chore: prepare 2026.8.9.1 release

Author: speak-agent

.agents/docs/2026-08-09-mcpp-template-runtime-graphics-aur-implementation-plan.md

@@ -306,17 +306,17 @@
 - exit classification `noop | updated | transient | permanent | refused-downgrade`
 - manual inputs `publish=false|true`, optional exact latest stable tag only; no downgrade override in this phase.
 
-- [ ] RED: fixture tests cover desired==observed no-op, upgrade, late old event refusal, missing/hash-mismatched asset, AUR maintenance retry, auth/permanent failure, RPC lag after git update, and known clone failure not becoming first publish.
-- [ ] RED: assert the reconciler never opens, hashes, copies, stages, or addresses `scripts/aur/mcpp-m/**`; compare pre/post tree hashes.
-- [ ] Split `update.sh` into an mcpp-bin-only compatibility wrapper around the renderer; remove all mcpp-m reads/writes without editing mcpp-m files.
-- [ ] Render PKGBUILD from `mcpp-release.json`; regenerate `.SRCINFO` with non-root Arch `makepkg --printsrcinfo`, then `makepkg --verifysource`.
-- [ ] Query AUR RPC and HTTPS git, compare versions with Arch `vercmp`, validate both Linux assets/sidecars, and produce a dry-run diff before secrets are loaded.
-- [ ] Publish only by normal fast-forward SSH push with pinned AUR host key and bounded exponential retry for maintenance/timeouts; never force or initialize a missing known package.
-- [ ] Verify remote git head, bounded-poll RPC, then install in a clean Arch container and assert `mcpp --version`.
-- [ ] Change workflow triggers to successful release workflow_run + six-hour schedule + workflow_dispatch; all call the same latest-stable reconciler. Remove the mcpp-m publish leg.
-- [ ] Emit Actions summary with trigger, desired/observed versions, hashes, remote commit, retry count, classification, and drift age; AUR failure must not alter GitHub release conclusion.
+- [x] RED: fixture tests cover desired==observed no-op, upgrade, late old event refusal, missing/hash-mismatched asset, AUR maintenance retry, auth/permanent failure, RPC lag after git update, and known clone failure not becoming first publish.
+- [x] RED: assert the reconciler never opens, hashes, copies, stages, or addresses `scripts/aur/mcpp-m/**`; compare pre/post tree hashes.
+- [x] Split `update.sh` into an mcpp-bin-only compatibility wrapper around the renderer; remove all mcpp-m reads/writes without editing mcpp-m files.
+- [x] Render PKGBUILD from `mcpp-release.json`; regenerate `.SRCINFO` with non-root Arch `makepkg --printsrcinfo`, then `makepkg --verifysource`.
+- [x] Query AUR RPC and HTTPS git, compare versions with Arch `vercmp`, validate both Linux assets/sidecars, and produce a dry-run diff before secrets are loaded.
+- [x] Publish only by normal fast-forward SSH push with pinned AUR host key and bounded exponential retry for maintenance/timeouts; never force or initialize a missing known package.
+- [x] Verify remote git head, bounded-poll RPC, then install in a clean Arch container and assert `mcpp --version`.
+- [x] Change workflow triggers to successful release workflow_run + six-hour schedule + workflow_dispatch; all call the same latest-stable reconciler. Remove the mcpp-m publish leg.
+- [x] Emit Actions summary with trigger, desired/observed versions, hashes, remote commit, retry count, classification, and drift age; AUR failure must not alter GitHub release conclusion.
 - [ ] GREEN: run Python tests, shell lint, dry-run against current latest release, and an Arch container source verification.
-- [ ] Commit mcpp-bin-only AUR reconciliation and verify mcpp-m byte hashes are unchanged.
+- [x] Commit mcpp-bin-only AUR reconciliation and verify mcpp-m byte hashes are unchanged.
 
 ## Task 10: Pin Latest xlings, Version mcpp, and Update User Documentation
 
@@ -338,13 +338,13 @@
 - Modify: `docs/spec/package-identity.md`
 - Modify: `scripts/aur/README.md`
 
-- [ ] Re-query latest non-draft/non-prerelease xlings immediately before pinning; pin the exact version and verify every authoritative pin site matches.
-- [ ] Choose the next unused calendar version (expected `2026.8.9.1` after live tag check), update `mcpp.toml`, and leave AUR snapshots to release-time generation.
-- [ ] Document `[ns.]name[@version][:tname]`, default `mcpplibs`, exact dotted namespaces, sole-template default, and legacy list migration.
-- [ ] Document McppDefault vs root/workspace-root `[xlings].subos`, no CLI override, non-transitive dependency semantics, coexistence across glibc bindings, and prebuilt ABI metadata boundary.
-- [ ] Document xlings/xim ownership of OpenGL/Vulkan providers and that mcpp never probes GPU/driver/ICD.
-- [ ] Document mcpp-bin-only eventual AUR reconciliation and explicitly state mcpp-m/mcpp-git are outside automation.
-- [ ] Update English and Chinese examples together; regenerate command reference if CLI help changed.
+- [x] Re-query latest non-draft/non-prerelease xlings immediately before pinning; pin the exact version and verify every authoritative pin site matches.
+- [x] Choose the next unused calendar version (expected `2026.8.9.1` after live tag check), update `mcpp.toml`, and leave AUR snapshots to release-time generation.
+- [x] Document `[ns.]name[@version][:tname]`, default `mcpplibs`, exact dotted namespaces, sole-template default, and legacy list migration.
+- [x] Document McppDefault vs root/workspace-root `[xlings].subos`, no CLI override, non-transitive dependency semantics, coexistence across glibc bindings, and prebuilt ABI metadata boundary.
+- [x] Document xlings/xim ownership of OpenGL/Vulkan providers and that mcpp never probes GPU/driver/ICD.
+- [x] Document mcpp-bin-only eventual AUR reconciliation and explicitly state mcpp-m/mcpp-git are outside automation.
+- [x] Update English and Chinese examples together; regenerate command reference if CLI help changed.
 - [ ] GREEN: run pin tests, docs example tests, generated command reference tests, `git diff --check`, and forbidden-vocabulary/boundary scans.
 - [ ] Commit version, xlings pin, and documentation.
 

.agents/docs/2026-08-09-mcpp-template-runtime-graphics-aur-validation.md

@@ -246,9 +246,48 @@ Task 8 focused local evidence:
 - Workflow structure: Ruby/Psych parses `.github/workflows/release.yml`; all six jobs are present and ecosystem publication is gated by the immutable manifest job.
 - Public GitHub upload/refetch and eventual-consistency polling cannot be truthfully claimed from local fixtures; they remain explicit latest-HEAD release CI evidence.
 
+### 5.8 mcpp-bin-only AUR reconciliation (Task 9)
+
+- State-machine/contract suite: `python3 -m unittest tests/scripts/test_aur_reconcile.py`
+  passes **11/11**. It covers no-op/upgrade/repair/RPC-lag/refused-downgrade,
+  missing or mismatched release material, bounded maintenance retry, permanent
+  auth failure, failed known-package clone without repo initialization, exact
+  latest-complete release selection, workflow recovery triggers, and the pinned
+  AUR ED25519 fingerprint.
+- Release fixture: the real public `v2026.8.8.4` payloads/sidecars and locally
+  generated immutable manifest validate as desired `2026.8.8.4-1`; both Linux
+  digests match manifest and sidecar. The first Arch render attempt classified
+  the Docker Hub registry-header timeout as **transient**, not success.
+- `bash -n scripts/aur/update.sh`, Python compilation/tests, Ruby/Psych workflow
+  parse, and `git diff --check`: PASS.
+- Protected `scripts/aur/mcpp-m/**` aggregate before/after remains
+  `afb8a647e04483a86985119e07086016f49d55f177ee6257094c336d226113c6`.
+- The remaining real Arch `makepkg --printsrcinfo` / `--verifysource` gate is
+  not claimed locally while the image pull is blocked; it remains an explicit
+  validation/CI item.
+
+### 5.9 latest pin, version, and user contract docs (Task 10)
+
+- Live GitHub release API on 2026-08-09: newest stable xlings is
+  `v2026.8.9.2`; newest stable mcpp is `v2026.8.8.4`, so the next unused mcpp
+  version is `2026.8.9.1`.
+- Live `openxlings/xim-pkgindex` main identifies `2026.8.8.4` as the current
+  mcpp latest for Linux/macOS/Windows; `.xlings.json` now bootstraps that
+  published version rather than the previous stale `2026.8.6.2`.
+- `.github/tools/check_version_pins.sh` passes with every xlings pin at
+  `2026.8.9.2`, build version `2026.8.9.1`, and bootstrap mcpp `2026.8.8.4`.
+- English/Chinese README, getting-started, manifest, toolchain, identity, AUR,
+  and changelog text now state the same template/SubOS/graphics/AUR boundaries.
+
 ## 6. Pull request and CI
 
-Not published yet. This section will record PR URL, local/remote HEAD, review state, all latest-head job IDs and terminal conclusions.
+Draft PR [#400](https://github.com/mcpp-community/mcpp/pull/400) was opened from
+`feat/template-runtime-graphics-aur`. Initial head `234a4df` exposed two real
+boundaries: stale declared glibc identity versus the resolved SubOS view on
+Linux, and Linux-only runtime-physics assertions executing on macOS/Windows.
+Both received focused regressions and were pushed at head `dae4384`; the new
+latest-head matrix was queued as runs `31317342625` through `31317342775`.
+Terminal conclusions are not yet claimed.
 
 ## 7. Merge and release
 

.github/actions/bootstrap-mcpp/action.yml

@@ -25,7 +25,7 @@ inputs:
     # `package.name`, so one of the two was simply unreachable — and which one
     # depended on the machine, which is why CI failed on `compat:lua` on
     # Windows and `mcpplibs.capi:lua` on Linux. Never pin below that.
-    default: '2026.8.8.1'
+    default: '2026.8.9.2'
   cache-target:
     description: also restore/save target/ (build artifacts + BMIs)
     required: false

.github/actions/setup-macos-llvm/action.yml

@@ -15,7 +15,7 @@ inputs:
     # Floor imposed by the index, not a routine bump — see
     # .github/actions/bootstrap-mcpp/action.yml for why 0.4.69 is required
     # (two packages named `lua` in one repo need openxlings/xlings#381).
-    default: '2026.8.8.1'
+    default: '2026.8.9.2'
 
 runs:
   using: composite

.github/workflows/bootstrap-macos.yml

@@ -17,7 +17,7 @@ jobs:
       # Dormant (workflow_dispatch only), but kept in step with the rest —
       # check_version_pins.sh holds it there. Floor: 0.4.69, below which the
       # index cannot resolve two packages that share a short name.
-      XLINGS_VERSION: '2026.8.8.1'
+      XLINGS_VERSION: '2026.8.9.2'
     steps:
       - uses: actions/checkout@v4
 

.github/workflows/ci-fresh-install.yml

@@ -152,7 +152,7 @@ jobs:
         env:
           XLINGS_NON_INTERACTIVE: '1'
         run: |
-          curl -fsSL https://raw.githubusercontent.com/openxlings/xlings/main/tools/other/quick_install.sh | bash -s v2026.8.8.1
+          curl -fsSL https://raw.githubusercontent.com/openxlings/xlings/main/tools/other/quick_install.sh | bash -s v2026.8.9.2
           echo "$HOME/.xlings/subos/current/bin" >> "$GITHUB_PATH"
 
       - name: Install mcpp and config mirror
@@ -293,7 +293,7 @@ jobs:
 
       - name: Install xlings + mcpp
         run: |
-          curl -fsSL https://raw.githubusercontent.com/openxlings/xlings/main/tools/other/quick_install.sh | bash -s v2026.8.8.1
+          curl -fsSL https://raw.githubusercontent.com/openxlings/xlings/main/tools/other/quick_install.sh | bash -s v2026.8.9.2
           # Deliberately NOT writing to $GITHUB_PATH here. On container
           # images that declare no PATH in their config (opensuse/
           # tumbleweed), appending a single dir to GITHUB_PATH makes the
@@ -364,7 +364,7 @@ jobs:
           #             (older ones carry minos=15 and refuse to start).
           #   v0.4.51+: in-process sha256 — this image has no sha256sum
           #             binary, so pinned fetches failed before it.
-          curl -fsSL https://raw.githubusercontent.com/openxlings/xlings/main/tools/other/quick_install.sh | bash -s v2026.8.8.1
+          curl -fsSL https://raw.githubusercontent.com/openxlings/xlings/main/tools/other/quick_install.sh | bash -s v2026.8.9.2
           echo "$HOME/.xlings/subos/current/bin" >> "$GITHUB_PATH"
 
       - name: Install mcpp and config mirror

.github/workflows/ci-linux-e2e.yml

@@ -133,7 +133,7 @@ jobs:
 
       - name: Bootstrap xlings + released mcpp
         run: |
-          curl -fsSL https://raw.githubusercontent.com/openxlings/xlings/main/tools/other/quick_install.sh | bash -s v2026.8.8.1
+          curl -fsSL https://raw.githubusercontent.com/openxlings/xlings/main/tools/other/quick_install.sh | bash -s v2026.8.9.2
           export PATH="$HOME/.xlings/subos/current/bin:$PATH"
           xlings update
           xlings install mcpp -y -g

.github/workflows/cross-build-test.yml

@@ -118,7 +118,7 @@ jobs:
           # release assets were uploaded in a broken state (records present,
           # blobs missing → 404 on GET); re-uploaded clean. The stale-INDEX
           # half is handled by the marker-clear below.
-          XLINGS_VERSION: '2026.8.8.1'
+          XLINGS_VERSION: '2026.8.9.2'
         run: |
           tarball="xlings-${XLINGS_VERSION}-linux-x86_64.tar.gz"
           curl -fsSL -o "/tmp/${tarball}" \
@@ -255,7 +255,7 @@ jobs:
       - name: Bootstrap mcpp via xlings
         env:
           XLINGS_NON_INTERACTIVE: '1'
-          XLINGS_VERSION: '2026.8.8.1'
+          XLINGS_VERSION: '2026.8.9.2'
         run: |
           tarball="xlings-${XLINGS_VERSION}-linux-x86_64.tar.gz"
           curl -fsSL -o "/tmp/${tarball}" \

.github/workflows/release.yml

@@ -96,7 +96,7 @@ jobs:
           # Pin xlings to a known-good version. The upstream install
           # script always grabs `latest` (no version override), so we
           # download + self-install manually to avoid broken releases.
-          XLINGS_VERSION: '2026.8.8.1'
+          XLINGS_VERSION: '2026.8.9.2'
         run: |
           if [ ! -x "$HOME/.xlings/subos/default/bin/xlings" ]; then
             tarball="xlings-${XLINGS_VERSION}-linux-x86_64.tar.gz"
@@ -288,7 +288,7 @@ jobs:
       - name: Bootstrap mcpp via xlings
         env:
           XLINGS_NON_INTERACTIVE: '1'
-          XLINGS_VERSION: '2026.8.8.1'
+          XLINGS_VERSION: '2026.8.9.2'
         run: |
           tarball="xlings-${XLINGS_VERSION}-linux-x86_64.tar.gz"
           curl -fsSL -o "/tmp/${tarball}" \
@@ -358,11 +358,11 @@ jobs:
           # below are pinned to the same version as XLINGS_VERSION; they are
           # NOT interpolated from it, so check_version_pins.sh scans for them
           # explicitly (they were absent from the old lock-step comment).
-          XLA="xlings-2026.8.8.1-linux-aarch64.tar.gz"
+          XLA="xlings-2026.8.9.2-linux-aarch64.tar.gz"
           if curl -fsSL -o "/tmp/$XLA" \
-               "https://github.com/openxlings/xlings/releases/download/v2026.8.8.1/$XLA"; then
+               "https://github.com/openxlings/xlings/releases/download/v2026.8.9.2/$XLA"; then
             tar -xzf "/tmp/$XLA" -C /tmp
-            XLBIN=$(find /tmp/xlings-2026.8.8.1-linux-aarch64 -path '*/bin/xlings' -type f | head -1)
+            XLBIN=$(find /tmp/xlings-2026.8.9.2-linux-aarch64 -path '*/bin/xlings' -type f | head -1)
             if [ -n "$XLBIN" ]; then
               mkdir -p "$STAGING/$WRAPPER/registry/bin"
               cp "$XLBIN" "$STAGING/$WRAPPER/registry/bin/xlings"
@@ -440,7 +440,7 @@ jobs:
       - name: Bootstrap mcpp via xlings
         env:
           XLINGS_NON_INTERACTIVE: '1'
-          XLINGS_VERSION: '2026.8.8.1'
+          XLINGS_VERSION: '2026.8.9.2'
         run: |
           if [ ! -x "$HOME/.xlings/subos/default/bin/xlings" ]; then
             WORK=$(mktemp -d)
@@ -622,7 +622,7 @@ jobs:
         shell: bash
         env:
           XLINGS_NON_INTERACTIVE: '1'
-          XLINGS_VERSION: '2026.8.8.1'
+          XLINGS_VERSION: '2026.8.9.2'
         run: |
           # Captured before the `cd` below, in POSIX form: this step never
           # returns to the workspace, and GITHUB_WORKSPACE is a backslash

.xlings.json

@@ -1,5 +1,5 @@
 {
   "workspace": {
-    "mcpp": "2026.8.6.2"
+    "mcpp": "2026.8.8.4"
   }
 }