chore(xlings): raise the floor to 2026.8.30.2 — the store-identity fix

openxlings/xlings#576, released as v2026.8.30.2. Below this version xlings
answers "is this package already installed" from the xvm version database keyed
on the bare short name, so a package skips its own `install()` whenever any
other namespace holds the same `<name>@<version>`.

This is a FLOOR and not a preference, which is the whole reason the pin has the
shape it does. The mcpp side of #533 makes the resulting failure legible on any
client — the link unit is refused by name, and `.mcpp_ok` is withheld from a
directory holding nothing the package installed — but only a client at or above
this version INSTALLS correctly.

⚠️ This does NOT authorise an index change. Publishing a deliberately colliding
`<name>@<version>` stays unsafe until the floor is adopted, not merely
released, and .agents/docs/2026-08-30-cross-repo-fix-plan-532-533-534.md §6.2
recommends not doing it at all: the fix is for the collisions people hit by
accident, which is already 20 short names wide on a real store.

`src/xlings/xlings.cppm` is the source of truth; the seven copies under
.github/ follow it and `check_version_pins.sh` enforces the agreement.

Also records what landed against the plan (§12), including two things the plan
had wrong: the xlings anchor was 167 commits stale and the call site had moved,
and `⚠` is CI-governed in xlings while it is merely conventional here.

Author: speak-agent

.agents/docs/2026-08-30-cross-repo-fix-plan-532-533-534.md

@@ -835,3 +835,95 @@ B3 on the produced artifact rather than a log line.
 - The decision to keep `Source` outputs out of `actionDefaults` (§3): reaching
   them two ways is how the soname aliases went missing in 0.0.104.
 - §7's three amendments to #532.
+
+---
+
+## 12. What landed, and what the plan got wrong
+
+Written after implementation, against the code as merged. Everything here was
+measured, not inferred.
+
+### 12.1 Two corrections to the plan itself
+
+**The xlings anchor was 167 commits stale.** §5 located Track X at
+`installer.cpp:903-911` and described `xvm::match_version(db, node.name, …)` as
+a fallback beside a namespace-aware primary path. That reading came from a local
+checkout dated 8 July. Upstream `main` had since consolidated four separate
+"is this installed" answerers into one `install_state` module whose predicate
+takes a namespace — and the defective call site had moved to
+`installer.cpp:2628`, survived the consolidation, and become a **fifth**
+answerer to the question that module exists to answer alone. The fix is
+unchanged in shape and better motivated than the plan knew.
+
+The general rule this is the second instance of: *what the implementation is*
+can only be read from the tracked upstream branch. A worktree at the fetched
+ref costs one command and is the only thing that makes an anchor trustworthy.
+
+**`⚠` is CI-enforced in xlings and merely conventional in mcpp.**
+`tests/e2e/tui_output_contract_test.sh` §S6 greps all of `src/**/*.{cppm,cpp}`
+for U+26A0 and U+24D8 and fails if either appears outside
+`src/core/glyph.cppm` — they are label glyphs the renderer owns, and a second
+spelling is how a dead icon table in `src/platform/` once drifted from the real
+one. Two comment headers turned an otherwise-green xlings PR red (101 passed, 1
+failed) for comment decoration alone. `⭐` is not governed and is already used
+in that tree.
+
+### 12.2 What shipped
+
+| | where | note |
+|---|---|---|
+| A1 | `ninja_backend.cppm` | `cc` unconditional |
+| A2 | `prepare.cppm`, before `return ctx` | after all three object sources |
+| A3 | `check_rule_commands_name_a_program` | exported, so hand-written manifests can test it |
+| B1 | `BuildAction::packageName` | set in `collect()`; `qualified_package_name` exported so the two spellings cannot drift |
+| B2 | per-package phony, 7 call sites | via `order_only_for(cu)` |
+| B3 | `blocking` | reaches the graph for the first time |
+| B4 | `prepare_actions` | placeholder gated on `is_compilable_output` |
+| B5 | `check_action_ordering` | with the denominator |
+| C1 | `payload_is_substantive` | both the write site and the fast path |
+| C2 | `validate.cppm` | gated on the graph containing a module interface |
+| D | `docs/07-build-mcpp.md` + zh | the role table and the engine comment |
+| X | `installer.cpp:2628`, `owner.cppm` | `payload_path_names_another_package` |
+
+### 12.3 The measurement that changed the plan's priorities
+
+§A0 was added mid-review and is the most consequential single fact found:
+
+```
+$ ar rcs libempty.a ; echo $? ; stat -c %s libempty.a
+0
+8
+```
+
+A static library target with no sources built **successfully** — confirmed
+against the released binary, which printed `Finished dev` and left an 8-byte
+`.a`. The reported symptom (`/bin/sh: 1: -shared: not found`) was the loud half
+of a defect whose quiet half reported success. That is why A2 is the fix and A1
+is hygiene, and why the check is at plan time rather than in the linker
+diagnostic.
+
+### 12.4 Evidence that the tests discriminate
+
+Every new e2e was run against the pre-fix binary (`2026.8.28.2`) and every one
+fails there:
+
+```
+314  'PROTO_ANSWER' was not declared in this scope
+315  a failing BLOCKING check did not stop the compile — the object exists
+316  /bin/sh: 1: -shared: not found
+```
+
+The xlings unit tests were checked the other way — by reverting
+`payload_path_names_another_package` to its previous answer and re-running.
+`PayloadOwnership.SameShortNameInAnotherNamespaceIsAnotherPackage` fails.
+
+Neither check is optional here. Three of these tests assert a *negative*
+(nothing was produced, the marker was withheld, the phony is absent), and a
+negative assertion against absent machinery passes by describing nothing.
+
+### 12.5 Unchanged
+
+§1's ordering constraint and §6.2's recommendation not to re-pin the index both
+survived implementation. Track X removes the accidental collision, which is the
+common case; publishing a deliberate one stays gated on the floor being adopted,
+and that gate has no green checkmark.

.github/actions/bootstrap-mcpp/action.yml

@@ -25,7 +25,7 @@ inputs:
     # `package.name`, so one of the two was simply unreachable — and which one
     # depended on the machine, which is why CI failed on `compat:lua` on
     # Windows and `mcpplibs.capi:lua` on Linux. Never pin below that.
-    default: '2026.8.27.5'
+    default: '2026.8.30.2'
   cache-target:
     description: also restore/save target/ (build artifacts + BMIs)
     required: false

.github/actions/setup-macos-llvm/action.yml

@@ -15,7 +15,7 @@ inputs:
     # Floor imposed by the index, not a routine bump — see
     # .github/actions/bootstrap-mcpp/action.yml for why 0.4.69 is required
     # (two packages named `lua` in one repo need openxlings/xlings#381).
-    default: '2026.8.27.5'
+    default: '2026.8.30.2'
 
 runs:
   using: composite

.github/workflows/bootstrap-macos.yml

@@ -17,7 +17,7 @@ jobs:
       # Dormant (workflow_dispatch only), but kept in step with the rest —
       # check_version_pins.sh holds it there. Floor: 0.4.69, below which the
       # index cannot resolve two packages that share a short name.
-      XLINGS_VERSION: '2026.8.27.5'
+      XLINGS_VERSION: '2026.8.30.2'
     steps:
       - uses: actions/checkout@v4
 

.github/workflows/ci-fresh-install.yml

@@ -152,7 +152,7 @@ jobs:
         env:
           XLINGS_NON_INTERACTIVE: '1'
         run: |
-          curl -fsSL https://raw.githubusercontent.com/openxlings/xlings/main/tools/other/quick_install.sh | bash -s v2026.8.27.5
+          curl -fsSL https://raw.githubusercontent.com/openxlings/xlings/main/tools/other/quick_install.sh | bash -s v2026.8.30.2
           echo "$HOME/.xlings/subos/current/bin" >> "$GITHUB_PATH"
 
       - name: Install mcpp and config mirror
@@ -293,7 +293,7 @@ jobs:
 
       - name: Install xlings + mcpp
         run: |
-          curl -fsSL https://raw.githubusercontent.com/openxlings/xlings/main/tools/other/quick_install.sh | bash -s v2026.8.27.5
+          curl -fsSL https://raw.githubusercontent.com/openxlings/xlings/main/tools/other/quick_install.sh | bash -s v2026.8.30.2
           # Deliberately NOT writing to $GITHUB_PATH here. On container
           # images that declare no PATH in their config (opensuse/
           # tumbleweed), appending a single dir to GITHUB_PATH makes the
@@ -364,7 +364,7 @@ jobs:
           #             (older ones carry minos=15 and refuse to start).
           #   v0.4.51+: in-process sha256 — this image has no sha256sum
           #             binary, so pinned fetches failed before it.
-          curl -fsSL https://raw.githubusercontent.com/openxlings/xlings/main/tools/other/quick_install.sh | bash -s v2026.8.27.5
+          curl -fsSL https://raw.githubusercontent.com/openxlings/xlings/main/tools/other/quick_install.sh | bash -s v2026.8.30.2
           echo "$HOME/.xlings/subos/current/bin" >> "$GITHUB_PATH"
 
       - name: Install mcpp and config mirror

.github/workflows/ci-linux-e2e.yml

@@ -237,7 +237,7 @@ jobs:
 
       - name: Bootstrap xlings + released mcpp
         run: |
-          curl -fsSL https://raw.githubusercontent.com/openxlings/xlings/main/tools/other/quick_install.sh | bash -s v2026.8.27.5
+          curl -fsSL https://raw.githubusercontent.com/openxlings/xlings/main/tools/other/quick_install.sh | bash -s v2026.8.30.2
           export PATH="$HOME/.xlings/subos/current/bin:$PATH"
           xlings update
           xlings install mcpp -y -g

.github/workflows/cross-build-test.yml

@@ -122,7 +122,7 @@ jobs:
           # release assets were uploaded in a broken state (records present,
           # blobs missing → 404 on GET); re-uploaded clean. The stale-INDEX
           # half is handled by the marker-clear below.
-          XLINGS_VERSION: '2026.8.27.5'
+          XLINGS_VERSION: '2026.8.30.2'
         run: |
           tarball="xlings-${XLINGS_VERSION}-linux-x86_64.tar.gz"
           bash "$GITHUB_WORKSPACE/.github/tools/fetch_release.sh" \
@@ -263,7 +263,7 @@ jobs:
       - name: Bootstrap mcpp via xlings
         env:
           XLINGS_NON_INTERACTIVE: '1'
-          XLINGS_VERSION: '2026.8.27.5'
+          XLINGS_VERSION: '2026.8.30.2'
         run: |
           tarball="xlings-${XLINGS_VERSION}-linux-x86_64.tar.gz"
           bash "$GITHUB_WORKSPACE/.github/tools/fetch_release.sh" \

.github/workflows/release.yml

@@ -96,7 +96,7 @@ jobs:
           # Pin xlings to a known-good version. The upstream install
           # script always grabs `latest` (no version override), so we
           # download + self-install manually to avoid broken releases.
-          XLINGS_VERSION: '2026.8.27.5'
+          XLINGS_VERSION: '2026.8.30.2'
         run: |
           if [ ! -x "$HOME/.xlings/subos/default/bin/xlings" ]; then
             tarball="xlings-${XLINGS_VERSION}-linux-x86_64.tar.gz"
@@ -289,7 +289,7 @@ jobs:
       - name: Bootstrap mcpp via xlings
         env:
           XLINGS_NON_INTERACTIVE: '1'
-          XLINGS_VERSION: '2026.8.27.5'
+          XLINGS_VERSION: '2026.8.30.2'
         run: |
           tarball="xlings-${XLINGS_VERSION}-linux-x86_64.tar.gz"
           bash "$GITHUB_WORKSPACE/.github/tools/fetch_release.sh" \
@@ -360,7 +360,7 @@ jobs:
           # below are pinned to the same version as XLINGS_VERSION; they are
           # NOT interpolated from it, so check_version_pins.sh scans for them
           # explicitly (they were absent from the old lock-step comment).
-          XLA="xlings-2026.8.27.5-linux-aarch64.tar.gz"
+          XLA="xlings-2026.8.30.2-linux-aarch64.tar.gz"
           # NOT fetch_release.sh: this asset is OPTIONAL and the `if` is the
           # point — an arch with no prebuilt xlings must fall through quietly,
           # while the helper retries a 404 five times before giving up. The one
@@ -369,9 +369,9 @@ jobs:
           # cover it.
           if curl -fsSL --retry 3 --retry-delay 2 --retry-all-errors \
                --connect-timeout 20 --max-time 600 -o "/tmp/$XLA" \
-               "https://github.com/openxlings/xlings/releases/download/v2026.8.27.5/$XLA"; then
+               "https://github.com/openxlings/xlings/releases/download/v2026.8.30.2/$XLA"; then
             tar -xzf "/tmp/$XLA" -C /tmp
-            XLBIN=$(find /tmp/xlings-2026.8.27.5-linux-aarch64 -path '*/bin/xlings' -type f | head -1)
+            XLBIN=$(find /tmp/xlings-2026.8.30.2-linux-aarch64 -path '*/bin/xlings' -type f | head -1)
             if [ -n "$XLBIN" ]; then
               mkdir -p "$STAGING/$WRAPPER/registry/bin"
               cp "$XLBIN" "$STAGING/$WRAPPER/registry/bin/xlings"
@@ -449,7 +449,7 @@ jobs:
       - name: Bootstrap mcpp via xlings
         env:
           XLINGS_NON_INTERACTIVE: '1'
-          XLINGS_VERSION: '2026.8.27.5'
+          XLINGS_VERSION: '2026.8.30.2'
         run: |
           if [ ! -x "$HOME/.xlings/subos/default/bin/xlings" ]; then
             WORK=$(mktemp -d)
@@ -632,7 +632,7 @@ jobs:
         shell: bash
         env:
           XLINGS_NON_INTERACTIVE: '1'
-          XLINGS_VERSION: '2026.8.27.5'
+          XLINGS_VERSION: '2026.8.30.2'
         run: |
           # Captured before the `cd` below, in POSIX form: this step never
           # returns to the workspace, and GITHUB_WORKSPACE is a backslash

src/xlings/xlings.cppm

@@ -46,10 +46,13 @@ namespace pinned {
     // actions, which is how CI's sandbox sat on 0.4.30 unnoticed while
     // everything else had moved on. Don't reintroduce a hand-maintained list.
     //
-    // ⚠️ 2026.8.27.5 is a FLOOR, not just the current pick. Below 2026.8.27.2
-    // the bundled xlings takes a subos's runtime binding from a compiled-in
-    // constant, so a home can declare one glibc and install another the
-    // moment the index publishes a packaging revision -- and mcpp is the
+    // ⚠️ THIS IS A FLOOR, not just the current pick, and it has been raised
+    // twice for reasons that both still hold.
+    //
+    // First, at 2026.8.27.5. Below 2026.8.27.2 the bundled xlings takes a
+    // subos's runtime binding from a compiled-in constant, so a home can
+    // declare one glibc and install another the moment the index publishes a
+    // packaging revision -- and mcpp is the
     // party that notices, because select_glibc_payload_lib looks up the
     // payload directory by the binding's exact version and refuses to fall
     // back:
@@ -62,7 +65,24 @@ namespace pinned {
     // 2026.8.27.4 and .5, which read the index, stayed consistent. .5 also
     // makes the declaration outrank the index during resolution, so it holds
     // even when `latest` is not the highest entry in the table.
-    inline constexpr std::string_view kXlingsVersion   = "2026.8.27.5";
+    //
+    // Second, at 2026.8.30.2 (mcpp#533). Below it, xlings answered "is this
+    // package already installed" from the xvm version database keyed on the
+    // BARE SHORT NAME, so a package skipped its own `install()` whenever any
+    // other namespace held the same `<name>@<version>` —
+    // `compat:libdrm@2.4.123` against the
+    // `xim:libdrm@2.4.123` that Mesa pulls in. The descriptor's tree was never
+    // built, and mcpp is again the party that notices, four layers later:
+    //
+    //   /bin/sh: 1: -shared: not found
+    //
+    // mcpp now refuses that link unit by name and withholds `.mcpp_ok` from a
+    // directory holding nothing the package installed, so the failure is
+    // legible on any client. Only a client at or above this floor INSTALLS
+    // correctly — which is why this is a floor and not a preference, and why
+    // an index must still not publish a deliberately colliding
+    // `<name>@<version>` (see .agents/docs/2026-08-30-cross-repo-fix-plan §1).
+    inline constexpr std::string_view kXlingsVersion   = "2026.8.30.2";
     inline constexpr std::string_view kNasmVersion     = "3.02";
 }