test(e2e): give 317 the window its bound needs, and run 602 where the report exists

Reaching "five consecutive short failures" costs at least 1.25 s (four
restart delays of 250 ms and five 50 ms polls). A two-second pause left
150 ms per spawn, and a loaded macOS runner exceeded it twice in a row on
main while the same code passed twice on this branch. The pause is now
five seconds, so the property is decided by the code.

602 declared no platform, and on Windows the doctor does not emit the
device-toolkit section at all: the payloads are Linux builds and the bound
a Windows toolkit states is an _MSC_VER range the report does not read.
It also ran the doctor in a fresh home, which provisioned a full toolchain
into the temporary directory: 229 s and 1.4 GB per run. It now requires
unix-shell and runs under MCPP_OFFLINE.

Author: speak-agent

tests/e2e/317_project_build_hooks.sh

@@ -182,9 +182,11 @@ esac
 if [[ $HOST_WINDOWS -eq 1 ]]; then
     slow_command="ping -n 6 127.0.0.1 >NUL"
     pause_2s="ping -n 3 127.0.0.1 >NUL"
+    pause_5s="ping -n 6 127.0.0.1 >NUL"
 else
     slow_command="sleep 5"
     pause_2s="sleep 2"
+    pause_5s="sleep 5"
 fi
 write_manifest <<EOF
 [package]
@@ -360,13 +362,22 @@ once=$(wc -l < runs.log | tr -d ' ')
 #
 # `loop` on a typo is a fork bomb otherwise. The bound is five consecutive
 # runs that end unsuccessfully within a second.
+#
+# The build must stay open long enough for the supervisor to reach that bound.
+# Reaching it costs five spawns, four restart delays of 250ms, and up to 50ms
+# of poll granularity after each exit: 1.25s before a single spawn is counted.
+# Under a two-second pause that left 150ms per spawn, and a loaded macOS
+# runner exceeded it (main, 2026-09-05: the build finished, the warning was
+# never printed, and the test reported the bound as missing). Five seconds
+# leaves 750ms per spawn; the property is then decided by the code and not by
+# the runner's load.
 write_manifest <<EOF
 [package]
 name = "hookprobe"
 version = "0.1.0"
 
 [hooks]
-build_start = "$pause_2s"
+build_start = "$pause_5s"
 during_build = { cmd = "mcpp-hook-command-that-does-not-exist", loop = true }
 EOF
 # The build still succeeds — an experimental hook has no vote — but giving up

tests/e2e/602_device_toolkit_payload_first.sh

@@ -1,6 +1,14 @@
 #!/usr/bin/env bash
+# requires: unix-shell
 # The device-toolkit report reads a PAYLOAD before it reads the host.
 #
+# POSIX hosts only: the report is produced there and nowhere else. On Windows
+# the doctor does not emit the section at all -- the toolkit payloads in the
+# index are Linux builds, and the host-compiler bound a Windows toolkit states
+# is an `_MSC_VER` range the report does not yet read. Running this fixture
+# there asserts on a section that cannot appear (measured on the Windows
+# runner, 2026-09-05).
+#
 # A toolkit installed through xlings is the one a build will use, and it is
 # also the newer one -- measured on the development machine, a payload states
 # `gcc <= 15` where the distribution's CUDA 12.0 states `gcc <= 12`. Reporting
@@ -19,14 +27,36 @@ trap "rm -rf $TMP" EXIT
 # bound is one nothing on a real machine would state.
 PAYLOAD="$TMP/xlings/data/xpkgs/local-x-cuda-crt/99.9.99/include/crt"
 mkdir -p "$PAYLOAD"
+# ⚠️ BOTH GUARDS, AND THAT IS NOT BELT-AND-BRACES. The report names the bound
+# for the family of the compiler mcpp resolved, and that family differs by
+# platform: gcc on the Linux runners, clang on the macOS one. A fixture stating
+# only the GNU guard reported `clang N <= 0` there — a criterion decided by the
+# environment rather than by the code under test. Stating both makes the
+# reading 41 whichever family answers.
 cat > "$PAYLOAD/host_config.h" <<'HDR'
 #if __GNUC__ > 41
 #error -- unsupported GNU version! gcc versions later than 41 are not supported!
 #endif
+#if defined(__clang__)
+#error -- unsupported clang version! clang version must be less than 42 and greater than 3.2 .
+#endif
 HDR
 
+# ⚠️ BOTH STORES ISOLATED. The report searches mcpp's own store before the
+# xlings one, so on a machine that has a real CUDA payload installed the real
+# one answers and this fixture is never read — the assertion then measures
+# whatever that machine happens to have. Fresh homes make the reading a property
+# of the code rather than of the runner.
+#
+# OFFLINE, because a fresh home is otherwise bootstrapped in full during the
+# diagnosis: measured on the development machine, the doctor cloned the index,
+# installed ninja and patchelf, and then downloaded glibc and gcc -- 1.4 GB and
+# 229 seconds -- before reaching the section under test. Under `MCPP_OFFLINE`
+# the bootstrap is skipped and the toolchain is not provisioned; the device
+# toolkit section is produced either way, and its reading is what matters here.
 out="$TMP/doctor.log"
-XLINGS_HOME="$TMP/xlings" "$MCPP" self doctor > "$out" 2>&1 || true
+MCPP_HOME="$TMP/mcpp" XLINGS_HOME="$TMP/xlings" MCPP_OFFLINE=1 \
+    "$MCPP" self doctor > "$out" 2>&1 || true
 
 grep -q "device toolkit" "$out" || { cat "$out"; echo "FAIL: no device toolkit section"; exit 1; }
 
@@ -42,7 +72,8 @@ echo "PASS: the payload's bound is the one reported"
 # The control. Without the payload store, the same command must NOT report 41 --
 # otherwise the assertion above would pass against a doctor that hardcodes it.
 out2="$TMP/doctor2.log"
-XLINGS_HOME="$TMP/empty" "$MCPP" self doctor > "$out2" 2>&1 || true
+MCPP_HOME="$TMP/mcpp2" XLINGS_HOME="$TMP/empty" MCPP_OFFLINE=1 \
+    "$MCPP" self doctor > "$out2" 2>&1 || true
 if grep -qE "<= ?41|bound of 41" "$out2"; then
     echo "FAIL: 41 is reported with no payload present; the test measures nothing"
     exit 1