fix: own detached compilers through cancellation and rebuilds

Author: Sunrisepeak

.agents/docs/2026-11-06-bmi-publication-and-compiler-cap-closeout.md

@@ -131,3 +131,71 @@ follow ordinary installation of the new release, in the same plugin PR.
 Public records contain synthetic assertions and aggregate evidence. Raw
 provider streams, user logs, usernames and private paths remain outside the
 repository and pull-request description.
+
+## Correction, 2026-11-06: ownership across cancellation and generations
+
+The shared-cap change exposed an existing lifetime gap. A real Ninja control
+cancelled the top-level build after BMI publication. Its detached compiler
+remained alive 200 milliseconds later. Deleting the previous directory tokens
+at the next build could therefore admit new compilers over the requested cap.
+The correction below supersedes directory-token ownership in the earlier
+shared-permit description.
+
+Each detached-schedule backend drive owns a runtime generation. Normal graph
+execution and cached replay, including quiet replay, open the same scope. Its
+owner has both the operating system's process identity with birth time and an
+exclusive kernel lock. A PID alone, a surviving record, or an absent birth time
+cannot establish ownership. Closing the lock revokes the drive even while its
+process is alive. The generation is passed only in the child environment after
+cache decoding; it never enters an action, build fingerprint or saved graph.
+
+Every phase-one helper, supervisor, join helper and ordinary compiler executor
+registers a kernel-locked actor before modifying build state and rechecks the
+owner after registration. The actor covers status publication, BMI equivalence
+settlement and backup restoration, as well as compiler execution. Interrupt
+callbacks retain that actor until their final write. A delayed helper from a
+closed generation returns cancellation before changing any build state.
+
+A stable gate serializes generations for one canonical output directory. The
+next generation waits for all previous actor locks, including actors that have
+already released a compiler permit. It retains busy state and refuses admission
+if the actors do not drain within the cleanup bound. Runtime locks reside under
+the work directory's `.mcpp/compiler-runs`, outside the target output tree and
+independently of `MCPP_HOME`. Cleaning output files cannot unlink a live permit.
+
+Actual compiler permits are stable kernel-locked files. A supervisor acquires
+its permit itself and holds it until the child has stopped; phase one does not
+transfer a lock or consume a second permit. Ordinary compilation uses the same
+slots. Files left after process death are reused by locking, never reclaimed by
+unlinking. A typed busy result is retried; permission and other failures stop
+the invocation. This also replaces the directory-creation contention path that
+reported access denied in the Windows-host GCC cross-build.
+
+Child cancellation uses the existing launcher stop predicate. A further causal
+control found that inherited or discarded streams skipped that predicate when
+no absolute deadline was set. The launcher now polls child completion in that
+case, retaining its argv, streams, exit status and existing deadline. No timeout
+is increased. Failed or cancelled compiler invocations withdraw partial outputs;
+subsequent ordinary builds recover missing objects and BMIs.
+
+The permanent real-Ninja control checks:
+
+- Module and ordinary compilation under top-level SIGINT and SIGKILL, followed
+  immediately by another generation; the old compiler has stopped before the
+  new drive is admitted.
+- No-op builds across generations, retaining compiler count and object mtime;
+  normal and quiet cached replay retain their graph, objects and BMIs.
+- Changed homes and a symlinked target directory retain the work-directory
+  runtime barrier, independently of the disposable output location.
+- Owner-lock closure while the owner process remains alive.
+- Missing and incorrect process birth identities, rejected before state writes.
+- Delayed phase-one BMI settlement and backup restoration after compiler exit;
+  both still block the next generation until their final state write.
+- Unregistered old phase-one and supervisor processes delayed until after a
+  successful new generation; neither can alter its BMI, object or status.
+
+The controls execute the actual helper and launcher implementations with a
+small synthetic compiler. The separate GCC mixed workload retains the real
+compiler cap, late failure, recovery, argv and no-op assertions. Selected-object
+controls establish causality; final qualification remains complete current-source
+CI and independent ecosystem review.

CHANGELOG.md

@@ -23,6 +23,11 @@
   BMI fails with a diagnostic and restores the previous BMI.
 - Ordinary compiler invocations share the detached GCC compilers' concurrency
   permits, so the additional Ninja scheduling slots do not exceed `--jobs`.
+- Cancelled detached builds stop their compilers and finish state cleanup before
+  another generation starts. Stable kernel permits retain live ownership across
+  immediate rebuilds; runtime generations leave no-op build identities unchanged.
+- Child stop predicates apply with inherited and discarded streams, including
+  executions without an absolute deadline.
 - Queued downloads begin their progress budget when a worker starts them,
   rather than inheriting time spent waiting for a slot.
 - Provider progress timeouts identify the stalled download and source attempt,

docs/04-mcpp-toml.md

@@ -1051,6 +1051,9 @@ with two behaviours has to be.
 With GCC and `bmi_schedule = "on"`, ordinary compilation and detached code
 generation share the same total `jobs` limit (2026.11.5.2+). Additional
 scheduling and join tasks do not increase the number of compiler processes.
+Cancelling the build ends its ordinary and detached compilers. An immediately
+following build waits for their cleanup before starting another compiler;
+partial outputs are rebuilt. An unchanged build still performs no compilation.
 
 | value | |
 |---|---|

docs/zh/04-mcpp-toml.md

@@ -974,6 +974,8 @@ bmi_schedule = "off"     # auto (default, = off) | on | off
 
 使用 GCC 且 `bmi_schedule = "on"` 时，普通编译与分离的代码生成共用同一个 `jobs` 总上限
 （2026.11.5.2+）。额外的调度和等待任务不增加编译器进程数量。
+取消构建会结束本轮普通编译器和分离的编译器。紧接着的构建等待它们完成清理后
+才启动新的编译器；未完成的输出会重新构建。输入不变的构建仍不进行编译。
 
 | 取值 | |
 |---|---|

src/build/execute.cppm

@@ -61,6 +61,7 @@ import mcpp.runtime.launch_env;
 import mcpp.run;
 import mcpp.home.files;
 import mcpp.build.schedule.policy;   // resolve_jobs — one answer to "how many at once"
+import mcpp.build.schedule.detach_codegen;
 import mcpp.fetcher.progress;
 import mcpp.project;
 import mcpp.ui;
@@ -2166,6 +2167,14 @@ std::optional<int> run_ninja_fast(const std::string& ninjaProgram,
         childEnv.emplace_back(runtimeEnvKey, runtimeEnvValue);
     }
 
+    std::optional<mcpp::build::schedule::detach::RunScope> compilerRun;
+    if (mcpp::build::read_schedule(ninjaPath) == "detach-codegen") {
+        auto opened = mcpp::build::schedule::detach::RunScope::begin(outputDir);
+        if (!opened) { mcpp::ui::error(opened.error()); return 1; }
+        compilerRun.emplace(std::move(*opened));
+        compilerRun->environment(childEnv);
+    }
+
     auto t0 = std::chrono::steady_clock::now();
     // capture_exec merges stderr into the captured output (replacing `2>&1`),
     // so is_stale_ninja_failure / filter_ninja_output still see ninja errors.
@@ -2213,6 +2222,12 @@ std::optional<int> run_ninja_fast(const std::string& ninjaProgram,
         out = std::move(r.output);
         status = r.exit_code;
     }
+    if (compilerRun) {
+        if (auto settled = compilerRun->finish(); !settled) {
+            mcpp::ui::error(settled.error());
+            return 1;
+        }
+    }
     if (status != 0) {
         if (!reported && is_stale_ninja_failure(out))
             return std::nullopt;

src/build/ninja_backend.cppm

@@ -58,6 +58,7 @@ import mcpp.ui;
 import mcpp.log;
 import mcpp.build.action_progress;
 import mcpp.build.progress;
+import mcpp.build.schedule.detach_codegen;
 
 export namespace mcpp::build {
 
@@ -1470,7 +1471,7 @@ std::string emit_ninja_string(const BuildPlan& plan, std::string* placements,
     // compilers must share the supervisors' semaphore rather than use that
     // larger slot count as their own concurrency bound.
     const std::string compilerPrefix = splitBmi
-        ? std::format("$mcpp __compiler-cap --sem .mcpp-sched --cap {} -- ", plan.scheduleCompilerCap)
+        ? std::format("$mcpp __compiler-cap --sem .mcpp-sched --cap {} --output $out -- ", plan.scheduleCompilerCap)
         : std::string{};
     // The other split shape. Clang publishes no BMI early — it writes the BMI
     // at the end of the compile — so the GCC trick of releasing the file
@@ -2108,7 +2109,7 @@ std::string emit_ninja_string(const BuildPlan& plan, std::string* placements,
         // wrong in this file before.
         append("rule cxx_module_bmi\n");
         append("  command = $mcpp bmi-compile --bmi $bmi_out --slot $slot"
-               " --self $mcpp --sem $sched_sem --cap $sched_cap"
+               " --self $mcpp --sem $sched_sem --cap $sched_cap --object $obj_out"
                " --command-file $out.cmd --dep-from $scan_dep --dep-to $out.d\n");
         append(std::format(
             "  rspfile = $out.cmd\n"
@@ -4538,6 +4539,12 @@ std::expected<BuildResult, BuildError> NinjaBackend::build(const BuildPlan& plan
         return std::unexpected(BuildError{std::format("cannot create output dir '{}': {}",
                                                       plan.outputDir.string(), ec.message()),
                                           plan.outputDir});
+    std::optional<mcpp::build::schedule::detach::RunScope> compilerRun;
+    if (!opts.dryRun && plan.scheduleTag == "detach-codegen") {
+        auto opened = mcpp::build::schedule::detach::RunScope::begin(plan.outputDir);
+        if (!opened) return std::unexpected(BuildError{opened.error(), plan.outputDir});
+        compilerRun.emplace(std::move(*opened));
+    }
     if (!opts.dryRun && plan.scheduleTag == "detach-codegen")
         reclaim_stale_schedule_tokens(plan.outputDir);
 
@@ -4881,6 +4888,7 @@ std::expected<BuildResult, BuildError> NinjaBackend::build(const BuildPlan& plan
             nenv.emplace_back(runtimeEnv->first, runtimeEnv->second);
     for (auto& ev : plan.toolchain.envOverrides)
         nenv.emplace_back(ev.key, ev.value);
+    if (compilerRun) compilerRun->environment(nenv);
 
     // THE STAGED CACHE IS PLACED BY A PASS OF ITS OWN, before the graph that
     // reads it. ninja 1.12.1 loads a dyndep file whose producer is up to date
@@ -5008,6 +5016,10 @@ std::expected<BuildResult, BuildError> NinjaBackend::build(const BuildPlan& plan
         ninjaExit = cap.exit_code;
     }
     stage("ninja");
+    if (compilerRun) {
+        if (auto settled = compilerRun->finish(); !settled)
+            return std::unexpected(BuildError{settled.error(), plan.outputDir});
+    }
     bool ok = (ninjaExit == 0) && !buildTimedOut;
     // Every package gets its final line before what the build has to say
     // after ninja: validations, advice, `Finished`.