[PHP] fix: preserve socket identity and routing semantics

[brandonpayton]

Purpose

PHP's ordinary stream and socket tests exposed platform-level gaps in Kandelo's socket model: address-family handling, datagram routing, multicast, socket-option layouts, inherited ownership, and host hostname parsing. These fixes belong in the shared kernel and host networking layers rather than in PHP-specific shims.

This PR retains the original six socket/network commits and adds two review-repair commits needed for truthful process, ABI, and Node/browser behavior.

What changed

The original commits add:

• AF_INET6 ::/::1 stream and datagram support, complete sockaddr_in6 results, IPv4-mapped peers for dual-stack listeners, and pre-bind IPV6_V6ONLY.
• AF_UNIX pathname and Linux abstract-namespace sockets, including local datagram delivery.
• IPv4 multicast membership, source filtering, interface selection, loop control, and wasm32/wasm64 request-layout parsing.
• Structured or string-valued SO_LINGER, SO_BINDTODEVICE, and TCP_CONGESTION handling.
• Linux-style dual-stack wildcard port reservation.
• Shared host-side handling for numeric IPv4 forms and DNS hostnames.

Review found and repaired several correctness problems:

• IPv4/IPv6 TCP and UDP binding tables retain exact owner sets across fork, spawn, close, and process cleanup. Closing a parent no longer unregisters a binding still inherited by a child, including paired dual-stack reservations.
• AF_UNIX registry entries likewise retain inherited owners. Abstract names disappear after their final owner closes; pathname metadata remains until unlink without leaving a live lookup target.
• AF_UNIX datagrams validate destination process, socket type, and socket identity instead of misindexing a sender or redirecting through a reused slot. Missing, wrong-type, closed, and unsupported cross-process peers return ECONNREFUSED; the exported connect path preserves that errno.
• Process-local stream peer indices are cleared before slot reuse, so MSG_OOB cannot target an unrelated replacement socket; a missing OOB peer returns EPIPE and raises SIGPIPE unless suppressed.
• IPv6 loopback streams use machine-scoped listener and pipe state, supporting same- and cross-process connections. Dual-stack accepts report IPv4 peers as mapped IPv6 addresses.
• accept() no longer inherits O_NONBLOCK; accept4() validates flags before consuming a pending connection.
• Multicast loop, interface, source-filter, TTL, SO_BINDTODEVICE, and cubic-only TCP_CONGESTION behavior were made consistent with the modeled routes.
• getsockopt() structured, string, timeval, and integer results share bounded, unaligned-safe copy handling, including null and short-length rejection.
• Fork state serialization preserves IPv6 addressing, socket options, multicast membership, and send/receive timeouts, with strict bounds and malformed-input tests.
• Poll filtering and datagram EPIPE/MSG_NOSIGNAL behavior are consistent across IPv4, IPv6, and Unix sockets.
• Node TCP, browser Fetch/TLS, and LocalVirtualNetwork share one parser for bounded decimal IPv4 forms, ASCII host-label syntax, DNS length limits, and trailing-root names. LocalVirtualNetwork resolves only registered aliases rather than inventing DNS results.
• Architecture, browser-support, and POSIX-status documentation now state the implemented boundaries explicitly.

Integration provenance

The previous live source head was f41e20dd9e03e68690b82c4a2dfda77f87bd6579. Its six logical commits were replayed onto the Batch 2 integration tip as:

• ac682923f
• cbf148fb6
• 078b20bc7
• e80cf4e61
• 516313e62
• 37edf7298

The replay conflict preserved #753's pathname-socket mode of 0777 & ~umask while retaining abstract sockets' no-inode behavior. Review repairs were appended as e5e1c99c8 and e492f5df7 rather than folded into those six commits. The source branch was updated under an exact --force-with-lease against f41e20dd....

ABI and landing boundary

bash scripts/check-abi-version.sh passes structurally at ABI 16: the snapshot, C header, and generated TypeScript constants agree. That is not a semantic compatibility clearance.

This PR changes observable errno, fd-inheritance, blocking, ownership, fork-wire, and pointer-copy behavior. It is therefore accepted only as a quarantined Batch 2 constituent, not as an independently mergeable or publishable branch. The final aggregate must perform the planned ABI 16→17 reconciliation and regenerate abi/snapshot.json, host/src/generated/abi.ts, and libc/glue/abi_constants.h together before Batch 2 can advance.

Validation

Run through scripts/dev-shell.sh on the final repaired source tree:

• cargo test -p kandelo --target aarch64-apple-darwin --lib: 1,005 passed, 0 failed.
• wasm32 and wasm64 kernel library checks passed; wasm64 used cargo check -p kandelo --target wasm64-unknown-unknown --lib -Z build-std=core,alloc.
• bash build.sh passed after rebuilding the final kernel, host package, examples, and rootfs.
• cd host && npx vitest run: 114 files passed, 16 skipped; 919 tests passed, 2 expected failures, 51 skipped.
• npm run typecheck in host/ passed.
• bash scripts/check-abi-version.sh passed at the structural ABI-16 level described above.
• Focused hostname/backend tests passed 66/66; focused AF_UNIX datagram, pathname tombstone, and OOB reuse tests passed before the full kernel run.
• After final artifact rebuild, a real Chromium run against a direct Vite server passed test/network.spec.ts: 1 passed. The three-machine lab exercised UDP, TCP, and curl and asserted no console or page errors.
• A separate real-Chromium hostname probe covered valid numeric forms, overflow and malformed rejection, host-label/DNS length limits, and trailing-root names without console errors.

The canonical ./run.sh browser --host 127.0.0.1 --port 57459 path rebuilt/resolved 64 of 66 package targets and all #754 network-lab assets, then stopped while preinstalling the WordPress image because repaired #740's PHP artifact imports env.__wasm_posix_vm_interrupt_after, intentionally supplied only by later constituent #757. The same known dependency also caused nginx/PHP opcache prewarm to skip. This is recorded as a failed aggregate startup attempt, not passing browser evidence and not a #754 socket regression.

Per the batching agreement, the constituent did not run the full libc, POSIX, Sortix, or PHP PHPT suites. Those remain mandatory on the exact final Batch 2 aggregate.

Known boundaries and follow-ups

• In-kernel IPv4/IPv6 and AF_UNIX datagram delivery remains process-local. Machine-wide cross-process delivery still needs the separately reviewed Deliver loopback UDP datagrams across processes on the same machine #855 design.
• Fork preserves logical UDP binding ownership, but host-backed UDP registration is still tied to the registering process/socket identity and is not shared or transferred across fork.
• SO_LINGER has the correct layout and survives fork, but nondefault linger does not yet affect close timing; repaired [PHP] fix: preserve orderly TCP close across bridges #755 must implement or truthfully reject enabled linger.
• Fork-shared AF_UNIX stream backlog behavior remains for [PHP] fix: preserve process-shared state across fork and exec #756.
• External and LocalVirtualNetwork IPv6 transport is not implemented; IPv6 support here is loopback-bounded.
• [PHP] fix: preserve queued datagrams under receive overflow #859's tail-drop queue policy and [PHP] fix: enforce limited-broadcast and datagram truncation semantics #860's buffer, broadcast, and MSG_TRUNC behavior still require post-[PHP] fix: preserve socket identity and routing semantics #754 adaptations.

View

Accept into stacked Batch 2 PR #871 only. Do not land this branch independently or merge Batch 2 until the ABI-17 reconciliation, remaining networking work, full aggregate gate, and PHP browser PHPT evidence are complete.