fix: keep Clang managed system headers hermetic

Author: speak-agent

modules/toolchain-model/src/linkmodel.cppm

@@ -89,6 +89,11 @@ struct ToolchainLinkModel {
     // Compile-side flags as argv tokens. Each entry is ONE argv word.
     std::vector<std::string> compile_tokens(const PathEscape& esc) const {
         std::vector<std::string> out;
+        // A managed libc supplies the complete system header surface. Keep
+        // Clang's resource headers while refusing an ambient /usr/include
+        // fallback, including when the driver cfg is explicitly bypassed.
+        if (mode == CLibMode::PayloadFirst && clangDriver)
+            out.push_back("-nostdlibinc");
         if (mode == CLibMode::Sysroot)
             out.push_back("--sysroot=" + esc(sysroot));
         // PayloadFirst headers: clang takes -isystem; GCC needs -idirafter so

src/toolchain/post_install.cppm

@@ -312,6 +312,8 @@ export void fixup_clang_cfg(const std::filesystem::path& payloadRoot,
         if (std::filesystem::exists(cxxInclude))
             cxxOnly += "-isystem " + cxxInclude.string() + "\n";
     } else {
+        if constexpr (mcpp::platform::is_linux)
+            common += "-nostdlibinc\n";
         if (!glibcLibDir.empty()) {
             auto loader = resolve_loader(glibcLibDir, triple);
             common += "-B" + glibcLibDir.string() + "\n";
@@ -525,7 +527,7 @@ void llvm_post_install_fixup(const mcpp::config::GlobalConfig& cfg,
 // runtime libs. Idempotent via a content-fingerprinted marker.
 //
 // Bump when the fixup logic changes so existing installs re-run it.
-constexpr std::string_view kFixupRev = "hermetic-4-exact-runtime";
+constexpr std::string_view kFixupRev = "hermetic-5-managed-headers";
 
 // What the fixup DID, so the caller can decide how loud to be about it.
 //

tests/unit/test_linkmodel.cpp

@@ -126,6 +126,7 @@ TEST(LinkModel, ClangCfgPayloadFirstCarriesCrtDiscovery) {
     EXPECT_NE(link.find("--dynamic-linker=" + lm.loader.string()), std::string::npos);
 
     auto compile = lm.compile_flags(ident);
+    EXPECT_NE(compile.find("-nostdlibinc"), std::string::npos);
     EXPECT_NE(compile.find("-isystem"), std::string::npos);
     EXPECT_EQ(compile.find("-idirafter"), std::string::npos);
 }
@@ -156,6 +157,7 @@ TEST(LinkModel, GccSysrootWinsOverPayload) {
     auto lm = tc::resolve_link_model(t);
     EXPECT_EQ(lm.mode, tc::CLibMode::Sysroot);
     EXPECT_NE(lm.compile_flags(ident).find("--sysroot="), std::string::npos);
+    EXPECT_EQ(lm.compile_flags(ident).find("-nostdlibinc"), std::string::npos);
     EXPECT_NE(lm.link_flags(ident).find("--sysroot="), std::string::npos);
     // Kernel headers exist in the sysroot → no supplement.
     EXPECT_TRUE(lm.systemIncludes.empty());
@@ -197,6 +199,7 @@ TEST(LinkModel, GccPayloadEmitsIdirafterAndItsOwnAddressing) {
     // Headers still differ by driver: libstdc++'s #include_next wrappers need
     // -idirafter, and that has not changed.
     EXPECT_NE(lm.compile_flags(ident).find("-idirafter"), std::string::npos);
+    EXPECT_EQ(lm.compile_flags(ident).find("-nostdlibinc"), std::string::npos);
 
     // Addressing no longer differs. GCC used to be left to its install-time
     // specs here, which made the RUN side a per-toolchain-install decision