fix(runtime, build): the dlopen surface is walked, and one unwinder per process (2026.9.10.1)

[Sunrisepeak]

Closes #596.

A SYCL project built cleanly and terminated with exit code 134 and no exception text. The trigger was in the ecosystem — an adapter's farm was missing one driver library, repaired in openxlings/xim-pkgindex#796 and mcpplibs/mcpp-index#375 — but the reasons it presented as a silent abort are two independent gaps in mcpp.

Design record: .agents/docs/2026-09-09-dlopen-surface-and-two-unwinders.md.

1. The surface nothing walked

resolve_runtime_closure is seeded with the artifact and follows DT_NEEDED. A library a package publishes through runtime.library_dirs exists precisely because something will dlopen it, so no link edge names it: it is outside that closure by construction, not by oversight. Measured — a farm of twenty-five libraries, two of which could not load at all, with no build diagnostic, because nothing had asked.

inspect_dlopen_surface reads each such library's own DT_NEEDED and resolves it against the search path the artifact actually carries:

state	meaning	reported
resolved	nothing to say	no
present as a dangling link	the machine has no such driver	no
absent	packaging gap	warning

Advisory, never blocking: a dangling link is the documented self-heal shape of a host driver that is not installed, and failing there would turn a supported CPU-only configuration into a failed build.

runtime.dlopen_surface in resolution.json carries the findings and both denominators. A surface that failed to build enumerates nothing, and "no findings" must not read like "nothing was examined".

2. Two unwinders in one process

hide_static_cxx_runtime skipped executables on the premise that "an executable's static libstdc++ is already local (ld exports only what a loaded object references, and mcpp passes no -rdynamic)". The premise is correct and the conclusion is not: when a loaded object does reference them, the linker puts them in .dynsym. Measured on the SYCL artifact — 89 exported symbols, 68 also defined by libstdc++ or libgcc_s.

A static archive contributes only the members something references, so the interposition is partial by construction:

libgcc_s _Unwind_* entry points           18
defined by the executable (libunwind.a)   10
still resolved in libgcc_s                 8   incl. _Unwind_GetIPInfo, _Unwind_GetCFA

libstdc++'s __gxx_personality_v0 therefore read an LLVM libunwind _Unwind_Context through libgcc's _Unwind_GetIPInfo, recovered a meaningless IP, found no landing pad, and __cxa_call_terminate ran past a handler three frames up. __verbose_terminate_handler rethrows to name the exception's type; that rethrow terminated too, which is why nothing printed.

Such a link now takes --unwindlib=libgcc and hides the static archives' symbols. libgcc_s is in the process either way — libstdc++ needs it — so this names a library rather than adding one, and the C++ runtime stays embedded. A link with no second runtime on it is byte-for-byte unchanged, asserted in test_distribution.cpp.

Measured on one machine, same source:

	error leg	device leg
before	exit 134, no output	12 24 36 48
after	sycl: no usable device: … / device unavailable, exit 1	12 24 36 48

-Wl,--exclude-libs alone is a regression, not a repair — written here as a prediction from the mechanism and then measured: exit 139 instead of 134. Hiding the exports makes libstdc++ bind to libgcc while the artifact's own libc++abi still calls its statically linked libunwind, so the mismatch reproduces in the other direction. The reason is recorded so the flag is not proposed again.

3. The warning says what it means

The duplicate-symbol check already detected the condition and described the impact as "the library's own copy is never called". For the _Unwind_* family the impact is that exception handling does not work. It now says so, and only when that family is in the conflicting set.

A documented claim, refuted

The SYCL example states that a missing device image is the one failure its island cannot turn into a return code. Compiled for sm_90 and run on an sm_89 device: with two unwinders, terminate called after throwing an instance of 'ur_result_t', exit 134; with one, the island's handler prints the build log and main prints device unavailable, exit 1. It was not outside the catches — no catch worked. The comment and the README are corrected.

Tests

• test_elf_runtime.cpp: three states plus both denominators; and one library counted once when two names link to it.
• test_distribution.cpp: the mechanism table's new cell asserted byte-for-byte, plus the unchanged cells beside it.
• Full unit suite: 108 passed, 0 failed.
• Docs updated in both languages (33-authoring-an-adapter, 42-heterogeneous-builds); style and structure checks pass.