# Workstation extension acceptance

Development reference and historical context. For current operating instructions, use the [user manual](../README.md). Acceptance applies only to the source and artifacts identified in each record.


**Software acceptance passed on 2026-09-21.** This record covers the new native
Linux software/cartridge builder, whole-image writer, public QEMU emulator and
guest software runtime. It is separate from the immutable local 0.1.0 release.

The host was Arch Linux x86_64, with QEMU 11.1.1 and erofs-utils 1.9.4. The public
workstation tools use ordinary Linux interfaces and distribution tools; other
Linux distributions and ARM workstations have not been exercised in this run.
The guest tests used the actual FDS Pi kernel, current initramfs and current CLI
SYSTEM on QEMU `virt`. The separate native-init test used its documented generic
ARM kernel fixture. Neither environment substitutes for physical Pi testing.

## Workstation and emulator evidence

| Check | Result and evidence |
| --- | --- |
| Typed Rust interfaces and archive contracts | **62 tests passed** across all host-testable workspace crates; `out/logs/workstation-all-rust-tests.log`. The architecture-restricted smoketest is validated separately by the ARM build. |
| Workstation builds and images | `out/workstation-images.5jczgwr7/acceptance.json` and `commands.log`; the recorded CLI SHA-256 matches the delivered `fds-cartridge` binary. |
| Public emulator lifecycle | `out/emu-test.36iqvx0j/acceptance.json`, `inputs.sha256`, `commands.log` and serial logs. The input hash matches the delivered `fds-emulator` binary. |
| Exact documentation examples | `out/logs/workstation-documented-example.log`; the compiled C program and report script were packaged into `out/demo-tools.img`, booted, run as UID 1000, safely ejected and shut down. |
| Incompatible initramfs | `out/emu-old-initramfs-final/console.log`; start promptly reports the complete unsupported boot-option diagnostic and stops the failed VM. |
| Current build inventory | `out/manifests/workstation-acceptance.json`, `workstation-artifacts.sha256` and `workstation-sources.sha256`. These are local evidence records, not a new signed release. |

The host suite executed a real AArch64 build recipe and packaged a portable
script. It built both separate-payload three-partition images and shared-payload
two-partition images; unchanged recipes produced identical bytes. Independent
`sfdisk`, `xz` and `tar` checks passed. Whole-image writes to exact-size and larger
disposable files passed flush/readback and backup-GPT checks.

Negative checks covered wrong confirmations, changed source images, stale target
previews, corrupt GPT, corrupt archives, invalid catalogue mappings, ELF files in
an architecture-independent bundle, escaping source symlinks, unsafe archive
paths/types, privileged modes, incorrect lengths/counts, trailing content and a
file replacing an implied parent directory. Existing writer failure tests remain
passing. The final host suite also uses the relative image-tool runner shown in
the guide, including extraction inside the inspection sandbox.

The emulator suite exercised **all twelve virtual USB bays**, catalogue reporting,
execution from both payload partitions and from shared partitions, read-only
runtime caches, safe eject, forced removal during execution, and reinsertion.
It verified that managed consumers and mounts disappear and that QEMU retains
only the SYSTEM block nodes after removal. It also checked literal guest
arguments, guest exit statuses, interactive console detach and terminal-state
restoration, DATA overlays preserving their original image, and native shutdown
with active software.

Normal-image workflows used the ordinary FDS user. A **separate test-only admin
console image** exercised service interruption/restart cleanup, unexpected
payload mount refusal and on-target PROGRAM creation rejection. That admin
console is not part of the delivered base SYSTEM.

## Regression commands completed

| Command | Evidence log under `out/logs/` |
| --- | --- |
| `make bootstrap` | `workstation-bootstrap.log` |
| `make smoke-test` | `workstation-smoke-test.log` |
| `make check` | `workstation-check.log`; final Rust formatting also passed |
| `make rootfs PROFILE=cli` | `workstation-rootfs-cli-accepted.log` |
| `make system-card PROFILE=cli` | `workstation-system-cli-accepted.log` |
| `make initramfs` | `workstation-initramfs.log` |
| `make rootfs-test` | `workstation-rootfs-test-accepted.log` |
| `make init-test` | `workstation-init-test-accepted.log` |
| `make tooling-test` | `workstation-tooling-test.log` |
| `make boot-test` | `workstation-boot-test.log` — all nine boot cases passed |
| `make cartridge-test` | `workstation-cartridge-test.log` |
| `make data-test` | `workstation-data-test.log` |
| `make media-image-test` | `workstation-media-image-test.log` |
| `make media-test` | `workstation-media-test-accepted.log`, including actual SYSTEM write/readback and boot |
| `make power-test` | `workstation-power-test.log` |
| `make desktop-test` | `workstation-desktop-test.log` |
| `make workstation-test` | `workstation-release-final.log` |
| `make emulator-test` | `workstation-emulator-final.log` |

The legacy media tests now require PROGRAM creation to fail inside FDS while
retaining prepared-image writing and legacy application execution. New software
creation is exercised through the native workstation tool. The ARM CLI test also
checks the explicit emulator boot option alongside strict invalid-option rejection.

The final CLI rootfs is `out/rootfs-build.KfWKvx/rootfs-aarch64.tar`; its SYSTEM
is `out/system-build.u1050ckh/system.img`. The matching emulator initramfs is
`out/initramfs-build.y6x9022y/initramfs.cpio`. Public convenience paths point to
these accepted artifacts. Upstream Void tracked files remain unchanged at
`02a3cbc132c3c4a3a9d59e9b98f517af5dd11cd1`.

## Skips and hardware boundary

M0's optional host `qemu-aarch64` execution was skipped because that command is
not installed in the host PATH; ARM static/glibc compilation and ELF validation
passed. The required guest tests ran separately through the project-local QEMU.

These checks do not measure Pi boot/shutdown speed, RP1 USB behavior, USB power
cycling, real drive writeback, physical bay wiring, or Dasung display recovery.
Use the [new software-cartridge hardware procedure](workstation.md#physical-pi-acceptance-procedure-deferred),
[stress procedure](stress-testing.md), and [Dasung guide](dasung.md) for those
checks. No physical USB disk or EEPROM was written. The frozen 0.1.0 release and
its source/build-input archives remain unchanged; it does not include this extension.