I have RB4011 Wifi version as router and set it up as CAPsMAN,
while RB4011 built in wifi, and CAP XL AC as CAPs.

RB4011 CAPs can connect to CAPsMAN and works fine. (with local firewall setting as explained in here).
But CAP XL AC couldn't find CAPsMAN.

Please help to finish my last 2 weeks over-night work.

Can you try and reset the cAP XL ac to CAP mode?
Just to make sure that you didn't make any errors in de the config...

https://help.mikrotik.com/docs/display/UM/cAP+XL+ac

Reset button
The reset button has three functions:

• Hold this button during boot time until LED light starts flashing, release the button to reset RouterOS configuration (total 5 seconds).
• Keep holding for 5 more seconds, LED turns solid, release now to turn on CAP mode. The device will now look for a CAPsMAN server (total 10 seconds).

Can you try and reset the cAP XL ac to CAP mode?
Just to make sure that you didn't make any errors in de the config...

https://help.mikrotik.com/docs/display/UM/cAP+XL+ac

Reset button
The reset button has three functions:

• Hold this button during boot time until LED light starts flashing, release the button to reset RouterOS configuration (total 5 seconds).
• Keep holding for 5 more seconds, LED turns solid, release now to turn on CAP mode. The device will now look for a CAPsMAN server (total 10 seconds).

Sure, caps.rsc, was exported after set the CAP mode.
But doesn't work.

Makes no sense as the CAP is pointing to the CAPsMAN. Sure it was not edited after resetting?

I have connected cAP ACs and cAP AC XL to hAP AC2's running 7.1. No problem.
I don't have any caps where I have a 4011.

I have a firewall that accepts caps on the local network.
Have the tech use his phone to log into the APs and RESET CONFIGURATION and CAPS-MODE. Works every time.

It sweet seeing those near real time numbers on the router, for all the APs in an install. Updated almost instantly...
I can also see how 2.4 clients can't get or stay connected in noisy environments. And other manufactures will have their packets silently dropped but LOOK connected in caps-man.

So you have to hope they only have dual band clients... and no URC remotes... or wireless printers from a certain firmware...

None of which I have to think about as soon as I give in and use another vendor for wireless.