@@ -83,6 +83,23 @@
   (内核接口的来源不参与这个决定)。按枚举写而不按想到的情形写:后者只覆盖
   作者想到的,前者在枚举新增取值时会留下可见的缺口。
 
+- 三条缓存键测试,**直接打在 `build_axes()` 上**而不是手搭 `BuildAxes`:
+  那个夹具表达不了这个缺陷,因为缺陷在推导里。两种配置的 flag 必须不同、
+  缓存键必须不同,而**宿主目标必须不受影响** —— 最后一条是防止修过头的控制项。
+
+- 五条真实依赖 openkal 包的 e2e。此前八条提到 openkal 的脚本里有七条用的是
+  **合成清单**(当场编造一个自称 `provides = ["mcpp:kernel-abi=…"]` 的包),
+  测的是引擎对一句声明的处理,测不到生态实际的形状 —— 今天的两条回归都从这条缝
+  里出去。
+
+  | | 覆盖 |
+  |---|---|
+  | 285 | kernel-abi 来自图 + C 库来自**载荷**(后端跑在平台之上) |
+  | 286 | 三层全来自图,断言静态、无 INTERP、能跑 |
+  | 287 | 交叉到 aarch64,断言 outline-atomics 辅助函数与 LSE 指令数,qemu 真跑 |
+  | 288 | 无 OS 无 C 库,断言报告里**没有 c-abi 那一行**,并在 qemu 里真启动 |
+  | 289 | **一台宿主横扫四个目标** —— 这个体系本就是通用交叉构建,传统栈要六个 runner 的覆盖,这里一个循环 |
+
 ## [2026.8.24.6] — 2026-08-25
 
 ### 新增
 
@@ -315,9 +315,37 @@ BuildAxes build_axes(const mcpp::toolchain::Toolchain& tc,
         : (tc.binaryPath.empty() ? std::string{}
                                  : mcpp::toolchain::hash_file(tc.binaryPath));
     b.targetTriple    = tc.targetTriple;
+    // ⚠️⚠️ `tc.targetCxxRuntime` IS PASSED, AND OMITTING IT MADE THIS KEY
+    // DESCRIBE A COMPILATION THAT DOES NOT HAPPEN.
+    //
+    // `compile_flags` takes that argument because the answer changes with it:
+    // a freestanding target whose graph supplies a C++ runtime is compiled
+    // WITHOUT `-fno-exceptions`, and one whose graph does not is compiled with
+    // it. The flag builder reads it (flags.cppm passes
+    // `plan.toolchain.targetCxxRuntime`); this key did not, so it defaulted to
+    // `false` and hashed the flags of the other configuration.
+    //
+    // ⭐ THE CONSEQUENCE IS A CACHE HIT ACROSS AN INCOMPATIBILITY, NOT A MISS.
+    // Two configurations that must not share a slot hashed to the same key, so
+    // the second build loaded the first's BMIs. Measured 2026-08-25 on a
+    // bare-metal program over openkal-opensbi:
+    //
+    //     error: exception handling was enabled in precompiled file
+    //            'openkal.stream.pcm' but is currently disabled
+    //
+    // and in the cache itself — `openkal@0.7.0` had six fingerprint slots
+    // holding five differently-sized copies of that one BMI. Slotting per
+    // configuration was working; choosing the slot was not.
+    //
+    // ⚠️ IT WAS DORMANT UNTIL THE ARGUMENT EXISTED. Before #486 the two layers
+    // computed identical flag lists for every input, so a key that ignored one
+    // of them was still correct. The defect is that a cache key derived its
+    // inputs a second time instead of reading what the build uses — and that
+    // stops being harmless the moment the derivation gains a parameter.
     if (auto ft = mcpp::toolchain::triple::parse(tc.targetTriple))
         if (auto spec = mcpp::freestanding::resolve(*ft))
-            b.targetImpliedFlags = mcpp::freestanding::compile_flags(*spec);
+            b.targetImpliedFlags =
+                mcpp::freestanding::compile_flags(*spec, tc.targetCxxRuntime);
     b.stdlibId        = tc.stdlibId;
     b.stdlibVersion   = tc.stdlibVersion;
 
 
@@ -81,6 +81,12 @@ inline std::string link_flags(const Spec& s, const LinkInputs& in,
 {
     std::string out;
     out += " --target=" + std::string(s.triple);
+    // The default `targetCxxRuntime` is deliberate here and not an omission of
+    // the kind fixed in cache_key.cppm: what this list contributes to a LINK
+    // line is the machine description (`-march`, `-mabi`, `-mcmodel`), and the
+    // two flags the argument governs — `-fno-exceptions`, `-fno-rtti` — say
+    // nothing to a linker. Passing it would change no byte of the output while
+    // suggesting it does.
     for (auto const& f : compile_flags(s)) { out += ' '; out += f; }
     out += " -nostdlib -nostartfiles -static";
     if (!in.lld.empty())
 
@@ -0,0 +1,132 @@
+#!/usr/bin/env bash
+# requires: llvm unix-shell qemu-riscv
+# openkal where there is no operating system, and no C library either.
+#
+# ⚠️ THE FREESTANDING SHAPE IS THE ONE THE ENGINE MODELS MOST AND TESTS LEAST.
+# `riscv64-none-elf` appears in ten e2e scripts and in none of them does a real
+# openkal package supply the platform: they build a program with no dependency
+# at all, which exercises the freestanding link path and not the seam this
+# ecosystem exists for. The layer that changes here is `kernelAbi` — supplied
+# by openkal-opensbi, which answers to the SBI a machine's firmware provides —
+# while `cAbi` is genuinely absent.
+#
+# ⭐ `cAbi.absent()` IS A DISTINCT ORIGIN, AND THE LINK LINE BRANCHES ON IT.
+# A hosted target whose C library comes from a package and one that has no C
+# library at all take different flags (`-nostdlib -static` for the latter), and
+# the predicate that chooses between them was, until 2026-08-25, an OR over two
+# layers. Four origins, four behaviours; this covers the one no other e2e does.
+#
+# ⚠️ AND THE PROGRAM RUNS UNDER QEMU RATHER THAN MERELY LINKING. A freestanding
+# image that links is not evidence: the entry point, the linker script and the
+# ordering of the startup objects are BSP facts, and the only check that reaches
+# them is the machine printing what the program told it to.
+set -e
+
+MCPP="${MCPP:-mcpp}"
+TARGET=riscv64-none-elf
+work="$(mktemp -d)"
+trap 'rm -rf "$work"' EXIT
+mkdir -p "$work/app/src"
+cd "$work/app"
+
+cat > mcpp.toml <<'TOML'
+[package]
+name    = "okbare"
+version = "0.1.0"
+
+[toolchain]
+default = "llvm@22.1.8"
+
+# The platform, and nothing above it. `standalone` says this implementation is
+# the whole of the program's environment: it supplies the entry point, because
+# no C runtime is going to.
+[dependencies]
+openkal-opensbi = { version = "0.1.5", features = ["standalone"] }
+TOML
+
+cat > src/main.cpp <<'CPP'
+import openkal.stream;
+import openkal.abort;
+
+// No <cstdio>: there is no C library here. The only way out of this program is
+// the interface the platform package implements.
+// ⚠️ `extern "C"`, AND THE THREE-ARGUMENT SIGNATURE THE ENTRY POINT DECLARES.
+// `-ffreestanding` removes the compiler's special handling of `main`, so the
+// name is an ordinary symbol and has to match what calls it. The platform
+// package's `standalone` feature runs the initialisers and then calls
+// `main(0, &nothing, &nothing)` — see `__okb_start_c` in its src/start.cpp. A
+// plain `int main()` compiled as C++ mangles to something else entirely:
+//
+//     ld.lld: error: undefined symbol: main
+extern "C" int main(int, char**, char**) {
+    const char msg[] = "okbare alive\n";
+    kal_stream_write(kal_stdout(), msg, sizeof msg - 1);
+    return 0;
+}
+CPP
+
+if ! out="$("$MCPP" build --target "$TARGET" 2>&1)"; then
+    case "$out" in
+      *"not found in the synced index"*|*"install_packages failed"*)
+        echo "SKIP: openkal-opensbi is not reachable from here"; exit 0 ;;
+      *"cannot be built on this host"*)
+        echo "SKIP: $TARGET cannot be built here"; exit 0 ;;
+    esac
+    echo "FAIL: the freestanding openkal build failed"
+    printf '%s\n' "$out" | grep -iE 'error' | head -5
+    exit 1
+fi
+
+# ── The report says what this target side is, and is not ───────────────────
+case "$out" in
+  *"kernel-abi"*graph*) echo "  ok  kernel-abi from the graph" ;;
+  *) echo "FAIL: the platform did not come from the graph"
+     printf '%s\n' "$out" | grep -E 'abi' | sed 's/^/        /'; exit 1 ;;
+esac
+# ⭐ AND NO `c-abi` LINE AT ALL. A target with no C library must not report one;
+# if this ever prints, something resolved a C library nobody asked for.
+case "$out" in
+  *"c-abi"*)
+    echo "FAIL: a C library was resolved for a target that has none"
+    printf '%s\n' "$out" | grep 'c-abi' | sed 's/^/        /'; exit 1 ;;
+  *) echo "  ok  no c-abi layer — the target has no C library" ;;
+esac
+
+bin="$(find target -type f -name okbare | head -1)"
+[ -n "$bin" ] || { echo "FAIL: no artefact"; exit 1; }
+
+desc="$(file -b "$bin")"
+case "$desc" in
+  *RISC-V*) echo "  ok  RISC-V" ;;
+  *) echo "FAIL: wrong machine — $desc"; exit 1 ;;
+esac
+
+# ── It boots on a machine whose firmware provides the SBI ──────────────────
+q="$(command -v qemu-system-riscv64 || true)"
+if [ -z "$q" ]; then
+    q="$(ls -d "$HOME"/.mcpp/registry/data/xpkgs/xim-x-qemu-riscv/*/bin/qemu-system-riscv64 2>/dev/null | head -1)"
+fi
+if [ -z "$q" ]; then
+    echo "  SKIP  no riscv64 machine emulator here — linking is not booting"
+else
+    log="$work/run.log"
+    # A watchdog: a program that never returns fails as surely as one that
+    # returns wrongly, and without this the test would spend its whole timeout
+    # discovering that.
+    ( "$q" -machine virt -nographic -no-reboot -bios default -kernel "$bin" > "$log" 2>&1 ) & pid=$!
+    ( sleep 40; kill -9 $pid 2>/dev/null ) & guard=$!
+    wait $pid 2>/dev/null || true
+    kill $guard 2>/dev/null || true
+
+    # ⚠️ The emulated console ends its lines with CRLF, so a comparison that
+    # does not strip them fails on a line that is correct.
+    if tr -d '\r' < "$log" | grep -q 'okbare alive'; then
+        echo "  ok  it boots and prints through openkal.stream"
+    else
+        echo "FAIL: the machine did not print what the program wrote"
+        sed 's/^/        /' "$log" | head -8
+        exit 1
+    fi
+fi
+
+echo "OK: openkal runs on a machine with no operating system and no C library"
@@ -0,0 +1,149 @@
+#!/usr/bin/env bash
+# requires: llvm unix-shell
+# One source, one host, every machine the ecosystem serves.
+#
+# ⭐⭐ THIS IS CHEAP BECAUSE OF WHAT THE ECOSYSTEM IS, AND THAT IS THE POINT.
+#
+# A traditional stack needs a macOS runner to test macOS and a Windows runner
+# to test Windows, because the target side comes from a payload that only
+# exists there. Over openkal it comes from PACKAGES built from source by one
+# retargetable clang — so a single Linux machine can produce an artefact for
+# every target, and the shape of that artefact is checkable without leaving it.
+# Coverage that would cost six runners costs one loop.
+#
+# ⚠️ WHAT THIS FILE IS FOR IS BREADTH, NOT DEPTH. 286, 287 and 288 each go deep
+# on one arrangement — the native stack, the aarch64 cross with its
+# outline-atomics helpers, the machine with no operating system. This asserts
+# the one property they cannot: that a change to the engine did not silently
+# stop serving a target nobody happened to build that day.
+#
+# ⚠️ A TARGET THAT CANNOT BE BUILT HERE IS SKIPPED WITH ITS REASON, NEVER
+# PASSED OVER SILENTLY. A sweep whose failure mode is "produced no output"
+# would report success on a run that swept nothing.
+set -e
+
+MCPP="${MCPP:-mcpp}"
+work="$(mktemp -d)"
+trap 'rm -rf "$work"' EXIT
+
+# target | extra dependency lines | what `file` must say
+#
+# The dependency list is per-target because the platform layer is: openkal is
+# an interface and each machine has its own implementation of it. That the C
+# library and C++ runtime lines are IDENTICAL across every row is the claim the
+# ecosystem makes, and it is visible here as repetition rather than stated.
+rows='
+x86_64-linux-musl|openkal-musl = "0.3.5"\nopenkal-llvm-runtime = "0.1.3"|ELF 64-bit LSB executable, x86-64|statically linked
+aarch64-linux-musl|openkal-musl = "0.3.5"\nopenkal-llvm-runtime = "0.1.3"|ELF 64-bit LSB executable, ARM aarch64|statically linked
+x86_64-windows-gnu|openkal-musl = "0.3.5"\nopenkal-llvm-runtime = "0.1.3"\nopenkal-windows = "0.1.5"|PE32+|
+riscv64-none-elf|openkal = "0.7.0"\nopenkal-opensbi = { version = "0.1.5", features = ["standalone"] }|ELF 64-bit LSB executable, UCB RISC-V|statically linked
+'
+
+built=0; skipped=0; failed=0
+printf '\n'
+while IFS='|' read -r target deps want_fmt want_link; do
+    [ -n "$target" ] || continue
+
+    d="$work/$target"; mkdir -p "$d/src"; cd "$d"
+    {
+        printf '[package]\nname    = "sweep"\nversion = "0.1.0"\n\n'
+        printf '[toolchain]\ndefault = "llvm@22.1.8"\n\n'
+        # ⚠️ `sysroot = ""` IS HOW A PROJECT SAYS "NO C LIBRARY", AND IT IS NOT
+        # IMPLIED BY THE TARGET. `riscv64-none-elf` names a machine with no
+        # operating system; whether the program has a C library is a separate
+        # statement, and the ecosystem's own bare-metal example makes it. Left
+        # out, the spec package's modules are compiled with exceptions enabled
+        # and the platform package's `-fno-exceptions` sources then cannot read
+        # the BMI:
+        #
+        #     error: exception handling was enabled in precompiled file
+        #            'openkal.stream.pcm' but is currently disabled
+        case "$target" in
+          *-none-*) printf '[target.%s]\nsysroot = ""\n\n' "$target" ;;
+        esac
+        printf '[dependencies]\n'
+        printf "$deps\n"
+    } > mcpp.toml
+
+    # ⚠️ TWO SOURCES, BECAUSE TWO OF THESE TARGETS HAVE NO C LIBRARY TO PRINT
+    # WITH. The bare-metal row reaches the platform interface directly; every
+    # other row is an ordinary hosted program. Writing one source that works
+    # everywhere would mean writing to the lowest common denominator, which is
+    # not what a user of a hosted target does.
+    case "$target" in
+      *-none-*)
+        cat > src/main.cpp <<'CPP'
+import openkal.stream;
+// `extern "C"` with the signature the platform's entry point calls: with
+// `-ffreestanding` the name is an ordinary symbol, not a special one.
+extern "C" int main(int, char**, char**) {
+    const char m[] = "sweep\n";
+    kal_stream_write(kal_stdout(), m, sizeof m - 1);
+    return 0;
+}
+CPP
+        ;;
+      *)
+        cat > src/main.cpp <<'CPP'
+#include <cstdio>
+#include <string>
+int main() {
+    std::string s = "sweep";
+    std::printf("%s\n", s.c_str());
+    return s.size() == 5 ? 0 : 1;
+}
+CPP
+        ;;
+    esac
+
+    if ! out="$("$MCPP" build --target "$target" 2>&1)"; then
+        case "$out" in
+          *"not found in the synced index"*|*"install_packages failed"*)
+            echo "  SKIP  $target — its packages are not reachable from here"
+            skipped=$((skipped+1)); continue ;;
+          *"cannot be built on this host"*)
+            echo "  SKIP  $target — this host cannot build it"
+            skipped=$((skipped+1)); continue ;;
+        esac
+        echo "  FAIL  $target — the build failed"
+        printf '%s\n' "$out" | grep -iE 'error' | head -3 | sed 's/^/          /'
+        failed=$((failed+1)); continue
+    fi
+
+    bin="$(find target -type f \( -name sweep -o -name sweep.exe \) | head -1)"
+    if [ -z "$bin" ]; then
+        echo "  FAIL  $target — the build reported success and produced nothing"
+        failed=$((failed+1)); continue
+    fi
+
+    desc="$(file -b "$bin")"
+    ok=1
+    case "$desc" in *"$want_fmt"*) ;; *) ok=0 ;; esac
+    if [ -n "$want_link" ]; then
+        case "$desc" in *"$want_link"*) ;; *) ok=0 ;; esac
+    fi
+    if [ "$ok" = 1 ]; then
+        echo "  ok    $target → $want_fmt${want_link:+, $want_link}"
+        built=$((built+1))
+    else
+        echo "  FAIL  $target — wrong artefact"
+        echo "          want: $want_fmt${want_link:+ + $want_link}"
+        echo "          got:  $desc"
+        failed=$((failed+1))
+    fi
+done <<EOF
+$rows
+EOF
+
+printf '\n  built %d, skipped %d, failed %d\n' "$built" "$skipped" "$failed"
+
+[ "$failed" = 0 ] || exit 1
+# ⭐ AND A SWEEP THAT SWEPT NOTHING IS NOT A PASS. Every row skipping is the
+# signature of a machine that cannot reach the index at all, which is worth
+# reporting as a skip of the whole file rather than as success.
+if [ "$built" = 0 ]; then
+    echo "SKIP: no target could be built here"
+    exit 0
+fi
+
+echo "OK: one host reached $built of the ecosystem's targets"