fix(tool-store): upstream key 走传递闭包,与注释声称的一致

注释写的是「recursive (Merkle)」,实现只遍历了直接边 —— 注释**多声称了一个它没有
的性质**,这比没有注释更糟。

两个选择:改注释、或让代码兑现。选后者,因为传递闭包确实更对:对索引包来说直接边
够用(冻结的版本改不了自己的依赖),但 **path 依赖可以** —— 往下两层改一处,工具的
直接依赖列表纹丝不动,于是 store 里留下一个陈旧的二进制。那是**静默的错误产物**,
本项目为这一族问题付过不止一次学费,而闭包遍历几乎不要钱。

Author: speak-agent

src/build/prepare.cppm

@@ -4038,11 +4038,30 @@ prepare_build(bool print_fingerprint,
                     key.profile          = "release";
                     key.features         = closure;
                     std::ranges::sort(key.features);
-                    for (auto const& edge : dependencyEdges) {
-                        if (edge.consumerPackageIndex != depIdx) continue;
-                        auto const& up = packages[edge.dependencyPackageIndex];
-                        key.upstreamKeys.push_back(std::format("{}@{}",
-                            up.manifest.package.name, up.manifest.package.version));
+                    // The tool package's TRANSITIVE dependency closure, not just
+                    // its direct edges. Direct-only would be enough for index
+                    // packages (a frozen version cannot change its own deps),
+                    // but a path dependency can: bump something two levels down
+                    // and the tool's direct list is unchanged, so a stale binary
+                    // stays in the store. That is a silently wrong artifact —
+                    // the failure mode this project has paid for more than once
+                    // — and the closure walk costs nothing.
+                    {
+                        std::set<std::size_t> seen{depIdx};
+                        std::vector<std::size_t> queue{depIdx};
+                        while (!queue.empty()) {
+                            auto cur = queue.back();
+                            queue.pop_back();
+                            for (auto const& edge : dependencyEdges) {
+                                if (edge.consumerPackageIndex != cur) continue;
+                                auto up = edge.dependencyPackageIndex;
+                                if (!seen.insert(up).second) continue;
+                                queue.push_back(up);
+                                key.upstreamKeys.push_back(std::format("{}@{}",
+                                    packages[up].manifest.package.name,
+                                    packages[up].manifest.package.version));
+                            }
+                        }
                     }
                     std::ranges::sort(key.upstreamKeys);
 

src/build/tool_store.cppm

@@ -84,10 +84,15 @@ struct Key {
     std::string compilerIdentity; // the HOST toolchain that will build it
     std::string profile;
     std::vector<std::string> features;   // resolved closure, sorted
-    // The cache key of each direct dependency of the TOOL package, recursively
-    // (Merkle). Without it, bumping one of protobuf's own dependencies would
-    // leave a stale protoc in the store — a silently wrong artifact, which is
-    // the failure mode this project has paid for more than once.
+    // The tool package's TRANSITIVE dependency closure, as sorted
+    // `<name>@<version>` entries. Without it, bumping something the tool
+    // depends on leaves a stale binary in the store — a silently wrong
+    // artifact, the failure mode this project has paid for more than once.
+    //
+    // Transitive rather than direct-only: for an index package a frozen
+    // version cannot change its own dependencies, so direct edges would do —
+    // but a PATH dependency can, and then a change two levels down leaves the
+    // tool's direct list untouched.
     std::vector<std::string> upstreamKeys;
 };