[Sunrisepeak]

The README route could pass with d2x 2026.08.02.2 while cold tests used a newer project pin. Activate public latest explicitly (xlings update, then xlings install --use d2x@latest mcpp@latest -y), install downloaded course dependencies, and verify the selected executable and version inside the course before first use. Pin the course and bilingual docs to the validated release 2026.10.21.1.

Keep README and unprepared cold routes separate across Linux without a compiler, macOS ARM64, Windows 2022/2025 and Windows without MSVC. Add explicit cross-repository candidate provenance/hash checks, archive preparation and Provider logs, and print diagnostic tails on failure. Upgrade fixtures start from actual August d2x/mcpp versions. A scheduled main matrix checks the stable release, public latest installation and course pin, including activation from an old selection; main also tests the actual published course download.

Coordinated fixes: d2x #39, d2x #40, release, index #1014. Native CI (six jobs), the exact-candidate first-use matrix (ten jobs), index checks/publication and three-host archive verification passed. Candidate and squash source trees match; release archives contain the exact tested binaries.

Local release validation: host xlings 2026.10.20.3 public latest activation; ordinary-user Ubuntu 20.04 with real xlings 2026.10.18.1 and a fresh MCPP_HOME, no candidate override: session 102.0s, first exercise 106.2s, fail/save/pass/advance/restart/setup-preserves-progress and 52/52 reference answers passed. Final pin CI passed all 24 applicable checks: ten first-use jobs, legacy upgrades and Dev Container, five-platform full regression and solutions parity, and bilingual book build. Post-merge main passed all 29 applicable checks: published course, ten first-use routes and three-platform public latest, legacy upgrades and Dev Container, full regression, and book build/deployment. The public course download is exactly squash commit 2482ab31bd075d8af6b5b4eb794e5584cbcf55ac, runs d2x 2026.10.21.1, and passes all 52 reference answers plus save/advance/resume. Linux, macOS and Windows each activate the August version first, then verify stable release = public latest installation = course pin = 2026.10.21.1.

Self-review: public installation runs outside ancestor project manifests; snapshots use the installer's actual shell/PATH; --use handles an already-installed but inactive latest version; artifact paths respect container boundaries; cold tests never prewarm the Provider; preparation messages cannot extend startup deadlines. Bilingual docs, book intro and changelog are consistent. Detailed design and evidence: .agents/docs/2026-10-20-d2x-d2mcpp-first-use-plan.md.