The per-minor scheme only ever covered packages that passed through the build
pipeline after it existed. A package built into the flat slot before that, and
not updated on CRAN since, is never reclassified and never gets a per-minor
copy, so the union index serves its flat binary to every minor.
When that binary references a symbol the client's R no longer exports, the
install fails at dyn.load():
base64enc.so: undefined symbol: SETLENGTH
base64enc calls SETLENGTH, its flat binary was built under R 4.4.3, and R 4.6
does not export SETLENGTH.
Rebuilding one package into one minor was only possible via `just rebuild` from
a workstation holding the S3 and Postgres credentials. This adds a CI path.
This change will:
- take a package@version list and a target R minor, over the same slot matrix
as reindex.yaml so the slot-to-image mapping cannot drift
- run build-one.R --sensitive-only, which reclassifies each version and skips
anything that is not ABI-risky rather than writing it to the wrong slot
- mount no shared cache volume, so it cannot disturb the build pipeline's
per-agent caches
- report a non-zero exit if any package fails, after attempting them all
pat-s
9d8fcda9af