darwin: harden reconcile_framework_install_names (fail-loud + all-slice ids)

Two robustness fixes to the #223 reconcile pass (both from code review):

1. Stop swallowing real failures. The install_name_tool/-id/-change and codesign
   calls used `2>/dev/null || true`, which also hid genuine failures — most
   importantly install_name_tool's 'larger updated load commands do not fit'
   (a Mach-O with no header space to grow a load command). A swallowed -change
   leaves a bare @rpath ref and reproduces the exact dyld launch crash this pass
   exists to prevent, silently. Now: -id, a *present-dep* -change (absent deps
   are still a rc-0 no-op), and codesign failures are fatal — the function
   returns non-zero with a clear message, and sync_site_packages.sh propagates it
   (`|| exit 1`) so `flet build` fails loudly instead of shipping a broken app.
   stderr is captured and only printed on error, so the expected
   'will invalidate the code signature' warning stays off the build log.

2. Record every slice's old install-id, not just the first. Pass 1 read oldid
   only from the first slice; a lib whose slices carry divergent install names
   (e.g. an arch-specific absolute build path instead of an @rpath id) would
   leave the other slices' deps unrewritten. Now each distinct old id is mapped
   (deduped) to the same new framework id.

Verified: happy path (padded dylibs) + the real llama ggml->llama chain both
reconcile to rc 0 with no bare refs; a divergent-slice-id pair rewrites both
slices; an unpadded binary now fails loudly (rc 1) instead of silently.

Author: ndonkoHenri

src/serious_python_darwin/darwin/sync_site_packages.sh

@@ -55,7 +55,12 @@ if [[ -n "$SERIOUS_PYTHON_SITE_PACKAGES" && -d "$SERIOUS_PYTHON_SITE_PACKAGES" ]
         # resolve e.g. @rpath/libarrow.dylib at launch and the app crashes
         # before Python starts. Exclude the python/stdlib xcframeworks copied
         # in above -- they are already correct.
-        reconcile_framework_install_names "$dist/site-xcframeworks" "$dist/python-xcframeworks"
+        # A reconcile failure (e.g. a Mach-O with no header space to grow a load
+        # command, or a signing error) would otherwise ship an app that crashes
+        # at launch -- abort the build instead. sync_site_packages.sh has no
+        # set -e; prepare_spm.sh runs it under set -euo pipefail, so a non-zero
+        # exit here fails `flet build` loudly.
+        reconcile_framework_install_names "$dist/site-xcframeworks" "$dist/python-xcframeworks" || exit 1
 
         rm -rf $dist/site-packages
         mkdir -p $dist/site-packages

src/serious_python_darwin/darwin/xcframework_utils.sh

@@ -132,34 +132,51 @@ reconcile_framework_install_names() {
     local -a map_old=()
     local -a map_new=()
 
-    # Pass 1: fix each framework's own install-id; record old->new for deps.
-    local xcf fw newid bin oldid raw
+    # Pass 1: set each framework's own install-id to @rpath/<fw>.framework/<fw>,
+    # and record old-id -> new-id for the dep rewrite below. Read the old id from
+    # EVERY slice, not just the first: a lib whose slices carry divergent install
+    # names (e.g. an upstream build that baked an arch-specific absolute path
+    # instead of an @rpath id) would otherwise leave the other slices' deps
+    # unrewritten. Distinct old ids all map to the same new id.
+    local xcf fw newid bin oldid raw err j found
     for xcf in "$xcframeworks_dir"/*.xcframework; do
         [ -d "$xcf" ] || continue
         fw=$(basename "$xcf" .xcframework)
         [ -n "$exclude_dir" ] && [ -e "$exclude_dir/$fw.xcframework" ] && continue
         newid="@rpath/$fw.framework/$fw"
-        oldid=""
         for bin in "$xcf"/*/"$fw.framework/$fw"; do
             [ -f "$bin" ] || continue
-            if [ -z "$oldid" ]; then
-                # Buffer otool output before filtering: piping otool straight
-                # into `head -1` lets head close the pipe early, and the SIGPIPE
-                # race intermittently drops the first read (empty oldid), which
-                # cascades into a shifted/short map.
-                raw=$(otool -D "$bin" 2>/dev/null)
-                oldid=$(printf '%s\n' "$raw" | grep -v ':$' | grep -vi 'Architectures in' | head -1 | sed 's/^[[:space:]]*//')
+            # Buffer otool output before filtering: piping otool straight into
+            # `head -1` lets head close the pipe early, and the SIGPIPE race
+            # intermittently drops the first read (empty oldid).
+            raw=$(otool -D "$bin" 2>/dev/null)
+            oldid=$(printf '%s\n' "$raw" | grep -v ':$' | grep -vi 'Architectures in' | head -1 | sed 's/^[[:space:]]*//')
+            # -id must succeed; a failure means the binary is unwritable/corrupt
+            # and the app would crash at launch, so surface it instead of hiding
+            # it behind `|| true` (stderr is captured and only printed on error,
+            # to keep the expected "will invalidate the code signature" warning
+            # off the build log).
+            if ! err=$(install_name_tool -id "$newid" "$bin" 2>&1); then
+                echo "reconcile_framework_install_names: install_name_tool -id failed for $bin: $err" >&2
+                return 1
+            fi
+            if [ -n "$oldid" ] && [ "$oldid" != "$newid" ]; then
+                found=0
+                for j in ${map_old[@]+"${map_old[@]}"}; do
+                    [ "$j" = "$oldid" ] && { found=1; break; }
+                done
+                [ "$found" -eq 0 ] && { map_old+=("$oldid"); map_new+=("$newid"); }
             fi
-            install_name_tool -id "$newid" "$bin" 2>/dev/null || true
         done
-        if [ -n "$oldid" ] && [ "$oldid" != "$newid" ]; then
-            map_old+=("$oldid")
-            map_new+=("$newid")
-        fi
     done
 
-    # Pass 2: rewrite interdependent refs to framework paths, then re-sign
-    # (install_name_tool invalidates the ad-hoc signature).
+    # Pass 2: rewrite each binary's deps that point at a sibling's old id to that
+    # sibling's framework path, then re-sign (install_name_tool invalidates the
+    # ad-hoc signature). `install_name_tool -change` is a no-op returning 0 when
+    # the dep is absent, so a NON-zero rc means a dep that IS present could not be
+    # rewritten -- usually no Mach-O header space to grow the load command. That
+    # is fatal: it would leave a bare @rpath ref and reproduce the exact launch
+    # crash this pass exists to prevent, so fail the build rather than ship it.
     local i n=${#map_old[@]}
     for xcf in "$xcframeworks_dir"/*.xcframework; do
         [ -d "$xcf" ] || continue
@@ -169,11 +186,16 @@ reconcile_framework_install_names() {
             [ -f "$bin" ] || continue
             i=0
             while [ $i -lt $n ]; do
-                # no-op if this binary does not reference map_old[i]
-                install_name_tool -change "${map_old[$i]}" "${map_new[$i]}" "$bin" 2>/dev/null || true
+                if ! err=$(install_name_tool -change "${map_old[$i]}" "${map_new[$i]}" "$bin" 2>&1); then
+                    echo "reconcile_framework_install_names: install_name_tool -change '${map_old[$i]}' -> '${map_new[$i]}' failed for $bin (no Mach-O header space?): $err" >&2
+                    return 1
+                fi
                 i=$((i+1))
             done
-            codesign --force --sign - "$bin" >/dev/null 2>&1 || true
+            if ! err=$(codesign --force --sign - "$bin" 2>&1); then
+                echo "reconcile_framework_install_names: codesign failed for $bin: $err" >&2
+                return 1
+            fi
         done
     done
 }