the chain reaches a consumer, and the review of how it got there

[Sunrisepeak]

Documentation and one new verification section.

Section I

A Linux sandbox cannot exercise a Windows call, so section I asserts the half it can, and the half a four-package chain actually gets wrong: that every version is published, that openkal-llvm-runtime 0.15.1 resolves from the published index, and that the build names openkal-musl@0.19.1. A resolution drawing an older musl would satisfy "it builds and runs" while carrying none of the fix.

It is labelled GRAPH, not CHANGE. A CHANGE section here must fail on the previous mcpp release; this one passes on it, because which graph an index publishes is independent of which engine resolves it. Labelling it CHANGE would have made the control reading against 2026.9.21.2 look like a hole when it is the right answer.

Measured in SubOS v920 with the CN mirror, against published artefacts: nine sections, fails=0, nothing skipped.

The ecosystem review

Written by cross-repository cause rather than by repository:

• Five repositories, six releases, one fix — every pin here is exact, so openkal-windows 0.10.1 needed openkal-musl 0.19.1 and openkal-llvm-runtime 0.15.1 to reach a consumer. Each link was registered, published and verified resolvable before the next pin moved.
• Three unrelated defects reported as one red Windows cell — an engine flag clang silently ignores, a consumer asking Windows for an execute bit, and openkal opening a file without FILE_READ_ATTRIBUTES. Each surfaced only after the previous was fixed. "One red cell, one defect" is a wrong default; the criterion is comparing the failure set before and after.
• What each environment can report — Wine passes the fstat control with the fix removed, so it could never have reported this, and neither could the index's Wine-backed windows column. It was used as a second opinion three times while receiving an input that cannot fail.
• Three defects this round introduced, each with the measurement that caught it and the rule that replaces care with a check: git add -A sweeping an uncommitted pin into a registration PR (55 of 60 cells red, workflow still green); the local GitCode top-up exiting 0 with its only leg skipped; a generated CN url valid in shape and 404 in fact.