release: 2026.10.26.2 -- ok images, mcpp over mcpplibs.os 0.2.0 (modules/platform removed), argv-named programs, no signal handlers

.agents/docs/README.md

@@ -18,7 +18,7 @@ superseded_by: 2026-09-07-....md  # when status is superseded
 ---
 ```
 
-337 records.
+338 records.
 
 ## By subject
 
@@ -66,6 +66,7 @@ Records that declare one. Everything else is listed by date below.
 
 ### ecosystem
 
+- [生态设计 part 2：openkal 的最小原子与二进制映像、其上的 `mcpplibs.os`，以及 part 1 的收尾与回归记录](2026-10-26-ecosystem-part2-os-library-over-openkal-design.md) — active
 - [控制契约、并发与性能、单一 C++ 运行时，以及 IDE 生态（生态级，#838、#839）](2026-10-26-control-contract-runtime-and-ide-ecosystem-design.md) — active
 
 ### heterogeneous
@@ -143,6 +144,7 @@ Records that declare one. Everything else is listed by date below.
 
 ### 2026-10
 
+- [生态设计 part 2：openkal 的最小原子与二进制映像、其上的 `mcpplibs.os`，以及 part 1 的收尾与回归记录](2026-10-26-ecosystem-part2-os-library-over-openkal-design.md) — active
 - [控制契约、并发与性能、单一 C++ 运行时，以及 IDE 生态（生态级，#838、#839）](2026-10-26-control-contract-runtime-and-ide-ecosystem-design.md) — active
 - [目标基座与执行宿主：sysroot 的通用模型、运行器契约、自备输入，以及同批的发布产物路径（#832）](2026-10-23-target-base-and-execution-host-design.md) — landed
 - [依赖 image 的资源归属、模块扫描边界与锁文件稳定写入](2026-10-21-resource-ownership-module-scan-and-lock-write-design.md) — active

.github/tools/install_pinned_mcpp.sh

@@ -95,4 +95,11 @@ GOT=$("$MCPP" --version 2>/dev/null | head -1 \
   exit 1; }
 echo "bootstrap mcpp: $MCPP ($GOT)" >&2
 
+# The package index the commit builds against is the one published now. The
+# sandbox the caller restored holds the index as it was when that cache was
+# saved, and the pinned mcpp refreshes on a miss only for the root's own
+# [dependencies] (fixed in 2026.10.26.2): a version a path member names --
+# a member's `os = "0.1.0"` -- missed against it with no refresh.
+"$MCPP" index update >&2 || echo "::warning::the bootstrap mcpp could not refresh its package index" >&2
+
 echo "$MCPP"

.github/tools/upgrade_lane.sh

@@ -131,6 +131,31 @@ assert installed.get("revision", 0) == 0, installed
 PY
 fi
 [ "$VARIANT" = orphan ] && { run old-tc-gcc "$W" "$OLD" toolchain install gcc@16.1.0 || fail "the previous release cannot install gcc"; }
+# modules_project <dir>: `openkal.timeout` imports `openkal.datagram`, an
+# INDIRECT import of the program's unit, found at the path its BMI records.
+modules_project() {
+  mkdir -p "$W/$1/src"
+  cat > "$W/$1/mcpp.toml" <<'TOML'
+[package]
+name = "kp"
+version = "0.1.0"
+
+[dependencies]
+openkal = "0.16.0"
+
+[target.linux.dependencies]
+openkal-linux = "0.17.0"
+
+[toolchain]
+default = "gcc@16.1.0"
+TOML
+  printf 'import openkal.timeout;\nint main() { return 0; }\n' > "$W/$1/src/main.cpp"
+}
+if [ "$VARIANT" = modules ]; then
+  run old-tc-gcc "$W" "$OLD" toolchain install gcc@16.1.0 || fail "the previous release cannot install gcc"
+  modules_project m-old
+  run old-modules "$W/m-old" "$OLD" build || fail "the previous release cannot build the module project"
+fi
 new_project p-old "$OLD"
 run old-run "$W/p-old" "$OLD" run || fail "the previous release cannot run a new project"
 
@@ -192,6 +217,18 @@ if [ "$VARIANT" = snapshot ]; then
   grep -q "packaging revision .* available" "$W/new-toolchain-list.log" \
     || fail "toolchain list does not offer the newer packaging"
 fi
+if [ "$VARIANT" = modules ]; then
+  # A BMI of the previous spelling is not read: the dependency is rebuilt
+  # once (its cache key carries the spelling), then served from the cache.
+  modules_project m-new1
+  run new-modules1 "$W/m-new1" "$NEW" build -v || fail "the module project does not build over the previous release's cache"
+  grep -q "STAGE gcm.cache/mcpplibs.openkal/" "$W/new-modules1.log" \
+    && fail "a dependency BMI of the previous spelling was taken from the cache"
+  modules_project m-new2
+  run new-modules2 "$W/m-new2" "$NEW" build -v || fail "the second module project failed"
+  grep -q "STAGE gcm.cache/mcpplibs.openkal/" "$W/new-modules2.log" \
+    || fail "the rebuilt dependency was not served from the cache"
+fi
 if [ "$VARIANT" = orphan ]; then
   run new-provision "$W" "$NEW" toolchain install "$TC" || fail "toolchain install could not replace the payload"
   grep -q "installed asset registration missing" "$W/new-provision.log" \

.github/workflows/ci-aarch64-fresh-install.yml

@@ -31,7 +31,7 @@ on:
     branches: [ main ]
     paths:
       - 'src/build/build_program.cppm'
-      - 'modules/platform/src/process.cppm'
+      - 'src/run/run.cpp'
       - 'tests/e2e/168_build_mcpp_musl_host_static.sh'
       - '.github/workflows/ci-aarch64-fresh-install.yml'
   push:

.github/workflows/ci-linux-e2e.yml

@@ -421,6 +421,11 @@ jobs:
           MCPP_BOOT="$HOME/.xlings/subos/current/bin/mcpp"
           "$MCPP_BOOT" --version
           "$MCPP_BOOT" self config --mirror GLOBAL
+          # The restored ~/.mcpp holds the package index as it was when that
+          # cache was saved; the commit builds against the index as published
+          # (.github/tools/install_pinned_mcpp.sh says why a miss alone did not
+          # refresh it before 2026.10.26.2).
+          "$MCPP_BOOT" index update
           echo "MCPP_BOOT=$MCPP_BOOT" >> "$GITHUB_ENV"
 
       # This job builds its own mcpp on purpose: the build is part of what it

.github/workflows/ci-macos.yml

@@ -84,7 +84,7 @@ jobs:
         run: echo 'APPLE_FLOAT_MACROS=-DINFINITY=HUGE_VALF -DNAN=__builtin_nanf("0x7fc00000")' >> "$GITHUB_ENV"
 
       # THE SDK mcpp'S OWN RESOLUTION NAMES: `xcrun --show-sdk-path`
-      # (modules/platform/src/macos/macos.cppm). These raw compiles state the
+      # (modules/toolchain-model/src/apple_sdk.cpp). These raw compiles state the
       # SDK the same way, on purpose.
       #
       # On the 22.1.8 line this was the known-red spot (mcpp#669 has the

.github/workflows/ci-upgrade.yml

@@ -29,6 +29,7 @@ jobs:
           - { host: linux-x86_64,   runs-on: ubuntu-24.04,     variant: plain }
           - { host: linux-x86_64,   runs-on: ubuntu-24.04,     variant: snapshot }
           - { host: linux-x86_64,   runs-on: ubuntu-24.04,     variant: orphan }
+          - { host: linux-x86_64,   runs-on: ubuntu-24.04,     variant: modules }
           - { host: linux-aarch64,  runs-on: ubuntu-24.04-arm, variant: plain }
           - { host: macos-arm64,    runs-on: macos-15,         variant: plain }
           - { host: windows-x86_64, runs-on: windows-latest,   variant: plain }

CHANGELOG.md

@@ -4,6 +4,172 @@
 > Each `## [<version>]` section is that release's notes. Entries are written in English
 > from 2026.9.28.3 on; earlier entries remain as written.
 
+## [2026.10.26.2] - 2026-10-26
+
+### Added
+
+- **`x86_64-openkal` and `aarch64-openkal`: one ok image per architecture**
+  (openkal SPEC clause 12). The image is compiled for no operating system
+  with the convention's flags, linked by `ld.lld` into an ET_DYN entered at
+  `ok_main` (`bin/<name>.oke`, or `lib<name>.okso` for an image another
+  loads), and published only after `okld note` has written its requirements
+  note and `okld check` has checked it. `okrun` runs it on Linux, macOS and
+  Windows and is the target's runner. Both programs come from the dependency
+  graph: `[build-dependencies] openkal-tools = { tools = ["okld", "okrun"] }`.
+  The C library and the C++ run-time inside an image are packages; the
+  payload's libc++ is not offered to an image.
+  A build that links an image with no `okld` in the graph is refused with
+  the machine-readable reason `image-tool-absent`.
+  The tools a workspace's root package declares are its own, as any root's
+  are.
+  `mcpp pack --mode self-contained` reads the declaration of openkal-tools a
+  build resolves: after workspace inheritance and in the target's
+  `[target.'cfg(os = "openkal")'.build-dependencies]`.
+
+- **A program's beginning can be a dependency's entry target, and a
+  freestanding image states the symbol it is entered at** (#845). A framework
+  declares `[targets.<n>] kind = "entry"` with the translation unit that
+  supplies `main`, and a program selects it with
+  `main = { from = "<dependency>/<entry>" }` in place of a file of its own; a
+  test suite does the same with `[test] main`. The entry is compiled in its
+  package's context with its own flags, linked only into the programs that
+  select it, gated by its `required_features`, and its `windows_entry` is
+  inherited. `start = "<symbol>"` on a program, an entry, a row or `[test]`,
+  and `mcpp:link-start` from a board package's build program (protocol 16),
+  name the ELF entry of a freestanding image; statements that disagree are
+  refused naming each, the symbol must be defined (it was a linker warning and
+  an image entered at address 0), and the build reports it on an `Entry` line
+  and in the result record's `entry`. A file a target names as `main` on any
+  row is no longer linked as an ordinary source on the other rows.
+
+### Changed
+
+- **mcpp keeps no operating-system layer of its own.** `modules/platform` is
+  removed; mcpp reaches the operating system through mcpplibs.os 0.2.0, and
+  what was mcpp's own meaning under that name now lives in the module that
+  owns it: the environment of an invocation in the `invocation` package, the
+  constraints of a run in `mcpp.effects`, every program mcpp starts in
+  `mcpp.run`, the loader environment and the run-time search in
+  `src/runtime`, command-line spelling in `mcpp.build.command_line`, the
+  platform keys and the Apple SDK in `toolchain-model`, the terminal and key
+  input in `src/ui`, the home's lock and trust check in `mcpp.home.files`.
+  The one primitive kept per system is the lock every release of mcpp takes
+  (`src/native/posix`, `src/native/windows`). A program is found on PATH
+  without a shell, with PATHEXT's suffixes on Windows, and the current
+  directory is not searched on Windows. A list of directories in an
+  environment variable (`PATH`, the run-time library path) is read and written
+  with `mcpplibs.os`'s `split_list` and `join_list`: an empty entry is
+  skipped, and a quoted entry on Windows is unquoted.
+- **A program mcpp starts is named by its argument vector.** Compiler probes,
+  git, xlings, tar, strip, patchelf, readelf and vswhere are started without a
+  command interpreter, with their additions to the environment given to them
+  alone; the interpreter runs only commands that are text by nature (a
+  `[hooks]` command, an MSVC environment script, and the command lines mcpp
+  composes and records as text, as ninja's rules are). On Windows the
+  interpreter receives `cmd.exe /d /s /c "<command>"` as one string. Every
+  started program reads an empty standard input unless it is the program
+  `mcpp run` becomes, and runs in a unit that ends with mcpp.
+- **No signal handlers.** A request to end (SIGINT, SIGTERM, SIGHUP, a
+  console's control events) is taken over by mcpplibs.os and read by one
+  watcher thread, which ends the units of the running programs, writes the
+  interrupt files, restores the terminal and ends mcpp as the request would
+  have; the exit codes of §5 are unchanged. A closed standard output ends mcpp
+  in the same order (`mcpp … | head`: 141 to a shell on POSIX). Every program
+  mcpp starts begins with SIGPIPE at its default, although openkal ignores it
+  for its own writes.
+- **mcpp does not write its own process environment.** Variables mcpp states
+  (its home, `--offline`, a hook's variables, xlings' home and PATH) are this
+  invocation's statements, read by every lookup mcpp makes and given to the
+  programs it starts; an xlings invocation's environment is the started
+  program's, on Windows as elsewhere.
+
+### Fixed
+
+- **A dependency upgraded to a cached version replaces the previous version's
+  files.** A package's BMI and objects are staged from the build cache at paths
+  named by the module and the source, not by the cache entry, and staging under
+  `--verify size` took a destination of the source's size as already staged.
+  After an upgrade the previous version's files are at those paths, and a
+  change that keeps their sizes (a constant) left them in place: the program
+  ran the old code, and a unit compiled against the new graph failed with
+  `CRC mismatch` (GCC). A destination that can be read is now compared by
+  content under every mode; an equal size is accepted only for one that cannot
+  be opened (a language server holding it). e2e 948.
+- **A compile whose status could not be written fails at once.** A detached
+  module compile reports its status in `<slot>.rc`, which appears by a rename
+  after the number is written. On a full disk the file appeared empty and the
+  build waited for a number until its two-hour limit; an `.rc` with no number is
+  now a failed unit, said as such.
+- **A WebAssembly link writes its `.wasm` again.** 2026.10.26.1 published every
+  POSIX link through a temporary name, and Emscripten names the file it writes
+  beside the output after the output: a link to `app.js.tmp` wrote no
+  `app.wasm`, the edge's implicit output was missing, and `mcpp pack` of a
+  `wasm32-emscripten` program (mcpp-plugins' `dist-web`) found no stem family.
+  A WebAssembly link is in place, as a PE link is.
+- **A module's indirect import is found whatever map its importer has (GCC).**
+  A unit that reaches another package's module is compiled with a module map,
+  and a unit that imports only the root's modules with GCC's own mapper. A BMI
+  records the paths of its imports as its compile's mapper spelt them, and the
+  map named no repository, so a unit with a map that imported a root module
+  compiled without one looked for that module's import beside the build
+  directory (`failed to read compiled module`, `Bad import dependency`). The
+  map now names the BMI directory as its repository (`$root gcm.cache`) and
+  every path below it, as GCC's own mapper does; the dyndep step reads the
+  same form. The same cause failed `import std.compat` in a unit with a map, in
+  any project with a dependency. A dependency's BMI that an earlier mcpp put in
+  the global build cache spells its imports the earlier way, so the cache key
+  of a package that provides a module under GCC carries the spelling: such a
+  package is compiled once more after the upgrade, and a package of object
+  files keeps its entry.
+- **`mcpp update` moves a branch dependency forward again.** The record of
+  the previous build was replayed although mcpp.lock had been cleared, so the
+  next build kept the old commit and wrote it back. A recorded build is now
+  replayed only under the lock it was planned with.
+- **A git branch reached through another package is locked.** mcpp.lock
+  recorded only the branches the project itself declared, so a branch two
+  edges away moved to its tip on every build and stopped an `--offline` build
+  ("mcpp.lock records no commit for branch"). It is now recorded under the
+  package's qualified name and read back as its anchor.
+- **A root's checkout answers a dependency's request by version that no index
+  carries.** The root's path or git declaration of a package overrides a
+  dependency's request for it by version, but the request was first given to
+  the index to select, and a package the index did not carry yet (a root
+  pinning a checkout ahead of a release) refused the build with "no package
+  found for exact selector". The root's checkout now answers it; a
+  requirement the checkout does not satisfy is still refused.
+- **A build program compiled against an updated interface of the same mcpp
+  version reads the new interface.** The compiled `mcpp` module of build
+  programs was kept by mcpp's version alone, so a build of mcpp between
+  releases that added a directive served the previous interface. It is kept by
+  the version and a digest of its text.
+- **A request by version the local index cannot answer refreshes the index
+  wherever it is in the graph.** The refresh before the dependency walk asked
+  only about the root's and the selected members' `[dependencies]`, so a
+  version named by a path dependency, by a package's own manifest or in a
+  conditional table, and published after the local index was fetched, refused
+  the build ("no package found for exact selector") with no refresh at all.
+  The miss now asks the refresh policy (offline, `[index] auto_refresh`, the
+  debounce, one sync per run) and the selection is made again; a namespace the
+  index cannot refute still never refreshes.
+- **A dependency written `workspace = true` under a target selector or behind
+  a feature receives the workspace's source.** Only `[dependencies]`,
+  `[dev-dependencies]` and `[build-dependencies]` were merged, so a git or path
+  dependency of `[workspace.dependencies]` inherited in
+  `[target.'cfg(...)'.dependencies]` or `[feature-deps.<f>]` kept an empty
+  version and resolved from the index. Such an entry no workspace declares is
+  now refused by name, as one in `[dependencies]` is.
+- **A branch pushed to between `git ls-remote` and the clone is still
+  fetched.** The clone of a branch is one commit deep, so a push between the
+  two left it at a newer tip without the commit the build had resolved, and
+  the build stopped at `unable to read tree`. That commit is now fetched by
+  its name, or, from a server that refuses that, with the branch's history.
+- **Switching workspace members under `trim_paths` no longer recompiles their
+  shared dependencies** (#844). The prefix map of the whole plan was part of
+  the flags every unit shares, so a dependency's command line named the roots
+  of the members being built, and `--release -p cli` then `-p gui` recompiled
+  the common packages each time. A unit's map is now the fixed roots and the
+  roots of its own package's dependency closure.
+
 ## [2026.10.26.1] - 2026-10-26
 
 ### Added

README.md

@@ -454,6 +454,7 @@ list` reports for this machine):
 | `thumbv7em-none-eabi` · `thumbv8m.base-none-eabi` · `thumbv8m.main-none-eabihf` | llvm 23 — Cortex-M4/M7 soft float, M23, M33F/M55F ² | preview |
 | `aarch64-linux-gnu` | `llvm@23.1.3` | preview |
 | `riscv64-linux-musl` · `x86_64-macos` | — | planned |
+| `x86_64-openkal` · `aarch64-openkal` | llvm 23 — an ok image: one artifact per architecture, run by `okrun` on Linux, macOS and Windows; the C library and C++ run-time inside it are packages ([24](docs/24-openkal-cross.md)) | preview |
 | `wasm32-emscripten` | `emsdk@6.0.9` — Emscripten ships its own sysroot and its own libc++ module surface; `mcpp run` executes the module with the `node` the payload declares (`xim:node`), not one found on PATH | verified |
 | `x86_64-linux-android` | `android-ndk@30.0.16248370` — bionic from the NDK, one payload for both ABIs; ran on an API 24 x86_64 emulator image | verified |
 | `aarch64-linux-android` | the same payload and the same build; ran under qemu-user over the system image's own bionic, which the platform emulator cannot do from an x86_64 host | verified |

README.zh-CN.md

@@ -403,6 +403,7 @@ mcpp 的身份模型有两条正交的轴：**工具链**是 `family@version`（
 | `thumbv7em-none-eabi` · `thumbv8m.base-none-eabi` · `thumbv8m.main-none-eabihf` | llvm 23；Cortex-M4/M7 软浮点、M23、M33F/M55F ² | preview |
 | `aarch64-linux-gnu` | `llvm@23.1.3` | preview |
 | `riscv64-linux-musl` · `x86_64-macos` | — | planned |
+| `x86_64-openkal` · `aarch64-openkal` | llvm 23；ok 映像：每种架构一个产物，由 `okrun` 在 Linux、macOS 与 Windows 上运行；映像内的 C 库与 C++ 运行时是包（[24](docs/zh/24-openkal-cross.md)） | preview |
 | `wasm32-emscripten` | `emsdk@6.0.9`；Emscripten 自带 sysroot 与 libc++ 模块接口；`mcpp run` 使用 payload 声明的 `node`（`xim:node`）运行模块，不使用 PATH 上的 `node` | verified |
 | `x86_64-linux-android` | `android-ndk@30.0.16248370`；bionic 来自 NDK，一个 payload 服务两个 ABI；已在 API 24 的 x86_64 模拟器镜像上运行 | verified |
 | `aarch64-linux-android` | 同一个 payload、同样的构建；已在 qemu-user 上配合系统镜像自带的 bionic 运行，平台模拟器无法在 x86_64 宿主上做到这一点 | verified |