One C++ runtime per process, the graph and pack facts, bounded offline-aware planning: #646 to #649 (2026.9.16.1)

[Sunrisepeak]

Summary

This pull request implements the engine side of #646, #647, #648 and #649 as one release, 2026.9.16.1. The triage record routes each of the 23 reported items, and 12 further findings from measuring them, to the repository where it belongs. The implementation plan states the review from eight angles, the task ledger with the reading that closes each row, and the refinements found while implementing:

• .agents/docs/2026-09-16-646-649-four-issues-by-home.md (triage record)
• .agents/docs/2026-09-16-646-649-implementation-plan.md (implementation plan)
• .agents/docs/2026-09-16-646-649-probes.sh (probes)

Every new e2e script fails on the released 2026.9.15.2 and passes on this branch; the plan's ledger quotes the failing line of each.

Images and runtimes (#646, #649 E10)

• One process, one C++ runtime (F3a, found while measuring). On ELF, a program over a C++ shared library that the build produces used to carry a static C++ runtime while the library used the shared one. The default llvm build aborted with std::bad_cast. Such programs and tests now take the shared library's contract, and a stated self-contained program is refused as program-cxx-runtime-split. (e2e 700)
• Symbol provision reports real duplicates only (F3b). STB_GNU_UNIQUE is vague linkage. A definition that both images take from one build object, or that the toolchain's own runtime provides for the std module initialiser, is no longer a finding. (e2e 701)
• A static package goes into the shared image that reaches it (F1). A static package reached from several images is refused where the link or load cannot succeed (Mach-O, PE, the Android app row). On other ELF rows it builds as before, with a build/static-placement diagnostic. (e2e 702, 307)
• The llvm row on the MSVC ABI records the static CRT it links (E10 step 1). Measurement legs for C++ identity across Mach-O and PE images print their readings into the job summaries. (e2e 703, 704, 705)

Build programs, the link line and pack (#647 E1-E3, #649 E5, E9)

• mcpp::graph_file(): the root build program reads the resolved graph, with each package's [package.metadata] kept verbatim. The graph's digest re-runs the program when it changes. [package] now reports unknown keys. (e2e 720)
• The link branch is chosen by host and target object format, so an Android row links on a macOS host. (unit LinkShape.*, e2e 721 as its own macOS step)
• mcpp pack strips the program on every stripping row, every shared library the graph built and staged runtime copies. The status line reports what was done, and build programs read the decision. (e2e 722)
• mcpp pack --message-format json prints one mcpp.pack envelope. pack accepts --release and --dev, and every verb shares one profile rule. (e2e 723)

Features, tools and git sources (#647 E4, #649 E6-E8)

• Forwards are validated against every dependency table and row. A [feature-deps] restatement with a different source is refused. dep_bin publishes the qualified name. (e2e 710, 711, 187)
• A package with only program targets contributes nothing to a consumer's graph. Package cycles are refused at resolution (package-cycle), and a tool cycle is refused at its first repetition. (e2e 712)
• A git dependency selects a repository member by identity, and a second declaration merges its requests. (e2e 713)
• --features <dependency>/<feature> is a root forward. (e2e 714)

An editor that plans in the background (#648)

• The index refresh decision walks the resolver's deprecated bare-name rung. A bare compat.* dependency no longer starts a network refresh every two minutes. (e2e 730)
• Children started while planning do not inherit the caller's pipe. (e2e 731)
• xlings children are owned (a process group, or a job object on Windows) and bounded: [index] refresh_timeout for a refresh, an inactivity bound for an install. (e2e 732)
• The envelope's effects report observed network, and an offline plan that needs a download has its own code, MCPP_OFFLINE_DOWNLOAD_REQUIRED. (e2e 733, 735)
• [index] auto_refresh = false governs every implicit refresh. (e2e 734)
• The default mcpplibs artifact is a GLOBAL/CN region object, and existing homes are upgraded in place. With mirror = CN, an index update reaches only GitCode. (e2e 151)

Ecosystem

• fix(publish): the index artifact for a commit is decided once, and both forges serve the pointer's bytes mcpplibs/mcpp-index#432 (merged): the index artifact for a commit is decided once, and both forges serve the pointer's bytes.
• build: spell compat.ftxui and compat.gtest with their namespace openxlings/xlings#597 (merged): the xlings manifest spells compat.ftxui and compat.gtest.
• A per-repo region artifact falls back to git rather than to the other region's base when a pointer fetch fails openxlings/xlings#598 (filed): a per-repo region artifact falls back to git rather than to the other region's base.
• mcpp-community/mcpp-plugins 0.12.0 follows this release (omit_keys, page, the strip decision, rules-swift, library contributions from the graph).

Verification

• Unit tests: the full suite on the integrated branch.
• e2e: every new script, and the full local suite on Linux.
• Docs: style, structure, path-hygiene and version-pin checks.
• CI on this pull request covers the macOS and Windows legs.