fix: restore ninja -v flag for compile command visibility

Removed in b24e4647b under naive assumption we were "past debugging phase".

Reality: debugging is never done, verbose output is invaluable, costs nothing.
Keep -v flag permanently.

.github/actions/xahau-actions-cache-restore/action.yml

@@ -1,5 +1,5 @@
-name: 'Xahau Cache Restore (S3 + OverlayFS)'
+name: 'Xahau Cache Restore (S3)'
-description: 'Drop-in replacement for actions/cache/restore using S3 and OverlayFS for delta caching'
+description: 'Drop-in replacement for actions/cache/restore using S3 storage'
 
 inputs:
   path:
@@ -28,10 +28,6 @@ inputs:
     description: 'Check if a cache entry exists for the given input(s) without downloading it'
     required: false
     default: 'false'
-  use-deltas:
-    description: 'Enable delta caching (download/upload incremental changes). Set to false for base-only caching.'
-    required: false
-    default: 'true'
   # Note: Composite actions can't access secrets.* directly - must be passed from workflow
   aws-access-key-id:
     description: 'AWS Access Key ID for S3 access'
@@ -48,13 +44,13 @@ outputs:
     description: 'The key that was used to restore the cache (may be from restore-keys)'
     value: ${{ steps.restore-cache.outputs.cache-primary-key }}
   cache-matched-key:
-    description: 'The key that matched (same as cache-primary-key for compatibility)'
+    description: 'The key that was used to restore the cache (exact or prefix match)'
-    value: ${{ steps.restore-cache.outputs.cache-primary-key }}
+    value: ${{ steps.restore-cache.outputs.cache-matched-key }}
 
 runs:
   using: 'composite'
   steps:
-    - name: Restore cache from S3 with OverlayFS
+    - name: Restore cache from S3
       id: restore-cache
       shell: bash
       env:
@@ -67,87 +63,42 @@ runs:
         TARGET_PATH: ${{ inputs.path }}
         FAIL_ON_MISS: ${{ inputs.fail-on-cache-miss }}
         LOOKUP_ONLY: ${{ inputs.lookup-only }}
-        USE_DELTAS: ${{ inputs.use-deltas }}
       run: |
         set -euo pipefail
 
         echo "=========================================="
-        echo "Xahau Cache Restore (S3 + OverlayFS)"
+        echo "Xahau Cache Restore (S3)"
         echo "=========================================="
         echo "Target path: ${TARGET_PATH}"
-        echo "Primary key: ${CACHE_KEY}"
+        echo "Cache key: ${CACHE_KEY}"
         echo "S3 bucket: s3://${S3_BUCKET}"
-        echo "Use deltas: ${USE_DELTAS}"
         echo ""
 
-        # Generate unique cache workspace
+        # Normalize target path (expand tilde and resolve to absolute path)
-        CACHE_HASH=$(echo "${CACHE_KEY}" | md5sum | cut -d' ' -f1)
+        if [[ "${TARGET_PATH}" == ~* ]]; then
-        CACHE_WORKSPACE="/tmp/xahau-cache-${CACHE_HASH}"
+          TARGET_PATH="${HOME}${TARGET_PATH:1}"
+        fi
+        TARGET_PATH=$(realpath -m "${TARGET_PATH}")
+        echo "Normalized target path: ${TARGET_PATH}"
+        echo ""
 
-        echo "Cache workspace: ${CACHE_WORKSPACE}"
+        # Function to try restoring a cache key
-
-        # Create OverlayFS directory structure
-        mkdir -p "${CACHE_WORKSPACE}"/{base,upper,work,merged}
-
-        # Function to try downloading from S3
         try_restore_key() {
-          local try_key="$1"
+          local key=$1
-          local s3_base="s3://${S3_BUCKET}/${try_key}-base.tar.zst"
+          local s3_key="s3://${S3_BUCKET}/${key}-base.tar.zst"
 
-          echo "Trying cache key: ${try_key}"
+          echo "Checking for key: ${key}"
-
-          # Check if base exists (one base per key, immutable)
-          echo "Checking for base layer..."
-          if aws s3 ls "${s3_base}" --region "${S3_REGION}" >/dev/null 2>&1; then
-            echo "✓ Found base layer: ${s3_base}"
-
-            if [ "${LOOKUP_ONLY}" = "true" ]; then
-              echo "Lookup-only mode: cache exists, skipping download"
-              return 0
-            fi
-
-            # Download base layer
-            echo "Downloading base layer..."
-            aws s3 cp "${s3_base}" /tmp/cache-base.tar.zst --region "${S3_REGION}" --quiet
-
-            # Extract base layer
-            echo "Extracting base layer..."
-            tar -xf /tmp/cache-base.tar.zst -C "${CACHE_WORKSPACE}/base"
-            rm /tmp/cache-base.tar.zst
-
-            # Query for latest timestamped delta (only if use-deltas enabled)
-            if [ "${USE_DELTAS}" = "true" ]; then
-              echo "Querying for latest delta..."
-              LATEST_DELTA=$(aws s3api list-objects-v2 \
-                --bucket "${S3_BUCKET}" \
-                --prefix "${try_key}-delta-" \
-                --region "${S3_REGION}" \
-                --query 'sort_by(Contents, &LastModified)[-1].Key' \
-                --output text 2>/dev/null || echo "")
-
-              if [ -n "${LATEST_DELTA}" ] && [ "${LATEST_DELTA}" != "None" ]; then
-                echo "✓ Found latest delta: ${LATEST_DELTA}"
-                echo "Downloading delta layer..."
-                aws s3 cp "s3://${S3_BUCKET}/${LATEST_DELTA}" /tmp/cache-delta.tar.zst --region "${S3_REGION}" --quiet
-
-                echo "Extracting delta layer..."
-                tar -xf /tmp/cache-delta.tar.zst -C "${CACHE_WORKSPACE}/upper" 2>/dev/null || true
-                rm /tmp/cache-delta.tar.zst
-              else
-                echo "ℹ No delta layer found (this is fine for first build)"
-              fi
-            else
-              echo "ℹ Delta caching disabled (use-deltas: false)"
-            fi
 
+          if aws s3 ls "${s3_key}" --region "${S3_REGION}" >/dev/null 2>&1; then
+            echo "✓ Found cache: ${s3_key}"
             return 0
           else
-            echo "✗ No base layer found for key: ${try_key}"
+            echo "✗ Not found: ${key}"
             return 1
           fi
         }
 
-        # Try primary key first
+        # Try exact match first
         MATCHED_KEY=""
         EXACT_MATCH="false"
 
@@ -162,12 +113,8 @@ runs:
             echo ""
             echo "Primary key not found, trying restore-keys..."
 
-            # Split restore-keys by newline
             while IFS= read -r restore_key; do
-              # Skip empty lines
               [ -z "${restore_key}" ] && continue
-
-              # Trim whitespace
               restore_key=$(echo "${restore_key}" | xargs)
 
               if try_restore_key "${restore_key}"; then
@@ -185,7 +132,6 @@ runs:
         if [ -z "${MATCHED_KEY}" ]; then
           echo ""
           echo "❌ No cache found for key: ${CACHE_KEY}"
-          echo "This is BOOTSTRAP mode - first build for this cache key"
 
           if [ "${FAIL_ON_MISS}" = "true" ]; then
             echo "fail-on-cache-miss is enabled, failing workflow"
@@ -195,16 +141,11 @@ runs:
           # Set outputs for cache miss
           echo "cache-hit=false" >> $GITHUB_OUTPUT
           echo "cache-primary-key=" >> $GITHUB_OUTPUT
+          echo "cache-matched-key=" >> $GITHUB_OUTPUT
 
-          # Create empty cache directory for bootstrap
+          # Create empty cache directory
           mkdir -p "${TARGET_PATH}"
 
-          # Record bootstrap mode for save action
-          # Format: path:workspace:matched_key:primary_key:exact_match:use_deltas
-          # For bootstrap: workspace="bootstrap", matched_key=primary_key, exact_match=false
-          MOUNT_REGISTRY="/tmp/xahau-cache-mounts.txt"
-          echo "${TARGET_PATH}:bootstrap:${CACHE_KEY}:${CACHE_KEY}:false:${USE_DELTAS}" >> "${MOUNT_REGISTRY}"
-
           echo ""
           echo "=========================================="
           echo "Cache restore completed (bootstrap mode)"
@@ -216,36 +157,30 @@ runs:
         # If lookup-only, we're done
         if [ "${LOOKUP_ONLY}" = "true" ]; then
           echo "cache-hit=${EXACT_MATCH}" >> $GITHUB_OUTPUT
-          echo "cache-primary-key=${MATCHED_KEY}" >> $GITHUB_OUTPUT
+          echo "cache-primary-key=${CACHE_KEY}" >> $GITHUB_OUTPUT
-
+          echo "cache-matched-key=${MATCHED_KEY}" >> $GITHUB_OUTPUT
-          # Clean up workspace
-          rm -rf "${CACHE_WORKSPACE}"
 
           echo ""
           echo "=========================================="
           echo "Cache lookup completed (lookup-only mode)"
+          echo "Cache exists: ${MATCHED_KEY}"
           echo "=========================================="
           exit 0
         fi
 
-        # Mount OverlayFS
+        # Download and extract cache
+        S3_KEY="s3://${S3_BUCKET}/${MATCHED_KEY}-base.tar.zst"
+        TEMP_TARBALL="/tmp/xahau-cache-restore-$$.tar.zst"
+
         echo ""
-        echo "Mounting OverlayFS..."
+        echo "Downloading cache..."
-        sudo mount -t overlay overlay \
+        aws s3 cp "${S3_KEY}" "${TEMP_TARBALL}" --region "${S3_REGION}"
-          -o lowerdir="${CACHE_WORKSPACE}/base",upperdir="${CACHE_WORKSPACE}/upper",workdir="${CACHE_WORKSPACE}/work" \
-          "${CACHE_WORKSPACE}/merged"
 
-        # Verify mount
+        TARBALL_SIZE=$(du -h "${TEMP_TARBALL}" | cut -f1)
-        if mount | grep -q "${CACHE_WORKSPACE}/merged"; then
+        echo "✓ Downloaded: ${TARBALL_SIZE}"
-          echo "✓ OverlayFS mounted successfully"
-        else
-          echo "❌ Failed to mount OverlayFS"
-          exit 1
-        fi
 
-        # Create target directory parent if needed
+        # Create parent directory if needed
-        TARGET_PARENT=$(dirname "${TARGET_PATH}")
+        mkdir -p "$(dirname "${TARGET_PATH}")"
-        mkdir -p "${TARGET_PARENT}"
 
         # Remove existing target if it exists
         if [ -e "${TARGET_PATH}" ]; then
@@ -253,30 +188,24 @@ runs:
           rm -rf "${TARGET_PATH}"
         fi
 
-        # Symlink target path to merged view
+        # Create target directory and extract
-        echo "Creating symlink: ${TARGET_PATH} -> ${CACHE_WORKSPACE}/merged"
+        mkdir -p "${TARGET_PATH}"
-        ln -s "${CACHE_WORKSPACE}/merged" "${TARGET_PATH}"
+        echo ""
+        echo "Extracting cache..."
+        zstd -d -c "${TEMP_TARBALL}" | tar -xf - -C "${TARGET_PATH}"
+        echo "✓ Cache extracted to: ${TARGET_PATH}"
 
-        # Save mount info for cleanup/save later
+        # Cleanup
-        # Format: path:workspace:matched_key:primary_key:exact_match:use_deltas
+        rm -f "${TEMP_TARBALL}"
-        # This tells save action whether to create new base (partial match) or just delta (exact match)
-        MOUNT_REGISTRY="/tmp/xahau-cache-mounts.txt"
-        echo "${TARGET_PATH}:${CACHE_WORKSPACE}:${MATCHED_KEY}:${CACHE_KEY}:${EXACT_MATCH}:${USE_DELTAS}" >> "${MOUNT_REGISTRY}"
 
         # Set outputs
         echo "cache-hit=${EXACT_MATCH}" >> $GITHUB_OUTPUT
-        echo "cache-primary-key=${MATCHED_KEY}" >> $GITHUB_OUTPUT
+        echo "cache-primary-key=${CACHE_KEY}" >> $GITHUB_OUTPUT
-
+        echo "cache-matched-key=${MATCHED_KEY}" >> $GITHUB_OUTPUT
-        # Show statistics
-        echo ""
-        echo "Cache statistics:"
-        echo "  Base layer size:  $(du -sh ${CACHE_WORKSPACE}/base 2>/dev/null | cut -f1 || echo '0')"
-        echo "  Delta layer size: $(du -sh ${CACHE_WORKSPACE}/upper 2>/dev/null | cut -f1 || echo '0')"
-        echo "  Merged view size: $(du -sh ${CACHE_WORKSPACE}/merged 2>/dev/null | cut -f1 || echo '0')"
 
         echo ""
         echo "=========================================="
         echo "Cache restore completed successfully"
-        echo "Exact match: ${EXACT_MATCH}"
+        echo "Cache hit: ${EXACT_MATCH}"
         echo "Matched key: ${MATCHED_KEY}"
         echo "=========================================="

.github/actions/xahau-actions-cache-save/action.yml

@@ -1,5 +1,5 @@
-name: 'Xahau Cache Save (S3 + OverlayFS)'
+name: 'Xahau Cache Save (S3)'
-description: 'Drop-in replacement for actions/cache/save using S3 and OverlayFS for delta caching'
+description: 'Drop-in replacement for actions/cache/save using S3 storage'
 
 inputs:
   path:
@@ -16,10 +16,6 @@ inputs:
     description: 'S3 region'
     required: false
     default: 'us-east-1'
-  use-deltas:
-    description: 'Enable delta caching (download/upload incremental changes). Set to false for base-only caching.'
-    required: false
-    default: 'true'
   # Note: Composite actions can't access secrets.* directly - must be passed from workflow
   aws-access-key-id:
     description: 'AWS Access Key ID for S3 access'
@@ -31,7 +27,7 @@ inputs:
 runs:
   using: 'composite'
   steps:
-    - name: Save cache to S3 with OverlayFS delta
+    - name: Save cache to S3
       shell: bash
       env:
         AWS_ACCESS_KEY_ID: ${{ inputs.aws-access-key-id }}
@@ -40,303 +36,75 @@ runs:
         S3_REGION: ${{ inputs.s3-region }}
         CACHE_KEY: ${{ inputs.key }}
         TARGET_PATH: ${{ inputs.path }}
-        USE_DELTAS: ${{ inputs.use-deltas }}
       run: |
         set -euo pipefail
 
         echo "=========================================="
-        echo "Xahau Cache Save (S3 + OverlayFS)"
+        echo "Xahau Cache Save (S3)"
         echo "=========================================="
         echo "Target path: ${TARGET_PATH}"
         echo "Cache key: ${CACHE_KEY}"
         echo "S3 bucket: s3://${S3_BUCKET}"
         echo ""
 
-        # Find the cache workspace from mount registry
+        # Normalize target path (expand tilde and resolve to absolute path)
-        MOUNT_REGISTRY="/tmp/xahau-cache-mounts.txt"
+        if [[ "${TARGET_PATH}" == ~* ]]; then
-
+          TARGET_PATH="${HOME}${TARGET_PATH:1}"
-        if [ ! -f "${MOUNT_REGISTRY}" ]; then
-          echo "⚠️  No cache mounts found (mount registry doesn't exist)"
-          echo "This usually means cache restore was not called, or there was no cache to restore."
-          echo "Skipping cache save."
-          exit 0
         fi
-
+        echo "Normalized target path: ${TARGET_PATH}"
-        # Find entry for this path
-        # Format: path:workspace:matched_key:primary_key:exact_match:use_deltas
-        # Bootstrap mode: path:bootstrap:key:key:false:true/false (workspace="bootstrap")
-        CACHE_WORKSPACE=""
-        MATCHED_KEY=""
-        PRIMARY_KEY=""
-        EXACT_MATCH=""
-        REGISTRY_USE_DELTAS=""
-
-        while IFS=: read -r mount_path mount_workspace mount_matched_key mount_primary_key mount_exact_match mount_use_deltas; do
-          if [ "${mount_path}" = "${TARGET_PATH}" ]; then
-            CACHE_WORKSPACE="${mount_workspace}"
-            MATCHED_KEY="${mount_matched_key}"
-            PRIMARY_KEY="${mount_primary_key}"
-            EXACT_MATCH="${mount_exact_match}"
-            REGISTRY_USE_DELTAS="${mount_use_deltas}"
-            break
-          fi
-        done < "${MOUNT_REGISTRY}"
-
-        if [ -z "${CACHE_WORKSPACE}" ] && [ -z "${MATCHED_KEY}" ]; then
-          echo "⚠️  No cache entry found for path: ${TARGET_PATH}"
-          echo "This usually means cache restore was not called for this path."
-          echo "Skipping cache save."
-          exit 0
-        fi
-
-        # Determine cache mode
-        if [ "${CACHE_WORKSPACE}" = "bootstrap" ]; then
-          CACHE_MODE="bootstrap"
-          PRIMARY_KEY="${MATCHED_KEY}"  # In bootstrap, matched_key field contains primary key
-          echo "Cache mode: BOOTSTRAP (first build for this key)"
-          echo "Primary key: ${PRIMARY_KEY}"
-        elif [ "${EXACT_MATCH}" = "false" ]; then
-          CACHE_MODE="partial-match"
-          echo "Cache mode: PARTIAL MATCH (restore-key used)"
-          echo "Cache workspace: ${CACHE_WORKSPACE}"
-          echo "Matched key from restore: ${MATCHED_KEY}"
-          echo "Primary key (will save new base): ${PRIMARY_KEY}"
-        else
-          CACHE_MODE="exact-match"
-          echo "Cache mode: EXACT MATCH (cache hit)"
-          echo "Cache workspace: ${CACHE_WORKSPACE}"
-          echo "Matched key: ${MATCHED_KEY}"
-        fi
-        echo "Use deltas: ${REGISTRY_USE_DELTAS}"
         echo ""
 
-        # Handle different cache modes
+        # Check if target directory exists
-        if [ "${CACHE_MODE}" = "bootstrap" ]; then
+        if [ ! -d "${TARGET_PATH}" ]; then
-          # Bootstrap: Save entire cache as base layer (no OverlayFS was used)
+          echo "⚠️  Target directory does not exist: ${TARGET_PATH}"
-          echo "Bootstrap mode: Creating initial base layer from ${TARGET_PATH}"
+          echo "Skipping cache save."
-
-          BASE_TARBALL="/tmp/xahau-cache-base-$$.tar.zst"
-          echo "Creating base tarball..."
-          tar -cf - -C "${TARGET_PATH}" . | zstd -3 -T0 -q -o "${BASE_TARBALL}"
-
-          BASE_SIZE=$(du -h "${BASE_TARBALL}" | cut -f1)
-          echo "✓ Base tarball created: ${BASE_SIZE}"
-          echo ""
-
-          # Use static base name (one base per key, immutable)
-          S3_BASE_KEY="s3://${S3_BUCKET}/${PRIMARY_KEY}-base.tar.zst"
-
-          # Check if base already exists (immutability - first write wins)
-          if aws s3 ls "${S3_BASE_KEY}" --region "${S3_REGION}" >/dev/null 2>&1; then
-            echo "⚠️  Base layer already exists: ${S3_BASE_KEY}"
-            echo "Skipping upload (immutability - first write wins, like GitHub Actions)"
-          else
-            echo "Uploading base layer to S3..."
-            echo "  Key: ${PRIMARY_KEY}-base.tar.zst"
-
-            aws s3 cp "${BASE_TARBALL}" "${S3_BASE_KEY}" \
-              --region "${S3_REGION}" \
-              --tagging "type=base" \
-              --quiet
-
-            echo "✓ Uploaded: ${S3_BASE_KEY}"
-          fi
-
-          # Cleanup
-          rm -f "${BASE_TARBALL}"
-
-          echo ""
-          echo "=========================================="
-          echo "Bootstrap cache save completed"
-          echo "Base size: ${BASE_SIZE}"
-          echo "Cache key: ${PRIMARY_KEY}"
-          echo "=========================================="
           exit 0
+        fi
 
-        elif [ "${CACHE_MODE}" = "partial-match" ]; then
+        # Use static base name (one base per key, immutable)
-          # Partial match: Save merged view as new base ONLY (no delta)
+        S3_BASE_KEY="s3://${S3_BUCKET}/${CACHE_KEY}-base.tar.zst"
-          # The delta is relative to the OLD base, not the NEW base we're creating
-          echo "Partial match mode: Saving new base layer for primary key"
-          echo "Note: Delta will NOT be saved (it's relative to old base)"
-
-          BASE_TARBALL="/tmp/xahau-cache-base-$$.tar.zst"
-          echo "Creating base tarball from merged view..."
-          tar -cf - -C "${CACHE_WORKSPACE}/merged" . | zstd -3 -T0 -q -o "${BASE_TARBALL}"
-
-          BASE_SIZE=$(du -h "${BASE_TARBALL}" | cut -f1)
-          echo "✓ Base tarball created: ${BASE_SIZE}"
-          echo ""
-
-          # Use static base name (one base per key, immutable)
-          S3_BASE_KEY="s3://${S3_BUCKET}/${PRIMARY_KEY}-base.tar.zst"
-
-          # Check if base already exists (immutability - first write wins)
-          if aws s3 ls "${S3_BASE_KEY}" --region "${S3_REGION}" >/dev/null 2>&1; then
-            echo "⚠️  Base layer already exists: ${S3_BASE_KEY}"
-            echo "Skipping upload (immutability - first write wins, like GitHub Actions)"
-          else
-            echo "Uploading new base layer to S3..."
-            echo "  Key: ${PRIMARY_KEY}-base.tar.zst"
-
-            aws s3 cp "${BASE_TARBALL}" "${S3_BASE_KEY}" \
-              --region "${S3_REGION}" \
-              --tagging "type=base" \
-              --quiet
-
-            echo "✓ Uploaded: ${S3_BASE_KEY}"
-          fi
-
-          # Cleanup
-          rm -f "${BASE_TARBALL}"
-
-          # Unmount and cleanup
-          echo ""
-          echo "Cleaning up..."
-          if mount | grep -q "${CACHE_WORKSPACE}/merged"; then
-            sudo umount "${CACHE_WORKSPACE}/merged" || {
-              echo "⚠️  Warning: Failed to unmount ${CACHE_WORKSPACE}/merged"
-              echo "Attempting lazy unmount..."
-              sudo umount -l "${CACHE_WORKSPACE}/merged" || true
-            }
-          fi
-          rm -rf "${CACHE_WORKSPACE}"
-
-          # Remove from registry
-          if [ -f "${MOUNT_REGISTRY}" ]; then
-            grep -v "^${TARGET_PATH}:" "${MOUNT_REGISTRY}" > "${MOUNT_REGISTRY}.tmp" 2>/dev/null || true
-            mv "${MOUNT_REGISTRY}.tmp" "${MOUNT_REGISTRY}" 2>/dev/null || true
-          fi
-
-          echo "✓ Cleanup completed"
 
+        # Check if base already exists (immutability - first write wins)
+        if aws s3 ls "${S3_BASE_KEY}" --region "${S3_REGION}" >/dev/null 2>&1; then
+          echo "⚠️  Cache already exists: ${S3_BASE_KEY}"
+          echo "Skipping upload (immutability - first write wins, like GitHub Actions)"
           echo ""
           echo "=========================================="
-          echo "Partial match cache save completed"
+          echo "Cache save completed (already exists)"
-          echo "New base created for: ${PRIMARY_KEY}"
-          echo "Base size: ${BASE_SIZE}"
-          if [ "${REGISTRY_USE_DELTAS}" = "true" ]; then
-            echo "Next exact-match build will create deltas from this base"
-          else
-            echo "Next exact-match build will reuse this base (base-only mode)"
-          fi
           echo "=========================================="
           exit 0
         fi
 
-        # For exact-match ONLY: Save delta (if use-deltas enabled)
+        # Create tarball
-        if [ "${CACHE_MODE}" = "exact-match" ]; then
+        BASE_TARBALL="/tmp/xahau-cache-base-$$.tar.zst"
-          # If deltas are disabled, just cleanup and exit
-          if [ "${REGISTRY_USE_DELTAS}" != "true" ]; then
-            echo "ℹ️  Delta caching disabled (use-deltas: false)"
-            echo "Base already exists for this key, nothing to save."
 
-            # Unmount and cleanup
+        echo "Creating cache tarball..."
-            echo ""
+        tar -cf - -C "${TARGET_PATH}" . | zstd -3 -T0 -q -o "${BASE_TARBALL}"
-            echo "Cleaning up..."
-            if mount | grep -q "${CACHE_WORKSPACE}/merged"; then
-              sudo umount "${CACHE_WORKSPACE}/merged" 2>/dev/null || true
-            fi
-            rm -rf "${CACHE_WORKSPACE}"
 
-            # Remove from registry
+        BASE_SIZE=$(du -h "${BASE_TARBALL}" | cut -f1)
-            if [ -f "${MOUNT_REGISTRY}" ]; then
+        echo "✓ Cache tarball created: ${BASE_SIZE}"
-              grep -v "^${TARGET_PATH}:" "${MOUNT_REGISTRY}" > "${MOUNT_REGISTRY}.tmp" 2>/dev/null || true
+        echo ""
-              mv "${MOUNT_REGISTRY}.tmp" "${MOUNT_REGISTRY}" 2>/dev/null || true
-            fi
 
-            echo ""
+        # Upload to S3
-            echo "=========================================="
+        echo "Uploading cache to S3..."
-            echo "Cache save completed (base-only mode)"
+        echo "  Key: ${CACHE_KEY}-base.tar.zst"
-            echo "=========================================="
-            exit 0
-          fi
 
-          # Check if upper layer has any changes
+        aws s3api put-object \
-          if [ -z "$(ls -A ${CACHE_WORKSPACE}/upper 2>/dev/null)" ]; then
+          --bucket "${S3_BUCKET}" \
-            echo "ℹ️  No changes detected in upper layer (cache is unchanged)"
+          --key "${CACHE_KEY}-base.tar.zst" \
-            echo "Skipping delta upload to save bandwidth."
+          --body "${BASE_TARBALL}" \
+          --tagging 'type=base' \
+          --region "${S3_REGION}" \
+          >/dev/null
 
-            # Still unmount and cleanup
+        echo "✓ Uploaded: ${S3_BASE_KEY}"
-            echo ""
-            echo "Cleaning up..."
-            sudo umount "${CACHE_WORKSPACE}/merged" 2>/dev/null || true
-            rm -rf "${CACHE_WORKSPACE}"
 
-            echo ""
+        # Cleanup
-            echo "=========================================="
+        rm -f "${BASE_TARBALL}"
-            echo "Cache save completed (no changes)"
-            echo "=========================================="
-            exit 0
-          fi
-
-          # Show delta statistics
-          echo "Delta layer statistics:"
-          echo "  Files changed: $(find ${CACHE_WORKSPACE}/upper -type f 2>/dev/null | wc -l)"
-          echo "  Delta size:    $(du -sh ${CACHE_WORKSPACE}/upper 2>/dev/null | cut -f1)"
-          echo ""
-
-          # Create delta tarball from upper layer
-          echo "Creating delta tarball..."
-          DELTA_TARBALL="/tmp/xahau-cache-delta-$$.tar.zst"
-
-          tar -cf - -C "${CACHE_WORKSPACE}/upper" . | zstd -3 -T0 -q -o "${DELTA_TARBALL}"
-
-          DELTA_SIZE=$(du -h "${DELTA_TARBALL}" | cut -f1)
-          echo "✓ Delta tarball created: ${DELTA_SIZE}"
-          echo ""
-
-          # Upload timestamped delta (no overwrites = zero concurrency issues)
-          TIMESTAMP=$(date +%Y%m%d%H%M%S)
-          COMMIT_SHA=$(git rev-parse --short HEAD 2>/dev/null || echo "unknown")
-
-          # Use PRIMARY_KEY for delta (ensures deltas match their base)
-          S3_DELTA_TIMESTAMPED="s3://${S3_BUCKET}/${PRIMARY_KEY}-delta-${TIMESTAMP}-${COMMIT_SHA}.tar.zst"
-
-          echo "Uploading timestamped delta to S3..."
-          echo "  Key: ${PRIMARY_KEY}-delta-${TIMESTAMP}-${COMMIT_SHA}.tar.zst"
-
-          # Upload with tag for auto-deletion after 7 days
-          aws s3 cp "${DELTA_TARBALL}" "${S3_DELTA_TIMESTAMPED}" \
-            --region "${S3_REGION}" \
-            --tagging "type=delta-archive" \
-            --quiet
-
-          echo "✓ Uploaded: ${S3_DELTA_TIMESTAMPED}"
-          echo "  (tagged for auto-deletion after 7 days)"
-
-          # Cleanup delta tarball
-          rm -f "${DELTA_TARBALL}"
-
-          # Cleanup: Unmount OverlayFS and remove workspace
-          echo ""
-          echo "Cleaning up..."
-
-          if mount | grep -q "${CACHE_WORKSPACE}/merged"; then
-            sudo umount "${CACHE_WORKSPACE}/merged" || {
-              echo "⚠️  Warning: Failed to unmount ${CACHE_WORKSPACE}/merged"
-              echo "Attempting lazy unmount..."
-              sudo umount -l "${CACHE_WORKSPACE}/merged" || true
-            }
-          fi
-
-          # Remove workspace
-          rm -rf "${CACHE_WORKSPACE}"
-        fi
-
-        # Remove from registry
-        if [ -f "${MOUNT_REGISTRY}" ]; then
-          grep -v "^${TARGET_PATH}:" "${MOUNT_REGISTRY}" > "${MOUNT_REGISTRY}.tmp" 2>/dev/null || true
-          mv "${MOUNT_REGISTRY}.tmp" "${MOUNT_REGISTRY}" 2>/dev/null || true
-        fi
-
-        echo "✓ Cleanup completed"
 
         echo ""
         echo "=========================================="
         echo "Cache save completed successfully"
-        echo "Mode: ${CACHE_MODE}"
+        echo "Cache size: ${BASE_SIZE}"
-        echo "Cache key: ${PRIMARY_KEY}"
+        echo "Cache key: ${CACHE_KEY}"
-        if [ -n "${DELTA_SIZE:-}" ]; then
-          echo "Delta size: ${DELTA_SIZE}"
-        fi
         echo "=========================================="

.github/actions/xahau-configure-ccache/action.yml

@@ -1,63 +0,0 @@
-name: 'Configure ccache'
-description: 'Sets up ccache with consistent configuration'
-
-inputs:
-  max_size:
-    description: 'Maximum cache size'
-    required: false
-    default: '2G'
-  hash_dir:
-    description: 'Whether to include directory paths in hash'
-    required: false
-    default: 'true'
-  compiler_check:
-    description: 'How to check compiler for changes'
-    required: false
-    default: 'content'
-  is_main_branch:
-    description: 'Whether the current branch is the main branch'
-    required: false
-    default: 'false'
-  main_cache_dir:
-    description: 'Path to the main branch cache directory'
-    required: false
-    default: '~/.ccache-main'
-  current_cache_dir:
-    description: 'Path to the current branch cache directory'
-    required: false
-    default: '~/.ccache-current'
-
-runs:
-  using: 'composite'
-  steps:
-    - name: Configure ccache
-      shell: bash
-      run: |
-        # Create cache directories
-        mkdir -p ${{ inputs.main_cache_dir }} ${{ inputs.current_cache_dir }}
-        
-        # Set compiler check globally
-        ccache -o compiler_check=${{ inputs.compiler_check }}
-        
-        # Use a single config file location
-        mkdir -p ~/.ccache
-        export CONF_PATH="$HOME/.ccache/ccache.conf"
-        
-        # Apply common settings
-        echo "max_size = ${{ inputs.max_size }}" > "$CONF_PATH"
-        echo "hash_dir = ${{ inputs.hash_dir }}" >> "$CONF_PATH"
-        echo "compiler_check = ${{ inputs.compiler_check }}" >> "$CONF_PATH"
-        
-        if [ "${{ inputs.is_main_branch }}" == "true" ]; then
-          # Main branch: use main branch cache
-          ccache --set-config=cache_dir="${{ inputs.main_cache_dir }}"
-          echo "CCACHE_DIR=${{ inputs.main_cache_dir }}" >> $GITHUB_ENV
-        else
-          # Feature branch: use current branch cache with main as secondary
-          ccache --set-config=cache_dir="${{ inputs.current_cache_dir }}"
-          ccache --set-config=secondary_storage="file:${{ inputs.main_cache_dir }}"
-          echo "CCACHE_DIR=${{ inputs.current_cache_dir }}" >> $GITHUB_ENV
-        fi
-        
-        ccache -p # Print config for verification
-        ccache -z # Zero statistics before the build

.github/actions/xahau-ga-build/action.yml

@@ -47,6 +47,24 @@ inputs:
     description: 'GCC version to use for Clang toolchain (e.g. 11, 13)'
     required: false
     default: ''
+  ccache_max_size:
+    description: 'Maximum ccache size'
+    required: false
+    default: '2G'
+  ccache_hash_dir:
+    description: 'Whether to include directory paths in hash'
+    required: false
+    default: 'true'
+  ccache_compiler_check:
+    description: 'How to check compiler for changes'
+    required: false
+    default: 'content'
+  aws-access-key-id:
+    description: 'AWS Access Key ID for S3 cache storage'
+    required: true
+  aws-secret-access-key:
+    description: 'AWS Secret Access Key for S3 cache storage'
+    required: true
 
 runs:
   using: 'composite'
@@ -59,28 +77,44 @@ runs:
         SAFE_BRANCH=$(echo "${{ github.ref_name }}" | tr -c 'a-zA-Z0-9_.-' '-')
         echo "name=${SAFE_BRANCH}" >> $GITHUB_OUTPUT
 
-    - name: Restore ccache directory for default branch
+    - name: Restore ccache directory
       if: inputs.ccache_enabled == 'true'
       id: ccache-restore
-      uses: actions/cache/restore@v4
+      uses: ./.github/actions/xahau-actions-cache-restore
       with:
-        path: ~/.ccache-main
+        path: ~/.ccache
-        key: ${{ runner.os }}-ccache-v${{ inputs.cache_version }}-${{ inputs.compiler-id }}-${{ inputs.configuration }}-${{ inputs.main_branch }}
-        restore-keys: |
-          ${{ runner.os }}-ccache-v${{ inputs.cache_version }}-${{ inputs.compiler-id }}-${{ inputs.configuration }}-
-          ${{ runner.os }}-ccache-v${{ inputs.cache_version }}-${{ inputs.compiler-id }}-
-
-    - name: Restore ccache directory for current branch
-      if: inputs.ccache_enabled == 'true' && steps.safe-branch.outputs.name != inputs.main_branch
-      id: ccache-restore-current-branch
-      uses: actions/cache/restore@v4
-      with:
-        path: ~/.ccache-current
         key: ${{ runner.os }}-ccache-v${{ inputs.cache_version }}-${{ inputs.compiler-id }}-${{ inputs.configuration }}-${{ steps.safe-branch.outputs.name }}
         restore-keys: |
           ${{ runner.os }}-ccache-v${{ inputs.cache_version }}-${{ inputs.compiler-id }}-${{ inputs.configuration }}-${{ inputs.main_branch }}
           ${{ runner.os }}-ccache-v${{ inputs.cache_version }}-${{ inputs.compiler-id }}-${{ inputs.configuration }}-
           ${{ runner.os }}-ccache-v${{ inputs.cache_version }}-${{ inputs.compiler-id }}-
+        aws-access-key-id: ${{ inputs.aws-access-key-id }}
+        aws-secret-access-key: ${{ inputs.aws-secret-access-key }}
+
+    - name: Configure ccache
+      if: inputs.ccache_enabled == 'true'
+      shell: bash
+      run: |
+        # Use ccache's default cache_dir (~/.ccache) - don't override it
+        # This avoids tilde expansion issues when setting it explicitly
+
+        # Create cache directory using ccache's default
+        mkdir -p ~/.ccache
+
+        # Configure ccache settings (but NOT cache_dir - use default)
+        # This overwrites any cached config to ensure fresh configuration
+        ccache --set-config=max_size=${{ inputs.ccache_max_size }}
+        ccache --set-config=hash_dir=${{ inputs.ccache_hash_dir }}
+        ccache --set-config=compiler_check=${{ inputs.ccache_compiler_check }}
+
+        # Note: Not setting CCACHE_DIR - let ccache use its default (~/.ccache)
+
+        # Print config for verification
+        echo "=== ccache configuration ==="
+        ccache -p
+
+        # Zero statistics before the build
+        ccache -z
 
     - name: Configure project
       shell: bash
@@ -96,14 +130,27 @@ runs:
         if [ -n "${{ inputs.cxx }}" ]; then
           export CXX="${{ inputs.cxx }}"
         fi
-        
+
-        
+        # Create wrapper toolchain that overlays ccache on top of Conan's toolchain
-        # Configure ccache launcher args
+        # This enables ccache for the main app build without affecting Conan dependency builds
-        CCACHE_ARGS=""
         if [ "${{ inputs.ccache_enabled }}" = "true" ]; then
-          CCACHE_ARGS="-DCMAKE_C_COMPILER_LAUNCHER=ccache -DCMAKE_CXX_COMPILER_LAUNCHER=ccache"
+          cat > wrapper_toolchain.cmake <<'EOF'
+        # Include Conan's generated toolchain first (sets compiler, flags, etc.)
+        # Note: CMAKE_CURRENT_LIST_DIR is the directory containing this wrapper (.build/)
+        include(${CMAKE_CURRENT_LIST_DIR}/build/generators/conan_toolchain.cmake)
+
+        # Overlay ccache configuration for main application build
+        # This does NOT affect Conan dependency builds (already completed)
+        set(CMAKE_C_COMPILER_LAUNCHER ccache CACHE STRING "C compiler launcher" FORCE)
+        set(CMAKE_CXX_COMPILER_LAUNCHER ccache CACHE STRING "C++ compiler launcher" FORCE)
+        EOF
+          TOOLCHAIN_FILE="wrapper_toolchain.cmake"
+          echo "✅ Created wrapper toolchain with ccache enabled"
+        else
+          TOOLCHAIN_FILE="build/generators/conan_toolchain.cmake"
+          echo "ℹ️  Using Conan toolchain directly (ccache disabled)"
         fi
-        
+
         # Configure C++ standard library if specified
         # libstdcxx used for clang-14/16 to work around missing lexicographical_compare_three_way in libc++
         # libcxx can be used with clang-17+ which has full C++20 support
@@ -143,32 +190,36 @@ runs:
         # So we get: .build/build/generators/ with our non-standard folder name
         cmake .. \
           -G "${{ inputs.generator }}" \
-          $CCACHE_ARGS \
           ${CMAKE_CXX_FLAGS:+-DCMAKE_CXX_FLAGS="$CMAKE_CXX_FLAGS"} \
-          -DCMAKE_TOOLCHAIN_FILE:FILEPATH=build/generators/conan_toolchain.cmake \
+          -DCMAKE_TOOLCHAIN_FILE:FILEPATH=${TOOLCHAIN_FILE} \
           -DCMAKE_BUILD_TYPE=${{ inputs.configuration }}
 
+    - name: Show ccache config before build
+      if: inputs.ccache_enabled == 'true'
+      shell: bash
+      run: |
+        echo "=========================================="
+        echo "ccache configuration before build"
+        echo "=========================================="
+        ccache -p
+        echo ""
+
     - name: Build project
       shell: bash
       run: |
         cd ${{ inputs.build_dir }}
-        cmake --build . --config ${{ inputs.configuration }} --parallel $(nproc)
+        cmake --build . --config ${{ inputs.configuration }} --parallel $(nproc) -- -v
 
     - name: Show ccache statistics
       if: inputs.ccache_enabled == 'true'
       shell: bash
       run: ccache -s
 
-    - name: Save ccache directory for default branch
+    - name: Save ccache directory
-      if: always() && inputs.ccache_enabled == 'true' && steps.safe-branch.outputs.name == inputs.main_branch
+      if: always() && inputs.ccache_enabled == 'true'
-      uses: actions/cache/save@v4
+      uses: ./.github/actions/xahau-actions-cache-save
       with:
-        path: ~/.ccache-main
+        path: ~/.ccache
-        key: ${{ steps.ccache-restore.outputs.cache-primary-key }}
+        key: ${{ runner.os }}-ccache-v${{ inputs.cache_version }}-${{ inputs.compiler-id }}-${{ inputs.configuration }}-${{ steps.safe-branch.outputs.name }}
-
+        aws-access-key-id: ${{ inputs.aws-access-key-id }}
-    - name: Save ccache directory for current branch
+        aws-secret-access-key: ${{ inputs.aws-secret-access-key }}
-      if: always() && inputs.ccache_enabled == 'true' && steps.safe-branch.outputs.name != inputs.main_branch
-      uses: actions/cache/save@v4
-      with:
-        path: ~/.ccache-current
-        key: ${{ steps.ccache-restore-current-branch.outputs.cache-primary-key }}

.github/actions/xahau-ga-dependencies/action.yml

@@ -25,6 +25,28 @@ inputs:
     description: 'Main branch name for restore keys'
     required: false
     default: 'dev'
+  os:
+    description: 'Operating system (Linux, Macos)'
+    required: false
+    default: 'Linux'
+  arch:
+    description: 'Architecture (x86_64, armv8)'
+    required: false
+    default: 'x86_64'
+  compiler:
+    description: 'Compiler type (gcc, clang, apple-clang)'
+    required: true
+  compiler_version:
+    description: 'Compiler version (11, 13, 14, etc.)'
+    required: true
+  cc:
+    description: 'C compiler executable (gcc-13, clang-14, etc.), empty for macOS'
+    required: false
+    default: ''
+  cxx:
+    description: 'C++ compiler executable (g++-14, clang++-14, etc.), empty for macOS'
+    required: false
+    default: ''
   stdlib:
     description: 'C++ standard library for Conan configuration (note: also in compiler-id)'
     required: true
@@ -32,6 +54,12 @@ inputs:
     options:
       - libstdcxx
       - libcxx
+  aws-access-key-id:
+    description: 'AWS Access Key ID for S3 cache storage'
+    required: true
+  aws-secret-access-key:
+    description: 'AWS Secret Access Key for S3 cache storage'
+    required: true
 
 outputs:
   cache-hit:
@@ -41,47 +69,72 @@ outputs:
 runs:
   using: 'composite'
   steps:
-    - name: Generate safe branch name
-      if: inputs.cache_enabled == 'true'
-      id: safe-branch
-      shell: bash
-      run: |
-        SAFE_BRANCH=$(echo "${{ github.ref_name }}" | tr -c 'a-zA-Z0-9_.-' '-')
-        echo "name=${SAFE_BRANCH}" >> $GITHUB_OUTPUT
-
-    - name: Check conanfile changes
-      if: inputs.cache_enabled == 'true'
-      id: check-conanfile-changes
-      shell: bash
-      run: |
-        # Check if we're on the main branch
-        if [ "${{ github.ref_name }}" == "${{ inputs.main_branch }}" ]; then
-          echo "should-save-conan-cache=true" >> $GITHUB_OUTPUT
-        else
-          # Fetch main branch for comparison
-          git fetch origin ${{ inputs.main_branch }}
-          
-          # Check if conanfile.txt or conanfile.py has changed compared to main branch
-          if git diff --quiet origin/${{ inputs.main_branch }}..HEAD -- '**/conanfile.txt' '**/conanfile.py'; then
-            echo "should-save-conan-cache=false" >> $GITHUB_OUTPUT
-          else
-            echo "should-save-conan-cache=true" >> $GITHUB_OUTPUT
-          fi
-        fi
 
     - name: Restore Conan cache
       if: inputs.cache_enabled == 'true'
       id: cache-restore-conan
-      uses: actions/cache/restore@v4
+      uses: ./.github/actions/xahau-actions-cache-restore
       with:
-        path: |
+        path: ~/.conan2
-          ~/.conan
-          ~/.conan2
         # Note: compiler-id format is compiler-version-stdlib[-gccversion]
         key: ${{ runner.os }}-conan-v${{ inputs.cache_version }}-${{ inputs.compiler-id }}-${{ hashFiles('**/conanfile.txt', '**/conanfile.py') }}-${{ inputs.configuration }}
         restore-keys: |
           ${{ runner.os }}-conan-v${{ inputs.cache_version }}-${{ inputs.compiler-id }}-${{ hashFiles('**/conanfile.txt', '**/conanfile.py') }}-
           ${{ runner.os }}-conan-v${{ inputs.cache_version }}-${{ inputs.compiler-id }}-
+        aws-access-key-id: ${{ inputs.aws-access-key-id }}
+        aws-secret-access-key: ${{ inputs.aws-secret-access-key }}
+
+    - name: Configure Conan
+      shell: bash
+      run: |
+        # Create the default profile directory if it doesn't exist
+        mkdir -p ~/.conan2/profiles
+
+        # Determine the correct libcxx based on stdlib parameter
+        if [ "${{ inputs.stdlib }}" = "libcxx" ]; then
+          LIBCXX="libc++"
+        else
+          LIBCXX="libstdc++11"
+        fi
+
+        # Create profile with our specific settings
+        # This overwrites any cached profile to ensure fresh configuration
+        cat > ~/.conan2/profiles/default <<EOF
+        [settings]
+        arch=${{ inputs.arch }}
+        build_type=${{ inputs.configuration }}
+        compiler=${{ inputs.compiler }}
+        compiler.cppstd=20
+        compiler.libcxx=${LIBCXX}
+        compiler.version=${{ inputs.compiler_version }}
+        os=${{ inputs.os }}
+        EOF
+
+        # Add buildenv and conf sections for Linux (not needed for macOS)
+        if [ "${{ inputs.os }}" = "Linux" ] && [ -n "${{ inputs.cc }}" ]; then
+          cat >> ~/.conan2/profiles/default <<EOF
+
+        [buildenv]
+        CC=/usr/bin/${{ inputs.cc }}
+        CXX=/usr/bin/${{ inputs.cxx }}
+
+        [conf]
+        tools.build:compiler_executables={"c": "/usr/bin/${{ inputs.cc }}", "cpp": "/usr/bin/${{ inputs.cxx }}"}
+        EOF
+        fi
+
+        # Add macOS-specific conf if needed
+        if [ "${{ inputs.os }}" = "Macos" ]; then
+          cat >> ~/.conan2/profiles/default <<EOF
+
+        [conf]
+        # Workaround for gRPC with newer Apple Clang
+        tools.build:cxxflags=["-Wno-missing-template-arg-list-after-template-kw"]
+        EOF
+        fi
+
+        # Display profile for verification
+        conan profile show
 
     - name: Export custom recipes
       shell: bash
@@ -107,10 +160,10 @@ runs:
           ..
 
     - name: Save Conan cache
-      if: always() && inputs.cache_enabled == 'true' && steps.cache-restore-conan.outputs.cache-hit != 'true' && steps.check-conanfile-changes.outputs.should-save-conan-cache == 'true'
+      if: always() && inputs.cache_enabled == 'true' && steps.cache-restore-conan.outputs.cache-hit != 'true'
-      uses: actions/cache/save@v4
+      uses: ./.github/actions/xahau-actions-cache-save
       with:
-        path: |
+        path: ~/.conan2
-          ~/.conan
+        key: ${{ runner.os }}-conan-v${{ inputs.cache_version }}-${{ inputs.compiler-id }}-${{ hashFiles('**/conanfile.txt', '**/conanfile.py') }}-${{ inputs.configuration }}
-          ~/.conan2
+        aws-access-key-id: ${{ inputs.aws-access-key-id }}
-        key: ${{ steps.cache-restore-conan.outputs.cache-primary-key }}
+        aws-secret-access-key: ${{ inputs.aws-secret-access-key }}

.github/workflows/test-cache-actions.yml.disabled

@@ -0,0 +1,290 @@
+name: Test Cache Actions (State Machine)
+
+on:
+  push:
+    branches: ["nd-experiment-overlayfs-*"]
+  workflow_dispatch:
+    inputs:
+      state_assertion:
+        description: 'Expected state (optional, e.g. "2" to assert state 2)'
+        required: false
+        type: string
+        default: '1'
+      start_state:
+        description: 'Force specific starting state (optional, e.g. "3" to start at state 3)'
+        required: false
+        type: string
+      clear_cache:
+        description: 'Clear cache before running'
+        required: false
+        type: boolean
+        default: false
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  test-cache-state-machine:
+    runs-on: ubuntu-latest
+    env:
+      CACHE_KEY: test-state-machine-${{ github.ref_name }}
+      CACHE_DIR: /tmp/test-cache
+      S3_BUCKET: xahaud-github-actions-cache-niq
+      S3_REGION: us-east-1
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Parse Inputs (workflow_dispatch or commit message)
+        id: parse-inputs
+        run: |
+          # Priority 1: workflow_dispatch inputs (manual trigger)
+          STATE_ASSERTION="${{ inputs.state_assertion }}"
+          START_STATE="${{ inputs.start_state }}"
+          SHOULD_CLEAR="${{ inputs.clear_cache }}"
+
+          # Priority 2: commit message tags (push event)
+          if [ "${{ github.event_name }}" = "push" ]; then
+            COMMIT_MSG="${{ github.event.head_commit.message }}"
+
+            # Parse [state:N] assertion tag (optional, if not provided as input)
+            if [ -z "${STATE_ASSERTION}" ] && echo "${COMMIT_MSG}" | grep -qE '\[state:[0-9]+\]'; then
+              STATE_ASSERTION=$(echo "${COMMIT_MSG}" | grep -oE '\[state:[0-9]+\]' | grep -oE '[0-9]+')
+              echo "State assertion found in commit: ${STATE_ASSERTION}"
+            fi
+
+            # Parse [start-state:N] force tag (optional, if not provided as input)
+            if [ -z "${START_STATE}" ] && echo "${COMMIT_MSG}" | grep -qE '\[start-state:[0-9]+\]'; then
+              START_STATE=$(echo "${COMMIT_MSG}" | grep -oE '\[start-state:[0-9]+\]' | grep -oE '[0-9]+')
+              echo "Start state found in commit: ${START_STATE}"
+            fi
+
+            # Parse [ci-clear-cache] tag (if not provided as input)
+            if [ "${SHOULD_CLEAR}" != "true" ] && echo "${COMMIT_MSG}" | grep -q '\[ci-clear-cache\]'; then
+              SHOULD_CLEAR=true
+              echo "Cache clear requested in commit"
+            fi
+          fi
+
+          # Output final values
+          echo "state_assertion=${STATE_ASSERTION}" >> "$GITHUB_OUTPUT"
+          echo "start_state=${START_STATE}" >> "$GITHUB_OUTPUT"
+          echo "should_clear=${SHOULD_CLEAR}" >> "$GITHUB_OUTPUT"
+
+          # Log what we're using
+          echo ""
+          echo "Configuration:"
+          [ -n "${STATE_ASSERTION}" ] && echo "  State assertion: ${STATE_ASSERTION}"
+          [ -n "${START_STATE}" ] && echo "  Start state: ${START_STATE}"
+          echo "  Clear cache: ${SHOULD_CLEAR}"
+
+      - name: Check S3 State (Before Restore)
+        env:
+          AWS_ACCESS_KEY_ID: ${{ secrets.XAHAUD_GITHUB_ACTIONS_CACHE_NIQ_AWS_KEY_ID }}
+          AWS_SECRET_ACCESS_KEY: ${{ secrets.XAHAUD_GITHUB_ACTIONS_CACHE_NIQ_AWS_ACCESS_KEY }}
+        run: |
+          echo "=========================================="
+          echo "S3 State Check (Before Restore)"
+          echo "=========================================="
+          echo "Cache key: ${CACHE_KEY}"
+          echo ""
+
+          # Check if base exists
+          BASE_EXISTS=false
+          if aws s3 ls "s3://${S3_BUCKET}/${CACHE_KEY}-base.tar.zst" --region "${S3_REGION}" >/dev/null 2>&1; then
+            BASE_EXISTS=true
+          fi
+          echo "Base exists: ${BASE_EXISTS}"
+
+          # Count deltas
+          DELTA_COUNT=$(aws s3 ls "s3://${S3_BUCKET}/" --region "${S3_REGION}" | grep "${CACHE_KEY}-delta-" | wc -l || echo "0")
+          echo "Delta count: ${DELTA_COUNT}"
+
+      - name: Restore Cache
+        uses: ./.github/actions/xahau-actions-cache-restore
+        with:
+          path: ${{ env.CACHE_DIR }}
+          key: ${{ env.CACHE_KEY }}
+          s3-bucket: ${{ env.S3_BUCKET }}
+          s3-region: ${{ env.S3_REGION }}
+          use-deltas: 'true'
+          aws-access-key-id: ${{ secrets.XAHAUD_GITHUB_ACTIONS_CACHE_NIQ_AWS_KEY_ID }}
+          aws-secret-access-key: ${{ secrets.XAHAUD_GITHUB_ACTIONS_CACHE_NIQ_AWS_ACCESS_KEY }}
+
+      - name: Auto-Detect State and Validate
+        id: state
+        env:
+          STATE_ASSERTION: ${{ steps.parse-inputs.outputs.state_assertion }}
+          START_STATE: ${{ steps.parse-inputs.outputs.start_state }}
+        run: |
+          echo "=========================================="
+          echo "State Detection and Validation"
+          echo "=========================================="
+
+          # Create cache directory if it doesn't exist
+          mkdir -p "${CACHE_DIR}"
+
+          # Handle [start-state:N] - force specific state
+          if [ -n "${START_STATE}" ]; then
+            echo "🎯 [start-state:${START_STATE}] detected - forcing state setup"
+
+            # Clear cache and create state files 0 through START_STATE
+            rm -f ${CACHE_DIR}/state*.txt 2>/dev/null || true
+            for i in $(seq 0 ${START_STATE}); do
+              echo "State ${i} - Forced at $(date)" > "${CACHE_DIR}/state${i}.txt"
+              echo "Commit: ${{ github.sha }}" >> "${CACHE_DIR}/state${i}.txt"
+            done
+
+            DETECTED_STATE=${START_STATE}
+            echo "✓ Forced to state ${DETECTED_STATE}"
+          else
+            # Auto-detect state by counting state files
+            STATE_FILES=$(ls ${CACHE_DIR}/state*.txt 2>/dev/null | wc -l)
+            DETECTED_STATE=${STATE_FILES}
+            echo "Auto-detected state: ${DETECTED_STATE} (${STATE_FILES} state files)"
+          fi
+
+          # Show cache contents
+          echo ""
+          echo "Cache contents:"
+          if [ -d "${CACHE_DIR}" ] && [ "$(ls -A ${CACHE_DIR})" ]; then
+            ls -la "${CACHE_DIR}"
+          else
+            echo "(empty)"
+          fi
+
+          # Validate [state:N] assertion if provided
+          if [ -n "${STATE_ASSERTION}" ]; then
+            echo ""
+            echo "Validating assertion: [state:${STATE_ASSERTION}]"
+            if [ "${DETECTED_STATE}" -ne "${STATE_ASSERTION}" ]; then
+              echo "❌ ERROR: State mismatch!"
+              echo "   Expected (from [state:N]): ${STATE_ASSERTION}"
+              echo "   Detected (from cache):     ${DETECTED_STATE}"
+              exit 1
+            fi
+            echo "✓ Assertion passed: detected == expected (${DETECTED_STATE})"
+          fi
+
+          # Output detected state for next steps
+          echo "detected_state=${DETECTED_STATE}" >> "$GITHUB_OUTPUT"
+
+          echo ""
+          echo "=========================================="
+
+      - name: Simulate Build (State Transition)
+        env:
+          DETECTED_STATE: ${{ steps.state.outputs.detected_state }}
+        run: |
+          echo "=========================================="
+          echo "Simulating Build (State Transition)"
+          echo "=========================================="
+
+          # Calculate next state
+          NEXT_STATE=$((DETECTED_STATE + 1))
+          echo "Transitioning: State ${DETECTED_STATE} → State ${NEXT_STATE}"
+          echo ""
+
+          # Create state file for next state
+          STATE_FILE="${CACHE_DIR}/state${NEXT_STATE}.txt"
+          echo "State ${NEXT_STATE} - Created at $(date)" > "${STATE_FILE}"
+          echo "Commit: ${{ github.sha }}" >> "${STATE_FILE}"
+          echo "Message: ${{ github.event.head_commit.message }}" >> "${STATE_FILE}"
+
+          echo "✓ Created ${STATE_FILE}"
+
+          # Show final cache state
+          echo ""
+          echo "Final cache contents:"
+          ls -la "${CACHE_DIR}"
+
+          echo ""
+          echo "State files:"
+          cat ${CACHE_DIR}/state*.txt
+
+      - name: Save Cache
+        uses: ./.github/actions/xahau-actions-cache-save
+        with:
+          path: ${{ env.CACHE_DIR }}
+          key: ${{ env.CACHE_KEY }}
+          s3-bucket: ${{ env.S3_BUCKET }}
+          s3-region: ${{ env.S3_REGION }}
+          use-deltas: 'true'
+          aws-access-key-id: ${{ secrets.XAHAUD_GITHUB_ACTIONS_CACHE_NIQ_AWS_KEY_ID }}
+          aws-secret-access-key: ${{ secrets.XAHAUD_GITHUB_ACTIONS_CACHE_NIQ_AWS_ACCESS_KEY }}
+
+      - name: Validate S3 State (After Save)
+        env:
+          AWS_ACCESS_KEY_ID: ${{ secrets.XAHAUD_GITHUB_ACTIONS_CACHE_NIQ_AWS_KEY_ID }}
+          AWS_SECRET_ACCESS_KEY: ${{ secrets.XAHAUD_GITHUB_ACTIONS_CACHE_NIQ_AWS_ACCESS_KEY }}
+          DETECTED_STATE: ${{ steps.state.outputs.detected_state }}
+        run: |
+          echo "=========================================="
+          echo "S3 State Validation (After Save)"
+          echo "=========================================="
+
+          # Calculate next state (what we just saved)
+          NEXT_STATE=$((DETECTED_STATE + 1))
+          echo "Saved state: ${NEXT_STATE}"
+          echo ""
+
+          # Check if base exists
+          if aws s3 ls "s3://${S3_BUCKET}/${CACHE_KEY}-base.tar.zst" --region "${S3_REGION}" >/dev/null 2>&1; then
+            BASE_SIZE=$(aws s3 ls "s3://${S3_BUCKET}/${CACHE_KEY}-base.tar.zst" --region "${S3_REGION}" | awk '{print $3}')
+            echo "✓ Base exists: ${CACHE_KEY}-base.tar.zst (${BASE_SIZE} bytes)"
+          else
+            echo "❌ ERROR: Base should exist after save"
+            exit 1
+          fi
+
+          # List deltas
+          echo ""
+          echo "Delta layers:"
+          DELTAS=$(aws s3 ls "s3://${S3_BUCKET}/" --region "${S3_REGION}" | grep "${CACHE_KEY}-delta-" || echo "")
+          if [ -n "${DELTAS}" ]; then
+            echo "${DELTAS}"
+            DELTA_COUNT=$(echo "${DELTAS}" | wc -l)
+          else
+            echo "(none)"
+            DELTA_COUNT=0
+          fi
+
+          # Validate S3 state
+          echo ""
+          if [ "${DETECTED_STATE}" -eq 0 ]; then
+            # Saved state 1 from bootstrap (state 0 → 1)
+            if [ "${DELTA_COUNT}" -ne 0 ]; then
+              echo "⚠️  WARNING: Bootstrap (state 1) should have 0 deltas, found ${DELTA_COUNT}"
+            else
+              echo "✓ State 1 saved: base exists, 0 deltas"
+            fi
+          else
+            # Saved delta (state N+1)
+            if [ "${DELTA_COUNT}" -ne 1 ]; then
+              echo "⚠️  WARNING: State ${NEXT_STATE} expects 1 delta (inline cleanup), found ${DELTA_COUNT}"
+              echo "This might be OK if multiple builds ran concurrently"
+            else
+              echo "✓ State ${NEXT_STATE} saved: base + 1 delta (old deltas cleaned)"
+            fi
+          fi
+
+          echo ""
+          echo "=========================================="
+          echo "✅ State ${DETECTED_STATE} → ${NEXT_STATE} Complete!"
+          echo "=========================================="
+          echo ""
+          echo "Next commit will auto-detect state ${NEXT_STATE}"
+          echo ""
+          echo "Options:"
+          echo "  # Normal (auto-advance)"
+          echo "  git commit -m 'continue testing'"
+          echo ""
+          echo "  # With assertion (validate state)"
+          echo "  git commit -m 'test delta [state:${NEXT_STATE}]'"
+          echo ""
+          echo "  # Clear cache and restart"
+          echo "  git commit -m 'fresh start [ci-clear-cache]'"
+          echo ""
+          echo "  # Jump to specific state"
+          echo "  git commit -m 'jump to state 3 [start-state:3]'"

.github/workflows/xahau-ga-macos.yml.disabled

@@ -78,14 +78,6 @@ jobs:
       - name: Install ccache
         run: brew install ccache
 
-      - name: Configure ccache
-        uses: ./.github/actions/xahau-configure-ccache
-        with:
-          max_size: 2G
-          hash_dir: true
-          compiler_check: content
-          is_main_branch: ${{ github.ref_name == env.MAIN_BRANCH_NAME }}
-
       - name: Check environment
         run: |
           echo "PATH:"
@@ -98,32 +90,12 @@ jobs:
           echo "---- Full Environment ----"
           env
 
-      - name: Configure Conan
+      - name: Detect compiler version
+        id: detect-compiler
         run: |
-          # Create the default profile directory if it doesn't exist
-          mkdir -p ~/.conan2/profiles
-
-          # Detect compiler version
           COMPILER_VERSION=$(clang --version | grep -oE 'version [0-9]+' | grep -oE '[0-9]+')
-
+          echo "compiler_version=${COMPILER_VERSION}" >> $GITHUB_OUTPUT
-          # Create profile with our specific settings
+          echo "Detected Apple Clang version: ${COMPILER_VERSION}"
-          cat > ~/.conan2/profiles/default <<EOF
-          [settings]
-          arch=armv8
-          build_type=Release
-          compiler=apple-clang
-          compiler.cppstd=20
-          compiler.libcxx=libc++
-          compiler.version=${COMPILER_VERSION}
-          os=Macos
-
-          [conf]
-          # Workaround for gRPC with newer Apple Clang
-          tools.build:cxxflags=["-Wno-missing-template-arg-list-after-template-kw"]
-          EOF
-
-          # Display profile for verification
-          conan profile show
 
       - name: Install dependencies
         uses: ./.github/actions/xahau-ga-dependencies
@@ -133,6 +105,13 @@ jobs:
           compiler-id: clang
           cache_version: ${{ env.CACHE_VERSION }}
           main_branch: ${{ env.MAIN_BRANCH_NAME }}
+          os: Macos
+          arch: armv8
+          compiler: apple-clang
+          compiler_version: ${{ steps.detect-compiler.outputs.compiler_version }}
+          stdlib: libcxx
+          aws-access-key-id: ${{ secrets.XAHAUD_GITHUB_ACTIONS_CACHE_NIQ_AWS_KEY_ID }}
+          aws-secret-access-key: ${{ secrets.XAHAUD_GITHUB_ACTIONS_CACHE_NIQ_AWS_ACCESS_KEY }}
 
       - name: Build
         uses: ./.github/actions/xahau-ga-build
@@ -143,6 +122,9 @@ jobs:
           compiler-id: clang
           cache_version: ${{ env.CACHE_VERSION }}
           main_branch: ${{ env.MAIN_BRANCH_NAME }}
+          stdlib: libcxx
+          aws-access-key-id: ${{ secrets.XAHAUD_GITHUB_ACTIONS_CACHE_NIQ_AWS_KEY_ID }}
+          aws-secret-access-key: ${{ secrets.XAHAUD_GITHUB_ACTIONS_CACHE_NIQ_AWS_ACCESS_KEY }}
 
       - name: Test
         run: |

.github/workflows/xahau-ga-nix.yml

@@ -2,7 +2,7 @@ name: Nix - GA Runner
 
 on:
   push:
-    branches: ["dev", "candidate", "release"]
+    branches: ["dev", "candidate", "release", "nd-experiment-overlayfs-2025-10-29"]
   pull_request:
     branches: ["dev", "candidate", "release"]
   schedule:
@@ -156,7 +156,7 @@ jobs:
     env:
       build_dir: .build
       # Bump this number to invalidate all caches globally.
-      CACHE_VERSION: 2
+      CACHE_VERSION: 3
       MAIN_BRANCH_NAME: dev
     steps:
       - name: Checkout
@@ -231,48 +231,6 @@ jobs:
           # Install Conan 2
           pip install --upgrade "conan>=2.0,<3"
 
-      - name: Configure ccache
-        uses: ./.github/actions/xahau-configure-ccache
-        with:
-          max_size: 2G
-          hash_dir: true
-          compiler_check: content
-          is_main_branch: ${{ github.ref_name == env.MAIN_BRANCH_NAME }}
-
-      - name: Configure Conan
-        run: |
-          # Create the default profile directory if it doesn't exist
-          mkdir -p ~/.conan2/profiles
-
-          # Determine the correct libcxx based on stdlib parameter
-          if [ "${{ matrix.stdlib }}" = "libcxx" ]; then
-            LIBCXX="libc++"
-          else
-            LIBCXX="libstdc++11"
-          fi
-
-          # Create profile with our specific settings
-          cat > ~/.conan2/profiles/default <<EOF
-          [settings]
-          arch=x86_64
-          build_type=${{ matrix.configuration }}
-          compiler=${{ matrix.compiler }}
-          compiler.cppstd=20
-          compiler.libcxx=${LIBCXX}
-          compiler.version=${{ matrix.compiler_version }}
-          os=Linux
-
-          [buildenv]
-          CC=/usr/bin/${{ matrix.cc }}
-          CXX=/usr/bin/${{ matrix.cxx }}
-
-          [conf]
-          tools.build:compiler_executables={"c": "/usr/bin/${{ matrix.cc }}", "cpp": "/usr/bin/${{ matrix.cxx }}"}
-          EOF
-
-          # Display profile for verification
-          conan profile show
-
       - name: Check environment
         run: |
           echo "PATH:"
@@ -293,7 +251,13 @@ jobs:
           compiler-id: ${{ matrix.compiler_id }}
           cache_version: ${{ env.CACHE_VERSION }}
           main_branch: ${{ env.MAIN_BRANCH_NAME }}
+          compiler: ${{ matrix.compiler }}
+          compiler_version: ${{ matrix.compiler_version }}
+          cc: ${{ matrix.cc }}
+          cxx: ${{ matrix.cxx }}
           stdlib: ${{ matrix.stdlib }}
+          aws-access-key-id: ${{ secrets.XAHAUD_GITHUB_ACTIONS_CACHE_NIQ_AWS_KEY_ID }}
+          aws-secret-access-key: ${{ secrets.XAHAUD_GITHUB_ACTIONS_CACHE_NIQ_AWS_ACCESS_KEY }}
 
       - name: Build
         uses: ./.github/actions/xahau-ga-build
@@ -308,6 +272,8 @@ jobs:
           main_branch: ${{ env.MAIN_BRANCH_NAME }}
           stdlib: ${{ matrix.stdlib }}
           clang_gcc_toolchain: ${{ matrix.clang_gcc_toolchain || '' }}
+          aws-access-key-id: ${{ secrets.XAHAUD_GITHUB_ACTIONS_CACHE_NIQ_AWS_KEY_ID }}
+          aws-secret-access-key: ${{ secrets.XAHAUD_GITHUB_ACTIONS_CACHE_NIQ_AWS_ACCESS_KEY }}
 
       - name: Set artifact name
         id: set-artifact-name