Correct the runtime bundle's glibc rule: the JDK vendor sets the floor

ADR 0006 assumed the bundle inherits the build machine's glibc, which would
have blocked the Hostsharing Managed Webspace (glibc 2.36, dev machine 2.39).
Measuring all 33 ELF files of the produced bundle shows GLIBC_2.15 as the
highest required symbol version: jlink copies Temurin's prebuilt binaries
instead of compiling, so the floor is the JDK vendor's build environment and
the build machine's glibc is irrelevant unless the toolchain resolves to a
distribution-packaged JDK.

Co-Authored-By: Claude <noreply@anthropic.com>

docs/adrs/0006-2026-08-10.runtime-bundle-distribution.md

@@ -36,7 +36,11 @@ Bad:
 
 - A directory tree, not a single file (still one tarball to copy).
 - JVM startup (~1-2 s) instead of native-image startup — irrelevant for a long-running server.
-- The jlink image links glibc dynamically: build on glibc ≤ target (Ubuntu 24.04 dev machine: 2.39; vm4006 Debian 13: 2.41 — compatible), same architecture.
+- The jlink image links glibc dynamically, so it is bound to an architecture and a minimum glibc.
+  Corrected on 2026-08-11: that minimum is **not** the build machine's glibc, as originally assumed here.
+  `jlink` compiles nothing — it copies the JDK vendor's prebuilt binaries out of the jmods, so the floor is the vendor's build environment.
+  Measured over all 33 ELF files of the bundle produced by the Temurin 21 toolchain, the highest required symbol version is `GLIBC_2.15`, which every supported distribution exceeds.
+  The build machine's glibc only matters if the toolchain resolves to a distribution-packaged JDK instead of Temurin.
 
 ### GraalVM Native Image
 

docs/plan/17-bwrap-build-runtime.md

@@ -43,9 +43,10 @@ The host runs `bubblewrap 0.8.0` on kernel `6.1.0-52-amd64`.
 Every option of the invocation below exists in 0.8.0 (`--die-with-parent` since 0.4.0, the rest is older), so the design stands as written.
 What 0.8.0 lacks is overlayfs (`--overlay`, added in 0.9.0): a future "throwaway writable rootfs per build" cannot be built from an overlay here, only from tmpfs mounts over the writable spots.
 
-**Consequence for the runtime bundle — verify before deploying:** kernel 6.1 means Debian 12 and therefore most likely glibc 2.36, while the dev machine builds the jlink bundle against glibc 2.39.
+**The runtime bundle runs there — checked, not assumed.** The webspace has glibc 2.36 (Debian 12), below the dev machine's 2.39, which by ADR 0006's original wording would have ruled the bundle out.
-ADR 0006 requires building on glibc ≤ the target's, which holds for vm4006 (2.41) but not for such a webspace — the JRE would fail to start.
+That wording was wrong and has been corrected: the bundle's highest required symbol version is `GLIBC_2.15`, because `jlink` copies Temurin's prebuilt binaries rather than compiling anything.
-Confirm with `ldd --version` on the target and, if it is below 2.39, build the bundle in an older base image (e.g. `eclipse-temurin:21-jdk-jammy`, glibc 2.35) instead of on the dev machine.
+So no container build and no second build machine are needed for this platform.
+The bundle's `java.desktop` module does carry X11, ALSA and freetype dependencies, but only in the AWT libraries, which a headless GitTally never loads — as on vm4006.
 
 ## Goal