ARCADIA-Studio/harness/release-source7-linux-gui-cross-build-20260907.md

# Source7 Linux GUI cross-build — 2026-09-07

Status: **Current frozen-source Linux GUI cross-build PASSED with Rust1.90; ELF and staged lesson independently verified. Linux GUI runtime acceptance remains pending. Both earlier incomplete runs are preserved below.** Root granted the exclusive Windows heavy-build lease after its Windows tests, strict Clippy and binary build passed. The Linux VM is off. No production code was changed for this build.

## Exact source and command

Root's new frozen archive contains 458 files, 2,089,801 compressed bytes. Archive `.local/linux-qa/runtime/source7-20260907T082753190288Z.tar.gz`, SHA256 `cbb371a93a562e1e641d7629fe351e016d63e66fc9112499b3fed6d5cd171f78`. The preparation helper verified this hash, each regular archive member and its digest, exact inventory, internal/external manifest identity/file mapping, and a previously absent destination. It rejected unsafe paths, duplicates and nonregular members. The copied source is:

`.local/cross-linux-qa/sources/source7-20260907T082753190288Z`

Its exact internal `QA-SNAPSHOT.json` SHA256 is `125557e1c3e9c7dcf843ed57a700311b944aa0f807c66bd004eac17b6adbbd7d`. Driver precheck independently verified all 458 copied files and the manifest before starting. The retained prior native Linux gate used a different 455-file snapshot; its results are not silently attributed to this source copy.

```powershell
. .local/cross-linux-qa/env.ps1
cargo +1.90.0-x86_64-pc-windows-gnu zigbuild `
  --manifest-path <exact-frozen-copy>/Cargo.toml `
  -p oa-desktop --bin arcadia-studio `
  --target x86_64-unknown-linux-gnu.2.28 --offline --locked
```

The child overrides only the task-local Windows-host linker with the response-aware shim described below. Cargo uses the preserved separate `.local/cross-linux-qa/target`, jobs=1, incremental=0, pinned Zig 0.16.0 and cargo-zigbuild 0.23.3. The default development profile is the repository's existing debug=0; no features or dependencies are removed to make the GUI compile.

Run directory `.local/cross-linux-qa/gui-runs/20260907T0831324427733Z`; hidden worker PID 2612. Start **08:31:32 UTC**, twenty-minute review **08:51:32 UTC**, hard command budget deadline **09:16:32 UTC**. The driver checks every approximately twenty seconds for available host RAM below 512 MiB or disk below 5 GiB and stops only its own still-live worker/compiler descendant tree if a floor or time limit is crossed. Cache is retained. It records status, resources, exact driver/child/proof/manifest and the Cargo log. The twenty-minute event requests an explicit progress assessment within the already authorized 45-minute budget; it does not start another job or extend the deadline.

## Read-only dependency and host-wrapper prerequisites

`cargo +1.90.0-x86_64-pc-windows-gnu metadata --locked --offline --filter-platform x86_64-unknown-linux-gnu` passed without downloads. Inspection of the metadata's desktop normal/build dependency closure found 333 package records and no declared `rust_version` above 1.90. Some packages do not declare an MSRV; this inventory cannot prove they compile. This metadata closure is an inventory, not an exact platform-feature compilation oracle: Cargo's metadata feature union included Emscripten-only EGL static flags. A separate target-specific offline `cargo tree -p oa-desktop --target x86_64-unknown-linux-gnu -e features -i khronos-egl` confirmed the actual Linux tree uses dynamic EGL, without those static flags.

Inspected locked build scripts/features confirm tiny-xlib and wayland-sys `dlopen`, smithay-client-toolkit without its build-time xkbcommon feature, and rfd's async-std/xdg-portal backend. Missing pkg-config data is tolerated on the inspected dynamic X11 path. Full link success remains the real check; no guest sysroot or host package installation was assumed. Inventory evidence: `gui-metadata.json`, `gui-dependency-inventory.json`, `gui-feature-evidence.json`, `gui-egl-tree.log`. The inspected workspace lock hash was `a6e070ed59b0ba19f18d60e8104494b777b470bd0268ae348cbe2b229790449f`; the build additionally requires the frozen lock's own manifest digest.

The previous `.cmd` host wrapper selected `dllcrt2.o` only when `-shared` appeared directly. Rust 1.90 can replace an oversized linker command with a UTF-8 response file containing its arguments. That makes direct-only detection insufficient. A task-local **native executable** shim now examines the original arguments and flat Rust GNU response file for the actual `-shared` flag, selects the matching Rust-provided `crt2.o` or `dllcrt2.o`, and forwards the original argument/response data to Clang without shell interpretation. Nested response files, non-UTF8 content and response files above the explicit 4 MiB inspection bound fail clearly instead of guessing. The format assessment follows the exact [Rust 1.90 linker implementation](https://github.com/rust-lang/rust/blob/1.90.0/compiler/rustc_codegen_ssa/src/back/link.rs#L1462-L1527).

Root approved a real bootstrap before the GUI build. The shim itself was compiled with the explicit Rust 1.90 GNU host and the previously proven EXE linker path. Then the existing task-local ring probe rebuilt and executed both its Windows EXE build script and Windows proc-macro DLL in **direct** and **forced-response-file** modes, and linked the Linux target in both modes. Two fresh audit records prove forced response inspection selected both artifact kinds. Results: direct **2.23s**, forced **2.11s**, both exit 0, warm cache. An initial helper-only `Select-String` argument-binding typo was fixed; its successful direct compilation was not a compiler defect or production change.

Final shim SHA256 `98f0da6d32ba3f99a334659e5803110c6d5c3eaa17b5cd288a23025216f814a9`; source SHA256 `c48c0a33621d4ad36ceb31415fc2497f0cb320986b54bdc1da3ba8b1d87f8b46`. Proof: `.local/cross-linux-qa/host-link-response-proof.json`, with direct/forced log hashes. The GUI driver requires this successful proof to match the actual shim executable. Earlier runtime-verified ELF `1D7029F9…8EA023` and host DLL `86B6321C…362710` were preserved as `hello-ring-before-response.elf` and `host-macro-before-response.dll` before this modified probe rebuilt; their earlier execution evidence remains scoped to those original bytes.

## Remaining checks and limits

On successful Cargo completion the driver verifies the frozen source again, records ELF headers/interpreter/dynamic dependencies/version requirements, hashes the executable and stages it in the fresh run's package directory with the **whole** `examples/release1` folder beside it. Manual inspection must confirm the Linux ELF and required runtime libraries before any guest trial. On failure/time/resource stop, preserve the exact error and partial cache; discuss production defects before changing shared code.

No GUI guest has been launched for this build. The separate `release-linux-gui-runtime-plan-20260907.md` still governs VGA/framebuffer, Xorg/Openbox, software Vulkan, portal and actual engineer workflow prerequisites. A cross-compiled GUI, even at Rust 1.90, does not establish display rendering, usable dialogs, Save/Undo/reopen behavior, Wayland support, or hardware acceleration. Native core/server test evidence remains in `release-source7-linux-gate-20260907.md` with its explicit server failure, separate snapshot and ignored cases.

Prepared helper ownership is limited to `.local/cross-linux-qa/{prepare-gui-source.ps1,bootstrap-host-link-response.ps1,host-link-response.rs,gui-cross-build.ps1,gui-cross-child.ps1}` and their task-local output. PowerShell parser checks, exact archive preparation/precheck, and real bootstrap passed. The original wall-clock time-stop and later explicitly requested process-tree interruption were observed as recorded below; the resource-floor branch was not deliberately triggered.


## First run stopped after host clock adjustments

The driver ended **TIME_LIMIT**, with the post-build frozen-source check **passed**, at `2026-09-07T09:30:04.4385366Z`. Cargo was terminated before completion, so `exit_status` is null and no GUI executable was staged. The last compiler lines were `rustls-webpki`, `tiny-skia`, `guillotiere` and `rand_core`; no compiler or linker error had appeared. This is an incomplete build, not a passing feature/MSRV test or a compiler failure.

Resource samples have a gap from `08:43:32Z` to `09:30:01Z`. Read-only Windows System event inspection found two Kernel-General event 1 records identifying `vmtoolsd.exe` as the time-change source:

| Old UTC | New UTC | Recorded delta |
|---|---|---:|
| 08:43:35.257 | 09:16:14.039 | +1,958,781 ms |
| 09:16:26.925 | 09:29:43.304 | +796,378 ms |

These total **45m55.159s** of clock adjustments. The driver's UTC start/end span was about 58m32s; it cannot establish 45 minutes of active compilation. No sleep/power transition is inferred. Exact event evidence is retained in the run's `host-time-events.json`. The twenty-minute review notification and time-limit decision occurred together when the monitor next resumed sampling after the clock jumps; there was no normal twenty-minute progress checkpoint before termination.

`stop.log` records termination of the task-created process tree. One child initially returned an unsupported-termination error; a subsequent explicit check confirmed **all seven referenced PIDs absent**, as well as no cargo/rustc/clang/zig processes. `stopped-process-check.json` records the check at `09:31:18Z`, host free RAM 4,125 MiB and disk 11.84 GiB. The heavy lease was released immediately. The preserved cache remains available; no source, features, dependencies or production code were changed in response.

A renewed run requires root authorization. Recommended helper-only correction before that run: use a monotonic `Stopwatch` for elapsed budget/review decisions, retaining UTC times and recording wall/monotonic divergence for provenance. This avoids using wall-clock synchronization as evidence of elapsed build work. Preserve this original TIME_LIMIT run and its logs; do not relabel it as a successful or continuously active 45-minute compile. No retry was started under the expired lease.


## Explicitly authorized renewed run

Root authorized a renewed cached run of the identical frozen 458 files after reviewing the documented VMware time events. Only the task-local driver timing was changed: a monotonic `Stopwatch` now controls the twenty-minute review and 45-minute cap. UTC timestamps, monotonic elapsed seconds, UTC elapsed seconds and their difference are recorded in status/resource evidence. Elapsed time is not described as active compiler CPU time. Original run/evidence are unchanged.

PowerShell parser review passed. Updated driver SHA256: `f58950cabb1f7567caba13462db766c40022da261a21ee5a047e8bea582de74c`. New run `.local/cross-linux-qa/gui-runs/20260907T0933400874515Z`; hidden worker PID **8156**; UTC start **09:33:40.5906463Z**. The 45-minute limit is monotonic (nominal UTC 10:18:40 only if wall time remains stable). The exact source precheck passed again, and the unchanged linker proof/cache were reused without rerunning the bootstrap. No VM or second Cargo worker was started.

At the renewed run's normal twenty-minute review (UTC `09:53:55Z`, monotonic elapsed **1,207 seconds**), Cargo had reached `oa-core`, `iced_renderer`, `rfd` and `ashpd` without a compiler/linker error. Sampled free RAM was **3,572 MiB**, disk **11.698 GiB**, and UTC/monotonic divergence approximately −0.062 seconds. The recorded decision was to continue within the existing 45-minute limit; no source/features/toolchain change or restart. Evidence: renewed run `twenty-minute-review.json`.


## Renewed run interrupted for the user's latest Windows build

Root directed immediate resource handoff for the user's requested latest Windows build. Inspection showed actual `rustc` PID3700 compiling `oa_core`, despite Cargo having printed the `oa-desktop` package/build-script line; this was **not final GUI linking**, and no completion-within60seconds estimate was justified. The owned worker8156 and six descendants were stopped, preserving their exact command inventory and the dependency cache. No source changes or compiler error prompted the interruption.

Final classification: **INTERRUPTED_FOR_REQUEST**, UTC end `09:57:14.715Z`, **1,414.196 seconds monotonic**. Frozen458-file postcheck passed. No completed GUI ELF, full desktop cross-build pass, or guest GUI runtime is claimed. The original driver's generic `BUILD_FAILED` after external child termination is preserved unchanged as `driver-raw-status.json`; `status.json` records the explicit root-request classification and reason. This does not conceal an observed compiler failure: Cargo exited through controlled termination without a Cargo completion status.

At `09:57:31Z`, all seven recorded owned PIDs were absent; free RAM3,784MiB. The lease was immediately returned to root. Last in-build resource sample: RAM3,727MiB, disk11.657GiB; wall-minus-monotonic difference approximately−0.071seconds. No VM was launched. Resuming the same immutable source/cache requires a new resource lease; no continuation was started.

Evidence in renewed run `20260907T0933400874515Z`:

| Artifact | SHA256 |
|---|---|
| status.json | `8C897558FDA5B84A23D4172750D47DCAB69D634E729C5DF5E05FAA26A7F327B3` |
| cargo.log | `F6D91EC5EE6ECFEC3861BD290149F030236E082B1A9920FC43F44D5BB821964F` |
| interruption-process-check.json | `70307293030D6D562B4381AF408A20A9FEA40A9F902E76B0F04337F54AC3F12D` |

`interruption.json`, `interrupted-process-tree.json` and `interruption-stop.log` preserve the request and scoped stop. The successful direct/response EXE/DLL prerequisite and first-run VMware Kernel-General evidence remain unchanged.


## Fresh current-source build after Windows preview delivery

Root granted a separate resource lease after the current Windows preview was packaged. Read-only process inspection found no Cargo/rustc/Zig/Clang/QEMU; preview GUI9148 and8044 remained untouched. Initial available RAM3,887MiB/disk11.42GiB. No production edits, VM or Computer Use were performed by this worker.

The existing capture helper froze the actual current working bytes, including the Fit `from_vec` zero-slot correction. New archive `.local/linux-qa/runtime/source7-20260907T102528493108Z.tar.gz`: **458files,2,094,375bytes**, SHA256 `9b10aa8457a5371367f7e24a0b2260b63c19fed69873d98a3972062a744503d7`. Internal manifest SHA256 `026E05AEDB431D57E0AD45F45A73B09E9AADC80631BF154B6DD3197013AB6B3F`. Capture verified its file inventory/bytes again before publication; archive preparation and separate build precheck passed. This is a new source snapshot, not the old458-file snapshot solely because the count is equal.

Build source `.local/cross-linux-qa/sources/source7-20260907T102528493108Z`; run `.local/cross-linux-qa/gui-runs/20260907T1025486926611Z`, hidden worker**2128**, start UTC`10:25:48.7075196Z`. Same verified Rust1.90GNU/response-aware shim/Zig/locked offline command and preserved cache; no bootstrap rerun. Driver parser/hash remained unchanged (`F58950…DE74C`). It retains20-minute review/45-minute maximum on Stopwatch elapsed,512MiB RAM/5GiB disk floors, with UTC provenance alongside monotonic elapsed. Initial Cargo output immediately reached oa-core/oa-desktop using the cached dependencies. Package-name lines do not by themselves prove desktop final linking.


### Completed current-source compile and independent ELF check

**Cargo exit0**, `Finished dev profile [unoptimized]` in **2m20s**; controller completed in **142.766 seconds monotonic** at UTC`10:28:11.471Z`. The preserved dependency cache made this a warm completion; this is not a2m20s cold-GUI estimate and the interrupted earlier work is retained above. Both pre/post458-file digest checks passed. No20-minute review was necessary because the command completed earlier. Latest in-build sample RAM3,869MiB/disk11.254GiB; no resource floor approached. Process inspection confirmed no Cargo/rustc/Zig/Clang/QEMU remained, and the heavy lease was immediately returned to root. Existing Windows GUI processes were not touched.

The final artifact is:

`.local/cross-linux-qa/gui-runs/20260907T1025486926611Z/package/arcadia-studio`

**72,953,296bytes**, SHA256 **`330A3872D48EBF24AD21E6D4FA13CB6098BEBB3CB7FF82A2E082925CCF3DD346`**.

`llvm-readelf` identifies ELF64 little-endian x86-64, position-independent executable, interpreter `/lib64/ld-linux-x86-64.so.2`. DT_NEEDED lists `libm.so.6`, `libc.so.6`, `ld-linux-x86-64.so.2`, `libpthread.so.0`, `libdl.so.2`. Recorded GLIBC version requirements do not exceed **2.28**; there is no RPATH/RUNPATH. This is compatible with the requested link baseline at the inspected ELF level, not proof of actual system runtime compatibility. Dynamically loaded X11/Wayland/Vulkan/EGL/XKB components and portal behavior remain part of the separate real-Linux gate.

Independent readback verified the staged ELF digest and **all37 teaching-folder files**, with no omitted/extra file relative to this exact frozen snapshot. Evidence: `status.json`, `cargo-status.json`, `cargo.log`, `elf.txt`, `independent-package-check.json`; full run-file hashes in `.local/cross-linux-qa/current-gui-run-hashes.json`. No GUI process was launched in Linux and no runtime pass is claimed. The native corrected-server gate remains a distinct source/test execution task.

Root edited built-in guide alignment **after** this frozen capture. This binary retains the captured guide text; its behavior includes the captured Fit zero-slot correction. The later guide text is not silently attributed to these bytes, and no automatic rebuild followed. This is the full locked desktop compilation at the declaredRust1.90 MSRV on the stated cross toolchain, not an optimized final release or acceptance of a later working tree.