ci: green full matrix and cargo audit (Windows gate/dylint/ARM, arm-musl, advisories)

.github/workflows/ci-preflight-rust.yml

@@ -16,7 +16,7 @@ name: CI Preflight Rust-only (Reusable)
 #     C-build-script crates (rusqlite/bundled, blake3 asm, etc.).
 #   - `zackees/setup-soldr@v0` provisions the toolchain from
 #     rust-toolchain.toml and soldr's zccache-backed build cache
-#     (CACHE-025, zackees/ci.yml#209); `soldr rustup target add` adds
+#     (CACHE-025, zackees/ci.yml#209); `ci/install_rust_target.sh` adds
 #     the rust-std for the musl target.
 #   - `soldr cargo build/clippy/nextest --target <triple>` builds
 #     against the musl target. The platform-default linker is kept:
@@ -95,7 +95,7 @@ jobs:
           linker: platform-default
 
       - name: Install ${{ inputs.target }} standard library
-        run: soldr rustup target add ${{ inputs.target }} --toolchain 1.95.0
+        run: bash ci/install_rust_target.sh ${{ inputs.target }} 1.95.0
 
       - name: cargo build --target ${{ inputs.target }}
         run: soldr cargo build --workspace --exclude running-process-py --all-targets --features ${{ inputs.features }} --target ${{ inputs.target }}
@@ -121,7 +121,7 @@ jobs:
           prebuild-deps: none
           linker: platform-default
       - name: Install ${{ inputs.target }} standard library
-        run: soldr rustup target add ${{ inputs.target }} --toolchain 1.95.0
+        run: bash ci/install_rust_target.sh ${{ inputs.target }} 1.95.0
       - name: cargo clippy --target ${{ inputs.target }}
         run: soldr cargo clippy --workspace --exclude running-process-py --all-targets --features ${{ inputs.features }} --target ${{ inputs.target }} -- -D warnings
 
@@ -147,7 +147,7 @@ jobs:
           prebuild-deps: none
           linker: platform-default
       - name: Install ${{ inputs.target }} standard library
-        run: soldr rustup target add ${{ inputs.target }} --toolchain 1.95.0
+        run: bash ci/install_rust_target.sh ${{ inputs.target }} 1.95.0
       - name: Install cargo-nextest
         uses: taiki-e/install-action@v2
         with:
@@ -201,7 +201,7 @@ jobs:
           prebuild-deps: none
           linker: platform-default
       - name: Install ${{ inputs.target }} standard library
-        run: soldr rustup target add ${{ inputs.target }} --toolchain 1.95.0
+        run: bash ci/install_rust_target.sh ${{ inputs.target }} 1.95.0
       - name: Install cargo-nextest
         uses: taiki-e/install-action@v2
         with:

.github/workflows/ci-preflight.yml

@@ -346,7 +346,11 @@ jobs:
     name: dylint (${{ inputs.label }})
     if: ${{ inputs.dylint }}
     runs-on: ${{ inputs.os }}
-    timeout-minutes: 30
+    # Windows x86 with a cold compiler-unit cache spent 20-30 min in each of
+    # the two workspace passes (2026-10-26, PR #1337: 50 min once, over 60
+    # the next time), and that cache is saved only from main, so a PR lane is
+    # always cold. 30 and then 60 cancelled the second pass.
+    timeout-minutes: 120
     env:
       SOLDR_DYLINT_DRIVER_FALLBACK: "off"
       # The lint crates select dylint-link through cfg(all()). Soldr's

ci/install_rust_target.sh

@@ -0,0 +1,42 @@
+#!/usr/bin/env bash
+# Install a Rust target's standard library, and reinstall it when the
+# toolchain claims it but its files are missing.
+#
+# Usage: ci/install_rust_target.sh <target-triple> [toolchain]
+#
+# setup-soldr restores the toolchain from a solo-toolchain cache whose key does
+# not include the added targets. A payload saved from a job that had added a
+# target can come back with rustup's component manifest listing
+# `rust-std-<target>` but without the library files. `rustup target add` then
+# reports "up to date" and changes nothing, and soldr refuses the build
+# ("lists rust-std ... but the library files are missing"). Removing the
+# component first makes the add a real install. `rustup component remove`
+# itself rolls back when a file listed in the component's manifest is gone,
+# so if it fails the component is dropped from the toolchain's installed list
+# (`components`) and its file list (`manifest-*`), and the removal retried:
+# rustup then only unregisters it from the channel config.
+set -euo pipefail
+
+target="${1:?usage: install_rust_target.sh <target-triple> [toolchain]}"
+toolchain="${2:-1.95.0}"
+
+soldr rustup target add "$target" --toolchain "$toolchain"
+
+rustc="$(soldr rustup which rustc --toolchain "$toolchain")"
+rustlib="$(dirname "$(dirname "$rustc")")/lib/rustlib"
+libdir="$rustlib/$target/lib"
+if compgen -G "$libdir/libstd-*.rlib" > /dev/null; then
+    exit 0
+fi
+
+echo "rust-std for $target is registered but $libdir has no libstd; reinstalling" >&2
+if ! soldr rustup component remove "rust-std-$target" --toolchain "$toolchain"; then
+    sed -i "/^rust-std-$target\$/d" "$rustlib/components"
+    rm -f "$rustlib/manifest-rust-std-$target"
+    soldr rustup component remove "rust-std-$target" --toolchain "$toolchain"
+fi
+soldr rustup target add "$target" --toolchain "$toolchain"
+if ! compgen -G "$libdir/libstd-*.rlib" > /dev/null; then
+    echo "rust-std for $target is still missing from $libdir after reinstall" >&2
+    exit 1
+fi

ci/local_gate.py

@@ -17,7 +17,7 @@
 import sys
 import tempfile
 from dataclasses import dataclass
-from pathlib import Path
+from pathlib import Path, PurePath
 from typing import TypeAlias
 
 JsonValue: TypeAlias = str | int | float | bool | list["JsonValue"] | dict[str, "JsonValue"] | None
@@ -185,10 +185,23 @@ def _jobs_error(jobs: tuple[Job, ...]) -> str | None:
     return None
 
 
+def _is_rooted(path: PurePath) -> bool:
+    """Whether a receipt's workspace names a location rather than a relative path.
+
+    Bosn executes the gate inside a Linux container, so its receipt reports a
+    POSIX workspace such as ``/work/repo``. ``Path.is_absolute()`` is false for
+    that on Windows, where an absolute path also needs a drive, so the check
+    rejected every genuine receipt there. A root is what separates a located
+    path from ``relative/repo`` (or a drive-relative ``C:repo``) on every host;
+    the ``resolve()`` comparison that follows still pins the exact workspace.
+    """
+    return bool(path.root)
+
+
 def proof_error(output: str, *, workspace: Path, head_sha: str) -> str | None:
     try:
         proof = _parse_proof(output)
-        if not proof.workspace.is_absolute() or proof.workspace.resolve() != workspace.resolve():
+        if not _is_rooted(proof.workspace) or proof.workspace.resolve() != workspace.resolve():
             return "Bosn executed another workspace"
         if proof.sha != head_sha:
             return "Bosn executed another commit"

crates/running-process-platform-internal/Cargo.toml

@@ -80,7 +80,7 @@ png = { version = "0.17", optional = true }
 [target.'cfg(windows)'.dependencies]
 sha2 = { version = "0.10", optional = true }
 ureq = { version = "2", default-features = false, features = ["tls"], optional = true }
-zstd = { version = "0.13", default-features = false, optional = true }
+zstd = { version = "0.14", default-features = false, optional = true }
 tar = { version = "0.4", default-features = false, optional = true }
 windows-sys = { version = "0.61", features = [
     "Wdk_System_Threading",