cross-verification stopped the withdrawal, so mcpp names the target itself

The first shape of this change simply withdrew `__CYGWIN__`. It was green
here and green in four of five ecosystem repositories built against this
branch; openkal-llvm-runtime failed, libunwind's `static_assert` reporting
that `Registers_x86_64` does not fit `unw_context_t`.

TWO INSTALLED HEADERS IN THIS ECOSYSTEM READ THAT MACRO ON PURPOSE, each
saying so in its own source: `openkal-musl`'s `bits/setjmp.h` sizes `jmp_buf`
by it, and `openkal-llvm-runtime`'s `__libunwind_config.h` sizes
`unw_context_t`. Both are INSTALLED --- an application's own compile reads
them --- so neither can use the package-private define its sibling `.S` files
use, and `__CYGWIN__` was the only name mcpp kept defined target-wide.

The 30-member measurement that justified withdrawal had counted THIRD-PARTY
readers of the macro and not ours. Ours are load-bearing, and wrong is silent
where it matters most: `setjmp.h`'s own comment says "a mismatch nothing
reports until the record overruns". libunwind having a `static_assert` is
what made this loud, not anything the measurement did.

So mcpp states the fact itself. `-D__mcpp_target_windows__=1` answers the
question those headers ask --- is this target Windows, whatever C environment
is presented above it --- and being mcpp's own name, its meaning is not
decided by anyone else's history. It is emitted only under this substitution;
an ordinary Windows build still has `_WIN64`. `expectDefined` carries it, so
a `-D` that failed to take effect is a verification failure rather than a
silent one.

The name differs from the design's proposed `__mcpp_format_pe__` because the
two consumers do not want the object format: they size Win64 register save
areas, which is the calling convention. The two co-vary on this target, and
naming it for the question actually asked is the honest form.

`__CYGWIN__` REMAINS DEFINED, as step one of three: this release adds the new
name, those packages move onto it while still accepting the old one, and only
then does a release stop defining the borrowed one. Step three taken first
would leave every published copy of those headers falling to its `#else` ---
the wrong record size, reported by nothing. Four loudly failing third-party
members is the better state to hold for one release.

Author: speak-agent

.agents/docs/2026-09-21-openkal-ecosystem-completion-and-acceptance.md

@@ -61,7 +61,8 @@ status: active
 
 #### E1 — P3：撤掉 `__CYGWIN__` 借用
 
-**状态**：**已实现**（mcpp 2026.9.21.1）。下文保留论证；落地形态见本节末。
+**状态**：**分三步，本版落地第一步**（mcpp 2026.9.21.1）。下文保留论证；落地形态与
+被交叉验证挡下的那一版见本节末。
 
 保留 `__CYGWIN__` 的本意是给「PE 格式 + POSIX C 环境」一个名字。实证否定了这个用法：
 
@@ -99,23 +100,38 @@ status: active
 `#if defined(_WIN32) && !defined(__CYGWIN__)`，撤销会**翻转**它的分支。基线已有，重测
 即可读出净值。
 
-**落地形态（2026.9.21.1）**：`cenv.cppm` 的 Windows+Posix 分支加两个 `-U` token，
-`expectUndefined` 加两项——**后者才是承重的**：探针会把实现出的配置的预定义与这两张表
-比对，一个没生效的 `-U` 是一次校验失败，不是一次沉默。
+**先做的那一版被跨仓库交叉验证挡下了，这条记录比结论更值钱。**
 
-直接量过一次，用钉住的 clang、按 mcpp 实际发出的 token 顺序：
+第一次实现就是直接撤：加 `-U__CYGWIN__ -U__CYGWIN32__`，`expectUndefined` 加两项。本机
+全绿，五个生态仓库里四个也绿——**openkal-llvm-runtime 红了**，libunwind 的
+`static_assert` 失败：`Registers_x86_64` 装不进 `unw_context_t`。
 
-```
-echo | clang -dM -E -x c - -U__CYGWIN__ -U__CYGWIN32__ \
-         --target=x86_64-pc-cygwin -U__CYGWIN__ -U__CYGWIN32__
-  -> __unix__ 定义；__CYGWIN__ 消失；_WIN32 仍不存在
-```
+根因是生态里有**两个已安装的公开头**有意读 `__CYGWIN__`，理由写在各自源码里：
+
+| 包 | 头文件 | 它定尺寸的记录 |
+| --- | --- | --- |
+| openkal-musl | `port/include/bits/setjmp.h` | `jmp_buf` |
+| openkal-llvm-runtime | `__libunwind_config.h` | `unw_context_t`、`unw_cursor_t` |
+
+两者都写明：这是**已安装**的头，会被**应用程序自己的编译**读到，所以用不了包私有的
+`OKM_TARGET_WINDOWS` / `OPENKAL_TARGET_WINDOWS`；而 `__CYGWIN__` 是 mcpp **target-wide**
+保持定义的唯一名字。
+
+**那个「四比零」数的是第三方读者，没数我们自己的。** 而自己这两个是承重的，且错了是
+**静默**的——`setjmp.h` 自己的注释写着「a mismatch nothing reports until the record
+overruns」。libunwind 那处有 `static_assert` 才响，属于运气。
+
+**落地形态（第一步）**：`cenv.cppm` 的 Windows+Posix 分支加 `-D__mcpp_target_windows__=1`，
+`expectDefined` 加该项与 `__CYGWIN__`——探针核对，一个没生效的 `-D` 是校验失败不是沉默。
+实测：三个通道（`.c`/`.cpp`/`.S`）全部到达；预定义为 `__unix__` + `__CYGWIN__` +
+`__mcpp_target_windows__`，`_WIN32` 仍不存在。
+
+**为什么名字是 `__mcpp_target_windows__` 而不是设计里写的 `__mcpp_format_pe__`**：两个
+消费者要的不是「目标文件格式」，是**调用约定**（Win64 的寄存器保存区大小）。在这个目标上
+两者同变，但按消费者实际问的那个问题命名更诚实。
 
-**`.S` 行上这对 token 出现两次**，`.c`/`.cpp` 各一次。`cEnvTokens` 会被加进包的
-asmflags，而形如 `-D`/`-U`/`-I` 的 token 同时经由「把 define 带进汇编」的通道到达；
-`--target=` 与 `-fno-short-wchar` 不是那个形状，所以只出现一次。`-U X` 两次等于一次，
-且真正的判据是探针，所以 e2e 不对次数作断言——那会把 flag 管线的实现细节钉死，而不是
-钉住被测性质。
+**第二、三步**：两个包改读新名字并保留 `|| defined(__CYGWIN__)`（在两种引擎上都能构建）；
+之后的版本再停止定义借来的那个。**先做第三步会让已发布的那两个头静默落进 `#else`。**
 
 #### E2 — P7-L3：链接期集合差
 

CHANGELOG.md

@@ -7,40 +7,30 @@
 
 ## [2026.9.21.1] - 2026-09-21
 
-### 撤掉借来的 `__CYGWIN__`,由一次测量裁决
-
-`presents = "posix"` 在 Windows 上实现成 Cygwin 形状的目标。上一版**保留**
-`__CYGWIN__`/`__CYGWIN32__` 定义,理由是:需要知道**目标文件格式**的第三方可移植代码,
-没有别的名字能指代「PE 格式 + 呈现 POSIX 的 C 环境」。那一版同时写下了自己的翻转条件
-——**留给 30 成员测量裁决;若定义它带来的失败比修好的多,结论就翻过来。**
-
-测量在 2026-09-20 给出读数,60 个「成员 × 目标」组合:**保留它代价是四个成员**——
-`archive`、`sqlite3`、`mimalloc`、`c-ares`,各自停在 `#include <windows.h>`,都经由形如
-`#if defined(_WIN32) || defined(__CYGWIN__)` 的守卫到达。**同一轮里没有任何一项因为缺少
-这个宏而失败。** 四比零。
-
-上游自己说明了这个名字的含义。mimalloc 把话写在守卫的注释里:
-`we use windows locks on cygwin, but otherwise treat it at unix`;sqlite3 把它列进
-`SQLITE_OS_WIN` 的检测集合,随后 `#include "windows.h"`。**它们用这个名字表达的是
-「Win32 可用」,不是「目标文件格式是 PE」。一个借来的名字,语义由借出方的历史决定,
-不由借用方的意图决定。**
-
-于是「目标文件格式」这一维**不保留任何宏**:包问 `cfg(os = "windows")`,那不需要宏。
-若某天确实发现只能在预处理期问这件事的第三方代码,答案是 mcpp 定义一个自己的名字。
-
-承重的不是那两个 `-U` token,是 `expectUndefined` 里新增的两项:探针把实现出的配置的
-预定义与它比对,**一个没生效的 `-U` 是一次校验失败,不是一次沉默**。
-
-实测(钉住的 clang,按 mcpp 实际发出的 token 顺序):
-
-```
-echo | clang -dM -E -x c - -U__CYGWIN__ -U__CYGWIN32__ \
-         --target=x86_64-pc-cygwin -U__CYGWIN__ -U__CYGWIN32__
-  -> __unix__ 定义;__CYGWIN__ 消失;_WIN32 仍不存在
-```
-
-单测与 e2e 741 都改成断言相反的一侧,注释里记着这个模块两种答案都持有过、以及是什么
-把它翻过来的。
+### mcpp 为「这个目标是 Windows」给出自己的名字
+
+`presents = "posix"` 在 Windows 上实现成 Cygwin 形状的目标,有意压掉 `_WIN32`——那正是
+「呈现 POSIX」的含义。但 **ABI 并没有跟着环境一起变**:调用约定仍是 Win64,寄存器保存区
+仍按它的大小。生态里有两个**已安装的**头按这个事实定尺寸——openkal-musl 的
+`bits/setjmp.h` 定 `jmp_buf`,openkal-llvm-runtime 的 `__libunwind_config.h` 定
+`unw_context_t`。已安装的头会被**应用程序自己的编译**读到,所以两者都用不了包私有的 define。
+
+本版发 `-D__mcpp_target_windows__`。它是 mcpp 自己的名字,语义由 mcpp 自己定;只在这次
+替换下发出,普通 Windows 构建仍有 `_WIN64`。
+
+**`__CYGWIN__` 仍然定义着,这是次序不是结论。** 30 成员测量已判定这个借来的名字代价是
+四个成员(`archive`、`sqlite3`、`mimalloc`、`c-ares` 各自停在 `#include <windows.h>`,
+经由 `#if defined(_WIN32) || defined(__CYGWIN__)`);上游用它表达「Win32 可用」,
+mimalloc 把这句话写在守卫自己的注释里。**一个借来的名字,语义由借出方的历史决定。**
+
+**撤掉它试过了,被跨仓库交叉验证挡下。** 上面那两个头正是因为没有别的 target-wide 名字
+才读它;撤掉后 libunwind 的 `static_assert` 响亮地红了,而 `setjmp.h` 那一处**不会**响——
+它自己的注释写着「a mismatch nothing reports until the record overruns」。那次测量数的是
+**第三方**读者,没数我们自己的。
+
+于是撤销分三步,每个中间状态都能构建:本版**增加**新名字;两个包改读新名字并保留
+`|| defined(__CYGWIN__)`;之后的版本再停止定义借来的那个。先做第三步会让**已发布**的那
+两个头全部落进 `#else`——错误的记录尺寸,没有任何东西报告。
 
 ## [2026.9.20.1] - 2026-09-20
 

docs/22-target-side.md

@@ -377,7 +377,7 @@ that names no C library:
 | Linux | `posix` / `arch-default` | the default triple already satisfies it |
 | macOS | `posix` / `arch-default` | one token, `-D__unix__` — Apple's clang predefines `__APPLE__`/`__MACH__` on its default triple, never `__unix__` |
 | freestanding | `posix` / `arch-default` | the same one token, `-D__unix__`, for the same reason: nothing here defines it either |
-| Windows | `posix` / `arch-default` | Cygwin-flavoured: `--target=x86_64-pc-cygwin` on the compile line only; `__CYGWIN__`/`__CYGWIN32__` are undefined on top of it (see the note below); `data-model` becomes LP64 as a consequence of the triple, not a separate flag |
+| Windows | `posix` / `arch-default` | Cygwin-flavoured: `--target=x86_64-pc-cygwin` on the compile line only; plus `-D__mcpp_target_windows__` (see the note below); `data-model` becomes LP64 as a consequence of the triple, not a separate flag |
 | any | `builtins = "iso"` | turns off code-generation idioms that assume a platform C library — `-fno-builtin-memset_pattern16` on Apple targets is the one this survey measured; see `src/toolchain/cenv.cppm` for what else was checked and found not to apply |
 | anything else | | refused, naming the target, the request and what is missing — never a silent downgrade |
 
@@ -418,31 +418,48 @@ preprocessor sees and how wide `long` is. Realisation therefore touches only
 the **compile** line; the **link** line keeps the triple the graph resolved,
 because nothing about the object format changed.
 
-**`__CYGWIN__`/`__CYGWIN32__` are undefined, and a measurement decided it
-(2026.9.21.1).** This page has carried both answers. A middle revision left
-them defined, so that portable third-party code needing to know the **object
-format** — not the C environment, not the platform API — would keep a name
-for "PE format with a POSIX-presenting C environment". That revision wrote
-its own condition for reversal: a trade-off for the 30-member measurement to
-settle, flipping if defining them produced more failures than it fixed.
-
-It produced four and fixed none. Across 60 member-target combinations,
-`archive`, `sqlite3`, `mimalloc` and `c-ares` each stopped at
-`#include <windows.h>`, reached through a guard of the shape
-`#if defined(_WIN32) || defined(__CYGWIN__)`. Nothing in the same run failed
-for want of the macro.
-
-**A borrowed name means what the lender's history made it mean.** Upstream
-uses this one to say *Win32 is available*, not *the object format is PE* —
-mimalloc states it in the guard itself (`we use windows locks on cygwin, but
-otherwise treat it at unix`), and sqlite3 lists it in the `SQLITE_OS_WIN`
-detection set before including `windows.h`. The intent behind borrowing it
-does not travel with it.
-
-The object-format question therefore keeps **no macro at all**. A package
-asks `cfg(os = "windows")`, which needs none. Should a third party ever be
-found that can only ask in the preprocessor, the answer is a name mcpp
-defines itself, not one it borrows.
+**`__mcpp_target_windows__` is defined here, and `__CYGWIN__` still is too
+(2026.9.21.1).**
+
+The substitution suppresses `_WIN32` on purpose — that is what presenting
+POSIX means. But the **ABI did not change with the environment**: the calling
+convention is still Win64 and the register save areas are still its. Two
+INSTALLED headers in this ecosystem size records by that fact:
+
+| package | header | sizes |
+|---|---|---|
+| openkal-musl | `port/include/bits/setjmp.h` | `jmp_buf` |
+| openkal-llvm-runtime | `__libunwind_config.h` | `unw_context_t`, `unw_cursor_t` |
+
+An installed header is read by an **application's own compile**, so neither
+can use a package-private define. `__mcpp_target_windows__` is mcpp's own
+name for the question they ask — is this target Windows, whatever C
+environment is presented above it — and being mcpp's own, its meaning is not
+decided by anyone else's history. It is emitted only under this substitution;
+an ordinary Windows build still has `_WIN64`.
+
+**`__CYGWIN__` is still defined, and that is a sequence rather than a
+decision to keep it.** The 30-member measurement settled that the borrowed
+name costs four members: `archive`, `sqlite3`, `mimalloc` and `c-ares` each
+stop at `#include <windows.h>`, reached through
+`#if defined(_WIN32) || defined(__CYGWIN__)`. Upstream means *Win32 is
+available* by it — mimalloc states so in the guard itself, sqlite3 lists it
+under `SQLITE_OS_WIN`. **A borrowed name means what the lender's history made
+it mean**, not what the borrower intended.
+
+Withdrawing it was tried and broke the two headers above, which read it for
+want of any other target-wide name. libunwind's `static_assert` failed
+loudly; `setjmp.h`'s equivalent would not have — its own comment says *a
+mismatch nothing reports until the record overruns*. So the withdrawal is
+three steps, and each intermediate state builds:
+
+1. this release defines `__mcpp_target_windows__` as well — purely additive;
+2. those packages read the new name, keeping `|| defined(__CYGWIN__)` so they
+   build on both engines;
+3. a later release stops defining the borrowed one.
+
+Taking step three first would leave every **published** copy of those headers
+falling to its `#else`: the wrong record size, reported by nothing.
 
 **A `kernel-abi` provider's own units are INFERRED onto the platform boundary
 — it never has to say so (mcpp 2026.9.18+, a mid-PR revision from the

docs/zh/22-target-side.md

@@ -309,7 +309,7 @@ libunwind 的 `assembly.h`,正是按这个宏来选寄存器保存集的)。mcpp
 | Linux | `posix` / `arch-default` | 默认三元组已经满足 |
 | macOS | `posix` / `arch-default` | 一个令牌,`-D__unix__`——Apple 的 clang 默认三元组预定义的是 `__APPLE__`/`__MACH__`,从来不是 `__unix__` |
 | 裸机(freestanding) | `posix` / `arch-default` | 同样一个令牌,`-D__unix__`,原因相同:这里同样没有任何东西定义它 |
-| Windows | `posix` / `arch-default` | 采用 Cygwin 式语义:仅在编译行加 `--target=x86_64-pc-cygwin`;在其之上再加 `-U__CYGWIN__ -U__CYGWIN32__`(见下方说明);`data-model` 变为 LP64 是三元组切换的结果,不是另一个开关 |
+| Windows | `posix` / `arch-default` | 采用 Cygwin 式语义:仅在编译行加 `--target=x86_64-pc-cygwin`;并加 `-D__mcpp_target_windows__`(见下方说明);`data-model` 变为 LP64 是三元组切换的结果,不是另一个开关 |
 | 任意目标 | `builtins = "iso"` | 关闭代码生成阶段假定平台 C 库在场的惯用法识别——本轮实测到的唯一一例是 Apple 目标上的 `-fno-builtin-memset_pattern16`;`src/toolchain/cenv.cppm` 记录了还核实过哪些、结论是不适用 |
 | 其余情况 | | 明确拒绝,点名目标、请求与缺什么——不静默降级 |
 
@@ -337,25 +337,37 @@ Windows 一行是旗舰情形:`x86_64-w64-windows-gnu` 与 `x86_64-pc-cygwin` 
 同样的 PE 格式、同样的 Win64 调用约定、同样的 SEH——差别只在预处理器看到什么、`long` 有多宽。
 因此实现只触及**编译**行;**链接**行保持图解析出的三元组,因为目标文件格式没有变化。
 
-**`__CYGWIN__`/`__CYGWIN32__` 取消定义,而这是一次实测裁决的(2026.9.21.1)。** 本页
-两种答案都写过。中间一版保持它们定义,为的是让需要知道**目标文件格式**——不是 C 环境,
-也不是平台 API——的第三方可移植代码,留住「PE 格式加呈现 POSIX 的 C 环境」这个组合的名字。
-那一版自己写下了翻转条件:留给 30 个成员那轮实测判定的权衡,若定义它带来的失败比修好的多,
-结论就翻过来。
-
-它带来四个,修好零个。60 个「成员 × 目标」组合里,`archive`、`sqlite3`、`mimalloc`、
-`c-ares` 各自停在 `#include <windows.h>`,经由形如
-`#if defined(_WIN32) || defined(__CYGWIN__)` 的守卫到达。同一轮里没有任何一项因为**缺少**
-这个宏而失败。
-
-**一个借来的名字,它的语义由借出方的历史决定。** 上游用它表达的是「**Win32 可用**」,
-不是「目标文件格式是 PE」——mimalloc 把这句话写在守卫自己的注释里(`we use windows locks
-on cygwin, but otherwise treat it at unix`),sqlite3 把它列进 `SQLITE_OS_WIN` 的检测集合
-随后 `#include "windows.h"`。借用时的意图不会跟着名字一起走。
-
-于是「目标文件格式」这个问题**不保留任何宏**。包问 `cfg(os = "windows")`,那不需要宏。
-若某天确实发现只能在预处理期问这件事的第三方代码,答案是 mcpp 定义一个**自己的**名字,
-而不是继续借别人的。
+**这里定义 `__mcpp_target_windows__`,而 `__CYGWIN__` 仍然定义着(2026.9.21.1)。**
+
+这次替换有意压掉 `_WIN32`——那正是「呈现 POSIX」的含义。但**ABI 并没有跟着环境一起变**:
+调用约定仍是 Win64,寄存器保存区仍按它的大小。生态里有两个**已安装的**头按这个事实定尺寸:
+
+| 包 | 头文件 | 它定尺寸的记录 |
+|---|---|---|
+| openkal-musl | `port/include/bits/setjmp.h` | `jmp_buf` |
+| openkal-llvm-runtime | `__libunwind_config.h` | `unw_context_t`、`unw_cursor_t` |
+
+已安装的头会被**应用程序自己的编译**读到,所以两者都用不了包私有的 define。
+`__mcpp_target_windows__` 是 mcpp 为它们所问的那个问题给出的**自己的**名字——这个目标是不是
+Windows,无论上面呈现的是什么 C 环境——既然是自己的名字,它的语义就不由别人的历史决定。
+它只在这次替换下发出;普通的 Windows 构建仍然有 `_WIN64`。
+
+**`__CYGWIN__` 仍然定义着,这是一个次序问题,不是决定留下它。** 30 成员测量已经判定这个
+借来的名字代价是四个成员:`archive`、`sqlite3`、`mimalloc`、`c-ares` 各自停在
+`#include <windows.h>`,经由 `#if defined(_WIN32) || defined(__CYGWIN__)` 到达。上游用它
+表达的是「**Win32 可用**」——mimalloc 把话写在守卫自己的注释里,sqlite3 把它列进
+`SQLITE_OS_WIN`。**一个借来的名字,语义由借出方的历史决定**,不由借用方的意图决定。
+
+撤掉它试过了,结果打断了上面那两个头——它们读它,正是因为没有别的 target-wide 名字可用。
+libunwind 的 `static_assert` 响亮地红了;`setjmp.h` 那一处不会——它自己的注释写着
+「a mismatch nothing reports until the record overruns」。所以撤销分三步,每个中间状态都能构建:
+
+1. 本版**增加** `__mcpp_target_windows__`——纯增量;
+2. 那两个包改读新名字,保留 `|| defined(__CYGWIN__)` 以便在两种引擎上都能构建;
+3. 之后的版本再停止定义借来的那个。
+
+先做第三步,会让**已发布**的那两个头全部落进各自的 `#else`:错误的记录尺寸,而没有任何
+东西报告。
 
 **`kernel-abi` 提供者的自身单元被推导落到平台边界上——它不必自己说出来**
 (mcpp 2026.9.18+,PR 进行中根据 openkal-musl 尖峰实验做的修订)。提供