fix(ci): green up all four CI platforms

- DateTime: compute the Unix-ns product in u64, not i64.
  DateTimeToUnixNs overflowed i64 for years > ~2262, and
  test_year_boundaries_sweep walks to 2550 -> SIGABRT under UBSan on the
  Linux sanitized job.

- TestRunner: author the AArch64 SetJmp/LongJmp as file-scope asm under
  GCC. GCC silently ignores __attribute__((naked)) on AArch64 (warns
  "'naked' attribute directive ignored") and emits a prologue that
  decrements SP, so the SP saved into the JmpBuf is wrong; LongJmp then
  restores it and every deadend test crashed in g_test_abort_jmp on the
  arm64 job. Clang honours naked (incl. macOS arm64), so that path is
  unchanged. GCC/AArch64 is Linux/ELF-only here, so no Mach-O underscore
  is needed. Verified red->green under qemu-aarch64.

- Socket: gate the IPv6 raw sockaddr byte check to PLATFORM_LINUX. macOS
  prefixes sin6_len and uses AF_INET6==30, Windows uses 23; the raw
  layout is Linux-specific (and mull, which the check feeds, runs on
  Linux). Fixes the macOS job.

- ArgParse: give the parser an output sink (ArgParse.out, default NULL =
  FileStderr()) so --help and error text is captured through the library's
  own File IO instead of OS-level stream redirection. The capture tests now
  point `out` at a FileOpenTemp file and read it back -- fully portable, so
  they compile and run identically on Linux, macOS and Windows. The old
  tests #include'd <unistd.h> and used pipe/dup2, which broke the Windows
  clang-cl/msvc build. No platform #if, no test gap across OSes.

Author: brightprogrammer

Include/Misra/Std/ArgParse.h

@@ -41,6 +41,7 @@
 #include <Misra/Std/Allocator.h>
 #include <Misra/Std/Container/Str.h>
 #include <Misra/Std/Container/Vec.h>
+#include <Misra/Std/File.h>
 #include <Misra/Std/Zstr.h>
 #include <Misra/Types.h>
 
@@ -128,12 +129,17 @@ extern "C" {
     /// `name`  -- shown as the program name in `--help` and errors.
     /// `about` -- one-line description at the top of `--help`. May be NULL.
     /// `alloc` -- where the `specs` Vec and any owned strings come from.
+    /// `out`   -- where `--help` and error text are written. NULL (the
+    ///            default) means `FileStderr()`; point it at any `File`
+    ///            (e.g. a `FileOpenTemp` handle) to capture the output
+    ///            portably, with no OS-level stream redirection.
     ///
     typedef struct ArgParse {
         Allocator *alloc;
         Zstr       name;
         Zstr       about;
         ArgSpecs   specs;
+        File      *out;
     } ArgParse;
 
     ///

Source/Misra/Std/ArgParse.c

@@ -312,7 +312,7 @@ static u64 spec_format_left(const ArgSpec *sp, Str *out) {
 }
 
 static void print_help(ArgParse *self) {
-    File err = FileStderr();
+    File err = self->out ? *self->out : FileStderr();
 
     if (self->about) {
         FWriteFmtLn(&err, "{} -- {}", self->name, self->about);
@@ -643,7 +643,7 @@ ArgRun ArgParseRun(ArgParse *self, int argc, char **argv) {
         VecPushBack(&self->specs, help);
     }
 
-    File err = FileStderr();
+    File err = self->out ? *self->out : FileStderr();
 
     bool rest_positional = false;
     u64  next_positional = 0;

Source/Misra/Std/DateTime.c

@@ -74,7 +74,7 @@ u64 DateTimeToUnixNs(DateTime dt) {
     i64 days      = days_from_civil(dt.year, dt.month, dt.day);
     i64 local_sec = days * SECS_PER_DAY + (i64)dt.hour * 3600 + (i64)dt.minute * 60 + (i64)dt.second;
     i64 utc_sec   = local_sec - (i64)dt.utc_offset_seconds;
-    return (u64)(utc_sec * NS_PER_SEC + (i64)dt.nanosecond);
+    return (u64)utc_sec * (u64)NS_PER_SEC + (u64)dt.nanosecond;
 }
 
 i32 DateTimeCompare(DateTime a, DateTime b) {

Tests/Std/ArgParse.Blind.c

@@ -4,43 +4,31 @@
 #include <Misra/Std/Zstr.h>
 #include <Misra/Std/ArgParse.h>
 #include <Misra/Std/Container/Str.h>
+#include <Misra/Std/File.h>
 #include <Misra/Std/Log.h>
 
-#include <unistd.h>
-
 #include "../Util/TestRunner.h"
 
 // ---------------------------------------------------------------------------
-// stderr capture: ArgParse writes errors / --help to fd 2 (FileStderr). To
-// assert error wording (which distinguishes several "both branches ERROR but
-// different message" mutants) we redirect fd 2 into a pipe, run, then drain.
-// pipe/dup/dup2/read are POSIX OS interfaces, allowed in tests.
+// ArgParse writes errors / --help to its output sink (`p->out`, default
+// FileStderr()). To assert error wording (which distinguishes several "both
+// branches ERROR but different message" mutants) we point the sink at a temp
+// file, run, then read it back. Fully portable -- no fd/handle redirection.
 // ---------------------------------------------------------------------------
 static ArgRun capture_run(ArgParse *p, int argc, char **argv, Str *out) {
-    int pipefd[2];
-    if (pipe(pipefd) != 0)
-        LOG_FATAL("capture_run: pipe failed");
-    int saved = dup(2);
-    if (saved < 0)
-        LOG_FATAL("capture_run: dup failed");
-    if (dup2(pipefd[1], 2) < 0)
-        LOG_FATAL("capture_run: dup2 failed");
-    close(pipefd[1]);
+    Str  tmp_path = StrInit(p->alloc);
+    File tmp      = FileOpenTemp(&tmp_path, p->alloc);
+    StrDeinit(&tmp_path);
+    if (!FileIsOpen(&tmp))
+        LOG_FATAL("capture_run: FileOpenTemp failed");
 
+    p->out    = &tmp;
     ArgRun rc = ArgParseRun(p, argc, argv);
+    p->out    = NULL;
 
-    dup2(saved, 2);
-    close(saved);
-
-    char buf[4096];
-    for (;;) {
-        long n = read(pipefd[0], buf, sizeof(buf));
-        if (n <= 0)
-            break;
-        for (long i = 0; i < n; ++i)
-            StrPushBackR(out, buf[i]);
-    }
-    close(pipefd[0]);
+    FileSeek(&tmp, 0, FILE_SEEK_SET);
+    FileRead(&tmp, out);
+    FileClose(&tmp);
     return rc;
 }
 

Tests/Std/ArgParse.Mut.c

@@ -12,45 +12,31 @@
 #include <Misra/Std/Io.h>
 #include <Misra/Std/Log.h>
 
-#include <unistd.h>
-
 #include "../Util/TestRunner.h"
 
 // ---------------------------------------------------------------------------
-// --help capture: print_help writes the usage table to fd 2 (FileStderr).
-// Redirect fd 2 into a pipe, run --help, drain the pipe back into a Str.
-// (Same technique the existing ArgParse.c suite uses.)
+// --help capture: point the parser's output sink at a temp file (`p->out`),
+// run --help, then read the file back. Fully portable -- the `File`
+// abstraction handles the platform difference, no fd/handle redirection.
 // ---------------------------------------------------------------------------
 static void capture_help(ArgParse *p, Str *out) {
-    int pipefd[2];
-    if (pipe(pipefd) != 0)
-        LOG_FATAL("capture_help: pipe failed");
-
-    int saved = dup(2);
-    if (saved < 0)
-        LOG_FATAL("capture_help: dup failed");
-    if (dup2(pipefd[1], 2) < 0)
-        LOG_FATAL("capture_help: dup2 failed");
-    close(pipefd[1]);
+    Str  tmp_path = StrInit(p->alloc);
+    File tmp      = FileOpenTemp(&tmp_path, p->alloc);
+    StrDeinit(&tmp_path);
+    if (!FileIsOpen(&tmp))
+        LOG_FATAL("capture_help: FileOpenTemp failed");
 
+    p->out        = &tmp;
     char  *argv[] = {(char *)"prog", (char *)"--help"};
     ArgRun rc     = ArgParseRun(p, 2, argv);
-
-    dup2(saved, 2);
-    close(saved);
+    p->out        = NULL;
 
     if (rc != ARG_RUN_HELP)
         LOG_FATAL("capture_help: expected ARG_RUN_HELP, got {}", (int)rc);
 
-    char buf[4096];
-    for (;;) {
-        long n = read(pipefd[0], buf, sizeof(buf));
-        if (n <= 0)
-            break;
-        for (long i = 0; i < n; ++i)
-            StrPushBackR(out, buf[i]);
-    }
-    close(pipefd[0]);
+    FileSeek(&tmp, 0, FILE_SEEK_SET);
+    FileRead(&tmp, out);
+    FileClose(&tmp);
 }
 
 static bool help_equals(ArgParse *p, Zstr expected) {

Tests/Std/ArgParse.c

@@ -6,8 +6,6 @@
 #include <Misra/Std/Io.h>
 #include <Misra/Std/Log.h>
 
-#include <unistd.h>
-
 #include "../Util/TestRunner.h"
 
 // ----------------------------------------------------------------------------
@@ -603,47 +601,33 @@ static bool test_help_returns_help_code(void) {
 // ===========================================================================
 
 // ---------------------------------------------------------------------------
-// print_help writes its usage table straight to fd 2 (FileStderr). To
-// assert the EXACT layout -- column alignment, padding width, section
-// order, separators -- we redirect fd 2 to a pipe, run
-// ArgParseRun(--help), then drain the pipe back into a Str. pipe / dup /
-// dup2 / read are OS interfaces (POSIX), not libc, so they are allowed
-// in MisraStdC tests.
+// To assert the EXACT --help layout -- column alignment, padding width,
+// section order, separators -- we point the parser's output sink (`p->out`)
+// at a temp file, run ArgParseRun(--help), then read the file back. Fully
+// portable: the `File` abstraction handles the platform difference, so the
+// test needs no fd/handle redirection.
 //
 // ArgParseRun appends a synthetic "-h, --help  print this help" FLAG
 // spec before printing, so every captured help text ends with that row.
 // ---------------------------------------------------------------------------
 static void capture_help(ArgParse *p, Str *out) {
-    int pipefd[2];
-    if (pipe(pipefd) != 0)
-        LOG_FATAL("capture_help: pipe failed");
-
-    int saved = dup(2);
-    if (saved < 0)
-        LOG_FATAL("capture_help: dup failed");
-    if (dup2(pipefd[1], 2) < 0)
-        LOG_FATAL("capture_help: dup2 failed");
-    close(pipefd[1]);
+    Str  tmp_path = StrInit(p->alloc);
+    File tmp      = FileOpenTemp(&tmp_path, p->alloc);
+    StrDeinit(&tmp_path);
+    if (!FileIsOpen(&tmp))
+        LOG_FATAL("capture_help: FileOpenTemp failed");
 
+    p->out        = &tmp;
     char  *argv[] = {(char *)"prog", (char *)"--help"};
     ArgRun rc     = ArgParseRun(p, 2, argv);
-
-    // Restore the real stderr before draining so later logging is sane.
-    dup2(saved, 2);
-    close(saved);
+    p->out        = NULL;
 
     if (rc != ARG_RUN_HELP)
         LOG_FATAL("capture_help: expected ARG_RUN_HELP, got {}", (int)rc);
 
-    char buf[4096];
-    for (;;) {
-        long n = read(pipefd[0], buf, sizeof(buf));
-        if (n <= 0)
-            break;
-        for (long i = 0; i < n; ++i)
-            StrPushBackR(out, buf[i]);
-    }
-    close(pipefd[0]);
+    FileSeek(&tmp, 0, FILE_SEEK_SET);
+    FileRead(&tmp, out);
+    FileClose(&tmp);
 }
 
 static bool help_equals(ArgParse *p, Zstr expected) {
@@ -895,34 +879,19 @@ static bool test_a1_render_cap_is_64(void) {
 // width) are then asserted.
 // ----------------------------------------------------------------------------
 
-// Run --help with stderr redirected into `out`. Returns true on a clean
-// capture. The captured help text (whole stderr stream) lands in `out`.
-// (Tempfile-based variant; the pipe-based capture_help above is kept
-// under its own name.)
+// Run --help with the parser's output sink pointed at a temp file, then
+// read it back into `out`. Returns true on a clean ARG_RUN_HELP capture.
 static bool capture_help_file(ArgParse *p, Str *out) {
     Str  tmp_path = StrInit(p->alloc);
     File tmp      = FileOpenTemp(&tmp_path, p->alloc);
     StrDeinit(&tmp_path);
     if (!FileIsOpen(&tmp))
         return false;
 
-    int saved = dup(2);
-    if (saved < 0) {
-        FileClose(&tmp);
-        return false;
-    }
-    if (dup2(tmp.fd, 2) < 0) {
-        close(saved);
-        FileClose(&tmp);
-        return false;
-    }
-
+    p->out        = &tmp;
     char  *argv[] = {(char *)"prog", (char *)"--help"};
     ArgRun rc     = ArgParseRun(p, 2, argv);
-
-    // Restore stderr before doing anything that might write to it.
-    dup2(saved, 2);
-    close(saved);
+    p->out        = NULL;
 
     bool ok = (rc == ARG_RUN_HELP);
     FileSeek(&tmp, 0, FILE_SEEK_SET);

Tests/Std/Socket.c

@@ -807,8 +807,13 @@ bool test_sk3_parse_ipv6_fields(void) {
     ok            = ok && addr.length == 28u; // sizeof(struct sockaddr_in6)
 
     // raw[0..1] is sin6_family (Linux: u16 host order at offset 0).
-    // AF_INET6 == 10. A mutation to 42 changes this byte.
+    // AF_INET6 == 10. A mutation to 42 changes this byte. The raw byte
+    // layout (offset, width, AF_INET6 value) is Linux-specific -- macOS
+    // prefixes sin6_len and uses AF_INET6==30, Windows uses 23 -- so this
+    // check is gated to Linux, which is also the only platform mull runs on.
+#if PLATFORM_LINUX
     ok = ok && addr.raw[0] == 10u && addr.raw[1] == 0u;
+#endif
 
     Str s = SocketAddrFormat(&addr, a);
     ok    = ok && StrLen(&s) > 0 && ZstrCompare(StrBegin(&s), "[2001:db8::1]:443") == 0;

Tests/Util/TestRunner.c

@@ -160,9 +160,10 @@ __attribute__((naked, used, noreturn)) static void LongJmp(JmpBuf env, int val)
         "1: jmpq *56(%rdi)\n"
     );
 }
-#elif (PLATFORM_LINUX || PLATFORM_DARWIN) && ARCHITECTURE_AARCH64
+#elif (PLATFORM_LINUX || PLATFORM_DARWIN) && ARCHITECTURE_AARCH64 && defined(__clang__)
 // AAPCS64: 1st arg in X0, 2nd arg in X1. Callee-saved scalars:
-// X19-X28, X29 (fp), X30 (lr). Plus SP.
+// X19-X28, X29 (fp), X30 (lr). Plus SP. Clang honours `naked` on
+// AArch64, so the asm body is emitted verbatim with no prologue.
 __attribute__((naked, used)) static int SetJmp(JmpBuf env) {
     __asm__(
         "stp x19, x20, [x0,  #0]\n"
@@ -194,6 +195,52 @@ __attribute__((naked, used, noreturn)) static void LongJmp(JmpBuf env, int val)
         "1: ret\n"
     );
 }
+#elif (PLATFORM_LINUX || PLATFORM_DARWIN) && ARCHITECTURE_AARCH64
+// GCC silently IGNORES `__attribute__((naked))` on AArch64 (it warns
+// `'naked' attribute directive ignored` and emits a real
+// prologue/epilogue). That prologue does `stp x29,x30,[sp,#-16]!`, so
+// the SP this routine hands back in the JmpBuf is 16 bytes below the
+// caller's frame; `LongJmp` then restores that bad SP and the unwound
+// frame is corrupt -- under ASan it lands in a guard page (the
+// `SEGV in g_test_abort_jmp` seen on the arm64 CI). Authoring the pair
+// as file-scope asm sidesteps `naked` entirely: top-level asm is never
+// wrapped in a prologue by any compiler. GCC/AArch64 only ever targets
+// Linux/ELF here (Darwin uses Clang, handled above), so the symbols
+// need no Mach-O underscore prefix.
+int  SetJmp(JmpBuf env);
+void LongJmp(JmpBuf env, int val) __attribute__((noreturn));
+
+__asm__(
+    ".text\n"
+    ".p2align 2\n"
+    ".globl SetJmp\n"
+    "SetJmp:\n"
+    "    stp x19, x20, [x0,  #0]\n"
+    "    stp x21, x22, [x0, #16]\n"
+    "    stp x23, x24, [x0, #32]\n"
+    "    stp x25, x26, [x0, #48]\n"
+    "    stp x27, x28, [x0, #64]\n"
+    "    stp x29, x30, [x0, #80]\n"
+    "    mov x1, sp\n"
+    "    str x1,       [x0, #96]\n"
+    "    mov w0, #0\n"
+    "    ret\n"
+    ".p2align 2\n"
+    ".globl LongJmp\n"
+    "LongJmp:\n"
+    "    ldp x19, x20, [x0,  #0]\n"
+    "    ldp x21, x22, [x0, #16]\n"
+    "    ldp x23, x24, [x0, #32]\n"
+    "    ldp x25, x26, [x0, #48]\n"
+    "    ldp x27, x28, [x0, #64]\n"
+    "    ldp x29, x30, [x0, #80]\n"
+    "    ldr x2,       [x0, #96]\n"
+    "    mov sp, x2\n"
+    "    mov w0, w1\n"
+    "    cbnz w0, 1f\n"
+    "    mov w0, #1\n"
+    "1:  ret\n"
+);
 #endif
 
 // Global jump buffer for capturing aborts