docs(libgbm): why the xlings pin stays at 2026.8.27.5

The task asked to pin the internal xlings dependency to 2026.8.27.4 'which
should be released by then'. Checked, and the premise is inverted: .4 is an
OLDER already-published release (2026-08-27T10:18) while .5 is Latest
(13:29, 8 assets), and every pin is already on .5 --
check_version_pins.sh reports 'OK: xlings pins all at 2026.8.27.5', and
xim-pkgindex's xlings.lua already has latest = 2026.8.27.5. mcpp-index pins
mcpp, not xlings. So the intent -- pin to a released xlings -- is already
satisfied, and better.

Downgrading would also drop a property the source documents: .5 makes the
declaration outrank the index during resolution, so it holds even when
 is not the highest entry in the table; .4 does not. kXlingsVersion
is the single source of truth for every pin under .github/, so the change
would touch release/CI/bootstrap in a dozen places.

The local warning that probably prompted this ('vendored xlings 2026.8.27.4
is older than the pinned 2026.8.27.5') is about the copy bundled into the
mcpp release tarball, not about .5 being unavailable -- and it names its own
fix, [xlings] updating package index...
[xlings] [index] fetching package index (mirror=CN)...
[xlings] [index] updated from artifact xim-index-92660f5.tar.gz (92660f5)
[xlings] [index] fetching sub-index 'awesome' (mirror=CN)...
[xlings] [index] updated from artifact xim-index-awesome-2026.8.27.5.tar.gz (2026.8.27.5)
[xlings] [index] fetching sub-index 'scode' (mirror=CN)...
[xlings] [index] updated from artifact xim-index-scode-2026.8.27.5.tar.gz (2026.8.27.5)
[xlings] [index] fetching sub-index 'd2x' (mirror=CN)...
[xlings] [index] updated from artifact xim-index-d2x-2026.8.27.5.tar.gz (2026.8.27.5)

[1/7] awesome::xim.lua�[K
[2/7] awesome::template.lua�[K
[3/7] awesome::fromsource.lua�[K
[4/7] awesome::awesome.lua�[K
[5/7] awesome::dragonos.lua�[K
[6/7] awesome::d2x.lua�[K
[7/7] awesome::scode.lua�[K

[1/6] d2x::mcpp-standard.lua�[K
[2/6] d2x::mcpp-start.lua�[K
[3/6] d2x::d2ds.lua�[K
[4/6] d2x::d2mystl.lua�[K
[5/6] d2x::d2mcpp.lua�[K
[6/6] d2x::project-template.lua�[K

[1/15] scode::libffi.lua�[K
[2/15] scode::linux-headers.lua�[K
[3/15] scode::libnsl.lua�[K
[4/15] scode::linux.lua�[K
[5/15] scode::xz-utils.lua�[K
[6/15] scode::zlib.lua�[K
[7/15] scode::gdbm.lua�[K
[8/15] scode::bzip2.lua�[K
[9/15] scode::ncurses.lua�[K
[10/15] scode::automake.lua�[K
[11/15] scode::readline.lua�[K
[12/15] scode::openssl.lua�[K
[13/15] scode::util-linux.lua�[K
[14/15] scode::sqlite.lua�[K
[15/15] scode::pango.lua�[K

[1/119] dsh::quantum-practices.lua�[K
[2/119] dsh::telegram.lua�[K
[3/119] dsh::gal-view.lua�[K
[4/119] dsh::group-web-essentials.lua�[K
[5/119] dsh::freestyle-dsh-theme.lua�[K
[6/119] dsh::forkprobe.lua�[K
[7/119] dsh::fabric.lua�[K
[8/119] dsh::mnemon.lua�[K
[9/119] dsh::modsearch.lua�[K
[10/119] dsh::modlens.lua�[K
[11/119] dsh::nowledge-mem-deepseek-harness.lua�[K
[12/119] dsh::agent-tui-coding.lua�[K
[13/119] dsh::arch-doc.lua�[K
[14/119] dsh::anysearch-dsh.lua�[K
[15/119] dsh::aegis.lua�[K
[16/119] dsh::agent-web-coding.lua�[K
[17/119] dsh::dsh-acp-for-bitfun.lua�[K
[18/119] dsh::dsh-plugin-workshop.lua�[K
[19/119] dsh::dsh-web-plugin-manager.lua�[K
[20/119] dsh::dsh-plugin-yet-another-subagent.lua�[K
[21/119] dsh::dsh-mnemon.lua�[K
[22/119] dsh::dsh-mac-desktop.lua�[K
[23/119] dsh::dsh-openai-codex-auth.lua�[K
[24/119] dsh::dsh-git-identity.lua�[K
[25/119] dsh::dsh-better-browser.lua�[K
[26/119] dsh::dsh-deep-research.lua�[K
[27/119] dsh::deepseek-manners.lua�[K
[28/119] dsh::dsh-file-explorer.lua�[K
[29/119] dsh::dsh-tianshu-tui.lua�[K
[30/119] dsh::dsh-chat-import.lua�[K
[31/119] dsh::dsh-plugin-template.lua�[K
[32/119] dsh::dsh-share.lua�[K
[33/119] dsh::dsh-sentinel.lua�[K
[34/119] dsh::dsh-ads.lua�[K
[35/119] dsh::dsh-market.lua�[K
[36/119] dsh::dsh-annotation.lua�[K
[37/119] dsh::dsh-recommend.lua�[K
[38/119] dsh::dsh-overdrive.lua�[K
[39/119] dsh::dsh-lark.lua�[K
[40/119] dsh::dsh-auto-continue.lua�[K
[41/119] dsh::dsh-custom-tool.lua�[K
[42/119] dsh::dsh-task-status.lua�[K
[43/119] dsh::dsh-context-doctor.lua�[K
[44/119] dsh::dsh-skin.lua�[K
[45/119] dsh::dsh-stock-market.lua�[K
[46/119] dsh::dsh-message-edit.lua�[K
[47/119] dsh::dsh-data-insight.lua�[K
[48/119] dsh::dskin.lua�[K
[49/119] dsh::dsh-openapi.lua�[K
[50/119] dsh::dsh-plannotator.lua�[K
[51/119] dsh::dsh-automation.lua�[K
[52/119] dsh::dsh-plugin-ya-workspace-sidebar.lua�[K
[53/119] dsh::dsh-plugin-better-sidebar-plugin-office.lua�[K
[54/119] dsh::dsh-plugin-opencode-bridge.lua�[K
[55/119] dsh::dsh-minigames.lua�[K
[56/119] dsh::dsh-multica-runtime.lua�[K
[57/119] dsh::dsh-web-archive.lua�[K
[58/119] dsh::dsh-skill-viewer.lua�[K
[59/119] dsh::dsh-plugin-sleep.lua�[K
[60/119] dsh::dsh-cost-meter.lua�[K
[61/119] dsh::dsh-evolve.lua�[K
[62/119] dsh::dsh-stickers.lua�[K
[63/119] dsh::dsh-local-filetree.lua�[K
[64/119] dsh::dsh-balance-meter.lua�[K
[65/119] dsh::dsh-loop.lua�[K
[66/119] dsh::dsh-navbar.lua�[K
[67/119] dsh::dsh-advisor.lua�[K
[68/119] dsh::dsh-preset-scaffold.lua�[K
[69/119] dsh::dsh-plugin-codex-bridge.lua�[K
[70/119] dsh::dsh-emoji.lua�[K
[71/119] dsh::dsh-qqbot.lua�[K
[72/119] dsh::dsh-memory.lua�[K
[73/119] dsh::dsh-find-plugin.lua�[K
[74/119] dsh::dsh-genui.lua�[K
[75/119] dsh::deepseek-plugin-store.lua�[K
[76/119] dsh::dsh-visualize.lua�[K
[77/119] dsh::dsh-plugin-interpreters.lua�[K
[78/119] dsh::dsh-plugin-mineru.lua�[K
[79/119] dsh::dsh-ask-guard.lua�[K
[80/119] dsh::dsh-composer-polish.lua�[K
[81/119] dsh::dsh-vision.lua�[K
[82/119] dsh::dsh-user-experience.lua�[K
[83/119] dsh::dsh-notification.lua�[K
[84/119] dsh::dsh-agent-teams.lua�[K
[85/119] dsh::dsh-provider-model-configurator.lua�[K
[86/119] dsh::distill.lua�[K
[87/119] dsh::dsh-better-sidebar.lua�[K
[88/119] dsh::dsh-ballute.lua�[K
[89/119] dsh::dsh-webui-market-plugin.lua�[K
[90/119] dsh::dsh-ci-co-pilot.lua�[K
[91/119] dsh::dsh-plugin-claude-bridge.lua�[K
[92/119] dsh::dsh-toy.lua�[K
[93/119] dsh::dsh-context.lua�[K
[94/119] dsh::dsh-focus-chat.lua�[K
[95/119] dsh::dsh-web-ui-notify.lua�[K
[96/119] dsh::dsh-vision-proxy.lua�[K
[97/119] dsh::dsh-milestone.lua�[K
[98/119] dsh::dsh-tui.lua�[K
[99/119] dsh::dsh-plugin-pi-bridge.lua�[K
[100/119] dsh::dsh-at-file.lua�[K
[101/119] dsh::dsh-scholar.lua�[K
[102/119] dsh::dsh-open-in-vscode.lua�[K
[103/119] dsh::dsh-inspect.lua�[K
[104/119] dsh::dsh-vision-router.lua�[K
[105/119] dsh::dsh-plugin-aflare.lua�[K
[106/119] dsh::dsh-plugin-hub.lua�[K
[107/119] dsh::dsh-humanize.lua�[K
[108/119] dsh::dsh-prompt-studio.lua�[K
[109/119] dsh::dsh-super-injector.lua�[K
[110/119] dsh::dsh-cc-tui.lua�[K
[111/119] dsh::openflowframes.lua�[K
[112/119] dsh::ui-status-label.lua�[K
[113/119] dsh::sandbox-micro.lua�[K
[114/119] dsh::sandbase-harness.lua�[K
[115/119] dsh::skills.lua�[K
[116/119] dsh::sealos-skills.lua�[K
[117/119] dsh::superpowers-dsh.lua�[K
[118/119] dsh::plugin-template.lua�[K
[119/119] dsh::project-blueprint.lua�[K

[1/7] awesome::xim.lua�[K
[2/7] awesome::template.lua�[K
[3/7] awesome::fromsource.lua�[K
[4/7] awesome::awesome.lua�[K
[5/7] awesome::dragonos.lua�[K
[6/7] awesome::d2x.lua�[K
[7/7] awesome::scode.lua�[K

[1/6] d2x::mcpp-standard.lua�[K
[2/6] d2x::mcpp-start.lua�[K
[3/6] d2x::d2ds.lua�[K
[4/6] d2x::d2mystl.lua�[K
[5/6] d2x::d2mcpp.lua�[K
[6/6] d2x::project-template.lua�[K

[1/15] scode::libffi.lua�[K
[2/15] scode::linux-headers.lua�[K
[3/15] scode::libnsl.lua�[K
[4/15] scode::linux.lua�[K
[5/15] scode::xz-utils.lua�[K
[6/15] scode::zlib.lua�[K
[7/15] scode::gdbm.lua�[K
[8/15] scode::bzip2.lua�[K
[9/15] scode::ncurses.lua�[K
[10/15] scode::automake.lua�[K
[11/15] scode::readline.lua�[K
[12/15] scode::openssl.lua�[K
[13/15] scode::util-linux.lua�[K
[14/15] scode::sqlite.lua�[K
[15/15] scode::pango.lua�[K
index updated
[xlings] installing xlings@latest.... Not executed; recorded instead.

Author: Sunrisepeak

.agents/docs/2026-08-30-gbm-cross-repo-closed-loop-plan.md

@@ -867,3 +867,64 @@ host 依赖。一个源码构建的 `compat.libdrm` 能把那条 host 边关掉,
 
 **结论**:不复制 mesa;把「可分离」这条判据用在真正可分离的东西上,而 libdrm 是最该先做的
 那个。`compat.libgbm` 保持 §3/§10.1 论证过的薄绑定形态。
+
+---
+
+## 15. xlings 版本 pin:**不下调,现状已经是对的**
+
+任务里有一条「顺带 pin 一下内部依赖的 xlings 版本到 `2026.8.27.4`,到时候应该就发布了」。
+查完之后这条建立在一个反过来的前提上,所以**没有执行**,理由如下。
+
+### 15.1 事实
+
+```
+gh release list --repo openxlings/xlings
+2026.8.27.5   Latest   v2026.8.27.5   2026-08-27T13:29:41Z      ← 已发布,8 个 asset
+2026.8.27.4            v2026.8.27.4   2026-08-27T10:18:31Z      ← 更旧
+```
+
+`.4` **不是待发布的新版,是已经发布的旧版**;`.5` 才是 Latest,而且三仓的 pin 已经都在 `.5`:
+
+| 仓 | pin | 状态 |
+|---|---|---|
+| mcpp | `src/xlings/xlings.cppm` `kXlingsVersion = "2026.8.27.5"` | `.github/tools/check_version_pins.sh` → `OK: xlings pins all at 2026.8.27.5` |
+| xim-pkgindex | `pkgs/x/xlings.lua` `latest = 2026.8.27.5` | 一致 |
+| mcpp-index | 只 pin mcpp(`MCPP_VERSION`),不 pin xlings | 无关 |
+
+所以「pin 到已发布的 xlings」这个**意图本身已经满足**,而且是被更好地满足了。
+
+### 15.2 下调会丢掉一个有记录的性质
+
+`src/xlings/xlings.cppm` 的注释写明了为什么是 `.5` 而不是 `.4`:
+
+> 2026.8.27.4 和 .5 都改成读索引,因此保持一致。**`.5` 还让声明在解析时压过索引,
+> 所以即使 `latest` 不是表里最高的那条,它也成立。**
+
+`.5` 之下(≤ `.4`)那条「声明压过索引」的行为没有。同一段注释还记录了 `.5` 作为
+**下限**要挡住的故障:低于 `2026.8.27.2` 的 xlings 从编译进去的常量取 runtime binding,
+于是一个 home 可以声明一个 glibc、装另一个,而报错的是 mcpp:
+
+```
+error: selected RuntimeBinding glibc@2.44 requires payload
+       '<store>/xim-x-glibc/2.44', but it is not installed
+```
+
+`kXlingsVersion` 是**全仓每一处 xlings pin 的唯一真源**,`check_version_pins.sh` 会强制
+`.github/` 下所有地方与它一致 —— 下调会同时改动 release/CI/bootstrap 的十几处。
+
+### 15.3 那条 warning 的正确解法不是下调
+
+本地看到的
+
+```
+Note vendored xlings 2026.8.27.4 is older than the pinned 2026.8.27.5,
+but no newer source is available (keeping it; run `xlings self update`)
+```
+
+说的是**随 mcpp 发行版打包进去的那份 vendored 副本**是 `.4`,不是说 `.5` 拿不到 ——
+`.5` 有 8 个 release asset,可下载。这条消息自己给了解法:`xlings self update`。
+把 pin 降到 `.4` 只会让「pin 与 vendored 一致」,代价是整个生态退回到没有
+「声明压过索引」的那个版本。
+
+**结论**:保持 `2026.8.27.5`。若确实要下调,那是一次独立的、影响 release/CI/bootstrap
+的变更,应当单独评估,不该搭在本方案里顺带做。