fix(toolchain): the compatibility fallback read a file this change deleted

Three defects, all found by CI in configurations this developer machine does
not have. Each is the same shape: a repair placed where the control flow, or
the machine state, does not reach it.

1. baked_runtime_binding read gcc's `specs` and clang's `.cfg` -- files mcpp
   used to write and no longer does. On a machine whose toolchain was
   installed after that change they are simply absent, so no binding resolved,
   so no payload paths, so no `--dynamic-linker`, so the artifact took the
   HOST loader and the hermetic check rejected it:

     /lib64/ld-linux-x86-64.so.2 (outside the sandbox)

   Every existing machine still has those files from before, which is exactly
   why local verification was green and CI was not. The binding now also comes
   from the compiler's own PT_INTERP -- written by the patchelf walk, which
   still runs on every install, and naming the same glibc payload the specs
   used to name. Read with a small ELF header reader rather than
   `patchelf --print-interpreter`: this runs during prepare, where patchelf is
   not guaranteed to be resolved.

   Verified by moving the specs file aside and rebuilding: binding still
   resolves, artifact still takes the payload loader.

2. probe_sysroot accepted gcc's reported sysroot as soon as it existed and
   carried headers, and only consulted remap_xlings_baked_sysroot when it did
   not exist. So the ownership predicate added for that function -- the whole
   point of which is a sysroot that EXISTS and belongs to someone else -- was
   never reached in the case it was written for. Measured on this machine: gcc
   reported a sysroot under an unrelated repo and every build took its headers.
   Ownership is now asked first; a foreign-but-usable sysroot remains the last
   resort, since taking nothing would break machines with no registry subos.

3. `rel.native().rfind("..", 0)` does not compile on Windows, where native()
   is a wstring -- every Windows job failed to build. It was also subtly wrong
   where it did compile: a directory named `..cache` is not an escape.
   Containment is a question about path components, so path_is_under asks it
   of components.

Also removes a duplicated flag group: the C-runtime flags were emitted both as
link_toolchain_flags and again as payload_ld for gcc. Correct but wasteful,
and the link line has a hard 128KiB ceiling that real workspaces already spend
43% of.

  gcc with specs / gcc without specs / llvm: payload interpreter, exactly one
  --dynamic-linker, program runs.
  65 unit tests, e2e 201/86/200/65/100/28/30.

Author: speak-agent

src/build/flags.cppm

@@ -712,14 +712,18 @@ CompileFlags compute_flags(const BuildPlan& plan) {
     // host's /lib or, on hosts without a system toolchain, passes bare names
     // that lld cannot open — issue #195), -L/-rpath for -lc/-lm, and the
     // payload's dynamic linker.
+    //
+    // Only for clang-with-cfg, and only in PayloadFirst. Every other
+    // combination already has these flags: the gcc branch above assigns
+    // `link_toolchain_flags = lm.link_flags(...)` for any mode but None, and
+    // the clang branch adds them for Sysroot. Emitting them here as well put
+    // the whole C-runtime group on the line twice -- harmless to correctness,
+    // but the link line has a hard 128KiB ceiling (MAX_ARG_STRLEN) that real
+    // workspaces already spend 43% of.
     std::string payload_ld;
-    if (lm.mode == mcpp::toolchain::CLibMode::PayloadFirst) {
-        // Emitted for gcc too now. It used to be gated on `isClangWithCfg`,
-        // which left gcc's run-side addressing to its install-time specs
-        // while the compile side moved per build.
-        if (isClangWithCfg || !lm.clangDriver)
-            payload_ld = lm.link_flags(ninjaEsc);
-    }
+    if (isClangWithCfg
+     && lm.mode == mcpp::toolchain::CLibMode::PayloadFirst)
+        payload_ld = lm.link_flags(ninjaEsc);
     // GCC: replace the payload's patched `*link:` with the pristine one, so
     // its accumulated rpath entries do not reach the artifact. Must come
     // BEFORE our own -Wl flags is not required (specs are processed by the

src/fallback/probe_sysroot.cppm

@@ -17,6 +17,22 @@ import mcpp.log;
 
 export namespace mcpp::fallback {
 
+// Does `child` sit under `anchor`?
+//
+// Spelled with path components rather than by inspecting the relative path's
+// text. `native()` is a wstring on Windows, so the obvious `rfind("..", 0)`
+// does not even compile there -- and where it does compile it is subtly wrong,
+// since a directory genuinely named `..cache` starts with those two
+// characters without escaping anything.
+bool path_is_under(const std::filesystem::path& child,
+                   const std::filesystem::path& anchor) {
+    if (anchor.empty() || child.empty()) return false;
+    auto rel = child.lexically_relative(anchor);
+    if (rel.empty()) return false;
+    static const std::filesystem::path kUp{".."};
+    return *rel.begin() != kUp;
+}
+
 // When GCC reports a baked "subos/default" sysroot that does not belong to
 // THIS toolchain's home, remap it to the equivalent sysroot under the
 // compiler's own xpkgs tree.
@@ -42,10 +58,8 @@ remap_xlings_baked_sysroot(std::string_view reportedPath,
         // Owned by this toolchain's registry? Then it is the right answer.
         auto registry = xpkgsOpt->parent_path().parent_path();
         std::error_code ec;
-        auto rel = std::filesystem::path(std::string(reportedPath))
-                       .lexically_relative(registry);
-        const bool inside = !rel.empty()
-                         && rel.native().rfind("..", 0) != 0;
+        const bool inside = path_is_under(
+            std::filesystem::path(std::string(reportedPath)), registry);
         if (inside && std::filesystem::exists(std::string(reportedPath), ec))
             return std::nullopt;
     }
@@ -60,6 +74,20 @@ remap_xlings_baked_sysroot(std::string_view reportedPath,
     return std::nullopt;
 }
 
+// Does this sysroot belong to the same registry as the compiler that reported
+// it? Callers need this BEFORE deciding whether a usable sysroot is
+// acceptable: usability and ownership are independent, and a path can pass the
+// first while failing the second.
+bool sysroot_is_owned(std::string_view reportedPath,
+                      const std::filesystem::path& compilerBin) {
+    if (reportedPath.empty()) return false;
+    auto xpkgs = mcpp::xlings::paths::xpkgs_from_compiler(compilerBin);
+    // No registry to compare against -- nothing to contradict, so accept.
+    if (!xpkgs) return true;
+    return path_is_under(std::filesystem::path(std::string(reportedPath)),
+                         xpkgs->parent_path().parent_path());
+}
+
 // Is this sysroot foreign -- neither this mcpp home's registry nor a tree
 // belonging to the project being built?
 //
@@ -76,12 +104,8 @@ bool sysroot_is_foreign(const std::filesystem::path& sysroot,
                         const std::filesystem::path& registryRoot,
                         const std::filesystem::path& projectRoot) {
     if (sysroot.empty()) return false;
-    auto under = [&](const std::filesystem::path& anchor) {
-        if (anchor.empty()) return false;
-        auto rel = sysroot.lexically_relative(anchor);
-        return !rel.empty() && rel.native().rfind("..", 0) != 0;
-    };
-    return !under(registryRoot) && !under(projectRoot);
+    return !path_is_under(sysroot, registryRoot)
+        && !path_is_under(sysroot, projectRoot);
 }
 
 // Parse a Clang .cfg file alongside the compiler binary for --sysroot=.

src/toolchain/post_install.cppm

@@ -530,6 +530,66 @@ export void ensure_post_install_fixup(const mcpp::config::GlobalConfig& cfg,
 }
 
 
+// PT_INTERP of an ELF, read directly.
+//
+// Not via `patchelf --print-interpreter`: this runs during prepare, where
+// patchelf is not guaranteed to be resolved, and a dependency on an external
+// tool for four fields of a header is a dependency that will be missing on
+// exactly the machine that needs the answer.
+std::string read_elf_interp(const std::filesystem::path& bin) {
+    std::ifstream is(bin, std::ios::binary);
+    if (!is) return {};
+    unsigned char ident[16]{};
+    is.read(reinterpret_cast<char*>(ident), sizeof ident);
+    if (!is || ident[0] != 0x7f || ident[1] != 'E'
+            || ident[2] != 'L' || ident[3] != 'F') return {};
+    const bool is64 = ident[4] == 2;
+    const bool le   = ident[5] == 1;
+    if (!is64 || !le) return {};   // the only shape payloads ship
+
+    auto u16 = [&](std::streamoff off) -> std::uint16_t {
+        is.seekg(off); unsigned char b[2]{};
+        is.read(reinterpret_cast<char*>(b), 2);
+        return static_cast<std::uint16_t>(b[0] | (b[1] << 8));
+    };
+    auto u64 = [&](std::streamoff off) -> std::uint64_t {
+        is.seekg(off); unsigned char b[8]{};
+        is.read(reinterpret_cast<char*>(b), 8);
+        std::uint64_t v = 0;
+        for (int i = 7; i >= 0; --i) v = (v << 8) | b[i];
+        return v;
+    };
+
+    const auto phoff     = u64(0x20);
+    const auto phentsize = u16(0x36);
+    const auto phnum     = u16(0x38);
+    if (!is || phoff == 0 || phentsize < 0x38 || phnum == 0) return {};
+
+    constexpr std::uint32_t kPtInterp = 3;
+    for (std::uint16_t i = 0; i < phnum; ++i) {
+        const auto ph = static_cast<std::streamoff>(phoff)
+                      + static_cast<std::streamoff>(i) * phentsize;
+        is.seekg(ph);
+        unsigned char t[4]{};
+        is.read(reinterpret_cast<char*>(t), 4);
+        if (!is) return {};
+        const std::uint32_t type =
+            static_cast<std::uint32_t>(t[0]) | (t[1] << 8)
+          | (t[2] << 16) | (static_cast<std::uint32_t>(t[3]) << 24);
+        if (type != kPtInterp) continue;
+        const auto offset = u64(ph + 0x08);
+        const auto filesz = u64(ph + 0x20);
+        if (filesz == 0 || filesz > 4096) return {};
+        std::string str(static_cast<std::size_t>(filesz), '\0');
+        is.seekg(static_cast<std::streamoff>(offset));
+        is.read(str.data(), static_cast<std::streamsize>(filesz));
+        if (!is) return {};
+        if (auto z = str.find('\0'); z != std::string::npos) str.resize(z);
+        return str;
+    }
+    return {};
+}
+
 std::string baked_runtime_binding(const std::filesystem::path& compilerBin) {
     if (compilerBin.empty()) return {};
     std::error_code ec;
@@ -568,6 +628,21 @@ std::string baked_runtime_binding(const std::filesystem::path& compilerBin) {
                 return r;
         }
     }
+
+    // The compiler's OWN interpreter.
+    //
+    // The two sources above are files mcpp used to write, and mcpp no longer
+    // writes them -- so on a machine where the toolchain was installed after
+    // that change they simply are not there, and the compatibility path that
+    // depends on them answers nothing. That is not hypothetical: it is what
+    // turned CI red while every existing developer machine, which still has
+    // the files from before, stayed green.
+    //
+    // PT_INTERP is produced by the patchelf walk, which still runs on every
+    // install, and it names the glibc payload this toolchain was aligned to --
+    // the same fact the specs held, from a mechanism that has not gone away.
+    if (auto r = from_text(read_elf_interp(compilerBin)); !r.empty())
+        return r;
     return {};
 }
 

src/toolchain/probe.cppm

@@ -291,21 +291,48 @@ probe_sysroot(const std::filesystem::path& compilerBin,
                                      mcpp::platform::null_redirect));
     if (r) {
         auto s = trim_line(*r);
-        if (!s.empty() && std::filesystem::exists(s)) {
-            if (usable(s)) return s;
+
+        // A usable sysroot that belongs to somebody else is still somebody
+        // else's. gcc records this path as a string when it is built and
+        // reports it forever after; on a machine with several checkouts the
+        // recorded one routinely exists AND carries headers, so accepting it
+        // on usability alone hands the build another project's tree. Measured
+        // right here: this repo's gcc reported a sysroot under an unrelated
+        // one, and every build took its headers.
+        //
+        // The ownership test lives inside remap_xlings_baked_sysroot, which is
+        // exactly why the order matters -- the early return below reached it
+        // only when the path was missing, so the case the remap exists for was
+        // the one case it never saw.
+        const bool ownedByThisHome =
+            !s.empty() && mcpp::fallback::sysroot_is_owned(s, compilerBin);
+
+        if (ownedByThisHome && usable(s)) return s;
+        if (!s.empty() && std::filesystem::exists(s) && !usable(s))
             mcpp::log::debug("probe", std::format(
                 "sysroot '{}' exists but lacks usr/include/stdlib.h — ignoring", s));
-        }
 
         // GCC bakes the build-time sysroot into the binary. For xlings-built
         // GCC this is a path like <buildhost>/.xlings/subos/default that
-        // doesn't exist on the user's machine. Remap via fallback module.
+        // doesn't exist on the user's machine -- or exists and belongs to a
+        // different one. Remap via fallback module.
         if (auto remapped = mcpp::fallback::remap_xlings_baked_sysroot(s, compilerBin)) {
             if (usable(*remapped)) return *remapped;
             mcpp::log::debug("probe", std::format(
                 "remapped sysroot '{}' lacks usr/include/stdlib.h — ignoring",
                 remapped->string()));
         }
+
+        // Last resort: a foreign but usable sysroot beats no sysroot. This is
+        // the pre-existing behaviour, kept for machines that have no registry
+        // subos to remap to -- it is a worse answer, not a wrong one, and
+        // taking nothing here would break them outright.
+        if (!s.empty() && std::filesystem::exists(s) && usable(s)) {
+            mcpp::log::verbose("probe", std::format(
+                "using sysroot '{}', which is outside this toolchain's "
+                "registry — no equivalent found under it", s));
+            return std::filesystem::path(s);
+        }
     }
 
     // 2. macOS fallback: use xcrun to discover the SDK path.

tests/unit/test_sysroot_ownership.cpp

@@ -66,4 +66,22 @@ TEST(SysrootOwnership, SiblingPrefixIsNotContainment) {
         kRegistry, kProject));
 }
 
+// A directory whose NAME begins with two dots is not an escape. The first
+// version compared the relative path's text (`rfind("..", 0)`), which called
+// `/home/u/.mcpp/registry/..cache` an escape from the registry -- and did not
+// compile at all on Windows, where `native()` is a wstring. Containment is a
+// question about path components, so it is asked of components.
+TEST(SysrootOwnership, DotDotPrefixedNameIsNotAnEscape) {
+    EXPECT_FALSE(fb::sysroot_is_foreign(
+        kRegistry / "..cache" / "subos" / "default", kRegistry, kProject));
+}
+
+TEST(SysrootOwnership, PathIsUnderIsDirectlyTestable) {
+    EXPECT_TRUE(fb::path_is_under(kRegistry / "a" / "b", kRegistry));
+    EXPECT_TRUE(fb::path_is_under(kRegistry, kRegistry));
+    EXPECT_FALSE(fb::path_is_under(kRegistry.parent_path(), kRegistry));
+    EXPECT_FALSE(fb::path_is_under(kRegistry, {}));
+    EXPECT_FALSE(fb::path_is_under({}, kRegistry));
+}
+
 }  // namespace