# 407 SYSROOT BUILD — canonical compile configuration

Status of claims in this file:
- VERIFIED = established directly from the 407 image / extracted sysroot.
- 407-SYSROOT COMPILED = rebuilt against the extracted 407 environment.

## 1. Sysroot provenance — VERIFIED

- Source: byte-identical working copy of the image, `/srv/beebo/407_audit/beebo_407.img`
  (sha256 `17fdb9c5e211677ed35d91500c9cb53b6ab26c2e7d6bdd49576baaf2cee4fc97`);
  original `/srv/beebo/beebo_407.img.gz` (sha256 `89eb3d51...`) untouched.
- Root partition: p2 (btrfs, 14 GiB, sector 204800 / byte offset 104857600),
  mounted **read-only** at `/mnt/beebo407-p2`.
- Sysroot created with symlinks/attrs preserved per brief §25:
  `rsync -aHAX --numeric-ids --exclude={/proc,/sys,/dev,/run} /mnt/beebo407-p2/ /srv/beebo/407_audit/sysroot/`
- Result: 11 GiB tree, includes `/usr/include` (glibc 2.36 headers, LV2 headers
  under `usr/include/lv2/`), `/usr/lib/aarch64-linux-gnu` shared+static libs,
  `/home/debian/UI` digit_ui sources.
- The mounted image and the loop mounts were never written to.

## 2. KEY FINDING — `--sysroot` alone does NOT redirect this toolchain — VERIFIED

`aarch64-linux-gnu-gcc` (Debian cross-gcc, **not** sysroot-configured) kept
compiling against its own `/usr/aarch64-linux-gnu/include` headers even with
`--sysroot` set. Proof: `gcc -H` showed `/usr/aarch64-linux-gnu/include/features.h`,
and a first rebuild still baked `fmod@GLIBC_2.38` / `sqrtf@GLIBC_2.43`
requirements — the host glibc ceiling, not the target's.

Fix (and it is the canonical configuration, see §4):

```
--sysroot=$SYS  -isystem $SYS/usr/include
-L $SYS/lib/aarch64-linux-gnu -L $SYS/usr/lib/aarch64-linux-gnu
```

## 3. KEY FINDING — broken absolute symlinks in a sysroot — VERIFIED

`$SYS/usr/lib/aarch64-linux-gnu/libm.so` is an **absolute symlink** to
`/lib/aarch64-linux-gnu/libm.so.6` (correct on the device; broken in a
sysroot, where `/lib` resolves against the build host and does not contain
that file). The linker then **silently fell back to static `libm.a`**,
baking libm's implementation into the plugin (observable as locally defined
`fmod`/`lrint` + no `libm.so.6` in DT_NEEDED).

Fix — rewritten to a relative link inside the sysroot only (the image is
not modified):

```
ln -sfn ../../lib/aarch64-linux-gnu/libm.so.6 \
    $SYS/usr/lib/aarch64-linux-gnu/libm.so
```

After that, plugins link against the shared 407 `libm.so.6` and the math
calls import as `fmod@GLIBC_2.17`, `sqrtf@GLIBC_2.17`, `expf@GLIBC_2.27`, …

Note: the same absolute-symlink pattern affects other dev symlinks in the
sysroot; only `libm.so` was needed for our four plugins.

## 4. Canonical build command — 407-SYSROOT COMPILED

```bash
aarch64-linux-gnu-gcc -std=c11 -O2 -Wall -Wextra -fPIC -shared \
  --sysroot=$SYS -isystem $SYS/usr/include \
  -L $SYS/lib/aarch64-linux-gnu -L $SYS/usr/lib/aarch64-linux-gnu \
  -I <tree>/beebo/tests/lv2 -I <tree>/beebo/lv2/$p.lv2 \
  <tree>/beebo/lv2/$p.lv2/$p.c -lm -o <out>/$p.so
```

Maintained script: `/srv/beebo/407_audit/rebuilt/build_407_sysroot.sh`.
Tree: `/root/beebo-work/beebo-v2.0.1` (commit `857dbf8`, VERSION 2.0.1-predevice).
No host headers or host libraries are copied or referenced.

## 5. Runtime sysroot vs development headers — VERIFIED

- The 407 image contains **both**: the runtime `libc6` 2.36 AND development
  pieces (`/usr/include` full glibc headers, `lv2.h` + LV2 extension headers,
  static libs). So no header contamination from the host was necessary —
  every header used to compile the plugins already existed in the 407 image.
- The only host-side inputs are the cross toolchain binaries
  (`aarch64-linux-gnu-{gcc,readelf,nm}`) — the compiler itself, never
  libraries or headers.

## 6. Artifacts — 407-SYSROOT COMPILED

`/srv/beebo/407_audit/rebuilt/`:

```
24956f55258285f885de2fe0b7c27d13fa5614dc2a318d2c70b172f3d3fbc55f  performance_buffer.so
769e3dd72fc772cc6527fba78ab0e25258b19eb43aac76d1512faa4c5af090ee  performance_granular.so
5a3d8bf08fee956c5db270ada25c638af49004898f948be372cc48b6900a1bde  performance_space.so
17954b6eeaed4da5ced834db91d7460a2c6978726f577c288acd6f01e95d7577  performance_spectral.so
```

ELF 64-bit LSB shared object, ARM aarch64. Verification:
`REBUILD_ABI_CHECK.txt` (ALL VERSION NEEDS SATISFIED), per-plugin
DT_NEEDED + symbol versions in `PLUGIN_COMPATIBILITY.md`.

## 7. Not claimed

- Runtime behaviour on the device (never executed; brief forbids running
  AArch64 binaries on the x86 host). Claim level is 407-SYSROOT COMPILED,
  not TARGET TESTED.
- The -O2 flag matches the project's host-tested build; no -O3/PGO work here.