mcpp emit build-database, program probes as argument vectors, and xlings 2026.9.14.1 (2026.9.15.1, #636)

[Sunrisepeak]

Summary

This one pull request carries every mcpp change in the design record .agents/docs/2026-09-14-636-build-database-and-the-latest-xlings.md (analysis, plan, self-review). It releases as 2026.9.15.1.

C. mcpp emit build-database (#636). The command prints the plan that mcpp build --configure-only computes as an S1 build database and writes nothing into the project. S1 is "C++ Build Database: IDE Profile" 0.2.0, a profile of WG21 P2977R2.

• --spec compile-commands prints compile_commands.json entries instead.
• --format json wraps the document in the mcpp.build-database envelope.
• The document is S1 level 2:
  • one set per package, plus <package>:test and mcpp:std;
  • visible-sets lists every other set;
  • roles come from the scanner's declaration form;
  • arguments come from the same record the compile database is rendered from;
  • baseline-arguments is the longest prefix shared within a set, and local-arguments is each unit's remainder;
  • private is false;
  • config-files lists what the driver reads without being named on the command line.
• SPEC-005 (docs/specs/build-database.md) states the rules. docs/50 and docs/01, with their translations, document the command.

The command depends on these engine changes:

• The BuildOverrides::work_dir leaks are fixed.
• describe_std_module describes the std module without compiling it. The std cache identity does not change.
• One UnitInvocation record feeds both databases.
• The scanner records ModuleDeclaration.
• plan_only planning reads mcpp.lock from the project and never writes it back, and writes no link-only input: the GCC -dumpspecs probe for mcpp-clean-link.specs is skipped. An independent review of this PR found that call.
• A target entry source that no sources glob matched is now read by the scanner (scan_entry_file). Before, it was read from line-leading import alone, so an import inside a comment or a raw string was planned as a real import. Validating lsp-mcpp's own database against S1 found this.

B. Windows no longer prints "The system cannot find the path specified."

• The vendored-xlings version probe ran <xlings> --version 2>/dev/null through cmd.exe, which cannot open /dev/null.
• The line appeared in every command after the first.
• The probe's empty version silently disabled the pin check, so a Windows home never picked up a newer xlings (Windows 使用由 xlings 安装的 mcpp 执行 mcpp build|test 的时候提示 The system cannot find the path specified. openxlings/xlings#543).
• capture_stdout now runs a program probe as an argument vector, and five probes use it.

A (via the pin). kXlingsVersion, and every pin check_version_pins.sh names, move to xlings 2026.9.14.1. In that release a package without an install hook receives its own archive instead of the shared download directory (openxlings/xlings#596), and xlings self doctor --fix repairs a swept store.

Also carried: the #634 ledger closure and the bootstrap pin commit this branch started with.

Refs #636, openxlings/xlings#543.

Test plan

• mcpp test passes locally (Linux), including the new tests:
  • BuildDatabase.*
  • CaptureStdout.*
  • XlingsVersionPin.ProbeReadsStandardOutputThroughTheLauncher
  • Scanner.DeclarationFormIsRecordedAsRead
  • Scanner.AnEntrySourceIsReadByTheScanner
  • Scanner.AnEntrySourceTheScannerRefusesKeepsItsImports
  • CompileCommandsEmit.UnitInvocationsAreTheCompileDatabaseArguments
  • WireGolden.NullDataIsOmitted
• e2e 687, the argument-vector probe, passes. Its discriminating leg ran green on Windows CI.
• e2e 688, the build database, passes on Linux, macOS and Windows. It checks:
  • the envelope;
  • no writes, with a configure-only control leg;
  • validation against the vendored S1 schema;
  • roles and sets;
  • the std unit;
  • compile-commands parity;
  • usage errors;
  • watch and fingerprint;
  • the baseline/local decomposition, private and config-files;
  • the discovered test's imports;
  • no object, BMI or link specs in the work directory, and a cold std cache that stays cold while --configure-only in the same home compiles std (the control).
• 60 further e2e tests that exercise mcpp test and entry mains pass locally.
• lsp-mcpp's S1 semantic and mcpp-contract checks (specs/tools/validate.py) pass on three databases: a GCC project, an LLVM project, and the lsp-mcpp repository (11 sets, package-provided std).
• lsp-mcpp's conformance runner passes against this mcpp instead of its mock:
  • mcpp-emit: 12/12
  • mcpp-emit-package-std: 13/13
  • a real-manifest watch scenario: 10/10 (edit reloads; a broken manifest leaves the model stale with MCPP_BUILD_DATABASE_PLAN_FAILED; the repair makes it fresh)
• Docs structure and style, modules wiring, narrow conversions and version pins checks pass.
• CI on Linux, macOS and Windows at the head commit.