feat(bench): the cmake and bazel arms build xlings for real

两条外部臂此前都不产出二进制,而 README 把这写成「已知缺口」。**它不是缺口,是
没做完的工作**,那句注释让它躺了很久。

**cmake 臂**(两棵树都实测:configure → build → `xlings --version` 输出对应版本)

* `add_subdirectory` 这条路走不通,不是难走:mbedtls 3.6.1 对缺失的 `framework/`
  子模块是**无条件 FATAL_ERROR**,与 `ENABLE_TESTING` 无关。改为按各包自己的
  `.xpkg.lua` —— 也就是 mcpp 对「编哪些文件」的定义 —— 生成 STATIC target。
* **glob 是错的,不只是脆**:libarchive 目录里 132 个 `.c` 而清单是 127,lua 是
  34 对 32,多出来的正是 `lua.c` / `luac.c`,各自带 `main()`。新的
  `xpkg_source_library.cmake` 在 configure 期打印逐包计数(127/32/108/73/…共
  467 个 TU),某个模式匹配到零个文件是 FATAL_ERROR 而不是静默变小。
* **libarchive 的五个压缩后端整个缺失**:它生成的 config 头把 `HAVE_LIBZ`
  等置 1,于是留下 72 个 `deflate`/`BZ2_`/`LZ4`/`lzma_`/`ZSTD_` 未定义符号。
* **C 语言从来没启用**:`project(xlings CXX)` 对 `.c` 源码没有规则。而且因为
  harness 只传 `-DCMAKE_CXX_COMPILER`,这里在 `project()` 之前从 C++ 驱动推出
  同族 C 驱动 —— 否则 CMake 去 PATH 找宿主 `cc`,而 payload 又按 C++ 编译器给它
  套 registry sysroot,正是那个文件注释里写的两套 libc 故障。
* 共享的 `bench_add_source_dep` **漏掉模块的实现单元**(只 glob `src/*.cppm`),
  于是 capi.lua 那个 428 行的 `src/capi/lua.cpp` 从未被编译。

**bazel 臂**(同样两棵树实测通过)

* 「工作区边界」是**跨过去**的,不是绕过去:`@xlings_tree` 用 repository rule
  解析 `BENCH_PROJECT_ROOT`(和另外两份描述读同一个变量),`@mcpp_deps` 同样
  从 `.xpkg.lua` 派生 13 个包。
* **`import std;` 不是墙**:`@mcpp_deps//:std` 直接编 libc++ 自己的 `std.cppm`,
  BMI 沿 `cc_library` 依赖传播。
* **`--compilation_mode=opt` 原本根本编不过**,而 harness 的 release 一律传 opt:
  bazel 附加 `-D_FORTIFY_SOURCE=1`,glibc 的 `__fortify_function` 是内部链接,
  libc++ 的 std 模块无法再导出。只测 debug 永远看不到这条。
* clang 的 BMI 会**重新打开自己的源文件**,而那不是声明过的输入。
  `--spawn_strategy=local` 能编过 —— 这正是陷阱:沙箱外看着好了,依赖其实一直
  没声明。用 `additional_compiler_inputs` 修。

**xmake 工具链缺了 `as`**:`-B<binutils>/bin` 只让 gcc 驱动找得到汇编器,而
xrepo 建包时是 xmake 自己解析程序,于是整个 configure 停在
`cannot get program for as` —— 既不提工具链也不提当时在建哪个包。

**e2e 233 的守卫判据写错了**:它找 `cc_binary|cc_library`,而能用的 bazel 描述
只声明 `alias` —— 那是 `bazel query kind(rule, //...)` 会返回的真实规则。要抓的
幽灵是**零规则**(`Found 0 targets`),不是「没有 cc_*」。改为匹配 `name =`,
并两个方向都重验过。

Author: speak-agent

bench/projects/.gitignore

@@ -29,3 +29,7 @@ compile_commands.json
 # bazel
 bazel-*/
 MODULE.bazel.lock
+
+# bazel convenience symlinks — created in the package dir on every build,
+# and pointing into ~/.cache/bazel, so they are never worth tracking.
+bazel-*

bench/projects/common/cmake/hermetic_payload.cmake

@@ -203,4 +203,20 @@ function(bench_add_source_dep target name version)
   string(REGEX REPLACE "[^A-Za-z0-9_]" "_" fsname "fs_${name}")
   target_sources(${target} PRIVATE
     FILE_SET "${fsname}" TYPE CXX_MODULES BASE_DIRS "${base}" FILES ${srcs})
+
+  # ⚠️ .cpp UNDER src/ TOO, as ORDINARY sources. A package's `src/` may hold
+  # MODULE IMPLEMENTATION UNITS — `module mcpplibs.capi.lua;` with no `export`
+  # — and those are not part of a CXX_MODULES file set (CMake rejects a
+  # non-interface unit there); they are plain sources that the scanner picks
+  # the module edge out of. mcpplibs.capi.lua 0.0.3 keeps all 428 lines of its
+  # Lua-C wrapper in one, and globbing only `*.cppm` dropped it: the arm then
+  # failed at the link on every `mcpplibs::capi::lua::*` symbol, naming the
+  # consumer rather than the file that was never compiled.
+  #
+  # `*/src/` and not the whole package: examples/ and tests/ carry their own
+  # main() and are not what mcpp compiles for a dependency.
+  file(GLOB_RECURSE impls CONFIGURE_DEPENDS "${dir}/*/src/*.cpp")
+  if(impls)
+    target_sources(${target} PRIVATE ${impls})
+  endif()
 endfunction()

bench/projects/common/xmake/payload.lua

@@ -112,6 +112,15 @@ function bench_define_toolchains(manifest)
             set_toolset("sh",    path.join(gcc_dir, "bin", "g++"))
             set_toolset("ar",    path.join(binutils, "bin", "ar"))
             set_toolset("strip", path.join(binutils, "bin", "strip"))
+            -- `as` and `ranlib` are NOT optional once xrepo builds packages with
+            -- this toolchain. `-B<binutils>/bin` only lets the DRIVER find them;
+            -- xmake resolves the assembler itself and stops the whole configure
+            -- with `cannot get program for as` — a message that names neither
+            -- the toolchain nor the package it was building (ftxui, here).
+            set_toolset("as",     path.join(gcc_dir,  "bin", "gcc"))
+            set_toolset("ranlib", path.join(binutils, "bin", "ranlib"))
+            set_toolset("nm",     path.join(binutils, "bin", "nm"))
+            set_toolset("objcopy", path.join(binutils, "bin", "objcopy"))
             on_load(function (toolchain)
                 local read_pin = function (m)
                     if not m or not os.isfile(m) then return nil end
@@ -164,6 +173,12 @@ function bench_define_toolchains(manifest)
             set_toolset("sh",    path.join(llvm_dir, "bin", "clang++"))
             set_toolset("ar",    path.join(llvm_dir, "bin", "llvm-ar"))
             set_toolset("strip", path.join(llvm_dir, "bin", "llvm-strip"))
+            -- Same reason as the gcc arm: xrepo package builds resolve these
+            -- programs through the toolchain, not through the driver.
+            set_toolset("as",     path.join(llvm_dir, "bin", "clang"))
+            set_toolset("ranlib", path.join(llvm_dir, "bin", "llvm-ranlib"))
+            set_toolset("nm",     path.join(llvm_dir, "bin", "llvm-nm"))
+            set_toolset("objcopy", path.join(llvm_dir, "bin", "llvm-objcopy"))
             -- xmake finds libc++'s `std.cppm` through the SDK dir, and it reads
             -- that at DESCRIPTION scope — setting it inside on_load is too late
             -- and leaves `std and std.compat modules not found!`, after which

bench/projects/xlings/.bazelignore

@@ -0,0 +1,15 @@
+# The pinned trees are consumed through @xlings_tree, which symlinks the ONE
+# named by BENCH_PROJECT_ROOT. Left visible here they would also be part of this
+# package, so `bazel build //...` would glob both of them into every target it
+# found — and a cell that measures two builds and reports one is worse than no
+# cell. Ignoring them is what makes "//... builds the tree under measurement"
+# true rather than approximately true.
+xlings-2026.8.11.2
+xlings-2026.8.13.1
+
+# Output directories of the other arms. cmake's build/ and mcpp's target/ hold
+# tens of thousands of files with no BUILD file among them; scanning them costs
+# real time on every `bazel build //...`.
+build
+target
+.xmake

bench/projects/xlings/.bazelrc

@@ -0,0 +1,45 @@
+# Flags this arm cannot build without. bench/src/engines/bazel.cppm passes the
+# first three itself; they are repeated here so that the command lines in
+# MODULE.bazel and README.md work as written, and so a hand-run build measures
+# the same thing the harness does.
+
+# Each one's absence is a different error, and none of them says "add this flag":
+#   without --experimental_cpp_modules: `attribute module_interfaces: requires
+#     --experimental_cpp_modules`
+#   without --features=cpp_modules:     `the feature cpp_modules must be enabled`
+build --experimental_cpp_modules
+build --features=cpp_modules
+
+# cc_binary registers the ddi aggregation action for BOTH the PIC and non-PIC
+# object sets but names its output <target>.CXXModules.json without a pic
+# suffix, so analysis dies before a single file compiles:
+#     Attempted action contains artifacts not in previous action:
+#       _objs/xlings/main.pic.ddi ... Outputs: are equal
+# Forcing one object flavour leaves one action. PIC rather than
+# --features=-supports_pic because it yields a PIE executable, which is what
+# gcc and clang produce by default for every other engine in the table.
+build --force_pic
+
+# ⚠️ --compilation_mode=opt DOES NOT BUILD WITHOUT THIS, and the harness always
+# passes opt for the release profile. bazel's opt mode appends
+# `-D_FORTIFY_SOURCE=1` after its own `-U_FORTIFY_SOURCE`, glibc then replaces
+# the string/stdio/wchar functions with `__fortify_function` wrappers — which
+# have INTERNAL LINKAGE — and libc++'s std module cannot re-export them:
+#
+#     libcxx_module/std/cwchar.inc:30:14: error: using declaration referring to
+#       'swprintf' with internal linkage cannot be exported
+#     note: target of using declaration
+#       .../xim-x-glibc/2.44/include/bits/wchar2.h:181:8
+#
+# It reads as a libc++/glibc incompatibility and is a build flag. --copt lands
+# after the compilation-mode flags, so the -U wins; no other engine in this
+# table defines _FORTIFY_SOURCE either, so removing it is also what keeps the
+# arms comparable rather than a local workaround.
+build --copt=-U_FORTIFY_SOURCE
+
+# The autoconfigured toolchain appends `-lstdc++ -lm` to every link. This arm is
+# libc++ (the payload clang's config file sets -stdlib=libc++), and linking the
+# two standard libraries into one binary is a coin flip decided by link order:
+# --as-needed happens to drop libstdc++ here, and "happens to" is not a
+# guarantee anyone should rely on for a 46k-line binary.
+build --repo_env=BAZEL_LINKLIBS=-lm

bench/projects/xlings/BUILD.bazel

@@ -1,22 +1,45 @@
-# See MODULE.bazel: this cannot build xlings today, and the blocker is the
-# workspace boundary rather than anything about modules.
+# The bazel arm of the xlings control target. See MODULE.bazel for why the two
+# interesting things — the tree and its dependencies — are external repositories
+# rather than globs, and mcpp_registry.bzl for how they are built.
 #
-# The shape a working version would take is kept here so the gap is legible:
+# THIS PACKAGE DECLARES ONE RULE ON PURPOSE, and that one rule is the point of
+# the file. It used to declare none: a comment-only BUILD.bazel makes
+# `bazel build //...` exit 0 in 0.14s with `Found 0 targets`, and the harness
+# published that as a 0.43s cold build in a column next to cmake's 94s.
+# bench/src/engines/bazel.cppm now asks `bazel query kind(rule, //...)` before it
+# will measure anything here, so an empty description reports a reason instead of
+# a number — but the fix for "no rules" is a rule.
 #
-#   cc_binary(
-#       name = "xlings",
-#       srcs = ["src/main.cpp"],
-#       module_interfaces = glob(["src/**/*.cppm"]) + [
-#           "std.cppm",                      # copied from libc++, listed FIRST
-#       ],
-#       includes = ["src/libs/json"],
-#       defines = ["LIBARCHIVE_STATIC", "UNICODE", "_UNICODE"],
-#       copts = ["-std=c++23", "-Wno-reserved-module-identifier"],
-#       linkopts = ["-static-libstdc++"],
-#   )
+# The alias, rather than the cc_binary itself, because `module_interfaces` takes
+# labels bazel can glob and the sources live in a submodule this package must not
+# write into. @xlings_tree carries the generated cc_binary; see _XLINGS_BUILD in
+# mcpp_registry.bzl for the source set and why it is not `src/main.cpp` alone.
 #
-# built with:
-#   bazel build //:xlings --experimental_cpp_modules --features=cpp_modules --force_pic
+# MEASURED, on bazel 9.2.0 + rules_cc 0.2.22 with the payload clang 22.1.8,
+# `--compilation_mode=opt`, cold after `bazel clean`:
 #
-# ...from inside the xlings checkout, which is the part that does not work: this
-# description would have to be written INTO the tree being measured.
+#   tree                 TUs compiled          cold     `--version`
+#   xlings-2026.8.11.2   110 .cppm +  2 .cpp   46.4s    xlings 2026.8.11.2
+#   xlings-2026.8.13.1   110 .cppm + 92 .cpp   18.0s    xlings 2026.8.13.1
+#
+# plus the dependency set, whose counts are the check that the .xpkg.lua
+# manifests are being read rather than the trees globbed: libarchive 127 (a glob
+# is 132), lua 32 (a glob is 34, and the two extra each define `main`), mbedtls
+# 108, xz 74, ftxui 73, zstd 26, zlib 15, bzip2 7, lz4 5, and 19 translation
+# units across the four mcpplibs packages — 18 of them module interfaces, one of
+# which is the generated mcpplibs.xpkg.lua_stdlib.
+#
+#   bazel build //:xlings                                    # the default pin
+#   BENCH_PROJECT_ROOT=$PWD/xlings-2026.8.11.2 bazel build //:xlings
+#   bazel run //:xlings -- --version
+#
+# The binary itself lands at
+#   bazel-bin/external/+xlings_tree+xlings_tree/xlings
+# because that is the repository that owns the rule; `bazel run` above is the
+# path-independent way to reach it.
+
+alias(
+    name = "xlings",
+    actual = "@xlings_tree//:xlings",
+    visibility = ["//visibility:public"],
+)