fix: Make NativeServer link and run on Windows, unblocking Windows Native CI (#641)

**Description**

uni's Scala Native test binary cannot link on Windows — at all, today,
on `main`:

```
error LNK2019: unresolved external symbol poll
error LNK2019: unresolved external symbol scalanative_pollerr
error LNK2019: unresolved external symbol scalanative_pollhup
error LNK2019: unresolved external symbol scalanative_pollin
error LNK2019: unresolved external symbol scalanative_pollnval
  referenced in function ...wvlet.uni.http.NativeServerTest...
fatal error LNK1120: 5 unresolved externals
```

Scala Native's
[`posixlib/poll.c`](https://github.com/scala-native/scala-native/blob/v0.5.12/posixlib/src/main/resources/scala-native/poll.c)
wraps its whole body in `#if defined(__unix__) || (defined(__APPLE__) &&
defined(__MACH__))`, so `poll` and the `scalanative_poll*` constant
accessors don't exist there. `NativeSocket` referenced
`scalanative.posix.poll`, every native HTTP test starts a server, and so
the whole binary was unlinkable.

That gap is why uni had **no Windows Scala Native CI**, and therefore
why #640's root cause — v2026.1.17 shipping a POSIX-only `#include
<dlfcn.h>` in `uni_curl_shim.c` — broke every downstream Windows build
instead of failing here.

**The fix.** Exactly three calls differ on Windows. Everything else uni
uses (`socket`, `bind`, `listen`, `accept`, `recv`, `send`,
`setsockopt`, `shutdown`) posixlib already maps onto winsock — the
failed link proved it, by resolving all of them and only missing `poll`.
So `uni_socket_shim.c` takes those three, behind an `@extern object
SocketShim`:

| | POSIX | Windows |
|---|---|---|
| `uni_socket_startup()` | nothing | `WSAStartup`, once, via
`InitOnceExecuteOnce` |
| `uni_socket_wait_readable(fd, ms)` | `poll` | `WSAPoll` |
| `uni_socket_close(fd)` | `close` | `closesocket` |

Three things here are easy to get wrong, so they're in the
[ADR](https://github.com/wvlet/uni/blob/fix/native-server-windows-poll/adr/2026-07-08-native-socket-shim.md):

- **The split has to be in C.** Scala Native has no per-OS source
directory (`.native` is per-*platform*), and DCE keeps every *reachable*
branch — so a runtime `if (isWindows)` in Scala links both sides and
still fails on `scalanative_pollin`. Merely *referencing* `posix.poll`
is the break. (`scalanative.windows.WinSocketApi.WSAPoll` is the
mirror-image problem: referencing it breaks the POSIX link on `ws2_32`.)
- **`#pragma comment(lib, "ws2_32.lib")`, not `@link("ws2_32")`.** Scala
Native compiles this `.c` into every downstream binary, including ones
that never open a socket. A bare `WSAPoll` reference with no guaranteed
`-lws2_32` breaks those links — precisely the #622 trap. The pragma
embeds the dependency in the object's linker directives, so it travels
with the object; a Scala-level `@link` gets dropped by DCE. Scala
Native's own `posixlib/sys/socket.c` does exactly this.
- **`WSAStartup` had no other caller.** Winsock rejects every `socket()`
with `WSANOTINITIALISED` until it runs. Scala Native calls it from
`WinSocketApiOps.init()`, reached only by javalib's `java.net` — which
uni's posixlib sockets never touch. And `close()` on a socket *links* on
Windows (`oldnames.lib` → `_close`) but only knows CRT file descriptors,
so it silently leaks the socket; that applies to the error-cleanup paths
in `bindAndListen`/`connect` too, not just the public `close`.

**Verification.**

- The shim's contract is exercised directly by a C harness over a
`socketpair`: idle → timeout, data pending → readable, drained →
timeout, **data+hangup → readable** (drain before reporting hangup),
hangup-only → readable/EOF, closed fd → error. All pass, and
`uni_socket_startup()` is idempotent.
- `projectNative/test` passes locally on macOS: 65/65, including
`NativeWebSocketClientTest`'s heartbeat test, which is the poll-timeout
path.
- CI now runs a real **`Scala Native (Windows)`** job — restored in
place of #640's standalone `clang` compile, which was only ever a
stand-in for this. It exercises `uni_socket_shim.c`
(`WSAStartup`/`WSAPoll`/`closesocket`) *and* `uni_curl_shim.c`
(`GetProcAddress` over `EnumProcessModules`) at runtime, not just at
compile time. Gated as before: every push to `main`, plus PRs touching
native code.

`check-curl-shim.sh` stays as a step in the Linux Native job. It is
still irreplaceable: `build.sbt` passes `-lcurl` unconditionally, so no
Scala Native job on any OS can notice the curl shim regrowing a libcurl
symbol reference — only a consumer without `-lcurl` breaks. Its
Windows/`llvm-nm` branch is dropped now that the real job covers Windows
compilation.

**Related Issue/Task**

Follow-up to #640. Removes the "a real Windows Native job is impossible"
caveat that PR had to record, and closes uni's Windows Scala Native
coverage gap at its source.

**Checklist**

- [x] This pull request focuses on a single task.
- [x] The change does not contain security credentials

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Author: xerial

.github/scripts/check-curl-shim.sh

@@ -1,20 +1,17 @@
 #!/usr/bin/env bash
 #
-# Guards uni_curl_shim.c, which Scala Native compiles into every downstream binary on every platform
-# it supports. Two things can go wrong, and both have:
+# Asserts that uni_curl_shim.c compiles to an object referencing no libcurl symbol.
 #
-#   1. It fails to compile. v2026.1.17 included <dlfcn.h>, which the MSVC toolchain does not ship,
-#      breaking every downstream Windows Scala Native build.
-#   2. Its object references a libcurl symbol, which breaks the link of downstream projects that
-#      never pull in -lcurl (issue #622, adr/2026-07-06-curl-shim-weak-linking.md).
+# Scala Native compiles that file into every downstream binary, whether or not the project uses
+# CurlBindings. If its object names `curl_easy_setopt`, a project that never links libcurl fails to
+# link (issue #622, adr/2026-07-06-curl-shim-weak-linking.md).
 #
-# No Scala Native job in this repo catches (2): build.sbt passes -lcurl unconditionally, so every uni
-# native binary resolves those symbols and links happily. Only a consumer without -lcurl breaks, and
-# inspecting the object directly is what stands in for that consumer.
+# No Scala Native job in this repo can catch that, on any OS: build.sbt passes -lcurl unconditionally,
+# so every uni native binary resolves those symbols and links happily. Only a consumer without -lcurl
+# breaks. Inspecting the object directly is what stands in for that consumer.
 #
-# Nor can one catch (1) on Windows: uni's NativeServer uses POSIX poll(), which Scala Native's
-# posixlib only builds on unix/Apple, so uni's native test binary cannot link on Windows at all.
-# Compiling this one file standalone with clang is the coverage that is available there.
+# The other way this file has broken — failing to compile at all, as when v2026.1.17 included the
+# POSIX-only <dlfcn.h> — is covered by the "Scala Native (Windows)" job, which builds it for real.
 set -euo pipefail
 
 shim="uni/.native/src/main/resources/scala-native/uni_curl_shim.c"
@@ -24,12 +21,7 @@ echo "== Compiling ${shim} with $(clang --version | head -1)"
 clang -c "${shim}" -o "${obj}" -Wall -Wextra -Werror
 
 echo "== Undefined symbols"
-if [[ "${RUNNER_OS:-}" == "Windows" ]]; then
-  nm_undefined=(llvm-nm --undefined-only)
-else
-  nm_undefined=(nm -u)
-fi
-"${nm_undefined[@]}" "${obj}" | tee "${obj}.undefined"
+nm -u "${obj}" | tee "${obj}.undefined"
 
 if grep -qi 'curl_easy' "${obj}.undefined"; then
   echo

.github/workflows/test.yml

@@ -137,25 +137,95 @@ jobs:
           check_name: Test Report Scala Native
           annotate_only: true
           detailed_summary: true
-  curl_shim_c_windows:
-    # Scala Native compiles every .c under resources/scala-native/ from every jar on the classpath,
-    # so uni's uni_curl_shim.c lands in each downstream Windows binary — including ones that never
-    # call curl. Nothing else here compiles that file for Windows, which is how v2026.1.17 shipped a
-    # POSIX-only `#include <dlfcn.h>` and broke those consumers rather than this repo's CI.
-    #
-    # A full Windows Scala Native job would be the broader guard, but uni cannot run one: NativeServer
-    # uses POSIX poll(), and Scala Native's posixlib only builds poll.c on unix/Apple, so uni's native
-    # test binary fails to link on Windows with `unresolved external symbol scalanative_pollin`.
-    # Compiling this one file with the same clang/MSVC toolchain is the coverage available today.
-    name: curl shim C (Windows)
+  test_native_3_windows:
+    # Scala Native compiles every .c under resources/scala-native/ from every jar on the classpath, so
+    # uni's C (uni_curl_shim.c, uni_socket_shim.c) lands in each downstream Windows binary — including
+    # ones that never call curl or open a socket. uni had no Windows Native build, so v2026.1.17
+    # shipped a POSIX-only `#include <dlfcn.h>` and broke those consumers rather than this repo's CI.
+    name: Scala Native (Windows)
     needs: changes
+    # ~15 minutes, nearly all of it toolchain setup, so don't spend it on every PR: run it on every
+    # push to main, and on the pull requests that can actually break it — those touching native code.
     if: ${{ github.event_name != 'pull_request' || needs.changes.outputs.native == 'true' }}
     runs-on: windows-latest
     steps:
       - uses: actions/checkout@v7
-      - name: Compile the shim and check for libcurl symbol references
+      - uses: actions/setup-java@v5
+        with:
+          distribution: 'temurin'
+          java-version: '23'
+      - uses: ilammy/msvc-dev-cmd@v1
+      - name: Install LLVM
+        run: choco install llvm -y
+        shell: pwsh
+      - name: Cache vcpkg artifacts
+        uses: actions/cache@v4
+        id: vcpkg-cache
+        with:
+          path: C:\vcpkg\installed
+          key: vcpkg-windows-x64-curl-zlib-openssl-v2
+      - name: Install libcurl, zlib and OpenSSL
+        if: steps.vcpkg-cache.outputs.cache-hit != 'true'
+        run: vcpkg install curl:x64-windows zlib:x64-windows openssl:x64-windows
+        shell: pwsh
+      - name: Expose the native libraries to the compiler, the linker and the test binary
+        # Each `-lfoo` / @link("foo") reaches clang in MSVC mode as a request for `foo.lib`:
+        # `-lcurl -lz` from this build, and `-lcrypto -lssl -lzlib` from Scala Native's own javalib
+        # (zlib under both names). vcpkg installs the import libraries under their upstream names,
+        # which vary by port revision, so for each name asked for take the first candidate that exists.
+        run: |
+          $root   = "$env:VCPKG_INSTALLATION_ROOT\installed\x64-windows"
+          $libDir = "$root\lib"
+          $wanted = [ordered]@{
+            "curl.lib"   = @("libcurl.lib")
+            "crypto.lib" = @("libcrypto.lib")
+            "ssl.lib"    = @("libssl.lib")
+            "z.lib"      = @("zlib.lib", "zlib1.lib", "libz.lib")
+            "zlib.lib"   = @("z.lib", "zlib1.lib", "libz.lib")
+          }
+          foreach ($dst in $wanted.Keys) {
+            $dstPath = Join-Path $libDir $dst
+            if (Test-Path $dstPath) { continue }
+            foreach ($src in $wanted[$dst]) {
+              $srcPath = Join-Path $libDir $src
+              if (Test-Path $srcPath) {
+                Write-Host "Copying $src -> $dst"
+                Copy-Item $srcPath $dstPath -Force
+                break
+              }
+            }
+            if (-not (Test-Path $dstPath)) { Write-Host "WARNING: no candidate found for $dst" }
+          }
+          Get-ChildItem $libDir -Filter *.lib | Select-Object -ExpandProperty Name | Sort-Object
+          # Scala Native's own javalib ships a z.c that includes <zlib.h>, so the headers must be
+          # reachable too, not just the import libraries.
+          echo "C_INCLUDE_PATH=$root\include" >> $env:GITHUB_ENV
+          echo "INCLUDE=$root\include;$env:INCLUDE" >> $env:GITHUB_ENV
+          # LIB is where lld-link searches; bin is where the linked test binary finds libcurl.dll.
+          echo "LIB=$libDir;$env:LIB" >> $env:GITHUB_ENV
+          echo "$root\bin" >> $env:GITHUB_PATH
+        shell: pwsh
+      # `testOnly` still links the whole native test binary, so both of uni's C shims get compiled and
+      # linked for Windows here; running the http suite then exercises uni_socket_shim.c (WSAStartup /
+      # WSAPoll / closesocket) and uni_curl_shim.c (GetProcAddress over EnumProcessModules) for real.
+      #
+      # Deliberately not the full `projectNative/test` yet. Six tests outside http fail on Windows, all
+      # of them predating this job and none socket-related: IOSymlinkTest (3 — uni itself raises
+      # `createSymlink is not supported on Scala Native + Windows`, so they want skipping there),
+      # IOPathTest's `resolve child path` (a Windows-naive expectation), and JSONTest /
+      # YAMLFormatterTest (their `stripMargin` literals arrive CRLF, as the repo has no .gitattributes,
+      # while the formatters emit LF). Fix those, then widen this step to projectNative/test.
+      - name: Scala Native test (http)
+        run: JVM_OPTS=-Xmx4g ./sbt "uniNative/testOnly wvlet.uni.http.*"
         shell: bash
-        run: .github/scripts/check-curl-shim.sh
+      - name: Publish Test Report
+        uses: mikepenz/action-junit-report@v6
+        if: always() # always run even if the previous step fails
+        with:
+          report_paths: '**/target/test-reports/TEST-*.xml'
+          check_name: Test Report Scala Native (Windows)
+          annotate_only: true
+          detailed_summary: true
   package_src:
     name: Verify packageSrc
     needs: changes

adr/2026-07-06-curl-shim-weak-linking.md

@@ -68,12 +68,16 @@ on stderr and `abort()`s rather than jumping to NULL.
 Two CI additions guard this, because the file's two failure modes need two
 different checks:
 
-- **`curl_shim_c_windows`** ("curl shim C (Windows)") compiles the file standalone
-  with clang on `windows-latest`. Nothing else here compiles the Windows half of
-  the `#if`, which is how v2026.1.17's POSIX-only `#include <dlfcn.h>` shipped. It
-  runs on every push to `main` and on pull requests touching native code (the
-  `native` paths-filter): a `.c` file, anything under a `.native/` source tree, or
-  the Scala Native version in `project/`.
+- **`test_native_3_windows`** ("Scala Native (Windows)") builds and runs the native
+  test suite on Windows, compiling this shim for real. Nothing here compiled the
+  Windows half of the `#if` when v2026.1.17 shipped its POSIX-only
+  `#include <dlfcn.h>`; uni had no Windows Native build at all, because
+  `NativeServer` could not link there — see
+  [`2026-07-08-native-socket-shim.md`](2026-07-08-native-socket-shim.md), which
+  fixed that and made this job possible. ~15 minutes, so it runs on every push to
+  `main` and only on pull requests touching native code (the `native`
+  paths-filter): a `.c` file, anything under a `.native/` source tree, or the Scala
+  Native version in `project/`.
 - **`.github/scripts/check-curl-shim.sh`**, a step in the Linux Native job, which
   compiles the shim standalone and asserts via `nm -u` that the object names no
   `curl_easy_*` symbol. No Scala Native job can catch that regression on any OS:
@@ -113,27 +117,6 @@ separate — but Scala Native's own `nativelib` already links both, so the shim
 inherits them. No extra linker option is required from consumers. Verified by
 inspecting Scala Native's link line (`[pthread, dl, m, crypto, curl, z]`).
 
-### A real "Scala Native on Windows" CI job would be better, and is not possible yet
-
-The obvious guard — build and run the native test suite on Windows, which would
-cover this break and any future one — was tried and abandoned. It gets the whole
-toolchain up (LLVM, vcpkg libcurl/zlib/OpenSSL, aliasing each `foo.lib` that
-`-lfoo` asks for), compiles every source *including this shim*, and then fails at
-the final link:
-
-    error LNK2019: unresolved external symbol scalanative_pollin
-      referenced in function ...wvlet.uni.http.NativeServerTest...
-    fatal error LNK1120: 5 unresolved externals
-
-`NativeServer` uses POSIX `poll()`, and Scala Native's `posixlib/poll.c` is wrapped
-in `#if defined(__unix__) || (defined(__APPLE__) && defined(__MACH__))` — the
-symbols do not exist on Windows. Every native HTTP test spins up a server, so uni's
-native test binary cannot link there at all. Giving `NativeServer` a Windows path
-(`WSAPoll`) would unblock it; until then, compiling the shim standalone is the
-Windows coverage available. Notably, that abandoned run *did* prove the shim
-compiles and links clean under clang/MSVC: none of the unresolved symbols were
-`curl_easy_*`.
-
 ### Windows: why module enumeration, and why `PSAPI_VERSION 2`
 
 Windows has no `RTLD_DEFAULT`. `GetProcAddress` takes one `HMODULE` at a time,

adr/2026-07-08-native-socket-shim.md

@@ -0,0 +1,153 @@
+# 2026-07-08: `uni_socket_shim.c` carries the Windows socket differences, in C
+
+## Context
+
+uni's Native HTTP server and WebSocket support (`NativeHttpServer`, `NativeWebSocket`,
+`NativeSocket`) are built directly on Scala Native's posixlib sockets. On
+Windows that binary would not even link:
+
+    error LNK2019: unresolved external symbol poll
+    error LNK2019: unresolved external symbol scalanative_pollin
+      referenced in function ...wvlet.uni.http.NativeServerTest...
+    fatal error LNK1120: 5 unresolved externals
+
+Scala Native's `posixlib/poll.c` wraps its whole body in
+`#if defined(__unix__) || defined(__unix) || defined(unix) || (defined(__APPLE__) && defined(__MACH__))`,
+so `poll` and the `scalanative_poll*` constant accessors do not exist on Windows.
+That single gap made uni's entire native test binary unlinkable there — which is
+why uni had no Windows Scala Native CI at all, and therefore why v2026.1.17 could
+ship a POSIX-only `#include <dlfcn.h>` in `uni_curl_shim.c` and break every
+downstream Windows build instead of failing here (see
+[`2026-07-06-curl-shim-weak-linking.md`](2026-07-06-curl-shim-weak-linking.md)).
+
+Three calls differ on Windows. Everything else uni uses — `socket`, `bind`,
+`listen`, `accept`, `recv`, `send`, `setsockopt`, `shutdown` — posixlib already
+maps onto winsock, and the failed link proved it: `poll` was the *only* thing
+missing.
+
+## Decision
+
+Put all three behind fixed-arity C functions in
+`uni/.native/src/main/resources/scala-native/uni_socket_shim.c`, called from an
+`@extern object SocketShim`:
+
+| | POSIX | Windows |
+|---|---|---|
+| `uni_socket_startup()` | nothing | `WSAStartup`, once, via `InitOnceExecuteOnce` |
+| `uni_socket_wait_readable(fd, ms)` | `poll` | `WSAPoll` |
+| `uni_socket_close(fd)` | `close` | `closesocket` |
+
+## Non-obvious points a future reader would otherwise reverse-engineer
+
+### The OS split has to be in C — Scala cannot express it
+
+Scala Native has no per-OS source directory (`.native` is per-*platform*, not
+per-OS), and dead-code elimination keeps every *reachable* branch. So a runtime
+`if (Platform.isWindows) ... else scalanative.posix.poll.poll(...)` in Scala
+still links both sides, and still fails on `scalanative_pollin`. Merely
+*referencing* `scala.scalanative.posix.poll` is what breaks the build. The branch
+must happen at C preprocessing time.
+
+`scala.scalanative.windows.WinSocketApi` does expose `WSAPoll`, but it is the
+mirror image of the same problem: referencing it from shared Scala makes the
+POSIX link fail on `ws2_32`.
+
+### Why the whole readable-wait contract lives in C, not just the `poll` call
+
+POSIX `struct pollfd.fd` is an `int`; Windows `WSAPOLLFD.fd` is a `SOCKET`, a
+64-bit `UINT_PTR` on Win64. One Scala `CStruct3` binding cannot describe both
+layouts. Returning a plain `int` verdict (1 readable / 0 timeout / -1 error)
+keeps the struct on the C side entirely. The EINTR retry and the `revents`
+interpretation moved along with it, since they are meaningless to split.
+
+### `#pragma comment(lib, "ws2_32.lib")` — not `@link("ws2_32")`
+
+Scala Native compiles this `.c` into **every** downstream binary, including ones
+that never open a socket. A bare `WSAPoll` reference with no guaranteed
+`-lws2_32` would break those links — exactly the trap `uni_curl_shim.c` fell into
+in #622. A `#pragma comment(lib, ...)` embeds the dependency in the object file's
+linker directives, so it travels with the object and always applies; a
+Scala-level `@link("ws2_32")` would be dropped by DCE when `CurlBindings`-style
+reachability fails. Scala Native's own `posixlib/sys/socket.c` uses the same
+pragma. MSVC-family linkers only, which is what Scala Native's Windows support
+targets.
+
+### Windows needs `WSAStartup`, and nothing else was going to call it
+
+Winsock rejects every `socket()` with `WSANOTINITIALISED` until `WSAStartup` has
+run in the process. Scala Native calls it from `WinSocketApiOps.init()`, reached
+only by javalib's `java.net` implementations — which uni's posixlib-based sockets
+never touch. `NativeSocket.bindAndListen` and `.connect` therefore call
+`ensureStarted()` first. The C side is `InitOnceExecuteOnce`-guarded and
+idempotent, so callers need not track it. There is no matching `WSACleanup`: the
+sockets live as long as the process.
+
+### `close(fd)` on a Windows socket silently does the wrong thing
+
+`close` *links* on Windows — `oldnames.lib` aliases it to the CRT's `_close` —
+but `_close` operates on CRT file descriptors, not socket handles. It would fail
+with `EBADF` and leak the socket. Sockets must be closed with `closesocket`. Note
+this applies to the error-cleanup paths in `bindAndListen` / `connect` too, not
+only the public `close`.
+
+### `uni_socket_wait_readable` must be annotated `@blocking`
+
+`scala.scalanative.unsafe.blocking` marks an `extern` that may park the calling
+thread, so Scala Native leaves it at a GC safepoint for the duration. Scala
+Native annotates its own `posix.poll.poll` that way. Dropping the annotation while
+moving the call into this shim does not fail to compile and does not fail on
+macOS — it makes the collector wait on a thread sitting inside `poll`, until:
+
+    [ScalaNative GC|Warning] Waiting for 1 thread(s) to reach safepoint (60.0s elapsed)
+    [ScalaNative GC|Error] FATAL: Timeout after 60.0s waiting for 1 thread(s)
+    Test runner interrupted by fatal signal 6
+
+Any future blocking call added here needs the same annotation. `uni_socket_close`
+and `uni_socket_startup` do not: neither parks the thread.
+
+### Narrowing `SOCKET` to `int` is safe
+
+Scala Native stores a socket as `CInt`, having narrowed the `SOCKET` winsock
+returned. Widening it back is sound: Windows keeps socket handles inside the low
+32 bits precisely so they can be passed through `int` for interoperability. Cast
+through `unsigned int` — `(SOCKET)(unsigned int)fd` — not straight to `UINT_PTR`:
+a signed `int` with bit 31 set would sign-extend to `0xFFFFFFFF........` and hand
+winsock an invalid `SOCKET`.
+
+### `POLLIN` still works on Windows
+
+`WSAPoll` only ever sets `POLLRDNORM` in `revents`, but `winsock2.h` defines
+`POLLIN` as `(POLLRDNORM | POLLRDBAND)`, so testing `revents & POLLIN` reads the
+same on both platforms. `winsock2.h` also supplies `POLLERR`, `POLLHUP` and
+`POLLNVAL`, so the verdict logic is shared, not duplicated.
+
+## Consequences
+
+- uni's Scala Native test binary links and runs on Windows, so CI gained a real
+  `Scala Native (Windows)` job. That job — not a standalone `clang` compile — is
+  now what would have caught v2026.1.17's `<dlfcn.h>` regression, and it exercises
+  both shims at runtime. `NativeServerTest` passes 21/21 there, keep-alive and
+  read timeouts (the `WSAPoll` timeout paths) and WebSocket upgrade included.
+- That job runs `uniNative/testOnly wvlet.uni.http.*`, not the full
+  `projectNative/test`. `testOnly` still links the entire test binary, so both
+  shims are compiled and linked for Windows either way. Six tests outside `http`
+  fail there, all predating the job and none socket-related — they are what stands
+  between this and the full suite:
+  - `IOSymlinkTest` (3): uni raises `createSymlink is not supported on Scala Native
+    + Windows`; the tests need skipping on that platform.
+  - `IOPathTest.resolve child path`: the expectation is Windows-naive.
+  - `JSONTest` / `YAMLFormatterTest`: their `stripMargin` literals arrive CRLF (the
+    repo has no `.gitattributes`, and `actions/checkout` leaves Windows'
+    `core.autocrlf=true`), while the formatters emit LF. `* text=auto eol=lf` would
+    fix both.
+- `NativeSocket` no longer imports `scalanative.posix.poll` or
+  `scalanative.posix.unistd`. Re-adding either would re-break Windows; the CI job
+  is what notices.
+- Error *messages* on Windows are still POSIX-shaped: winsock reports failures via
+  `WSAGetLastError()`, not `errno`, so a failed `bind` yields uni's generic
+  message rather than a specific cause. uni never read `errno` here, so nothing
+  regressed — but a future "why did bind fail" improvement needs a Windows branch.
+- `WSAPoll` before Windows 10 2004 does not report a failed connection attempt in
+  `revents`. uni only polls accepted/connected sockets for readability, so this
+  does not bite; do not extend the shim to poll for connect-completion without
+  revisiting it.