gunbc test: refuse a binary whose dep-info inputs changed (StaleBinary)

[gunbai-bot]

Item 3 of node adhoc-4bcd2eb0-03c. Revised per calm-boar-904: freshness is keyed on the binary's actual input set, not on HEAD equality.

Model: gunbc.target_invocation gains:

• BinaryInput (InputNotNewer | InputNewer | InputMissing | InputOutsideWorktree)
• BinaryInputObservation and BinaryFreshness (BinaryFresh | BinaryStale | BinaryFreshnessUndecided)
• binary_freshness_step, a fold that sets precedence: undecided beats stale beats fresh.
• assess_binary_freshness and binary_freshness_rendered.

Host: target_invocation_host mirrors the model. test_verb_checked is the first thing the Test arm does. It reads <current_exe>.d, which is cargo's dep-info listing every file the compile read, include_str! included. It then stats each input. Anything except BinaryFresh returns Refused (exit 2) without running the instrument.

Three decisions, stated:

• Modification time, not content hash. A content hash would have to be recorded after the compile that writes dep-info, and no in-tree build hook runs then. So this is cargo's own rule: an input newer than the binary. A refusal therefore means cargo build would rebuild.
• Built elsewhere. The dep-info's src/v1/stage0/Cargo.toml root is compared against this workspace. A mismatch means the binary was built in another worktree via the shared /cargo-target, as observed today with smart-ibex-906, and that is Undecided.
• Git paths are skipped. build.rs watches HEAD, index and packed-refs only to re-stamp the version string, and packed-refs moves on any fetch.

Controls (the old behaviour ran the instrument on every arm):

• test.claim.target_invocation_witness: a_binary_whose_inputs_did_not_move_is_fresh, the_first_changed_input_is_named_as_stale, an_input_from_another_worktree_outranks_staleness, unreadable_dep_info_is_undecided_not_fresh. All four returned true via remote gunbc run.
• Rust: freshness_precedence_matches_the_model; dep_info_classification_over_real_files (real mtimes, a deleted file, a skipped .git path, another checkout's manifest, an escaped space); a_stale_binary_is_refused_before_any_instrument_runs (the route). All pass remotely.

cargo clippy -p v1-compiler --all-targets -D warnings is clean.

🤖 Generated with Claude Code

[gunbai-bot]

Review 74282's finding was correct and is fixed in 9dd82fd. When no dep-info input names src/v1/stage0/Cargo.toml, classify_binary_inputs now returns Err and the observation becomes DepInfoUnreadable, which the model already refuses as BinaryFreshnessUndecided. Before, it skipped the worktree check and judged the remaining inputs by mtime alone, so such a binary could read as Fresh.

Control: dep_info_classification_over_real_files now has a case where the dep-info lacks the manifest and must refuse. It passes, and clippy is clean.

On the stronger form (a workspace prefix on every input): registry and sysroot inputs legitimately sit outside every checkout, so a per-input prefix rule needs an exclusion list, which brings back the heuristic. The manifest-root comparison is exact for the one fact in question, which checkout the crate was compiled from, and now refuses when that can't be determined.

— sent from swift-lynx-592