Install it on a machine that has never heard of it

[tamnd]

The clean-machine install item of the client scorecard, which the table words as a nightly install test in a container holding the language runtime and nothing else.

Every job here so far runs against a checkout: the engine is built beside it, ZU_LIBRARY points at the library, and the suite is told where everything is so that it tests the binding rather than the search. That is the right shape for a test suite and it is not an answer to the question a new reader asks, which is whether three lines in a pom and a JDK are the whole of it.

So this answers it somewhere else. scripts/install.sh runs inside a container that holds a JDK and Maven and nothing else. It asserts what is absent before it does anything: no rustc, no cargo, no compiler of any kind, no libzu anywhere on the filesystem, no header, no pkg-config file, no ZU_LIBRARY. Then it lifts the quickstart off README.md character for character, lifts the dependency elements off the same page, writes a pom with nothing of ours in it, and builds against the artifacts this commit would publish, staged into a file repository standing in for Central. It runs the program in an empty directory somewhere else on the machine and compares what came out against the block the page says it prints.

Two rows. The claim this client makes that no other client of this engine makes is that it installs on a JDK from 17 and on a JDK from 25, over two different bindings, out of the same dependency. zudb-ffm on JDK 25 and zudb-jni on JDK 17 is what keeps that from being a paragraph. Both need a dependency element on the page to lift, so the page now prints one for the JNI pair as well, which a reader on 17 previously had to write from prose.

The last step is the one that matters most. It takes the library artifact off the classpath and asserts the run fails saying which artifact is missing, because a job that has only ever passed is a job nobody has watched fail. Both rows print this on the way out:

no provider could bind libzu at libzu.so, found through the platform library path.
Every provider refused. ffm: cannot load libzu.so: Cannot open library: libzu.so
Before that: -Dzu.library; then ZU_LIBRARY; then a zudb-native artifact for
linux-amd64, which was not on the classpath. Set -Dzu.library to point at a
libzu of your own.

Running it turned up something the page had wrong. From JDK 24 native access is granted by whoever starts the JVM, and the Enable-Native-Access attribute these jars carry speaks only for the jar that java -jar names. A -cp run needs the flag on the command line whatever a dependency's manifest says. The README claimed the attribute covered the class path case, so that paragraph now says who grants it and where, and the comment in ReadmeTest that gave the wrong reason for passing the flag says the right one. The exception the provider raises was already correct about all of this, which is how the script found out.

Verified on a machine with docker, both rows, against a libzu built from the engine at HEAD:

=== and what it is not
no rustc
no cargo
no cc
no gcc
no g++
no make
no cmake
no ninja
no libzu, no header, no pkg-config file, no ZU_LIBRARY

=== the program off the front page
Quickstart, and the 36 characters it says it prints

=== the dependencies off the front page
<artifactId>zudb</artifactId>
<artifactId>zudb-ffm</artifactId>
<artifactId>zudb-native</artifactId>

=== what a user's classpath came out as
zudb-0.11.0.jar          75920
zudb-ffm-0.11.0.jar      41735
zudb-native-0.11.0.jar 2639021
the engine came down inside the jar, at dev/zudb/native/linux-amd64/libzu.so

=== the program, in a directory of its own
ada follows grace
grace follows lynn
which is what /src/README.md says it prints

=== what it cost to get here
2.9M of artifacts, one platform of the seven

The full reactor is green beside it, 199 tests on the Panama provider, 197 on JNI, 12 on Arrow.

That is 70 to 80 on practice for this client. What is left is leaks, which is apparatus, and api-map and perf, which are reports the release collects.