Stdlib: move_uploaded_file for VM (multipart upload reference apps)

[PurHur]

Problem

#87 closed with nested $_FILES population from multipart bodies (#52), but there is no move_uploaded_file() implementation in ext/standard/ or VM builtins (repo grep is empty).

#1999 (006-FileUploadWeb) can echo $_FILES['doc']['name'] without this, but a credible upload demo needs to persist the temp part to uploads/ safely.

Goal

if (move_uploaded_file($_FILES['doc']['tmp_name'], '/var/app/uploads/doc.pdf')) {
    echo 'saved';
}

works in VM + phpc serve + AOT CGI refresh path when multipart env is set.

Scope

Piece	Deliverable
VM builtin	ext/standard/file.php or dedicated upload helper
Temp path policy	Only accept paths under parser temp dir from #52
Security	Reject .., absolute escapes; document max size tie-in #77
JIT	Defer — VM + compliance PHPT first
AOT	Runtime builtin or VM fallback until JIT lands
Tests	test/compliance/cases/stdlib/move_uploaded_file.phpt

Implementation hints

Layer	Files	Notes
Parser temp files	lib/Web/Superglobals.php	$_FILES[..]['tmp_name'] from multipart parts
Builtin	ext/standard/*.php, lib/VM.php dispatch	Mirror Zend subset semantics
Capabilities	script/capability-matrix.php	Row for web upload apps
Example	examples/006-FileUploadWeb/	Optional save path behind flag

Acceptance criteria

./phpc run -r '/* synthetic $_FILES + temp — see PHPT */'
./script/ci-fast.sh --filter move_uploaded_file

phpc serve multipart POST + move_uploaded_file returns success HTML.

Verification (local / Docker only)

make docker-build-22
./script/docker-ci-local.sh --filter move_uploaded

No GitHub Actions.

Dependencies

• Web: multipart/form-data and application/json POST bodies #52 ✅ multipart POST
• Web: $_FILES population and move_uploaded_file subset #87 ✅ $_FILES shape
• Examples: 006-FileUploadWeb — multipart $_FILES reference + AOT execute smoke #1999 — reference example (can ship echo-only first)

Links

• ROADMAP 🗺️ ROADMAP: Self-host + web-capable PHP subset (living) #78 Phase 2 Stdlib / Phase 4 Examples: 006-FileUploadWeb — multipart $_FILES reference + AOT execute smoke #1999

[PurHur]

Unblocked for implementation — #1999 closed

#1999 / #2008 shipped examples/006-FileUploadWeb/ as echo-only ($_FILES['doc']['name'] + size). This issue is the next measurable step for a credible upload demo (persist temp part to uploads/).

Suggested order: VM builtin + compliance PHPT first → optional 006 README flag → JIT/AOT defer.

CI: opt-in 006 gates are wired (#2006 closed); default-on tracked in #2009.

No dependency on open PRs.