fix(plan): farm 的护栏补上 libc 轴,并且「不匹配」必须是被证明的

原护栏只看 os + arch。x86_64-linux-musl 两者都对得上,于是一个 glibc farm 会落到
musl 程序的搜索路径上 —— 正是 rule B 在防的载荷混用。今天那个目标是 static
(实测:根本没有 dynamic section,flag 是惰性的),所以这是为它不再是 static 的那天准备的。

⚠️ 第一版把「未声明」当成了「不匹配」:没有 subos_info 的 SubOS 没有 runtimeId,
于是它自己的库视图被拒绝了 —— e2e 220 的 half 0 当场变红。这是本次改动在别处正在
消灭的那个错误的又一次现形:**缺席不是矛盾**。改为只有两边都说了话且说的不一样才算
不匹配;任一侧未知,就交给 os/arch 护栏决定。

补一张护栏矩阵单测(host / 换 arch / 换 libc / 换格式 / 未声明),因为逐条端到端
验证每一格都要一整套交叉工具链,而它防的失败是静默的。

Author: speak-agent

src/build/plan.cppm

@@ -694,18 +694,38 @@ std::vector<mcpp::platform::search::Dir> runtime_search_closure(
     //   format   DT_RPATH exists on ELF only. Mach-O and PE get nothing rather
     //            than a branch in every consumer — the same shape
     //            `loader_contract` uses for the tag half of this contract.
-    //   host     The farm belongs to THIS host's SubOS. A cross target
-    //            (aarch64-musl, mingw, wasm) would receive a path that is inert
-    //            at best and points at the wrong architecture's libraries at
-    //            worst.
+    //   host     The farm belongs to THIS host's SubOS, and a SubOS is a
+    //            (os, arch, libc) triple's worth of libraries. A cross target
+    //            must match all three or the path is inert at best and points
+    //            at the wrong architecture's — or the wrong C library's —
+    //            objects at worst. `x86_64-linux-musl` is the case that makes
+    //            the libc axis load-bearing: same OS, same arch, and a glibc
+    //            farm on a musl program's search path is exactly the payload
+    //            mixing rule B exists to prevent. (Today that target is also
+    //            `linkage = "static"`, so the flag is inert — measured: no
+    //            dynamic section at all. The guard is for the day it is not.)
     const auto triple = [&] {
         auto t = mcpp::toolchain::triple::parse(plan.toolchain.targetTriple);
         return t ? *t : mcpp::toolchain::triple::Triple{};
     }();
     const bool elfTarget = triple.empty()
         ? bool(mcpp::platform::is_linux)
         : (triple.os != "macos" && triple.os != "windows");
+    // The binding names its libc as `<family>@<version>`; the triple names it
+    // as an ABI env (`gnu` ⇒ glibc). A MISMATCH must be PROVEN, not assumed:
+    // an undeclared SubOS has no runtime identity at all, and refusing its own
+    // library view because it did not describe itself would be the same
+    // absence-read-as-contradiction this change exists to remove. Unknown on
+    // either side ⇒ no evidence of a mismatch ⇒ the os/arch guards decide.
+    const auto bindingLibcFamily =
+        binding.runtimeId.substr(0, binding.runtimeId.find('@'));
+    const auto targetLibcFamily = triple.env.empty()
+        ? std::string{} : (triple.env == "gnu" ? "glibc" : triple.env);
+    const bool libcMismatch = !bindingLibcFamily.empty()
+        && !targetLibcFamily.empty()
+        && targetLibcFamily != bindingLibcFamily;
     const bool hostTarget = binding.platform == "linux"
+        && !libcMismatch
         && (triple.empty()
             || (triple.os == "linux"
                 && (triple.arch.empty() || triple.arch == binding.arch)));

tests/unit/test_runtime_contract.cpp

@@ -9,6 +9,7 @@ import mcpp.modgraph.scanner;
 import mcpp.platform;
 import mcpp.platform.axis;
 import mcpp.platform.runtime_binding;
+import mcpp.platform.runtime_search;
 import mcpp.platform.xlings.subos_info;
 
 namespace build = mcpp::build;
@@ -277,6 +278,8 @@ TEST(RuntimeContract, XlingsSelectedFactsPrecedeDescriptorFallbacks) {
     });
 
     build::merge_runtime_binding_contract(plan, binding);
+    ASSERT_EQ(plan.runtimeSearch.size(), 0u)
+        << "a binding with no SubOS library view contributes no farm entry";
     ASSERT_EQ(plan.runtimeProviders.size(), 2u);
     EXPECT_EQ(plan.runtimeProviders.front().provider.canonical(),
               "xim.selected@4.0.0");
@@ -287,3 +290,74 @@ TEST(RuntimeContract, XlingsSelectedFactsPrecedeDescriptorFallbacks) {
 }
 
 }  // namespace
+
+// ── the farm's two guards, as a matrix ─────────────────────────────────────
+//
+// The farm belongs to THIS host's SubOS, so it may only reach an artifact that
+// will run here under this runtime. The guards are asserted directly because
+// each one costs a full cross toolchain to exercise end to end, and the failure
+// they prevent is silent: a path that is inert at best, and points at another
+// architecture's or another C library's objects at worst.
+namespace {
+
+build::BuildPlan plan_for(std::string targetTriple) {
+    build::BuildPlan plan;
+    plan.toolchain.targetTriple = std::move(targetTriple);
+    return plan;
+}
+
+mcpp::platform::runtime::RuntimeBinding host_binding_with_farm() {
+    mcpp::platform::runtime::RuntimeBinding b;
+    b.platform = "linux";
+    b.arch = "x86_64";
+    b.declared = true;
+    b.runtimeId = "glibc@2.39";
+    b.searchDirs = {"/home/u/.mcpp/registry/subos/default/lib"};
+    return b;
+}
+
+std::size_t farm_entries(const std::vector<mcpp::platform::search::Dir>& dirs) {
+    return static_cast<std::size_t>(std::ranges::count_if(dirs, [](auto const& d) {
+        return d.origin == mcpp::platform::search::Origin::SubosFarm;
+    }));
+}
+
+}  // namespace
+
+TEST(RuntimeSearchClosure, HostTargetGetsTheFarm) {
+    EXPECT_EQ(farm_entries(build::runtime_search_closure(
+        plan_for(""), host_binding_with_farm())), 1u);
+    EXPECT_EQ(farm_entries(build::runtime_search_closure(
+        plan_for("x86_64-linux-gnu"), host_binding_with_farm())), 1u);
+}
+
+TEST(RuntimeSearchClosure, CrossTargetGetsNoFarm) {
+    // Another architecture: the farm holds x86_64 objects.
+    EXPECT_EQ(farm_entries(build::runtime_search_closure(
+        plan_for("aarch64-linux-gnu"), host_binding_with_farm())), 0u);
+    // Another C library: a glibc farm on a musl program's search path is the
+    // payload mixing rule B exists to prevent.
+    EXPECT_EQ(farm_entries(build::runtime_search_closure(
+        plan_for("x86_64-linux-musl"), host_binding_with_farm())), 0u);
+    // Another format: DT_RPATH does not exist there at all.
+    EXPECT_EQ(farm_entries(build::runtime_search_closure(
+        plan_for("x86_64-windows-gnu"), host_binding_with_farm())), 0u);
+    EXPECT_EQ(farm_entries(build::runtime_search_closure(
+        plan_for("aarch64-macos"), host_binding_with_farm())), 0u);
+}
+
+// A MISMATCH must be proven, not assumed. An undeclared SubOS has no runtime
+// identity, and refusing its own library view on that basis would be exactly
+// the absence-read-as-contradiction this release removes elsewhere. Caught by
+// e2e 220, which builds against a SubOS it creates and which therefore has no
+// `subos_info` to declare anything.
+TEST(RuntimeSearchClosure, UndeclaredBindingStillGetsItsOwnFarm) {
+    auto b = host_binding_with_farm();
+    b.declared = false;
+    b.runtimeId.clear();
+    EXPECT_EQ(farm_entries(build::runtime_search_closure(plan_for(""), b)), 1u);
+    // …but the architecture guard still applies: unknown libc is not a licence
+    // to ignore everything else.
+    EXPECT_EQ(farm_entries(build::runtime_search_closure(
+        plan_for("aarch64-linux-gnu"), b)), 0u);
+}