The two upstream-derived packages take upstream's version

A PACKAGE THAT VENDORS SOMEONE ELSE'S SOURCES TAKES THEIR NUMBER AS WELL AS
THEIR NAMESPACE.

`picolibc.picolibc` and `llvm.compiler-rt-builtins` were published with an
independent version (0.1.x), on the argument that a version must move when the
packaging changes and upstream's has not. The fourth segment answers that
without a second numbering scheme: it orders strictly above the bare upstream
number, because mcpp compares an arbitrary-length dot list with absent segments
as zero, and it satisfies every requirement the bare number satisfies, because a
bare requirement is a caret. A consumer therefore writes the number upstream
released:

    picolibc.picolibc         = "1.8.12"
    llvm.compiler-rt-builtins = "22.1.8"

Both entries publish `.1` rather than the bare number, which is the scheme in
use rather than an exception to it: tags named `1.8.12` and `22.1.8` had already
been published carrying different bytes, and a published version must not come
to mean something else.

VERIFIED AGAINST UPSTREAM RATHER THAN ASSERTED. Every one of picolibc's 2109
vendored files is byte-identical to the 1.8.12 release tarball, whose
`meson.build` declares that version; every one of the 347 vendored builtins is
byte-identical to `compiler-rt/lib/builtins` at the tag `llvmorg-22.1.8`.

picolibc's licence field was wrong and is now counted rather than guessed. The
tree descends from newlib and carries five identifiers over the files actually
shipped: BSD-3-Clause (902), BSD-3-Clause-Clear (31), MIT (8),
BSD-2-Clause-FreeBSD (5), BSD-2-Clause (4). The entry declared BSD-3-Clause and
BSD-2-Clause. `mcpp sbom` emits this field into a document a legal review reads,
where one wrong identifier reads as examined and is worse than silence.

`mcpplibs.cortex-m-rt` moves to 0.2.3, in which a `main` that returns terminates
instead of hanging for ever: C defines returning from `main` as `exit(status)`,
and the startup file called `board_main` for effect and then spun. With a C
library in the graph that discarded buffered output; with none, the program ran
until something killed it. The template writes an explicit `board::exit(0)`, so
every test of the package took the one path that worked.

The superseded versions are withdrawn from the table rather than left beside
their replacements: they are hours old, nothing consumes them, and leaving them
would make the same bytes installable under two identities, one of which
contradicts the convention.

AUDITED MECHANICALLY BEFORE SUBMISSION. Across the seven entries this batch
touches — 32 versions, 64 URLs — every GLOBAL and CN URL was fetched, hashed and
compared with the index, and every tarball's own `mcpp.toml` was read and
checked to declare the same namespace, name and version the entry claims. No
disagreement was found.

Author: speak-agent

pkgs/c/cortex-m-rt.lua

@@ -1,7 +1,7 @@
 -- Board support for Cortex-M: startup, memory layout, a semihosting console,
 -- and the runners that reach an emulator or a debug probe.
 --
--- ⭐⭐ ONE PACKAGE, TWO ENVIRONMENTS — AND SINCE 0.2.1, THREE FEATURES.
+-- ONE PACKAGE, TWO ENVIRONMENTS — AND SINCE 0.2.1, THREE FEATURES.
 --
 -- A board reached through an emulator and the same board reached through a
 -- debug probe differ in the argv of their runners and in NOTHING else: the
@@ -14,20 +14,20 @@
 --     mcpp run --features hardware    # the board, over a debug probe
 --     mcpp run --features libc        # with a C library
 --
--- ⭐ `mcpp run` IS THE WHOLE OF THE COMMON CASE, ON EITHER. On a device,
+-- `mcpp run` IS THE WHOLE OF THE COMMON CASE, ON EITHER. On a device,
 -- running a program means writing it, resetting, attaching to its output and
 -- reading its exit status — ONE command, not several. So that is the DEFAULT
 -- runner in both environments, and the command a developer types does not
 -- change when the board arrives. `flash` and `serve` are named exceptions, and
 -- the engine knows neither name.
 --
--- ⚠️ EACH ENVIRONMENT BRINGS ITS OWN TOOL, ON THE `run` TIER. `qemu-arm` under
+-- EACH ENVIRONMENT BRINGS ITS OWN TOOL, ON THE `run` TIER. `qemu-arm` under
 -- `[feature-xlings.emulator]`, `probe-rs` under `[feature-xlings.hardware]`,
 -- both `when = "run"` — so a consumer downloads exactly what the feature they
 -- selected needs, and a CI job that compiles firmware and never flashes it
 -- downloads nothing at all. Requires mcpp 2026.9.4.2.
 --
--- ⚠️ AND THE BOARD SETS THE THREAD POINTER, which is what makes `libc` work.
+-- AND THE BOARD SETS THE THREAD POINTER, which is what makes `libc` work.
 -- picolibc reaches `stdout` through thread-local storage, and a freestanding
 -- image has none until the startup file sets one. Measured without it: a
 -- `printf` program linked cleanly, ran, printed NOTHING and hung. There is no
@@ -43,30 +43,30 @@ package = {
 
     xpm = {
         linux = {
-            ["0.2.1"] = {
+            ["0.2.3"] = {
                 url    = {
-                    GLOBAL = "https://github.com/mcpplibs/cortex-m-rt/archive/refs/tags/0.2.1.tar.gz",
-                    CN     = "https://gitcode.com/mcpp-res/cortex-m-rt/releases/download/0.2.1/cortex-m-rt-0.2.1.tar.gz",
+                    GLOBAL = "https://github.com/mcpplibs/cortex-m-rt/archive/refs/tags/0.2.3.tar.gz",
+                    CN     = "https://gitcode.com/mcpp-res/cortex-m-rt/releases/download/0.2.3/cortex-m-rt-0.2.3.tar.gz",
                 },
-                sha256 = "d4983148c80cd5366a3374f3bc5a379f9688657c516868e459eefd31b97cfd60",
+                sha256 = "2b926b10df89ad35d9eff7d1c318b334317d106525cb24eea00a0c623e448ce7",
             },
         },
         macosx = {
-            ["0.2.1"] = {
+            ["0.2.3"] = {
                 url    = {
-                    GLOBAL = "https://github.com/mcpplibs/cortex-m-rt/archive/refs/tags/0.2.1.tar.gz",
-                    CN     = "https://gitcode.com/mcpp-res/cortex-m-rt/releases/download/0.2.1/cortex-m-rt-0.2.1.tar.gz",
+                    GLOBAL = "https://github.com/mcpplibs/cortex-m-rt/archive/refs/tags/0.2.3.tar.gz",
+                    CN     = "https://gitcode.com/mcpp-res/cortex-m-rt/releases/download/0.2.3/cortex-m-rt-0.2.3.tar.gz",
                 },
-                sha256 = "d4983148c80cd5366a3374f3bc5a379f9688657c516868e459eefd31b97cfd60",
+                sha256 = "2b926b10df89ad35d9eff7d1c318b334317d106525cb24eea00a0c623e448ce7",
             },
         },
         windows = {
-            ["0.2.1"] = {
+            ["0.2.3"] = {
                 url    = {
-                    GLOBAL = "https://github.com/mcpplibs/cortex-m-rt/archive/refs/tags/0.2.1.tar.gz",
-                    CN     = "https://gitcode.com/mcpp-res/cortex-m-rt/releases/download/0.2.1/cortex-m-rt-0.2.1.tar.gz",
+                    GLOBAL = "https://github.com/mcpplibs/cortex-m-rt/archive/refs/tags/0.2.3.tar.gz",
+                    CN     = "https://gitcode.com/mcpp-res/cortex-m-rt/releases/download/0.2.3/cortex-m-rt-0.2.3.tar.gz",
                 },
-                sha256 = "d4983148c80cd5366a3374f3bc5a379f9688657c516868e459eefd31b97cfd60",
+                sha256 = "2b926b10df89ad35d9eff7d1c318b334317d106525cb24eea00a0c623e448ce7",
             },
         },
     },

pkgs/l/llvm.compiler-rt-builtins.lua

@@ -1,59 +1,69 @@
 -- The compiler-rt builtins as a SOURCE package.
 --
--- ⭐ TWO PACKAGES RATHER THAN ONE, AND THE EDGE IS THE REASON. picolibc's
+-- TWO PACKAGES RATHER THAN ONE, AND THE EDGE IS THE REASON. picolibc's
 -- `printf` formats floats through ryu, which calls routines no C library
 -- defines — and on rv64 a 128-bit shift the instruction set has none for. A C
 -- library carrying its own copy would be wrong for anyone supplying their own
 -- builtins; the dependency edge says the same thing and can be overridden.
 --
--- ⚠️ AND compiler-rt DOES NOT RECOGNISE A `thumb*` TRIPLE. Configuring its own
+-- AND compiler-rt DOES NOT RECOGNISE A `thumb*` TRIPLE. Configuring its own
 -- CMake with `thumbv6m-none-eabi` produces a build tree with NO builtins target
 -- at all: cmake succeeds, ninja reports "no work to do", and the failure
 -- surfaces later as a missing file. A source package has no archive to name and
 -- no triple to translate.
 --
--- ⚠️ THE NAMESPACE IS UPSTREAM'S, NOT `mcpplibs`. This package vendors someone
+-- THE NAMESPACE IS UPSTREAM'S, NOT `mcpplibs`. This package vendors someone
 -- else's sources and adds a manifest; the code is theirs and the identity says
 -- so. `mcpplibs` is for packages whose CONTENT this organisation wrote.
 --
--- ⭐ The wrapper REPOSITORY can still live under mcpplibs — `ocornut.imgui` is
+-- The wrapper REPOSITORY can still live under mcpplibs — `ocornut.imgui` is
 -- published from `mcpplibs/imgui-m` for exactly this reason. Where the manifest
 -- lives and whose code it describes are different questions.
+-- THE VERSION IS UPSTREAM'S, AND THE FOURTH SEGMENT IS THE PACKAGING REVISION.
+--
+-- `22.1.8` is the LLVM release every one of the 347 vendored files was compared
+-- against, byte for byte, at the tag `llvmorg-22.1.8`. The number carries
+-- information no independent one could: these routines are an ABI contract with
+-- a COMPILER, and "the builtins that ship with the clang in this toolchain" is
+-- the question a consumer is asking. A change to the PACKAGING moves the fourth
+-- segment, which orders above the bare number and satisfies the same
+-- requirements.
+--
 package = {
     spec        = "1",
     namespace   = "llvm",
     name        = "compiler-rt-builtins",
-    description = "The compiler-rt 22.1.8 builtins as a source package: the routines a compiler emits calls to, compiled with the consuming program's own flags",
+    description = "The compiler-rt builtins as a source package: LLVM's replacement for libgcc — the routines a compiler emits calls to — compiled with the consuming program's own flags",
     licenses    = {"Apache-2.0 WITH LLVM-exception"},
     repo        = "https://github.com/mcpplibs/compiler-rt-builtins",
     type        = "package",
 
     xpm = {
         linux = {
-            ["0.1.1"] = {
+            ["22.1.8.1"] = {
                 url    = {
-                    GLOBAL = "https://github.com/mcpplibs/compiler-rt-builtins/archive/refs/tags/0.1.1.tar.gz",
-                    CN     = "https://gitcode.com/mcpp-res/compiler-rt-builtins/releases/download/0.1.1/compiler-rt-builtins-0.1.1.tar.gz",
+                    GLOBAL = "https://github.com/mcpplibs/compiler-rt-builtins/archive/refs/tags/22.1.8.1.tar.gz",
+                    CN     = "https://gitcode.com/mcpp-res/compiler-rt-builtins/releases/download/22.1.8.1/compiler-rt-builtins-22.1.8.1.tar.gz",
                 },
-                sha256 = "443673d32137ae64896e341cce52f76a2e8c183cad86d5772a457c4cf4daf513",
+                sha256 = "799797e79e927d28b949e8723d9642e2b8a9d8e997b8c56ecc84ee8220228da3",
             },
         },
         macosx = {
-            ["0.1.1"] = {
+            ["22.1.8.1"] = {
                 url    = {
-                    GLOBAL = "https://github.com/mcpplibs/compiler-rt-builtins/archive/refs/tags/0.1.1.tar.gz",
-                    CN     = "https://gitcode.com/mcpp-res/compiler-rt-builtins/releases/download/0.1.1/compiler-rt-builtins-0.1.1.tar.gz",
+                    GLOBAL = "https://github.com/mcpplibs/compiler-rt-builtins/archive/refs/tags/22.1.8.1.tar.gz",
+                    CN     = "https://gitcode.com/mcpp-res/compiler-rt-builtins/releases/download/22.1.8.1/compiler-rt-builtins-22.1.8.1.tar.gz",
                 },
-                sha256 = "443673d32137ae64896e341cce52f76a2e8c183cad86d5772a457c4cf4daf513",
+                sha256 = "799797e79e927d28b949e8723d9642e2b8a9d8e997b8c56ecc84ee8220228da3",
             },
         },
         windows = {
-            ["0.1.1"] = {
+            ["22.1.8.1"] = {
                 url    = {
-                    GLOBAL = "https://github.com/mcpplibs/compiler-rt-builtins/archive/refs/tags/0.1.1.tar.gz",
-                    CN     = "https://gitcode.com/mcpp-res/compiler-rt-builtins/releases/download/0.1.1/compiler-rt-builtins-0.1.1.tar.gz",
+                    GLOBAL = "https://github.com/mcpplibs/compiler-rt-builtins/archive/refs/tags/22.1.8.1.tar.gz",
+                    CN     = "https://gitcode.com/mcpp-res/compiler-rt-builtins/releases/download/22.1.8.1/compiler-rt-builtins-22.1.8.1.tar.gz",
                 },
-                sha256 = "443673d32137ae64896e341cce52f76a2e8c183cad86d5772a457c4cf4daf513",
+                sha256 = "799797e79e927d28b949e8723d9642e2b8a9d8e997b8c56ecc84ee8220228da3",
             },
         },
     },

pkgs/p/picolibc.picolibc.lua

@@ -1,6 +1,6 @@
 -- picolibc as a SOURCE package: compiled with the consuming program's own flags.
 --
--- ⭐⭐ THERE IS NO MULTILIB HERE, AND THAT IS WHY IT IS A SOURCE PACKAGE.
+-- THERE IS NO MULTILIB HERE, AND THAT IS WHY IT IS A SOURCE PACKAGE.
 --
 -- A prebuilt C library ships one build per ABI a target table can name — seven
 -- for Cortex-M alone — and every consumer then finds the right one through a
@@ -14,59 +14,73 @@
 -- directories and the soft-float row received a library carrying
 -- `Tag_ABI_HardFP_use`. Nothing failed at build time.
 --
--- ⚠️ AND THE HEADERS WERE NEVER PER-PROFILE. Measured across those seven
+-- AND THE HEADERS WERE NEVER PER-PROFILE. Measured across those seven
 -- builds, the whole include tree — `picolibc.h` and `newlib.h`, which meson
 -- GENERATES, included — is byte-identical. The prebuilt ships seven copies of
 -- one directory.
 --
--- ⚠️ `picocrt` IS DELIBERATELY ABSENT. A startup object decides where execution
+-- `picocrt` IS DELIBERATELY ABSENT. A startup object decides where execution
 -- begins and how it reaches the host — which board is running. Choosing among
 -- picolibc's nine variants is a board-support package's job; `cortex-m-rt`
 -- supplies its own, including the thread-pointer initialisation without which a
 -- `printf` program links cleanly, runs, prints nothing and hangs.
 --
--- ⚠️ THE NAMESPACE IS UPSTREAM'S, NOT `mcpplibs`. This package vendors someone
+-- THE NAMESPACE IS UPSTREAM'S, NOT `mcpplibs`. This package vendors someone
 -- else's sources and adds a manifest; the code is theirs and the identity says
 -- so. `mcpplibs` is for packages whose CONTENT this organisation wrote.
 --
--- ⭐ The wrapper REPOSITORY can still live under mcpplibs — `ocornut.imgui` is
+-- The wrapper REPOSITORY can still live under mcpplibs — `ocornut.imgui` is
 -- published from `mcpplibs/imgui-m` for exactly this reason. Where the manifest
 -- lives and whose code it describes are different questions.
+-- THE VERSION IS UPSTREAM'S, AND THE FOURTH SEGMENT IS THE PACKAGING REVISION.
+--
+-- `1.8.12` is what upstream released and what every one of the 2109 vendored
+-- files was compared against, byte for byte. A change to the PACKAGING moves
+-- the fourth segment: `1.8.12.1` orders strictly above `1.8.12`, because mcpp
+-- compares an arbitrary-length dot list with absent segments as zero, and
+-- satisfies every requirement `1.8.12` satisfies, because a bare requirement is
+-- a caret. A consumer therefore writes the number upstream released.
+--
 package = {
     spec        = "1",
     namespace   = "picolibc",
     name        = "picolibc",
-    description = "picolibc 1.8.12 as a source package: a freestanding C library compiled with the consuming program's own flags, so there is no multilib and no ABI convention to match",
-    licenses    = {"BSD-3-Clause", "BSD-2-Clause"},
+    description = "picolibc as a source package: a freestanding C library compiled with the consuming program's own flags, so there is no multilib and no ABI convention to match",
+    -- Counted over the files actually shipped, not guessed. picolibc descends
+    -- from newlib and the vendored tree carries five identifiers: BSD-3-Clause
+    -- (902 files), BSD-3-Clause-Clear (31), MIT (8), BSD-2-Clause-FreeBSD (5),
+    -- BSD-2-Clause (4). `LICENSE.picolibc` is upstream's per-file mapping.
+    licenses    = {"BSD-3-Clause", "BSD-3-Clause-Clear", "MIT",
+                   "BSD-2-Clause-FreeBSD", "BSD-2-Clause"},
     repo        = "https://github.com/mcpplibs/picolibc",
     type        = "package",
 
     xpm = {
         linux = {
-            ["0.1.1"] = {
+            ["1.8.12.1"] = {
                 url    = {
-                    GLOBAL = "https://github.com/mcpplibs/picolibc/archive/refs/tags/0.1.1.tar.gz",
-                    CN     = "https://gitcode.com/mcpp-res/picolibc/releases/download/0.1.1/picolibc-0.1.1.tar.gz",
+                    GLOBAL = "https://github.com/mcpplibs/picolibc/archive/refs/tags/1.8.12.1.tar.gz",
+                    CN     = "https://gitcode.com/mcpp-res/picolibc/releases/download/1.8.12.1/picolibc-1.8.12.1.tar.gz",
                 },
-                sha256 = "2265a49e58ed02b2166a4cbef40595a2250c7a0821156f96d4e04ae2086ccf89",
+                sha256 = "8c148d5cce7857caeeeacacc95c28e1bbdf13cc06408876ae2fdaece2caaefa8",
             },
         },
         macosx = {
-            ["0.1.1"] = {
+            ["1.8.12.1"] = {
                 url    = {
-                    GLOBAL = "https://github.com/mcpplibs/picolibc/archive/refs/tags/0.1.1.tar.gz",
-                    CN     = "https://gitcode.com/mcpp-res/picolibc/releases/download/0.1.1/picolibc-0.1.1.tar.gz",
+                    GLOBAL = "https://github.com/mcpplibs/picolibc/archive/refs/tags/1.8.12.1.tar.gz",
+                    CN     = "https://gitcode.com/mcpp-res/picolibc/releases/download/1.8.12.1/picolibc-1.8.12.1.tar.gz",
                 },
-                sha256 = "2265a49e58ed02b2166a4cbef40595a2250c7a0821156f96d4e04ae2086ccf89",
+                sha256 = "8c148d5cce7857caeeeacacc95c28e1bbdf13cc06408876ae2fdaece2caaefa8",
             },
         },
         windows = {
-            ["0.1.1"] = {
+            ["1.8.12.1"] = {
                 url    = {
-                    GLOBAL = "https://github.com/mcpplibs/picolibc/archive/refs/tags/0.1.1.tar.gz",
-                    CN     = "https://gitcode.com/mcpp-res/picolibc/releases/download/0.1.1/picolibc-0.1.1.tar.gz",
+                    GLOBAL = "https://github.com/mcpplibs/picolibc/archive/refs/tags/1.8.12.1.tar.gz",
+                    CN     = "https://gitcode.com/mcpp-res/picolibc/releases/download/1.8.12.1/picolibc-1.8.12.1.tar.gz",
                 },
-                sha256 = "2265a49e58ed02b2166a4cbef40595a2250c7a0821156f96d4e04ae2086ccf89",
+                sha256 = "8c148d5cce7857caeeeacacc95c28e1bbdf13cc06408876ae2fdaece2caaefa8",
             },
         },
     },