test: 两个键会在同一个包里相遇,而没有任何判据覆盖这件事

## e2e 304:提供层的包同时带私有目录

`openkal-musl` 就是这个形状 —— `provides = ["mcpp:c-abi=musl"]` **加上**内部头
覆盖层。层的目录到达**每一个**单元,所以在这里误发布覆盖层比在别处都宽:musl 的
`hidden`/`weak` 宏不只落到它的消费者,而是落到整个构建的每一个翻译单元。

两者按构造是相容的(目标侧取的是提供者的 `publicUsage`,而那已经是过滤后的集合)
—— 「按构造」正是需要一条断言的地方。反向对照实测:把 fixture 里的
`private_include_dirs` 拿掉,判据当场检出

    /tmp/.../dep/src/sibling.cppm      ← 兄弟依赖包
    /tmp/.../src/main.cpp              ← 根

也就是把那句「爆炸半径」从注释变成了读数。⭐ 另加控制:提供者自己的单元必须仍然
带着它,否则「没泄漏」和「整个丢掉了」同读数。

## e2e 305:glob 在展开之后比对

文档承诺「条目支持 `*` glob 并在展开之后比对」,而没有判据。加 `gen/*` 两条边:
提供者两个目录都要有,消费者一个都不能有。⭐ 判据落到 `gen/one`/`gen/two` **按名**
而不是 `gen`—— 只查 `gen` 的话,一个拿未展开拼写去比的实现照样通过。

反向对照实测:把 glob 从 private 列表里拿掉,两条都变红并各自点名。

Author: speak-agent

tests/e2e/304_the_target_side_reaches_every_unit.sh

@@ -35,20 +35,35 @@ work="$(mktemp -d)"
 trap 'rm -rf "$work"' EXIT
 cd "$work"
 
-mkdir -p src abi/src abi/abi-include dep/src dep/dep-include
+mkdir -p src abi/src abi/abi-include abi/abi-internal dep/src dep/dep-include
 
-# The provider: supplies a target-side layer and publishes one directory.
+# The provider: supplies a target-side layer, publishes one directory, and
+# keeps one to itself.
+#
+# ⭐⭐ THE TWO KEYS OF THIS RELEASE MEET IN THIS ONE PACKAGE, AND THAT IS THE
+# REAL-WORLD SHAPE. `openkal-musl` declares `provides = ["mcpp:c-abi=musl"]`
+# AND carries an internal header overlay. A layer's directories reach EVERY
+# unit, so publishing the overlay by mistake would put musl's `hidden`/`weak`
+# macros not merely on its consumers but on every translation unit of the
+# build — a strictly wider blast radius than the leak `private_include_dirs`
+# was written for.
+#
+# The two compose correctly by construction (the target side is assembled from
+# the provider's `publicUsage`, which is the filtered set), and "by
+# construction" is what an assertion is for.
 cat > abi/mcpp.toml <<'EOF'
 [package]
 name    = "abiprov"
 version = "0.1.0"
 provides = ["mcpp:c++-abi=libc++"]
 
 [build]
-include_dirs = ["abi-include"]
+include_dirs         = ["abi-internal", "abi-include"]
+private_include_dirs = ["abi-internal"]
 EOF
 printf 'export module abiprov;\nexport int abiprov_v() { return 1; }\n' > abi/src/abiprov.cppm
 printf '#pragma once\n' > abi/abi-include/marker.h
+printf '#pragma once\n' > abi/abi-internal/private.h
 
 # The sibling: a dependency package that does NOT depend on the provider.
 cat > dep/mcpp.toml <<'EOF'
@@ -125,4 +140,36 @@ if [ -n "$leaked" ]; then
     exit 1
 fi
 
-echo "OK: the graph-supplied target side reaches every unit ($siblings sibling units), and nothing else does"
+# ⭐⭐ AND THE LAYER'S *PRIVATE* DIRECTORY REACHES NOBODY BUT ITSELF.
+#
+# A layer reaches every unit, so publishing an internal overlay by mistake is
+# wider here than anywhere else: it would land on every translation unit of the
+# build rather than on the provider's consumers.
+private_leak="$(jq -r '
+  [ .[]
+    | select((.file | test("/abi/src/")) | not)
+    | { f: .file, has: ((.arguments // (.command | split(" "))) | map(test("abi-internal")) | any) }
+    | select(.has)
+    | .f
+  ] | .[]' compile_commands.json)"
+
+if [ -n "$private_leak" ]; then
+    echo "FAIL: the layer's PRIVATE directory reached units outside the package:"
+    printf '%s\n' "$private_leak" | sed 's/^/        /'
+    exit 1
+fi
+
+# The control: private is not the same as dropped. The provider's own units
+# must still be built with it, or the assertion above passes for a build that
+# simply lost the directory.
+own_private="$(jq -r '
+  [ .[]
+    | select(.file | test("/abi/src/"))
+    | select((.arguments // (.command | split(" "))) | map(test("abi-internal")) | any)
+  ] | length' compile_commands.json)"
+if [ "$own_private" -lt 1 ]; then
+    echo "FAIL: the provider lost its own private directory — the check above proves nothing"
+    exit 1
+fi
+
+echo "OK: the graph-supplied target side reaches every unit ($siblings sibling units), its private directory reaches only its own $own_private unit(s), and nothing else spreads"

tests/e2e/305_built_from_is_not_published.sh

@@ -31,7 +31,7 @@ work="$(mktemp -d)"
 trap 'rm -rf "$work"' EXIT
 cd "$work"
 
-mkdir -p src lib/src lib/pub lib/internal
+mkdir -p src lib/src lib/pub lib/internal lib/gen/one lib/gen/two
 
 cat > lib/mcpp.toml <<'EOF'
 [package]
@@ -43,14 +43,21 @@ version = "0.1.0"
 # this list rather than a second list: the internal overlay must precede the
 # public headers for the package's OWN build, and two TOML arrays cannot
 # express one order.
-include_dirs         = ["internal", "pub"]
-private_include_dirs = ["internal"]
+#
+# ⭐ `gen/*` IS A GLOB ON BOTH LINES. The filter is applied AFTER expansion, so
+# the glob withholds exactly the directories it expands to. Comparing the
+# unexpanded spellings would be the obvious implementation and would publish
+# every one of them, because `gen/*` is not literally equal to `gen/one`.
+include_dirs         = ["internal", "gen/*", "pub"]
+private_include_dirs = ["internal", "gen/*"]
 EOF
 printf 'export module vendored;\nexport int vendored_v() { return 7; }\n' > lib/src/vendored.cppm
 printf '#pragma once\n#define VENDORED_PUBLIC 1\n' > lib/pub/pub.h
 # The internal overlay: a macro that is meaningful to the package and a
 # perfectly ordinary identifier to everyone else.
 printf '#pragma once\n#define hidden __attribute__((visibility("hidden")))\n' > lib/internal/overlay.h
+printf '#pragma once\n' > lib/gen/one/one.h
+printf '#pragma once\n' > lib/gen/two/two.h
 
 cat > mcpp.toml <<'EOF'
 [package]
@@ -107,5 +114,16 @@ fail=0
 [ "$(has_dir '/src/main' '/lib/internal')" = false ] || {
     echo "FAIL: the private directory leaked to the consumer"; fail=1; }
 
+# ⭐ AND THE GLOB WITHHOLDS WHAT IT EXPANDS TO — both directories, by name.
+# Checking `gen` alone would pass for an implementation that matched the
+# unexpanded spelling and published `gen/one` and `gen/two` anyway.
+for g in one two; do
+    [ "$(has_dir '/lib/src/' "/lib/gen/$g")" = true ] || {
+        echo "FAIL: the provider lost 'gen/$g', which its own glob names"; fail=1; }
+    [ "$(has_dir '/src/main' "/lib/gen/$g")" = false ] || {
+        echo "FAIL: 'gen/$g' leaked to the consumer — the glob was compared unexpanded"
+        fail=1; }
+done
+
 [ "$fail" = 0 ] || exit 1
-echo "OK: built-from and published are separable (provider=$prov consumer=$cons rows)"
+echo "OK: built-from and published are separable, globs included (provider=$prov consumer=$cons rows)"