@rightkit/release 0.6.13 → 0.6.14

package/stage-binary.mjs

@@ -32,8 +32,26 @@ export function stageDevelopmentBinary({ root, source, name = path.basename(sour
 const profileDirectory = (profile) => (profile === "dev" || profile === "test" ? "debug" : profile === "bench" ? "release" : profile);
 
 /** `{ source }` or `{ manifestPath, bin, targetTriple?, profile? }` (resolved through Cargo's own target directory, broker or not). */
-export function resolveStageSource(entry, { root, resolveTarget = resolveTargetRoot, platform = process.platform } = {}) {
-  if (entry.source) return path.resolve(root, entry.source);
+export function resolveStageSource(entry, { root, resolveTarget = resolveTargetRoot, platform = process.platform, managedOutputDirs = [] } = {}) {
+  if (entry.source) {
+    const from = path.resolve(root, entry.source);
+    // GB-60: on a receipt-managed build (managedOutputDirs: the output directories signed receipts of this run named) a source path under a `target`
+    // directory is the Cargo target directory's, which the broker keeps elsewhere: it is migrated onto the receipt's directory when exactly one is known,
+    // and refused when the receipts name several (the entry must then say which: manifestPath and bin). A source path outside any target directory is a
+    // source-tree file and is used as written.
+    const unique = [...new Set(managedOutputDirs)];
+    const segments = path.relative(path.resolve(root), from).split(path.sep).filter(Boolean);
+    const at = segments.indexOf("target");
+    if (unique.length && at >= 0 && !segments.includes("..")) {
+      if (unique.length > 1) {
+        const error = new Error(`development stage source ${JSON.stringify(entry.source)} is under a Cargo target directory, but this build's receipts name ${unique.length} output directories; name the workspace with manifestPath and bin instead`);
+        error.code = "DEV_OUTPUT_AMBIGUOUS";
+        throw error;
+      }
+      return path.join(unique[0], ...segments.slice(at + 1));
+    }
+    return from;
+  }
   if (!entry.manifestPath || !entry.bin) throw new Error("development stage entry needs source, or manifestPath and bin");
   const target = resolveTarget(path.resolve(root, entry.manifestPath));
   const file = platform === "win32" ? `${entry.bin}.exe` : entry.bin;
@@ -51,9 +69,9 @@ export function validateStageEntries(entries, label) {
   return entries;
 }
 
-export function stageDevelopmentBinaries(entries, { root, platform = process.platform, resolveTarget } = {}) {
+export function stageDevelopmentBinaries(entries, { root, platform = process.platform, resolveTarget, managedOutputDirs = [] } = {}) {
   return entries.map((entry) => {
-    const source = resolveStageSource(entry, { root, platform, resolveTarget });
+    const source = resolveStageSource(entry, { root, platform, resolveTarget, managedOutputDirs });
     const name = entry.name ?? path.basename(source);
     return stageDevelopmentBinary({ root, source, name, triple: entry.targetTriple ?? null });
   });

package/stage-commands.mjs

@@ -2,14 +2,26 @@
 // localTestPlan and the pack argv builders), so the gate (which chooses the receipts to carry) and the hosted admission (which checks
 // the signed requestedArgv of each) share one definition and cannot drift from the stages. EVERY command of a stage must be covered by
 // a signed receipt of its own job; a missing command is a refusal that names it.
+import fs from "node:fs";
 import path from "node:path";
 import { CARGO_METADATA_ARGS, cargoPackageArgs, localTestPlan, npmPackArgs, qualifyFmtArgs } from "./local-publish.mjs";
 import { SWAP_HELPER_CARGO_ARGS, SWAP_HELPER_METADATA_ARGS, SWAP_HELPER_PACKAGE } from "./swap-helper-bundle.mjs";
+import { carriedRequestOf } from "./snapshot-request.mjs";
 
 /** Stands for the one argument that is a fresh absolute scratch path (`pnpm pack --pack-destination <mkdtemp>`). */
 export const ANY_ABSOLUTE_PATH = Object.freeze({ anyAbsolutePath: true });
 const PNPM = (...argvs) => ({ kind: "adapter", adapter: "rightkit-pnpm", argvs });
-const CARGO = (...argvs) => ({ kind: "cargo", argvs });
+/**
+ * A cargo command as a broker host receives it. Every Cargo call of a snapshot stage is carried (carried-cargo.mjs): `--manifest-path` is
+ * not sent (the call runs from the manifest's directory) and a build or run is sent with `--locked`, so the signed `requestedArgv` is
+ * that argv and the signed `workspace` is that directory of the checkout, never the spelling the stage's code wrote. `cwd` is the
+ * directory the stage runs the command from, relative to the repository root; the row keeps the directory the call runs in.
+ */
+const CARGO = (cwd, ...argvs) => {
+  const carried = argvs.map((argv) => carriedRequestOf(argv, cwd) ?? { argv, cwd });
+  if (new Set(carried.map((c) => c.cwd)).size !== 1) throw new Error(`the spellings of one cargo command run in different directories: ${argvs.map((a) => a.join(" ")).join(" | ")}`);
+  return { kind: "cargo", argvs: carried.map((c) => c.argv), cwd: carried[0].cwd };
+};
 
 /** Readable name of an expected command (scratch paths shown as <scratch>). */
 export const describeCommand = (row) => `${row.kind === "adapter" ? "pnpm" : "cargo"} ${row.argvs[0].map((a) => (typeof a === "string" ? a : "<scratch>")).join(" ")}`;
@@ -22,16 +34,18 @@ export const describeCommand = (row) => `${row.kind === "adapter" ? "pnpm" : "ca
 export function expectedStageCommands({ kind, unit, config, manifest, platform }) {
   const dir = kind === "npm" ? `packages/${unit.slice("@rightkit/".length)}` : `crates/${unit}`;
   const plan = localTestPlan({ kind, unit, dir, config, manifest, batch: false, platform });
-  const compile = plan.steps.map((step) => (step.command === "pnpm" ? PNPM(step.args) : CARGO(step.args)));
+  // The stage's own working directories (local-publish.mjs): a crate's cargo steps run in its workspace; a consumer row's (named by
+  // --manifest-path from the repository root) and the swap helper's run from the repository root.
+  const crateDir = `crates/${unit}`;
+  const compile = plan.steps.map((step) => (step.command === "pnpm" ? PNPM(step.args) : CARGO(step.args.includes("--manifest-path") ? "." : crateDir, step.args)));
   const pack = [];
   if (kind === "npm") {
-    if (unit === SWAP_HELPER_PACKAGE) {
-      // The swap helper builds and signs a binary, then packs from a scratch copy of its directory.
-      pack.push(CARGO(SWAP_HELPER_CARGO_ARGS), CARGO(SWAP_HELPER_METADATA_ARGS), PNPM(npmPackArgs(ANY_ABSOLUTE_PATH, ANY_ABSOLUTE_PATH)));
-    } else pack.push(PNPM(npmPackArgs(dir, ANY_ABSOLUTE_PATH)));
+    // The swap helper builds and signs a binary into its own directory of the snapshot (a declared stage output), then packs from there like any unit.
+    if (unit === SWAP_HELPER_PACKAGE) pack.push(CARGO(".", SWAP_HELPER_CARGO_ARGS), CARGO(".", SWAP_HELPER_METADATA_ARGS));
+    pack.push(PNPM(npmPackArgs(dir, ANY_ABSOLUTE_PATH)));
   } else {
-    compile.unshift(CARGO(qualifyFmtArgs(unit)));
-    pack.push(CARGO(cargoPackageArgs(unit, true)), CARGO([...CARGO_METADATA_ARGS], CARGO_METADATA_ARGS.filter((arg) => arg !== "--offline")));
+    compile.unshift(CARGO(crateDir, qualifyFmtArgs(unit)));
+    pack.push(CARGO(crateDir, cargoPackageArgs(unit, true)), CARGO(crateDir, [...CARGO_METADATA_ARGS], CARGO_METADATA_ARGS.filter((arg) => arg !== "--offline")));
   }
   return { compile, package: pack };
 }
@@ -39,21 +53,50 @@ export function expectedStageCommands({ kind, unit, config, manifest, platform }
 const argvMatches = (expected, actual) => Array.isArray(actual) && expected.length === actual.length
   && expected.every((want, i) => (want === ANY_ABSOLUTE_PATH ? typeof actual[i] === "string" && (path.posix.isAbsolute(actual[i]) || /^[A-Za-z]:[\\/]/.test(actual[i])) : want === actual[i]));
 
-/** Whether a signed payload's request is this command: request.kind, adapter (when any) and requestedArgv. */
-export function requestIs(payload, row) {
+const posixOf = (p) => String(p ?? "").replaceAll("\\", "/").replace(/\/+$/, "");
+const realOf = (p) => { try { return fs.realpathSync.native(p); } catch { return path.resolve(p); } };
+
+/**
+ * The repository root a job ran under, given the directory its row runs in: the signed `workspace` of a carried cargo call is that
+ * directory of the checkout (`crates/<x>`), so the root is the workspace with the row's `cwd` removed. Null when the workspace is not that
+ * directory. A row with no `cwd` (a pnpm job) ran at the root itself.
+ */
+export function rootOfWorkspace(workspace, cwd) {
+  const where = posixOf(workspace);
+  if (cwd === undefined || cwd === ".") return where;
+  return where.endsWith(`/${cwd}`) ? where.slice(0, -(cwd.length + 1)) : null;
+}
+
+/** Whether the signed workspace is the directory the row runs in. With `checkout` (the gate's own primary checkout) it must be exactly that directory of it. */
+function workspaceIs(workspace, row, checkout) {
+  if (row.cwd === undefined) return true;
+  if (typeof workspace !== "string" || !workspace) return false;
+  if (checkout) {
+    const want = path.join(checkout, ...(row.cwd === "." ? [] : row.cwd.split("/")));
+    return posixOf(workspace) === posixOf(want) || posixOf(realOf(workspace)) === posixOf(realOf(want));
+  }
+  return rootOfWorkspace(workspace, row.cwd) !== null;
+}
+
+/**
+ * Whether a signed payload's request is this command: request.kind, adapter (when any), requestedArgv, and for a cargo command the
+ * directory it ran in (`row.cwd`: a different crate's call cannot satisfy it). `checkout` pins that directory exactly (the gate knows its
+ * checkout; the hosted admission does not and checks the suffix).
+ */
+export function requestIs(payload, row, { checkout = null } = {}) {
   const request = payload?.request;
-  return Boolean(request && typeof request === "object" && request.kind === row.kind && (row.adapter === undefined || request.adapter === row.adapter) && row.argvs.some((argv) => argvMatches(argv, request.requestedArgv)));
+  return Boolean(request && typeof request === "object" && request.kind === row.kind && (row.adapter === undefined || request.adapter === row.adapter) && row.argvs.some((argv) => argvMatches(argv, request.requestedArgv)) && workspaceIs(request.workspace, row, checkout));
 }
 
 /**
  * Assigns each job (`{ id, payload }`) to a distinct command of the stage. Returns { assigned: Map(id -> row), unmatched: [id...],
  * missing: [row...] }: a job that is none of the commands is unmatched; a command no job covers is missing.
  */
-export function assignJobs(rows, jobs) {
+export function assignJobs(rows, jobs, options = {}) {
   const free = rows.map((row) => ({ row, taken: false }));
   const assigned = new Map(), unmatched = [];
   for (const job of jobs) {
-    const slot = free.find((s) => !s.taken && requestIs(job.payload, s.row));
+    const slot = free.find((s) => !s.taken && requestIs(job.payload, s.row, options));
     if (slot) { slot.taken = true; assigned.set(job.id, slot.row); } else unmatched.push(job.id);
   }
   return { assigned, unmatched, missing: free.filter((s) => !s.taken).map((s) => s.row) };

package/stage-sidecar.mjs

@@ -38,7 +38,9 @@ import os from "node:os";
 import path from "node:path";
 import { spawnSync as nodeSpawnSync } from "./background-process.mjs";
 import { resolveCommand } from "./development.mjs";
-import { directPlatform, managedHost } from "./managed-cargo.mjs";
+import { carriedCargoMapOf } from "./carried-cargo.mjs";
+import { BUILD_LAUNCH_REFUSED, buildLaunch } from "./build-launch.mjs";
+import { directHost, managedHost, runCargoSync } from "./managed-cargo.mjs";
 import { APPROVAL_MACHO_STRIP_LINKEDIT_V1, APPROVAL_RAW_SHA256, approvalDigest } from "./macho-approval-hash.mjs";
 import {
   bundledFileName, planMediaSidecar, sourceOfferText, stagedFileName, validateMediaSidecarConfig, verifyStagedSidecars, writeMediaSidecarNotices,
@@ -583,6 +585,9 @@ const tail = (text, lines = 12) => String(text ?? "").trim().split("\n").slice(-
 /** Default process runner: `rustright` resolves through the installed runtime client (its Windows shim is rustright.cmd). */
 export function defaultRun(command, args, { cwd, env = process.env } = {}) {
   if (command === "rightkit") throw new Error("`rightkit` is the retired name of the RustRight client (rustright#91); use rustright (stage: { cmd: \"rustright\" })");
+  // Every `rustright cargo` of this module is a right-release Cargo call: the one carried seam (managed-cargo.mjs runCargoSync) takes it,
+  // so a snapshot stage's call is carried and verified, and any other host runs it as before.
+  if (command === "rustright" && args[0] === "cargo") return runCargoSync(args.slice(1), { cwd, env, encoding: "utf8", maxBuffer: 512 * 1024 * 1024, shell: false, windowsHide: true, stdio: ["inherit", "pipe", "inherit"] });
   const launch = command === "rustright" ? resolveCommand(command, args, { root: cwd, env }) : { command, args };
   return nodeSpawnSync(launch.command, launch.args, {
     cwd, env: { ...env, ...(launch.env ?? {}) }, encoding: "utf8", maxBuffer: 512 * 1024 * 1024, shell: false, windowsHide: true, stdio: ["inherit", "pipe", "inherit"],
@@ -668,7 +673,7 @@ function resolveCatalogFile(spec, ctx, kind) {
   if (spec.via === "absolute") return requireSnapshotSource(ctx, spec.file, `the ${label} catalog`);
   if (spec.via === "path") return requireSnapshotSource(ctx, path.resolve(ctx.appRoot, spec.file), `the ${label} catalog`);
   if (spec.via === "crate") {
-    const meta = ctx.run("rustright", ["cargo", "metadata", "--format-version", "1"], { cwd: ctx.appRoot, env: ctx.env });
+    const meta = ctx.run("rustright", ["cargo", "metadata", "--frozen", "--format-version", "1"], { cwd: ctx.appRoot, env: ctx.env });
     let packages;
     try { packages = JSON.parse(meta.stdout).packages; } catch { /* refused below */ }
     if (meta?.status !== 0 || !Array.isArray(packages)) fail("STAGE_SIDECAR_CATALOG_UNREADABLE", `the ${label} catalog crate ${spec.crate} cannot be located: the workspace metadata query failed`, { crate: spec.crate });
@@ -760,12 +765,16 @@ function cleanDest(ctx, entry, dest, { directory = false } = {}) {
 function carryMtime(ctx, dest, sources) {
   const { fs } = ctx;
   if (typeof fs.utimesSync !== "function") return;
+  // Millisecond precision (a Date), FLOORED: Node's `stat().mtime` rounds the file's sub-millisecond part to the nearest millisecond, so a source whose mtime is x.6 ms would be carried
+  // as x+1 ms, newer than the source it was copied from; floored, the carried mtime is never newer than the source and less than a millisecond older. `mtimeMs` carries the
+  // fraction; a file system double that gives only a `mtime` Date is carried as that Date.
   let newest = null;
   for (const source of sources) {
     let st; try { st = fs.statSync(source); } catch { continue; }
-    if (st?.mtime instanceof Date && (!newest || st.mtime > newest)) newest = st.mtime;
+    const ms = Number.isFinite(st?.mtimeMs) ? Math.floor(st.mtimeMs) : st?.mtime instanceof Date ? st.mtime.getTime() : null;
+    if (ms !== null && (newest === null || ms > newest)) newest = ms;
   }
-  if (newest) { try { fs.utimesSync(dest, newest, newest); } catch { /* the mtime is a cache hint, never a binding */ } }
+  if (newest !== null) { const carried = new Date(newest); try { fs.utimesSync(dest, carried, carried); } catch { /* the mtime is a cache hint, never a binding */ } }
 }
 
 function copyInto(ctx, source, dest, { executable }) {
@@ -799,6 +808,38 @@ function requireSnapshotSource(ctx, file, label) {
   if (relative === ".." || relative.startsWith(`..${path.sep}`) || path.isAbsolute(relative)) fail("STAGE_SIDECAR_SOURCE_OUTSIDE_SNAPSHOT", `${label} resolves to ${file}, outside the snapshot's app root ${ctx.appRoot}; a split run reads sources only from the snapshot (checkout bytes enter only as digest-pinned cache entries)`, { file });
   return file;
 }
+/**
+ * The Cargo output directory of the workspace a split run builds in, as the checkout's absolute path, or `{ error }`. Resolved from the SNAPSHOT: `cargo
+ * metadata --offline --no-deps` runs in the snapshot's app root (with `--manifest-path` the snapshot's manifest when the entry names one), so the
+ * committed manifests and Cargo configuration decide, and a path it reports under the snapshot is mapped lexically to the same relative path under the
+ * checkout (the output directory is the checkout's, GATE-CONTRACT "Output directory & cache"; cargoOutputPin does the same for the stage's own calls). The
+ * checkout is never asked: a newer HEAD that deleted the crate's directory, a dirty manifest or another build.target-dir there changes nothing (audit GB-16).
+ * A path outside the snapshot (an absolute CARGO_TARGET_DIR, a target-dir set in the user's Cargo home) stands as reported.
+ */
+function snapshotTargetDirectory(ctx, env, manifest) {
+  const resolved = ctx.run("rustright", ["cargo", "metadata", "--offline", "--format-version", "1", "--no-deps", ...(manifest ? ["--manifest-path", manifest] : [])], { cwd: ctx.appRoot, env });
+  let dir;
+  try { dir = JSON.parse(resolved?.stdout).target_directory; } catch { /* reported below */ }
+  if (resolved?.error || resolved?.status !== 0 || typeof dir !== "string" || !path.isAbsolute(dir)) return { error: resolved?.error?.message ?? `exit ${resolved?.status}` };
+  const roots = splitRoots(ctx);
+  for (const snapshot of roots.snapshots) {
+    const rel = path.relative(snapshot, dir);
+    if (rel === "" || (!rel.startsWith("..") && !path.isAbsolute(rel))) return { dir: path.join(roots.checkout, rel) };
+  }
+  return { dir: path.resolve(dir) };
+}
+
+/** The snapshot's and the checkout's roots of a split run: `appRoot` and `cacheRoot` are the same app directory in each, so what their paths do not share is the root. */
+function splitRoots(ctx) {
+  const a = path.resolve(ctx.appRoot).split(path.sep); const c = path.resolve(ctx.cacheRoot).split(path.sep);
+  let n = 0;
+  while (n < a.length - 1 && n < c.length - 1 && a[a.length - 1 - n] === c[c.length - 1 - n]) n += 1;
+  const snapshot = a.slice(0, a.length - n).join(path.sep) || path.sep;
+  const snapshots = [snapshot];
+  try { snapshots.push(nodeFs.realpathSync.native(snapshot)); } catch { /* the path as given */ }
+  return { snapshots, checkout: c.slice(0, c.length - n).join(path.sep) || path.sep };
+}
+
 /**
  * The environment a split run hands to the commands it starts (a `command` entry, an ffmpeg `stage` command): Cargo's output directory is
  * the checkout's, resolved there once and passed absolute, so a command that reaches Cargo (`rustright cargo run -p ...`) never writes
@@ -806,15 +847,40 @@ function requireSnapshotSource(ctx, file, label) {
  */
 function splitCommandEnv(ctx) {
   if (!ctx.split) return ctx.env;
+  // A carried stage (carried-cargo.mjs): the broker pins every Cargo output, so nothing is pinned here and the commands inherit the carrier.
+  if (carriedCargoMapOf(ctx.env)?.map) return ctx.env;
   if (ctx.splitEnv === undefined) {
-    const resolved = ctx.run("rustright", ["cargo", "metadata", "--format-version", "1", "--no-deps"], { cwd: ctx.cacheRoot, env: ctx.env });
-    let dir;
-    try { dir = JSON.parse(resolved?.stdout).target_directory; } catch { /* no workspace in the checkout: nothing to pin */ }
-    ctx.splitEnv = !resolved?.error && resolved?.status === 0 && typeof dir === "string" && path.isAbsolute(dir) ? { ...ctx.env, CARGO_TARGET_DIR: path.resolve(dir) } : ctx.env;
+    const pinned = snapshotTargetDirectory(ctx, ctx.env, null); // no Cargo workspace in the snapshot: nothing to pin
+    ctx.splitEnv = pinned.dir ? { ...ctx.env, CARGO_TARGET_DIR: pinned.dir } : ctx.env;
   }
   return ctx.splitEnv;
 }
 
+/**
+ * One step command of a config (`stage.cmd`, a `command` entry's `cmd`, the cmake tool). In a snapshot stage with a carrier (the gate's
+ * carrier map in the environment) every compile is carried or nested under a carried adapter job, so such a step goes through the door
+ * (build-launch.mjs): `pnpm`, `node` and `swift` become carried adapter jobs, `rightkit-qa` runs direct (it compiles nothing), `rustright cargo` keeps the carried seam
+ * (defaultRun), this package's own `right-release` runs as it is, and anything else (`cmake`, a bare tool, `rustright <not cargo>`) is
+ * refused with STAGE_SIDECAR_STEP_REFUSED, naming the step: it would otherwise run uncarried around the broker. Without a carrier the
+ * step runs exactly as before. Utility commands that compile nothing (`tar`, `codesign`) never come through here.
+ */
+export function runStep(ctx, command, args, options = {}) {
+  const env = options.env ?? ctx.env;
+  const carried = carriedCargoMapOf(env);
+  if (!carried || (command === "rustright" && String(args[0]) === "cargo")) return ctx.run(command, args, options);
+  const describe = `${command} ${args.join(" ")}`.trim();
+  if (carried.error) fail("STAGE_SIDECAR_STEP_REFUSED", `step \`${describe}\`: ${carried.error}; a snapshot stage's step is never run around its carrier`, { command });
+  const own = command === "right-release" || (command === "pnpm" && ((args[0] === "exec" && args[1] === "right-release") || args[0] === "right-release"));
+  let launch;
+  try {
+    launch = own ? resolveCommand(command, args, { root: options.cwd, env }) : buildLaunch(command, args, { env, cwd: options.cwd, exists: ctx.fs?.existsSync });
+  } catch (error) {
+    if (error?.code === BUILD_LAUNCH_REFUSED) fail("STAGE_SIDECAR_STEP_REFUSED", `step \`${describe}\` of a snapshot stage is refused: ${error.message}`, { command });
+    throw error;
+  }
+  return ctx.run(launch.command, launch.args, { ...options, env: launch.env ? { ...env, ...launch.env } : env });
+}
+
 /** A cache directory the config names (`cacheDir`): the checkout's `.right-release` under a split, the app root otherwise. */
 const cacheDirFor = (ctx, dir) => (ctx.split ? path.resolve(ctx.cacheRoot, ".right-release", dir) : path.resolve(ctx.appRoot, dir));
 /** The per-arch slice directory of a universal staging: absolute under the checkout's cache root on a split, app-relative otherwise. */
@@ -907,18 +973,24 @@ function stageCargoBuild(entry, ctx, triple) {
   // resolved in the checkout instead and passed as an absolute CARGO_TARGET_DIR, so the warm outputs stay the checkout's and the
   // snapshot holds no target/ (docs/GATE-CONTRACT.md "Output directory & cache").
   let buildEnv = env;
-  if (ctx.split) {
-    const checkoutManifest = entry.manifestPath ? ["--manifest-path", path.resolve(ctx.cacheRoot, entry.manifestPath)] : [];
-    const resolved = run("rustright", ["cargo", "metadata", "--format-version", "1", "--no-deps", ...checkoutManifest], { cwd: ctx.cacheRoot, env });
-    let pinned;
-    try { pinned = JSON.parse(resolved?.stdout).target_directory; } catch { /* refused below */ }
-    if (resolved?.error || resolved?.status !== 0 || typeof pinned !== "string" || !path.isAbsolute(pinned)) fail("STAGE_SIDECAR_BUILD_FAILED", `the checkout's cargo output directory for ${entry.package} cannot be resolved (${resolved?.error?.message ?? `exit ${resolved?.status}`}); nothing was built`, { package: entry.package });
-    buildEnv = { ...env, CARGO_TARGET_DIR: path.resolve(pinned) };
+  // A carried stage (carried-cargo.mjs, a broker host): the broker pins the output directory and the call passes no CARGO_TARGET_DIR;
+  // the directory the binary is read from is the signed receipt's `outputDir`, never a carrier-less `cargo metadata`.
+  const carried = Boolean(carriedCargoMapOf(env)?.map);
+  if (ctx.split && !carried) {
+    const pinned = snapshotTargetDirectory(ctx, env, entry.manifestPath ? path.resolve(appRoot, entry.manifestPath) : null);
+    if (!pinned.dir) fail("STAGE_SIDECAR_BUILD_FAILED", `the cargo output directory for ${entry.package} cannot be resolved from the snapshot (${pinned.error}); nothing was built`, { package: entry.package });
+    buildEnv = { ...env, CARGO_TARGET_DIR: pinned.dir };
   }
   const built = run("rustright", args, { cwd: appRoot, env: buildEnv });
   if (built?.error || built?.status !== 0) fail("STAGE_SIDECAR_BUILD_FAILED", `rustright cargo build of ${entry.package} failed (${built?.error?.message ?? `exit ${built?.status}`})`, { package: entry.package, stderr: tail(built?.stderr) });
   let source = artifactFromStream(built.stdout, entry.bin);
-  if (!source || !fs.existsSync(source)) {
+  if (carried && (!source || !fs.existsSync(source))) {
+    const targetDir = typeof built.outputDir === "string" && path.isAbsolute(built.outputDir) ? built.outputDir : undefined;
+    if (!targetDir) fail("STAGE_SIDECAR_BINARY_NOT_FOUND", `cargo reported no ${entry.bin} executable and the receipt names no output directory`, { bin: entry.bin });
+    const candidates = builtBinaryCandidates({ targetDir, targetDirs: [], triple, profile: entry.profile, bin: entry.bin, windows: ctx.windows });
+    source = candidates.find((file) => fs.existsSync(file));
+    if (!source) fail("STAGE_SIDECAR_BINARY_NOT_FOUND", `the build did not produce ${entry.bin} (looked in ${candidates.join(", ")})`, { bin: entry.bin, candidates });
+  } else if (!source || !fs.existsSync(source)) {
     const meta = run("rustright", ["cargo", "metadata", "--format-version", "1", "--no-deps", ...(entry.manifestPath ? ["--manifest-path", path.resolve(appRoot, entry.manifestPath)] : [])], { cwd: appRoot, env: buildEnv });
     let targetDir;
     try { targetDir = JSON.parse(meta.stdout).target_directory; } catch { /* refused below */ }
@@ -1029,7 +1101,7 @@ async function stageFfmpegSlice(entry, ctx, resolved, { config, t, writeNotices,
     // A universal entry stages once per slice: `{arch}`, `{triple}` and `{stageDir}` in the stage command's arguments name the slice.
     const args = (config.stage.args ?? []).map((arg) => (universal ? String(arg).replaceAll("{arch}", t.arch).replaceAll("{triple}", t.triple).replaceAll("{stageDir}", sliceRoot === appRoot ? config.stageDir : path.resolve(sliceRoot, config.stageDir)) : arg));
     ctx.log(`stage-sidecar: ${config.stage.cmd} ${args.join(" ")}`);
-    const staged = run(config.stage.cmd, args, { cwd: appRoot, env: splitCommandEnv(ctx) });
+    const staged = runStep(ctx, config.stage.cmd, args, { cwd: appRoot, env: splitCommandEnv(ctx) });
     if (staged?.error || staged?.status !== 0) fail("STAGE_SIDECAR_BUILD_FAILED", `ffmpeg stage command failed (${staged?.error?.message ?? `exit ${staged?.status}`})`);
   }
   const noticeFiles = writeNotices ? writeMediaSidecarNotices(plan, { exists: fs.existsSync, mkdir: fs.mkdirSync, copy: fs.copyFileSync, write: fs.writeFileSync }) : [];
@@ -1519,7 +1591,7 @@ function stageCommand(entry, ctx) {
   const cwd = entry.cwd ? path.resolve(appRoot, entry.cwd) : appRoot;
   cleanDest(ctx, entry, destFor(entry, ctx));
   ctx.log(`stage-sidecar: ${entry.cmd} ${entry.args.join(" ")}`);
-  const built = run(entry.cmd, entry.args, { cwd, env: splitCommandEnv(ctx) });
+  const built = runStep(ctx, entry.cmd, entry.args, { cwd, env: splitCommandEnv(ctx) });
   if (built?.error || built?.status !== 0) fail("STAGE_SIDECAR_BUILD_FAILED", `command ${entry.name} (${entry.cmd}) failed (${built?.error?.message ?? `exit ${built?.status}`})`, { name: entry.name, stderr: tail(built?.stderr) });
   const source = path.resolve(appRoot, entry.output);
   if (!fs.existsSync(source) || !fs.statSync(source).isFile()) fail("STAGE_SIDECAR_BINARY_NOT_FOUND", `command ${entry.name} did not produce ${entry.output}`, { name: entry.name, output: entry.output });
@@ -1681,7 +1753,7 @@ function stageCmake(entry, ctx) {
   const configure = ["-S", srcDir, "-B", buildDir, "-DCMAKE_BUILD_TYPE=Release", ...(generator ? ["-G", generator] : []), ...(entry.architecture ? ["-A", entry.architecture] : []), ...(archFlag ? [archFlag] : []), ...(entry.platformArgs[target.platform] ?? []), ...entry.cmakeArgs];
   const step = (args, label) => {
     ctx.log(`stage-sidecar: ${cmake} ${args.join(" ")}`);
-    const result = run(cmake, args, { cwd: appRoot, env });
+    const result = runStep(ctx, cmake, args, { cwd: appRoot, env });
     if (result?.error || result?.status !== 0) fail("STAGE_SIDECAR_BUILD_FAILED", `cmake ${label} of ${entry.name} failed (${result?.error?.message ?? `exit ${result?.status}`})`, { name: entry.name, stderr: tail(result?.stderr) });
   };
   step(configure, "configure");
@@ -1808,8 +1880,8 @@ function wipeStaleStageDir(ctx, plan, produced) {
  */
 export function isNestedBrokerContext(env = process.env, platform = process.platform) {
   // A direct (Linux) host has no broker, so no outer broker build to nest in, whatever flag or socket the env carries (heavy-command sets
-  // RIGHTSUITE_HEAVY_WORK_OWNER on every platform).
-  if (directPlatform(platform)) return false;
+  // RIGHTSUITE_HEAVY_WORK_OWNER on every platform). A Linux host that declared the broker route (managed-cargo linuxBrokerDeclared) is a broker host.
+  if (directHost(platform, env ?? {})) return false;
   if (env?.RIGHTKIT_STAGE_SIDECAR_ALLOW_NESTED === "1") return false;
   const insideTauri = Boolean(env?.TAURI_ENV_PLATFORM || env?.TAURI_ENV_TARGET_TRIPLE);
   return insideTauri && (managedHost(env ?? {}, platform) || env?.RIGHTSUITE_HEAVY_WORK_OWNER === "1");