[KeithRaghubar]

Problem

A sandboxed lib32-libcanberra build failed in the container with error: target not found: lib32-tdb.

lib32-tdb has left [multilib] for the AUR. The host still runs the last repo build (1.4.15-1, signed by an Arch packager), so pacman -Qm lists it as foreign, but sysforge never built it, so there was no artifact in PKGDEST. resolve_dep_artifacts put it in the host-only set correctly, found no artifact, and warned "the container will use the repo version instead". No repo carries a foreign package, so the build could only fail 25s later inside the chroot. local_repo.sync made the same claim.

Fix

• build_sandbox.cached_repo_artifact: returns the installed version's file from pacman's cache, reusing pacman.cached_repo_pkg_file, which accepts only a file with a detached .sig (a repo download, never a local build). Callers pass it only foreign names sysforge never built: the cache can hold the repo's same-pkgver build of a package sysforge rebuilt from source (the 2026-09-11 mesa skew).
• resolve_dep_artifacts: for a foreign dep, looks in PKGDEST, then the local repo dir (which keeps a copy pruned from PKGDEST), then the cache (only when sysforge never built it). If none has it, raises SandboxUnavailable before the container starts, naming the package and sysforge build <name>. A pruned dep that a repo still carries warns and continues as before.
• local_repo.sync publishes such a package from the cache too. Its missing-artifact warning no longer promises a repo version for a foreign package.
• Design doc (11-makepkg-wrapper.md + DESIGN.md), the sandbox guide, the guardrail in sysforge/CLAUDE.md, and a 4.0.0-B7 release-note entry.

Tests

• 9 new unit tests. Resolver: inject from cache; never from cache for a source-built name; never an unsigned cached file; refuse with an actionable message when no copy exists; take a pruned foreign dep from the local repo; a repo-carried pruned dep still warns. Local repo: publish from cache; never publish a source-built package from cache; the foreign wording. The six covering new behaviour that existed at the red run failed before the fix; the unsigned-file test was added afterwards, with the switch to cached_repo_pkg_file, and was not run against the old code.
• Full suite: 7740 passed, 4 skipped. lint, check-standards, check-design, check-shipped and check-surface are clean.
• Checked on the affected host (read-only): cached_repo_artifact("lib32-tdb") returns /var/cache/pacman/pkg/lib32-tdb-1.4.15-1-x86_64.pkg.tar.zst; llvm-libs is classed as source-built and stays out of the cache path. I haven't re-run the lib32-libcanberra build itself yet.

Tier: unit tests only. The precondition, a package installed from a repo that has since dropped it, can't be reproduced against the live mirrors. The pacman cache, the signed-file check and the local repo dir are read for real in the tests; only their inputs are stubbed.

Checklist

• Release-note entry in docs/release-notes/unreleased.md, led by its roadmap ID
• If a user-facing surface changed: make surface committed, and its diff matches what I meant to change (no surface change; check-surface clean)
• If a name was removed or renamed: the old one is in tools/retired_names.toml (none removed)
• The guide for this feature (docs/guides/) still describes it correctly (sandbox.md updated)
• make pre-release (or make ci-local) passes locally (not run; the full suite and the static guards pass)

🤖 Generated with Claude Code