Record optimized WSL verification of GLib iterator backport

docs/DEPENDENCY-REVIEW.md

@@ -5,7 +5,7 @@ by the desktop lockfile. Root independently verified all 121 original archive
 members and the exact two-line patch using `tools/glib-regression/verify_vendor.py`.
 The patched source retains original LF bytes; provenance records were updated
 after removing an unintended Windows newline conversion. Optimized Linux tests
-and native desktop validation remain pending; the broad security gate stays open.
+now pass; native desktop validation and the broad security gate stay open.
 
 Recorded 2026-10-13 against commit `4e60038c2f3b0a7b1d2dd0f4361309a735ee140f`.
 This is an advisory inventory and dependency-path review, not a complete security
@@ -198,7 +198,7 @@ The cost is explicitly owning a small documented vendor patch and its future
 review; root coordination and actual Linux validation are required before
 claiming remediation.
 
-## Prepared local backport (execution pending)
+## Local backport and optimized Linux execution
 
 The desktop manifest now overrides GLib with `vendor/glib`. All 121 upstream
 files were compared byte-for-byte with the official archive; the only difference
@@ -211,6 +211,21 @@ source. The all-target inverse graph selects it for every GTK/WebKit consumer.
 
 An isolated `tools/glib-regression` harness and lockfile are prepared for actual
 optimized Linux execution, including an owner-lifetime compile-fail doctest.
-No Linux compilation/test or native desktop check has been executed for this
-backport yet. The advisory remains recorded as unresolved validation, and the
-separate macro maintenance notice remains open.
+Actual optimized execution passed in Ubuntu 24.04 WSL on 2026-10-13: all three
+unit tests and the owner-lifetime compile-fail doctest passed. The inverse graph
+confirmed the selected local GLib 0.18.5 package. The archive verifier again
+confirmed all 121 official files and only the exact two-line fix; harness source
+and lockfile matched the repository byte-for-byte before execution.
+
+Rust 1.99.0, system GLib 2.80.0; one Cargo build job, no inference or GPU.
+After downloading a missing locked dependency, the recorded repeat used
+`--release --locked --offline --jobs 1` and passed. The upstream crate emitted
+34 compiler warnings; this is not a warning-free Clippy result. Its official
+source was not reformatted or otherwise edited to suppress those warnings.
+
+Raw WSL evidence:
+`/home/karl/.cache/searchi-validation/glib-optimized-20261013.log`, SHA-256
+`98ce2a1580e6b73f58040d6efefdbdcc2dcb5e2cab6f64dc88d8a9424a0031dc`.
+This validates the focused iterator regression, not all GLib memory safety or
+the patched native desktop. Desktop interaction, broad security review and the
+separate macro maintenance notice remain open.