docs: the compiler ships a capability; mcpp supplies the policy (2026.8.8.2)

08-toolchain-internals had two sections that stopped being true when the
specs rewrite was removed. §4's gcc row still promised a specs rewrite; §5
described the clang cfg as if bypassing an install-time configuration were a
clang-specific accommodation rather than the rule both compilers now follow.
Rewritten as one policy with two mechanisms (`--no-default-config` for clang,
a generated `-specs=` for gcc), including what removing gcc's baked `*link:`
takes away and therefore what mcpp has to put back.

New §2.1 documents where the runtime binding comes from, since it is now a
resolution with an authority rather than a directory scan, and since "no
binding declines payload-first" is surprising unless the reason is written
down. 05-mcpp-toml notes that `[xlings] subos` picks the runtime too -- it
was already a key, but it did not previously decide this.

CHANGELOG gains 2026.8.8.2 and, separately, 2026.8.8.1, which shipped without
an entry.

xlings pin 2026.8.6.3 -> 2026.8.7.1: upstream is at 2026.8.8.1, but
xim-pkgindex does not carry it yet and pinning ahead of the index makes every
CI job install a version that is not there.

Author: speak-agent

.github/actions/bootstrap-mcpp/action.yml

@@ -25,7 +25,7 @@ inputs:
     # `package.name`, so one of the two was simply unreachable — and which one
     # depended on the machine, which is why CI failed on `compat:lua` on
     # Windows and `mcpplibs.capi:lua` on Linux. Never pin below that.
-    default: '2026.8.6.3'
+    default: '2026.8.7.1'
   cache-target:
     description: also restore/save target/ (build artifacts + BMIs)
     required: false

.github/actions/setup-macos-llvm/action.yml

@@ -15,7 +15,7 @@ inputs:
     # Floor imposed by the index, not a routine bump — see
     # .github/actions/bootstrap-mcpp/action.yml for why 0.4.69 is required
     # (two packages named `lua` in one repo need openxlings/xlings#381).
-    default: '2026.8.6.3'
+    default: '2026.8.7.1'
 
 runs:
   using: composite

.github/workflows/bootstrap-macos.yml

@@ -17,7 +17,7 @@ jobs:
       # Dormant (workflow_dispatch only), but kept in step with the rest —
       # check_version_pins.sh holds it there. Floor: 0.4.69, below which the
       # index cannot resolve two packages that share a short name.
-      XLINGS_VERSION: '2026.8.6.3'
+      XLINGS_VERSION: '2026.8.7.1'
     steps:
       - uses: actions/checkout@v4
 

.github/workflows/ci-fresh-install.yml

@@ -152,7 +152,7 @@ jobs:
         env:
           XLINGS_NON_INTERACTIVE: '1'
         run: |
-          curl -fsSL https://raw.githubusercontent.com/openxlings/xlings/main/tools/other/quick_install.sh | bash -s v2026.8.6.3
+          curl -fsSL https://raw.githubusercontent.com/openxlings/xlings/main/tools/other/quick_install.sh | bash -s v2026.8.7.1
           echo "$HOME/.xlings/subos/current/bin" >> "$GITHUB_PATH"
 
       - name: Install mcpp and config mirror
@@ -292,7 +292,7 @@ jobs:
 
       - name: Install xlings + mcpp
         run: |
-          curl -fsSL https://raw.githubusercontent.com/openxlings/xlings/main/tools/other/quick_install.sh | bash -s v2026.8.6.3
+          curl -fsSL https://raw.githubusercontent.com/openxlings/xlings/main/tools/other/quick_install.sh | bash -s v2026.8.7.1
           # Deliberately NOT writing to $GITHUB_PATH here. On container
           # images that declare no PATH in their config (opensuse/
           # tumbleweed), appending a single dir to GITHUB_PATH makes the
@@ -363,7 +363,7 @@ jobs:
           #             (older ones carry minos=15 and refuse to start).
           #   v0.4.51+: in-process sha256 — this image has no sha256sum
           #             binary, so pinned fetches failed before it.
-          curl -fsSL https://raw.githubusercontent.com/openxlings/xlings/main/tools/other/quick_install.sh | bash -s v2026.8.6.3
+          curl -fsSL https://raw.githubusercontent.com/openxlings/xlings/main/tools/other/quick_install.sh | bash -s v2026.8.7.1
           echo "$HOME/.xlings/subos/current/bin" >> "$GITHUB_PATH"
 
       - name: Install mcpp and config mirror

.github/workflows/ci-linux-e2e.yml

@@ -123,7 +123,7 @@ jobs:
 
       - name: Bootstrap xlings + released mcpp
         run: |
-          curl -fsSL https://raw.githubusercontent.com/openxlings/xlings/main/tools/other/quick_install.sh | bash -s v2026.8.6.3
+          curl -fsSL https://raw.githubusercontent.com/openxlings/xlings/main/tools/other/quick_install.sh | bash -s v2026.8.7.1
           export PATH="$HOME/.xlings/subos/current/bin:$PATH"
           xlings update
           xlings install mcpp -y -g

.github/workflows/cross-build-test.yml

@@ -118,7 +118,7 @@ jobs:
           # release assets were uploaded in a broken state (records present,
           # blobs missing → 404 on GET); re-uploaded clean. The stale-INDEX
           # half is handled by the marker-clear below.
-          XLINGS_VERSION: '2026.8.6.3'
+          XLINGS_VERSION: '2026.8.7.1'
         run: |
           tarball="xlings-${XLINGS_VERSION}-linux-x86_64.tar.gz"
           curl -fsSL -o "/tmp/${tarball}" \
@@ -255,7 +255,7 @@ jobs:
       - name: Bootstrap mcpp via xlings
         env:
           XLINGS_NON_INTERACTIVE: '1'
-          XLINGS_VERSION: '2026.8.6.3'
+          XLINGS_VERSION: '2026.8.7.1'
         run: |
           tarball="xlings-${XLINGS_VERSION}-linux-x86_64.tar.gz"
           curl -fsSL -o "/tmp/${tarball}" \

.github/workflows/release.yml

@@ -96,7 +96,7 @@ jobs:
           # Pin xlings to a known-good version. The upstream install
           # script always grabs `latest` (no version override), so we
           # download + self-install manually to avoid broken releases.
-          XLINGS_VERSION: '2026.8.6.3'
+          XLINGS_VERSION: '2026.8.7.1'
         run: |
           if [ ! -x "$HOME/.xlings/subos/default/bin/xlings" ]; then
             tarball="xlings-${XLINGS_VERSION}-linux-x86_64.tar.gz"
@@ -288,7 +288,7 @@ jobs:
       - name: Bootstrap mcpp via xlings
         env:
           XLINGS_NON_INTERACTIVE: '1'
-          XLINGS_VERSION: '2026.8.6.3'
+          XLINGS_VERSION: '2026.8.7.1'
         run: |
           tarball="xlings-${XLINGS_VERSION}-linux-x86_64.tar.gz"
           curl -fsSL -o "/tmp/${tarball}" \
@@ -358,11 +358,11 @@ jobs:
           # below are pinned to the same version as XLINGS_VERSION; they are
           # NOT interpolated from it, so check_version_pins.sh scans for them
           # explicitly (they were absent from the old lock-step comment).
-          XLA="xlings-2026.8.6.3-linux-aarch64.tar.gz"
+          XLA="xlings-2026.8.7.1-linux-aarch64.tar.gz"
           if curl -fsSL -o "/tmp/$XLA" \
-               "https://github.com/openxlings/xlings/releases/download/v2026.8.6.3/$XLA"; then
+               "https://github.com/openxlings/xlings/releases/download/v2026.8.7.1/$XLA"; then
             tar -xzf "/tmp/$XLA" -C /tmp
-            XLBIN=$(find /tmp/xlings-2026.8.6.3-linux-aarch64 -path '*/bin/xlings' -type f | head -1)
+            XLBIN=$(find /tmp/xlings-2026.8.7.1-linux-aarch64 -path '*/bin/xlings' -type f | head -1)
             if [ -n "$XLBIN" ]; then
               mkdir -p "$STAGING/$WRAPPER/registry/bin"
               cp "$XLBIN" "$STAGING/$WRAPPER/registry/bin/xlings"
@@ -440,7 +440,7 @@ jobs:
       - name: Bootstrap mcpp via xlings
         env:
           XLINGS_NON_INTERACTIVE: '1'
-          XLINGS_VERSION: '2026.8.6.3'
+          XLINGS_VERSION: '2026.8.7.1'
         run: |
           if [ ! -x "$HOME/.xlings/subos/default/bin/xlings" ]; then
             WORK=$(mktemp -d)
@@ -622,7 +622,7 @@ jobs:
         shell: bash
         env:
           XLINGS_NON_INTERACTIVE: '1'
-          XLINGS_VERSION: '2026.8.6.3'
+          XLINGS_VERSION: '2026.8.7.1'
         run: |
           # Captured before the `cd` below, in POSIX form: this step never
           # returns to the workspace, and GITHUB_WORKSPACE is a backslash

CHANGELOG.md

@@ -3,6 +3,71 @@
 > 本文件追踪 `mcpp-community/mcpp` 公开仓的版本演进。
 > 格式参考 [Keep a Changelog](https://keepachangelog.com/zh-CN/1.1.0/)。
 
+## [2026.8.8.2] — 2026-08-08
+
+编译器交付的是**能力**,不是配置。设计与实测证据见
+`.agents/docs/2026-08-08-payload-version-and-contract-drift-design.md`。
+
+### 修复
+
+- **产物加载哪个 glibc,现在有权威,不再靠目录顺序。**
+
+  payload-first 的构建要链接到某个具体 glibc。旧规则是问目录"那个 glibc"、
+  取 `readdir` 的第一项——只装了一个时它永远对,所以从没有东西逼它对。一条带
+  `xim:glibc@>=2.38` 的依赖就足以装进第二个:编译侧取了 2.44,而产物的
+  interpreter(装机时冻结在 gcc specs 里)仍是 2.39,于是二进制引用
+  `GLIBC_2.42` 符号却跑在没有它的运行时上,报错还落在与那条依赖无关的包上。
+
+  现在由 subos 自述的 runtime 作答(`[xlings] subos` 可指定),没有答案就**拒绝**
+  走 payload-first,而不是挑一个。该绑定计入工具链指纹(11 字段),两次只在
+  runtime 上不同的构建不再共用缓存。旧 subos 回落到工具链自身烙入的值。
+
+- **不再改写 GCC 的 `specs`,产物也不再带别人机器的死路径。**
+
+  旧的 specs 重写用单路径 needle 配双路径 replacement,每个跑过它的 home 都漏下
+  一条:一台开发机产出的每个 gcc 产物里都有 **68** 条陈旧 `RUNPATH`,全指向已删除
+  的 `mktemp` 目录。改为 `-specs=` 一份逐构建生成的干净文件(`-dumpspecs` 取内建
+  `*link:`,去掉 loader/rpath),loader 与 rpath 由 mcpp 显式写在链接行上。逐构建、
+  不需写权限,继承来的只读 payload 也能用。e2e `201_gcc_no_specs_pollution.sh`
+  断言的是产物而非 specs 文件。
+
+- **落后于 pin 的 vendored xlings 会被替换——但只在替换品确实更新时。**
+
+  `acquire_xlings_binary` 过去见到文件存在就返回,于是一个 home 会永远留着它第一次
+  获取的 xlings(实测 2026.8.2.1 对 pin 2026.8.6.3)。`subos_info` 是 2026.8.5.1
+  才有的,所以那台机器上 subos 的自述一直被一个太旧的客户端丢弃。修复的第一版直接
+  删了重取,结果把 2026.8.2.1 换成了系统的 0.4.51——更旧,且同样没有那个特性;现在
+  先给替换品定价再动手。
+
+- **`--sysroot` 的判据从"存在"改为"归属"。** gcc 把
+  `--sysroot=<...>/.xlings/subos/default` 当字符串烙进去,而一台机器上有很多同名
+  目录,所以那条烙入的路径经常存在、却属于另一个 checkout(实测:mcpp 里的构建解析
+  到了无关仓库下的 sysroot)。
+
+### 其他
+
+- `mcpp self doctor` 新增两条检查:vendored xlings 落后于 pin;sysroot 既不属于本
+  mcpp home 也不属于当前项目。
+- xlings pin 提升到 2026.8.7.1。
+
+## [2026.8.8.1] — 2026-08-07
+
+xlings 作为运行时底座:subos 环境到达程序,以及 self-contained 的
+`/proc/self/exe` 陷阱(#352、#375)。设计见
+`.agents/docs/2026-08-07-xlings-as-runtime-substrate-design.md`。
+
+### 修复
+
+- **subos 声明的环境变量现在真的到达被运行的程序(#352)。** 之前 mcpp 读的是自己
+  想象出来的 `subos_info.envs` 线格式(数组),而 xlings 写的是以 binding 为键的
+  对象,于是整条修复是空转的。现在按 xlings 实际写出的格式解析,并用逐字取自真实
+  xlings 输出的 fixture 钉住。
+- **升级后的 mcpp 会重放升级前的缓存,导致 subos 环境丢失。** 快路径命中时不带
+  subos 环境;该缺陷是靠一条"必须走快路径"的自证断言抓到的,而那条断言随即又抓到
+  第二个:缓存行写在 `profile=` 之前却在 `cacheMode=` 之后解析。
+- **self-contained 打包的 `/proc/self/exe` 陷阱(#375)。** 新增 `MCPP_BUNDLE_DIR`
+  契约。
+
 ## [2026.8.7.1] — 2026-08-07
 
 两处「模型比生态少一层」。设计与实测证据见 `.agents/docs/2026-08-07-windows-resources-and-version-identity-design.md`。

docs/05-mcpp-toml.md

@@ -966,6 +966,17 @@ build needs (`make`/`cmake`/`protoc`/…), pin tool versions per project, or set
 build-time env vars — without hand-editing `.xlings.json`. `[toolchain]` (§2.7) remains
 the ergonomic shorthand for the compiler; `[xlings.workspace]` is the general form.
 
+`subos` carries a second meaning on Linux: it selects **which C runtime the
+build binds against**. A subos describes its own runtime (xlings 2026.8.5.1+),
+and mcpp takes that as the authority rather than looking around for a libc — so
+`subos = "el8"` and `subos = "trixie"` in two projects on one machine produce
+artifacts targeting each one's glibc, with the compile side and the run side
+guaranteed to agree. The binding is part of the toolchain fingerprint, so
+switching it rebuilds rather than reusing the other subos' objects. A subos
+older than that (or none at all) falls back to whatever the toolchain itself
+was installed against; `mcpp build -v` prints which of the two happened. See
+docs/08-toolchain-internals.md §2.1.
+
 ### 2.14 Host tools from a dependency (mcpp 2026.8.5.1+)
 
 A package can build a binary its consumers need *at build time* — `protoc`, a