fix(build): a package's generated inputs come before its compiles; an empty link is refused (2026.8.30.1)

[Sunrisepeak]

Closes #534. Addresses the mcpp-side half of #533 (the xlings-side root cause is openxlings/xlings#576).

Analysis and the cross-repo plan are in .agents/docs/2026-08-30-issues-532-533-534-analysis.md and .agents/docs/2026-08-30-cross-repo-fix-plan-532-533-534.md. Every claim below has a reproduction recorded there.

---

One change of mind, three places

Each defect here is somewhere that answered "is this ready?" from a proxy instead of from the artifact.

answerer	trusted	now trusts
the ninja graph	"a Source action's outputs ARE the compile edge's inputs"	an explicit order-only edge — because headers never are
a link edge	that its rule's variables are defined because its inputs exist	a manifest-level check
.mcpp_ok	the installer's exit code + a directory the installer creates first	one entry the package actually installed

That is why they are one PR: they are one decision, applied where it was missing.

#534 — the filed diagnosis was wrong, and the defect is larger

Reported as an intermittent race in dependency packages. It is deterministic, and it reaches the root project too.

role = "source" is documented as "outputs join the compile set; the compile edge consumes them". True of a generated .cpp; false of a generated .h, which is reached through -I, never appears as an edge input, and whose depfile does not exist until a compile has already succeeded. So an action whose outputs were all headers had a node in build.ninja that nothing could reach — not default (Source outputs are excluded on purpose), not the goal phony (objects and link outputs only), no consuming edge.

$ grep -c ':.*gen\.h' build.ninja      # consumers
0
$ ninja -n -d explain | grep -c mcpp_action_0
0                                      # ninja never plans it
$ ninja -t targets all | grep gen.h
/…/out/gen.h: mcpp_action_0            # …though it is in the manifest

Five consecutive builds, header deleted before each: 0 bytes every time. What made it look like a race is that prepare_actions wrote a zero-byte placeholder for every declared Source output including headers, so the file was on disk whether or not the generator ran — and the reporter reasonably concluded from its presence that the action had run.

Fix. A per-package phony over that package's gating action outputs; every compile edge of the package takes it order-only. Per package rather than build-wide because include_dir colours only the declaring package's own TUs, and a build-wide edge would encode a dependency that does not exist while landing on the critical path of a build whose wall clock is its critical path.

blocking = true on a check now works. It was typed, emitted over the build-program protocol, parsed, documented in two languages and demonstrated in a shipped example — and read by nothing. It needed the same mechanism.

#533 — an empty link unit, reported as a shell error

A dependency whose install() was skipped left a version directory with no sources. mcpp planned its shared library anyway:

/bin/sh: 1: -shared: not found

Reproduced from a pure mcpp input — a kind = "shared" target matching zero sources — with no xlings involved.

The static case is why this is refused at plan time rather than given a better linker message:

$ ar rcs libempty.a ; echo $? ; stat -c %s libempty.a
0
8          # an empty archive, and the build REPORTS SUCCESS

Consumers then fail with undefined symbols, one repository further from the cause. Confirmed against the released binary: Finished dev plus an 8-byte .a.

Also here: cc is emitted unconditionally, for the reason c_ldflags twenty-six lines below already carried (#426) — the rule had been written down for one variable of c_link/c_shared and not the other.

Guards, not care

Both new checks scan the emitted manifest, the way check_inline_command_lengths already does and for the reason its comment gives — "a new edge kind is covered the day it is added".

• check_rule_commands_name_a_program — a rule's command must begin with a program. Deliberately not "no undefined variables": ninja's empty expansion is a feature $soname_flag and $unit_ldflags rely on, and that check would have needed an allowlist of exceptions.
• check_action_ordering — every compile edge of a package that generates its own inputs must wait for them, with the denominator. Seven call sites append the order-only string today; an eighth added later without it would reintroduce 依赖包 build.mcpp 的 mcpp::action 产物未排在该包自身编译之前(竞态,间歇性失败) #534 for that edge kind, silently.

Seamless upgrade

.mcpp_ok is checked on the fast path too, not only where it is written. is_install_complete is marker-only by design, so a store already poisoned by #533 carries a stale marker that short-circuits forever — guarding only the write site would help people who have not hit the bug and do nothing for the ones who filed it. Nobody has to be told which directory to delete.

The marker is withheld, not fatal, when nothing was installed: a package may legitimately install no payload (xlings type-only packages, and #531 provisioning). The cost of being wrong is one cheap re-check per build; the cost of a wrong marker is permanent.

Behaviour changes

change	before	after
empty static library	built, success, 8-byte .a	error naming the target
empty shared library	/bin/sh: 1: -shared: not found	error naming the target
header-only source action	never ran	runs, ordered
generated header, generator failed	empty file	file not found
.mcpp_ok over an empty install	written	withheld + warning
lib-root warning on a C library	emitted in every consumer's build	silent

Tests

e2e 314 (a dependency generating its only header), 315 (blocking gates the compile; non-blocking does not), 316 (empty shared and static refused; a populated one still builds). All three were run against the pre-fix binary and all three fail there — they discriminate rather than describe.

14 unit cases over the two emitter guards, the ordering denominator, and the marker evidence including the poisoned-store heal.

Local: mcpp build clean, mcpp test 96 passed / 0 failed, all five .github/tools/check_*.sh guards pass.

Still to come on this branch

The kXlingsVersion floor bump to the xlings release carrying openxlings/xlings#576. Per §1 of the plan doc, that does not authorise an index change — publishing a colliding <name>@<version> stays unsafe until the floor is adopted, and §6.2 recommends not doing it at all.