2026.9.28.2: one resolver for the runtime beside a Windows program, header tracking on every host, one statement per fact, conditional tables by specificity

[speak-agent]

Summary

The mcpp part of the 2026-09-28 ecosystem design (.agents/docs/2026-09-28-ecosystem-design-and-optimisation-plan.md, tasks M1 to M9; the review it answers is .agents/docs/2026-09-28-ecosystem-review-of-two-days-of-mcpp-and-xlings.md). Closes #728 and #729; completes the runtime-placement half of #718.

• WS1: one resolver for the files beside a Windows program (src/build/runtime_placement.cppm, SPEC-006 §3.7.1). Declared outranks toolchain, toolchain outranks derived. The MSVC C++ runtime is one versioned set, read from VERSIONINFO: the toolset's set unless a search directory offers the complete set at a strictly newer version (then that set, with a note); a dependency's copy that is not placed is stated once as a packaging fault; a declared runtime file older than the toolset's is a warning; an unreadable version decides nothing. The contract governs the kind: toolchain-coupled carries, host-coupled places none and refuses a declared copy (crt-declared-under-host-coupled). The plan, place-dlls (--crt, --toolset-crt) and mcpp pack read one answer; resolution.json records it.
• WS1, D3: the action PATH. Every action of an MSVC-ABI build has the toolset's runtime directory first on PATH (__action --path-prepend), so a host tool that a dependency ships without a runtime (Qt's moc.exe) starts.
• WS2: header tracking on every host. A GNU depfile for every GNU-dialect compiler on every host; GCC's module depfile on Windows is filtered by mcpp depfile-filter, which runs the compile and needs no shell.
• WS3: one statement per fact. mcpp.diag prints once per process; notes are a severity; a word inherited from [workspace.build] is attributed there; an edge's success-time statements go to .mcpp-advice/<stamp>.advice and are reported once, by one function called on the full and the fast path (SPEC-007 R4.5).
• D7 (SPEC-004 says matching conditional tables apply in manifest order; the implementation applies them in selector text order #728): conditional tables by specificity (modules/manifest/src/cfg_selector.cppm, SPEC-004 §3.1.1).
• WS8: defaults stated once. mcpp self env --format json reports defaultToolchain; check_default_toolchain_docs.py checks the tables of docs/01 and docs/20 against it on each CI host.
• WS7 (CI: the LLVM toolchain job reports success while mcpp's self-build with llvm@20.1.7 fails #729): CI integrity. check_workflow_assertions.py (W1 pipefail, W2 discarded status, W3 known-red with its issue) reports 7 problems on origin/main and none here; the LLVM self-build uses llvm@22.1.8 under pipefail, with the function-size gate after it.
• WS10: the release as a gate. Release canaries that the tag job needs (release-canaries.yml), tests/release/verify-published.sh, and this pull-request template.
• Measurement (design §2.9): measure-windows-tool-crt.yml hides the system's C++ runtime and measures whether Qt's moc.exe and lrelease.exe, from a payload without a runtime copy, start from the action PATH alone, on a Visual Studio row and a bare row with a managed toolset. It gates the qt-base change in xim-pkgindex.

The xlings pin moves to 2026.9.28.2 (openxlings/xlings#628) once that release is published.

Criteria

Change	Criterion	Before (2026.9.28.1)	After	Where
WS1 resolver	unit RuntimePlacement.* property test over kinds, versions and contracts; PE reader on synthesised images	not built	pass	every host
WS1 place-dlls	e2e 819 L1 to L6 (synthesised PE files)	L6 is the old behaviour; L1 to L5 have no --crt	pass	every host
WS1, WS3	e2e 818 criterion 5: a prepare-filled directory's differing DLL is stated once without -v	0 statements	1	Linux, locally measured
WS1 on Windows	e2e 820 W1 to W7	not measurable before (the resolver did not exist)	pass: toolset MSVC 14.51.36231 (VS 2026) on the LLVM row, older and newer synthesised sets, host-coupled, the refusal, pack, the action PATH, the five-member workspace	Windows e2e shard 1
D3	e2e 820 W6; the measurement workflow (run 36361809507), system runtime hidden, payload copy removed	the tools do not start as actions of 2026.9.28.1 (M-c)	moc.exe and lrelease.exe start as actions (M-b), on the Visual Studio row (14.51.36231) and the masked row (managed msvc@14.44.35207); neither starts directly (M-a)	Windows
WS2	e2e 118 asserts the rebuild on every host	the Windows row asserted only the degradation message (no depfile)	pass, clang leg included	Windows e2e shard 1
D7	unit ConditionalOrder.*; the sandbox section #728	fails under lexical order	pass	every host
WS8	test_check_default_toolchain_docs.py; the docs check on each host row	no defaultToolchain	pass	Linux, macOS, Windows, bare Windows
WS7	test_check_workflow_assertions.py; the lint on origin/main	7 problems	0	Linux static checks
WS10	verify-published.sh rehearsed against the candidate binaries	n/a	24 ok; 3 failures, all expected until the xlings pin moves or a known open issue (see below)	host rehearsal

| WS3 | e2e 821: an edge's advice on the full and the fast path | fails at A1 | pass (the fast path on Linux; macOS reads the full path, #400) | Linux, macOS |
| D3, R3.8 | e2e 799 D: --path-prepend before a declared PATH | unknown option | pass | Linux, macOS |

Sandbox readings (the previous pair and the new xlings). verify-published.sh in fresh SubOS with the CN mirror: mcpp 2026.9.28.1 with xlings 2026.9.28.1, 15 ok, 12 failed (every failure a section this round adds); mcpp 2026.9.28.1 with the published xlings 2026.9.28.2, 20 ok, 7 failed (the seven mcpp items). The new pair is read after the release.

Found in CI and fixed on this branch. A stale unit expectation (the place-dlls command carries --crt), which a filtered local run had not run; e2e 780, which recognised a check by the __action-stamp spelling while every MSVC-ABI action now uses the named wrapper (each action re-runs once after the upgrade, now in the CHANGELOG); e2e 821's fast-path criterion, which holds on Linux only (#400); and three harness defects of the measurement workflow.

The rehearsal's three failures: the registry xlings and the registry's .xlings-home wait for the xlings pin; an escape-sequence check was too broad and found a pre-existing defect in the sub-index build scripts' progress (openxlings/xlings#629), so the check now reads the download lines and reports the build-script frames as a reading.

Intersections

New rule or feature	Invariant it crosses	Test at the crossing
CRT placed by set rule	one destination, one writer (SPEC-007 R4.3, #723)	e2e 811, 818 criteria 1 to 4, 819 L2
CRT placed by set rule	mcpp pack places what the build placed	e2e 820 W5
host-coupled refuses a declared CRT	a declared deploy is placed as declared (R4.2)	e2e 820 W4
action PATH prepend	an action's env PATH is its own (R3.8)	unit NinjaBackendPeRuntime.EveryActionOfAWindowsTargetHasTheToolsetRuntimeOnPath (the graph); e2e 799 D (the wrapper: before a declared PATH, before the inherited one otherwise; fails on 2026.9.28.1)
action PATH prepend on the MSVC ABI	an action's command line survives an upgrade (the __action-stamp spelling)	none before CI; e2e 780 found it on the Windows row. The detector accepts both spellings, and the one re-run per action after the upgrade is in the CHANGELOG and the cli.cppm comment
depfile on Windows	the fast path replays the last graph	e2e 118 (a second build after the edit)
diag once per process	--strict counts every degradation	unit Diag.*
edge advice	the fast path reports what the full path reports	e2e 821 A1 to A3 (an action's advice file, on the full path, on the fast path, and not again; fails on 2026.9.28.1 at A1); e2e 818 criterion 6
D7 order	list values append in application order	unit ConditionalOrder.AMoreSpecificTableAppliesLater

Compatibility

• A Windows program whose runtime search directories hold an older copy of the MSVC C++ runtime now receives the toolset's copy; the difference is a note, once, instead of a warning per link.
• A manifest that declares an MSVC C++ runtime file under host-coupled is refused.
• Where several conditional tables match one target and the lexical and the specificity order differ, a scalar's value and the order of list values change.
• A Windows project compiled with a GNU-dialect compiler gains the depfile flags; the first build after the upgrade rebuilds fully.

Checks before merging

• bash .github/tools/check_docs_style.sh, check_docs_structure.sh and check_version_pins.sh pass.
• python3 .github/tools/check_workflow_assertions.py passes.
• No commit on the branch carries an attribution trailer.
• The squash merge is given an explicit subject and body.