bundle: the head magic must survive the optimizer (#882 follow-up)

[InauguralPhysicist]

#882 stores the archive head magic XOR-obfuscated so its plaintext never lands in the runtime image — otherwise every plain eigenscript start finds the constant inside itself and refuses to run.

That obfuscation is only as good as the compiler's willingness to leave it alone. gcc -O2 did not fold it. clang did — it constant-folded the XOR loop and materialized the plaintext in rodata. So on macOS the interpreter detected itself as a damaged bundle and exited 3:

FAIL: CLI09 REPL banner (rc=3 out='bundle: archive header found but the trailer is
      missing or unreadable — the file is truncated or damaged — refusing to run')
FAIL: 16 REPL check(s) failed
FAIL: plain interpreter still starts the REPL (rc=3 …)

Exactly the failure mode the obfuscation exists to prevent, on the platform I can't build for locally. CI's macos-latest job caught it.

Changes

1. The XOR key is volatile — a volatile read cannot be folded away, so the plaintext cannot be precomputed into rodata by any optimizer.
2. A scan hit is only believed when a well-formed entry header follows it — [u32 path_len][printable path][u64 size] that fits inside the file. A coincidental magic match anywhere in future rodata therefore cannot make the interpreter refuse itself, independent of the obfuscation holding.

And a gate that doesn't depend on trusting either of those

tests/test_bundle.sh now greps the built interpreter for the plaintext magic and fails if it's present:

PASS: head magic plaintext is NOT in the interpreter image (fold guard)

That catches the fold at test time on any toolchain — present or future — instead of waiting for a platform job to go red. Validated both directions: it passes on the real binary and fires on a file that does contain the magic.

The lesson worth keeping: I verified the no-false-positive property on the compiler I had, and shipped a property that was compiler-dependent. The assertion is now on the outcome (is the string in the binary?) rather than on the mechanism.

• Suite: 3805/3805
• Bundle section: 13 → 14 checks

🤖 Generated with Claude Code

[Copilot]

Pull request overview

This PR hardens --bundle self-exec detection against compiler optimizations that could accidentally materialize the bundle head magic plaintext in the interpreter image (notably under clang), and adds a test gate to detect such folds at build/test time.

Changes:

• Makes the bundle head-magic XOR key volatile to prevent constant-folding into rodata.
• Tightens head-magic scan validation by requiring a plausible archive entry header after a match (to reduce false positives).
• Adds a test that scans the built interpreter image to ensure the plaintext head magic does not appear, and updates suite/changelog messaging accordingly.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.

File	Description
src/bundle.c	Prevents optimizer folding of head-magic deobfuscation; adds plausibility validation after scan hits.
tests/test_bundle.sh	Adds a regression gate that inspects the built interpreter for the plaintext head magic.
tests/run_all_tests.sh	Updates the displayed bundle check count.
CHANGELOG.md	Documents the new fold-guard and strengthened scan validation behavior.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.