fix(build): a package's generated inputs come before its compiles; an empty link is refused (2026.8.30.1) (#536)

* fix(build): a package's generated inputs come before its compiles; an empty link is refused (2026.8.30.1)

Three defects, one change of mind about evidence. Each of them was a place
where something answered "is this ready?" from a proxy instead of from the
artifact.

── mcpp#534: `role = "source"` did not order a generated header ─────────────

The engine's own comment claimed ordering needed no special handling because
"a Source action's outputs ARE the compile edge's inputs". That is true of a
generated `.cpp` and false of a generated `.h`: a header is reached through
`-I`, never appears as an edge input, and the depfile that would record it does
not exist until a compile has already succeeded.

So an action whose outputs were all headers had a node in build.ninja that
nothing could reach — not `default` (Source outputs are excluded on purpose),
not the goal phony (objects and link outputs only), and no consuming edge. It
never ran. The issue was filed as an intermittent race; it is deterministic,
and five consecutive builds reproduce it identically. What made it look like a
race is that `prepare_actions` wrote a zero-byte placeholder for every declared
Source output, headers included — so the file was on disk whether or not the
generator had run.

  * `BuildAction` records the package that declared it, spelled the same way
    `CompileUnit::packageName` is (`qualified_package_name`, now exported so
    the two cannot drift).
  * Each package that declares a gating action gets one phony over its outputs,
    and every compile edge of that package takes it as an order-only
    prerequisite. Per package, not per build: `include_dir` colours only the
    declaring package's own TUs, and a build-wide edge would express a
    dependency that does not exist while landing on the critical path.
  * `check_action_ordering` scans the emitted manifest and fails the build if
    any such edge is missing one — including the denominator, because "every
    edge that should carry it does" is vacuously true when none does, which was
    exactly the previous state. Seven call sites append the string today; being
    careful at seven sites is not a mechanism.
  * `blocking` on a `check` now does what it has been documented to do since it
    was introduced. It was typed, emitted over the build-program protocol,
    parsed, documented in two languages and demonstrated in a shipped example —
    and read by nothing.
  * Placeholders are no longer written for outputs that are not translation
    units. The scan never reads a header, and the empty file only ever turned
    "the generator did not run" into "the header is empty".

── mcpp#533: an empty link unit, reported as a shell error ──────────────────

A dependency whose `install()` was skipped over a package-identity collision
left a version directory with no sources. mcpp planned its shared library
anyway and the user was shown `/bin/sh: 1: -shared: not found`.

  * A link unit with no inputs is refused at plan time, naming the target. The
    static case is why this is an error rather than a better linker message:
    `ar rcs` with no members exits 0 and writes an 8-byte archive, so the build
    REPORTED SUCCESS and every consumer failed later with undefined symbols.
  * `cc` is emitted unconditionally, for the reason `c_ldflags` twenty-six
    lines below already carried (mcpp#426). The rule had been written down for
    one variable of `c_link`/`c_shared` and not for the other.
  * `check_rule_commands_name_a_program` scans the manifest for the class: a
    rule's command must begin with a program. Deliberately not the more obvious
    "no undefined variables" — ninja's empty expansion is a feature several
    rules rely on (`$soname_flag`, `$unit_ldflags`), and that check would have
    needed an allowlist of exceptions.
  * `.mcpp_ok` is no longer written from the installer's exit code plus the
    existence of a directory the installer creates before doing any work. It
    now requires one entry that neither mcpp nor xlings wrote. Withheld rather
    than fatal, because a package may legitimately install no payload.
  * The same predicate runs on the fast path, so a store already poisoned by
    this bug heals on the next build instead of requiring the user to know
    which directory to delete.
  * The lib-root warning asked `has_lib_target` — "does this produce a library"
    — when the property it wants is "is this a C++ module library". A
    source-built C package warned that `src/<name>.cppm` was missing in every
    consumer's build.

── Tests ───────────────────────────────────────────────────────────────────

e2e 314 (a dependency generating its only header), 315 (blocking gates the
compile, non-blocking does not), 316 (empty shared AND static targets refused;
a populated one still builds). All three were run against the pre-fix binary
and all three fail there, so they discriminate rather than describe.

Unit: 14 new cases over the two emitter guards, the ordering denominator, and
the install-marker evidence — including the poisoned-store heal.

Analysis and cross-repo plan: .agents/docs/2026-08-30-*.md

Refs #533, #534

* chore(xlings): raise the floor to 2026.8.30.2 — the store-identity fix

openxlings/xlings#576, released as v2026.8.30.2. Below this version xlings
answers "is this package already installed" from the xvm version database keyed
on the bare short name, so a package skips its own `install()` whenever any
other namespace holds the same `<name>@<version>`.

This is a FLOOR and not a preference, which is the whole reason the pin has the
shape it does. The mcpp side of #533 makes the resulting failure legible on any
client — the link unit is refused by name, and `.mcpp_ok` is withheld from a
directory holding nothing the package installed — but only a client at or above
this version INSTALLS correctly.

⚠️ This does NOT authorise an index change. Publishing a deliberately colliding
`<name>@<version>` stays unsafe until the floor is adopted, not merely
released, and .agents/docs/2026-08-30-cross-repo-fix-plan-532-533-534.md §6.2
recommends not doing it at all: the fix is for the collisions people hit by
accident, which is already 20 short names wide on a real store.

`src/xlings/xlings.cppm` is the source of truth; the seven copies under
.github/ follow it and `check_version_pins.sh` enforces the agreement.

Also records what landed against the plan (§12), including two things the plan
had wrong: the xlings anchor was 167 commits stale and the call site had moved,
and `⚠` is CI-governed in xlings while it is merely conventional here.

---------

Co-authored-by: speak-agent <x.d2learn.org@gmail.com>

Author: Sunrisepeak

.agents/docs/2026-08-30-cross-repo-fix-plan-532-533-534.md

@@ -25,7 +25,7 @@ inputs:
     # `package.name`, so one of the two was simply unreachable — and which one
     # depended on the machine, which is why CI failed on `compat:lua` on
     # Windows and `mcpplibs.capi:lua` on Linux. Never pin below that.
-    default: '2026.8.27.5'
+    default: '2026.8.30.2'
   cache-target:
     description: also restore/save target/ (build artifacts + BMIs)
     required: false

.agents/docs/2026-08-30-issues-532-533-534-analysis.md

@@ -15,7 +15,7 @@ inputs:
     # Floor imposed by the index, not a routine bump — see
     # .github/actions/bootstrap-mcpp/action.yml for why 0.4.69 is required
     # (two packages named `lua` in one repo need openxlings/xlings#381).
-    default: '2026.8.27.5'
+    default: '2026.8.30.2'
 
 runs:
   using: composite

.github/actions/bootstrap-mcpp/action.yml

@@ -17,7 +17,7 @@ jobs:
       # Dormant (workflow_dispatch only), but kept in step with the rest —
       # check_version_pins.sh holds it there. Floor: 0.4.69, below which the
       # index cannot resolve two packages that share a short name.
-      XLINGS_VERSION: '2026.8.27.5'
+      XLINGS_VERSION: '2026.8.30.2'
     steps:
       - uses: actions/checkout@v4
 

.github/actions/setup-macos-llvm/action.yml

@@ -152,7 +152,7 @@ jobs:
         env:
           XLINGS_NON_INTERACTIVE: '1'
         run: |
-          curl -fsSL https://raw.githubusercontent.com/openxlings/xlings/main/tools/other/quick_install.sh | bash -s v2026.8.27.5
+          curl -fsSL https://raw.githubusercontent.com/openxlings/xlings/main/tools/other/quick_install.sh | bash -s v2026.8.30.2
           echo "$HOME/.xlings/subos/current/bin" >> "$GITHUB_PATH"
 
       - name: Install mcpp and config mirror
@@ -293,7 +293,7 @@ jobs:
 
       - name: Install xlings + mcpp
         run: |
-          curl -fsSL https://raw.githubusercontent.com/openxlings/xlings/main/tools/other/quick_install.sh | bash -s v2026.8.27.5
+          curl -fsSL https://raw.githubusercontent.com/openxlings/xlings/main/tools/other/quick_install.sh | bash -s v2026.8.30.2
           # Deliberately NOT writing to $GITHUB_PATH here. On container
           # images that declare no PATH in their config (opensuse/
           # tumbleweed), appending a single dir to GITHUB_PATH makes the
@@ -364,7 +364,7 @@ jobs:
           #             (older ones carry minos=15 and refuse to start).
           #   v0.4.51+: in-process sha256 — this image has no sha256sum
           #             binary, so pinned fetches failed before it.
-          curl -fsSL https://raw.githubusercontent.com/openxlings/xlings/main/tools/other/quick_install.sh | bash -s v2026.8.27.5
+          curl -fsSL https://raw.githubusercontent.com/openxlings/xlings/main/tools/other/quick_install.sh | bash -s v2026.8.30.2
           echo "$HOME/.xlings/subos/current/bin" >> "$GITHUB_PATH"
 
       - name: Install mcpp and config mirror

.github/workflows/bootstrap-macos.yml

@@ -237,7 +237,7 @@ jobs:
 
       - name: Bootstrap xlings + released mcpp
         run: |
-          curl -fsSL https://raw.githubusercontent.com/openxlings/xlings/main/tools/other/quick_install.sh | bash -s v2026.8.27.5
+          curl -fsSL https://raw.githubusercontent.com/openxlings/xlings/main/tools/other/quick_install.sh | bash -s v2026.8.30.2
           export PATH="$HOME/.xlings/subos/current/bin:$PATH"
           xlings update
           xlings install mcpp -y -g

.github/workflows/ci-fresh-install.yml

@@ -122,7 +122,7 @@ jobs:
           # release assets were uploaded in a broken state (records present,
           # blobs missing → 404 on GET); re-uploaded clean. The stale-INDEX
           # half is handled by the marker-clear below.
-          XLINGS_VERSION: '2026.8.27.5'
+          XLINGS_VERSION: '2026.8.30.2'
         run: |
           tarball="xlings-${XLINGS_VERSION}-linux-x86_64.tar.gz"
           bash "$GITHUB_WORKSPACE/.github/tools/fetch_release.sh" \
@@ -263,7 +263,7 @@ jobs:
       - name: Bootstrap mcpp via xlings
         env:
           XLINGS_NON_INTERACTIVE: '1'
-          XLINGS_VERSION: '2026.8.27.5'
+          XLINGS_VERSION: '2026.8.30.2'
         run: |
           tarball="xlings-${XLINGS_VERSION}-linux-x86_64.tar.gz"
           bash "$GITHUB_WORKSPACE/.github/tools/fetch_release.sh" \

.github/workflows/ci-linux-e2e.yml

@@ -96,7 +96,7 @@ jobs:
           # Pin xlings to a known-good version. The upstream install
           # script always grabs `latest` (no version override), so we
           # download + self-install manually to avoid broken releases.
-          XLINGS_VERSION: '2026.8.27.5'
+          XLINGS_VERSION: '2026.8.30.2'
         run: |
           if [ ! -x "$HOME/.xlings/subos/default/bin/xlings" ]; then
             tarball="xlings-${XLINGS_VERSION}-linux-x86_64.tar.gz"
@@ -289,7 +289,7 @@ jobs:
       - name: Bootstrap mcpp via xlings
         env:
           XLINGS_NON_INTERACTIVE: '1'
-          XLINGS_VERSION: '2026.8.27.5'
+          XLINGS_VERSION: '2026.8.30.2'
         run: |
           tarball="xlings-${XLINGS_VERSION}-linux-x86_64.tar.gz"
           bash "$GITHUB_WORKSPACE/.github/tools/fetch_release.sh" \
@@ -360,7 +360,7 @@ jobs:
           # below are pinned to the same version as XLINGS_VERSION; they are
           # NOT interpolated from it, so check_version_pins.sh scans for them
           # explicitly (they were absent from the old lock-step comment).
-          XLA="xlings-2026.8.27.5-linux-aarch64.tar.gz"
+          XLA="xlings-2026.8.30.2-linux-aarch64.tar.gz"
           # NOT fetch_release.sh: this asset is OPTIONAL and the `if` is the
           # point — an arch with no prebuilt xlings must fall through quietly,
           # while the helper retries a 404 five times before giving up. The one
@@ -369,9 +369,9 @@ jobs:
           # cover it.
           if curl -fsSL --retry 3 --retry-delay 2 --retry-all-errors \
                --connect-timeout 20 --max-time 600 -o "/tmp/$XLA" \
-               "https://github.com/openxlings/xlings/releases/download/v2026.8.27.5/$XLA"; then
+               "https://github.com/openxlings/xlings/releases/download/v2026.8.30.2/$XLA"; then
             tar -xzf "/tmp/$XLA" -C /tmp
-            XLBIN=$(find /tmp/xlings-2026.8.27.5-linux-aarch64 -path '*/bin/xlings' -type f | head -1)
+            XLBIN=$(find /tmp/xlings-2026.8.30.2-linux-aarch64 -path '*/bin/xlings' -type f | head -1)
             if [ -n "$XLBIN" ]; then
               mkdir -p "$STAGING/$WRAPPER/registry/bin"
               cp "$XLBIN" "$STAGING/$WRAPPER/registry/bin/xlings"
@@ -449,7 +449,7 @@ jobs:
       - name: Bootstrap mcpp via xlings
         env:
           XLINGS_NON_INTERACTIVE: '1'
-          XLINGS_VERSION: '2026.8.27.5'
+          XLINGS_VERSION: '2026.8.30.2'
         run: |
           if [ ! -x "$HOME/.xlings/subos/default/bin/xlings" ]; then
             WORK=$(mktemp -d)
@@ -632,7 +632,7 @@ jobs:
         shell: bash
         env:
           XLINGS_NON_INTERACTIVE: '1'
-          XLINGS_VERSION: '2026.8.27.5'
+          XLINGS_VERSION: '2026.8.30.2'
         run: |
           # Captured before the `cd` below, in POSIX form: this step never
           # returns to the workspace, and GITHUB_WORKSPACE is a backslash

.github/workflows/cross-build-test.yml

@@ -311,14 +311,27 @@ attach:
 
 | `role` | Outputs | Ordering | Typical |
 |---|---|---|---|
-| `source` | join the compile set | the compile edge consumes them | protoc, a transpiler |
-| `check` | a stamp file, written by mcpp | runs **alongside** compilation (set `blocking = true` to gate it) | clang-tidy, a format or ABI check |
+| `source` | compilable ones join the compile set; the rest are produced but not compiled | **every compile edge of the declaring package waits for them** | protoc, a transpiler, a protocol/IDL generator |
+| `check` | a stamp file, written by mcpp | runs **alongside** compilation; `blocking = true` makes the package's compile edges wait for it | clang-tidy, a format or ABI check |
 | `object` | join the **link** set | the link edge consumes them | a resource compiler, `objcopy` embedding a blob, a generated `.def`, a pre-built `.o` |
 | `artifact` | a new file | its *inputs* are link outputs, so it runs after the link | codesign, packaging, size budgets |
 
-No phase machinery is involved: ninja's own file dependencies do the
-sequencing, which is also why an `artifact` action cannot double-apply itself
-the way a naive "post-build hook" would.
+No phase machinery is involved. `object` and `artifact` are sequenced by
+ninja's own file dependencies — which is also why an `artifact` action cannot
+double-apply itself the way a naive "post-build hook" would. `source` and a
+blocking `check` are sequenced by an order-only edge from the declaring
+package's compile edges to that package's action outputs.
+
+> **Why `source` needs the edge (mcpp 2026.8.30.2+).** A generated `.cpp`
+> becomes an input of the edge that compiles it, so it was ordered for free. A
+> generated **header** never does: it is reached through `-I`, and the depfile
+> that would record it does not exist until a compile has already succeeded.
+> Before this, an action whose outputs were all headers had a node in
+> `build.ninja` that nothing could reach — not `default`, not the goal set, no
+> consuming edge — so it never ran, and what the compiler read was the empty
+> placeholder mcpp writes for a declared output. The ordering is **per
+> package**, because `include_dir` colours only the declaring package's own
+> translation units.
 
 **A check's command does not have to write its stamp** (mcpp 2026.8.29.1+).
 The verdict is the exit code; the stamp is bookkeeping the graph needs, and