diff --git a/docs/evidence/linux-desktops-20261104/desktop-list.png b/docs/evidence/linux-desktops-20261104/desktop-list.png
new file mode 100644
index 0000000..6c90613
Binary files /dev/null and b/docs/evidence/linux-desktops-20261104/desktop-list.png differ
diff --git a/docs/evidence/linux-desktops-20261104/final-stream-check.json b/docs/evidence/linux-desktops-20261104/final-stream-check.json
new file mode 100644
index 0000000..f4356e9
--- /dev/null
+++ b/docs/evidence/linux-desktops-20261104/final-stream-check.json
@@ -0,0 +1,20 @@
+[
+  {
+    "desktop": "Ubuntu",
+    "endpoint": "192.168.1.72",
+    "hardware_decode_ready": true,
+    "still_running": true
+  },
+  {
+    "desktop": "Kylin",
+    "endpoint": "192.168.1.71",
+    "hardware_decode_ready": true,
+    "still_running": true
+  },
+  {
+    "desktop": "Windows",
+    "endpoint": "192.168.1.70",
+    "hardware_decode_ready": true,
+    "still_running": true
+  }
+]
diff --git a/docs/evidence/linux-desktops-20261104/kylin-final-state.txt b/docs/evidence/linux-desktops-20261104/kylin-final-state.txt
new file mode 100644
index 0000000..63df8a1
--- /dev/null
+++ b/docs/evidence/linux-desktops-20261104/kylin-final-state.txt
@@ -0,0 +1,37 @@
+Server String: /run/user/1000/pulse/native
+Library Protocol Version: 33
+Server Protocol Version: 33
+Is Local: yes
+Client Index: 60
+Tile Size: 65472
+User Name: test1
+Host Name: test1
+Server Name: pulseaudio
+Server Version: 13.99.1
+Default Sample Specification: s16le 2ch 44100Hz
+Default Channel Map: front-left,front-right
+Default Sink: vdi_audio
+Default Source: vdi_audio.monitor
+active
+enabled
+0	auto_null	module-null-sink.c	s16le 2ch 44100Hz	SUSPENDED
+4	vdi_audio	module-null-sink.c	s16le 2ch 44100Hz	SUSPENDED
+0	auto_null.monitor	module-null-sink.c	s16le 2ch 44100Hz	SUSPENDED
+4	vdi_audio.monitor	module-null-sink.c	s16le 2ch 44100Hz	SUSPENDED
+ 3 1000 test1 seat0  
+56 1000 test1        
+[Desktop Entry]
+Type=Application
+Name=VDI Sunshine host
+Exec=/bin/sh -c "systemctl --user import-environment DISPLAY XAUTHORITY XDG_SESSION_TYPE; systemctl --user start vdi-sunshine.service"
+X-GNOME-Autostart-enabled=true
+KERNEL=="uinput", SUBSYSTEM=="misc", OPTIONS+="static_node=uinput", GROUP="input", MODE="0660", TAG+="uaccess"
+# file: /dev/uinput
+# owner: root
+# group: input
+user::rw-
+user:test1:rw-
+group::---
+mask::rw-
+other::---
+
diff --git a/docs/evidence/linux-desktops-20261104/kylin-input.jsonl b/docs/evidence/linux-desktops-20261104/kylin-input.jsonl
new file mode 100644
index 0000000..461055b
--- /dev/null
+++ b/docs/evidence/linux-desktops-20261104/kylin-input.jsonl
@@ -0,0 +1,2 @@
+{"event": "key", "keyval": 65477}
+{"event": "click", "button": 1, "x": 320.34991455078125, "y": 150.28619384765625}
diff --git a/docs/evidence/linux-desktops-20261104/kylin-stream.png b/docs/evidence/linux-desktops-20261104/kylin-stream.png
new file mode 100644
index 0000000..4333844
Binary files /dev/null and b/docs/evidence/linux-desktops-20261104/kylin-stream.png differ
diff --git a/docs/evidence/linux-desktops-20261104/kylin-sunshine.conf b/docs/evidence/linux-desktops-20261104/kylin-sunshine.conf
new file mode 100644
index 0000000..6e6c69e
--- /dev/null
+++ b/docs/evidence/linux-desktops-20261104/kylin-sunshine.conf
@@ -0,0 +1,9 @@
+sunshine_name = VDI-Kylin
+capture = x11
+encoder = software
+sw_preset = ultrafast
+sw_tune = zerolatency
+upnp = disabled
+origin_web_ui_allowed = pc
+hevc_mode = 1
+audio_sink = vdi_audio
diff --git a/docs/evidence/linux-desktops-20261104/kylin-sunshine.service b/docs/evidence/linux-desktops-20261104/kylin-sunshine.service
new file mode 100644
index 0000000..8943764
--- /dev/null
+++ b/docs/evidence/linux-desktops-20261104/kylin-sunshine.service
@@ -0,0 +1,16 @@
+[Unit]
+Description=VDI Linux desktop Sunshine host
+PartOf=graphical-session.target
+After=graphical-session.target
+
+[Service]
+Environment=DISPLAY=:0 XAUTHORITY=/home/test1/.Xauthority
+ExecStartPre=/usr/bin/xrandr --output Virtual-1 --mode 1920x1080
+ExecStartPre=/bin/sh -c 'pactl list short sinks | grep -qw vdi_audio || pactl load-module module-null-sink sink_name=vdi_audio sink_properties=device.description=VDI-Audio'
+ExecStartPre=/usr/bin/pactl set-default-sink vdi_audio
+ExecStart=/opt/vdi-sunshine-0.21.0/usr/bin/sunshine /home/test1/.config/sunshine/sunshine.conf
+Restart=on-failure
+RestartSec=5
+
+[Install]
+WantedBy=graphical-session.target
diff --git a/docs/evidence/linux-desktops-20261104/ubuntu-final-state.txt b/docs/evidence/linux-desktops-20261104/ubuntu-final-state.txt
new file mode 100644
index 0000000..f69cbf8
--- /dev/null
+++ b/docs/evidence/linux-desktops-20261104/ubuntu-final-state.txt
@@ -0,0 +1,34 @@
+Server String: /run/user/1000/pulse/native
+Library Protocol Version: 35
+Server Protocol Version: 35
+Is Local: yes
+Client Index: 212
+Tile Size: 65472
+User Name: test2
+Host Name: test2-Standard-PC-Q35-ICH9-2009
+Server Name: PulseAudio (on PipeWire 1.0.5)
+Server Version: 15.0.0
+Default Sample Specification: float32le 2ch 48000Hz
+Default Channel Map: front-left,front-right
+Default Sink: vdi_audio
+Default Source: vdi_audio.monitor
+active
+enabled
+152	vdi_audio	PipeWire	float32le 2ch 48000Hz	SUSPENDED
+152	vdi_audio.monitor	PipeWire	float32le 2ch 48000Hz	SUSPENDED
+181 1000 test2 seat0 tty2 active no -
+204 1000 test2 -     -    active no -
+[Desktop Entry]
+Type=Application
+Name=VDI Sunshine host
+Exec=/bin/sh -c "systemctl --user import-environment DISPLAY XAUTHORITY XDG_SESSION_TYPE; systemctl --user start vdi-sunshine.service"
+X-GNOME-Autostart-enabled=true
+# file: /dev/uinput
+# owner: root
+# group: input
+user::rw-
+user:test2:rw-
+group::rw-
+mask::rw-
+other::---
+
diff --git a/docs/evidence/linux-desktops-20261104/ubuntu-input.jsonl b/docs/evidence/linux-desktops-20261104/ubuntu-input.jsonl
new file mode 100644
index 0000000..006fd6c
--- /dev/null
+++ b/docs/evidence/linux-desktops-20261104/ubuntu-input.jsonl
@@ -0,0 +1,8 @@
+{"event": "key", "keyval": 65477}
+{"event": "click", "button": 1, "x": 286.970703125, "y": 111.9871826171875}
+{"event": "key", "keyval": 65507}
+{"event": "key", "keyval": 65513}
+{"event": "key", "keyval": 65505}
+{"event": "key", "keyval": 65507}
+{"event": "key", "keyval": 65513}
+{"event": "key", "keyval": 65505}
diff --git a/docs/evidence/linux-desktops-20261104/ubuntu-login-config.txt b/docs/evidence/linux-desktops-20261104/ubuntu-login-config.txt
new file mode 100644
index 0000000..cbefde6
--- /dev/null
+++ b/docs/evidence/linux-desktops-20261104/ubuntu-login-config.txt
@@ -0,0 +1,47 @@
+# GDM configuration storage
+#
+# See /usr/share/gdm/gdm.schemas for a list of available options.
+
+[daemon]
+WaylandEnable=false
+AutomaticLoginEnable=true
+AutomaticLogin=test2
+DefaultSession=ubuntu-xorg.desktop
+# Uncomment the line below to force the login screen to use Xorg
+#WaylandEnable=false
+
+# Enabling automatic login
+#  AutomaticLoginEnable = true
+#  AutomaticLogin = user1
+
+# Enabling timed login
+#  TimedLoginEnable = true
+#  TimedLogin = user1
+#  TimedLoginDelay = 10
+
+[security]
+
+[xdmcp]
+
+[chooser]
+
+[debug]
+# Uncomment the line below to turn on debugging
+# More verbose logs
+# Additionally lets the X server dump core if it crashes
+#Enable=true
+
+[User]
+Session = ubuntu-xorg
+Icon = /home/test2/.face
+SystemAccount = false
+XSession = ubuntu-xorg
+
+[InputSource0]
+xkb = cn
+
+[InputSource1]
+ibus = libpinyin
+
+Backup directory: /var/backups/vdi-linux-20261104-100722/
+Backed up files: custom.conf, test2
diff --git a/docs/evidence/linux-desktops-20261104/ubuntu-stream.png b/docs/evidence/linux-desktops-20261104/ubuntu-stream.png
new file mode 100644
index 0000000..2e58838
Binary files /dev/null and b/docs/evidence/linux-desktops-20261104/ubuntu-stream.png differ
diff --git a/docs/evidence/linux-desktops-20261104/ubuntu-sunshine.conf b/docs/evidence/linux-desktops-20261104/ubuntu-sunshine.conf
new file mode 100644
index 0000000..5e01276
--- /dev/null
+++ b/docs/evidence/linux-desktops-20261104/ubuntu-sunshine.conf
@@ -0,0 +1,9 @@
+sunshine_name = VDI-Ubuntu
+capture = x11
+encoder = software
+sw_preset = ultrafast
+sw_tune = zerolatency
+upnp = disabled
+origin_web_ui_allowed = pc
+hevc_mode = 1
+audio_sink = vdi_audio
diff --git a/docs/evidence/linux-desktops-20261104/ubuntu-sunshine.service b/docs/evidence/linux-desktops-20261104/ubuntu-sunshine.service
new file mode 100644
index 0000000..e18c848
--- /dev/null
+++ b/docs/evidence/linux-desktops-20261104/ubuntu-sunshine.service
@@ -0,0 +1,15 @@
+[Unit]
+Description=VDI Linux desktop Sunshine host
+PartOf=graphical-session.target
+After=graphical-session.target
+
+[Service]
+ExecStartPre=/usr/bin/xrandr --output Virtual-1 --mode 1920x1080
+ExecStartPre=/bin/sh -c 'pactl list short sinks | grep -qw vdi_audio || pactl load-module module-null-sink sink_name=vdi_audio sink_properties=device.description=VDI-Audio'
+ExecStartPre=/usr/bin/pactl set-default-sink vdi_audio
+ExecStart=/usr/bin/sunshine /home/test2/.config/sunshine/sunshine.conf
+Restart=on-failure
+RestartSec=5
+
+[Install]
+WantedBy=graphical-session.target
diff --git a/docs/linux-desktop-onboarding-20261104.md b/docs/linux-desktop-onboarding-20261104.md
new file mode 100644
index 0000000..e7d881c
--- /dev/null
+++ b/docs/linux-desktop-onboarding-20261104.md
@@ -0,0 +1,94 @@
+# Ubuntu / 麒麟云桌面接入记录（2026-11-04）
+
+> 后续更新：麒麟已升级真实2560×1440/30FPS配置与30Mbps，动态短测约23FPS，见[麒麟2K调优记录](kylin-quality-20261104.md)。以下1080p参数属于初次接入记录。
+
+两台 Linux 已接入现场盒子的正常桌面选择流程。实际验证了连接、画面、键盘、鼠标、退出和再次连接；最终回到桌面列表。Windows 也完成了原配置连接回归。
+
+## 现场配置
+
+| 桌面 | 地址 / 用户 | 系统与服务端 | 串流配置 |
+| --- | --- | --- | --- |
+| Ubuntu | 192.168.1.72 / test2 | Ubuntu 24.04.4；Sunshine 2026.914.233613 | Desktop，1920×1080，30 FPS，H.264 软件编码 |
+| 麒麟 | 192.168.1.71 / test1 | 银河麒麟 V10 SP1；Sunshine v0.21.0 Ubuntu20.04 构建 | Desktop，1920×1080，30 FPS，H.264 软件编码 |
+| Windows | 192.168.1.70 | 原 Sunshine 服务端 | 原 Desktop，2560×1440，45 FPS 配置 |
+
+盒子为 `armbian@192.168.1.188`。原 Linux 桌面上的 Moonlight 是客户端，用于连接其他主机；本次补齐 Linux 的 Sunshine 服务端，让盒子 Moonlight 可以连接它们。未移除原 Moonlight。
+
+盒子使用原 RKMPP 私有客户端与 EGL/GLES 呈现路径；本次没有修改产品源码，也没有把现场 IP 写入源码默认值。
+
+## Linux 服务
+
+两台均使用登录用户的 systemd 服务与 XDG 自启动：
+
+- `~/.config/systemd/user/vdi-sunshine.service`：已 enabled，现场为 active。
+- `~/.config/autostart/vdi-sunshine.desktop`：图形登录后导入 DISPLAY、XAUTHORITY 等会话环境并启动服务。
+- `~/.config/sunshine/sunshine.conf`：X11 捕获、software 编码、ultrafast、zerolatency、禁用 UPnP、Web 管理来源限制为本机。
+- `~/.config/sunshine/apps.json`：发布 `Desktop`。
+- `~/.config/sunshine/vdi-admin.json`：随机生成的各自主机管理凭据，权限 600；未复制进仓库。
+
+服务启动前把 `Virtual-1` 设置为 1920×1080，创建或复用 `vdi_audio` 虚拟音频 sink，并设为默认。Sunshine 配置使用 `audio_sink = vdi_audio`，采集端自动选中 `vdi_audio.monitor`。两台最后一轮串流均未出现采音初始化失败；Ubuntu 日志明确显示 Opus 初始化，盒子日志显示双声道音频流启动。实际扬声器听感尚未验收。
+
+### Ubuntu 登录配置
+
+用户明确授权 test2 自动登录并使用 Xorg，修改前已备份：
+
+- `/etc/gdm3/custom.conf`：`WaylandEnable=false`、`AutomaticLoginEnable=true`、`AutomaticLogin=test2`、`DefaultSession=ubuntu-xorg.desktop`。
+- `/var/lib/AccountsService/users/test2`：`Session` / `XSession` 为 `ubuntu-xorg`。
+- 备份目录 `/var/backups/vdi-linux-20261104-100722/`，文件 `custom.conf`、`test2`。
+
+重启 GDM 后已进入 test2 的 Xorg 桌面，`DISPLAY=:0`、`XAUTHORITY=/run/user/1000/gdm/Xauthority`。未重启虚拟机；整机重启后的自动恢复仍待验证。另补装 `pulseaudio-utils`，未执行系统整体升级。
+
+### 麒麟兼容部署
+
+现场 glibc 2.31，选择可兼容的官方 v0.21.0 Ubuntu20.04 构建。麒麟安全策略拒绝未签名 DEB 后，采用解包部署：
+
+- root 拥有的 `/opt/vdi-sunshine-0.21.0/`。
+- `/usr/share/sunshine` 指向其资源目录。
+- 对具体 Sunshine 二进制及当次临时安装脚本做 `kysec_set -n exectl -v verified` 单文件认证；未全局关闭 KYSEC。
+- `/etc/udev/rules.d/85-vdi-sunshine.rules` 配置 uinput，现场 ACL 已赋予 test1 读写权限。
+
+麒麟沿用已有 test1 图形会话；当时锁屏已临时解锁，未关闭长期锁屏，也未配置新的自动登录。后续若回到登录界面或锁屏，需要按原策略登录或解锁。
+
+## 盒子配置与配对
+
+只更新 `~/.config/vdi-terminal/desktops.json` 中 Ubuntu / 麒麟对象，Windows 对象保留原值。原配置备份：
+
+`/home/armbian/vdi-terminal/backups/linux-desktops-20261104-101507/desktops.json`
+
+两台均完成盒子原 Moonlight 配对；Sunshine 服务重启后原配对仍有效。只在无串流时重启 kiosk 刷新列表。正常客户端路径：
+
+`/home/armbian/vdi-build/rkmpp-experiment/build/moonlight/app/moonlight`
+
+退出串流回列表使用 `Ctrl+Alt+Shift+Q`。
+
+## 验证结果与证据
+
+证据目录：[linux-desktops-20261104](evidence/linux-desktops-20261104/)。
+
+| 项目 | 结果 | 证据 |
+| --- | --- | --- |
+| 三张卡可连接 | 通过 | [列表截图](evidence/linux-desktops-20261104/desktop-list.png) |
+| Ubuntu 实际画面与输入 | F8（65477）及鼠标左键事件到达虚拟机临时 GTK 窗口 | [截图](evidence/linux-desktops-20261104/ubuntu-stream.png)、[事件](evidence/linux-desktops-20261104/ubuntu-input.jsonl) |
+| 麒麟实际画面与输入 | F8（65477）及鼠标左键事件到达虚拟机临时 GTK 窗口 | [截图](evidence/linux-desktops-20261104/kylin-stream.png)、[事件](evidence/linux-desktops-20261104/kylin-input.jsonl) |
+| 最后 Ubuntu / 麒麟 / Windows 依次连接再返回列表 | 三项均硬解就绪且保持运行，最后正常退出 | [结果 JSON](evidence/linux-desktops-20261104/final-stream-check.json) |
+| Linux 实际视频尺寸与渲染路径 | h264_rkmpp、drm_prime、EGL/GLES、1920×1080 | [Ubuntu 日志](evidence/linux-desktops-20261104/ubuntu-client-final.log)、[麒麟日志](evidence/linux-desktops-20261104/kylin-client-final.log) |
+| Windows 原配置回归 | 2560×1440 硬解就绪，正常退出 | [客户端日志](evidence/linux-desktops-20261104/windows-client-final.log) |
+
+最后约十秒有效视频样本中 Ubuntu 渲染 29.59 FPS、麒麟 29.35 FPS，仅用于确认短时链路可运行，不代表长时间性能验收。Windows 这轮短测渲染 35.76 FPS，不据此重新定义原 45 FPS 配置的性能结论。
+
+`*-sunshine.service`、`*-sunshine.conf` 是最终配置快照，`*-sunshine-final.log` 是最后串流服务端日志，`*-final-state.txt` 记录服务、音频和 uinput 状态，`ubuntu-login-config.txt` 记录登录配置。截图是盒子 2560×1440 输出，Linux 视频本身为 1920×1080。
+
+Ubuntu 日志仍有 CAP_SYS_ADMIN 探测失败及显示信息回退提示，但实际选中了 X11 并成功捕获 1080p；本次没有为消除这些提示授予额外高权限。麒麟退出时有 GLib Source ID 警告，服务仍为 active 且可再次连接。
+
+最初 Xvfb + 软件解码独立探测曾出现控制断开，同期原 Windows 会话也断开，原因未确定；后续以上正常硬解入口回归均通过。安装 Xvfb 时 apt 同时升级了盒子的 `libpciaccess0`、`xserver-common`、`xserver-xorg-core`；未重启 Xorg。临时 Xvfb 与输入测试服务已停止。
+
+当前验收覆盖基础画面与输入及短时重连；Linux 2K、GPU 编码、长期稳定性、重启恢复、锁屏策略、音质与生产多用户隔离尚未验收。
+
+## 回退与后续维护
+
+1. 盒子恢复上述备份的 `desktops.json`，在无活动会话时刷新 kiosk，可撤回本轮卡片配置。
+2. 在对应 Linux 图形用户下执行 `systemctl --user disable --now vdi-sunshine.service`，将 `~/.config/autostart/vdi-sunshine.desktop` 移出自启动目录，可停止本次 Sunshine 自动启动。保留 `~/.config/sunshine/` 可保留配对与配置。
+3. Ubuntu 如需恢复原登录方式，以 sudo 将备份 `custom.conf` 放回 `/etc/gdm3/custom.conf`，备份 `test2` 放回 `/var/lib/AccountsService/users/test2`，保留原属主和权限；在维护窗口重启 GDM（会终止图形会话）。
+4. 麒麟如需彻底卸载，先停服务，再核对 `/usr/share/sunshine` 链接目标和 uinput 规则是否仍被其他应用使用，最后移除本次 `/opt/vdi-sunshine-0.21.0` 部署；不要直接覆盖发行版同名文件或全局修改 KYSEC。
+
+排查服务可先运行 `systemctl --user status vdi-sunshine.service` 和 `journalctl --user -u vdi-sunshine.service`。麒麟版本较旧是当前兼容方案，后续升级需要重新评估系统库兼容性与安全维护。