mcpplibs
diff --git a/‎CHANGELOG.md‎
Lines changed: 52 additions & 0 deletions b/‎CHANGELOG.md‎
Lines changed: 52 additions & 0 deletions
diff --git a/‎pkgs/c/compat.glfw.lua‎
Lines changed: 1 addition & 1 deletion b/‎pkgs/c/compat.glfw.lua‎
Lines changed: 1 addition & 1 deletion
diff --git a/‎pkgs/c/compat.glx-runtime.lua‎
Lines changed: 193 additions & 0 deletions b/‎pkgs/c/compat.glx-runtime.lua‎
Lines changed: 193 additions & 0 deletions
@@ -7,6 +7,58 @@
 
 ## [Unreleased]
 
+### Changed
+
+- **三个 host farm 改为对自己的成员负责,并且对宿主只保留一条具名的触达**
+  (`compat.glx-runtime` 2026.09.10、`compat.opencl-runtime` 2026.09.10、
+  `compat.vulkan-runtime` 2026.09.10)。
+
+  这三个包的成员由**文件名模式**决定,而完整性(如果检查的话)对着的是**另一个
+  集合** —— ICD 清单里的库。模式存在的理由恰恰是「专有驱动会按名字 dlopen 自己
+  家族的成员,没有任何 `DT_NEEDED` 遍历看得见」;既然这么说了,那些成员在别处也
+  得当作可达的 —— 而它们不是。**从来没被验证的,正是模式为之存在的那一半。**
+
+  实测(装了 NVIDIA 驱动的宿主,用 mcpp 自己的 dlopen 面检查):
+  `compat.glx-runtime` 52 个成员缺 30 条闭包边(它根本没有闭包遍历)、
+  `compat.vulkan-runtime` 76 个缺 5 条、`compat.opencl-runtime` 缺 4 条 ——
+  最后这 4 条就是 mcpp-index#376 报的那几条(该 issue 标题写的是 vulkan,
+  实际观测到的来自 opencl)。
+
+  ⚠️ **配方里「种子不能取整个 farm」的理由测的是排除之前的集合。** 它写着闭包会
+  拉进 64 个库、GTK 在其中 —— 那是对「模式匹配到的每个文件」成立,因为
+  `libnvidia*.so.*` 也匹配驱动的设置界面。farm 是模式匹配**减去**
+  `never_farm_patterns`,对**那个**求闭包在本机只新增 5 个,GTK/GLib/Pango/Cairo
+  一个都没有。**结论会被复查,理由不会。**
+
+  ⭐ 新规则:一个成员需要的每条 soname 都有**明写的答案**,没有静默分支。
+  1. 生态发布了它 —— 在 `xpm.linux.deps` 里声明,从已装载荷取
+     (新增 `xim:openssl`、`xim:mesa`);
+  2. 不可再分发的专有驱动用户态 —— 也走包:新增
+     `xim:nvidia-video-host-link` 拥有「宿主的 `libnvcuvid.so.1` 在哪」这一个
+     问题,和 `libcuda-host-link`/`nvidia-gl-host-link` 同形;
+  3. 两者都不是、也不可能成为 —— 写进配方的 `UNSERVED` 表**并附理由**
+     (今天只有 `libcrypto.so.1.1`:OpenSSL 1.1 上游已 EOL,而只有 NVIDIA 的
+     PKCS#11 提供者要它,没有任何 OpenCL/Vulkan 入口够得到);
+  4. 以上都不是 —— 安装时**打警告点名**。这一条是关键:farm 从生态之外拿了什么,
+     必须是有人写下来的清单,而不是残留物。
+
+  **没有任何一条分支会为成员去 /usr/lib 收一个新文件。** `compat.glx-runtime`
+  一条都不收:那 30 条全部来自已装载荷(4 条 `libnvidia-*` 来自
+  `xim:nvidia-gl-host-link`,其余 26 条来自 `xim:graphics` 拉起来的栈)。
+
+  ⭐ 判据落在 mcpp 会问的那个问题上:成员的 `DT_NEEDED` 用 `readelf -d` 读,
+  归属只对着 farm 这一个目录判。**先前用 `ldd` 是错的** —— 它答的是「在这台机器
+  上能不能解析」,而这台机器包含宿主默认目录,于是宿主碰巧有的 soname 读成已解析、
+  从不被记录,而消费者的搜索路径里没有宿主。实测:`libcrypto` 那两条对这一趟不可见,
+  却被 mcpp 在上一层从同一个目录报了出来。
+
+  实测结果(本机,opencl farm):`members 48 / walked 47 / missing 0`,
+  只剩 `libcrypto.so.1.1` 一条 dangling —— 正是明写为 unserved 的那条。
+  改动前是 4 条 missing。
+
+  ⚠️ 抬版本键是必须的:`install()` 的产物烤进已安装载荷,不换键的机器会一直留着
+  未闭合的 farm。消费者 `compat.glfw` / `compat.opencl` / `compat.vulkan` 同步重钉。
+
 ### Added
 
 - 收录 `compat.sdl3` 3.4.2 —— SDL3 窗口/输入/音频层,从源码构建(形态 E)。
 
@@ -80,7 +80,7 @@ package = {
                 "src/posix_module.c",
             },
             deps = {
-                ["compat.glx-runtime"] = "2026.08.08",
+                ["compat.glx-runtime"] = "2026.09.10",
                 ["compat.x11"]       = "1.8.13",
                 ["compat.xcursor"]   = "1.2.3",
                 ["compat.xext"]      = "1.3.7",
 
@@ -45,6 +45,24 @@ package = {
             -- a download it will not read, and the alternative -- deleting the
             -- published version -- would break them outright.
             deps = { runtime = { "xim:graphics" } },
+            -- 2026.09.10: the farm answers for what its own members need.
+            -- Nothing new is taken from the host: a soname a member needs is
+            -- filled from an installed payload, and otherwise recorded as a
+            -- dangling link. A new key because install() output is baked into
+            -- the installed payload -- without one, a host that already holds
+            -- 2026.08.08 keeps a farm 30 sonames short of closed.
+            --
+            -- The anchor is 2026.08.08's, deliberately: the URL is a
+            -- well-formedness anchor and nothing more, and reusing it means no
+            -- new mirror asset has to exist for a key that changes only
+            -- install() behaviour.
+            ["2026.09.10"] = {
+                url    = {
+                    GLOBAL = "https://raw.githubusercontent.com/KhronosGroup/OpenGL-Registry/a30033d3e812c9bf10094f1010374a6b15e192eb/README.adoc",
+                    CN     = "https://gitcode.com/mcpp-res/glx-runtime/releases/download/2026.08.08/glx-runtime-2026.08.08.adoc",
+                },
+                sha256 = "ea68efce197e68413ebb62c51ab4bccfb2309a2fca776d31b49d972f59f3640e",
+            },
             ["2026.08.08"] = {
                 url    = {
                     GLOBAL = "https://raw.githubusercontent.com/KhronosGroup/OpenGL-Registry/a30033d3e812c9bf10094f1010374a6b15e192eb/README.adoc",
@@ -174,6 +192,160 @@ local required = {
     ["libGL.so.1"] = false,
 }
 
+-- WHAT THE FARM'S OWN MEMBERS NEED, AND WHY NOTHING NEW COMES FROM THE HOST.
+--
+-- The pattern list above decides membership; nothing decided completeness.
+-- Measured 2026-09-10 on a host with the proprietary driver: 52 members, and
+-- 30 sonames those members need that this directory does not carry --
+-- `libX11.so.6`, `libxcb*.so.*`, `libz.so.1`, `libLLVM.so.20.1`,
+-- `libnvidia-glcore.so.*` and `libstdc++.so.6` among them. A consumer reaching
+-- any of those members through this farm gets a load failure that no closure
+-- check can see, because no link edge names it.
+--
+-- THE HOST SURFACE IS HELD AT WHAT THE PATTERN LIST ALREADY TAKES. Two of the
+-- thirty say why: `libstdc++.so.6`, and behind it a host C++ runtime on the
+-- RUNPATH of every GL consumer this index has. mcpp links libstdc++ statically,
+-- and a second one arriving through a farm is the failure class the libc guard
+-- below already exists for. So the rule is:
+--
+--   * an installed payload provides it  -> link the payload's copy
+--   * nothing does                      -> named in UNSERVED with the reason,
+--                                          and linked into a directory this
+--                                          package never creates
+--   * anything else                     -> a warning naming it
+--
+-- and there is no branch at all that harvests a file from /usr/lib. Measured
+-- 2026-09-10 on a host with the proprietary driver: ALL THIRTY come from
+-- installed payloads. The four `libnvidia-*` ones come from
+-- `xim:nvidia-gl-host-link`, which is where this file already says the driver
+-- reaches the subos from; the other twenty-six come from the stack
+-- `xim:graphics` pulls in -- `xim:libX11`, `xim:libxcb`, `xim:mesa`,
+-- `xim:libllvm`, `xim:gcc-runtime` and the rest. The host surface of this farm
+-- is therefore exactly what the pattern list takes, and nothing more.
+--
+-- The dangling branch is not a workaround. mcpp reads this directory with a
+-- three-state rule -- resolved, present-but-dangling (this machine has no such
+-- library), absent everywhere (the publisher never carried it) -- and DANGLING
+-- IS ONLY EXPRESSIBLE IF THIS PACKAGE MADE A LINK. Leaving the soname out
+-- reports "the publisher never considered it" on every machine, including the
+-- ones where the truth is "this host has no X11". The link is also
+-- self-healing, the shape `xim:libcuda-host-link` already uses: it resolves the
+-- moment the machine gains the library.
+local never_farm = {
+    ["libc.so.6"] = true, ["libm.so.6"] = true, ["libdl.so.2"] = true,
+    ["libpthread.so.0"] = true, ["librt.so.1"] = true, ["libresolv.so.2"] = true,
+    ["ld-linux-x86-64.so.2"] = true, ["ld-linux-aarch64.so.1"] = true,
+    ["libgcc_s.so.1"] = true,
+}
+
+local function xim_store_roots()
+    local roots = {}
+    local home = os.getenv("XLINGS_HOME")
+    if home and home ~= "" then roots[#roots + 1] = path.join(home, "data/xpkgs") end
+    local pfx = pkginfo.install_dir()
+    if pfx then roots[#roots + 1] = path.directory(path.directory(pfx)) end
+    return roots
+end
+
+-- Every copy, not the last one sorted: a driver payload can ship its own copy
+-- of a library another package owns. compat.vulkan-runtime carries the
+-- measurement behind this.
+local function find_in_store(soname)
+    local out, seen = {}, {}
+    for _, root in ipairs(xim_store_roots()) do
+        local f = io.popen(string.format(
+            [[ls -1 "%s"/xim-x-*/*/lib/%s "%s"/xim-x-*/*/lib64/%s 2>/dev/null | sort -V]],
+            root, soname, root, soname))
+        if f then
+            for line in f:lines() do
+                local hit = line:gsub("[\r\n]+$", "")
+                if hit ~= "" and not seen[hit] then
+                    seen[hit] = true
+                    out[#out + 1] = hit
+                end
+            end
+            f:close()
+        end
+    end
+    return out
+end
+
+-- WHAT A MEMBER NEEDS IS READ FROM THE MEMBER, NOT FROM A LOADER.
+--
+-- `ldd` answers "can this resolve HERE", and here includes the host's default
+-- directories -- so a soname the host happens to carry reads as resolved and is
+-- never recorded, while the consumer, whose search path is this farm and not
+-- the host, cannot load it. `readelf -d` answers what the FILE says, and
+-- membership is decided against this directory alone, which is the question
+-- mcpp asks of it.
+local function find_tool(name)
+    local f = io.popen(string.format([[command -v %s 2>/dev/null]], name))
+    if f then
+        local hit = (f:read("l") or ""):gsub("[\r\n]+$", "")
+        f:close()
+        if hit ~= "" then return hit end
+    end
+    return nil
+end
+
+local function unresolved_against_farm(outdir)
+    local readelf = find_tool("readelf")
+    if not readelf then return {} end
+    local have, members = {}, {}
+    local lsf = io.popen(string.format([[ls -1 "%s" 2>/dev/null]], outdir))
+    if not lsf then return {} end
+    for line in lsf:lines() do
+        local b = line:gsub("[\r\n]+$", "")
+        if b ~= "" then have[b] = true; members[#members + 1] = b end
+    end
+    lsf:close()
+    local out, seen = {}, {}
+    for _, base in ipairs(members) do
+        local f = io.popen(string.format(
+            [[%s -d %s 2>/dev/null | sed -n 's/.*(NEEDED).*\[\(.*\)\]/\1/p']],
+            sh_quote(readelf), sh_quote(path.join(outdir, base))))
+        if f then
+            for line in f:lines() do
+                local n = line:gsub("[\r\n]+$", "")
+                if n ~= "" and not have[n] and not never_farm[n] and not seen[n] then
+                    seen[n] = true
+                    out[#out + 1] = n
+                end
+            end
+            f:close()
+        end
+    end
+    return out
+end
+
+-- Nothing is here today, and the table exists so that the day something is,
+-- somebody has to write down why it cannot be a package. The warning below is
+-- what makes leaving it blank impossible to do by accident.
+local UNSERVED = {}
+
+local function close_farm(outdir)
+    local filled, unserved, undeclared = {}, {}, {}
+    local unserved_dir = path.join(path.directory(outdir), "unserved")
+    for _, soname in ipairs(unresolved_against_farm(outdir)) do
+        local candidates = find_in_store(soname)
+        local hit = candidates[#candidates]
+        if hit then
+            os.exec(string.format([[ln -sf "%s" "%s"]], hit, path.join(outdir, soname)))
+            filled[#filled + 1] = soname
+        else
+            -- Inside this package, not at the canonical host path: a link into
+            -- /usr/lib resolves on any machine that happens to carry the file,
+            -- which is a host harvest wearing a different name.
+            os.exec(string.format([[ln -sf "%s" "%s"]],
+                                  path.join(unserved_dir, soname),
+                                  path.join(outdir, soname)))
+            unserved[#unserved + 1] = soname
+            if not UNSERVED[soname] then undeclared[#undeclared + 1] = soname end
+        end
+    end
+    return filled, unserved, undeclared
+end
+
 local function link_runtime_libs(outdir)
     os.mkdir(outdir)
     for _, dir in ipairs(candidate_dirs()) do
@@ -187,6 +359,27 @@ local function link_runtime_libs(outdir)
         end
     end
 
+    -- Completeness, before the guards. Neither branch puts a new host library
+    -- on a consumer's path, so the guards below still see exactly what the
+    -- pattern list matched.
+    local filled, unserved, undeclared = close_farm(outdir)
+    if #filled > 0 then
+        log.info("compat.glx-runtime: %d libraries the farm's members need were "
+                 .. "filled from installed payloads", #filled)
+    end
+    if #unserved > 0 then
+        log.info("compat.glx-runtime: %d sonames the farm's members need are "
+                 .. "published by no installed payload and are recorded as "
+                 .. "unserved", #unserved)
+    end
+    -- The list has to be written, not discovered.
+    for _, soname in ipairs(undeclared) do
+        log.warn("compat.glx-runtime: %s is needed by a farmed member, is "
+                 .. "published by no installed payload, and is not declared in "
+                 .. "UNSERVED. Add the ecosystem package that provides it, or "
+                 .. "record why it cannot be one.", soname)
+    end
+
     for name, _ in pairs(required) do
         if not os.isfile(path.join(outdir, name)) then
             log.error("%s is not in this subos. The GL runtime comes from "