feat(devmap-store): latest_symbols_for_file (recover code vendored from an unpushed commit)

.github/actions/setup-gusset/action.yml

@@ -25,7 +25,7 @@ runs:
         # Pinned to the sibling revision this tree was linked against.
         # Bump deliberately; tracking main would let a Gusset push fail a
         # DevCouncil release without a DevCouncil commit.
-        ref: 7a56c3c98d026b4e445f687140c90d70755e8590
+        ref: 709c2b7b85be0de7c263471d933f395bb3b1b27f
         path: third_party/gusset
         persist-credentials: false
 
@@ -60,45 +60,25 @@ runs:
         test -f "$dest/go.mod"
         test -f "$dest/crates/gusset/Cargo.toml"
 
-    # Gusset's cgo line is -lgusset -lpthread -lm -ldl. That is a GNU link.
-    # windows-latest's Rust host is MSVC, which emits gusset.lib and has no
-    # libdl. The gnu target plus MinGW produces libgusset.a, which is what
-    # the #cgo -L path in gussetfn/engine.go already names.
-    - name: Install MinGW
-      if: ${{ runner.os == 'Windows' && inputs.build-engine == 'true' }}
-      uses: msys2/setup-msys2@v2
-      with:
-        msystem: MINGW64
-        update: false
-        install: mingw-w64-x86_64-gcc mingw-w64-x86_64-dlfcn
-        path-type: inherit
-
+    # gusset is unix-only: its crate refuses other targets with compile_error!,
+    # so no Windows toolchain can build the archive. On Windows the sibling is
+    # still checked out (go.mod's replace must resolve) and the host builds
+    # without it — gussetfn is build-tagged unix and answers ErrUnsupported
+    # elsewhere. The MinGW/gnu-target path this replaced could never succeed.
     - name: Rust toolchain
       if: ${{ runner.os != 'Windows' && inputs.build-engine == 'true' }}
       uses: dtolnay/rust-toolchain@stable
 
-    - name: Rust toolchain (Windows gnu target)
-      if: ${{ runner.os == 'Windows' && inputs.build-engine == 'true' }}
-      uses: dtolnay/rust-toolchain@stable
-      with:
-        targets: x86_64-pc-windows-gnu
-
     - name: Build the umbrella staticlib
-      if: ${{ inputs.build-engine == 'true' }}
+      if: ${{ runner.os != 'Windows' && inputs.build-engine == 'true' }}
       shell: bash
       working-directory: rust/gusset-engine
       run: |
         set -euo pipefail
-        if [[ "${RUNNER_OS}" == "Windows" ]]; then
-          export CARGO_TARGET_X86_64_PC_WINDOWS_GNU_LINKER=gcc
-          cargo build --release --locked --target x86_64-pc-windows-gnu
-          mkdir -p target/release
-          cp -f target/x86_64-pc-windows-gnu/release/libgusset.a target/release/libgusset.a
-          # Later `go build` steps in this job must use the same gcc. cgo
-          # will not use the MSVC linker for Gusset's -lpthread/-ldl line.
-          echo "CC=gcc" >> "$GITHUB_ENV"
-          echo "CARGO_TARGET_X86_64_PC_WINDOWS_GNU_LINKER=gcc" >> "$GITHUB_ENV"
-        else
-          cargo build --release --locked
-        fi
+        cargo build --release --locked
         test -f target/release/libgusset.a
+        # Key Go's build and test caches on the archive (see cgo-env.sh):
+        # setup-go restores GOCACHE, and without this a cached link or a
+        # cached "ok" from an older archive is replayed.
+        # The -L is already in gussetfn/engine.go; only the key is needed here.
+        ./cgo-env.sh --no-build | grep -v "^CGO_LDFLAGS=" >> "$GITHUB_ENV"

.github/workflows/analysis-plane.yml

@@ -24,11 +24,13 @@ on:
       - "rust/**"
       - "backend/go_orchestrator/**"
       - ".github/workflows/analysis-plane.yml"
+      - ".github/actions/setup-gusset/**"
   pull_request:
     paths:
       - "rust/**"
       - "backend/go_orchestrator/**"
       - ".github/workflows/analysis-plane.yml"
+      - ".github/actions/setup-gusset/**"
   workflow_dispatch:
 
 permissions:

.github/workflows/rust.yml

@@ -20,6 +20,9 @@ on:
       - "rust/Cargo.lock"
       - "rust/.gitignore"
       - ".github/workflows/rust.yml"
+      - ".github/actions/setup-gusset/**"
+      - "rust/gusset-engine/**"
+      - "backend/go_orchestrator/gussetfn/**"
   pull_request:
     paths:
       - "rust/devmap-*/**"
@@ -31,6 +34,9 @@ on:
       - "rust/Cargo.lock"
       - "rust/.gitignore"
       - ".github/workflows/rust.yml"
+      - ".github/actions/setup-gusset/**"
+      - "rust/gusset-engine/**"
+      - "backend/go_orchestrator/gussetfn/**"
   workflow_dispatch:
 
 permissions:

backend/go_orchestrator/cmd/devcouncil/gusset_check.go

@@ -1,3 +1,5 @@
+//go:build unix
+
 package main
 
 import (
@@ -6,15 +8,24 @@ import (
 
 	"github.com/bharathvbcr/DevCouncil/backend/go_orchestrator/console"
 	"github.com/bharathvbcr/DevCouncil/backend/go_orchestrator/gussetfn"
+	"github.com/bharathvbcr/gusset"
 )
 
 func runGussetCheck() int {
 	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
 	defer cancel()
-	if err := gussetfn.Check(ctx); err != nil {
+	err := gussetfn.SelfTest(ctx)
+	// The check panics on purpose; what Rust logged about it, and anything
+	// else, belongs on stderr rather than in a ring nobody reads.
+	if _, drainErr := gussetfn.DrainLogs(console.Stderr()); drainErr != nil {
+		console.Errorf("gusset-check: draining Rust logs: %v\n", drainErr)
+	}
+	if err != nil {
 		console.Errorf("gusset-check: %v\n", err)
 		return 1
 	}
-	console.Println("gusset-check: ok")
+	st := gusset.Stats()
+	console.Printf("gusset-check: ok (parity, match-any, panic firewall; rust live=%dB peak=%dB allocs=%d; go threads=%d)\n",
+		st.LiveBytes, st.PeakBytes, st.AllocCount, gusset.Threads())
 	return 0
 }

backend/go_orchestrator/cmd/devcouncil/gusset_check_other.go

@@ -0,0 +1,15 @@
+//go:build !unix
+
+package main
+
+import (
+	"github.com/bharathvbcr/DevCouncil/backend/go_orchestrator/console"
+	"github.com/bharathvbcr/DevCouncil/backend/go_orchestrator/gussetfn"
+)
+
+// runGussetCheck says the check could not run: gusset is unix-only. A check
+// that could not run exits non-zero, never as a pass.
+func runGussetCheck() int {
+	console.Errorf("gusset-check: %v\n", gussetfn.ErrUnsupported)
+	return 2
+}

backend/go_orchestrator/gate/redirect_test.go

@@ -232,7 +232,12 @@ func runInThrowawayTree(t *testing.T, command string) []string {
 		t.Fatal(err)
 	}
 	before := treeSnapshot(root)
-	cmd := exec.Command("sh", "-c", command)
+	// `wait` so a backgrounded write (`echo hi > .env &`) lands before the
+	// tree is read. Without it sh exited first, the write was reported as
+	// nothing, and it landed during t.TempDir's cleanup, which then failed
+	// with "directory not empty" (macOS, 241b018). Every corpus entry is a
+	// complete command, so a trailing line cannot change how it parses.
+	cmd := exec.Command("sh", "-c", command+"\nwait")
 	cmd.Dir = root
 	// A corpus entry that hangs would wedge the suite; nothing here reads
 	// stdin, and closing it turns any that starts to into an immediate EOF.
@@ -250,6 +255,17 @@ func runInThrowawayTree(t *testing.T, command string) []string {
 	return changed
 }
 
+// A backgrounded write is a write. The corpus holds `echo hi > .env &`, and
+// the invariant above only means something for it if its write is seen.
+func TestThrowawayTreeSeesABackgroundedWrite(t *testing.T) {
+	for i := 0; i < 20; i++ {
+		written := runInThrowawayTree(t, "sleep 0.05; echo hi > .env &")
+		if len(written) != 1 || written[0] != ".env" {
+			t.Fatalf("run %d: saw %v, want [.env]", i, written)
+		}
+	}
+}
+
 func treeSnapshot(root string) map[string]string {
 	out := map[string]string{}
 	_ = filepath.Walk(root, func(p string, info os.FileInfo, err error) error {