feat(platform): add full Windows x86_64 PE32+ cross-compilation support

[Guikingone]

Closes #379.

Summary

This pull request adds an experimental windows-x86_64 backend that produces
standalone PE32+ executables and brings the compiler, runtime, bridge crates,
Magician/eval, TLS, and web mode onto native Windows validation paths.

The implementation uses the GNU/MinGW Windows ABI. The accepted
x86_64-pc-windows-msvc spelling is a CLI compatibility alias only; it does not
claim MSVC ABI output. The branch is rebased on the current main and remains
one squashed commit. Windows stays experimental until every strict gate below
is green on the same revision.

What is included

Target, PE/COFF, and toolchain support

• Adds windows-x86_64 / x86_64-pc-windows-gnu target selection.
• Emits and links x86-64 PE/COFF executables through MinGW-w64.
• Supports an opt-in Clang integrated-assembler + LLD path while retaining the
  GNU Windows ABI.
• Emits PE startup/runtime data for argc/argv, process exit, exceptions,
  callbacks, fibers, refcounted values, unwind records, and loader mitigations.
• Runs the compiler pipeline on a dedicated 64 MiB Windows worker stack.
• Cross-builds and discovers GNU/COFF bridge archives even when the compiler is
  running under Rust's native MSVC host toolchain.
• Keeps Control Flow Guard disabled until indirect-call instrumentation, GFIDS,
  and the PE load-configuration directory can be emitted as one validated unit.

Windows ABI and runtime

• Centralizes the boundary between elephc's internal runtime-helper convention
  and Microsoft x64 ABI imports, including shadow space, integer/floating
  register classes, stack arguments, variadics, callbacks, and indirect calls.
• Adds Win32/CRT/Winsock implementations for memory, Unicode filesystem paths,
  metadata, directory iteration, streams, processes, clocks, entropy, sockets,
  DNS, synchronization, and console/file I/O.
• Implements PHP-compatible Windows realpath/stat/lstat/fstat
  metadata, readonly/link/executable modes, reparse-point probing, dangling
  symlinks, tempnam, tmpfile, loopback socketpair, stream_isatty, and
  stream timeout behavior.
• Opens canonicalization handles with compatible sharing, follows symbolic
  links through GetFinalPathNameByHandleW, materializes all seven
  CreateFileW arguments in their exact MSx64 slots (including directory
  backup semantics), and avoids issuing reparse-point control requests for
  ordinary files and directories.
• Matches PHP's tempnam() contract for prefix basenames, Windows path
  separators, the 63-byte prefix limit, and the false failure sentinel.
• Keeps chown()/chgrp() visible with Windows failure semantics while
  omitting lchown()/lchgrp() exactly as php-src does without HAVE_LCHOWN.
  Direct calls, namespace fallback, user redeclarations, first-class callables,
  dynamic dispatch, Reflection, eval, function_exists(), and is_callable()
  all use the same target-aware catalog.
• Supports PHP's full fopen base-mode and suffix surface, Windows
  temporary-file deletion, complete 64-bit Winsock handles, and the correct
  close order for filters, TLS sessions, stream state, CRT descriptors, and
  sockets.
• Preserves stream payloads and arguments across Windows slot lookups in
  ordinary I/O and zlib, bzip2, iconv, and user-filter paths; fseek() and
  rewind() use the same handle mapping.
• Preserves user-filter instances across Windows slot allocation so
  onCreate, filter callbacks, parameters, and onClose use the same object.
• Uses the MinGW LLP64 z_stream layout and 32-bit uLong fields for one-shot
  zlib operations, and recognizes PHP's exact uppercase INF, -INF, and
  NAN serialized float tokens before falling back to MSVCRT strtod.
• Normalizes Windows verbatim canonical paths before exposing __FILE__,
  __DIR__, closure names, and EIR source metadata.
• Uses native Winsock protocol/service lookup and advertises only transports
  the runtime can negotiate; Windows omits Unix-domain transports and all
  targets omit unavailable SSLv2/SSLv3 aliases.
• Widens signed 32-bit CRT long results before 64-bit consumers and derives
  PHP_EOL, DIRECTORY_SEPARATOR, and PATH_SEPARATOR from the target.

Processes, shell behavior, eval, and web

• Implements Windows proc_open() descriptor inheritance and sparse
  descriptor behavior, proc_close(), proc_terminate(), and
  proc_get_status(). Windows reports cached: false, while Unix preserves
  PHP's post-exit cached transition.
• Polls nonblocking process pipes with php-src's bounded wait and caps
  synchronous reads to the bytes reported by PeekNamedPipe, preventing both
  startup races and accidental blocking.
• Accepts PHP command arrays with associative or numeric keys in insertion
  order, ignores the keys like php-src, and preserves raw numeric environment
  entries while skipping empty converted values.
• Matches php-src's Windows shell escaping behavior and preserves arguments
  correctly through CRT argv construction.
• Extends Magician/eval parity for filesystem, process, shell, network,
  randomness, time, string, callable, and target-specific builtin behavior.
• Exercises --web as a PE program with exported ABI validation, HTTP
  success/error responses, Ctrl-C shutdown, watchdog termination, and clean
  --max-requests exit.

TLS and stream contexts

• Cross-builds and validates the Rust TLS bridge on native and cross Windows
  paths.
• Loads Windows native certificate roots by default so administrator-installed
  and enterprise trust anchors remain visible; other targets retain the
  deterministic bundled root set.
• Uses bridge ABI v3 with a stable 88-byte ElephcTlsClientOptions structure
  (options layout ABI v1) shared by HTTPS connects and STARTTLS attachment.
• Implements independent PHP stream-context policies for verify_peer,
  verify_peer_name, and allow_self_signed, plus peer_name, additive
  cafile/capath, and combinable local_cert/local_pk.
• Treats local_pk as optional when the key is present in local_cert, and
  ignores local_pk without a client certificate, matching php-src.
• Restricts allow_self_signed to a valid depth-zero genuinely self-signed
  leaf. It never accepts an arbitrary untrusted leaf, never bypasses hostname
  validation, and always verifies TLS 1.2/1.3 handshake signatures.
• Applies PHP boolean truthiness to stream-context options (0 and "0" are
  false; any other non-zero integer is true).
• Distinguishes an omitted/null STARTTLS crypto method from an explicit zero,
  enforces supported TLS 1.2/1.3 client masks, and reuses the source TLS
  configuration/session cache when session_stream is provided.
• Completes HTTPS request and tempfile writes across partial I/O, maps rustls's
  terminal UnexpectedEof read to the same response EOF behavior php-src
  enables through SSL_OP_IGNORE_UNEXPECTED_EOF, and rejects oversized,
  truncated, or unrewindable response streams with balanced handle cleanup.
• Validates Unix file descriptors and Winsock sockets before adopting them into
  Rust, preserving retryable WouldBlock/TimedOut results without marking
  streams as EOF.

Final php-src audit

The implementation was audited against the current official php-src Windows,
stream, TLS, process, shell, and filesystem paths:

• win32/ioutil.c
• win32/sockets.c
• win32/build/config.w32.h.in
• main/streams/xp_socket.c
• main/streams/plain_wrapper.c
• main/php_open_temporary_file.c
• ext/standard/streamsfuncs.c
• ext/standard/filestat.c
• ext/standard/proc_open.c
• ext/standard/exec.c
• ext/openssl/xp_ssl.c

The last comparison found and closed the remaining gaps around native Windows
trust roots, TLS policy independence and true self-signed handling, client key
fallback, STARTTLS crypto-method/session propagation, complete HTTPS I/O,
target-aware lchown/lchgrp visibility, namespace and callable resolution,
tempnam() failure/prefix semantics, proc_open() command/environment
marshalling, proc_get_status().cached, shell escaping, stream-filter register
preservation and object lifetime, bounded process-pipe reads, LLP64 zlib
layout, serialized non-finite floats, loopback socket-pair fixtures,
canonical-path sharing/reparse handling, terminal TLS EOF, Windows stream
seeking, deterministic process-filter line endings, and target-path
normalization. The resulting CI investigation also
closed an AArch64 runtime-callable stack-padding regression without changing
the Windows shadow-space contract, and split a redundant composite eval
failure-path regression into focused cases so each native scenario retains its
own timeout budget.

The audit also removed the obsolete Wine allow-list/known-failures snapshots
and their exemption commands. The retained aggregate verifier accepts only
exact native shard coverage with no failing testcase, validates the expected
JUnit report count inside the verifier, and emits an explicit cardinality
diagnostic instead of counting CLI argument tokens in the workflow shell.

What the first full CI run exposed

Earlier runs on this branch had all been cancelled, so the complete matrix had
never seen this code. The first full run returned 14 red checks across 6
distinct defect classes. Every one is fixed in this revision, and each was
visible on exactly one platform while the others hid it:

defect	failed only on	what hid it elsewhere
mod zval; dropped by the merge resolution	Linux + macOS (link)	nothing — an undeclared module is absent, not dead, so no warning is possible
sprintf missing the ll length modifier	linux-x86_64	no fixture exercised a value above 2³²
sprintf overflow re-render losing its variadic	linux-aarch64	Apple's ABI passes every variadic on the stack, so the stack copy sufficed
random_int losing its min bound	Windows	a bare syscall clobbers only rcx/r11; the Windows rewrite turns it into a call, which destroys r9
POSIX-only test fixtures	Windows	—
fclose() on a TLS stream faulting	linux-x86_64	this path had never run in CI at all (#[ignore], outbound network)

The TLS fault was the last to close and was not where it appeared to be. Connect,
write, and reads all succeed on x86-64; only closing failed. On that target the
descriptor lives in rax while __rt_user_filter_release_fd reads it from rdi,
and lower_fclose was the one call site in the function that did not stage the
argument. It worked by accident, because the TLS teardown's own map lookup leaves
the descriptor in rdi — but only while it finds no session to close. Once it does,
it loads the session handle into rdi and calls the bridge, and the Rust close
leaves rdi holding whatever it likes; the filter table was then indexed with that
value. AArch64 was unaffected because it passes the argument in x0, which the
teardown restores.

Two further defects were found while investigating the above and are fixed here:

• __rt_fread and stream_get_contents wrote past the end of the fixed 64 KiB
  concat arena. The returned bytes were correct — read back from the overflowed
  region — while whatever followed the buffer was destroyed, so the observable
  casualty changed from program to program. Reads that do not fit now take an owned
  block, sized from what the stream can actually supply rather than from the
  requested length, since fread($f, $n) reads up to $n bytes.
• microtime(true) returned a value roughly 2000× too large on macOS. Darwin's
  gettimeofday trap returns 0 without filling the caller's timeval, and
  suseconds_t is 32 bits there; both are now handled.

CI and acceptance gates

Cross-compilation gate

Windows PE Cross-Compile Tests and the independent Windows PE LLVM/LLD Tests run on Ubuntu with MinGW-w64 and Wine. Together they:

• build warning-free;
• cross-build all supported Windows bridge archives;
• verify the GNU and opt-in Clang integrated-assembler/LLD toolchain paths;
• run the dedicated PE integration tests; and
• compile, inspect, and execute representative PHP programs as PE32+
  binaries.

Native bridge gate

Windows Native PE & Bridge Tests runs on Windows Server 2025. It:

• builds and tests bridge crates with the native MSVC Rust host;
• cross-builds their GNU/COFF archives;
• verifies every exported C ABI symbol;
• runs the complete windows_pe integration module; and
• validates native bridge, eval, TLS, and web behavior.

Strict native codegen gate

The runnable ci-profile codegen inventory is split into 16 deterministic
partitions and executed directly on Windows Server 2025. There is no allowlist
or known-failure exemption: each runnable fixture must appear exactly once and
every shard must succeed. The aggregate Windows gates are required by the
top-level Build & Test job.

The same top-level gate explicitly waits for both ordinary and Magician/eval
codegen matrices on macOS AArch64, Linux x86_64, and Linux AArch64, so a
separately sharded eval failure cannot be hidden behind a green aggregate.

Validation

The complete CI matrix is green on this revision: 123 jobs, no failures, across
macOS AArch64, Linux x86-64, Linux AArch64, and native Windows Server 2025, including
all 16 strict native codegen shards, both eval matrices, and the aggregate gates.

Focused local validation performed during development includes:

• 135 Windows-specific library tests;
• focused magic-constant, process, TLS, stream, eval, ownership, and PE/Wine
  regressions;
• MinGW assembly/link and PE inspection of representative programs;
• bridge export and multi-archive link validation;
• focused supported-target regressions discovered by CI;
• oracle comparison against php 8.5.6 for every behavioural fix above, plus
  execution of the affected fixtures as PE32+ binaries under Wine; and
• post-rebase Cargo metadata validation, assembly-comment validation,
  git diff --check, ancestry, squash, and unmerged-file checks.

Closing the disclosed gaps

The four items previously disclosed here have been worked through; what changed and what
did not is recorded below rather than quietly dropped.

Windows ACLs behind is_readable() / is_writable() — closed. __rt_sys_access was
GetFileAttributesW-only, and its own docblock admitted that "R_OK succeeds whenever the
path exists". It now performs php-src's check from TSRM/tsrm_win32.c: a cached
impersonation token, GetFileSecurityW, MapGenericMask, then AccessCheck, with php's
exact FILE_GENERIC_READ / FILE_GENERIC_WRITE masks. advapi32 joins both the
production and test-harness link sets.

The check fails open by construction. Every failure — no token, a failed security
query, a descriptor larger than the inline buffer, a failed AccessCheck — returns a
sentinel that the gate treats exactly like "granted", so the DACL verdict can only ever
turn a yes into a no and never invents a denial. That matters more than it sounds: a
fail-closed design would make is_readable() return false for every path, permanently and
invisibly, under a restricted token (a service, AppContainer, or low integrity). The
worst case here equals the previous behaviour.

Reaching that guarantee required dropping the heap from the path entirely. An earlier
draft allocated the security descriptor and treated a null return as its fallback, but
__rt_heap_alloc never returns null — it diverges through __rt_heap_exhausted, which on
Windows issues Linux syscall numbers that neither print nor exit before falling off the end
of the helper. The fallback branch was unreachable. The descriptor now lives in a
fixed-size stack buffer, and an oversized descriptor takes the same fail-open path.

_elephc_web_handler non-volatile registers — closed. The handler is an
extern "C" fn() the bridge's Rust server loop calls directly, so it owes that caller the
platform's callee-saved contract; the register allocator does not discharge it, because its
pools deliberately exclude the registers involved (AArch64 allocates x21-x28, x86_64 only
rbx). abi::nested_call_reg hands out x19 and r12 regardless, hand-written runtime routines
use r14/r15 as scratch, and float spills stage through xmm15. The handler now preserves
those itself, plus rdi/rsi and xmm6-xmm15 on Windows, where MSx64 makes them callee-saved
and elephc's SysV-internal convention treats them as scratch. AArch64 was violating the same
contract through x19 and is fixed with it.

Oversized-read heap blocks — closed for fread(). This needed two independent
omissions, which is why fixing either alone measured as no change at all. The EIR already
emitted a release for these values and the backend discarded it, because
value_is_scratch_string treats any non-Fresh runtime call as arena scratch; and the
block carried heap kind 0, which every __rt_decref_any in the runtime's own read paths
skips as raw. Arena slices stay safe under the release: _concat_buf and _heap_buf are
separate .comm objects, so an arena pointer can never satisfy __rt_heap_free_safe's
managed-heap window test, making the discrimination exact rather than heuristic.

Still open: a stream_get_contents() result boxed into a Mixed cell strands its grown
accumulation buffer. __rt_mixed_from_value copies the bytes out, so the original block is
orphaned before any release refers to it. That belongs to the boxing path.

Marginal eval fixtures — closed. Two fixtures that compile and link a PHP program at
run time sat against the global 60s slow-timeout. They now carry the same documented
per-test override the four heavier fixtures above them already use.

Known gaps

• A stream_get_contents() result boxed into a Mixed cell still strands its accumulation
  buffer, as described above.
• __rt_heap_exhausted does not terminate correctly on Windows: it issues Linux syscall
  numbers, so heap exhaustion falls off the end of the helper rather than reporting and
  exiting. Pre-existing and independent of this branch's work; found while reviewing the
  ACL fallback and worth fixing on its own.

Promotion criteria

Windows can move into the first-class supported-target matrix only when one
revision satisfies all of the following:

• all 16 strict native codegen shards and the exact-coverage aggregate are
  green;
• native PE, bridge, Magician/eval, TLS, and web suites are green;
• GNU and LLVM/LLD cross-toolchain probes are green;
• PHP's Windows-specific behavior has been audited against php-src; and
• no Windows path silently reports success for unsupported behavior or retains
  reduced semantics that the project claims to support.

On this revision the first three are met, and the php-src audit is recorded above.
The last is not: is_readable()/is_writable() still ignore Windows ACLs, which is
exactly the kind of reduced semantics that criterion exists to catch. Promotion is
the maintainer's call, and this branch does not claim it — documentation and
diagnostics continue to label the target experimental.