ElyOffice/tasks/reviews/L1.7-r2.md

FAIL

1. packaging/linux/package.sh:156 — Dropping empty RUNPATH components hides searches outside the AppDir: leading or trailing : means the current working directory to the loader. In the compiled ELF probe, both :$ORIGIN/missing and $ORIGIN/missing: passed packaging and produced deb, rpm, and Arch packages. Loading returned 42 with libleaf.so in the working directory, then failed when that external library was removed. Preserve empty components and reject current-directory searches; add leading/trailing-colon regression cases. Evidence: .work/L1.7-r2/guard.log.

2. packaging/linux/package.sh:156 — The original extraction error now propagates, but failures in the splitting process substitution still bypass validation. Making its sed exit 74 or its tr exit 75 let an ELF with an absolute external RUNPATH pass; the copied packager exited 0 and produced all three native packages. Capture and check the complete splitting pipeline before consuming its output, and add failure-injection regressions for both commands. Evidence: .work/L1.7-r2/guard.log.

3. packaging/source.sh:9 — --untracked-files=no lets uncommitted build inputs pass the clean-tree check, so the commit-labelled archive can differ from the binary, contrary to PRD §§21.3 and 24.2. In a Rust probe checkout using this script, an untracked, automatically discovered build.rs changed the built program's output to untracked-build-input; source.sh succeeded but omitted that file, and rebuilding its archive printed committed. Reject untracked build inputs or build from the same committed snapshot that is archived; add a regression covering this mismatch. Evidence: .work/L1.7-r2/source.log.