chore(xlings): pin 2026.8.17.2 → 2026.8.27.1,索引已经在等这个客户端

⚠️⚠️ 这是那条 `glibc@2.44 ... not installed` 的**主因**,而它在索引里被逐字
预告过。`xim-pkgindex` 的 `pkgs/g/glibc.lua` 记着一对提交:

    fb289b8  glibc: withdraw 2.44.2 until the client that can resolve it ships
    557e862  glibc: restore 2.44.2 now that the client resolving it has shipped

以及那次失败的原文:

    -- released xlings pinned `glibc@2.44`, payload directories are named
    -- after the version, and so a clean environment installed 2.44.2 and
    -- then found nothing answering to the binding
    --   error: selected RuntimeBinding glibc@2.44 requires payload
    --          '<home>/.../xpkgs/xim-x-glibc/2.44', but it is not installed
    -- on every NEW environment and on none that already existed.
    -- The index is DATA and the client is a PROGRAM: the consumer ships first.

⭐ 那个消费者是 **xlings 2026.8.27.1**(openxlings/xlings#567):它改为从索引文件
读默认 runtime binding,而不是读一个编译进客户端的常量。mcpp 钉的还是 8.17.2,
所以每一台冷缓存的 CI 机器都停在上面 —— **在 main 上和在任何分支上一样**。

## ⭐ 与前一条提交的关系(两条,不是一条的两半)

| | 覆盖谁 |
|---|---|
| 本条(pin) | **新环境**:xlings 从索引读绑定,直接绑到 2.44.2 |
| 前一条(`select_glibc_payload_lib`) | **已存在的环境升级**:subos 记下的绑定还是 `2.44`,而载荷已经是 `2.44.2`,且 SubOS 视图尚未建立 —— `runtime_binding.cppm:224` 早一个版本就记过这个形状 |

两者在不同的层,谁也替代不了谁;去掉后者,一台已经跑过一次的机器在升级后仍会停住。

## 判据

`.github/tools/check_version_pins.sh` 是这件事的唯一真源检查器,它一次列出了
全部 7 个不同步的点(3 个 workflow + 2 个 composite action + 2 个 release 段),
同步后退出码 0。**这正是它存在的理由** —— 注释里说过,手工维护的清单曾漏掉
两个 composite action,让 CI 的沙箱在 0.4.30 上停了很久没人发现。

Author: speak-agent

.github/actions/bootstrap-mcpp/action.yml

@@ -25,7 +25,7 @@ inputs:
     # `package.name`, so one of the two was simply unreachable — and which one
     # depended on the machine, which is why CI failed on `compat:lua` on
     # Windows and `mcpplibs.capi:lua` on Linux. Never pin below that.
-    default: '2026.8.17.2'
+    default: '2026.8.27.1'
   cache-target:
     description: also restore/save target/ (build artifacts + BMIs)
     required: false
@@ -49,7 +49,7 @@ runs:
         # `ubuntu-24.04-arm` restored what `ubuntu-24.04` had stored. Measured
         # the first time this repo scheduled an arm Linux runner:
         #
-        #     Cache hit for: xlings-Linux-v2-xl2026.8.17.2-…
+        #     Cache hit for: xlings-Linux-v2-xl2026.8.27.1-…
         #     …/bin/xlings: cannot execute binary file: Exec format error
         #
         # ⭐ AND IT SURVIVED THE FIX ONE LAYER DOWN. Reading `uname -m` to pick
@@ -93,7 +93,7 @@ runs:
         # invisible until a Linux runner is not x86_64. Measured on
         # `ubuntu-24.04-arm`, the first time this repo scheduled one:
         #
-        #     .../xlings-2026.8.17.2-linux-x86_64/subos/default/bin/xlings:
+        #     .../xlings-2026.8.27.1-linux-x86_64/subos/default/bin/xlings:
         #       cannot execute binary file: Exec format error
         #     Process completed with exit code 126
         #
@@ -118,7 +118,7 @@ runs:
           "${WORK}/${tarball}"
         tar -xzf "${WORK}/${tarball}" -C "${WORK}"
         # ⚠️⚠️ THE TWO LINUX TARBALLS DO NOT HAVE THE SAME SHAPE, and this line
-        # named one of them. Measured on the 2026.8.17.2 assets:
+        # named one of them. Measured on the 2026.8.27.1 assets:
         #
         #   linux-x86_64   → subos/default/bin/xlings   (513 entries)
         #   linux-aarch64  → bin/xlings                 (494 entries)

.github/actions/setup-macos-llvm/action.yml

@@ -15,7 +15,7 @@ inputs:
     # Floor imposed by the index, not a routine bump — see
     # .github/actions/bootstrap-mcpp/action.yml for why 0.4.69 is required
     # (two packages named `lua` in one repo need openxlings/xlings#381).
-    default: '2026.8.17.2'
+    default: '2026.8.27.1'
 
 runs:
   using: composite

.github/workflows/bootstrap-macos.yml

@@ -17,7 +17,7 @@ jobs:
       # Dormant (workflow_dispatch only), but kept in step with the rest —
       # check_version_pins.sh holds it there. Floor: 0.4.69, below which the
       # index cannot resolve two packages that share a short name.
-      XLINGS_VERSION: '2026.8.17.2'
+      XLINGS_VERSION: '2026.8.27.1'
     steps:
       - uses: actions/checkout@v4
 

.github/workflows/ci-fresh-install.yml

@@ -152,7 +152,7 @@ jobs:
         env:
           XLINGS_NON_INTERACTIVE: '1'
         run: |
-          curl -fsSL https://raw.githubusercontent.com/openxlings/xlings/main/tools/other/quick_install.sh | bash -s v2026.8.17.2
+          curl -fsSL https://raw.githubusercontent.com/openxlings/xlings/main/tools/other/quick_install.sh | bash -s v2026.8.27.1
           echo "$HOME/.xlings/subos/current/bin" >> "$GITHUB_PATH"
 
       - name: Install mcpp and config mirror
@@ -293,7 +293,7 @@ jobs:
 
       - name: Install xlings + mcpp
         run: |
-          curl -fsSL https://raw.githubusercontent.com/openxlings/xlings/main/tools/other/quick_install.sh | bash -s v2026.8.17.2
+          curl -fsSL https://raw.githubusercontent.com/openxlings/xlings/main/tools/other/quick_install.sh | bash -s v2026.8.27.1
           # Deliberately NOT writing to $GITHUB_PATH here. On container
           # images that declare no PATH in their config (opensuse/
           # tumbleweed), appending a single dir to GITHUB_PATH makes the
@@ -364,7 +364,7 @@ jobs:
           #             (older ones carry minos=15 and refuse to start).
           #   v0.4.51+: in-process sha256 — this image has no sha256sum
           #             binary, so pinned fetches failed before it.
-          curl -fsSL https://raw.githubusercontent.com/openxlings/xlings/main/tools/other/quick_install.sh | bash -s v2026.8.17.2
+          curl -fsSL https://raw.githubusercontent.com/openxlings/xlings/main/tools/other/quick_install.sh | bash -s v2026.8.27.1
           echo "$HOME/.xlings/subos/current/bin" >> "$GITHUB_PATH"
 
       - name: Install mcpp and config mirror

.github/workflows/ci-linux-e2e.yml

@@ -237,7 +237,7 @@ jobs:
 
       - name: Bootstrap xlings + released mcpp
         run: |
-          curl -fsSL https://raw.githubusercontent.com/openxlings/xlings/main/tools/other/quick_install.sh | bash -s v2026.8.17.2
+          curl -fsSL https://raw.githubusercontent.com/openxlings/xlings/main/tools/other/quick_install.sh | bash -s v2026.8.27.1
           export PATH="$HOME/.xlings/subos/current/bin:$PATH"
           xlings update
           xlings install mcpp -y -g

.github/workflows/cross-build-test.yml

@@ -122,7 +122,7 @@ jobs:
           # release assets were uploaded in a broken state (records present,
           # blobs missing → 404 on GET); re-uploaded clean. The stale-INDEX
           # half is handled by the marker-clear below.
-          XLINGS_VERSION: '2026.8.17.2'
+          XLINGS_VERSION: '2026.8.27.1'
         run: |
           tarball="xlings-${XLINGS_VERSION}-linux-x86_64.tar.gz"
           bash "$GITHUB_WORKSPACE/.github/tools/fetch_release.sh" \
@@ -263,7 +263,7 @@ jobs:
       - name: Bootstrap mcpp via xlings
         env:
           XLINGS_NON_INTERACTIVE: '1'
-          XLINGS_VERSION: '2026.8.17.2'
+          XLINGS_VERSION: '2026.8.27.1'
         run: |
           tarball="xlings-${XLINGS_VERSION}-linux-x86_64.tar.gz"
           bash "$GITHUB_WORKSPACE/.github/tools/fetch_release.sh" \

.github/workflows/release.yml

@@ -96,7 +96,7 @@ jobs:
           # Pin xlings to a known-good version. The upstream install
           # script always grabs `latest` (no version override), so we
           # download + self-install manually to avoid broken releases.
-          XLINGS_VERSION: '2026.8.17.2'
+          XLINGS_VERSION: '2026.8.27.1'
         run: |
           if [ ! -x "$HOME/.xlings/subos/default/bin/xlings" ]; then
             tarball="xlings-${XLINGS_VERSION}-linux-x86_64.tar.gz"
@@ -289,7 +289,7 @@ jobs:
       - name: Bootstrap mcpp via xlings
         env:
           XLINGS_NON_INTERACTIVE: '1'
-          XLINGS_VERSION: '2026.8.17.2'
+          XLINGS_VERSION: '2026.8.27.1'
         run: |
           tarball="xlings-${XLINGS_VERSION}-linux-x86_64.tar.gz"
           bash "$GITHUB_WORKSPACE/.github/tools/fetch_release.sh" \
@@ -360,7 +360,7 @@ jobs:
           # below are pinned to the same version as XLINGS_VERSION; they are
           # NOT interpolated from it, so check_version_pins.sh scans for them
           # explicitly (they were absent from the old lock-step comment).
-          XLA="xlings-2026.8.17.2-linux-aarch64.tar.gz"
+          XLA="xlings-2026.8.27.1-linux-aarch64.tar.gz"
           # NOT fetch_release.sh: this asset is OPTIONAL and the `if` is the
           # point — an arch with no prebuilt xlings must fall through quietly,
           # while the helper retries a 404 five times before giving up. The one
@@ -369,9 +369,9 @@ jobs:
           # cover it.
           if curl -fsSL --retry 3 --retry-delay 2 --retry-all-errors \
                --connect-timeout 20 --max-time 600 -o "/tmp/$XLA" \
-               "https://github.com/openxlings/xlings/releases/download/v2026.8.17.2/$XLA"; then
+               "https://github.com/openxlings/xlings/releases/download/v2026.8.27.1/$XLA"; then
             tar -xzf "/tmp/$XLA" -C /tmp
-            XLBIN=$(find /tmp/xlings-2026.8.17.2-linux-aarch64 -path '*/bin/xlings' -type f | head -1)
+            XLBIN=$(find /tmp/xlings-2026.8.27.1-linux-aarch64 -path '*/bin/xlings' -type f | head -1)
             if [ -n "$XLBIN" ]; then
               mkdir -p "$STAGING/$WRAPPER/registry/bin"
               cp "$XLBIN" "$STAGING/$WRAPPER/registry/bin/xlings"
@@ -449,7 +449,7 @@ jobs:
       - name: Bootstrap mcpp via xlings
         env:
           XLINGS_NON_INTERACTIVE: '1'
-          XLINGS_VERSION: '2026.8.17.2'
+          XLINGS_VERSION: '2026.8.27.1'
         run: |
           if [ ! -x "$HOME/.xlings/subos/default/bin/xlings" ]; then
             WORK=$(mktemp -d)
@@ -632,7 +632,7 @@ jobs:
         shell: bash
         env:
           XLINGS_NON_INTERACTIVE: '1'
-          XLINGS_VERSION: '2026.8.17.2'
+          XLINGS_VERSION: '2026.8.27.1'
         run: |
           # Captured before the `cd` below, in POSIX form: this step never
           # returns to the workspace, and GITHUB_WORKSPACE is a backslash

src/platform/xlings/xlings.cppm

@@ -45,7 +45,7 @@ namespace pinned {
     // in lock-step by hand; that list was already missing both composite
     // actions, which is how CI's sandbox sat on 0.4.30 unnoticed while
     // everything else had moved on. Don't reintroduce a hand-maintained list.
-    inline constexpr std::string_view kXlingsVersion   = "2026.8.17.2";
+    inline constexpr std::string_view kXlingsVersion   = "2026.8.27.1";
     inline constexpr std::string_view kNasmVersion     = "3.02";
 }