Test coordination: bundle-4.0-icu70 (D.3 candidate, awaiting independent tester)

## Context

PR #2 ([`Proposal: bundle-4.0-icu70`](https://github.com/airvzxf/icaclient-aur/pull/2)) is **merged** with variant D.3 in [`pkgbuilds/bundle-4.0-icu70/`](../tree/main/pkgbuilds/bundle-4.0-icu70). The strategy is in [`docs/alternatives.md`](../blob/main/docs/alternatives.md) section D.3; the implementation plan in [`docs/d3-bundle-implementation-plan.md`](../blob/main/docs/d3-bundle-implementation-plan.md); the CHANGELOG entry in [CHANGELOG.md → 2026-06-15](../blob/main/CHANGELOG.md).

**Current status:** `candidate` (PKGBUILD in the repo, pending independent validation before promoting to `accepted` and submitting to buzo).

## What is needed

`status:candidate` requires at least one independent tester (not the author) with a different environment from the dev host. The dev host is x86_64 with Wayland + PipeWire + NVIDIA. **Any** different combination works: different distro, X11 instead of Wayland, AMD/Intel instead of NVIDIA, aarch64, different StoreFront, different network (corporate proxy, etc.).

## Gates already passed by the author (2026-06-15)

| Gate | Result |
|---|---|
| L0 namcap | clean (no `E:`, no `W:`) |
| `bash -n PKGBUILD` | OK |
| L2 chroot build (`makechrootpkg`) | 33–46 s, target <5 min |
| L2 chroot install (`pacman -U`) | clean |
| S1 selfservice launches | ✅ `/proc//maps` shows `libwebkit2gtk-4.0.so.37` and `libsoup-2.4.so.1` loaded from the bundle |
| S2 wfica opens `.ica` | ✅ live process, `.ica` parsed |
| S3 dialog renders | ✅ `WebKitWebProcess` / `WebKitNetworkProcess` as children of wfica |
| S4 install without AUR webkit | ✅ chroot `base+base-devel` (without `webkit*`/`soup*`); `ldd` resolves D.3 deps from the bundle |
| S5 build time | ✅ 33–46 s |
| S7 no new deps | ✅ `pacman -Qe` differs only in `icaclient` |
| libsoup `.deb` sha256 | ✅ verified against `deb.debian.org` for amd64 (`d3eac276…`) and arm64 (`e3a1948a…`) |

## Pending gates (what an independent tester needs)

### S6 — Real Citrix session (the most important)

**Why it's critical:** S1–S3 confirm that the binary starts, the `.so` loads, and the dialog enters rendering. **They do not** confirm that the TLS handshake with a real StoreFront works, that the `wfica` arguments reach the backend, or that a published desktop launches. This can only be validated against a real farm.

**How to test:**
1. Build and install on your machine (not in chroot):

git clone https://github.com/airvzxf/icaclient-aur
cd icaclient-aur/pkgbuilds/bundle-4.0-icu70
makepkg -si

2. Launch `selfservice`, add a real StoreFront (your company URL), authenticate, open a published desktop.
3. Capture:
- `journalctl --user -xe` during the launch
- `ls -la ~/.ICAClient/logs/` (Citrix logs)
- `ldd /opt/Citrix/ICAClient/selfservice | grep -E 'webkit|soup|icu'` (must resolve from the bundle)
4. Report using the template at [`test-report.md`](../blob/main/.github/ISSUE_TEMPLATE/test-report.md).

### aarch64 build (nice-to-have)

**Why:** the PKGBUILD is structured for multi-arch (`source_x86_64` / `source_aarch64`, `ARCH_MULTIARCH="${CARCH}-linux-gnu"`), but the dev host is x86_64. The arm64 sha256 of the libsoup `.deb` is committed, but the build itself has not been run.

**How to test:**
1. On an aarch64 machine (or an aarch64 chroot via `qemu-user` + `arch-chroot`):

cd pkgbuilds/bundle-4.0-icu70
makepkg -si

2. Capture build time (should be similar to x86_64) and `ldd` of the installed binary.
3. If you have a Citrix farm that also accepts aarch64 client, test S6 as well.

### Any extra scenario you can think of

If your machine diverges from the dev host in something not listed above (distro, GPU, display server, SELinux, AppArmor, user namespace, container with reduced capabilities, etc.), run the full S1–S5 + S7 battery and report. Environment divergences are where bugs appear.

## Testing matrix (to be filled by testers)

| Tester | Environment | S1 | S2 | S3 | S4 | S5 | S6 | S7 | Notes |
|---|---|---|---|---|---|---|---|---|---|
| airvzxf (author) | x86_64, Wayland, PipeWire, NVIDIA, dev host | ✅ | ✅ | ✅ | ✅ | ✅ 33–46 s | ⏭️ no farm | ✅ | baseline |
| _your row here_ | | | | | | | | | |

> If you prefer not to edit this issue directly, open a new issue with the `test-report.md` template and we'll link it here.

## Checklist to promote to `accepted`

Per [`CONTRIBUTING.md`](../blob/main/CONTRIBUTING.md) and the CHANGELOG 2026-06-15:

- [ ] S1–S5 + S7 run by at least one independent tester (different environment)
- [ ] S6 run by at least one tester with a real Citrix farm
- [ ] aarch64 build (nice-to-have, not blocking)
- [ ] No regressions reported on the `libsoup` hard dep
- [ ] (After all checks) contact buzo by email (`buzo+arch@Lini.de`, per `CONTRIBUTING.md` "Communication channels") to propose the final patch to AUR

## References

- PR: [#2](https://github.com/airvzxf/icaclient-aur/pull/2)
- Variant: [`pkgbuilds/bundle-4.0-icu70/`](../tree/main/pkgbuilds/bundle-4.0-icu70)
- CHANGELOG: [2026-06-15](../blob/main/CHANGELOG.md)
- Plan: [`docs/d3-bundle-implementation-plan.md`](../blob/main/docs/d3-bundle-implementation-plan.md)
- Tests: [`TESTING.md`](../blob/main/TESTING.md), [`docs/testing-infrastructure.md`](../blob/main/docs/testing-infrastructure.md)
- Workflow / labels: [`docs/workflow.md`](../blob/main/docs/workflow.md)