E5: the fast path serves on macOS, Windows and SDK-sysroot targets; three e2e made portable (#734)

The runtime validation holds ELF/glibc rules and returned before writing its
record on every other target, so the project fast path found no validated
artifact snapshot there and every build was planned in full (read on the
macOS row: e2e 645, 831 and 832). Where no rule applies, each artifact's stamp
is now recorded with a Pass verdict, which is the module's definition of Pass;
a relinked artifact still sends the fast path to the full build.

e2e 827 no longer uses GNU stat, 828 no longer uses GNU sed -i, and 646 accepts
the destination in the placement list when the program has two or more
placements (a Windows program places its C++ runtime as well).

Author: speak-agent

.agents/docs/2026-09-28-build-cost-foreign-toolsets-and-library-surface-design.md

@@ -1235,6 +1235,13 @@ Each item has an e2e:
       graph's text changed. The backend now moves the file's time when it
       confirms the graph (e2e 832).
     Under `-v` each refusal is a sentence rather than the code of its condition.
+11. **E5's reading, and its fix.** On the macOS row every build declined with
+    "no validated artifact snapshot is recorded for this build". The runtime
+    validation holds ELF/glibc rules only and returned before writing its
+    record on every other target, so the fast path never found a snapshot to
+    compare. Where no rule applies the record is now written with a Pass verdict
+    (the module's own definition: every rule that applies held); a relinked
+    artifact still sends the fast path to the full build.
 
 **mcpp-plugins 0.17.0.** U1 to U4 on one branch (`feat/734-plugins-0.17.0`).
 

CHANGELOG.md

@@ -57,7 +57,10 @@ SPEC-007 §9 与新的 SPEC-008。配套的 mcpp-plugins 0.17.0 以本版本为
 - **包的版本下限(E9)。** `[package] mcpp = ">=<release>"` 与 `[workspace.package] mcpp`;
   低于下限的引擎在其他工作之前停止,写出升级命令;只接受 `>=`。
 - **`[lib]` 报告未知键(E12)。** 此前拼错的 `path` 被静默接受。
-- **快路径说明拒绝原因(E5 的测量部分)。** `-v` 下每个拒绝点以一句话写出其条件。
+- **快路径在 macOS、Windows 与自带 sysroot 的目标上生效(E5)。** 运行期校验只含 ELF/glibc 规则,在这些目标上
+  提前返回而不写校验记录,快路径因此找不到已校验的产物快照,每次构建都走完整路径(macOS 上 e2e 645、831、
+  832 读出 `no validated artifact snapshot is recorded`)。现在这些目标记录产物的戳记,判定为通过(没有适用的
+  规则);产物被重新链接时快路径仍交回完整路径。`-v` 下每个拒绝点以一句话写出其条件。
 
 ### 兼容性
 

src/build/runtime_validation.cppm

@@ -600,18 +600,57 @@ ArtifactSnapshot snapshot_link_artifacts(const mcpp::build::BuildPlan& plan) {
     return out;
 }
 
+// THE RECORD WITHOUT THE RULES (#734 E5). The rules below are ELF/glibc
+// rules, and on every other target none of them applies: that is a Pass by
+// this module's own definition ("every rule that applies was checked and
+// held"). The record is still written, because the project fast path replays
+// a build only against a validated snapshot of its artifacts; before this,
+// no record was written on macOS, Windows or an SDK-sysroot target, and every
+// build there was planned in full (e2e 645, 831 and 832 on the macOS row: "no
+// validated artifact snapshot is recorded for this build").
+void record_without_rules(const mcpp::build::BuildPlan& plan,
+                          const ArtifactSnapshot& before) {
+    auto doc = read_cache(plan.outputDir);
+    bool changed = false;
+    if (doc.value("schema", 0) != 1
+        || doc.value("contract_hash", "") != plan.runtimeBinding.contractHash) {
+        doc = nlohmann::json::object();
+        changed = true;
+    }
+    doc["schema"] = 1;
+    doc["contract_hash"] = plan.runtimeBinding.contractHash;
+    for (auto const& [artifact, oldStamp] : before) {
+        auto now = stamp(artifact);
+        if (!now.exists) continue;
+        const auto key = cache_key(plan, artifact);
+        const auto fp  = fingerprint(artifact, now, plan.runtimeBinding.contractHash);
+        if (auto a = doc.find("artifacts"); a != doc.end() && a->is_object())
+            if (auto e = a->find(key); e != a->end() && e->is_object()
+                && e->value("fingerprint", "") == fp && e->value("status", "") == "pass")
+                continue;
+        ValidatedArtifact v;
+        v.artifact = artifact;
+        v.verdict.status = mcpp::platform::elf::RuntimeVerdict::Status::Pass;
+        store_artifact(doc, key, fp, v);
+        changed = true;
+    }
+    if (changed) write_cache(plan.outputDir, doc);
+}
+
 ValidationReport validate_changed_artifacts(
     const mcpp::build::BuildPlan& plan,
     const ArtifactSnapshot& before) {
     ValidationReport report;
-    if constexpr (!mcpp::platform::is_linux) return report;
+    if constexpr (!mcpp::platform::is_linux) { record_without_rules(plan, before); return report; }
     // Provider dispatch (see mcpp.runtime.binding): what follows is
     // ELF/glibc physics, and an identity from another provider — `ucrt@…` on
     // Windows — has no rules here rather than a missing glibc.
     if (plan.runtimeBinding.platform != "linux"
         || mcpp::platform::runtime::runtime_provider(
-               plan.runtimeBinding.runtimeId) != "glibc")
+               plan.runtimeBinding.runtimeId) != "glibc") {
+        record_without_rules(plan, before);
         return report;
+    }
 
     // AND THE ARTIFACT HAS TO BE ONE THAT COULD LOAD ON THIS MACHINE.
     //
@@ -638,8 +677,10 @@ ValidationReport validate_changed_artifacts(
     // decision in the tree is right about it except the ones that mean "this
     // machine".
     if (auto tt = mcpp::toolchain::triple::parse(plan.toolchain.targetTriple);
-        tt && tt->has_own_sysroot())
+        tt && tt->has_own_sysroot()) {
+        record_without_rules(plan, before);
         return report;
+    }
 
     auto doc = read_cache(plan.outputDir);
     bool changedCache = false;

tests/e2e/646_runtime_deploy_places_files_in_a_directory.sh

@@ -125,11 +125,22 @@ write_manifest '{ from = "assets/icd2/lvp_icd.json", to = "vulkan/icd.d" }'
 grep -q 'library_path' "$bin/vulkan/icd.d/lvp_icd.json" 2>/dev/null \
     || fail "the merged destination does not carry the shared bytes" merge.log
 G=$(find target -name build.ninja | head -1)
-STAGE_LINES=$(grep -c "^build .*vulkan/icd\.d/lvp_icd\.json : stage_file" "$G" 2>/dev/null || true)
-[ "$STAGE_LINES" -eq 1 ] \
-    || fail "expected exactly one stage_file edge, found $STAGE_LINES" "$G"
-grep "^build .*vulkan/icd\.d/lvp_icd\.json : stage_file" "$G" | grep -qF "icd2/lvp_icd.json" \
-    || fail "the merged edge does not list the root's second source" "$G"
+# One placement is its own `stage_file` edge; two or more (a Windows program
+# also places its C++ runtime DLLs) are one `stage_list` edge reading
+# placements.list (#734 E4). Either way the destination has both sources.
+if grep -q "^build .*vulkan/icd\.d/lvp_icd\.json.* : stage_list" "$G"; then
+    LIST="$(dirname "$G")/placements.list"
+    n=$(grep -c "bin/vulkan/icd\.d/lvp_icd\.json$" "$LIST" || true)
+    [ "$n" -eq 2 ] || fail "expected the destination twice in the placement list, found $n" "$LIST"
+    grep "bin/vulkan/icd\.d/lvp_icd\.json$" "$LIST" | grep -qF "icd2/lvp_icd.json" \
+        || fail "the placement list does not name the root's second source" "$LIST"
+else
+    STAGE_LINES=$(grep -c "^build .*vulkan/icd\.d/lvp_icd\.json : stage_file" "$G" 2>/dev/null || true)
+    [ "$STAGE_LINES" -eq 1 ] \
+        || fail "expected exactly one stage_file edge, found $STAGE_LINES" "$G"
+    grep "^build .*vulkan/icd\.d/lvp_icd\.json : stage_file" "$G" | grep -qF "icd2/lvp_icd.json" \
+        || fail "the merged edge does not list the root's second source" "$G"
+fi
 echo "identical-bytes merge OK"
 
 # ── 4. A destination outside the executable's directory ───────────────────

tests/e2e/827_many_placements_run_as_one_process.sh

@@ -62,13 +62,13 @@ after=$(grep -c "placements\|data/f" "$OUT/.ninja_log" || true)
 [ "$before" = "$after" ] || fail "S2: a build with no placement change ran the placement edge" "$OUT/.ninja_log"
 
 # S3
-t2=$(stat -c %Y "$DEST2")
+touch -r "$DEST2" s3.ref   # a reference file, since the stat options differ between GNU and BSD
 sleep 1.1
 echo changed > data/f1.txt
 touch src/main.cpp
 "$MCPP" build > s3.log 2>&1 || fail "S3: the build failed" s3.log
 grep -qx changed "$DEST1" || fail "S3: the changed source did not arrive" "$DEST1"
-[ "$(stat -c %Y "$DEST2")" = "$t2" ] || fail "S3: an unchanged destination was rewritten" s3.log
+[ -z "$(find "$DEST2" -newer s3.ref)" ] || fail "S3: an unchanged destination was rewritten" s3.log
 
 # S4
 program 1

tests/e2e/828_a_library_states_its_interface.sh

@@ -58,7 +58,7 @@ cat >> mcpp.toml <<'EOF'
 [lib]
 path = "src/flatlib.cppm"
 EOF
-sed -i 's|sources = \["src/alpha.cppm", "src/beta.cppm"\]|sources = ["src/flatlib.cppm", "src/alpha.cppm", "src/beta.cppm"]|' mcpp.toml
+sed 's|sources = \["src/alpha.cppm", "src/beta.cppm"\]|sources = ["src/flatlib.cppm", "src/alpha.cppm", "src/beta.cppm"]|' mcpp.toml > mcpp.toml.new && mv mcpp.toml.new mcpp.toml   # BSD sed has no bare -i
 printf 'export module probe.flatlib;\nexport import Alpha;\nexport import Beta;\n' > src/flatlib.cppm
 "$MCPP" pack flatlib > i2.log 2>&1 || fail "I2: the pack failed" i2.log
 grep -q "does not ship" i2.log && fail "I2: W2 appeared with a facade" i2.log