Release v1.1.0: fix examples 009-FastCGIWeb AOT smoke (PATH_INFO exit 134 realloc)

[PurHur]

Context

./script/release-readiness.sh --full --json fails examples-aot-smoke on master (2026-07-09 release manager probe).

Quick gates also red on spine coverage (#17520 filed separately); this issue tracks the AOT smoke regression only.

Failure

• Gate: examples-aot-smoke
• Example: 009-FastCGIWeb
• Step: PATH_INFO request
• Symptom: exit 134 — realloc(): invalid next size

examples-aot-smoke: 009-FastCGIWeb: PATH_INFO exited 134 realloc(): invalid next size

Repro:

./script/docker-exec.sh -- bash -lc './script/examples-aot-smoke.sh --fastcgi-only'

Acceptance criteria

• ./script/docker-exec.sh -- bash -lc './script/examples-aot-smoke.sh' ends with examples-aot-smoke: ok
• ./script/docker-exec.sh -- bash -lc './script/release-readiness.sh --full --json' reports examples-aot-smoke: ok

Release tracking

• Roadmap: 🗺️ ROADMAP: Self-host + web-capable PHP subset (living) #78 (User release roadmap v1.1.0 → Gate checklist → examples AOT smoke)
• Prior fixes: Release v1.1.0: fix examples 000–009 AOT smoke (exit 139 on 000-HelloWorld phpc build) #15417, Release v1.1.0: fix examples 000–009 AOT smoke regression (001-SimpleWeb munmap_chunk) #12039, Release v1.1.0: fix examples 000–009 AOT smoke (exit 139 on 000-HelloWorld phpc build) #13571 (same gate, prior regressions)
• Target: v1.1.0 user release tag

[PurHur]

claim: cursor-agent-lane-c — starting this run

[PurHur]

Merged via #17554.

Fix: In-place TYPE_CONCAT (arg1 === arg2) now uses JitStringConcat::concat (fresh alloc) instead of __string__realloc after a stale left-pointer load — fixes heap corruption on multi-segment echo/?? chains.

Verification:

• FASTCGI_WEB_AOT_SMOKE_GATE=1 EXAMPLES_AOT_SMOKE_ONLY=009 ./script/examples-aot-smoke.sh → 009-FastCGIWeb: ok
• vendor/bin/phpunit --filter echo_concat_coalesce_aot → OK (2 tests)
• Repro: test/repro/maintainer_gap_echo_concat_coalesce_aot.php green on VM + AOT