fix(ci): resilient apt install with per-attempt timeout + retry, drop dead-weight packages

.github/workflows/ci.yml

@@ -173,10 +173,13 @@ jobs:
     steps:
       - uses: actions/checkout@v6
       - name: Install LuaJIT and build deps
+        # ci-apt-install.sh retries with a per-attempt timeout so one slow
+        # mirror rotation doesn't fail the job (#125, #164). cmake / gcc /
+        # make (build-essential) are preinstalled on the runner image —
+        # asserted below instead of apt-installing shadowed duplicates.
         run: |
-          sudo apt-get update
-          sudo apt-get install -y --no-install-recommends \
-            cmake build-essential libluajit-5.1-dev libcurl4-openssl-dev
+          bash scripts/ci-apt-install.sh libluajit-5.1-dev libcurl4-openssl-dev
+          cmake --version | head -1
       - name: Configure pine-cpp
         working-directory: pine-cpp
         run: cmake -S . -B build -DCMAKE_BUILD_TYPE=Release
@@ -220,10 +223,10 @@ jobs:
         with:
           python-version: "3.13"
       - name: Install LuaJIT and build deps
+        # Resilient apt install — see cpp-build job comment (#125, #164).
         run: |
-          sudo apt-get update
-          sudo apt-get install -y --no-install-recommends \
-            cmake build-essential libluajit-5.1-dev libcurl4-openssl-dev
+          bash scripts/ci-apt-install.sh libluajit-5.1-dev libcurl4-openssl-dev
+          cmake --version | head -1
       - name: Run ASan/UBSan smoke
         run: bash scripts/cpp-sanitizer-smoke.sh
 
@@ -236,10 +239,10 @@ jobs:
         with:
           python-version: "3.13"
       - name: Install LuaJIT and build deps
+        # Resilient apt install — see cpp-build job comment (#125, #164).
         run: |
-          sudo apt-get update
-          sudo apt-get install -y --no-install-recommends \
-            cmake build-essential libluajit-5.1-dev libcurl4-openssl-dev util-linux
+          bash scripts/ci-apt-install.sh libluajit-5.1-dev libcurl4-openssl-dev util-linux
+          cmake --version | head -1
       - name: Run TSan smoke (high-fanout DAG stress)
         run: bash scripts/cpp-tsan-smoke.sh
 
@@ -248,10 +251,10 @@ jobs:
     steps:
       - uses: actions/checkout@v6
       - name: Install build deps
+        # Resilient apt install — see cpp-build job comment (#125, #164).
         run: |
-          sudo apt-get update
-          sudo apt-get install -y --no-install-recommends \
-            cmake build-essential libluajit-5.1-dev libcurl4-openssl-dev
+          bash scripts/ci-apt-install.sh libluajit-5.1-dev libcurl4-openssl-dev
+          cmake --version | head -1
       - name: Strict build (-Werror)
         working-directory: pine-cpp
         run: |
@@ -305,10 +308,10 @@ jobs:
     steps:
       - uses: actions/checkout@v6
       - name: Install build deps
+        # Resilient apt install — see cpp-build job comment (#125, #164).
         run: |
-          sudo apt-get update
-          sudo apt-get install -y --no-install-recommends \
-            cmake build-essential libluajit-5.1-dev libcurl4-openssl-dev
+          bash scripts/ci-apt-install.sh libluajit-5.1-dev libcurl4-openssl-dev
+          cmake --version | head -1
       - name: Build + run tests
         run: make cpp-test PARALLEL=$(nproc)
 
@@ -382,11 +385,11 @@ jobs:
         with:
           python-version: "3.13"
       - name: Install redis-server and LuaJIT
+        # Resilient apt install — see cpp-build job comment (#125, #164).
         run: |
-          sudo apt-get update
-          sudo apt-get install -y --no-install-recommends \
-            redis-server=5:7.* cmake build-essential libluajit-5.1-dev libcurl4-openssl-dev
+          bash scripts/ci-apt-install.sh "redis-server=5:7.*" libluajit-5.1-dev libcurl4-openssl-dev
           redis-server --version
+          cmake --version | head -1
       - name: Cross-validate Go vs Java vs C++
         run: make cross-validate | tee cross-validate-output.txt
       - name: Fail on any divergence
@@ -525,9 +528,13 @@ jobs:
         run: mvn package -B -q -DskipTests
         working-directory: pine-java
       - name: Install LuaJIT and build deps
+        # Resilient apt install — see cpp-build job comment (#125, #164).
+        # libhiredis-dev was dropped: pine-cpp's redis client is raw-socket
+        # (no hiredis reference anywhere in the tree), and every other cpp
+        # job already builds without it.
         run: |
-          sudo apt-get update -qq
-          sudo apt-get install -y -qq libluajit-5.1-dev libcurl4-openssl-dev libhiredis-dev >/dev/null
+          bash scripts/ci-apt-install.sh libluajit-5.1-dev libcurl4-openssl-dev
+          cmake --version | head -1
       - name: Build C++
         run: |
           cmake -S . -B build -DCMAKE_BUILD_TYPE=Release

.github/workflows/daily-sanitized-fuzz.yml

@@ -84,10 +84,14 @@ jobs:
           cache: maven
 
       - name: Install C++ build deps
+        # ci-apt-install.sh retries with a per-attempt timeout so one slow
+        # mirror rotation doesn't burn the whole budget (#125, #164). cmake /
+        # g++-13 / make are preinstalled on the runner image — assert them
+        # instead of apt-installing shadowed duplicates.
         run: |
-          timeout 600 sudo apt-get update
-          timeout 600 sudo apt-get install -y --no-install-recommends \
-            cmake ninja-build g++-13 libluajit-5.1-dev libcurl4-openssl-dev
+          bash scripts/ci-apt-install.sh libluajit-5.1-dev libcurl4-openssl-dev
+          cmake --version | head -1
+          g++-13 --version | head -1
 
       - name: Build Go binary
         run: go build -o pineapple-run ./cmd/pineapple-run/

.github/workflows/nightly-benchmark.yml

@@ -43,10 +43,14 @@ jobs:
           cache: maven
 
       - name: Install system deps
+        # ci-apt-install.sh retries with a per-attempt timeout so one slow
+        # mirror rotation doesn't burn the whole budget (#125, #164). cmake /
+        # gcc / make (build-essential) are preinstalled on the runner image —
+        # assert instead of apt-installing shadowed duplicates.
         run: |
-          timeout 600 sudo apt-get update
-          timeout 600 sudo apt-get install -y --no-install-recommends \
-            cmake build-essential libluajit-5.1-dev libcurl4-openssl-dev
+          bash scripts/ci-apt-install.sh libluajit-5.1-dev libcurl4-openssl-dev
+          cmake --version | head -1
+          g++ --version | head -1
 
       - name: Install hey
         run: go install github.com/rakyll/hey@latest

.github/workflows/nightly-diff-fuzz.yml

@@ -48,10 +48,15 @@ jobs:
           cache: maven
 
       - name: Install C++ build deps
+        # ci-apt-install.sh retries with a per-attempt timeout so one slow
+        # mirror rotation doesn't burn the whole budget (#125, #164). cmake /
+        # g++-13 / make are preinstalled on the runner image (apt's cmake is
+        # older and shadowed by PATH anyway; #164's fatal 11.2 MB download
+        # was exactly that dead weight) — assert them instead of installing.
         run: |
-          timeout 600 sudo apt-get update
-          timeout 600 sudo apt-get install -y --no-install-recommends \
-            cmake ninja-build g++-13 libluajit-5.1-dev libcurl4-openssl-dev
+          bash scripts/ci-apt-install.sh libluajit-5.1-dev libcurl4-openssl-dev
+          cmake --version | head -1
+          g++-13 --version | head -1
 
       - name: Build Go binary
         run: go build -o pineapple-run ./cmd/pineapple-run/

.github/workflows/nightly-sanitizer.yml

@@ -34,10 +34,12 @@ jobs:
         with:
           python-version: "3.13"
       - name: Install LuaJIT and build deps
+        # ci-apt-install.sh retries with a per-attempt timeout so one slow
+        # mirror rotation doesn't burn the whole budget (#125, #164). cmake /
+        # gcc / make (build-essential) are preinstalled on the runner image.
         run: |
-          sudo apt-get update
-          sudo apt-get install -y --no-install-recommends \
-            cmake build-essential libluajit-5.1-dev libcurl4-openssl-dev util-linux
+          bash scripts/ci-apt-install.sh libluajit-5.1-dev libcurl4-openssl-dev util-linux
+          cmake --version | head -1
 
       - name: Run TSan stress
         id: tsan
@@ -62,10 +64,10 @@ jobs:
         with:
           python-version: "3.13"
       - name: Install LuaJIT and build deps
+        # Same resilient install as the tsan job above (#125, #164).
         run: |
-          sudo apt-get update
-          sudo apt-get install -y --no-install-recommends \
-            cmake build-essential libluajit-5.1-dev libcurl4-openssl-dev util-linux
+          bash scripts/ci-apt-install.sh libluajit-5.1-dev libcurl4-openssl-dev util-linux
+          cmake --version | head -1
 
       - name: Run ASan/UBSan smoke
         id: asan

llmdoc/guides/ci-quality-baseline.md

@@ -42,6 +42,16 @@
 
 Benchmark job 将 `go test -bench` 输出写入 `benchmark.txt`，同时追加到 `$GITHUB_STEP_SUMMARY` 供 PR/CI 页面直接查看；artifact 作为可下载原始结果保留。
 
+## CI apt 依赖安装约定
+
+所有 workflow 中安装 apt 依赖的步骤必须统一走 `scripts/ci-apt-install.sh`，不得回退到裸 `timeout N sudo apt-get install ...` 单发模式。
+
+背景：慢速 Azure archive mirror 曾两次拖垮 CI——#125（2026-06-18）把整段 `timeout` 从 300s 提到 600s 作为"修复"，#164（2026-07-10）同一堵墙被再次撞穿（单个包在 26 KB/s 下载了 433s）。根因是"单发安装 + 整段超时"结构本身没有第二次机会，静态加大超时数值只是把击穿点往后挪。判断准则：先问这个失败模式重试后是否大概率自愈（mirror rotation 通常会）——是则加重试层，否则才考虑调大超时数值。
+
+`ci-apt-install.sh` 的结构：update / install 各自最多 3 次尝试（`ATTEMPTS`，默认 3）、每次独立 per-attempt timeout（`ATTEMPT_TIMEOUT`，默认 300s，均可通过环境变量覆盖）、尝试间 backoff（`attempt * 10`s）、kill 后 `dpkg --configure -a` 修复半配置状态、`Acquire::Retries=3`（覆盖单次尝试内的连接中断）+ `DPkg::Lock::Timeout=60`（等待 unattended-upgrades 类锁持有者）。
+
+包清单纪律：只安装 runner image 真正缺失的包，不重复安装已预装工具（GitHub runner image 预装 cmake / g++ / build-essential，apt 装的同名包版本更旧且 PATH 排序在后，纯粹是死重，只会放大慢镜像暴露面）；install step 之后应对预装工具做版本断言（如 `cmake --version`、`g++ --version`），使 image 变更导致的依赖缺失在 install 阶段就明确报错，而不是在后续编译步骤里表现为莫名错误。新增 workflow 或 job 时禁止绕过 `ci-apt-install.sh` 直接内联 apt 命令。
+
 ## 统一任务入口（Makefile）
 
 仓库提供顶层 `Makefile` 与 `pine-go/Makefile` 作为本地与 CI 共用的统一任务入口，封装跨四语言的格式化 / lint / test / bench / codegen / 版本管理等命令。目标列表以 `make help`（或两个 Makefile 自身）为准，禁止在本指南中硬编码完整清单。常用入口示例：
@@ -289,6 +299,7 @@ Pine-Java 通过 Sonatype Central Portal 发布到 Maven Central（release profi
 ## 检索指针
 
 - CI 配置：`.github/workflows/ci.yml`
+- CI apt 安装 wrapper：`scripts/ci-apt-install.sh`
 - Nightly differential-fuzz：`.github/workflows/nightly-diff-fuzz.yml`
 - Daily sanitized-fuzz：`.github/workflows/daily-sanitized-fuzz.yml`
 - Nightly cross-runtime benchmark：`.github/workflows/nightly-benchmark.yml`

llmdoc/index.md

@@ -19,7 +19,7 @@
 ## guides/
 
 - `llmdoc/guides/standard-workflow.md` — 标准工作流程：llmdoc 加载、plan mode 对齐、任务跟踪、逐步验证、文档同步、review-driven scope expansion 接受。
-- `llmdoc/guides/ci-quality-baseline.md` — CI 工程质量基线：lint（含 Java checkstyle `failOnViolation=true` + `OneStatementPerLine`、C++ clang-format）/ test / coverage / fuzz / differential-fuzz / daily sanitized-fuzz（ASan/TSan 深度诊断，与 nightly Release 10k 轮吞吐互补，`--time-budget-seconds` 内层 pacing + 外层纯 hang 保护两层 timeout 设计） / cross-validate / nightly cross-runtime benchmark / release-gate 架构与接入约定（含 pine-cpp 的 4 个 CI job 与 cross-validate cpp 二进制注入路径），统一任务入口 Makefile 体系（顶层 + `pine-go/` Makefile 封装跨四语言 fmt/lint/test/bench/codegen/版本管理，CI 与本地共用同一命令序列、`make bench` 默认 `pine_bench` tag），以及本地 `.githooks/` 体系（`pre-commit` staged-only 格式 gate + `pre-push` 工程级 lint + 自包装 CI watch）。
+- `llmdoc/guides/ci-quality-baseline.md` — CI 工程质量基线：lint（含 Java checkstyle `failOnViolation=true` + `OneStatementPerLine`、C++ clang-format）/ test / coverage / fuzz / differential-fuzz / daily sanitized-fuzz（ASan/TSan 深度诊断，与 nightly Release 10k 轮吞吐互补，`--time-budget-seconds` 内层 pacing + 外层纯 hang 保护两层 timeout 设计） / cross-validate / nightly cross-runtime benchmark / release-gate 架构与接入约定（含 pine-cpp 的 4 个 CI job 与 cross-validate cpp 二进制注入路径），统一任务入口 Makefile 体系（顶层 + `pine-go/` Makefile 封装跨四语言 fmt/lint/test/bench/codegen/版本管理，CI 与本地共用同一命令序列、`make bench` 默认 `pine_bench` tag），CI apt 依赖安装约定（`scripts/ci-apt-install.sh` 重试 wrapper + 包清单瘦身，防慢镜像单发击穿，历史 #125/#164），以及本地 `.githooks/` 体系（`pre-commit` staged-only 格式 gate + `pre-push` 工程级 lint + 自包装 CI watch）。
 - `llmdoc/guides/investigation-to-fix-testing.md` — 从调查到修复的测试策略：按缺陷类型选择测试层、最小修复面原则、跟进上游 issue 与临时止血方法论（跨 issue 根因归属不顺 follow-up 措辞、临时止血阈值用 probe 实测标定）。
 - `llmdoc/guides/cross-layer-validation.md` — 跨层语义校验：JSON 边界类型枚举、codegen 语义验证（含跨引擎 markdown / Python 产物 byte-equal gate）、边界值 E2E、隐含 metadata 契约检测、扩展点对等验证（能力等价）。
 - `llmdoc/guides/benchmark-hygiene.md` — Benchmark 噪声卫生：跑前/跑后 load 与残留进程检查、同日同机对照纪律、±5-7% 二进制布局噪声与 perf stat 交叉验证、calibrated stddev 33-36ms 来源校准（DAG 调度抖动 + LuaJ JIT warmup + 网络抖动主导，GC pause 非主要源）、fixture 代表性（calibrated 为性能决策唯一裁判）、microbench 访问模式戒律、逐 op 删除归因法、测量路径对称性（PureVM vs CallOnly vs Boundary 不可互推）。
@@ -110,6 +110,7 @@
 - `llmdoc/memory/reflections/jdk25-upgrade-and-zgc-investigation.md` — 2026-06-26 评估 pine-java 升 JDK 25 + 切 ZGC 的 A/B/C 路径复盘，记录"性能假设要测不要猜"与 deployment-shape vs GC-shape 匹配检查的教训，含 G1/ZGC GC log 实测数据点（G1 max STW 12.82ms 证伪 stddev=GC 假设、ZGC 2C cgroup 下 concurrent 6.7% CPU 偷窃致 −5~7% QPS）。
 - `llmdoc/memory/reflections/sanitized-fuzz-time-budget-graceful-stop.md` — daily-sanitized-fuzz.yml ASan pass 连续 8/10 天被内层 timeout 杀死复盘，记录 all-or-nothing 全损结构缺陷（不管差多少轮，超时即全部作废）、预算标定须用观测窗口内 worst 实测而非快日均值标定（快慢日方差达 55%）、长时任务 timeout 应分内层 pacing（`--time-budget-seconds` 优雅降级、保留 `Results:` 部分覆盖信号）/ 外层纯 hang-protection 两层、"若 X 再现则走 Y"式观察窗口决策树若无 owner 跟进执行则形同虚设四条教训。
 - `llmdoc/memory/reflections/column-vs-row-parity-investigation.md` — 列存 vs 行存性能持平调查复盘（2026-07-07，pine-go 调查 + 同日三引擎实现 fbf2ef7/bf7ce0b/95a3000），记录三层根因（逐元素 `Item()` 接口税 27x 第一性、ColumnFrame 三处行主序热路径、负载形状由列存劣势操作构成）、A/B 数据（BuildInput 列存 53μs→3.9μs、transform-heavy e2e 列存 +30%）、三引擎批量列访问 API 形式对照与验证结果（cross-validate + 120 轮 fuzz 零 divergence + coverage 背书）、实现阶段教训（spec 裸指针生命周期、覆盖要量化不要感觉、flaky divergence 先排环境、样板对齐不等于逐行照抄、翻译残留死代码）与 row/column 使用判据；含第二阶段 typed columns 实现记录（issue #156 / PR #162）与第三阶段批量列写实现记录（issue #157 / PR #163，写侧 profiling 归因 ~24% 过闸门、列存 allocs -66%、Go 批量路径 `any` 装箱税教训、新写路径六消费点清单）。
+- `llmdoc/memory/reflections/ci-apt-resilience-and-dead-weight-packages.md` — 修复 apt 慢镜像二次击穿 CI（#125→#164）复盘，记录单发安装+整段超时结构性缺陷需重试层而非更大超时数值（判据：失败模式重试后是否大概率自愈）、死重包（cmake/ninja-build/build-essential）放大慢镜像暴露面 10 倍（15.7 MB vs 实需 ~1.5 MB）、依赖断言（`cmake --version`）比隐式依赖预装更健壮、go native fuzz "context deadline exceeded" 且无 crash corpus 文件即为 coordinator flake（应 rerun 而非误判为真实发现）四条教训。
 
 ## memory/decisions/