[PHP] Batch 2: PHPT platform and ABI fixes

[brandonpayton]

Purpose

This is the stacked Batch 2 integration PR for the PHP PHPT platform fixes
split from #717. It is based on the still-open Batch 1 integration branch rather
than main, so the batches remain independently reviewable while constituent
PRs are landed linearly with rebase merges.

This PR intentionally remains open. Constituent review, live-main rebase,
and ABI reconciliation are complete at current tip 6d93e09d5, but the full
browser PHPT run, canonical browser/manual verification, and final exact-head
gate are still outstanding. Do not merge this aggregate into Batch 1 or
main without Brandon's explicit approval.

2026-07-12 live-main reconciliation

• Rebased Batch 1's seven commits onto live main 2c083e143 (ABI 18), then
  replayed all 96 Batch 2 constituent commits onto rebased Batch 1 tip
  372387b15. The current branch has 102 commits above Batch 1: the 96 reviewed
  constituent commits plus six aggregate reconciliation/build-contract
  commits.
• Selected ABI 19 in 04e3bd39a. It preserves live main's atomic
  kernel_create_process_with_stdio design, requires the lifecycle,
  real-reader, and operation-wide write-preflight exports, regenerates the ABI
  snapshot/C/TypeScript artifacts, and raises PHP's package floor to 19 in the
  same change.
• Preserved live main's repaired absolute fork-buffer cursor semantics. The
  previously failing regression/raise-race now passes from branch-built
  fixtures; no stale fork instrumenter is used.
• Updated focused host test doubles to model the required ABI 19 process-exit
  export (45670a72d). Hardened the canonical Nix dev shell against Darwin
  login-profile PATH resets so both direct and bash -lc workflows use the
  declared CMake/GNU Make (734906e52).
• Made the shared fork-instrument tool builder independent of its caller's
  working directory (84f086975), with an empty-source-directory regression,
  so resolver-driven PHP builds can bootstrap the exact branch tool normally.
• Force-updated both still-open aggregate branches with exact leases. No
  aggregate was merged to main.

Constituent review ledger

PR	Summary	Review changes	View
#740	Establishes a reproducible PHP 8.3.15 package and upstream-aware PHPT surface for Node and browser, including package recipes, VFS/page wiring, fixtures, structured reports, and bounded execution.	Replayed the five source commits onto Batch 1; appended deterministic fork instrumentation and leading-dylink.0 preservation, reproducible package/SDK/timer work, canonical packaged browser state, truthful PHPT verdict/evidence handling, a 2 GiB/131,072-inode PHPT VFS capacity repair, and a clean browser-readiness asset fix.	Accept into Batch 2 only. The PHP artifact intentionally imports env.__wasm_posix_vm_interrupt_after, supplied by #757; it is not independently runnable or publishable and must receive the aggregate ABI reconciliation plus the PHP ABI floor selected by that reconciliation.
#754	Establishes coherent IPv4/IPv6/Unix socket addressing, local datagrams, multicast, structured socket options, dual-stack listeners, and shared hostname validation for PHP's ordinary socket surface.	Replayed six source commits while preserving #753's pathname-socket permissions; added exact binding-owner inheritance across fork/spawn, AF_UNIX lifecycle and stale-identity repairs, machine-scoped IPv6 stream state, mapped dual-stack peers, correct accept flags, bounded getsockopt copies, complete forked socket state, multicast/interface fixes, Node/browser hostname parity, focused tests, and truthful architecture/POSIX/browser docs.	Accept into Batch 2 only. Datagram delivery remains process-local; #859 and #860 now supply queue/backpressure plus limited-broadcast/MSG_TRUNC semantics, while host-backed UDP fork ownership and #855's deferred machine-wide routing redesign remain. Observable semantic changes require the final aggregate ABI reconciliation; the structural ABI-16 check is not standalone clearance.
#755	Makes TCP close orderly across kernel loopback, Node real sockets, and LocalVirtualNetwork, separating FIN from abort/reset while preserving queued data and independent stream directions.	Replayed the two unique source commits; replaced the fabricated exact-one post-FIN write model with a persistent pipe-backed discard sink and OS-driven Node close; made shutdown refs idempotent; fixed direct-I/O wakeups, accepted-bridge backpressure, fork/listener lifetime, final-owner cleanup, and port reuse; rejected enabled SO_LINGER; added an additive real-reader export/snapshot; strengthened Node, virtual, fork, large-payload, zero-FIN, Sortix, and browser coverage; and documented the remaining reset limitation truthfully.	Accept into Batch 2 only. The FIN/reset, wakeup, and ownership repairs passed focused review and validation. The host now requires kernel_pipe_has_readers while the constituent still reports ABI 16, so it is deliberately not independently main-ready and must be included in the aggregate ABI reconciliation. Full PHPT/host/browser gating remains aggregate-only; its constituent attempts predated #757.
#859	Preserves already-accepted UDP order under overflow and gives bounded AF_UNIX datagram queues reliable sender backpressure with coherent readiness and shutdown behavior.	Expanded the original tail-drop hunk into lazy capacity admission across IPv4/IPv6/multicast/host injection; reliable AF_UNIX EAGAIN; connected-peer purge/admission and EPERM; read-shutdown EPIPE/SIGPIPE; dequeue/connect/shutdown/close/unlink send-state wakes; one absolute finite readiness deadline with final kernel checks; and Rust, host, pthread guest, Node, and Chromium coverage.	Accept into Batch 2 only. The repaired behavior is sound and the cross-process routing gap remains explicit. Its new kernel-host wake bit is semantic ABI state not captured by the snapshot, so #859 remains quarantined for the aggregate ABI reconciliation.
#860	Enforces SO_BROADCAST for IPv4 limited broadcast and Linux-compatible input MSG_TRUNC length reporting across IPv4, IPv6, and Unix datagrams.	Replaced the stale one-commit patch with a three-commit stack on the aggregate tip; moved permission checking into the central send path with coherent error ordering; dropped fabricated requested-value buffer readback; preserved #859's queue/backpressure contract; hardened zero-length recv/recvfrom/recvmsg marshalling; and added Rust, guest-ABI, Node, Chromium, and contract-documentation coverage.	Accept into Batch 2 only. The repaired behavior is sound, with broadcast delivery and recvmsg() output msg_flags still explicit gaps. Its changed send errno and receive return-length semantics are semantic ABI changes and remain quarantined for the aggregate ABI reconciliation.
#756	Preserves authoritative process, descriptor, and shared-memory state across fork/exec: in-place exec, anonymous/SysV and regular-file MAP_SHARED, shared kernel descriptor backings, AF_UNIX accept queues, side-module fork coordination, wait/signal/thread lifecycle, and documented boundaries.	Rebuilt the stale eight-commit split on exact aggregate tip e45019127 as nineteen reviewed commits instead of replaying its altered socket base. Repaired wait cause, mmap geometry, PID allocation, fallible exec preparation, OFD/kernel-object ownership, stable file identity and dirty/version merging, transactional side-module replay, exact-TID sleep/signal routing, additive ABI metadata, inactive fast paths, and terminal/re-entrant host dispatch boundaries.	Accept into Batch 2 only. The repaired tree passed the exact host/ABI/guest diagnostics and independent audits, but it remains quarantined for the single aggregate ABI reconciliation and rebuilt PHP/opcache artifacts. File coherence is mediated rather than immediate; cross-PID futex, shared memfd/unstable-OPFS identity, SIGBUS past EOF, and external-writer detection remain explicit gaps.
#757	Repairs host/browser runtime parity, SharedFS namespace and persistence coherence, process launch and VM deadlines, networking and clock behavior, canonical PHP-derived images, PHP shutdown timing, and the netcat package boundary.	Replayed twenty unique source commits on exact aggregate tip 23e70c569, dropped three stale commits already superseded by #756/#859, and added nine review commits. Review corrected commit overclaims; repaired HostFS/SharedFS race and identity defects, Node/browser protocol parity, rootfs/package inputs, Linux coarse-clock handling, PHP timeout behavior, and resolver-safe netcat builds; and preserved an exact reviewed tree through the rebase merge.	Accept into Batch 2 only. Final kernel, host, libc, ABI, package, canonical-browser, and real-Chromium evidence supports the constituent. The PHP host import and semantic host/kernel changes remain quarantined for the aggregate ABI reconciliation; regression/raise-race exposes a pre-existing relative-vs-absolute fork-buffer pointer defect that must be repaired atomically with that reconciliation.
#758	Preserves actual 64-bit wasm32 cancellation-point arguments, failed-seek offset state, caught-signal select/pselect interruption, and the now-passing shared-condvar Sortix case.	Replaced the ineffective widening with the compiled (i32, i64 x 6) -> i32 musl/glue contract; expanded checked seek behavior through kernel, Node, SharedFS, and exact-i64 OPFS paths; repaired exact-thread signal, no-fd sleep, ready-result, termination, and mask-restoration behavior; added guest/backend/real-Chromium coverage; and dropped the non-compiling partial netlink model, fabricated Times accounting, and redundant bzip2 edit.	Accept into Batch 2 only. The reviewed behavior is sound, but its linked syscall function type and observable seek/select semantics remain quarantined for the aggregate ABI reconciliation. The inherited raise-race failure is still an aggregate blocker; #758 is not independently main-ready.
#742	Keeps guest environments and kernel process metadata coherent across launch, fork, and exec, and implements chown-family unchanged-ID sentinels without suppressing validation or backend behavior.	Split the misleading squash into three purpose-specific commits; used the aggregate metadata contract instead of stale scratch/snapshot reconstruction; normalized Node/browser launch environments; replaced the unsafe same-ID early return with authorized delegation; and added Rust, instrumented Node/Chromium guest coverage, POSIX docs, and a truthful cancellation-xfail rationale.	Accept into Batch 2 only. The full kernel suite plus focused Node, Chromium, and Sortix evidence passed. The process-metadata dependency and syscall-visible semantics remain quarantined for the aggregate ABI reconciliation, with broader aggregate gates pending.
#745	Adds durable guest-level coverage that an AF_UNIX listener inherited across fork retains one queue and survives exec through a non-CLOEXEC alias.	Dropped the stale non-compiling socket serialization, syscall, Wasm-export, and poll-logging patch already superseded by the aggregate (e3c7ba3a9 / 9def16b2a). Added an instrumented C fixture proving CLOEXEC closure, sole-child listener ownership, pre/post-exec FIFO acceptance exactly once, and bidirectional data through Node and Chromium; corrected stale socket comments.	Accept as test/comment-only Batch 2 coverage. The exact commit passed 1,076 kernel tests, focused Node and real-Chromium runs, and the structural ABI check; no runtime or ABI surface changed. Full host/libc/POSIX/Sortix/PHPT/manual-browser gates remain aggregate-only.
#746	Makes OpenSSL's maintained configuration and public trust bundle ordinary canonical-rootfs state at /etc/ssl, while preserving the browser's per-session MITM bundle as the documented dynamic exception.	Replaced both unsafe original commits with one truthful VFS commit; moved config/trust and the refresh helper into rootfs ownership; removed kernel/Node fabrication; made the legacy browser /etc/** merge recursive, ownership-preserving, and fail-closed; bumped rootfs rev 6→7; and added exact Node, Chromium, PHP, missing-image, and ENOSPC coverage.	Accept into Batch 2 only. The repaired tree passed focused Node/Chromium/PHP/ABI evidence and correctly leaves arbitrary caller-supplied images responsible for their own static policy. It adds no ABI surface, but changed rootfs and transitive image bytes must be rebuilt again under the reconciled aggregate ABI epoch.
#747	Proposed restoring a boxed Process constructor plus an all-zero WasmStat::Default to reduce kernel Wasm stack pressure.	Replayed nothing. Review showed the split was only an incomplete fragment of the historical fix: it conflicts with explicit-stdio construction, has no production boxed caller, immediately dereferences the allocation back into by-value storage, and bundles an unrelated unused stat convenience API.	Reject and close as superseded. No current constituent depends on it and no Wasm stack reproducer supports a speculative process-storage redesign. A future measured defect should box ownership end-to-end across every constructor and process-table/fork/exec/spawn path in a fresh PR.
#748	Enforces one wasm32-safe RLIMIT_FSIZE boundary across scalar, vectored, transfer, truncate, fallocate, memfd, and host-decomposed file writes, with exact-caller SIGXFSZ delivery.	Replaced the original non-compiling two-syscall patch with an operation-wide design; repaired integer wrap, append and transfer side effects, memfd and size-changing paths, host chunk/error/offset handling, main-thread-directed signal state across fork/exec/signalfd/poll/select/procfs, bounded exec-state serialization, and added wasm32/wasm64 Node plus Chromium guest coverage and POSIX documentation.	Accept into Batch 2 only. The repaired behavior passed independent audit and focused validation, but its host-required preflight export plus syscall/signal/exec-wire semantics remain quarantined for the aggregate ABI reconciliation, rebuilt PHP/opcache artifacts, the exact PHPT, and the aggregate full/manual-browser gate.
#741	Replaces lexical cwd normalization with component-wise pathname resolution in the kernel's global namespace, preserving symlink, dot-dot, trailing-slash, mount, virtual-filesystem, and AF_UNIX semantics.	Replaced the unsafe original commit with one reviewed commit on exact aggregate tip 4c7bac713; routed ordinary and *at() paths, cwd, realpath/statfs/exec, and AF_UNIX names through the walker; fenced procfs/devfs fallthrough while preserving /dev/shm; re-keyed renamed pathname sockets; validated initial cwd after credentials with failed-spawn cleanup; added kernel, Node, Chromium, and contract documentation.	Accept into Batch 2 only. The reviewed and landed trees match exactly. Cwd/dirfd records remain pathname-backed after rename/unlink, proc fd magic-link traversal remains partial, and the syscall-visible semantic change stays quarantined for the aggregate ABI reconciliation and full gate.
#751	Preserves the former first-fit automatic mmap address selection while walking the already-ordered guest mapping and host-reservation streams without constructing and sorting a temporary combined list.	Rejected the stale source history and unsupported performance/PHP claims; normalized fork-restored mappings at ingestion; added a test-only former-algorithm oracle covering empty, interleaved, equal-start, overlap, exact-fit, exhaustion, and 675 systematic layouts; and removed #756's copied munmap test.	Accept as an unmeasured kernel-internal equivalence refactor. Automatic addresses are observable, so the reference-equivalence evidence is load-bearing. No throughput, PHP/PHPT, host, or ABI change is claimed.
#743	Implements true no-follow ownership changes for lchown() and fchownat(..., AT_SYMLINK_NOFOLLOW) across the kernel, Node host, browser VFS, and host-backed filesystems.	Rejected the original marshal-only/following dispatch; replaced it on exact aggregate tip with component-wise final-link selection, an explicit cross-host lchown capability, strict flag handling, descriptor-driven pre-copy C-string validation, nullable utimensat metadata, wasm32/wasm64/Node/Chromium coverage, and POSIX/ABI documentation.	Accept into the quarantined Batch 2 aggregate only. Three independent audits found the repaired implementation sound. Its required env.host_lchown import and changed existing descriptor remain assigned to the post-rebase ABI/host-adapter reconciliation; it is not independently main-ready.
#752	Reports POSIX pathconf/fpathconf values from the live namespace, mounted backend, open-file description, and terminal state while preserving indeterminate results and errno.	Rejected the static libc table and rebuilt the contract across musl, shared descriptors, host marshalling, kernel/backend state, byte-based namespace limits, OPFS, generated bindings, docs, wasm32/wasm64 guests, PHP PHPTs, and real Chromium.	Accept into the quarantined Batch 2 aggregate only. Host-captured stdio PIPE_BUF remains explicitly indeterminate, and the required host imports, changed exports, and descriptor semantics must receive the aggregate post-rebase ABI reconciliation.
#759	Preserves authoritative stopped/continued/exited child events, exact-thread wait interruption, public wasm32/memory64 rusage layouts, stopped-process host parking, and pthread channel reuse across Node and browser.	Rejected the conflicting one-commit implementation and rebuilt it on exact aggregate tip f6346312b as two commits; repaired wait selection/peek/transactionality, job-control signals, SA_NOCLDSTOP, procfs T, output-before-wake ordering, deferred Worker launch, per-thread exit notification, deterministic guest synchronization, and sandbox-safe PHPT staging.	Accept into Batch 2 quarantine only. The repaired behavior passed independent audit and exact kernel/host/Node/Chromium evidence, but its incompatible ABI-16 wait/host changes and branch-local fork-instrument failure must be reconciled by the aggregate. The inherited raise-race failure and uncontended performance gate also remain aggregate work.

#740's review includes two byte-identical five-artifact PHP builds, full kernel
and host evidence, exact artifact hashes, a complete 19,017-test VFS image
audit, and a clean headed-Chromium readiness check. Full PHPT results in its
description are explicitly labeled historical and were not rerun on the
repaired constituent.

#754's final repaired source passed 1,005 kernel tests, 114 host test files/919
passing tests, wasm32+wasm64 checks, host typecheck, build.sh, and the
structural ABI-16 check. A real Chromium run passed the three-machine
UDP/TCP/curl network lab. The canonical ./run.sh browser package preparation
resolved 64/66 targets but stopped at WordPress preinstall on #740's known
missing #757 import; that is recorded as a failed aggregate startup attempt,
not a passing result.

#755's final repaired source passed 1,010 kernel tests; 32 focused host
networking tests with 2 skipped; host typecheck; build.sh; and 3/3 focused
Sortix close/shutdown cases in both the native runner and real Chromium. Its
structural ABI check reports only the additive reader export, which does not
clear the semantic or prebuilt-kernel compatibility boundary. Exact full-host
and canonical-browser attempts reached the generated PHP artifact and failed on
#740's known missing #757 interrupt import; the final network-lab rerun was
separately blocked by the currently generated GNU netcat artifact, which fails
its own Node tests. None of those blocked/failed aggregate attempts is claimed
as a pass.

#859's final repaired source passed 1,015 kernel tests; 3 focused host
wake/deadline tests; host build/type declarations; warning-clean wasm32 guest
syntax; and the two exact overflow/backpressure Sortix tests in both Node and
real Chromium. Full host Vitest reached 115 passing files / 5 failing files and
903 passing / 23 failing tests; every failure was the known missing #757 PHP
interrupt import or absent wasm64 hello artifact, not a datagram regression.
The ABI check remained synchronized and reported only #755's existing additive
export. The constituent-time ./run.sh browser attempt was blocked by the then-missing #757 import, so only its exact real-Chromium guest result is claimed; the aggregate rerun remains pending.

#860's repaired source passed 1,021 kernel tests; the focused #859 host
wake/deadline regressions (2 files / 3 tests); host build and declaration
generation; warning-clean wasm32 guest syntax; and its exact datagram-flags
guest test in both Node and real Chromium. The guest path covers bounded-copy
sentinels, zero-length recvfrom/recvmsg, all three datagram families,
MSG_PEEK, fixed buffer readback, and AF_UNIX full-queue readiness. The ABI
check stayed synchronized and still reports only #755's existing additive
export structurally; #860's syscall-semantic changes are reserved for the aggregate ABI reconciliation.
The full host/libc/browser-demo gate remains aggregate-only. Its constituent-time ./run.sh browser attempt predated #757; the aggregate rerun remains pending.

#756's repaired source passed 1,066 kernel, 183 fork-instrument, 19 shared, and
10 focused ABI-classifier tests. Its exact final tip passed 108 host files / 940
tests with no failures (2 expected failures, 166 skips), built ESM/CJS/type
declarations, passed the synchronized additive ABI-16 check, and ran the real
anonymous-MAP_SHARED fork guest to PASS. Nine-round Node medians stayed
close to the exact base; Chromium remained coarse/noisy and is not claimed as
performance-neutral. The constituent did not run the aggregate-only
libc/POSIX/PHP/PHPT/application or manual-browser gate.

#757's final reviewed source passed 1,071 kernel tests; 140 host files / 1,206 passing tests with 2 expected failures and 19 skips; fork-instrument 185/185; the focused SharedFS/MemoryFS set 161/161; and the focused virtual-network/netcat set 8/8. The final libc run recorded 302 passes, 20 expected failures, 1 flake-pass, and one unexpected regression/raise-race failure. That case fails on the exact pre-#757 aggregate tip too; its root cause is the inherited relative fork-frame offset being consumed as an absolute pointer. The existing repair e8fa12447 passes the focused case but changes the fork-buffer ABI meaning, so it is reserved for the aggregate ABI reconciliation. The structural ABI check remained synchronized. Canonical ./run.sh browser resolved 66/66 assets without fallback, reached Vite in 3m23s, and real Chromium reached PHP Ready in 1.004s; PHP 8.3.15 exited 0 with correct output, guest stderr was empty, and the console, page, request, and HTTP-error collections were empty. Full PHP PHPT, POSIX, Sortix, aggregate gate, and performance benchmarks were not run for this constituent.

#758's final reviewed source passed fresh wasm32 and wasm64 musl builds, with
the compiled wasm32 __syscall_cp.o inspected as (i32, i64 x 6) -> i32;
the canonical full build; 1,072 kernel tests; 125 passing host files / 1,124
passing tests with 2 expected failures and 111 skips; focused backend, guest,
OPFS, and host-type checks; and the synchronized structural ABI check. The
shared-condvar Sortix case passed 5/5 on Node and 5/5 in real Chromium; a
direct two-worker OPFS regression and three guest browser programs also
passed. Canonical ./run.sh browser reached Vite after all package/image
checks reported [OK]; with the PHPT runner's separately generated VFS
present, fresh Chromium reached PHP Ready in 1.388s and a real PHP smoke
script exited 0 with exact output and no collected browser/network errors.
The full libc run recorded 302 passes, 20 XFAIL, 1 flake-pass, and the same
inherited regression/raise-race failure. Full PHPT, POSIX, full Sortix, and
performance suites remain aggregate-only. Direct OPFS backend coverage is
claimed; guest-through-BrowserKernel OPFS mounting is not currently wired and
is not claimed.

#742 passed 1,076 kernel tests; its 12-test focused chown-family Rust set; 46 focused Node tests with 3 expected skips across environment/chown/exec/spawn/fork paths; and 2/2 real-Chromium guest specs on an isolated Vite port. Four focused Sortix ownership cases, the canonical build, and the synchronized structural ABI check also passed. Repository-wide rustfmt checking remains blocked by pre-existing drift, including unrelated regions of syscalls.rs; git diff --check is clean. Full host, libc, POSIX, full Sortix, canonical-browser, PHPT, and performance gates remain aggregate-only.

#745 was deliberately rebuilt as test/comment-only coverage because its
original production patch was non-compiling, lossy, and ABI-unsafe, while the
aggregate already owns shared AF_UNIX queues and in-place exec. Its exact
reviewed commit passed 1,076/1,076 kernel tests, the focused instrumented guest
1/1 on Node and 1/1 in real Chromium, and the synchronized structural ABI
check. The guest proves the CLOEXEC/non-CLOEXEC alias split, sole-child listener
ownership, one connection queued before exec and one after, FIFO acceptance,
bidirectional data, and exact queue consumption. The isolated Vite server
warned that optional Node-demo artifacts were absent, but the test-runner route
completed with no captured console, page, request, HTTP, guest-stderr, or host
diagnostic errors. Full host/libc/POSIX/Sortix/PHPT/canonical-browser/manual-
browser gates remain aggregate-only.

#746 was deliberately rebuilt as one rootfs/VFS commit because its original
kernel-synthetic policy and stale-base include_bytes! dependency were unsafe,
and its second commit message described scheduler work it did not contain. The
final tree passed 1,077/1,077 kernel tests; 60/60 focused host/PHP tests; the
17/17 Node PHP package suite; exact Node image byte/mode/owner checks; upstream
OpenSSL key/CSR PHPTs on Node and Chromium; real-Chromium legacy-rootfs and PHP
package specs; canonical rootfs/build and ABI checks; and ./run.sh browser
preparation plus a Chromium probe against the live server. The canonical full
host attempt was not green: 1,223 tests passed, 2 expected failures and 26 skips
were recorded, and one unrelated SpiderMonkey SHA-1 guest exited 139; the
isolated parity file then passed 16/16. That broad suite is not claimed as a
pass. Full libc/POSIX/Sortix/PHPT/performance gates remain aggregate-only.

#747 was reviewed and closed without replay. Its exact old head
504c80211 compiles, and a throwaway conflict adaptation also compiled and
passed the structural ABI check, but those facts do not validate the claimed
stack invariant. The current aggregate has no new_boxed or
WasmStat::default consumer; explicit-stdio creation bypasses the helper; and
Process::new would allocate, move, dereference, and deallocate before storing
another by-value Process. The earlier genuine design used direct
Box::new_uninit field writes and boxed process-table ownership. #747 restores
neither and provides no Node/Chromium stack reproducer, so it is superseded
rather than a Batch-2 code dependency.

#748 was rebuilt as a single reviewed replacement commit on exact aggregate tip
cd3f0181f, because the old patch did not compile and enforced the limit at
the wrong internal boundary. Its final exact tree passed 1,089/1,089 kernel
tests; wasm32 and wasm64 kernel checks; host typechecking; a fresh wasm32 and
wasm64 musl plus canonical build; the focused Node guest 2/2; and the focused
real-Chromium guest 1/1 on an isolated fresh Vite server. The synchronized ABI
check reports kernel_prepare_write_operation as a structural addition, which
does not clear the observable syscall/signal behavior or fork/exec wire v11.
The upstream ext/opcache/tests/file_cache_error.phpt and canonical
./run.sh browser surface remain aggregate-only after the aggregate ABI reconciliation and rebuilt
artifacts. The PHPT harness must truthfully admit that explicitly file-cache
test without broadly treating SHM-dependent opcache tests as supported.

#741's original lexical-normalization commit was rejected and replaced with source commit cc579aabb, rebase-landed as 4ba585a05; both commits have tree 5741231b4139507abe670bfd088d3e665a04f74b. The final reviewed tree passed 1,102/1,102 kernel tests, the host ESM/CJS/declaration build, the synchronized structural ABI check, 12/12 focused Node mount/path tests, and 1/1 focused real-Chromium probe. The canonical ./run.sh --fetch-only browser path resolved 66/66 published artifacts, rebuilt required local guests/images, reached Vite on an isolated port, and the same Chromium probe passed against that live server. Full host/libc/POSIX/Sortix/PHPT/performance gating remains aggregate-only.

#751's stale one-commit history was replaced by source commit 7336e524836773027951dda95f1607fbc39429c1 and rebase-landed as 347bceaac5774e499c4ee7b36c49f83f9b58461a; both commits have tree b46db8c8bafb253a7bd5d9d62dd00374da6d4937. The focused memory suite passed 36/36, including comparison with the former stable-sort algorithm across 675 systematic layouts; the exact final aarch64 kernel library suite passed 1,104/1,104; the synchronized structural ABI check passed; and git diff --check was clean. Full host/libc/POSIX/Sortix/browser/PHPT/performance gating remains aggregate-only. Performance was not measured.

#743's unsafe original marshal-only commit was replaced by source commit f32c248e1355369b77866b056998685b53f29d1d, rebase-landed as a71015bc2be5296825af5c336257c3ee69a218ce; both commits have tree 38e88d64bf7b614a47e951664b26b7c344a6efb9. The final reviewed tree passed 1,108/1,108 kernel tests; 16/16 focused chown-family tests; 3/3 shared host-ABI tests; 10/10 ABI generator/classifier tests; 76/76 focused host/backend/wasm32/wasm64 guest tests; the host ESM/CJS/declaration build; fresh wasm32 and wasm64 musl builds; 1/1 isolated real-Chromium guest; ABI artifact synchronization; and git diff --check. The exact same-version ABI classifier intentionally fails because descriptor 125 changes and env.host_lchown is a new required import without the aggregate bump; the default stale-stack check is not claimed as standalone clearance. Canonical ./run.sh --fetch-only browser resolved 60/66 packages but stopped before Vite on six cache-key mismatches, while the isolated Chromium path passed. Full host/libc/POSIX/Sortix/PHPT/canonical-browser/performance gating remains aggregate-only.

#752's static original commit was rejected and replaced by source commit
95c34d809fd357dffb006b043ac938ea4180fa29, rebase-landed as
f6346312ba6adef0f761973213ff585b4dc7e8d2; both commits have tree
cb2949e1a59df6640f731d656c39da2596b86e65. The final exact tree passed
1,124/1,124 kernel tests, 19/19 shared tests, 12/12 ABI generator/classifier
tests, 56/56 focused host/pathconf/VFS tests, the host ESM/CJS/declaration
build, fresh wasm32 and wasm64 musl builds, raw wasm32/wasm64 guests, and the
canonical build. A fresh PHP package build produced artifact
28fe4a6f8a13a9d8828ce05cd127008286318d7fea18c780783c319607a27bfb;
the two upstream ext/posix pathconf PHPTs passed 2/2 on Node and 2/2 in real
Chromium. Three isolated pathconf/OPFS Chromium specs passed 3/3. Canonical
./run.sh browser resolved 66/66 enabled artifacts, reached Vite, and the
focused pathconf plus OPFS specs passed 2/2 against that live server.
git diff --check was clean. The exact same-version ABI classifier
intentionally reports the required host imports, changed kernel exports, and
descriptor semantics as incompatible; this is quarantine evidence, not a
passing ABI gate. Host-captured stdio PIPE_BUF remains an explicit boundary.
Full host/libc/POSIX/Sortix/full-PHPT/performance gating remains aggregate-only,
and performance was not measured.

#759's original conflicting head was replaced by reviewed source commits
00f26226c35f4207382a02af1e0378b7c0b775ad and
68f8e6b3c95b365a44b88cefe903dd83e607bd3c, rebase-landed as
a44fd0779 and f75960ed3; the landed aggregate tree exactly matches the
reviewed tree 3c2f8be1e85683580b213bfa2df1d19b291025fe. The final head passed
1,135/1,135 aarch64 kernel tests and the full host suite with 153 passing files,
6 skipped files, 1,292 passing tests, 2 expected failures, and 19 skipped tests.
The wasm32/memory64 lifecycle guests passed 2/2 on Node; the lifecycle and
pthread-channel-reuse specs passed 3/3 in real Chromium; and the three focused
pcntl wait PHPTs passed 3/3 on Node and 3/3 in real Chromium. Focused shared and
ABI-generator suites passed 21/21 and 14/14; the host build and canonical
browser startup reached Vite. Full libc recorded 302 passes, 20 XFAIL, one
flake-pass, and the inherited regression/raise-race failure reproduced on
exact base f6346312b. The exact-base ABI classifier intentionally reports
incompatible wait/host contracts under ABI 16. The passing wasm32 fixture was
built with live main's repaired fork instrumenter because the aggregate's own
tool corrupts it; clean branch-owned fixture production remains mandatory in
the aggregate reconciliation. Performance attempts were invalidated by
unrelated sustained host load, so no performance claim is made.

#855 is explicitly deferred without replaying its current commits. #754/#859
leave a genuine machine-wide datagram gap, but #855's IPv4-only post-send helper
can duplicate reuse-address delivery and attach ECONNREFUSED after a
successful delivery. A future replacement must route once through
ProcessTable-owned Inet/Inet6/multicast/Unix state and test the public syscall
wrapper.

Planned remaining constituents

• Networking remainder: Deliver loopback UDP datagrams across processes on the same machine #855 is deferred pending a ProcessTable-owned
  machine-wide datagram routing redesign; do not replay its current commits.
• Ancestry-bearing sequence: [PHP] Establish a reproducible PHPT conformance surface #740 -> [PHP] fix: preserve socket identity and routing semantics #754 -> [PHP] fix: preserve process-shared state across fork and exec #756 -> [PHP] fix: keep host/browser runtime and SharedFS state coherent #757 -> [PHP] fix: preserve syscall widths, seek state, and select signals #758 is complete.
• Independent/special constituents: [PHP] vfs: resolve pathname components across mounts #741, [PHP] refactor: preserve first-fit mmap gap selection #751, [PHP] vfs: change symlink ownership without following final link #743, [PHP] vfs: report truthful per-object path configuration #752, and [PHP] fix: preserve stopped-child wait and pthread exit lifecycle #759 are complete; no Batch 2 constituents remain.

The ledger above will be extended with the summary, review changes, and
recommendation for each constituent as it is reviewed and landed.

Aggregate reconciliation — complete

The historical ABI-16 constituent line was rebased onto ABI-18 live main and
assigned to ABI 19. The completed reconciliation keeps one coherent
creation-time stdio contract; includes the required reader, lifecycle, wait,
pathconf, lchown, write-preflight, fork/exec, networking, VM timer, and linked
cancellation-point contracts; retains truthful ENOSYS for fabricated Times
accounting; and commits the regenerated snapshot, C header, TypeScript bindings,
PHP ABI floor, and documentation together. Fresh wasm32/wasm64 musl, kernel,
fork-instrument, program, host, package, and rootfs artifacts were rebuilt.

The remaining artifact work is the full PHP package/PHPT browser image and its
complete browser outcome set. That is validation/distribution work under ABI
19, not an unresolved ABI design decision.

The /etc/ssl ownership decision remains resolved by #746; it is ordinary
rootfs/VFS state, not kernel-synthetic policy.

Verification status

• Constituent-ready CI is intentionally skipped under the agreed batching plan.
• [PHP] Establish a reproducible PHPT conformance surface #740, [PHP] fix: preserve socket identity and routing semantics #754, [PHP] fix: preserve orderly TCP close across bridges #755, [PHP] fix: preserve queued datagrams under receive overflow #859, [PHP] fix: enforce limited-broadcast and datagram truncation semantics #860, [PHP] fix: preserve process-shared state across fork and exec #756, [PHP] fix: keep host/browser runtime and SharedFS state coherent #757, [PHP] fix: preserve syscall widths, seek state, and select signals #758, [PHP] fix: preserve process environments and chown sentinel semantics #742, [PHP] test: verify AF_UNIX listener queues across fork and exec #745, [PHP] fix: provide OpenSSL defaults from rootfs images #746, [PHP] fix: enforce RLIMIT_FSIZE at file-write operation boundaries #748, [PHP] vfs: resolve pathname components across mounts #741, [PHP] refactor: preserve first-fit mmap gap selection #751, [PHP] vfs: change symlink ownership without following final link #743, [PHP] vfs: report truthful per-object path configuration #752, and [PHP] fix: preserve stopped-child wait and pthread exit lifecycle #759 were validated on their repaired
  source trees before their rebase merges; see their PR descriptions for exact
  commands, counts, hashes, browser evidence, and explicit non-runs.
• [PHP] fix: restore boxed process construction helpers #747 was reviewed and closed as superseded; no [PHP] fix: restore boxed process construction helpers #747 code is present or
  claimed as validated aggregate behavior.
• The reconciled runtime tree passed cargo test -p kandelo --target aarch64-apple-darwin --lib (1,135/1,135), full host Vitest (134 files;
  1,194 passed, 2 expected failures, 112 skipped), and libc-test (303 passed,
  20 expected failures, 1 known flake-pass, 0 failures; raise-race passed).
  The exact current head passes ABI snapshot/version synchronization and the
  direct plus bash -lc dev-shell tool-precedence regression.
• A fresh ABI-19 build produced the kernel, fork instrumenter, wasm32/wasm64
  programs, host bundles, package fallbacks, and a 16,787,688-byte rootfs VFS.
  The rebuilt wasm32/memory64 wait guests and concurrent pthread-fork guest
  passed 4/4.
• These results are strong intermediate evidence, not a main-ready claim: the
  full PHP package/PHPT browser image, complete browser PHPT outcome artifacts,
  canonical ./run.sh browser plus real-browser verification, performance
  disposition, and one final exact-head aggregate rerun remain.

Landing mechanics

• Constituent PRs are rebase-merged into this branch, preserving their commits
  linearly.
• This PR is stacked on
  integration/kd-6nz-php-phpt-batch-1-kernel-fixes.
• No aggregate branch is to be merged to main without Brandon's explicit
  approval.
• Current final batch-to-main assumption is rebase merge for
  granular/revertible history; confirm before the aggregate landing.

2026-07-12 browser-PHPT repair

• b1d96cf40 separates the canonical 63-file rootfs lazy-asset registry from
  the optional interactive-shell catalog. The focused PHP page no longer asks
  Vite to resolve unrelated less/tar/curl/networking/Git/compression/archive
  artifacts that its VFS image does not carry. General shell callers retain
  the combined rootfs-plus-optional-shell behavior.
• 6d93e09d5 migrates the PHPT page from the deleted legacy
  BrowserKernel.init/spawn path to one persistent worker-owned VFS using
  initFromImage and spawnFromVfs. Typed snapshot/write/unlink RPCs execute
  through mounted VirtualPlatformIO in the worker, so generated scripts can
  be staged/restored and guest mutations persist across SKIPIF, FILE, CLEAN,
  and later tests without returning the live VFS SAB to the main thread.
• Focused BrowserKernel/ownership/lazy-asset tests passed 13/13; the host
  declaration typecheck, PHP-only Vite 8.0.16 build (85 modules), and ABI-19
  synchronization check passed. With a fresh ABI-19 PHP artifact, real
  Chromium passed Zend/tests/001.phpt; a combined run also passed
  bug63741.phpt, whose CLEAN section observed and removed the FILE-created
  fixture, proving persistent cross-section state.
• These are focused repair results, not the full browser gate. The complete
  browser PHPT inventory, canonical ./run.sh browser plus manual
  verification, performance disposition, and final exact-head aggregate gate
  remain outstanding.

[github-actions]

Phase B-1 matrix build status — pr-871-staging

ABI v19. 69 built, 0 failed, 69 total.

Package	Arch	Status	Sha
libcurl	wasm32	built	e6d84c9e
libcxx	wasm32	built	125701cb
libcxx	wasm64	built	27b8632b
libiconv	wasm32	built	99619c53
libpng	wasm32	built	c11fe7a3
libxml2	wasm32	built	d37e55b0
openssl	wasm32	built	3bef3b47
openssl	wasm64	built	dd55f594
sqlite	wasm32	built	acaab402
sqlite	wasm64	built	d8c4bd83
zlib	wasm32	built	c2644c11
zlib	wasm64	built	0a92e1fd
bc	wasm32	built	a59b6b69
bzip2	wasm32	built	949ff502
coreutils	wasm32	built	39a3cc51
curl	wasm32	built	c0cda643
dash	wasm32	built	3d50460e
diffutils	wasm32	built	85b92dde
dinit	wasm32	built	f90ffe66
fbdoom	wasm32	built	47c37ec5
file	wasm32	built	15fcd9b9
findutils	wasm32	built	b9c0c6e3
gawk	wasm32	built	f6930ef0
git	wasm32	built	0012c03b
grep	wasm32	built	93876756
gzip	wasm32	built	6599b79a
hello	wasm32	built	65f94017
kandelo-sdk	wasm32	built	4eb1d32d
kernel	wasm32	built	b697326f
less	wasm32	built	e5fd4d44
lsof	wasm32	built	c6f6fc76
m4	wasm32	built	93e9875c
make	wasm32	built	49c532f3
mariadb	wasm32	built	ff0d8619
mariadb	wasm64	built	2699992e
modeset	wasm32	built	80aa3f6a
msmtpd	wasm32	built	5bca0f0b
nano	wasm32	built	ad03e346
ncurses	wasm32	built	e67397eb
netcat	wasm32	built	fb699a1f
nginx	wasm32	built	2c296da1
php	wasm32	built	6b89ead1
posix-utils-lite	wasm32	built	3830adcc
ruby	wasm32	built	bf41a46b
sed	wasm32	built	43edede7
spidermonkey	wasm32	built	667d45e7
tar	wasm32	built	2d39220c
tcl	wasm32	built	d0336feb
unzip	wasm32	built	990b360f
userspace	wasm32	built	1f3f8b39
vim	wasm32	built	678b22ef
wget	wasm32	built	f0503b24
xz	wasm32	built	7ef7ea7e
zip	wasm32	built	55ee3121
zstd	wasm32	built	db024284
bash	wasm32	built	e5c92cbf
mariadb-test	wasm32	built	fc7b6e97
mariadb-vfs	wasm32	built	836de90c
mariadb-vfs	wasm64	built	ce4a84f2
nethack	wasm32	built	5df5f220
node	wasm32	built	eebe9f7b
spidermonkey-node	wasm32	built	30e6afe4
vim-browser-bundle	wasm32	built	f74d5f17
nethack-browser-bundle	wasm32	built	86775d63
rootfs	wasm32	built	d7a30a3f
shell	wasm32	built	afaab851
lamp	wasm32	built	30c9cd71
node-vfs	wasm32	built	9825b695
wordpress	wasm32	built	16c3e0b1

_{Auto-generated; replaced on each push. Raw data in the publish-status workflow artifact.}