[w3irdrobot]

When Research starts on a Linux host without a compatible GLES library, bundled libepoxy fails its normal soname lookup and retries under a build-machine Nix path. The observed failure aborts WebKitWebProcess while the main Maple process continues logging updater activity.

Bundle libglvnd's GL/GLES dispatch libraries, leaving GPU vendor drivers on the host. Reuse the existing string patcher to make libepoxy's fallback relative to its library and replace the absolute libsoup loads in GStreamer's soup and adaptive-demux plugins with sonames. Keep the patcher's Nix interpreter until packaging-time rewrites finish, then sanitize it for distribution.

Extend the existing AppImage verifiers to reject live Nix library constants in .rodata and missing libepoxy dlopen dependencies. Ignore stale dynamic strings left by patchelf. Add behavioral tests covering real dlopen, stale DT_NEEDED strings, missing dependencies, and patcher lifecycle; document the packaging behavior.

Validation:

• Full scripts/ci/desktop-pr.sh passed in .#desktop-linux, with MAPLE_TAURI_FAKE_UPDATER_SIGNING=1 and MAPLE_DISABLE_SHARED_CARGO_BUILD_DIR=1.
• nix flake check --no-update-lock-file passed, including the new behavioral tests.
• Extended portability verifier rejects the old artifact and passes the final AppImage.
• Before: Ubuntu 26.10/Xvfb trace shows the GLES error followed by WebKitWebProcess SIGABRT.
• After: final Maple_3.4.8_amd64.AppImage starts in Ubuntu 26.10, reaches frontend and updater logs, and survives until the 30-second timeout (124), without the GLES error or SIGABRT.

Hardware acceleration is unverified under Xvfb. Existing plugin search directories/patterns, such as V4L and PipeWire, remain outside this literal-library-path fix.

This change stays separate from #1454's glibc-floor work.

---

^{Open in [code]smith · Need help on this PR? Tag @codesmith-bot with what you need.}

[github-actions]

Maple Auth development preview: https://c0025939.maple-auth-dev.pages.dev

Commit: 02355eaefd393fabf8bb23e3db95e00719a488cc

Uses development services. Cloudflare Access applies. Provider OAuth is not configured for PR URLs; use the stable Auth Dev host for OAuth rehearsal.

[github-actions]

Maple development preview: https://8b14d3b6.maple-ca8.pages.dev

Commit: 02355eaefd393fabf8bb23e3db95e00719a488cc

Uses development API, billing, flags and PCR configuration. Cloudflare Access applies.

[w3irdrobot]

Folded into #1487, together with the TLS, schema and GBM fixes. This commit is included as-is, except its path rewrite no longer copies libgbm or libdrm into the bundle.