feat(runtime): 运行期搜索闭包 —— SubOS 库视图进 DT_RPATH,末位

mcpp 在编译与链接两条线上都发 --sysroot=<subos>,所以 subos 提供的库零 flag 就能
解析。运行期的搜索路径却是另一套独立推导(只有工具链载荷目录)。同一个决策
「subos 是我的根」推导了两次,而第二次的输入集合小了一整个库视图:

  $ mcpp build            rc=0
  $ ./bin/app             libGL.so.1: cannot open shared object file  (127)
  $ mcpp why runtime      validation: pass                            ← 假绿

新增 mcpp.platform.runtime_search:一条搜索目录的来源、次序、是否机器本地。
放 platform/ 是因为它描述的是加载器怎么搜(物理),而 elf_runtime 必须读它 ——
放 build/ 会让 platform 反向依赖 build。它只 import std,四个消费者共读一份。

次序 = 不可变性递减,farm 在最后。载荷目录装一次不再动,<subos>/lib 每次
xlings install 都重写。载荷在前 ⇒ libc/libm/libstdc++ 永远从被 pin 的载荷解析,
farm 只补没人提供的;farm 在前 ⇒ 一次安装能在事后换掉一个已链接产物的 libc。
今天 farm 的 libc.so.6 就是指向那个载荷的符号链接,所以两种次序行为相同 ——
这正是它必须被写下来并断言的理由。

假绿是独立缺陷,且必须先修:resolve_needed 搜完 rpath 后回落到宿主默认目录,
而宿主通常自带 libGL.so.1 ⇒ 模型认为解析到了。但产物跑在私有加载器下,它的默认
路径里没有宿主目录 —— 模型模拟的是宿主加载器,产物用的是私有加载器。现在宿主
默认目录只在非 hermetic binding 下参与。

第四种判决 Unresolvable:hermetic 下一个解析不到的 DT_NEEDED 是可证的失败
(整条搜索路径由 mcpp 算出,没有 ld.so.cache 兜底),把它归到 Inconclusive 是
把可证的事说成没查过。失败门改问 verdict.blocking(),而不是枚举状态。

护栏两条,与加载器标签契约同一判据:非 ELF 不发(Mach-O/PE 没有这个概念),
交叉目标不发(farm 属于宿主 subos)。

farm 不进 linkIntent.runtimeSearchDirs —— 那个字段会流向 runtimeLibraryDirs,
再变成 mcpp run 的 LD_LIBRARY_PATH,污染它拉起的每个子进程包括宿主二进制。
farm 只按对象可达(DT_RPATH),这是上一轮图形设计里明确立下的规矩。

载荷目录向发出它们的同一个函数要(resolve_link_model(...).libDirs):
plan.toolchain.linkRuntimeDirs 只有 clang 会填,第一版记录只有一条 farm 而产物
DT_RPATH 有三条 —— 记录与产物不一致,正是这套东西要消灭的形状。

不读 $XLINGS_SUBOS_LIB。实测它指向当前 shell 的 subos,而 mcpp 有自己的
registry home,两者由不同物理 glibc 载荷支撑 —— 继承它等于给产物挂第二套 libc。
改为主动声明 XLINGS_SUBOS_LD_PATHS=0(xlings#540 的退出),今天是无操作。

观测:resolution.json 的 runtime.search.closure(保序,带 origin 与
machine_local),mcpp why runtime 按加载器次序打印。

测试:219 断言产物 DT_RPATH 末位是 farm、首位载荷目录真的有 libc,并要求记录与
产物逐条一致;220 从「farm 有而载荷没有」的差集里取一个库,--no-as-needed 让它
成为 DT_NEEDED,然后真的 exec —— 只有跑起来才能戳破假绿,因为宿主也有 libGL;
另一半用一个 SONAME 谁都提供不了的库断言构建变红并指名。215 的机器本地前缀从
data/xpkgs 扩到整个 mcpp home(farm 在 registry/subos 下,原来会漏过去),并补
--mode system 档 —— 它是唯一不重写 rpath 的档,此前没有任何用例检查过它。

Author: speak-agent

src/build/flags.cppm

@@ -17,6 +17,7 @@ import mcpp.build.plan;
 import mcpp.manifest.types;
 import mcpp.modgraph.scanner;
 import mcpp.platform;
+import mcpp.platform.runtime_search;
 import mcpp.toolchain.clang;
 import mcpp.toolchain.detect;
 import mcpp.toolchain.dialect;
@@ -503,6 +504,26 @@ CompileFlags compute_flags(const BuildPlan& plan) {
     }();
     const std::string link_intent_ld =
         render_link_intent_flags(plan.linkIntent, linkIntentFlavor);
+
+    // The SubOS farm tail — the only origin in `plan.runtimeSearch` with no
+    // other producer, appended after everything else so it is LAST in the
+    // artifact's DT_RPATH (see `runtime_search_closure`).
+    //
+    // RUNPATH ONLY, never `-L`. Link-time resolution already works: mcpp
+    // passes `--sysroot=<subos>`, which makes `<subos>/lib` the linker's
+    // default library directory. Emitting `-L` as well would be redundant on
+    // a link line that has a hard 128KiB ceiling real workspaces already spend
+    // 43% of. This is the same rule `runtimeSearchDirs` states for package
+    // dirs, applied to the origin that needed it most.
+    std::string farm_ld;
+    if (linkIntentFlavor == LinkIntentFlavor::Elf) {
+        for (auto const& dir : plan.runtimeSearch) {
+            if (dir.origin != mcpp::platform::search::Origin::SubosFarm) continue;
+            farm_ld += ' ';
+            farm_ld += shell_quote_arg(escape_ninja_chars(
+                "-Wl,-rpath," + dir.path.string()));
+        }
+    }
     std::filesystem::path binutilsBin;
     if (!isMuslTc && !isMingwTc && caps.stdlib_id == "libstdc++") {
         auto ar = mcpp::toolchain::archive_tool(plan.toolchain);
@@ -972,9 +993,9 @@ CompileFlags compute_flags(const BuildPlan& plan) {
         // actually being present (see atomic_link_flag).
         std::string atomic_ld = atomic_link_flag(plan.toolchain.linkRuntimeDirs,
                                                  !full_static.empty());
-        f.ld = std::format("{}{}{}{}{}{}{}{}{}", full_static,
+        f.ld = std::format("{}{}{}{}{}{}{}{}{}{}", full_static,
                            link_toolchain_flags, b_flag, runtime_dirs,
-                           link_intent_ld, atomic_ld, payload_ld,
+                           link_intent_ld, farm_ld, atomic_ld, payload_ld,
                            user_ldflags, link_extra);
     }
 

src/build/ninja_backend.cppm

@@ -37,7 +37,7 @@ import mcpp.toolchain.detect;
 import mcpp.toolchain.dialect;
 import mcpp.toolchain.provider;
 import mcpp.toolchain.registry;
-import mcpp.xlings;
+import mcpp.platform.xlings;
 import mcpp.platform;
 import mcpp.ui;
 
@@ -1791,7 +1791,11 @@ std::expected<BuildResult, BuildError> NinjaBackend::build(const BuildPlan& plan
         for (auto const& checked : runtimeReport.artifacts) {
             using Status = mcpp::platform::elf::RuntimeVerdict::Status;
             auto explanation = checked.verdict.explain();
-            if (checked.verdict.status == Status::ProvenMismatch) {
+            // `blocking()` rather than a state list: a proven payload mismatch
+            // and a DT_NEEDED the artifact's own loader will never find are
+            // both "this artifact is known bad", and enumerating them here is
+            // how one of them gets forgotten.
+            if (checked.verdict.blocking()) {
                 if (runtimeFailure.empty()) {
                     runtimeFailureArtifact = checked.artifact;
                     runtimeFailure = std::move(explanation);
@@ -1807,7 +1811,7 @@ std::expected<BuildResult, BuildError> NinjaBackend::build(const BuildPlan& plan
         }
         if (!runtimeFailure.empty()) {
             return std::unexpected(BuildError{
-                "runtime closure validation failed (proven Linux ELF mismatch)",
+                "runtime closure validation failed (proven Linux ELF defect)",
                 runtimeFailureArtifact, std::move(runtimeFailure)});
         }
         // Rule E — the loader-tag contract, checked on what actually landed

src/build/plan.cppm

@@ -16,11 +16,13 @@ import mcpp.toolchain.cppfly;
 import mcpp.toolchain.detect;
 import mcpp.toolchain.dialect;
 import mcpp.toolchain.fingerprint;
+import mcpp.toolchain.linkmodel;
 import mcpp.toolchain.triple;
 import mcpp.platform;
 import mcpp.platform.runtime_binding;
 import mcpp.platform.runtime_env_contract;
-import mcpp.xlings.subos_info;
+import mcpp.platform.runtime_search;
+import mcpp.platform.xlings.subos_info;
 
 export namespace mcpp::build {
 
@@ -202,6 +204,22 @@ struct BuildPlan {
     std::vector<mcpp::manifest::RuntimeRequirement> runtimeRequirements;
     std::vector<mcpp::manifest::RuntimeArtifact>    runtimeArtifacts;
     mcpp::manifest::LinkIntent                      linkIntent;
+    // The complete run-time search closure of the artifacts this plan will
+    // produce, in loader order and tagged with where each directory came from
+    // (`mcpp.platform.runtime_search`).
+    //
+    // This is the RECORD — what resolution.json publishes and `mcpp why
+    // runtime` explains. Emission is still owned by each origin's existing
+    // producer (payloads by the toolchain link model, package dirs by
+    // LinkIntent), with one exception: SubosFarm entries have no other
+    // producer, so `flags.cppm` renders them from here, appended last.
+    //
+    // ⚠️ The farm deliberately does NOT enter `runtimeLibraryDirs`. That
+    // vector becomes LD_LIBRARY_PATH for `mcpp run`, which is inherited by
+    // every child process including host binaries — measured to kill
+    // `xdg-open`/`notify-send` outright when a private libc is on it. The farm
+    // is reachable PER OBJECT (DT_RPATH) and must stay that way.
+    std::vector<mcpp::platform::search::Dir>        runtimeSearch;
     // Windows runtime-DLL deployment. On PE (`supports_rpath` is false) a
     // directly-launched .exe cannot RUNPATH-locate a dependency's DLL, so each
     // *.dll found in a dependency's [runtime] library_dir is copied beside the
@@ -233,6 +251,13 @@ void merge_runtime_binding_contract(
     BuildPlan& plan,
     const mcpp::platform::runtime::RuntimeBinding& binding);
 
+// The run-time search closure for this plan, in loader order and tagged with
+// provenance. Exported so a test can exercise the guards (cross target, non-ELF
+// format, undeclared SubOS) without linking a binary for each.
+std::vector<mcpp::platform::search::Dir> runtime_search_closure(
+    const BuildPlan& plan,
+    const mcpp::platform::runtime::RuntimeBinding& binding);
+
 // Is `p` inside one of `roots`, judged LEXICALLY?
 //
 // Lexical is the whole point (mcpp#344). std::filesystem::relative() runs
@@ -621,6 +646,76 @@ ResolvedRuntimeContract resolve_runtime_contract(
     return out;
 }
 
+// The run-time search closure of everything this plan will link, in the order
+// the loader will consult it, tagged with where each directory came from.
+//
+// ONE assembly, three producers. Payload directories come from the toolchain
+// link model, package directories from the resolved LinkIntent, and the SubOS
+// farm from the RuntimeBinding — and the farm is the addition that closes the
+// gap this whole change exists for: mcpp already passes `--sysroot=<subos>` on
+// the compile AND link lines, so `-lGL` resolves out of `<subos>/lib` with no
+// flags from the user, while the RUN-time path was derived from payload
+// directories alone. Link succeeded, the artifact could not start.
+//
+// FARM LAST, and it is the only invariant here. `<subos>/lib` is a symlink
+// view rewritten by every `xlings install`; payload directories are written
+// once and never touched. Payload-first keeps libc / libm / libstdc++ resolving
+// from the pinned payload and leaves the farm to supply only what nothing else
+// does. Farm-first would let a later install silently change which libc an
+// ALREADY LINKED artifact loads. `search::ordered` is what enforces it, and
+// e2e 219 asserts it on the produced ELF rather than on this code.
+std::vector<mcpp::platform::search::Dir> runtime_search_closure(
+    const BuildPlan& plan,
+    const mcpp::platform::runtime::RuntimeBinding& binding) {
+    using mcpp::platform::search::Dir;
+    using mcpp::platform::search::Origin;
+
+    // PAYLOAD DIRECTORIES COME FROM THE SAME FUNCTION THAT EMITS THEM.
+    //
+    // `resolve_link_model` is a pure function of the toolchain and is what
+    // `flags.cppm` renders as `-L`/`-Wl,-rpath` for the C runtime; asking it
+    // here is how the record and the artifact stay the same list. Deriving
+    // them a second way is what made the first version of this record show a
+    // one-entry closure while the artifact carried three — `linkRuntimeDirs`
+    // is populated for CLANG ONLY, so on GCC it is simply empty and the
+    // payloads arrive through the link model instead.
+    //
+    // Both are read, in the order `flags.cppm` concatenates them.
+    std::vector<Dir> closure;
+    for (auto const& dir : mcpp::toolchain::resolve_link_model(plan.toolchain).libDirs)
+        closure.push_back({dir, Origin::Payload});
+    for (auto const& dir : plan.toolchain.linkRuntimeDirs)
+        closure.push_back({dir, Origin::Payload});
+    for (auto const& dir : plan.linkIntent.runtimeSearchDirs)
+        closure.push_back({dir, Origin::Package});
+
+    // TWO GUARDS, both about "will this artifact ever run here".
+    //
+    //   format   DT_RPATH exists on ELF only. Mach-O and PE get nothing rather
+    //            than a branch in every consumer — the same shape
+    //            `loader_contract` uses for the tag half of this contract.
+    //   host     The farm belongs to THIS host's SubOS. A cross target
+    //            (aarch64-musl, mingw, wasm) would receive a path that is inert
+    //            at best and points at the wrong architecture's libraries at
+    //            worst.
+    const auto triple = [&] {
+        auto t = mcpp::toolchain::triple::parse(plan.toolchain.targetTriple);
+        return t ? *t : mcpp::toolchain::triple::Triple{};
+    }();
+    const bool elfTarget = triple.empty()
+        ? bool(mcpp::platform::is_linux)
+        : (triple.os != "macos" && triple.os != "windows");
+    const bool hostTarget = binding.platform == "linux"
+        && (triple.empty()
+            || (triple.os == "linux"
+                && (triple.arch.empty() || triple.arch == binding.arch)));
+    if (elfTarget && hostTarget)
+        for (auto const& dir : binding.searchDirs)
+            closure.push_back({dir, Origin::SubosFarm});
+
+    return mcpp::platform::search::ordered(std::move(closure));
+}
+
 void merge_runtime_binding_contract(
     BuildPlan& plan,
     const mcpp::platform::runtime::RuntimeBinding& binding) {
@@ -676,6 +771,8 @@ void merge_runtime_binding_contract(
             }))
             plan.runtimeArtifacts.push_back(std::move(value));
     }
+
+    plan.runtimeSearch = runtime_search_closure(plan, binding);
 }
 
 // True if `src` defines a top-level `int main(` / `auto main(` entry point.

src/build/runtime_validation.cppm

@@ -38,10 +38,13 @@ struct ValidatedArtifact {
 struct ValidationReport {
     std::vector<ValidatedArtifact> artifacts;
 
-    bool has_proven_mismatch() const {
+    // Any artifact PROVEN bad — payloads mixed, or a DT_NEEDED that the
+    // artifact's own loader will not find. Asks the verdict rather than
+    // enumerating states here, so a fifth state cannot be added without this
+    // gate deciding what it means.
+    bool has_blocking_failure() const {
         return std::ranges::any_of(artifacts, [](auto const& artifact) {
-            return artifact.verdict.status
-                == mcpp::platform::elf::RuntimeVerdict::Status::ProvenMismatch;
+            return artifact.verdict.blocking();
         });
     }
 };
@@ -150,16 +153,35 @@ std::string status_name(mcpp::platform::elf::RuntimeVerdict::Status status) {
     switch (status) {
         case Status::Pass: return "pass";
         case Status::ProvenMismatch: return "proven_mismatch";
+        case Status::Unresolvable: return "unresolvable";
         case Status::Inconclusive: return "inconclusive";
     }
     return "inconclusive";
 }
 
+// How bad each state is, for rolling many artifacts into one summary.
+// `Unresolvable` sits above `Inconclusive` (it is proven, not unknown) and
+// below `ProvenMismatch` (mixing payloads is the more fundamental error, and
+// it is usually the CAUSE of anything unresolvable alongside it).
+int status_severity(mcpp::platform::elf::RuntimeVerdict::Status status) {
+    using Status = mcpp::platform::elf::RuntimeVerdict::Status;
+    switch (status) {
+        case Status::Pass:           return 0;
+        case Status::Inconclusive:   return 1;
+        case Status::Unresolvable:   return 2;
+        case Status::ProvenMismatch: return 3;
+    }
+    return 1;
+}
+
 mcpp::platform::elf::RuntimeVerdict::Status
 parse_status(std::string_view value) {
     using Status = mcpp::platform::elf::RuntimeVerdict::Status;
     if (value == "pass") return Status::Pass;
     if (value == "proven_mismatch") return Status::ProvenMismatch;
+    if (value == "unresolvable") return Status::Unresolvable;
+    // Anything unknown reads as `inconclusive`, never as `pass`: a record
+    // written by a newer mcpp must not be mistaken for a clean bill of health.
     return Status::Inconclusive;
 }
 
@@ -273,8 +295,10 @@ void sync_resolution_verdict(const mcpp::build::BuildPlan& plan,
             if (!it.value().is_object()) continue;
             any = true;
             auto status = parse_status(it.value().value("status", "inconclusive"));
-            if (status == Status::ProvenMismatch
-                || (status == Status::Inconclusive && summary == Status::Pass))
+            // Worst wins, by an explicit severity order rather than a chain of
+            // pairwise comparisons that has to be re-derived every time a
+            // state is added.
+            if (status_severity(status) > status_severity(summary))
                 summary = status;
             checked.push_back({
                 {"path", (plan.outputDir / it.key()).lexically_normal().generic_string()},

src/cli.cppm

@@ -30,6 +30,7 @@ import mcpp.pm.commands;
 import mcpp.toolchain.fingerprint;   // MCPP_VERSION
 import mcpp.wire;
 import mcpp.platform.env;            // --offline → MCPP_OFFLINE
+import mcpp.platform.runtime_search; // linker-wrapper path-injection opt-out
 import mcpp.ui;
 import mcpp.log;
 
@@ -114,6 +115,28 @@ int run(int argc, char** argv) {
         // it makes `MCPP_OFFLINE=1` and `--offline` literally the same switch.
         else if (a == "--offline") mcpp::platform::env::set("MCPP_OFFLINE", "1");
     }
+    // Decline xlings' linker-wrapper path injection, for this process and
+    // everything it spawns (openxlings/xlings#540).
+    //
+    // That wrapper appends `-rpath "$XLINGS_SUBOS_LIB"` to every link it sees.
+    // mcpp wants the TAG half of what it does and must refuse the PATH half:
+    // `$XLINGS_SUBOS_LIB` names the ACTIVE SHELL's SubOS, which is measurably
+    // not the one mcpp resolved — mcpp keeps its own xlings home under
+    // `<mcpp home>/registry`, so on an ordinary developer machine the variable
+    // points at a different farm backed by a DIFFERENT PHYSICAL glibc payload.
+    // Inheriting it would put a second libc on the artifact's search path,
+    // which is the one thing rule B exists to prevent. mcpp emits its own farm
+    // entry, derived from the binding it actually selected.
+    //
+    // Set here rather than per link command: the link line has a hard 128KiB
+    // ceiling that real workspaces already spend 43% of, and children inherit
+    // the environment for free. Declared BEFORE the wrapper ships, because
+    // "the exit must be declared, not inferred" is the rule that whole
+    // negotiation established — today this is a no-op.
+    mcpp::platform::env::set(
+        std::string(mcpp::platform::search::kLinkerPathInjectionOptOut),
+        std::string(mcpp::platform::search::kLinkerPathInjectionOptOutValue));
+
     // Env override (observability, esp. CI): MCPP_VERBOSE=<non-empty, not "0">
     // turns on verbose logging for EVERY mcpp invocation — including the ones
     // nested inside e2e test scripts that call $MCPP without flags. Lets a

src/doctor.cppm

@@ -35,7 +35,7 @@ import mcpp.toolchain.registry;
 import mcpp.toolchain.stdmod;
 import mcpp.toolchain.abi;
 import mcpp.ui;
-import mcpp.xlings;
+import mcpp.platform.xlings;
 
 namespace mcpp::doctor {
 
@@ -281,6 +281,9 @@ export int doctor_report() {
             } else if (stored->verdict.status == Status::Inconclusive) {
                 warn(std::format("{}: inconclusive{}{}", subject,
                     detail.empty() ? "" : "\n", detail));
+            } else if (stored->verdict.status == Status::Unresolvable) {
+                err(std::format("{}: unresolvable runtime closure{}{}", subject,
+                    detail.empty() ? "" : "\n", detail));
             } else {
                 err(std::format("{}: proven mismatch{}{}", subject,
                     detail.empty() ? "" : "\n", detail));
@@ -677,6 +680,22 @@ int print_stored_runtime_resolution() {
             search->value("format", "?"), search->value("link_library", "?"),
             search->value("transitive_needed", "?"),
             search->value("runtime", "?"));
+        // The closure IN ORDER, with where each directory came from. Order is
+        // the answer to "why does my GL program find its driver" and to "why
+        // is my libc still the pinned one" — both invisible when the report
+        // says only which mechanism is used.
+        if (auto closure = search->find("closure");
+            closure != search->end() && closure->is_array() && !closure->empty()) {
+            std::println("  runtime search closure (loader order):");
+            for (auto const& dir : *closure) {
+                if (!dir.is_object()) continue;
+                std::println("    {:<12} {}{}",
+                    dir.value("origin", "?"), dir.value("path", "?"),
+                    dir.value("machine_local", false) ? "  [machine-local]" : "");
+            }
+            std::println("    note: the mutable SubOS farm is LAST on purpose — "
+                         "libc stays pinned to its payload");
+        }
     }
     if (auto validation = runtime->find("validation");
         validation != runtime->end() && validation->is_object()) {