fix(features): mcpp test compiled sources a feature had not activated

Same package, same manifest, two commands, different source sets:

    mcpp build --target riscv64-none-elf   skips src/kal/**   (correct)
    mcpp test  --target riscv64-none-elf   compiles it, and dies on
                                           'openkal/abort.h' file not found

The header arrives through that feature's `[feature-deps]`; with the feature
inactive it is not there, and neither are the files that include it.

⭐ TWO FAMILIES REACH THIS CODE AND THEY WANT OPPOSITE THINGS.

  gtest         lists `*/googletest/src/gtest_main.cc` in base `sources` AND
                under `features.main`. The package provides the file
                unconditionally; the feature is a gate over it, and the
                dev-dependency track's per-test main detection must SEE it in
                order to prune it per test.

  riscv-virt-rt names `src/kal/**` under `features.openkal` and nowhere else.
                Those files are not part of the package without the feature.

The engine gated the whole exclusion on "is this a test build", which is right
for the first family and wrong for the second.

⚠️ THIS IS THE FOURTH ATTEMPT, AND THE THIRD WAS ABANDONED ON A MISTAKEN
READING. It was recorded as failing because "gtest's base entry is a glob that
MATCHES the file rather than the same string". Measured against the descriptor
the index actually carries — `compat.gtest.lua` lines 71-73 and 90 — the two
entries are byte-identical. The reason had been written from memory without
opening the file.

What actually defeated that attempt was WHEN the criterion was applied: it
tested membership against `bc.sources` after `drop()` had already removed the
entry, so the test could only ever be false.

The fix snapshots the base globs BEFORE the drop and uses them only in test
mode: a glob in both places is a gate and stays visible; a glob in one place is
a provider and gets the `!` exclusion. The exclusion is the whole mechanism —
`src/kal/**` is never in `bc.sources` at all, because that package declares no
`sources` and its files are matched by the inferred `src/**`, so erasing the
string erases nothing.

Verified, all three of the plan's criteria:

  1. riscv-virt-rt: `mcpp test` no longer compiles src/kal/**; both commands
     exit 0.
  2. mcpp's own 92 unit tests still link and pass (the gtest family).
  3. tests/e2e/138_feature_sources_gate_vs_provider.sh covers both families
     with two minimal packages and no ecosystem dependency.

⭐ (3) was checked the way a regression test has to be: run against the engine
before this commit it fails with exactly the symptom above; against the engine
after it, it passes. The defect survived this long because no test covered both
families at once, and each of the three earlier attempts broke the one it did
not cover.

Author: speak-agent

.agents/docs/2026-08-21-freestanding-outstanding-four.md

@@ -39,6 +39,9 @@ payload: /c/Users/runneradmin/.mcpp/registry/data/xpkgs/xim-x-llvm/*/
 
 ## 1. `mcpp test` 与 `mcpp build` 对 feature 源的判断不一致
 
+> **已修复(mcpp 2026.8.21.1)。** ⚠️ 而修法既不是路线 A 也不是路线 B —— 是第三次
+> 尝试的判据,它当初被以一个**错误的理由**放弃了。见 1.3.1。
+
 ### 1.1 现象与位置
 
 同一个包、同一份清单,两条命令编译的源文件集合不同:
@@ -82,11 +85,38 @@ base `sources` 里,而 dev 依赖那条轨道的「逐测试 main 探测」需
 |---|---|
 | DROP 与 `!` 排除在两种模式下都跑 | **弄坏 gtest**:mcpp 自己的单测链接失败,`ld returned 1 exit status` |
 | test 模式只删 glob 字符串、不加 `!` 排除 | 无效:`src/kal/**` 从来不在 `bc.sources` 里,删字符串什么都没删,文件仍由 base glob `src/**` 匹配 |
-| 按「该 glob 是否也出现在 base `sources`」判别 | 无效:gtest 的 base 是一条**能匹配到**那个文件的 glob,不是同一个字符串;字符串相等判别不到 |
+| 按「该 glob 是否也出现在 base `sources`」判别 | 记录为无效,理由是「gtest 的 base 是一条能匹配到那个文件的 glob,不是同一个字符串」。**这条记录是错的** —— 见 1.3.1 |
 
 三次都已撤销。**不留半个修复**:把一个只在部分情形下正确的门放进已发布的
 引擎,比一个有文档的缺陷更糟。
 
+### 1.3.1 ⚠️ 第三次尝试的判据是对的,被放弃的理由是错的
+
+去读索引真正携带的描述符 `pkgs/c/compat.gtest.lua`:
+
+```lua
+sources  = { "*/googletest/src/gtest-all.cc",
+             "*/googletest/src/gtest_main.cc" },   -- 第 71–73 行
+features = { ["main"] = { sources = { "*/googletest/src/gtest_main.cc" } } },  -- 第 90 行
+```
+
+两处**逐字节相同**。所以「字符串相等判别不到」这句话与事实不符,而当初把它写进
+文档时没有去读那个文件 —— 判据被一个凭印象写下的理由否掉了。
+
+真正让第三次尝试失效的是**判据被施加的时机**:membership 是拿 `bc.sources` 去比
+的,而 `drop()` 已经先一步把那条 glob 从里面删掉了,于是这个测试只可能为假。
+
+⭐ **修法**:在 `drop()` 之前把 base 的 glob 集合快照下来,并且只在 test 模式使用
+它 ——
+
+* glob 同时出现在 base `sources` 与 feature 里 ⇒ 这是一个**门**(gtest 那一族),
+  test 模式下保持可见,逐测试 main 探测仍然剪得掉它;
+* glob 只出现在 feature 里 ⇒ 这是一个**提供者**(riscv-virt-rt 那一族),
+  test 模式下也要 `!` 排除。
+
+⚠️ 而 `!` 排除才是整个机制,删 glob 字符串不是:`src/kal/**` 从来就不在
+`bc.sources` 里(该包根本没声明 `sources`),它的文件由推导出的 `src/**` 匹配。
+
 ### 1.4 正确的修法
 
 三次失败指向同一个结论:**判据不是「这条 glob 字符串在不在 base 里」,而是
@@ -129,14 +159,19 @@ openkal = { sources = ["src/kal/**"] }                             # 只经 feat
 
 必须同时满足,**任缺其一即视为未修复**:
 
-1. `mcpplibs/riscv-virt-rt` 不带 feature 时 `mcpp test` 与 `mcpp build`
-   编出的目标文件集合相同;
-2. mcpp 自己的 `mcpp test unit/test_manifest` 仍然链接并通过(gtest 那一族);
-3. 两条断言进 e2e,用两个最小包分别表达上面两族,而不是依赖生态包。
+1. ✅ `mcpplibs/riscv-virt-rt` 不带 feature 时 `mcpp test` 不再编译
+   `src/kal/**`,两条命令都以 0 退出(此前 test 死于
+   `'openkal/abort.h' file not found`);
+2. ✅ mcpp 自己的 92 个单测仍然链接并通过(gtest 那一族);
+3. ✅ `tests/e2e/138_feature_sources_gate_vs_provider.sh`,两个最小包分别表达
+   上面两族,不依赖任何生态包。
 
 ⚠️ 第 3 条是重点。这个缺陷之所以活到今天,是因为**没有任何测试同时覆盖两族**;
 只修不测,下一次同样的改动会再次在两者之间摇摆。
 
+⭐ 那条 e2e 已按「回归测试必须先失败」验证过:拿修复前的引擎跑它,它以正是本节
+开头那句症状失败;拿修复后的引擎跑它,它通过。
+
 ### 1.6 副作用
 
 修好之后,`mcpplibs/riscv-virt-rt` CI 里那句
@@ -598,7 +633,7 @@ openarch 的第三个后端因此写得出来,而**第三台机器正是把门
 | | 项 | 状态 | 建议 |
 |---|---|---|---|
 | 1 | Windows libc++(第 2 节) | 未做。⭐ 结论已从「加进载荷」**改为独立成包**,理由见 2.5 | 先做 2.1 的测量,再按三步落地。**我们自己能做完** |
-| 2 | feature 源不一致(第 1 节) | 未做,三次修法被证伪 | 需要 glob 展开 + 两族的 e2e |
+| 2 | feature 源不一致(第 1 节) | ✅ **已修复**(2026.8.21.1)。⚠️ 修法就是第三次尝试的判据 —— 它当初被一个**没有去读文件就写下的理由**否掉了 | — |
 | 3 | openarch(第 3 节) | ✅ **0.4.0 已完成**:混合式的根、两个门面、feature 选后端、三个指令集 | — |
 | 4 | openarch 的时钟归属(3.3) | 未做 | ⭐ 先作为**调研**:两种启动方式各一个最小探针,答案决定接口归属 |
 | 5 | x86_64 裸机(第 4 节) | ✅ **阶段 4 已完成**(目标行 + 引擎的直连链接);阶段 1–3 未做 | `xim:qemu-x86` 仍缺。阶段 1 先做 linux x64 供 openkal-uefi 用;阶段 2 用**临时 PR 的 CI 矩阵**跑通五条腿再谈收录 |

src/build/prepare.cppm

@@ -4535,6 +4535,45 @@ prepare_build(bool print_fingerprint,
             // doubly-listed gtest_main.cc cannot land twice.
             auto& bc = pkg.manifest.buildConfig;
             if (!bc.featureSources.empty()) {
+                // ⭐ WHETHER A FEATURE *GATES* A SOURCE OR *PROVIDES* IT, AND
+                // THE ANSWER IS WRITTEN IN THE MANIFEST ALREADY.
+                //
+                // Two families of package reach this code and they want
+                // opposite things under `mcpp test`:
+                //
+                //   gtest         lists `*/googletest/src/gtest_main.cc` in
+                //                 base `sources` AND under `features.main`.
+                //                 The package provides the file unconditionally;
+                //                 the feature is a gate over it. The
+                //                 dev-dependency track's per-test main detection
+                //                 must still SEE it in order to prune it per
+                //                 test, so an inactive gate must not make it
+                //                 vanish.
+                //
+                //   riscv-virt-rt names `src/kal/**` under `features.openkal`
+                //                 and nowhere else. The package does not provide
+                //                 those files at all without the feature — the
+                //                 headers they include arrive through that
+                //                 feature's `[feature-deps]` — so compiling them
+                //                 fails on `'openkal/abort.h' file not found`.
+                //
+                // The discriminator is membership in base `sources`, evaluated
+                // BEFORE the drop below removes it. A glob in both places is a
+                // gate; a glob in one place is a provider.
+                //
+                // ⚠️ THIS IS THE FOURTH ATTEMPT, AND THE THIRD WAS ABANDONED ON
+                // A MISTAKEN READING. It was recorded as failing because
+                // "gtest's base entry is a glob that MATCHES the file rather
+                // than the same string". Measured against the descriptor the
+                // index actually carries, the two entries are byte-identical
+                // (`compat.gtest.lua` lines 71 and 90). The criterion was
+                // sound; what it was applied to was not — the earlier attempt
+                // compared against `bc.sources` AFTER `drop()` had already
+                // removed the entry, so the membership test could only ever be
+                // false.
+                std::set<std::string> baseGlobs(bc.sources.begin(), bc.sources.end());
+                baseGlobs.insert(pkg.manifest.modules.sources.begin(),
+                                 pkg.manifest.modules.sources.end());
                 if (!includeDevDeps) {
                     // glob → owned by at least one ACTIVE feature?
                     std::set<std::string> activeNow(active.begin(), active.end());
@@ -4558,6 +4597,30 @@ prepare_build(bool print_fingerprint,
                         pkg.manifest.modules.sources.push_back("!" + g);
                     }
                 }
+                else {
+                    // `mcpp test`. The gate that build mode applies wholesale is
+                    // applied here only to the globs the package provides
+                    // NOWHERE ELSE, which leaves gtest's doubly-listed source
+                    // visible and stops riscv-virt-rt's feature-only sources
+                    // from being compiled without their feature.
+                    //
+                    // ⚠️ THE `!` EXCLUSION IS THE WHOLE MECHANISM, NOT THE GLOB
+                    // REMOVAL. `src/kal/**` is never IN `bc.sources` — the
+                    // package declares no `sources` at all and its files are
+                    // matched by the inferred `src/**`. Erasing the string
+                    // erases nothing; only an exclusion gates.
+                    std::set<std::string> activeNow(active.begin(), active.end());
+                    std::map<std::string, bool> gated;
+                    for (auto& [f, globs] : bc.featureSources)
+                        for (auto& g : globs)
+                            gated[g] = gated[g] || activeNow.contains(f);
+                    for (auto& [g, isActive] : gated) {
+                        if (isActive || g.starts_with("!")) continue;
+                        if (baseGlobs.contains(g)) continue;   // a gate, not a provider
+                        bc.sources.push_back("!" + g);
+                        pkg.manifest.modules.sources.push_back("!" + g);
+                    }
+                }
                 std::set<std::string> activeSet(active.begin(), active.end());
                 auto add = [](std::vector<std::string>& v, const std::string& g) {
                     if (std::ranges::find(v, g) == v.end()) v.push_back(g);

tests/e2e/138_feature_sources_gate_vs_provider.sh

@@ -0,0 +1,147 @@
+#!/usr/bin/env bash
+# requires: unix-shell
+# A feature that GATES a source and a feature that PROVIDES one, under both
+# `mcpp build` and `mcpp test`.
+#
+# ⚠️ THIS DEFECT SURVIVED FOR MONTHS BECAUSE NO TEST COVERED BOTH FAMILIES, AND
+# THREE ATTEMPTED FIXES EACH BROKE THE ONE THEY DID NOT COVER.
+#
+# Two shapes of package reach the same code in `prepare_build`, and under
+# `mcpp test` they want opposite things:
+#
+#   the GATE family      gtest lists `*/googletest/src/gtest_main.cc` in base
+#                        `sources` AND under `features.main`. The package
+#                        provides the file unconditionally; the feature is a
+#                        switch over it. The dev-dependency track's per-test
+#                        main detection has to SEE it to prune it per test, so
+#                        an inactive gate must not make it disappear.
+#
+#   the PROVIDER family  riscv-virt-rt names `src/kal/**` under
+#                        `features.openkal` and nowhere else. Those files are
+#                        not part of the package without the feature — the
+#                        headers they include arrive through that feature's
+#                        `[feature-deps]` — so compiling them fails on a header
+#                        that was never meant to be there.
+#
+# The engine gated the whole exclusion on "is this a test build", which is
+# right for the first family and wrong for the second. Fixing it by removing
+# the gate broke gtest; fixing it by removing only the glob string was a no-op,
+# because a provider's glob is not in base `sources` at all and its files are
+# matched by the inferred `src/**`.
+#
+# Both families are asserted here so that the next change to this code cannot
+# satisfy one at the other's expense.
+set -e
+
+TMP=$(mktemp -d)
+trap "rm -rf $TMP" EXIT
+cd "$TMP"
+
+# ── The PROVIDER family ─────────────────────────────────────────────────────
+#
+# `src/gated/**` is named only by the feature, and the file includes a header
+# that does not exist. With the feature inactive both commands must ignore it;
+# a command that compiles it fails on the missing header, which is exactly the
+# symptom the real package produced.
+mkdir -p provider/src/gated provider/tests
+cat > provider/mcpp.toml <<'EOF'
+[package]
+name    = "provider"
+version = "0.1.0"
+
+# ⚠️ NO `[build] sources`, WHICH IS THE POINT. The base set is the inferred
+# `src/**`, which matches `src/gated/only_with_feature.cpp` — so removing the
+# feature's glob STRING from a list it was never in gates nothing.
+[features]
+default = []
+gated   = { sources = ["src/gated/**"] }
+EOF
+cat > provider/src/lib.cpp <<'EOF'
+int provider_value() { return 7; }
+EOF
+cat > provider/src/gated/only_with_feature.cpp <<'EOF'
+// The header arrives with the feature's dependencies and does not exist
+// without it. Compiling this file without the feature is the defect.
+#include <a_header_the_feature_would_have_brought.h>
+int gated_value() { return 1; }
+EOF
+cat > provider/tests/basic.cpp <<'EOF'
+extern int provider_value();
+int main() { return provider_value() == 7 ? 0 : 1; }
+EOF
+
+cd provider
+"$MCPP" build > build.log 2>&1 || { cat build.log; echo "provider: build compiled a feature-only source"; exit 1; }
+"$MCPP" test  > test.log  2>&1 || { cat test.log;  echo "provider: TEST compiled a feature-only source — the defect this file exists for"; exit 1; }
+
+if find target -name '*only_with_feature*' | grep -q .; then
+    find target -name '*only_with_feature*'
+    echo "provider: an object was produced for a source the feature did not activate"
+    exit 1
+fi
+
+# With the feature ON it must be reached — otherwise the check above would pass
+# for a build that simply ignores feature sources entirely.
+if "$MCPP" build --features gated > gated.log 2>&1; then
+    cat gated.log
+    echo "provider: the feature did not bring its own source in"
+    exit 1
+fi
+grep -q "a_header_the_feature_would_have_brought.h" gated.log || {
+    cat gated.log
+    echo "provider: activating the feature failed for some other reason"; exit 1; }
+cd ..
+
+# ── The GATE family ─────────────────────────────────────────────────────────
+#
+# The same glob in base `sources` and under a feature. `mcpp build` excludes it;
+# `mcpp test` keeps it visible, which is what the dev-dependency track's
+# per-test main detection depends on.
+mkdir -p gate/src gate/tests
+cat > gate/mcpp.toml <<'EOF'
+[package]
+name    = "gate"
+version = "0.1.0"
+
+# ⚠️ `src/gated_main.cpp` IS IN BOTH LISTS, EXACTLY AS gtest'S DESCRIPTOR HAS IT.
+# The package provides the file; the feature is a switch over it.
+[build]
+sources = ["src/lib.cpp", "src/gated_main.cpp"]
+
+[features]
+default = []
+main    = { sources = ["src/gated_main.cpp"] }
+EOF
+cat > gate/src/lib.cpp <<'EOF'
+int gate_value() { return 11; }
+EOF
+cat > gate/src/gated_main.cpp <<'EOF'
+int gated_main_marker() { return 42; }
+EOF
+cat > gate/tests/basic.cpp <<'EOF'
+extern int gate_value();
+int main() { return gate_value() == 11 ? 0 : 1; }
+EOF
+
+cd gate
+"$MCPP" build > build.log 2>&1 || { cat build.log; echo "gate: build failed"; exit 1; }
+if find target -name '*gated_main*' | grep -q .; then
+    find target -name '*gated_main*'
+    echo "gate: build compiled a gated source with the feature inactive"
+    exit 1
+fi
+
+rm -rf target
+"$MCPP" test > test.log 2>&1 || { cat test.log; echo "gate: test failed"; exit 1; }
+# ⚠️ THE ASSERTION IS THAT IT IS STILL THERE. A fix that excluded every
+# inactive feature glob under `mcpp test` would remove it — and would then
+# break gtest, whose per-test main detection needs to see the file in order to
+# prune it. Measured once as `ld returned 1 exit status` across mcpp's own
+# unit tests.
+find target -name '*gated_main*' | grep -q . || {
+    echo "gate: a source the package provides unconditionally vanished under \`mcpp test\`"
+    echo "      (this is the shape that broke gtest)"
+    exit 1; }
+cd ..
+
+echo "PASS: a feature that gates a source and a feature that provides one behave correctly under both commands"