docs(release): 自举 pin 的失败又被归因成「索引删了版本」,第三次

09-release.md §5 已经为 3b1cb6b 记过一次这个更正,而本 PR 的 c1a3e45 又写了一遍
「指向索引里已经不存在的版本」。它是错的:openxlings/xim-pkgindex 与
d2learn/xim-pkgindex 都列着 63 个 mcpp 版本,`2026.8.5.3` 在里面。

值得注意的是 `available:` 实际列出的东西 —— 只有一个版本,正是那次 job 刚装上
的那个。这是「已安装版本」的形状,不是索引清单;而那一步解析的是 .xlings.json
的 **workspace** pin,workspace 作用域正是既有的那个陷阱。真实机制未坐实,不写
成结论。

pin 的 bump 本身没问题(§4 明确说这是合理的做法,而且它确实解开了那条 job)。
教训更窄,而且反复被重学:**在断言「索引删了它」之前,先读索引。** 一条 curl
就能定。

Author: speak-agent

docs/09-release.md

@@ -141,6 +141,20 @@ would again let the index guard and the installed version drift apart.
 > §3, seen from the other side. Nothing about a release removes older versions,
 > and no reasoning should be built on the idea that it does.
 
+> **The same misdiagnosis, again (2026-08-06).** `ci-aarch64-fresh-install`
+> failed with `xlings: version '2026.8.5.3' not found for 'mcpp' — available:
+> 2026.8.6.1`, and the fix commit again claimed the index had dropped the
+> version. It had not: both `openxlings/xim-pkgindex` and `d2learn/xim-pkgindex`
+> list 63 mcpp versions including `2026.8.5.3`. Note what `available:` actually
+> enumerated — a single version, the one that job had just installed — which is
+> the shape of an *installed-versions* view, not an index listing. That step
+> resolves a `.xlings.json` **workspace** pin, and a workspace-scoped resolve is
+> the documented scope trap.
+>
+> The bump itself was fine (§4 endorses it, and it did unblock the job). The
+> lesson is narrower and keeps being relearned: **before concluding "the index
+> dropped it", read the index.** One `curl` of `pkgs/m/mcpp.lua` settles it.
+
 ## 6. Checklist
 
 ```