fix(toolchain): one payload is an answer; two are a question

CI still had no runtime binding, and therefore no loader on the link line:

  -o bin/mcpp --sysroot=<...>/subos/default -B<...>/binutils/bin -static-libstdc++

Every compatibility source is something an earlier mechanism wrote -- gcc's
specs, clang's cfg, and now the compiler's PT_INTERP -- and a machine can
legitimately have none of them. Recorded loader paths can also name a subos
VIEW rather than the payload; those carry no version at all, so they are
canonicalised first (R6: artifacts bind the payload, never the view).

The last resort is the installed payload set, and only when it is a singleton.
This is not the rule the design removed: that one asked a directory for "the
glibc" and took whatever readdir yielded first -- a choice, made by something
unrelated to what the artifact loads, silently wrong as soon as a dependency's
`>=` floor installed a second payload. Where exactly one glibc exists there is
no choice to make; it is the only runtime any artifact from this toolchain
could bind. Two or more and this stays silent, which is precisely the case the
incident was and the case the subos has to settle.

Verified under conditions this machine had to be forced into: gcc's specs file
moved aside AND gcc's own PT_INTERP repointed at the host loader. The binding
still resolves and the artifact still takes the payload loader.

  tests/unit/test_runtime_binding_fallback.cpp  +5

Author: speak-agent

src/toolchain/post_install.cppm

@@ -597,6 +597,14 @@ std::string baked_runtime_binding(const std::filesystem::path& compilerBin) {
     auto from_text = [](const std::string& text) -> std::string {
         auto loader = detect_baked_loader(text);
         if (loader.empty()) return {};
+        // The recorded path may name a subos VIEW (`<home>/subos/default/lib/
+        // ld-linux-...`), which is a symlink into the payload. R6: artifacts
+        // bind the payload, never the mutable view -- so resolve to the
+        // payload before reading a version off it. A view path has no version
+        // component at all, and parsing one yields nothing.
+        std::error_code cec;
+        if (auto real = std::filesystem::canonical(loader, cec); !cec)
+            loader = real.string();
         // .../xim-x-glibc/<ver>/lib64/ld-linux-... — the version is the
         // grandparent of the lib dir.
         auto dir = std::filesystem::path(loader).parent_path();   // lib64
@@ -643,6 +651,39 @@ std::string baked_runtime_binding(const std::filesystem::path& compilerBin) {
     // the same fact the specs held, from a mechanism that has not gone away.
     if (auto r = from_text(read_elf_interp(compilerBin)); !r.empty())
         return r;
+
+    // Last: the installed payload set, but ONLY when it is a singleton.
+    //
+    // This is not the rule this design removed. That rule asked a directory
+    // for "the glibc" and took whatever `readdir` yielded first -- a CHOICE,
+    // made by something with no bearing on what the artifact would load, and
+    // silently wrong the moment a second payload appeared. Where exactly one
+    // payload is installed there is no choice to make: it is the only glibc
+    // any artifact from this toolchain could bind, and declining would refuse
+    // a question that has a single answer.
+    //
+    // Two or more and this stays silent. That is the case the incident was,
+    // and it is the case the subos must answer.
+    if (auto xpkgs = mcpp::xlings::paths::xpkgs_from_compiler(compilerBin)) {
+        std::vector<std::string> versions;
+        for (auto it = std::filesystem::directory_iterator(*xpkgs / "xim-x-glibc", ec);
+             !ec && it != std::filesystem::directory_iterator{}; it.increment(ec)) {
+            if (!it->is_directory(ec)) continue;
+            auto v = it->path().filename().string();
+            if (!v.empty() && v.front() != '.') versions.push_back(v);
+        }
+        if (versions.size() == 1) {
+            mcpp::log::verbose("probe", std::format(
+                "runtime binding glibc@{} — the only glibc payload installed, "
+                "so there is nothing to choose between", versions[0]));
+            return "glibc@" + versions[0];
+        }
+        if (versions.size() > 1)
+            mcpp::log::verbose("probe", std::format(
+                "{} glibc payloads installed and nothing declares which one "
+                "this build binds; declining rather than picking",
+                versions.size()));
+    }
     return {};
 }
 

tests/unit/test_runtime_binding_fallback.cpp

@@ -0,0 +1,69 @@
+// When nothing declares the runtime, how far may mcpp go on its own?
+//
+// The rule this replaced asked a directory for "the glibc" and took the first
+// entry readdir yielded. That is a CHOICE made by something with no bearing on
+// what the artifact loads, and it went wrong the moment a dependency's
+// `xim:glibc@>=2.38` floor installed a second payload: the compile side took
+// 2.44 while the interpreter still named 2.39.
+//
+// So the axis is not "may mcpp look at the payload directory" -- it is
+// "is there anything to choose between". One payload is an answer; two are a
+// question only the subos can settle.
+//
+// This mattered because the compatibility sources (gcc's specs, clang's cfg,
+// the compiler's PT_INTERP) are all things some earlier mechanism wrote, and a
+// machine can legitimately have none of them.
+
+#include <gtest/gtest.h>
+
+import std;
+import mcpp.toolchain.post_install;
+
+namespace tc = mcpp::toolchain;
+
+namespace {
+
+struct Home {
+    std::filesystem::path root, compiler;
+    explicit Home(std::initializer_list<const char*> glibcVersions) {
+        root = std::filesystem::temp_directory_path()
+             / std::format("mcpp_binding_{}", std::random_device{}());
+        auto xpkgs = root / "data" / "xpkgs";
+        compiler = xpkgs / "xim-x-gcc" / "16.1.0" / "bin" / "g++";
+        std::filesystem::create_directories(compiler.parent_path());
+        std::ofstream(compiler) << "not an elf";
+        for (auto v : glibcVersions)
+            std::filesystem::create_directories(
+                xpkgs / "xim-x-glibc" / v / "lib64");
+    }
+    ~Home() { std::error_code ec; std::filesystem::remove_all(root, ec); }
+};
+
+TEST(RuntimeBindingFallback, OnePayloadIsAnAnswer) {
+    Home h{"2.39"};
+    EXPECT_EQ(tc::baked_runtime_binding(h.compiler), "glibc@2.39");
+}
+
+// The incident, in one assertion. Two payloads and nothing declaring which:
+// silence, not a coin flip.
+TEST(RuntimeBindingFallback, TwoPayloadsIsSilence) {
+    Home h{"2.39", "2.44"};
+    EXPECT_EQ(tc::baked_runtime_binding(h.compiler), "");
+}
+
+TEST(RuntimeBindingFallback, NoPayloadIsSilence) {
+    Home h{};
+    EXPECT_EQ(tc::baked_runtime_binding(h.compiler), "");
+}
+
+// A compiler outside any xpkgs tree (a system gcc) has no payload set to read,
+// and must not acquire one from somewhere else.
+TEST(RuntimeBindingFallback, NonPayloadCompilerGetsNothing) {
+    EXPECT_EQ(tc::baked_runtime_binding("/usr/bin/g++"), "");
+}
+
+TEST(RuntimeBindingFallback, EmptyPathIsSilence) {
+    EXPECT_EQ(tc::baked_runtime_binding({}), "");
+}
+
+}  // namespace