the token was accepted in silence and changed nothing

`[c-abi] builtins = "iso"` emitted `-fno-builtin-memset_pattern16` from this
mechanism's first revision. A/B on a real compile command, varying only that
flag, reads

    as built (flag present)              1 reference to memset_pattern16
    flag REMOVED                         1 reference
    -fno-builtin                         0
    -mllvm -disable-loop-idiom-memset    0

and clang accepts `-fno-builtin-totally_not_a_function` just as quietly: the
`-fno-builtin-<fn>` family is matched against clang's builtin table, while
`memset_pattern16` is an LLVM TargetLibraryInfo libfunc. The call is emitted by
LoopIdiomRecognize, which consults TLI, and the per-function attribute does not
reach it.

`-mllvm` is not chosen because it passes an internal LLVM option, which can be
renamed or removed between releases; when it is, the mechanism returns to
failing silently, which is the defect being repaired. The cost of the blunt
flag is measured rather than argued: on the translation unit that surfaced this
the object grows 38200 to 38888 bytes, 1.8 per cent.

THE NO-OP SURVIVED BECAUSE IT HAD NO CRITERION. `cenv` verifies its tokens
against a `-dM` dump, and a code-generation property is not visible there. The
criterion now lives in `openkal-cross.yml` and has three legs, on all three
hosts: no flag (the symbol MUST appear, or the probe measures nothing), the
per-function flag (it must still appear, pinning the defect), and an
`aarch64-macos` build over the openkal stack by the mcpp under test (zero
references). Run against the previous binary the step fails, at the link:

    ld64.lld: error: undefined symbol: memset_pattern16

Author: speak-agent

.github/workflows/openkal-cross.yml

@@ -264,6 +264,117 @@ jobs:
             echo "${{ matrix.host }} → $t : $(ls -l "$a" | awk '{print $5}') bytes"
           done
 
+      # THE ONLY CRITERION THE `builtins` TOKEN HAS, AND WHY IT IS HERE.
+      #
+      # `[c-abi] builtins = "iso"` states that the C library supplies the ISO
+      # functions and no vendor extensions. On Darwin targets clang's loop
+      # idiom recogniser rewrites a constant-pattern fill into a call to
+      # `memset_pattern16`, an Apple libc extension no such library carries.
+      # That call is produced by the code generator, so it appears in no `-D`
+      # and in no preprocessor dump --- and `mcpp.toolchain.cenv` verifies its
+      # tokens by comparing a `-dM` dump. The token this mechanism emitted was
+      # therefore a silent no-op for the whole of its first life, and this
+      # step exists because no other kind of check could have reported it.
+      #
+      # LEG 1 IS THE DENOMINATOR, AND IT IS NOT DECORATION. At `-O0` the pass
+      # does not run, and `-ffreestanding` implies `-fno-builtin`; an
+      # assertion that only reads "the symbol is absent" therefore passes in
+      # several worlds where nothing was measured. Leg 1 compiles with no flag
+      # at all and fails if the symbol does NOT appear.
+      #
+      # LEG 2 PINS THE DEFECT ITSELF. `-fno-builtin-memset_pattern16` is
+      # accepted in silence and changes nothing: `-fno-builtin-<fn>` is matched
+      # against clang's builtin table, and `memset_pattern16` is an LLVM
+      # TargetLibraryInfo libfunc rather than a clang builtin. The toolchain is
+      # pinned in this job, so the reading is stable. Should a later pin make
+      # leg 2 fail, clang has gained the narrower behaviour, and `cenv` can
+      # emit the narrower flag and recover the 1.8 per cent `-fno-builtin`
+      # costs.
+      #
+      # LEG 3 IS THE ENGINE: the same idiom, over the openkal stack, for
+      # `aarch64-macos`, built by the mcpp under test. Measured on the token
+      # this step was written for, the two readings are
+      #
+      #     -fno-builtin-memset_pattern16   1 reference, and the link fails
+      #     -fno-builtin                    0 references, and it links
+      #
+      # so a regression here reports itself at the link before the assertion
+      # is reached. The assertion covers the remaining case, in which some
+      # layer happens to supply the symbol and the link succeeds anyway.
+      #
+      # `-O2` IS PER PACKAGE RATHER THAN `--release`. The idiom pass does not
+      # run at the dev profile's `-O0`, and a release build would compile the
+      # runtime a second time in a second profile for no reading.
+      - name: builtins = "iso" withdraws the Apple pattern fill
+        run: |
+          set -euo pipefail
+          BIN="${MCPP_HOME:-$HOME/.mcpp}/registry/data/xpkgs/xim-x-llvm/22.1.8/bin"
+          # Not `ls ... | head -1`: with `pipefail` the absent candidate's
+          # exit status ends the step before the guard below is reached.
+          CLANG=""
+          for c in "$BIN/clang" "$BIN/clang.exe"; do
+            if [ -x "$c" ]; then CLANG="$c"; break; fi
+          done
+          [ -n "$CLANG" ] || { echo "::error::no clang under $BIN"; exit 1; }
+
+          # Inside the clone, so the dependency is named by a relative path.
+          # `$RUNNER_TEMP` is a backslash path on the Windows host and a TOML
+          # string would read its separators as escapes.
+          W="$RUNNER_TEMP/okl/examples/builtins-probe"
+          rm -rf "$W"; mkdir -p "$W/src"
+
+          # The one shape the idiom recogniser rewrites. The element type is
+          # `int` and not `char` because a byte-repeating value becomes
+          # `memset`, which every C library has.
+          cat > "$W/src/main.cpp" <<'PROBE'
+          extern "C" void fill(int* a, long n) {
+              for (long i = 0; i < n; ++i) a[i] = 0x01020304;
+          }
+
+          int main() {
+              static int buf[64];
+              fill(buf, 64);
+              return buf[0] == 0x01020304 ? 0 : 1;
+          }
+          PROBE
+
+          cat > "$W/mcpp.toml" <<'PROJECT'
+          [package]
+          name    = "openkal-builtins-probe"
+          version = "0.1.0"
+
+          [build]
+          cxxflags = ["-O2"]
+
+          [dependencies]
+          openkal-llvm-runtime = { path = "../.." }
+
+          [toolchain]
+          default = "llvm@22.1.8"
+          PROJECT
+
+          # The symbol name is in the object's string table, so a byte match
+          # reads it without naming an `llvm-nm` whose path differs per host.
+          refs() { grep -ac memset_pattern16 "$1" 2>/dev/null || true; }
+          T=--target=arm64-apple-macos14.0
+
+          "$CLANG" $T -O2                                -c "$W/src/main.cpp" -o "$W/bare.o"
+          "$CLANG" $T -O2 -fno-builtin-memset_pattern16  -c "$W/src/main.cpp" -o "$W/narrow.o"
+          "$CLANG" $T -O2 -fno-builtin                   -c "$W/src/main.cpp" -o "$W/blunt.o"
+          echo "no flag                       : $(refs "$W/bare.o")"
+          echo "-fno-builtin-memset_pattern16 : $(refs "$W/narrow.o")"
+          echo "-fno-builtin                  : $(refs "$W/blunt.o")"
+
+          [ "$(refs "$W/bare.o")" = 1 ] || { echo "::error::leg 1: the probe no longer triggers the idiom, so legs 2 and 3 measure nothing"; exit 1; }
+          [ "$(refs "$W/narrow.o")" = 1 ] || { echo "::error::leg 2: clang now honours -fno-builtin-memset_pattern16, and mcpp.toolchain.cenv can emit the narrower token"; exit 1; }
+          [ "$(refs "$W/blunt.o")" = 0 ] || { echo "::error::leg 2: -fno-builtin no longer withdraws the pattern fill"; exit 1; }
+
+          (cd "$W" && "$MCPP_UNDER_TEST" build --target aarch64-macos)
+          obj=$(find "$W/target" -name 'main.o' | head -1)
+          [ -n "$obj" ] || { echo "::error::leg 3 produced no object to read"; exit 1; }
+          echo "engine, aarch64-macos over openkal: $(refs "$obj")"
+          [ "$(refs "$obj")" = 0 ] || { echo "::error::leg 3: builtins = \"iso\" did not withdraw memset_pattern16"; exit 1; }
+
       - uses: actions/upload-artifact@v4
         with:
           name: openkal-built-on-${{ matrix.host }}

CHANGELOG.md

@@ -5,6 +5,45 @@
 
 ## [Unreleased]
 
+### `builtins = "iso"` 发的那个 token 是静默空操作,已换成 `-fno-builtin`
+
+`[c-abi] builtins = "iso"` 声明 C 库只提供 ISO 函数、没有厂商扩展。Apple 目标上
+clang 的循环惯用法识别会把常量模式填充改写成 `memset_pattern16` 调用——那是一个
+Apple libc 扩展,这样的库没有它。此前这里发的是 `-fno-builtin-memset_pattern16`。
+在一份真实的 `build.ninja` 编译命令上做 A/B,只改这一个 flag:
+
+| flag | `memset_pattern16` 引用数 |
+|---|---|
+| 照原样(flag 在) | 1 |
+| flag **删掉** | 1 |
+| `-fno-builtin` | 0 |
+| `-mllvm -disable-loop-idiom-memset` | 0 |
+
+**而它报不出自己什么都没做。** clang 静默接受 `-fno-builtin-totally_not_a_function`:
+`-fno-builtin-X` 这一族按 clang 的 builtin 表校验,而 `memset_pattern16` 是 LLVM
+TargetLibraryInfo 的 libfunc,不在那张表里;发出调用的是 LoopIdiomRecognize,它查
+TLI,按函数名的属性到不了它。
+
+不选 `-mllvm` 的理由是它传的是 LLVM 内部选项,不是受支持的接口,改名或删除之后这套
+机制会再次静默失效——那正是这次要修的缺陷本身。代价是量出来的:在暴露此事的那个翻译
+单元(libarchive 的 7zip reader,`-O2`,aarch64-macos)上,目标文件从 38200 涨到
+38888 字节,1.8%,因为 `-fno-builtin` 同时撤走了 C 库确实提供的那些 ISO 函数。这比
+`builtins = "iso"` 声明的范围宽,而它宽在安全的方向:代码生成器不合成的调用不会变成
+链接错误。
+
+**这个空操作能活下来,是因为它没有判据。** `cenv` 的探针用 `-dM` dump 校验自己发的
+token,而代码生成阶段的性质在预处理器 dump 里不可见。判据现在在
+`.github/workflows/openkal-cross.yml`,三条腿,跑在三台宿主上:
+
+| 腿 | 内容 | 判据 |
+|---|---|---|
+| 1 | 不带任何 flag 编译探针 | 符号**必须出现**——否则探针已经触发不了惯用法,腿 2、3 什么都没测 |
+| 2 | `-fno-builtin-memset_pattern16` | 符号**仍必须出现**(钉住这个缺陷;若哪天红了,说明 clang 认了窄拼法,`cenv` 可以改回去把这 1.8% 拿回来) |
+| 3 | mcpp 为 `aarch64-macos` 走 openkal 栈构建同一份源码 | 目标文件里**零引用** |
+
+腿 3 的对照:换回旧 token,同一个工程链接失败于
+`ld64.lld: error: undefined symbol: memset_pattern16`。
+
 ### 更正:那个「四个成员」是二,而分组用错了依据
 
 2026.9.21.2 的条目、`cenv.cppm` 与 `predefines.cppm` 的注释、`docs/21` 与 `docs/22`

docs/22-target-side.md

@@ -378,7 +378,7 @@ that names no C library:
 | macOS | `posix` / `arch-default` | one token, `-D__unix__` — Apple's clang predefines `__APPLE__`/`__MACH__` on its default triple, never `__unix__` |
 | freestanding | `posix` / `arch-default` | the same one token, `-D__unix__`, for the same reason: nothing here defines it either |
 | Windows | `posix` / `arch-default` | Cygwin-flavoured: `--target=x86_64-pc-cygwin` on the compile line only; plus `-D__MCPP_TARGET_WINDOWS__` (see the note below); `data-model` becomes LP64 as a consequence of the triple, not a separate flag |
-| any | `builtins = "iso"` | turns off code-generation idioms that assume a platform C library — `-fno-builtin-memset_pattern16` on Apple targets is the one this survey measured; see `src/toolchain/cenv.cppm` for what else was checked and found not to apply |
+| any | `builtins = "iso"` | turns off code-generation idioms that assume a platform C library — `-fno-builtin` on Apple targets, because the per-function spelling was measured to be a silent no-op for the one idiom that matters (`memset_pattern16` is an LLVM TargetLibraryInfo libfunc, not a clang builtin); see `src/toolchain/cenv.cppm` for the A/B and the measured cost |
 | anything else | | refused, naming the target, the request and what is missing — never a silent downgrade |
 
 **The macOS and freestanding rows are a correction, not the design's original

docs/zh/22-target-side.md

@@ -310,7 +310,7 @@ libunwind 的 `assembly.h`,正是按这个宏来选寄存器保存集的)。mcpp
 | macOS | `posix` / `arch-default` | 一个令牌,`-D__unix__`——Apple 的 clang 默认三元组预定义的是 `__APPLE__`/`__MACH__`,从来不是 `__unix__` |
 | 裸机(freestanding) | `posix` / `arch-default` | 同样一个令牌,`-D__unix__`,原因相同:这里同样没有任何东西定义它 |
 | Windows | `posix` / `arch-default` | 采用 Cygwin 式语义:仅在编译行加 `--target=x86_64-pc-cygwin`;并加 `-D__MCPP_TARGET_WINDOWS__`(见下方说明);`data-model` 变为 LP64 是三元组切换的结果,不是另一个开关 |
-| 任意目标 | `builtins = "iso"` | 关闭代码生成阶段假定平台 C 库在场的惯用法识别——本轮实测到的唯一一例是 Apple 目标上的 `-fno-builtin-memset_pattern16`;`src/toolchain/cenv.cppm` 记录了还核实过哪些、结论是不适用 |
+| 任意目标 | `builtins = "iso"` | 关闭代码生成阶段假定平台 C 库在场的惯用法识别——Apple 目标上发 `-fno-builtin`,因为按函数名的那个拼法对唯一重要的那个惯用法实测是**静默空操作**(`memset_pattern16` 是 LLVM TargetLibraryInfo 的 libfunc,不是 clang 的 builtin);A/B 与实测代价见 `src/toolchain/cenv.cppm` |
 | 其余情况 | | 明确拒绝,点名目标、请求与缺什么——不静默降级 |
 
 **macOS 与裸机这两行是一次修正,不是设计原文(协调者修订,2026.9.18.1 发布不到一天就被真实

src/toolchain/cenv.cppm

@@ -558,9 +558,51 @@ inline std::expected<Realisation, std::string> realise(
     // So `iso` realises to one flag, on Apple targets only, and does nothing
     // measurable elsewhere today. That is reported rather than silently
     // accepted: a caller that wants to know what changed reads `builtinsTokens`.
+    // `-fno-builtin`, NOT `-fno-builtin-memset_pattern16`, AND THE NARROWER
+    // SPELLING WAS A SILENT NO-OP.
+    //
+    // The per-function form was emitted here from this mechanism's first
+    // revision, because `memset_pattern16` is the one platform idiom measured
+    // to matter and a targeted flag looks like the smaller instrument. A/B on
+    // the real compile command from a build.ninja, varying only this flag,
+    // says it does nothing:
+    //
+    //     as built (flag present)              1 reference to memset_pattern16
+    //     flag REMOVED                         1 reference
+    //     -fno-builtin                         0
+    //     -mllvm -disable-loop-idiom-memset    0
+    //
+    // AND IT CANNOT REPORT THAT IT DOES NOTHING. clang accepts
+    // `-fno-builtin-totally_not_a_function` in silence: the `-fno-builtin-X`
+    // family is checked against clang's builtin table, and
+    // `memset_pattern16` is an LLVM TargetLibraryInfo libfunc rather than a
+    // clang builtin. The call is produced by LoopIdiomRecognize, which
+    // consults TLI, and the per-function attribute does not reach it.
+    //
+    // WHY THE BLUNT ONE AND NOT `-mllvm`. `-mllvm` passes an internal LLVM
+    // option; it is not a supported interface and can be renamed or removed
+    // between releases, and when it is, this mechanism goes back to failing
+    // silently --- which is exactly the defect being repaired.
+    //
+    // THE COST IS MEASURED RATHER THAN ARGUED: on the translation unit that
+    // surfaced this (libarchive's 7zip reader, `-O2`, aarch64-macos) the
+    // object grows 38200 to 38888 bytes, 1.8 per cent, because `-fno-builtin`
+    // also withdraws the ISO functions the C library does supply. That is
+    // broader than `builtins = "iso"` declares, and it errs in the safe
+    // direction: a call the generator does not synthesise is never a link
+    // error.
+    //
+    // NOTHING HERE IS VERIFIED BY THE PROBE, WHICH IS HOW THE NO-OP SURVIVED.
+    // `expectDefined`/`expectUndefined` are compared against the probe's `-dM`
+    // dump, under this module's own rule that a `-D` which did not take effect
+    // is a verification failure rather than a silent one. A code-generation
+    // property is not visible in a preprocessor dump, so the criterion for
+    // this token lives in `openkal-cross.yml`, which compiles an
+    // idiom-triggering unit for `aarch64-macos` over the openkal stack and
+    // asserts the symbol is absent from the object.
     if (decl.builtins == mcpp::targetside::CAbiBuiltins::Iso) {
         if (!freestanding && (os == "macos" || os == "ios"))
-            r.builtinsTokens.push_back("-fno-builtin-memset_pattern16");
+            r.builtinsTokens.push_back("-fno-builtin");
     }
 
     return r;

tests/unit/test_cenv.cpp

@@ -147,7 +147,14 @@ TEST(CEnv, BuiltinsIsoOnMacosDisablesMemsetPattern16) {
                   ts::CAbiBuiltins::Iso);
     auto r = cenv::realise(d, "macos", "x86_64", false);
     ASSERT_TRUE(r.has_value()) << r.error();
-    EXPECT_TRUE(has(r->builtinsTokens, "-fno-builtin-memset_pattern16"));
+    // `-fno-builtin`, NOT the per-function spelling. The narrower form was
+    // emitted here and measured to do nothing: clang checks `-fno-builtin-X`
+    // against its builtin table, `memset_pattern16` is an LLVM TLI libfunc,
+    // and the call is produced by a pass that consults TLI. clang accepts an
+    // unknown name in that family in silence, so the flag looked right and
+    // was not.
+    EXPECT_TRUE(has(r->builtinsTokens, "-fno-builtin"));
+    EXPECT_FALSE(has(r->builtinsTokens, "-fno-builtin-memset_pattern16"));
 }
 
 TEST(CEnv, BuiltinsIsoOnLinuxAddsNothingMeasurable) {

tests/unit/test_cenv_probe.cpp

@@ -352,11 +352,11 @@ TEST(CenvProbeArgv, AHostedCrossTargetCarriesItsCrossFlag) {
 
 TEST(CenvProbeArgv, BuiltinsTokensAreCarriedLast) {
     auto r = cp::assemble_argv("", {}, {"-D__unix__"},
-                               {"-fno-builtin-memset_pattern16"},
+                               {"-fno-builtin"},
                                false, "x86_64-apple-macos");
     ASSERT_TRUE(r.has_value()) << r.error();
     ASSERT_EQ(r->size(), 2u);
-    EXPECT_EQ((*r)[1], "-fno-builtin-memset_pattern16");
+    EXPECT_EQ((*r)[1], "-fno-builtin");
 }
 
 // ── The argv must select the target (mcpp#674 review, 2026-09-20) ──────────