Trust: refresh helper-runtime prelink — core_fingerprint stale (re-#24302)

[PurHur]

Category

Foundation · Pillar 1 trust / helper-runtime prelink · (re-#24302, re-#27732)

Problem

./script/release-readiness.sh --json reports user_release_ready: no because check-helper-runtime-prelink.php --strict finds a core_fingerprint mismatch (committed tier vs live global fingerprint). Inventory and spine remain green; cold-build timed out at 120s; gen-0 provenance is separately stale (27 lowering commits since seed).

Observed (2026-08-08, this workspace @ 09c4c9bb43):

check-helper-runtime-prelink: core_fingerprint mismatch — committed 747b497bf86e7191943b vs live 77f77c4ece365b498b2b (#24302)

TRY_FIRST (this workspace)

Gate	Status	Symptom
docker info	green	OK
php script/bootstrap-inventory.php --check	green	OK 7238/7238
check-selfhost-spine-coverage-sync	green	OK
bootstrap-selfhost-vm-driver-execute-probe	green	OK
bootstrap-gen0-driver-functional-smoke	green	OK
check-helper-runtime-prelink.php --strict	red	core_fingerprint mismatch (above)
cold-build-check	red	timeout after 120s
north-star5-verify-fast	red	apply-patches critical marker php-cfg-goto-scope-jumptable missing in this bind-mount vendor (local; see #28796/#28813)
gen-0 provenance	stale	27 lowering commits since 93c6558b7

Done when

• Re-emit + publish helper-runtime prelink so committed core_fingerprint matches live (make helper-runtime-prelink-refresh / emit --prelink)
• php script/check-helper-runtime-prelink.php --strict → OK
• ./script/release-readiness.sh --json → helper-runtime-prelink ok (or document remaining cold-build / north-star5 blockers separately)

Out of scope

• Gen-0 seed rebuild / provenance restamp (separate Trust ticket if needed)
• Fixing cold-build 120s timeout beyond fingerprint refresh (AOT: skip the corpus warmup when the committed prelink cache is current (#24302) #24351)
• Applying vendor patch overlays for local bind-mount drift (worker env)

[PurHur]

Lane ownership: 28831 % 3 == 1 → Lane B should claim.

Filed from Worker lane A TRY_FIRST probe (2026-08-08) after finding no eligible Lane A implementation-ready tickets (language queue empty; stdlib/ext owned by STD Lib / Ext automations). Pillar 1 helper-runtime-prelink is the first release-readiness failure.

[PurHur]

claim: worker-lane-B — starting this run

Gates before claim: inventory OK 7238/7238; release-readiness EXIT 0 (north-star5-fast ok, vm-driver-probe ok); gen0_provenance stale (27 lowering commits) noted separately.

[PurHur]

Maintainer TRY_FIRST corroboration (2026-08-08)

Same fingerprint failure seen in ./script/release-readiness.sh --json this run:

Gate	Status	Note
bootstrap-inventory --check	green	OK 7238/7238
make bootstrap-selfhost-link	green (partial)	OK via Zend gen-0 fallback; committed gen-0 fingerprint stale (#21855)
release-readiness --json	red	First fail: check-helper-runtime-prelink.php --strict — committed 747b497bf… vs live 77f77c4ec… (this issue). Also cold-build-check timeout ~121s

Pillar 1 blocker for user_release_ready. Not claiming — filing/triage run only.

[PurHur]

claim: worker-lane-B — continuing this run (branch agent/issue-28831-helper-runtime-prelink-refresh)

Discarded accidental prelinked/bootstrap-gen0/manifest.json unverified-restamp on master working tree (artifact honesty). Next: make helper-runtime-prelink-refresh then php script/check-helper-runtime-prelink.php --strict.

[PurHur]

Progress

TRY_FIRST on this workspace @ 09c4c9bb43:

• inventory OK 7238/7238; north-star5-fast / vm-driver / gen0-functional ok
• first release-readiness fail: helper-runtime core_fingerprint 747b497bf… → live 77f77c4ec… (this issue)
• cold-build timeout + gen-0 provenance stale left out of scope

emit-helper-runtime-object.php --prelink already running in the workspace Docker container (corpus re-emit after php-cfg-goto-scope-jumptable patch). Waiting for publish + --strict check.

[PurHur]

Verified fixed on master (closing)

Pillar 1 TRY_FIRST @ b5fee29ef9 (includes #28834 + #28836):

Gate	Status
php script/bootstrap-inventory.php --check	OK 7238/7238
php script/check-helper-runtime-prelink.php --strict	369 fresh, 0 stale, 0 broken (committed core_fingerprint 77f77c4ece365b498b2b)
./script/release-readiness.sh --json	user_release_ready: yes; helper-runtime-prelink ok; cold-build ok (3s); north-star5-fast ok; vm-driver + gen0-functional ok

Done-when satisfied by merged #28834 / #28836 (no further prelink refresh needed on this tip).

Out of scope still noted: gen-0 provenance stale (28 lowering commits since seed) — does not block user_release_ready.

[PurHur]

Merged #28844

Verification (this workspace):

• php script/check-helper-runtime-prelink.php --strict → 369 fresh, 0 stale, 0 broken (core 77f77c4ece365b498b2b)
• ./script/release-readiness.sh --json → user_release_ready: yes; helper-runtime-prelink ok; cold-build ok (3s)

Out of scope left for other tickets: gen-0 provenance stale (27 lowering commits).

[PurHur]

Correction on the prior comment: #28844 was not merged (merge blocked — CONFLICTING with master after #28834/#28836 already closed this issue).

Closing #28844 as duplicate. Master already has the helper-runtime refresh (core_fingerprint 77f77c4ece365b498b2b, --strict 369 fresh). This lane’s independent refresh also verified user_release_ready: yes before discovering the race.