lmcp: bump to 1.2.4 (shell timeout-kill fix + kill_job/list_jobs)

Ships marfrit/lmcp v1.2.4: shell/shell_bg kills the whole process group on
timeout/cancel (no orphans) + new kill_job/list_jobs tools. Updates arch
PKGBUILD (pkgver + sha256) and debian changelog.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

arch/ffmpeg-v4l2-request-fourier/0016-h264-mb-inspect-callback.patch

@@ -35,13 +35,20 @@ to fall through.
 
 Used by:
   - daedalus-decoder/tools/daedalus_decode_h264 (PR-A1b)
-  - future daedalus-v4l2 daemon refactor
+  - daedalus-v4l2 daemon shadow-mode path (PR-Q3a.1+)
+
+The CLI static-links libavcodec.a so symbol visibility doesn't matter
+there.  The daemon dlopens libavcodec.so.62 and resolves the callback
+via dlsym, so the symbol MUST be exported — added to libavcodec.v
+explicitly (FFmpeg's default version script hides every `ff_*` symbol
+as LOCAL behind a glob).
 
 Refs reauktion/daedalus-decoder!12 (Stage 2 PR-b complete).
 ---
- libavcodec/h264_mb.c | 20 ++++++++++++++++++++
- libavcodec/h264dec.h | 26 ++++++++++++++++++++++++++
- 2 files changed, 46 insertions(+)
+ libavcodec/h264_mb.c    | 20 ++++++++++++++++++++
+ libavcodec/h264dec.h    | 26 ++++++++++++++++++++++++++
+ libavcodec/libavcodec.v |  1 +
+ 3 files changed, 47 insertions(+)
 
 --- a/libavcodec/h264dec.h
 +++ b/libavcodec/h264dec.h
@@ -113,3 +120,13 @@ Refs reauktion/daedalus-decoder!12 (Stage 2 PR-b complete).
 +    h->mb_inspect_cb     = cb;
 +    h->mb_inspect_opaque = opaque;
  }
+--- a/libavcodec/libavcodec.v
++++ b/libavcodec/libavcodec.v
+@@ -3,6 +3,7 @@
+         av_*;
+         avcodec_*;
+         avpriv_*;
++        ff_h264_set_mb_inspect_cb;
+         avsubtitle_free;
+     local:
+         *;

arch/ffmpeg-v4l2-request-fourier/PKGBUILD

@@ -24,7 +24,7 @@ _srcname=FFmpeg
 _version='8.1'
 _commit='b57fbbe50c9b2656fad86a1a7eeabfd2b2a50935'  # v4l2-request-n8.1 tip 2026-04-24
 pkgver=8.1.r123329.b57fbbe
-pkgrel=14  # pkgrel=14 — per-MB coefficient side buffer (0017) extending 0016 for daedalus-decoder CLI IDCT validation; observation-only, no behaviour change to existing decode path
+pkgrel=16  # pkgrel=16 — rebuild against libx265.so=216 (system upgrade broke SO name dep)
 epoch=2
 
 # daedalus-fourier pin.  209a421 = PR #2 merge (Phase 8c — public API

arch/linux-pinetab2-danctnix-besser/PKGBUILD

@@ -29,7 +29,7 @@
 
 pkgbase=linux-pinetab2-danctnix-besser
 pkgver=7.0.danctnix1
-pkgrel=5
+pkgrel=6
 pkgdesc='PineTab2 (BESser bes2600 driver patchset, kernel-agent managed)'
 _srcname=linux-pinetab2
 _srctag=v${pkgver%.*}-${pkgver##*.}
@@ -69,7 +69,7 @@ b2sums=('3d9795083c8938f80f480de0d10bfd9c525640e59d5c7f22983de3f12ee42c84c31be90
         '71fe98221e802b315e54b4b10d3e8c8f376695a36bae3541d876e5776a37f3fa33c8f8dfa6e51fcbd6f5396add02e5166634165f2351836a0ea0453c172fe56c'
         'SKIP'
         '50397711a6a3ba522283685a9e7397aeed6663f353f7cba214d4bb88bc98516065b2fca9a36ce13c52644617879f69f39c5305e86db5d9fb25c4dae5434eb9c4'
-        '656a998ab40cb85ee4c00f087b071a91632a6c091da2c84b0f74236b51d2dea6e9db6886625f80ad81dc249d8494ec47cd79d6dd9ea4f5e44f3cde857f861e10')
+        '19c35c69a4ed40635fb6ad108d2e0ed3d0edc682972255b4a9b719d09e377aa916e533b2e29f4aed256d3a393d77df9e11b661b690acd96edcf61eafe016f55b')
 
 export KBUILD_BUILD_HOST=archlinux
 export KBUILD_BUILD_USER=$pkgbase

arch/linux-pinetab2-danctnix-besser/README.md

@@ -34,15 +34,11 @@ DanctNIX PineTab2 kernel + the BESser bes2600 driver patchset.
 |--------|------------|-------------------------------------------------|
 | 1–3    | 2026-05-08…05-18 | hand-managed in `marfrit/besser/danctnix-besser-pkgbuild/` (DEPRECATED) |
 | 4      | 2026-05-18 | first kernel-agent-managed release; same source contents as the hand-managed pkgrel=3 (Patch I + SCS workaround folded into single cumulative); fixes pkgrel=3's duplicated `0003-arm64-...patch` source-array bug |
+| 5      | 2026-05-18 | SCS workaround deployed, pkgrel bump for rebuild |
+| 6      | 2026-07-10 | Re-enable `CONFIG_SHADOW_CALL_STACK=y` — GCC 16.1.1 fixed the `arm_neon.h` `#pragma target` + SCS interaction |
 
 ## Known caveats
 
-- **`CONFIG_SHADOW_CALL_STACK=n`** in the config: GCC 15.2.1 fails to
-  build `arch/arm64/lib/xor-neon.c` with `arm_neon.h` `#pragma GCC
-  target()` blocks and `-fsanitize=shadow-call-stack`. See
-  `reference_arm64_scs_arm_neon_gcc15` memory and the Makefile
-  workaround patch included in the cumulative. Track upstream GCC
-  resolution before re-enabling.
 - The `cumulative-c5x-danctnix` series-dir in kernel-agent is currently
   a single-file interim (the working hand-curated cumulative) because
   the per-series mirrors created in `kernel-agent#17` use DKMS-style

arch/linux-pinetab2-danctnix-besser/config

@@ -791,7 +791,7 @@ CONFIG_HAVE_STACKPROTECTOR=y
 CONFIG_STACKPROTECTOR=y
 CONFIG_STACKPROTECTOR_STRONG=y
 CONFIG_ARCH_SUPPORTS_SHADOW_CALL_STACK=y
-# CONFIG_SHADOW_CALL_STACK is not set
+CONFIG_SHADOW_CALL_STACK=y
 CONFIG_ARCH_SUPPORTS_LTO_CLANG=y
 CONFIG_ARCH_SUPPORTS_LTO_CLANG_THIN=y
 CONFIG_LTO_NONE=y

arch/lmcp/PKGBUILD

@@ -3,7 +3,7 @@
 # Source of truth: git.reauktion.de/marfrit/lmcp
 
 pkgname=lmcp
-pkgver=1.2.1
+pkgver=1.2.4
 pkgrel=1
 pkgdesc="Lightweight MCP (Model Context Protocol) server in pure Lua"
 arch=('any')
@@ -14,7 +14,7 @@ depends=('lua' 'lua-socket')
 # pre-release pkgvers (e.g. 1.2.0_rc1 → v1.2.0-rc1).
 _tag="v${pkgver//_/-}"
 source=("${pkgname}-${pkgver}.tar.gz::https://git.reauktion.de/marfrit/lmcp/archive/${_tag}.tar.gz")
-sha256sums=('bf9cce1a84c66b1b74c5aec923c5960d60ae33c221afc8d47ce0d74b8f7ee609')
+sha256sums=('e8ede94e93f5f2bbc8bacbc795c17640772ecd62855e820394c00f2f3be5b42c')
 
 package() {
     cd "${pkgname}"
@@ -22,6 +22,7 @@ package() {
     install -Dm644 json.lua           "${pkgdir}/usr/share/lua/5.4/json.lua"
     install -Dm644 server.lua         "${pkgdir}/usr/share/lua/5.4/server.lua"
     install -Dm644 hub.lua            "${pkgdir}/usr/share/lua/5.4/hub.lua"
+    install -Dm644 tools.d/nash.lua   "${pkgdir}/usr/share/lua/5.4/nash.lua"
     install -Dm644 examples/lmcp-hub.service          "${pkgdir}/usr/share/doc/${pkgname}/examples/lmcp-hub.service"
     install -Dm644 examples/lmcp.service              "${pkgdir}/usr/share/doc/${pkgname}/examples/lmcp.service"
     install -Dm644 examples/hub-backends.conf.example "${pkgdir}/usr/share/doc/${pkgname}/examples/hub-backends.conf.example"

debian/ffmpeg-v4l2-request-fourier/0016-h264-mb-inspect-callback.patch

@@ -35,13 +35,20 @@ to fall through.
 
 Used by:
   - daedalus-decoder/tools/daedalus_decode_h264 (PR-A1b)
-  - future daedalus-v4l2 daemon refactor
+  - daedalus-v4l2 daemon shadow-mode path (PR-Q3a.1+)
+
+The CLI static-links libavcodec.a so symbol visibility doesn't matter
+there.  The daemon dlopens libavcodec.so.62 and resolves the callback
+via dlsym, so the symbol MUST be exported — added to libavcodec.v
+explicitly (FFmpeg's default version script hides every `ff_*` symbol
+as LOCAL behind a glob).
 
 Refs reauktion/daedalus-decoder!12 (Stage 2 PR-b complete).
 ---
- libavcodec/h264_mb.c | 20 ++++++++++++++++++++
- libavcodec/h264dec.h | 26 ++++++++++++++++++++++++++
- 2 files changed, 46 insertions(+)
+ libavcodec/h264_mb.c    | 20 ++++++++++++++++++++
+ libavcodec/h264dec.h    | 26 ++++++++++++++++++++++++++
+ libavcodec/libavcodec.v |  1 +
+ 3 files changed, 47 insertions(+)
 
 --- a/libavcodec/h264dec.h
 +++ b/libavcodec/h264dec.h
@@ -113,3 +120,13 @@ Refs reauktion/daedalus-decoder!12 (Stage 2 PR-b complete).
 +    h->mb_inspect_cb     = cb;
 +    h->mb_inspect_opaque = opaque;
  }
+--- a/libavcodec/libavcodec.v
++++ b/libavcodec/libavcodec.v
+@@ -3,6 +3,7 @@
+         av_*;
+         avcodec_*;
+         avpriv_*;
++        ff_h264_set_mb_inspect_cb;
+         avsubtitle_free;
+     local:
+         *;

debian/ffmpeg-v4l2-request-fourier/build-deb.sh

@@ -33,12 +33,10 @@ FFMPEG_VERSION=8.1
 # epoch 2 matches Debian's stock ffmpeg (currently 7:7.1.x in trixie);
 # +rfourier suffix to avoid colliding with upstream/Debian rebuilds.
 PKGVER=2:${FFMPEG_VERSION}+rfourier+gb57fbbe
-PKGREL=14  # pkgrel=14 — per-MB coefficient side buffer (0017) extending 0016 for daedalus-decoder CLI IDCT validation; observation-only, no behaviour change to existing decode path
-           # (cycle 9 of the daedalus-v4l2#11 step 2 substitution arc; closes
-           # the libavcodec.so substitution sequence 6 IDCT4 / 7 IDCT8 /
-           # 8 luma-v deblock / 9 qpel mc20).  Pulls daedalus-fourier PR #2
-           # which extends the public API with
-           # daedalus_recipe_dispatch_h264_qpel_mc20.  (2026-05-23)
+PKGREL=15  # pkgrel=15 — export ff_h264_set_mb_inspect_cb via libavcodec.v so
+           # dlsym consumers (daedalus-v4l2 daemon shadow_decoder, PR-Q3a.1)
+           # can resolve the symbol; static-link CLI was unaffected.  No
+           # behaviour change to existing decode path.  (2026-05-26)
 
 # daedalus-fourier pin.  209a421 = daedalus-fourier PR #2 merge — public
 # API now exposes daedalus_recipe_dispatch_h264_qpel_mc20 +

debian/ffmpeg-v4l2-request-fourier/debian/changelog

@@ -1,3 +1,21 @@
+ffmpeg-v4l2-request-fourier (2:8.1+rfourier+gb57fbbe-15) bookworm trixie; urgency=medium
+
+  * Amend 0016-h264-mb-inspect-callback.patch to also add
+    ff_h264_set_mb_inspect_cb to libavcodec/libavcodec.v so the
+    symbol is exported (GLOBAL) on the shipped libavcodec.so.62.
+    Without this, FFmpeg's default version script hides every ff_*
+    symbol behind a glob → LOCAL → dlsym() returns NULL.  The CLI
+    consumer (daedalus_decode_h264) was unaffected because it
+    static-links libavcodec.a; the daedalus-v4l2 daemon (PR-Q3a.1
+    shadow_decoder path) dlopens libavcodec.so.62 and needs the
+    symbol resolvable at runtime.
+  * No behaviour change to existing decode path.  Callback is still
+    opt-in via the function pointer (NULL default), so paying the
+    one-load-one-branch cost only when a consumer has explicitly
+    installed an inspection callback.
+
+ -- Markus Fritsche <mfritsche@reauktion.de>  Tue, 26 May 2026 15:00:00 +0200
+
 ffmpeg-v4l2-request-fourier (2:8.1+rfourier+gb57fbbe-10) bookworm trixie; urgency=medium
 
   * Add 0007-h264-qpel-mc20-daedalus-fourier.patch —

debian/lmcp/build-deb.sh

@@ -7,10 +7,10 @@
 # package (Architecture: all, depends on lua + lua-socket).
 set -euo pipefail
 
-PKGVER=1.2.1
-UPSTREAM_TAG=v1.2.1
+PKGVER=1.2.3
+UPSTREAM_TAG=v1.2.3
 PKGREL=1
-LMCP_TARBALL_SHA256=bf9cce1a84c66b1b74c5aec923c5960d60ae33c221afc8d47ce0d74b8f7ee609
+LMCP_TARBALL_SHA256=5def217c307eacaff2812d3b8116e556a6a117168b0e8972c64eddae72728f0c
 HERE=$(dirname "$(readlink -f "$0")")
 
 # Reproducible build: pin all file mtimes + ar member timestamps to a fixed
@@ -28,15 +28,13 @@ echo "$LMCP_TARBALL_SHA256  lmcp.tar.gz" | sha256sum -c
 tar xzf lmcp.tar.gz
 
 ROOT="$work/pkgroot"
-mkdir -p "$ROOT/DEBIAN" \
-         "$ROOT/usr/share/lua/5.4" \
-         "$ROOT/usr/bin" \
-         "$ROOT/usr/share/doc/lmcp"
+mkdir -p "$ROOT/DEBIAN"          "$ROOT/usr/share/lua/5.4"          "$ROOT/usr/bin"          "$ROOT/usr/share/doc/lmcp"
 
 cp lmcp/lmcp.lua   "$ROOT/usr/share/lua/5.4/"
 cp lmcp/json.lua   "$ROOT/usr/share/lua/5.4/"
 cp lmcp/server.lua "$ROOT/usr/share/lua/5.4/"
 cp lmcp/hub.lua    "$ROOT/usr/share/lua/5.4/"
+cp lmcp/tools.d/nash.lua "$ROOT/usr/share/lua/5.4/nash.lua"
 mkdir -p "$ROOT/usr/share/doc/lmcp/examples"
 cp lmcp/examples/lmcp-hub.service          "$ROOT/usr/share/doc/lmcp/examples/"
     cp lmcp/examples/lmcp.service              "$ROOT/usr/share/doc/lmcp/examples/"

debian/lmcp/debian/changelog

@@ -1,3 +1,30 @@
+lmcp (1.2.4-1) bookworm trixie; urgency=medium
+
+  * shell/shell_bg: kill the whole process group (setsid + SIGTERM/SIGKILL)
+    on timeout or client cancel, so a timed-out command leaves no orphan
+    process thrashing the host (fixes the shell->shell_bg relaunch pileup).
+  * Add kill_job and list_jobs tools to reap runaway background jobs
+    (registry at /tmp/lmcp-bg-jobs.tsv) without a reboot.
+
+ -- Markus Fritsche <mfritsche@reauktion.de>  Sun, 12 Jul 2026 21:05:38 +0000
+
+lmcp (1.2.3-1) bookworm trixie; urgency=medium
+
+  * Add nash memory tools plugin (tools.d/nash.lua): 4 tools
+    (nash_add, nash_search, nash_list, nash_delete) backed by
+    mem0 REST API at NASH_URL env var.
+  * Package installs nash.lua alongside the other lua libs at
+    /usr/share/lua/5.4/nash.lua.
+
+ -- Markus Fritsche <mfritsche@reauktion.de>  Fri, 05 Jun 2026 16:00:00 +0000
+
+lmcp (1.2.2-1) bookworm trixie; urgency=medium
+
+  * case-insensitive Bearer auth header (lmcp#25): regex ^Bearer → ^[Bb]earer
+    so clients sending lowercase 'bearer' don't get spurious 401s.
+
+ -- Markus Fritsche <mfritsche@reauktion.de>  Sat, 30 May 2026 14:52:16 +0000
+
 lmcp (1.2.1-1) bookworm trixie; urgency=medium
 
   * tools.d/ plugin scan (closes lmcp#22): server.lua now scans