2026.9.29.1: install configures once per scope, --reconfig, and progress that belongs to the renderer

[speak-agent]

2026.9.29.1. Closes #629, closes #632 (§1, §3 via openxlings/xim-pkgindex#903, §4; §2 left as is by decision). Consumes libxpkg 0.0.59 (openxlings/libxpkg#44, closes libxpkg#43; published to mcpp-index in mcpplibs/mcpp-index#485).

Plan and review record: .agents/docs/2026-09-29-install-config-trigger-and-output-plan.md. Release notes: .agents/docs/2026-09-29-release-2026.9.29.1-notes.md.

Install configures once per scope (#632 §1)

A payload in the store is a home fact; having run its config() is a fact about one scope. Each scope's .xlings.json now records configured: {"<ns>:<name>@<version>": <revision>} (top-level, next to workspace). xim::configured_verdict — asked by the planner and by the installer — leaves a present payload alone only when the record names the recipe's current revision and every ledger entry the payload owns is claimed by the scope's installed[]. No record means "configure" (old homes migrate on their next install).

• An install whose whole closure is configured returns after the report, the activation and one routing-table rebuild, and prints how to configure again. --reconfig (interface: "reconfig": true, protocol 1.4) runs config for the whole plan, as before.
• A revision bump reinstalls the shared payload in one scope; every other scope's record then names the old revision and reconfigures on its next install. remove and a superseded unbind take the record with the binding.
• Each node that did something prints [i/n] installed|configured <coord>; the interface gets progress phase configure.
• SubosRuntimeUnknown's remedy now says --reconfig (glibc's config is what records the runtime).

Routing-table rebuild (B2)

Deferring the rebuild to the end of the plan was rejected: later hooks in one plan run earlier nodes' commands by name (musl-gcc → patchelf, media-crawler → uv, mcpp-vscode-clangd → mcpp, claude-llm → claude) and gcc's config calls <bindir>/gcc-specs-config by path. Measured instead: a rebuild spent ~0.08 s of its ~0.16 s re-parsing the 3.6 MB home config to read knownProjects, and in project scope rewrote it to move lastSeen. known_projects() now follows the file's size/mtime and takes the list from the parses that already happen; register_known_project writes at most once a day.

Output (A1–A3, #629)

• An index build script's output reaches xlings through libxpkg's BuildOutput, not fd 1: one [index] built <ns> (<n> files) line, the script's other lines passed on, the interface's index_rebuild events unchanged.
• index:* downloads draw no frames; a finished progress block is followed by a blank line; the renderer asks the frontend's capability, so --ui-mode cli means no bars; self update runs its children with --ui-mode cli.
• The privileged-env notice is printed for new or changed declarations only (install: an already-installed package re-configures its whole closure silently (~85 s), repeating privileged-env warnings; a partial name resolves without asking; recipe installed() never re-checked #632 §4).

Tests

• New e2e: E2E-125 install_configured_record_test.sh (C1–C8; C1 fails on 2026.9.28.2), E2E-126 index_build_output_test.sh (B1 fails on 2026.9.28.2). E2E-123 P2 updated: index artifact draws no frame, blank line after the last frame, --ui-mode cli draws none.
• New unit: ConfiguredVerdict.*; ProgressOutput.* moved from the removed palette predicate to ui::capabilities_of.
• mcpp test all suites pass locally; the non-tarball e2e manifest run locally with XLINGS_TEST_MIRROR=CN.