel, fork instrumentation, full
Vitest, browser, libc, POSIX, Sortix, and the aggregate test gate;
browser smoke run 29293767232
ran on that same pre-compaction head and passed the host check and Chromium,
Firefox, and WebKit COI smoke coverage;
scripts/check-abi-version.sh passed through scripts/dev-shell.sh;
host declaration/type generation passed;
focused current-main Vitest passed 86/86 SharedFS positioned-I/O, VFS-image,
lazy-archive, and rootfs-overlay tests;
the current 20-commit tree is still exactly
b3a9a9da574ec7b276e7f61e11f004e578377afa, byte-identical to both the
green pre-compaction head and the prior reviewed 30-commit tree; only homebrew: name the generic bottle publisher accurately #891
is absent from the earlier batch, because homebrew: publish and verify installable Kandelo bottles #936 now owns it;
fresh exact-head staging and browser smoke checks are running after this
history-only compaction;
each focused source PR records its own contract-specific Node, Chromium,
fork, libc/POSIX/Sortix, MariaDB, and SQLite validation.

The earlier 31-commit pre-rebuild head
c0ef6ae3368480da8990064593c9c35920fbacb7, which contained the same focused
work plus #891's workflow rename now owned by #936, also passed:

browser smoke run 29281207312
passed the host check and Chromium, Firefox, and WebKit COI smoke coverage;
staging run 29281207249, attempt 2
passed 14/14 library rebuilds, 57/57 program/image rebuilds, staged binary
materialization, the browser asset check, cargo/kernel, fork instrumentation,
full Vitest, browser, libc, POSIX, Sortix, and the aggregate test gate;
Bash's first source-build attempt hit an upstream GNU mirror HTTP 502. The
declared URL recovered, and the isolated retry passed without a code change.
wasm32/wasm64 musl builds, 1,154/1,154 cargo/kernel tests, and 187/187
fork-instrument tests also passed locally through scripts/dev-shell.sh.

The current head is built directly on main at
9a7a679195ead9bbdef119830437d5a758566607. Its tree is unchanged by the final
history-only rewrite; the new hosted checks will provide exact-head status.

Validation not run

A manual ./run.sh browser pass and the full SQLite upstream matrix were not
rerun locally. Performance was not measured, and this PR makes no performance
claim.

Merge and cleanup

Keep the 20 commits in order; do not squash across the remaining purpose
boundaries. An independent per-commit audit found no other valid full squash. The included source PRs are closed as carried into this batch, and
their remote branches were deleted with exact-SHA leases, top-down for the
SQLite stack. This cleanup does not add ready-to-ship; the normal approval
and prepare-merge flow remain separate.

github-actions · 2026-07-13T22:30:53Z

Phase B-1 matrix build status — `pr-934-staging`

ABI v39. 71 built, 0 failed, 71 total.

Package	Arch	Status	Sha
icu	wasm32	built	`df50355f`
libcurl	wasm32	built	`eff13ed9`
libcxx	wasm32	built	`7989f75b`
libcxx	wasm64	built	`15f45186`
libiconv	wasm32	built	`55beab72`
libpng	wasm32	built	`ff9927f2`
libxml2	wasm32	built	`3238343a`
libzip	wasm32	built	`74fa1395`
openssl	wasm32	built	`76d96c6e`
openssl	wasm64	built	`912566eb`
sqlite	wasm32	built	`4f395eaa`
sqlite	wasm64	built	`9ea2044b`
zlib	wasm32	built	`edcbcb05`
zlib	wasm64	built	`0c65f349`
bc	wasm32	built	`c3513140`
bzip2	wasm32	built	`d0f16d7f`
coreutils	wasm32	built	`190a9b04`
curl	wasm32	built	`b35cf878`
dash	wasm32	built	`e72eac78`
diffutils	wasm32	built	`1671d2c4`
dinit	wasm32	built	`d366b990`
fbdoom	wasm32	built	`50828ca7`
file	wasm32	built	`b0b5f319`
findutils	wasm32	built	`54d8b55e`
gawk	wasm32	built	`b119d2b0`
git	wasm32	built	`135b973c`
grep	wasm32	built	`3343257f`
gzip	wasm32	built	`dfddbf00`
hello	wasm32	built	`b23d651b`
kandelo-sdk	wasm32	built	`02b5aa7f`
kernel	wasm32	built	`2e1d8990`
less	wasm32	built	`d4b1b655`
lsof	wasm32	built	`03d6c53e`
m4	wasm32	built	`599dea84`
make	wasm32	built	`86e14b04`
mariadb	wasm32	built	`b85ba025`
mariadb	wasm64	built	`cd3d1a28`
modeset	wasm32	built	`364a5dc3`
msmtpd	wasm32	built	`346926f4`
nano	wasm32	built	`b58c5c51`
ncurses	wasm32	built	`9646f601`
netcat	wasm32	built	`cb19fa84`
nginx	wasm32	built	`e0974b4b`
php	wasm32	built	`d75ce9eb`
posix-utils-lite	wasm32	built	`927fb76e`
ruby	wasm32	built	`3defafeb`
sed	wasm32	built	`f0a36592`
spidermonkey	wasm32	built	`794a13d5`
tar	wasm32	built	`3e14b588`
tcl	wasm32	built	`c2ee1701`
unzip	wasm32	built	`3d9892e7`
userspace	wasm32	built	`4ad2d955`
vim	wasm32	built	`a096a29d`
wget	wasm32	built	`760f1716`
xz	wasm32	built	`b4ece42c`
zip	wasm32	built	`c99c71dd`
zstd	wasm32	built	`eaa226fc`
bash	wasm32	built	`f62b8fb5`
mariadb-test	wasm32	built	`2390c511`
mariadb-vfs	wasm32	built	`05ca805e`
mariadb-vfs	wasm64	built	`ea9b5ef3`
nethack	wasm32	built	`66ec7a5e`
node	wasm32	built	`62ecd88e`
spidermonkey-node	wasm32	built	`d34e46bf`
vim-browser-bundle	wasm32	built	`54fa00dc`
nethack-browser-bundle	wasm32	built	`425bc5a3`
rootfs	wasm32	built	`44f0d6c4`
shell	wasm32	built	`9dc7deee`
lamp	wasm32	built	`eef497d2`
node-vfs	wasm32	built	`51971e37`
wordpress	wasm32	built	`969b62e1`

_{Auto-generated; replaced on each push. Raw data in the publish-status workflow artifact.}

Configure the browser test runner with its same-origin Vite proxy and keep a Chromium Wget regression for pages without a service-worker controller. Assert that BrowserKernel forwards the existing option and document the browser transport boundary.

The deterministic region ordering already landed through #907, but its in-process regression does not vary Rust HashMap random state. Run the CLI in twelve fresh processes against an alternating-type nested-region fixture and compare the emitted bytes. Document the cross-process byte-reproducibility contract and update the fork-instrumentation reference to the current ABI 39. This adds no ABI or package-artifact change. Validation: the full fork-instrument suite passed 187 tests; the focused fresh-process test passed; and the ABI snapshot check passed through scripts/dev-shell.sh.

Move the recursive /etc merge landed with #907 out of the browser app and into the shared host VFS layer. Preserve caller-owned entries and source metadata, and keep missing canonical state, short reads, and capacity failures visible during image assembly.

Add raw wasm32/wasm64 and fork-instrumented controls for issue #918, plus a positive SIGCHLD child-reaping fixture. Cover the behavior in Node and Chromium and document the pinned LLVM 21 limitation without replaying Dinit production or package changes from #911.

Delegate fsync on directory descriptors to the active filesystem backend so Node can issue its native durability barrier. Keep memory-backed and OPFS behavior truthful at their host boundaries, and cover the kernel, host backends, Chromium OPFS, and POSIX regression path.

Apply one supported recursion policy to both the shipped library and official testfixture: compound-select, expression, JSON, and trigger recursion stay within current browser and Node WebAssembly stacks. Keep the test patches aligned with those compiled limits and preserve the existing package revision recorded by the reviewed batch tree.

Keep analyze9's memory-accounting assertion, but use the encoding-correct allocation delta for SQLite's utf16 permutation.

Align the stack passed to kernel_clone to the 16-byte boundary required by Wasm code generation. This keeps stack-based variadic arguments intact when a new pthread begins. Add a local Sortix regression that formats the SQLite temporary-file pattern from fresh pthreads. The kernel_clone interface and ABI layout are unchanged.

brandonpayton · 2026-07-14T05:44:53Z

Merge-order note for the Homebrew migration: keep this PR queued behind #913. #913 has already completed its durable package promotion against the current main tree. Landing #934 first would change that tree and require #913 to be rebased and its package evidence rebuilt before merge. After #913 lands, rebase this exact reviewed batch onto the new main and rerun the required gate; its current 86/86 successful jobs remain review evidence, but are not a substitute for the post-#913 synthetic merge.

brandonpayton marked this pull request as ready for review July 13, 2026 23:23

brandonpayton marked this pull request as draft July 13, 2026 23:25

brandonpayton force-pushed the integration/post-907-focused-batch branch 2 times, most recently from 7dce296 to 260d75d Compare July 13, 2026 23:41

brandonpayton marked this pull request as ready for review July 14, 2026 02:40

brandonpayton added 4 commits July 13, 2026 22:46

Browser: stop retaining stale immediate cancellations

60bbb1f

test(browser): preserve guest stderr on nonzero exit

5e4637f

brandonpayton added 16 commits July 13, 2026 22:46

MariaDB: share writable-directory setup across VFS images

654425d

VFS: keep positioned I/O off shared file offsets

d982db9

host: preserve output buffers on zero-byte syscalls

4f82563

Runner: start examples with requested user and group IDs

539557a

mremap: reject growth without matching mapping metadata

d59dda6

Locks: report shared lock-table exhaustion as ENOLCK

7d3dc6d

libc: zero stat fields the kernel does not report

7eae43d

SQLite tests: run all-mode child jobs on Kandelo

f75b91e

SQLite tests: preserve truthful outcome evidence

02e25c4

SQLite tests: account for UTF-16 STAT4 sample bytes

aa985ee

Keep analyze9's memory-accounting assertion, but use the encoding-correct allocation delta for SQLite's utf16 permutation.

SQLite: clean up TestRecover Tcl commands

af1645b

brandonpayton force-pushed the integration/post-907-focused-batch branch from 260d75d to 822f35e Compare July 14, 2026 02:50

This was referenced Jul 14, 2026

bash, pcre2: require reproducible ABI-valid Wasm artifacts Automattic/kandelo-homebrew#75

Open

sqlite: ship the real command-line shell Automattic/kandelo-homebrew#76

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Land the focused platform follow-ups after #907#934

Land the focused platform follow-ups after #907#934
brandonpayton wants to merge 20 commits into
mainfrom
integration/post-907-focused-batch

brandonpayton commented Jul 13, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Jul 13, 2026 •

edited

Loading

Uh oh!

brandonpayton commented Jul 14, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

brandonpayton commented Jul 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What this batch does

Unique work that remains

Exact source heads

What was deliberately removed

ABI and package-artifact impact

Validation

Validation not run

Merge and cleanup

Uh oh!

github-actions Bot commented Jul 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Phase B-1 matrix build status — pr-934-staging

Uh oh!

brandonpayton commented Jul 14, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

brandonpayton commented Jul 13, 2026 •

edited

Loading

github-actions Bot commented Jul 13, 2026 •

edited

Loading

Phase B-1 matrix build status — `pr-934-staging`