ci, round 5: a fast path that skips the xlings tarball when the cache is at the pin, and a Windows e2e step that installs mingw only when the sandbox does not already hold it

Both guards keep the existing fallback, so a no-cache restore still runs the
full bootstrap and a sandbox without mingw still installs it. The guards are
covering measured cost, not invented one:

- bootstrap-mcpp pays the xlings tarball fetch + extract on every job even
  when the restored cache already holds the pinned binary. Measured 5 to 30 s
  per job on Linux and ~30 s per job on Windows, repeated across ~30 jobs per
  run. The cache key is already xl$VER; the check is the one case the guard
  would otherwise miss — a stale xlings cache from before the pin was bumped,
  or a binary that no longer runs because its dynamic loader is gone.

- ci-windows-e2e's three shards each call `toolchain install mingw 16.1.0`.
  The build job prewarms mingw on main and saves it into the sandbox cache,
  so every PR restores a sandbox that already holds it; the call is a no-op
  but still pays mcpp-toolchain startup. Measured 68 s per shard on three
  shards per PR. The check looks for the g++ in the two homes run_all.sh
  probes, and the install is gated on the missing-payload case only.

The fallback paths are the same code in C++ or in \ux\. The guards do not
change what a cold cache installs or what a warm cache restores; they only
save the cost of the redundant calls on warm caches.

Author: speak-agent

.github/actions/bootstrap-mcpp/action.yml

@@ -132,6 +132,37 @@ runs:
             esac
             tarball="xlings-${XLINGS_VERSION}-linux-${xa}.tar.gz" ;;
         esac
+        # FAST PATH: the xlings cache already holds the pinned version, so the
+        # tarball fetch + extract + `self install` are skipped. Without this
+        # guard every job of every CI run paid the download and the extract,
+        # measured at 5 to 30 seconds per job on Linux and ~30 seconds on
+        # Windows, across thirty jobs per run — about half the bootstrap-mcpp
+        # step on Windows, more the 7 seconds the unix leg pays. The cache key
+        # is `xl$VER` already; the check is the one case this guard would
+        # otherwise miss: a stale `xlings` cache from BEFORE the pin was
+        # bumped (a partial restore-key match hands the same OS/ARCH cache
+        # back, but with the previous release), or a binary that no longer runs
+        # because its dynamic loader is gone.
+        XL_BIN_PATH="$HOME/.xlings/subos/default/bin/xlings"
+        if [ -x "$XL_BIN_PATH" ]; then
+          xl_ver="$("$XL_BIN_PATH" --version 2>/dev/null | head -1 || true)"
+          if [ -n "$xl_ver" ] && echo "$xl_ver" | grep -qF "$XLINGS_VERSION"; then
+            export PATH="$HOME/.xlings/subos/default/bin:$PATH"
+            echo "$HOME/.xlings/subos/default/bin" >> "$GITHUB_PATH"
+            xlings --version
+            MCPP=$(bash "$REPO_DIR/.github/tools/install_pinned_mcpp.sh" "$REPO_DIR")
+            echo "system  xlings: $(xlings --version 2>/dev/null | head -1)"
+            if [ -x "$HOME/.mcpp/registry/bin/xlings" ]; then
+              echo "sandbox xlings: $("$HOME/.mcpp/registry/bin/xlings" --version 2>/dev/null | head -1)"
+            else
+              echo "sandbox xlings: (not initialised yet)"
+            fi
+            echo "MCPP=$MCPP" >> "$GITHUB_ENV"
+            echo "XLINGS_BIN=$XL_BIN_PATH" >> "$GITHUB_ENV"
+            exit 0
+          fi
+        fi
+
         WORK=$(mktemp -d)
         # Retried and verified — see .github/tools/fetch_release.sh. A bare curl
         # here was the single largest source of unexplained CI red on this repo
@@ -202,6 +233,29 @@ runs:
         XLINGS_VERSION: ${{ inputs.xlings-version }}
       run: |
         REPO_DIR="$(pwd)"
+        # FAST PATH: see the unix leg for the reasoning. The cost on Windows is
+        # larger (the zip is bigger and the runner's network path to
+        # github.com is slower), measured at ~30 s per job.
+        XL_BIN_PATH="$USERPROFILE/.xlings/subos/default/bin/xlings.exe"
+        if [ -x "$XL_BIN_PATH" ]; then
+          xl_ver="$("$XL_BIN_PATH" --version 2>/dev/null | head -1 || true)"
+          if [ -n "$xl_ver" ] && echo "$xl_ver" | grep -qF "$XLINGS_VERSION"; then
+            export PATH="$USERPROFILE/.xlings/subos/default/bin:$PATH"
+            echo "$USERPROFILE/.xlings/subos/default/bin" >> "$GITHUB_PATH"
+            xlings.exe --version
+            MCPP=$(bash "$REPO_DIR/.github/tools/install_pinned_mcpp.sh" "$REPO_DIR")
+            echo "system  xlings: $(xlings.exe --version 2>/dev/null | head -1)"
+            if [ -x "$USERPROFILE/.mcpp/registry/bin/xlings.exe" ]; then
+              echo "sandbox xlings: $("$USERPROFILE/.mcpp/registry/bin/xlings.exe" --version 2>/dev/null | head -1)"
+            else
+              echo "sandbox xlings: (not initialised yet)"
+            fi
+            echo "MCPP=$MCPP" >> "$GITHUB_ENV"
+            echo "XLINGS_BIN=$(cygpath -w "$XL_BIN_PATH")" >> "$GITHUB_ENV"
+            exit 0
+          fi
+        fi
+
         WORK=$(mktemp -d)
         zipfile="xlings-${XLINGS_VERSION}-windows-x86_64.zip"
         # Same helper as the unix leg. This is the leg that kept failing, and a

.github/workflows/ci-windows-e2e.yml

@@ -66,16 +66,30 @@ jobs:
       - name: "Toolchain: MinGW payload for the fat-package e2e"
         shell: bash
         run: |
+          # The build job's prewarm installs `mingw 16.1.0` on `main` and saves
+          # it into the sandbox cache, so every PR restores a sandbox that
+          # already holds it. The install call is then a no-op but still pays
+          # the mcpp-toolchain startup cost; measured 68 s on three shards per
+          # PR. Skip the call when the payload is already reachable, and keep
+          # the verification that names the missing-capability case (the whole
+          # reason this step exists is so a skipped shard does not read like a
+          # passing one).
           export MCPP_VENDORED_XLINGS="$XLINGS_BIN"
-          "$MCPP_SELF" toolchain install mingw 16.1.0
-          # Verified through the SAME two locations run_all.sh probes — checking
-          # only one of them would let the step pass while the capability stays
-          # ungranted, which is the shape of a green run that tested nothing.
           found=""
           for c in "${MCPP_HOME:-$HOME/.mcpp}"/registry/data/xpkgs/xim-x-mingw-gcc/*/bin/g++.exe \
                    "$HOME"/.xlings/data/xpkgs/xim-x-mingw-gcc/*/bin/g++.exe; do
             [[ -x "$c" ]] && { found="$c"; break; }
           done
+          if [ -z "$found" ]; then
+            "$MCPP_SELF" toolchain install mingw 16.1.0
+            for c in "${MCPP_HOME:-$HOME/.mcpp}"/registry/data/xpkgs/xim-x-mingw-gcc/*/bin/g++.exe \
+                     "$HOME"/.xlings/data/xpkgs/xim-x-mingw-gcc/*/bin/g++.exe; do
+              [[ -x "$c" ]] && { found="$c"; break; }
+            done
+          fi
+          # Verified through the SAME two locations run_all.sh probes — checking
+          # only one of them would let the step pass while the capability stays
+          # ungranted, which is the shape of a green run that tested nothing.
           test -n "$found" || { echo "FAIL: mingw installed but not where run_all.sh looks"; exit 1; }
           echo "mingw payload: $found"