feat(compat): the farm carries only what its runtime can reach, and a moved pin is carried down the chain (#383)

Three farms move to 2026.09.11 and the consumers that pin them move with them:
compat.glfw 3.4.0.1, compat.opencl 2026.09.11, compat.vulkan 1.4.357.2,
compat.sycl-runtime 2026.09.11. An installed copy records the pin it resolved
with, so every link in sycl-runtime -> opencl -> opencl-runtime needs its own
key or the farm at the end never arrives.

`libnvidia-pkcs11*` leaves both farms, and the OpenSSL declaration it was the
only reason for leaves with it. It is a PKCS#11 token module, loaded by an
application's own configuration and by nothing in a GPU driver's dispatch; it
was in the farm because its name matched `libnvidia*.so.*`. Measured with
`LD_DEBUG=libs` AND A CONTROL: `pkcs11` appears zero times on both the Vulkan
and the SYCL/OpenCL run, while `libnvidia-glvkspirv` appears six times and the
OpenCL adapter twenty-three -- so the zero is a reading rather than a silence.
An earlier criterion -- remove the member, see whether the example still runs --
measured nothing: removing glvkspirv left the example working too, because the
binary under test and the farm being edited were different objects.

Three defects that only appear when the code is executed:

  * `never_farm_patterns` was iterated and then ignored: the loop bound `pat`
    and passed a literal `libnvidia-gtk*`, so the table read like a list and
    behaved like one entry. Adding pkcs11 to it did nothing at all.
  * `readelf -d` is not transitive, so one round does not close the farm. The
    pass this replaced asked `ldd`, whose answer is the whole closure. Measured
    on glx-runtime's first real install: 52 members became 77 and were still
    nine sonames short, `libLLVM.so.20.1` and `libstdc++.so.6` among them. Now
    iterated to a fixed point, bounded so a cycle cannot spin.
  * a missing `readelf` returned an empty answer, which reads exactly like a
    closed farm. It warns now, and glx-runtime's tool lookup reaches the xim
    store before PATH.

Measured on this host, with the driver: glx-runtime 86 members, 0 gaps, and NO
direct host reach -- four entries route through xim:nvidia-gl-host-link,
twenty-four through other xim payloads, the rest through the subos view. The
SYCL example records members 49, walked 49, no findings; the Vulkan example 56,
56, no findings; both compute the right answer on an RTX 4080.

Author: Sunrisepeak

CHANGELOG.md

@@ -7,6 +7,48 @@
 
 ## [Unreleased]
 
+### Changed
+
+- **farm 只携带这个 runtime 够得到的东西,并且把「一个钉挪动」这件事在整条链上补齐。**
+  三个 farm(`compat.glx-runtime` / `compat.opencl-runtime` / `compat.vulkan-runtime`)
+  一起到 2026.09.11,消费者链 `compat.glfw` 3.4.0.1、`compat.opencl` 2026.09.11、
+  `compat.vulkan` 1.4.357.2、`compat.sycl-runtime` 2026.09.11 同步。
+
+  ⭐ **剔掉 `libnvidia-pkcs11*`,并撤回它带来的 OpenSSL 依赖。** 它是加密令牌模块,
+  由应用自己的 PKCS#11 配置加载,不由任何 GPU 驱动派发;进 farm 只因为名字匹配
+  `libnvidia*.so.*`。判据是 `LD_DEBUG=libs`(**带对照**):两条链上 `pkcs11` 出现
+  **0 次**,而驱动确实够得到的 `libnvidia-glvkspirv` 出现 6 次、OpenCL adapter 出现
+  23 次 —— 对照证明这个仪器分得开,所以 0 是读数不是沉默。它们也是 farm 里唯一需要
+  `libcrypto` 的成员,随之消失的还有那条无解的 `libcrypto.so.1.1`(OpenSSL 1.1 上游
+  已 EOL)。
+
+  ⚠️⚠️ **一个更早的判据什么都没测到**:把成员删掉看示例还跑不跑 —— 删掉
+  `libnvidia-glvkspirv` 示例照样跑。原因是被测二进制和被改的 farm 不是同一个
+  (产物目录有两个,钉着不同版本)。**判据又一次指错了对象。**
+
+### Fixed
+
+- **三处只有真跑一遍才会现形的缺陷。**
+
+  ⚠️⚠️ **排除循环遍历了模式表却把模式写死。** `compat.vulkan-runtime` 的
+  `never_farm_patterns` 绑定了 `pat` 然后传了字面量 `libnvidia-gtk*`,于是这张表
+  **看起来是列表、行为上只有一条**。往里加 `libnvidia-pkcs11` 毫无效果 —— farm 依旧
+  81 个成员、两个 PKCS#11 都在,这是「排除」写完之后才发现的。
+
+  ⚠️⚠️ **`readelf -d` 不是传递的,一趟补不完。** 上一版用 `ldd`(答案是整个传递闭包)
+  所以一趟够;换成 `readelf` 是对的(它答**文件**说什么,而不是**这台机器**能不能解析),
+  但这一轮补进来的库会带来自己的依赖。实测:`compat.glx-runtime` 第一次真安装,
+  farm 从 52 涨到 77 **仍缺 9 条**,包括 `libLLVM.so.20.1` 和 `libstdc++.so.6`。
+  现在迭代到不动点(带上界防环),再测 **86 个成员、0 缺口、0 封条**。
+
+  ⚠️ 找不到 `readelf` 时那一趟静默返回空,读数与「已完全闭合」相同;现在明确告警,
+  且 `compat.glx-runtime` 的工具查找也先查 store 再查 PATH。
+
+  实测(本机,真驱动):`compat.glx-runtime` 86 成员 / 0 缺口,**零直接宿主触达** ——
+  4 条走 `xim:nvidia-gl-host-link`、24 条走其它 xim 载荷、其余走 subos 库视图。
+  SYCL 示例 `members 49 / walked 49 / findings 无`,Vulkan 示例
+  `members 56 / walked 56 / findings 无`,两者都在 RTX 4080 上跑出正确结果。
+
 ### Fixed
 
 - **两处只有把 glx 那一版真正跑一遍才会现形的缺陷。** 上一轮我量了 opencl 和

pkgs/c/compat.glfw.lua

@@ -9,6 +9,19 @@ package = {
 
     xpm = {
         linux = {
+            -- A new version because this package's pin on its runtime farm
+            -- moved. An installed copy RECORDS the pin it resolved with, so a
+            -- moved pin does not reach a machine that already holds the old
+            -- version -- and where a consumer also names the farm directly, the
+            -- two disagree and the build stops. Measured on a CI runner with a
+            -- warm ~/.mcpp; see the note on compat.vulkan 1.4.357.1.
+            ["3.4.0.1"] = {
+                url    = {
+                    GLOBAL = "https://github.com/glfw/glfw/archive/refs/tags/3.4.tar.gz",
+                    CN     = "https://gitcode.com/mcpp-res/glfw/releases/download/3.4/glfw-3.4.tar.gz",
+                },
+                sha256 = "c038d34200234d071fae9345bc455e4a8f2f544ab60150765d7704e08f3dac01",
+            },
             ["3.4"] = {
                 url    = {
                     GLOBAL = "https://github.com/glfw/glfw/archive/refs/tags/3.4.tar.gz",
@@ -18,6 +31,19 @@ package = {
             },
         },
         macosx = {
+            -- A new version because this package's pin on its runtime farm
+            -- moved. An installed copy RECORDS the pin it resolved with, so a
+            -- moved pin does not reach a machine that already holds the old
+            -- version -- and where a consumer also names the farm directly, the
+            -- two disagree and the build stops. Measured on a CI runner with a
+            -- warm ~/.mcpp; see the note on compat.vulkan 1.4.357.1.
+            ["3.4.0.1"] = {
+                url    = {
+                    GLOBAL = "https://github.com/glfw/glfw/archive/refs/tags/3.4.tar.gz",
+                    CN     = "https://gitcode.com/mcpp-res/glfw/releases/download/3.4/glfw-3.4.tar.gz",
+                },
+                sha256 = "c038d34200234d071fae9345bc455e4a8f2f544ab60150765d7704e08f3dac01",
+            },
             ["3.4"] = {
                 url    = {
                     GLOBAL = "https://github.com/glfw/glfw/archive/refs/tags/3.4.tar.gz",
@@ -27,6 +53,19 @@ package = {
             },
         },
         windows = {
+            -- A new version because this package's pin on its runtime farm
+            -- moved. An installed copy RECORDS the pin it resolved with, so a
+            -- moved pin does not reach a machine that already holds the old
+            -- version -- and where a consumer also names the farm directly, the
+            -- two disagree and the build stops. Measured on a CI runner with a
+            -- warm ~/.mcpp; see the note on compat.vulkan 1.4.357.1.
+            ["3.4.0.1"] = {
+                url    = {
+                    GLOBAL = "https://github.com/glfw/glfw/archive/refs/tags/3.4.tar.gz",
+                    CN     = "https://gitcode.com/mcpp-res/glfw/releases/download/3.4/glfw-3.4.tar.gz",
+                },
+                sha256 = "c038d34200234d071fae9345bc455e4a8f2f544ab60150765d7704e08f3dac01",
+            },
             ["3.4"] = {
                 url    = {
                     GLOBAL = "https://github.com/glfw/glfw/archive/refs/tags/3.4.tar.gz",
@@ -80,7 +119,7 @@ package = {
                 "src/posix_module.c",
             },
             deps = {
-                ["compat.glx-runtime"] = "2026.09.10",
+                ["compat.glx-runtime"] = "2026.09.11",
                 ["compat.x11"]       = "1.8.13",
                 ["compat.xcursor"]   = "1.2.3",
                 ["compat.xext"]      = "1.3.7",

pkgs/c/compat.glx-runtime.lua

@@ -56,6 +56,18 @@ package = {
             -- well-formedness anchor and nothing more, and reusing it means no
             -- new mirror asset has to exist for a key that changes only
             -- install() behaviour.
+            -- 2026.09.11: install() changed again after 2026.09.10 was
+            -- published -- an absolute `DT_NEEDED` is no longer treated as a
+            -- soname, and a missing `readelf` now says so instead of reading
+            -- as "no gaps". Behaviour baked into an installed payload needs a
+            -- key of its own, including when the previous key is hours old.
+            ["2026.09.11"] = {
+                url    = {
+                    GLOBAL = "https://raw.githubusercontent.com/KhronosGroup/OpenGL-Registry/a30033d3e812c9bf10094f1010374a6b15e192eb/README.adoc",
+                    CN     = "https://gitcode.com/mcpp-res/glx-runtime/releases/download/2026.08.08/glx-runtime-2026.08.08.adoc",
+                },
+                sha256 = "ea68efce197e68413ebb62c51ab4bccfb2309a2fca776d31b49d972f59f3640e",
+            },
             ["2026.09.10"] = {
                 url    = {
                     GLOBAL = "https://raw.githubusercontent.com/KhronosGroup/OpenGL-Registry/a30033d3e812c9bf10094f1010374a6b15e192eb/README.adoc",
@@ -369,7 +381,28 @@ local UNSERVED = {}
 local function close_farm(outdir)
     local filled, unserved, undeclared = {}, {}, {}
     local unserved_dir = path.join(path.directory(outdir), "unserved")
+    -- ITERATED TO A FIXED POINT, because `readelf -d` reports DIRECT
+    -- dependencies only.
+    --
+    -- The pass this replaced asked `ldd`, whose answer is the whole transitive
+    -- closure, so one round was enough and the comment said so. `readelf` is
+    -- the right instrument -- it answers what the FILE says instead of what
+    -- this machine can resolve -- but it is not transitive, and a library
+    -- filled in one round brings needs of its own. Measured on the first real
+    -- install of this package: the farm went from 52 members to 77 and was
+    -- still nine sonames short, `libLLVM.so.20.1` and `libstdc++.so.6` among
+    -- them, every one of them reachable from something the same round had just
+    -- added.
+    --
+    -- The bound is not a guess about depth; it is there so a cycle cannot spin.
+    -- A round that adds nothing ends the loop, which is the normal exit.
+    local seen = {}
+    for _ = 1, 16 do
+    local added = 0
     for _, soname in ipairs(unresolved_against_farm(outdir)) do
+        if seen[soname] then goto next end
+        seen[soname] = true
+        added = added + 1
         local candidates = find_in_store(soname)
         local hit = candidates[#candidates]
         if hit then
@@ -385,6 +418,9 @@ local function close_farm(outdir)
             unserved[#unserved + 1] = soname
             if not UNSERVED[soname] then undeclared[#undeclared + 1] = soname end
         end
+        ::next::
+    end
+    if added == 0 then break end
     end
     return filled, unserved, undeclared
 end

pkgs/c/compat.opencl-runtime.lua

@@ -42,16 +42,19 @@ package = {
             -- PLATFORM LEVEL, NOT PER VERSION, matching compat.vulkan-runtime:
             -- a `deps` inside a version entry is not read.
             --
-            -- `xim:openssl` is here because a farmed member needs
-            -- `libcrypto.so.3` and this ecosystem publishes it. The rule this
-            -- package follows is that anything xlings or this index can supply
-            -- comes from there, and the host is reached for one class only --
-            -- proprietary vendor userspace, which cannot be a package at all.
-            -- A floor, not a pin: the soname is ABI-stable at 3.x.
+            -- The rule this package follows is that anything xlings or this
+            -- index can supply comes from there, and the host is reached
+            -- through a named sentinel rather than by this package itself.
+            -- `xim:nvidia-video-host-link` owns "where is the host's
+            -- `libnvcuvid.so.1`", which two farmed members need.
+            --
+            -- OpenSSL was declared here for one release and is gone with the
+            -- member that asked for it: the PKCS#11 provider the name pattern
+            -- swept in and no OpenCL entry point reaches.
             deps = {
-                runtime = { "xim:openssl@>=3", "xim:nvidia-video-host-link" },
+                runtime = { "xim:nvidia-video-host-link" },
             },
-            ["latest"] = { ref = "2026.09.10" },
+            ["latest"] = { ref = "2026.09.11" },
             -- 2026.09.07: a soname carried by more than one installed payload
             -- is decided by symbol coverage rather than by which store path
             -- sorts last, and the ELF machine guard refuses a foreign payload.
@@ -64,6 +67,18 @@ package = {
             -- install() output is baked into the installed payload: without one
             -- a host that already holds the previous version keeps the open
             -- farm. The anchor is unchanged; only install() behaviour is.
+            -- 2026.09.11: the farm carries only what this runtime can
+            -- reach. `libnvidia-pkcs11*` is a PKCS#11 token module that matched
+            -- the vendor name pattern and nothing else -- measured with
+            -- LD_DEBUG on both examples, it is looked for zero times while a
+            -- member the driver does reach appears six -- so it leaves, and the
+            -- OpenSSL declaration it was the only reason for leaves with it.
+            -- A new key because install() output is baked into the installed
+            -- payload.
+            ["2026.09.11"] = {
+                url    = "https://raw.githubusercontent.com/KhronosGroup/OpenCL-ICD-Loader/v2026.05.29/README.md",
+                sha256 = "b332515b9a0bc266ad94fe6e951f0ef7a988ccb9e933068faf0fd8ba3cfde805",
+            },
             ["2026.09.10"] = {
                 url    = "https://raw.githubusercontent.com/KhronosGroup/OpenCL-ICD-Loader/v2026.05.29/README.md",
                 sha256 = "b332515b9a0bc266ad94fe6e951f0ef7a988ccb9e933068faf0fd8ba3cfde805",
@@ -199,6 +214,32 @@ local never_farm = {
     ["libgcc_s.so.1"] = true, ["libOpenCL.so.1"] = true,
 }
 
+-- WHAT THE PATTERN SWEEPS IN THAT THIS RUNTIME CANNOT REACH.
+--
+-- `libnvidia-gtk*` is the driver's settings GUI. `libnvidia-pkcs11*` is its
+-- PKCS#11 provider: a cryptographic token module, loaded by an application's
+-- own PKCS#11 configuration and by nothing in a GPU driver's dispatch. Both
+-- match `libnvidia*.so.*` by name alone.
+--
+-- MEASURED, WITH A CONTROL, before removing them. `LD_DEBUG=libs` on a run of
+-- each example says which files the process actually looked for:
+--
+--   pkcs11                      0 occurrences   (Vulkan and SYCL/OpenCL alike)
+--   libnvidia-glvkspirv         6 occurrences   (Vulkan)
+--   libur_adapter_opencl / libOpenCL   23       (SYCL/OpenCL)
+--
+-- The last two are the control: this instrument does report a member the
+-- driver reaches, so a zero for `pkcs11` is a reading rather than a silence.
+-- An earlier attempt -- remove the member and see whether the example still
+-- runs -- could NOT tell the two apart: removing `libnvidia-glvkspirv` left the
+-- example working too, because the binary under test had been built against a
+-- different farm than the one being edited.
+--
+-- They are also the only members that need `libcrypto` at all, so removing them
+-- removes this package's reason to declare OpenSSL, and with it the
+-- `libcrypto.so.1.1` that no ecosystem package can serve: OpenSSL 1.1 is
+-- end-of-life upstream. A member that cannot be reached is not a capability
+-- being dropped -- it is a file the name pattern collected.
 -- Proprietary vendor userspace: linked from the host by design. `libnvidia-gtk*`
 -- is the driver's settings GUI and is not part of any driver.
 local host_opencl_patterns = { "libnvidia*.so.*" }
@@ -232,7 +273,6 @@ end
 -- /usr/lib. What a farmed member needs is answered in this order:
 --
 --   * an installed payload publishes it -> link the payload's copy.
---     `xim:openssl` covers `libcrypto.so.3` and
 --     `xim:nvidia-video-host-link` covers `libnvcuvid.so.1`, which is
 --     what the two encode/optical-flow members need. Both are declared
 --     in `xpm.linux.deps` above, so the reach is visible in the
@@ -482,7 +522,7 @@ end
 -- SILENCE. Four classes, in the order they are tried:
 --
 --   * a package this ecosystem publishes -- declared in `xpm.linux.deps` and
---     taken from the installed payload. `xim:openssl` covers `libcrypto.so.3`.
+--     taken from the installed payload.
 --   * proprietary vendor userspace -- also a package, and deliberately so:
 --     `xim:nvidia-video-host-link` owns the one question "where is the host's
 --     `libnvcuvid.so.1`". The library still comes from the host, because it is
@@ -496,18 +536,37 @@ end
 --     that quietly absorbs an unknown soname: the answer to "what does this
 --     farm take from outside the ecosystem" has to be a list somebody wrote,
 --     not a residue.
-local UNSERVED = {
-    ["libcrypto.so.1.1"] =
-        "OpenSSL 1.1 is end-of-life upstream and this ecosystem publishes 3.x. "
-        .. "The only member that asks for it is NVIDIA's PKCS#11 provider, "
-        .. "which no OpenCL entry point reaches.",
-}
+-- Empty, and the table stays so that the day something lands here somebody has
+-- to write down why it cannot be a package. The warning below is what makes
+-- leaving it blank impossible to do by accident. `libcrypto.so.1.1` was the
+-- only entry and left with the PKCS#11 member that asked for it.
+local UNSERVED = {}
 
 local function seal_unresolved(outdir)
     local filled, unserved, undeclared = {}, {}, {}
-    local names = unresolved_against_farm(outdir)
     local unserved_dir = path.join(path.directory(outdir), "unserved")
-    for _, soname in ipairs(names) do
+    -- ITERATED TO A FIXED POINT, because `readelf -d` reports DIRECT
+    -- dependencies only.
+    --
+    -- The pass this replaced asked `ldd`, whose answer is the whole transitive
+    -- closure, so one round was enough and the comment said so. `readelf` is
+    -- the right instrument -- it answers what the FILE says instead of what
+    -- this machine can resolve -- but it is not transitive, and a library
+    -- filled in one round brings needs of its own. Measured on the first real
+    -- install of this package: the farm went from 52 members to 77 and was
+    -- still nine sonames short, `libLLVM.so.20.1` and `libstdc++.so.6` among
+    -- them, every one of them reachable from something the same round had just
+    -- added.
+    --
+    -- The bound is not a guess about depth; it is there so a cycle cannot spin.
+    -- A round that adds nothing ends the loop, which is the normal exit.
+    local seen = {}
+    for _ = 1, 16 do
+    local added = 0
+    for _, soname in ipairs(unresolved_against_farm(outdir)) do
+        if seen[soname] then goto next end
+        seen[soname] = true
+        added = added + 1
         local candidates = find_in_store(soname)
         local hit = candidates[#candidates]
         if hit then
@@ -520,6 +579,9 @@ local function seal_unresolved(outdir)
             unserved[#unserved + 1] = soname
             if not UNSERVED[soname] then undeclared[#undeclared + 1] = soname end
         end
+        ::next::
+    end
+    if added == 0 then break end
     end
     return filled, unserved, undeclared
 end
@@ -607,7 +669,7 @@ local function link_runtime_libs(outdir)
             os.exec(
                 "for lib in " .. sh_quote(dir) .. "/" .. pattern ..
                 "; do [ -e \"$lib\" ] || continue; " ..
-                "case \"$(basename \"$lib\")\" in libnvidia-gtk*) continue;; esac; " ..
+                "case \"$(basename \"$lib\")\" in libnvidia-gtk*|libnvidia-pkcs11*) continue;; esac; " ..
                 "ln -sf \"$lib\" " .. sh_quote(outdir) .. "/\"$(basename \"$lib\")\"; " ..
                 "done"
             )