@@ -542,67 +542,29 @@ fn is_extracted_temp_runtime(p: &std::path::Path) -> bool {
542542 })
543543}
544544
545−/// Returns true if the runtime archive `lib` is stale — i.e. the newest
546−/// source file under `crates/knot-runtime/src/` (recursively) or the
547−/// runtime crate's `Cargo.toml` has an mtime newer than the archive itself.
548−/// Falls back to `false` (assume fresh) when the workspace root can't be
549−/// located or mtimes can't be compared, so we never block builds spuriously.
550−fn is_runtime_stale(lib: &std::path::Path, exe_dir: &std::path::Path) -> bool {
551− // Walk up from the compiler's directory to find the workspace root
552− // (the directory containing `crates/knot-runtime/`). In a cargo
553− // workspace the compiler binary lives in `target/<profile>/`, so the
554− // workspace root is two levels above `exe_dir`.
555− let workspace_root = exe_dir
556− .ancestors()
557− .skip(1) // skip `target/<profile>` itself
558− .find(|d| d.join("crates/knot-runtime").is_dir());
559−
560− let workspace_root = match workspace_root {
561− Some(r) => r,
562− None => return false, // can't locate workspace — assume fresh
563− };
564−
565− let lib_mtime = match std::fs::metadata(lib).and_then(|m| m.modified()) {
566− Ok(m) => m,
567− Err(_) => return false,
568− };
569−
570− // Recursively find the newest mtime among all `*.rs` files under
571− // `crates/knot-runtime/src/`, plus the runtime crate's `Cargo.toml`.
572− let mut newest_src: Option<std::time::SystemTime> = None;
573−
574− fn consider(
575− p: &std::path::Path,
576− newest: &mut Option<std::time::SystemTime>,
577− ) {
578− if let Ok(m) = std::fs::metadata(p).and_then(|m| m.modified())
579− && newest.map(|n| m > n).unwrap_or(true) {
580− *newest = Some(m);
581− }
582− }
583−
584− fn walk_dir(dir: &std::path::Path, newest: &mut Option<std::time::SystemTime>) {
585− if let Ok(rd) = std::fs::read_dir(dir) {
586− for entry in rd.flatten() {
587− let p = entry.path();
588− if p.is_dir() {
589− walk_dir(&p, newest);
590− } else if p.extension().map(|e| e == "rs").unwrap_or(false) {
591− consider(&p, newest);
592− }
593− }
594− }
595− }
596−
597− walk_dir(&workspace_root.join("crates/knot-runtime/src"), &mut newest_src);
598− consider(
599− &workspace_root.join("crates/knot-runtime/Cargo.toml"),
600− &mut newest_src,
601− );
545+/// The blake3 content hash of the runtime archive this compiler embeds (set by
546+/// build.rs when an archive was embedded). Comparing a candidate archive's hash
547+/// against this is the freshness check: a match means byte-identical bits, so
548+/// the archive is exactly what this compiler would link — independent of file
549+/// mtimes, clock skew, or which build produced it.
550+const EMBEDDED_RUNTIME_HASH: Option<&str> = option_env!("KNOT_EMBEDDED_RUNTIME_HASH");
551+
552+/// Hash an archive's bytes. `None` on read error.
553+fn hash_archive(p: &std::path::Path) -> Option<String> {
554+ std::fs::read(p)
555+ .ok()
556+ .map(|bytes| blake3::hash(&bytes).to_hex().to_string())
557+}
602558
603− match newest_src {
604− Some(src_mtime) => src_mtime > lib_mtime,
605− None => false, // no source files found — assume fresh
559+/// True if `lib` is stale — its content differs from the runtime archive this
560+/// compiler embeds. Falls back to `false` (assume fresh) when there's no
561+/// embedded runtime to compare against or the file can't be read, so we never
562+/// block builds spuriously. Replaces the old mtime walk: content comparison is
563+/// immune to clock skew, `touch`, and VCS checkouts that reset mtimes.
564+fn is_runtime_stale(lib: &std::path::Path) -> bool {
565+ match EMBEDDED_RUNTIME_HASH {
566+ Some(expected) => hash_archive(lib).map(|h| h != expected).unwrap_or(false),
567+ None => false,
606568 }
607569}
608570
@@ -611,19 +573,15 @@ fn find_runtime() -> PathBuf {
611573 if let Ok(path) = std::env::var("KNOT_RUNTIME_LIB") {
612574 let p = PathBuf::from(&path);
613575 if p.exists() {
614− // Warn if the archive is stale relative to the runtime source,
576+ // Warn if the archive's content differs from the embedded runtime,
615577 // but still use it — the user set the override explicitly.
616− if let Some(exe_dir) = std::env::current_exe()
617− .ok()
618− .and_then(|e| e.parent().map(|p| p.to_path_buf()))
619− && is_runtime_stale(&p, &exe_dir)
620− {
621− eprintln!(
622− "Warning: KNOT_RUNTIME_LIB archive '{}' is older than \
623− crates/knot-runtime/src/ — rebuild knot-runtime to \
624− pick up source changes",
625− path
626− );
578+ if is_runtime_stale(&p) {
579+ eprintln!(
580+ "Warning: KNOT_RUNTIME_LIB archive '{}' content differs from \
581+ the runtime this compiler embeds — rebuild knot-runtime to \
582+ pick up source changes",
583+ path
584+ );
627585 }
628586 return p;
629587 }
@@ -642,13 +600,14 @@ fn find_runtime() -> PathBuf {
642600 && let Some(exe_dir) = exe.parent() {
643601 let candidate = exe_dir.join("libknot_runtime.a");
644602 if candidate.exists() {
645− // Freshness check: if the runtime source is newer than the
646− // archive, the archive is stale (e.g. only knot-compiler was
647− // rebuilt). Skip it and fall through to the embedded runtime
603+ // Freshness check: if the archive's content differs from the
604+ // runtime this compiler embeds (e.g. only knot-compiler was
605+ // rebuilt, or knot-runtime sources changed), the archive is
606+ // stale. Skip it and fall through to the embedded runtime
648607 // rather than silently linking stale code.
649− if is_runtime_stale(&candidate, exe_dir) {
608+ if is_runtime_stale(&candidate) {
650609 eprintln!(
651− "Warning: {} is older than crates/knot-runtime/src/ \
610+ "Warning: {} content differs from the embedded runtime \
652611 — skipping stale archive, falling back to embedded \
653612 runtime. Run `cargo build -p knot-runtime` to refresh.",
654613 candidate.display()