According to Git / SVN history research, it was last used by KDE in
KDE 1. It seems like other toolkits also stopped using it 10-20 years
ago. It should have little to no practical relevance anymore.
I've found some documentation of legacy XSM session management from
1992, and the first copyright year of the XSMP spec (what we're
currently using) is 1993.

Also, XSM was removed from GNOME's gnome-session in 2005, rationale
and short discussion here:
https://mail.gnome.org/archives/desktop-devel-list/
2005-July/msg00527.html
with the following objections:
- Firefox doesn't support XSMP (long fixed)
- CDE on Solaris doesn't support XSMP (oh well...)
- Motif applications don't support XSMP

On kde-core-devel and kwin, nobody cared too much.
Consider XSM "accidentally" broken now ;)
https://marc.info/?l=kde-core-devel&m=144857647812257
https://marc.info/?l=kde-core-devel&m=144976915400658

There is a utility called xsmproxy which comes from X.org.
It talks legacy XSM to clients and XSMP to an XSMP compliant
session manager and can therefore maybe hopefully make session
management of dinosaur applicatons sort of work.
It seems like that one received its last major modification
in 2003.

There is also some XSM related code in KWin that I will remove next.