@@ -102,11 +102,19 @@ jobs:
 
       # --overwrite is not optional. Without it, and with a release directory already
       # present, mix release prompts, gets no stdin, and exits 0 having built nothing.
+      # Slice 013: on Linux, mdex's NIF is built from source for Burrito's musl ERTS, linked
+      # through Zig (scripts/zig-cc-musl; config/config.exs names the three settings and
+      # NOTES.md finding 14 the measurement). rustup installed the musl standard library from
+      # rust-toolchain.toml above. macOS and Windows load the precompiled artifact for their
+      # native ERTS; the smoke step below is what says whether it loaded.
       - name: Build the Burrito binary
         shell: bash
         env:
           BURRITO_TARGET: ${{ matrix.target }}
           MIX_ENV: prod
+          MDEX_NATIVE_BUILD: ${{ runner.os == 'Linux' && '1' || '' }}
+          TRINITY_NIF_TARGET: ${{ runner.os == 'Linux' && 'x86_64-unknown-linux-musl' || '' }}
+          CARGO_TARGET_X86_64_UNKNOWN_LINUX_MUSL_LINKER: ${{ runner.os == 'Linux' && format('{0}/scripts/zig-cc-musl', github.workspace) || '' }}
         run: |
           set -euo pipefail
           # `mix deps.get` above runs in the default env. On the Windows runner the prod build
@@ -188,6 +196,8 @@ jobs:
           sleep 3
           ours > ps-after.txt
           grep -q '^TRINITY_SMOKE_PORT=[0-9][0-9]*$' smoke.log
+          # Slice 013: the renderer's NIF loaded and rendered in this binary (exit 3 otherwise).
+          grep -q '^TRINITY_SMOKE_MARKDOWN=ok$' smoke.log
           echo "--- ours, before ---"; cat ps-before.txt
           echo "--- ours, after ----"; cat ps-after.txt
           diff ps-before.txt ps-after.txt
@@ -202,6 +212,9 @@ jobs:
           if (-not (Select-String -Path smoke.log -Pattern '^TRINITY_SMOKE_PORT=\d+$')) {
             throw "no port line"
           }
+          if (-not (Select-String -Path smoke.log -Pattern '^TRINITY_SMOKE_MARKDOWN=ok$')) {
+            throw "the markdown renderer did not render in this binary (slice 013)"
+          }
 
       # AC1's property on a runner, and AC6's per-OS cold start, which used to be skipped.
       # `bash` on every OS, Windows included: the job that never curled was the one gap in
 
@@ -134,7 +134,8 @@ never pin a version hex marks as retired or vulnerable.
 | `nostrum` | ~> 0.10 | 🔍 not yet a dependency | Discord. ⚠️ No release in roughly 18 months. R11's trigger already fires. Check intents and components against the current gateway before Slice 072. |
 | `telegex` | **not pinned** | 🔍 not a single package | Telegram. ⚠️ The latest release on hex is a release candidate, roughly two years old, and this file's own rule forbids pinning an `-rc`. Alternative: ex_gram. Slice 071 decides with the measurement. |
 | `phoenix_streamdown` | not used (measured at Slice 013, 2026-09-20) | 🔍 not a single package | Streaming markdown renderer for LiveView. Measured at Slice 013: 1.0.0-beta.4 (2026-05-03) was still the latest release with no stable behind it, and this file's own rule forbids a pre-release. It is 801 lines over `mdex`, whose own `streaming: true` option completes fragments; the rest is a rendering rule Slice 013 keeps anyway. The row stays so the decision is visible where a reader would look for the package. |
-| `mdex` | ~> 0.13 | ✅ in `mix.lock` | Markdown renderer for the chat (`TrinityWeb.Markdown`), streaming fragments completed by its `streaming: true` option, raw HTML omitted (`unsafe: false`) and the default sanitizer on top. Added at Slice 013 after the measurement in its NOTES.md: `earmark` 1.4.49 is retired on hex with an open XSS advisory (EEF-CVE-2026-48591), which the gate refuses. ⚠️ A Rust NIF (`mdex_native`, precompiled through `rustler_precompiled` for the four packaging targets): the first NIF in the bundle; the `package` workflow proves it on three operating systems, cited in Slice 013's PROOF.md. |
+| `mdex` | ~> 0.13 | ✅ in `mix.lock` | Markdown renderer for the chat (`TrinityWeb.Markdown`), streaming fragments completed by its `streaming: true` option, raw HTML omitted (`unsafe: false`) and the default sanitizer on top. Added at Slice 013 after the measurement in its NOTES.md: `earmark` 1.4.49 is retired on hex with an open XSS advisory (EEF-CVE-2026-48591), which the gate refuses. ⚠️ A Rust NIF (`mdex_native`): the first in the bundle. Measured at Slice 013 (NOTES finding 13): neither precompiled artifact loads in Burrito's musl ERTS on Linux, so the linux package builds it from source for musl with Zig as the linker (`rustler` below, `scripts/zig-cc-musl`, the three settings in config/config.exs); macOS and Windows load the precompiled artifact. The `--smoke` path prints whether it rendered, and the `package` workflow reads that line on every target. |
+| `rustler` | ~> 0.38 | ✅ in `mix.lock` | Build time only (`runtime: false`): what `rustler_precompiled` needs to compile `mdex_native` from source when `MDEX_NATIVE_BUILD=1`, which the linux package sets (owner decision 2026-09-20, Slice 013 NOTES finding 14). Nothing in the tree calls it. |
 
 ### Dev and quality
 
 
@@ -36,6 +36,20 @@ config :trinity,
           other -> raise "TRINITY_DB must be sqlite or postgres, got #{inspect(other)}"
         end)
 
+# Slice 013 (owner decision, 2026-09-20): the packaged Linux binary runs on Burrito's musl ERTS,
+# in which neither precompiled mdex_native artifact loads (both need glibc's libgcc_s), so the
+# linux package builds that NIF from source for the musl target with Zig as the linker
+# (NOTES.md finding 14). Three settings travel together, all compile time:
+#   MDEX_NATIVE_BUILD=1                                  mdex_native compiles instead of downloading
+#   TRINITY_NIF_TARGET=x86_64-unknown-linux-musl         the cargo target, given to Rustler here
+#   CARGO_TARGET_X86_64_UNKNOWN_LINUX_MUSL_LINKER=scripts/zig-cc-musl
+# Unset, development and the test gate use the precompiled artifact for the host as before.
+nif_target = System.get_env("TRINITY_NIF_TARGET", "")
+
+if nif_target != "" do
+  config :mdex_native, MDExNative.Native, target: nif_target
+end
+
 # Slice 011: the model registry lives in its own file so the live test suite can read it
 # without evaluating the environment-specific imports below.
 import_config "llm.exs"
 
@@ -22,4 +22,5 @@
 | R21 | The tree carries IP that is not this project's to publish | Med | High | Any design in Trinity that reproduces a third party's protected mechanism | Trinity's receipt and policy design is its own. Policy identifiers stay out of `signed_payload` until legal review clears them; 024's field set is reviewed before that slice starts | 024, 120, 122 |
 | R22 | Single maintainer; Growth needs two unaffiliated production users and commits from two orgs | High | Med | 6-month Sandbox checkpoint | Sandbox tolerates it; GOVERNANCE.md documents intent to grow; recruit co-maintainers via the Elixir community once public | 120, 122 |
 | R24 | A native NIF in the desktop bundle: `mdex_native` (the markdown renderer's Rust core, added at 013) is the first, and slice 001 proved the packaging chain with a pure-BEAM release | Med | Med | The `package` workflow fails on one of its three operating systems after 013, or 100's cross-target build finds no artifact for a target | `rustler_precompiled` ships artifacts for every target the chain builds for (013 NOTES.md, measured against the checksum file); the `package` run on 013's `mix.lock` change is the first proof on three runners; lift condition: that run green on all three, cited in 013's PROOF.md; a fallback is `MDEX_NATIVE_BUILD=1` with the pinned Rust toolchain already in the tree | 013, 100 |
+| R24 | Fired 2026-09-20, in slice 013: neither precompiled `mdex_native` artifact loads in Burrito's musl ERTS (both need glibc's `libgcc_s`; `_dl_find_object: symbol not found`). Lifted the same day by the owner's decision: the linux package builds the NIF from source for musl with Zig as the linker (`scripts/zig-cc-musl`, config/config.exs, `rustler` at build time), measured on a fresh install of the packaged binary rendering the real provider's answer; the `--smoke` path now prints `TRINITY_SMOKE_MARKDOWN=ok` and exits 3 otherwise, and the `package` workflow reads that line on every target, so a dead NIF cannot pass again. Residual: macOS and Windows use the precompiled artifact, and the `package` workflow has yet to run green there since the slice/011 tag (an older failure at "Serves HTTP 200", now diagnosed by the step's log). The row above stands as written | none | none | none | none | 013 |
 | R23 | EMA / ID-JAG is beta everywhere (vendors label it so); IETF draft still moving | Med | Med | Spec revision breaks the exchange | Keep the AS small and behaviour-driven; pin the draft version in the ADR; conformance tests against two IdPs' documented flows | 062 |
@@ -168,3 +168,29 @@ something it is not.
 A screenshot of a real window on a real desktop does not exist for macOS, Windows or Linux, and
 Slice 001 exits saying so rather than counting those criteria as met.
 
+
+## Native code in the bundle (slice 013)
+
+Burrito's Linux ERTS is a musl build, and every NIF in the bundle has to be one too. Burrito cross-compiles C
+NIFs (exqlite) with Zig by itself; a Rust NIF it does not touch. `mdex_native` (the markdown renderer's core)
+ships precompiled artifacts, and neither the gnu nor the musl one loads in that ERTS: both need glibc's
+`libgcc_s.so.1` (`_dl_find_object: symbol not found`). The linux package therefore builds it from source for
+`x86_64-unknown-linux-musl` with Zig as the linker:
+
+```
+MDEX_NATIVE_BUILD=1 TRINITY_NIF_TARGET=x86_64-unknown-linux-musl \
+CARGO_TARGET_X86_64_UNKNOWN_LINUX_MUSL_LINKER=$PWD/scripts/zig-cc-musl \
+MIX_ENV=prod BURRITO_TARGET=linux_x86_64 mix release desktop --overwrite
+```
+
+`rust-toolchain.toml` names the musl target so rustup installs its standard library; `rustler` is a build-time
+dependency for this alone. The result needs `libc.so` only (`readelf -d`), the same shape as the exqlite NIF.
+macOS and Windows load the precompiled artifact for their native ERTS. Whether it loaded is not inferred from
+a boot: `--smoke` prints `TRINITY_SMOKE_MARKDOWN=ok` after rendering one line through the NIF and exits 3
+otherwise, and the `package` workflow's smoke step reads that line on every target.
+
+Two things measured on the way (slice 013 NOTES.md, findings 12 to 14): Burrito reuses the payload it
+extracted to `~/.local/share/.burrito/<name>_erts-<v>_<app v>` for as long as the app version stays the same,
+so a local run of a new binary at the same version runs the old code until that directory is removed; and the
+Burrito wrapper starts `erlexec` directly, so `RELEASE_NAME` is unset in the packaged app (the migrator no
+longer keys on it).
@@ -55,17 +55,37 @@ defmodule Trinity.Smoke do
   @spec port_line(:inet.port_number()) :: String.t()
   def port_line(port), do: "TRINITY_SMOKE_PORT=#{port}"
 
+  @doc """
+  The second line (slice 013): whether the markdown renderer's NIF loaded and rendered in this
+  binary. A packaged build whose NIF fails to load still boots and serves, showing escaped
+  text instead of markdown (NOTES.md finding 13), so booting proves nothing about it; this
+  does. `ok` or `failed:<reason>`, one line, no prose.
+  """
+  @spec markdown_line() :: String.t()
+  def markdown_line do
+    case MDEx.to_html("**smoke**", render: [unsafe: false]) do
+      {:ok, html} ->
+        if html =~ "<strong>smoke</strong>",
+          do: "TRINITY_SMOKE_MARKDOWN=ok",
+          else: "TRINITY_SMOKE_MARKDOWN=failed:#{inspect(html)}"
+
+      {:error, reason} ->
+        "TRINITY_SMOKE_MARKDOWN=failed:#{inspect(reason)}"
+    end
+  end
+
   @doc """
   Runs the smoke check: report the listening port, then stop the OS process.
 
   `say` and `halt` are injected so the whole path is exercisable from a test without ending
   the test runner's own OS process.
   """
-  @spec run(say_fun(), halt_fun()) :: any()
-  def run(say \\ &IO.puts/1, halt \\ &System.halt/1) do
+  @spec run(say_fun(), halt_fun(), String.t()) :: any()
+  def run(say \\ &IO.puts/1, halt \\ &System.halt/1, markdown \\ markdown_line()) do
     {:ok, {_ip, port}} = TrinityWeb.Endpoint.server_info(:http)
     say.(port_line(port))
-    halt.(0)
+    say.(markdown)
+    halt.(if markdown == "TRINITY_SMOKE_MARKDOWN=ok", do: 0, else: 3)
   end
 
   @doc """
@@ -79,8 +99,19 @@ defmodule Trinity.Smoke do
   the VM from within the OTP boot sequence: a boot crash rather than a clean exit. `ps`
   cannot tell those apart from the outside; the exit code can, and AC7 reads both.
   """
+  #
+  # The markdown line is computed here, inside `Trinity.Application.start/2`, not in the Task:
+  # `Kernel.CLI` reads the same plain arguments once the application has started and treats
+  # `--smoke` as a file to run ("No file named --smoke", exit 1), so the Task wins only by
+  # halting at once. Measured at slice 013 when a few milliseconds of rendering inside the
+  # Task lost that race on the first packaged run.
   @spec children([String.t()]) :: [Supervisor.child_spec() | {module(), term()}]
   def children(args) do
-    if requested?(args), do: [{Task, &run/0}], else: []
+    if requested?(args) do
+      markdown = markdown_line()
+      [{Task, fn -> run(&IO.puts/1, &System.halt/1, markdown) end}]
+    else
+      []
+    end
   end
 end
@@ -265,7 +265,14 @@ defmodule Trinity.Versions do
       pin: "~> 0.13",
       lock: "mdex",
       note:
-        "Markdown renderer for the chat (`TrinityWeb.Markdown`), streaming fragments completed by its `streaming: true` option, raw HTML omitted (`unsafe: false`) and the default sanitizer on top. Added at Slice 013 after the measurement in its NOTES.md: `earmark` 1.4.49 is retired on hex with an open XSS advisory (EEF-CVE-2026-48591), which the gate refuses. ⚠️ A Rust NIF (`mdex_native`, precompiled through `rustler_precompiled` for the four packaging targets): the first NIF in the bundle; the `package` workflow proves it on three operating systems, cited in Slice 013's PROOF.md."
+        "Markdown renderer for the chat (`TrinityWeb.Markdown`), streaming fragments completed by its `streaming: true` option, raw HTML omitted (`unsafe: false`) and the default sanitizer on top. Added at Slice 013 after the measurement in its NOTES.md: `earmark` 1.4.49 is retired on hex with an open XSS advisory (EEF-CVE-2026-48591), which the gate refuses. ⚠️ A Rust NIF (`mdex_native`): the first in the bundle. Measured at Slice 013 (NOTES finding 13): neither precompiled artifact loads in Burrito's musl ERTS on Linux, so the linux package builds it from source for musl with Zig as the linker (`rustler` below, `scripts/zig-cc-musl`, the three settings in config/config.exs); macOS and Windows load the precompiled artifact. The `--smoke` path prints whether it rendered, and the `package` workflow reads that line on every target."
+    },
+    %{
+      name: "rustler",
+      pin: "~> 0.38",
+      lock: "rustler",
+      note:
+        "Build time only (`runtime: false`): what `rustler_precompiled` needs to compile `mdex_native` from source when `MDEX_NATIVE_BUILD=1`, which the linux package sets (owner decision 2026-09-20, Slice 013 NOTES finding 14). Nothing in the tree calls it."
     }
   ]
 
 
@@ -11,6 +11,8 @@ defmodule TrinityWeb.Markdown do
   in-progress message uses; a finished message renders without it, once.
   """
 
+  require Logger
+
   # Sobelow reads `@sobelow_skip` from the source; the compiler would call it unused (the same
   # measure `Trinity.Paths` takes, slice 001 line 4).
   Module.register_attribute(__MODULE__, :sobelow_skip, persist: true)
@@ -36,10 +38,20 @@ defmodule TrinityWeb.Markdown do
     ]
 
     case MDEx.to_html(markdown, options) do
-      {:ok, html} -> Phoenix.HTML.raw(html)
-      # A parse failure is the renderer's, not the text's: show the text escaped rather than
-      # nothing, so a message is never blank on screen.
-      {:error, _} -> Phoenix.HTML.html_escape(markdown)
+      {:ok, html} ->
+        Phoenix.HTML.raw(html)
+
+      # A failure is the renderer's, not the text's: show the text escaped rather than nothing,
+      # so a message is never blank on screen, and say so once at :error, because the one
+      # failure seen so far was a NIF that did not load in a packaged binary (NOTES finding
+      # 13), which must never pass for a rendering choice.
+      {:error, reason} ->
+        unless :persistent_term.get({__MODULE__, :failed}, false) do
+          :persistent_term.put({__MODULE__, :failed}, true)
+          Logger.error("markdown renderer failed; showing escaped text: #{inspect(reason)}")
+        end
+
+        Phoenix.HTML.html_escape(markdown)
     end
   end
 end
@@ -103,6 +103,11 @@ defmodule Trinity.MixProject do
       # Slice 013: the chat's markdown renderer, behind TrinityWeb.Markdown. Chosen by the
       # measurement in the slice's NOTES.md; it brings a Rust NIF (mdex_native), precompiled.
       {:mdex, "~> 0.13"},
+      # Slice 013 (owner decision, 2026-09-20): the linux package builds mdex's NIF from
+      # source for musl (MDEX_NATIVE_BUILD=1 and TRINITY_NIF_TARGET in config/config.exs),
+      # because neither precompiled artifact loads in Burrito's musl ERTS (NOTES finding 13).
+      # rustler_precompiled needs Rustler present to run that build; build time only.
+      {:rustler, "~> 0.38", runtime: false},
       {:phoenix_html, "~> 4.1"},
       {:phoenix_live_reload, "~> 1.2", only: :dev},
       {:phoenix_live_view, "~> 1.2.0"},