translator: expand multi-architecture instruction coverage and independent tests

.gitattributes

@@ -0,0 +1,6 @@
+# Shell scripts are executed and inspected verbatim on every CI host.
+*.sh text eol=lf
+# Original Go test drivers and embedded ASM/C retain byte-exact hash guards.
+*.go text eol=lf
+# Tracked ASM conformance sources retain their original whole-program hashes.
+*.s text eol=lf

.github/actions/publish-windows-llvm22/action.yml

@@ -0,0 +1,9 @@
+name: Publish Windows LLVM 22
+description: Validate and publish one installed LLVM prefix without retry-dependent paths.
+inputs:
+  attempt:
+    description: The successful setup-msys2 attempt (1, 2, or 3).
+    required: true
+runs:
+  using: node24
+  main: index.cjs

.github/actions/publish-windows-llvm22/index.cjs

@@ -0,0 +1,157 @@
+'use strict';
+
+const fs = require('node:fs');
+const path = require('node:path');
+const {execFileSync} = require('node:child_process');
+
+function requireThat(condition, message) {
+  if (!condition) throw new Error(message);
+}
+
+function absent(file) {
+  try { fs.lstatSync(file); } catch (error) {
+    if (error.code === 'ENOENT') return;
+    throw error;
+  }
+  throw new Error('publication target already exists: ' + file);
+}
+
+function directory(file) {
+  const stat = fs.lstatSync(file);
+  requireThat(stat.isDirectory() && !stat.isSymbolicLink(), 'not an owned directory: ' + file);
+  return stat;
+}
+
+function noLinks(file) {
+  const stat = fs.lstatSync(file);
+  requireThat(!stat.isSymbolicLink() && (stat.isFile() || stat.isDirectory()),
+    'redirected or unsupported prefix entry: ' + file);
+  if (stat.isDirectory()) {
+    for (const name of fs.readdirSync(file)) noLinks(path.join(file, name));
+  }
+}
+
+function publishPrefix({runnerTemp, attempt, systemRoot, run}) {
+  requireThat(typeof attempt === 'string' && /^[123]$/.test(attempt), 'unknown successful bootstrap attempt');
+  for (const value of [runnerTemp, systemRoot]) {
+    requireThat(typeof value === 'string' && path.isAbsolute(value) &&
+      path.normalize(value) === value && !/[\x00-\x1f]/.test(value), 'invalid absolute system path');
+  }
+  for (let ancestor = runnerTemp; ; ancestor = path.dirname(ancestor)) {
+    directory(ancestor);
+    if (ancestor === path.dirname(ancestor)) break;
+  }
+  const source = path.join(runnerTemp, 'plan9asm-msys2-attempt-' + attempt, 'msys64', 'clang64');
+  const target = path.join(runnerTemp, 'plan9asm-llvm22');
+  const proof = path.join(runnerTemp, 'plan9asm-llvm22-proof');
+  directory(path.dirname(path.dirname(source)));
+  directory(path.dirname(source));
+  const original = directory(source);
+  absent(target);
+  absent(proof);
+  noLinks(source);
+  for (const relative of ['bin/llvm-config.exe', 'bin/clang.exe', 'bin/clang++.exe',
+    'include/_mingw.h', 'lib/libkernel32.a']) {
+    requireThat(fs.lstatSync(path.join(source, relative)).isFile(), 'missing prefix input: ' + relative);
+  }
+
+  // lstat covers symlinks/junctions; Windows attributes also reject other
+  // reparse tags. Inspect before descending and never follow a redirected node.
+  const checkReparse = `
+$ErrorActionPreference = 'Stop'
+$root = Get-Item -Force -LiteralPath $env:PLAN9ASM_LLVM22_CHECK
+for ($item = $root; $null -ne $item; $item = $item.Parent) {
+  if ($item.Attributes -band [IO.FileAttributes]::ReparsePoint) { throw 'reparse ancestor' }
+}
+$pending = [Collections.Generic.Stack[IO.FileSystemInfo]]::new()
+$pending.Push($root)
+while ($pending.Count) {
+  $item = $pending.Pop()
+  if ($item.Attributes -band [IO.FileAttributes]::ReparsePoint) { throw 'reparse prefix entry' }
+  if ($item -is [IO.DirectoryInfo]) {
+    foreach ($child in $item.GetFileSystemInfos()) { $pending.Push($child) }
+  }
+}`;
+  run(path.join(systemRoot, 'System32', 'WindowsPowerShell', 'v1.0', 'powershell.exe'),
+    ['-NoLogo', '-NoProfile', '-NonInteractive', '-Command', checkReparse],
+    {env: {...process.env, PLAN9ASM_LLVM22_CHECK: source}});
+  const checked = directory(source);
+  requireThat(original.dev === checked.dev && original.ino === checked.ino, 'prefix replaced during validation');
+  for (let ancestor = path.dirname(source); ; ancestor = path.dirname(ancestor)) {
+    directory(ancestor);
+    if (ancestor === path.dirname(ancestor)) break;
+  }
+  noLinks(source);
+  absent(target);
+  // Windows directory rename is same-volume and cannot replace an existing
+  // file/directory. Do not copy, merge, remove failed attempts, or retry a move.
+  fs.renameSync(source, target);
+  const moved = directory(target);
+  requireThat(original.dev === moved.dev && original.ino === moved.ino, 'published prefix identity changed');
+
+  const bin = path.join(target, 'bin');
+  // No bootstrap PATH: the relocation probe must resolve its DLLs, linker,
+  // headers and runtime from the moved prefix, not a retained old installation.
+  const env = {...process.env, PATH: [bin, path.join(systemRoot, 'System32'), systemRoot].join(path.delimiter)};
+  if (process.platform === 'win32') {
+    for (const name of Object.keys(env)) if (name.toUpperCase() === 'PATH' && name !== 'PATH') delete env[name];
+  }
+  const query = (file, args) => {
+    const result = run(file, args, {env});
+    requireThat(typeof result === 'string' && !result.includes('\0'), 'invalid tool output');
+    return result;
+  };
+  const config = path.join(bin, 'llvm-config.exe');
+  const clang = path.join(bin, 'clang.exe');
+  const line = value => {
+    requireThat(/^[^\r\n]+\r?\n?$/.test(value), 'expected one tool output line');
+    return value.replace(/\r?\n$/, '');
+  };
+  const samePath = (value, expected) => path.normalize(line(value).replace(/[\\/]/g, path.sep)) === expected;
+  requireThat(line(query(config, ['--version'])) === '22.1.8', 'expected LLVM 22.1.8');
+  for (const [flag, relative] of [['--prefix', ''], ['--bindir', 'bin'], ['--includedir', 'include'], ['--libdir', 'lib']]) {
+    requireThat(samePath(query(config, [flag]), path.join(target, relative)), 'LLVM prefix did not relocate: ' + flag);
+  }
+  requireThat(/^clang version 22\.1\.8(?:\s|$)/.test(query(clang, ['--version'])), 'expected Clang 22.1.8');
+  const resources = path.join(target, 'lib', 'clang', '22');
+  requireThat(samePath(query(clang, ['--print-resource-dir']), resources), 'Clang resources did not relocate');
+  directory(resources);
+  const flags = args => {
+    const value = query(config, args).replace(/\r/g, '').replace(/\n/g, ' ').trim();
+    requireThat(value.length > 0 && !/[\x00-\x1f]/.test(value) &&
+      !/plan9asm-msys2-attempt-/i.test(value), 'invalid or attempt-dependent LLVM flags');
+    return value;
+  };
+  const environment = {
+    CGO_CFLAGS: flags(['--cflags']),
+    CGO_CXXFLAGS: flags(['--cxxflags']),
+    CGO_LDFLAGS: flags(['--ldflags', '--libs', 'all', '--system-libs']),
+    LLVM_CONFIG: config, CC: clang, CXX: path.join(bin, 'clang++.exe'),
+    CGO_ENABLED: '1', GOFLAGS: '-tags=byollvm',
+  };
+  fs.mkdirSync(proof); // Exclusive, retained on failure; never overwrite a probe.
+  const input = path.join(proof, 'publication.c');
+  const output = path.join(proof, 'publication.exe');
+  fs.writeFileSync(input, '#include <stdint.h>\nint main(void) { return sizeof(uintptr_t) == 8 ? 0 : 1; }\n', {flag: 'wx'});
+  query(clang, [input, '-o', output]);
+  requireThat(fs.lstatSync(output).isFile(), 'compiler did not produce the native probe');
+  query(output, []);
+  return {environment, path: bin};
+}
+
+module.exports = {publishPrefix};
+if (require.main === module) {
+  try {
+    requireThat(process.platform === 'win32', 'Windows LLVM publication requires Windows');
+    const result = publishPrefix({runnerTemp: process.env.RUNNER_TEMP, attempt: process.env.INPUT_ATTEMPT,
+      systemRoot: process.env.SystemRoot || process.env.SYSTEMROOT,
+      run: (file, args, options) => execFileSync(file, args,
+        {...options, encoding: 'utf8', timeout: 120000, maxBuffer: 1024 * 1024, windowsHide: true})});
+    fs.appendFileSync(process.env.GITHUB_ENV, Object.entries(result.environment).map(([key, value]) => `${key}=${value}\n`).join(''));
+    fs.appendFileSync(process.env.GITHUB_PATH, result.path + '\n');
+    console.log('Published and executed LLVM 22.1.8 from ' + result.path);
+  } catch (error) {
+    console.error(error.stack || error.message);
+    process.exitCode = 1;
+  }
+}

.github/actions/setup-go/action.yml

@@ -5,10 +5,6 @@ inputs:
   go-version:
     description: Go version accepted by actions/setup-go
     required: true
-  cache:
-    description: Whether actions/setup-go should cache dependencies
-    required: false
-    default: "true"
 
 runs:
   using: composite
@@ -22,7 +18,45 @@ runs:
         echo "GOCACHE=${RUNNER_TEMP}/go-build-cache" >> "$GITHUB_ENV"
 
     - name: Set up Go
+      id: install_go
       uses: actions/setup-go@v7
       with:
         go-version: ${{ inputs.go-version }}
-        cache: ${{ inputs.cache }}
+        # Account cache egress exhaustion must not block compiler installation.
+        # The writable job-local Go caches above remain available.
+        cache: false
+
+    # Some self-hosted runner interruptions report a successful action before
+    # its download completes. Neither that outcome nor an ambient Go is proof
+    # that the requested compiler was installed.
+    - name: Verify Go installation
+      shell: bash
+      env:
+        REQUESTED_GO_VERSION: ${{ inputs.go-version }}
+        INSTALLED_GO_VERSION: ${{ steps.install_go.outputs.go-version }}
+      run: |
+        set -euo pipefail
+
+        if [[ ! "$INSTALLED_GO_VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+          echo "Go installer did not report a complete stable version" >&2
+          exit 1
+        fi
+
+        if [[ "$REQUESTED_GO_VERSION" =~ ^[0-9]+\.[0-9]+\.x$ ]]; then
+          minor="${REQUESTED_GO_VERSION%.x}"
+          if [[ "$INSTALLED_GO_VERSION" != "$minor."* ]]; then
+            echo "Requested Go $REQUESTED_GO_VERSION, installed $INSTALLED_GO_VERSION" >&2
+            exit 1
+          fi
+        elif [[ "$REQUESTED_GO_VERSION" != "$INSTALLED_GO_VERSION" ]]; then
+          echo "Requested Go $REQUESTED_GO_VERSION, installed $INSTALLED_GO_VERSION" >&2
+          exit 1
+        fi
+
+        actual="$(GOTOOLCHAIN=local go env GOVERSION)"
+        if [[ "$actual" != "go$INSTALLED_GO_VERSION" ]]; then
+          echo "Installed Go $INSTALLED_GO_VERSION, but PATH selects $actual" >&2
+          exit 1
+        fi
+        printf 'Verified Go %s: %s\n' "$INSTALLED_GO_VERSION" "$(command -v go)"
+        GOTOOLCHAIN=local go version

.github/actions/setup-node22/action.yml

@@ -0,0 +1,34 @@
+name: Setup Node.js 22
+description: Install the exact Node.js runtime shared by CI producers and verifiers
+
+runs:
+  using: composite
+  steps:
+    - name: Install Node.js 22
+      id: install_node22
+      uses: actions/setup-node@v6
+      with:
+        node-version: '22.23.4'
+
+    # An installer step marked successful without its output must not borrow
+    # the runner image's ambient Node or produce an incompatible WASM scope.
+    - name: Verify Node.js installation
+      shell: bash
+      env:
+        EXPECTED_NODE_VERSION: 'v22.23.4'
+        INSTALLED_NODE_VERSION: ${{ steps.install_node22.outputs.node-version }}
+      run: |
+        set -euo pipefail
+
+        if [[ "$INSTALLED_NODE_VERSION" != "$EXPECTED_NODE_VERSION" ]]; then
+          echo "Expected Node $EXPECTED_NODE_VERSION, installer reported '$INSTALLED_NODE_VERSION'" >&2
+          exit 1
+        fi
+
+        actual="$(node --version)"
+        actual="${actual%$'\r'}"
+        if [[ "$actual" != "$EXPECTED_NODE_VERSION" ]]; then
+          echo "Installed Node $INSTALLED_NODE_VERSION, but PATH selects '$actual'" >&2
+          exit 1
+        fi
+        printf 'Verified Node %s: %s\n' "$actual" "$(command -v node)"

.github/actions/setup-windows-llvm22/action.yml

@@ -5,10 +5,42 @@ runs:
   using: composite
   steps:
     - name: Set up MSYS2 for LLVM 22
+      id: msys2_attempt_1
+      continue-on-error: true
       uses: msys2/setup-msys2@v2
       with:
         msystem: CLANG64
         path-type: inherit
+        release: true
+        location: ${{ runner.temp }}/plan9asm-msys2-attempt-1
+        update: true
+
+    # These are bounded installer retries, not test retries or LLVM fallbacks.
+    # Only the first two bootstrap failures may proceed to another attempt.
+    # setup-msys2 refuses an existing installation, including a failed update's
+    # directory. Keep each fresh attempt separate; the action rewrites its
+    # msys2 shell wrapper to the successful installation without deleting any.
+    - name: Retry MSYS2 bootstrap (2 of 3)
+      id: msys2_attempt_2
+      if: ${{ steps.msys2_attempt_1.outcome == 'failure' }}
+      continue-on-error: true
+      uses: msys2/setup-msys2@v2
+      with:
+        msystem: CLANG64
+        path-type: inherit
+        release: true
+        location: ${{ runner.temp }}/plan9asm-msys2-attempt-2
+        update: true
+
+    - name: Retry MSYS2 bootstrap (3 of 3, failure is fatal)
+      id: msys2_attempt_3
+      if: ${{ steps.msys2_attempt_1.outcome == 'failure' && steps.msys2_attempt_2.outcome == 'failure' }}
+      uses: msys2/setup-msys2@v2
+      with:
+        msystem: CLANG64
+        path-type: inherit
+        release: true
+        location: ${{ runner.temp }}/plan9asm-msys2-attempt-3
         update: true
 
     - name: Install LLVM 22
@@ -39,27 +71,31 @@ runs:
 
         # libc++ supplies the compiler runtime. Keep the exact LLVM component
         # set mutually consistent while acknowledging the cc-libs virtual.
-        pacman --noconfirm -U \
-          --assume-installed "$prefix-cc-libs=$LLVM_VERSION" \
-          "${urls[@]}"
+        install_status=1
+        for attempt in 1 2 3; do
+          if pacman --noconfirm -U \
+            --assume-installed "$prefix-cc-libs=$LLVM_VERSION" \
+            "${urls[@]}"; then
+            install_status=0
+            break
+          else
+            install_status=$?
+          fi
+          if (( attempt < 3 )); then
+            echo "Pinned LLVM install attempt $attempt failed ($install_status); retrying in 5 seconds" >&2
+            sleep 5
+          fi
+        done
+        if (( install_status != 0 )); then
+          exit "$install_status"
+        fi
 
         if [[ "$(llvm-config --version)" != "$LLVM_VERSION" ]]; then
           echo "expected LLVM $LLVM_VERSION, got $(llvm-config --version)" >&2
           exit 1
         fi
 
-        flatten() {
-          local value=$1
-          value="${value//$'\r'/}"
-          value="${value//$'\n'/ }"
-          printf '%s' "$value"
-        }
-        echo "CGO_CFLAGS=$(flatten "$(llvm-config --cflags)")" >> "$GITHUB_ENV"
-        echo "CGO_CXXFLAGS=$(flatten "$(llvm-config --cxxflags)")" >> "$GITHUB_ENV"
-        echo "CGO_LDFLAGS=$(flatten "$(llvm-config --ldflags --libs all --system-libs)")" >> "$GITHUB_ENV"
-        clang_bin="$(cygpath -w /clang64/bin)"
-        echo "CC=$clang_bin\\clang.exe" >> "$GITHUB_ENV"
-        echo "CXX=$clang_bin\\clang++.exe" >> "$GITHUB_ENV"
-        echo 'CGO_ENABLED=1' >> "$GITHUB_ENV"
-        echo 'GOFLAGS=-tags=byollvm' >> "$GITHUB_ENV"
-        echo "$clang_bin" >> "$GITHUB_PATH"
+    - name: Publish stable LLVM 22 prefix
+      uses: ./.github/actions/publish-windows-llvm22
+      with:
+        attempt: ${{ steps.msys2_attempt_1.outcome == 'success' && '1' || steps.msys2_attempt_2.outcome == 'success' && '2' || steps.msys2_attempt_3.outcome == 'success' && '3' || '' }}