fix(build.mcpp): ask the prerequisite question before the cache is consulted

Self-review found the refusal sitting after the cache fast path returns.
Withdrawing `reexport = true` from an edge leaves the module set and every
interface hash identical, so nothing in `compilerIdentity` moves -- the cached
program would be replayed and the now-illegal import would never be reported.

Measured: it fires anyway today, because `ctxHash` happens to change too. That
is an incidental coupling between two keys that answer different questions, and
this codebase has paid for that shape repeatedly. Adding `importable` to the
cache identity would have been a second place deriving the same decision;
asking before the cache is consulted needs no key at all.

`srcText` is hoisted to where the check now lives and read once.

e2e 311 gains a section that runs on a warm cache, with the measurement above
written into it: the assertion pins the behaviour, and the placement is what
makes it hold.

Author: speak-agent

src/build/build_program.cppm

@@ -703,6 +703,40 @@ std::expected<void, std::string> run_build_program(
     std::string programHash  = mcpp::toolchain::hash_file(src);
     std::string compilerHash = mcpp::toolchain::hash_string(compilerIdentity);
 
+    // Read once, here, because the check below has to run BEFORE the cache
+    // fast path returns.
+    std::string srcText;
+    { std::ifstream is(src); std::ostringstream ss; ss << is.rdbuf(); srcText = ss.str(); }
+
+    // A module that is present only as another rule's prerequisite is not part
+    // of this package's declared surface. Refusing the import rather than
+    // letting it work is the difference between a rule that travels and one
+    // that happens to build on whoever's machine: the same source stops
+    // compiling the moment the intermediate rule stops depending on it, or the
+    // moment a Clang user tries it, since only GCC makes the BMI reachable
+    // without the flags.
+    //
+    // ⚠️ AHEAD OF THE FAST PATH ON PURPOSE. Withdrawing `reexport = true` from
+    // an edge leaves the module SET and every interface hash identical, so
+    // nothing in `compilerIdentity` moves. Measured: the replay is prevented
+    // today only because `ctxHash` happens to change too — an incidental
+    // coupling, and the shape this codebase keeps paying for. Asking the
+    // question before the cache is consulted needs no key at all.
+    for (auto const& hm : env.hostModules) {
+        if (hm.importable) continue;
+        if (!imports_module(srcText, hm.logical)) continue;
+        return std::unexpected(std::format(
+            "build.mcpp imports '{}', which reaches this build only as a "
+            "prerequisite of another build rule.\n"
+            "       A rule's build-time provisions cross one further edge only "
+            "when that edge says so.\n"
+            "       Either depend on the package providing '{}' directly, or "
+            "have the rule that owns it re-export it:\n"
+            "         <that rule's package> = {{ ..., host-module = true, "
+            "reexport = true }}",
+            hm.logical, hm.logical));
+    }
+
     // Fast path: declared inputs + contract unchanged → reapply cached
     // directives, no run.
     CacheRecord cache = read_cache(bdir);
@@ -763,8 +797,8 @@ std::expected<void, std::string> run_build_program(
     // -fmodules, cwd = project root). When it does `import mcpp;`, compile the
     // module, link its object, and run the build.mcpp compile from `bdir` so GCC
     // finds gcm.cache/mcpp.gcm.
-    std::string srcText;
-    { std::ifstream is(src); std::ostringstream ss; ss << is.rdbuf(); srcText = ss.str(); }
+    // `srcText` was read above the cache fast path, which the prerequisite
+    // check needs to run ahead of.
     bool usesModule    = srcText.find("import mcpp") != std::string::npos;
     bool usesStdCompat = imports_module(srcText, "std.compat");
     bool usesStd       = usesStdCompat || imports_module(srcText, "std");
@@ -784,27 +818,6 @@ std::expected<void, std::string> run_build_program(
         if (imports_module(t, "std"))        usesStd       = true;
     }
 
-    // A module that is present only as another rule's prerequisite is not part
-    // of this package's declared surface. Refusing the import here rather than
-    // letting it work is the difference between a rule that travels and one
-    // that happens to build on whoever's machine: the same source stops
-    // compiling the moment the intermediate rule stops depending on it, or the
-    // moment a Clang user tries it, since only GCC makes the BMI reachable
-    // without the flags.
-    for (auto const& hm : env.hostModules) {
-        if (hm.importable) continue;
-        if (!imports_module(srcText, hm.logical)) continue;
-        return std::unexpected(std::format(
-            "build.mcpp imports '{}', which reaches this build only as a "
-            "prerequisite of another build rule.\n"
-            "       A rule's build-time provisions cross one further edge only "
-            "when that edge says so.\n"
-            "       Either depend on the package providing '{}' directly, or "
-            "have the rule that owns it re-export it:\n"
-            "         <that rule's package> = {{ ..., host-module = true, "
-            "reexport = true }}",
-            hm.logical, hm.logical));
-    }
     usesStd = usesStd || usesStdCompat;
 
     // The toolchain's own environment (MSVC's INCLUDE / LIB / VSLANG, which

tests/e2e/311_rule_build_dependencies.sh

@@ -136,6 +136,29 @@ out="$("$MCPP" run 2>&1 | grep '^ANSWER=' | tail -1)"
 [[ "$out" == "ANSWER=7" ]] || {
     echo "FAIL: the re-exported path broke the value: $out"; exit 1; }
 
+# ── 3b. withdrawing reexport is caught on a warm cache ─────────────────────
+# Ordered right after the successful build above, so build.mcpp's cache and the
+# whole-project fast path are both warm. Dropping `reexport` leaves the module
+# SET and every interface hash identical, so nothing in the cache identity
+# moves; the refusal is reached only because it is asked BEFORE the cache is
+# consulted.
+#
+# ⚠️ This assertion does not prove that placement on its own. Measured: with
+# the check below the fast path it still fired here, because `ctxHash` happens
+# to change as well. The placement is what makes the property hold; this pins
+# the behaviour, not the reason.
+cd "$TMP"
+mk_outer ""
+touch app/src/main.cpp   # the whole-project fast path never reaches build.mcpp
+cd app
+if "$MCPP" build > b3b.log 2>&1; then
+    cat b3b.log
+    echo "FAIL: withdrawing reexport was replayed from the build.mcpp cache"
+    exit 1
+fi
+grep -qF "globbing" b3b.log || {
+    cat b3b.log; echo "FAIL: the refusal after cache invalidation does not name the module"; exit 1; }
+
 # ── 4. a cycle is reported as a cycle ──────────────────────────────────────
 cd "$TMP"
 cat >> globbing/mcpp.toml <<'EOF'