[PHP] vfs: resolve pathname components across mounts

[brandonpayton]

Summary

Replace the unsafe lexical cwd-only fix with a component-wise global namespace resolver used before backend routing. Pathname syscalls now preserve symlink, ./.., missing-component, trailing-slash, mount-boundary, procfs/devfs, and AF_UNIX semantics instead of normalizing the input spelling before lookup.

This constituent is stacked on the open PHP platform aggregate, PR #871. It must not land independently on main; its syscall-visible semantic change remains covered by the aggregate ABI reconciliation and full gate.

Review of the original PR

The original commit (429390c8d) was not safe to replay. It validated one pathname and then lexically collapsed .., which can store a cwd different from the directory actually reached through a symlink. The same approach also broke missing/.., regular/., trailing slashes, VFS mount crossings, virtual namespaces, AF_UNIX registry aliases, and initial process cwd. The original commit was replaced, not retained as a misleading permanent intermediate commit.

Reviewed replacement

Replacement source commit: cc579aabb

• Walk pathname components in the kernel's global namespace before selecting a host or synthetic backend.
• Follow relative and absolute symlinks across mounts with a 40-link limit; preserve missing-component and trailing-directory error behavior.
• Apply the resolver to ordinary and *at() pathname syscalls, cwd, realpath, statfs, exec paths, and AF_UNIX bind/connect/send paths.
• Keep kernel-owned /proc and /dev names from falling through to hidden host entries while preserving the writable /dev/shm mount.
• Store canonical global paths in cwd, OFDs, directory streams, and AF_UNIX registrations; re-key pathname sockets after rename.
• Validate initial cwd through the same syscall path after installing child credentials, surface its errno to Node/browser hosts, and unregister a partially created process when startup fails.
• Add kernel regressions plus a reusable guest probe exercised by Node and Chromium.
• Document the remaining pathname-backed cwd/dirfd identity limitation instead of claiming inode identity after rename or unlink.

Remaining boundaries

• Cwd and directory OFDs retain canonical pathnames, not stable directory identities. Rename/unlink followed by recreation can therefore redirect later getcwd, fchdir, or dirfd-relative behavior.
• /proc/<pid>/fd/N magic links preserve final metadata but do not yet provide full OFD-identity traversal.
• The legacy custom opendir stream API returns EOPNOTSUPP for synthetic procfs/devfs directories; normal open(O_DIRECTORY) plus getdents64 remains the supported path.

Validation on the reviewed tree

Run through scripts/dev-shell.sh unless noted:

• cargo test -p kandelo --target aarch64-apple-darwin --lib — 1,102 passed, 0 failed.
• cd host && npm run build — passed (ESM/CJS/type declarations built; existing import.meta CJS warnings only).
• bash scripts/check-abi-version.sh — passed; structural snapshot and generated bindings are in sync.
• cd host && npx vitest run test/node-host-mounts.test.ts — 12 passed, 0 failed, including cross-mount component resolution and both invalid-initial-cwd cleanup cases.
• Isolated Chromium probe — 1 passed, 0 failed.
• ./run.sh --fetch-only browser --host 127.0.0.1 --port 54742 --strictPort prepared the canonical browser path and launched Vite; the same Chromium probe against that live server passed 1/1.
• git diff --check — clean.

The full host, libc, POSIX, Sortix, PHPT, and aggregate ABI/version gate remain intentionally deferred to PR #871's one ready-to-merge run.

Recommendation

Accept into PR #871. The replacement fixes a real platform-level pathname defect with Node/browser parity and truthful documented limits. Do not ship it independently or merge the aggregate until the aggregate ABI reconciliation is redesigned against the then-current main ABI and the full batch gate passes.