ABI: Batch ABI 43 platform work and shared-memory vfork

[brandonpayton]

Why

Kandelo needs one coherent ABI 43 transition instead of merging many
overlapping ABI, kernel, libc, host, package, and fork-instrument
changes independently. The working integration tip had 176 commits,
including many fixups and generated refreshes. That tree was useful for
recovery, but not a reasonable permanent history.

This batch preserves the accepted platform work as 73 purpose-scoped
commits. It also replaces full-memory copying for eligible
fork-then-exec workloads with genuine shared-memory vfork() semantics.
Pristine upstream CRuby can therefore select its own vfork() path
without the temporary source patch in PR #1166.

Merge method

REBASE MERGE ONLY. DO NOT SQUASH. DO NOT CREATE A MERGE COMMIT.

The 73 commits are intentional review, attribution, and bisection
boundaries. Squashing this PR would destroy those boundaries and violate
the batch contract. The batched-changes label is applied so merge
preparation selects the rebase path.

After the rebase lands on main, the batched source PRs can be closed
as superseded. Do not close them based only on this PR being opened.

What changed

ABI 43 and host ownership

• Makes fork replay activation state safe and reconstructs admitted
  references in fresh workers.
• Replaces host access to guest-shaped kernel transfer memory with
  bounded, generated, kernel-owned scratch and scalar contracts.
• Moves clear-TID, shared-memory attachment, TCP listener, timer
  cleanup, procfs, readiness, and VFS metadata authority into Rust.
• Regenerates the ABI snapshot plus matching Rust, C, libc, TypeScript,
  package, fixture, and artifact projections.
• Preserves symmetric Node and browser worker protocols.

Affordable fork and genuine vfork

• Rejects ordinary fork with truthful EAGAIN before allocation or
  copying when exact retired-memory debt reaches its bound. Admitted
  ordinary forks retain independent copied address spaces.
• Charges actual backing bytes, uses exact ownership and finalization
  evidence, and keeps the time-based retirement fallback bounded.
• Adds explicit shared-memory alias ownership and exact final
  retirement.
• Borrows replay state across main and active side modules without
  allowing a child to overwrite parent continuation state.
• Changes kernel_fork to take an explicit ordinary-fork or vfork mode.
  A separate kernel_vfork import, guest marker, and new frame field
  were rejected because they add implicit state or duplicate call
  graphs. The incompatible import, kernel export, host launch metadata,
  and instrumented replay contract are versioned together as ABI 43.
• Runs a vfork child in a separate worker over the same
  SharedArrayBuffer-backed WebAssembly.Memory, with child-private
  syscall, replay-workspace, and continuation-control state.
• Suspends the calling parent worker until successful exec, _exit(),
  or exact fatal-child containment. Failed exec keeps the lifetime
  coherent. Other parent pthread workers remain independently runnable.
• Covers pthread callers, repeated calls, nested-operation rejection,
  signals, traps, credentials, cwd, process groups, descriptors, shared
  open file descriptions, wait/reaping, and active side modules.
• Removes the PR [Homebrew/Ruby] Spawn representable commands without fork #1166 CRuby source patch. Upstream CRuby 4.0.5 selects
  vfork as uid 1000 and retains its intentional privileged ordinary-fork
  fallback.

Other selected platform work

• Includes the accepted POSIX, VFS, networking, signal, SDK, browser,
  CI, dependency, audio, package, and documentation changes listed
  below.
• Makes package and worker validation hermetic and records exact
  ABI-bound fixture ownership.
• Retains the Homebrew migration boundary: ABI 42 finalizer fixtures
  stay explicit, while flat VFS names and identities are bound to their
  ABI.

Batched source PRs

This PR incorporates the selected work from every item below. Original
authors are retained in the conceptual commits.

1. host: call fpcast-emu'd pthread entry functions with the correct ABI #841 — Call fpcast-emulated pthread entries with the correct ABI.
2. [Kernel/POSIX] Distinguish terminals from character devices #1104 — Distinguish terminals from other character devices.
3. host vfs: synthesize POSIX permission bits for host mounts on Windows #965 — Synthesize POSIX permissions for Windows host mounts.
4. docs(agent-guidance): document fresh-worktree prerequisites for full validation #861 — Document fresh-worktree validation prerequisites.
5. Docs: Require purpose prefixes for PRs and commits #1013 — Require purpose-prefixed PR titles and commit subjects.
6. Fix live setup WebKit predicate #679 — Restrict WebKit reclaim handling to actual WebKit.
7. Avoid munmap mapping churn under SQLite pressure #720 — Avoid munmap() mapping-vector churn under SQLite pressure.
8. kernel: reject late reaped-process syscalls #761 — Reject late syscalls from reaped processes.
9. Deliver loopback UDP datagrams across processes on the same machine #855 — Deliver loopback UDP datagrams across processes.
10. Preserve descriptor identity through devfs aliases #876 — Preserve descriptor identity through devfs aliases.
11. SDK: preserve user linker order after platform glue #899 — Preserve executable linker input order after platform glue.
12. [POSIX] Keep directory streams usable when rewind fails #1063 — Keep directory streams usable when rewind fails.
13. [Host/Signals] Deliver caught signals before retrying waits #1129 — Deliver caught signals before retrying waits.
14. host: make pthread launch publication atomic #892 — Preserve atomic pthread launch publication.
15. Make desktop process state and lifecycle truthful #886 — Make desktop process state and lifecycle truthful.
16. Use dinit-backed VFS images for Node service demos #707 — Run Node service demos from shared dinit images.
17. xtask: repair 7 stale wasm-fixture tests and gate cargo test -p xtask #836 — Repair stale xtask fixtures and add the xtask CI gate.
18. ci: gate cargo test --workspace (minus xtask) over per-crate cargo suites (kd-i9oc) #846 — Gate the Rust workspace as one contract.
19. host: fix source-mode worker startup churn (esbuild-bundle the worker entry once) #857 — Bundle the source-mode worker entry once.
20. Add a declarative file-ingest capability for browser demos (with DOOM WAD upload) #869 — Add image-owned browser file ingest.
21. Bump the npm-security group across 1 directory with 1 update #870 — Update the mkrootfs esbuild security dependency.
22. Bump the npm-minor-patch group across 6 directories with 13 updates #1031 — Refresh minor and patch npm dependencies. The source PR is
    already closed; its selected changes remain in this batch.
23. Bump the npm-major group across 5 directories with 2 updates #1030 — Adopt Node 26 type definitions.
24. Move more host logic ownership into Rust #592 — Move additional host logic ownership into Rust.
25. audio: provide OSS-compatible /dev/dsp PCM playback #947 — Add process-safe OSS /dev/dsp PCM playback and consumers.
26. [Fork/ABI] Make fresh-instance replay activation-state safe #1096 — Make fresh-instance replay activation state safe. This was
    a draft source stack and is incorporated here for the coordinated
    ABI.
27. [Host/ABI] Make kernel scratch capacity explicit #1098 — Make kernel scratch capacity explicit. This was a draft
    source stack and is incorporated here for the coordinated ABI.

The batch also contains the Kandelo-owned ordinary-fork admission,
shared-memory replay, genuine vfork, upstream Ruby, ABI projection,
validation, and Homebrew ABI-boundary integration described above.

Conceptual commit inventory

73 commits that must be retained by rebase

1. Fork: Make replay activation state safe
2. Host: Rebuild replay references in fresh workers
3. Packages: Bind replay artifacts and rollout to ABI 43
4. Host: Bound kernel scratch transfers
5. Build: Make cached toolchain sysroots portable
6. Build: Materialize browser memory64 fixtures
7. Host: Complete kernel scratch ownership closure
8. Host: Publish and validate kernel scratch atomically
9. Host: Stop pumping relinquished TCP endpoints
10. Host: Run conformance on owned storage
11. Host: Reject shadowed session seeds
12. Host: Pin mutable executable bytes
13. Host: Reject saturated ordinary forks before cloning
14. Host: Retain exact shared memory aliases
15. Tests: Exercise fork admission through sealed authority
16. Fork: Borrow replay workers across main and side modules
17. Performance: Record affordable-fork design and replay evidence
18. Host: Call fpcast-emulated pthread entries correctly
19. POSIX: Distinguish terminals from character devices
20. Host: Synthesize POSIX permissions for Windows mounts
21. Docs: Document fresh-worktree validation prerequisites
22. Docs: Require purpose-prefixed PRs and commits
23. Browser: Restrict reclaim handling to WebKit
24. Performance: Avoid munmap mapping-vector churn
25. Kernel: Reject late reaped-process syscalls
26. Network: Deliver loopback UDP across processes
27. Kernel: Preserve descriptor identity through devfs aliases
28. SDK: Preserve executable linker input order
29. POSIX: Preserve directory streams when rewind fails
30. Host: Reflect ABI 43 modules from admitted bytes
31. Host: Deliver caught signals before retrying waits
32. Host: Ignore debug names while patching thread modules
33. Host: Finalize readiness timeouts through the kernel
34. Host: Run Node service demos from shared dinit images
35. CI: Repair xtask fixtures and gate xtask tests
36. CI: Gate the Rust workspace as one contract
37. Host: Reuse one bundled source worker entry
38. Browser: Add image-owned file ingest
39. Build: Update mkrootfs esbuild security release
40. Build: Refresh minor and patch npm dependencies
41. Build: Adopt Node 26 type definitions
42. Threads: Move clear-TID metadata into Rust
43. IPC: Move shared-memory attachment identity into Rust
44. Network: Move TCP listener selection into Rust
45. Timers: Move cleanup identity into Rust
46. Procfs: Record generated process snapshot schema
47. Readiness: Generate wakeup and multiplexing metadata
48. VFS: Generate ABI-bound host metadata
49. Docs: Record the Rust and host ownership boundary
50. Audio: Provide process-safe OSS PCM across both hosts
51. Browser: Expose machine-level PCM activation
52. Packages: Validate portable OSS consumers
53. ABI: Checkpoint the pre-vfork ABI 43 adapter
54. Homebrew: Keep Node smoke claims exact
55. Host: Retire old executable images through ABI markers
56. Host: Close lifecycle and kernel-authority seams
57. Packages: Checkpoint pre-vfork ABI 43 projections
58. Tests: Make integrated package and worker validation hermetic
59. Docs: Record the integrated ABI 43 batch boundary
60. ABI: Add an explicit vfork transaction mode
61. Vfork: Share memory while isolating child replay state
62. Vfork: Prove memory and fatal-child lifecycles
63. Vfork: Share inherited process and open-file state
64. Vfork: Prove compute-running child containment
65. Packages: Select pristine upstream Ruby vfork
66. Tests: Refresh ABI 43 vfork fixtures and consumers
67. Packaging: Support macOS Bash in workspace staging
68. Packages: Publish forced source resolves as local generations
69. Tests: Pin process-tool exec fixtures
70. Tests: Make libc spawn proof hermetic
71. Docs: Record ABI 43 vfork and validation evidence
72. Homebrew: Keep ABI 42 finalizer fixtures explicit
73. Homebrew: Bind flat VFS names and identities to their ABI

History and attribution

• Base: 8c19f577dcb2ef23855e4f5015847674fdd0d2b9 on main.
• Head: 7885a97ac78d5dc70612dd03dd69a1e43c47805c.
• The 73-commit history has zero merge commits and zero empty commits.
• The final tree is byte-identical to the saved 176-commit recovery tip:
  tree 2e3c97b1dff54356cd4ae319ae5532db42269f5b.
• The complete binary diff SHA-256 is identical on both histories:
  d118ec2f887c01a16059f53b25b8ed7713f15016fe3b11cb022d8a8cd648bb1e.
• Authorship is preserved: 69 Brandon Payton commits, three Dependabot
  commits, and one mho22 commit. Co-author trailers remain attached.
• Dated plan and measurement sections that name an older base, commit
  count, or individual pre-consolidation hash are historical
  checkpoints. This 73-commit inventory supersedes those history-only
  details; their measured tree and runtime evidence remains applicable.

Performance evidence and known risk

The component RSS harness shows why shared memory is the selected design
for a 256 MiB sparse parent:

• shared-memory worker growth: about 11.1 MiB;
• full clone growth: 496.344 MiB; and
• sparse clone growth: about 262.65 MiB, while taking 79 to 95 ms
  instead of about 35 ms for the full clone.

This is component evidence, not a Homebrew application RSS claim.

The batch also has a measured startup regression. A same-day pre-batch
build was 37 to 50 percent faster across four Node lifecycle metrics.
Empty-VFS measurements attribute roughly 39 to 42 percent slowdown to
the pre-vfork ABI 43 checkpoint, with vfork adding about 2.3 to 2.4
percent. The commits stay separate so that regression remains
bisectable. This PR makes no broad no-regression claim.

See
docs/measurements/2026-07-31-affordable-fork-then-exec.md
for the complete design, measurements, rejected alternatives, and
evidence.

Validation

Fresh validation on the exact PR tree used scripts/dev-shell.sh:

• bash scripts/check-abi-version.sh passed native, wasm32, and wasm64
  layouts; kernel exports; generated C and TypeScript bindings; the
  snapshot; and the ABI 42-to-43 bump.
• bash scripts/ci-run-test-suite.sh cargo-workspace passed, including
  1,522 kernel tests, four pointer-contract tests, 13 root-spill tests,
  48 shared-ABI tests, fork-instrument tests, and documentation tests.
• bash scripts/ci-run-test-suite.sh cargo-xtask passed 647 unit tests,
  one cache-root integration test, and two source-root integration
  tests.
• bash scripts/ci-run-test-suite.sh vitest passed 352 files and
  skipped 28; it recorded 4,307 passes, two expected failures, and 129
  skips.
  Its isolated upstream Ruby failed-exec, successful-exec, and
  privileged-fallback cases each passed, and its teardown supplement
  passed three tests.
• Focused Playwright vfork and Ruby tests passed in Chromium, Firefox,
  and WebKit: 19 passed and two intentional cross-engine skips.
• Every commit passed git diff-tree --check; the range has no merge,
  empty, or non-purpose-prefixed commits.

The committed measurement record also contains prior full libc, POSIX,
and Sortix runs after the runtime and vfork tree was complete and before
the final package and Homebrew metadata refreshes: libc 303 passed with
zero failures, POSIX 174 passed with zero failures, and Sortix 5,037
passed with zero failures. Expected failures and skips are itemized in
that document.

Remaining release gates

Opening this PR does not publish ABI 43 artifacts or merge any subsystem
change.
Candidate-ABI Homebrew bottle staging is being developed separately on
emdash/homebrew-complete-qk044 and remains a prerequisite for
publication.

Before declaring PR #1166 fully retired in released products, rebuild
and publish the exact pristine upstream Ruby and complete ABI 43 package
closure, construct the Homebrew image, and repeat the real in-guest
tap/install lifecycle with process-tree RSS evidence, no renderer loss,
and no unbounded memory growth. The full product browser and application
benchmark matrices must also run against that published closure without
an ABI 42 fallback.