fix: incremental rootfs builds so stale archives are never deployed

The deploy failed with "grub-install: command not found" in the chroot —
the installed rootfs archive was built BEFORE the BOOT/grub injection, so
it had no bootloader at all. build-iso.sh / build-image.sh only rebuilt
the rootfs when the archive was missing, never when sources changed, so
development fixes were silently absent from deployed images.

- build-rootfs.sh: incremental staleness check — skips a rebuild only when
  no input (scripts/, btrfs/, overlays/, editions/<e>/, versions.mk,
  toolchain debs) is newer than the artifact; FORCE=1 rebuilds anyway.
- build-iso.sh / build-image.sh: always delegate freshness to
  build-rootfs.sh instead of gating on file existence.
- deploy-disk.sh: defensive check that grub-install exists in the deployed
  rootfs, with a clear "stale archive — rebuild" message instead of a bare
  "command not found".
- docs/building.md: incremental-build note (FORCE=1 / make clean).

docs/building.md

@@ -47,6 +47,13 @@ Everything lands under `build/`:
 
 Each artifact ships with a `.sha256` checksum file.
 
+> **Incremental builds:** `build-rootfs.sh` is incremental — it skips a rebuild
+> when no input (scripts, editions, overlays, versions.mk, toolchain debs) has
+> changed since the last archive, so `make iso-<edition>` only redoes
+> debootstrap when something actually changed. This also means a stale archive
+> can never be deployed: any source change forces a fresh rootfs. Rebuild
+> unconditionally with `FORCE=1 make rootfs-<edition>` (or `make clean`).
+
 ## Disk images & installing
 
 - `make image-<edition>` builds a bootable **qcow2** disk image (the cloud

scripts/build-image.sh

@@ -49,11 +49,8 @@ ARTIFACT="$ARTIFACT_DIR/arcline-$EDITION-$VERSION-$ARCH.$EXT"
 mkdir -p "$IMAGE_DIR/$EDITION" "$ARTIFACT_DIR"
 rm -f "$RAW" "$ARTIFACT" "$ARTIFACT.sha256"
 
-# ── 1. rootfs ───────────────────────────────────────────────────────────────
-if [[ ! -d "$ROOTFS" ]]; then
-  log "rootfs missing — building it first"
-  "$ROOT/scripts/build-rootfs.sh" "$EDITION"
-fi
+# ── 1. rootfs (incremental: build-rootfs skips when inputs are unchanged) ─
+"$ROOT/scripts/build-rootfs.sh" "$EDITION"
 
 # ── 2. sparse raw file + loop device ────────────────────────────────────────
 log "creating ${SIZE} sparse image (edition $EDITION, $BOOT boot)"

scripts/build-iso.sh

@@ -30,14 +30,9 @@ ARTIFACT="$ARTIFACT_DIR/arcline-$EDITION-$VERSION-$ARCH.iso"
 # ── 1. rootfs(es) ───────────────────────────────────────────────────────────
 # The ISO is a live session (built on top of the clean rootfs) and carries the
 # CLEAN rootfs archive as the install source for the graphical installer.
-if [[ ! -d "$CLEAN" ]]; then
-  log "clean rootfs missing — building it first"
-  "$ROOT/scripts/build-rootfs.sh" "$EDITION"
-fi
-if [[ ! -f "$INSTALL_ARC" ]]; then
-  log "clean rootfs archive missing — building it first"
-  "$ROOT/scripts/build-rootfs.sh" "$EDITION"
-fi
+# build-rootfs is incremental (skips when inputs are unchanged) and rebuilds
+# when any input is newer — so a stale archive can never be deployed again.
+"$ROOT/scripts/build-rootfs.sh" "$EDITION"
 "$ROOT/scripts/build-live.sh" "$EDITION"
 
 # ── 2. stage files ──────────────────────────────────────────────────────────

scripts/build-rootfs.sh

@@ -42,6 +42,27 @@ ROOTFS="$ROOTFS_DIR/$EDITION"
 ARTIFACT="$ARTIFACT_DIR/arcline-$EDITION-$VERSION-$ARCH.tar.xz"
 
 mkdir -p "$ROOTFS_DIR" "$LOG_DIR" "$ARTIFACT_DIR"
+
+# ── staleness check ─────────────────────────────────────────────────────────
+# Incremental builds: skip rebuilding when no input changed since the last
+# artifact. This is what makes `make iso-<edition>` fast when nothing changed,
+# AND it catches stale archives during development (the bug class that shipped
+# a rootfs with no grub-install). Force with FORCE=1 or `make clean`.
+newer_input() { # <artifact> → 0 if any input is newer than the artifact
+  local art="$1"
+  [[ -f "$art" ]] || return 0
+  find "$ROOT/scripts" "$ROOT/btrfs" "$ROOT/overlays" "$EDIR" \
+       -type f -newer "$art" -print -quit 2>/dev/null | grep -q . && return 0
+  [[ -d "$DEB_DIR" ]] && find "$DEB_DIR" -name '*.deb' -newer "$art" -print -quit 2>/dev/null | grep -q . && return 0
+  [[ "$ROOT/versions.mk" -nt "$art" ]] && return 0
+  return 1
+}
+
+if [[ "${FORCE:-0}" != "1" && -d "$ROOTFS" && -f "$ARTIFACT" ]] && ! newer_input "$ARTIFACT"; then
+  log "rootfs '$EDITION' is up to date — skipping rebuild ($ARTIFACT)"
+  log "  (FORCE=1 rebuilds anyway)"
+  exit 0
+fi
 rm -rf "$ROOTFS" "$ARTIFACT"
 
 log "═══ building Arcline $EDITION rootfs ($DISTRO_NAME $VERSION) ═══"

scripts/deploy-disk.sh

@@ -138,6 +138,12 @@ mount --bind /sys "$MNT/root/sys"
 # add a swapfile later if you want one — btrfs swapfiles need nocow).
 "$ROOT/scripts/apply-fstab.sh" "$MNT/root" "$EDITION" "$ROOT_UUID" "$EFI_UUID"
 
+# defensive: the deployed rootfs must carry the bootloader. A stale archive
+# from before the BOOT/grub injection has no grub-install at all.
+if ! chroot "$MNT/root" /bin/bash -c 'command -v grub-install >/dev/null 2>&1'; then
+  die "grub-install not found in the deployed rootfs — the rootfs archive is stale; rebuild it (FORCE=1 make iso-$EDITION or make clean)"
+fi
+
 chroot "$MNT/root" /bin/bash -c '
 set -e
 case "$1" in