# Independent Windows package review

Reviewed the current packaging script, guide, selected Cargo metadata, installed toolchain notices, and `.local/package-script-qa/ArcadiaStudio-qa-debug-20260906-a-x86_64-pc-windows-gnullvm` contents on 2026-09-06. No application was launched and no Cargo build/test was run for this review.

## Release blocker: third-party notices missing

The inspected QA bundle contains the application MIT license and only `licenses/llvm-mingw-LICENSE.TXT` under `licenses/`. It omits dependency notices, including Iced 0.14.0 (Hector Ramon and Iced contributors) and Tokio 1.53.1 (Tokio contributors). Their exact downloaded crate license files require their copyright and permission notices in copies or substantial portions. The selected locked Windows normal/build dependency graph contains 266 packages; a top-level dependency list would miss transitive notices. Several published workspace crates omit license texts even though their manifests declare license expressions, so collecting only existing root LICENSE files is insufficient.

Iced graphics embeds `fonts/Iced-Icons.ttf`; its optional Fira Sans font is gated by `fira-sans` (disabled in the observed metadata). Embedded assets need an explicit provenance record, not an assumption that every font in dependency examples/tests ships. Rust's installed toolchain supplies `share/doc/rust/COPYRIGHT-library.html` and `COPYRIGHT.html`; these are absent from the QA bundle too. LLVM-MinGW's root LICENSE.TXT alone is not evidence that every component-specific notice was resolved.

Smallest correction: select the two binary packages' transitive normal/build graph using locked target-filtered Cargo metadata; stage available notices, exact version/license/source information and local hashes; require reviewed, hash-bound supplements where publications omit required texts or contain embedded assets; include installed Rust library notices and the exact runtime distribution's notices. Refuse unresolved sources/notices before publishing an archive. This provides auditable inputs, not a universal license audit or proof that a prebuilt binary matches that graph.

## Runtime and integrity

No missing ordinary runtime DLL was established: current evidence identifies `libunwind.dll` as the sole non-Windows static import and it is staged beside both executables. The script inspects its imports too. Dynamic graphics and delay-loaded dependencies remain a clean-environment runtime acceptance gate, as the guide already states. The inspected bundle uses debug binaries; package-label version and PE architecture cannot prove release profile/source revision.

Fresh-output refusal, no recursive removal, create-new claim, copy hash checks, and ZIP readback are useful protections. Optional hardening: leaf reparse checks do not establish physical containment through ancestor junctions. This was not a demonstrated failure for the actual ordinary workspace/output paths and is distinct from the concrete missing-notice release blocker.

## Correction evidence

Implemented `scripts/windows-notices.ps1`, integrated it into `scripts/package-windows.ps1`, documented the workflow, and added hash-bound local supplements under `scripts/windows-notices/`. The collector uses locked offline target-filtered metadata, verifies cached registry archives against Cargo.lock, hashes actual local source files, stages nested notices and exact asset mappings, and includes the installed Rust copyright reports/compiler identity/target-library hashes. Git sources, missing declared sources, unknown font mappings, missing texts, path traversal and altered supplements are explicit refusals. Supplemental notice downloads were performed during this review at the recorded source URLs; packaging itself does not download.

Actual current graph preflight passes: **266 selected packages, 484 staged notice inputs, 58 Rust target library files hashed**. Twenty-seven published-crate notice mappings cover omitted texts. Iced graphics has two conservative font mappings: Fira Sans (disabled current feature, OFL statement and copyright extracted from its exact metadata plus upstream OFL text) and Iced Icons (declared distributed MIT plus its exact separate copyright/name metadata). LLVM-MinGW's exact libunwind hash is mapped to the component license at LLVM commit `ea7d852a70e8bdfaf601d6626a760f9771b2c4b4`, reported by the installed distribution's clang.

The icon font's different copyright owner was investigated, then distinguished from a proven conflicting license. Its pinned crate declares MIT; no explicit contrary asset license/exception was found in the pinned repository or inspected history. The conservative distribution record therefore retains Iced's MIT plus the font's own Fontello copyright metadata and a candid provenance limitation. Missing original glyph configuration alone is not treated as proof that the distributed license excludes the asset. No font replacement or dependency modification was made. Exact name/cmap inspection confirmed the seven renderer codepoints (F00C, E800 through E805). See `scripts/windows-notices/Iced-Icons-NOTICE.txt` for the evidence boundary.

`scripts/test-windows-notices.ps1` passes **8 contract checks on Windows PowerShell 5.1 and PowerShell 7**: selected normal/build graph excludes dev-only and disconnected packages; both Rust copyright reports are included; actual source changes alter source hashes; tampered archives, unmapped fonts, unsupported sources, escaping supplement paths and altered supplements are refused. All three scripts parse successfully. Tests use synthetic metadata and temporary fixtures; no build, Cargo target mutation or UI occurs. This does not test every license's legal requirements or indirect/generated asset discovery.

Fresh staging/archive verification against the root's newly rebuilt debug binaries **passed** as `qa-debug-20260906-b` under `.local/package-script-qa/`. The archive contains **528 files**, including **485 license files** (484 collected inputs plus the LLVM-MinGW distribution root notice). Every staged input was hash-checked and every ZIP entry was read back and compared. The archive is 30,615,400 bytes. Log: `.local/package-notices-qa-b.log`.

| Input/output | SHA-256 | Bytes |
| --- | --- | ---: |
| arcadia-studio.exe | `821f702f37f902955d63d230d6d7522935d09348931c36a45b24d70a72434553` | 102,017,024 |
| arcadia-server.exe | `dd6b7a6a9725558954f4f29219ebf6e773b30843766fe738c365f1ced3df9e8e` | 37,202,432 |
| libunwind.dll | `f45604a12e8bcd839fd86f667c1be1cc7c4f9da2b3c69ff381ac708f0e1ae7d4` | 190,976 |
| QA b ZIP | `237b30ee0c704efad89ed5c371d2c965f9e7d11ea318c97ba16ee34282456f73` | 30,615,400 |

The collected Cargo.lock hash is `e7b95afac40a11823fa68d615fcad97deeb878c8fa1e83b28561be5a81896112`. Spot inspection of the actual stage confirms the Tokio, Iced and separate font copyright notices are present; the machine-readable inventory contains both font mappings, all selected package declarations and source hashes, and Rust distribution evidence. Native acceptance remains owned by the release operator; this package is QA and does not imply the full release objective is complete. Script/docs ownership was returned to root after this successful run, with no Cargo build or target mutation by this work.