posix id setters, __fspath__ binding, sendfile vectors and exec environments; a -c argument's common indentation - #1305

…s, exec environments, fork at finalization, and scandir close

Twelve changes to the posix module, squashed into one because origin/main
reformatted this file and replaying them individually produced merges that
interleaved unrelated blocks.

- setuid, seteuid, setgid, setegid, setreuid and setregid are implemented and
  removed from the no-op stub list; seteuid and setegid join the sandbox
  override list.
- os.fspath and the shared path converter bind __fspath__ off the type before
  calling it, call it with no arguments, and report a None left there as "not
  a path" rather than as something that failed to be called.
- The macos sendfile arm passes its header and trailer vectors to the syscall.
  An empty or absent vector is passed as absent, since an sf_hdtr with both
  counts zero is EINVAL. The length cell covers the header and the file
  together, so the header lengths are added onto a nonzero requested count --
  with checked_add, raising OverflowError rather than wrapping. Each present,
  non-None vector must satisfy issequence_w, so a generator is refused instead
  of consumed.
- execve, posix_spawn and the windows execve read len(env) and then the keys()
  and values() snapshots, walk exactly that many positions, and raise
  IndexError when a snapshot cannot cover it. __getitem__ is never consulted.
- fork and forkpty raise PythonFinalizationError once finalization has begun.
- os.urandom reports a host entropy failure instead of returning zeros.
- posix.ScandirIterator carries an open flag that close() and __exit__ clear
  and that exhaustion clears; __next__ ends the enumeration once it is clear,
  and __del__ warns ResourceWarning for an iterator that was neither closed
  nor exhausted.

baseobjspace gains issequence_w, ported beside the ismapping_w already there.

Assisted-by: Claude

… changed

`cli_dash_c_dedent.py` runs `sys.executable -c` on an indented block, a single
indented line, a tab-indented block, an argument whose common prefix is empty,
and code on stdin, which keeps its indentation.

`stdlib_posix.py` gains the `__fspath__` cases (a property that resolves to a
callable, and a None on the type, an inherited override and a property, across
os.fspath, open and os.rename), the conversion failures of the six id setters,
and the three scandir dispositions: abandoned mid-way warns, exhausted and
closed do not.

Each assertion fails on the binary from before the commits above.

Assisted-by: Claude

A line of nothing but spaces or tabs is emitted empty rather than having the
common prefix taken off it, and its own depth never narrows that prefix.

The blank test is spaces and tabs alone, which is narrower than
`textwrap.dedent`'s. Every other whitespace character is content: a line is
what sits between two `\n`, so `"  \r"` holds something, narrows the prefix to
its two spaces and keeps the carriage return. Measured against python3.14 for
each of `\x0b \x0c \r \x1c \x85 \xa0 U+2000` and for a line ending `"  \r"`,
none of which lets a four-space prefix go.

Assisted-by: Claude

os.urandom draws from a libc entropy call and never from a descriptor, so
_sysconfigdata publishes the name that describes it. Callers read these to
decide whether descriptor semantics apply at all. Windows draws from the
cryptography provider, which neither name describes, so it publishes neither.

Assisted-by: Claude

`_sysconfigdata` publishes HAVE_GETRANDOM_SYSCALL or HAVE_GETENTROPY to say
that `os.urandom` takes no descriptor. That describes
`rustpython_host_env::os::urandom`, which is `getrandom::fill` -- measured:
under `setrlimit(RLIMIT_NOFILE, (1, hard))`, `os.open` raises EMFILE while
`os.urandom(16)` still returns 16 bytes. A sandbox build routes the call
through `host_seam::ops::urandom`, which opens `/dev/urandom`, so it publishes
neither name.

Assisted-by: Claude

The dedent snippet checks that a space-or-tab-only line is emptied whatever its
depth, and that a form feed, a carriage return, a line ending `"  \r"` and a
no-break space are content that leaves no prefix to remove. The vertical tab
and the information separators are left out: they are non-printable and the two
runtimes report different errors for one.

The posix snippet checks that an exec environment's variable count comes from
the mapping's own length, that a snapshot too short for it raises IndexError,
that tuple and set snapshots are accepted, and that a generator handed to
sendfile's headers or trailers is refused.

Assisted-by: Claude

Emptying blank lines is part of removing a common prefix, not something done on
its own. An argument with a line at column zero has no prefix to remove and now
comes back exactly as written, blank lines included: `-c 'x="""a\n  \nb"""'`
built the string `'a\n  \nb'` before this branch, `'a\n\nb'` after the previous
commit, and `'a\n  \nb'` again now, which is what python3.14 builds.

Assisted-by: Claude

Closing ends the enumeration, so the entries that were never read are not
handed out afterwards.

Assisted-by: Claude

… host_env

HAVE_GETRANDOM_SYSCALL and HAVE_GETENTROPY say that `os.urandom` takes no
descriptor. That describes `rustpython_host_env::os::urandom`. The
`not(feature = "host_env")` fallback at `importing.rs` opens `/dev/urandom`
exactly as the sandbox route does, so a `--no-default-features` linux build
published a name for a descriptor-backed source. Both names now require
`host_env`.

Assisted-by: Claude

…ule, and a sendfile item type

`__fspath__` returning bytes is accepted and returning an int reports the type
it returned. An exec environment name that is empty or holds an interior `=`
is rejected, while a leading `=` is the permitted drive-current-directory
spelling. A sendfile header or trailer holding an item that is not bytes-like
is refused separately from the sequence check.

Assisted-by: Claude

The upstream citations name the symbol rather than a file and line, and the
sentences are shortened. No code changes: the diff adds and removes zero
non-comment lines.

Assisted-by: Claude

Reading `keys()` and `values()` replaced the per-key `__getitem__` call that
used to reject a non-mapping, and nothing took its place, so an object with
`__len__`, `keys()` and `values()` but no `__getitem__` reached the syscall,
and `execve(path, argv, None)` reported that None has no length.

The three copied paths now apply `PyMapping_Check`'s rule -- the type defines
`__getitem__` -- before reading the length. A list, tuple, str or bytes passes
that check and still fails on its missing `keys()`, an instance attribute does
not answer it, and `posix_spawn` still takes None.

`py_mapping_check` sits beside `ismapping_w` and `issequence_w`, which cannot
answer this: both consult `flag_map_or_seq` first, making a list non-mapping
and a dict non-sequence before reaching the shared `__getitem__` fallback.

Assisted-by: Claude

`WarmEnterState::maybe_compile` ended in `start_tracing_cell`, which sets
`JC_TRACING`. `eval.rs maybe_compile_and_run` called it and then delegated to
`bound_reached`, whose `MetaInterp::bound_reached` makes its own decision
through `force_start_tracing_for_key` — that call reads `JC_TRACING` first and
returns `AlreadyTracing`, so `compile_and_run_once` returned at its
`!driver.is_tracing()` exit (`mc_diag caro_not_tracing`) and the trace the door
had decided on never started.

Split the two: `maybe_compile_decision` performs the token lookup,
DONT_TRACE_HERE retry, dead-token cleanup and counter tick and returns
`StartTracing` without touching the cell; `maybe_compile` is that decision
followed by `start_tracing_cell`, for callers that go straight into
`setup_tracing`. The eval door calls the decision form.

warmstate.py:437-444 marks the cell inside `bound_reached`, between the early
returns and the `try:` whose `finally:` clears it.

`counter.tick` resets on reaching the bound (counter.py:199-200), so dropping
the door's `start_tracing_cell` does not leave the counter armed.

On `pyre/bench/synth/loops_comprehension.py`, dynasm: loops_compiled 5 -> 7,
bridges_compiled 5 -> 12, guard_failures 70875 -> 2611, caro_not_tracing 1 -> 0.
`cargo test -p majit-metainterp --features dynasm`: 1761 passed, 0 failed.

Assisted-by: Claude

`lookup_exc_class("PythonFinalizationError")` is read while
`thread::is_finalizing()` holds, which is when the registry it consults may
already be torn down; `expect` there ends the process instead of refusing the
operation. Both call sites now go through `builtins::finalization_error`, which
falls back to the base the class is registered on when the lookup answers
nothing.

Assisted-by: Claude

`W_ScandirIterator` gains `_in_next` (interp_scandir.py:86), set and cleared
around one enumeration step and read on the way in (interp_scandir.py:133-136,
158). A step that finds the flag set closes the iterator and raises, instead of
reading the same `index` as the step already running and handing out its entry
twice. The flag transition is serialized on its own mutex, the enumeration step
is not.

Assisted-by: Claude

`execve` on unix, `execve` on windows and `posix_spawn`'s `collect_spawn_env`
each carried the same body: pin the mapping, reject a non-mapping, read `len()`,
snapshot `keys()` and `values()`, and pair them by position under the reported
length. `collect_env_entries` holds it once and answers the `key=value` byte
entries; each caller converts those to the string form its exec takes.
`collect_spawn_env` now runs that conversion once for both the inherited
environment and the mapping.

Assisted-by: Claude

`getrandom::fill` reaches `getentropy(2)` only on macOS, OpenBSD, Vita and
Emscripten; FreeBSD, DragonFly, illumos, Solaris and Hurd reach `getrandom(2)`
like Linux does. The two capability names follow those sets, and a target in
neither — the iOS family, NetBSD, Haiku, Redox, NTO, AIX — publishes neither.

Assisted-by: Claude

`next()` read the open flag outside the region that claims `_in_next`, so a
`close()` on another thread could land between the two. Both flags are now read
and written under the one serializer, and `close()` takes it as well, so a step
decision names a state no concurrent close is halfway through. `next()` reports
that decision as `ScandirStep`.

Assisted-by: Claude

Every value below reproduces identically across repeated runs of the built
binaries, on both backends.

Ten dynasm getframe baselines re-recorded by `Preserve inline frame identity
for getframe` no longer reproduce. Nine land back on main's values exactly —
`loops_aborted` and the blackhole adoption count at 5 rather than 1 — so the
snapshot they were taken from was made against a different binary than the one
this branch builds now.

Five cranelift getframe baselines carry the transition that same commit already
recorded on its dynasm side and nowhere else: `loops_aborted 15 -> 0`,
`fbw_blackhole_adopted_multi_frame 15 -> 0`, `guard_failures 0 -> 2`.

`trace_too_long_effect_replay`, `trace_too_long_inline_multiframe` and
`for_iter_direct_store_double` abort more often on both backends — 6 -> 18,
23 -> 31, 4 -> 8. A location whose trace aborts re-arms its counter and is
traced again (warmstate.py:437-444). `jit: take the eval door's hotness
decision without marking the cell` is what lets that second decision reach
`bound_reached` instead of declining at `AlreadyTracing`, so retries the door
used to swallow are now attempted, and on a fixture built to outgrow
`trace_limit` every attempt aborts.

Assisted-by: Claude

…uard-exits every entry

The fixture's rewrite in `Preserve inline frame identity for getframe` compiles
two loops where the recorded run compiled none on cranelift and one on dynasm.
The compiled code is entered 8948 times over the fixture's 20000 iterations and
leaves through a guard every one of them: `MAJIT_STATS=1` reports
`mc_entered=8948` and `guard_failures=8948` on both backends, deterministic
across runs. So the baseline this records is a loop that never completes in
machine code, which is worth reading before it is treated as the expected
shape.

Assisted-by: Claude

…lk escape

`try_execute_residual_call_via_executor` reached `build_multi_frame_miframe`
only when `writes_live_heap && odometer_unchanged` also held. A residual call
that meets neither — the `LoadAttr` behind `f_locals`, whose read barrier
forces — took the single-frame handoff instead, and the caller frame resumed
with `valuestackdepth == stack_base`, so the interpreter underflowed on its
pending `CALL`.

`synth/frame_inlined_callee_own_image_regression` panicked on both backends
and on windows; it passes now.

Assisted-by: Claude

`interp_scandir.py:172-180` keeps finalization on `_finalize_` and publishes
no `__del__`, while 3.14 carries it as a type-dict entry.

Assisted-by: Claude

Both path converters turn away a `None` bound `__fspath__` instead of
calling it, so the error names the original object's type. `_unwrap_path`
and `_fspath` call what they found and report `NoneType` as not callable.

Assisted-by: Claude

`uint_w`'s `_typed_unwrap_error` position read `(*(*obj).ob_type).name`.
That tag is shared by every instance of a Python-level class, so the
message named all of them `object`. `baseobjspace.py:316-318` formats
`%T`, `space.type(w_obj).getname(space)`; the sibling positions in this
file already spell that as `object_functionstr_type_name`.

`os.setuid(x)` for an `x` that is not an integer now reports
`expected integer, got <class> object` rather than `got object object`,
which is the class both CPython and PyPy name there.

Assisted-by: Claude

`scandir_iter_next` took `W_ScandirIterator::from_obj`, an
`&'static mut`, before locking SCANDIR_IN_NEXT_SERIALIZER and held it
across `scandir_iter_next_entry`, which called `scandir_iter_mark_closed`
and derived a second `&mut` to the same object.

The claim, step, release, close and open-flag reads now go through one
`with_scandir_iter` helper that locks, derives the borrow, and drops it
before releasing. The step itself is still unlocked, so a second thread
arriving mid-enumeration finds `_in_next` set and is refused
(interp_scandir.py:133-135) rather than blocked.

Assisted-by: Claude

`autoflusher_add` reserved a handle index under one lock and indexed
`handles` under two later ones. `flush_all_streams` takes the table with
`std::mem::take` between them, so the reserved index was out of bounds
and the constructor panicked.

`AutoFlusher` now carries a generation, bumped wherever the table is
reinitialized, and `autoflusher_add` discards its reservation and retries
when the generation moved. The allocation stays outside the lock:
`w_gc_weakref_box_new` can collect, and the collector locks AUTOFLUSHER
in `walk_autoflusher_roots`.

Assisted-by: Claude

…andoff values

`jit: attempt the multi-frame blackhole handoff for every inline-subwalk
escape` re-recorded the dynasm and cranelift baselines for these fixtures
and left the wasm ones alone; only the linux CI leg runs the wasm backend,
where they have been failing since.

The six `getframe_*` fixtures now report on wasm what dynasm and cranelift
already record: `getframe_inline_subwalk_multiframe` goes from
loops_compiled=0 loops_aborted=15 with 14 blackhole adoptions to
loops_compiled=2 loops_aborted=1 with none, the "no escape abort or
frame-blackhole adoption" its header asks for. In
`for_iter_direct_store_double` and the two `trace_too_long_*` fixtures each
added abort is paired with a single-frame adoption. The deltas are
identical on darwin-arm64 and on the x86_64 CI runner.

Assisted-by: Claude

`_Py_Uid_Converter` (posixmodule.c:823) calls `_PyNumber_Index` before its
range checks, so an object that is an integer only through `__index__` is
accepted as a uid or gid. `c_uid_t_w` is that converter's counterpart and
went straight to `uint_w`, which runs no conversion of its own, so such an
object was refused as a non-integer.

The conversion now happens once up front and falls back to the original
object when it fails, which is what the converter does: whatever
`_PyNumber_Index` raised — an `__index__` of its own included — is replaced
by the type error naming the argument's class.

`os.setuid(Index(-2))` raises OverflowError where it raised TypeError, and
an `__index__`-only object is accepted. `__int__` alone still is not.
Message wording is unchanged.

Assisted-by: Claude