From 3b8a43a572a636045baa05347b5a54fa653e73ba Mon Sep 17 00:00:00 2001
From: leynos <leynos@rohga>
Date: Wed, 29 Jul 2026 00:38:55 +0200
Subject: [PATCH 01/24] Add opt-in mold and Cranelift local build acceleration

Introduce pinned toolchain contracts and Make targets for accelerated
local debug builds, without changing any existing quality gate or CI
path.

- Pin the mold release and its artefact checksums under `tools/mold/`,
  and the Cranelift-bearing nightly under `tools/cranelift/`, so the
  linker, backend, and toolchain move in lockstep.
- Add `tools/dev-fast/config.toml`, a Cargo fragment that is
  deliberately *not* `.cargo/config.toml`. Cargo auto-discovers that
  path, which would leak nightly-only unstable flags and a Linux-only
  linker choice into CI's stable and MSRV legs, release packaging,
  coverage, and the formal-verification toolchains. It is reachable only
  through `cargo --config` from the new `dev-*` targets.
- Add `make install-dev-fast`, `make dev-fast-check`, `make dev-build`,
  `make dev-test`, and `make bench-build`, backed by shell helpers under
  `scripts/`. The capability check gates the build targets so a missing
  tool yields an actionable installation hint rather than an opaque
  codegen-backend or linker failure.
- Gate the mold link argument behind `cfg(target_os = "linux")` so macOS
  and Windows fall back to the platform linker.
---
 Makefile                    | 30 +++++++++++++-
 scripts/bench-build.sh      | 81 +++++++++++++++++++++++++++++++++++++
 scripts/dev-fast-check.sh   | 62 ++++++++++++++++++++++++++++
 scripts/dev-fast-common.sh  | 63 +++++++++++++++++++++++++++++
 scripts/install-dev-fast.sh | 74 +++++++++++++++++++++++++++++++++
 tools/cranelift/VERSION     |  1 +
 tools/dev-fast/config.toml  | 29 +++++++++++++
 tools/mold/SHA256SUMS       |  2 +
 tools/mold/VERSION          |  1 +
 9 files changed, 342 insertions(+), 1 deletion(-)
 create mode 100755 scripts/bench-build.sh
 create mode 100755 scripts/dev-fast-check.sh
 create mode 100644 scripts/dev-fast-common.sh
 create mode 100755 scripts/install-dev-fast.sh
 create mode 100644 tools/cranelift/VERSION
 create mode 100644 tools/dev-fast/config.toml
 create mode 100644 tools/mold/SHA256SUMS
 create mode 100644 tools/mold/VERSION

diff --git a/Makefile b/Makefile
index f3f0ed895..e9542a616 100644
--- a/Makefile
+++ b/Makefile
@@ -1,4 +1,4 @@
-.PHONY: help all clean test test-nextest doctest test-workflow-contracts test-typos-config build release lint lint-clippy lint-whitaker fmt check-fmt typecheck markdownlint spelling spelling-config spelling-helper-test nixie install-kani kani-check kani-full kani-ir install-verus verus formal-pr
+.PHONY: help all clean test test-nextest doctest test-workflow-contracts test-typos-config build release lint lint-clippy lint-whitaker fmt check-fmt typecheck markdownlint spelling spelling-config spelling-helper-test nixie install-kani kani-check kani-full kani-ir install-verus verus formal-pr install-dev-fast dev-fast-check dev-build dev-test bench-build
 
 APP ?= netsuke
 CARGO ?= $(shell command -v cargo 2>/dev/null || printf '%s' "$$HOME/.cargo/bin/cargo")
@@ -18,6 +18,19 @@ KANI_FLAGS ?=
 KANI_INSTALL_FLAGS ?=
 KANI_CHECK_FLAGS ?=
 KANI_VERSION_FILE ?= tools/kani/VERSION
+# Opt-in local build acceleration. The Cargo fragment is deliberately not
+# `.cargo/config.toml`, so only the `dev-*` targets below can reach it and CI's
+# stable, MSRV, release, coverage, and formal-verification legs stay on the
+# supported LLVM backend and platform linker.
+MOLD_VERSION_FILE ?= tools/mold/VERSION
+MOLD_SHA256SUMS_FILE ?= tools/mold/SHA256SUMS
+CRANELIFT_TOOLCHAIN_FILE ?= tools/cranelift/VERSION
+DEV_FAST_CONFIG ?= tools/dev-fast/config.toml
+DEV_FAST_ENV = MOLD_VERSION_FILE='$(MOLD_VERSION_FILE)' \
+	MOLD_SHA256SUMS_FILE='$(MOLD_SHA256SUMS_FILE)' \
+	CRANELIFT_TOOLCHAIN_FILE='$(CRANELIFT_TOOLCHAIN_FILE)' \
+	DEV_FAST_CONFIG='$(DEV_FAST_CONFIG)'
+DEV_FAST_TOOLCHAIN = $$(tr -d '[:space:]' <'$(CRANELIFT_TOOLCHAIN_FILE)')
 MDLINT ?= $(shell command -v markdownlint-cli2 2>/dev/null || printf '%s' "$$HOME/.bun/bin/markdownlint-cli2")
 NIXIE ?= nixie
 # Single source of truth for the typos version; the markdownlint target and CI
@@ -148,6 +161,21 @@ verus: ## Run the Verus proof entry point
 formal-pr: ## Run pull-request formal-verification checks
 	$(MAKE) kani-check
 
+install-dev-fast: ## Install the pinned mold linker and Cranelift backend
+	@$(DEV_FAST_ENV) scripts/install-dev-fast.sh
+
+dev-fast-check: ## Check the mold and Cranelift local build prerequisites
+	@$(DEV_FAST_ENV) scripts/dev-fast-check.sh
+
+dev-build: dev-fast-check ## Build the debug binary with Cranelift and mold
+	RUSTUP_TOOLCHAIN=$(DEV_FAST_TOOLCHAIN) $(CARGO) --config '$(DEV_FAST_CONFIG)' build $(BUILD_JOBS) --bin $(APP)
+
+dev-test: dev-fast-check ## Run the test suite with Cranelift and mold
+	RUSTUP_TOOLCHAIN=$(DEV_FAST_TOOLCHAIN) $(CARGO) --config '$(DEV_FAST_CONFIG)' test --all-targets --all-features $(BUILD_JOBS)
+
+bench-build: dev-fast-check ## Time clean and incremental debug builds for both paths
+	@$(DEV_FAST_ENV) CARGO='$(CARGO)' scripts/bench-build.sh
+
 help: ## Show available targets
 	@grep -E '^[a-zA-Z_-]+:.*?##' $(MAKEFILE_LIST) | \
 	awk 'BEGIN {FS=":"; printf "Available targets:\n"} {printf "  %-20s %s\n", $$1, $$2}'
diff --git a/scripts/bench-build.sh b/scripts/bench-build.sh
new file mode 100755
index 000000000..6afcc160c
--- /dev/null
+++ b/scripts/bench-build.sh
@@ -0,0 +1,81 @@
+#!/usr/bin/env bash
+# Benchmark the default (LLVM + platform linker) debug build against the opt-in
+# mold + Cranelift path.
+#
+# Each variant is measured twice: a clean build from an empty target directory,
+# and an incremental rebuild after touching the binary's entry point. Variants
+# use separate target directories so neither warms nor invalidates the other's
+# cache, and neither disturbs the working `target/` tree. Results are printed as
+# a Markdown table so the developers' guide can be regenerated verbatim.
+
+set -euo pipefail
+
+script_dir=$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)
+# shellcheck source=scripts/dev-fast-common.sh
+. "$script_dir/dev-fast-common.sh"
+
+: "${CARGO:=cargo}"
+: "${DEV_FAST_CONFIG:?DEV_FAST_CONFIG must be set}"
+
+BENCH_ROOT=${BENCH_ROOT:-target/bench}
+BENCH_BIN=${BENCH_BIN:-netsuke}
+BENCH_TOUCH_FILE=${BENCH_TOUCH_FILE:-src/main.rs}
+
+# Populated as "<label>|<clean seconds>|<incremental seconds>" rows.
+results=()
+
+# Wall-clock seconds for a command, to one decimal place. EPOCHREALTIME keeps
+# the measurement sub-second without shelling out to an external timer.
+time_command() {
+  local start=${EPOCHREALTIME/,/.} end
+  "$@" >/dev/null 2>&1 || fail "benchmark command failed: $*"
+  end=${EPOCHREALTIME/,/.}
+  LC_ALL=C awk -v start="$start" -v end="$end" 'BEGIN { printf "%.1f", end - start }'
+}
+
+# Usage: measure_variant <slug> <label> <command...>
+# The slug names the variant's private target directory; the label is the table
+# caption for that row.
+measure_variant() {
+  local slug=$1 label=$2
+  local clean incremental
+  shift 2
+  export CARGO_TARGET_DIR="$BENCH_ROOT/$slug"
+
+  note "measuring $label (clean)"
+  rm -rf "$CARGO_TARGET_DIR"
+  clean=$(time_command "$@")
+
+  note "measuring $label (incremental)"
+  touch "$BENCH_TOUCH_FILE"
+  incremental=$(time_command "$@")
+
+  unset CARGO_TARGET_DIR
+  results+=("$label|$clean|$incremental")
+}
+
+report() {
+  local row label clean incremental
+  printf '\n| Variant | Clean build (s) | Incremental build (s) |\n'
+  printf '| --- | --- | --- |\n'
+  for row in "${results[@]}"; do
+    IFS='|' read -r label clean incremental <<<"$row"
+    printf '| %s | %s | %s |\n' "$label" "$clean" "$incremental"
+  done
+}
+
+main() {
+  local toolchain
+  toolchain=$(cranelift_toolchain)
+
+  measure_variant default 'Default (LLVM, platform linker)' \
+    "$CARGO" build --bin "$BENCH_BIN"
+
+  measure_variant dev-fast 'dev-fast (Cranelift, mold)' \
+    env RUSTUP_TOOLCHAIN="$toolchain" \
+    "$CARGO" --config "$DEV_FAST_CONFIG" build --bin "$BENCH_BIN"
+
+  report
+}
+
+main "$@"
diff --git a/scripts/dev-fast-check.sh b/scripts/dev-fast-check.sh
new file mode 100755
index 000000000..490bed736
--- /dev/null
+++ b/scripts/dev-fast-check.sh
@@ -0,0 +1,62 @@
+#!/usr/bin/env bash
+# Fast capability check for the opt-in mold + Cranelift local build path.
+#
+# Runs before `make dev-build` and `make dev-test` so a missing tool produces an
+# actionable installation hint rather than an opaque codegen-backend or linker
+# failure deep inside a Cargo invocation. Exits non-zero when a required
+# component is absent; a version drift from the pin is reported but tolerated.
+
+set -euo pipefail
+
+script_dir=$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)
+# shellcheck source=scripts/dev-fast-common.sh
+. "$script_dir/dev-fast-common.sh"
+
+check_mold() {
+  local pinned=$1 installed
+  if ! is_linux; then
+    note "mold is Linux-only; falling back to the default $(uname -s) linker"
+    return 0
+  fi
+  if ! command -v mold >/dev/null 2>&1; then
+    note "mold not found on PATH (pinned $pinned)"
+    note 'install it with: make install-dev-fast'
+    return 1
+  fi
+  installed=$(installed_mold_version)
+  if [ "$installed" != "$pinned" ]; then
+    note "mold $installed found, pin is $pinned; run make install-dev-fast to match"
+  else
+    note "mold $installed"
+  fi
+}
+
+check_cranelift() {
+  local toolchain=$1
+  if ! command -v rustup >/dev/null 2>&1; then
+    note 'rustup not found on PATH; it is required to select the pinned nightly'
+    note 'install it from https://rustup.rs'
+    return 1
+  fi
+  if ! rustup toolchain list | grep -q "^$toolchain"; then
+    note "toolchain $toolchain is not installed"
+    note 'install it with: make install-dev-fast'
+    return 1
+  fi
+  if ! has_cranelift_component "$toolchain"; then
+    note "$CRANELIFT_COMPONENT is not installed for $toolchain"
+    note 'install it with: make install-dev-fast'
+    return 1
+  fi
+  note "$CRANELIFT_COMPONENT available on $toolchain"
+}
+
+main() {
+  local status=0
+  check_mold "$(mold_version)" || status=1
+  check_cranelift "$(cranelift_toolchain)" || status=1
+  [ "$status" -eq 0 ] || note 'capability check failed; see the messages above'
+  return "$status"
+}
+
+main "$@"
diff --git a/scripts/dev-fast-common.sh b/scripts/dev-fast-common.sh
new file mode 100644
index 000000000..3ecc08e79
--- /dev/null
+++ b/scripts/dev-fast-common.sh
@@ -0,0 +1,63 @@
+#!/usr/bin/env bash
+# Shared helpers for the opt-in mold + Cranelift local build acceleration.
+#
+# Sourced by scripts/install-dev-fast.sh and scripts/dev-fast-check.sh so both
+# resolve the pinned versions and emit diagnostics identically. Every message is
+# prefixed `dev-fast:` and written to stderr, matching the `prover-tools:`
+# convention used by the Kani and Verus targets.
+
+set -euo pipefail
+
+: "${MOLD_VERSION_FILE:?MOLD_VERSION_FILE must be set}"
+: "${MOLD_SHA256SUMS_FILE:?MOLD_SHA256SUMS_FILE must be set}"
+: "${CRANELIFT_TOOLCHAIN_FILE:?CRANELIFT_TOOLCHAIN_FILE must be set}"
+
+# Prefix for the mold installation tree. `bin/` is prepended to PATH by the
+# Makefile, so a pinned mold shadows any older distribution package.
+DEV_FAST_PREFIX="${DEV_FAST_PREFIX:-$HOME/.local}"
+
+# shellcheck disable=SC2034 # consumed by the scripts that source this file.
+CRANELIFT_COMPONENT='rustc-codegen-cranelift-preview'
+
+note() { printf 'dev-fast: %s\n' "$*" >&2; }
+
+fail() {
+  printf 'dev-fast: %s\n' "$*" >&2
+  exit 1
+}
+
+read_pin() {
+  local file=$1 value
+  [ -f "$file" ] || fail "missing version pin: $file"
+  value=$(tr -d '[:space:]' <"$file")
+  [ -n "$value" ] || fail "empty version pin: $file"
+  printf '%s' "$value"
+}
+
+mold_version() { read_pin "$MOLD_VERSION_FILE"; }
+
+cranelift_toolchain() { read_pin "$CRANELIFT_TOOLCHAIN_FILE"; }
+
+is_linux() { [ "$(uname -s)" = 'Linux' ]; }
+
+# mold publishes per-architecture tarballs; map `uname -m` onto those names.
+mold_arch() {
+  local machine
+  machine=$(uname -m)
+  case "$machine" in
+    x86_64 | amd64) printf 'x86_64' ;;
+    aarch64 | arm64) printf 'aarch64' ;;
+    *) fail "unsupported architecture for the pinned mold release: $machine" ;;
+  esac
+}
+
+installed_mold_version() {
+  # `mold --version` prints e.g. "mold 2.41.0 (compatible with GNU ld)".
+  mold --version 2>/dev/null | awk 'NR == 1 { print $2 }'
+}
+
+has_cranelift_component() {
+  local toolchain=$1
+  rustup component list --installed --toolchain "$toolchain" 2>/dev/null |
+    grep -q '^rustc-codegen-cranelift'
+}
diff --git a/scripts/install-dev-fast.sh b/scripts/install-dev-fast.sh
new file mode 100755
index 000000000..d7e200e4c
--- /dev/null
+++ b/scripts/install-dev-fast.sh
@@ -0,0 +1,74 @@
+#!/usr/bin/env bash
+# Install the pinned toolchain for the opt-in mold + Cranelift local build path.
+#
+# Downloads the pinned mold release, verifies it against tools/mold/SHA256SUMS,
+# unpacks it under $DEV_FAST_PREFIX (default ~/.local), then installs the pinned
+# nightly toolchain and its Cranelift codegen backend. Nothing here touches the
+# release, packaging, coverage, or formal-verification toolchains.
+
+set -euo pipefail
+
+script_dir=$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)
+# shellcheck source=scripts/dev-fast-common.sh
+. "$script_dir/dev-fast-common.sh"
+
+MOLD_RELEASE_BASE_URL=${MOLD_RELEASE_BASE_URL:-https://github.com/rui314/mold/releases/download}
+
+# Verify the downloaded tarball against the single matching line in
+# SHA256SUMS. An unlisted artefact is a hard failure, never a silent skip.
+verify_mold_archive() {
+  local archive=$1 name=$2 expected
+  expected=$(awk -v name="$name" '$2 == name { print $1 }' "$MOLD_SHA256SUMS_FILE")
+  [ -n "$expected" ] || fail "no checksum recorded for $name in $MOLD_SHA256SUMS_FILE"
+  printf '%s  %s\n' "$expected" "$archive" | sha256sum --check --status ||
+    fail "checksum mismatch for $name; refusing to install"
+  note "verified $name against $MOLD_SHA256SUMS_FILE"
+}
+
+install_mold() {
+  local version=$1 arch name url workdir
+  if ! is_linux; then
+    note "mold is Linux-only; skipping on $(uname -s), the platform linker is used instead"
+    return 0
+  fi
+  arch=$(mold_arch)
+  name="mold-$version-$arch-linux.tar.gz"
+  url="$MOLD_RELEASE_BASE_URL/v$version/$name"
+
+  workdir=$(mktemp -d)
+  # shellcheck disable=SC2064 # expand workdir now so the trap cannot lose it.
+  trap "rm -rf '$workdir'" EXIT
+
+  note "downloading $url"
+  curl --fail --silent --show-error --location --output "$workdir/$name" "$url" ||
+    fail "failed to download $name"
+  verify_mold_archive "$workdir/$name" "$name"
+
+  # The tarball root is mold-<version>-<arch>-linux/{bin,lib,libexec}; strip it
+  # so the tree merges into the prefix and `bin/ld.mold` lands on PATH.
+  mkdir -p "$DEV_FAST_PREFIX"
+  tar --extract --gzip --strip-components=1 --directory "$DEV_FAST_PREFIX" --file "$workdir/$name" ||
+    fail "failed to unpack $name into $DEV_FAST_PREFIX"
+  note "installed mold $version into $DEV_FAST_PREFIX"
+  note "ensure $DEV_FAST_PREFIX/bin precedes any distribution mold on PATH"
+}
+
+install_cranelift() {
+  local toolchain=$1
+  command -v rustup >/dev/null 2>&1 ||
+    fail 'rustup not found on PATH; install it from https://rustup.rs'
+  note "installing toolchain $toolchain"
+  rustup toolchain install "$toolchain" --profile minimal ||
+    fail "failed to install toolchain $toolchain"
+  note "installing $CRANELIFT_COMPONENT for $toolchain"
+  rustup component add "$CRANELIFT_COMPONENT" --toolchain "$toolchain" ||
+    fail "failed to install $CRANELIFT_COMPONENT for $toolchain"
+}
+
+main() {
+  install_mold "$(mold_version)"
+  install_cranelift "$(cranelift_toolchain)"
+  note 'ready; verify with: make dev-fast-check'
+}
+
+main "$@"
diff --git a/tools/cranelift/VERSION b/tools/cranelift/VERSION
new file mode 100644
index 000000000..46d999c32
--- /dev/null
+++ b/tools/cranelift/VERSION
@@ -0,0 +1 @@
+nightly-2026-06-29
diff --git a/tools/dev-fast/config.toml b/tools/dev-fast/config.toml
new file mode 100644
index 000000000..8d18e5dec
--- /dev/null
+++ b/tools/dev-fast/config.toml
@@ -0,0 +1,29 @@
+# Opt-in Cargo configuration fragment for accelerated local debug builds.
+#
+# This file is deliberately NOT `.cargo/config.toml`: Cargo auto-discovers that
+# path, which would leak nightly-only unstable flags and a Linux-only linker
+# choice into CI's stable/MSRV legs, release packaging, coverage, and the formal
+# verification toolchains. The fragment is instead passed explicitly with
+# `cargo --config tools/dev-fast/config.toml ...` from the `make dev-*` targets,
+# so every other build path keeps the supported LLVM backend and platform
+# linker.
+#
+# The pinned nightly that supplies the Cranelift backend lives in
+# `tools/cranelift/VERSION`; the pinned mold release lives in
+# `tools/mold/VERSION`. See `docs/developers-guide.md` for the ownership
+# boundary and composition rules.
+
+[unstable]
+codegen-backend = true
+
+# Cranelift trades runtime performance for compile speed, so it is applied to
+# the dev profile only. `make dev-*` never builds release artefacts.
+[profile.dev]
+codegen-backend = "cranelift"
+
+# mold ships for Linux only, so the flag is gated behind a target `cfg`. On
+# macOS and Windows the table simply does not apply and the platform default
+# linker is used; `make dev-fast-check` reports that fallback explicitly rather
+# than leaving it implicit.
+[target.'cfg(target_os = "linux")']
+rustflags = ["-Clink-arg=-fuse-ld=mold"]
diff --git a/tools/mold/SHA256SUMS b/tools/mold/SHA256SUMS
new file mode 100644
index 000000000..0e50c4470
--- /dev/null
+++ b/tools/mold/SHA256SUMS
@@ -0,0 +1,2 @@
+a3696680d99e692970590a178bc3a33d78d60d1c6dc9db7a11b557b02b751f5d  mold-2.41.0-x86_64-linux.tar.gz
+946de2774b06a71346bd59b55fddba610b65b8d93c3a4a1559cc84e103472710  mold-2.41.0-aarch64-linux.tar.gz
diff --git a/tools/mold/VERSION b/tools/mold/VERSION
new file mode 100644
index 000000000..2d4c52ede
--- /dev/null
+++ b/tools/mold/VERSION
@@ -0,0 +1 @@
+2.41.0

From 2a53e40264eba227cf50bdbc6a1cf7b9aca44e4d Mon Sep 17 00:00:00 2001
From: leynos <leynos@rohga>
Date: Wed, 29 Jul 2026 00:48:34 +0200
Subject: [PATCH 02/24] Document the local build acceleration contract

Record the ownership boundary, composition rules, fallback behaviour,
and benchmark evidence for the opt-in mold and Cranelift build path.

- Add a `Local build acceleration` section to the developers' guide
  covering the canonical commands, the three version pins, why the Cargo
  fragment must never become `.cargo/config.toml`, and how the path
  composes with quality gates, `RUSTFLAGS`, release and packaging,
  coverage, Kani and Verus, the test runner, rust-analyzer, and a future
  Polonius adoption.
- Record clean and incremental timings for both paths, produced by
  `make bench-build`, with the caveat that the ratio rather than the
  absolute seconds is the durable signal.
- Describe `tools/cranelift/`, `tools/dev-fast/`, and `tools/mold/` in
  the repository layout, and mention build acceleration in the
  documentation contents index.
- Backtick the linker's name in prose, and emit its benchmark row label
  backticked, so the en-GB spelling gate does not read the product name
  as a misspelling of "mould".
---
 docs/contents.md          |   3 +-
 docs/developers-guide.md  | 148 ++++++++++++++++++++++++++++++++++++++
 docs/repository-layout.md |  12 +++-
 scripts/bench-build.sh    |   5 +-
 4 files changed, 165 insertions(+), 3 deletions(-)

diff --git a/docs/contents.md b/docs/contents.md
index 4e7367123..924d52ff5 100644
--- a/docs/contents.md
+++ b/docs/contents.md
@@ -61,7 +61,8 @@ operator, user, and contributor references are easier to find.
 ## Contributor guidance
 
 - [developers-guide.md](developers-guide.md): Engineering workflow, quality
-  gates, testing strategy, and stdlib resolver-boundary conventions.
+  gates, local build acceleration, testing strategy, and stdlib
+  resolver-boundary conventions.
 - [polonius.md](polonius.md): Polonius migration audit, borrow-centric API
   evolution log, and principled refusals.
 - [documentation-style-guide.md](documentation-style-guide.md): Documentation
diff --git a/docs/developers-guide.md b/docs/developers-guide.md
index 531399384..f12d0beee 100644
--- a/docs/developers-guide.md
+++ b/docs/developers-guide.md
@@ -168,6 +168,10 @@ set -o pipefail
 make test 2>&1 | tee /tmp/netsuke-make-test.log
 ```
 
+These gates always use the repository toolchain and the default codegen
+backend. For a faster inner loop between gate runs, see
+[local build acceleration](#local-build-acceleration).
+
 ### Workflow pins and Dependabot
 
 Dependabot owns the upgrade of GitHub Actions and reusable workflows, including
@@ -368,6 +372,150 @@ unit tests, and `rstest-bdd` release-help scenarios.
 `src/cli/config_path_precedence_tests.rs` is the canonical exhaustive
 state-enumeration example.
 
+
+## Local build acceleration
+
+Debug builds and tests can optionally use the [`mold`] linker and the Cranelift
+`rustc` codegen backend to shorten the local edit-compile-test loop. This is a
+developer convenience only. It is opt-in, it is never used for release
+artefacts, and it changes nothing about what CI builds.
+
+[`mold`]: https://github.com/rui314/mold
+
+The canonical commands are:
+
+```bash
+make install-dev-fast   # install the pinned mold release and Cranelift backend
+make dev-fast-check     # verify the prerequisites are present
+make dev-build          # debug binary via Cranelift and mold
+make dev-test           # full test suite via Cranelift and mold
+```
+
+`make dev-build` and `make dev-test` both depend on `make dev-fast-check`, so a
+missing tool reports an installation hint before Cargo is invoked rather than
+surfacing as an opaque codegen-backend or linker error.
+
+
+### Toolchain contract
+
+Three pins keep the backend, linker, and toolchain in lockstep. Change them
+together, never individually.
+
+- `tools/cranelift/VERSION` holds the nightly toolchain date, formatted
+  `nightly-YYYY-MM-DD`. The `rustc-codegen-cranelift-preview` component is
+  installed for exactly that toolchain, and `make dev-*` selects it with
+  `RUSTUP_TOOLCHAIN`.
+- `tools/mold/VERSION` holds the `mold` release tag.
+- `tools/mold/SHA256SUMS` holds the SHA-256 checksum of each supported `mold`
+  release artefact. `make install-dev-fast` refuses to install an artefact that
+  is absent from this file or whose checksum does not match.
+
+`make install-dev-fast` unpacks `mold` under `~/.local` by default; override
+the location with `DEV_FAST_PREFIX`. That prefix's `bin/` directory must
+precede any distribution-packaged `mold` on `PATH`, otherwise a system `mold`
+of a different version is used. `make dev-fast-check` reports such a drift as a
+warning and still proceeds, because a newer `mold` is normally harmless; a
+missing `mold` is a hard failure.
+
+
+### Ownership boundary
+
+The accelerated configuration lives in `tools/dev-fast/config.toml`, which is
+deliberately *not* `.cargo/config.toml`. Cargo auto-discovers the latter, and
+placing these settings there would silently apply nightly-only unstable flags
+and a Linux-only linker choice to every build in the repository, including CI.
+The fragment is instead passed explicitly with
+`cargo --config tools/dev-fast/config.toml` from the `make dev-*` targets. Do
+not add a repository-root `.cargo/config.toml`, and do not source this fragment
+from any target that CI invokes.
+
+The fragment sets three things and nothing else: the `codegen-backend` unstable
+flag, `codegen-backend = "cranelift"` on the `dev` profile, and a
+`-Clink-arg=-fuse-ld=mold` rustflag gated behind `cfg(target_os = "linux")`.
+
+
+### Composition rules
+
+- **Quality gates.** `make check-fmt`, `make lint`, `make lint-clippy`,
+  `make test`, and `make typecheck` are unchanged and remain on the stable
+  toolchain from `rust-toolchain.toml` with the default LLVM backend. The
+  `dev-*` targets are not part of `make test`, `make lint`, `make check-fmt`, or
+  `make all`, mirroring the Kani boundary described below. Run the ordinary
+  gates before proposing a change; `make dev-test` is a faster inner-loop
+  proxy, not a substitute.
+- **`RUSTFLAGS`.** `make test` and `make typecheck` set
+  `RUSTFLAGS="-D warnings"`. An externally set `RUSTFLAGS` overrides the
+  `[target.*]` `rustflags` in a Cargo configuration file, so the `dev-*`
+  targets deliberately do not set it. Exporting `RUSTFLAGS` in your shell
+  silently disables `mold` for these targets.
+- **Release and packaging.** `make release`, `make build`, and everything under
+  `.github/workflows/build-and-package.yml` use the release profile, the LLVM
+  backend, and the platform linker. Cranelift is applied to the `dev` profile
+  only, so it cannot reach a shipped artefact even if the fragment were loaded.
+- **Coverage.** Coverage is generated through LLVM source-based instrumentation
+  in `.github/workflows/ci.yml` and `coverage-main.yml`. Cranelift does not
+  emit that instrumentation. Never combine the `dev-fast` fragment with a
+  coverage run.
+- **Formal verification.** Kani manages its own supporting nightly toolchain
+  during `cargo kani setup`. That nightly is unrelated to
+  `tools/cranelift/VERSION` and must not be conflated with it; verification
+  must run on Kani's own toolchain and the LLVM backend. The same applies to
+  Verus.
+- **Test runner.** Tests currently run through `cargo test`; `cargo-nextest` is
+  not used in this repository. If it is adopted later, the same
+  `RUSTUP_TOOLCHAIN` and `--config` overrides apply unchanged, because both are
+  Cargo-level rather than runner-level concerns.
+- **rust-analyzer.** No rust-analyzer configuration is committed, so the
+  language server uses the stable toolchain and default backend. Opting
+  rust-analyzer into Cranelift is a personal, machine-local choice; it needs a
+  separate target directory to avoid thrashing the cache shared with
+  `make test`.
+- **Polonius.** A future move to the Polonius borrow checker would also need a
+  nightly toolchain. It is a separate decision with its own pin; do not overload
+  `tools/cranelift/VERSION` to carry it.
+
+
+### Fallback behaviour
+
+- **Non-Linux hosts.** `mold` ships for Linux only, so on macOS and Windows
+  `make install-dev-fast` skips the linker installation, the
+  `cfg(target_os = "linux")` gate keeps the link argument inert, and
+  `make dev-fast-check` prints the fallback to the platform linker explicitly.
+  Cranelift still applies.
+- **Unsupported architecture.** `make install-dev-fast` fails with a clear
+  message rather than guessing when `uname -m` is not one of the architectures
+  recorded in `tools/mold/SHA256SUMS`.
+- **Missing tools.** `make dev-fast-check` names the absent component — `mold`,
+  `rustup`, the pinned toolchain, or the Cranelift backend — and points at
+  `make install-dev-fast`. It exits non-zero, so `make dev-build` and
+  `make dev-test` stop before Cargo runs.
+
+
+### Benchmark evidence
+
+`make bench-build` measures both paths with one repeatable command. It builds
+the `netsuke` binary from an empty target directory, touches `src/main.rs`, and
+rebuilds. Each variant uses its own target directory under `target/bench/`, so
+neither warms the other's cache nor disturbs the working `target/` tree.
+
+Results below were recorded on a 24-core x86_64 Linux host with Rust 1.89.0 as
+the default toolchain, `nightly-2026-06-29` supplying Cranelift 0.132.0, and
+`mold` 2.41.0. Regenerate the table verbatim with `make bench-build`. Absolute
+figures move with machine load — a clean build on this host ranged from 15 s to
+24 s across runs — so the ratio between the two rows is the durable signal, not
+the seconds.
+
+| Variant                         | Clean build (s) | Incremental build (s) |
+| ------------------------------- | --------------- | --------------------- |
+| Default (LLVM, platform linker) | 15.4            | 3.6                   |
+| dev-fast (Cranelift, `mold`)    | 10.6            | 0.7                   |
+
+Table: Debug build wall-clock time for the default and accelerated paths.
+
+The clean build gains roughly a third, dominated by codegen. The incremental
+rebuild — the case that actually paces the edit-compile-test loop — is about
+five times faster, because it is dominated by linking a single crate.
+
 ## Formal-verification tooling
 
 Kani is the repository-supported bounded model checker for local
diff --git a/docs/repository-layout.md b/docs/repository-layout.md
index f66d2af60..2e78834fa 100644
--- a/docs/repository-layout.md
+++ b/docs/repository-layout.md
@@ -42,7 +42,10 @@ output and some leaf files so the long-lived structure remains visible.
 │   ├── fixtures/
 │   └── snapshots/
 └── tools/
-    └── kani/
+    ├── cranelift/
+    ├── dev-fast/
+    ├── kani/
+    └── mold/
 ```
 
 ## Path responsibilities
@@ -97,8 +100,15 @@ output and some leaf files so the long-lived structure remains visible.
 - `tests/features/`: Cross-platform behavioural feature files.
 - `tests/features_unix/`: Unix-specific behavioural feature files.
 - `tests/snapshots/`: Checked-in integration-test snapshots.
+- `tools/cranelift/`: Pinned nightly toolchain date supplying the Cranelift
+  codegen backend used by the opt-in local build acceleration.
+- `tools/dev-fast/`: Non-auto-loaded Cargo configuration fragment for the
+  opt-in Cranelift and `mold` build path. Cargo never discovers this file on
+  its own; only the `make dev-*` targets pass it through `cargo --config`.
 - `tools/kani/`: Kani formal-verification harness configuration and related
   local tooling.
+- `tools/mold/`: Pinned `mold` linker release version and the SHA-256 checksums
+  used to verify the downloaded release artefacts.
 
 ## Placement conventions
 
diff --git a/scripts/bench-build.sh b/scripts/bench-build.sh
index 6afcc160c..0db8998c3 100755
--- a/scripts/bench-build.sh
+++ b/scripts/bench-build.sh
@@ -71,7 +71,10 @@ main() {
   measure_variant default 'Default (LLVM, platform linker)' \
     "$CARGO" build --bin "$BENCH_BIN"
 
-  measure_variant dev-fast 'dev-fast (Cranelift, mold)' \
+  # The label is backticked because the developers' guide embeds this table
+  # verbatim, and the repository spelling gate reads a bare "mold" as "mould".
+  # shellcheck disable=SC2016 # the backticks are Markdown, not a subshell.
+  measure_variant dev-fast 'dev-fast (Cranelift, `mold`)' \
     env RUSTUP_TOOLCHAIN="$toolchain" \
     "$CARGO" --config "$DEV_FAST_CONFIG" build --bin "$BENCH_BIN"
 

From a03934e8df43cf483201ec02f0c95b100dd6868f Mon Sep 17 00:00:00 2001
From: leynos <leynos@troubledskies.net>
Date: Wed, 29 Jul 2026 14:56:32 +0200
Subject: [PATCH 03/24] Honour the overridden dev-fast prefix and harden
 diagnostics

Address review findings on the local build acceleration path.

- Prepend `$(DEV_FAST_PREFIX)/bin` to `PATH` in every `dev-*` recipe.
  The Makefile's unconditional export puts `~/.local/bin` first, so an
  overridden prefix was installed to but never selected: both
  `dev-fast-check` and `-fuse-ld=mold` resolve by `PATH` order and kept
  picking a stale mold under the default prefix.
- Report the resolved mold path alongside its version, so an unexpected
  pick is visible rather than inferred.
- Fail the capability check when mold is on `PATH` but cannot report a
  version. `installed_mold_version` now propagates the command's status
  instead of masking it behind a downstream `awk`, so a truncated
  download no longer surfaces as a confusing version-drift warning.
- Fail `bench-build` with a named prerequisite when Bash predates 5.0,
  rather than reporting every duration as zero from an unset
  `EPOCHREALTIME`.
- Correct the developers' guide: `make build` produces a debug binary
  through the default backend and linker, not a release one. Document
  the prefix and `PATH` contract and the Bash 5.0 requirement, and drop
  a second-person pronoun.
---
 Makefile                    | 16 ++++++++++++----
 docs/developers-guide.md    | 25 ++++++++++++++++---------
 scripts/bench-build.sh      |  5 +++++
 scripts/dev-fast-check.sh   | 19 ++++++++++++++-----
 scripts/dev-fast-common.sh  |  8 ++++++--
 scripts/install-dev-fast.sh |  4 +++-
 6 files changed, 56 insertions(+), 21 deletions(-)

diff --git a/Makefile b/Makefile
index e9542a616..e112ac281 100644
--- a/Makefile
+++ b/Makefile
@@ -26,10 +26,18 @@ MOLD_VERSION_FILE ?= tools/mold/VERSION
 MOLD_SHA256SUMS_FILE ?= tools/mold/SHA256SUMS
 CRANELIFT_TOOLCHAIN_FILE ?= tools/cranelift/VERSION
 DEV_FAST_CONFIG ?= tools/dev-fast/config.toml
-DEV_FAST_ENV = MOLD_VERSION_FILE='$(MOLD_VERSION_FILE)' \
+DEV_FAST_PREFIX ?= $(HOME)/.local
+# The installer may write mold to a prefix other than the default, so every
+# dev-fast recipe puts that prefix first on PATH. Without this the PATH export
+# below would keep selecting whichever mold sits in ~/.local/bin, silently
+# ignoring an overridden DEV_FAST_PREFIX.
+DEV_FAST_PATH = PATH='$(DEV_FAST_PREFIX)/bin:$(PATH)'
+DEV_FAST_ENV = $(DEV_FAST_PATH) \
+	MOLD_VERSION_FILE='$(MOLD_VERSION_FILE)' \
 	MOLD_SHA256SUMS_FILE='$(MOLD_SHA256SUMS_FILE)' \
 	CRANELIFT_TOOLCHAIN_FILE='$(CRANELIFT_TOOLCHAIN_FILE)' \
-	DEV_FAST_CONFIG='$(DEV_FAST_CONFIG)'
+	DEV_FAST_CONFIG='$(DEV_FAST_CONFIG)' \
+	DEV_FAST_PREFIX='$(DEV_FAST_PREFIX)'
 DEV_FAST_TOOLCHAIN = $$(tr -d '[:space:]' <'$(CRANELIFT_TOOLCHAIN_FILE)')
 MDLINT ?= $(shell command -v markdownlint-cli2 2>/dev/null || printf '%s' "$$HOME/.bun/bin/markdownlint-cli2")
 NIXIE ?= nixie
@@ -168,10 +176,10 @@ dev-fast-check: ## Check the mold and Cranelift local build prerequisites
 	@$(DEV_FAST_ENV) scripts/dev-fast-check.sh
 
 dev-build: dev-fast-check ## Build the debug binary with Cranelift and mold
-	RUSTUP_TOOLCHAIN=$(DEV_FAST_TOOLCHAIN) $(CARGO) --config '$(DEV_FAST_CONFIG)' build $(BUILD_JOBS) --bin $(APP)
+	$(DEV_FAST_PATH) RUSTUP_TOOLCHAIN=$(DEV_FAST_TOOLCHAIN) $(CARGO) --config '$(DEV_FAST_CONFIG)' build $(BUILD_JOBS) --bin $(APP)
 
 dev-test: dev-fast-check ## Run the test suite with Cranelift and mold
-	RUSTUP_TOOLCHAIN=$(DEV_FAST_TOOLCHAIN) $(CARGO) --config '$(DEV_FAST_CONFIG)' test --all-targets --all-features $(BUILD_JOBS)
+	$(DEV_FAST_PATH) RUSTUP_TOOLCHAIN=$(DEV_FAST_TOOLCHAIN) $(CARGO) --config '$(DEV_FAST_CONFIG)' test --all-targets --all-features $(BUILD_JOBS)
 
 bench-build: dev-fast-check ## Time clean and incremental debug builds for both paths
 	@$(DEV_FAST_ENV) CARGO='$(CARGO)' scripts/bench-build.sh
diff --git a/docs/developers-guide.md b/docs/developers-guide.md
index f12d0beee..08f5e6722 100644
--- a/docs/developers-guide.md
+++ b/docs/developers-guide.md
@@ -411,12 +411,16 @@ together, never individually.
   is absent from this file or whose checksum does not match.
 
 `make install-dev-fast` unpacks `mold` under `~/.local` by default; override
-the location with `DEV_FAST_PREFIX`. That prefix's `bin/` directory must
-precede any distribution-packaged `mold` on `PATH`, otherwise a system `mold`
-of a different version is used. `make dev-fast-check` reports such a drift as a
-warning and still proceeds, because a newer `mold` is normally harmless; a
-missing `mold` is a hard failure.
+the location with `DEV_FAST_PREFIX`. Every `dev-*` recipe prepends
+`$(DEV_FAST_PREFIX)/bin` to `PATH`, so an overridden prefix is the one actually
+selected — `-fuse-ld=mold` resolves by `PATH` order, and the Makefile otherwise
+puts `~/.local/bin` first unconditionally. Invoking the scripts directly rather
+than through `make` means arranging that `PATH` order yourself.
 
+`make dev-fast-check` prints the resolved `mold` path alongside its version, so
+an unexpected pick is visible. It treats a version that differs from the pin as
+a warning and still proceeds, because a newer `mold` is normally harmless. A
+missing `mold`, or one that cannot report its version, is a hard failure.
 
 ### Ownership boundary
 
@@ -446,12 +450,14 @@ flag, `codegen-backend = "cranelift"` on the `dev` profile, and a
 - **`RUSTFLAGS`.** `make test` and `make typecheck` set
   `RUSTFLAGS="-D warnings"`. An externally set `RUSTFLAGS` overrides the
   `[target.*]` `rustflags` in a Cargo configuration file, so the `dev-*`
-  targets deliberately do not set it. Exporting `RUSTFLAGS` in your shell
+  targets deliberately do not set it. Exporting `RUSTFLAGS` in the shell
   silently disables `mold` for these targets.
-- **Release and packaging.** `make release`, `make build`, and everything under
+- **Release and packaging.** `make release` and everything under
   `.github/workflows/build-and-package.yml` use the release profile, the LLVM
   backend, and the platform linker. Cranelift is applied to the `dev` profile
   only, so it cannot reach a shipped artefact even if the fragment were loaded.
+  `make build` produces a debug binary, but through the default backend and
+  linker; `make dev-build` is the accelerated counterpart.
 - **Coverage.** Coverage is generated through LLVM source-based instrumentation
   in `.github/workflows/ci.yml` and `coverage-main.yml`. Cranelift does not
   emit that instrumentation. Never combine the `dev-fast` fragment with a
@@ -474,7 +480,6 @@ flag, `codegen-backend = "cranelift"` on the `dev` profile, and a
   nightly toolchain. It is a separate decision with its own pin; do not overload
   `tools/cranelift/VERSION` to carry it.
 
-
 ### Fallback behaviour
 
 - **Non-Linux hosts.** `mold` ships for Linux only, so on macOS and Windows
@@ -496,7 +501,9 @@ flag, `codegen-backend = "cranelift"` on the `dev` profile, and a
 `make bench-build` measures both paths with one repeatable command. It builds
 the `netsuke` binary from an empty target directory, touches `src/main.rs`, and
 rebuilds. Each variant uses its own target directory under `target/bench/`, so
-neither warms the other's cache nor disturbs the working `target/` tree.
+neither warms the other's cache nor disturbs the working `target/` tree. The
+timer reads `EPOCHREALTIME`, so this target needs Bash 5.0 or newer; it fails
+with a named prerequisite on older shells rather than reporting zeroes.
 
 Results below were recorded on a 24-core x86_64 Linux host with Rust 1.89.0 as
 the default toolchain, `nightly-2026-06-29` supplying Cranelift 0.132.0, and
diff --git a/scripts/bench-build.sh b/scripts/bench-build.sh
index 0db8998c3..f1b58b8fb 100755
--- a/scripts/bench-build.sh
+++ b/scripts/bench-build.sh
@@ -17,6 +17,11 @@ script_dir=$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)
 : "${CARGO:=cargo}"
 : "${DEV_FAST_CONFIG:?DEV_FAST_CONFIG must be set}"
 
+# The timer below reads EPOCHREALTIME, which Bash gained in 5.0. Fail here with
+# a named prerequisite rather than silently reporting every duration as zero.
+[ "${BASH_VERSINFO[0]:-0}" -ge 5 ] ||
+  fail "bash 5.0 or newer is required to benchmark; found ${BASH_VERSION:-unknown}"
+
 BENCH_ROOT=${BENCH_ROOT:-target/bench}
 BENCH_BIN=${BENCH_BIN:-netsuke}
 BENCH_TOUCH_FILE=${BENCH_TOUCH_FILE:-src/main.rs}
diff --git a/scripts/dev-fast-check.sh b/scripts/dev-fast-check.sh
index 490bed736..3ef44f53a 100755
--- a/scripts/dev-fast-check.sh
+++ b/scripts/dev-fast-check.sh
@@ -13,21 +13,30 @@ script_dir=$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)
 . "$script_dir/dev-fast-common.sh"
 
 check_mold() {
-  local pinned=$1 installed
+  local pinned=$1 installed resolved
   if ! is_linux; then
     note "mold is Linux-only; falling back to the default $(uname -s) linker"
     return 0
   fi
-  if ! command -v mold >/dev/null 2>&1; then
+  if ! resolved=$(command -v mold 2>/dev/null); then
     note "mold not found on PATH (pinned $pinned)"
     note 'install it with: make install-dev-fast'
     return 1
   fi
-  installed=$(installed_mold_version)
+  # A mold that cannot report its version is broken — a truncated download or
+  # an unresolved shared library — so treat it as a failure rather than letting
+  # the empty string surface as a confusing version-drift warning.
+  if ! installed=$(installed_mold_version) || [ -z "$installed" ]; then
+    note "mold at $resolved is on PATH but cannot report its version"
+    note 'reinstall it with: make install-dev-fast'
+    return 1
+  fi
+  # Report the resolved path, not just the version: `-fuse-ld=mold` selects by
+  # PATH order, so naming the winner makes an unexpected pick obvious.
   if [ "$installed" != "$pinned" ]; then
-    note "mold $installed found, pin is $pinned; run make install-dev-fast to match"
+    note "mold $installed at $resolved, pin is $pinned; run make install-dev-fast to match"
   else
-    note "mold $installed"
+    note "mold $installed at $resolved"
   fi
 }
 
diff --git a/scripts/dev-fast-common.sh b/scripts/dev-fast-common.sh
index 3ecc08e79..bd2cf943d 100644
--- a/scripts/dev-fast-common.sh
+++ b/scripts/dev-fast-common.sh
@@ -52,8 +52,12 @@ mold_arch() {
 }
 
 installed_mold_version() {
-  # `mold --version` prints e.g. "mold 2.41.0 (compatible with GNU ld)".
-  mold --version 2>/dev/null | awk 'NR == 1 { print $2 }'
+  # `mold --version` prints e.g. "mold 2.41.0 (compatible with GNU ld)". Capture
+  # first so a failing mold propagates its status instead of being masked by the
+  # exit status of a downstream awk.
+  local output
+  output=$(mold --version 2>/dev/null) || return 1
+  printf '%s' "$output" | awk 'NR == 1 { print $2 }'
 }
 
 has_cranelift_component() {
diff --git a/scripts/install-dev-fast.sh b/scripts/install-dev-fast.sh
index d7e200e4c..2c0a8a076 100755
--- a/scripts/install-dev-fast.sh
+++ b/scripts/install-dev-fast.sh
@@ -50,7 +50,9 @@ install_mold() {
   tar --extract --gzip --strip-components=1 --directory "$DEV_FAST_PREFIX" --file "$workdir/$name" ||
     fail "failed to unpack $name into $DEV_FAST_PREFIX"
   note "installed mold $version into $DEV_FAST_PREFIX"
-  note "ensure $DEV_FAST_PREFIX/bin precedes any distribution mold on PATH"
+  # The `make dev-*` recipes prepend this prefix to PATH themselves; the hint
+  # matters only when the scripts are invoked directly.
+  note "put $DEV_FAST_PREFIX/bin first on PATH when not using the make targets"
 }
 
 install_cranelift() {

From 9966e899568ca69630618548fe84f820a9c37c83 Mon Sep 17 00:00:00 2001
From: leynos <leynos@troubledskies.net>
Date: Wed, 29 Jul 2026 15:10:33 +0200
Subject: [PATCH 04/24] Clarify which prefix the dev-fast recipes put on PATH

The comment claimed only that "the Makefile" prepends `bin/` to PATH,
without naming whose prefix. That reads as though the hard-coded
~/.local from the Makefile's unconditional export is meant, which is
precisely the behaviour that was corrected. State that the recipes use
the resolved DEV_FAST_PREFIX, and note that direct script invocation
must arrange the PATH order itself.

Comment only; no behavioural change.
---
 scripts/dev-fast-common.sh | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/scripts/dev-fast-common.sh b/scripts/dev-fast-common.sh
index bd2cf943d..3f591c9e4 100644
--- a/scripts/dev-fast-common.sh
+++ b/scripts/dev-fast-common.sh
@@ -12,8 +12,11 @@ set -euo pipefail
 : "${MOLD_SHA256SUMS_FILE:?MOLD_SHA256SUMS_FILE must be set}"
 : "${CRANELIFT_TOOLCHAIN_FILE:?CRANELIFT_TOOLCHAIN_FILE must be set}"
 
-# Prefix for the mold installation tree. `bin/` is prepended to PATH by the
-# Makefile, so a pinned mold shadows any older distribution package.
+# Prefix for the mold installation tree. The `dev-*` recipes prepend this
+# prefix's `bin/` to PATH -- this exact prefix, not a hard-coded ~/.local -- so
+# an overridden DEV_FAST_PREFIX is the one that wins PATH resolution for both
+# `dev-fast-check` and `-fuse-ld=mold`. Invoking these scripts outside `make`
+# means arranging that PATH order separately.
 DEV_FAST_PREFIX="${DEV_FAST_PREFIX:-$HOME/.local}"
 
 # shellcheck disable=SC2034 # consumed by the scripts that source this file.

From 68ab7ca5a6f3a69a4d36eb77dd3616a088128fd1 Mon Sep 17 00:00:00 2001
From: leynos <leynos@troubledskies.net>
Date: Wed, 29 Jul 2026 15:12:33 +0200
Subject: [PATCH 05/24] Add an install-dev-fast flow diagram

Illustrate the installer's control flow in the developers' guide,
following the document's existing convention of a screen-reader
description before the diagram and a `**Figure**:` caption after it.

The diagram makes the two decision points explicit: the `is_linux`
branch that keeps macOS and Windows on the platform linker while still
installing Cranelift, and the checksum verification that aborts on an
unlisted or mismatched artefact.
---
 docs/developers-guide.md | 41 ++++++++++++++++++++++++++++++++++++++++
 1 file changed, 41 insertions(+)

diff --git a/docs/developers-guide.md b/docs/developers-guide.md
index 08f5e6722..4976c1665 100644
--- a/docs/developers-guide.md
+++ b/docs/developers-guide.md
@@ -422,6 +422,47 @@ an unexpected pick is visible. It treats a version that differs from the pin as
 a warning and still proceeds, because a newer `mold` is normally harmless. A
 missing `mold`, or one that cannot report its version, is a hard failure.
 
+For screen readers: the following flowchart traces `make install-dev-fast` from
+start to exit. It reads the pinned linker version, then branches on the host
+platform. On Linux it selects the architecture, downloads the release tarball,
+verifies its checksum, unpacks it into the install prefix, and reports the
+`PATH` requirement; on other platforms it skips the linker entirely and falls
+back to the platform default. Both branches then converge on the toolchain
+half, which reads the pinned nightly, fails early if `rustup` is absent, and
+otherwise installs the toolchain and the Cranelift backend component before
+printing a readiness message.
+
+```mermaid
+flowchart TD
+  A["Start install-dev-fast.sh"] --> B["Source dev-fast-common.sh"]
+  B --> C["mold_version"]
+  C --> D{"is_linux"}
+  D -- No --> E["Skip linker installation<br/>Fall back to platform linker"]
+  D -- Yes --> F["mold_arch"]
+  F --> G["Download tarball from MOLD_RELEASE_BASE_URL"]
+  G --> H["verify_mold_archive"]
+  H --> I["tar extract into DEV_FAST_PREFIX"]
+  I --> J["Report DEV_FAST_PREFIX/bin PATH requirement"]
+
+  E --> K["cranelift_toolchain"]
+  J --> K
+  K --> L{"rustup on PATH?"}
+  L -- No --> M["fail: install rustup"]
+  L -- Yes --> N["rustup toolchain install pinned nightly --profile minimal"]
+  N --> O["rustup component add rustc-codegen-cranelift-preview"]
+  O --> P["Print ready; verify with make dev-fast-check"]
+  M --> Q["Exit"]
+  P --> Q
+```
+
+**Figure**: `make install-dev-fast` control flow. The `is_linux` branch is what
+keeps macOS and Windows on the platform linker while still installing
+Cranelift, and `verify_mold_archive` is the point at which an artefact absent
+from `tools/mold/SHA256SUMS`, or one whose checksum does not match, aborts the
+installation. The final node only reports the `PATH` requirement for direct
+script invocation; the `dev-*` recipes prepend `$(DEV_FAST_PREFIX)/bin`
+themselves.
+
 ### Ownership boundary
 
 The accelerated configuration lives in `tools/dev-fast/config.toml`, which is

From c336b710579c2561ab26b5a2d2c54463a64cc9b6 Mon Sep 17 00:00:00 2001
From: leynos <leynos@troubledskies.net>
Date: Wed, 29 Jul 2026 15:41:12 +0200
Subject: [PATCH 06/24] Test the dev-fast tooling and document its helpers
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The Make targets and scripts had no automated coverage, and several
shell helpers carried no explanation.

Add `tests/dev_fast_check_tests.rs` (10 cases) and
`tests/dev_fast_install_tests.rs` (4 cases). They assert on what the
tooling is for — the diagnostic each failure mode emits, the exit
status, and the installer's refusal to unpack an artefact it cannot
verify — rather than on a build artefact. Neither mold, rustup, nor a
network is required, so both run under `make test` on any Linux host.

The harness is `test_support::dev_fast::Sandbox`, placed in the crate
the repository designates for reusable integration-test helpers. It
builds `PATH` from nothing: an explicit allowlist of utilities
symlinked into a temporary directory, plus whichever fakes a case
installs. Prepending fakes would not do, because a machine with a real
mold installed cannot then express "the tool is absent". `HOME` is
redirected too, so the Makefile's `$(HOME)/.local/bin` export cannot
reach outside the sandbox.

Two supporting changes:

- `write_exec` gains a body-carrying sibling, `write_exec_with_body`,
  rather than a second near-duplicate stub writer. Utility resolution
  requires the executable bit: `uv` installs a sourceable, non-executable
  `env` fragment into `~/.local/bin`, which a plain file probe otherwise
  selects.
- `dev_fast_install_tests` joins the `no_std_fs_operations` exclusion
  list, matching the sanctioned treatment of integration-test crates
  that need ambient fixture I/O.

The prefix-on-PATH regression from the previous commit is now covered:
reverting that fix fails four of these tests.
---
 docs/developers-guide.md        |  22 +++
 dylint.toml                     |   1 +
 scripts/bench-build.sh          |   4 +
 scripts/dev-fast-check.sh       |   8 ++
 scripts/dev-fast-common.sh      |  14 ++
 scripts/install-dev-fast.sh     |   7 +
 test_support/src/dev_fast.rs    | 248 ++++++++++++++++++++++++++++++++
 test_support/src/lib.rs         |   4 +
 tests/dev_fast_check_tests.rs   | 186 ++++++++++++++++++++++++
 tests/dev_fast_install_tests.rs | 245 +++++++++++++++++++++++++++++++
 10 files changed, 739 insertions(+)
 create mode 100644 test_support/src/dev_fast.rs
 create mode 100644 tests/dev_fast_check_tests.rs
 create mode 100644 tests/dev_fast_install_tests.rs

diff --git a/docs/developers-guide.md b/docs/developers-guide.md
index 4976c1665..d3a232fb2 100644
--- a/docs/developers-guide.md
+++ b/docs/developers-guide.md
@@ -537,6 +537,28 @@ flag, `codegen-backend = "cranelift"` on the `dev` profile, and a
   `make dev-test` stop before Cargo runs.
 
 
+### Testing the tooling
+
+`tests/dev_fast_check_tests.rs` and `tests/dev_fast_install_tests.rs` cover the
+targets' observable behaviour: the diagnostics each failure mode emits, the
+exit status, and the installer's refusal to unpack an unverifiable artefact.
+They need neither `mold`, `rustup`, nor a network, so they run as part of
+`make test` on any Linux host.
+
+The harness is `test_support::dev_fast::Sandbox`. Because the scripts probe
+`PATH`, a test cannot express "the tool is absent" by prepending fakes on a
+machine that has the real tool installed. The sandbox therefore builds `PATH`
+from nothing — an explicit allowlist of ordinary utilities symlinked into a
+temporary directory, plus whichever fakes a case installs — and redirects
+`HOME` so the Makefile's `$(HOME)/.local/bin` export cannot reach outside it.
+Add to `SANDBOX_UTILITIES` when a script gains a dependency; a missing entry
+surfaces as a test failure rather than as a silent fallback to the developer's
+own tools.
+
+Reuse the sandbox for any future target with the same shape. Do not reach for
+`PathGuard` here: these tests spawn children with a bespoke environment rather
+than mutating the parent's, which is what keeps them safe to run in parallel.
+
 ### Benchmark evidence
 
 `make bench-build` measures both paths with one repeatable command. It builds
diff --git a/dylint.toml b/dylint.toml
index f0b565322..9657b599c 100644
--- a/dylint.toml
+++ b/dylint.toml
@@ -69,6 +69,7 @@ excluded_crates = [
     "test_support",
     "advanced_usage_tests",
     "assert_cmd_tests",
+    "dev_fast_install_tests",
     "manifest_glob_tests",
     "ninja_snapshot_tests",
     "novice_flow_smoke_tests",
diff --git a/scripts/bench-build.sh b/scripts/bench-build.sh
index f1b58b8fb..ecde2b70b 100755
--- a/scripts/bench-build.sh
+++ b/scripts/bench-build.sh
@@ -59,6 +59,8 @@ measure_variant() {
   results+=("$label|$clean|$incremental")
 }
 
+# Render the accumulated rows as a Markdown table, ready to paste into the
+# developers' guide.
 report() {
   local row label clean incremental
   printf '\n| Variant | Clean build (s) | Incremental build (s) |\n'
@@ -69,6 +71,8 @@ report() {
   done
 }
 
+# Measure the default path first so its numbers are not attributed to a warm
+# page cache created by the accelerated run.
 main() {
   local toolchain
   toolchain=$(cranelift_toolchain)
diff --git a/scripts/dev-fast-check.sh b/scripts/dev-fast-check.sh
index 3ef44f53a..28324b83b 100755
--- a/scripts/dev-fast-check.sh
+++ b/scripts/dev-fast-check.sh
@@ -12,6 +12,9 @@ script_dir=$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)
 # shellcheck source=scripts/dev-fast-common.sh
 . "$script_dir/dev-fast-common.sh"
 
+# Report on the linker half of the prerequisites. Returns non-zero only when
+# mold is required but unusable; a non-Linux host and a version drift from the
+# pin are both tolerated, with a note explaining what will happen instead.
 check_mold() {
   local pinned=$1 installed resolved
   if ! is_linux; then
@@ -40,6 +43,9 @@ check_mold() {
   fi
 }
 
+# Report on the toolchain half of the prerequisites: rustup itself, the pinned
+# nightly, and the Cranelift backend component. Any absence is fatal, because
+# there is no meaningful fallback for a missing codegen backend.
 check_cranelift() {
   local toolchain=$1
   if ! command -v rustup >/dev/null 2>&1; then
@@ -60,6 +66,8 @@ check_cranelift() {
   note "$CRANELIFT_COMPONENT available on $toolchain"
 }
 
+# Run both checks unconditionally so a developer sees every missing piece in one
+# pass rather than fixing them one failed run at a time.
 main() {
   local status=0
   check_mold "$(mold_version)" || status=1
diff --git a/scripts/dev-fast-common.sh b/scripts/dev-fast-common.sh
index 3f591c9e4..87054ef3a 100644
--- a/scripts/dev-fast-common.sh
+++ b/scripts/dev-fast-common.sh
@@ -22,13 +22,20 @@ DEV_FAST_PREFIX="${DEV_FAST_PREFIX:-$HOME/.local}"
 # shellcheck disable=SC2034 # consumed by the scripts that source this file.
 CRANELIFT_COMPONENT='rustc-codegen-cranelift-preview'
 
+# Emit a diagnostic. Always stderr, so a caller may capture a helper's stdout
+# without the diagnostics contaminating the captured value.
 note() { printf 'dev-fast: %s\n' "$*" >&2; }
 
+# Emit a diagnostic and abort. Used for conditions no caller can recover from,
+# such as a missing pin file or an unverifiable download.
 fail() {
   printf 'dev-fast: %s\n' "$*" >&2
   exit 1
 }
 
+# Read a single-line version pin, trimming surrounding whitespace. A missing or
+# blank pin aborts rather than yielding an empty version that would silently
+# produce a nonsensical download URL or toolchain name.
 read_pin() {
   local file=$1 value
   [ -f "$file" ] || fail "missing version pin: $file"
@@ -37,10 +44,13 @@ read_pin() {
   printf '%s' "$value"
 }
 
+# The pinned mold release tag, e.g. "2.41.0".
 mold_version() { read_pin "$MOLD_VERSION_FILE"; }
 
+# The pinned nightly supplying Cranelift, e.g. "nightly-2026-06-29".
 cranelift_toolchain() { read_pin "$CRANELIFT_TOOLCHAIN_FILE"; }
 
+# Whether the host can use mold at all; it ships for Linux only.
 is_linux() { [ "$(uname -s)" = 'Linux' ]; }
 
 # mold publishes per-architecture tarballs; map `uname -m` onto those names.
@@ -54,6 +64,8 @@ mold_arch() {
   esac
 }
 
+# The version of whichever mold PATH resolves to, or a non-zero status when
+# that mold cannot be run.
 installed_mold_version() {
   # `mold --version` prints e.g. "mold 2.41.0 (compatible with GNU ld)". Capture
   # first so a failing mold propagates its status instead of being masked by the
@@ -63,6 +75,8 @@ installed_mold_version() {
   printf '%s' "$output" | awk 'NR == 1 { print $2 }'
 }
 
+# Whether the Cranelift backend is installed for the given toolchain. rustup
+# reports the component with a host-triple suffix, so match on the prefix.
 has_cranelift_component() {
   local toolchain=$1
   rustup component list --installed --toolchain "$toolchain" 2>/dev/null |
diff --git a/scripts/install-dev-fast.sh b/scripts/install-dev-fast.sh
index 2c0a8a076..9e8300b9b 100755
--- a/scripts/install-dev-fast.sh
+++ b/scripts/install-dev-fast.sh
@@ -25,6 +25,8 @@ verify_mold_archive() {
   note "verified $name against $MOLD_SHA256SUMS_FILE"
 }
 
+# Download, verify, and unpack the pinned mold release, or explain why the step
+# is being skipped on a platform mold does not support.
 install_mold() {
   local version=$1 arch name url workdir
   if ! is_linux; then
@@ -55,6 +57,9 @@ install_mold() {
   note "put $DEV_FAST_PREFIX/bin first on PATH when not using the make targets"
 }
 
+# Install the pinned nightly and its Cranelift backend component. Uses the
+# minimal profile: this toolchain exists to supply a codegen backend, not to
+# replace the repository's stable toolchain.
 install_cranelift() {
   local toolchain=$1
   command -v rustup >/dev/null 2>&1 ||
@@ -67,6 +72,8 @@ install_cranelift() {
     fail "failed to install $CRANELIFT_COMPONENT for $toolchain"
 }
 
+# Install both halves. The linker step runs first so a checksum failure aborts
+# before spending time on a toolchain download.
 main() {
   install_mold "$(mold_version)"
   install_cranelift "$(cranelift_toolchain)"
diff --git a/test_support/src/dev_fast.rs b/test_support/src/dev_fast.rs
new file mode 100644
index 000000000..d17ae0c9e
--- /dev/null
+++ b/test_support/src/dev_fast.rs
@@ -0,0 +1,248 @@
+//! Sandbox harness for the opt-in `dev-fast` build-acceleration tooling.
+//!
+//! The `make dev-*` targets and their backing scripts probe `PATH` for `mold`
+//! and `rustup`. A test that merely prepends fakes therefore cannot express
+//! "the tool is absent" on a machine that has the real thing installed. This
+//! harness instead builds a `PATH` from nothing: a sandbox directory holding
+//! symlinks to an explicit allowlist of ordinary utilities, plus whichever
+//! fakes a case installs. Anything unnamed is genuinely unreachable.
+//!
+//! `HOME` is redirected into the sandbox too, so the Makefile's unconditional
+//! `$(HOME)/.cargo/bin:$(HOME)/.local/bin` export cannot reach a real tool.
+//!
+//! Scope: these helpers exist for the `dev-fast` target tests. They spawn
+//! child processes with a bespoke environment and never mutate the parent's,
+//! so they compose with the repository's prohibition on direct environment
+//! mutation in tests.
+
+use anyhow::{Context, Result, bail};
+use camino::{Utf8Path, Utf8PathBuf};
+use std::fs;
+use std::os::unix::fs::PermissionsExt;
+use std::process::{Command, Output};
+use tempfile::{TempDir, tempdir};
+
+use crate::exec::write_exec_with_content;
+
+/// Utilities the scripts and `make` legitimately need. Kept explicit so a new
+/// dependency surfaces as a test failure rather than silently resolving to
+/// whatever the developer happens to have installed.
+const SANDBOX_UTILITIES: &[&str] = &[
+    "awk",
+    "bash",
+    "cat",
+    "chmod",
+    "cp",
+    "curl",
+    "dirname",
+    "env",
+    "grep",
+    "gzip",
+    "ln",
+    "make",
+    "mkdir",
+    "mktemp",
+    "rm",
+    "sed",
+    "sh",
+    "sha256sum",
+    "tar",
+    "touch",
+    "tr",
+    "uname",
+];
+
+/// A `PATH` and `HOME` containing only what a test explicitly puts there.
+pub struct Sandbox {
+    temp: TempDir,
+    repo: Utf8PathBuf,
+}
+
+impl Sandbox {
+    /// Build a sandbox and populate it with the utility allowlist.
+    pub fn new() -> Result<Self> {
+        let temp = tempdir().context("create sandbox directory")?;
+        let repo = std::env::current_dir().context("resolve repository root")?;
+        let repo = Utf8PathBuf::try_from(repo).context("repository root must be UTF-8")?;
+        let sandbox = Self { temp, repo };
+        fs::create_dir_all(sandbox.bin().as_std_path()).context("create sandbox bin")?;
+        fs::create_dir_all(sandbox.home().as_std_path()).context("create sandbox home")?;
+        sandbox.link_utilities()?;
+        Ok(sandbox)
+    }
+
+    fn root(&self) -> Utf8PathBuf {
+        Utf8Path::from_path(self.temp.path())
+            .expect("tempdir path must be UTF-8")
+            .to_path_buf()
+    }
+
+    /// The only directory on the sandbox `PATH`.
+    pub fn bin(&self) -> Utf8PathBuf {
+        self.root().join("bin")
+    }
+
+    /// A `HOME` inside the sandbox, isolating the Makefile's `PATH` export.
+    pub fn home(&self) -> Utf8PathBuf {
+        self.root().join("home")
+    }
+
+    /// An install prefix that starts out empty; `DEV_FAST_PREFIX` points here.
+    pub fn prefix(&self) -> Utf8PathBuf {
+        self.root().join("prefix")
+    }
+
+    fn link_utilities(&self) -> Result<()> {
+        for utility in SANDBOX_UTILITIES {
+            let source =
+                which(utility).with_context(|| format!("locate `{utility}` for the sandbox"))?;
+            std::os::unix::fs::symlink(
+                source.as_std_path(),
+                self.bin().join(utility).as_std_path(),
+            )
+            .with_context(|| format!("link `{utility}` into the sandbox"))?;
+        }
+        Ok(())
+    }
+
+    /// Install a fake executable, creating `dir` if needed.
+    ///
+    /// `body` is a shell fragment without a shebang; this adds one, so call
+    /// sites stay focused on the behaviour they are faking.
+    pub fn write_fake(&self, dir: &Utf8Path, name: &str, body: &str) -> Result<Utf8PathBuf> {
+        fs::create_dir_all(dir.as_std_path()).with_context(|| format!("create {dir}"))?;
+        let script = format!("#!/bin/sh\n{body}\n");
+        let path = write_exec_with_content(dir.as_std_path(), name, &script)?;
+        Utf8PathBuf::try_from(path).context("fake executable path must be UTF-8")
+    }
+
+    /// A `mold` reporting the given version, formatted as the real one does.
+    pub fn write_mold(&self, dir: &Utf8Path, version: &str) -> Result<Utf8PathBuf> {
+        self.write_fake(
+            dir,
+            "mold",
+            &format!("echo \"mold {version} (compatible with GNU ld)\""),
+        )
+    }
+
+    /// A `rustup` reporting the given toolchain and, optionally, the Cranelift
+    /// component as installed.
+    pub fn write_rustup(&self, toolchain: &str, has_cranelift: bool) -> Result<Utf8PathBuf> {
+        let component = if has_cranelift {
+            "rustc-codegen-cranelift-x86_64-unknown-linux-gnu"
+        } else {
+            "rustfmt-x86_64-unknown-linux-gnu"
+        };
+        let body = format!(
+            concat!(
+                "case \"$1 $2\" in\n",
+                "  'toolchain list') echo '{toolchain}-x86_64-unknown-linux-gnu' ;;\n",
+                "  'component list') echo '{component}' ;;\n",
+                "  *) exit 0 ;;\n",
+                "esac"
+            ),
+            toolchain = toolchain,
+            component = component,
+        );
+        self.write_fake(&self.bin(), "rustup", &body)
+    }
+
+    fn base_command(&self, program: &Utf8Path) -> Command {
+        let mut command = Command::new(program.as_std_path());
+        command
+            .current_dir(self.repo.as_std_path())
+            .env_clear()
+            .env("PATH", self.bin().as_std_path())
+            .env("HOME", self.home().as_std_path());
+        command
+    }
+
+    /// Run a `scripts/` entry point directly, with the sandbox as the entire
+    /// environment plus the given overrides. Use where a test must vary inputs
+    /// the Makefile does not expose as variables.
+    pub fn script(&self, name: &str, env: &[(&str, String)]) -> Result<Output> {
+        let mut command = self.base_command(&self.bin().join("bash"));
+        command
+            .env("DEV_FAST_PREFIX", self.prefix().as_std_path())
+            .env("MOLD_VERSION_FILE", "tools/mold/VERSION")
+            .env("MOLD_SHA256SUMS_FILE", "tools/mold/SHA256SUMS")
+            .env("CRANELIFT_TOOLCHAIN_FILE", "tools/cranelift/VERSION")
+            .env("DEV_FAST_CONFIG", "tools/dev-fast/config.toml")
+            .arg(format!("scripts/{name}"));
+        for (key, value) in env {
+            command.env(key, value);
+        }
+        command
+            .output()
+            .with_context(|| format!("run scripts/{name}"))
+    }
+
+    /// Run a Make target with the sandbox as the entire environment.
+    pub fn make(&self, target: &str) -> Result<Output> {
+        let mut command = self.base_command(&self.bin().join("make"));
+        command
+            .arg("--no-print-directory")
+            .arg("-f")
+            .arg("Makefile")
+            .arg(format!("DEV_FAST_PREFIX={}", self.prefix()))
+            .arg(target);
+        command
+            .output()
+            .with_context(|| format!("run make {target}"))
+    }
+}
+
+/// Resolve a utility against the ambient `PATH`, before it is replaced.
+///
+/// Executability is part of the match, not an afterthought: `uv` installs a
+/// sourceable `env` shell fragment into `~/.local/bin`, so a plain file probe
+/// selects a non-executable file and every sandboxed `env` invocation then
+/// fails with a permission error.
+fn which(utility: &str) -> Result<Utf8PathBuf> {
+    let path = std::env::var_os("PATH").context("read PATH")?;
+    for dir in std::env::split_paths(&path) {
+        let Ok(dir) = Utf8PathBuf::try_from(dir) else {
+            continue;
+        };
+        let candidate = dir.join(utility);
+        if is_executable_file(&candidate) {
+            return Ok(candidate);
+        }
+    }
+    bail!("`{utility}` not found on PATH")
+}
+
+fn is_executable_file(path: &Utf8Path) -> bool {
+    fs::metadata(path.as_std_path())
+        .map(|metadata| metadata.is_file() && metadata.permissions().mode() & 0o111 != 0)
+        .unwrap_or(false)
+}
+
+/// Combined stdout and stderr, for asserting on diagnostics regardless of the
+/// stream a given message went to.
+pub fn combined(output: &Output) -> String {
+    format!(
+        "{}{}",
+        String::from_utf8_lossy(&output.stdout),
+        String::from_utf8_lossy(&output.stderr)
+    )
+}
+
+/// Read a `tools/` version pin, so tests agree with the repository rather than
+/// hard-coding a value that drifts on the next bump.
+fn read_pin(path: &str) -> Result<String> {
+    Ok(fs::read_to_string(path)
+        .with_context(|| format!("read {path}"))?
+        .trim()
+        .to_owned())
+}
+
+/// The repository's pinned mold release tag.
+pub fn pinned_mold_version() -> Result<String> {
+    read_pin("tools/mold/VERSION")
+}
+
+/// The repository's pinned Cranelift-bearing nightly.
+pub fn pinned_toolchain() -> Result<String> {
+    read_pin("tools/cranelift/VERSION")
+}
diff --git a/test_support/src/lib.rs b/test_support/src/lib.rs
index 6d2d08cb3..611edd4e0 100644
--- a/test_support/src/lib.rs
+++ b/test_support/src/lib.rs
@@ -8,6 +8,7 @@
 //!   LocalizerGuard, localizer_test_lock, set_en_localizer)
 //! - computing SHA-256 hashes for cache keys (hash module)
 //! - spawning lightweight HTTP servers for network tests (http module)
+//! - sandboxing PATH and HOME for the dev-fast target tests (dev_fast module)
 //!
 //! All items are intended for use in tests within this workspace; avoid using
 //! them in production code.
@@ -17,6 +18,9 @@
 pub mod check_ninja;
 pub mod command_helper;
 pub mod cwd_guard;
+
+#[cfg(unix)]
+pub mod dev_fast;
 pub mod env;
 pub mod env_guard;
 pub mod env_lock;
diff --git a/tests/dev_fast_check_tests.rs b/tests/dev_fast_check_tests.rs
new file mode 100644
index 000000000..10466feee
--- /dev/null
+++ b/tests/dev_fast_check_tests.rs
@@ -0,0 +1,186 @@
+//! Behavioural tests for the `dev-fast-check` capability gate.
+//!
+//! The gate's whole purpose is to turn a missing tool into an actionable
+//! message instead of an opaque codegen-backend or linker failure, so these
+//! tests assert on the diagnostics and exit status rather than on any build
+//! artefact. Every case runs against fakes in a sandboxed `PATH`; none needs
+//! mold, rustup, or a network.
+
+#![cfg(all(unix, target_os = "linux"))]
+
+use anyhow::{Result, ensure};
+use rstest::rstest;
+use test_support::dev_fast::{Sandbox, combined, pinned_mold_version, pinned_toolchain};
+
+/// A sandbox with everything present and matching the pins.
+fn healthy_sandbox() -> Result<Sandbox> {
+    let sandbox = Sandbox::new()?;
+    sandbox.write_mold(&sandbox.prefix().join("bin"), &pinned_mold_version()?)?;
+    sandbox.write_rustup(&pinned_toolchain()?, true)?;
+    Ok(sandbox)
+}
+
+#[test]
+fn reports_resolved_path_and_version_when_prerequisites_are_met() -> Result<()> {
+    let sandbox = healthy_sandbox()?;
+    let output = sandbox.make("dev-fast-check")?;
+    let text = combined(&output);
+
+    ensure!(output.status.success(), "check should pass, got `{text}`");
+    ensure!(
+        text.contains(&format!("mold {}", pinned_mold_version()?)),
+        "should report the resolved version, got `{text}`"
+    );
+    ensure!(
+        text.contains(&sandbox.prefix().join("bin/mold").to_string()),
+        "should name the resolved path so an unexpected pick is visible, got `{text}`"
+    );
+    Ok(())
+}
+
+/// The regression this guards: the Makefile unconditionally exports
+/// `$(HOME)/.local/bin` ahead of the caller's `PATH`, so an overridden
+/// `DEV_FAST_PREFIX` used to be installed to but never selected.
+#[test]
+fn overridden_prefix_wins_over_a_mold_in_the_default_location() -> Result<()> {
+    let sandbox = Sandbox::new()?;
+    sandbox.write_rustup(&pinned_toolchain()?, true)?;
+    // A decoy in the location the Makefile's export would otherwise favour.
+    sandbox.write_mold(&sandbox.home().join(".local/bin"), "0.0.0-decoy")?;
+    sandbox.write_mold(&sandbox.prefix().join("bin"), &pinned_mold_version()?)?;
+
+    let output = sandbox.make("dev-fast-check")?;
+    let text = combined(&output);
+
+    ensure!(output.status.success(), "check should pass, got `{text}`");
+    ensure!(
+        text.contains(&sandbox.prefix().join("bin/mold").to_string()),
+        "the overridden prefix should win PATH resolution, got `{text}`"
+    );
+    ensure!(
+        !text.contains("0.0.0-decoy"),
+        "the default-location mold should not be selected, got `{text}`"
+    );
+    Ok(())
+}
+
+#[test]
+fn tolerates_a_version_drift_from_the_pin() -> Result<()> {
+    let sandbox = Sandbox::new()?;
+    sandbox.write_rustup(&pinned_toolchain()?, true)?;
+    sandbox.write_mold(&sandbox.prefix().join("bin"), "99.0.0")?;
+
+    let output = sandbox.make("dev-fast-check")?;
+    let text = combined(&output);
+
+    ensure!(
+        output.status.success(),
+        "a newer mold is harmless and must not fail the check, got `{text}`"
+    );
+    ensure!(
+        text.contains("run make install-dev-fast to match"),
+        "drift should still be reported, got `{text}`"
+    );
+    Ok(())
+}
+
+/// Each unusable-tool case names the fault and the remedy, and exits non-zero
+/// so `dev-build` and `dev-test` stop before Cargo runs.
+/// `arrange` is carried as a function rather than dispatched on a name, so
+/// adding a case cannot leave an unhandled arm behind.
+#[derive(Copy, Clone)]
+struct FailureCase {
+    arrange: fn(&Sandbox) -> Result<()>,
+    expected: &'static str,
+}
+
+fn without_mold(sandbox: &Sandbox) -> Result<()> {
+    sandbox.write_rustup(&pinned_toolchain()?, true)?;
+    Ok(())
+}
+
+/// A truncated download or an unresolved shared library: on `PATH`, but
+/// incapable of reporting a version.
+fn with_unrunnable_mold(sandbox: &Sandbox) -> Result<()> {
+    sandbox.write_fake(&sandbox.prefix().join("bin"), "mold", "exit 1")?;
+    sandbox.write_rustup(&pinned_toolchain()?, true)?;
+    Ok(())
+}
+
+fn without_rustup(sandbox: &Sandbox) -> Result<()> {
+    sandbox.write_mold(&sandbox.prefix().join("bin"), &pinned_mold_version()?)?;
+    Ok(())
+}
+
+fn without_pinned_toolchain(sandbox: &Sandbox) -> Result<()> {
+    sandbox.write_mold(&sandbox.prefix().join("bin"), &pinned_mold_version()?)?;
+    sandbox.write_rustup("nightly-1970-01-01", true)?;
+    Ok(())
+}
+
+fn without_cranelift_component(sandbox: &Sandbox) -> Result<()> {
+    sandbox.write_mold(&sandbox.prefix().join("bin"), &pinned_mold_version()?)?;
+    sandbox.write_rustup(&pinned_toolchain()?, false)?;
+    Ok(())
+}
+
+#[rstest]
+#[case::mold_absent(FailureCase { arrange: without_mold, expected: "mold not found on PATH" })]
+#[case::mold_unrunnable(
+    FailureCase { arrange: with_unrunnable_mold, expected: "cannot report its version" }
+)]
+#[case::rustup_absent(
+    FailureCase { arrange: without_rustup, expected: "rustup not found on PATH" }
+)]
+#[case::toolchain_absent(
+    FailureCase { arrange: without_pinned_toolchain, expected: "is not installed" }
+)]
+#[case::component_absent(
+    FailureCase { arrange: without_cranelift_component, expected: "is not installed for" }
+)]
+fn unusable_prerequisites_fail_with_an_actionable_message(#[case] case: FailureCase) -> Result<()> {
+    let sandbox = Sandbox::new()?;
+    (case.arrange)(&sandbox)?;
+
+    let output = sandbox.make("dev-fast-check")?;
+    let text = combined(&output);
+
+    ensure!(
+        !output.status.success(),
+        "case should fail the check, got `{text}`"
+    );
+    ensure!(
+        text.contains(case.expected),
+        "case should explain the fault (`{}`), got `{text}`",
+        case.expected
+    );
+    ensure!(
+        text.contains("make install-dev-fast") || text.contains("https://rustup.rs"),
+        "case should point at a remedy, got `{text}`"
+    );
+    Ok(())
+}
+
+/// `dev-build` and `dev-test` depend on the check, so a missing prerequisite
+/// must stop them before Cargo is invoked.
+#[rstest]
+#[case("dev-build")]
+#[case("dev-test")]
+fn build_targets_stop_when_the_check_fails(#[case] target: &str) -> Result<()> {
+    let sandbox = Sandbox::new()?;
+    sandbox.write_rustup(&pinned_toolchain()?, true)?;
+    // No mold anywhere, and no cargo in the sandbox either: if the recipe ran,
+    // the failure would name cargo rather than the capability check.
+    let output = sandbox.make(target)?;
+    let text = combined(&output);
+
+    ensure!(
+        !output.status.success(),
+        "`{target}` should fail, got `{text}`"
+    );
+    ensure!(
+        text.contains("mold not found on PATH"),
+        "`{target}` should fail in the capability check, got `{text}`"
+    );
+    Ok(())
+}
diff --git a/tests/dev_fast_install_tests.rs b/tests/dev_fast_install_tests.rs
new file mode 100644
index 000000000..672ffb8a1
--- /dev/null
+++ b/tests/dev_fast_install_tests.rs
@@ -0,0 +1,245 @@
+//! Behavioural tests for the `dev-fast` installer and benchmark scripts.
+//!
+//! The installer's security-relevant behaviour is that it refuses to unpack an
+//! artefact it cannot verify, so these tests serve a locally built tarball over
+//! a `file://` URL and vary only the recorded checksum. No network is used.
+
+#![cfg(all(unix, target_os = "linux"))]
+
+use anyhow::{Context, Result, ensure};
+use camino::{Utf8Path, Utf8PathBuf};
+use rstest::rstest;
+use std::fs;
+use std::process::Command;
+use test_support::dev_fast::{Sandbox, combined, pinned_mold_version, pinned_toolchain};
+
+/// A stand-in mold release laid out like the real tarball: a versioned root
+/// directory the installer strips, containing `bin/mold`.
+struct FakeRelease {
+    dir: Utf8PathBuf,
+    archive: Utf8PathBuf,
+    name: String,
+    sha256: String,
+}
+
+fn build_fake_release(sandbox: &Sandbox, version: &str) -> Result<FakeRelease> {
+    let dir = sandbox.home().join("releases");
+    let root = format!("mold-{version}-x86_64-linux");
+    let staging = dir.join(&root);
+    fs::create_dir_all(staging.join("bin").as_std_path()).context("stage fake release tree")?;
+    fs::write(
+        staging.join("bin/mold").as_std_path(),
+        "#!/bin/sh\necho fake\n",
+    )
+    .context("write staged mold")?;
+
+    let name = format!("{root}.tar.gz");
+    let archive = dir.join(&name);
+    let status = Command::new(sandbox.bin().join("tar").as_std_path())
+        .current_dir(dir.as_std_path())
+        .args(["--create", "--gzip", "--file"])
+        .arg(&name)
+        .arg(&root)
+        .status()
+        .context("create fake release tarball")?;
+    ensure!(status.success(), "tar should build the fake release");
+
+    let sha256 = sha256_of(sandbox, &archive)?;
+    Ok(FakeRelease {
+        dir,
+        archive,
+        name,
+        sha256,
+    })
+}
+
+fn sha256_of(sandbox: &Sandbox, path: &Utf8Path) -> Result<String> {
+    let output = Command::new(sandbox.bin().join("sha256sum").as_std_path())
+        .arg(path.as_std_path())
+        .output()
+        .context("hash fake release tarball")?;
+    ensure!(output.status.success(), "sha256sum should succeed");
+    let text = String::from_utf8_lossy(&output.stdout);
+    Ok(text
+        .split_whitespace()
+        .next()
+        .context("parse sha256sum output")?
+        .to_owned())
+}
+
+/// Point the installer at a local release directory, with a caller-chosen
+/// checksum recorded for the artefact.
+fn install_env(
+    sandbox: &Sandbox,
+    release: &FakeRelease,
+    version: &str,
+    recorded: &str,
+) -> Result<Vec<(&'static str, String)>> {
+    let version_file = sandbox.home().join("MOLD_VERSION");
+    let sums_file = sandbox.home().join("SHA256SUMS");
+    fs::write(version_file.as_std_path(), format!("{version}\n"))
+        .context("write test version pin")?;
+    fs::write(
+        sums_file.as_std_path(),
+        format!("{recorded}  {}\n", release.name),
+    )
+    .context("write test checksum file")?;
+
+    Ok(vec![
+        ("MOLD_VERSION_FILE", version_file.to_string()),
+        ("MOLD_SHA256SUMS_FILE", sums_file.to_string()),
+        (
+            "MOLD_RELEASE_BASE_URL",
+            // The installer appends `/v<version>/<name>`, so expose the release
+            // directory under a matching `v<version>` path.
+            format!("file://{}", release.dir),
+        ),
+    ])
+}
+
+/// The installer builds `<base>/v<version>/<name>`; mirror the artefact there.
+fn publish_under_version_path(release: &FakeRelease, version: &str) -> Result<()> {
+    let versioned = release.dir.join(format!("v{version}"));
+    fs::create_dir_all(versioned.as_std_path()).context("create versioned release path")?;
+    fs::copy(
+        release.archive.as_std_path(),
+        versioned.join(&release.name).as_std_path(),
+    )
+    .context("publish fake release under its version path")?;
+    Ok(())
+}
+
+fn prepared_installer(version: &str) -> Result<(Sandbox, FakeRelease)> {
+    let sandbox = Sandbox::new()?;
+    sandbox.write_rustup(&pinned_toolchain()?, true)?;
+    let release = build_fake_release(&sandbox, version)?;
+    publish_under_version_path(&release, version)?;
+    Ok((sandbox, release))
+}
+
+#[test]
+fn installs_and_records_the_verification_when_the_checksum_matches() -> Result<()> {
+    let version = "9.9.9";
+    let (sandbox, release) = prepared_installer(version)?;
+    let env = install_env(&sandbox, &release, version, &release.sha256)?;
+
+    let output = sandbox.script("install-dev-fast.sh", &env)?;
+    let text = combined(&output);
+
+    ensure!(
+        output.status.success(),
+        "install should succeed, got `{text}`"
+    );
+    ensure!(
+        text.contains(&format!("verified {}", release.name)),
+        "should report the verification, got `{text}`"
+    );
+    ensure!(
+        sandbox.prefix().join("bin/mold").as_std_path().is_file(),
+        "the tarball root should be stripped so bin/mold lands in the prefix"
+    );
+    ensure!(
+        text.contains("rustc-codegen-cranelift-preview"),
+        "should install the Cranelift component, got `{text}`"
+    );
+    Ok(())
+}
+
+/// Refusing an unverifiable artefact is the point of the checksum file, so both
+/// a mismatch and an unlisted name must abort before anything is unpacked.
+#[rstest]
+#[case::mismatch(
+    "0000000000000000000000000000000000000000000000000000000000000000",
+    "checksum mismatch"
+)]
+#[case::unlisted("", "no checksum recorded")]
+fn refuses_to_install_an_unverifiable_artefact(
+    #[case] recorded: &str,
+    #[case] expected: &str,
+) -> Result<()> {
+    let version = "9.9.9";
+    let (sandbox, release) = prepared_installer(version)?;
+    let mut env = install_env(&sandbox, &release, version, recorded)?;
+    if recorded.is_empty() {
+        // Record a checksum for a different artefact, so the file is valid but
+        // this release is absent from it.
+        let sums_file = sandbox.home().join("SHA256SUMS");
+        fs::write(
+            sums_file.as_std_path(),
+            format!("{}  mold-0.0.0-x86_64-linux.tar.gz\n", release.sha256),
+        )
+        .context("write checksum file without this artefact")?;
+        env.retain(|(key, _)| *key != "MOLD_SHA256SUMS_FILE");
+        env.push(("MOLD_SHA256SUMS_FILE", sums_file.to_string()));
+    }
+
+    let output = sandbox.script("install-dev-fast.sh", &env)?;
+    let text = combined(&output);
+
+    ensure!(
+        !output.status.success(),
+        "install should abort, got `{text}`"
+    );
+    ensure!(
+        text.contains(expected),
+        "should explain the refusal (`{expected}`), got `{text}`"
+    );
+    ensure!(
+        !sandbox.prefix().join("bin/mold").as_std_path().exists(),
+        "nothing should be unpacked when verification fails"
+    );
+    Ok(())
+}
+
+/// A cell holding a one-decimal duration, as `bench-build` formats them.
+/// Timings are inherently unstable, so tests assert on shape, not value.
+fn is_timing(cell: &str) -> bool {
+    !cell.is_empty() && cell.contains('.') && cell.chars().all(|c| c.is_ascii_digit() || c == '.')
+}
+
+#[test]
+fn benchmark_emits_a_markdown_table_for_both_paths() -> Result<()> {
+    let sandbox = Sandbox::new()?;
+    sandbox.write_mold(&sandbox.prefix().join("bin"), &pinned_mold_version()?)?;
+    sandbox.write_rustup(&pinned_toolchain()?, true)?;
+    let cargo = sandbox.write_fake(&sandbox.bin(), "cargo", "exit 0")?;
+    let touch_file = sandbox.home().join("bench-touch");
+    fs::write(touch_file.as_std_path(), "").context("create bench touch target")?;
+
+    let output = sandbox.script(
+        "bench-build.sh",
+        &[
+            ("CARGO", cargo.to_string()),
+            ("BENCH_ROOT", sandbox.home().join("bench").to_string()),
+            ("BENCH_TOUCH_FILE", touch_file.to_string()),
+        ],
+    )?;
+    let stdout = String::from_utf8_lossy(&output.stdout);
+
+    ensure!(
+        output.status.success(),
+        "benchmark should succeed, got `{}`",
+        combined(&output)
+    );
+    ensure!(
+        stdout.contains("| Variant | Clean build (s) | Incremental build (s) |"),
+        "should emit the table header, got `{stdout}`"
+    );
+    // Timings are inherently unstable, so assert on shape rather than values.
+    let rows: Vec<&str> = stdout
+        .lines()
+        .filter(|line| line.starts_with("| Default") || line.starts_with("| dev-fast"))
+        .collect();
+    ensure!(
+        rows.len() == 2,
+        "should report one row per variant, got `{stdout}`"
+    );
+    for row in rows {
+        let measurements = row.split('|').map(str::trim).filter(|cell| is_timing(cell));
+        ensure!(
+            measurements.count() == 2,
+            "row should carry two decimal timings, got `{row}`"
+        );
+    }
+    Ok(())
+}

From 7edbec8b3f9b9f6214165896d2f9c930bd5f5bf5 Mon Sep 17 00:00:00 2001
From: leynos <leynos@troubledskies.net>
Date: Wed, 29 Jul 2026 23:30:00 +0200
Subject: [PATCH 07/24] Replace string plumbing in the dev-fast tests with
 typed fixtures
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

CodeScene flagged String Heavy Function Arguments in the installer
tests. Four helpers threaded a bare `version: &str`, `install_env` took
four positional arguments of which three were interchangeable strings,
and the checksum-failure cases were parameterized on a raw recorded
digest plus a raw expected diagnostic — two strings whose correspondence
was implicit and unenforced.

- `FakeRelease` moves into `test_support::dev_fast` and owns its
  version, so callers ask the release for what they need rather than
  passing a version alongside it. `publish` is the only place a version
  string appears.
- `InstallerScenario` and `InstallerFixture` group the sandbox, release,
  pin path, checksum path, and URL. `script_env` derives the overrides,
  so no helper takes a handful of strings positionally.
- `ChecksumFailure` replaces the two raw `rstest` parameters. Each
  variant owns both the checksum file it needs and the diagnostic the
  installer must emit, so the two cannot drift apart, and the domain is
  closed rather than open.

`is_timing` is unchanged: its input is text parsed from command output,
not incidental configuration.

Also complete Make-target coverage in a new
`tests/dev_fast_make_target_tests.rs`. `RecordingCargo` logs each
invocation's arguments, `RUSTUP_TOOLCHAIN`, and `PATH`, so the recipes'
contract is asserted rather than assumed: the pinned nightly is
selected, `--config tools/dev-fast/config.toml` is passed, `dev-build`
runs `build --bin netsuke`, `dev-test` runs
`test --all-targets --all-features`, and the install prefix leads `PATH`.
`install-dev-fast` and `bench-build` are exercised through Make as well
as directly, confirming the recipes forward the prefix, pin overrides,
and release URL.

`MakeInvocation` describes a Make run, keeping command-line variables
and environment entries distinct because they reach a recipe by
different routes and differ in precedence.

Reverting the config-fragment argument or the PATH prefix from the
Makefile fails three of the four new tests.

The support module becomes a directory to stay within the file-length
limit; `sandbox.rs` is a pure move.
---
 docs/developers-guide.md                      |  59 +++--
 dylint.toml                                   |   1 +
 test_support/src/dev_fast/cargo_log.rs        | 144 ++++++++++
 test_support/src/dev_fast/make.rs             |  72 +++++
 test_support/src/dev_fast/mod.rs              |  33 +++
 test_support/src/dev_fast/release.rs          | 149 +++++++++++
 .../src/{dev_fast.rs => dev_fast/sandbox.rs}  |  42 +--
 tests/dev_fast_install_tests.rs               | 250 ++++++++----------
 tests/dev_fast_make_target_tests.rs           | 188 +++++++++++++
 9 files changed, 768 insertions(+), 170 deletions(-)
 create mode 100644 test_support/src/dev_fast/cargo_log.rs
 create mode 100644 test_support/src/dev_fast/make.rs
 create mode 100644 test_support/src/dev_fast/mod.rs
 create mode 100644 test_support/src/dev_fast/release.rs
 rename test_support/src/{dev_fast.rs => dev_fast/sandbox.rs} (87%)
 create mode 100644 tests/dev_fast_make_target_tests.rs

diff --git a/docs/developers-guide.md b/docs/developers-guide.md
index d3a232fb2..affde8501 100644
--- a/docs/developers-guide.md
+++ b/docs/developers-guide.md
@@ -539,25 +539,50 @@ flag, `codegen-backend = "cranelift"` on the `dev` profile, and a
 
 ### Testing the tooling
 
-`tests/dev_fast_check_tests.rs` and `tests/dev_fast_install_tests.rs` cover the
-targets' observable behaviour: the diagnostics each failure mode emits, the
-exit status, and the installer's refusal to unpack an unverifiable artefact.
-They need neither `mold`, `rustup`, nor a network, so they run as part of
+Three suites cover the tooling's observable behaviour. All are hermetic — no
+network, and no real `mold`, `rustup`, or Cargo — so they run as part of
 `make test` on any Linux host.
 
-The harness is `test_support::dev_fast::Sandbox`. Because the scripts probe
-`PATH`, a test cannot express "the tool is absent" by prepending fakes on a
-machine that has the real tool installed. The sandbox therefore builds `PATH`
-from nothing — an explicit allowlist of ordinary utilities symlinked into a
-temporary directory, plus whichever fakes a case installs — and redirects
-`HOME` so the Makefile's `$(HOME)/.local/bin` export cannot reach outside it.
-Add to `SANDBOX_UTILITIES` when a script gains a dependency; a missing entry
-surfaces as a test failure rather than as a silent fallback to the developer's
-own tools.
-
-Reuse the sandbox for any future target with the same shape. Do not reach for
-`PathGuard` here: these tests spawn children with a bespoke environment rather
-than mutating the parent's, which is what keeps them safe to run in parallel.
+- `tests/dev_fast_check_tests.rs`: the capability gate. Which diagnostic each
+  failure mode emits, and that `dev-build` and `dev-test` stop before Cargo
+  runs.
+- `tests/dev_fast_install_tests.rs`: the installer and benchmark scripts,
+  invoked directly. Verification against a locally built release, and the
+  refusal to unpack an artefact whose checksum mismatches or is unlisted.
+- `tests/dev_fast_make_target_tests.rs`: the Make recipes' success paths. That
+  `dev-build` and `dev-test` select the pinned nightly, pass
+  `--config tools/dev-fast/config.toml`, run the expected Cargo subcommand, and
+  lead `PATH` with the install prefix; that `install-dev-fast` forwards the
+  prefix, pin overrides, and release URL; and that `bench-build` emits both
+  variant rows.
+
+The fixtures live in `test_support::dev_fast`:
+
+- `Sandbox` builds `PATH` from nothing — an explicit allowlist of ordinary
+  utilities symlinked into a temporary directory, plus whichever fakes a case
+  installs — and redirects `HOME` so the Makefile's `$(HOME)/.local/bin` export
+  cannot reach outside it. Prepending fakes would not do: on a machine with a
+  real `mold` installed, a test could not then express "the tool is absent".
+  Add to `SANDBOX_UTILITIES` when a script gains a dependency; a missing entry
+  surfaces as a test failure rather than as a silent fallback to the
+  developer's own tools.
+- `FakeRelease` publishes a tarball under the `v<version>` path the installer
+  requests and serves it over a `file://` URL, exercising the real URL layout,
+  checksum verification, and strip depth. Each release owns its version, so no
+  caller threads a version string around.
+- `RecordingCargo` is a fake `cargo` that logs the arguments,
+  `RUSTUP_TOOLCHAIN`,
+  and `PATH` of every invocation, turning a recipe's command line into a
+  checkable fact.
+- `MakeInvocation` describes a Make run. Variable overrides and environment
+  entries are kept apart deliberately: a command-line variable outranks a `?=`
+  default, whereas an environment entry is the only channel for a setting a
+  script reads without the Makefile naming it.
+
+Assert on the shape of a timing cell, never on a duration. Reuse the sandbox
+for any future target with the same shape, and do not reach for `PathGuard`:
+these tests spawn children with a bespoke environment rather than mutating the
+parent's, which is what keeps them safe to run in parallel.
 
 ### Benchmark evidence
 
diff --git a/dylint.toml b/dylint.toml
index 9657b599c..8b4ea75d1 100644
--- a/dylint.toml
+++ b/dylint.toml
@@ -70,6 +70,7 @@ excluded_crates = [
     "advanced_usage_tests",
     "assert_cmd_tests",
     "dev_fast_install_tests",
+    "dev_fast_make_target_tests",
     "manifest_glob_tests",
     "ninja_snapshot_tests",
     "novice_flow_smoke_tests",
diff --git a/test_support/src/dev_fast/cargo_log.rs b/test_support/src/dev_fast/cargo_log.rs
new file mode 100644
index 000000000..2c9bae7cf
--- /dev/null
+++ b/test_support/src/dev_fast/cargo_log.rs
@@ -0,0 +1,144 @@
+//! A fake `cargo` that records how it was called.
+//!
+//! The `dev-build` and `dev-test` recipes are worth asserting on directly: they
+//! select a toolchain, pass a configuration fragment, and prepend the install
+//! prefix to `PATH`. Recording the arguments and environment each invocation
+//! received turns those into checkable facts rather than assumptions.
+
+use anyhow::{Context, Result};
+use camino::{Utf8Path, Utf8PathBuf};
+use std::fs;
+
+use super::Sandbox;
+
+/// Separator between records in the log. Chosen so it cannot collide with an
+/// argument or a path.
+const RECORD_SEPARATOR: &str = "--dev-fast-record--";
+
+/// A `cargo` stand-in installed on the sandbox `PATH`, plus its log.
+pub struct RecordingCargo {
+    executable: Utf8PathBuf,
+    log: Utf8PathBuf,
+}
+
+impl RecordingCargo {
+    /// Install the fake into the sandbox's `bin`, logging under its `HOME`.
+    pub fn install(sandbox: &Sandbox) -> Result<Self> {
+        let log = sandbox.home().join("cargo-invocations.log");
+        let body = format!(
+            concat!(
+                "{{\n",
+                "  echo '{separator}'\n",
+                "  printf 'arguments\\t%s\\n' \"$*\"\n",
+                "  printf 'toolchain\\t%s\\n' \"${{RUSTUP_TOOLCHAIN:-}}\"\n",
+                "  printf 'path\\t%s\\n' \"${{PATH:-}}\"\n",
+                "}} >> '{log}'\n",
+                "exit 0"
+            ),
+            separator = RECORD_SEPARATOR,
+            log = log,
+        );
+        let executable = sandbox.write_fake(&sandbox.bin(), "cargo", &body)?;
+        Ok(Self { executable, log })
+    }
+
+    /// The fake's path, for passing as the `CARGO` Make variable.
+    pub fn executable(&self) -> &Utf8Path {
+        &self.executable
+    }
+
+    /// Every invocation recorded so far, in order.
+    ///
+    /// An absent log means the fake was never called, which is reported as an
+    /// empty list so a test can assert on that directly.
+    pub fn invocations(&self) -> Result<Vec<CargoInvocation>> {
+        if !self.log.as_std_path().exists() {
+            return Ok(Vec::new());
+        }
+        let text = fs::read_to_string(self.log.as_std_path())
+            .with_context(|| format!("read {}", self.log))?;
+        Ok(text
+            .split(RECORD_SEPARATOR)
+            .filter(|record| !record.trim().is_empty())
+            .map(CargoInvocation::parse)
+            .collect())
+    }
+
+    /// The single recorded invocation, or an error naming how many there were.
+    pub fn sole_invocation(&self) -> Result<CargoInvocation> {
+        let mut invocations = self.invocations()?;
+        match invocations.len() {
+            1 => Ok(invocations.remove(0)),
+            count => anyhow::bail!("expected exactly one cargo invocation, recorded {count}"),
+        }
+    }
+}
+
+/// One recorded `cargo` call.
+pub struct CargoInvocation {
+    arguments: Vec<String>,
+    toolchain: String,
+    path: String,
+}
+
+impl CargoInvocation {
+    fn parse(record: &str) -> Self {
+        let mut invocation = Self {
+            arguments: Vec::new(),
+            toolchain: String::new(),
+            path: String::new(),
+        };
+        for line in record.lines() {
+            let Some((field, value)) = line.split_once('\t') else {
+                continue;
+            };
+            match field {
+                "arguments" => {
+                    invocation.arguments = value.split_whitespace().map(str::to_owned).collect();
+                }
+                "toolchain" => invocation.toolchain = value.to_owned(),
+                "path" => invocation.path = value.to_owned(),
+                _ => {}
+            }
+        }
+        invocation
+    }
+
+    /// The arguments Cargo received. Recorded via `"$*"`, so an argument
+    /// containing whitespace would be split; none of the `dev-fast` recipes
+    /// pass one.
+    pub fn arguments(&self) -> &[String] {
+        &self.arguments
+    }
+
+    /// `RUSTUP_TOOLCHAIN` as seen by the invocation, empty when unset.
+    pub fn toolchain(&self) -> &str {
+        &self.toolchain
+    }
+
+    /// Whether `sequence` appears as consecutive arguments.
+    ///
+    /// Contiguity matters: it distinguishes `--config <fragment>` from the same
+    /// two values appearing far apart for unrelated reasons.
+    pub fn contains_sequence(&self, sequence: &[&str]) -> bool {
+        if sequence.is_empty() || sequence.len() > self.arguments.len() {
+            return false;
+        }
+        self.arguments
+            .windows(sequence.len())
+            .any(|window| window.iter().zip(sequence).all(|(got, want)| got == want))
+    }
+
+    /// Whether `directory` is the first entry on the invocation's `PATH`.
+    pub fn path_starts_with(&self, directory: &Utf8Path) -> bool {
+        self.path
+            .split(':')
+            .next()
+            .is_some_and(|first| first == directory.as_str())
+    }
+
+    /// The recorded `PATH`, for failure messages.
+    pub fn path(&self) -> &str {
+        &self.path
+    }
+}
diff --git a/test_support/src/dev_fast/make.rs b/test_support/src/dev_fast/make.rs
new file mode 100644
index 000000000..944baf4c7
--- /dev/null
+++ b/test_support/src/dev_fast/make.rs
@@ -0,0 +1,72 @@
+//! A described Make run, so tests exercise the real recipes.
+//!
+//! Variable overrides and environment entries are separate because the two
+//! reach a recipe by different routes, and the distinction is load-bearing: a
+//! command-line variable outranks a `?=` default in the Makefile, whereas an
+//! environment entry is the only channel for a setting a script reads directly
+//! without the Makefile naming it.
+
+use std::fmt::Display;
+
+/// A Make target plus the overrides a case needs.
+///
+/// Built fluently, then handed to
+/// [`Sandbox::run_make`](super::Sandbox::run_make):
+///
+/// ```rust,no_run
+/// use test_support::dev_fast::MakeInvocation;
+///
+/// let invocation = MakeInvocation::new("bench-build")
+///     .variable("CARGO", "/path/to/fake/cargo")
+///     .environment("BENCH_ROOT", "/tmp/bench");
+/// ```
+#[derive(Clone, Debug)]
+pub struct MakeInvocation {
+    target: String,
+    variables: Vec<(String, String)>,
+    environment: Vec<(String, String)>,
+}
+
+impl MakeInvocation {
+    /// A run of `target` with no overrides.
+    pub fn new(target: &str) -> Self {
+        Self {
+            target: target.to_owned(),
+            variables: Vec::new(),
+            environment: Vec::new(),
+        }
+    }
+
+    /// Override a Make variable on the command line, outranking any `?=`
+    /// default the Makefile sets.
+    #[must_use]
+    pub fn variable(mut self, name: &str, value: impl Display) -> Self {
+        self.variables.push((name.to_owned(), value.to_string()));
+        self
+    }
+
+    /// Set an environment entry for the Make process, which recipes inherit.
+    /// Use this for settings a script reads directly from the environment.
+    #[must_use]
+    pub fn environment(mut self, name: &str, value: impl Display) -> Self {
+        self.environment.push((name.to_owned(), value.to_string()));
+        self
+    }
+
+    pub(super) fn target(&self) -> &str {
+        &self.target
+    }
+
+    /// Variable overrides rendered as `NAME=value` command-line arguments.
+    pub(super) fn variable_arguments(&self) -> impl Iterator<Item = String> + '_ {
+        self.variables
+            .iter()
+            .map(|(name, value)| format!("{name}={value}"))
+    }
+
+    pub(super) fn environment_entries(&self) -> impl Iterator<Item = (&str, &str)> + '_ {
+        self.environment
+            .iter()
+            .map(|(name, value)| (name.as_str(), value.as_str()))
+    }
+}
diff --git a/test_support/src/dev_fast/mod.rs b/test_support/src/dev_fast/mod.rs
new file mode 100644
index 000000000..662a2e0a8
--- /dev/null
+++ b/test_support/src/dev_fast/mod.rs
@@ -0,0 +1,33 @@
+//! Test scaffolding for the opt-in `dev-fast` build-acceleration tooling.
+//!
+//! The `make dev-*` targets and their backing scripts probe `PATH` for `mold`
+//! and `rustup`, download a pinned release, and shell out to Cargo. Testing
+//! them needs three things this module provides:
+//!
+//! - [`Sandbox`], a `PATH` and `HOME` built from nothing, so a case can express
+//!   "the tool is absent" on a machine that has the real tool installed.
+//! - [`FakeRelease`], a locally built stand-in for a mold release served over a
+//!   `file://` URL, so the installer's download and verification path runs
+//!   without a network.
+//! - [`RecordingCargo`], a fake `cargo` that records the arguments and
+//!   environment each invocation received, so a target's command line can be
+//!   asserted rather than inferred.
+//!
+//! [`MakeInvocation`] ties them together, describing a Make run with its
+//! variable overrides and environment so tests exercise the real recipes rather
+//! than reimplementing them.
+//!
+//! Scope: these helpers exist for the `dev-fast` target tests. They spawn child
+//! processes with a bespoke environment and never mutate the parent's, so they
+//! compose with the repository's prohibition on direct environment mutation in
+//! tests.
+
+mod cargo_log;
+mod make;
+mod release;
+mod sandbox;
+
+pub use cargo_log::{CargoInvocation, RecordingCargo};
+pub use make::MakeInvocation;
+pub use release::FakeRelease;
+pub use sandbox::{Sandbox, combined, pinned_mold_version, pinned_toolchain};
diff --git a/test_support/src/dev_fast/release.rs b/test_support/src/dev_fast/release.rs
new file mode 100644
index 000000000..f5ab1e65f
--- /dev/null
+++ b/test_support/src/dev_fast/release.rs
@@ -0,0 +1,149 @@
+//! A locally built stand-in for a pinned mold release.
+//!
+//! The installer downloads `<base>/v<version>/<name>`, verifies the artefact
+//! against a checksum file, and unpacks it with the tarball's versioned root
+//! stripped. Serving that from a `file://` URL exercises the whole path — URL
+//! layout, verification, and strip depth — with no network.
+//!
+//! Each release owns its version, so no caller threads a version string
+//! through: ask the release for what you need instead.
+
+use anyhow::{Context, Result, ensure};
+use camino::{Utf8Path, Utf8PathBuf};
+use std::fs;
+use std::process::Command;
+
+use super::Sandbox;
+
+/// A published fake release, ready for the installer to fetch.
+pub struct FakeRelease {
+    version: String,
+    directory: Utf8PathBuf,
+    name: String,
+    sha256: String,
+}
+
+impl FakeRelease {
+    /// Build a release for `version` and publish it under the `v<version>` path
+    /// the installer will request.
+    pub fn publish(sandbox: &Sandbox, version: &str) -> Result<Self> {
+        let directory = sandbox.home().join("releases");
+        let root = format!("mold-{version}-x86_64-linux");
+        let name = format!("{root}.tar.gz");
+
+        stage_release_tree(&directory.join(&root))?;
+        let archive = build_archive(sandbox, &directory, &name, &root)?;
+        let sha256 = sha256_of(sandbox, &archive)?;
+        publish_under_version_path(&directory, &archive, &name, version)?;
+
+        Ok(Self {
+            version: version.to_owned(),
+            directory,
+            name,
+            sha256,
+        })
+    }
+
+    /// The version this release was published as.
+    pub fn version(&self) -> &str {
+        &self.version
+    }
+
+    /// The artefact's file name, as it appears in a checksum file.
+    pub fn name(&self) -> &str {
+        &self.name
+    }
+
+    /// The artefact's real SHA-256 digest.
+    pub fn sha256(&self) -> &str {
+        &self.sha256
+    }
+
+    /// The base URL to point the installer at. It appends `/v<version>/<name>`.
+    pub fn base_url(&self) -> String {
+        format!("file://{}", self.directory)
+    }
+
+    /// Write a version pin naming this release, and return its path.
+    pub fn write_version_pin(&self, sandbox: &Sandbox) -> Result<Utf8PathBuf> {
+        let path = sandbox.home().join("MOLD_VERSION");
+        fs::write(path.as_std_path(), format!("{}\n", self.version))
+            .context("write test version pin")?;
+        Ok(path)
+    }
+
+    /// Write a checksum file recording `digest` for this artefact, and return
+    /// its path. Pass the real [`sha256`](Self::sha256) for the success path, or
+    /// any other value to exercise a mismatch.
+    pub fn write_checksums(&self, sandbox: &Sandbox, digest: &str) -> Result<Utf8PathBuf> {
+        self.write_checksum_file(sandbox, &format!("{digest}  {}\n", self.name))
+    }
+
+    /// Write a checksum file that is well-formed but does not mention this
+    /// artefact, exercising the unlisted-artefact refusal.
+    pub fn write_checksums_omitting_this_artefact(&self, sandbox: &Sandbox) -> Result<Utf8PathBuf> {
+        let other = format!("{}  mold-0.0.0-x86_64-linux.tar.gz\n", self.sha256);
+        self.write_checksum_file(sandbox, &other)
+    }
+
+    fn write_checksum_file(&self, sandbox: &Sandbox, contents: &str) -> Result<Utf8PathBuf> {
+        let path = sandbox.home().join("SHA256SUMS");
+        fs::write(path.as_std_path(), contents).context("write test checksum file")?;
+        Ok(path)
+    }
+}
+
+/// Lay out the tarball's versioned root containing `bin/mold`, so a correct
+/// `--strip-components` lands the binary directly in the install prefix.
+fn stage_release_tree(root: &Utf8Path) -> Result<()> {
+    fs::create_dir_all(root.join("bin").as_std_path()).context("stage fake release tree")?;
+    fs::write(
+        root.join("bin/mold").as_std_path(),
+        "#!/bin/sh\necho fake\n",
+    )
+    .context("write staged mold")
+}
+
+fn build_archive(
+    sandbox: &Sandbox,
+    directory: &Utf8Path,
+    name: &str,
+    root: &str,
+) -> Result<Utf8PathBuf> {
+    let status = Command::new(sandbox.bin().join("tar").as_std_path())
+        .current_dir(directory.as_std_path())
+        .args(["--create", "--gzip", "--file"])
+        .arg(name)
+        .arg(root)
+        .status()
+        .context("create fake release tarball")?;
+    ensure!(status.success(), "tar should build the fake release");
+    Ok(directory.join(name))
+}
+
+fn sha256_of(sandbox: &Sandbox, path: &Utf8Path) -> Result<String> {
+    let output = Command::new(sandbox.bin().join("sha256sum").as_std_path())
+        .arg(path.as_std_path())
+        .output()
+        .context("hash fake release tarball")?;
+    ensure!(output.status.success(), "sha256sum should succeed");
+    let text = String::from_utf8_lossy(&output.stdout);
+    Ok(text
+        .split_whitespace()
+        .next()
+        .context("parse sha256sum output")?
+        .to_owned())
+}
+
+fn publish_under_version_path(
+    directory: &Utf8Path,
+    archive: &Utf8Path,
+    name: &str,
+    version: &str,
+) -> Result<()> {
+    let versioned = directory.join(format!("v{version}"));
+    fs::create_dir_all(versioned.as_std_path()).context("create versioned release path")?;
+    fs::copy(archive.as_std_path(), versioned.join(name).as_std_path())
+        .context("publish fake release under its version path")?;
+    Ok(())
+}
diff --git a/test_support/src/dev_fast.rs b/test_support/src/dev_fast/sandbox.rs
similarity index 87%
rename from test_support/src/dev_fast.rs
rename to test_support/src/dev_fast/sandbox.rs
index d17ae0c9e..5881c675f 100644
--- a/test_support/src/dev_fast.rs
+++ b/test_support/src/dev_fast/sandbox.rs
@@ -1,20 +1,7 @@
-//! Sandbox harness for the opt-in `dev-fast` build-acceleration tooling.
+//! A hermetic `PATH` and `HOME` for exercising the `dev-fast` targets.
 //!
-//! The `make dev-*` targets and their backing scripts probe `PATH` for `mold`
-//! and `rustup`. A test that merely prepends fakes therefore cannot express
-//! "the tool is absent" on a machine that has the real thing installed. This
-//! harness instead builds a `PATH` from nothing: a sandbox directory holding
-//! symlinks to an explicit allowlist of ordinary utilities, plus whichever
-//! fakes a case installs. Anything unnamed is genuinely unreachable.
-//!
-//! `HOME` is redirected into the sandbox too, so the Makefile's unconditional
-//! `$(HOME)/.cargo/bin:$(HOME)/.local/bin` export cannot reach a real tool.
-//!
-//! Scope: these helpers exist for the `dev-fast` target tests. They spawn
-//! child processes with a bespoke environment and never mutate the parent's,
-//! so they compose with the repository's prohibition on direct environment
-//! mutation in tests.
-
+//! See the parent module for why the sandbox is built from nothing rather
+//! than by prepending fakes to the ambient `PATH`.
 use anyhow::{Context, Result, bail};
 use camino::{Utf8Path, Utf8PathBuf};
 use std::fs;
@@ -23,6 +10,7 @@ use std::process::{Command, Output};
 use tempfile::{TempDir, tempdir};
 
 use crate::exec::write_exec_with_content;
+use super::MakeInvocation;
 
 /// Utilities the scripts and `make` legitimately need. Kept explicit so a new
 /// dependency surfaces as a test failure rather than silently resolving to
@@ -177,18 +165,32 @@ impl Sandbox {
             .with_context(|| format!("run scripts/{name}"))
     }
 
-    /// Run a Make target with the sandbox as the entire environment.
+    /// Run a Make target with the sandbox as the entire environment and no
+    /// overrides beyond the sandbox's own install prefix.
     pub fn make(&self, target: &str) -> Result<Output> {
+        self.run_make(&MakeInvocation::new(target))
+    }
+
+    /// Run a described Make invocation with the sandbox as the entire
+    /// environment. The sandbox's install prefix is applied first, so an
+    /// invocation may still override it.
+    pub fn run_make(&self, invocation: &MakeInvocation) -> Result<Output> {
         let mut command = self.base_command(&self.bin().join("make"));
         command
             .arg("--no-print-directory")
             .arg("-f")
             .arg("Makefile")
-            .arg(format!("DEV_FAST_PREFIX={}", self.prefix()))
-            .arg(target);
+            .arg(format!("DEV_FAST_PREFIX={}", self.prefix()));
+        for (name, value) in invocation.environment_entries() {
+            command.env(name, value);
+        }
+        for argument in invocation.variable_arguments() {
+            command.arg(argument);
+        }
+        command.arg(invocation.target());
         command
             .output()
-            .with_context(|| format!("run make {target}"))
+            .with_context(|| format!("run make {}", invocation.target()))
     }
 }
 
diff --git a/tests/dev_fast_install_tests.rs b/tests/dev_fast_install_tests.rs
index 672ffb8a1..ac02b39ea 100644
--- a/tests/dev_fast_install_tests.rs
+++ b/tests/dev_fast_install_tests.rs
@@ -3,127 +3,128 @@
 //! The installer's security-relevant behaviour is that it refuses to unpack an
 //! artefact it cannot verify, so these tests serve a locally built tarball over
 //! a `file://` URL and vary only the recorded checksum. No network is used.
+//!
+//! The Make targets that wrap these scripts are covered separately in
+//! `dev_fast_make_target_tests.rs`.
 
 #![cfg(all(unix, target_os = "linux"))]
 
 use anyhow::{Context, Result, ensure};
-use camino::{Utf8Path, Utf8PathBuf};
+use camino::Utf8PathBuf;
 use rstest::rstest;
 use std::fs;
-use std::process::Command;
-use test_support::dev_fast::{Sandbox, combined, pinned_mold_version, pinned_toolchain};
-
-/// A stand-in mold release laid out like the real tarball: a versioned root
-/// directory the installer strips, containing `bin/mold`.
-struct FakeRelease {
-    dir: Utf8PathBuf,
-    archive: Utf8PathBuf,
-    name: String,
-    sha256: String,
+use test_support::dev_fast::{
+    FakeRelease, Sandbox, combined, pinned_mold_version, pinned_toolchain,
+};
+
+/// The version the fake release is published as. Deliberately not a real mold
+/// version, so a test that accidentally reached the network would fail rather
+/// than silently succeed against an upstream artefact.
+const TEST_MOLD_VERSION: &str = "9.9.9";
+
+/// A digest that cannot match any artefact, for the mismatch case.
+const WRONG_SHA256: &str = "0000000000000000000000000000000000000000000000000000000000000000";
+
+/// The installer inputs pointing at a local fake release.
+///
+/// Grouping them keeps the version, pin path, checksum path, and URL travelling
+/// together as one value instead of as a handful of interchangeable strings.
+struct InstallerFixture {
+    version_pin: Utf8PathBuf,
+    checksums: Utf8PathBuf,
+    base_url: String,
 }
 
-fn build_fake_release(sandbox: &Sandbox, version: &str) -> Result<FakeRelease> {
-    let dir = sandbox.home().join("releases");
-    let root = format!("mold-{version}-x86_64-linux");
-    let staging = dir.join(&root);
-    fs::create_dir_all(staging.join("bin").as_std_path()).context("stage fake release tree")?;
-    fs::write(
-        staging.join("bin/mold").as_std_path(),
-        "#!/bin/sh\necho fake\n",
-    )
-    .context("write staged mold")?;
-
-    let name = format!("{root}.tar.gz");
-    let archive = dir.join(&name);
-    let status = Command::new(sandbox.bin().join("tar").as_std_path())
-        .current_dir(dir.as_std_path())
-        .args(["--create", "--gzip", "--file"])
-        .arg(&name)
-        .arg(&root)
-        .status()
-        .context("create fake release tarball")?;
-    ensure!(status.success(), "tar should build the fake release");
-
-    let sha256 = sha256_of(sandbox, &archive)?;
-    Ok(FakeRelease {
-        dir,
-        archive,
-        name,
-        sha256,
-    })
+impl InstallerFixture {
+    /// Environment overrides for a direct `install-dev-fast.sh` invocation.
+    fn script_env(&self) -> Vec<(&'static str, String)> {
+        vec![
+            ("MOLD_VERSION_FILE", self.version_pin.to_string()),
+            ("MOLD_SHA256SUMS_FILE", self.checksums.to_string()),
+            ("MOLD_RELEASE_BASE_URL", self.base_url.clone()),
+        ]
+    }
 }
 
-fn sha256_of(sandbox: &Sandbox, path: &Utf8Path) -> Result<String> {
-    let output = Command::new(sandbox.bin().join("sha256sum").as_std_path())
-        .arg(path.as_std_path())
-        .output()
-        .context("hash fake release tarball")?;
-    ensure!(output.status.success(), "sha256sum should succeed");
-    let text = String::from_utf8_lossy(&output.stdout);
-    Ok(text
-        .split_whitespace()
-        .next()
-        .context("parse sha256sum output")?
-        .to_owned())
+/// A sandbox with a published fake release and a usable `rustup`.
+struct InstallerScenario {
+    sandbox: Sandbox,
+    release: FakeRelease,
 }
 
-/// Point the installer at a local release directory, with a caller-chosen
-/// checksum recorded for the artefact.
-fn install_env(
-    sandbox: &Sandbox,
-    release: &FakeRelease,
-    version: &str,
-    recorded: &str,
-) -> Result<Vec<(&'static str, String)>> {
-    let version_file = sandbox.home().join("MOLD_VERSION");
-    let sums_file = sandbox.home().join("SHA256SUMS");
-    fs::write(version_file.as_std_path(), format!("{version}\n"))
-        .context("write test version pin")?;
-    fs::write(
-        sums_file.as_std_path(),
-        format!("{recorded}  {}\n", release.name),
-    )
-    .context("write test checksum file")?;
-
-    Ok(vec![
-        ("MOLD_VERSION_FILE", version_file.to_string()),
-        ("MOLD_SHA256SUMS_FILE", sums_file.to_string()),
-        (
-            "MOLD_RELEASE_BASE_URL",
-            // The installer appends `/v<version>/<name>`, so expose the release
-            // directory under a matching `v<version>` path.
-            format!("file://{}", release.dir),
-        ),
-    ])
+impl InstallerScenario {
+    /// Publish a release and make the Cranelift toolchain appear installed, so
+    /// only the linker half of the installer is under test.
+    fn prepare() -> Result<Self> {
+        let sandbox = Sandbox::new()?;
+        sandbox.write_rustup(&pinned_toolchain()?, true)?;
+        let release = FakeRelease::publish(&sandbox, TEST_MOLD_VERSION)?;
+        Ok(Self { sandbox, release })
+    }
+
+    /// Fixture recording the release's real digest, so verification passes.
+    fn with_matching_checksum(&self) -> Result<InstallerFixture> {
+        self.fixture(
+            self.release
+                .write_checksums(&self.sandbox, self.release.sha256())?,
+        )
+    }
+
+    /// Fixture whose checksum file fails verification in the given way.
+    fn with_failure(&self, failure: ChecksumFailure) -> Result<InstallerFixture> {
+        self.fixture(failure.write_checksums(&self.sandbox, &self.release)?)
+    }
+
+    fn fixture(&self, checksums: Utf8PathBuf) -> Result<InstallerFixture> {
+        Ok(InstallerFixture {
+            version_pin: self.release.write_version_pin(&self.sandbox)?,
+            checksums,
+            base_url: self.release.base_url(),
+        })
+    }
+
+    fn installed_mold(&self) -> Utf8PathBuf {
+        self.sandbox.prefix().join("bin/mold")
+    }
 }
 
-/// The installer builds `<base>/v<version>/<name>`; mirror the artefact there.
-fn publish_under_version_path(release: &FakeRelease, version: &str) -> Result<()> {
-    let versioned = release.dir.join(format!("v{version}"));
-    fs::create_dir_all(versioned.as_std_path()).context("create versioned release path")?;
-    fs::copy(
-        release.archive.as_std_path(),
-        versioned.join(&release.name).as_std_path(),
-    )
-    .context("publish fake release under its version path")?;
-    Ok(())
+/// The ways verification can legitimately fail.
+///
+/// A closed enum rather than a pair of strings: each variant owns both the
+/// checksum file it needs and the diagnostic the installer must emit, so the two
+/// cannot drift apart.
+#[derive(Copy, Clone, Debug)]
+enum ChecksumFailure {
+    /// The artefact is listed, but under a different digest.
+    Mismatch,
+    /// The checksum file is well-formed but says nothing about this artefact.
+    MissingEntry,
 }
 
-fn prepared_installer(version: &str) -> Result<(Sandbox, FakeRelease)> {
-    let sandbox = Sandbox::new()?;
-    sandbox.write_rustup(&pinned_toolchain()?, true)?;
-    let release = build_fake_release(&sandbox, version)?;
-    publish_under_version_path(&release, version)?;
-    Ok((sandbox, release))
+impl ChecksumFailure {
+    fn write_checksums(self, sandbox: &Sandbox, release: &FakeRelease) -> Result<Utf8PathBuf> {
+        match self {
+            Self::Mismatch => release.write_checksums(sandbox, WRONG_SHA256),
+            Self::MissingEntry => release.write_checksums_omitting_this_artefact(sandbox),
+        }
+    }
+
+    const fn expected_diagnostic(self) -> &'static str {
+        match self {
+            Self::Mismatch => "checksum mismatch",
+            Self::MissingEntry => "no checksum recorded",
+        }
+    }
 }
 
 #[test]
 fn installs_and_records_the_verification_when_the_checksum_matches() -> Result<()> {
-    let version = "9.9.9";
-    let (sandbox, release) = prepared_installer(version)?;
-    let env = install_env(&sandbox, &release, version, &release.sha256)?;
+    let scenario = InstallerScenario::prepare()?;
+    let fixture = scenario.with_matching_checksum()?;
 
-    let output = sandbox.script("install-dev-fast.sh", &env)?;
+    let output = scenario
+        .sandbox
+        .script("install-dev-fast.sh", &fixture.script_env())?;
     let text = combined(&output);
 
     ensure!(
@@ -131,11 +132,11 @@ fn installs_and_records_the_verification_when_the_checksum_matches() -> Result<(
         "install should succeed, got `{text}`"
     );
     ensure!(
-        text.contains(&format!("verified {}", release.name)),
+        text.contains(&format!("verified {}", scenario.release.name())),
         "should report the verification, got `{text}`"
     );
     ensure!(
-        sandbox.prefix().join("bin/mold").as_std_path().is_file(),
+        scenario.installed_mold().as_std_path().is_file(),
         "the tarball root should be stripped so bin/mold lands in the prefix"
     );
     ensure!(
@@ -146,34 +147,17 @@ fn installs_and_records_the_verification_when_the_checksum_matches() -> Result<(
 }
 
 /// Refusing an unverifiable artefact is the point of the checksum file, so both
-/// a mismatch and an unlisted name must abort before anything is unpacked.
+/// failure modes must abort before anything is unpacked.
 #[rstest]
-#[case::mismatch(
-    "0000000000000000000000000000000000000000000000000000000000000000",
-    "checksum mismatch"
-)]
-#[case::unlisted("", "no checksum recorded")]
-fn refuses_to_install_an_unverifiable_artefact(
-    #[case] recorded: &str,
-    #[case] expected: &str,
-) -> Result<()> {
-    let version = "9.9.9";
-    let (sandbox, release) = prepared_installer(version)?;
-    let mut env = install_env(&sandbox, &release, version, recorded)?;
-    if recorded.is_empty() {
-        // Record a checksum for a different artefact, so the file is valid but
-        // this release is absent from it.
-        let sums_file = sandbox.home().join("SHA256SUMS");
-        fs::write(
-            sums_file.as_std_path(),
-            format!("{}  mold-0.0.0-x86_64-linux.tar.gz\n", release.sha256),
-        )
-        .context("write checksum file without this artefact")?;
-        env.retain(|(key, _)| *key != "MOLD_SHA256SUMS_FILE");
-        env.push(("MOLD_SHA256SUMS_FILE", sums_file.to_string()));
-    }
-
-    let output = sandbox.script("install-dev-fast.sh", &env)?;
+#[case::mismatch(ChecksumFailure::Mismatch)]
+#[case::missing_entry(ChecksumFailure::MissingEntry)]
+fn refuses_to_install_an_unverifiable_artefact(#[case] failure: ChecksumFailure) -> Result<()> {
+    let scenario = InstallerScenario::prepare()?;
+    let fixture = scenario.with_failure(failure)?;
+
+    let output = scenario
+        .sandbox
+        .script("install-dev-fast.sh", &fixture.script_env())?;
     let text = combined(&output);
 
     ensure!(
@@ -181,11 +165,12 @@ fn refuses_to_install_an_unverifiable_artefact(
         "install should abort, got `{text}`"
     );
     ensure!(
-        text.contains(expected),
-        "should explain the refusal (`{expected}`), got `{text}`"
+        text.contains(failure.expected_diagnostic()),
+        "should explain the refusal (`{}`), got `{text}`",
+        failure.expected_diagnostic()
     );
     ensure!(
-        !sandbox.prefix().join("bin/mold").as_std_path().exists(),
+        !scenario.installed_mold().as_std_path().exists(),
         "nothing should be unpacked when verification fails"
     );
     Ok(())
@@ -225,7 +210,6 @@ fn benchmark_emits_a_markdown_table_for_both_paths() -> Result<()> {
         stdout.contains("| Variant | Clean build (s) | Incremental build (s) |"),
         "should emit the table header, got `{stdout}`"
     );
-    // Timings are inherently unstable, so assert on shape rather than values.
     let rows: Vec<&str> = stdout
         .lines()
         .filter(|line| line.starts_with("| Default") || line.starts_with("| dev-fast"))
diff --git a/tests/dev_fast_make_target_tests.rs b/tests/dev_fast_make_target_tests.rs
new file mode 100644
index 000000000..6ff0bb119
--- /dev/null
+++ b/tests/dev_fast_make_target_tests.rs
@@ -0,0 +1,188 @@
+//! Behavioural tests for the `dev-fast` Make targets' success paths.
+//!
+//! The scripts are covered directly elsewhere; what these tests pin down is the
+//! contract the recipes themselves establish — which toolchain is selected,
+//! which configuration fragment is passed, which Cargo subcommand runs, and that
+//! the install prefix leads `PATH` so `-fuse-ld=mold` resolves the pinned
+//! linker. A fake `cargo` records each invocation so those become checked facts
+//! rather than assumptions.
+//!
+//! Every case is hermetic: no network, and no real mold, rustup, or Cargo.
+
+#![cfg(all(unix, target_os = "linux"))]
+
+use anyhow::{Result, ensure};
+use camino::Utf8PathBuf;
+use rstest::rstest;
+use test_support::dev_fast::{
+    CargoInvocation, FakeRelease, MakeInvocation, RecordingCargo, Sandbox, combined,
+    pinned_mold_version, pinned_toolchain,
+};
+
+/// The version the fake release is published as; see the installer tests.
+const TEST_MOLD_VERSION: &str = "9.9.9";
+
+/// The fragment the recipes must hand to Cargo. Hard-coded rather than derived,
+/// so a change to the committed path fails a test instead of passing silently.
+const DEV_FAST_CONFIG: &str = "tools/dev-fast/config.toml";
+
+/// A sandbox whose prerequisites all pass, with a recording `cargo` installed.
+struct BuildScenario {
+    sandbox: Sandbox,
+    cargo: RecordingCargo,
+}
+
+impl BuildScenario {
+    fn prepare() -> Result<Self> {
+        let sandbox = Sandbox::new()?;
+        sandbox.write_mold(&sandbox.prefix().join("bin"), &pinned_mold_version()?)?;
+        sandbox.write_rustup(&pinned_toolchain()?, true)?;
+        let cargo = RecordingCargo::install(&sandbox)?;
+        Ok(Self { sandbox, cargo })
+    }
+
+    /// Run `target`, pointing `CARGO` at the recording fake.
+    fn run(&self, target: &str) -> Result<CargoInvocation> {
+        let invocation = MakeInvocation::new(target).variable("CARGO", self.cargo.executable());
+        let output = self.sandbox.run_make(&invocation)?;
+        ensure!(
+            output.status.success(),
+            "make {target} should succeed, got `{}`",
+            combined(&output)
+        );
+        self.cargo.sole_invocation()
+    }
+
+    fn prefix_bin(&self) -> Utf8PathBuf {
+        self.sandbox.prefix().join("bin")
+    }
+}
+
+/// What a given build target must ask Cargo to do.
+#[derive(Copy, Clone, Debug)]
+struct BuildTarget {
+    name: &'static str,
+    subcommand: &'static [&'static str],
+}
+
+#[rstest]
+#[case::dev_build(BuildTarget { name: "dev-build", subcommand: &["build", "--bin", "netsuke"] })]
+#[case::dev_test(
+    BuildTarget { name: "dev-test", subcommand: &["test", "--all-targets", "--all-features"] }
+)]
+fn build_targets_select_the_pinned_toolchain_and_fragment(
+    #[case] target: BuildTarget,
+) -> Result<()> {
+    let scenario = BuildScenario::prepare()?;
+    let invocation = scenario.run(target.name)?;
+
+    ensure!(
+        invocation.toolchain() == pinned_toolchain()?,
+        "`{}` should select the pinned nightly, got `{}`",
+        target.name,
+        invocation.toolchain()
+    );
+    ensure!(
+        invocation.contains_sequence(&["--config", DEV_FAST_CONFIG]),
+        "`{}` should pass the fragment, got `{:?}`",
+        target.name,
+        invocation.arguments()
+    );
+    ensure!(
+        invocation.contains_sequence(target.subcommand),
+        "`{}` should run `{:?}`, got `{:?}`",
+        target.name,
+        target.subcommand,
+        invocation.arguments()
+    );
+    // The linker is resolved by PATH order, so leading the prefix is the whole
+    // mechanism by which the pinned mold, and not a system one, gets used.
+    ensure!(
+        invocation.path_starts_with(&scenario.prefix_bin()),
+        "`{}` should lead PATH with the install prefix, got `{}`",
+        target.name,
+        invocation.path()
+    );
+    Ok(())
+}
+
+#[test]
+fn install_target_forwards_the_prefix_pins_and_release_url() -> Result<()> {
+    let sandbox = Sandbox::new()?;
+    sandbox.write_rustup(&pinned_toolchain()?, true)?;
+    let release = FakeRelease::publish(&sandbox, TEST_MOLD_VERSION)?;
+    let version_pin = release.write_version_pin(&sandbox)?;
+    let checksums = release.write_checksums(&sandbox, release.sha256())?;
+
+    // Pins go through as command-line variables, outranking the Makefile's `?=`
+    // defaults; the release URL is read straight from the environment by the
+    // script, which is the only channel available for it.
+    let invocation = MakeInvocation::new("install-dev-fast")
+        .variable("MOLD_VERSION_FILE", &version_pin)
+        .variable("MOLD_SHA256SUMS_FILE", &checksums)
+        .environment("MOLD_RELEASE_BASE_URL", release.base_url());
+    let output = sandbox.run_make(&invocation)?;
+    let text = combined(&output);
+
+    ensure!(
+        output.status.success(),
+        "make install-dev-fast should succeed, got `{text}`"
+    );
+    ensure!(
+        text.contains(&release.base_url()),
+        "should fetch from the local release URL, got `{text}`"
+    );
+    ensure!(
+        text.contains(&format!("verified {}", release.name())),
+        "should verify against the overridden checksum file, got `{text}`"
+    );
+    ensure!(
+        text.contains(sandbox.prefix().as_str()),
+        "should install into the forwarded prefix, got `{text}`"
+    );
+    ensure!(
+        sandbox.prefix().join("bin/mold").as_std_path().is_file(),
+        "the pinned linker should land in the forwarded prefix"
+    );
+    Ok(())
+}
+
+#[test]
+fn bench_target_emits_both_variant_rows() -> Result<()> {
+    let scenario = BuildScenario::prepare()?;
+    let sandbox = &scenario.sandbox;
+    // Touch a disposable file rather than `src/main.rs`, so the benchmark does
+    // not invalidate the working tree's build cache.
+    let touch_file = sandbox.home().join("bench-touch");
+    std::fs::write(touch_file.as_std_path(), "").map_err(anyhow::Error::from)?;
+
+    let invocation = MakeInvocation::new("bench-build")
+        .variable("CARGO", scenario.cargo.executable())
+        .environment("BENCH_ROOT", sandbox.home().join("bench"))
+        .environment("BENCH_TOUCH_FILE", &touch_file);
+    let output = sandbox.run_make(&invocation)?;
+    let stdout = String::from_utf8_lossy(&output.stdout);
+
+    ensure!(
+        output.status.success(),
+        "make bench-build should succeed, got `{}`",
+        combined(&output)
+    );
+    for variant in [
+        "| Default (LLVM, platform linker) |",
+        "| dev-fast (Cranelift,",
+    ] {
+        ensure!(
+            stdout.contains(variant),
+            "table should carry the `{variant}` row, got `{stdout}`"
+        );
+    }
+    // Four builds: clean and incremental, for each of the two variants.
+    let invocations = scenario.cargo.invocations()?;
+    ensure!(
+        invocations.len() == 4,
+        "should measure two builds per variant, recorded {}",
+        invocations.len()
+    );
+    Ok(())
+}

From f72aee35196bbdc2ade6b2696746e07e66838e9b Mon Sep 17 00:00:00 2001
From: leynos <leynos@troubledskies.net>
Date: Thu, 30 Jul 2026 16:02:36 +0200
Subject: [PATCH 08/24] Collapse blank lines left by the rebase merge

The entity-level merge driver reassembled the developers' guide with a
doubled blank line before four headings, which `MD012` rejects. Purely
cosmetic; no prose changed.
---
 docs/developers-guide.md | 9 ++-------
 1 file changed, 2 insertions(+), 7 deletions(-)

diff --git a/docs/developers-guide.md b/docs/developers-guide.md
index affde8501..0376d8e55 100644
--- a/docs/developers-guide.md
+++ b/docs/developers-guide.md
@@ -372,7 +372,6 @@ unit tests, and `rstest-bdd` release-help scenarios.
 `src/cli/config_path_precedence_tests.rs` is the canonical exhaustive
 state-enumeration example.
 
-
 ## Local build acceleration
 
 Debug builds and tests can optionally use the [`mold`] linker and the Cranelift
@@ -395,7 +394,6 @@ make dev-test           # full test suite via Cranelift and mold
 missing tool reports an installation hint before Cargo is invoked rather than
 surfacing as an opaque codegen-backend or linker error.
 
-
 ### Toolchain contract
 
 Three pins keep the backend, linker, and toolchain in lockstep. Change them
@@ -478,7 +476,6 @@ The fragment sets three things and nothing else: the `codegen-backend` unstable
 flag, `codegen-backend = "cranelift"` on the `dev` profile, and a
 `-Clink-arg=-fuse-ld=mold` rustflag gated behind `cfg(target_os = "linux")`.
 
-
 ### Composition rules
 
 - **Quality gates.** `make check-fmt`, `make lint`, `make lint-clippy`,
@@ -536,7 +533,6 @@ flag, `codegen-backend = "cranelift"` on the `dev` profile, and a
   `make install-dev-fast`. It exits non-zero, so `make dev-build` and
   `make dev-test` stop before Cargo runs.
 
-
 ### Testing the tooling
 
 Three suites cover the tooling's observable behaviour. All are hermetic — no
@@ -571,9 +567,8 @@ The fixtures live in `test_support::dev_fast`:
   checksum verification, and strip depth. Each release owns its version, so no
   caller threads a version string around.
 - `RecordingCargo` is a fake `cargo` that logs the arguments,
-  `RUSTUP_TOOLCHAIN`,
-  and `PATH` of every invocation, turning a recipe's command line into a
-  checkable fact.
+  `RUSTUP_TOOLCHAIN`, and `PATH` of every invocation, turning a recipe's
+  command line into a checkable fact.
 - `MakeInvocation` describes a Make run. Variable overrides and environment
   entries are kept apart deliberately: a command-line variable outranks a `?=`
   default, whereas an environment entry is the only channel for a setting a

From 2cea7d31607f12a2aae54126f2b2bdbc2423b57f Mon Sep 17 00:00:00 2001
From: leynos <leynos@troubledskies.net>
Date: Thu, 30 Jul 2026 16:09:03 +0200
Subject: [PATCH 09/24] Compose the sandbox fake over main's stub primitive

`main` deduplicated fake-executable creation in `#63`/`#350`, adding
`write_exec_with_content` as the shared primitive and moving the `exec`
helpers from `camino` to `std::path`. This branch had independently
added `write_exec_with_body` for the same purpose, so the two arrived
as near-duplicates.

Keep main's primitive and drop this branch's. `Sandbox::write_fake`
now composes `write_exec_with_content`, supplying the shebang itself so
its call sites still carry only the behaviour being faked. That matches
the convention main documents: reach for a higher-level domain helper
and let it compose the primitive.

Cross-reference the two developers' guide sections so the ownership
boundary reads consistently from either end.
---
 docs/developers-guide.md             | 5 ++++-
 test_support/src/dev_fast/sandbox.rs | 2 +-
 2 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/docs/developers-guide.md b/docs/developers-guide.md
index 0376d8e55..2f8301b25 100644
--- a/docs/developers-guide.md
+++ b/docs/developers-guide.md
@@ -561,7 +561,10 @@ The fixtures live in `test_support::dev_fast`:
   real `mold` installed, a test could not then express "the tool is absent".
   Add to `SANDBOX_UTILITIES` when a script gains a dependency; a missing entry
   surfaces as a test failure rather than as a silent fallback to the
-  developer's own tools.
+  developer's own tools. Its `write_fake` is the domain helper described under
+  [temporary executable test helpers](#temporary-executable-test-helpers): it
+  composes `write_exec_with_content`, supplying the shebang so call sites carry
+  only the behaviour being faked.
 - `FakeRelease` publishes a tarball under the `v<version>` path the installer
   requests and serves it over a `file://` URL, exercising the real URL layout,
   checksum verification, and strip depth. Each release owns its version, so no
diff --git a/test_support/src/dev_fast/sandbox.rs b/test_support/src/dev_fast/sandbox.rs
index 5881c675f..f7f90d2e8 100644
--- a/test_support/src/dev_fast/sandbox.rs
+++ b/test_support/src/dev_fast/sandbox.rs
@@ -9,8 +9,8 @@ use std::os::unix::fs::PermissionsExt;
 use std::process::{Command, Output};
 use tempfile::{TempDir, tempdir};
 
-use crate::exec::write_exec_with_content;
 use super::MakeInvocation;
+use crate::exec::write_exec_with_content;
 
 /// Utilities the scripts and `make` legitimately need. Kept explicit so a new
 /// dependency surfaces as a test failure rather than silently resolving to

From 5f6d440e21918e553b4fe7617c9c186b450208fe Mon Sep 17 00:00:00 2001
From: leynos <leynos@troubledskies.net>
Date: Fri, 31 Jul 2026 02:02:54 +0200
Subject: [PATCH 10/24] Route dev-test through nextest to match the gate
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

`main` adopted cargo-nextest as the default runner in `#463`/`#473`,
splitting `make test` into a `test-nextest` pass and a separate
`doctest` pass. That left this branch stating, as a composition rule,
that nextest "is not used in this repository" — now false — and left
`make dev-test` on `cargo test` while the gate it stands in for had
moved to a runner with different process isolation.

Point `dev-test` at `cargo nextest run --all-targets --all-features`,
so the accelerated loop and the gate exercise the same runner under the
same `.config/nextest.toml`, including its `serial-env` group. The
acceleration is unaffected: `RUSTUP_TOOLCHAIN` and `cargo --config` are
Cargo-level rather than runner-level, so they compose with nextest
unchanged. Verified end to end — 1188 tests pass under Cranelift and
mold.

Use `NEXTEST_BUILD_JOBS` rather than `BUILD_JOBS`, for the reason main
records when it introduced the split: nextest reserves `-j` for test
concurrency, so a Cargo-shaped `-j` would silently become a thread
count.

`dev-test` deliberately omits the doctest pass, `cargo test --doc`
being a separate and comparatively quick runner. The guide says so
rather than leaving the omission to be discovered, and continues to
direct developers at `make test` before proposing a change.

Update the Make-target test to assert the new command line, so the
contract stays checked rather than assumed.
---
 Makefile                            |  4 +-
 docs/developers-guide.md            | 57 ++++++++++++++++-------------
 tests/dev_fast_make_target_tests.rs |  7 +++-
 3 files changed, 40 insertions(+), 28 deletions(-)

diff --git a/Makefile b/Makefile
index e112ac281..eab5e4170 100644
--- a/Makefile
+++ b/Makefile
@@ -178,8 +178,8 @@ dev-fast-check: ## Check the mold and Cranelift local build prerequisites
 dev-build: dev-fast-check ## Build the debug binary with Cranelift and mold
 	$(DEV_FAST_PATH) RUSTUP_TOOLCHAIN=$(DEV_FAST_TOOLCHAIN) $(CARGO) --config '$(DEV_FAST_CONFIG)' build $(BUILD_JOBS) --bin $(APP)
 
-dev-test: dev-fast-check ## Run the test suite with Cranelift and mold
-	$(DEV_FAST_PATH) RUSTUP_TOOLCHAIN=$(DEV_FAST_TOOLCHAIN) $(CARGO) --config '$(DEV_FAST_CONFIG)' test --all-targets --all-features $(BUILD_JOBS)
+dev-test: dev-fast-check ## Run the nextest pass with Cranelift and mold
+	$(DEV_FAST_PATH) RUSTUP_TOOLCHAIN=$(DEV_FAST_TOOLCHAIN) $(CARGO) --config '$(DEV_FAST_CONFIG)' nextest run --all-targets --all-features $(NEXTEST_BUILD_JOBS)
 
 bench-build: dev-fast-check ## Time clean and incremental debug builds for both paths
 	@$(DEV_FAST_ENV) CARGO='$(CARGO)' scripts/bench-build.sh
diff --git a/docs/developers-guide.md b/docs/developers-guide.md
index 2f8301b25..45b3bee3f 100644
--- a/docs/developers-guide.md
+++ b/docs/developers-guide.md
@@ -111,8 +111,8 @@ or the README — also run:
 - `make nixie`
 
 `make test` runs the non-doctest suite through
-[cargo-nextest](https://nexte.st/) and then runs the doctests separately.
-CI pins the runner version in `NEXTEST_VERSION` in `.github/workflows/ci.yml`.
+[cargo-nextest](https://nexte.st/) and then runs the doctests separately. CI
+pins the runner version in `NEXTEST_VERSION` in `.github/workflows/ci.yml`.
 Install that same version locally so local runs match CI; read the pin from the
 workflow rather than copying the number, so the two cannot drift:
 
@@ -387,7 +387,7 @@ The canonical commands are:
 make install-dev-fast   # install the pinned mold release and Cranelift backend
 make dev-fast-check     # verify the prerequisites are present
 make dev-build          # debug binary via Cranelift and mold
-make dev-test           # full test suite via Cranelift and mold
+make dev-test           # the nextest pass via Cranelift and mold
 ```
 
 `make dev-build` and `make dev-test` both depend on `make dev-fast-check`, so a
@@ -485,8 +485,8 @@ flag, `codegen-backend = "cranelift"` on the `dev` profile, and a
   `make all`, mirroring the Kani boundary described below. Run the ordinary
   gates before proposing a change; `make dev-test` is a faster inner-loop
   proxy, not a substitute.
-- **`RUSTFLAGS`.** `make test` and `make typecheck` set
-  `RUSTFLAGS="-D warnings"`. An externally set `RUSTFLAGS` overrides the
+- **`RUSTFLAGS`.** `make test-nextest`, `make doctest`, and `make typecheck`
+  set `RUSTFLAGS="-D warnings"`. An externally set `RUSTFLAGS` overrides the
   `[target.*]` `rustflags` in a Cargo configuration file, so the `dev-*`
   targets deliberately do not set it. Exporting `RUSTFLAGS` in the shell
   silently disables `mold` for these targets.
@@ -505,10 +505,17 @@ flag, `codegen-backend = "cranelift"` on the `dev` profile, and a
   `tools/cranelift/VERSION` and must not be conflated with it; verification
   must run on Kani's own toolchain and the LLVM backend. The same applies to
   Verus.
-- **Test runner.** Tests currently run through `cargo test`; `cargo-nextest` is
-  not used in this repository. If it is adopted later, the same
-  `RUSTUP_TOOLCHAIN` and `--config` overrides apply unchanged, because both are
-  Cargo-level rather than runner-level concerns.
+- **Test runner.** `make dev-test` is the accelerated counterpart of
+  `make test-nextest`, not of `make test`: it runs the same
+  `cargo nextest run --all-targets --all-features`, and so is governed by the
+  same [`.config/nextest.toml`](#nextest-configuration), including the
+  `serial-env` group. It omits the `doctest` pass, because `cargo test --doc`
+  is a separate and comparatively quick runner; run `make test` before
+  proposing a change. The acceleration is applied through `RUSTUP_TOOLCHAIN` and
+  `cargo --config`, both Cargo-level rather than runner-level, which is why
+  they compose with nextest unchanged. Note the target uses
+  `NEXTEST_BUILD_JOBS`, not `BUILD_JOBS`: nextest reserves `-j` for test
+  concurrency, so a Cargo-shaped `-j` would silently become a thread count.
 - **rust-analyzer.** No rust-analyzer configuration is committed, so the
   language server uses the stable toolchain and default backend. Opting
   rust-analyzer into Cranelift is a personal, machine-local choice; it needs a
@@ -759,10 +766,10 @@ home plus Kani support-file home.
 If either pass fails, `make test` fails. Run the individual targets when
 iterating, but treat `make test` as the gate.
 
-Cargo spells build parallelism `-j`; nextest reserves `-j` for test
-concurrency and spells build parallelism `--build-jobs`. The Makefile
-therefore keeps `BUILD_JOBS` (Cargo flags) and `NEXTEST_BUILD_JOBS` (nextest
-flags) as separate variables rather than reinterpreting one as the other.
+Cargo spells build parallelism `-j`; nextest reserves `-j` for test concurrency
+and spells build parallelism `--build-jobs`. The Makefile therefore keeps
+`BUILD_JOBS` (Cargo flags) and `NEXTEST_BUILD_JOBS` (nextest flags) as separate
+variables rather than reinterpreting one as the other.
 
 ### nextest configuration
 
@@ -782,12 +789,12 @@ governs the non-doctest pass only, and deliberately stays small:
 
 ### How this relates to `#[serial]` and the isolation utilities
 
-nextest runs each test in its own process, so environment and
-working-directory mutations cannot leak between tests the way they can under
-the threaded in-process harness. The `EnvLock`, `EnvVarGuard`, and `CwdGuard`
-utilities described in [Test isolation utilities](#test-isolation-utilities),
-and the `#[serial]` markers on the tests in the three binaries above, remain
-necessary because the coverage workflow still drives an in-process runner.
+nextest runs each test in its own process, so environment and working-directory
+mutations cannot leak between tests the way they can under the threaded
+in-process harness. The `EnvLock`, `EnvVarGuard`, and `CwdGuard` utilities
+described in [Test isolation utilities](#test-isolation-utilities), and the
+`#[serial]` markers on the tests in the three binaries above, remain necessary
+because the coverage workflow still drives an in-process runner.
 
 The `serial-env` group is therefore not load-bearing for the tests that exist
 today; it states the serialization contract once so both runners agree, and so
@@ -1373,8 +1380,8 @@ Configuration merge helpers:
 ### Environment lookup seams
 
 `EnvProvider` is the port for raw environment access during early CLI
-configuration resolution. The production `StdEnvProvider` adapter delegates
-to `std::env::var_os`; tests can inject map-backed providers without mutating
+configuration resolution. The production `StdEnvProvider` adapter delegates to
+`std::env::var_os`; tests can inject map-backed providers without mutating
 process-global state.
 
 ```rust
@@ -1413,8 +1420,8 @@ bare `EnvProvider` name.
 
 Discovery tests that exercise OrthoConfig's `ConfigDiscovery` may still need
 `EnvLock` because the external discovery implementation reads platform
-environment variables directly. Tests for Netsuke's own environment port
-should avoid `EnvLock`.
+environment variables directly. Tests for Netsuke's own environment port should
+avoid `EnvLock`.
 
 Unit tests that only need to verify explicit config path precedence should test
 `explicit_config_path_with_env` with an injected provider instead of mutating
@@ -1439,8 +1446,8 @@ Early JSON resolution reads only the boolean `json` field from each
 configuration layer. File layers are applied in merge order, followed by
 `NETSUKE_JSON`; an explicit root `--json` flag has the highest precedence.
 Selected file-load errors and malformed `NETSUKE_JSON` values are returned to
-the caller. Accepted environment values are `true`, `false`, `1`, and `0`.
-An explicit root `--json` flag bypasses environment parsing.
+the caller. Accepted environment values are `true`, `false`, `1`, and `0`. An
+explicit root `--json` flag bypasses environment parsing.
 
 ### Configuration discovery module layout
 
diff --git a/tests/dev_fast_make_target_tests.rs b/tests/dev_fast_make_target_tests.rs
index 6ff0bb119..c36658a08 100644
--- a/tests/dev_fast_make_target_tests.rs
+++ b/tests/dev_fast_make_target_tests.rs
@@ -68,7 +68,12 @@ struct BuildTarget {
 #[rstest]
 #[case::dev_build(BuildTarget { name: "dev-build", subcommand: &["build", "--bin", "netsuke"] })]
 #[case::dev_test(
-    BuildTarget { name: "dev-test", subcommand: &["test", "--all-targets", "--all-features"] }
+    BuildTarget {
+        name: "dev-test",
+        // Mirrors `make test-nextest`, so the accelerated loop and the gate run
+        // the same runner under the same `.config/nextest.toml`.
+        subcommand: &["nextest", "run", "--all-targets", "--all-features"],
+    }
 )]
 fn build_targets_select_the_pinned_toolchain_and_fragment(
     #[case] target: BuildTarget,

From 9b10ed79eb1be546eaa33f85ed1c1c0f507039e2 Mon Sep 17 00:00:00 2001
From: leynos <leynos@troubledskies.net>
Date: Fri, 31 Jul 2026 02:21:55 +0200
Subject: [PATCH 11/24] Default the dev-fast pin paths from the script location
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The three pin-file variables were mandatory, so the entry points ran
only when a caller supplied every path — in practice, only through the
`make dev-*` recipes. Derive the repository root from `BASH_SOURCE[0]`
instead and default each pin to its committed location, so a direct
`scripts/dev-fast-check.sh` works from any working directory. An
explicit override still wins, and `read_pin` still validates whichever
path is selected, so a missing or empty file reports the same
actionable `dev-fast:` diagnostic either way.

Writing the tests for that surfaced a real defect. `fail` ends with
`exit 1`, but `check_mold "$(mold_version)"` invokes it inside a command
substitution, where the exit kills only the subshell. An unreadable pin
therefore printed its diagnostic and then continued with an empty
version: the check reported a nonsensical `pin is ` drift and exited
zero, and the installer would have built a download URL around the empty
string. Both entry points now resolve pins into variables first, where
the assignment propagates the status.

Strengthen the benchmark coverage, which previously asserted only the
table shape and the total number of cargo calls. `RecordingCargo` now
records each invocation's target directory, whether that directory
already existed, and the touch file's timestamp. The test asserts, per
variant, the build subcommand, the presence or absence of the Cranelift
fragment and pinned toolchain, a private target directory reused across
both passes, and an Absent-then-Present cycle proving a genuine
clean-then-incremental pair.

Two details make those assertions load-bearing rather than decorative.
The test seeds stale target directories first, because on a fresh
sandbox the benchmark's `rm -rf` is indistinguishable from doing
nothing. And the touch is measured against a backdated baseline rather
than by comparing passes to each other, so the assertion does not depend
on filesystem timestamp granularity. Six mutations of `bench-build.sh` —
sharing a target directory, dropping the wipe, dropping the touch,
dropping the fragment, dropping the toolchain, and building a different
target — each now fail the test; before this change, two of them passed.

`Sandbox` gains `write_file` so the test crates stage fixtures without
reaching for `std::fs` themselves, keeping the ambient access inside the
support crate rather than widening the Whitaker exclusion list.
---
 docs/developers-guide.md               |  21 +++-
 scripts/dev-fast-check.sh              |  12 +-
 scripts/dev-fast-common.sh             |  17 ++-
 scripts/install-dev-fast.sh            |  11 +-
 test_support/src/dev_fast/cargo_log.rs |  69 +++++++++++
 test_support/src/dev_fast/mod.rs       |   4 +-
 test_support/src/dev_fast/sandbox.rs   |  52 +++++++-
 tests/dev_fast_check_tests.rs          | 109 ++++++++++++++++-
 tests/dev_fast_install_tests.rs        |  74 ++++++++++-
 tests/dev_fast_make_target_tests.rs    | 163 ++++++++++++++++++++++++-
 10 files changed, 509 insertions(+), 23 deletions(-)

diff --git a/docs/developers-guide.md b/docs/developers-guide.md
index 45b3bee3f..78becd3d0 100644
--- a/docs/developers-guide.md
+++ b/docs/developers-guide.md
@@ -399,6 +399,15 @@ surfacing as an opaque codegen-backend or linker error.
 Three pins keep the backend, linker, and toolchain in lockstep. Change them
 together, never individually.
 
+The scripts locate these files relative to their own path, so `make dev-*`, a
+direct `scripts/dev-fast-check.sh`, and a run from any working directory all
+resolve the same committed pins. Setting `MOLD_VERSION_FILE`,
+`MOLD_SHA256SUMS_FILE`, or `CRANELIFT_TOOLCHAIN_FILE` overrides the
+corresponding default; the tests use that to point the scripts at fixtures.
+Either way a missing or empty file is reported as
+`dev-fast: missing version pin: <path>` rather than silently becoming an empty
+version.
+
 - `tools/cranelift/VERSION` holds the nightly toolchain date, formatted
   `nightly-YYYY-MM-DD`. The `rustc-codegen-cranelift-preview` component is
   installed for exactly that toolchain, and `make dev-*` selects it with
@@ -578,7 +587,17 @@ The fixtures live in `test_support::dev_fast`:
   caller threads a version string around.
 - `RecordingCargo` is a fake `cargo` that logs the arguments,
   `RUSTUP_TOOLCHAIN`, and `PATH` of every invocation, turning a recipe's
-  command line into a checkable fact.
+  command line into a checkable fact. It also records the target directory and
+  whether that directory already existed, which makes a benchmark's
+  clean-then-incremental cycle observable: the clean pass sees
+  `TargetState::Absent` because the harness wiped the directory, and the
+  incremental pass that follows sees `Present`. Seed a stale target directory
+  before asserting on that, or the wipe is indistinguishable from doing
+  nothing. It records the benchmark touch file's timestamp too, compared
+  against a backdated baseline rather than between passes so the assertion does
+  not depend on filesystem timestamp granularity.
+- `PinOverrides` selects whether a script run supplies the pin-file variables.
+  `Omitted` is how a test proves the scripts fall back to the committed pins.
 - `MakeInvocation` describes a Make run. Variable overrides and environment
   entries are kept apart deliberately: a command-line variable outranks a `?=`
   default, whereas an environment entry is the only channel for a setting a
diff --git a/scripts/dev-fast-check.sh b/scripts/dev-fast-check.sh
index 28324b83b..02734e69a 100755
--- a/scripts/dev-fast-check.sh
+++ b/scripts/dev-fast-check.sh
@@ -69,9 +69,15 @@ check_cranelift() {
 # Run both checks unconditionally so a developer sees every missing piece in one
 # pass rather than fixing them one failed run at a time.
 main() {
-  local status=0
-  check_mold "$(mold_version)" || status=1
-  check_cranelift "$(cranelift_toolchain)" || status=1
+  local status=0 mold_pin toolchain_pin
+  # Resolve the pins into variables first. `fail` exits, but inside a command
+  # substitution that exit kills only the subshell, so passing `$(mold_version)`
+  # straight into a check would continue with an empty pin and report a
+  # nonsensical drift. An assignment propagates the status, so this stops.
+  mold_pin=$(mold_version) || return 1
+  toolchain_pin=$(cranelift_toolchain) || return 1
+  check_mold "$mold_pin" || status=1
+  check_cranelift "$toolchain_pin" || status=1
   [ "$status" -eq 0 ] || note 'capability check failed; see the messages above'
   return "$status"
 }
diff --git a/scripts/dev-fast-common.sh b/scripts/dev-fast-common.sh
index 87054ef3a..1b808f3eb 100644
--- a/scripts/dev-fast-common.sh
+++ b/scripts/dev-fast-common.sh
@@ -8,9 +8,20 @@
 
 set -euo pipefail
 
-: "${MOLD_VERSION_FILE:?MOLD_VERSION_FILE must be set}"
-: "${MOLD_SHA256SUMS_FILE:?MOLD_SHA256SUMS_FILE must be set}"
-: "${CRANELIFT_TOOLCHAIN_FILE:?CRANELIFT_TOOLCHAIN_FILE must be set}"
+# Locate the repository from this file rather than from the working directory,
+# so the entry points run correctly when invoked directly and not only through
+# the `make dev-*` recipes that used to supply every pin path. `BASH_SOURCE[0]`
+# is this file even when sourced, which is what makes the derivation reliable.
+DEV_FAST_HELPER_DIR=$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)
+DEV_FAST_REPO_ROOT=$(cd -- "$DEV_FAST_HELPER_DIR/.." && pwd)
+
+# Pin files default to their committed locations. An explicit override still
+# wins, which is what lets the tests point the scripts at fixtures. `read_pin`
+# validates whichever path is selected, so a missing or empty file is reported
+# the same way whether it came from a default or an override.
+MOLD_VERSION_FILE="${MOLD_VERSION_FILE:-$DEV_FAST_REPO_ROOT/tools/mold/VERSION}"
+MOLD_SHA256SUMS_FILE="${MOLD_SHA256SUMS_FILE:-$DEV_FAST_REPO_ROOT/tools/mold/SHA256SUMS}"
+CRANELIFT_TOOLCHAIN_FILE="${CRANELIFT_TOOLCHAIN_FILE:-$DEV_FAST_REPO_ROOT/tools/cranelift/VERSION}"
 
 # Prefix for the mold installation tree. The `dev-*` recipes prepend this
 # prefix's `bin/` to PATH -- this exact prefix, not a hard-coded ~/.local -- so
diff --git a/scripts/install-dev-fast.sh b/scripts/install-dev-fast.sh
index 9e8300b9b..d3beb422a 100755
--- a/scripts/install-dev-fast.sh
+++ b/scripts/install-dev-fast.sh
@@ -75,8 +75,15 @@ install_cranelift() {
 # Install both halves. The linker step runs first so a checksum failure aborts
 # before spending time on a toolchain download.
 main() {
-  install_mold "$(mold_version)"
-  install_cranelift "$(cranelift_toolchain)"
+  local mold_pin toolchain_pin
+  # Resolve the pins into variables first: `fail` exits, but inside a command
+  # substitution that exit kills only the subshell, so an unreadable pin would
+  # otherwise reach the installer as an empty string and be built into a
+  # download URL.
+  mold_pin=$(mold_version) || return 1
+  toolchain_pin=$(cranelift_toolchain) || return 1
+  install_mold "$mold_pin"
+  install_cranelift "$toolchain_pin"
   note 'ready; verify with: make dev-fast-check'
 }
 
diff --git a/test_support/src/dev_fast/cargo_log.rs b/test_support/src/dev_fast/cargo_log.rs
index 2c9bae7cf..c15bd7e11 100644
--- a/test_support/src/dev_fast/cargo_log.rs
+++ b/test_support/src/dev_fast/cargo_log.rs
@@ -23,15 +23,37 @@ pub struct RecordingCargo {
 
 impl RecordingCargo {
     /// Install the fake into the sandbox's `bin`, logging under its `HOME`.
+    ///
+    /// The fake reports whether its target directory already existed and then
+    /// creates it. That makes a benchmark's clean-then-incremental cycle
+    /// directly observable: the clean pass sees `absent`, because the harness
+    /// removed the directory, and the incremental pass that follows sees
+    /// `present`.
     pub fn install(sandbox: &Sandbox) -> Result<Self> {
         let log = sandbox.home().join("cargo-invocations.log");
         let body = format!(
             concat!(
+                "target_dir=\"${{CARGO_TARGET_DIR:-}}\"\n",
+                "if [ -n \"$target_dir\" ] && [ -d \"$target_dir\" ]; then\n",
+                "  target_state=present\n",
+                "else\n",
+                "  target_state=absent\n",
+                "fi\n",
+                "[ -z \"$target_dir\" ] || mkdir -p \"$target_dir\"\n",
+                "touch_file=\"${{BENCH_TOUCH_FILE:-}}\"\n",
+                "if [ -n \"$touch_file\" ] && [ -e \"$touch_file\" ]; then\n",
+                "  touch_mtime=$(stat -c %Y \"$touch_file\")\n",
+                "else\n",
+                "  touch_mtime=\n",
+                "fi\n",
                 "{{\n",
                 "  echo '{separator}'\n",
                 "  printf 'arguments\\t%s\\n' \"$*\"\n",
                 "  printf 'toolchain\\t%s\\n' \"${{RUSTUP_TOOLCHAIN:-}}\"\n",
                 "  printf 'path\\t%s\\n' \"${{PATH:-}}\"\n",
+                "  printf 'target_dir\\t%s\\n' \"$target_dir\"\n",
+                "  printf 'target_state\\t%s\\n' \"$target_state\"\n",
+                "  printf 'touch_mtime\\t%s\\n' \"$touch_mtime\"\n",
                 "}} >> '{log}'\n",
                 "exit 0"
             ),
@@ -74,11 +96,25 @@ impl RecordingCargo {
     }
 }
 
+/// Whether the invocation's target directory existed when it started.
+#[derive(Copy, Clone, Debug, PartialEq, Eq)]
+pub enum TargetState {
+    /// A clean build: the harness had removed the directory.
+    Absent,
+    /// An incremental build: a previous pass left the directory behind.
+    Present,
+    /// No `CARGO_TARGET_DIR` was set, so the question does not arise.
+    Unset,
+}
+
 /// One recorded `cargo` call.
 pub struct CargoInvocation {
     arguments: Vec<String>,
     toolchain: String,
     path: String,
+    target_dir: String,
+    target_state: TargetState,
+    touch_mtime: Option<i64>,
 }
 
 impl CargoInvocation {
@@ -87,6 +123,9 @@ impl CargoInvocation {
             arguments: Vec::new(),
             toolchain: String::new(),
             path: String::new(),
+            target_dir: String::new(),
+            target_state: TargetState::Unset,
+            touch_mtime: None,
         };
         for line in record.lines() {
             let Some((field, value)) = line.split_once('\t') else {
@@ -98,9 +137,21 @@ impl CargoInvocation {
                 }
                 "toolchain" => invocation.toolchain = value.to_owned(),
                 "path" => invocation.path = value.to_owned(),
+                "target_dir" => invocation.target_dir = value.to_owned(),
+                "target_state" => {
+                    invocation.target_state = match value {
+                        "present" => TargetState::Present,
+                        "absent" => TargetState::Absent,
+                        _ => TargetState::Unset,
+                    };
+                }
+                "touch_mtime" => invocation.touch_mtime = value.parse().ok(),
                 _ => {}
             }
         }
+        if invocation.target_dir.is_empty() {
+            invocation.target_state = TargetState::Unset;
+        }
         invocation
     }
 
@@ -141,4 +192,22 @@ impl CargoInvocation {
     pub fn path(&self) -> &str {
         &self.path
     }
+
+    /// The `CARGO_TARGET_DIR` the invocation was given, empty when unset.
+    pub fn target_dir(&self) -> &str {
+        &self.target_dir
+    }
+
+    /// Whether the target directory existed when the invocation started.
+    pub fn target_state(&self) -> TargetState {
+        self.target_state
+    }
+
+    /// The benchmark touch file's modification time, when one was configured.
+    /// A benchmark touches that file between a variant's two passes, so the
+    /// value distinguishes the pass that ran before the touch from the one
+    /// after it.
+    pub fn touch_mtime(&self) -> Option<i64> {
+        self.touch_mtime
+    }
 }
diff --git a/test_support/src/dev_fast/mod.rs b/test_support/src/dev_fast/mod.rs
index 662a2e0a8..0eef6bb4b 100644
--- a/test_support/src/dev_fast/mod.rs
+++ b/test_support/src/dev_fast/mod.rs
@@ -27,7 +27,7 @@ mod make;
 mod release;
 mod sandbox;
 
-pub use cargo_log::{CargoInvocation, RecordingCargo};
+pub use cargo_log::{CargoInvocation, RecordingCargo, TargetState};
 pub use make::MakeInvocation;
 pub use release::FakeRelease;
-pub use sandbox::{Sandbox, combined, pinned_mold_version, pinned_toolchain};
+pub use sandbox::{PinOverrides, Sandbox, combined, pinned_mold_version, pinned_toolchain};
diff --git a/test_support/src/dev_fast/sandbox.rs b/test_support/src/dev_fast/sandbox.rs
index f7f90d2e8..3b8f08e9f 100644
--- a/test_support/src/dev_fast/sandbox.rs
+++ b/test_support/src/dev_fast/sandbox.rs
@@ -34,12 +34,25 @@ const SANDBOX_UTILITIES: &[&str] = &[
     "sed",
     "sh",
     "sha256sum",
+    "stat",
     "tar",
     "touch",
     "tr",
     "uname",
 ];
 
+/// Whether a script run supplies the pin-file environment overrides.
+///
+/// A closed choice rather than a bare `bool`, so a call site reads as the
+/// scenario it is describing.
+#[derive(Copy, Clone, Debug)]
+pub enum PinOverrides {
+    /// Point the script at the pin files explicitly, as the Makefile does.
+    Supplied,
+    /// Leave the variables unset, exercising the committed defaults.
+    Omitted,
+}
+
 /// A `PATH` and `HOME` containing only what a test explicitly puts there.
 pub struct Sandbox {
     temp: TempDir,
@@ -104,6 +117,18 @@ impl Sandbox {
         Utf8PathBuf::try_from(path).context("fake executable path must be UTF-8")
     }
 
+    /// Write a fixture file, creating its parent directory.
+    ///
+    /// Offered here so test crates can stage fixtures without reaching for
+    /// `std::fs` themselves, keeping the ambient filesystem access inside this
+    /// already-sanctioned support crate.
+    pub fn write_file(&self, path: &Utf8Path, contents: &str) -> Result<()> {
+        if let Some(parent) = path.parent() {
+            fs::create_dir_all(parent.as_std_path()).with_context(|| format!("create {parent}"))?;
+        }
+        fs::write(path.as_std_path(), contents).with_context(|| format!("write {path}"))
+    }
+
     /// A `mold` reporting the given version, formatted as the real one does.
     pub fn write_mold(&self, dir: &Utf8Path, version: &str) -> Result<Utf8PathBuf> {
         self.write_fake(
@@ -149,14 +174,31 @@ impl Sandbox {
     /// environment plus the given overrides. Use where a test must vary inputs
     /// the Makefile does not expose as variables.
     pub fn script(&self, name: &str, env: &[(&str, String)]) -> Result<Output> {
+        self.script_with(name, PinOverrides::Supplied, env)
+    }
+
+    /// As [`script`](Self::script), but choosing whether the pin-file
+    /// environment variables are supplied at all.
+    ///
+    /// Omitting them is how a test proves the scripts fall back to the
+    /// committed pins rather than depending on the caller to pass every path.
+    pub fn script_with(
+        &self,
+        name: &str,
+        pins: PinOverrides,
+        env: &[(&str, String)],
+    ) -> Result<Output> {
         let mut command = self.base_command(&self.bin().join("bash"));
         command
             .env("DEV_FAST_PREFIX", self.prefix().as_std_path())
-            .env("MOLD_VERSION_FILE", "tools/mold/VERSION")
-            .env("MOLD_SHA256SUMS_FILE", "tools/mold/SHA256SUMS")
-            .env("CRANELIFT_TOOLCHAIN_FILE", "tools/cranelift/VERSION")
-            .env("DEV_FAST_CONFIG", "tools/dev-fast/config.toml")
-            .arg(format!("scripts/{name}"));
+            .env("DEV_FAST_CONFIG", "tools/dev-fast/config.toml");
+        if matches!(pins, PinOverrides::Supplied) {
+            command
+                .env("MOLD_VERSION_FILE", "tools/mold/VERSION")
+                .env("MOLD_SHA256SUMS_FILE", "tools/mold/SHA256SUMS")
+                .env("CRANELIFT_TOOLCHAIN_FILE", "tools/cranelift/VERSION");
+        }
+        command.arg(format!("scripts/{name}"));
         for (key, value) in env {
             command.env(key, value);
         }
diff --git a/tests/dev_fast_check_tests.rs b/tests/dev_fast_check_tests.rs
index 10466feee..7ddf714d7 100644
--- a/tests/dev_fast_check_tests.rs
+++ b/tests/dev_fast_check_tests.rs
@@ -10,7 +10,9 @@
 
 use anyhow::{Result, ensure};
 use rstest::rstest;
-use test_support::dev_fast::{Sandbox, combined, pinned_mold_version, pinned_toolchain};
+use test_support::dev_fast::{
+    PinOverrides, Sandbox, combined, pinned_mold_version, pinned_toolchain,
+};
 
 /// A sandbox with everything present and matching the pins.
 fn healthy_sandbox() -> Result<Sandbox> {
@@ -38,6 +40,111 @@ fn reports_resolved_path_and_version_when_prerequisites_are_met() -> Result<()>
     Ok(())
 }
 
+/// Run without the pin-file variables, the check must still find the committed
+/// pins by locating the repository from the script's own path.
+#[test]
+fn falls_back_to_the_committed_pins_when_no_overrides_are_given() -> Result<()> {
+    let sandbox = Sandbox::new()?;
+    // Both fakes report exactly what the committed pins name, so the check can
+    // only pass if it read those files rather than defaulting to nothing. The
+    // mold goes on the sandbox PATH directly: only the Make recipes prepend the
+    // install prefix, and this case invokes the script itself.
+    sandbox.write_mold(&sandbox.bin(), &pinned_mold_version()?)?;
+    sandbox.write_rustup(&pinned_toolchain()?, true)?;
+
+    let output = sandbox.script_with("dev-fast-check.sh", PinOverrides::Omitted, &[])?;
+    let text = combined(&output);
+
+    ensure!(
+        output.status.success(),
+        "check should pass on the committed pins, got `{text}`"
+    );
+    ensure!(
+        text.contains(&format!("mold {}", pinned_mold_version()?)),
+        "should read tools/mold/VERSION by default, got `{text}`"
+    );
+    ensure!(
+        text.contains(&pinned_toolchain()?),
+        "should read tools/cranelift/VERSION by default, got `{text}`"
+    );
+    Ok(())
+}
+
+/// A drift warning names the pinned version, so a mismatching fake proves which
+/// file the default resolved to rather than merely that some file was read.
+#[test]
+fn default_pins_are_the_committed_ones_not_an_empty_fallback() -> Result<()> {
+    let sandbox = Sandbox::new()?;
+    sandbox.write_mold(&sandbox.bin(), "99.0.0")?;
+    sandbox.write_rustup(&pinned_toolchain()?, true)?;
+
+    let output = sandbox.script_with("dev-fast-check.sh", PinOverrides::Omitted, &[])?;
+    let text = combined(&output);
+
+    ensure!(
+        output.status.success(),
+        "a drift is tolerated, got `{text}`"
+    );
+    ensure!(
+        text.contains(&format!("pin is {}", pinned_mold_version()?)),
+        "the drift message should name the committed pin, got `{text}`"
+    );
+    Ok(())
+}
+
+/// An override must still win over the default.
+#[test]
+fn an_explicit_pin_override_wins_over_the_committed_default() -> Result<()> {
+    let sandbox = Sandbox::new()?;
+    let toolchain_pin = sandbox.home().join("CRANELIFT_VERSION");
+    sandbox.write_file(&toolchain_pin, "nightly-1970-01-01\n")?;
+    sandbox.write_mold(&sandbox.bin(), &pinned_mold_version()?)?;
+    // rustup knows only the committed toolchain, so the run can fail only if
+    // the override displaced the default.
+    sandbox.write_rustup(&pinned_toolchain()?, true)?;
+
+    let output = sandbox.script_with(
+        "dev-fast-check.sh",
+        PinOverrides::Omitted,
+        &[("CRANELIFT_TOOLCHAIN_FILE", toolchain_pin.to_string())],
+    )?;
+    let text = combined(&output);
+
+    ensure!(
+        !output.status.success(),
+        "the overridden toolchain is not installed, so the check should fail: `{text}`"
+    );
+    ensure!(
+        text.contains("nightly-1970-01-01"),
+        "the override should be the toolchain reported, got `{text}`"
+    );
+    Ok(())
+}
+
+/// A pin path that does not exist must produce the ordinary actionable
+/// diagnostic, whether it arrived as a default or as an override.
+#[test]
+fn a_missing_pin_file_reports_the_actionable_diagnostic() -> Result<()> {
+    let sandbox = Sandbox::new()?;
+    sandbox.write_mold(&sandbox.bin(), &pinned_mold_version()?)?;
+    sandbox.write_rustup(&pinned_toolchain()?, true)?;
+    let missing = sandbox.home().join("absent/MOLD_VERSION");
+
+    let output = sandbox.script_with(
+        "dev-fast-check.sh",
+        PinOverrides::Omitted,
+        &[("MOLD_VERSION_FILE", missing.to_string())],
+    )?;
+    let text = combined(&output);
+
+    ensure!(!output.status.success(), "should fail, got `{text}`");
+    ensure!(
+        text.contains("missing version pin") && text.contains(missing.as_str()),
+        "should name the missing pin file, got `{text}`"
+    );
+    Ok(())
+}
+
 /// The regression this guards: the Makefile unconditionally exports
 /// `$(HOME)/.local/bin` ahead of the caller's `PATH`, so an overridden
 /// `DEV_FAST_PREFIX` used to be installed to but never selected.
diff --git a/tests/dev_fast_install_tests.rs b/tests/dev_fast_install_tests.rs
index ac02b39ea..afaaf14d6 100644
--- a/tests/dev_fast_install_tests.rs
+++ b/tests/dev_fast_install_tests.rs
@@ -14,7 +14,7 @@ use camino::Utf8PathBuf;
 use rstest::rstest;
 use std::fs;
 use test_support::dev_fast::{
-    FakeRelease, Sandbox, combined, pinned_mold_version, pinned_toolchain,
+    FakeRelease, PinOverrides, Sandbox, combined, pinned_mold_version, pinned_toolchain,
 };
 
 /// The version the fake release is published as. Deliberately not a real mold
@@ -176,6 +176,78 @@ fn refuses_to_install_an_unverifiable_artefact(#[case] failure: ChecksumFailure)
     Ok(())
 }
 
+/// Run without the pin-file variables, the installer must resolve the committed
+/// pins from the script's own location.
+///
+/// It is pointed at a locally published artefact named for the *committed*
+/// version, whose digest cannot match the committed checksum. The refusal
+/// therefore proves both defaults were read — the version pin supplied the
+/// artefact name, and the checksum file supplied the digest it was measured
+/// against — while keeping the case hermetic.
+#[test]
+fn falls_back_to_the_committed_pins_when_no_overrides_are_given() -> Result<()> {
+    let sandbox = Sandbox::new()?;
+    sandbox.write_rustup(&pinned_toolchain()?, true)?;
+    let committed_version = pinned_mold_version()?;
+    let release = FakeRelease::publish(&sandbox, &committed_version)?;
+
+    let output = sandbox.script_with(
+        "install-dev-fast.sh",
+        PinOverrides::Omitted,
+        &[("MOLD_RELEASE_BASE_URL", release.base_url())],
+    )?;
+    let text = combined(&output);
+
+    ensure!(
+        !output.status.success(),
+        "a stand-in artefact cannot match the committed digest, got `{text}`"
+    );
+    ensure!(
+        text.contains(&format!("mold-{committed_version}-")),
+        "the committed version pin should name the artefact, got `{text}`"
+    );
+    ensure!(
+        text.contains("checksum mismatch"),
+        "the committed checksum file should reject it, got `{text}`"
+    );
+    ensure!(
+        !sandbox.prefix().join("bin/mold").as_std_path().exists(),
+        "nothing should be unpacked when verification fails"
+    );
+    Ok(())
+}
+
+/// An unreadable pin must abort rather than reaching the download as an empty
+/// string. `fail` exits, but from inside a command substitution that exit ends
+/// only the subshell, so the status has to be propagated explicitly.
+#[test]
+fn an_unreadable_pin_aborts_before_any_download() -> Result<()> {
+    let sandbox = Sandbox::new()?;
+    let missing = sandbox.home().join("absent/MOLD_VERSION");
+
+    let output = sandbox.script_with(
+        "install-dev-fast.sh",
+        PinOverrides::Omitted,
+        &[
+            ("MOLD_VERSION_FILE", missing.to_string()),
+            // A URL that would fail loudly if the installer ever reached it.
+            ("MOLD_RELEASE_BASE_URL", "file:///nonexistent".to_owned()),
+        ],
+    )?;
+    let text = combined(&output);
+
+    ensure!(!output.status.success(), "should abort, got `{text}`");
+    ensure!(
+        text.contains("missing version pin"),
+        "should name the unreadable pin, got `{text}`"
+    );
+    ensure!(
+        !text.contains("downloading"),
+        "must not attempt a download with an empty version, got `{text}`"
+    );
+    Ok(())
+}
+
 /// A cell holding a one-decimal duration, as `bench-build` formats them.
 /// Timings are inherently unstable, so tests assert on shape, not value.
 fn is_timing(cell: &str) -> bool {
diff --git a/tests/dev_fast_make_target_tests.rs b/tests/dev_fast_make_target_tests.rs
index c36658a08..d22049b4c 100644
--- a/tests/dev_fast_make_target_tests.rs
+++ b/tests/dev_fast_make_target_tests.rs
@@ -11,11 +11,13 @@
 
 #![cfg(all(unix, target_os = "linux"))]
 
-use anyhow::{Result, ensure};
-use camino::Utf8PathBuf;
+use anyhow::{Context, Result, ensure};
+use camino::{Utf8Path, Utf8PathBuf};
 use rstest::rstest;
+use std::fs::File;
+use std::time::{Duration, UNIX_EPOCH};
 use test_support::dev_fast::{
-    CargoInvocation, FakeRelease, MakeInvocation, RecordingCargo, Sandbox, combined,
+    CargoInvocation, FakeRelease, MakeInvocation, RecordingCargo, Sandbox, TargetState, combined,
     pinned_mold_version, pinned_toolchain,
 };
 
@@ -152,6 +154,27 @@ fn install_target_forwards_the_prefix_pins_and_release_url() -> Result<()> {
     Ok(())
 }
 
+/// Timestamp stamped on the benchmark's touch file before the run, chosen far
+/// enough in the past that any `touch` is unambiguously newer. Comparing
+/// against a fixed baseline keeps the assertion deterministic, where comparing
+/// the two passes to each other would depend on filesystem timestamp
+/// granularity.
+const BASELINE_MTIME: i64 = 1_600_000_000;
+
+/// Target-directory slugs the benchmark uses, one per variant.
+const DEFAULT_SLUG: &str = "default";
+const DEV_FAST_SLUG: &str = "dev-fast";
+
+/// Create the touch file with [`BASELINE_MTIME`], returning that timestamp.
+fn write_with_old_mtime(path: &Utf8Path) -> Result<i64> {
+    let file = File::create(path.as_std_path())
+        .with_context(|| format!("create bench touch target {path}"))?;
+    let baseline = UNIX_EPOCH + Duration::from_secs(BASELINE_MTIME.unsigned_abs());
+    file.set_modified(baseline)
+        .with_context(|| format!("backdate {path}"))?;
+    Ok(BASELINE_MTIME)
+}
+
 #[test]
 fn bench_target_emits_both_variant_rows() -> Result<()> {
     let scenario = BuildScenario::prepare()?;
@@ -159,11 +182,20 @@ fn bench_target_emits_both_variant_rows() -> Result<()> {
     // Touch a disposable file rather than `src/main.rs`, so the benchmark does
     // not invalidate the working tree's build cache.
     let touch_file = sandbox.home().join("bench-touch");
-    std::fs::write(touch_file.as_std_path(), "").map_err(anyhow::Error::from)?;
+    let baseline_mtime = write_with_old_mtime(&touch_file)?;
+
+    // Seed both target directories, modelling a re-run. Without this the
+    // benchmark's `rm -rf` would be indistinguishable from doing nothing,
+    // because a fresh sandbox has no artefacts to remove.
+    let bench_root = sandbox.home().join("bench");
+    for slug in [DEFAULT_SLUG, DEV_FAST_SLUG] {
+        std::fs::create_dir_all(bench_root.join(slug).as_std_path())
+            .with_context(|| format!("seed stale {slug} target directory"))?;
+    }
 
     let invocation = MakeInvocation::new("bench-build")
         .variable("CARGO", scenario.cargo.executable())
-        .environment("BENCH_ROOT", sandbox.home().join("bench"))
+        .environment("BENCH_ROOT", &bench_root)
         .environment("BENCH_TOUCH_FILE", &touch_file);
     let output = sandbox.run_make(&invocation)?;
     let stdout = String::from_utf8_lossy(&output.stdout);
@@ -189,5 +221,126 @@ fn bench_target_emits_both_variant_rows() -> Result<()> {
         "should measure two builds per variant, recorded {}",
         invocations.len()
     );
+
+    // The benchmark measures the default variant first, then the accelerated
+    // one, each as a clean pass followed by an incremental pass.
+    let mut pairs = invocations.chunks_exact(2);
+    let default_pass = BenchVariant::from_pair(DEFAULT_SLUG, pairs.next(), false)?;
+    let dev_fast_pass = BenchVariant::from_pair(DEV_FAST_SLUG, pairs.next(), true)?;
+    for variant in [&default_pass, &dev_fast_pass] {
+        variant.check(&pinned_toolchain()?)?;
+    }
+
+    ensure!(
+        default_pass.target_dir() != dev_fast_pass.target_dir(),
+        "variants must not share a target directory, got `{}` and `{}`",
+        default_pass.target_dir(),
+        dev_fast_pass.target_dir()
+    );
+
+    // Only the very first pass runs before any touch; each variant touches the
+    // file between its own two passes, so every later pass must see a newer
+    // timestamp. Comparing against a backdated baseline rather than between
+    // passes keeps this free of filesystem timestamp granularity.
+    let first = invocations.first().context("expected a recorded pass")?;
+    ensure!(
+        first.touch_mtime() == Some(baseline_mtime),
+        "the first clean pass should precede any touch, got {:?}",
+        first.touch_mtime()
+    );
+    for (index, pass) in invocations.iter().enumerate().skip(1) {
+        ensure!(
+            pass.touch_mtime()
+                .is_some_and(|mtime| mtime > baseline_mtime),
+            "pass {index} should follow a touch, got {:?}",
+            pass.touch_mtime()
+        );
+    }
     Ok(())
 }
+
+/// One variant's pair of recorded builds: the clean pass then the incremental.
+struct BenchVariant<'a> {
+    label: &'a str,
+    clean: &'a CargoInvocation,
+    incremental: &'a CargoInvocation,
+    /// Whether this variant is the accelerated one, which alone carries the
+    /// Cranelift fragment and the pinned toolchain.
+    expects_fragment: bool,
+}
+
+impl<'a> BenchVariant<'a> {
+    /// Build a descriptor from the variant's recorded pair of passes.
+    fn from_pair(
+        label: &'a str,
+        pair: Option<&'a [CargoInvocation]>,
+        expects_fragment: bool,
+    ) -> Result<Self> {
+        let passes = pair.with_context(|| format!("no recorded passes for `{label}`"))?;
+        let clean = passes
+            .first()
+            .with_context(|| format!("no clean pass for `{label}`"))?;
+        let incremental = passes
+            .get(1)
+            .with_context(|| format!("no incremental pass for `{label}`"))?;
+        Ok(Self {
+            label,
+            clean,
+            incremental,
+            expects_fragment,
+        })
+    }
+
+    fn target_dir(&self) -> &str {
+        self.clean.target_dir()
+    }
+
+    fn check(&self, toolchain: &str) -> Result<()> {
+        let label = self.label;
+        for pass in [self.clean, self.incremental] {
+            ensure!(
+                pass.contains_sequence(&["build", "--bin", "netsuke"]),
+                "`{label}` should build the binary, got `{:?}`",
+                pass.arguments()
+            );
+            ensure!(
+                pass.contains_sequence(&["--config", DEV_FAST_CONFIG]) == self.expects_fragment,
+                "`{label}` fragment expectation ({}) not met, got `{:?}`",
+                self.expects_fragment,
+                pass.arguments()
+            );
+            let expected_toolchain = if self.expects_fragment { toolchain } else { "" };
+            ensure!(
+                pass.toolchain() == expected_toolchain,
+                "`{label}` should run under `{expected_toolchain}`, got `{}`",
+                pass.toolchain()
+            );
+        }
+
+        ensure!(
+            self.clean.target_dir() == self.incremental.target_dir(),
+            "`{label}` should reuse one target directory across its passes"
+        );
+        ensure!(
+            self.clean.target_dir().ends_with(label),
+            "`{label}` should measure in its own directory, got `{}`",
+            self.clean.target_dir()
+        );
+
+        // The harness removes the directory before the clean pass, and the
+        // clean pass leaves it behind, so this ordering is what distinguishes
+        // a genuine clean/incremental pair from two identical builds.
+        ensure!(
+            self.clean.target_state() == TargetState::Absent,
+            "`{label}` clean pass should start from an empty target directory, got {:?}",
+            self.clean.target_state()
+        );
+        ensure!(
+            self.incremental.target_state() == TargetState::Present,
+            "`{label}` incremental pass should reuse the clean pass's output, got {:?}",
+            self.incremental.target_state()
+        );
+
+        Ok(())
+    }
+}

From 34fee0e53782a13da8cb75c27b1c6532d49f77fc Mon Sep 17 00:00:00 2001
From: leynos <leynos@troubledskies.net>
Date: Sat, 1 Aug 2026 01:09:16 +0200
Subject: [PATCH 12/24] Address the dev-fast review round
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Fixes verified against current code; two findings were already stale.

- `bench-build.sh` no longer sends the benchmark command's stderr to
  `/dev/null`. Suppressing stdout is necessary — the caller captures it
  to read the timing — but discarding stderr meant a failing build
  reported only "benchmark command failed" and hid the diagnostic.
- `Sandbox` validates its temporary root as UTF-8 once during
  construction and stores it, so `root()` no longer panics via
  `.expect()`.
- `is_timing` now requires exactly one point with digits either side.
  The looser check accepted `.`, `..`, and `1.2.3`, none of which the
  benchmark can emit. Two proptest cases cover the shape.
- `CargoInvocation::parse` returns `Result` and requires every field the
  fake writes, rejecting an unrecognised `target_state` rather than
  silently reading it as "no target directory". `invocations()`
  distinguishes a log that was never created from a log that could not
  be read, so an I/O error can no longer masquerade as "cargo did not
  run" — which is exactly what one test concludes.
- `as_chunks::<2>()` replaces `chunks_exact(2)`, making the pairing a
  type-level fact and removing the absent-pass branch. Confirmed to
  compile on the pinned 1.89.0.

Close three coverage gaps the review named:

- A failed capability check now asserts *zero* recorded Cargo
  invocations. Previously the test relied on no Cargo existing in the
  sandbox, so it would have passed even had the recipe invoked one.
- The Cargo fragment's contents are parsed and asserted, not just its
  path: the unstable flag, Cranelift on the dev profile, mold behind the
  Linux `cfg`, and no backend on any other profile. A fragment that lost
  its contents previously still passed.
- `rustup` invocations are recorded, so the installer's toolchain and
  component commands are observed rather than inferred from its
  narration, and a refused artefact is shown never to reach them.

Routing the remaining fixture I/O through `Sandbox` lets both dev-fast
test crates leave the `no_std_fs_operations` exclusion list, narrowing
that surface rather than widening it.

Skipped: the property/proof warning's suggestion of proptest over the
shell scripts. Each case spawns processes, so a generated corpus would
be slow without covering more than the enumerated cases already do. The
pure function it did apply to, `is_timing`, is now property-tested.

Documentation: the guide introduced the config environment port by its
crate-internal name while the code block below used the public
re-export. It now states the relationship. That text is pre-existing on
main, not introduced here.
---
 docs/developers-guide.md               |  10 +-
 dylint.toml                            |   2 -
 scripts/bench-build.sh                 |   6 +-
 test_support/src/dev_fast/cargo_log.rs | 112 +++++++++++--------
 test_support/src/dev_fast/mod.rs       |   5 +-
 test_support/src/dev_fast/sandbox.rs   | 108 +++++++++++++++---
 tests/dev_fast_install_tests.rs        |  86 ++++++++++++++-
 tests/dev_fast_make_target_tests.rs    | 147 +++++++++++++++++++------
 8 files changed, 366 insertions(+), 110 deletions(-)

diff --git a/docs/developers-guide.md b/docs/developers-guide.md
index 78becd3d0..451316d1f 100644
--- a/docs/developers-guide.md
+++ b/docs/developers-guide.md
@@ -1398,10 +1398,12 @@ Configuration merge helpers:
 
 ### Environment lookup seams
 
-`EnvProvider` is the port for raw environment access during early CLI
-configuration resolution. The production `StdEnvProvider` adapter delegates to
-`std::env::var_os`; tests can inject map-backed providers without mutating
-process-global state.
+`cli::discovery::EnvProvider` is the port for raw environment access during
+early CLI configuration resolution; `src/cli/mod.rs` re-exports it as
+`ConfigEnvProvider` (and `StdEnvProvider` as `ConfigStdEnvProvider`), so
+external callers see only the `Config*` names below. The production
+`StdEnvProvider` adapter delegates to `std::env::var_os`; tests can inject
+map-backed providers without mutating process-global state.
 
 ```rust
 pub trait EnvProvider {
diff --git a/dylint.toml b/dylint.toml
index 8b4ea75d1..f0b565322 100644
--- a/dylint.toml
+++ b/dylint.toml
@@ -69,8 +69,6 @@ excluded_crates = [
     "test_support",
     "advanced_usage_tests",
     "assert_cmd_tests",
-    "dev_fast_install_tests",
-    "dev_fast_make_target_tests",
     "manifest_glob_tests",
     "ninja_snapshot_tests",
     "novice_flow_smoke_tests",
diff --git a/scripts/bench-build.sh b/scripts/bench-build.sh
index ecde2b70b..400c04722 100755
--- a/scripts/bench-build.sh
+++ b/scripts/bench-build.sh
@@ -33,7 +33,11 @@ results=()
 # the measurement sub-second without shelling out to an external timer.
 time_command() {
   local start=${EPOCHREALTIME/,/.} end
-  "$@" >/dev/null 2>&1 || fail "benchmark command failed: $*"
+  # Suppress stdout only. This function's stdout is captured by the caller, so
+  # build chatter would corrupt the measurement, but stderr must reach the
+  # terminal: without it a failing build reports only "benchmark command
+  # failed" and hides the compiler or linker diagnostic that explains why.
+  "$@" >/dev/null || fail "benchmark command failed: $*"
   end=${EPOCHREALTIME/,/.}
   LC_ALL=C awk -v start="$start" -v end="$end" 'BEGIN { printf "%.1f", end - start }'
 }
diff --git a/test_support/src/dev_fast/cargo_log.rs b/test_support/src/dev_fast/cargo_log.rs
index c15bd7e11..dd248825a 100644
--- a/test_support/src/dev_fast/cargo_log.rs
+++ b/test_support/src/dev_fast/cargo_log.rs
@@ -5,9 +5,11 @@
 //! prefix to `PATH`. Recording the arguments and environment each invocation
 //! received turns those into checkable facts rather than assumptions.
 
-use anyhow::{Context, Result};
+use anyhow::{Context, Result, bail};
 use camino::{Utf8Path, Utf8PathBuf};
+use std::collections::HashMap;
 use std::fs;
+use std::io::ErrorKind;
 
 use super::Sandbox;
 
@@ -71,19 +73,22 @@ impl RecordingCargo {
 
     /// Every invocation recorded so far, in order.
     ///
-    /// An absent log means the fake was never called, which is reported as an
-    /// empty list so a test can assert on that directly.
+    /// A log that was never created means the fake was never called, reported
+    /// as an empty list so a test can assert on that directly. Any other read
+    /// failure is propagated: a permission or I/O error must not masquerade as
+    /// "cargo did not run", which is exactly the conclusion some tests draw.
     pub fn invocations(&self) -> Result<Vec<CargoInvocation>> {
-        if !self.log.as_std_path().exists() {
-            return Ok(Vec::new());
-        }
-        let text = fs::read_to_string(self.log.as_std_path())
-            .with_context(|| format!("read {}", self.log))?;
-        Ok(text
-            .split(RECORD_SEPARATOR)
+        let text = match fs::read_to_string(self.log.as_std_path()) {
+            Ok(text) => text,
+            Err(error) if error.kind() == ErrorKind::NotFound => return Ok(Vec::new()),
+            Err(error) => {
+                return Err(error).with_context(|| format!("read {}", self.log));
+            }
+        };
+        text.split(RECORD_SEPARATOR)
             .filter(|record| !record.trim().is_empty())
             .map(CargoInvocation::parse)
-            .collect())
+            .collect()
     }
 
     /// The single recorded invocation, or an error naming how many there were.
@@ -118,41 +123,58 @@ pub struct CargoInvocation {
 }
 
 impl CargoInvocation {
-    fn parse(record: &str) -> Self {
-        let mut invocation = Self {
-            arguments: Vec::new(),
-            toolchain: String::new(),
-            path: String::new(),
-            target_dir: String::new(),
-            target_state: TargetState::Unset,
-            touch_mtime: None,
-        };
-        for line in record.lines() {
-            let Some((field, value)) = line.split_once('\t') else {
-                continue;
-            };
-            match field {
-                "arguments" => {
-                    invocation.arguments = value.split_whitespace().map(str::to_owned).collect();
-                }
-                "toolchain" => invocation.toolchain = value.to_owned(),
-                "path" => invocation.path = value.to_owned(),
-                "target_dir" => invocation.target_dir = value.to_owned(),
-                "target_state" => {
-                    invocation.target_state = match value {
-                        "present" => TargetState::Present,
-                        "absent" => TargetState::Absent,
-                        _ => TargetState::Unset,
-                    };
-                }
-                "touch_mtime" => invocation.touch_mtime = value.parse().ok(),
-                _ => {}
-            }
-        }
-        if invocation.target_dir.is_empty() {
-            invocation.target_state = TargetState::Unset;
+    /// Parse one record, rejecting anything the fake could not have written.
+    ///
+    /// A silently-defaulted field would let a harness bug read as a legitimate
+    /// observation — an unrecognised `target_state`, say, would look exactly
+    /// like "no target directory was set". Every field the fake emits is
+    /// therefore required, and every value must be one it can produce.
+    fn parse(record: &str) -> Result<Self> {
+        let mut fields: HashMap<&str, &str> = HashMap::new();
+        for line in record.lines().filter(|line| !line.trim().is_empty()) {
+            let (field, value) = line
+                .split_once('\t')
+                .with_context(|| format!("malformed record line `{line}`"))?;
+            fields.insert(field, value);
         }
-        invocation
+
+        let take = |name: &str| -> Result<String> {
+            fields
+                .get(name)
+                .map(|value| (*value).to_owned())
+                .with_context(|| format!("record is missing the `{name}` field"))
+        };
+
+        let target_dir = take("target_dir")?;
+        let target_state = match (target_dir.is_empty(), take("target_state")?.as_str()) {
+            (true, _) => TargetState::Unset,
+            (false, "present") => TargetState::Present,
+            (false, "absent") => TargetState::Absent,
+            (false, other) => bail!("unrecognised target_state `{other}`"),
+        };
+
+        let raw_mtime = take("touch_mtime")?;
+        let touch_mtime = if raw_mtime.is_empty() {
+            None
+        } else {
+            Some(
+                raw_mtime
+                    .parse()
+                    .with_context(|| format!("malformed touch_mtime `{raw_mtime}`"))?,
+            )
+        };
+
+        Ok(Self {
+            arguments: take("arguments")?
+                .split_whitespace()
+                .map(str::to_owned)
+                .collect(),
+            toolchain: take("toolchain")?,
+            path: take("path")?,
+            target_dir,
+            target_state,
+            touch_mtime,
+        })
     }
 
     /// The arguments Cargo received. Recorded via `"$*"`, so an argument
diff --git a/test_support/src/dev_fast/mod.rs b/test_support/src/dev_fast/mod.rs
index 0eef6bb4b..002a25d02 100644
--- a/test_support/src/dev_fast/mod.rs
+++ b/test_support/src/dev_fast/mod.rs
@@ -30,4 +30,7 @@ mod sandbox;
 pub use cargo_log::{CargoInvocation, RecordingCargo, TargetState};
 pub use make::MakeInvocation;
 pub use release::FakeRelease;
-pub use sandbox::{PinOverrides, Sandbox, combined, pinned_mold_version, pinned_toolchain};
+pub use sandbox::{
+    DEV_FAST_CONFIG_PATH, PinOverrides, Sandbox, combined, dev_fast_config, pinned_mold_version,
+    pinned_toolchain,
+};
diff --git a/test_support/src/dev_fast/sandbox.rs b/test_support/src/dev_fast/sandbox.rs
index 3b8f08e9f..ebbc61d47 100644
--- a/test_support/src/dev_fast/sandbox.rs
+++ b/test_support/src/dev_fast/sandbox.rs
@@ -5,8 +5,11 @@
 use anyhow::{Context, Result, bail};
 use camino::{Utf8Path, Utf8PathBuf};
 use std::fs;
-use std::os::unix::fs::PermissionsExt;
+use std::fs::File;
+use std::io::ErrorKind;
+use std::os::unix::fs::{FileExt, PermissionsExt};
 use std::process::{Command, Output};
+use std::time::SystemTime;
 use tempfile::{TempDir, tempdir};
 
 use super::MakeInvocation;
@@ -55,7 +58,10 @@ pub enum PinOverrides {
 
 /// A `PATH` and `HOME` containing only what a test explicitly puts there.
 pub struct Sandbox {
-    temp: TempDir,
+    /// Retained so the temporary tree outlives the sandbox; the usable path is
+    /// `root`, validated as UTF-8 once during construction.
+    _temp: TempDir,
+    root: Utf8PathBuf,
     repo: Utf8PathBuf,
 }
 
@@ -63,34 +69,35 @@ impl Sandbox {
     /// Build a sandbox and populate it with the utility allowlist.
     pub fn new() -> Result<Self> {
         let temp = tempdir().context("create sandbox directory")?;
+        let root = Utf8Path::from_path(temp.path())
+            .context("sandbox path must be UTF-8")?
+            .to_path_buf();
         let repo = std::env::current_dir().context("resolve repository root")?;
         let repo = Utf8PathBuf::try_from(repo).context("repository root must be UTF-8")?;
-        let sandbox = Self { temp, repo };
+        let sandbox = Self {
+            _temp: temp,
+            root,
+            repo,
+        };
         fs::create_dir_all(sandbox.bin().as_std_path()).context("create sandbox bin")?;
         fs::create_dir_all(sandbox.home().as_std_path()).context("create sandbox home")?;
         sandbox.link_utilities()?;
         Ok(sandbox)
     }
 
-    fn root(&self) -> Utf8PathBuf {
-        Utf8Path::from_path(self.temp.path())
-            .expect("tempdir path must be UTF-8")
-            .to_path_buf()
-    }
-
     /// The only directory on the sandbox `PATH`.
     pub fn bin(&self) -> Utf8PathBuf {
-        self.root().join("bin")
+        self.root.join("bin")
     }
 
     /// A `HOME` inside the sandbox, isolating the Makefile's `PATH` export.
     pub fn home(&self) -> Utf8PathBuf {
-        self.root().join("home")
+        self.root.join("home")
     }
 
     /// An install prefix that starts out empty; `DEV_FAST_PREFIX` points here.
     pub fn prefix(&self) -> Utf8PathBuf {
-        self.root().join("prefix")
+        self.root.join("prefix")
     }
 
     fn link_utilities(&self) -> Result<()> {
@@ -119,16 +126,48 @@ impl Sandbox {
 
     /// Write a fixture file, creating its parent directory.
     ///
-    /// Offered here so test crates can stage fixtures without reaching for
-    /// `std::fs` themselves, keeping the ambient filesystem access inside this
-    /// already-sanctioned support crate.
+    /// Offered here, along with [`create_dir`](Self::create_dir) and
+    /// [`write_file_with_mtime`](Self::write_file_with_mtime), so test crates
+    /// can stage fixtures without reaching for `std::fs` themselves. That keeps
+    /// the ambient filesystem access inside this already-sanctioned support
+    /// crate instead of widening the Whitaker exclusion list.
     pub fn write_file(&self, path: &Utf8Path, contents: &str) -> Result<()> {
-        if let Some(parent) = path.parent() {
-            fs::create_dir_all(parent.as_std_path()).with_context(|| format!("create {parent}"))?;
-        }
+        self.create_parent(path)?;
         fs::write(path.as_std_path(), contents).with_context(|| format!("write {path}"))
     }
 
+    /// Write a fixture file and backdate it to `mtime`, in seconds since the
+    /// Unix epoch.
+    ///
+    /// Tests that need to observe a later `touch` compare against a fixed old
+    /// timestamp rather than against each other, which keeps the observation
+    /// free of filesystem timestamp granularity.
+    pub fn write_file_with_mtime(
+        &self,
+        path: &Utf8Path,
+        contents: &str,
+        mtime: SystemTime,
+    ) -> Result<()> {
+        self.create_parent(path)?;
+        let file = File::create(path.as_std_path()).with_context(|| format!("create {path}"))?;
+        file.write_all_at(contents.as_bytes(), 0)
+            .with_context(|| format!("write {path}"))?;
+        file.set_modified(mtime)
+            .with_context(|| format!("backdate {path}"))
+    }
+
+    /// Create a directory and any missing parents.
+    pub fn create_dir(&self, path: &Utf8Path) -> Result<()> {
+        fs::create_dir_all(path.as_std_path()).with_context(|| format!("create {path}"))
+    }
+
+    fn create_parent(&self, path: &Utf8Path) -> Result<()> {
+        match path.parent() {
+            Some(parent) => self.create_dir(parent),
+            None => Ok(()),
+        }
+    }
+
     /// A `mold` reporting the given version, formatted as the real one does.
     pub fn write_mold(&self, dir: &Utf8Path, version: &str) -> Result<Utf8PathBuf> {
         self.write_fake(
@@ -140,6 +179,10 @@ impl Sandbox {
 
     /// A `rustup` reporting the given toolchain and, optionally, the Cranelift
     /// component as installed.
+    ///
+    /// Every invocation is appended to [`rustup_log`](Self::rustup_log), so a
+    /// test can assert which toolchain commands the installer actually issued
+    /// rather than inferring them from its diagnostics.
     pub fn write_rustup(&self, toolchain: &str, has_cranelift: bool) -> Result<Utf8PathBuf> {
         let component = if has_cranelift {
             "rustc-codegen-cranelift-x86_64-unknown-linux-gnu"
@@ -148,18 +191,38 @@ impl Sandbox {
         };
         let body = format!(
             concat!(
+                "printf '%s\\n' \"$*\" >> '{log}'\n",
                 "case \"$1 $2\" in\n",
                 "  'toolchain list') echo '{toolchain}-x86_64-unknown-linux-gnu' ;;\n",
                 "  'component list') echo '{component}' ;;\n",
                 "  *) exit 0 ;;\n",
                 "esac"
             ),
+            log = self.rustup_log(),
             toolchain = toolchain,
             component = component,
         );
         self.write_fake(&self.bin(), "rustup", &body)
     }
 
+    /// Where [`write_rustup`](Self::write_rustup) records its invocations.
+    pub fn rustup_log(&self) -> Utf8PathBuf {
+        self.home().join("rustup-invocations.log")
+    }
+
+    /// The `rustup` command lines recorded so far, in order.
+    ///
+    /// A log that was never created means `rustup` was never called. Any other
+    /// read failure is propagated rather than reported as "it did not run".
+    pub fn rustup_invocations(&self) -> Result<Vec<String>> {
+        let log = self.rustup_log();
+        match fs::read_to_string(log.as_std_path()) {
+            Ok(text) => Ok(text.lines().map(str::to_owned).collect()),
+            Err(error) if error.kind() == ErrorKind::NotFound => Ok(Vec::new()),
+            Err(error) => Err(error).with_context(|| format!("read {log}")),
+        }
+    }
+
     fn base_command(&self, program: &Utf8Path) -> Command {
         let mut command = Command::new(program.as_std_path());
         command
@@ -281,6 +344,15 @@ fn read_pin(path: &str) -> Result<String> {
         .to_owned())
 }
 
+/// The committed Cargo fragment's path, relative to the repository root.
+pub const DEV_FAST_CONFIG_PATH: &str = "tools/dev-fast/config.toml";
+
+/// The committed Cargo fragment's contents, so a test can assert on what the
+/// `dev-*` recipes actually apply rather than only on the path they pass.
+pub fn dev_fast_config() -> Result<String> {
+    fs::read_to_string(DEV_FAST_CONFIG_PATH).with_context(|| format!("read {DEV_FAST_CONFIG_PATH}"))
+}
+
 /// The repository's pinned mold release tag.
 pub fn pinned_mold_version() -> Result<String> {
     read_pin("tools/mold/VERSION")
diff --git a/tests/dev_fast_install_tests.rs b/tests/dev_fast_install_tests.rs
index afaaf14d6..21e0dd699 100644
--- a/tests/dev_fast_install_tests.rs
+++ b/tests/dev_fast_install_tests.rs
@@ -9,10 +9,11 @@
 
 #![cfg(all(unix, target_os = "linux"))]
 
-use anyhow::{Context, Result, ensure};
+use anyhow::{Result, ensure};
 use camino::Utf8PathBuf;
+use proptest::prelude::*;
+use proptest::proptest;
 use rstest::rstest;
-use std::fs;
 use test_support::dev_fast::{
     FakeRelease, PinOverrides, Sandbox, combined, pinned_mold_version, pinned_toolchain,
 };
@@ -139,9 +140,46 @@ fn installs_and_records_the_verification_when_the_checksum_matches() -> Result<(
         scenario.installed_mold().as_std_path().is_file(),
         "the tarball root should be stripped so bin/mold lands in the prefix"
     );
+    // Assert on the commands rustup actually received, not on the installer's
+    // own narration of them: a diagnostic can be emitted without the command
+    // ever running.
+    let rustup = scenario.sandbox.rustup_invocations()?;
+    let toolchain = pinned_toolchain()?;
     ensure!(
-        text.contains("rustc-codegen-cranelift-preview"),
-        "should install the Cranelift component, got `{text}`"
+        rustup
+            .iter()
+            .any(|call| call == &format!("toolchain install {toolchain} --profile minimal")),
+        "should install the pinned toolchain, recorded `{rustup:?}`"
+    );
+    ensure!(
+        rustup.iter().any(|call| {
+            call == &format!(
+                "component add rustc-codegen-cranelift-preview --toolchain {toolchain}"
+            )
+        }),
+        "should add the Cranelift component to the pinned toolchain, recorded `{rustup:?}`"
+    );
+    Ok(())
+}
+
+/// A refused artefact must abort before the toolchain half runs, so rustup sees
+/// nothing beyond whatever the capability probe needed.
+#[test]
+fn a_refused_artefact_never_reaches_the_toolchain_install() -> Result<()> {
+    let scenario = InstallerScenario::prepare()?;
+    let fixture = scenario.with_failure(ChecksumFailure::Mismatch)?;
+
+    let output = scenario
+        .sandbox
+        .script("install-dev-fast.sh", &fixture.script_env())?;
+    ensure!(!output.status.success(), "install should abort");
+
+    let rustup = scenario.sandbox.rustup_invocations()?;
+    ensure!(
+        !rustup
+            .iter()
+            .any(|call| call.starts_with("toolchain install") || call.starts_with("component add")),
+        "no toolchain should be installed after a refusal, recorded `{rustup:?}`"
     );
     Ok(())
 }
@@ -251,7 +289,43 @@ fn an_unreadable_pin_aborts_before_any_download() -> Result<()> {
 /// A cell holding a one-decimal duration, as `bench-build` formats them.
 /// Timings are inherently unstable, so tests assert on shape, not value.
 fn is_timing(cell: &str) -> bool {
-    !cell.is_empty() && cell.contains('.') && cell.chars().all(|c| c.is_ascii_digit() || c == '.')
+    // Exactly one point, with digits either side. A looser check accepts `.`,
+    // `..`, and `1.2.3`, none of which the benchmark can emit.
+    let Some((whole, fraction)) = cell.split_once('.') else {
+        return false;
+    };
+    !whole.is_empty()
+        && !fraction.is_empty()
+        && whole.chars().all(|c| c.is_ascii_digit())
+        && fraction.chars().all(|c| c.is_ascii_digit())
+}
+
+proptest! {
+    /// A timing cell is exactly `<digits>.<digits>`. Generating around that
+    /// shape covers the malformed neighbours — bare dots, multiple points, a
+    /// missing side — that a hand-picked example list tends to miss.
+    #[test]
+    fn is_timing_accepts_exactly_one_point_between_digits(
+        cell in r"[0-9.]{0,6}"
+    ) {
+        let expected = {
+            let mut parts = cell.split('.');
+            let whole = parts.next().unwrap_or_default();
+            let fraction = parts.next().unwrap_or_default();
+            parts.next().is_none()
+                && cell.contains('.')
+                && !whole.is_empty()
+                && !fraction.is_empty()
+        };
+        prop_assert_eq!(is_timing(&cell), expected, "cell `{}`", cell);
+    }
+
+    /// Whatever the digits, a well-formed one-decimal timing is accepted.
+    #[test]
+    fn is_timing_accepts_any_one_decimal_duration(whole in 0u32..100_000, fraction in 0u32..10) {
+        let cell = format!("{whole}.{fraction}");
+        prop_assert!(is_timing(&cell), "cell `{}`", cell);
+    }
 }
 
 #[test]
@@ -261,7 +335,7 @@ fn benchmark_emits_a_markdown_table_for_both_paths() -> Result<()> {
     sandbox.write_rustup(&pinned_toolchain()?, true)?;
     let cargo = sandbox.write_fake(&sandbox.bin(), "cargo", "exit 0")?;
     let touch_file = sandbox.home().join("bench-touch");
-    fs::write(touch_file.as_std_path(), "").context("create bench touch target")?;
+    sandbox.write_file(&touch_file, "")?;
 
     let output = sandbox.script(
         "bench-build.sh",
diff --git a/tests/dev_fast_make_target_tests.rs b/tests/dev_fast_make_target_tests.rs
index d22049b4c..1d844647d 100644
--- a/tests/dev_fast_make_target_tests.rs
+++ b/tests/dev_fast_make_target_tests.rs
@@ -11,23 +11,18 @@
 
 #![cfg(all(unix, target_os = "linux"))]
 
-use anyhow::{Context, Result, ensure};
+use anyhow::{Context, Result, bail, ensure};
 use camino::{Utf8Path, Utf8PathBuf};
 use rstest::rstest;
-use std::fs::File;
 use std::time::{Duration, UNIX_EPOCH};
 use test_support::dev_fast::{
-    CargoInvocation, FakeRelease, MakeInvocation, RecordingCargo, Sandbox, TargetState, combined,
-    pinned_mold_version, pinned_toolchain,
+    CargoInvocation, DEV_FAST_CONFIG_PATH, FakeRelease, MakeInvocation, RecordingCargo, Sandbox,
+    TargetState, combined, dev_fast_config, pinned_mold_version, pinned_toolchain,
 };
 
 /// The version the fake release is published as; see the installer tests.
 const TEST_MOLD_VERSION: &str = "9.9.9";
 
-/// The fragment the recipes must hand to Cargo. Hard-coded rather than derived,
-/// so a change to the committed path fails a test instead of passing silently.
-const DEV_FAST_CONFIG: &str = "tools/dev-fast/config.toml";
-
 /// A sandbox whose prerequisites all pass, with a recording `cargo` installed.
 struct BuildScenario {
     sandbox: Sandbox,
@@ -90,7 +85,7 @@ fn build_targets_select_the_pinned_toolchain_and_fragment(
         invocation.toolchain()
     );
     ensure!(
-        invocation.contains_sequence(&["--config", DEV_FAST_CONFIG]),
+        invocation.contains_sequence(&["--config", DEV_FAST_CONFIG_PATH]),
         "`{}` should pass the fragment, got `{:?}`",
         target.name,
         invocation.arguments()
@@ -113,6 +108,91 @@ fn build_targets_select_the_pinned_toolchain_and_fragment(
     Ok(())
 }
 
+/// The capability check gates the build targets, so a failing check must stop
+/// them before Cargo runs. Asserting on the recorded invocations proves that
+/// directly, where relying on Cargo's absence from the sandbox would pass even
+/// if the recipe did invoke it.
+#[rstest]
+#[case("dev-build")]
+#[case("dev-test")]
+fn a_failed_gate_invokes_cargo_not_at_all(#[case] target: &str) -> Result<()> {
+    let sandbox = Sandbox::new()?;
+    sandbox.write_rustup(&pinned_toolchain()?, true)?;
+    // A usable cargo is present and recording; only mold is missing.
+    let cargo = RecordingCargo::install(&sandbox)?;
+
+    let invocation = MakeInvocation::new(target).variable("CARGO", cargo.executable());
+    let output = sandbox.run_make(&invocation)?;
+    let text = combined(&output);
+
+    ensure!(
+        !output.status.success(),
+        "`{target}` should fail, got `{text}`"
+    );
+    ensure!(
+        text.contains("mold not found on PATH"),
+        "`{target}` should fail in the capability check, got `{text}`"
+    );
+    let recorded = cargo.invocations()?;
+    ensure!(
+        recorded.is_empty(),
+        "`{target}` should not reach Cargo, recorded {} invocation(s)",
+        recorded.len()
+    );
+    Ok(())
+}
+
+/// The recipes pass the fragment by path, so a test asserting only that the
+/// path appears would still pass if the file lost its contents. Read it.
+#[test]
+fn the_cargo_fragment_selects_cranelift_and_mold() -> Result<()> {
+    let fragment: toml::Value = toml::from_str(&dev_fast_config()?)?;
+
+    ensure!(
+        fragment
+            .get("unstable")
+            .and_then(|table| table.get("codegen-backend"))
+            == Some(&toml::Value::Boolean(true)),
+        "the fragment must enable the codegen-backend unstable flag, got `{fragment}`"
+    );
+    ensure!(
+        fragment
+            .get("profile")
+            .and_then(|table| table.get("dev"))
+            .and_then(|table| table.get("codegen-backend"))
+            .and_then(toml::Value::as_str)
+            == Some("cranelift"),
+        "the dev profile must select Cranelift, got `{fragment}`"
+    );
+    // Release artefacts must never inherit the backend, so no other profile may
+    // name one.
+    let profiles = fragment
+        .get("profile")
+        .and_then(toml::Value::as_table)
+        .context("the fragment must configure a profile")?;
+    for (name, table) in profiles {
+        ensure!(
+            name == "dev" || table.get("codegen-backend").is_none(),
+            "only the dev profile may select a backend, but `{name}` does"
+        );
+    }
+
+    let linux = fragment
+        .get("target")
+        .and_then(|table| table.get(r#"cfg(target_os = "linux")"#))
+        .and_then(|table| table.get("rustflags"))
+        .and_then(toml::Value::as_array)
+        .context("the fragment must gate rustflags behind the Linux cfg")?;
+    ensure!(
+        linux
+            .iter()
+            .filter_map(toml::Value::as_str)
+            .any(|flag| flag.contains("-fuse-ld=mold")),
+        "the Linux target must select mold, got `{linux:?}`"
+    );
+    Ok(())
+}
+
 #[test]
 fn install_target_forwards_the_prefix_pins_and_release_url() -> Result<()> {
     let sandbox = Sandbox::new()?;
@@ -166,12 +246,9 @@ const DEFAULT_SLUG: &str = "default";
 const DEV_FAST_SLUG: &str = "dev-fast";
 
 /// Create the touch file with [`BASELINE_MTIME`], returning that timestamp.
-fn write_with_old_mtime(path: &Utf8Path) -> Result<i64> {
-    let file = File::create(path.as_std_path())
-        .with_context(|| format!("create bench touch target {path}"))?;
+fn write_with_old_mtime(sandbox: &Sandbox, path: &Utf8Path) -> Result<i64> {
     let baseline = UNIX_EPOCH + Duration::from_secs(BASELINE_MTIME.unsigned_abs());
-    file.set_modified(baseline)
-        .with_context(|| format!("backdate {path}"))?;
+    sandbox.write_file_with_mtime(path, "", baseline)?;
     Ok(BASELINE_MTIME)
 }
 
@@ -182,15 +259,14 @@ fn bench_target_emits_both_variant_rows() -> Result<()> {
     // Touch a disposable file rather than `src/main.rs`, so the benchmark does
     // not invalidate the working tree's build cache.
     let touch_file = sandbox.home().join("bench-touch");
-    let baseline_mtime = write_with_old_mtime(&touch_file)?;
+    let baseline_mtime = write_with_old_mtime(sandbox, &touch_file)?;
 
     // Seed both target directories, modelling a re-run. Without this the
     // benchmark's `rm -rf` would be indistinguishable from doing nothing,
     // because a fresh sandbox has no artefacts to remove.
     let bench_root = sandbox.home().join("bench");
     for slug in [DEFAULT_SLUG, DEV_FAST_SLUG] {
-        std::fs::create_dir_all(bench_root.join(slug).as_std_path())
-            .with_context(|| format!("seed stale {slug} target directory"))?;
+        sandbox.create_dir(&bench_root.join(slug))?;
     }
 
     let invocation = MakeInvocation::new("bench-build")
@@ -224,9 +300,17 @@ fn bench_target_emits_both_variant_rows() -> Result<()> {
 
     // The benchmark measures the default variant first, then the accelerated
     // one, each as a clean pass followed by an incremental pass.
-    let mut pairs = invocations.chunks_exact(2);
-    let default_pass = BenchVariant::from_pair(DEFAULT_SLUG, pairs.next(), false)?;
-    let dev_fast_pass = BenchVariant::from_pair(DEV_FAST_SLUG, pairs.next(), true)?;
+    let (pairs, rest) = invocations.as_chunks::<2>();
+    ensure!(
+        rest.is_empty(),
+        "passes should come in pairs, got {} spare",
+        rest.len()
+    );
+    let [default_chunk, dev_fast_chunk] = pairs else {
+        bail!("expected one pair per variant, got {}", pairs.len());
+    };
+    let default_pass = BenchVariant::from_pair(DEFAULT_SLUG, default_chunk, false);
+    let dev_fast_pass = BenchVariant::from_pair(DEV_FAST_SLUG, dev_fast_chunk, true);
     for variant in [&default_pass, &dev_fast_pass] {
         variant.check(&pinned_toolchain()?)?;
     }
@@ -271,24 +355,20 @@ struct BenchVariant<'a> {
 
 impl<'a> BenchVariant<'a> {
     /// Build a descriptor from the variant's recorded pair of passes.
-    fn from_pair(
+    ///
+    /// The fixed-size array makes the pairing a type-level fact, so there is no
+    /// absent-pass case left to handle at runtime.
+    const fn from_pair(
         label: &'a str,
-        pair: Option<&'a [CargoInvocation]>,
+        [clean, incremental]: &'a [CargoInvocation; 2],
         expects_fragment: bool,
-    ) -> Result<Self> {
-        let passes = pair.with_context(|| format!("no recorded passes for `{label}`"))?;
-        let clean = passes
-            .first()
-            .with_context(|| format!("no clean pass for `{label}`"))?;
-        let incremental = passes
-            .get(1)
-            .with_context(|| format!("no incremental pass for `{label}`"))?;
-        Ok(Self {
+    ) -> Self {
+        Self {
             label,
             clean,
             incremental,
             expects_fragment,
-        })
+        }
     }
 
     fn target_dir(&self) -> &str {
@@ -304,7 +384,8 @@ impl<'a> BenchVariant<'a> {
                 pass.arguments()
             );
             ensure!(
-                pass.contains_sequence(&["--config", DEV_FAST_CONFIG]) == self.expects_fragment,
+                pass.contains_sequence(&["--config", DEV_FAST_CONFIG_PATH])
+                    == self.expects_fragment,
                 "`{label}` fragment expectation ({}) not met, got `{:?}`",
                 self.expects_fragment,
                 pass.arguments()

From 581628c1deadd54e06befbf3478e4010593bd064 Mon Sep 17 00:00:00 2001
From: leynos <leynos@troubledskies.net>
Date: Sat, 1 Aug 2026 15:59:55 +0200
Subject: [PATCH 13/24] Share the repository toolchain and restate the Polonius
 flag
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

`main` adopted the Polonius borrow checker in `#465`/`#472`, moving the
whole repository to a dated nightly and adding a root
`.cargo/config.toml` that applies `-Zpolonius=next` to every Cargo
invocation. Two consequences for this branch, one of them fatal.

Cargo picks a single rustflags source rather than merging them, and a
`[target.*]` table outranks the `[build]` table. The dev-fast fragment
names `[target.'cfg(target_os = "linux")'] rustflags`, so it shadowed
the new `[build]` table and silently dropped Polonius. That is not a
divergence from the gate — the tree does not borrow-check without the
flag, so `make dev-build` stopped compiling outright, with an `E0499`
that says nothing about the cause. The fragment now restates the flag,
and a test asserts it: deleting it fails that test and produces two
compile errors.

The separate Cranelift nightly is now vestigial. It existed only
because the repository was on stable and Cranelift needs a nightly;
`rust-toolchain.toml` supplies one. Worse than redundant, it was a
hazard: dev-fast would have compiled under a different nightly from the
gate, and with an alpha borrow checker the two can disagree about which
borrows are legal. `tools/cranelift/VERSION` is therefore deleted and
the toolchain read from `rust-toolchain.toml`, so the accelerated loop
and the gates share one compiler. Verified that
`rustc-codegen-cranelift-preview` is installable on the pinned nightly,
and that `make dev-build` links with Cranelift and mold under it.

The fragment's header no longer claims a root `.cargo/config.toml` must
never exist. It now says why this fragment stays out of the one that
does: Polonius belongs to every build, Cranelift and a Linux-only
linker must not reach release, packaging, coverage, or verification.
---
 Makefile                             | 16 ++++---
 docs/developers-guide.md             | 64 +++++++++++++++-------------
 docs/repository-layout.md            |  3 --
 scripts/dev-fast-common.sh           | 17 ++++++--
 test_support/src/dev_fast/sandbox.rs | 17 ++++++--
 tests/dev_fast_check_tests.rs        | 11 +++--
 tests/dev_fast_make_target_tests.rs  | 11 +++++
 tools/cranelift/VERSION              |  1 -
 tools/dev-fast/config.toml           | 30 +++++++------
 9 files changed, 107 insertions(+), 63 deletions(-)
 delete mode 100644 tools/cranelift/VERSION

diff --git a/Makefile b/Makefile
index eab5e4170..ee021e545 100644
--- a/Makefile
+++ b/Makefile
@@ -18,13 +18,15 @@ KANI_FLAGS ?=
 KANI_INSTALL_FLAGS ?=
 KANI_CHECK_FLAGS ?=
 KANI_VERSION_FILE ?= tools/kani/VERSION
-# Opt-in local build acceleration. The Cargo fragment is deliberately not
-# `.cargo/config.toml`, so only the `dev-*` targets below can reach it and CI's
-# stable, MSRV, release, coverage, and formal-verification legs stay on the
-# supported LLVM backend and platform linker.
+# Opt-in local build acceleration. The Cargo fragment is deliberately separate
+# from `.cargo/config.toml`: that file is auto-discovered and carries the
+# repository-wide Polonius flag, whereas Cranelift and mold must stay opt-in so
+# release, packaging, coverage, and formal-verification paths keep the
+# supported LLVM backend and platform linker. The toolchain is not pinned
+# separately — dev-fast uses the repository's own nightly.
 MOLD_VERSION_FILE ?= tools/mold/VERSION
 MOLD_SHA256SUMS_FILE ?= tools/mold/SHA256SUMS
-CRANELIFT_TOOLCHAIN_FILE ?= tools/cranelift/VERSION
+RUST_TOOLCHAIN_FILE ?= rust-toolchain.toml
 DEV_FAST_CONFIG ?= tools/dev-fast/config.toml
 DEV_FAST_PREFIX ?= $(HOME)/.local
 # The installer may write mold to a prefix other than the default, so every
@@ -35,10 +37,10 @@ DEV_FAST_PATH = PATH='$(DEV_FAST_PREFIX)/bin:$(PATH)'
 DEV_FAST_ENV = $(DEV_FAST_PATH) \
 	MOLD_VERSION_FILE='$(MOLD_VERSION_FILE)' \
 	MOLD_SHA256SUMS_FILE='$(MOLD_SHA256SUMS_FILE)' \
-	CRANELIFT_TOOLCHAIN_FILE='$(CRANELIFT_TOOLCHAIN_FILE)' \
+	RUST_TOOLCHAIN_FILE='$(RUST_TOOLCHAIN_FILE)' \
 	DEV_FAST_CONFIG='$(DEV_FAST_CONFIG)' \
 	DEV_FAST_PREFIX='$(DEV_FAST_PREFIX)'
-DEV_FAST_TOOLCHAIN = $$(tr -d '[:space:]' <'$(CRANELIFT_TOOLCHAIN_FILE)')
+DEV_FAST_TOOLCHAIN = $$(awk -F'"' '/^[[:space:]]*channel[[:space:]]*=/ { print $$2; exit }' '$(RUST_TOOLCHAIN_FILE)')
 MDLINT ?= $(shell command -v markdownlint-cli2 2>/dev/null || printf '%s' "$$HOME/.bun/bin/markdownlint-cli2")
 NIXIE ?= nixie
 # Single source of truth for the typos version; the markdownlint target and CI
diff --git a/docs/developers-guide.md b/docs/developers-guide.md
index 451316d1f..cce433cba 100644
--- a/docs/developers-guide.md
+++ b/docs/developers-guide.md
@@ -81,19 +81,19 @@ construction.
 Netsuke builds on the dated nightly toolchain pinned in `rust-toolchain.toml`
 with the Polonius alpha borrow-checking analysis (`-Zpolonius=next`) enabled.
 `rustup` provisions the toolchain automatically, and `.cargo/config.toml`
-supplies the flag by default, covering Cargo invocations such as
-rust-analyzer and `cargo kani` that run without `RUSTFLAGS` in the
-environment. Makefile recipes that set `RUSTFLAGS` re-state the flag through
-the `POLONIUS_FLAGS` variable because an inherited `RUSTFLAGS` environment
-variable overrides `.cargo/config.toml`.
+supplies the flag by default, covering Cargo invocations such as rust-analyzer
+and `cargo kani` that run without `RUSTFLAGS` in the environment. Makefile
+recipes that set `RUSTFLAGS` re-state the flag through the `POLONIUS_FLAGS`
+variable because an inherited `RUSTFLAGS` environment variable overrides
+`.cargo/config.toml`.
 
 [ADR-006](adr-006-adopt-polonius-nightly-toolchain.md) records the policy
 decision, and the [polonius migration notes](polonius.md) track every site
 whose design depends on the analysis. Sites tagged `POLONIUS(...)` fail to
 compile under plain non-lexical lifetimes (NLL); do not rewrite them into
-double lookups, unconditional key clones, or id indirection, and do not pad
-new code with defensive clones that only NLL required. When a borrow-centric
-form fails to compile, consult the migration notes before restructuring.
+double lookups, unconditional key clones, or id indirection, and do not pad new
+code with defensive clones that only NLL required. When a borrow-centric form
+fails to compile, consult the migration notes before restructuring.
 
 ## Quality gates
 
@@ -396,22 +396,23 @@ surfacing as an opaque codegen-backend or linker error.
 
 ### Toolchain contract
 
-Three pins keep the backend, linker, and toolchain in lockstep. Change them
-together, never individually.
+Two pins fix the linker; the toolchain is not pinned separately. Change the
+pins together, never individually.
 
 The scripts locate these files relative to their own path, so `make dev-*`, a
 direct `scripts/dev-fast-check.sh`, and a run from any working directory all
 resolve the same committed pins. Setting `MOLD_VERSION_FILE`,
-`MOLD_SHA256SUMS_FILE`, or `CRANELIFT_TOOLCHAIN_FILE` overrides the
-corresponding default; the tests use that to point the scripts at fixtures.
-Either way a missing or empty file is reported as
-`dev-fast: missing version pin: <path>` rather than silently becoming an empty
-version.
-
-- `tools/cranelift/VERSION` holds the nightly toolchain date, formatted
-  `nightly-YYYY-MM-DD`. The `rustc-codegen-cranelift-preview` component is
-  installed for exactly that toolchain, and `make dev-*` selects it with
-  `RUSTUP_TOOLCHAIN`.
+`MOLD_SHA256SUMS_FILE`, or `RUST_TOOLCHAIN_FILE` overrides the corresponding
+default; the tests use that to point the scripts at fixtures. Either way a
+missing or empty file is reported as `dev-fast: missing version pin: <path>`
+rather than silently becoming an empty version.
+
+- `rust-toolchain.toml` supplies the toolchain. dev-fast deliberately shares
+  the repository's own dated nightly rather than pinning a second one: the tree
+  borrow-checks only under Polonius on that nightly (ADR-006), so a separate
+  pin would let the accelerated loop and the gates disagree about which borrows
+  are legal. `make install-dev-fast` adds `rustc-codegen-cranelift-preview` to
+  that toolchain.
 - `tools/mold/VERSION` holds the `mold` release tag.
 - `tools/mold/SHA256SUMS` holds the SHA-256 checksum of each supported `mold`
   release artefact. `make install-dev-fast` refuses to install an artefact that
@@ -510,10 +511,9 @@ flag, `codegen-backend = "cranelift"` on the `dev` profile, and a
   emit that instrumentation. Never combine the `dev-fast` fragment with a
   coverage run.
 - **Formal verification.** Kani manages its own supporting nightly toolchain
-  during `cargo kani setup`. That nightly is unrelated to
-  `tools/cranelift/VERSION` and must not be conflated with it; verification
-  must run on Kani's own toolchain and the LLVM backend. The same applies to
-  Verus.
+  during `cargo kani setup`. That nightly is unrelated to the repository's
+  Polonius nightly and must not be conflated with it; verification must run on
+  Kani's own toolchain and the LLVM backend. The same applies to Verus.
 - **Test runner.** `make dev-test` is the accelerated counterpart of
   `make test-nextest`, not of `make test`: it runs the same
   `cargo nextest run --all-targets --all-features`, and so is governed by the
@@ -526,13 +526,17 @@ flag, `codegen-backend = "cranelift"` on the `dev` profile, and a
   `NEXTEST_BUILD_JOBS`, not `BUILD_JOBS`: nextest reserves `-j` for test
   concurrency, so a Cargo-shaped `-j` would silently become a thread count.
 - **rust-analyzer.** No rust-analyzer configuration is committed, so the
-  language server uses the stable toolchain and default backend. Opting
+  language server uses the repository toolchain and the default backend. Opting
   rust-analyzer into Cranelift is a personal, machine-local choice; it needs a
   separate target directory to avoid thrashing the cache shared with
   `make test`.
-- **Polonius.** A future move to the Polonius borrow checker would also need a
-  nightly toolchain. It is a separate decision with its own pin; do not overload
-  `tools/cranelift/VERSION` to carry it.
+- **Polonius.** `.cargo/config.toml` applies `-Zpolonius=next` to every Cargo
+  invocation, and the tree does not borrow-check without it (ADR-006). Cargo
+  picks a single rustflags source rather than merging them, and a `[target.*]`
+  table outranks that `[build]` table, so the dev-fast fragment restates the
+  flag alongside the `mold` link argument. Anything that adds a rustflag there
+  must restate it too: omitting it does not merely diverge from the gate, it
+  stops the tree compiling.
 
 ### Fallback behaviour
 
@@ -774,8 +778,8 @@ home plus Kani support-file home.
 - `make test-nextest` —
   `cargo nextest run --all-targets --all-features`, with
   `RUSTFLAGS="-D warnings $(POLONIUS_FLAGS)"` (the Makefile re-states the
-  Polonius flag because a set `RUSTFLAGS` overrides `.cargo/config.toml`).
-  This runs every unit, integration, `rstest`, and `rstest-bdd` test.
+  Polonius flag because a set `RUSTFLAGS` overrides `.cargo/config.toml`). This
+  runs every unit, integration, `rstest`, and `rstest-bdd` test.
 - `make doctest` — `cargo test --doc --all-features`, with the same
   `RUSTFLAGS`. nextest cannot execute doctests, so they need their own pass.
   Note that the previous `cargo test --all-targets` invocation never ran
diff --git a/docs/repository-layout.md b/docs/repository-layout.md
index 2e78834fa..f8b3e0577 100644
--- a/docs/repository-layout.md
+++ b/docs/repository-layout.md
@@ -42,7 +42,6 @@ output and some leaf files so the long-lived structure remains visible.
 │   ├── fixtures/
 │   └── snapshots/
 └── tools/
-    ├── cranelift/
     ├── dev-fast/
     ├── kani/
     └── mold/
@@ -100,8 +99,6 @@ output and some leaf files so the long-lived structure remains visible.
 - `tests/features/`: Cross-platform behavioural feature files.
 - `tests/features_unix/`: Unix-specific behavioural feature files.
 - `tests/snapshots/`: Checked-in integration-test snapshots.
-- `tools/cranelift/`: Pinned nightly toolchain date supplying the Cranelift
-  codegen backend used by the opt-in local build acceleration.
 - `tools/dev-fast/`: Non-auto-loaded Cargo configuration fragment for the
   opt-in Cranelift and `mold` build path. Cargo never discovers this file on
   its own; only the `make dev-*` targets pass it through `cargo --config`.
diff --git a/scripts/dev-fast-common.sh b/scripts/dev-fast-common.sh
index 1b808f3eb..82d3711e4 100644
--- a/scripts/dev-fast-common.sh
+++ b/scripts/dev-fast-common.sh
@@ -21,7 +21,7 @@ DEV_FAST_REPO_ROOT=$(cd -- "$DEV_FAST_HELPER_DIR/.." && pwd)
 # the same way whether it came from a default or an override.
 MOLD_VERSION_FILE="${MOLD_VERSION_FILE:-$DEV_FAST_REPO_ROOT/tools/mold/VERSION}"
 MOLD_SHA256SUMS_FILE="${MOLD_SHA256SUMS_FILE:-$DEV_FAST_REPO_ROOT/tools/mold/SHA256SUMS}"
-CRANELIFT_TOOLCHAIN_FILE="${CRANELIFT_TOOLCHAIN_FILE:-$DEV_FAST_REPO_ROOT/tools/cranelift/VERSION}"
+RUST_TOOLCHAIN_FILE="${RUST_TOOLCHAIN_FILE:-$DEV_FAST_REPO_ROOT/rust-toolchain.toml}"
 
 # Prefix for the mold installation tree. The `dev-*` recipes prepend this
 # prefix's `bin/` to PATH -- this exact prefix, not a hard-coded ~/.local -- so
@@ -58,8 +58,19 @@ read_pin() {
 # The pinned mold release tag, e.g. "2.41.0".
 mold_version() { read_pin "$MOLD_VERSION_FILE"; }
 
-# The pinned nightly supplying Cranelift, e.g. "nightly-2026-06-29".
-cranelift_toolchain() { read_pin "$CRANELIFT_TOOLCHAIN_FILE"; }
+# The repository's toolchain, read from `rust-toolchain.toml`.
+#
+# Deliberately the same toolchain the ordinary gates use, not a second pin.
+# The tree borrow-checks only under Polonius on that dated nightly (ADR-006),
+# so a separate dev-fast nightly would let the fast loop and the gate disagree
+# about which borrows are legal.
+cranelift_toolchain() {
+  local file=$RUST_TOOLCHAIN_FILE value
+  [ -f "$file" ] || fail "missing version pin: $file"
+  value=$(awk -F'"' '/^[[:space:]]*channel[[:space:]]*=/ { print $2; exit }' "$file")
+  [ -n "$value" ] || fail "no channel found in: $file"
+  printf '%s' "$value"
+}
 
 # Whether the host can use mold at all; it ships for Linux only.
 is_linux() { [ "$(uname -s)" = 'Linux' ]; }
diff --git a/test_support/src/dev_fast/sandbox.rs b/test_support/src/dev_fast/sandbox.rs
index ebbc61d47..c2559bab0 100644
--- a/test_support/src/dev_fast/sandbox.rs
+++ b/test_support/src/dev_fast/sandbox.rs
@@ -259,7 +259,7 @@ impl Sandbox {
             command
                 .env("MOLD_VERSION_FILE", "tools/mold/VERSION")
                 .env("MOLD_SHA256SUMS_FILE", "tools/mold/SHA256SUMS")
-                .env("CRANELIFT_TOOLCHAIN_FILE", "tools/cranelift/VERSION");
+                .env("RUST_TOOLCHAIN_FILE", "rust-toolchain.toml");
         }
         command.arg(format!("scripts/{name}"));
         for (key, value) in env {
@@ -358,7 +358,18 @@ pub fn pinned_mold_version() -> Result<String> {
     read_pin("tools/mold/VERSION")
 }
 
-/// The repository's pinned Cranelift-bearing nightly.
+/// The repository's toolchain, read from `rust-toolchain.toml`.
+///
+/// dev-fast deliberately shares it rather than pinning a second nightly, so the
+/// accelerated loop and the gates borrow-check identically under Polonius.
 pub fn pinned_toolchain() -> Result<String> {
-    read_pin("tools/cranelift/VERSION")
+    let contents = read_pin("rust-toolchain.toml")?;
+    contents
+        .lines()
+        .find_map(|line| {
+            let rest = line.trim().strip_prefix("channel")?;
+            let value = rest.trim_start().strip_prefix('=')?;
+            Some(value.trim().trim_matches('"').to_owned())
+        })
+        .context("rust-toolchain.toml should declare a channel")
 }
diff --git a/tests/dev_fast_check_tests.rs b/tests/dev_fast_check_tests.rs
index 7ddf714d7..b03a6c9a8 100644
--- a/tests/dev_fast_check_tests.rs
+++ b/tests/dev_fast_check_tests.rs
@@ -65,7 +65,7 @@ fn falls_back_to_the_committed_pins_when_no_overrides_are_given() -> Result<()>
     );
     ensure!(
         text.contains(&pinned_toolchain()?),
-        "should read tools/cranelift/VERSION by default, got `{text}`"
+        "should read rust-toolchain.toml by default, got `{text}`"
     );
     Ok(())
 }
@@ -96,8 +96,11 @@ fn default_pins_are_the_committed_ones_not_an_empty_fallback() -> Result<()> {
 #[test]
 fn an_explicit_pin_override_wins_over_the_committed_default() -> Result<()> {
     let sandbox = Sandbox::new()?;
-    let toolchain_pin = sandbox.home().join("CRANELIFT_VERSION");
-    sandbox.write_file(&toolchain_pin, "nightly-1970-01-01\n")?;
+    let toolchain_pin = sandbox.home().join("rust-toolchain.toml");
+    sandbox.write_file(
+        &toolchain_pin,
+        "[toolchain]\nchannel = \"nightly-1970-01-01\"\n",
+    )?;
     sandbox.write_mold(&sandbox.bin(), &pinned_mold_version()?)?;
     // rustup knows only the committed toolchain, so the run can fail only if
     // the override displaced the default.
@@ -106,7 +109,7 @@ fn an_explicit_pin_override_wins_over_the_committed_default() -> Result<()> {
     let output = sandbox.script_with(
         "dev-fast-check.sh",
         PinOverrides::Omitted,
-        &[("CRANELIFT_TOOLCHAIN_FILE", toolchain_pin.to_string())],
+        &[("RUST_TOOLCHAIN_FILE", toolchain_pin.to_string())],
     )?;
     let text = combined(&output);
 
diff --git a/tests/dev_fast_make_target_tests.rs b/tests/dev_fast_make_target_tests.rs
index 1d844647d..b3f88b2c1 100644
--- a/tests/dev_fast_make_target_tests.rs
+++ b/tests/dev_fast_make_target_tests.rs
@@ -190,6 +190,17 @@ fn the_cargo_fragment_selects_cranelift_and_mold() -> Result<()> {
             .any(|flag| flag.contains("-fuse-ld=mold")),
         "the Linux target must select mold, got `{linux:?}`"
     );
+    // Cargo picks one rustflags source rather than merging, and this table
+    // outranks `.cargo/config.toml`'s `[build]` table. Dropping the Polonius
+    // flag here does not merely diverge from the gate: the tree does not
+    // borrow-check without it, so `make dev-build` stops compiling.
+    ensure!(
+        linux
+            .iter()
+            .filter_map(toml::Value::as_str)
+            .any(|flag| flag == "-Zpolonius=next"),
+        "the Linux target must restate the Polonius flag it shadows, got `{linux:?}`"
+    );
     Ok(())
 }
 
diff --git a/tools/cranelift/VERSION b/tools/cranelift/VERSION
deleted file mode 100644
index 46d999c32..000000000
--- a/tools/cranelift/VERSION
+++ /dev/null
@@ -1 +0,0 @@
-nightly-2026-06-29
diff --git a/tools/dev-fast/config.toml b/tools/dev-fast/config.toml
index 8d18e5dec..ea3f851e5 100644
--- a/tools/dev-fast/config.toml
+++ b/tools/dev-fast/config.toml
@@ -1,17 +1,17 @@
 # Opt-in Cargo configuration fragment for accelerated local debug builds.
 #
-# This file is deliberately NOT `.cargo/config.toml`: Cargo auto-discovers that
-# path, which would leak nightly-only unstable flags and a Linux-only linker
-# choice into CI's stable/MSRV legs, release packaging, coverage, and the formal
-# verification toolchains. The fragment is instead passed explicitly with
-# `cargo --config tools/dev-fast/config.toml ...` from the `make dev-*` targets,
-# so every other build path keeps the supported LLVM backend and platform
-# linker.
+# This file is deliberately kept out of `.cargo/config.toml`. Cargo
+# auto-discovers that path, and the repository uses it for settings every build
+# must have — the Polonius flag. Cranelift and a Linux-only linker are not in
+# that category: putting them there would apply them to release packaging,
+# coverage, and the formal-verification toolchains, which must keep the
+# supported LLVM backend and platform linker. This fragment is instead passed
+# explicitly with `cargo --config tools/dev-fast/config.toml ...` from the
+# `make dev-*` targets.
 #
-# The pinned nightly that supplies the Cranelift backend lives in
-# `tools/cranelift/VERSION`; the pinned mold release lives in
-# `tools/mold/VERSION`. See `docs/developers-guide.md` for the ownership
-# boundary and composition rules.
+# The toolchain is the repository's own, from `rust-toolchain.toml`; only the
+# mold release is pinned here, in `tools/mold/VERSION`. See
+# `docs/developers-guide.md` for the ownership boundary and composition rules.
 
 [unstable]
 codegen-backend = true
@@ -25,5 +25,11 @@ codegen-backend = "cranelift"
 # macOS and Windows the table simply does not apply and the platform default
 # linker is used; `make dev-fast-check` reports that fallback explicitly rather
 # than leaving it implicit.
+#
+# `-Zpolonius=next` is restated here, not inherited. Cargo picks a single
+# rustflags source rather than merging them, and a `[target.*]` table outranks
+# the `[build]` table in `.cargo/config.toml`, so naming any flag here drops
+# Polonius. The tree only borrow-checks under Polonius (ADR-006), so omitting
+# it does not merely diverge from the gate — it fails to compile.
 [target.'cfg(target_os = "linux")']
-rustflags = ["-Clink-arg=-fuse-ld=mold"]
+rustflags = ["-Zpolonius=next", "-Clink-arg=-fuse-ld=mold"]

From 79d390fea1793d170b89cca71c230c0d6cd65b28 Mon Sep 17 00:00:00 2001
From: leynos <leynos@troubledskies.net>
Date: Sat, 1 Aug 2026 16:04:59 +0200
Subject: [PATCH 14/24] Split the benchmark test into fixture, run, and checks
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

CodeScene flagged `bench_target_emits_both_variant_rows` as a Large
Method: one body staged the fixture, ran `make bench-build`, validated
the Markdown table, and then checked four recorded Cargo invocations
across two dimensions.

Extract the two ends and leave orchestration behind.
`prepare_bench_fixture` stages the disposable touch file and seeds both
target directories; `check_benchmark_invocations` owns pairing, the
per-variant contract, and separate target directories, delegating the
timestamp ordering to `check_touch_ordering`.

The fixture returns a named `BenchFixture` rather than the suggested
`(Utf8PathBuf, Utf8PathBuf, i64)`. Two same-typed paths in a positional
return can be transposed at the call site without the compiler
objecting, which is the hazard a previous review round had me remove
from these tests; reintroducing it to satisfy a size metric would be a
poor trade.

Behaviour is unchanged. Every assertion moved intact, including the
`as_chunks::<2>()` pairing, the fixed-size destructuring, and the
explicit diagnostic when the pair count is not two. Re-running the
seven-mutation sweep over `bench-build.sh` — shared target directory,
no clean wipe, no touch, no fragment, no toolchain, wrong build target,
one variant only — still fails the test in all seven cases, so the
assertions remain load-bearing where they now live.

`cs check` reports the finding cleared: Large Method (LoC = 71) is gone
and the file's code health rises from 9.60 to 10.00.
---
 tests/dev_fast_make_target_tests.rs | 108 ++++++++++++++++++----------
 1 file changed, 72 insertions(+), 36 deletions(-)

diff --git a/tests/dev_fast_make_target_tests.rs b/tests/dev_fast_make_target_tests.rs
index b3f88b2c1..b7913711a 100644
--- a/tests/dev_fast_make_target_tests.rs
+++ b/tests/dev_fast_make_target_tests.rs
@@ -263,46 +263,48 @@ fn write_with_old_mtime(sandbox: &Sandbox, path: &Utf8Path) -> Result<i64> {
     Ok(BASELINE_MTIME)
 }
 
-#[test]
-fn bench_target_emits_both_variant_rows() -> Result<()> {
-    let scenario = BuildScenario::prepare()?;
+/// The disposable inputs one benchmark run needs.
+///
+/// Named fields rather than a returned tuple: `root` and `touch_file` are both
+/// paths, so positional returns could be transposed at the call site without
+/// the compiler noticing.
+struct BenchFixture {
+    /// Benchmark root; each variant gets its own target directory beneath it.
+    root: Utf8PathBuf,
+    /// The file the benchmark touches between a variant's two passes.
+    touch_file: Utf8PathBuf,
+    /// The touch file's timestamp before the run, for ordering assertions.
+    baseline_mtime: i64,
+}
+
+/// Stage a benchmark run's disposable inputs.
+///
+/// The touch file stands in for `src/main.rs`, so a run does not invalidate the
+/// working tree's build cache. Both target directories are seeded to model a
+/// re-run: on a fresh sandbox the benchmark's `rm -rf` would be
+/// indistinguishable from doing nothing, and the clean-pass assertion would
+/// hold vacuously.
+fn prepare_bench_fixture(scenario: &BuildScenario) -> Result<BenchFixture> {
     let sandbox = &scenario.sandbox;
-    // Touch a disposable file rather than `src/main.rs`, so the benchmark does
-    // not invalidate the working tree's build cache.
     let touch_file = sandbox.home().join("bench-touch");
     let baseline_mtime = write_with_old_mtime(sandbox, &touch_file)?;
 
-    // Seed both target directories, modelling a re-run. Without this the
-    // benchmark's `rm -rf` would be indistinguishable from doing nothing,
-    // because a fresh sandbox has no artefacts to remove.
-    let bench_root = sandbox.home().join("bench");
+    let root = sandbox.home().join("bench");
     for slug in [DEFAULT_SLUG, DEV_FAST_SLUG] {
-        sandbox.create_dir(&bench_root.join(slug))?;
+        sandbox.create_dir(&root.join(slug))?;
     }
+    Ok(BenchFixture {
+        root,
+        touch_file,
+        baseline_mtime,
+    })
+}
 
-    let invocation = MakeInvocation::new("bench-build")
-        .variable("CARGO", scenario.cargo.executable())
-        .environment("BENCH_ROOT", &bench_root)
-        .environment("BENCH_TOUCH_FILE", &touch_file);
-    let output = sandbox.run_make(&invocation)?;
-    let stdout = String::from_utf8_lossy(&output.stdout);
-
-    ensure!(
-        output.status.success(),
-        "make bench-build should succeed, got `{}`",
-        combined(&output)
-    );
-    for variant in [
-        "| Default (LLVM, platform linker) |",
-        "| dev-fast (Cranelift,",
-    ] {
-        ensure!(
-            stdout.contains(variant),
-            "table should carry the `{variant}` row, got `{stdout}`"
-        );
-    }
+/// Check the recorded passes: their count and pairing, each variant's own
+/// contract, that the variants measured separately, and where each pass sits
+/// relative to the touch.
+fn check_benchmark_invocations(invocations: &[CargoInvocation], baseline_mtime: i64) -> Result<()> {
     // Four builds: clean and incremental, for each of the two variants.
-    let invocations = scenario.cargo.invocations()?;
     ensure!(
         invocations.len() == 4,
         "should measure two builds per variant, recorded {}",
@@ -333,10 +335,14 @@ fn bench_target_emits_both_variant_rows() -> Result<()> {
         dev_fast_pass.target_dir()
     );
 
-    // Only the very first pass runs before any touch; each variant touches the
-    // file between its own two passes, so every later pass must see a newer
-    // timestamp. Comparing against a backdated baseline rather than between
-    // passes keeps this free of filesystem timestamp granularity.
+    check_touch_ordering(invocations, baseline_mtime)
+}
+
+/// Only the very first pass runs before any touch; each variant touches the
+/// file between its own two passes, so every later pass must see a newer
+/// timestamp. Comparing against a backdated baseline rather than between passes
+/// keeps this free of filesystem timestamp granularity.
+fn check_touch_ordering(invocations: &[CargoInvocation], baseline_mtime: i64) -> Result<()> {
     let first = invocations.first().context("expected a recorded pass")?;
     ensure!(
         first.touch_mtime() == Some(baseline_mtime),
@@ -354,6 +360,36 @@ fn bench_target_emits_both_variant_rows() -> Result<()> {
     Ok(())
 }
 
+#[test]
+fn bench_target_emits_both_variant_rows() -> Result<()> {
+    let scenario = BuildScenario::prepare()?;
+    let fixture = prepare_bench_fixture(&scenario)?;
+
+    let invocation = MakeInvocation::new("bench-build")
+        .variable("CARGO", scenario.cargo.executable())
+        .environment("BENCH_ROOT", &fixture.root)
+        .environment("BENCH_TOUCH_FILE", &fixture.touch_file);
+    let output = scenario.sandbox.run_make(&invocation)?;
+    let stdout = String::from_utf8_lossy(&output.stdout);
+
+    ensure!(
+        output.status.success(),
+        "make bench-build should succeed, got `{}`",
+        combined(&output)
+    );
+    for variant in [
+        "| Default (LLVM, platform linker) |",
+        "| dev-fast (Cranelift,",
+    ] {
+        ensure!(
+            stdout.contains(variant),
+            "table should carry the `{variant}` row, got `{stdout}`"
+        );
+    }
+
+    check_benchmark_invocations(&scenario.cargo.invocations()?, fixture.baseline_mtime)
+}
+
 /// One variant's pair of recorded builds: the clean pass then the incremental.
 struct BenchVariant<'a> {
     label: &'a str,

From f5a689f0d25255fb6e2adb59516b623dae3319ad Mon Sep 17 00:00:00 2001
From: leynos <leynos@troubledskies.net>
Date: Sat, 1 Aug 2026 21:44:05 +0200
Subject: [PATCH 15/24] Warn that test_support's own tests are not gated
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The `Testing the tooling` section directs contributors to put reusable
dev-fast fixtures in `test_support::dev_fast`, without saying that a
`#[cfg(test)]` test added there never runs: `Cargo.toml` excludes the
crate from the workspace, so `cargo nextest run --all-targets` does not
reach it. Measured while verifying a review round — `make test` lists
1218 tests and none of them come from `test_support`.

Record the consequence and point at the `tests/dev_fast_*.rs` crates,
which the gate does exercise.
---
 docs/developers-guide.md | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/docs/developers-guide.md b/docs/developers-guide.md
index cce433cba..e0ff0db5e 100644
--- a/docs/developers-guide.md
+++ b/docs/developers-guide.md
@@ -612,6 +612,12 @@ for any future target with the same shape, and do not reach for `PathGuard`:
 these tests spawn children with a bespoke environment rather than mutating the
 parent's, which is what keeps them safe to run in parallel.
 
+A `#[cfg(test)]` unit test added inside `test_support` will not run as part
+of `make test`, because `Cargo.toml` excludes `test_support` from the
+workspace. Put assertions about the fixtures themselves in the
+`tests/dev_fast_*.rs` integration crates instead, where the gate will
+actually exercise them.
+
 ### Benchmark evidence
 
 `make bench-build` measures both paths with one repeatable command. It builds

From 80ac4a972b2dd048a93d1ec1e0300b6eb9a48919 Mon Sep 17 00:00:00 2001
From: leynos <leynos@troubledskies.net>
Date: Sat, 1 Aug 2026 21:49:25 +0200
Subject: [PATCH 16/24] Record why the sandbox qualifies for the subprocess
 exemption
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

`main` sharpened the environment-injection rules in `#293`/`#330`,
forbidding in-process mutation outright and naming subprocess isolation
as the sole exemption. This branch already complied — no `set_var`,
no `remove_var`, and no `serial_test`, `Mutex`, or `OnceLock` escape
hatch anywhere in it — but the module doc predates the new wording.

The exemption is written around `assert_cmd`, and these helpers use
`std::process::Command` directly, because the subject under test is
`make` and the `scripts/` entry points rather than the `netsuke`
binary. Say so, and say that the isolation is the same and stricter:
`env_clear` means a child inherits nothing it was not handed. That
saves a future reader having to re-derive whether an unnamed vehicle
qualifies.
---
 test_support/src/dev_fast/mod.rs | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/test_support/src/dev_fast/mod.rs b/test_support/src/dev_fast/mod.rs
index 002a25d02..8774b04a4 100644
--- a/test_support/src/dev_fast/mod.rs
+++ b/test_support/src/dev_fast/mod.rs
@@ -19,8 +19,12 @@
 //!
 //! Scope: these helpers exist for the `dev-fast` target tests. They spawn child
 //! processes with a bespoke environment and never mutate the parent's, so they
-//! compose with the repository's prohibition on direct environment mutation in
-//! tests.
+//! qualify for the subprocess-isolation exemption to the ban on in-process
+//! environment mutation (`AGENTS.md`). That exemption is written around
+//! `assert_cmd`; these helpers use `std::process::Command` directly, because
+//! the subject under test is `make` and the `scripts/` entry points rather than
+//! the `netsuke` binary. The isolation is the same, and stricter: `env_clear`
+//! means a child inherits nothing it was not handed.
 
 mod cargo_log;
 mod make;

From e4c86a2bfc9ec8cd888fa6835c603dea34ff68cb Mon Sep 17 00:00:00 2001
From: leynos <leynos@troubledskies.net>
Date: Sun, 2 Aug 2026 13:50:06 +0200
Subject: [PATCH 17/24] Model the checksum and clean-build invariants, and fix
 a hole
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The review was right that `is_timing` was the only property-covered
invariant. Add coverage for the two it named, and repair what the first
of them found on its first run.

`the_installer_verifies_exactly_when_the_model_says_it_should` ranges
over the structural relationships a checksum row can hold to the
artefact — right digest, wrong, truncated, re-cased, another
artefact's, duplicated, whitespace-padded — and asserts the installer
agrees with a model of when verification should succeed. Random digests
would have been useless here: they never match, so they explore one
equivalence class. Probing `sha256sum` first also corrected an
assumption, as it compares hex case-insensitively, so an upper-cased
digest verifies.

That test failed immediately, on `[Wrong, Real]`. Two rows for one
artefact make `awk` emit two digests, so `expected` becomes multi-line
and the check hands `sha256sum` one malformed line per surplus digest
plus a single well-formed one. Malformed lines are only warned about,
so the verdict rested on whichever digest came last — a file recording
a wrong digest beside the right one verified, and a file recording them
the other way round did not. Verification silently depended on row
order. `verify_mold_archive` now refuses an ambiguous file rather than
guessing, and the model requires exactly one recorded digest.

`the_benchmark_wipes_whatever_each_variant_started_from` ranges over
what each variant's target directory held beforehand — absent, empty,
populated — and asserts every variant still records a clean pass then
an incremental one. That is precisely what the `rm -rf` exists to
guarantee, and without ranging over prior states the assertion holds
vacuously on a fresh sandbox. Removing the wipe now fails it, shrunk to
an *empty* stale directory, which a hand-picked fixture would probably
not have chosen.

Both corpora are small because each case spawns processes. The
regression seeds are checked in, as proptest recommends, so the two
cases that exposed these defects re-run first.
---
 docs/developers-guide.md                      |  22 +++
 scripts/install-dev-fast.sh                   |  11 +-
 ...ev_fast_install_tests.proptest-regressions |   7 +
 tests/dev_fast_install_tests.rs               | 148 ++++++++++++++++++
 ...ast_make_target_tests.proptest-regressions |   7 +
 tests/dev_fast_make_target_tests.rs           |  90 +++++++++++
 6 files changed, 284 insertions(+), 1 deletion(-)
 create mode 100644 tests/dev_fast_install_tests.proptest-regressions
 create mode 100644 tests/dev_fast_make_target_tests.proptest-regressions

diff --git a/docs/developers-guide.md b/docs/developers-guide.md
index e0ff0db5e..88058a60d 100644
--- a/docs/developers-guide.md
+++ b/docs/developers-guide.md
@@ -612,6 +612,28 @@ for any future target with the same shape, and do not reach for `PathGuard`:
 these tests spawn children with a bespoke environment rather than mutating the
 parent's, which is what keeps them safe to run in parallel.
 
+Three invariants carry property coverage rather than fixed examples, because
+each ranges over inputs an enumerated list tends to under-sample:
+
+- **Checksum verification.** The strategy ranges over the structural
+  relationships a checksum row can have to the artefact — right digest, wrong,
+  truncated, re-cased, another artefact's, duplicated, whitespace-padded —
+  rather than over random digests, which never match and so explore a single
+  equivalence class. A model predicts the verdict, and the installer must agree
+  with it. That model found a real defect: several rows for one artefact made
+  the shell's `expected` multi-line, which silently reduced verification to
+  whichever digest came last. The installer now refuses an ambiguous file.
+- **Clean and incremental passes.** The strategy ranges over what each
+  variant's target directory held beforehand — absent, empty, populated — and
+  asserts every variant still records a clean pass then an incremental one.
+  That is what the benchmark's `rm -rf` exists to guarantee; without ranging
+  over prior states, the assertion holds vacuously on a fresh sandbox.
+- **Timing-cell format**, as above.
+
+Prefer a model that predicts an outcome over a table that restates one. Where
+an invariant lives in a shell script, the cost is a process per case, so keep
+the corpus small and the strategy structural.
+
 A `#[cfg(test)]` unit test added inside `test_support` will not run as part
 of `make test`, because `Cargo.toml` excludes `test_support` from the
 workspace. Put assertions about the fixtures themselves in the
diff --git a/scripts/install-dev-fast.sh b/scripts/install-dev-fast.sh
index d3beb422a..125626780 100755
--- a/scripts/install-dev-fast.sh
+++ b/scripts/install-dev-fast.sh
@@ -17,9 +17,18 @@ MOLD_RELEASE_BASE_URL=${MOLD_RELEASE_BASE_URL:-https://github.com/rui314/mold/re
 # Verify the downloaded tarball against the single matching line in
 # SHA256SUMS. An unlisted artefact is a hard failure, never a silent skip.
 verify_mold_archive() {
-  local archive=$1 name=$2 expected
+  local archive=$1 name=$2 expected recorded
   expected=$(awk -v name="$name" '$2 == name { print $1 }' "$MOLD_SHA256SUMS_FILE")
   [ -n "$expected" ] || fail "no checksum recorded for $name in $MOLD_SHA256SUMS_FILE"
+  # Refuse an ambiguous file rather than guessing. Several rows for one artefact
+  # make `expected` multi-line, and the check below would then hand `sha256sum`
+  # one malformed line per extra digest plus a single well-formed one. Malformed
+  # lines are only warned about, so the verdict would silently rest on whichever
+  # digest happened to come last — a file recording a wrong digest alongside the
+  # right one would verify.
+  recorded=$(printf '%s\n' "$expected" | grep -c .)
+  [ "$recorded" -eq 1 ] ||
+    fail "$recorded checksums recorded for $name in $MOLD_SHA256SUMS_FILE; refusing to guess"
   printf '%s  %s\n' "$expected" "$archive" | sha256sum --check --status ||
     fail "checksum mismatch for $name; refusing to install"
   note "verified $name against $MOLD_SHA256SUMS_FILE"
diff --git a/tests/dev_fast_install_tests.proptest-regressions b/tests/dev_fast_install_tests.proptest-regressions
new file mode 100644
index 000000000..cbcd0175a
--- /dev/null
+++ b/tests/dev_fast_install_tests.proptest-regressions
@@ -0,0 +1,7 @@
+# Seeds for failure cases proptest has generated in the past. It is
+# automatically read and these particular cases re-run before any
+# novel cases are generated.
+#
+# It is recommended to check this file in to source control so that
+# everyone who runs the test benefits from these saved cases.
+cc 39afa002e740912843c3a4d7702ae68f00b99fab91d2059392f008404d1026e6 # shrinks to rows = [Row { digest: Wrong, named: ThisArtefact, padded: false }, Row { digest: Real, named: ThisArtefact, padded: false }]
diff --git a/tests/dev_fast_install_tests.rs b/tests/dev_fast_install_tests.rs
index 21e0dd699..7e2be48b5 100644
--- a/tests/dev_fast_install_tests.rs
+++ b/tests/dev_fast_install_tests.rs
@@ -300,7 +300,155 @@ fn is_timing(cell: &str) -> bool {
         && fraction.chars().all(|c| c.is_ascii_digit())
 }
 
+/// How one recorded digest relates to the artefact's real one.
+#[derive(Copy, Clone, Debug)]
+enum Digest {
+    /// The artefact's own digest, verbatim.
+    Real,
+    /// The same digest upper-cased. `sha256sum` compares hex case-insensitively,
+    /// so this still verifies — established by probing the tool rather than
+    /// assumed.
+    RealUpperCased,
+    /// A well-formed digest belonging to nothing.
+    Wrong,
+    /// The real digest with its tail removed.
+    Truncated,
+}
+
+/// Which artefact a checksum row names.
+#[derive(Copy, Clone, Debug)]
+enum Named {
+    ThisArtefact,
+    Other,
+}
+
+/// One row of a checksum file.
+#[derive(Copy, Clone, Debug)]
+struct Row {
+    digest: Digest,
+    named: Named,
+    /// Surrounding whitespace, which the installer's `awk` field split ignores.
+    padded: bool,
+}
+
+impl Row {
+    fn render(self, real: &str, artefact: &str) -> String {
+        let digest = match self.digest {
+            Digest::Real => real.to_owned(),
+            Digest::RealUpperCased => real.to_uppercase(),
+            Digest::Wrong => WRONG_SHA256.to_owned(),
+            // `get` rather than a bare range: the digest is ASCII hex, but a
+            // panicking slice has no place in a model oracle.
+            Digest::Truncated => real
+                .get(..real.len().saturating_sub(4))
+                .unwrap_or_default()
+                .to_owned(),
+        };
+        let name = match self.named {
+            Named::ThisArtefact => artefact,
+            Named::Other => "mold-0.0.0-x86_64-linux.tar.gz",
+        };
+        if self.padded {
+            format!("   {digest}   {name}   \n")
+        } else {
+            format!("{digest}  {name}\n")
+        }
+    }
+}
+
+/// The installer must unpack exactly when the file records this artefact
+/// exactly once, under the artefact's real digest.
+///
+/// This is a model, not a lookup table: it predicts the outcome for row lists
+/// nobody enumerated. Requiring a single row is deliberate — several rows for
+/// one artefact are ambiguous, and the installer refuses rather than picking
+/// one. Case is not significant, because `sha256sum` compares hex
+/// case-insensitively.
+fn model_installs(rows: &[Row]) -> bool {
+    let mut selected = rows
+        .iter()
+        .filter(|row| matches!(row.named, Named::ThisArtefact));
+    let Some(only) = selected.next() else {
+        return false;
+    };
+    selected.next().is_none() && matches!(only.digest, Digest::Real | Digest::RealUpperCased)
+}
+
+fn digest_strategy() -> impl Strategy<Value = Digest> {
+    prop_oneof![
+        Just(Digest::Real),
+        Just(Digest::RealUpperCased),
+        Just(Digest::Wrong),
+        Just(Digest::Truncated),
+    ]
+}
+
+fn row_strategy() -> impl Strategy<Value = Row> {
+    (
+        digest_strategy(),
+        prop_oneof![Just(Named::ThisArtefact), Just(Named::Other)],
+        any::<bool>(),
+    )
+        .prop_map(|(digest, named, padded)| Row {
+            digest,
+            named,
+            padded,
+        })
+}
+
 proptest! {
+    // Each case runs the installer, so keep the corpus small enough to stay a
+    // second or two while still ranging over the row space.
+    #![proptest_config(ProptestConfig { cases: 24, ..ProptestConfig::default() })]
+
+    /// Whatever rows a checksum file carries, the installer's decision must
+    /// match the model, and a refusal must leave nothing unpacked.
+    ///
+    /// Random digests alone would be uninformative — they never match — so the
+    /// strategy ranges over the structural relationships instead: right digest,
+    /// wrong digest, truncated, re-cased, another artefact's, duplicated, and
+    /// whitespace-padded.
+    #[test]
+    fn the_installer_verifies_exactly_when_the_model_says_it_should(
+        rows in prop::collection::vec(row_strategy(), 0..4)
+    ) {
+        let scenario = InstallerScenario::prepare()
+            .map_err(|error| TestCaseError::fail(error.to_string()))?;
+        let real = scenario.release.sha256().to_owned();
+        let artefact = scenario.release.name().to_owned();
+        let contents: String = rows.iter().map(|row| row.render(&real, &artefact)).collect();
+
+        let checksums = scenario.sandbox.home().join("SHA256SUMS");
+        scenario
+            .sandbox
+            .write_file(&checksums, &contents)
+            .map_err(|error| TestCaseError::fail(error.to_string()))?;
+        let fixture = scenario
+            .fixture(checksums)
+            .map_err(|error| TestCaseError::fail(error.to_string()))?;
+
+        let output = scenario
+            .sandbox
+            .script("install-dev-fast.sh", &fixture.script_env())
+            .map_err(|error| TestCaseError::fail(error.to_string()))?;
+
+        let expected = model_installs(&rows);
+        prop_assert_eq!(
+            output.status.success(),
+            expected,
+            "rows {:?} should {} install, got `{}`",
+            rows,
+            if expected { "" } else { "not" },
+            combined(&output)
+        );
+        prop_assert_eq!(
+            scenario.installed_mold().as_std_path().exists(),
+            expected,
+            "unpacked state should follow the verification decision for {:?}",
+            rows
+        );
+    }
+
     /// A timing cell is exactly `<digits>.<digits>`. Generating around that
     /// shape covers the malformed neighbours — bare dots, multiple points, a
     /// missing side — that a hand-picked example list tends to miss.
diff --git a/tests/dev_fast_make_target_tests.proptest-regressions b/tests/dev_fast_make_target_tests.proptest-regressions
new file mode 100644
index 000000000..ec5567f1c
--- /dev/null
+++ b/tests/dev_fast_make_target_tests.proptest-regressions
@@ -0,0 +1,7 @@
+# Seeds for failure cases proptest has generated in the past. It is
+# automatically read and these particular cases re-run before any
+# novel cases are generated.
+#
+# It is recommended to check this file in to source control so that
+# everyone who runs the test benefits from these saved cases.
+cc ad43f0949681499ca164d1f904a334a4ca95bb55c4030679ea31694066d56452 # shrinks to default_pre = Absent, dev_fast_pre = Empty
diff --git a/tests/dev_fast_make_target_tests.rs b/tests/dev_fast_make_target_tests.rs
index b7913711a..7a70657e0 100644
--- a/tests/dev_fast_make_target_tests.rs
+++ b/tests/dev_fast_make_target_tests.rs
@@ -13,6 +13,8 @@
 
 use anyhow::{Context, Result, bail, ensure};
 use camino::{Utf8Path, Utf8PathBuf};
+use proptest::prelude::*;
+use proptest::proptest;
 use rstest::rstest;
 use std::time::{Duration, UNIX_EPOCH};
 use test_support::dev_fast::{
@@ -360,6 +362,94 @@ fn check_touch_ordering(invocations: &[CargoInvocation], baseline_mtime: i64) ->
     Ok(())
 }
 
+/// What a variant's target directory holds before the benchmark starts.
+#[derive(Copy, Clone, Debug)]
+enum PreState {
+    /// Nothing there, as on a first run.
+    Absent,
+    /// The directory exists but is empty.
+    Empty,
+    /// The directory exists and holds an artefact from an earlier run.
+    Populated,
+}
+
+impl PreState {
+    fn stage(self, sandbox: &Sandbox, dir: &Utf8Path) -> Result<()> {
+        match self {
+            Self::Absent => Ok(()),
+            Self::Empty => sandbox.create_dir(dir),
+            Self::Populated => sandbox.write_file(&dir.join("stale-artefact"), "stale"),
+        }
+    }
+}
+
+fn pre_state_strategy() -> impl Strategy<Value = PreState> {
+    prop_oneof![
+        Just(PreState::Absent),
+        Just(PreState::Empty),
+        Just(PreState::Populated),
+    ]
+}
+
+proptest! {
+    // Nine combinations; a few extra draws cost little because the fake Cargo
+    // returns immediately.
+    #![proptest_config(ProptestConfig { cases: 12, ..ProptestConfig::default() })]
+
+    /// Whatever each variant's target directory held beforehand, every variant
+    /// must record a clean pass then an incremental one.
+    ///
+    /// This is the invariant the `rm -rf` exists to provide: the benchmark's
+    /// first measurement must not inherit a previous run's artefacts, or the
+    /// "clean build" column measures something else entirely. Ranging over the
+    /// prior states shows the wipe erases history rather than merely working on
+    /// an empty sandbox.
+    #[test]
+    fn the_benchmark_wipes_whatever_each_variant_started_from(
+        default_pre in pre_state_strategy(),
+        dev_fast_pre in pre_state_strategy(),
+    ) {
+        let fail = |error: anyhow::Error| TestCaseError::fail(error.to_string());
+        let scenario = BuildScenario::prepare().map_err(fail)?;
+        let sandbox = &scenario.sandbox;
+
+        let touch_file = sandbox.home().join("bench-touch");
+        write_with_old_mtime(sandbox, &touch_file).map_err(fail)?;
+        let bench_root = sandbox.home().join("bench");
+        for (slug, pre) in [(DEFAULT_SLUG, default_pre), (DEV_FAST_SLUG, dev_fast_pre)] {
+            pre.stage(sandbox, &bench_root.join(slug)).map_err(fail)?;
+        }
+
+        let invocation = MakeInvocation::new("bench-build")
+            .variable("CARGO", scenario.cargo.executable())
+            .environment("BENCH_ROOT", &bench_root)
+            .environment("BENCH_TOUCH_FILE", &touch_file);
+        let output = sandbox.run_make(&invocation).map_err(fail)?;
+        prop_assert!(
+            output.status.success(),
+            "bench-build should succeed from {:?}/{:?}, got `{}`",
+            default_pre,
+            dev_fast_pre,
+            combined(&output)
+        );
+
+        let invocations = scenario.cargo.invocations().map_err(fail)?;
+        let states: Vec<TargetState> = invocations.iter().map(CargoInvocation::target_state).collect();
+        prop_assert_eq!(
+            states,
+            vec![
+                TargetState::Absent,
+                TargetState::Present,
+                TargetState::Absent,
+                TargetState::Present,
+            ],
+            "each variant should measure a clean then an incremental pass, from {:?}/{:?}",
+            default_pre,
+            dev_fast_pre
+        );
+    }
+}
+
 #[test]
 fn bench_target_emits_both_variant_rows() -> Result<()> {
     let scenario = BuildScenario::prepare()?;

From a7fc19760e51a7b48b433d82253eee9b9b5cacbb Mon Sep 17 00:00:00 2001
From: leynos <leynos@troubledskies.net>
Date: Sun, 2 Aug 2026 14:03:44 +0200
Subject: [PATCH 18/24] Reject malformed pins, fail on drift, and split by
 feature
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Five review findings; the two the wyverns re-scoped are noted below.

`read_pin` deleted every whitespace character, which corrupted rather
than rejected: a stray space turned `1.2 3` into `1.23`, and a second
line concatenated into `1.2.34.5.6`, either of which would have reached
the download URL looking well-formed. It now trims only the boundaries
and refuses a multi-line or internally-spaced pin outright.

A mold that differs from the pin now fails the check instead of warning.
An advisory pin is not a pin: tolerating drift means the linker actually
used, and so the benchmark figures, stop matching what the repository
claims. `make install-dev-fast` puts the pinned release ahead of a
distribution one on PATH, so the remedy is one command. Two tests that
asserted drift was tolerated are inverted, and `dev-build` and
`dev-test` are shown to record zero Cargo invocations after it.

The guide's ownership boundary still forbade a repository-root
`.cargo/config.toml`, which `main` has since added for the Polonius
flag — and which the same guide acknowledged twenty lines later. The
rule is about what belongs in that file, not whether it may exist.

The test-file bullet list credited `dev_fast_check_tests.rs` with the
zero-Cargo-invocation guarantee, which lives in the Make-target tests.
Corrected along with the reorganisation below.

`dev_fast_make_target_tests.rs` was 564 lines against a 400-line cap.
Split by feature into Make-recipe contracts and benchmark coverage. The
wyverns also found `dev_fast_install_tests.rs` over at 523 — not in the
review, but I put it there, so its checksum model moves out too. All
five test files and the support modules now fit. `BuildScenario` moves
into `test_support` rather than being duplicated, since both halves of
the split need it.

The review placed `check_mold` in the Makefile; it is in
`scripts/dev-fast-check.sh`. Stale comments there still described drift
as tolerated, so they are corrected too.
---
 docs/developers-guide.md              |  64 +++--
 scripts/dev-fast-check.sh             |  21 +-
 scripts/dev-fast-common.sh            |  25 +-
 test_support/src/dev_fast/mod.rs      |   2 +
 test_support/src/dev_fast/scenario.rs |  59 ++++
 tests/dev_fast_bench_tests.rs         | 339 ++++++++++++++++++++++
 tests/dev_fast_check_tests.rs         |  84 +++++-
 tests/dev_fast_checksum_tests.rs      | 220 +++++++++++++++
 tests/dev_fast_install_tests.rs       | 148 ----------
 tests/dev_fast_make_target_tests.rs   | 390 +++-----------------------
 10 files changed, 802 insertions(+), 550 deletions(-)
 create mode 100644 test_support/src/dev_fast/scenario.rs
 create mode 100644 tests/dev_fast_bench_tests.rs
 create mode 100644 tests/dev_fast_checksum_tests.rs

diff --git a/docs/developers-guide.md b/docs/developers-guide.md
index 88058a60d..9eac3b54b 100644
--- a/docs/developers-guide.md
+++ b/docs/developers-guide.md
@@ -426,9 +426,12 @@ puts `~/.local/bin` first unconditionally. Invoking the scripts directly rather
 than through `make` means arranging that `PATH` order yourself.
 
 `make dev-fast-check` prints the resolved `mold` path alongside its version, so
-an unexpected pick is visible. It treats a version that differs from the pin as
-a warning and still proceeds, because a newer `mold` is normally harmless. A
-missing `mold`, or one that cannot report its version, is a hard failure.
+an unexpected pick is visible. A version that differs from the pin fails the
+check, as does a missing `mold` or one that cannot report its version; run
+`make install-dev-fast` to install the pinned release ahead of any
+distribution `mold` on `PATH`. An advisory pin is not a pin: tolerating drift
+would let the linker actually in use stop matching what the repository
+claims.
 
 For screen readers: the following flowchart traces `make install-dev-fast` from
 start to exit. It reads the pinned linker version, then branches on the host
@@ -474,17 +477,25 @@ themselves.
 ### Ownership boundary
 
 The accelerated configuration lives in `tools/dev-fast/config.toml`, which is
-deliberately *not* `.cargo/config.toml`. Cargo auto-discovers the latter, and
-placing these settings there would silently apply nightly-only unstable flags
-and a Linux-only linker choice to every build in the repository, including CI.
-The fragment is instead passed explicitly with
-`cargo --config tools/dev-fast/config.toml` from the `make dev-*` targets. Do
-not add a repository-root `.cargo/config.toml`, and do not source this fragment
-from any target that CI invokes.
-
-The fragment sets three things and nothing else: the `codegen-backend` unstable
-flag, `codegen-backend = "cranelift"` on the `dev` profile, and a
-`-Clink-arg=-fuse-ld=mold` rustflag gated behind `cfg(target_os = "linux")`.
+deliberately *not* `.cargo/config.toml`. Cargo auto-discovers the latter, so
+placing Cranelift and the Linux-only `mold` linker there would silently apply
+them to every build in the repository, including release, packaging,
+coverage, and formal-verification builds. The fragment is instead passed
+explicitly with `cargo --config tools/dev-fast/config.toml` from the
+`make dev-*` targets, and must not be sourced from any target that CI
+invokes.
+
+A repository-root `.cargo/config.toml` does exist, and legitimately so: it
+carries the Polonius flag (`[build] rustflags = ["-Zpolonius=next"]`, see
+Polonius under Composition rules) needed by every build in the repository.
+The rule is about what belongs in that file, not about whether it may exist:
+settings needed everywhere may go there; settings that are only safe for the
+accelerated dev loop must not.
+
+The fragment sets the `codegen-backend` unstable flag, `codegen-backend =
+"cranelift"` on the `dev` profile, and a `cfg(target_os = "linux")`-gated
+rustflags list carrying both `-Zpolonius=next` and
+`-Clink-arg=-fuse-ld=mold`.
 
 ### Composition rules
 
@@ -555,22 +566,23 @@ flag, `codegen-backend = "cranelift"` on the `dev` profile, and a
 
 ### Testing the tooling
 
-Three suites cover the tooling's observable behaviour. All are hermetic — no
+Five suites cover the tooling's observable behaviour. All are hermetic — no
 network, and no real `mold`, `rustup`, or Cargo — so they run as part of
 `make test` on any Linux host.
 
 - `tests/dev_fast_check_tests.rs`: the capability gate. Which diagnostic each
-  failure mode emits, and that `dev-build` and `dev-test` stop before Cargo
-  runs.
-- `tests/dev_fast_install_tests.rs`: the installer and benchmark scripts,
-  invoked directly. Verification against a locally built release, and the
-  refusal to unpack an artefact whose checksum mismatches or is unlisted.
-- `tests/dev_fast_make_target_tests.rs`: the Make recipes' success paths. That
-  `dev-build` and `dev-test` select the pinned nightly, pass
-  `--config tools/dev-fast/config.toml`, run the expected Cargo subcommand, and
-  lead `PATH` with the install prefix; that `install-dev-fast` forwards the
-  prefix, pin overrides, and release URL; and that `bench-build` emits both
-  variant rows.
+  failure mode emits, exit status, pin resolution, and refusal of a
+  malformed pin.
+- `tests/dev_fast_install_tests.rs`: the installer's happy path and its
+  refusals, plus the benchmark script's Markdown output.
+- `tests/dev_fast_checksum_tests.rs`: property coverage for checksum
+  verification against a model.
+- `tests/dev_fast_make_target_tests.rs`: the Make recipes. Toolchain and
+  fragment selection; that a failed gate reaches zero Cargo invocations
+  (`dev-build` and `dev-test` stop before Cargo runs); the fragment's
+  contents; and `install-dev-fast` forwarding.
+- `tests/dev_fast_bench_tests.rs`: `make bench-build`. Per-variant target
+  directories, the clean/incremental cycle, and both variant rows.
 
 The fixtures live in `test_support::dev_fast`:
 
diff --git a/scripts/dev-fast-check.sh b/scripts/dev-fast-check.sh
index 02734e69a..c0b7450bd 100755
--- a/scripts/dev-fast-check.sh
+++ b/scripts/dev-fast-check.sh
@@ -4,7 +4,7 @@
 # Runs before `make dev-build` and `make dev-test` so a missing tool produces an
 # actionable installation hint rather than an opaque codegen-backend or linker
 # failure deep inside a Cargo invocation. Exits non-zero when a required
-# component is absent; a version drift from the pin is reported but tolerated.
+# component is absent, unusable, or does not match its pin.
 
 set -euo pipefail
 
@@ -12,9 +12,9 @@ script_dir=$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)
 # shellcheck source=scripts/dev-fast-common.sh
 . "$script_dir/dev-fast-common.sh"
 
-# Report on the linker half of the prerequisites. Returns non-zero only when
-# mold is required but unusable; a non-Linux host and a version drift from the
-# pin are both tolerated, with a note explaining what will happen instead.
+# Report on the linker half of the prerequisites. Returns non-zero when mold is
+# required but missing, unusable, or a different version from the pin. Only a
+# non-Linux host is tolerated, with a note explaining what is used instead.
 check_mold() {
   local pinned=$1 installed resolved
   if ! is_linux; then
@@ -36,11 +36,18 @@ check_mold() {
   fi
   # Report the resolved path, not just the version: `-fuse-ld=mold` selects by
   # PATH order, so naming the winner makes an unexpected pick obvious.
+  #
+  # A drift from the pin fails rather than warns. An advisory pin is not a pin:
+  # tolerating it means the linker actually used, and so the benchmark figures
+  # and any linker-specific behaviour, silently stop matching what the
+  # repository claims. `make install-dev-fast` puts the pinned release ahead of
+  # a distribution one on PATH, so the remedy is a single command.
   if [ "$installed" != "$pinned" ]; then
-    note "mold $installed at $resolved, pin is $pinned; run make install-dev-fast to match"
-  else
-    note "mold $installed at $resolved"
+    note "mold $installed at $resolved does not match the pin $pinned"
+    note 'run make install-dev-fast to match'
+    return 1
   fi
+  note "mold $installed at $resolved"
 }
 
 # Report on the toolchain half of the prerequisites: rustup itself, the pinned
diff --git a/scripts/dev-fast-common.sh b/scripts/dev-fast-common.sh
index 82d3711e4..5ce64eea5 100644
--- a/scripts/dev-fast-common.sh
+++ b/scripts/dev-fast-common.sh
@@ -44,14 +44,29 @@ fail() {
   exit 1
 }
 
-# Read a single-line version pin, trimming surrounding whitespace. A missing or
-# blank pin aborts rather than yielding an empty version that would silently
-# produce a nonsensical download URL or toolchain name.
+# Read a single-line version pin, trimming only its leading and trailing
+# whitespace.
+#
+# A missing, blank, or multi-line pin aborts rather than yielding a version that
+# would silently produce a nonsensical download URL. Deleting every whitespace
+# character instead would corrupt rather than reject: a stray space would turn
+# `1.2 3` into `1.23`, and a second line would concatenate into `1.2.34.5.6`.
+# Internal whitespace is likewise rejected, because no pin legitimately contains
+# any and silently rewriting one is worse than refusing it.
 read_pin() {
-  local file=$1 value
+  local file=$1 value lines
   [ -f "$file" ] || fail "missing version pin: $file"
-  value=$(tr -d '[:space:]' <"$file")
+  lines=$(grep -c '' <"$file")
+  [ "$lines" -le 1 ] || fail "expected one line in version pin: $file, found $lines"
+  # `$(...)` strips trailing newlines; the parameter expansions trim spaces and
+  # tabs from each end without touching anything between them.
+  value=$(cat -- "$file")
+  value=${value#"${value%%[![:space:]]*}"}
+  value=${value%"${value##*[![:space:]]}"}
   [ -n "$value" ] || fail "empty version pin: $file"
+  case $value in
+    *[[:space:]]*) fail "version pin contains whitespace: $file" ;;
+  esac
   printf '%s' "$value"
 }
 
diff --git a/test_support/src/dev_fast/mod.rs b/test_support/src/dev_fast/mod.rs
index 8774b04a4..a088250f1 100644
--- a/test_support/src/dev_fast/mod.rs
+++ b/test_support/src/dev_fast/mod.rs
@@ -30,6 +30,7 @@ mod cargo_log;
 mod make;
 mod release;
 mod sandbox;
+mod scenario;
 
 pub use cargo_log::{CargoInvocation, RecordingCargo, TargetState};
 pub use make::MakeInvocation;
@@ -38,3 +39,4 @@ pub use sandbox::{
     DEV_FAST_CONFIG_PATH, PinOverrides, Sandbox, combined, dev_fast_config, pinned_mold_version,
     pinned_toolchain,
 };
+pub use scenario::BuildScenario;
diff --git a/test_support/src/dev_fast/scenario.rs b/test_support/src/dev_fast/scenario.rs
new file mode 100644
index 000000000..772a83b86
--- /dev/null
+++ b/test_support/src/dev_fast/scenario.rs
@@ -0,0 +1,59 @@
+//! A sandbox with every `dev-fast` prerequisite satisfied.
+//!
+//! Shared because both the Make-recipe tests and the benchmark tests need the
+//! same starting point: a pinned `mold` on the install prefix, a `rustup` that
+//! reports the Cranelift component, and a recording Cargo standing in for the
+//! real one.
+
+use anyhow::{Result, ensure};
+use camino::Utf8PathBuf;
+
+use super::{
+    CargoInvocation, MakeInvocation, RecordingCargo, Sandbox, combined, pinned_mold_version,
+    pinned_toolchain,
+};
+
+/// A sandbox whose prerequisites all pass, with a recording `cargo` installed.
+pub struct BuildScenario {
+    sandbox: Sandbox,
+    cargo: RecordingCargo,
+}
+
+impl BuildScenario {
+    /// Stage a sandbox in which `dev-fast-check` passes.
+    pub fn prepare() -> Result<Self> {
+        let sandbox = Sandbox::new()?;
+        sandbox.write_mold(&sandbox.prefix().join("bin"), &pinned_mold_version()?)?;
+        sandbox.write_rustup(&pinned_toolchain()?, true)?;
+        let cargo = RecordingCargo::install(&sandbox)?;
+        Ok(Self { sandbox, cargo })
+    }
+
+    /// The sandbox the scenario runs in.
+    pub fn sandbox(&self) -> &Sandbox {
+        &self.sandbox
+    }
+
+    /// The recording Cargo standing in for the real one.
+    pub fn cargo(&self) -> &RecordingCargo {
+        &self.cargo
+    }
+
+    /// The install prefix's `bin`, which the `dev-*` recipes lead `PATH` with.
+    pub fn prefix_bin(&self) -> Utf8PathBuf {
+        self.sandbox.prefix().join("bin")
+    }
+
+    /// Run `target`, pointing `CARGO` at the recording fake, and return the
+    /// single invocation it must have produced.
+    pub fn run(&self, target: &str) -> Result<CargoInvocation> {
+        let invocation = MakeInvocation::new(target).variable("CARGO", self.cargo.executable());
+        let output = self.sandbox.run_make(&invocation)?;
+        ensure!(
+            output.status.success(),
+            "make {target} should succeed, got `{}`",
+            combined(&output)
+        );
+        self.cargo.sole_invocation()
+    }
+}
diff --git a/tests/dev_fast_bench_tests.rs b/tests/dev_fast_bench_tests.rs
new file mode 100644
index 000000000..4006a82ea
--- /dev/null
+++ b/tests/dev_fast_bench_tests.rs
@@ -0,0 +1,339 @@
+//! Behavioural tests for `make bench-build`.
+//!
+//! The benchmark's job is to produce comparable figures, so what these tests
+//! pin down is comparability: each variant measures in its own target
+//! directory, a clean pass really starts from nothing, and the incremental pass
+//! that follows really is incremental. A fake `cargo` records the target
+//! directory and whether it already existed, which makes those facts checkable
+//! rather than assumed.
+//!
+//! Timings themselves are never asserted — only their format. Every case is
+//! hermetic: no network, and no real mold, rustup, or Cargo.
+
+#![cfg(all(unix, target_os = "linux"))]
+
+use anyhow::{Context, Result, bail, ensure};
+use camino::{Utf8Path, Utf8PathBuf};
+use proptest::prelude::*;
+use proptest::proptest;
+use std::time::{Duration, UNIX_EPOCH};
+use test_support::dev_fast::{
+    BuildScenario, CargoInvocation, DEV_FAST_CONFIG_PATH, MakeInvocation, Sandbox, TargetState,
+    combined, pinned_toolchain,
+};
+
+/// Timestamp stamped on the benchmark's touch file before the run, chosen far
+/// enough in the past that any `touch` is unambiguously newer. Comparing
+/// against a fixed baseline keeps the assertion deterministic, where comparing
+/// the two passes to each other would depend on filesystem timestamp
+/// granularity.
+const BASELINE_MTIME: i64 = 1_600_000_000;
+
+/// Target-directory slugs the benchmark uses, one per variant.
+const DEFAULT_SLUG: &str = "default";
+const DEV_FAST_SLUG: &str = "dev-fast";
+
+/// Create the touch file with [`BASELINE_MTIME`], returning that timestamp.
+fn write_with_old_mtime(sandbox: &Sandbox, path: &Utf8Path) -> Result<i64> {
+    let baseline = UNIX_EPOCH + Duration::from_secs(BASELINE_MTIME.unsigned_abs());
+    sandbox.write_file_with_mtime(path, "", baseline)?;
+    Ok(BASELINE_MTIME)
+}
+
+/// The disposable inputs one benchmark run needs.
+///
+/// Named fields rather than a returned tuple: `root` and `touch_file` are both
+/// paths, so positional returns could be transposed at the call site without
+/// the compiler noticing.
+struct BenchFixture {
+    /// Benchmark root; each variant gets its own target directory beneath it.
+    root: Utf8PathBuf,
+    /// The file the benchmark touches between a variant's two passes.
+    touch_file: Utf8PathBuf,
+    /// The touch file's timestamp before the run, for ordering assertions.
+    baseline_mtime: i64,
+}
+
+/// Stage a benchmark run's disposable inputs.
+///
+/// The touch file stands in for `src/main.rs`, so a run does not invalidate the
+/// working tree's build cache. Both target directories are seeded to model a
+/// re-run: on a fresh sandbox the benchmark's `rm -rf` would be
+/// indistinguishable from doing nothing, and the clean-pass assertion would
+/// hold vacuously.
+fn prepare_bench_fixture(scenario: &BuildScenario) -> Result<BenchFixture> {
+    let sandbox = scenario.sandbox();
+    let touch_file = sandbox.home().join("bench-touch");
+    let baseline_mtime = write_with_old_mtime(sandbox, &touch_file)?;
+
+    let root = sandbox.home().join("bench");
+    for slug in [DEFAULT_SLUG, DEV_FAST_SLUG] {
+        sandbox.create_dir(&root.join(slug))?;
+    }
+    Ok(BenchFixture {
+        root,
+        touch_file,
+        baseline_mtime,
+    })
+}
+
+/// Check the recorded passes: their count and pairing, each variant's own
+/// contract, that the variants measured separately, and where each pass sits
+/// relative to the touch.
+fn check_benchmark_invocations(invocations: &[CargoInvocation], baseline_mtime: i64) -> Result<()> {
+    // Four builds: clean and incremental, for each of the two variants.
+    ensure!(
+        invocations.len() == 4,
+        "should measure two builds per variant, recorded {}",
+        invocations.len()
+    );
+
+    // The benchmark measures the default variant first, then the accelerated
+    // one, each as a clean pass followed by an incremental pass.
+    let (pairs, rest) = invocations.as_chunks::<2>();
+    ensure!(
+        rest.is_empty(),
+        "passes should come in pairs, got {} spare",
+        rest.len()
+    );
+    let [default_chunk, dev_fast_chunk] = pairs else {
+        bail!("expected one pair per variant, got {}", pairs.len());
+    };
+    let default_pass = BenchVariant::from_pair(DEFAULT_SLUG, default_chunk, false);
+    let dev_fast_pass = BenchVariant::from_pair(DEV_FAST_SLUG, dev_fast_chunk, true);
+    for variant in [&default_pass, &dev_fast_pass] {
+        variant.check(&pinned_toolchain()?)?;
+    }
+
+    ensure!(
+        default_pass.target_dir() != dev_fast_pass.target_dir(),
+        "variants must not share a target directory, got `{}` and `{}`",
+        default_pass.target_dir(),
+        dev_fast_pass.target_dir()
+    );
+
+    check_touch_ordering(invocations, baseline_mtime)
+}
+
+/// Only the very first pass runs before any touch; each variant touches the
+/// file between its own two passes, so every later pass must see a newer
+/// timestamp. Comparing against a backdated baseline rather than between passes
+/// keeps this free of filesystem timestamp granularity.
+fn check_touch_ordering(invocations: &[CargoInvocation], baseline_mtime: i64) -> Result<()> {
+    let first = invocations.first().context("expected a recorded pass")?;
+    ensure!(
+        first.touch_mtime() == Some(baseline_mtime),
+        "the first clean pass should precede any touch, got {:?}",
+        first.touch_mtime()
+    );
+    for (index, pass) in invocations.iter().enumerate().skip(1) {
+        ensure!(
+            pass.touch_mtime()
+                .is_some_and(|mtime| mtime > baseline_mtime),
+            "pass {index} should follow a touch, got {:?}",
+            pass.touch_mtime()
+        );
+    }
+    Ok(())
+}
+
+/// What a variant's target directory holds before the benchmark starts.
+#[derive(Copy, Clone, Debug)]
+enum PreState {
+    /// Nothing there, as on a first run.
+    Absent,
+    /// The directory exists but is empty.
+    Empty,
+    /// The directory exists and holds an artefact from an earlier run.
+    Populated,
+}
+
+impl PreState {
+    fn stage(self, sandbox: &Sandbox, dir: &Utf8Path) -> Result<()> {
+        match self {
+            Self::Absent => Ok(()),
+            Self::Empty => sandbox.create_dir(dir),
+            Self::Populated => sandbox.write_file(&dir.join("stale-artefact"), "stale"),
+        }
+    }
+}
+
+fn pre_state_strategy() -> impl Strategy<Value = PreState> {
+    prop_oneof![
+        Just(PreState::Absent),
+        Just(PreState::Empty),
+        Just(PreState::Populated),
+    ]
+}
+
+proptest! {
+    // Nine combinations; a few extra draws cost little because the fake Cargo
+    // returns immediately.
+    #![proptest_config(ProptestConfig { cases: 12, ..ProptestConfig::default() })]
+
+    /// Whatever each variant's target directory held beforehand, every variant
+    /// must record a clean pass then an incremental one.
+    ///
+    /// This is the invariant the `rm -rf` exists to provide: the benchmark's
+    /// first measurement must not inherit a previous run's artefacts, or the
+    /// "clean build" column measures something else entirely. Ranging over the
+    /// prior states shows the wipe erases history rather than merely working on
+    /// an empty sandbox.
+    #[test]
+    fn the_benchmark_wipes_whatever_each_variant_started_from(
+        default_pre in pre_state_strategy(),
+        dev_fast_pre in pre_state_strategy(),
+    ) {
+        let fail = |error: anyhow::Error| TestCaseError::fail(error.to_string());
+        let scenario = BuildScenario::prepare().map_err(fail)?;
+        let sandbox = scenario.sandbox();
+
+        let touch_file = sandbox.home().join("bench-touch");
+        write_with_old_mtime(sandbox, &touch_file).map_err(fail)?;
+        let bench_root = sandbox.home().join("bench");
+        for (slug, pre) in [(DEFAULT_SLUG, default_pre), (DEV_FAST_SLUG, dev_fast_pre)] {
+            pre.stage(sandbox, &bench_root.join(slug)).map_err(fail)?;
+        }
+
+        let invocation = MakeInvocation::new("bench-build")
+            .variable("CARGO", scenario.cargo().executable())
+            .environment("BENCH_ROOT", &bench_root)
+            .environment("BENCH_TOUCH_FILE", &touch_file);
+        let output = sandbox.run_make(&invocation).map_err(fail)?;
+        prop_assert!(
+            output.status.success(),
+            "bench-build should succeed from {:?}/{:?}, got `{}`",
+            default_pre,
+            dev_fast_pre,
+            combined(&output)
+        );
+
+        let invocations = scenario.cargo().invocations().map_err(fail)?;
+        let states: Vec<TargetState> = invocations.iter().map(CargoInvocation::target_state).collect();
+        prop_assert_eq!(
+            states,
+            vec![
+                TargetState::Absent,
+                TargetState::Present,
+                TargetState::Absent,
+                TargetState::Present,
+            ],
+            "each variant should measure a clean then an incremental pass, from {:?}/{:?}",
+            default_pre,
+            dev_fast_pre
+        );
+    }
+}
+
+#[test]
+fn bench_target_emits_both_variant_rows() -> Result<()> {
+    let scenario = BuildScenario::prepare()?;
+    let fixture = prepare_bench_fixture(&scenario)?;
+
+    let invocation = MakeInvocation::new("bench-build")
+        .variable("CARGO", scenario.cargo().executable())
+        .environment("BENCH_ROOT", &fixture.root)
+        .environment("BENCH_TOUCH_FILE", &fixture.touch_file);
+    let output = scenario.sandbox().run_make(&invocation)?;
+    let stdout = String::from_utf8_lossy(&output.stdout);
+
+    ensure!(
+        output.status.success(),
+        "make bench-build should succeed, got `{}`",
+        combined(&output)
+    );
+    for variant in [
+        "| Default (LLVM, platform linker) |",
+        "| dev-fast (Cranelift,",
+    ] {
+        ensure!(
+            stdout.contains(variant),
+            "table should carry the `{variant}` row, got `{stdout}`"
+        );
+    }
+
+    check_benchmark_invocations(&scenario.cargo().invocations()?, fixture.baseline_mtime)
+}
+
+/// One variant's pair of recorded builds: the clean pass then the incremental.
+struct BenchVariant<'a> {
+    label: &'a str,
+    clean: &'a CargoInvocation,
+    incremental: &'a CargoInvocation,
+    /// Whether this variant is the accelerated one, which alone carries the
+    /// Cranelift fragment and the pinned toolchain.
+    expects_fragment: bool,
+}
+
+impl<'a> BenchVariant<'a> {
+    /// Build a descriptor from the variant's recorded pair of passes.
+    ///
+    /// The fixed-size array makes the pairing a type-level fact, so there is no
+    /// absent-pass case left to handle at runtime.
+    const fn from_pair(
+        label: &'a str,
+        [clean, incremental]: &'a [CargoInvocation; 2],
+        expects_fragment: bool,
+    ) -> Self {
+        Self {
+            label,
+            clean,
+            incremental,
+            expects_fragment,
+        }
+    }
+
+    fn target_dir(&self) -> &str {
+        self.clean.target_dir()
+    }
+
+    fn check(&self, toolchain: &str) -> Result<()> {
+        let label = self.label;
+        for pass in [self.clean, self.incremental] {
+            ensure!(
+                pass.contains_sequence(&["build", "--bin", "netsuke"]),
+                "`{label}` should build the binary, got `{:?}`",
+                pass.arguments()
+            );
+            ensure!(
+                pass.contains_sequence(&["--config", DEV_FAST_CONFIG_PATH])
+                    == self.expects_fragment,
+                "`{label}` fragment expectation ({}) not met, got `{:?}`",
+                self.expects_fragment,
+                pass.arguments()
+            );
+            let expected_toolchain = if self.expects_fragment { toolchain } else { "" };
+            ensure!(
+                pass.toolchain() == expected_toolchain,
+                "`{label}` should run under `{expected_toolchain}`, got `{}`",
+                pass.toolchain()
+            );
+        }
+
+        ensure!(
+            self.clean.target_dir() == self.incremental.target_dir(),
+            "`{label}` should reuse one target directory across its passes"
+        );
+        ensure!(
+            self.clean.target_dir().ends_with(label),
+            "`{label}` should measure in its own directory, got `{}`",
+            self.clean.target_dir()
+        );
+
+        // The harness removes the directory before the clean pass, and the
+        // clean pass leaves it behind, so this ordering is what distinguishes
+        // a genuine clean/incremental pair from two identical builds.
+        ensure!(
+            self.clean.target_state() == TargetState::Absent,
+            "`{label}` clean pass should start from an empty target directory, got {:?}",
+            self.clean.target_state()
+        );
+        ensure!(
+            self.incremental.target_state() == TargetState::Present,
+            "`{label}` incremental pass should reuse the clean pass's output, got {:?}",
+            self.incremental.target_state()
+        );
+
+        Ok(())
+    }
+}
diff --git a/tests/dev_fast_check_tests.rs b/tests/dev_fast_check_tests.rs
index b03a6c9a8..d5e1bf5f1 100644
--- a/tests/dev_fast_check_tests.rs
+++ b/tests/dev_fast_check_tests.rs
@@ -70,8 +70,9 @@ fn falls_back_to_the_committed_pins_when_no_overrides_are_given() -> Result<()>
     Ok(())
 }
 
-/// A drift warning names the pinned version, so a mismatching fake proves which
-/// file the default resolved to rather than merely that some file was read.
+/// The drift diagnostic names the pinned version, so a mismatching fake proves
+/// which file the default resolved to rather than merely that some file was
+/// read.
 #[test]
 fn default_pins_are_the_committed_ones_not_an_empty_fallback() -> Result<()> {
     let sandbox = Sandbox::new()?;
@@ -82,11 +83,11 @@ fn default_pins_are_the_committed_ones_not_an_empty_fallback() -> Result<()> {
     let text = combined(&output);
 
     ensure!(
-        output.status.success(),
-        "a drift is tolerated, got `{text}`"
+        !output.status.success(),
+        "a drift should fail, got `{text}`"
     );
     ensure!(
-        text.contains(&format!("pin is {}", pinned_mold_version()?)),
+        text.contains(&format!("the pin {}", pinned_mold_version()?)),
         "the drift message should name the committed pin, got `{text}`"
     );
     Ok(())
@@ -148,6 +149,68 @@ fn a_missing_pin_file_reports_the_actionable_diagnostic() -> Result<()> {
     Ok(())
 }
 
+/// A malformed pin must be refused, never silently rewritten.
+///
+/// Deleting every whitespace character would turn `1.2 3` into `1.23` and two
+/// lines into their concatenation, so a corrupted pin would reach the download
+/// URL looking well-formed. Boundary whitespace is the only kind trimmed.
+#[rstest]
+#[case::internal_space("1.2 3\n", "contains whitespace")]
+#[case::internal_tab("1.2\t3\n", "contains whitespace")]
+#[case::two_lines("1.2.3\n4.5.6\n", "expected one line")]
+#[case::blank("\n", "empty version pin")]
+fn a_malformed_version_pin_is_refused_not_rewritten(
+    #[case] contents: &str,
+    #[case] expected: &str,
+) -> Result<()> {
+    let sandbox = Sandbox::new()?;
+    sandbox.write_mold(&sandbox.bin(), &pinned_mold_version()?)?;
+    sandbox.write_rustup(&pinned_toolchain()?, true)?;
+    let pin = sandbox.home().join("MOLD_VERSION");
+    sandbox.write_file(&pin, contents)?;
+
+    let output = sandbox.script_with(
+        "dev-fast-check.sh",
+        PinOverrides::Omitted,
+        &[("MOLD_VERSION_FILE", pin.to_string())],
+    )?;
+    let text = combined(&output);
+
+    ensure!(!output.status.success(), "should refuse, got `{text}`");
+    ensure!(
+        text.contains(expected),
+        "should report `{expected}`, got `{text}`"
+    );
+    Ok(())
+}
+
+/// Whitespace either side of the version is trimmed, so a pin file written with
+/// a trailing newline or stray indentation still resolves.
+#[rstest]
+#[case::trailing_newline("2.41.0\n")]
+#[case::surrounding_spaces("   2.41.0   \n")]
+#[case::no_trailing_newline("2.41.0")]
+fn boundary_whitespace_around_a_pin_is_trimmed(#[case] contents: &str) -> Result<()> {
+    let sandbox = Sandbox::new()?;
+    sandbox.write_mold(&sandbox.bin(), "2.41.0")?;
+    sandbox.write_rustup(&pinned_toolchain()?, true)?;
+    let pin = sandbox.home().join("MOLD_VERSION");
+    sandbox.write_file(&pin, contents)?;
+
+    let output = sandbox.script_with(
+        "dev-fast-check.sh",
+        PinOverrides::Omitted,
+        &[("MOLD_VERSION_FILE", pin.to_string())],
+    )?;
+    let text = combined(&output);
+
+    ensure!(
+        output.status.success(),
+        "`{contents:?}` should resolve to 2.41.0, got `{text}`"
+    );
+    Ok(())
+}
+
 /// The regression this guards: the Makefile unconditionally exports
 /// `$(HOME)/.local/bin` ahead of the caller's `PATH`, so an overridden
 /// `DEV_FAST_PREFIX` used to be installed to but never selected.
@@ -174,8 +237,11 @@ fn overridden_prefix_wins_over_a_mold_in_the_default_location() -> Result<()> {
     Ok(())
 }
 
+/// An advisory pin is not a pin: a `mold` that does not match it must fail the
+/// gate, so the linker actually used cannot silently diverge from the one the
+/// repository claims.
 #[test]
-fn tolerates_a_version_drift_from_the_pin() -> Result<()> {
+fn rejects_a_version_drift_from_the_pin() -> Result<()> {
     let sandbox = Sandbox::new()?;
     sandbox.write_rustup(&pinned_toolchain()?, true)?;
     sandbox.write_mold(&sandbox.prefix().join("bin"), "99.0.0")?;
@@ -184,12 +250,12 @@ fn tolerates_a_version_drift_from_the_pin() -> Result<()> {
     let text = combined(&output);
 
     ensure!(
-        output.status.success(),
-        "a newer mold is harmless and must not fail the check, got `{text}`"
+        !output.status.success(),
+        "a drifting mold should fail the check, got `{text}`"
     );
     ensure!(
         text.contains("run make install-dev-fast to match"),
-        "drift should still be reported, got `{text}`"
+        "the remedy should be named, got `{text}`"
     );
     Ok(())
 }
diff --git a/tests/dev_fast_checksum_tests.rs b/tests/dev_fast_checksum_tests.rs
new file mode 100644
index 000000000..c6f5f87f0
--- /dev/null
+++ b/tests/dev_fast_checksum_tests.rs
@@ -0,0 +1,220 @@
+//! Property coverage for the installer's checksum verification.
+//!
+//! Verification is the installer's whole reason for existing, so its decision
+//! is checked against a model rather than against a list of examples. The
+//! strategy ranges over the structural relationships a recorded row can hold to
+//! the artefact — right digest, wrong, truncated, re-cased, another artefact's,
+//! duplicated, whitespace-padded — because random digests would explore only
+//! one equivalence class: they never match.
+//!
+//! This is where the order-dependence defect surfaced, on the first run: two
+//! rows for one artefact made the shell's `expected` multi-line, and only the
+//! last one was actually checked.
+
+#![cfg(all(unix, target_os = "linux"))]
+
+use anyhow::Result;
+use camino::Utf8PathBuf;
+use proptest::prelude::*;
+use proptest::proptest;
+use test_support::dev_fast::{FakeRelease, Sandbox, combined, pinned_toolchain};
+
+/// The version the fake release is published as; see the installer tests.
+const TEST_MOLD_VERSION: &str = "9.9.9";
+
+/// A digest that cannot match any artefact.
+const WRONG_SHA256: &str = "0000000000000000000000000000000000000000000000000000000000000000";
+
+/// The installer inputs pointing at a local fake release.
+struct InstallerFixture {
+    version_pin: Utf8PathBuf,
+    checksums: Utf8PathBuf,
+    base_url: String,
+}
+
+impl InstallerFixture {
+    fn script_env(&self) -> Vec<(&'static str, String)> {
+        vec![
+            ("MOLD_VERSION_FILE", self.version_pin.to_string()),
+            ("MOLD_SHA256SUMS_FILE", self.checksums.to_string()),
+            ("MOLD_RELEASE_BASE_URL", self.base_url.clone()),
+        ]
+    }
+}
+
+/// A sandbox with a published fake release and a usable `rustup`.
+struct InstallerScenario {
+    sandbox: Sandbox,
+    release: FakeRelease,
+}
+
+impl InstallerScenario {
+    fn prepare() -> Result<Self> {
+        let sandbox = Sandbox::new()?;
+        sandbox.write_rustup(&pinned_toolchain()?, true)?;
+        let release = FakeRelease::publish(&sandbox, TEST_MOLD_VERSION)?;
+        Ok(Self { sandbox, release })
+    }
+
+    fn fixture(&self, checksums: Utf8PathBuf) -> Result<InstallerFixture> {
+        Ok(InstallerFixture {
+            version_pin: self.release.write_version_pin(&self.sandbox)?,
+            checksums,
+            base_url: self.release.base_url(),
+        })
+    }
+
+    fn installed_mold(&self) -> Utf8PathBuf {
+        self.sandbox.prefix().join("bin/mold")
+    }
+}
+
+/// How one recorded digest relates to the artefact's real one.
+#[derive(Copy, Clone, Debug)]
+enum Digest {
+    /// The artefact's own digest, verbatim.
+    Real,
+    /// The same digest upper-cased. `sha256sum` compares hex case-insensitively,
+    /// so this still verifies — established by probing the tool rather than
+    /// assumed.
+    RealUpperCased,
+    /// A well-formed digest belonging to nothing.
+    Wrong,
+    /// The real digest with its tail removed.
+    Truncated,
+}
+
+/// Which artefact a checksum row names.
+#[derive(Copy, Clone, Debug)]
+enum Named {
+    ThisArtefact,
+    Other,
+}
+
+/// One row of a checksum file.
+#[derive(Copy, Clone, Debug)]
+struct Row {
+    digest: Digest,
+    named: Named,
+    /// Surrounding whitespace, which the installer's `awk` field split ignores.
+    padded: bool,
+}
+
+impl Row {
+    fn render(self, real: &str, artefact: &str) -> String {
+        let digest = match self.digest {
+            Digest::Real => real.to_owned(),
+            Digest::RealUpperCased => real.to_uppercase(),
+            Digest::Wrong => WRONG_SHA256.to_owned(),
+            // `get` rather than a bare range: the digest is ASCII hex, but a
+            // panicking slice has no place in a model oracle.
+            Digest::Truncated => real
+                .get(..real.len().saturating_sub(4))
+                .unwrap_or_default()
+                .to_owned(),
+        };
+        let name = match self.named {
+            Named::ThisArtefact => artefact,
+            Named::Other => "mold-0.0.0-x86_64-linux.tar.gz",
+        };
+        if self.padded {
+            format!("   {digest}   {name}   \n")
+        } else {
+            format!("{digest}  {name}\n")
+        }
+    }
+}
+
+/// The installer must unpack exactly when the file records this artefact
+/// exactly once, under the artefact's real digest.
+///
+/// This is a model, not a lookup table: it predicts the outcome for row lists
+/// nobody enumerated. Requiring a single row is deliberate — several rows for
+/// one artefact are ambiguous, and the installer refuses rather than picking
+/// one. Case is not significant, because `sha256sum` compares hex
+/// case-insensitively.
+fn model_installs(rows: &[Row]) -> bool {
+    let mut selected = rows
+        .iter()
+        .filter(|row| matches!(row.named, Named::ThisArtefact));
+    let Some(only) = selected.next() else {
+        return false;
+    };
+    selected.next().is_none() && matches!(only.digest, Digest::Real | Digest::RealUpperCased)
+}
+
+fn digest_strategy() -> impl Strategy<Value = Digest> {
+    prop_oneof![
+        Just(Digest::Real),
+        Just(Digest::RealUpperCased),
+        Just(Digest::Wrong),
+        Just(Digest::Truncated),
+    ]
+}
+
+fn row_strategy() -> impl Strategy<Value = Row> {
+    (
+        digest_strategy(),
+        prop_oneof![Just(Named::ThisArtefact), Just(Named::Other)],
+        any::<bool>(),
+    )
+        .prop_map(|(digest, named, padded)| Row {
+            digest,
+            named,
+            padded,
+        })
+}
+
+proptest! {
+    // Each case runs the installer, so keep the corpus small enough to stay a
+    // second or two while still ranging over the row space.
+    #![proptest_config(ProptestConfig { cases: 24, ..ProptestConfig::default() })]
+
+    /// Whatever rows a checksum file carries, the installer's decision must
+    /// match the model, and a refusal must leave nothing unpacked.
+    ///
+    /// Random digests alone would be uninformative — they never match — so the
+    /// strategy ranges over the structural relationships instead: right digest,
+    /// wrong digest, truncated, re-cased, another artefact's, duplicated, and
+    /// whitespace-padded.
+    #[test]
+    fn the_installer_verifies_exactly_when_the_model_says_it_should(
+        rows in prop::collection::vec(row_strategy(), 0..4)
+    ) {
+        let scenario = InstallerScenario::prepare()
+            .map_err(|error| TestCaseError::fail(error.to_string()))?;
+        let real = scenario.release.sha256().to_owned();
+        let artefact = scenario.release.name().to_owned();
+        let contents: String = rows.iter().map(|row| row.render(&real, &artefact)).collect();
+
+        let checksums = scenario.sandbox.home().join("SHA256SUMS");
+        scenario
+            .sandbox
+            .write_file(&checksums, &contents)
+            .map_err(|error| TestCaseError::fail(error.to_string()))?;
+        let fixture = scenario
+            .fixture(checksums)
+            .map_err(|error| TestCaseError::fail(error.to_string()))?;
+
+        let output = scenario
+            .sandbox
+            .script("install-dev-fast.sh", &fixture.script_env())
+            .map_err(|error| TestCaseError::fail(error.to_string()))?;
+
+        let expected = model_installs(&rows);
+        prop_assert_eq!(
+            output.status.success(),
+            expected,
+            "rows {:?} should {} install, got `{}`",
+            rows,
+            if expected { "" } else { "not" },
+            combined(&output)
+        );
+        prop_assert_eq!(
+            scenario.installed_mold().as_std_path().exists(),
+            expected,
+            "unpacked state should follow the verification decision for {:?}",
+            rows
+        );
+    }
+}
diff --git a/tests/dev_fast_install_tests.rs b/tests/dev_fast_install_tests.rs
index 7e2be48b5..21e0dd699 100644
--- a/tests/dev_fast_install_tests.rs
+++ b/tests/dev_fast_install_tests.rs
@@ -300,155 +300,7 @@ fn is_timing(cell: &str) -> bool {
         && fraction.chars().all(|c| c.is_ascii_digit())
 }
 
-/// How one recorded digest relates to the artefact's real one.
-#[derive(Copy, Clone, Debug)]
-enum Digest {
-    /// The artefact's own digest, verbatim.
-    Real,
-    /// The same digest upper-cased. `sha256sum` compares hex case-insensitively,
-    /// so this still verifies — established by probing the tool rather than
-    /// assumed.
-    RealUpperCased,
-    /// A well-formed digest belonging to nothing.
-    Wrong,
-    /// The real digest with its tail removed.
-    Truncated,
-}
-
-/// Which artefact a checksum row names.
-#[derive(Copy, Clone, Debug)]
-enum Named {
-    ThisArtefact,
-    Other,
-}
-
-/// One row of a checksum file.
-#[derive(Copy, Clone, Debug)]
-struct Row {
-    digest: Digest,
-    named: Named,
-    /// Surrounding whitespace, which the installer's `awk` field split ignores.
-    padded: bool,
-}
-
-impl Row {
-    fn render(self, real: &str, artefact: &str) -> String {
-        let digest = match self.digest {
-            Digest::Real => real.to_owned(),
-            Digest::RealUpperCased => real.to_uppercase(),
-            Digest::Wrong => WRONG_SHA256.to_owned(),
-            // `get` rather than a bare range: the digest is ASCII hex, but a
-            // panicking slice has no place in a model oracle.
-            Digest::Truncated => real
-                .get(..real.len().saturating_sub(4))
-                .unwrap_or_default()
-                .to_owned(),
-        };
-        let name = match self.named {
-            Named::ThisArtefact => artefact,
-            Named::Other => "mold-0.0.0-x86_64-linux.tar.gz",
-        };
-        if self.padded {
-            format!("   {digest}   {name}   \n")
-        } else {
-            format!("{digest}  {name}\n")
-        }
-    }
-}
-
-/// The installer must unpack exactly when the file records this artefact
-/// exactly once, under the artefact's real digest.
-///
-/// This is a model, not a lookup table: it predicts the outcome for row lists
-/// nobody enumerated. Requiring a single row is deliberate — several rows for
-/// one artefact are ambiguous, and the installer refuses rather than picking
-/// one. Case is not significant, because `sha256sum` compares hex
-/// case-insensitively.
-fn model_installs(rows: &[Row]) -> bool {
-    let mut selected = rows
-        .iter()
-        .filter(|row| matches!(row.named, Named::ThisArtefact));
-    let Some(only) = selected.next() else {
-        return false;
-    };
-    selected.next().is_none() && matches!(only.digest, Digest::Real | Digest::RealUpperCased)
-}
-
-fn digest_strategy() -> impl Strategy<Value = Digest> {
-    prop_oneof![
-        Just(Digest::Real),
-        Just(Digest::RealUpperCased),
-        Just(Digest::Wrong),
-        Just(Digest::Truncated),
-    ]
-}
-
-fn row_strategy() -> impl Strategy<Value = Row> {
-    (
-        digest_strategy(),
-        prop_oneof![Just(Named::ThisArtefact), Just(Named::Other)],
-        any::<bool>(),
-    )
-        .prop_map(|(digest, named, padded)| Row {
-            digest,
-            named,
-            padded,
-        })
-}
-
 proptest! {
-    // Each case runs the installer, so keep the corpus small enough to stay a
-    // second or two while still ranging over the row space.
-    #![proptest_config(ProptestConfig { cases: 24, ..ProptestConfig::default() })]
-
-    /// Whatever rows a checksum file carries, the installer's decision must
-    /// match the model, and a refusal must leave nothing unpacked.
-    ///
-    /// Random digests alone would be uninformative — they never match — so the
-    /// strategy ranges over the structural relationships instead: right digest,
-    /// wrong digest, truncated, re-cased, another artefact's, duplicated, and
-    /// whitespace-padded.
-    #[test]
-    fn the_installer_verifies_exactly_when_the_model_says_it_should(
-        rows in prop::collection::vec(row_strategy(), 0..4)
-    ) {
-        let scenario = InstallerScenario::prepare()
-            .map_err(|error| TestCaseError::fail(error.to_string()))?;
-        let real = scenario.release.sha256().to_owned();
-        let artefact = scenario.release.name().to_owned();
-        let contents: String = rows.iter().map(|row| row.render(&real, &artefact)).collect();
-
-        let checksums = scenario.sandbox.home().join("SHA256SUMS");
-        scenario
-            .sandbox
-            .write_file(&checksums, &contents)
-            .map_err(|error| TestCaseError::fail(error.to_string()))?;
-        let fixture = scenario
-            .fixture(checksums)
-            .map_err(|error| TestCaseError::fail(error.to_string()))?;
-
-        let output = scenario
-            .sandbox
-            .script("install-dev-fast.sh", &fixture.script_env())
-            .map_err(|error| TestCaseError::fail(error.to_string()))?;
-
-        let expected = model_installs(&rows);
-        prop_assert_eq!(
-            output.status.success(),
-            expected,
-            "rows {:?} should {} install, got `{}`",
-            rows,
-            if expected { "" } else { "not" },
-            combined(&output)
-        );
-        prop_assert_eq!(
-            scenario.installed_mold().as_std_path().exists(),
-            expected,
-            "unpacked state should follow the verification decision for {:?}",
-            rows
-        );
-    }
-
     /// A timing cell is exactly `<digits>.<digits>`. Generating around that
     /// shape covers the malformed neighbours — bare dots, multiple points, a
     /// missing side — that a hand-picked example list tends to miss.
diff --git a/tests/dev_fast_make_target_tests.rs b/tests/dev_fast_make_target_tests.rs
index 7a70657e0..28deee002 100644
--- a/tests/dev_fast_make_target_tests.rs
+++ b/tests/dev_fast_make_target_tests.rs
@@ -11,52 +11,16 @@
 
 #![cfg(all(unix, target_os = "linux"))]
 
-use anyhow::{Context, Result, bail, ensure};
-use camino::{Utf8Path, Utf8PathBuf};
-use proptest::prelude::*;
-use proptest::proptest;
+use anyhow::{Context, Result, ensure};
 use rstest::rstest;
-use std::time::{Duration, UNIX_EPOCH};
 use test_support::dev_fast::{
-    CargoInvocation, DEV_FAST_CONFIG_PATH, FakeRelease, MakeInvocation, RecordingCargo, Sandbox,
-    TargetState, combined, dev_fast_config, pinned_mold_version, pinned_toolchain,
+    BuildScenario, DEV_FAST_CONFIG_PATH, FakeRelease, MakeInvocation, RecordingCargo, Sandbox,
+    combined, dev_fast_config, pinned_toolchain,
 };
 
 /// The version the fake release is published as; see the installer tests.
 const TEST_MOLD_VERSION: &str = "9.9.9";
 
-/// A sandbox whose prerequisites all pass, with a recording `cargo` installed.
-struct BuildScenario {
-    sandbox: Sandbox,
-    cargo: RecordingCargo,
-}
-
-impl BuildScenario {
-    fn prepare() -> Result<Self> {
-        let sandbox = Sandbox::new()?;
-        sandbox.write_mold(&sandbox.prefix().join("bin"), &pinned_mold_version()?)?;
-        sandbox.write_rustup(&pinned_toolchain()?, true)?;
-        let cargo = RecordingCargo::install(&sandbox)?;
-        Ok(Self { sandbox, cargo })
-    }
-
-    /// Run `target`, pointing `CARGO` at the recording fake.
-    fn run(&self, target: &str) -> Result<CargoInvocation> {
-        let invocation = MakeInvocation::new(target).variable("CARGO", self.cargo.executable());
-        let output = self.sandbox.run_make(&invocation)?;
-        ensure!(
-            output.status.success(),
-            "make {target} should succeed, got `{}`",
-            combined(&output)
-        );
-        self.cargo.sole_invocation()
-    }
-
-    fn prefix_bin(&self) -> Utf8PathBuf {
-        self.sandbox.prefix().join("bin")
-    }
-}
-
 /// What a given build target must ask Cargo to do.
 #[derive(Copy, Clone, Debug)]
 struct BuildTarget {
@@ -144,6 +108,38 @@ fn a_failed_gate_invokes_cargo_not_at_all(#[case] target: &str) -> Result<()> {
     Ok(())
 }
 
+/// A drifting `mold` fails the gate, so it must stop the build targets exactly
+/// as a missing one does.
+///
+/// Worth asserting separately from the absent case: a drift leaves a perfectly
+/// usable linker on `PATH`, so nothing but the gate's own verdict prevents the
+/// recipe from proceeding.
+#[rstest]
+#[case("dev-build")]
+#[case("dev-test")]
+fn a_drifting_mold_invokes_cargo_not_at_all(#[case] target: &str) -> Result<()> {
+    let sandbox = Sandbox::new()?;
+    sandbox.write_rustup(&pinned_toolchain()?, true)?;
+    sandbox.write_mold(&sandbox.prefix().join("bin"), "99.0.0")?;
+    let cargo = RecordingCargo::install(&sandbox)?;
+
+    let invocation = MakeInvocation::new(target).variable("CARGO", cargo.executable());
+    let output = sandbox.run_make(&invocation)?;
+    let text = combined(&output);
+
+    ensure!(
+        !output.status.success(),
+        "`{target}` should fail on a drifting mold, got `{text}`"
+    );
+    let recorded = cargo.invocations()?;
+    ensure!(
+        recorded.is_empty(),
+        "`{target}` should not reach Cargo, recorded {} invocation(s)",
+        recorded.len()
+    );
+    Ok(())
+}
+
 /// The recipes pass the fragment by path, so a test asserting only that the
 /// path appears would still pass if the file lost its contents. Read it.
 #[test]
@@ -246,319 +242,3 @@ fn install_target_forwards_the_prefix_pins_and_release_url() -> Result<()> {
     );
     Ok(())
 }
-
-/// Timestamp stamped on the benchmark's touch file before the run, chosen far
-/// enough in the past that any `touch` is unambiguously newer. Comparing
-/// against a fixed baseline keeps the assertion deterministic, where comparing
-/// the two passes to each other would depend on filesystem timestamp
-/// granularity.
-const BASELINE_MTIME: i64 = 1_600_000_000;
-
-/// Target-directory slugs the benchmark uses, one per variant.
-const DEFAULT_SLUG: &str = "default";
-const DEV_FAST_SLUG: &str = "dev-fast";
-
-/// Create the touch file with [`BASELINE_MTIME`], returning that timestamp.
-fn write_with_old_mtime(sandbox: &Sandbox, path: &Utf8Path) -> Result<i64> {
-    let baseline = UNIX_EPOCH + Duration::from_secs(BASELINE_MTIME.unsigned_abs());
-    sandbox.write_file_with_mtime(path, "", baseline)?;
-    Ok(BASELINE_MTIME)
-}
-
-/// The disposable inputs one benchmark run needs.
-///
-/// Named fields rather than a returned tuple: `root` and `touch_file` are both
-/// paths, so positional returns could be transposed at the call site without
-/// the compiler noticing.
-struct BenchFixture {
-    /// Benchmark root; each variant gets its own target directory beneath it.
-    root: Utf8PathBuf,
-    /// The file the benchmark touches between a variant's two passes.
-    touch_file: Utf8PathBuf,
-    /// The touch file's timestamp before the run, for ordering assertions.
-    baseline_mtime: i64,
-}
-
-/// Stage a benchmark run's disposable inputs.
-///
-/// The touch file stands in for `src/main.rs`, so a run does not invalidate the
-/// working tree's build cache. Both target directories are seeded to model a
-/// re-run: on a fresh sandbox the benchmark's `rm -rf` would be
-/// indistinguishable from doing nothing, and the clean-pass assertion would
-/// hold vacuously.
-fn prepare_bench_fixture(scenario: &BuildScenario) -> Result<BenchFixture> {
-    let sandbox = &scenario.sandbox;
-    let touch_file = sandbox.home().join("bench-touch");
-    let baseline_mtime = write_with_old_mtime(sandbox, &touch_file)?;
-
-    let root = sandbox.home().join("bench");
-    for slug in [DEFAULT_SLUG, DEV_FAST_SLUG] {
-        sandbox.create_dir(&root.join(slug))?;
-    }
-    Ok(BenchFixture {
-        root,
-        touch_file,
-        baseline_mtime,
-    })
-}
-
-/// Check the recorded passes: their count and pairing, each variant's own
-/// contract, that the variants measured separately, and where each pass sits
-/// relative to the touch.
-fn check_benchmark_invocations(invocations: &[CargoInvocation], baseline_mtime: i64) -> Result<()> {
-    // Four builds: clean and incremental, for each of the two variants.
-    ensure!(
-        invocations.len() == 4,
-        "should measure two builds per variant, recorded {}",
-        invocations.len()
-    );
-
-    // The benchmark measures the default variant first, then the accelerated
-    // one, each as a clean pass followed by an incremental pass.
-    let (pairs, rest) = invocations.as_chunks::<2>();
-    ensure!(
-        rest.is_empty(),
-        "passes should come in pairs, got {} spare",
-        rest.len()
-    );
-    let [default_chunk, dev_fast_chunk] = pairs else {
-        bail!("expected one pair per variant, got {}", pairs.len());
-    };
-    let default_pass = BenchVariant::from_pair(DEFAULT_SLUG, default_chunk, false);
-    let dev_fast_pass = BenchVariant::from_pair(DEV_FAST_SLUG, dev_fast_chunk, true);
-    for variant in [&default_pass, &dev_fast_pass] {
-        variant.check(&pinned_toolchain()?)?;
-    }
-
-    ensure!(
-        default_pass.target_dir() != dev_fast_pass.target_dir(),
-        "variants must not share a target directory, got `{}` and `{}`",
-        default_pass.target_dir(),
-        dev_fast_pass.target_dir()
-    );
-
-    check_touch_ordering(invocations, baseline_mtime)
-}
-
-/// Only the very first pass runs before any touch; each variant touches the
-/// file between its own two passes, so every later pass must see a newer
-/// timestamp. Comparing against a backdated baseline rather than between passes
-/// keeps this free of filesystem timestamp granularity.
-fn check_touch_ordering(invocations: &[CargoInvocation], baseline_mtime: i64) -> Result<()> {
-    let first = invocations.first().context("expected a recorded pass")?;
-    ensure!(
-        first.touch_mtime() == Some(baseline_mtime),
-        "the first clean pass should precede any touch, got {:?}",
-        first.touch_mtime()
-    );
-    for (index, pass) in invocations.iter().enumerate().skip(1) {
-        ensure!(
-            pass.touch_mtime()
-                .is_some_and(|mtime| mtime > baseline_mtime),
-            "pass {index} should follow a touch, got {:?}",
-            pass.touch_mtime()
-        );
-    }
-    Ok(())
-}
-
-/// What a variant's target directory holds before the benchmark starts.
-#[derive(Copy, Clone, Debug)]
-enum PreState {
-    /// Nothing there, as on a first run.
-    Absent,
-    /// The directory exists but is empty.
-    Empty,
-    /// The directory exists and holds an artefact from an earlier run.
-    Populated,
-}
-
-impl PreState {
-    fn stage(self, sandbox: &Sandbox, dir: &Utf8Path) -> Result<()> {
-        match self {
-            Self::Absent => Ok(()),
-            Self::Empty => sandbox.create_dir(dir),
-            Self::Populated => sandbox.write_file(&dir.join("stale-artefact"), "stale"),
-        }
-    }
-}
-
-fn pre_state_strategy() -> impl Strategy<Value = PreState> {
-    prop_oneof![
-        Just(PreState::Absent),
-        Just(PreState::Empty),
-        Just(PreState::Populated),
-    ]
-}
-
-proptest! {
-    // Nine combinations; a few extra draws cost little because the fake Cargo
-    // returns immediately.
-    #![proptest_config(ProptestConfig { cases: 12, ..ProptestConfig::default() })]
-
-    /// Whatever each variant's target directory held beforehand, every variant
-    /// must record a clean pass then an incremental one.
-    ///
-    /// This is the invariant the `rm -rf` exists to provide: the benchmark's
-    /// first measurement must not inherit a previous run's artefacts, or the
-    /// "clean build" column measures something else entirely. Ranging over the
-    /// prior states shows the wipe erases history rather than merely working on
-    /// an empty sandbox.
-    #[test]
-    fn the_benchmark_wipes_whatever_each_variant_started_from(
-        default_pre in pre_state_strategy(),
-        dev_fast_pre in pre_state_strategy(),
-    ) {
-        let fail = |error: anyhow::Error| TestCaseError::fail(error.to_string());
-        let scenario = BuildScenario::prepare().map_err(fail)?;
-        let sandbox = &scenario.sandbox;
-
-        let touch_file = sandbox.home().join("bench-touch");
-        write_with_old_mtime(sandbox, &touch_file).map_err(fail)?;
-        let bench_root = sandbox.home().join("bench");
-        for (slug, pre) in [(DEFAULT_SLUG, default_pre), (DEV_FAST_SLUG, dev_fast_pre)] {
-            pre.stage(sandbox, &bench_root.join(slug)).map_err(fail)?;
-        }
-
-        let invocation = MakeInvocation::new("bench-build")
-            .variable("CARGO", scenario.cargo.executable())
-            .environment("BENCH_ROOT", &bench_root)
-            .environment("BENCH_TOUCH_FILE", &touch_file);
-        let output = sandbox.run_make(&invocation).map_err(fail)?;
-        prop_assert!(
-            output.status.success(),
-            "bench-build should succeed from {:?}/{:?}, got `{}`",
-            default_pre,
-            dev_fast_pre,
-            combined(&output)
-        );
-
-        let invocations = scenario.cargo.invocations().map_err(fail)?;
-        let states: Vec<TargetState> = invocations.iter().map(CargoInvocation::target_state).collect();
-        prop_assert_eq!(
-            states,
-            vec![
-                TargetState::Absent,
-                TargetState::Present,
-                TargetState::Absent,
-                TargetState::Present,
-            ],
-            "each variant should measure a clean then an incremental pass, from {:?}/{:?}",
-            default_pre,
-            dev_fast_pre
-        );
-    }
-}
-
-#[test]
-fn bench_target_emits_both_variant_rows() -> Result<()> {
-    let scenario = BuildScenario::prepare()?;
-    let fixture = prepare_bench_fixture(&scenario)?;
-
-    let invocation = MakeInvocation::new("bench-build")
-        .variable("CARGO", scenario.cargo.executable())
-        .environment("BENCH_ROOT", &fixture.root)
-        .environment("BENCH_TOUCH_FILE", &fixture.touch_file);
-    let output = scenario.sandbox.run_make(&invocation)?;
-    let stdout = String::from_utf8_lossy(&output.stdout);
-
-    ensure!(
-        output.status.success(),
-        "make bench-build should succeed, got `{}`",
-        combined(&output)
-    );
-    for variant in [
-        "| Default (LLVM, platform linker) |",
-        "| dev-fast (Cranelift,",
-    ] {
-        ensure!(
-            stdout.contains(variant),
-            "table should carry the `{variant}` row, got `{stdout}`"
-        );
-    }
-
-    check_benchmark_invocations(&scenario.cargo.invocations()?, fixture.baseline_mtime)
-}
-
-/// One variant's pair of recorded builds: the clean pass then the incremental.
-struct BenchVariant<'a> {
-    label: &'a str,
-    clean: &'a CargoInvocation,
-    incremental: &'a CargoInvocation,
-    /// Whether this variant is the accelerated one, which alone carries the
-    /// Cranelift fragment and the pinned toolchain.
-    expects_fragment: bool,
-}
-
-impl<'a> BenchVariant<'a> {
-    /// Build a descriptor from the variant's recorded pair of passes.
-    ///
-    /// The fixed-size array makes the pairing a type-level fact, so there is no
-    /// absent-pass case left to handle at runtime.
-    const fn from_pair(
-        label: &'a str,
-        [clean, incremental]: &'a [CargoInvocation; 2],
-        expects_fragment: bool,
-    ) -> Self {
-        Self {
-            label,
-            clean,
-            incremental,
-            expects_fragment,
-        }
-    }
-
-    fn target_dir(&self) -> &str {
-        self.clean.target_dir()
-    }
-
-    fn check(&self, toolchain: &str) -> Result<()> {
-        let label = self.label;
-        for pass in [self.clean, self.incremental] {
-            ensure!(
-                pass.contains_sequence(&["build", "--bin", "netsuke"]),
-                "`{label}` should build the binary, got `{:?}`",
-                pass.arguments()
-            );
-            ensure!(
-                pass.contains_sequence(&["--config", DEV_FAST_CONFIG_PATH])
-                    == self.expects_fragment,
-                "`{label}` fragment expectation ({}) not met, got `{:?}`",
-                self.expects_fragment,
-                pass.arguments()
-            );
-            let expected_toolchain = if self.expects_fragment { toolchain } else { "" };
-            ensure!(
-                pass.toolchain() == expected_toolchain,
-                "`{label}` should run under `{expected_toolchain}`, got `{}`",
-                pass.toolchain()
-            );
-        }
-
-        ensure!(
-            self.clean.target_dir() == self.incremental.target_dir(),
-            "`{label}` should reuse one target directory across its passes"
-        );
-        ensure!(
-            self.clean.target_dir().ends_with(label),
-            "`{label}` should measure in its own directory, got `{}`",
-            self.clean.target_dir()
-        );
-
-        // The harness removes the directory before the clean pass, and the
-        // clean pass leaves it behind, so this ordering is what distinguishes
-        // a genuine clean/incremental pair from two identical builds.
-        ensure!(
-            self.clean.target_state() == TargetState::Absent,
-            "`{label}` clean pass should start from an empty target directory, got {:?}",
-            self.clean.target_state()
-        );
-        ensure!(
-            self.incremental.target_state() == TargetState::Present,
-            "`{label}` incremental pass should reuse the clean pass's output, got {:?}",
-            self.incremental.target_state()
-        );
-
-        Ok(())
-    }
-}

From b417984e9be49a73e9d22d0175351c4c44b1e15f Mon Sep 17 00:00:00 2001
From: leynos <leynos@troubledskies.net>
Date: Sun, 2 Aug 2026 15:13:14 +0200
Subject: [PATCH 19/24] Harden the trap and quoting, and correct the benchmark
 evidence
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

A string trap is re-parsed by the shell when it fires, so
`trap "rm -rf '$workdir'" EXIT` breaks on a quote-bearing `TMPDIR` and
the scratch directory leaks:

    bash: exit trap: line 1: unexpected EOF while looking for matching `''

Name a function instead. The path is then only ever a variable, expanded
at removal time and never re-parsed, and `rm -rf --` guards a leading
dash. Verified against a `TMPDIR` containing a quote.

The Makefile interpolated the same class of value into recipes as
`VAR='$(VAR)'`, which a single quote in a path would likewise break.
Export the variables instead: Make hands an exported value to the child
directly, so nothing is re-parsed. `PATH` becomes a target-specific
export, which also removes the quoting there. Target-specific exports do
not reach prerequisites, so all five dev-fast targets are named — the
first attempt listed only the build targets and dropped the install
prefix from `dev-fast-check`, which three tests caught.

`bench-build` touched `src/main.rs` — a tracked file — and never
restored it, so a benchmark silently invalidated the developer's next
real build long after finishing. The timestamp is now restored on EXIT,
INT, and TERM.

Ask Cargo what the fragment means, not only what it contains. Parsing
the TOML cannot prove Cargo accepts the key paths: a backend under the
wrong table parses fine and is ignored. `cargo config get` reports the
resolved view, so a misplaced key surfaces as a missing value.

Finally, the benchmark evidence was stale and flattering. It cited a
nightly this branch no longer uses, and compared a stable-toolchain
baseline against a nightly one, so it attributed a toolchain change to
Cranelift and mold. Re-measured with both variants on the repository's
own nightly, the gain is roughly 8% on a clean build and a quarter on an
incremental one — a few hundred milliseconds here, not the "five times
faster" previously claimed. The guide now says so, and names the
benchmark's own limit: it builds only `--bin netsuke`, so it
under-represents what `make dev-test` sees.
---
 Makefile                            | 33 ++++++++++----------
 docs/developers-guide.md            | 26 ++++++++++------
 scripts/bench-build.sh              | 18 ++++++++++-
 scripts/install-dev-fast.sh         | 21 +++++++++++--
 tests/dev_fast_make_target_tests.rs | 48 +++++++++++++++++++++++++++++
 5 files changed, 116 insertions(+), 30 deletions(-)

diff --git a/Makefile b/Makefile
index ee021e545..2ee022cb4 100644
--- a/Makefile
+++ b/Makefile
@@ -29,17 +29,11 @@ MOLD_SHA256SUMS_FILE ?= tools/mold/SHA256SUMS
 RUST_TOOLCHAIN_FILE ?= rust-toolchain.toml
 DEV_FAST_CONFIG ?= tools/dev-fast/config.toml
 DEV_FAST_PREFIX ?= $(HOME)/.local
-# The installer may write mold to a prefix other than the default, so every
-# dev-fast recipe puts that prefix first on PATH. Without this the PATH export
-# below would keep selecting whichever mold sits in ~/.local/bin, silently
-# ignoring an overridden DEV_FAST_PREFIX.
-DEV_FAST_PATH = PATH='$(DEV_FAST_PREFIX)/bin:$(PATH)'
-DEV_FAST_ENV = $(DEV_FAST_PATH) \
-	MOLD_VERSION_FILE='$(MOLD_VERSION_FILE)' \
-	MOLD_SHA256SUMS_FILE='$(MOLD_SHA256SUMS_FILE)' \
-	RUST_TOOLCHAIN_FILE='$(RUST_TOOLCHAIN_FILE)' \
-	DEV_FAST_CONFIG='$(DEV_FAST_CONFIG)' \
-	DEV_FAST_PREFIX='$(DEV_FAST_PREFIX)'
+# Exported rather than interpolated into the recipes. Make hands an exported
+# variable to the child process directly, so a path containing a quote cannot
+# break the command line the shell parses; a `VAR='$(VAR)'` prefix could.
+export MOLD_VERSION_FILE MOLD_SHA256SUMS_FILE RUST_TOOLCHAIN_FILE
+export DEV_FAST_CONFIG DEV_FAST_PREFIX
 DEV_FAST_TOOLCHAIN = $$(awk -F'"' '/^[[:space:]]*channel[[:space:]]*=/ { print $$2; exit }' '$(RUST_TOOLCHAIN_FILE)')
 MDLINT ?= $(shell command -v markdownlint-cli2 2>/dev/null || printf '%s' "$$HOME/.bun/bin/markdownlint-cli2")
 NIXIE ?= nixie
@@ -172,19 +166,26 @@ formal-pr: ## Run pull-request formal-verification checks
 	$(MAKE) kani-check
 
 install-dev-fast: ## Install the pinned mold linker and Cranelift backend
-	@$(DEV_FAST_ENV) scripts/install-dev-fast.sh
+	@scripts/install-dev-fast.sh
 
 dev-fast-check: ## Check the mold and Cranelift local build prerequisites
-	@$(DEV_FAST_ENV) scripts/dev-fast-check.sh
+	@scripts/dev-fast-check.sh
+
+# Every dev-fast target needs the install prefix ahead of a distribution mold:
+# the check probes PATH for it, and `-fuse-ld=mold` resolves by PATH order.
+# Target-specific exports do not reach prerequisites, so `dev-fast-check` is
+# listed in its own right as well as being a prerequisite of the others.
+DEV_FAST_TARGETS = install-dev-fast dev-fast-check dev-build dev-test bench-build
+$(DEV_FAST_TARGETS): export PATH := $(DEV_FAST_PREFIX)/bin:$(PATH)
 
 dev-build: dev-fast-check ## Build the debug binary with Cranelift and mold
-	$(DEV_FAST_PATH) RUSTUP_TOOLCHAIN=$(DEV_FAST_TOOLCHAIN) $(CARGO) --config '$(DEV_FAST_CONFIG)' build $(BUILD_JOBS) --bin $(APP)
+	RUSTUP_TOOLCHAIN=$(DEV_FAST_TOOLCHAIN) $(CARGO) --config "$$DEV_FAST_CONFIG" build $(BUILD_JOBS) --bin $(APP)
 
 dev-test: dev-fast-check ## Run the nextest pass with Cranelift and mold
-	$(DEV_FAST_PATH) RUSTUP_TOOLCHAIN=$(DEV_FAST_TOOLCHAIN) $(CARGO) --config '$(DEV_FAST_CONFIG)' nextest run --all-targets --all-features $(NEXTEST_BUILD_JOBS)
+	RUSTUP_TOOLCHAIN=$(DEV_FAST_TOOLCHAIN) $(CARGO) --config "$$DEV_FAST_CONFIG" nextest run --all-targets --all-features $(NEXTEST_BUILD_JOBS)
 
 bench-build: dev-fast-check ## Time clean and incremental debug builds for both paths
-	@$(DEV_FAST_ENV) CARGO='$(CARGO)' scripts/bench-build.sh
+	@CARGO="$(CARGO)" scripts/bench-build.sh
 
 help: ## Show available targets
 	@grep -E '^[a-zA-Z_-]+:.*?##' $(MAKEFILE_LIST) | \
diff --git a/docs/developers-guide.md b/docs/developers-guide.md
index 9eac3b54b..f54225806 100644
--- a/docs/developers-guide.md
+++ b/docs/developers-guide.md
@@ -661,23 +661,29 @@ neither warms the other's cache nor disturbs the working `target/` tree. The
 timer reads `EPOCHREALTIME`, so this target needs Bash 5.0 or newer; it fails
 with a named prerequisite on older shells rather than reporting zeroes.
 
-Results below were recorded on a 24-core x86_64 Linux host with Rust 1.89.0 as
-the default toolchain, `nightly-2026-06-29` supplying Cranelift 0.132.0, and
+Results below were recorded on a 24-core x86_64 Linux host, with both variants
+on the repository's own `nightly-2026-06-25` supplying Cranelift 0.132.0, and
 `mold` 2.41.0. Regenerate the table verbatim with `make bench-build`. Absolute
-figures move with machine load — a clean build on this host ranged from 15 s to
-24 s across runs — so the ratio between the two rows is the durable signal, not
-the seconds.
+figures move with machine load, so the ratio between the two rows is the
+durable signal, not the seconds; the run below is representative of three
+consecutive runs that agreed to within 0.4 s.
 
 | Variant                         | Clean build (s) | Incremental build (s) |
 | ------------------------------- | --------------- | --------------------- |
-| Default (LLVM, platform linker) | 15.4            | 3.6                   |
-| dev-fast (Cranelift, `mold`)    | 10.6            | 0.7                   |
+| Default (LLVM, platform linker) | 11.6            | 0.8                   |
+| dev-fast (Cranelift, `mold`)    | 10.7            | 0.6                   |
 
 Table: Debug build wall-clock time for the default and accelerated paths.
 
-The clean build gains roughly a third, dominated by codegen. The incremental
-rebuild — the case that actually paces the edit-compile-test loop — is about
-five times faster, because it is dominated by linking a single crate.
+Be realistic about the size of this: roughly 8% off a clean build and a quarter
+off an incremental one, which on this host is a few hundred milliseconds. Two
+things bound it. Both variants now share one nightly, so the comparison
+isolates Cranelift and `mold` rather than also capturing a toolchain change —
+earlier figures in this document did not, and overstated the gain. And the
+benchmark builds only `--bin netsuke`, the smallest useful target, so it
+under-represents what `make dev-test` sees, where Cranelift has every test
+binary's codegen to save on. Measure your own workload before concluding the
+acceleration is or is not worth the setup.
 
 ## Formal-verification tooling
 
diff --git a/scripts/bench-build.sh b/scripts/bench-build.sh
index 400c04722..bd21257e3 100755
--- a/scripts/bench-build.sh
+++ b/scripts/bench-build.sh
@@ -29,6 +29,21 @@ BENCH_TOUCH_FILE=${BENCH_TOUCH_FILE:-src/main.rs}
 # Populated as "<label>|<clean seconds>|<incremental seconds>" rows.
 results=()
 
+# The benchmark touches BENCH_TOUCH_FILE to make the second pass incremental,
+# and that file defaults to a tracked source. Leaving it newer than the ordinary
+# `target/` outputs would silently force the developer's next real build to
+# redo work, long after the benchmark finished, so the timestamp is restored on
+# exit — including when a measurement fails or the run is interrupted.
+BENCH_TOUCH_STAMP=
+
+restore_touch_file() {
+  [ -n "$BENCH_TOUCH_STAMP" ] || return 0
+  touch -d "@$BENCH_TOUCH_STAMP" -- "$BENCH_TOUCH_FILE" || true
+  BENCH_TOUCH_STAMP=
+}
+
+trap restore_touch_file EXIT INT TERM
+
 # Wall-clock seconds for a command, to one decimal place. EPOCHREALTIME keeps
 # the measurement sub-second without shelling out to an external timer.
 time_command() {
@@ -56,7 +71,8 @@ measure_variant() {
   clean=$(time_command "$@")
 
   note "measuring $label (incremental)"
-  touch "$BENCH_TOUCH_FILE"
+  [ -n "$BENCH_TOUCH_STAMP" ] || BENCH_TOUCH_STAMP=$(stat -c %Y -- "$BENCH_TOUCH_FILE")
+  touch -- "$BENCH_TOUCH_FILE"
   incremental=$(time_command "$@")
 
   unset CARGO_TARGET_DIR
diff --git a/scripts/install-dev-fast.sh b/scripts/install-dev-fast.sh
index 125626780..23463443d 100755
--- a/scripts/install-dev-fast.sh
+++ b/scripts/install-dev-fast.sh
@@ -14,6 +14,22 @@ script_dir=$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)
 
 MOLD_RELEASE_BASE_URL=${MOLD_RELEASE_BASE_URL:-https://github.com/rui314/mold/releases/download}
 
+# The scratch directory the EXIT trap removes. A trap whose action is a string
+# is re-parsed by the shell when it fires, so a path containing a quote — from a
+# quote-bearing `TMPDIR`, say — breaks the quoting and the cleanup never runs.
+# Naming a function instead means the path is only ever a variable, expanded at
+# removal time and never re-parsed. It is script-scope rather than local because
+# the trap fires after `install_mold` has returned.
+DEV_FAST_WORKDIR=
+
+remove_workdir() {
+  [ -n "$DEV_FAST_WORKDIR" ] || return 0
+  rm -rf -- "$DEV_FAST_WORKDIR"
+  DEV_FAST_WORKDIR=
+}
+
+trap remove_workdir EXIT
+
 # Verify the downloaded tarball against the single matching line in
 # SHA256SUMS. An unlisted artefact is a hard failure, never a silent skip.
 verify_mold_archive() {
@@ -46,9 +62,8 @@ install_mold() {
   name="mold-$version-$arch-linux.tar.gz"
   url="$MOLD_RELEASE_BASE_URL/v$version/$name"
 
-  workdir=$(mktemp -d)
-  # shellcheck disable=SC2064 # expand workdir now so the trap cannot lose it.
-  trap "rm -rf '$workdir'" EXIT
+  DEV_FAST_WORKDIR=$(mktemp -d)
+  workdir=$DEV_FAST_WORKDIR
 
   note "downloading $url"
   curl --fail --silent --show-error --location --output "$workdir/$name" "$url" ||
diff --git a/tests/dev_fast_make_target_tests.rs b/tests/dev_fast_make_target_tests.rs
index 28deee002..17c216e84 100644
--- a/tests/dev_fast_make_target_tests.rs
+++ b/tests/dev_fast_make_target_tests.rs
@@ -13,6 +13,7 @@
 
 use anyhow::{Context, Result, ensure};
 use rstest::rstest;
+use std::process::Command;
 use test_support::dev_fast::{
     BuildScenario, DEV_FAST_CONFIG_PATH, FakeRelease, MakeInvocation, RecordingCargo, Sandbox,
     combined, dev_fast_config, pinned_toolchain,
@@ -140,6 +141,53 @@ fn a_drifting_mold_invokes_cargo_not_at_all(#[case] target: &str) -> Result<()>
     Ok(())
 }
 
+/// Ask Cargo what the fragment means, rather than only what it contains.
+///
+/// Parsing the TOML proves the file is well-formed; it cannot prove Cargo
+/// accepts the key paths. A backend nested under the wrong table, or a
+/// misspelled key, parses perfectly and is then silently ignored. `cargo config
+/// get` reports Cargo's own resolved view, so a misplaced key shows up as a
+/// missing value instead of passing unnoticed.
+///
+/// This exercises configuration resolution, not code generation: proving
+/// Cranelift and `mold` are genuinely used needs both installed, which
+/// `make dev-fast-check` gates at the point of use.
+/// The Linux entry is queried through its parent table: `config get` cannot
+/// address a key whose name is a quoted `cfg` expression.
+#[rstest]
+#[case::dev_profile_backend(
+    "profile.dev.codegen-backend",
+    "profile.dev.codegen-backend = \"cranelift\""
+)]
+#[case::unstable_flag("unstable.codegen-backend", "unstable.codegen-backend = true")]
+#[case::linux_rustflags(
+    "target",
+    "target.'cfg(target_os = \"linux\")'.rustflags = \
+     [\"-Zpolonius=next\", \"-Clink-arg=-fuse-ld=mold\"]"
+)]
+fn cargo_resolves_the_fragment_to_the_intended_settings(
+    #[case] query: &str,
+    #[case] expected: &str,
+) -> Result<()> {
+    let output = Command::new(env!("CARGO"))
+        .args(["--config", DEV_FAST_CONFIG_PATH, "-Zunstable-options"])
+        .args(["config", "get", query])
+        .output()
+        .with_context(|| format!("ask cargo for {query}"))?;
+    let reported = String::from_utf8_lossy(&output.stdout);
+
+    ensure!(
+        output.status.success(),
+        "cargo should resolve `{query}`, got `{}`",
+        String::from_utf8_lossy(&output.stderr)
+    );
+    ensure!(
+        reported.contains(expected),
+        "cargo should report `{expected}`, got `{reported}`"
+    );
+    Ok(())
+}
+
 /// The recipes pass the fragment by path, so a test asserting only that the
 /// path appears would still pass if the file lost its contents. Read it.
 #[test]

From 85e0fefef0c2d2ae52a14878b87aab628e790525 Mon Sep 17 00:00:00 2001
From: leynos <leynos@troubledskies.net>
Date: Sun, 2 Aug 2026 15:27:57 +0200
Subject: [PATCH 20/24] Pin the drift regression to its cause

`a_drifting_mold_invokes_cargo_not_at_all` asserted that the target
failed and that Cargo was never reached, but not *why* it failed. A
missing `rustup`, or a broken recipe, would have satisfied it just as
well, so it would have stopped exercising the drift gate without ever
going red.

Assert the diagnostic names the mismatch and the pinned version.
Replacing the drift message with any other failure now fails both cases.
---
 tests/dev_fast_make_target_tests.rs | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/tests/dev_fast_make_target_tests.rs b/tests/dev_fast_make_target_tests.rs
index 17c216e84..800e12210 100644
--- a/tests/dev_fast_make_target_tests.rs
+++ b/tests/dev_fast_make_target_tests.rs
@@ -16,7 +16,7 @@ use rstest::rstest;
 use std::process::Command;
 use test_support::dev_fast::{
     BuildScenario, DEV_FAST_CONFIG_PATH, FakeRelease, MakeInvocation, RecordingCargo, Sandbox,
-    combined, dev_fast_config, pinned_toolchain,
+    combined, dev_fast_config, pinned_mold_version, pinned_toolchain,
 };
 
 /// The version the fake release is published as; see the installer tests.
@@ -132,6 +132,13 @@ fn a_drifting_mold_invokes_cargo_not_at_all(#[case] target: &str) -> Result<()>
         !output.status.success(),
         "`{target}` should fail on a drifting mold, got `{text}`"
     );
+    // Pin the failure to its cause. Asserting only the exit status would let
+    // this pass on an unrelated failure — a missing `rustup`, or a broken
+    // recipe — and so would stop testing the drift gate at all.
+    ensure!(
+        text.contains("does not match the pin") && text.contains(&pinned_mold_version()?),
+        "`{target}` should name the version mismatch and the pin, got `{text}`"
+    );
     let recorded = cargo.invocations()?;
     ensure!(
         recorded.is_empty(),

From 31ce5210e84a9501ca518fc02a6167839a865715 Mon Sep 17 00:00:00 2001
From: leynos <leynos@troubledskies.net>
Date: Sun, 2 Aug 2026 19:56:10 +0200
Subject: [PATCH 21/24] Bound the download, share the installer fixture, revive
 the seeds
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

All three findings were valid; two turned out to run deeper than
reported.

`curl` had no bound at either end, so a server that completes the
handshake and then stops sending left the installer waiting forever and
its own failure path unreachable. Bound the connect phase, and detect a
stalled transfer with `--speed-limit`/`--speed-time` rather than a flat
`--max-time`, which would punish a slow-but-progressing link. Three
cases assert the flags `curl` actually receives, since a bounded and an
unbounded download are indistinguishable from outside unless one is
left to hang.

Renaming the proptest regression files was not enough: they were inert.
Proptest's default `SourceParallel` persistence looks for a `lib.rs` or
`main.rs` beside the source, finds neither in an integration-test crate,
and gives up — it warned about this on every run. Deleting a file and
inducing a failure confirmed proptest neither read nor wrote them, so
the recorded seeds had never been replayed. Both blocks now name their
file with `FileFailurePersistence::Direct`; a deleted file is recreated
on failure, which is the proof the rename alone could not give.

`InstallerFixture`, `InstallerScenario`, and their two constants were
duplicated across the installer and checksum suites, and had already
drifted — the installer copy had grown two methods the other lacked.
The shared core moves beside `BuildScenario`, with the re-use policy
recorded in the developers' guide as the abstraction rules require: a
scenario earns its place once a second suite needs it, suite-specific
conveniences stay put, and constructors carry no assertions.
`ChecksumFailure` therefore stays with the installer tests.

Extracting that surfaced a latent hazard in the harness. `write_fake`
wrote through a symlink, and the utility allowlist symlinks real
binaries into the sandbox — so faking an already-linked utility, which
the `curl` test now does, would have truncated the host's copy. Only
file permissions had prevented it. It unlinks first.
---
 docs/developers-guide.md                      |  19 +++
 scripts/install-dev-fast.sh                   |  16 ++-
 test_support/src/dev_fast/mod.rs              |   4 +-
 test_support/src/dev_fast/sandbox.rs          |  20 +++
 test_support/src/dev_fast/scenario.rs         | 102 ++++++++++++-
 ...dev_fast_bench_tests.proptest-regressions} |   0
 tests/dev_fast_bench_tests.rs                 |  13 +-
 ..._fast_checksum_tests.proptest-regressions} |   0
 tests/dev_fast_checksum_tests.rs              |  77 +++-------
 tests/dev_fast_install_tests.rs               | 135 ++++++++----------
 10 files changed, 240 insertions(+), 146 deletions(-)
 rename tests/{dev_fast_make_target_tests.proptest-regressions => dev_fast_bench_tests.proptest-regressions} (100%)
 rename tests/{dev_fast_install_tests.proptest-regressions => dev_fast_checksum_tests.proptest-regressions} (100%)

diff --git a/docs/developers-guide.md b/docs/developers-guide.md
index f54225806..652828357 100644
--- a/docs/developers-guide.md
+++ b/docs/developers-guide.md
@@ -618,6 +618,25 @@ The fixtures live in `test_support::dev_fast`:
   entries are kept apart deliberately: a command-line variable outranks a `?=`
   default, whereas an environment entry is the only channel for a setting a
   script reads without the Makefile naming it.
+- `test_support::dev_fast::scenario` builds on the fixtures above to assemble
+  two starting points. `BuildScenario` is a sandbox where `make dev-fast-check`
+  passes — pinned `mold` on the install prefix, a `rustup` reporting the
+  Cranelift component, and a `RecordingCargo` installed — and is shared by the
+  Make-target and benchmark suites. `InstallerScenario` is a sandbox with a
+  published `FakeRelease` and a usable `rustup`, letting a test concentrate on
+  the linker half of the installer; the installer and checksum suites share
+  it. The module also exports `TEST_MOLD_VERSION`, deliberately not a real
+  `mold` version so a test that accidentally reaches the network fails rather
+  than silently succeeding against an upstream artefact, and `WRONG_SHA256`.
+  `InstallerFixture` groups the installer's pin path, checksum path, and
+  release URL, and renders them via `script_env()`.
+
+A scenario earns its place here once a second suite needs it, and not before;
+suite-specific conveniences stay with their suite — the installer tests keep
+their own `ChecksumFailure` enum and `with_failure` helper, because a fixture
+encoding one suite's failure taxonomy is not shared ground. Scenario
+constructors stay free of assertions, so a scenario cannot decide on a
+caller's behalf what counts as correct.
 
 Assert on the shape of a timing cell, never on a duration. Reuse the sandbox
 for any future target with the same shape, and do not reach for `PathGuard`:
diff --git a/scripts/install-dev-fast.sh b/scripts/install-dev-fast.sh
index 23463443d..a0a0498db 100755
--- a/scripts/install-dev-fast.sh
+++ b/scripts/install-dev-fast.sh
@@ -14,6 +14,11 @@ script_dir=$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)
 
 MOLD_RELEASE_BASE_URL=${MOLD_RELEASE_BASE_URL:-https://github.com/rui314/mold/releases/download}
 
+# Download bounds, overridable so a test can drive them without waiting.
+CURL_CONNECT_TIMEOUT=${CURL_CONNECT_TIMEOUT:-15}
+CURL_MIN_BYTES_PER_SECOND=${CURL_MIN_BYTES_PER_SECOND:-1024}
+CURL_STALL_SECONDS=${CURL_STALL_SECONDS:-60}
+
 # The scratch directory the EXIT trap removes. A trap whose action is a string
 # is re-parsed by the shell when it fires, so a path containing a quote — from a
 # quote-bearing `TMPDIR`, say — breaks the quoting and the cleanup never runs.
@@ -66,7 +71,16 @@ install_mold() {
   workdir=$DEV_FAST_WORKDIR
 
   note "downloading $url"
-  curl --fail --silent --show-error --location --output "$workdir/$name" "$url" ||
+  # Bound both the handshake and the transfer. Without these a server that
+  # accepts the connection and then stalls leaves `curl` waiting indefinitely,
+  # so the failure path below is never reached and `make install-dev-fast`
+  # simply hangs. The transfer bound is a stall detector rather than a deadline:
+  # a plain `--max-time` would punish a slow-but-progressing link, whereas
+  # `--speed-limit`/`--speed-time` only fire when throughput actually dies.
+  curl --fail --silent --show-error --location \
+    --connect-timeout "$CURL_CONNECT_TIMEOUT" \
+    --speed-limit "$CURL_MIN_BYTES_PER_SECOND" --speed-time "$CURL_STALL_SECONDS" \
+    --output "$workdir/$name" "$url" ||
     fail "failed to download $name"
   verify_mold_archive "$workdir/$name" "$name"
 
diff --git a/test_support/src/dev_fast/mod.rs b/test_support/src/dev_fast/mod.rs
index a088250f1..51ff7823f 100644
--- a/test_support/src/dev_fast/mod.rs
+++ b/test_support/src/dev_fast/mod.rs
@@ -39,4 +39,6 @@ pub use sandbox::{
     DEV_FAST_CONFIG_PATH, PinOverrides, Sandbox, combined, dev_fast_config, pinned_mold_version,
     pinned_toolchain,
 };
-pub use scenario::BuildScenario;
+pub use scenario::{
+    BuildScenario, InstallerFixture, InstallerScenario, TEST_MOLD_VERSION, WRONG_SHA256,
+};
diff --git a/test_support/src/dev_fast/sandbox.rs b/test_support/src/dev_fast/sandbox.rs
index c2559bab0..eede9273a 100644
--- a/test_support/src/dev_fast/sandbox.rs
+++ b/test_support/src/dev_fast/sandbox.rs
@@ -119,6 +119,17 @@ impl Sandbox {
     /// sites stay focused on the behaviour they are faking.
     pub fn write_fake(&self, dir: &Utf8Path, name: &str, body: &str) -> Result<Utf8PathBuf> {
         fs::create_dir_all(dir.as_std_path()).with_context(|| format!("create {dir}"))?;
+        // Unlink first. The utility allowlist symlinks real binaries into this
+        // directory, and writing to a symlink follows it — faking a utility
+        // that is already linked would otherwise truncate the host's copy of
+        // it. Only file permissions have stood between that and a broken
+        // system.
+        let target = dir.join(name);
+        match fs::remove_file(target.as_std_path()) {
+            Ok(()) => {}
+            Err(error) if error.kind() == ErrorKind::NotFound => {}
+            Err(error) => return Err(error).with_context(|| format!("replace {target}")),
+        }
         let script = format!("#!/bin/sh\n{body}\n");
         let path = write_exec_with_content(dir.as_std_path(), name, &script)?;
         Utf8PathBuf::try_from(path).context("fake executable path must be UTF-8")
@@ -156,6 +167,15 @@ impl Sandbox {
             .with_context(|| format!("backdate {path}"))
     }
 
+    /// Read a file staged in the sandbox.
+    ///
+    /// A missing file is an error rather than an empty string: a test asserting
+    /// on recorded output would otherwise read "the command was never run" as
+    /// "the command recorded nothing".
+    pub fn read_file(&self, path: &Utf8Path) -> Result<String> {
+        fs::read_to_string(path.as_std_path()).with_context(|| format!("read {path}"))
+    }
+
     /// Create a directory and any missing parents.
     pub fn create_dir(&self, path: &Utf8Path) -> Result<()> {
         fs::create_dir_all(path.as_std_path()).with_context(|| format!("create {path}"))
diff --git a/test_support/src/dev_fast/scenario.rs b/test_support/src/dev_fast/scenario.rs
index 772a83b86..35d395322 100644
--- a/test_support/src/dev_fast/scenario.rs
+++ b/test_support/src/dev_fast/scenario.rs
@@ -1,18 +1,106 @@
-//! A sandbox with every `dev-fast` prerequisite satisfied.
+//! Starting points that more than one `dev-fast` test suite needs.
 //!
-//! Shared because both the Make-recipe tests and the benchmark tests need the
-//! same starting point: a pinned `mold` on the install prefix, a `rustup` that
-//! reports the Cranelift component, and a recording Cargo standing in for the
-//! real one.
+//! Scope: these describe a *sandbox already in a known state*, not assertions
+//! about it. [`BuildScenario`] is a sandbox where `dev-fast-check` passes;
+//! [`InstallerScenario`] is one where a fake release is published and the
+//! toolchain half is already satisfied, so a test can concentrate on the
+//! linker half.
+//!
+//! Re-use policy: a scenario belongs here once a second suite needs it, and
+//! only then. Suite-specific conveniences stay with their suite — the
+//! installer tests keep their own `ChecksumFailure`, because a fixture that
+//! encodes one suite's failure taxonomy is not shared ground. Keep these
+//! constructors free of assertions so a scenario cannot decide, on a caller's
+//! behalf, what counts as correct.
 
 use anyhow::{Result, ensure};
 use camino::Utf8PathBuf;
 
 use super::{
-    CargoInvocation, MakeInvocation, RecordingCargo, Sandbox, combined, pinned_mold_version,
-    pinned_toolchain,
+    CargoInvocation, FakeRelease, MakeInvocation, RecordingCargo, Sandbox, combined,
+    pinned_mold_version, pinned_toolchain,
 };
 
+/// The version a fake mold release is published as.
+///
+/// Deliberately not a real mold version, so a test that accidentally reached
+/// the network would fail rather than silently succeed against an upstream
+/// artefact.
+pub const TEST_MOLD_VERSION: &str = "9.9.9";
+
+/// A well-formed digest that cannot match any artefact.
+pub const WRONG_SHA256: &str = "0000000000000000000000000000000000000000000000000000000000000000";
+
+/// The installer inputs pointing at a local fake release.
+///
+/// Grouping them keeps the pin path, checksum path, and URL travelling together
+/// as one value instead of as a handful of interchangeable strings.
+pub struct InstallerFixture {
+    version_pin: Utf8PathBuf,
+    checksums: Utf8PathBuf,
+    base_url: String,
+}
+
+impl InstallerFixture {
+    /// Environment overrides for a direct `install-dev-fast.sh` invocation.
+    pub fn script_env(&self) -> Vec<(&'static str, String)> {
+        vec![
+            ("MOLD_VERSION_FILE", self.version_pin.to_string()),
+            ("MOLD_SHA256SUMS_FILE", self.checksums.to_string()),
+            ("MOLD_RELEASE_BASE_URL", self.base_url.clone()),
+        ]
+    }
+}
+
+/// A sandbox with a published fake release and a usable `rustup`.
+pub struct InstallerScenario {
+    sandbox: Sandbox,
+    release: FakeRelease,
+}
+
+impl InstallerScenario {
+    /// Publish a release and make the Cranelift toolchain appear installed, so
+    /// only the linker half of the installer is under test.
+    pub fn prepare() -> Result<Self> {
+        let sandbox = Sandbox::new()?;
+        sandbox.write_rustup(&pinned_toolchain()?, true)?;
+        let release = FakeRelease::publish(&sandbox, TEST_MOLD_VERSION)?;
+        Ok(Self { sandbox, release })
+    }
+
+    /// The sandbox the scenario runs in.
+    pub fn sandbox(&self) -> &Sandbox {
+        &self.sandbox
+    }
+
+    /// The published release under test.
+    pub fn release(&self) -> &FakeRelease {
+        &self.release
+    }
+
+    /// Where a successful install lands the linker.
+    pub fn installed_mold(&self) -> Utf8PathBuf {
+        self.sandbox.prefix().join("bin/mold")
+    }
+
+    /// Installer inputs verified against `checksums`.
+    pub fn fixture(&self, checksums: Utf8PathBuf) -> Result<InstallerFixture> {
+        Ok(InstallerFixture {
+            version_pin: self.release.write_version_pin(&self.sandbox)?,
+            checksums,
+            base_url: self.release.base_url(),
+        })
+    }
+
+    /// Inputs recording the release's real digest, so verification passes.
+    pub fn with_matching_checksum(&self) -> Result<InstallerFixture> {
+        self.fixture(
+            self.release
+                .write_checksums(&self.sandbox, self.release.sha256())?,
+        )
+    }
+}
+
 /// A sandbox whose prerequisites all pass, with a recording `cargo` installed.
 pub struct BuildScenario {
     sandbox: Sandbox,
diff --git a/tests/dev_fast_make_target_tests.proptest-regressions b/tests/dev_fast_bench_tests.proptest-regressions
similarity index 100%
rename from tests/dev_fast_make_target_tests.proptest-regressions
rename to tests/dev_fast_bench_tests.proptest-regressions
diff --git a/tests/dev_fast_bench_tests.rs b/tests/dev_fast_bench_tests.rs
index 4006a82ea..74806c820 100644
--- a/tests/dev_fast_bench_tests.rs
+++ b/tests/dev_fast_bench_tests.rs
@@ -16,6 +16,7 @@ use anyhow::{Context, Result, bail, ensure};
 use camino::{Utf8Path, Utf8PathBuf};
 use proptest::prelude::*;
 use proptest::proptest;
+use proptest::test_runner::FileFailurePersistence;
 use std::time::{Duration, UNIX_EPOCH};
 use test_support::dev_fast::{
     BuildScenario, CargoInvocation, DEV_FAST_CONFIG_PATH, MakeInvocation, Sandbox, TargetState,
@@ -169,7 +170,17 @@ fn pre_state_strategy() -> impl Strategy<Value = PreState> {
 proptest! {
     // Nine combinations; a few extra draws cost little because the fake Cargo
     // returns immediately.
-    #![proptest_config(ProptestConfig { cases: 12, ..ProptestConfig::default() })]
+    #![proptest_config(ProptestConfig {
+        cases: 12,
+        // Name the file explicitly. The default `SourceParallel` policy
+        // looks for a `lib.rs` or `main.rs` beside the source and gives up
+        // in an integration-test crate, so recorded seeds were neither
+        // written nor replayed — the file on disk was inert.
+        failure_persistence: Some(Box::new(FileFailurePersistence::Direct(
+            "tests/dev_fast_bench_tests.proptest-regressions",
+        ))),
+        ..ProptestConfig::default()
+    })]
 
     /// Whatever each variant's target directory held beforehand, every variant
     /// must record a clean pass then an incremental one.
diff --git a/tests/dev_fast_install_tests.proptest-regressions b/tests/dev_fast_checksum_tests.proptest-regressions
similarity index 100%
rename from tests/dev_fast_install_tests.proptest-regressions
rename to tests/dev_fast_checksum_tests.proptest-regressions
diff --git a/tests/dev_fast_checksum_tests.rs b/tests/dev_fast_checksum_tests.rs
index c6f5f87f0..230f36e3d 100644
--- a/tests/dev_fast_checksum_tests.rs
+++ b/tests/dev_fast_checksum_tests.rs
@@ -13,61 +13,10 @@
 
 #![cfg(all(unix, target_os = "linux"))]
 
-use anyhow::Result;
-use camino::Utf8PathBuf;
 use proptest::prelude::*;
 use proptest::proptest;
-use test_support::dev_fast::{FakeRelease, Sandbox, combined, pinned_toolchain};
-
-/// The version the fake release is published as; see the installer tests.
-const TEST_MOLD_VERSION: &str = "9.9.9";
-
-/// A digest that cannot match any artefact.
-const WRONG_SHA256: &str = "0000000000000000000000000000000000000000000000000000000000000000";
-
-/// The installer inputs pointing at a local fake release.
-struct InstallerFixture {
-    version_pin: Utf8PathBuf,
-    checksums: Utf8PathBuf,
-    base_url: String,
-}
-
-impl InstallerFixture {
-    fn script_env(&self) -> Vec<(&'static str, String)> {
-        vec![
-            ("MOLD_VERSION_FILE", self.version_pin.to_string()),
-            ("MOLD_SHA256SUMS_FILE", self.checksums.to_string()),
-            ("MOLD_RELEASE_BASE_URL", self.base_url.clone()),
-        ]
-    }
-}
-
-/// A sandbox with a published fake release and a usable `rustup`.
-struct InstallerScenario {
-    sandbox: Sandbox,
-    release: FakeRelease,
-}
-
-impl InstallerScenario {
-    fn prepare() -> Result<Self> {
-        let sandbox = Sandbox::new()?;
-        sandbox.write_rustup(&pinned_toolchain()?, true)?;
-        let release = FakeRelease::publish(&sandbox, TEST_MOLD_VERSION)?;
-        Ok(Self { sandbox, release })
-    }
-
-    fn fixture(&self, checksums: Utf8PathBuf) -> Result<InstallerFixture> {
-        Ok(InstallerFixture {
-            version_pin: self.release.write_version_pin(&self.sandbox)?,
-            checksums,
-            base_url: self.release.base_url(),
-        })
-    }
-
-    fn installed_mold(&self) -> Utf8PathBuf {
-        self.sandbox.prefix().join("bin/mold")
-    }
-}
+use proptest::test_runner::FileFailurePersistence;
+use test_support::dev_fast::{InstallerScenario, WRONG_SHA256, combined};
 
 /// How one recorded digest relates to the artefact's real one.
 #[derive(Copy, Clone, Debug)]
@@ -168,7 +117,17 @@ fn row_strategy() -> impl Strategy<Value = Row> {
 proptest! {
     // Each case runs the installer, so keep the corpus small enough to stay a
     // second or two while still ranging over the row space.
-    #![proptest_config(ProptestConfig { cases: 24, ..ProptestConfig::default() })]
+    #![proptest_config(ProptestConfig {
+        cases: 24,
+        // Name the file explicitly. The default `SourceParallel` policy
+        // looks for a `lib.rs` or `main.rs` beside the source and gives up
+        // in an integration-test crate, so recorded seeds were neither
+        // written nor replayed — the file on disk was inert.
+        failure_persistence: Some(Box::new(FileFailurePersistence::Direct(
+            "tests/dev_fast_checksum_tests.proptest-regressions",
+        ))),
+        ..ProptestConfig::default()
+    })]
 
     /// Whatever rows a checksum file carries, the installer's decision must
     /// match the model, and a refusal must leave nothing unpacked.
@@ -183,13 +142,13 @@ proptest! {
     ) {
         let scenario = InstallerScenario::prepare()
             .map_err(|error| TestCaseError::fail(error.to_string()))?;
-        let real = scenario.release.sha256().to_owned();
-        let artefact = scenario.release.name().to_owned();
+        let real = scenario.release().sha256().to_owned();
+        let artefact = scenario.release().name().to_owned();
         let contents: String = rows.iter().map(|row| row.render(&real, &artefact)).collect();
 
-        let checksums = scenario.sandbox.home().join("SHA256SUMS");
+        let checksums = scenario.sandbox().home().join("SHA256SUMS");
         scenario
-            .sandbox
+            .sandbox()
             .write_file(&checksums, &contents)
             .map_err(|error| TestCaseError::fail(error.to_string()))?;
         let fixture = scenario
@@ -197,7 +156,7 @@ proptest! {
             .map_err(|error| TestCaseError::fail(error.to_string()))?;
 
         let output = scenario
-            .sandbox
+            .sandbox()
             .script("install-dev-fast.sh", &fixture.script_env())
             .map_err(|error| TestCaseError::fail(error.to_string()))?;
 
diff --git a/tests/dev_fast_install_tests.rs b/tests/dev_fast_install_tests.rs
index 21e0dd699..fc7cad620 100644
--- a/tests/dev_fast_install_tests.rs
+++ b/tests/dev_fast_install_tests.rs
@@ -15,78 +15,19 @@ use proptest::prelude::*;
 use proptest::proptest;
 use rstest::rstest;
 use test_support::dev_fast::{
-    FakeRelease, PinOverrides, Sandbox, combined, pinned_mold_version, pinned_toolchain,
+    FakeRelease, InstallerFixture, InstallerScenario, PinOverrides, Sandbox, WRONG_SHA256,
+    combined, pinned_mold_version, pinned_toolchain,
 };
 
-/// The version the fake release is published as. Deliberately not a real mold
-/// version, so a test that accidentally reached the network would fail rather
-/// than silently succeed against an upstream artefact.
-const TEST_MOLD_VERSION: &str = "9.9.9";
-
-/// A digest that cannot match any artefact, for the mismatch case.
-const WRONG_SHA256: &str = "0000000000000000000000000000000000000000000000000000000000000000";
-
-/// The installer inputs pointing at a local fake release.
+/// Inputs whose checksum file fails verification in the given way.
 ///
-/// Grouping them keeps the version, pin path, checksum path, and URL travelling
-/// together as one value instead of as a handful of interchangeable strings.
-struct InstallerFixture {
-    version_pin: Utf8PathBuf,
-    checksums: Utf8PathBuf,
-    base_url: String,
-}
-
-impl InstallerFixture {
-    /// Environment overrides for a direct `install-dev-fast.sh` invocation.
-    fn script_env(&self) -> Vec<(&'static str, String)> {
-        vec![
-            ("MOLD_VERSION_FILE", self.version_pin.to_string()),
-            ("MOLD_SHA256SUMS_FILE", self.checksums.to_string()),
-            ("MOLD_RELEASE_BASE_URL", self.base_url.clone()),
-        ]
-    }
-}
-
-/// A sandbox with a published fake release and a usable `rustup`.
-struct InstallerScenario {
-    sandbox: Sandbox,
-    release: FakeRelease,
-}
-
-impl InstallerScenario {
-    /// Publish a release and make the Cranelift toolchain appear installed, so
-    /// only the linker half of the installer is under test.
-    fn prepare() -> Result<Self> {
-        let sandbox = Sandbox::new()?;
-        sandbox.write_rustup(&pinned_toolchain()?, true)?;
-        let release = FakeRelease::publish(&sandbox, TEST_MOLD_VERSION)?;
-        Ok(Self { sandbox, release })
-    }
-
-    /// Fixture recording the release's real digest, so verification passes.
-    fn with_matching_checksum(&self) -> Result<InstallerFixture> {
-        self.fixture(
-            self.release
-                .write_checksums(&self.sandbox, self.release.sha256())?,
-        )
-    }
-
-    /// Fixture whose checksum file fails verification in the given way.
-    fn with_failure(&self, failure: ChecksumFailure) -> Result<InstallerFixture> {
-        self.fixture(failure.write_checksums(&self.sandbox, &self.release)?)
-    }
-
-    fn fixture(&self, checksums: Utf8PathBuf) -> Result<InstallerFixture> {
-        Ok(InstallerFixture {
-            version_pin: self.release.write_version_pin(&self.sandbox)?,
-            checksums,
-            base_url: self.release.base_url(),
-        })
-    }
-
-    fn installed_mold(&self) -> Utf8PathBuf {
-        self.sandbox.prefix().join("bin/mold")
-    }
+/// Stays with this suite rather than moving to `test_support`: it encodes one
+/// suite's failure taxonomy, which is not shared ground.
+fn with_failure(
+    scenario: &InstallerScenario,
+    failure: ChecksumFailure,
+) -> Result<InstallerFixture> {
+    scenario.fixture(failure.write_checksums(scenario.sandbox(), scenario.release())?)
 }
 
 /// The ways verification can legitimately fail.
@@ -124,7 +65,7 @@ fn installs_and_records_the_verification_when_the_checksum_matches() -> Result<(
     let fixture = scenario.with_matching_checksum()?;
 
     let output = scenario
-        .sandbox
+        .sandbox()
         .script("install-dev-fast.sh", &fixture.script_env())?;
     let text = combined(&output);
 
@@ -133,7 +74,7 @@ fn installs_and_records_the_verification_when_the_checksum_matches() -> Result<(
         "install should succeed, got `{text}`"
     );
     ensure!(
-        text.contains(&format!("verified {}", scenario.release.name())),
+        text.contains(&format!("verified {}", scenario.release().name())),
         "should report the verification, got `{text}`"
     );
     ensure!(
@@ -143,7 +84,7 @@ fn installs_and_records_the_verification_when_the_checksum_matches() -> Result<(
     // Assert on the commands rustup actually received, not on the installer's
     // own narration of them: a diagnostic can be emitted without the command
     // ever running.
-    let rustup = scenario.sandbox.rustup_invocations()?;
+    let rustup = scenario.sandbox().rustup_invocations()?;
     let toolchain = pinned_toolchain()?;
     ensure!(
         rustup
@@ -162,19 +103,59 @@ fn installs_and_records_the_verification_when_the_checksum_matches() -> Result<(
     Ok(())
 }
 
+/// The download must be bounded at both ends.
+///
+/// A server that completes the handshake and then stops sending leaves an
+/// unbounded `curl` waiting forever, so `install-dev-fast` hangs and its own
+/// failure path is never reached. Asserting on the flags `curl` actually
+/// received is the only way to see that from outside: a bounded and an
+/// unbounded download look identical unless one is left to stall.
+#[rstest]
+#[case::connect_timeout("--connect-timeout")]
+#[case::stall_floor("--speed-limit")]
+#[case::stall_window("--speed-time")]
+fn the_download_is_bounded_at_both_ends(#[case] flag: &str) -> Result<()> {
+    let scenario = InstallerScenario::prepare()?;
+    let fixture = scenario.with_matching_checksum()?;
+    let log = scenario.sandbox().home().join("curl-args.log");
+    // Record and fail: the arguments are the subject, and refusing the download
+    // keeps the case hermetic.
+    scenario.sandbox().write_fake(
+        &scenario.sandbox().bin(),
+        "curl",
+        &format!("printf '%s\\n' \"$*\" >> '{log}'\nexit 7"),
+    )?;
+
+    let output = scenario
+        .sandbox()
+        .script("install-dev-fast.sh", &fixture.script_env())?;
+    ensure!(
+        !output.status.success(),
+        "a refused download should abort, got `{}`",
+        combined(&output)
+    );
+
+    let recorded = scenario.sandbox().read_file(&log)?;
+    ensure!(
+        recorded.contains(flag),
+        "curl should receive `{flag}`, got `{recorded}`"
+    );
+    Ok(())
+}
+
 /// A refused artefact must abort before the toolchain half runs, so rustup sees
 /// nothing beyond whatever the capability probe needed.
 #[test]
 fn a_refused_artefact_never_reaches_the_toolchain_install() -> Result<()> {
     let scenario = InstallerScenario::prepare()?;
-    let fixture = scenario.with_failure(ChecksumFailure::Mismatch)?;
+    let fixture = with_failure(&scenario, ChecksumFailure::Mismatch)?;
 
     let output = scenario
-        .sandbox
+        .sandbox()
         .script("install-dev-fast.sh", &fixture.script_env())?;
     ensure!(!output.status.success(), "install should abort");
 
-    let rustup = scenario.sandbox.rustup_invocations()?;
+    let rustup = scenario.sandbox().rustup_invocations()?;
     ensure!(
         !rustup
             .iter()
@@ -191,10 +172,10 @@ fn a_refused_artefact_never_reaches_the_toolchain_install() -> Result<()> {
 #[case::missing_entry(ChecksumFailure::MissingEntry)]
 fn refuses_to_install_an_unverifiable_artefact(#[case] failure: ChecksumFailure) -> Result<()> {
     let scenario = InstallerScenario::prepare()?;
-    let fixture = scenario.with_failure(failure)?;
+    let fixture = with_failure(&scenario, failure)?;
 
     let output = scenario
-        .sandbox
+        .sandbox()
         .script("install-dev-fast.sh", &fixture.script_env())?;
     let text = combined(&output);
 

From 1b8d9ebcdebe636490ea679994d276f628f3bdb4 Mon Sep 17 00:00:00 2001
From: leynos <leynos@troubledskies.net>
Date: Sun, 2 Aug 2026 21:52:17 +0200
Subject: [PATCH 22/24] Make the timestamps portable and the fallbacks tested
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

`bench-build.sh` restored the touched file's mtime with `stat -c %Y` and
`touch -d @epoch`, both GNU extensions. On macOS or a BSD the capture
silently produced an empty stamp and the restore was a no-op, so a
benchmark run left the source file permanently newer than it was found.
Carry the timestamp in a scratch file and copy it back with POSIX
`touch -r` instead, which needs no formatting at either end.

The non-Linux path through the capability check and the installer was
documented but unreachable from CI, so it could rot unnoticed. Faking
`uname` makes both branches testable from Linux: the check now proves it
skips mold, names the host, and still demands Cranelift; the installer
proves it skips the download entirely and still adds the component.

Drop `FakeRelease::version()`, which no caller used, and split the two
files that had grown past the 400-line cap — pin resolution into
`dev_fast_pin_tests.rs`, fixture staging into `dev_fast/staging.rs`.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 docs/developers-guide.md             |  18 ++-
 scripts/bench-build.sh               |  22 +++-
 test_support/src/dev_fast/mod.rs     |   1 +
 test_support/src/dev_fast/release.rs |   5 -
 test_support/src/dev_fast/sandbox.rs |  57 +-------
 test_support/src/dev_fast/staging.rs |  87 ++++++++++++
 tests/dev_fast_bench_tests.rs        |  46 +++++++
 tests/dev_fast_check_tests.rs        | 166 +++++------------------
 tests/dev_fast_pin_tests.rs          | 189 +++++++++++++++++++++++++++
 9 files changed, 382 insertions(+), 209 deletions(-)
 create mode 100644 test_support/src/dev_fast/staging.rs
 create mode 100644 tests/dev_fast_pin_tests.rs

diff --git a/docs/developers-guide.md b/docs/developers-guide.md
index 652828357..7bf8d9e06 100644
--- a/docs/developers-guide.md
+++ b/docs/developers-guide.md
@@ -500,12 +500,12 @@ rustflags list carrying both `-Zpolonius=next` and
 ### Composition rules
 
 - **Quality gates.** `make check-fmt`, `make lint`, `make lint-clippy`,
-  `make test`, and `make typecheck` are unchanged and remain on the stable
-  toolchain from `rust-toolchain.toml` with the default LLVM backend. The
-  `dev-*` targets are not part of `make test`, `make lint`, `make check-fmt`, or
-  `make all`, mirroring the Kani boundary described below. Run the ordinary
-  gates before proposing a change; `make dev-test` is a faster inner-loop
-  proxy, not a substitute.
+  `make test`, and `make typecheck` are unchanged and remain on the
+  repository's pinned nightly toolchain from `rust-toolchain.toml` with the
+  default LLVM backend. The `dev-*` targets are not part of `make test`,
+  `make lint`, `make check-fmt`, or `make all`, mirroring the Kani boundary
+  described below. Run the ordinary gates before proposing a change;
+  `make dev-test` is a faster inner-loop proxy, not a substitute.
 - **`RUSTFLAGS`.** `make test-nextest`, `make doctest`, and `make typecheck`
   set `RUSTFLAGS="-D warnings"`. An externally set `RUSTFLAGS` overrides the
   `[target.*]` `rustflags` in a Cargo configuration file, so the `dev-*`
@@ -678,7 +678,11 @@ the `netsuke` binary from an empty target directory, touches `src/main.rs`, and
 rebuilds. Each variant uses its own target directory under `target/bench/`, so
 neither warms the other's cache nor disturbs the working `target/` tree. The
 timer reads `EPOCHREALTIME`, so this target needs Bash 5.0 or newer; it fails
-with a named prerequisite on older shells rather than reporting zeroes.
+with a named prerequisite on older shells rather than reporting zeroes. The
+benchmark assumes it is the only run in flight: `BENCH_ROOT` and
+`BENCH_TOUCH_FILE` default to the shared `target/bench` directory and the
+tracked `src/main.rs`, so concurrent runs would interfere with each other's
+measurements; run one at a time, or override both variables per run.
 
 Results below were recorded on a 24-core x86_64 Linux host, with both variants
 on the repository's own `nightly-2026-06-25` supplying Cranelift 0.132.0, and
diff --git a/scripts/bench-build.sh b/scripts/bench-build.sh
index bd21257e3..546facc7a 100755
--- a/scripts/bench-build.sh
+++ b/scripts/bench-build.sh
@@ -31,14 +31,21 @@ results=()
 
 # The benchmark touches BENCH_TOUCH_FILE to make the second pass incremental,
 # and that file defaults to a tracked source. Leaving it newer than the ordinary
-# `target/` outputs would silently force the developer's next real build to
-# redo work, long after the benchmark finished, so the timestamp is restored on
-# exit — including when a measurement fails or the run is interrupted.
+# `target/` outputs would silently force the developer's next real build to redo
+# work, long after the benchmark finished, so the timestamp is restored on exit —
+# including when a measurement fails or the run is interrupted.
+#
+# This holds a scratch file whose own timestamp is the one to put back, rather
+# than an epoch number: `touch -r` is POSIX, whereas reading the stamp with
+# `stat -c` and replaying it with `touch -d @epoch` is GNU-only and fails on
+# macOS. The benchmark is reachable there, because the capability check tolerates
+# a non-Linux host rather than aborting.
 BENCH_TOUCH_STAMP=
 
 restore_touch_file() {
   [ -n "$BENCH_TOUCH_STAMP" ] || return 0
-  touch -d "@$BENCH_TOUCH_STAMP" -- "$BENCH_TOUCH_FILE" || true
+  touch -r "$BENCH_TOUCH_STAMP" "$BENCH_TOUCH_FILE" || true
+  rm -f "$BENCH_TOUCH_STAMP"
   BENCH_TOUCH_STAMP=
 }
 
@@ -71,8 +78,11 @@ measure_variant() {
   clean=$(time_command "$@")
 
   note "measuring $label (incremental)"
-  [ -n "$BENCH_TOUCH_STAMP" ] || BENCH_TOUCH_STAMP=$(stat -c %Y -- "$BENCH_TOUCH_FILE")
-  touch -- "$BENCH_TOUCH_FILE"
+  if [ -z "$BENCH_TOUCH_STAMP" ]; then
+    BENCH_TOUCH_STAMP=$(mktemp)
+    touch -r "$BENCH_TOUCH_FILE" "$BENCH_TOUCH_STAMP"
+  fi
+  touch "$BENCH_TOUCH_FILE"
   incremental=$(time_command "$@")
 
   unset CARGO_TARGET_DIR
diff --git a/test_support/src/dev_fast/mod.rs b/test_support/src/dev_fast/mod.rs
index 51ff7823f..ee14a6bd6 100644
--- a/test_support/src/dev_fast/mod.rs
+++ b/test_support/src/dev_fast/mod.rs
@@ -31,6 +31,7 @@ mod make;
 mod release;
 mod sandbox;
 mod scenario;
+mod staging;
 
 pub use cargo_log::{CargoInvocation, RecordingCargo, TargetState};
 pub use make::MakeInvocation;
diff --git a/test_support/src/dev_fast/release.rs b/test_support/src/dev_fast/release.rs
index f5ab1e65f..5b4a708b5 100644
--- a/test_support/src/dev_fast/release.rs
+++ b/test_support/src/dev_fast/release.rs
@@ -44,11 +44,6 @@ impl FakeRelease {
         })
     }
 
-    /// The version this release was published as.
-    pub fn version(&self) -> &str {
-        &self.version
-    }
-
     /// The artefact's file name, as it appears in a checksum file.
     pub fn name(&self) -> &str {
         &self.name
diff --git a/test_support/src/dev_fast/sandbox.rs b/test_support/src/dev_fast/sandbox.rs
index eede9273a..fd5a84a56 100644
--- a/test_support/src/dev_fast/sandbox.rs
+++ b/test_support/src/dev_fast/sandbox.rs
@@ -5,11 +5,9 @@
 use anyhow::{Context, Result, bail};
 use camino::{Utf8Path, Utf8PathBuf};
 use std::fs;
-use std::fs::File;
 use std::io::ErrorKind;
-use std::os::unix::fs::{FileExt, PermissionsExt};
+use std::os::unix::fs::PermissionsExt;
 use std::process::{Command, Output};
-use std::time::SystemTime;
 use tempfile::{TempDir, tempdir};
 
 use super::MakeInvocation;
@@ -135,59 +133,6 @@ impl Sandbox {
         Utf8PathBuf::try_from(path).context("fake executable path must be UTF-8")
     }
 
-    /// Write a fixture file, creating its parent directory.
-    ///
-    /// Offered here, along with [`create_dir`](Self::create_dir) and
-    /// [`write_file_with_mtime`](Self::write_file_with_mtime), so test crates
-    /// can stage fixtures without reaching for `std::fs` themselves. That keeps
-    /// the ambient filesystem access inside this already-sanctioned support
-    /// crate instead of widening the Whitaker exclusion list.
-    pub fn write_file(&self, path: &Utf8Path, contents: &str) -> Result<()> {
-        self.create_parent(path)?;
-        fs::write(path.as_std_path(), contents).with_context(|| format!("write {path}"))
-    }
-
-    /// Write a fixture file and backdate it to `mtime`, in seconds since the
-    /// Unix epoch.
-    ///
-    /// Tests that need to observe a later `touch` compare against a fixed old
-    /// timestamp rather than against each other, which keeps the observation
-    /// free of filesystem timestamp granularity.
-    pub fn write_file_with_mtime(
-        &self,
-        path: &Utf8Path,
-        contents: &str,
-        mtime: SystemTime,
-    ) -> Result<()> {
-        self.create_parent(path)?;
-        let file = File::create(path.as_std_path()).with_context(|| format!("create {path}"))?;
-        file.write_all_at(contents.as_bytes(), 0)
-            .with_context(|| format!("write {path}"))?;
-        file.set_modified(mtime)
-            .with_context(|| format!("backdate {path}"))
-    }
-
-    /// Read a file staged in the sandbox.
-    ///
-    /// A missing file is an error rather than an empty string: a test asserting
-    /// on recorded output would otherwise read "the command was never run" as
-    /// "the command recorded nothing".
-    pub fn read_file(&self, path: &Utf8Path) -> Result<String> {
-        fs::read_to_string(path.as_std_path()).with_context(|| format!("read {path}"))
-    }
-
-    /// Create a directory and any missing parents.
-    pub fn create_dir(&self, path: &Utf8Path) -> Result<()> {
-        fs::create_dir_all(path.as_std_path()).with_context(|| format!("create {path}"))
-    }
-
-    fn create_parent(&self, path: &Utf8Path) -> Result<()> {
-        match path.parent() {
-            Some(parent) => self.create_dir(parent),
-            None => Ok(()),
-        }
-    }
-
     /// A `mold` reporting the given version, formatted as the real one does.
     pub fn write_mold(&self, dir: &Utf8Path, version: &str) -> Result<Utf8PathBuf> {
         self.write_fake(
diff --git a/test_support/src/dev_fast/staging.rs b/test_support/src/dev_fast/staging.rs
new file mode 100644
index 000000000..8601f068d
--- /dev/null
+++ b/test_support/src/dev_fast/staging.rs
@@ -0,0 +1,87 @@
+//! Staging fixtures into a [`Sandbox`].
+//!
+//! Split from `sandbox.rs` to keep both files within the repository's
+//! file-length limit. These are `Sandbox` methods, offered so test crates can
+//! write, read, and time-stamp fixtures without reaching for `std::fs`
+//! themselves — which keeps the ambient filesystem access inside this
+//! already-sanctioned support crate rather than widening the Whitaker
+//! exclusion list.
+
+use anyhow::{Context, Result};
+use camino::Utf8Path;
+use std::fs;
+use std::fs::File;
+use std::os::unix::fs::FileExt;
+use std::time::SystemTime;
+
+use super::Sandbox;
+
+impl Sandbox {
+    /// Write a fixture file, creating its parent directory.
+    ///
+    /// Offered here, along with [`create_dir`](Self::create_dir) and
+    /// [`write_file_with_mtime`](Self::write_file_with_mtime), so test crates
+    /// can stage fixtures without reaching for `std::fs` themselves. That keeps
+    /// the ambient filesystem access inside this already-sanctioned support
+    /// crate instead of widening the Whitaker exclusion list.
+    pub fn write_file(&self, path: &Utf8Path, contents: &str) -> Result<()> {
+        self.create_parent(path)?;
+        fs::write(path.as_std_path(), contents).with_context(|| format!("write {path}"))
+    }
+
+    /// Write a fixture file and backdate it to `mtime`, in seconds since the
+    /// Unix epoch.
+    ///
+    /// Tests that need to observe a later `touch` compare against a fixed old
+    /// timestamp rather than against each other, which keeps the observation
+    /// free of filesystem timestamp granularity.
+    pub fn write_file_with_mtime(
+        &self,
+        path: &Utf8Path,
+        contents: &str,
+        mtime: SystemTime,
+    ) -> Result<()> {
+        self.create_parent(path)?;
+        let file = File::create(path.as_std_path()).with_context(|| format!("create {path}"))?;
+        file.write_all_at(contents.as_bytes(), 0)
+            .with_context(|| format!("write {path}"))?;
+        file.set_modified(mtime)
+            .with_context(|| format!("backdate {path}"))
+    }
+
+    /// Read a file staged in the sandbox.
+    ///
+    /// A missing file is an error rather than an empty string: a test asserting
+    /// on recorded output would otherwise read "the command was never run" as
+    /// "the command recorded nothing".
+    pub fn read_file(&self, path: &Utf8Path) -> Result<String> {
+        fs::read_to_string(path.as_std_path()).with_context(|| format!("read {path}"))
+    }
+
+    /// A file's modification time, in whole seconds since the Unix epoch.
+    ///
+    /// Whole seconds because the callers compare against a deliberately
+    /// backdated stamp, not against each other.
+    pub fn mtime_seconds(&self, path: &Utf8Path) -> Result<i64> {
+        let modified = fs::metadata(path.as_std_path())
+            .with_context(|| format!("stat {path}"))?
+            .modified()
+            .with_context(|| format!("read mtime of {path}"))?;
+        let since_epoch = modified
+            .duration_since(SystemTime::UNIX_EPOCH)
+            .with_context(|| format!("{path} predates the Unix epoch"))?;
+        i64::try_from(since_epoch.as_secs()).context("mtime does not fit in i64")
+    }
+
+    /// Create a directory and any missing parents.
+    pub fn create_dir(&self, path: &Utf8Path) -> Result<()> {
+        fs::create_dir_all(path.as_std_path()).with_context(|| format!("create {path}"))
+    }
+
+    fn create_parent(&self, path: &Utf8Path) -> Result<()> {
+        match path.parent() {
+            Some(parent) => self.create_dir(parent),
+            None => Ok(()),
+        }
+    }
+}
diff --git a/tests/dev_fast_bench_tests.rs b/tests/dev_fast_bench_tests.rs
index 74806c820..498d31c8b 100644
--- a/tests/dev_fast_bench_tests.rs
+++ b/tests/dev_fast_bench_tests.rs
@@ -17,6 +17,7 @@ use camino::{Utf8Path, Utf8PathBuf};
 use proptest::prelude::*;
 use proptest::proptest;
 use proptest::test_runner::FileFailurePersistence;
+use rstest::rstest;
 use std::time::{Duration, UNIX_EPOCH};
 use test_support::dev_fast::{
     BuildScenario, CargoInvocation, DEV_FAST_CONFIG_PATH, MakeInvocation, Sandbox, TargetState,
@@ -236,6 +237,51 @@ proptest! {
     }
 }
 
+/// The touched file's timestamp must be put back, whether the run finishes or
+/// aborts partway.
+///
+/// The benchmark touches a tracked source to make its second pass incremental.
+/// Leaving it newer than `target/` would make the developer's next ordinary
+/// build redo work for reasons nothing on screen explains — and a failed run is
+/// the case most likely to leave it that way, so it is the one worth asserting.
+#[rstest]
+#[case::completes(true)]
+#[case::aborts(false)]
+fn the_touched_file_is_restored_however_the_run_ends(#[case] succeeds: bool) -> Result<()> {
+    let scenario = BuildScenario::prepare()?;
+    let sandbox = scenario.sandbox();
+    let fixture = prepare_bench_fixture(&scenario)?;
+
+    if !succeeds {
+        // Fail the second variant, after the first has already touched the file.
+        sandbox.write_fake(
+            &sandbox.bin(),
+            "cargo",
+            "case \"$*\" in *--config*) exit 1 ;; *) exit 0 ;; esac",
+        )?;
+    }
+
+    let invocation = MakeInvocation::new("bench-build")
+        .variable("CARGO", scenario.cargo().executable())
+        .environment("BENCH_ROOT", &fixture.root)
+        .environment("BENCH_TOUCH_FILE", &fixture.touch_file);
+    let output = sandbox.run_make(&invocation)?;
+    ensure!(
+        output.status.success() == succeeds,
+        "the run should {} , got `{}`",
+        if succeeds { "succeed" } else { "abort" },
+        combined(&output)
+    );
+
+    ensure!(
+        sandbox.mtime_seconds(&fixture.touch_file)? == fixture.baseline_mtime,
+        "the touched file should be restored to {}, found {}",
+        fixture.baseline_mtime,
+        sandbox.mtime_seconds(&fixture.touch_file)?
+    );
+    Ok(())
+}
+
 #[test]
 fn bench_target_emits_both_variant_rows() -> Result<()> {
     let scenario = BuildScenario::prepare()?;
diff --git a/tests/dev_fast_check_tests.rs b/tests/dev_fast_check_tests.rs
index d5e1bf5f1..a32bab43c 100644
--- a/tests/dev_fast_check_tests.rs
+++ b/tests/dev_fast_check_tests.rs
@@ -40,173 +40,69 @@ fn reports_resolved_path_and_version_when_prerequisites_are_met() -> Result<()>
     Ok(())
 }
 
-/// Run without the pin-file variables, the check must still find the committed
-/// pins by locating the repository from the script's own path.
+/// On a host without `mold`, the check reports the platform-linker fallback and
+/// still passes.
+///
+/// The documented promise is that macOS and Windows keep Cranelift and lose
+/// only the linker. Faking `uname` is what makes that testable from Linux —
+/// otherwise the branch is reachable only on hardware CI does not have, which
+/// is exactly where an untested fallback rots.
 #[test]
-fn falls_back_to_the_committed_pins_when_no_overrides_are_given() -> Result<()> {
+fn a_non_linux_host_skips_mold_and_still_passes() -> Result<()> {
     let sandbox = Sandbox::new()?;
-    // Both fakes report exactly what the committed pins name, so the check can
-    // only pass if it read those files rather than defaulting to nothing. The
-    // mold goes on the sandbox PATH directly: only the Make recipes prepend the
-    // install prefix, and this case invokes the script itself.
-    sandbox.write_mold(&sandbox.bin(), &pinned_mold_version()?)?;
     sandbox.write_rustup(&pinned_toolchain()?, true)?;
+    // No mold anywhere: the point is that its absence stops mattering.
+    sandbox.write_fake(&sandbox.bin(), "uname", "echo Darwin")?;
 
     let output = sandbox.script_with("dev-fast-check.sh", PinOverrides::Omitted, &[])?;
     let text = combined(&output);
 
     ensure!(
         output.status.success(),
-        "check should pass on the committed pins, got `{text}`"
+        "a non-Linux host should pass without mold, got `{text}`"
     );
     ensure!(
-        text.contains(&format!("mold {}", pinned_mold_version()?)),
-        "should read tools/mold/VERSION by default, got `{text}`"
+        text.contains("mold is Linux-only") && text.contains("Darwin"),
+        "should name the fallback and the host, got `{text}`"
     );
     ensure!(
-        text.contains(&pinned_toolchain()?),
-        "should read rust-toolchain.toml by default, got `{text}`"
+        text.contains("rustc-codegen-cranelift-preview"),
+        "Cranelift should still be required off Linux, got `{text}`"
     );
     Ok(())
 }
 
-/// The drift diagnostic names the pinned version, so a mismatching fake proves
-/// which file the default resolved to rather than merely that some file was
-/// read.
+/// The installer likewise skips the linker off Linux rather than failing, and
+/// goes on to install the toolchain half.
 #[test]
-fn default_pins_are_the_committed_ones_not_an_empty_fallback() -> Result<()> {
+fn a_non_linux_host_skips_the_mold_install() -> Result<()> {
     let sandbox = Sandbox::new()?;
-    sandbox.write_mold(&sandbox.bin(), "99.0.0")?;
     sandbox.write_rustup(&pinned_toolchain()?, true)?;
-
-    let output = sandbox.script_with("dev-fast-check.sh", PinOverrides::Omitted, &[])?;
-    let text = combined(&output);
-
-    ensure!(
-        !output.status.success(),
-        "a drift should fail, got `{text}`"
-    );
-    ensure!(
-        text.contains(&format!("the pin {}", pinned_mold_version()?)),
-        "the drift message should name the committed pin, got `{text}`"
-    );
-    Ok(())
-}
-
-/// An override must still win over the default.
-#[test]
-fn an_explicit_pin_override_wins_over_the_committed_default() -> Result<()> {
-    let sandbox = Sandbox::new()?;
-    let toolchain_pin = sandbox.home().join("rust-toolchain.toml");
-    sandbox.write_file(
-        &toolchain_pin,
-        "[toolchain]\nchannel = \"nightly-1970-01-01\"\n",
-    )?;
-    sandbox.write_mold(&sandbox.bin(), &pinned_mold_version()?)?;
-    // rustup knows only the committed toolchain, so the run can fail only if
-    // the override displaced the default.
-    sandbox.write_rustup(&pinned_toolchain()?, true)?;
-
+    sandbox.write_fake(&sandbox.bin(), "uname", "echo Darwin")?;
+    // A URL that would fail loudly if the download were ever attempted.
     let output = sandbox.script_with(
-        "dev-fast-check.sh",
+        "install-dev-fast.sh",
         PinOverrides::Omitted,
-        &[("RUST_TOOLCHAIN_FILE", toolchain_pin.to_string())],
+        &[("MOLD_RELEASE_BASE_URL", "file:///nonexistent".to_owned())],
     )?;
     let text = combined(&output);
 
     ensure!(
-        !output.status.success(),
-        "the overridden toolchain is not installed, so the check should fail: `{text}`"
+        output.status.success(),
+        "the install should succeed off Linux, got `{text}`"
     );
     ensure!(
-        text.contains("nightly-1970-01-01"),
-        "the override should be the toolchain reported, got `{text}`"
+        text.contains("skipping on Darwin"),
+        "should say why the linker was skipped, got `{text}`"
     );
-    Ok(())
-}
-
-/// A pin path that does not exist must produce the ordinary actionable
-/// diagnostic, whether it arrived as a default or as an override.
-#[test]
-fn a_missing_pin_file_reports_the_actionable_diagnostic() -> Result<()> {
-    let sandbox = Sandbox::new()?;
-    sandbox.write_mold(&sandbox.bin(), &pinned_mold_version()?)?;
-    sandbox.write_rustup(&pinned_toolchain()?, true)?;
-    let missing = sandbox.home().join("absent/MOLD_VERSION");
-
-    let output = sandbox.script_with(
-        "dev-fast-check.sh",
-        PinOverrides::Omitted,
-        &[("MOLD_VERSION_FILE", missing.to_string())],
-    )?;
-    let text = combined(&output);
-
-    ensure!(!output.status.success(), "should fail, got `{text}`");
-    ensure!(
-        text.contains("missing version pin") && text.contains(missing.as_str()),
-        "should name the missing pin file, got `{text}`"
-    );
-    Ok(())
-}
-
-/// A malformed pin must be refused, never silently rewritten.
-///
-/// Deleting every whitespace character would turn `1.2 3` into `1.23` and two
-/// lines into their concatenation, so a corrupted pin would reach the download
-/// URL looking well-formed. Boundary whitespace is the only kind trimmed.
-#[rstest]
-#[case::internal_space("1.2 3\n", "contains whitespace")]
-#[case::internal_tab("1.2\t3\n", "contains whitespace")]
-#[case::two_lines("1.2.3\n4.5.6\n", "expected one line")]
-#[case::blank("\n", "empty version pin")]
-fn a_malformed_version_pin_is_refused_not_rewritten(
-    #[case] contents: &str,
-    #[case] expected: &str,
-) -> Result<()> {
-    let sandbox = Sandbox::new()?;
-    sandbox.write_mold(&sandbox.bin(), &pinned_mold_version()?)?;
-    sandbox.write_rustup(&pinned_toolchain()?, true)?;
-    let pin = sandbox.home().join("MOLD_VERSION");
-    sandbox.write_file(&pin, contents)?;
-
-    let output = sandbox.script_with(
-        "dev-fast-check.sh",
-        PinOverrides::Omitted,
-        &[("MOLD_VERSION_FILE", pin.to_string())],
-    )?;
-    let text = combined(&output);
-
-    ensure!(!output.status.success(), "should refuse, got `{text}`");
     ensure!(
-        text.contains(expected),
-        "should report `{expected}`, got `{text}`"
+        !text.contains("downloading"),
+        "no download should be attempted off Linux, got `{text}`"
     );
-    Ok(())
-}
-
-/// Whitespace either side of the version is trimmed, so a pin file written with
-/// a trailing newline or stray indentation still resolves.
-#[rstest]
-#[case::trailing_newline("2.41.0\n")]
-#[case::surrounding_spaces("   2.41.0   \n")]
-#[case::no_trailing_newline("2.41.0")]
-fn boundary_whitespace_around_a_pin_is_trimmed(#[case] contents: &str) -> Result<()> {
-    let sandbox = Sandbox::new()?;
-    sandbox.write_mold(&sandbox.bin(), "2.41.0")?;
-    sandbox.write_rustup(&pinned_toolchain()?, true)?;
-    let pin = sandbox.home().join("MOLD_VERSION");
-    sandbox.write_file(&pin, contents)?;
-
-    let output = sandbox.script_with(
-        "dev-fast-check.sh",
-        PinOverrides::Omitted,
-        &[("MOLD_VERSION_FILE", pin.to_string())],
-    )?;
-    let text = combined(&output);
-
+    let rustup = sandbox.rustup_invocations()?;
     ensure!(
-        output.status.success(),
-        "`{contents:?}` should resolve to 2.41.0, got `{text}`"
+        rustup.iter().any(|call| call.starts_with("component add")),
+        "the toolchain half should still run, recorded `{rustup:?}`"
     );
     Ok(())
 }
diff --git a/tests/dev_fast_pin_tests.rs b/tests/dev_fast_pin_tests.rs
new file mode 100644
index 000000000..0a4557c72
--- /dev/null
+++ b/tests/dev_fast_pin_tests.rs
@@ -0,0 +1,189 @@
+//! Behavioural tests for how the `dev-fast` scripts resolve their pins.
+//!
+//! The scripts locate `tools/mold/VERSION` and `rust-toolchain.toml` relative to
+//! their own path, so they work from any working directory and without the
+//! Makefile supplying every path. These tests cover that resolution and its
+//! refusals; the capability gate's own diagnostics live in
+//! `dev_fast_check_tests.rs`.
+//!
+//! A malformed pin must be refused rather than silently rewritten — a corrupted
+//! version would otherwise reach a download URL looking well-formed.
+
+#![cfg(all(unix, target_os = "linux"))]
+
+use anyhow::{Result, ensure};
+use rstest::rstest;
+use test_support::dev_fast::{
+    PinOverrides, Sandbox, combined, pinned_mold_version, pinned_toolchain,
+};
+
+/// Run without the pin-file variables, the check must still find the committed
+/// pins by locating the repository from the script's own path.
+#[test]
+fn falls_back_to_the_committed_pins_when_no_overrides_are_given() -> Result<()> {
+    let sandbox = Sandbox::new()?;
+    // Both fakes report exactly what the committed pins name, so the check can
+    // only pass if it read those files rather than defaulting to nothing. The
+    // mold goes on the sandbox PATH directly: only the Make recipes prepend the
+    // install prefix, and this case invokes the script itself.
+    sandbox.write_mold(&sandbox.bin(), &pinned_mold_version()?)?;
+    sandbox.write_rustup(&pinned_toolchain()?, true)?;
+
+    let output = sandbox.script_with("dev-fast-check.sh", PinOverrides::Omitted, &[])?;
+    let text = combined(&output);
+
+    ensure!(
+        output.status.success(),
+        "check should pass on the committed pins, got `{text}`"
+    );
+    ensure!(
+        text.contains(&format!("mold {}", pinned_mold_version()?)),
+        "should read tools/mold/VERSION by default, got `{text}`"
+    );
+    ensure!(
+        text.contains(&pinned_toolchain()?),
+        "should read rust-toolchain.toml by default, got `{text}`"
+    );
+    Ok(())
+}
+
+/// The drift diagnostic names the pinned version, so a mismatching fake proves
+/// which file the default resolved to rather than merely that some file was
+/// read.
+#[test]
+fn default_pins_are_the_committed_ones_not_an_empty_fallback() -> Result<()> {
+    let sandbox = Sandbox::new()?;
+    sandbox.write_mold(&sandbox.bin(), "99.0.0")?;
+    sandbox.write_rustup(&pinned_toolchain()?, true)?;
+
+    let output = sandbox.script_with("dev-fast-check.sh", PinOverrides::Omitted, &[])?;
+    let text = combined(&output);
+
+    ensure!(
+        !output.status.success(),
+        "a drift should fail, got `{text}`"
+    );
+    ensure!(
+        text.contains(&format!("the pin {}", pinned_mold_version()?)),
+        "the drift message should name the committed pin, got `{text}`"
+    );
+    Ok(())
+}
+
+/// An override must still win over the default.
+#[test]
+fn an_explicit_pin_override_wins_over_the_committed_default() -> Result<()> {
+    let sandbox = Sandbox::new()?;
+    let toolchain_pin = sandbox.home().join("rust-toolchain.toml");
+    sandbox.write_file(
+        &toolchain_pin,
+        "[toolchain]\nchannel = \"nightly-1970-01-01\"\n",
+    )?;
+    sandbox.write_mold(&sandbox.bin(), &pinned_mold_version()?)?;
+    // rustup knows only the committed toolchain, so the run can fail only if
+    // the override displaced the default.
+    sandbox.write_rustup(&pinned_toolchain()?, true)?;
+
+    let output = sandbox.script_with(
+        "dev-fast-check.sh",
+        PinOverrides::Omitted,
+        &[("RUST_TOOLCHAIN_FILE", toolchain_pin.to_string())],
+    )?;
+    let text = combined(&output);
+
+    ensure!(
+        !output.status.success(),
+        "the overridden toolchain is not installed, so the check should fail: `{text}`"
+    );
+    ensure!(
+        text.contains("nightly-1970-01-01"),
+        "the override should be the toolchain reported, got `{text}`"
+    );
+    Ok(())
+}
+
+/// A pin path that does not exist must produce the ordinary actionable
+/// diagnostic, whether it arrived as a default or as an override.
+#[test]
+fn a_missing_pin_file_reports_the_actionable_diagnostic() -> Result<()> {
+    let sandbox = Sandbox::new()?;
+    sandbox.write_mold(&sandbox.bin(), &pinned_mold_version()?)?;
+    sandbox.write_rustup(&pinned_toolchain()?, true)?;
+    let missing = sandbox.home().join("absent/MOLD_VERSION");
+
+    let output = sandbox.script_with(
+        "dev-fast-check.sh",
+        PinOverrides::Omitted,
+        &[("MOLD_VERSION_FILE", missing.to_string())],
+    )?;
+    let text = combined(&output);
+
+    ensure!(!output.status.success(), "should fail, got `{text}`");
+    ensure!(
+        text.contains("missing version pin") && text.contains(missing.as_str()),
+        "should name the missing pin file, got `{text}`"
+    );
+    Ok(())
+}
+
+/// A malformed pin must be refused, never silently rewritten.
+///
+/// Deleting every whitespace character would turn `1.2 3` into `1.23` and two
+/// lines into their concatenation, so a corrupted pin would reach the download
+/// URL looking well-formed. Boundary whitespace is the only kind trimmed.
+#[rstest]
+#[case::internal_space("1.2 3\n", "contains whitespace")]
+#[case::internal_tab("1.2\t3\n", "contains whitespace")]
+#[case::two_lines("1.2.3\n4.5.6\n", "expected one line")]
+#[case::blank("\n", "empty version pin")]
+fn a_malformed_version_pin_is_refused_not_rewritten(
+    #[case] contents: &str,
+    #[case] expected: &str,
+) -> Result<()> {
+    let sandbox = Sandbox::new()?;
+    sandbox.write_mold(&sandbox.bin(), &pinned_mold_version()?)?;
+    sandbox.write_rustup(&pinned_toolchain()?, true)?;
+    let pin = sandbox.home().join("MOLD_VERSION");
+    sandbox.write_file(&pin, contents)?;
+
+    let output = sandbox.script_with(
+        "dev-fast-check.sh",
+        PinOverrides::Omitted,
+        &[("MOLD_VERSION_FILE", pin.to_string())],
+    )?;
+    let text = combined(&output);
+
+    ensure!(!output.status.success(), "should refuse, got `{text}`");
+    ensure!(
+        text.contains(expected),
+        "should report `{expected}`, got `{text}`"
+    );
+    Ok(())
+}
+
+/// Whitespace either side of the version is trimmed, so a pin file written with
+/// a trailing newline or stray indentation still resolves.
+#[rstest]
+#[case::trailing_newline("2.41.0\n")]
+#[case::surrounding_spaces("   2.41.0   \n")]
+#[case::no_trailing_newline("2.41.0")]
+fn boundary_whitespace_around_a_pin_is_trimmed(#[case] contents: &str) -> Result<()> {
+    let sandbox = Sandbox::new()?;
+    sandbox.write_mold(&sandbox.bin(), "2.41.0")?;
+    sandbox.write_rustup(&pinned_toolchain()?, true)?;
+    let pin = sandbox.home().join("MOLD_VERSION");
+    sandbox.write_file(&pin, contents)?;
+
+    let output = sandbox.script_with(
+        "dev-fast-check.sh",
+        PinOverrides::Omitted,
+        &[("MOLD_VERSION_FILE", pin.to_string())],
+    )?;
+    let text = combined(&output);
+
+    ensure!(
+        output.status.success(),
+        "`{contents:?}` should resolve to 2.41.0, got `{text}`"
+    );
+    Ok(())
+}

From b04f5da0e8ec885d8b95fcc375eca06a122bb11c Mon Sep 17 00:00:00 2001
From: leynos <leynos@troubledskies.net>
Date: Mon, 3 Aug 2026 00:18:51 +0200
Subject: [PATCH 23/24] Make a benchmark run indivisible
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The benchmark deleted and rebuilt shared target directories and rewrote a
tracked source file's timestamp, with nothing but a documented convention
stopping two runs from doing it at once. Interleaved, they delete each
other's caches mid-measurement and the second run captures a stamp the
first has already moved, so it restores that instead of the original. The
result is not a crash but something worse: a plausible-looking table and
a permanently newer `src/main.rs`.

Take `$BENCH_ROOT.lock` exclusively for the duration of a run instead.
`mkdir` is the portable atomic test-and-set — `flock` is util-linux and
absent on macOS, where this script is reachable because the capability
check tolerates a non-Linux host. The lock is acquired before the first
`rm -rf` or `touch`, so a rejected run leaves the holder's state alone,
and released by the same trap that restores the timestamp, so an
interrupted run does not wedge the next one.

Adding `rmdir` to the sandbox utility allowlist was not incidental: its
absence is what the release test caught first.

Pass the release digest and artefact name to `Row::render` by borrow;
both were cloned for an argument the function takes as `&str`.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 docs/developers-guide.md             |  22 +++-
 scripts/bench-build.sh               |  41 ++++++-
 test_support/src/dev_fast/bench.rs   |  79 +++++++++++++
 test_support/src/dev_fast/mod.rs     |   2 +
 test_support/src/dev_fast/sandbox.rs |   1 +
 tests/dev_fast_bench_lock_tests.rs   | 160 +++++++++++++++++++++++++++
 tests/dev_fast_bench_tests.rs        |  67 +----------
 tests/dev_fast_checksum_tests.rs     |   6 +-
 8 files changed, 308 insertions(+), 70 deletions(-)
 create mode 100644 test_support/src/dev_fast/bench.rs
 create mode 100644 tests/dev_fast_bench_lock_tests.rs

diff --git a/docs/developers-guide.md b/docs/developers-guide.md
index 7bf8d9e06..057fd489f 100644
--- a/docs/developers-guide.md
+++ b/docs/developers-guide.md
@@ -583,6 +583,10 @@ network, and no real `mold`, `rustup`, or Cargo — so they run as part of
   contents; and `install-dev-fast` forwarding.
 - `tests/dev_fast_bench_tests.rs`: `make bench-build`. Per-variant target
   directories, the clean/incremental cycle, and both variant rows.
+- `tests/dev_fast_bench_lock_tests.rs`: the benchmark's exclusion lock. That a
+  held lock rejects a second run before it mutates anything, that the lock is
+  released however a run ends, and that a later run can take it after an
+  aborted one.
 
 The fixtures live in `test_support::dev_fast`:
 
@@ -678,11 +682,19 @@ the `netsuke` binary from an empty target directory, touches `src/main.rs`, and
 rebuilds. Each variant uses its own target directory under `target/bench/`, so
 neither warms the other's cache nor disturbs the working `target/` tree. The
 timer reads `EPOCHREALTIME`, so this target needs Bash 5.0 or newer; it fails
-with a named prerequisite on older shells rather than reporting zeroes. The
-benchmark assumes it is the only run in flight: `BENCH_ROOT` and
-`BENCH_TOUCH_FILE` default to the shared `target/bench` directory and the
-tracked `src/main.rs`, so concurrent runs would interfere with each other's
-measurements; run one at a time, or override both variables per run.
+with a named prerequisite on older shells rather than reporting zeroes.
+
+`BENCH_ROOT` and `BENCH_TOUCH_FILE` default to the shared `target/bench`
+directory and the tracked `src/main.rs`, so two runs in one checkout would
+delete each other's caches mid-measurement and leave the touched source
+permanently newer. Rather than leave that to convention, the benchmark takes
+`$BENCH_ROOT.lock` exclusively for the duration of a run. A second run refuses
+immediately, naming the lock and the remedy, and does so before touching
+anything, so the holder's state is unaffected. The lock is released however the
+run ends, including on interrupt. To benchmark two things at once, override
+`BENCH_ROOT` and `BENCH_TOUCH_FILE` per run; the lock path follows `BENCH_ROOT`,
+so distinct roots do not contend. If a killed run ever leaves the directory
+behind, remove it.
 
 Results below were recorded on a 24-core x86_64 Linux host, with both variants
 on the repository's own `nightly-2026-06-25` supplying Cranelift 0.132.0, and
diff --git a/scripts/bench-build.sh b/scripts/bench-build.sh
index 546facc7a..185c6f847 100755
--- a/scripts/bench-build.sh
+++ b/scripts/bench-build.sh
@@ -25,6 +25,7 @@ script_dir=$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)
 BENCH_ROOT=${BENCH_ROOT:-target/bench}
 BENCH_BIN=${BENCH_BIN:-netsuke}
 BENCH_TOUCH_FILE=${BENCH_TOUCH_FILE:-src/main.rs}
+BENCH_LOCK_DIR=${BENCH_LOCK_DIR:-$BENCH_ROOT.lock}
 
 # Populated as "<label>|<clean seconds>|<incremental seconds>" rows.
 results=()
@@ -49,7 +50,41 @@ restore_touch_file() {
   BENCH_TOUCH_STAMP=
 }
 
-trap restore_touch_file EXIT INT TERM
+# Two benchmark runs in one checkout are not independent: they share the variant
+# target directories, so one run's `rm -rf` for its clean pass deletes the other
+# run's warm cache mid-measurement, and they share the touch file, so the second
+# run captures a stamp the first has already moved and restores that instead of
+# the original. The result is neither a crash nor a comparable figure — it is a
+# plausible-looking table and a permanently newer source file.
+#
+# So take the run exclusively rather than documenting the hazard. `mkdir` is the
+# portable atomic test-and-set: it succeeds for exactly one caller and needs no
+# `flock`, which is util-linux and absent on macOS, where this script is
+# reachable because the capability check tolerates a non-Linux host.
+BENCH_LOCK_HELD=
+
+acquire_bench_lock() {
+  mkdir -p -- "$(dirname -- "$BENCH_LOCK_DIR")"
+  mkdir -- "$BENCH_LOCK_DIR" 2>/dev/null || fail \
+    "another benchmark run holds $BENCH_LOCK_DIR; wait for it to finish, or remove that directory if it was left behind by a killed run"
+  BENCH_LOCK_HELD=1
+}
+
+release_bench_lock() {
+  [ -n "$BENCH_LOCK_HELD" ] || return 0
+  rmdir -- "$BENCH_LOCK_DIR" 2>/dev/null || true
+  BENCH_LOCK_HELD=
+}
+
+# One handler for both, so an interrupted run releases the lock as well as
+# restoring the timestamp. Each half is idempotent, so EXIT firing after INT or
+# TERM is harmless.
+cleanup() {
+  restore_touch_file
+  release_bench_lock
+}
+
+trap cleanup EXIT INT TERM
 
 # Wall-clock seconds for a command, to one decimal place. EPOCHREALTIME keeps
 # the measurement sub-second without shelling out to an external timer.
@@ -107,6 +142,10 @@ main() {
   local toolchain
   toolchain=$(cranelift_toolchain)
 
+  # Before the first `rm -rf` or `touch`, so a rejected run leaves the holder's
+  # state untouched.
+  acquire_bench_lock
+
   measure_variant default 'Default (LLVM, platform linker)' \
     "$CARGO" build --bin "$BENCH_BIN"
 
diff --git a/test_support/src/dev_fast/bench.rs b/test_support/src/dev_fast/bench.rs
new file mode 100644
index 000000000..53f3ea601
--- /dev/null
+++ b/test_support/src/dev_fast/bench.rs
@@ -0,0 +1,79 @@
+//! Disposable inputs for a `make bench-build` run.
+//!
+//! The benchmark mutates two things a test must not let it reach: the variant
+//! target directories and the file it touches to make the second pass
+//! incremental. Both are redirected into the sandbox here, so a benchmark test
+//! never disturbs the working tree's build cache or a tracked source.
+
+use anyhow::Result;
+use camino::{Utf8Path, Utf8PathBuf};
+use std::time::{Duration, UNIX_EPOCH};
+
+use super::{BuildScenario, Sandbox};
+
+/// Timestamp stamped on the benchmark's touch file before the run, chosen far
+/// enough in the past that any `touch` is unambiguously newer. Comparing
+/// against a fixed baseline keeps the assertion deterministic, where comparing
+/// the two passes to each other would depend on filesystem timestamp
+/// granularity.
+pub const BASELINE_MTIME: i64 = 1_600_000_000;
+
+/// Target-directory slugs the benchmark uses, one per variant.
+pub const DEFAULT_SLUG: &str = "default";
+pub const DEV_FAST_SLUG: &str = "dev-fast";
+
+/// Create the touch file with [`BASELINE_MTIME`], returning that timestamp.
+pub fn write_with_old_mtime(sandbox: &Sandbox, path: &Utf8Path) -> Result<i64> {
+    let baseline = UNIX_EPOCH + Duration::from_secs(BASELINE_MTIME.unsigned_abs());
+    sandbox.write_file_with_mtime(path, "", baseline)?;
+    Ok(BASELINE_MTIME)
+}
+
+/// The disposable inputs one benchmark run needs.
+///
+/// Named fields rather than a returned tuple: `root` and `touch_file` are both
+/// paths, so positional returns could be transposed at the call site without
+/// the compiler noticing.
+pub struct BenchFixture {
+    /// Benchmark root; each variant gets its own target directory beneath it.
+    pub root: Utf8PathBuf,
+    /// The file the benchmark touches between a variant's two passes.
+    pub touch_file: Utf8PathBuf,
+    /// The touch file's timestamp before the run, for ordering assertions.
+    pub baseline_mtime: i64,
+}
+
+impl BenchFixture {
+    /// Stage a benchmark run's disposable inputs.
+    ///
+    /// The touch file stands in for `src/main.rs`, so a run does not invalidate
+    /// the working tree's build cache. Both target directories are seeded to
+    /// model a re-run: on a fresh sandbox the benchmark's `rm -rf` would be
+    /// indistinguishable from doing nothing, and the clean-pass assertion would
+    /// hold vacuously.
+    pub fn prepare(scenario: &BuildScenario) -> Result<Self> {
+        let sandbox = scenario.sandbox();
+        let touch_file = sandbox.home().join("bench-touch");
+        let baseline_mtime = write_with_old_mtime(sandbox, &touch_file)?;
+
+        let root = sandbox.home().join("bench");
+        for slug in [DEFAULT_SLUG, DEV_FAST_SLUG] {
+            sandbox.create_dir(&root.join(slug))?;
+        }
+        Ok(Self {
+            root,
+            touch_file,
+            baseline_mtime,
+        })
+    }
+
+    /// The lock directory the benchmark takes for the duration of a run.
+    ///
+    /// Derived from the root the same way the script derives it, so a test
+    /// asserting on contention holds the same path the script will try to
+    /// create rather than a guess that could drift from it.
+    #[must_use]
+    pub fn lock_dir(&self) -> Utf8PathBuf {
+        Utf8PathBuf::from(format!("{}.lock", self.root))
+    }
+}
diff --git a/test_support/src/dev_fast/mod.rs b/test_support/src/dev_fast/mod.rs
index ee14a6bd6..fe2f82668 100644
--- a/test_support/src/dev_fast/mod.rs
+++ b/test_support/src/dev_fast/mod.rs
@@ -26,6 +26,7 @@
 //! the `netsuke` binary. The isolation is the same, and stricter: `env_clear`
 //! means a child inherits nothing it was not handed.
 
+mod bench;
 mod cargo_log;
 mod make;
 mod release;
@@ -33,6 +34,7 @@ mod sandbox;
 mod scenario;
 mod staging;
 
+pub use bench::{BASELINE_MTIME, BenchFixture, DEFAULT_SLUG, DEV_FAST_SLUG, write_with_old_mtime};
 pub use cargo_log::{CargoInvocation, RecordingCargo, TargetState};
 pub use make::MakeInvocation;
 pub use release::FakeRelease;
diff --git a/test_support/src/dev_fast/sandbox.rs b/test_support/src/dev_fast/sandbox.rs
index fd5a84a56..319028d74 100644
--- a/test_support/src/dev_fast/sandbox.rs
+++ b/test_support/src/dev_fast/sandbox.rs
@@ -32,6 +32,7 @@ const SANDBOX_UTILITIES: &[&str] = &[
     "mkdir",
     "mktemp",
     "rm",
+    "rmdir",
     "sed",
     "sh",
     "sha256sum",
diff --git a/tests/dev_fast_bench_lock_tests.rs b/tests/dev_fast_bench_lock_tests.rs
new file mode 100644
index 000000000..e86f99f3e
--- /dev/null
+++ b/tests/dev_fast_bench_lock_tests.rs
@@ -0,0 +1,160 @@
+//! Behavioural tests for the benchmark's exclusion lock.
+//!
+//! The benchmark deletes and rebuilds shared target directories and rewrites a
+//! tracked source file's timestamp, so two runs in one checkout would corrupt
+//! each other's measurements and leave the source permanently newer. The lock
+//! is what makes a run indivisible; these tests pin down that it is taken
+//! before any of that mutation happens, that it is released however the run
+//! ends, and that a rejected run leaves the holder's state alone.
+
+#![cfg(all(unix, target_os = "linux"))]
+
+use anyhow::{Result, ensure};
+use rstest::rstest;
+use test_support::dev_fast::{BenchFixture, BuildScenario, MakeInvocation, combined};
+
+/// Build the standard benchmark invocation for a staged fixture.
+fn bench_invocation(scenario: &BuildScenario, fixture: &BenchFixture) -> MakeInvocation {
+    MakeInvocation::new("bench-build")
+        .variable("CARGO", scenario.cargo().executable())
+        .environment("BENCH_ROOT", &fixture.root)
+        .environment("BENCH_TOUCH_FILE", &fixture.touch_file)
+}
+
+/// A held lock turns a concurrent run into a refusal with a remedy, rather than
+/// letting it interleave and produce a plausible-looking but corrupt table.
+#[test]
+fn a_held_lock_rejects_a_concurrent_run() -> Result<()> {
+    let scenario = BuildScenario::prepare()?;
+    let fixture = BenchFixture::prepare(&scenario)?;
+    // Stand in for a run already in progress.
+    scenario.sandbox().create_dir(&fixture.lock_dir())?;
+
+    let output = scenario
+        .sandbox()
+        .run_make(&bench_invocation(&scenario, &fixture))?;
+    let text = combined(&output);
+
+    ensure!(
+        !output.status.success(),
+        "a contended benchmark should refuse to run, got `{text}`"
+    );
+    ensure!(
+        text.contains("another benchmark run holds"),
+        "the refusal should name the cause, got `{text}`"
+    );
+    ensure!(
+        text.contains("remove that directory"),
+        "the refusal should name the remedy for a stale lock, got `{text}`"
+    );
+    Ok(())
+}
+
+/// The refusal must be inert: a run that loses the race must not have already
+/// touched the source file or wiped the holder's warm target directories, and
+/// must not release a lock it never took.
+#[test]
+fn a_rejected_run_leaves_the_holders_state_untouched() -> Result<()> {
+    let scenario = BuildScenario::prepare()?;
+    let sandbox = scenario.sandbox();
+    let fixture = BenchFixture::prepare(&scenario)?;
+    let lock = fixture.lock_dir();
+    sandbox.create_dir(&lock)?;
+    // A warm cache the holder is mid-measurement on.
+    let warm = fixture.root.join("default/warm-artefact");
+    sandbox.write_file(&warm, "")?;
+
+    let output = sandbox.run_make(&bench_invocation(&scenario, &fixture))?;
+    ensure!(
+        !output.status.success(),
+        "the run should be rejected, got `{}`",
+        combined(&output)
+    );
+
+    ensure!(
+        lock.as_std_path().exists(),
+        "the rejected run must not release a lock it never took"
+    );
+    ensure!(
+        warm.as_std_path().exists(),
+        "the holder's warm target directory must survive a rejected run"
+    );
+    ensure!(
+        sandbox.mtime_seconds(&fixture.touch_file)? == fixture.baseline_mtime,
+        "the rejected run must not have touched the source file"
+    );
+    ensure!(
+        scenario.cargo().invocations()?.is_empty(),
+        "the rejected run must not reach Cargo"
+    );
+    Ok(())
+}
+
+/// However a run ends, it must hand the lock back — otherwise the first
+/// interrupted benchmark wedges every later one behind a stale directory.
+#[rstest]
+#[case::completes(true)]
+#[case::aborts(false)]
+fn the_lock_is_released_however_the_run_ends(#[case] succeeds: bool) -> Result<()> {
+    let scenario = BuildScenario::prepare()?;
+    let sandbox = scenario.sandbox();
+    let fixture = BenchFixture::prepare(&scenario)?;
+
+    if !succeeds {
+        // Fail the accelerated variant, after the lock has been taken.
+        sandbox.write_fake(
+            &sandbox.bin(),
+            "cargo",
+            "case \"$*\" in *--config*) exit 1 ;; *) exit 0 ;; esac",
+        )?;
+    }
+
+    let output = sandbox.run_make(&bench_invocation(&scenario, &fixture))?;
+    ensure!(
+        output.status.success() == succeeds,
+        "the run should {}, got `{}`",
+        if succeeds { "succeed" } else { "abort" },
+        combined(&output)
+    );
+    ensure!(
+        !fixture.lock_dir().as_std_path().exists(),
+        "the lock should be released so the next run is not wedged behind it"
+    );
+    Ok(())
+}
+
+/// A released lock is not merely absent at the end — the next run can actually
+/// take it. This is the property a developer cares about after an interrupted
+/// benchmark, and it is not implied by the release assertion alone: a leftover
+/// non-empty lock directory would fail `rmdir` silently and still refuse.
+#[test]
+fn a_later_run_succeeds_after_an_earlier_one_aborts() -> Result<()> {
+    let scenario = BuildScenario::prepare()?;
+    let sandbox = scenario.sandbox();
+    let fixture = BenchFixture::prepare(&scenario)?;
+    // A cargo that aborts the first run and then behaves, so the second run is
+    // a genuine success rather than a differently-worded failure.
+    let marker = sandbox.home().join("first-run-aborted");
+    sandbox.write_fake(
+        &sandbox.bin(),
+        "cargo",
+        &format!(
+            "[ -e '{marker}' ] && exit 0\n\
+             case \"$*\" in *--config*) : >'{marker}'; exit 1 ;; *) exit 0 ;; esac"
+        ),
+    )?;
+    let first = sandbox.run_make(&bench_invocation(&scenario, &fixture))?;
+    ensure!(
+        !first.status.success(),
+        "the first run should abort, got `{}`",
+        combined(&first)
+    );
+
+    let second = sandbox.run_make(&bench_invocation(&scenario, &fixture))?;
+    ensure!(
+        second.status.success(),
+        "the second run should not be blocked by the first, got `{}`",
+        combined(&second)
+    );
+    Ok(())
+}
diff --git a/tests/dev_fast_bench_tests.rs b/tests/dev_fast_bench_tests.rs
index 498d31c8b..ad0abcf7b 100644
--- a/tests/dev_fast_bench_tests.rs
+++ b/tests/dev_fast_bench_tests.rs
@@ -13,72 +13,17 @@
 #![cfg(all(unix, target_os = "linux"))]
 
 use anyhow::{Context, Result, bail, ensure};
-use camino::{Utf8Path, Utf8PathBuf};
+use camino::Utf8Path;
 use proptest::prelude::*;
 use proptest::proptest;
 use proptest::test_runner::FileFailurePersistence;
 use rstest::rstest;
-use std::time::{Duration, UNIX_EPOCH};
 use test_support::dev_fast::{
-    BuildScenario, CargoInvocation, DEV_FAST_CONFIG_PATH, MakeInvocation, Sandbox, TargetState,
-    combined, pinned_toolchain,
+    BenchFixture, BuildScenario, CargoInvocation, DEFAULT_SLUG, DEV_FAST_CONFIG_PATH,
+    DEV_FAST_SLUG, MakeInvocation, Sandbox, TargetState, combined, pinned_toolchain,
+    write_with_old_mtime,
 };
 
-/// Timestamp stamped on the benchmark's touch file before the run, chosen far
-/// enough in the past that any `touch` is unambiguously newer. Comparing
-/// against a fixed baseline keeps the assertion deterministic, where comparing
-/// the two passes to each other would depend on filesystem timestamp
-/// granularity.
-const BASELINE_MTIME: i64 = 1_600_000_000;
-
-/// Target-directory slugs the benchmark uses, one per variant.
-const DEFAULT_SLUG: &str = "default";
-const DEV_FAST_SLUG: &str = "dev-fast";
-
-/// Create the touch file with [`BASELINE_MTIME`], returning that timestamp.
-fn write_with_old_mtime(sandbox: &Sandbox, path: &Utf8Path) -> Result<i64> {
-    let baseline = UNIX_EPOCH + Duration::from_secs(BASELINE_MTIME.unsigned_abs());
-    sandbox.write_file_with_mtime(path, "", baseline)?;
-    Ok(BASELINE_MTIME)
-}
-
-/// The disposable inputs one benchmark run needs.
-///
-/// Named fields rather than a returned tuple: `root` and `touch_file` are both
-/// paths, so positional returns could be transposed at the call site without
-/// the compiler noticing.
-struct BenchFixture {
-    /// Benchmark root; each variant gets its own target directory beneath it.
-    root: Utf8PathBuf,
-    /// The file the benchmark touches between a variant's two passes.
-    touch_file: Utf8PathBuf,
-    /// The touch file's timestamp before the run, for ordering assertions.
-    baseline_mtime: i64,
-}
-
-/// Stage a benchmark run's disposable inputs.
-///
-/// The touch file stands in for `src/main.rs`, so a run does not invalidate the
-/// working tree's build cache. Both target directories are seeded to model a
-/// re-run: on a fresh sandbox the benchmark's `rm -rf` would be
-/// indistinguishable from doing nothing, and the clean-pass assertion would
-/// hold vacuously.
-fn prepare_bench_fixture(scenario: &BuildScenario) -> Result<BenchFixture> {
-    let sandbox = scenario.sandbox();
-    let touch_file = sandbox.home().join("bench-touch");
-    let baseline_mtime = write_with_old_mtime(sandbox, &touch_file)?;
-
-    let root = sandbox.home().join("bench");
-    for slug in [DEFAULT_SLUG, DEV_FAST_SLUG] {
-        sandbox.create_dir(&root.join(slug))?;
-    }
-    Ok(BenchFixture {
-        root,
-        touch_file,
-        baseline_mtime,
-    })
-}
-
 /// Check the recorded passes: their count and pairing, each variant's own
 /// contract, that the variants measured separately, and where each pass sits
 /// relative to the touch.
@@ -250,7 +195,7 @@ proptest! {
 fn the_touched_file_is_restored_however_the_run_ends(#[case] succeeds: bool) -> Result<()> {
     let scenario = BuildScenario::prepare()?;
     let sandbox = scenario.sandbox();
-    let fixture = prepare_bench_fixture(&scenario)?;
+    let fixture = BenchFixture::prepare(&scenario)?;
 
     if !succeeds {
         // Fail the second variant, after the first has already touched the file.
@@ -285,7 +230,7 @@ fn the_touched_file_is_restored_however_the_run_ends(#[case] succeeds: bool) ->
 #[test]
 fn bench_target_emits_both_variant_rows() -> Result<()> {
     let scenario = BuildScenario::prepare()?;
-    let fixture = prepare_bench_fixture(&scenario)?;
+    let fixture = BenchFixture::prepare(&scenario)?;
 
     let invocation = MakeInvocation::new("bench-build")
         .variable("CARGO", scenario.cargo().executable())
diff --git a/tests/dev_fast_checksum_tests.rs b/tests/dev_fast_checksum_tests.rs
index 230f36e3d..4d3662c50 100644
--- a/tests/dev_fast_checksum_tests.rs
+++ b/tests/dev_fast_checksum_tests.rs
@@ -142,9 +142,9 @@ proptest! {
     ) {
         let scenario = InstallerScenario::prepare()
             .map_err(|error| TestCaseError::fail(error.to_string()))?;
-        let real = scenario.release().sha256().to_owned();
-        let artefact = scenario.release().name().to_owned();
-        let contents: String = rows.iter().map(|row| row.render(&real, &artefact)).collect();
+        let real = scenario.release().sha256();
+        let artefact = scenario.release().name();
+        let contents: String = rows.iter().map(|row| row.render(real, artefact)).collect();
 
         let checksums = scenario.sandbox().home().join("SHA256SUMS");
         scenario

From 39e3572b4644f77f914935911872731d201a9106 Mon Sep 17 00:00:00 2001
From: leynos <leynos@troubledskies.net>
Date: Mon, 3 Aug 2026 00:27:16 +0200
Subject: [PATCH 24/24] Say when the timestamp could not be put back
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

`restore_touch_file` discarded the result of `touch -r`, which is the
worst of both worlds: the developer keeps the consequence — a source file
left newer than the build outputs, so every later build silently redoes
work — and loses the only notice that it happened. Warn instead, naming
the file and how to check it. A trap must not abort the run, so this
stays a note rather than a failure.

The test drives it with a `touch` that captures the stamp and then
refuses to put it back, delegating everything else to the real binary.
Resolving that binary needs the sandbox's own PATH lookup rather than
`std::fs::read_link`, which the capability-filesystem lint rejects in
test code.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 scripts/bench-build.sh               |  8 ++++-
 test_support/src/dev_fast/mod.rs     |  2 +-
 test_support/src/dev_fast/sandbox.rs |  9 ++++++
 tests/dev_fast_bench_tests.rs        | 48 +++++++++++++++++++++++++++-
 4 files changed, 64 insertions(+), 3 deletions(-)

diff --git a/scripts/bench-build.sh b/scripts/bench-build.sh
index 185c6f847..269011f4d 100755
--- a/scripts/bench-build.sh
+++ b/scripts/bench-build.sh
@@ -45,7 +45,13 @@ BENCH_TOUCH_STAMP=
 
 restore_touch_file() {
   [ -n "$BENCH_TOUCH_STAMP" ] || return 0
-  touch -r "$BENCH_TOUCH_STAMP" "$BENCH_TOUCH_FILE" || true
+  # Swallowing this would be the worst of both worlds: the developer keeps the
+  # consequence — a source file left newer than the build outputs, so the next
+  # real build silently redoes work — and loses the only notice that it
+  # happened. The trap must not abort the run, so warn rather than fail, and say
+  # enough that the state can be checked and put right by hand.
+  touch -r "$BENCH_TOUCH_STAMP" "$BENCH_TOUCH_FILE" ||
+    note "failed to restore the timestamp of $BENCH_TOUCH_FILE; it is left newer than before the benchmark, so the next build will redo work. Check it with: ls -l $BENCH_TOUCH_FILE"
   rm -f "$BENCH_TOUCH_STAMP"
   BENCH_TOUCH_STAMP=
 }
diff --git a/test_support/src/dev_fast/mod.rs b/test_support/src/dev_fast/mod.rs
index fe2f82668..fa9aaec0e 100644
--- a/test_support/src/dev_fast/mod.rs
+++ b/test_support/src/dev_fast/mod.rs
@@ -40,7 +40,7 @@ pub use make::MakeInvocation;
 pub use release::FakeRelease;
 pub use sandbox::{
     DEV_FAST_CONFIG_PATH, PinOverrides, Sandbox, combined, dev_fast_config, pinned_mold_version,
-    pinned_toolchain,
+    pinned_toolchain, real_utility,
 };
 pub use scenario::{
     BuildScenario, InstallerFixture, InstallerScenario, TEST_MOLD_VERSION, WRONG_SHA256,
diff --git a/test_support/src/dev_fast/sandbox.rs b/test_support/src/dev_fast/sandbox.rs
index 319028d74..f1cda2c26 100644
--- a/test_support/src/dev_fast/sandbox.rs
+++ b/test_support/src/dev_fast/sandbox.rs
@@ -265,6 +265,15 @@ impl Sandbox {
     }
 }
 
+/// The genuine binary behind a sandboxed utility name.
+///
+/// A fake that must delegate to the real tool — one that intercepts a single
+/// invocation and passes the rest through — needs an absolute path to it,
+/// because `PATH` inside the sandbox names the fake.
+pub fn real_utility(utility: &str) -> Result<Utf8PathBuf> {
+    which(utility)
+}
+
 /// Resolve a utility against the ambient `PATH`, before it is replaced.
 ///
 /// Executability is part of the match, not an afterthought: `uv` installs a
diff --git a/tests/dev_fast_bench_tests.rs b/tests/dev_fast_bench_tests.rs
index ad0abcf7b..4344bde6c 100644
--- a/tests/dev_fast_bench_tests.rs
+++ b/tests/dev_fast_bench_tests.rs
@@ -20,7 +20,7 @@ use proptest::test_runner::FileFailurePersistence;
 use rstest::rstest;
 use test_support::dev_fast::{
     BenchFixture, BuildScenario, CargoInvocation, DEFAULT_SLUG, DEV_FAST_CONFIG_PATH,
-    DEV_FAST_SLUG, MakeInvocation, Sandbox, TargetState, combined, pinned_toolchain,
+    DEV_FAST_SLUG, MakeInvocation, Sandbox, TargetState, combined, pinned_toolchain, real_utility,
     write_with_old_mtime,
 };
 
@@ -227,6 +227,52 @@ fn the_touched_file_is_restored_however_the_run_ends(#[case] succeeds: bool) ->
     Ok(())
 }
 
+/// When the restore itself fails, the run must say so.
+///
+/// This is the one case where silence costs the most: the developer keeps a
+/// source file newer than the build outputs, so every later build redoes work,
+/// and has nothing on screen connecting that to the benchmark they ran.
+#[test]
+fn a_failed_restore_warns_rather_than_passing_silently() -> Result<()> {
+    let scenario = BuildScenario::prepare()?;
+    let sandbox = scenario.sandbox();
+    let fixture = BenchFixture::prepare(&scenario)?;
+
+    // A `touch` that captures the stamp and then refuses to put it back. Only
+    // the second `-r` fails, because the first is the capture the script needs
+    // to get as far as a restore at all. Delegating to the real binary keeps
+    // every other use — the touches between passes — behaving normally.
+    let real_touch = real_utility("touch")?;
+    let marker = sandbox.home().join("stamp-captured");
+    sandbox.write_fake(
+        &sandbox.bin(),
+        "touch",
+        &format!(
+            "if [ \"$1\" = -r ]; then\n\
+             \x20 [ -e '{marker}' ] && exit 1\n\
+             \x20 : >'{marker}'\n\
+             fi\n\
+             exec '{real_touch}' \"$@\""
+        ),
+    )?;
+
+    let invocation = MakeInvocation::new("bench-build")
+        .variable("CARGO", scenario.cargo().executable())
+        .environment("BENCH_ROOT", &fixture.root)
+        .environment("BENCH_TOUCH_FILE", &fixture.touch_file);
+    let text = combined(&sandbox.run_make(&invocation)?);
+
+    ensure!(
+        text.contains("failed to restore the timestamp"),
+        "a failed restore should be reported, got `{text}`"
+    );
+    ensure!(
+        text.contains(fixture.touch_file.as_str()),
+        "the warning should name the file left newer, got `{text}`"
+    );
+    Ok(())
+}
+
 #[test]
 fn bench_target_emits_both_variant_rows() -> Result<()> {
     let scenario = BuildScenario::prepare()?;