@@ -651,7 +651,7 @@ jobs:
           for t in tests/e2e/285_*.sh tests/e2e/286_*.sh tests/e2e/287_*.sh \
                    tests/e2e/288_*.sh tests/e2e/289_*.sh tests/e2e/291_*.sh \
                    tests/e2e/292_*.sh tests/e2e/293_*.sh tests/e2e/294_*.sh \
-                   tests/e2e/738_*.sh tests/e2e/778_*.sh; do
+                   tests/e2e/738_*.sh tests/e2e/778_*.sh tests/e2e/891_*.sh; do
             echo "=== $t ==="
             bash "$t" 2>&1 | tee "$(basename "$t").log" || true
             rc=${PIPESTATUS[0]}
@@ -718,6 +718,11 @@ jobs:
             "ok: aarch64-linux-musl links -lm from the graph and runs under qemu-aarch64" || fail=1
           check 778_a_graph_link_searches_no_host_directory.sh \
             "ok: a host directory in ldflags is refused, by name" || fail=1
+          # LLVM 23.1.3 Part 3 (D2/D3): the payload's C library closes the
+          # host's /usr/include, a written -idirafter reopens it, and the
+          # graph note stays away from a payload C library on both paths.
+          check 891_a_host_header_is_written_not_searched.sh \
+            "PASS: 891 a host header is written down, not searched" || fail=1
           [ "$fail" = 0 ] || exit 1
 
 
 
@@ -4,7 +4,7 @@
 > Each `## [<version>]` section is that release's notes. Entries are written in English
 > from 2026.9.28.3 on; earlier entries remain as written.
 
-## [2026.10.8.1] - 2026-10-08
+## [2026.10.8.1] - 2026-10-09
 
 ### Changed
 
@@ -16,6 +16,16 @@
 - Use the native GNU manifest row when building mcpp and installing the
   toolchain for ARM64 consumer jobs. Centralize E2E toolchain version discovery
   and respect a custom MCPP_HOME.
+- Search no system header directory of the host on a managed C library. clang
+  carries `-nostdlibinc` on the native Linux rows, including through the driver
+  configuration file regenerated after installation; GCC without a usable
+  subos takes `-isysroot <C library payload>` in place of the sysroot recorded
+  when it was built. A project that needs a host header writes the directory,
+  for example `cxxflags = ["-idirafter", "/usr/include"]`; `allow_host_libs`
+  concerns the link only. The std module and object caches of Linux clang
+  builds are rebuilt once.
+- Mark `aarch64-linux-gnu` `preview` until the released engine is consumed on
+  a clean ARM64 host.
 
 ### Fixed
 
@@ -24,7 +34,8 @@
   engine-selected foreign payloads.
 - Keep AArch64 host `std` modules and build programs on the same compiler-rt
   code-generation settings. Suppress the driver's automatic unwinder library
-  when a self-contained ELF already links its static unwinder explicitly.
+  (`--unwindlib=none`, on every architecture) when a self-contained ELF already
+  links its static unwinder explicitly.
 - Stop E2E package discovery from exporting GCC's reserved `GCC_ROOT` variable,
   which redirected managed Windows GCC helper lookup to the registry wrapper.
 - Verify the native ARM64 openkal stack and indexed JSON serialization and
@@ -33,6 +44,18 @@
 - Cover both xcode-27 E2E shards and exercise explicit toolchain installation
   with a cold registry. Restore historical measurements to their original
   environment and adapt the namespace fixture to libc++ 23.
+- Give the note for a graph-supplied C library only when the C library is the
+  graph's, on the full build and on the fast path; a native build on a managed
+  C library carries `-nostdlibinc` as well.
+
+### Known limitations
+
+- clang 23 does not support C++20 coroutines on `i686-pc-windows-msvc`: it no
+  longer predefines `__cpp_impl_coroutine` there, so the MSVC STL's
+  `<coroutine>` is empty. The C++23 std module (through `<generator>`) and code
+  that uses coroutines fail on that target, and mcpp appends a note naming the
+  cause: C++20, where `import std` and `import std.compat` build, or optionally
+  `llvm@22.1.8` for that target. mcpp does not define the macro (#786).
 
 ## [2026.10.5.3] - 2026-10-06
 
 
@@ -427,20 +427,20 @@ list` reports for this machine):
 | `aarch64-linux-musl`  | gcc 16, fully static — cross from x86_64 (qemu) or native | verified |
 | `x86_64-windows-gnu`  | gcc 16 MinGW-w64 — native on Windows, cross from Linux (wine) *(Windows default without Visual Studio)* | verified |
 | `x86_64-windows-msvc` | `msvc@system` (detected VS/BuildTools) or llvm ¹ *(Windows default with Visual Studio)* | verified |
-| `x86_64-windows-musl` | llvm 22 — a PE with a musl C library, which no gcc emits; the system comes from the dependency graph | preview |
+| `x86_64-windows-musl` | llvm 23 — a PE with a musl C library, which no gcc emits; the system comes from the dependency graph | preview |
 | `aarch64-macos`       | llvm *(macOS default)* | verified |
-| `riscv64-none-elf` · `riscv32-none-elf` | llvm 22 — bare metal, `xim:picolibc-riscv` ² | verified |
-| `thumbv6m-none-eabi` · `thumbv7m-none-eabi` | llvm 22 — Cortex-M0/M0+/M1, Cortex-M3 ² | verified |
-| `thumbv7em-none-eabihf` · `thumbv8m.main-none-eabi` | llvm 22 — Cortex-M4F/M7F hard float, Cortex-M33/M55 soft float ² | verified |
-| `armv7a-none-eabi` · `armv7a-none-eabihf` | llvm 22 — Cortex-A 32-bit, the first row with an MMU ² | verified |
-| `aarch64-none-elf` · `x86_64-none-elf` | llvm 22 — bare metal, no C library by default ² | preview |
-| `thumbv7em-none-eabi` · `thumbv8m.base-none-eabi` · `thumbv8m.main-none-eabihf` | llvm 22 — Cortex-M4/M7 soft float, M23, M33F/M55F ² | preview |
-| `aarch64-linux-gnu` | `llvm@23.1.3` | verified |
+| `riscv64-none-elf` · `riscv32-none-elf` | llvm 23 — bare metal, `xim:picolibc-riscv` ² | verified |
+| `thumbv6m-none-eabi` · `thumbv7m-none-eabi` | llvm 23 — Cortex-M0/M0+/M1, Cortex-M3 ² | verified |
+| `thumbv7em-none-eabihf` · `thumbv8m.main-none-eabi` | llvm 23 — Cortex-M4F/M7F hard float, Cortex-M33/M55 soft float ² | verified |
+| `armv7a-none-eabi` · `armv7a-none-eabihf` | llvm 23 — Cortex-A 32-bit, the first row with an MMU ² | verified |
+| `aarch64-none-elf` · `x86_64-none-elf` | llvm 23 — bare metal, no C library by default ² | preview |
+| `thumbv7em-none-eabi` · `thumbv8m.base-none-eabi` · `thumbv8m.main-none-eabihf` | llvm 23 — Cortex-M4/M7 soft float, M23, M33F/M55F ² | preview |
+| `aarch64-linux-gnu` | `llvm@23.1.3` | preview |
 | `riscv64-linux-musl` · `x86_64-macos` | — | planned |
 | `wasm32-emscripten` | `emsdk@6.0.9` — Emscripten ships its own sysroot and its own libc++ module surface; `mcpp run` executes the module with the `node` the payload declares (`xim:node`), not one found on PATH | verified |
 | `x86_64-linux-android` | `android-ndk@30.0.16248370` — bionic from the NDK, one payload for both ABIs; ran on an API 24 x86_64 emulator image | verified |
 | `aarch64-linux-android` | the same payload and the same build; ran under qemu-user over the system image's own bionic, which the platform emulator cannot do from an x86_64 host | verified |
-| `aarch64-ios-sim` | llvm 22 plus the machine's iPhoneSimulator SDK, which mcpp locates rather than installs; ran on a simulator through `simctl-run` ³ | verified |
+| `aarch64-ios-sim` | llvm 23 plus the machine's iPhoneSimulator SDK, which mcpp locates rather than installs; ran on a simulator through `simctl-run` ³ | verified |
 | `aarch64-ios` | the same split for the device; the artefact names the iOS platform, and running it off a device needs a signature the developer owns ³ | preview |
 | `x86_64-ios-sim` | the same build; nothing ran it, because a simulator runs the host's architecture and the machine measured was Apple silicon ³ | preview |
 
 
@@ -381,20 +381,20 @@ mcpp 的身份模型有两条正交的轴：**工具链**是 `family@version`（
 | `aarch64-linux-musl`  | gcc 16，全静态；从 x86_64 交叉编译（qemu）或原生构建 | verified |
 | `x86_64-windows-gnu`  | gcc 16 MinGW-w64；Windows 上原生构建，Linux 上交叉编译（wine）（*无 Visual Studio 时的 Windows 默认*） | verified |
 | `x86_64-windows-msvc` | `msvc@system`（探测 VS/BuildTools）或 llvm ¹（*有 Visual Studio 时的 Windows 默认*） | verified |
-| `x86_64-windows-musl` | llvm 22；带 musl C 库的 PE，gcc 无法产出；系统部分由依赖图提供 | preview |
+| `x86_64-windows-musl` | llvm 23；带 musl C 库的 PE，gcc 无法产出；系统部分由依赖图提供 | preview |
 | `aarch64-macos`       | llvm（*macOS 默认*） | verified |
-| `riscv64-none-elf` · `riscv32-none-elf` | llvm 22；裸机，`xim:picolibc-riscv` ² | verified |
-| `thumbv6m-none-eabi` · `thumbv7m-none-eabi` | llvm 22；Cortex-M0/M0+/M1、Cortex-M3 ² | verified |
-| `thumbv7em-none-eabihf` · `thumbv8m.main-none-eabi` | llvm 22；Cortex-M4F/M7F 硬浮点，Cortex-M33/M55 软浮点 ² | verified |
-| `armv7a-none-eabi` · `armv7a-none-eabihf` | llvm 22；Cortex-A 32 位，第一个带 MMU 的目标 ² | verified |
-| `aarch64-none-elf` · `x86_64-none-elf` | llvm 22；裸机，默认不带 C 库 ² | preview |
-| `thumbv7em-none-eabi` · `thumbv8m.base-none-eabi` · `thumbv8m.main-none-eabihf` | llvm 22；Cortex-M4/M7 软浮点、M23、M33F/M55F ² | preview |
-| `aarch64-linux-gnu` | `llvm@23.1.3` | verified |
+| `riscv64-none-elf` · `riscv32-none-elf` | llvm 23；裸机，`xim:picolibc-riscv` ² | verified |
+| `thumbv6m-none-eabi` · `thumbv7m-none-eabi` | llvm 23；Cortex-M0/M0+/M1、Cortex-M3 ² | verified |
+| `thumbv7em-none-eabihf` · `thumbv8m.main-none-eabi` | llvm 23；Cortex-M4F/M7F 硬浮点，Cortex-M33/M55 软浮点 ² | verified |
+| `armv7a-none-eabi` · `armv7a-none-eabihf` | llvm 23；Cortex-A 32 位，第一个带 MMU 的目标 ² | verified |
+| `aarch64-none-elf` · `x86_64-none-elf` | llvm 23；裸机，默认不带 C 库 ² | preview |
+| `thumbv7em-none-eabi` · `thumbv8m.base-none-eabi` · `thumbv8m.main-none-eabihf` | llvm 23；Cortex-M4/M7 软浮点、M23、M33F/M55F ² | preview |
+| `aarch64-linux-gnu` | `llvm@23.1.3` | preview |
 | `riscv64-linux-musl` · `x86_64-macos` | — | planned |
 | `wasm32-emscripten` | `emsdk@6.0.9`；Emscripten 自带 sysroot 与 libc++ 模块接口；`mcpp run` 使用 payload 声明的 `node`（`xim:node`）运行模块，不使用 PATH 上的 `node` | verified |
 | `x86_64-linux-android` | `android-ndk@30.0.16248370`；bionic 来自 NDK，一个 payload 服务两个 ABI；已在 API 24 的 x86_64 模拟器镜像上运行 | verified |
 | `aarch64-linux-android` | 同一个 payload、同样的构建；已在 qemu-user 上配合系统镜像自带的 bionic 运行，平台模拟器无法在 x86_64 宿主上做到这一点 | verified |
-| `aarch64-ios-sim` | llvm 22 加上本机的 iPhoneSimulator SDK（mcpp 定位该 SDK，不安装它）；已通过 `simctl-run` 在模拟器上运行 ³ | verified |
+| `aarch64-ios-sim` | llvm 23 加上本机的 iPhoneSimulator SDK（mcpp 定位该 SDK，不安装它）；已通过 `simctl-run` 在模拟器上运行 ³ | verified |
 | `aarch64-ios` | 真机采用同样的分工；产物标记为 iOS 平台，在设备上运行需要开发者自己的签名 ³ | preview |
 | `x86_64-ios-sim` | 同一次构建；尚未运行过，因为模拟器运行宿主的架构，而测量所用的机器是 Apple 芯片 ³ | preview |
 
 
@@ -947,6 +947,39 @@ that reaches a build silently is.** That is why the entries above are a table
 rather than a prohibition: each is reachable, each has a reason, and each says
 so where it is used.
 
+### System headers: none are the host's (2026.10.8.1+)
+
+A build on a managed C library searches no system header directory of the
+host. The managed glibc and `linux-headers` supply the whole system header
+surface, and each compiler family is closed against the host's copy:
+
+- **clang** carries `-nostdlibinc` on the native Linux rows. The driver keeps
+  its own resource headers and stops its fallback to `/usr/include`, including
+  when the driver configuration file is bypassed. A directly invoked
+  `clang++` reads the same token from the configuration file mcpp regenerates
+  after installation.
+- **GCC** compiles with `--sysroot=<the xlings subos>`, so its search ends at
+  the subos's `usr/include`. When no usable subos exists, it falls back to the
+  payload layout and receives `-isysroot <the C library payload>`, which
+  replaces the sysroot recorded when the compiler was built: that recorded
+  path belongs to the machine that built the compiler and is otherwise
+  searched wherever it happens to exist.
+
+A header that only the host has is therefore not found. A project that needs
+one names the directory in its own manifest, where the dependency on the host
+is visible:
+
+```toml
+[build]
+cflags   = ["-idirafter", "/usr/include"]
+cxxflags = ["-idirafter", "/usr/include"]
+```
+
+`-idirafter` places the directory after the managed headers, so the C library
+the build links against still supplies its own declarations. `allow_host_libs`
+does not change the header search: it concerns the libraries a link may
+resolve from the host.
+
 ### The host surface this adds, named and bounded
 
 Two items, both macOS-only, both in the category a proprietary runtime that
@@ -1269,6 +1302,51 @@ workarounds were measured downstream:
 
 Tracked as [mcpp#609](https://github.com/mcpp-community/mcpp/issues/609).
 
+## Known Toolchain Limitation: Coroutines on the 32-bit x86 Microsoft ABI (clang 23)
+
+clang 23 does not support C++20 coroutines on `i686-pc-windows-msvc`. It does
+not predefine `__cpp_impl_coroutine` for that target, and it reports code that
+uses coroutines there with `-Wcoroutines-unsupported-target`. clang 22.1.8 and
+every other target mcpp builds for, including `x86_64-pc-windows-msvc` and
+`i686-pc-windows-gnu`, still predefine the macro.
+
+The MSVC STL keys `<coroutine>` on that macro, so the header is empty on this
+target. Two failures follow:
+
+- **The C++23 std module.** `std.ixx` includes `<generator>` under C++23, and
+  `<generator>` uses `coroutine_handle` and `suspend_always` without checking
+  for them. The precompile stops inside `generator`.
+- **Code that uses coroutines.** The compile stops at `use of undeclared
+  identifier 'std'` and `std::coroutine_traits type was not found`, before
+  clang's own coroutine diagnostic is reached.
+
+mcpp follows the compiler. It does not define the macro and does not alter the
+std module; it appends a note to either failure, naming the cause and the
+options. The note is decided after the failure, from the failed command and a
+`-dM -E` probe of the same compiler and target, so a build that succeeds is not
+affected and the note disappears when the compiler or the STL changes.
+
+The options, in the order the note gives them:
+
+- Build the package as C++20. `import std` and `import std.compat` do not
+  include `<generator>` there and build on this target. This does not make
+  coroutines available.
+- Name an LLVM that still enables coroutines for this target:
+
+  ```toml
+  [target.i686-windows-msvc]
+  toolchain = "llvm@22.1.8"
+  ```
+
+  The newer compiler treats coroutines on this ABI as unsupported; code that
+  uses them on this target does so at its own risk.
+
+Defining `__cpp_impl_coroutine` in a project is not a workaround. It switches
+on a feature the compiler has declared unsupported for this ABI.
+
+`i686-windows-msvc` is not a row of the target table; a project that builds
+for it declares `[target.i686-windows-msvc]`, as for any custom triple.
+
 ## The C++ runtime contract (`cxx_runtime`)
 
 `cxx_runtime` states what the produced artifact promises about the machine that
 
@@ -492,7 +492,7 @@ other's rows.
 | target | tier | pin | linux-x86_64 | linux-aarch64 | macos-arm64 | windows-x86_64 |
 |---|---|---|---|---|---|---|
 | `x86_64-linux-gnu` | verified | — | payload | — | — | — |
-| `aarch64-linux-gnu` | verified | `llvm@23.1.3` | — | payload | — | — |
+| `aarch64-linux-gnu` | preview | `llvm@23.1.3` | — | payload | — | — |
 | `x86_64-linux-musl` | verified | `gcc@16.1.0` | payload | payload | — | payload |
 | `aarch64-linux-musl` | verified | `gcc@16.1.0` | payload | payload | — | — |
 | `riscv64-linux-musl` | planned | — | planned | planned | planned | planned |
 
@@ -205,7 +205,7 @@ Output (2026.9.30.1; the times vary by machine):
 
 ```
    Resolving toolchain
-    Resolved llvm@22.1.8 → riscv64-none-elf → @mcpp/registry/data/xpkgs/xim-x-llvm/22.1.8/bin/clang++
+    Resolved llvm@23.1.3 → riscv64-none-elf → @mcpp/registry/data/xpkgs/xim-x-llvm/23.1.3/bin/clang++
     Resolved host toolchain for build.mcpp: clang 22.1.8 (x86_64-unknown-linux-gnu)
   build.mcpp blinky  ran 0.41s
     Inferred sources [src/**/*.{cppm,cpp,cc,c,S,s,asm}]
 
@@ -35,10 +35,10 @@
 | [SPEC-003](exit-codes.md) | 退出码契约(分类、语义、稳定性承诺) | 评审中 v1.0 | 2026-09-01 | mcpp >= 2026.9.1.1 |
 | [SPEC-004](manifest-semantics.md) | `mcpp.toml` 的平面划分、条件化形状、解析轴与命名规约 | 草案 v1.13 | 2026-10-06 | 条件化形状 mcpp >= 2026.8.29.1;目标轴 mcpp >= 2026.9.6.4;`linkage` 默认值 mcpp >= 2026.9.15.2;链接 flag 的词读法 mcpp >= 2026.9.26.2;条件化的 `dialect_cxxflags` 与 `-p` 的包身份 mcpp >= 2026.9.28.1;条件表按具体程度生效 mcpp >= 2026.9.28.2;平台前缀规约 mcpp >= 2026.10.5.1;根包的继承、根位置的 profile、链接 flag 的作用域、链接期优化与导出发现 mcpp >= 2026.10.5.2;架构段的 `x86` 即 `i686` mcpp >= 2026.10.5.3 |
 | [SPEC-005](build-database.md) | 构建数据库:`mcpp emit build-database` 的内容、取值规则与不写工程目录的保证 | 评审中 v1.6 | 2026-09-29 | mcpp >= 2026.9.15.1;v1.3 条款 mcpp >= 2026.9.26.2;v1.4 条款 mcpp >= 2026.9.27.1;v1.5 条款 mcpp >= 2026.9.28.1;v1.6 条款 mcpp >= 2026.9.29.5 |
-| [SPEC-006](toolchain-management.md) | 工具链管理:身份、来源、选择与载荷契约 | 草案 v0.6 | 2026-10-02 | 逐条标注;已实现条款 mcpp >= 2026.9.24.1;§3.7 mcpp >= 2026.9.28.1;§3.7.1 mcpp >= 2026.9.28.2;§2.2.1 与 §3.3 的非缺省来源 mcpp >= 2026.10.1.3 |
+| [SPEC-006](toolchain-management.md) | 工具链管理:身份、来源、选择与载荷契约 | 草案 v0.7 | 2026-10-09 | 逐条标注;已实现条款 mcpp >= 2026.9.24.1;§3.7 mcpp >= 2026.9.28.1;§3.7.1 mcpp >= 2026.9.28.2;§2.2.1 与 §3.3 的非缺省来源 mcpp >= 2026.10.1.3;§3.8 mcpp >= 2026.10.8.1 |
 | [SPEC-007](build-plugins.md) | 构建插件:配置、施工与校验的分工,运行时与规划期的义务 | 草案 v0.6 | 2026-09-28 | 逐条标注;mcpp >= 2026.9.26.2;v0.3 条款 mcpp >= 2026.9.27.1;v0.4 条款 mcpp >= 2026.9.28.1;v0.5 条款 mcpp >= 2026.9.28.2;v0.6(§9)mcpp >= 2026.9.28.3 |
 | [SPEC-008](library-interface.md) | 库的接口:公开模块、发布闭包与两种形态的一致 | 草案 v0.1 | 2026-09-28 | 第一阶段(只警告)mcpp >= 2026.9.28.3 |
-| [SPEC-009](toolchain-maintenance.md) | 工具链的支持与维护:版本线、默认值、来源、移动与退役 | 草案 v0.5 | 2026-10-08 | 逐条标注;本版只有规范,多数条款未实现 |
+| [SPEC-009](toolchain-maintenance.md) | 工具链的支持与维护:版本线、默认值、来源、移动与退役 | 草案 v0.6 | 2026-10-09 | 逐条标注;本版只有规范,多数条款未实现;§6.4 mcpp >= 2026.10.8.1 |
 
 ## 文档约定