flake: bundle what librln loads

[osmaczko]

flake: bundle what librln loads

librln.dylib is copied in prebuilt from zerokit's output, so the libiconv it names by absolute store path is zerokit's dependency and not this module's. A module reaches an app inside an LGX archive, and a tar is opaque to nix's reference scanning, so that path ends up registered as a reference of nothing, ships with nothing, and the plugin fails to dlopen wherever it is absent.

That has always been true of this packaging; what changed is that runners stopped building the module. The path only ever arrived as a side effect of compiling it, since zerokit drags its own dependencies in. logos-chat-ui's macOS doc-test shows the progression across three runs of an unchanged delivery module: on 2026-07-23 it built zerokit from source and passed, on 07-27 it substituted zerokit and passed, and on 07-28 it substituted the finished .lgx, realised nothing underneath it, and failed with Library not loaded on that libiconv. Derivations built per run went 2875, 122, 13. A warm cache is what exposes this class, and a cold one hides it, which is why it reads as a failure out of nowhere and why bisecting over revisions could not converge.

Copy what librln loads next to it and point the load commands at @loader_path, so those libraries travel inside the archive as files rather than as references nothing carries. The walk is transitive: the libiconv librln loads re-exports libcharset from the same store path, so rewriting one level moves the dangling path down instead of removing it.

The module still shows a reference to that libiconv afterwards, because the copy names its own i18n conversion tables by absolute path. Nothing reads them here: librln imports no iconv symbol and links the library only because cargo adds it.

ci: run the doc-test against the commit under test

The runtime doc-test builds github:logos-co/logos-delivery-module{release}#lgx, and with no --release-for the placeholder resolves to master, so the job installs and exercises master's module whatever the branch changed. No packaging change could ever pass or fail it. This branch demonstrated that: its first doc-test run reproduced master's dlopen failure while the commit that fixes it sat unbuilt.

Pin the placeholder to the head commit, blanking it for fork PRs whose head nix cannot fetch.

[github-actions]

📊 delivery-module doc-test report

This commit of the delivery module, packaged as an .lgx and run through a logoscore daemon — rendered alongside the commands actually run and their output (updated each run, commit f08c504):

• ubuntu-latest report
• macos-latest report

Pages can take a minute to update after the run finishes.