Normalize size-profile roots only at path operand boundaries

Start with scripts/ci/size-profile.py and the focused contract tests in scripts/ci/test-main-size-monitor.py; inspect how the script receives Meson-produced arguments and compare profiles captured under the two checkout roots. Add regressions for repeated root components, embedded unrelated paths, supported path-operand forms, and build-root precedence. Done means relocated equivalent profiles match while the listed negative controls and existing size-policy contracts still detect real differences.

discovery_risks — size profile root normalization

Architect/Critic disposition: confirmed separate CI-tooling follow-up. Do not fold it into #1995's production manifest size reduction. No repository source edits or GitHub writes were performed.

Proposed title

Normalize size-profile checkout roots only at actual path boundaries

Discovery context and reproduction

While reproducing PR #1989's GCC13.3 size failure for #1995, the same production recipe relocated from /src to /work/manifest-head yielded different profile fingerprints (reported prefixes 9e0c... versus hosted-compatible cd6cc2...). Inspection of /dev/shm/wirelog-1995/scripts/ci/size-profile.py:21 shows replace_root uses an unanchored global regular expression. It checks only the character after a root match, not whether that match begins the path operand.

Independent reproduction imported the unchanged script using Python in a newly uv-created virtual environment:

The first output should be -I<SOURCE>/subprojects/nanoarrow/src; the third should remain unchanged. The malformed first string also appears in /tmp/wirelog-1995-workflow/original-profile.json:16. Existing tests in scripts/ci/test-main-size-monitor.py cover sibling-root rejection, a simple root prefix and attached -I, but miss repeated root components and unrelated paths containing the root text.

The bug can produce a false profile mismatch solely from relocation and can erase meaningful suffix/path distinctions. It changes profile evidence, not compiled code or measured library bytes. Authoritative reproduced production sizes remain head 410387 / base 407304 bytes, with integrated occurrence consumer 411710 bytes. Fixing normalization does not remove #1995's real size overage or satisfy its unchanged size gate.

Scope

Repair root normalization in scripts/ci/size-profile.py and its focused CI contract tests. Identify complete source/build roots at actual path starts or supported compiler/linker option-operand boundaries. Preserve all subsequent path components, sibling paths, unrelated embedded root text, option syntax and multiple independent path operands. Retain build-root precedence over source-root normalization so nested and external build layouts compare consistently.

Use the script's actual Meson-produced argument forms to choose a maintainable parsing/boundary rule. Merely limiting replacement to the first match is insufficient: it still corrupts an unrelated path containing /src and may mishandle arguments carrying several paths. Do not implement arbitrary compiler-option parsing or broaden this into toolchain fingerprint redesign.

Acceptance criteria

1. Add red/green regressions for the reproduced repeated-component and unrelated-path cases, ordinary complete-root replacement and /src-old preservation. No suffix component may be rewritten as a root.
2. Cover supported attached and separate path options, equals-valued and comma-separated path forms where emitted by the existing profile inputs, paths containing spaces, and multiple genuine path operands. Preserve unrelated option text. Include nested/external build-root precedence and repeated normalization stability.
3. Capture equivalent real production or representative Meson profiles under short repeated-component-prone and unique checkout roots. After normalization, compare/fingerprint must agree when all actual settings agree. Record exact fixtures, profiles and commands.
4. Negative controls must continue rejecting genuine differences in include suffix/path, compiler/version, selected linker/flags, LTO/optimization/logging or dependency/build options. Do not delete fingerprint fields, erase meaningful distinctions, accept unknown toolchains, or weaken fail-closed profile comparison.
5. Existing size policy, main-size monitor, attribution/provenance and related focused CI contracts pass. Production .text, baseline, allowance and gate enforcement remain unchanged. Re-capture old profiles as needed; do not pretend old incorrectly normalized hashes are interchangeable with corrected evidence.
6. Keep the fix separately reviewable from #1995 and re-run exact-profile size comparison after integration. Profile equality is a prerequisite to interpreting measurements, not evidence that a candidate fits the size budget.

Discussion and priority

Architect independently agreed this is a separate CI-tooling defect and endorsed boundary-aware normalization, relocation and negative-control tests, build-before-source precedence and unchanged policy. No disagreement remains. This follow-up must not distract from the user's TDD priority or hide the manifest's production-size blocker; #1995 still owns measured code-size reduction, and #1913 separately owns required throughput recovery.

Priority recommendation: P2, milestone 0.85. Common short container roots make the defect reproducible, and profile fidelity is important, but current hosted unique absolute roots are unaffected and relocation to unique roots provides a verified workaround without relaxing comparisons. This does not block the P1/0.80 production-size repair or urgent TDD input work. Escalate if a required CI path actually becomes blocked or a reproduced collision admits materially different profiles; that broader impact is not established by the present evidence.

Triage: P2 / 0.85.0. Canonical hosted checkout roots are unaffected, and #1995's exact canonical-profile reproduction succeeds with a distinct root path. This is a correctness fix for relocatable profile evidence, rather than a prerequisite to the current TDD production-size fix.