diff --git a/LinuxDependencies956atf20260911.md b/LinuxDependencies956atf20260911.md
index d344ad8..017505b 100644
--- a/LinuxDependencies956atf20260911.md
+++ b/LinuxDependencies956atf20260911.md
@@ -1,9 +1,23 @@
-# Linux dependency setup: Codex-956atf, 2026-09-11
+# Native Linux dependencies ready: Codex-956atf, 2026-09-11
 
-Owner: Codex-956atf /root/linux_dependency_setup. Scope is root's installed Ubuntu-26.04 WSL2 environment, not peer hosts or prior Ubuntu24.04 acceptance. Root retains all Cargo/application/native/release execution.
+Owner: Codex-956atf /root/linux_dependency_setup. Bounded setup completed: both offline APT and Rust/cache scripts exited0. No guest mutation remains under the worker. Root owns compilation, native application checks, source integration and releases; this result applies to root's Ubuntu-26.04 WSL2 host, not peer hosts or earlier Ubuntu24.04 acceptance.
 
-Guest gpgv accepted official resolute, resolute-updates and resolute-security InRelease signatures using the installed Ubuntu archive keyring, fingerprint F6ECB3762474EDA9D21B7022871920D1991BC93C. APT imported hash-bound main/universe amd64 indexes from a task-local file mirror and resolved the native dependencies without insecure options or changing system APT sources. Windows HTTPS supplied all77 required .debs (121,298,540 bytes), all five Rust1.98.1 Linux components bound to official manifest SHA256 a7c8774a5fd8441c997d94c029776cbc5eb111e9d72ab5d256fa69866644347e, and all462 exact8d55d2d Cargo.lock crate archives (71,341,076 bytes). Crate payload hashes match Cargo.lock; only targeted sparse index files and public config were copied, no credentials.
+## Installed and verified
 
-The worker paused guest work at a terminal boundary for root's user-authorized issue1/comment316 mirrored+dnsTunneling restart, then resumed only after root explicitly released the guest lease. Guest rehash of all77 .debs passed; ordinary APT unpack/configuration is currently running. Actual installed cc/pkg-config/Rust versions and all Linux application gates remain pending. Do not restart WSL during the active install.
+- Native GCC15.2.0-16ubuntu1 and pkg-config2.5.1; xkbcommon1.13.1, wayland-client1.24.0, vulkan1.4.341, X11 1.8.13. dpkg --audit returned no findings.
+- Actual rustc1.98.1 commit48a229ceaefd4985c50990b14116b6d856af0985, native hostx86_64-unknown-linux-gnu, LLVM22.1.8; cargo1.98.1 commit797e8a9bca276c1c9f9f738d2a20f484fa4eea9d, rustfmt1.9.0-stable and clippy0.1.98. All five official component installers succeeded.
+- Prefix /opt/arcadia-956atf/rust-1.98.1 and CARGO_HOME=/opt/arcadia-956atf/cargo. Source /opt/arcadia-956atf/env.sh in one guest shell to select them. All462 exact archived8d55d2d Cargo.lock crate archives were verified after copying into the Linux filesystem; targeted sparse index entries and public registry configuration only, no credentials.
 
-Durable source report: harness/release-linux-dependencies-956atf-20260911.md. Private evidence under .local/wsl-956atf-20260911/dependencies includes metadata-manifest.json, prepare-apt.log, package-uris.txt, packages-manifest.json, install-apt.log, rust-manifest.json and cargo-cache-complete-manifest.json, plus preserved failed download logs. Ordinary explicit Windows IPv4 downloads resolved prior default-address connection timeouts; this worker changed no OS/VPN/firewall/security/network configuration. Setup does not establish Ubuntu24.04 compatibility, compilation, GUI, packaging or release acceptance.
\ No newline at end of file
+## Verification chain
+
+Windows HTTPS supplied original signed resolute/resolute-updates/resolute-security InRelease and main/universe amd64 Packages.xz files. Guest gpgv accepted every signature using installed Ubuntu archive key fingerprint F6ECB3762474EDA9D21B7022871920D1991BC93C. APT imported the signed/hash-bound indexes through a task-local file mirror, resolved and installed77 hash-verified .debs121,298,540 bytes with normal enforcement. System APT sources were unchanged; no insecure/trusted/unsigned bypass. Official Rust1.98.1 manifest SHA256 a7c8774a5fd8441c997d94c029776cbc5eb111e9d72ab5d256fa69866644347e matched publisher HTTPS checksum, all components matched that manifest, then guest rehash passed before installers. Crate payload hashes match Cargo.lock;421 reused archives plus41 ordinary official downloads, total71,341,076 bytes.
+
+Installed rustc SHA256859254978c0a0402c32f949f6de0d99aee73be8d15f45aac00ae1448aac51e74; Cargo SHA256da77c8b33849312255ccde3179198ada4c8deb370488d050286146b1d1b27e14. Successful APT log SHA256e42bb5583896d4d59b2c9c0e079e08cb77b1eff12c6d6c7092256ab7567ad357; Rust/cache log SHA256221665be74dd00ccdfb7b2897afac0aef178114b63c7ecbed38607dfeecb09ea.
+
+## Root handoff and limits
+
+Durable report [harness/release-linux-dependencies-956atf-20260911.md](http://217.177.34.108:3000/sorokin.oleg.edu/ARCADIA-Studio/src/branch/codex/release1-956atf/harness/release-linux-dependencies-956atf-20260911.md) includes exact manifest hashes, failed approaches and the unexecuted first native build command. It awaits root's Git publication. Private original signed mirror, downloads, manifests, scripts and raw logs remain under .local/wsl-956atf-20260911/dependencies. No cleanup/deletion or worker Git action occurred.
+
+Root's exact source archive is .local/wsl-956atf-20260911/source-8d55d2d.tar, SHA256b7a11cc7f0ac56c0f8fded46b040665ae75ee55775ae429dfc8579a5d51ead57. Extract a fresh /opt/arcadia-956atf/source-8d55d2d, source the environment, then CARGO_BUILD_JOBS=1 CARGO_TARGET_DIR=/opt/arcadia-956atf/target-8d55d2d cargo build --locked --offline --workspace --bins. This is prepared, never run by the worker; the archive excludes later uncommitted focus/isolated schema8/canvas changes. Native build/tests, GUI/WSLg/portal behavior, optimized packaging, current-source integration and Ubuntu24.04 compatibility remain unaccepted.
+
+The worker safely paused for root's user316 networking restart, resumed only after explicit release and sent another terminal acknowledgment after installation. Root may now execute the separately authorized user328 VirtioProxy restart. No worker OS/VPN/firewall/security/network changes or VPN inspection. Prior networking failure remains separate from successful offline setup; the root-session warning persisted but commands succeeded.
\ No newline at end of file