Merge nucleic/amber-velvet-marten-zmww into dev

Makefile

@@ -20,13 +20,14 @@
 # if ever necessary, e.g. `make dev BUILDSYS='--build-system native'`.
 # dev is a debug build; canary/beta/rc/stable are release-optimized.
 
-# SwiftPM/SwiftBuild bake the repo's ABSOLUTE path into .build/, but the same trunk is
-# reachable at different paths depending on where the build runs (host: /Users/…; the
-# per-session macOS VM: /Volumes/My Shared Files/…). A single shared .build/ gets poisoned
-# by whichever mount built last. scripts/lib/build-scratch.sh gives each mount its own
-# scratch tree: nothing extra on the host (default .build/), a `--scratch-path` redirect
-# onto the VM's local disk when building from the /Volumes share. See BUILD.md
-# "Cross-environment builds". Appended to every swift build/run/test below.
+# The per-session macOS VM mounts this trunk over virtiofs at the SAME absolute /Users/… path
+# as the host, so both environments share one physical .build/. Driving every object file
+# through virtiofs is far slower than the guest's own disk, and SwiftPM's binary-target
+# extraction needs filesystem operations virtiofs does not provide (Sparkle's xcframework
+# fails to unpack there). scripts/lib/build-scratch.sh gives each mount its own scratch tree:
+# nothing extra on the host (default .build/), a `--scratch-path` redirect onto the VM's local
+# disk when building from the share. See BUILD.md "Cross-environment builds". Appended to
+# every swift build/run/test below.
 SCRATCH := $(shell bash ./scripts/lib/build-scratch.sh)
 
 BUILDSYS :=

scripts/build-macos-base.sh

@@ -65,7 +65,7 @@ fi
 # ── Step 1: build + ad-hoc-codesign the spike ────────────────────────────────────────────────────
 # Ad-hoc signing (`--sign -`) is enough for com.apple.security.virtualization; a Developer ID is NOT
 # required to run VMs locally. --force re-signs an existing binary so this stays idempotent.
-# Per-mount scratch dir (empty on host, --scratch-path redirect on the /Volumes VM share)
+# Per-mount scratch dir (empty on host, --scratch-path redirect on the VM's virtiofs share)
 # so host and VM builds don't share/poison one .build/. Same flag on the build and the
 # --show-bin-path query. See scripts/lib/build-scratch.sh and BUILD.md.
 SCRATCH_ARGS="$(bash "$ROOT/scripts/lib/build-scratch.sh" "$ROOT")"

scripts/build-vm-agent.sh

@@ -22,8 +22,8 @@ OUT_DIR="${1:-$PKG_DIR/dist}"
 APP="$OUT_DIR/NucleicVMAgent.app"
 IDENTITY="${NUCLEIC_VMAGENT_SIGN_IDENTITY:-}"
 
-# Per-mount scratch dir (keyed on the guest package's own path) so a build off the /Volumes
-# VM share doesn't poison the host's guest/NucleicVMAgent/.build. See scripts/lib/build-scratch.sh.
+# Per-mount scratch dir (keyed on the guest package's own path) so a build off the VM's
+# virtiofs share doesn't poison the host's guest/NucleicVMAgent/.build. See scripts/lib/build-scratch.sh.
 SCRATCH_ARGS="$(bash "$REPO_ROOT/scripts/lib/build-scratch.sh" "$PKG_DIR")"
 
 echo "▸ Building NucleicVMAgent (release) …"

scripts/lib/build-scratch.sh

@@ -66,11 +66,24 @@ case "$resolved" in
 esac
 
 # A custom-tagged macOS share is mounted directly at the original workdir. Find any enclosing
-# virtiofs mount point from mount(8)'s "<source> on <path> (virtiofs, ...)" output. Process
+# virtiofs mount point from mount(8)'s "<source> on <path> (<fstype>, ...)" output. Process
 # substitution keeps the flag in this shell rather than a pipeline subshell.
+#
+# The type field is NOT spelled consistently: the guest reports "AppleVirtIOFS" (device
+# "virtio-fs"), while other seeds/hosts print a plain "virtiofs". Matching only the lowercase
+# literal left the guest undetected, so SwiftPM kept its scratch tree in the shared checkout and
+# Sparkle's binary-target extraction failed on virtiofs. Compare the parenthesised type field
+# case-insensitively against every spelling instead.
 while IFS= read -r line; do
-  case "$line" in
-    *" (virtiofs"*)
+  # Options are the LAST parenthesised group, so strip to the final "(" — a mount point
+  # containing "(" can't shift the field. The "(" MUST be backslash-escaped: unescaped, a
+  # shell with extglob enabled reads "*(" as the start of an extglob group instead of a
+  # literal, and the strip silently no-ops.
+  fstype="${line##*\(}"
+  fstype="${fstype%%,*}"
+  fstype="${fstype%\)}"
+  case "$(printf '%s' "$fstype" | tr '[:upper:]' '[:lower:]')" in
+    virtiofs | virtio-fs | applevirtiofs)
       mountpoint="${line#* on }"
       mountpoint="${mountpoint% (*}"
       case "$resolved/" in

scripts/package-app.sh

@@ -110,7 +110,7 @@ clean_icloud_dupes() {
 clean_icloud_dupes
 
 # Per-mount scratch dir so a build from the VM share doesn't poison the host's .build/
-# (and vice versa). Empty on the host; a --scratch-path redirect on the /Volumes share.
+# (and vice versa). Empty on the host; a --scratch-path redirect on the virtiofs share.
 # Must be passed to BOTH the build and the --show-bin-path query so they agree. See
 # scripts/lib/build-scratch.sh and BUILD.md "Cross-environment builds".
 SCRATCH_ARGS="$(bash "$ROOT/scripts/lib/build-scratch.sh" "$ROOT")"